--- /dev/null
+From d131902f17df39bdea1d8095a318514b0281b9bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Jan 2023 17:37:54 +0100
+Subject: accel/ivpu: PM: remove broken ivpu_dbg() statements
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 17ab1ea679be48d905559d968a7622f5f212de6e ]
+
+When CONFIG_PM is disabled, the driver fails to build:
+
+drivers/accel/ivpu/ivpu_pm.c: In function 'ivpu_rpm_get':
+drivers/accel/ivpu/ivpu_pm.c:240:84: error: 'struct dev_pm_info' has no member named 'usage_count'
+ 240 | ivpu_dbg(vdev, RPM, "rpm_get count %d\n", atomic_read(&vdev->drm.dev->power.usage_count));
+ | ^
+include/linux/dynamic_debug.h:223:29: note: in definition of macro '__dynamic_func_call_cls'
+ 223 | func(&id, ##__VA_ARGS__); \
+ | ^~~~~~~~~~~
+include/linux/dynamic_debug.h:249:9: note: in expansion of macro '_dynamic_func_call_cls'
+ 249 | _dynamic_func_call_cls(_DPRINTK_CLASS_DFLT, fmt, func, ##__VA_ARGS__)
+ | ^~~~~~~~~~~~~~~~~~~~~~
+include/linux/dynamic_debug.h:272:9: note: in expansion of macro '_dynamic_func_call'
+ 272 | _dynamic_func_call(fmt, __dynamic_dev_dbg, \
+ | ^~~~~~~~~~~~~~~~~~
+include/linux/dev_printk.h:155:9: note: in expansion of macro 'dynamic_dev_dbg'
+ 155 | dynamic_dev_dbg(dev, dev_fmt(fmt), ##__VA_ARGS__)
+ | ^~~~~~~~~~~~~~~
+drivers/accel/ivpu/ivpu_drv.h:65:17: note: in expansion of macro 'dev_dbg'
+ 65 | dev_dbg((vdev)->drm.dev, "[%s] " fmt, #type, ##args); \
+ | ^~~~~~~
+drivers/accel/ivpu/ivpu_pm.c:240:9: note: in expansion of macro 'ivpu_dbg'
+ 240 | ivpu_dbg(vdev, RPM, "rpm_get count %d\n", atomic_read(&vdev->drm.dev->power.usage_count));
+ | ^~~~~~~~
+
+It would be possible to rework these statements to only conditionally print
+the reference counter, or to make the driver depend on CONFIG_PM, but my
+impression is that these are not actually needed at all if the driver generally
+works, or they could be put back when required. Just remove all four of these
+to make the driver build in all configurations.
+
+Fixes: 852be13f3bd3 ("accel/ivpu: Add PM support")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Stanislaw Gruszka <stanislaw.gruszka@linux.intel.com>
+Signed-off-by: Jacek Lawrynowicz <jacek.lawrynowicz@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230126163804.3648051-1-arnd@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/accel/ivpu/ivpu_pm.c | 10 ----------
+ 1 file changed, 10 deletions(-)
+
+diff --git a/drivers/accel/ivpu/ivpu_pm.c b/drivers/accel/ivpu/ivpu_pm.c
+index bde42d6383da6..aa4d56dc52b39 100644
+--- a/drivers/accel/ivpu/ivpu_pm.c
++++ b/drivers/accel/ivpu/ivpu_pm.c
+@@ -239,8 +239,6 @@ int ivpu_rpm_get(struct ivpu_device *vdev)
+ {
+ int ret;
+
+- ivpu_dbg(vdev, RPM, "rpm_get count %d\n", atomic_read(&vdev->drm.dev->power.usage_count));
+-
+ ret = pm_runtime_resume_and_get(vdev->drm.dev);
+ if (!drm_WARN_ON(&vdev->drm, ret < 0))
+ vdev->pm->suspend_reschedule_counter = PM_RESCHEDULE_LIMIT;
+@@ -250,8 +248,6 @@ int ivpu_rpm_get(struct ivpu_device *vdev)
+
+ void ivpu_rpm_put(struct ivpu_device *vdev)
+ {
+- ivpu_dbg(vdev, RPM, "rpm_put count %d\n", atomic_read(&vdev->drm.dev->power.usage_count));
+-
+ pm_runtime_mark_last_busy(vdev->drm.dev);
+ pm_runtime_put_autosuspend(vdev->drm.dev);
+ }
+@@ -321,16 +317,10 @@ void ivpu_pm_enable(struct ivpu_device *vdev)
+ pm_runtime_allow(dev);
+ pm_runtime_mark_last_busy(dev);
+ pm_runtime_put_autosuspend(dev);
+-
+- ivpu_dbg(vdev, RPM, "Enable RPM count %d\n", atomic_read(&dev->power.usage_count));
+ }
+
+ void ivpu_pm_disable(struct ivpu_device *vdev)
+ {
+- struct device *dev = vdev->drm.dev;
+-
+- ivpu_dbg(vdev, RPM, "Disable RPM count %d\n", atomic_read(&dev->power.usage_count));
+-
+ pm_runtime_get_noresume(vdev->drm.dev);
+ pm_runtime_forbid(vdev->drm.dev);
+ }
+--
+2.39.2
+
--- /dev/null
+From cda224635ec4307fcb60aef87690d6590e60e7a4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Mar 2023 11:35:26 +0700
+Subject: accel: Link to compute accelerator subsystem intro
+
+From: Bagas Sanjaya <bagasdotme@gmail.com>
+
+[ Upstream commit 6d179f84f274a87da51f24ac3e9427221bbaed51 ]
+
+Commit 2c204f3d53218d ("accel: add dedicated minor for accelerator
+devices") adds link to accelerator nodes section of DRM internals doc
+(Documentation/gpu/drm-internals.rst), but the target doesn't exist.
+Instead, there is only an introduction doc for computer accelerator
+subsytem.
+
+Link to that doc until there is documentation of accelerator internals.
+
+Fixes: 2c204f3d53218d ("accel: add dedicated minor for accelerator devices")
+Signed-off-by: Bagas Sanjaya <bagasdotme@gmail.com>
+Reviewed-by: Jeffrey Hugo <quic_jhugo@quicinc.com>
+Signed-off-by: Oded Gabbay <ogabbay@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/drm/drm_file.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/include/drm/drm_file.h b/include/drm/drm_file.h
+index 0d1f853092ab8..ecffe24e2b1b0 100644
+--- a/include/drm/drm_file.h
++++ b/include/drm/drm_file.h
+@@ -408,7 +408,8 @@ static inline bool drm_is_render_client(const struct drm_file *file_priv)
+ * Returns true if this is an open file of the compute acceleration node, i.e.
+ * &drm_file.minor of @file_priv is a accel minor.
+ *
+- * See also the :ref:`section on accel nodes <drm_accel_node>`.
++ * See also :doc:`Introduction to compute accelerators subsystem
++ * </accel/introduction>`.
+ */
+ static inline bool drm_is_accel_client(const struct drm_file *file_priv)
+ {
+--
+2.39.2
+
--- /dev/null
+From 994056cf9e1fb0a833addcc630eb4a2f98500735 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Apr 2023 16:00:48 +0200
+Subject: ACPI: bus: Ensure that notify handlers are not running after removal
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit faae443738c6f0dac9b0d3d11d108f6911a989a9 ]
+
+Currently, acpi_device_remove_notify_handler() may return while the
+notify handler being removed is still running which may allow the
+module holding that handler to be torn down prematurely.
+
+Address this issue by making acpi_device_remove_notify_handler() wait
+for the handling of all the ACPI events in progress to complete before
+returning.
+
+Fixes: 5894b0c46e49 ("ACPI / scan: Move bus operations and notification routines to bus.c")
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/bus.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c
+index a96da65057b19..d34451cf04bc2 100644
+--- a/drivers/acpi/bus.c
++++ b/drivers/acpi/bus.c
+@@ -589,6 +589,7 @@ static void acpi_device_remove_notify_handler(struct acpi_device *device,
+ acpi_remove_notify_handler(device->handle, type,
+ acpi_notify_device);
+ }
++ acpi_os_wait_events_complete();
+ }
+
+ /* Handle events targeting \_SB device (at present only graceful shutdown) */
+--
+2.39.2
+
--- /dev/null
+From 2f1f40a97af3218df26b2d7967a76dcdfedc8d1a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Apr 2023 13:02:20 +0200
+Subject: ACPI: PM: Do not turn of unused power resources on the Toshiba Click
+ Mini
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 9b04d99788cf475cbd277f30ec66230ccb7e99f4 ]
+
+The CPR3 power resource on the Toshiba Click Mini toggles a GPIO
+which is called SISP (for SIS touchscreen power?) on/off.
+
+This CPR3 power resource is not listed in any _PR? lists, let alone
+in a _PR0 list for the SIS0817 touchscreen ACPI device which needs it.
+
+Before commit a1224f34d72a ("ACPI: PM: Check states of power resources
+during initialization") this was not an issue because since nothing
+referenced the CPR3 power resource its state was always
+ACPI_POWER_RESOURCE_STATE_UNKNOWN and power resources with this state
+get ignored by acpi_turn_off_unused_power_resources().
+
+This clearly is a bug in the DSDT of this device. Add a DMI quirk
+to make acpi_turn_off_unused_power_resources() a no-op on this
+model to fix the touchscreen no longer working since kernel 5.16 .
+
+This quirk also causes 2 other power resources to not get turned
+off, but the _OFF method on these already was a no-op, so this makes
+no difference for the other 2 power resources.
+
+Fixes: a1224f34d72a ("ACPI: PM: Check states of power resources during initialization")
+Reported-by: Gé Koerkamp <ge.koerkamp@gmail.com>
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=216946
+Link: https://lore.kernel.org/regressions/32a14a8a-9795-4c8c-7e00-da9012f548f8@leemhuis.info/
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/power.c | 19 +++++++++++++++++++
+ 1 file changed, 19 insertions(+)
+
+diff --git a/drivers/acpi/power.c b/drivers/acpi/power.c
+index 23507d29f0006..c2c70139c4f1d 100644
+--- a/drivers/acpi/power.c
++++ b/drivers/acpi/power.c
+@@ -23,6 +23,7 @@
+
+ #define pr_fmt(fmt) "ACPI: PM: " fmt
+
++#include <linux/dmi.h>
+ #include <linux/kernel.h>
+ #include <linux/module.h>
+ #include <linux/init.h>
+@@ -1022,6 +1023,21 @@ void acpi_resume_power_resources(void)
+ }
+ #endif
+
++static const struct dmi_system_id dmi_leave_unused_power_resources_on[] = {
++ {
++ /*
++ * The Toshiba Click Mini has a CPR3 power-resource which must
++ * be on for the touchscreen to work, but which is not in any
++ * _PR? lists. The other 2 affected power-resources are no-ops.
++ */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "SATELLITE Click Mini L9W-B"),
++ },
++ },
++ {}
++};
++
+ /**
+ * acpi_turn_off_unused_power_resources - Turn off power resources not in use.
+ */
+@@ -1029,6 +1045,9 @@ void acpi_turn_off_unused_power_resources(void)
+ {
+ struct acpi_power_resource *resource;
+
++ if (dmi_check_system(dmi_leave_unused_power_resources_on))
++ return;
++
+ mutex_lock(&power_resource_list_lock);
+
+ list_for_each_entry_reverse(resource, &acpi_power_resource_list, list_node) {
+--
+2.39.2
+
--- /dev/null
+From 1af4485f380f3b6cd5225f12f37fd3d876d5acbd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Mar 2023 12:13:29 +0100
+Subject: ACPI: processor: Fix evaluating _PDC method when running as Xen dom0
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Roger Pau Monne <roger.pau@citrix.com>
+
+[ Upstream commit 073828e954459b883f23e53999d31e4c55ab9654 ]
+
+In ACPI systems, the OS can direct power management, as opposed to the
+firmware. This OS-directed Power Management is called OSPM. Part of
+telling the firmware that the OS going to direct power management is
+making ACPI "_PDC" (Processor Driver Capabilities) calls. These _PDC
+methods must be evaluated for every processor object. If these _PDC
+calls are not completed for every processor it can lead to
+inconsistency and later failures in things like the CPU frequency
+driver.
+
+In a Xen system, the dom0 kernel is responsible for system-wide power
+management. The dom0 kernel is in charge of OSPM. However, the
+number of CPUs available to dom0 can be different than the number of
+CPUs physically present on the system.
+
+This leads to a problem: the dom0 kernel needs to evaluate _PDC for
+all the processors, but it can't always see them.
+
+In dom0 kernels, ignore the existing ACPI method for determining if a
+processor is physically present because it might not be accurate.
+Instead, ask the hypervisor for this information.
+
+Fix this by introducing a custom function to use when running as Xen
+dom0 in order to check whether a processor object matches a CPU that's
+online. Such checking is done using the existing information fetched
+by the Xen pCPU subsystem, extending it to also store the ACPI ID.
+
+This ensures that _PDC method gets evaluated for all physically online
+CPUs, regardless of the number of CPUs made available to dom0.
+
+Fixes: 5d554a7bb064 ("ACPI: processor: add internal processor_physically_present()")
+Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
+Reviewed-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/processor_pdc.c | 11 +++++++++++
+ drivers/xen/pcpu.c | 20 ++++++++++++++++++++
+ include/xen/xen.h | 11 +++++++++++
+ 3 files changed, 42 insertions(+)
+
+diff --git a/drivers/acpi/processor_pdc.c b/drivers/acpi/processor_pdc.c
+index 8c3f82c9fff35..18fb04523f93b 100644
+--- a/drivers/acpi/processor_pdc.c
++++ b/drivers/acpi/processor_pdc.c
+@@ -14,6 +14,8 @@
+ #include <linux/acpi.h>
+ #include <acpi/processor.h>
+
++#include <xen/xen.h>
++
+ #include "internal.h"
+
+ static bool __init processor_physically_present(acpi_handle handle)
+@@ -47,6 +49,15 @@ static bool __init processor_physically_present(acpi_handle handle)
+ return false;
+ }
+
++ if (xen_initial_domain())
++ /*
++ * When running as a Xen dom0 the number of processors Linux
++ * sees can be different from the real number of processors on
++ * the system, and we still need to execute _PDC for all of
++ * them.
++ */
++ return xen_processor_present(acpi_id);
++
+ type = (acpi_type == ACPI_TYPE_DEVICE) ? 1 : 0;
+ cpuid = acpi_get_cpuid(handle, type, acpi_id);
+
+diff --git a/drivers/xen/pcpu.c b/drivers/xen/pcpu.c
+index fd3a644b08559..b3e3d1bb37f3e 100644
+--- a/drivers/xen/pcpu.c
++++ b/drivers/xen/pcpu.c
+@@ -58,6 +58,7 @@ struct pcpu {
+ struct list_head list;
+ struct device dev;
+ uint32_t cpu_id;
++ uint32_t acpi_id;
+ uint32_t flags;
+ };
+
+@@ -249,6 +250,7 @@ static struct pcpu *create_and_register_pcpu(struct xenpf_pcpuinfo *info)
+
+ INIT_LIST_HEAD(&pcpu->list);
+ pcpu->cpu_id = info->xen_cpuid;
++ pcpu->acpi_id = info->acpi_id;
+ pcpu->flags = info->flags;
+
+ /* Need hold on xen_pcpu_lock before pcpu list manipulations */
+@@ -381,3 +383,21 @@ static int __init xen_pcpu_init(void)
+ return ret;
+ }
+ arch_initcall(xen_pcpu_init);
++
++#ifdef CONFIG_ACPI
++bool __init xen_processor_present(uint32_t acpi_id)
++{
++ const struct pcpu *pcpu;
++ bool online = false;
++
++ mutex_lock(&xen_pcpu_lock);
++ list_for_each_entry(pcpu, &xen_pcpus, list)
++ if (pcpu->acpi_id == acpi_id) {
++ online = pcpu->flags & XEN_PCPU_FLAGS_ONLINE;
++ break;
++ }
++ mutex_unlock(&xen_pcpu_lock);
++
++ return online;
++}
++#endif
+diff --git a/include/xen/xen.h b/include/xen/xen.h
+index 7adf59837c258..0efeb652f9b8f 100644
+--- a/include/xen/xen.h
++++ b/include/xen/xen.h
+@@ -71,4 +71,15 @@ static inline void xen_free_unpopulated_pages(unsigned int nr_pages,
+ }
+ #endif
+
++#if defined(CONFIG_XEN_DOM0) && defined(CONFIG_ACPI) && defined(CONFIG_X86)
++bool __init xen_processor_present(uint32_t acpi_id);
++#else
++#include <linux/bug.h>
++static inline bool xen_processor_present(uint32_t acpi_id)
++{
++ BUG();
++ return false;
++}
++#endif
++
+ #endif /* _XEN_XEN_H */
+--
+2.39.2
+
--- /dev/null
+From be8a848da61056070d0066577793ef0cfa21e4ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Mar 2023 12:47:15 +0530
+Subject: ACPI: utils: Fix acpi_evaluate_dsm_typed() redefinition error
+
+From: Kiran K <kiran.k@intel.com>
+
+[ Upstream commit 2c5a06e5505a716387a4d86f1f39de506836435a ]
+
+acpi_evaluate_dsm_typed() needs to be gaurded with CONFIG_ACPI to avoid
+a redefintion error when the stub is also enabled.
+
+In file included from ../drivers/bluetooth/btintel.c:13:
+../include/acpi/acpi_bus.h:57:1: error: redefinition of 'acpi_evaluate_dsm_typed'
+ 57 | acpi_evaluate_dsm_typed(acpi_handle handle, const guid_t *guid,..
+ | ^~~~~~~~~~~~~~~~~~~~~~~
+In file included from ../drivers/bluetooth/btintel.c:12:
+../include/linux/acpi.h:967:34: note: previous definition of
+'acpi_evaluate_dsm_typed' with type 'union acpi_object *(void *,
+const guid_t *, u64, u64, union acpi_object *, acpi_object_type)'
+{aka 'union acpi_object *(void *, const guid_t *, long long unsigned int,
+long long unsigned int, union acpi_object *, unsigned int)'}
+ 967 | static inline union acpi_object
+*acpi_evaluate_dsm_typed(acpi_handle handle,
+
+Fixes: 1b94ad7ccc21 ("ACPI: utils: Add acpi_evaluate_dsm_typed() and acpi_check_dsm() stubs")
+Signed-off-by: Kiran K <kiran.k@intel.com>
+[ rjw: Subject and changelog edits ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/acpi/acpi_bus.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/include/acpi/acpi_bus.h b/include/acpi/acpi_bus.h
+index 57acb895c0381..a6affc0550b0f 100644
+--- a/include/acpi/acpi_bus.h
++++ b/include/acpi/acpi_bus.h
+@@ -52,7 +52,7 @@ bool acpi_dock_match(acpi_handle handle);
+ bool acpi_check_dsm(acpi_handle handle, const guid_t *guid, u64 rev, u64 funcs);
+ union acpi_object *acpi_evaluate_dsm(acpi_handle handle, const guid_t *guid,
+ u64 rev, u64 func, union acpi_object *argv4);
+-
++#ifdef CONFIG_ACPI
+ static inline union acpi_object *
+ acpi_evaluate_dsm_typed(acpi_handle handle, const guid_t *guid, u64 rev,
+ u64 func, union acpi_object *argv4,
+@@ -68,6 +68,7 @@ acpi_evaluate_dsm_typed(acpi_handle handle, const guid_t *guid, u64 rev,
+
+ return obj;
+ }
++#endif
+
+ #define ACPI_INIT_DSM_ARGV4(cnt, eles) \
+ { \
+--
+2.39.2
+
--- /dev/null
+From 597c0a5844a89a21f6c253af8b766a8c6e5fbb77 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Mar 2023 18:05:29 +0000
+Subject: ACPI: VIOT: Initialize the correct IOMMU fwspec
+
+From: Jean-Philippe Brucker <jean-philippe@linaro.org>
+
+[ Upstream commit 47d26684185d09e083669bbbd0c465ab3493a51f ]
+
+When setting up DMA for a PCI device, we need to initialize its
+iommu_fwspec with all possible alias RIDs (such as PCI bridges). To do
+this we use pci_for_each_dma_alias() which calls
+viot_pci_dev_iommu_init(). This function incorrectly initializes the
+fwspec of the bridge instead of the device being configured. Fix it by
+passing the original device as context to pci_for_each_dma_alias().
+
+Fixes: 3cf485540e7b ("ACPI: Add driver for the VIOT table")
+Link: https://lore.kernel.org/all/Y8qzOKm6kvhGWG1T@myrica
+Reported-by: Eric Auger <eric.auger@redhat.com>
+Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
+Reviewed-by: Eric Auger <eric.auger@redhat.com>
+Tested-by: Eric Auger <eric.auger@redhat.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/viot.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/acpi/viot.c b/drivers/acpi/viot.c
+index ed752cbbe6362..c8025921c129b 100644
+--- a/drivers/acpi/viot.c
++++ b/drivers/acpi/viot.c
+@@ -328,6 +328,7 @@ static int viot_pci_dev_iommu_init(struct pci_dev *pdev, u16 dev_id, void *data)
+ {
+ u32 epid;
+ struct viot_endpoint *ep;
++ struct device *aliased_dev = data;
+ u32 domain_nr = pci_domain_nr(pdev->bus);
+
+ list_for_each_entry(ep, &viot_pci_ranges, list) {
+@@ -338,7 +339,7 @@ static int viot_pci_dev_iommu_init(struct pci_dev *pdev, u16 dev_id, void *data)
+ epid = ((domain_nr - ep->segment_start) << 16) +
+ dev_id - ep->bdf_start + ep->endpoint_id;
+
+- return viot_dev_iommu_init(&pdev->dev, ep->viommu,
++ return viot_dev_iommu_init(aliased_dev, ep->viommu,
+ epid);
+ }
+ }
+@@ -372,7 +373,7 @@ int viot_iommu_configure(struct device *dev)
+ {
+ if (dev_is_pci(dev))
+ return pci_for_each_dma_alias(to_pci_dev(dev),
+- viot_pci_dev_iommu_init, NULL);
++ viot_pci_dev_iommu_init, dev);
+ else if (dev_is_platform(dev))
+ return viot_mmio_dev_iommu_init(to_platform_device(dev));
+ return -ENODEV;
+--
+2.39.2
+
--- /dev/null
+From 6f3e48bd04275c91c57ee3cdb838bea7d88c0b37 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Dec 2022 10:19:42 -0400
+Subject: afs: Avoid endless loop if file is larger than expected
+
+From: Marc Dionne <marc.dionne@auristor.com>
+
+[ Upstream commit 9ea4eff4b6f4f36546d537a74da44fd3f30903ab ]
+
+afs_read_dir fetches an amount of data that's based on what the inode
+size is thought to be. If the file on the server is larger than what
+was fetched, the code rechecks i_size and retries. If the local i_size
+was not properly updated, this can lead to an endless loop of fetching
+i_size from the server and noticing each time that the size is larger on
+the server.
+
+If it is known that the remote size is larger than i_size, bump up the
+fetch size to that size.
+
+Fixes: f3ddee8dc4e2 ("afs: Fix directory handling")
+Signed-off-by: Marc Dionne <marc.dionne@auristor.com>
+Signed-off-by: David Howells <dhowells@redhat.com>
+cc: linux-afs@lists.infradead.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/afs/dir.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/fs/afs/dir.c b/fs/afs/dir.c
+index 82690d1dd49a0..a97499fd747b6 100644
+--- a/fs/afs/dir.c
++++ b/fs/afs/dir.c
+@@ -275,6 +275,7 @@ static struct afs_read *afs_read_dir(struct afs_vnode *dvnode, struct key *key)
+ loff_t i_size;
+ int nr_pages, i;
+ int ret;
++ loff_t remote_size = 0;
+
+ _enter("");
+
+@@ -289,6 +290,8 @@ static struct afs_read *afs_read_dir(struct afs_vnode *dvnode, struct key *key)
+
+ expand:
+ i_size = i_size_read(&dvnode->netfs.inode);
++ if (i_size < remote_size)
++ i_size = remote_size;
+ if (i_size < 2048) {
+ ret = afs_bad(dvnode, afs_file_error_dir_small);
+ goto error;
+@@ -364,6 +367,7 @@ static struct afs_read *afs_read_dir(struct afs_vnode *dvnode, struct key *key)
+ * buffer.
+ */
+ up_write(&dvnode->validate_lock);
++ remote_size = req->file_size;
+ goto expand;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From d63984721586be4808d3a35f887d72ea41cc29c6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Dec 2022 13:49:42 +0000
+Subject: afs: Fix getattr to report server i_size on dirs, not local size
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit 45f66fa03ba9943cca5af88d691399332b8bde08 ]
+
+Fix afs_getattr() to report the server's idea of the file size of a
+directory rather than the local size. The local size may differ as we edit
+the local copy to avoid having to redownload it and we may end up with a
+differently structured blob of a different size.
+
+However, if the directory is discarded from the pagecache we then download
+it again and the user may see the directory file size apparently change.
+
+Fixes: 63a4681ff39c ("afs: Locally edit directory data for mkdir/create/unlink/...")
+Signed-off-by: David Howells <dhowells@redhat.com>
+cc: Marc Dionne <marc.dionne@auristor.com>
+cc: linux-afs@lists.infradead.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/afs/inode.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/fs/afs/inode.c b/fs/afs/inode.c
+index 790cca53c1453..c5098f70b53af 100644
+--- a/fs/afs/inode.c
++++ b/fs/afs/inode.c
+@@ -450,7 +450,7 @@ static void afs_get_inode_cache(struct afs_vnode *vnode)
+ 0 : FSCACHE_ADV_SINGLE_CHUNK,
+ &key, sizeof(key),
+ &aux, sizeof(aux),
+- vnode->status.size));
++ i_size_read(&vnode->netfs.inode)));
+ #endif
+ }
+
+@@ -766,6 +766,13 @@ int afs_getattr(struct mnt_idmap *idmap, const struct path *path,
+ if (test_bit(AFS_VNODE_SILLY_DELETED, &vnode->flags) &&
+ stat->nlink > 0)
+ stat->nlink -= 1;
++
++ /* Lie about the size of directories. We maintain a locally
++ * edited copy and may make different allocation decisions on
++ * it, but we need to give userspace the server's size.
++ */
++ if (S_ISDIR(inode->i_mode))
++ stat->size = vnode->netfs.remote_i_size;
+ } while (need_seqretry(&vnode->cb_lock, seq));
+
+ done_seqretry(&vnode->cb_lock, seq);
+--
+2.39.2
+
--- /dev/null
+From 3a173a0ab94c4c89f1df244c8ce6195bc793faf6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Dec 2022 10:07:01 -0400
+Subject: afs: Fix updating of i_size with dv jump from server
+
+From: Marc Dionne <marc.dionne@auristor.com>
+
+[ Upstream commit d7f74e9a917503ee78f2b603a456d7227cf38919 ]
+
+If the data version returned from the server is larger than expected,
+the local data is invalidated, but we may still want to note the remote
+file size.
+
+Since we're setting change_size, we have to also set data_changed
+for the i_size to get updated.
+
+Fixes: 3f4aa9818163 ("afs: Fix EOF corruption")
+Signed-off-by: Marc Dionne <marc.dionne@auristor.com>
+Signed-off-by: David Howells <dhowells@redhat.com>
+cc: linux-afs@lists.infradead.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/afs/inode.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/afs/inode.c b/fs/afs/inode.c
+index 0167e96e51986..790cca53c1453 100644
+--- a/fs/afs/inode.c
++++ b/fs/afs/inode.c
+@@ -230,6 +230,7 @@ static void afs_apply_status(struct afs_operation *op,
+ set_bit(AFS_VNODE_ZAP_DATA, &vnode->flags);
+ }
+ change_size = true;
++ data_changed = true;
+ } else if (vnode->status.type == AFS_FTYPE_DIR) {
+ /* Expected directory change is handled elsewhere so
+ * that we can locally edit the directory and save on a
+--
+2.39.2
+
--- /dev/null
+From d6e65078656a1b7b4b69fb93f36a27eb8226c4a1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Mar 2023 12:01:02 +0100
+Subject: ARM: 9292/1: vfp: Pass thread_info pointer to vfp_support_entry
+
+From: Ard Biesheuvel <ardb@kernel.org>
+
+[ Upstream commit dae904d96ad6a5fa79bd9d99a3decf93685d398b ]
+
+Instead of dereferencing thread_info in do_vfp, pass the thread_info
+pointer to vfp_support_entry via R1. That way, we only use a single
+caller save register, which makes it easier to convert do_vfp to C code
+in a subsequent patch.
+
+Note that, unlike the CPU number, which can change due to preemption,
+passing the thread_info pointer can safely be done with preemption
+enabled.
+
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Tested-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Stable-dep-of: c76c6c4ecbec ("ARM: 9294/2: vfp: Fix broken softirq handling with instrumentation enabled")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/vfp/entry.S | 5 +----
+ arch/arm/vfp/vfphw.S | 10 +++++++---
+ 2 files changed, 8 insertions(+), 7 deletions(-)
+
+diff --git a/arch/arm/vfp/entry.S b/arch/arm/vfp/entry.S
+index 9a89264cdcc0b..cfedc2a3dbd68 100644
+--- a/arch/arm/vfp/entry.S
++++ b/arch/arm/vfp/entry.S
+@@ -22,15 +22,12 @@
+ @ IRQs enabled.
+ @
+ ENTRY(do_vfp)
+- local_bh_disable r10, r4
++ mov r1, r10
+ ldr r4, .LCvfp
+- ldr r11, [r10, #TI_CPU] @ CPU number
+- add r10, r10, #TI_VFPSTATE @ r10 = workspace
+ ldr pc, [r4] @ call VFP entry point
+ ENDPROC(do_vfp)
+
+ ENTRY(vfp_null_entry)
+- local_bh_enable_ti r10, r4
+ ret lr
+ ENDPROC(vfp_null_entry)
+
+diff --git a/arch/arm/vfp/vfphw.S b/arch/arm/vfp/vfphw.S
+index 26c4f61ecfa39..6d056d810e486 100644
+--- a/arch/arm/vfp/vfphw.S
++++ b/arch/arm/vfp/vfphw.S
+@@ -6,9 +6,9 @@
+ * Written by Deep Blue Solutions Limited.
+ *
+ * This code is called from the kernel's undefined instruction trap.
++ * r1 holds the thread_info pointer
+ * r9 holds the return address for successful handling.
+ * lr holds the return address for unrecognised instructions.
+- * r10 points at the start of the private FP workspace in the thread structure
+ * sp points to a struct pt_regs (as defined in include/asm/proc/ptrace.h)
+ */
+ #include <linux/init.h>
+@@ -69,13 +69,17 @@
+ @ VFP hardware support entry point.
+ @
+ @ r0 = instruction opcode (32-bit ARM or two 16-bit Thumb)
++@ r1 = thread_info pointer
+ @ r2 = PC value to resume execution after successful emulation
+ @ r9 = normal "successful" return address
+-@ r10 = vfp_state union
+-@ r11 = CPU number
+ @ lr = unrecognised instruction return address
+ @ IRQs enabled.
+ ENTRY(vfp_support_entry)
++ local_bh_disable r1, r4
++
++ ldr r11, [r1, #TI_CPU] @ CPU number
++ add r10, r1, #TI_VFPSTATE @ r10 = workspace
++
+ DBGSTR3 "instr %08x pc %08x state %p", r0, r2, r10
+
+ .fpu vfpv2
+--
+2.39.2
+
--- /dev/null
+From 5c573f5d8754af513a37d70f7702e4235f05ac09 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Mar 2023 12:01:51 +0100
+Subject: ARM: 9293/1: vfp: Pass successful return address via register R3
+
+From: Ard Biesheuvel <ardb@kernel.org>
+
+[ Upstream commit 3a2bdad0b46649cc73fb3b3f9e2b91ef97a7fa63 ]
+
+In preparation for reimplementing the do_vfp()->vfp_support_entry()
+handover in C code, switch to using R3 to pass the 'success' return
+address, rather than R9, as it cannot be used for parameter passing.
+
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Tested-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Stable-dep-of: c76c6c4ecbec ("ARM: 9294/2: vfp: Fix broken softirq handling with instrumentation enabled")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/vfp/entry.S | 1 +
+ arch/arm/vfp/vfphw.S | 14 +++++++-------
+ 2 files changed, 8 insertions(+), 7 deletions(-)
+
+diff --git a/arch/arm/vfp/entry.S b/arch/arm/vfp/entry.S
+index cfedc2a3dbd68..6dabb47617781 100644
+--- a/arch/arm/vfp/entry.S
++++ b/arch/arm/vfp/entry.S
+@@ -23,6 +23,7 @@
+ @
+ ENTRY(do_vfp)
+ mov r1, r10
++ mov r3, r9
+ ldr r4, .LCvfp
+ ldr pc, [r4] @ call VFP entry point
+ ENDPROC(do_vfp)
+diff --git a/arch/arm/vfp/vfphw.S b/arch/arm/vfp/vfphw.S
+index 6d056d810e486..60acd42e05786 100644
+--- a/arch/arm/vfp/vfphw.S
++++ b/arch/arm/vfp/vfphw.S
+@@ -7,7 +7,7 @@
+ *
+ * This code is called from the kernel's undefined instruction trap.
+ * r1 holds the thread_info pointer
+- * r9 holds the return address for successful handling.
++ * r3 holds the return address for successful handling.
+ * lr holds the return address for unrecognised instructions.
+ * sp points to a struct pt_regs (as defined in include/asm/proc/ptrace.h)
+ */
+@@ -71,7 +71,7 @@
+ @ r0 = instruction opcode (32-bit ARM or two 16-bit Thumb)
+ @ r1 = thread_info pointer
+ @ r2 = PC value to resume execution after successful emulation
+-@ r9 = normal "successful" return address
++@ r3 = normal "successful" return address
+ @ lr = unrecognised instruction return address
+ @ IRQs enabled.
+ ENTRY(vfp_support_entry)
+@@ -89,9 +89,9 @@ ENTRY(vfp_support_entry)
+ bne look_for_VFP_exceptions @ VFP is already enabled
+
+ DBGSTR1 "enable %x", r10
+- ldr r3, vfp_current_hw_state_address
++ ldr r9, vfp_current_hw_state_address
+ orr r1, r1, #FPEXC_EN @ user FPEXC has the enable bit set
+- ldr r4, [r3, r11, lsl #2] @ vfp_current_hw_state pointer
++ ldr r4, [r9, r11, lsl #2] @ vfp_current_hw_state pointer
+ bic r5, r1, #FPEXC_EX @ make sure exceptions are disabled
+ cmp r4, r10 @ this thread owns the hw context?
+ #ifndef CONFIG_SMP
+@@ -150,7 +150,7 @@ vfp_reload_hw:
+ #endif
+
+ DBGSTR1 "load state %p", r10
+- str r10, [r3, r11, lsl #2] @ update the vfp_current_hw_state pointer
++ str r10, [r9, r11, lsl #2] @ update the vfp_current_hw_state pointer
+ @ Load the saved state back into the VFP
+ VFPFLDMIA r10, r5 @ reload the working registers while
+ @ FPEXC is in a safe state
+@@ -180,7 +180,7 @@ vfp_hw_state_valid:
+ @ always subtract 4 from the following
+ @ instruction address.
+ local_bh_enable_ti r10, r4
+- ret r9 @ we think we have handled things
++ ret r3 @ we think we have handled things
+
+
+ look_for_VFP_exceptions:
+@@ -210,7 +210,7 @@ skip:
+ process_exception:
+ DBGSTR "bounce"
+ mov r2, sp @ nothing stacked - regdump is at TOS
+- mov lr, r9 @ setup for a return to the user code.
++ mov lr, r3 @ setup for a return to the user code.
+
+ @ Now call the C code to package up the bounce to the support code
+ @ r0 holds the trigger instruction
+--
+2.39.2
+
--- /dev/null
+From ccb24bbd6d60771bac1510a86cd783c2c299093a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Apr 2023 09:50:20 +0100
+Subject: ARM: 9294/2: vfp: Fix broken softirq handling with instrumentation
+ enabled
+
+From: Ard Biesheuvel <ardb@kernel.org>
+
+[ Upstream commit c76c6c4ecbec0deb56a4f9e932b26866024a508f ]
+
+Commit 62b95a7b44d1 ("ARM: 9282/1: vfp: Manipulate task VFP state with
+softirqs disabled") replaced the en/disable preemption calls inside the
+VFP state handling code with en/disabling of soft IRQs, which is
+necessary to allow kernel use of the VFP/SIMD unit when handling a soft
+IRQ.
+
+Unfortunately, when lockdep is enabled (or other instrumentation that
+enables TRACE_IRQFLAGS), the disable path implemented in asm fails to
+perform the lockdep and RCU related bookkeeping, resulting in spurious
+warnings and other badness.
+
+Set let's rework the VFP entry code a little bit so we can make the
+local_bh_disable() call from C, with all the instrumentations that
+happen to have been configured. Calling local_bh_enable() can be done
+from asm, as it is a simple wrapper around __local_bh_enable_ip(), which
+is always a callable function.
+
+Link: https://lore.kernel.org/all/ZBBYCSZUJOWBg1s8@localhost.localdomain/
+
+Fixes: 62b95a7b44d1 ("ARM: 9282/1: vfp: Manipulate task VFP state with softirqs disabled")
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Tested-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/include/asm/assembler.h | 13 -------------
+ arch/arm/vfp/entry.S | 11 +----------
+ arch/arm/vfp/vfphw.S | 12 ++++++------
+ arch/arm/vfp/vfpmodule.c | 27 ++++++++++++++++++++++-----
+ 4 files changed, 29 insertions(+), 34 deletions(-)
+
+diff --git a/arch/arm/include/asm/assembler.h b/arch/arm/include/asm/assembler.h
+index 06b48ce23e1ca..505a306e0271a 100644
+--- a/arch/arm/include/asm/assembler.h
++++ b/arch/arm/include/asm/assembler.h
+@@ -244,19 +244,6 @@ THUMB( fpreg .req r7 )
+ .endm
+ #endif
+
+- .macro local_bh_disable, ti, tmp
+- ldr \tmp, [\ti, #TI_PREEMPT]
+- add \tmp, \tmp, #SOFTIRQ_DISABLE_OFFSET
+- str \tmp, [\ti, #TI_PREEMPT]
+- .endm
+-
+- .macro local_bh_enable_ti, ti, tmp
+- get_thread_info \ti
+- ldr \tmp, [\ti, #TI_PREEMPT]
+- sub \tmp, \tmp, #SOFTIRQ_DISABLE_OFFSET
+- str \tmp, [\ti, #TI_PREEMPT]
+- .endm
+-
+ #define USERL(l, x...) \
+ 9999: x; \
+ .pushsection __ex_table,"a"; \
+diff --git a/arch/arm/vfp/entry.S b/arch/arm/vfp/entry.S
+index 6dabb47617781..7483ef8bccda3 100644
+--- a/arch/arm/vfp/entry.S
++++ b/arch/arm/vfp/entry.S
+@@ -24,14 +24,5 @@
+ ENTRY(do_vfp)
+ mov r1, r10
+ mov r3, r9
+- ldr r4, .LCvfp
+- ldr pc, [r4] @ call VFP entry point
++ b vfp_entry
+ ENDPROC(do_vfp)
+-
+-ENTRY(vfp_null_entry)
+- ret lr
+-ENDPROC(vfp_null_entry)
+-
+- .align 2
+-.LCvfp:
+- .word vfp_vector
+diff --git a/arch/arm/vfp/vfphw.S b/arch/arm/vfp/vfphw.S
+index 60acd42e05786..4d8478264d82b 100644
+--- a/arch/arm/vfp/vfphw.S
++++ b/arch/arm/vfp/vfphw.S
+@@ -75,8 +75,6 @@
+ @ lr = unrecognised instruction return address
+ @ IRQs enabled.
+ ENTRY(vfp_support_entry)
+- local_bh_disable r1, r4
+-
+ ldr r11, [r1, #TI_CPU] @ CPU number
+ add r10, r1, #TI_VFPSTATE @ r10 = workspace
+
+@@ -179,9 +177,12 @@ vfp_hw_state_valid:
+ @ else it's one 32-bit instruction, so
+ @ always subtract 4 from the following
+ @ instruction address.
+- local_bh_enable_ti r10, r4
+- ret r3 @ we think we have handled things
+
++ mov lr, r3 @ we think we have handled things
++local_bh_enable_and_ret:
++ adr r0, .
++ mov r1, #SOFTIRQ_DISABLE_OFFSET
++ b __local_bh_enable_ip @ tail call
+
+ look_for_VFP_exceptions:
+ @ Check for synchronous or asynchronous exception
+@@ -204,8 +205,7 @@ skip:
+ @ not recognised by VFP
+
+ DBGSTR "not VFP"
+- local_bh_enable_ti r10, r4
+- ret lr
++ b local_bh_enable_and_ret
+
+ process_exception:
+ DBGSTR "bounce"
+diff --git a/arch/arm/vfp/vfpmodule.c b/arch/arm/vfp/vfpmodule.c
+index 01bc48d738478..349dcb944a937 100644
+--- a/arch/arm/vfp/vfpmodule.c
++++ b/arch/arm/vfp/vfpmodule.c
+@@ -32,10 +32,9 @@
+ /*
+ * Our undef handlers (in entry.S)
+ */
+-asmlinkage void vfp_support_entry(void);
+-asmlinkage void vfp_null_entry(void);
++asmlinkage void vfp_support_entry(u32, void *, u32, u32);
+
+-asmlinkage void (*vfp_vector)(void) = vfp_null_entry;
++static bool have_vfp __ro_after_init;
+
+ /*
+ * Dual-use variable.
+@@ -645,6 +644,25 @@ static int vfp_starting_cpu(unsigned int unused)
+ return 0;
+ }
+
++/*
++ * Entered with:
++ *
++ * r0 = instruction opcode (32-bit ARM or two 16-bit Thumb)
++ * r1 = thread_info pointer
++ * r2 = PC value to resume execution after successful emulation
++ * r3 = normal "successful" return address
++ * lr = unrecognised instruction return address
++ */
++asmlinkage void vfp_entry(u32 trigger, struct thread_info *ti, u32 resume_pc,
++ u32 resume_return_address)
++{
++ if (unlikely(!have_vfp))
++ return;
++
++ local_bh_disable();
++ vfp_support_entry(trigger, ti, resume_pc, resume_return_address);
++}
++
+ #ifdef CONFIG_KERNEL_MODE_NEON
+
+ static int vfp_kmode_exception(struct pt_regs *regs, unsigned int instr)
+@@ -798,7 +816,6 @@ static int __init vfp_init(void)
+ vfpsid = fmrx(FPSID);
+ barrier();
+ unregister_undef_hook(&vfp_detect_hook);
+- vfp_vector = vfp_null_entry;
+
+ pr_info("VFP support v0.3: ");
+ if (VFP_arch) {
+@@ -883,7 +900,7 @@ static int __init vfp_init(void)
+ "arm/vfp:starting", vfp_starting_cpu,
+ vfp_dying_cpu);
+
+- vfp_vector = vfp_support_entry;
++ have_vfp = true;
+
+ thread_register_notifier(&vfp_notifier_block);
+ vfp_pm_init();
+--
+2.39.2
+
--- /dev/null
+From a7c33d92f5e47294652ec606d279f8cacbd3b396 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Jan 2023 22:11:51 +0100
+Subject: ARM: dts: gta04: fix excess dma channel usage
+
+From: H. Nikolaus Schaller <hns@goldelico.com>
+
+[ Upstream commit a622310f7f0185da02e42cdb06475f533efaae60 ]
+
+OMAP processors support 32 channels but there is no check or
+inspect this except booting a device and looking at dmesg reports
+of not available channels.
+
+Recently some more subsystems with DMA (aes1+2) were added filling
+the list of dma channels beyond the limit of 32 (even if other
+parameters indicate 96 or 128 channels). This leads to random
+subsystem failures i(e.g. mcbsp for audio) after boot or boot
+messages that DMA can not be initialized.
+
+Another symptom is that
+
+/sys/kernel/debug/dmaengine/summary
+
+has 32 entries and does not show all required channels.
+
+Fix by disabling unused (on the GTA04 hardware) mcspi1...4.
+Each SPI channel allocates 4 DMA channels rapidly filling
+the available ones.
+
+Disabling unused SPI modules on the OMAP3 SoC may also save
+some energy (has not been checked).
+
+Fixes: c312f066314e ("ARM: dts: omap3: Migrate AES from hwmods to sysc-omap2")
+Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
+[re-enabled aes2, improved commit subject line]
+Signed-off-by: Andreas Kemnade <andreas@kemnade.info>
+Message-Id: <20230113211151.2314874-1-andreas@kemnade.info>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/omap3-gta04.dtsi | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+diff --git a/arch/arm/boot/dts/omap3-gta04.dtsi b/arch/arm/boot/dts/omap3-gta04.dtsi
+index 87e0ab1bbe957..e0be0fb23f80f 100644
+--- a/arch/arm/boot/dts/omap3-gta04.dtsi
++++ b/arch/arm/boot/dts/omap3-gta04.dtsi
+@@ -612,6 +612,22 @@
+ clock-frequency = <100000>;
+ };
+
++&mcspi1 {
++ status = "disabled";
++};
++
++&mcspi2 {
++ status = "disabled";
++};
++
++&mcspi3 {
++ status = "disabled";
++};
++
++&mcspi4 {
++ status = "disabled";
++};
++
+ &usb_otg_hs {
+ interface-type = <0>;
+ usb-phy = <&usb2_phy>;
+--
+2.39.2
+
--- /dev/null
+From 353d3a5d9948110f30ac7d181fae254ce068c0e6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Feb 2023 13:08:31 +0100
+Subject: ARM: dts: qcom-apq8064: Fix opp table child name
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit b9745c275246a7e43c34d1b3be5ff9a9f3cf9305 ]
+
+The opp-320000000 name is rather misleading with the opp-hz value
+of 450 MHz. Fix it!
+
+Fixes: 8db0b6c7b636 ("ARM: dts: qcom: apq8064: Convert adreno from legacy gpu-pwrlevels to opp-v2")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Reviewed-by: David Heidelberg <david@ixit.cz>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230220120831.1591820-1-konrad.dybcio@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/qcom-apq8064.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/qcom-apq8064.dtsi b/arch/arm/boot/dts/qcom-apq8064.dtsi
+index 92aa2b081901f..3aeac0cabb28b 100644
+--- a/arch/arm/boot/dts/qcom-apq8064.dtsi
++++ b/arch/arm/boot/dts/qcom-apq8064.dtsi
+@@ -1260,7 +1260,7 @@
+ gpu_opp_table: opp-table {
+ compatible = "operating-points-v2";
+
+- opp-320000000 {
++ opp-450000000 {
+ opp-hz = /bits/ 64 <450000000>;
+ };
+
+--
+2.39.2
+
--- /dev/null
+From 002fdda891f90f48a118ce8ce783a48ff4790ad7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Feb 2023 22:17:51 +0530
+Subject: ARM: dts: qcom: ipq4019: Fix the PCI I/O port range
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+
+[ Upstream commit 2540279e9a9e74fc880d1e4c83754ecfcbe290a0 ]
+
+For 1MiB of the I/O region, the I/O ports of the legacy PCI devices are
+located in the range of 0x0 to 0x100000. Hence, fix the bogus PCI address
+(0x40200000) specified in the ranges property for I/O region.
+
+While at it, let's use the missing 0x prefix for the addresses.
+
+Fixes: 187519403273 ("ARM: dts: ipq4019: Add a few peripheral nodes")
+Reported-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/linux-arm-msm/7c5dfa87-41df-4ba7-b0e4-72c8386402a8@app.fastmail.com/
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Reviewed-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230228164752.55682-16-manivannan.sadhasivam@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/qcom-ipq4019.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/qcom-ipq4019.dtsi b/arch/arm/boot/dts/qcom-ipq4019.dtsi
+index 02e9ea78405d0..1159268f06d70 100644
+--- a/arch/arm/boot/dts/qcom-ipq4019.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq4019.dtsi
+@@ -426,8 +426,8 @@
+ #address-cells = <3>;
+ #size-cells = <2>;
+
+- ranges = <0x81000000 0 0x40200000 0x40200000 0 0x00100000>,
+- <0x82000000 0 0x40300000 0x40300000 0 0x00d00000>;
++ ranges = <0x81000000 0x0 0x00000000 0x40200000 0x0 0x00100000>,
++ <0x82000000 0x0 0x40300000 0x40300000 0x0 0x00d00000>;
+
+ interrupts = <GIC_SPI 141 IRQ_TYPE_LEVEL_HIGH>;
+ interrupt-names = "msi";
+--
+2.39.2
+
--- /dev/null
+From 7c0a59e6947ed87c67a2d7f012e9ae36064d30fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Feb 2023 22:17:52 +0530
+Subject: ARM: dts: qcom: ipq8064: Fix the PCI I/O port range
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+
+[ Upstream commit 0b16b34e491629016109e56747ad64588074194b ]
+
+For 64KiB of the I/O region, the I/O ports of the legacy PCI devices are
+located in the range of 0x0 to 0x10000. Hence, fix the bogus PCI addresses
+(0x0fe00000, 0x31e00000, 0x35e00000) specified in the ranges property for
+I/O region.
+
+While at it, let's use the missing 0x prefix for the addresses.
+
+Fixes: 93241840b664 ("ARM: dts: qcom: Add pcie nodes for ipq8064")
+Reported-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/linux-arm-msm/7c5dfa87-41df-4ba7-b0e4-72c8386402a8@app.fastmail.com/
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Reviewed-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230228164752.55682-17-manivannan.sadhasivam@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/qcom-ipq8064.dtsi | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/arch/arm/boot/dts/qcom-ipq8064.dtsi b/arch/arm/boot/dts/qcom-ipq8064.dtsi
+index 52d77e105957a..59fc18c448c4c 100644
+--- a/arch/arm/boot/dts/qcom-ipq8064.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq8064.dtsi
+@@ -1081,8 +1081,8 @@
+ #address-cells = <3>;
+ #size-cells = <2>;
+
+- ranges = <0x81000000 0 0x0fe00000 0x0fe00000 0 0x00010000 /* downstream I/O */
+- 0x82000000 0 0x08000000 0x08000000 0 0x07e00000>; /* non-prefetchable memory */
++ ranges = <0x81000000 0x0 0x00000000 0x0fe00000 0x0 0x00010000 /* I/O */
++ 0x82000000 0x0 0x08000000 0x08000000 0x0 0x07e00000>; /* MEM */
+
+ interrupts = <GIC_SPI 35 IRQ_TYPE_LEVEL_HIGH>;
+ interrupt-names = "msi";
+@@ -1132,8 +1132,8 @@
+ #address-cells = <3>;
+ #size-cells = <2>;
+
+- ranges = <0x81000000 0 0x31e00000 0x31e00000 0 0x00010000 /* downstream I/O */
+- 0x82000000 0 0x2e000000 0x2e000000 0 0x03e00000>; /* non-prefetchable memory */
++ ranges = <0x81000000 0x0 0x00000000 0x31e00000 0x0 0x00010000 /* I/O */
++ 0x82000000 0x0 0x2e000000 0x2e000000 0x0 0x03e00000>; /* MEM */
+
+ interrupts = <GIC_SPI 57 IRQ_TYPE_LEVEL_HIGH>;
+ interrupt-names = "msi";
+@@ -1183,8 +1183,8 @@
+ #address-cells = <3>;
+ #size-cells = <2>;
+
+- ranges = <0x81000000 0 0x35e00000 0x35e00000 0 0x00010000 /* downstream I/O */
+- 0x82000000 0 0x32000000 0x32000000 0 0x03e00000>; /* non-prefetchable memory */
++ ranges = <0x81000000 0x0 0x00000000 0x35e00000 0x0 0x00010000 /* I/O */
++ 0x82000000 0x0 0x32000000 0x32000000 0x0 0x03e00000>; /* MEM */
+
+ interrupts = <GIC_SPI 71 IRQ_TYPE_LEVEL_HIGH>;
+ interrupt-names = "msi";
+--
+2.39.2
+
--- /dev/null
+From faf241b19961e6c5351b7e19a8b444db139d6674 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Mar 2023 13:54:16 +0530
+Subject: ARM: dts: qcom: sdx55: Fix the unit address of PCIe EP node
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+
+[ Upstream commit 3b76b736cd9933ff88764ffec01cbd859c1475e7 ]
+
+Unit address of PCIe EP node should be 0x1c00000 as it has to match the
+first address specified in the reg property.
+
+This also requires sorting the node in the ascending order.
+
+Fixes: e6b69813283f ("ARM: dts: qcom: sdx55: Add support for PCIe EP")
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230308082424.140224-6-manivannan.sadhasivam@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/qcom-sdx55.dtsi | 78 +++++++++++++++----------------
+ 1 file changed, 39 insertions(+), 39 deletions(-)
+
+diff --git a/arch/arm/boot/dts/qcom-sdx55.dtsi b/arch/arm/boot/dts/qcom-sdx55.dtsi
+index df7303c5c843a..7fa542249f1af 100644
+--- a/arch/arm/boot/dts/qcom-sdx55.dtsi
++++ b/arch/arm/boot/dts/qcom-sdx55.dtsi
+@@ -304,6 +304,45 @@
+ status = "disabled";
+ };
+
++ pcie_ep: pcie-ep@1c00000 {
++ compatible = "qcom,sdx55-pcie-ep";
++ reg = <0x01c00000 0x3000>,
++ <0x40000000 0xf1d>,
++ <0x40000f20 0xc8>,
++ <0x40001000 0x1000>,
++ <0x40200000 0x100000>,
++ <0x01c03000 0x3000>;
++ reg-names = "parf", "dbi", "elbi", "atu", "addr_space",
++ "mmio";
++
++ qcom,perst-regs = <&tcsr 0xb258 0xb270>;
++
++ clocks = <&gcc GCC_PCIE_AUX_CLK>,
++ <&gcc GCC_PCIE_CFG_AHB_CLK>,
++ <&gcc GCC_PCIE_MSTR_AXI_CLK>,
++ <&gcc GCC_PCIE_SLV_AXI_CLK>,
++ <&gcc GCC_PCIE_SLV_Q2A_AXI_CLK>,
++ <&gcc GCC_PCIE_SLEEP_CLK>,
++ <&gcc GCC_PCIE_0_CLKREF_CLK>;
++ clock-names = "aux", "cfg", "bus_master", "bus_slave",
++ "slave_q2a", "sleep", "ref";
++
++ interrupts = <GIC_SPI 140 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 145 IRQ_TYPE_LEVEL_HIGH>;
++ interrupt-names = "global", "doorbell";
++ reset-gpios = <&tlmm 57 GPIO_ACTIVE_LOW>;
++ wake-gpios = <&tlmm 53 GPIO_ACTIVE_LOW>;
++ resets = <&gcc GCC_PCIE_BCR>;
++ reset-names = "core";
++ power-domains = <&gcc PCIE_GDSC>;
++ phys = <&pcie0_lane>;
++ phy-names = "pciephy";
++ max-link-speed = <3>;
++ num-lanes = <2>;
++
++ status = "disabled";
++ };
++
+ pcie0_phy: phy@1c07000 {
+ compatible = "qcom,sdx55-qmp-pcie-phy";
+ reg = <0x01c07000 0x1c4>;
+@@ -401,45 +440,6 @@
+ status = "disabled";
+ };
+
+- pcie_ep: pcie-ep@40000000 {
+- compatible = "qcom,sdx55-pcie-ep";
+- reg = <0x01c00000 0x3000>,
+- <0x40000000 0xf1d>,
+- <0x40000f20 0xc8>,
+- <0x40001000 0x1000>,
+- <0x40200000 0x100000>,
+- <0x01c03000 0x3000>;
+- reg-names = "parf", "dbi", "elbi", "atu", "addr_space",
+- "mmio";
+-
+- qcom,perst-regs = <&tcsr 0xb258 0xb270>;
+-
+- clocks = <&gcc GCC_PCIE_AUX_CLK>,
+- <&gcc GCC_PCIE_CFG_AHB_CLK>,
+- <&gcc GCC_PCIE_MSTR_AXI_CLK>,
+- <&gcc GCC_PCIE_SLV_AXI_CLK>,
+- <&gcc GCC_PCIE_SLV_Q2A_AXI_CLK>,
+- <&gcc GCC_PCIE_SLEEP_CLK>,
+- <&gcc GCC_PCIE_0_CLKREF_CLK>;
+- clock-names = "aux", "cfg", "bus_master", "bus_slave",
+- "slave_q2a", "sleep", "ref";
+-
+- interrupts = <GIC_SPI 140 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 145 IRQ_TYPE_LEVEL_HIGH>;
+- interrupt-names = "global", "doorbell";
+- reset-gpios = <&tlmm 57 GPIO_ACTIVE_LOW>;
+- wake-gpios = <&tlmm 53 GPIO_ACTIVE_LOW>;
+- resets = <&gcc GCC_PCIE_BCR>;
+- reset-names = "core";
+- power-domains = <&gcc PCIE_GDSC>;
+- phys = <&pcie0_lane>;
+- phy-names = "pciephy";
+- max-link-speed = <3>;
+- num-lanes = <2>;
+-
+- status = "disabled";
+- };
+-
+ remoteproc_mpss: remoteproc@4080000 {
+ compatible = "qcom,sdx55-mpss-pas";
+ reg = <0x04080000 0x4040>;
+--
+2.39.2
+
--- /dev/null
+From 7ef77adc257747a4164274edbb0bd9e4ccf2a8d9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Mar 2023 18:03:31 +0100
+Subject: ARM: dts: stm32: fix spi1 pin assignment on stm32mp15
+
+From: Alexandre Torgue <alexandre.torgue@foss.st.com>
+
+[ Upstream commit 1b9f0ec81af0012aae30aa3b4c711ad71d42e246 ]
+
+Bank A and B IOs can't be handled by the pin controller 'Z'. This patch
+assign spi1 pin definition to the correct controller.
+
+Fixes: 9ad65d245b7b ("ARM: dts: stm32: stm32mp15-pinctrl: add spi1-1 pinmux group")
+
+Signed-off-by: Alexandre Torgue <alexandre.torgue@foss.st.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/stm32mp15-pinctrl.dtsi | 30 ++++++++++++------------
+ 1 file changed, 15 insertions(+), 15 deletions(-)
+
+diff --git a/arch/arm/boot/dts/stm32mp15-pinctrl.dtsi b/arch/arm/boot/dts/stm32mp15-pinctrl.dtsi
+index a9d2bec990141..e15a3b2a9b399 100644
+--- a/arch/arm/boot/dts/stm32mp15-pinctrl.dtsi
++++ b/arch/arm/boot/dts/stm32mp15-pinctrl.dtsi
+@@ -1880,6 +1880,21 @@
+ };
+ };
+
++ spi1_pins_b: spi1-1 {
++ pins1 {
++ pinmux = <STM32_PINMUX('A', 5, AF5)>, /* SPI1_SCK */
++ <STM32_PINMUX('B', 5, AF5)>; /* SPI1_MOSI */
++ bias-disable;
++ drive-push-pull;
++ slew-rate = <1>;
++ };
++
++ pins2 {
++ pinmux = <STM32_PINMUX('A', 6, AF5)>; /* SPI1_MISO */
++ bias-disable;
++ };
++ };
++
+ spi2_pins_a: spi2-0 {
+ pins1 {
+ pinmux = <STM32_PINMUX('B', 10, AF5)>, /* SPI2_SCK */
+@@ -2448,19 +2463,4 @@
+ bias-disable;
+ };
+ };
+-
+- spi1_pins_b: spi1-1 {
+- pins1 {
+- pinmux = <STM32_PINMUX('A', 5, AF5)>, /* SPI1_SCK */
+- <STM32_PINMUX('B', 5, AF5)>; /* SPI1_MOSI */
+- bias-disable;
+- drive-push-pull;
+- slew-rate = <1>;
+- };
+-
+- pins2 {
+- pinmux = <STM32_PINMUX('A', 6, AF5)>; /* SPI1_MISO */
+- bias-disable;
+- };
+- };
+ };
+--
+2.39.2
+
--- /dev/null
+From bf7dcf83e6263e565d5efc803d7f27e37198413b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Feb 2023 16:07:57 +0100
+Subject: arm64: dts: amlogic: meson-g12b-radxa-zero2: fix pwm clock names
+
+From: Neil Armstrong <neil.armstrong@linaro.org>
+
+[ Upstream commit db217e84d0a3f4183ea5b6d5929e55b73128fcb2 ]
+
+Fixes the following bindings check error:
+ - pwm@2000: clock-names: 'oneOf' conditional failed, one must be fixed:
+ ['clkin4'] is too short
+ 'clkin4' is not one of ['clkin0', 'clkin1']
+ 'clkin0' was expected
+ - pwm@7000: clock-names: 'oneOf' conditional failed, one must be fixed:
+ ['clkin3'] is too short
+ 'clkin3' is not one of ['clkin0', 'clkin1']
+ 'clkin0' was expected
+ - pwm@19000: clock-names: 'oneOf' conditional failed, one must be fixed:
+ ['clkin2'] is too short
+ 'clkin2' is not one of ['clkin0', 'clkin1']
+ 'clkin0' was expected
+
+Fixes: d747e7f76a5f ("arm64: dts: meson: add support for Radxa Zero2")
+Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Link: https://lore.kernel.org/r/20230207-b4-amlogic-bindings-fixups-v2-v1-4-93b7e50286e7@linaro.org
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/amlogic/meson-g12b-radxa-zero2.dts | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/amlogic/meson-g12b-radxa-zero2.dts b/arch/arm64/boot/dts/amlogic/meson-g12b-radxa-zero2.dts
+index 9a60c5ec20725..890f5bfebb030 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-g12b-radxa-zero2.dts
++++ b/arch/arm64/boot/dts/amlogic/meson-g12b-radxa-zero2.dts
+@@ -360,7 +360,7 @@
+ pinctrl-0 = <&pwm_e_pins>;
+ pinctrl-names = "default";
+ clocks = <&xtal>;
+- clock-names = "clkin2";
++ clock-names = "clkin0";
+ status = "okay";
+ };
+
+@@ -368,7 +368,7 @@
+ pinctrl-0 = <&pwm_ao_a_pins>;
+ pinctrl-names = "default";
+ clocks = <&xtal>;
+- clock-names = "clkin3";
++ clock-names = "clkin0";
+ status = "okay";
+ };
+
+@@ -376,7 +376,7 @@
+ pinctrl-0 = <&pwm_ao_d_e_pins>;
+ pinctrl-names = "default";
+ clocks = <&xtal>;
+- clock-names = "clkin4";
++ clock-names = "clkin1";
+ status = "okay";
+ };
+
+--
+2.39.2
+
--- /dev/null
+From 8aa732b92d4e4c294488a820666ba3032942e438 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Feb 2023 15:07:22 +0100
+Subject: arm64: dts: apple: t8103: Disable unused PCIe ports
+
+From: Janne Grunau <j@jannau.net>
+
+[ Upstream commit a0189fdfb73dac856b8fa9b9f9581e5099c9391f ]
+
+The PCIe ports are unused (without devices) so disable them instead of
+removing them.
+
+Fixes: 7c77ab91b33d ("arm64: dts: apple: Add missing M1 (t8103) devices")
+Signed-off-by: Janne Grunau <j@jannau.net>
+Reviewed-by: Sven Peter <sven@svenpeter.dev>
+Signed-off-by: Hector Martin <marcan@marcan.st>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/apple/t8103-j274.dts | 10 ++++++++++
+ arch/arm64/boot/dts/apple/t8103-j293.dts | 15 ---------------
+ arch/arm64/boot/dts/apple/t8103-j313.dts | 15 ---------------
+ arch/arm64/boot/dts/apple/t8103-j456.dts | 10 ++++++++++
+ arch/arm64/boot/dts/apple/t8103-j457.dts | 11 +++--------
+ arch/arm64/boot/dts/apple/t8103.dtsi | 4 ++++
+ 6 files changed, 27 insertions(+), 38 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/apple/t8103-j274.dts b/arch/arm64/boot/dts/apple/t8103-j274.dts
+index b52ddc4098939..1c3e37f86d46d 100644
+--- a/arch/arm64/boot/dts/apple/t8103-j274.dts
++++ b/arch/arm64/boot/dts/apple/t8103-j274.dts
+@@ -37,10 +37,12 @@
+
+ &port01 {
+ bus-range = <2 2>;
++ status = "okay";
+ };
+
+ &port02 {
+ bus-range = <3 3>;
++ status = "okay";
+ ethernet0: ethernet@0,0 {
+ reg = <0x30000 0x0 0x0 0x0 0x0>;
+ /* To be filled by the loader */
+@@ -48,6 +50,14 @@
+ };
+ };
+
++&pcie0_dart_1 {
++ status = "okay";
++};
++
++&pcie0_dart_2 {
++ status = "okay";
++};
++
+ &i2c2 {
+ status = "okay";
+ };
+diff --git a/arch/arm64/boot/dts/apple/t8103-j293.dts b/arch/arm64/boot/dts/apple/t8103-j293.dts
+index 151074109a114..c363dfef80709 100644
+--- a/arch/arm64/boot/dts/apple/t8103-j293.dts
++++ b/arch/arm64/boot/dts/apple/t8103-j293.dts
+@@ -25,21 +25,6 @@
+ brcm,board-type = "apple,honshu";
+ };
+
+-/*
+- * Remove unused PCIe ports and disable the associated DARTs.
+- */
+-
+-&pcie0_dart_1 {
+- status = "disabled";
+-};
+-
+-&pcie0_dart_2 {
+- status = "disabled";
+-};
+-
+-/delete-node/ &port01;
+-/delete-node/ &port02;
+-
+ &i2c2 {
+ status = "okay";
+ };
+diff --git a/arch/arm64/boot/dts/apple/t8103-j313.dts b/arch/arm64/boot/dts/apple/t8103-j313.dts
+index bc1f865aa7909..08409be1cf357 100644
+--- a/arch/arm64/boot/dts/apple/t8103-j313.dts
++++ b/arch/arm64/boot/dts/apple/t8103-j313.dts
+@@ -24,18 +24,3 @@
+ &wifi0 {
+ brcm,board-type = "apple,shikoku";
+ };
+-
+-/*
+- * Remove unused PCIe ports and disable the associated DARTs.
+- */
+-
+-&pcie0_dart_1 {
+- status = "disabled";
+-};
+-
+-&pcie0_dart_2 {
+- status = "disabled";
+-};
+-
+-/delete-node/ &port01;
+-/delete-node/ &port02;
+diff --git a/arch/arm64/boot/dts/apple/t8103-j456.dts b/arch/arm64/boot/dts/apple/t8103-j456.dts
+index 2db425ceb30f6..58c8e43789b48 100644
+--- a/arch/arm64/boot/dts/apple/t8103-j456.dts
++++ b/arch/arm64/boot/dts/apple/t8103-j456.dts
+@@ -55,13 +55,23 @@
+
+ &port01 {
+ bus-range = <2 2>;
++ status = "okay";
+ };
+
+ &port02 {
+ bus-range = <3 3>;
++ status = "okay";
+ ethernet0: ethernet@0,0 {
+ reg = <0x30000 0x0 0x0 0x0 0x0>;
+ /* To be filled by the loader */
+ local-mac-address = [00 10 18 00 00 00];
+ };
+ };
++
++&pcie0_dart_1 {
++ status = "okay";
++};
++
++&pcie0_dart_2 {
++ status = "okay";
++};
+diff --git a/arch/arm64/boot/dts/apple/t8103-j457.dts b/arch/arm64/boot/dts/apple/t8103-j457.dts
+index 3821ff146c56b..152f95fd49a21 100644
+--- a/arch/arm64/boot/dts/apple/t8103-j457.dts
++++ b/arch/arm64/boot/dts/apple/t8103-j457.dts
+@@ -37,6 +37,7 @@
+
+ &port02 {
+ bus-range = <3 3>;
++ status = "okay";
+ ethernet0: ethernet@0,0 {
+ reg = <0x30000 0x0 0x0 0x0 0x0>;
+ /* To be filled by the loader */
+@@ -44,12 +45,6 @@
+ };
+ };
+
+-/*
+- * Remove unused PCIe port and disable the associated DART.
+- */
+-
+-&pcie0_dart_1 {
+- status = "disabled";
++&pcie0_dart_2 {
++ status = "okay";
+ };
+-
+-/delete-node/ &port01;
+diff --git a/arch/arm64/boot/dts/apple/t8103.dtsi b/arch/arm64/boot/dts/apple/t8103.dtsi
+index 9859219699f45..87a9c1ba6d0f4 100644
+--- a/arch/arm64/boot/dts/apple/t8103.dtsi
++++ b/arch/arm64/boot/dts/apple/t8103.dtsi
+@@ -724,6 +724,7 @@
+ interrupt-parent = <&aic>;
+ interrupts = <AIC_IRQ 699 IRQ_TYPE_LEVEL_HIGH>;
+ power-domains = <&ps_apcie_gp>;
++ status = "disabled";
+ };
+
+ pcie0_dart_2: iommu@683008000 {
+@@ -733,6 +734,7 @@
+ interrupt-parent = <&aic>;
+ interrupts = <AIC_IRQ 702 IRQ_TYPE_LEVEL_HIGH>;
+ power-domains = <&ps_apcie_gp>;
++ status = "disabled";
+ };
+
+ pcie0: pcie@690000000 {
+@@ -807,6 +809,7 @@
+ <0 0 0 2 &port01 0 0 0 1>,
+ <0 0 0 3 &port01 0 0 0 2>,
+ <0 0 0 4 &port01 0 0 0 3>;
++ status = "disabled";
+ };
+
+ port02: pci@2,0 {
+@@ -826,6 +829,7 @@
+ <0 0 0 2 &port02 0 0 0 1>,
+ <0 0 0 3 &port02 0 0 0 2>,
+ <0 0 0 4 &port02 0 0 0 3>;
++ status = "disabled";
+ };
+ };
+ };
+--
+2.39.2
+
--- /dev/null
+From 2595adf301375fab995bb71c045562c5a4ef579f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Feb 2023 15:43:59 +0100
+Subject: arm64: dts: broadcom: bcmbca: bcm4908: fix LED nodenames
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rafał Miłecki <rafal@milecki.pl>
+
+[ Upstream commit 23be9f68f933adee8163b8efc9c6bff71410cc7c ]
+
+This fixes:
+arch/arm64/boot/dts/broadcom/bcmbca/bcm4908-asus-gt-ac5300.dtb: leds@800: 'led-lan@19', 'led-power@11', 'led-wan-red@12', 'led-wan-white@15', 'led-wps@14' do not match any of the regexes: '^led@[a-f0-9]+$', 'pinctrl-[0-9]+'
+ From schema: Documentation/devicetree/bindings/leds/leds-bcm63138.yaml
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Link: https://lore.kernel.org/all/20230228144400.21689-2-zajec5@gmail.com/
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../dts/broadcom/bcmbca/bcm4908-asus-gt-ac5300.dts | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908-asus-gt-ac5300.dts b/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908-asus-gt-ac5300.dts
+index 839ca33178b01..d94a53d68320b 100644
+--- a/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908-asus-gt-ac5300.dts
++++ b/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908-asus-gt-ac5300.dts
+@@ -120,7 +120,7 @@
+ };
+
+ &leds {
+- led-power@11 {
++ led@11 {
+ reg = <0x11>;
+ function = LED_FUNCTION_POWER;
+ color = <LED_COLOR_ID_WHITE>;
+@@ -130,7 +130,7 @@
+ pinctrl-0 = <&pins_led_17_a>;
+ };
+
+- led-wan-red@12 {
++ led@12 {
+ reg = <0x12>;
+ function = LED_FUNCTION_WAN;
+ color = <LED_COLOR_ID_RED>;
+@@ -139,7 +139,7 @@
+ pinctrl-0 = <&pins_led_18_a>;
+ };
+
+- led-wps@14 {
++ led@14 {
+ reg = <0x14>;
+ function = LED_FUNCTION_WPS;
+ color = <LED_COLOR_ID_WHITE>;
+@@ -148,7 +148,7 @@
+ pinctrl-0 = <&pins_led_20_a>;
+ };
+
+- led-wan-white@15 {
++ led@15 {
+ reg = <0x15>;
+ function = LED_FUNCTION_WAN;
+ color = <LED_COLOR_ID_WHITE>;
+@@ -157,7 +157,7 @@
+ pinctrl-0 = <&pins_led_21_a>;
+ };
+
+- led-lan@19 {
++ led@19 {
+ reg = <0x19>;
+ function = LED_FUNCTION_LAN;
+ color = <LED_COLOR_ID_WHITE>;
+--
+2.39.2
+
--- /dev/null
+From e6f684325169c572331a086fbf7914ce849325a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Feb 2023 15:43:58 +0100
+Subject: arm64: dts: broadcom: bcmbca: bcm4908: fix NAND interrupt name
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rafał Miłecki <rafal@milecki.pl>
+
+[ Upstream commit 5cca02449490e767289bda38db1577e2c375c084 ]
+
+This fixes:
+arch/arm64/boot/dts/broadcom/bcmbca/bcm94908.dtb: nand-controller@1800: interrupt-names:0: 'nand_ctlrdy' was expected
+ From schema: Documentation/devicetree/bindings/mtd/brcm,brcmnand.yaml
+arch/arm64/boot/dts/broadcom/bcmbca/bcm94908.dtb: nand-controller@1800: Unevaluated properties are not allowed ('interrupt-names' was unexpected)
+ From schema: Documentation/devicetree/bindings/mtd/brcm,brcmnand.yaml
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Link: https://lore.kernel.org/all/20230228144400.21689-1-zajec5@gmail.com/
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/broadcom/bcmbca/bcm4908.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908.dtsi b/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908.dtsi
+index eb2a78f4e0332..af5dc04aa1878 100644
+--- a/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908.dtsi
++++ b/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908.dtsi
+@@ -538,7 +538,7 @@
+ reg = <0x1800 0x600>, <0x2000 0x10>;
+ reg-names = "nand", "nand-int-base";
+ interrupts = <GIC_SPI 37 IRQ_TYPE_LEVEL_HIGH>;
+- interrupt-names = "nand";
++ interrupt-names = "nand_ctlrdy";
+ status = "okay";
+
+ nandcs: nand@0 {
+--
+2.39.2
+
--- /dev/null
+From 0e5c5075a7c06a7881ea9ee3fc78fbdcdf416a8d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Feb 2023 15:44:00 +0100
+Subject: arm64: dts: broadcom: bcmbca: bcm4908: fix procmon nodename
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rafał Miłecki <rafal@milecki.pl>
+
+[ Upstream commit f16a8294dd7a02c7ad042cd2e3acc5ea06698dc1 ]
+
+This fixes:
+arch/arm64/boot/dts/broadcom/bcmbca/bcm94908.dtb: syscon@280000: $nodename:0: 'syscon@280000' does not match '^([a-z][a-z0-9\\-]+-bus|bus|localbus|soc|axi|ahb|apb)(@.+)?$'
+ From schema: schemas/simple-bus.yaml
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Link: https://lore.kernel.org/all/20230228144400.21689-3-zajec5@gmail.com/
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/broadcom/bcmbca/bcm4908.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908.dtsi b/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908.dtsi
+index af5dc04aa1878..343b320cbd746 100644
+--- a/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908.dtsi
++++ b/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908.dtsi
+@@ -254,7 +254,7 @@
+ };
+ };
+
+- procmon: syscon@280000 {
++ procmon: bus@280000 {
+ compatible = "simple-bus";
+ reg = <0x280000 0x1000>;
+ ranges;
+--
+2.39.2
+
--- /dev/null
+From a4886460e2d40a6568aa6013a4244d7711687c3a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Feb 2023 16:54:22 +0100
+Subject: arm64: dts: imx8mp: Drop simple-bus from fsl,imx8mp-media-blk-ctrl
+
+From: Marek Vasut <marex@denx.de>
+
+[ Upstream commit 5a51e1f2b083423f75145c512ee284862ab33854 ]
+
+This block should not be compatible with simple-bus and misuse it that way.
+Instead, the driver should scan its subnodes and bind drivers to them.
+
+Reviewed-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Reviewed-by: Liu Ying <victor.liu@nxp.com>
+Tested-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Fixes: 94e6197dadc9 ("arm64: dts: imx8mp: Add LCDIF2 & LDB nodes")
+Signed-off-by: Marek Vasut <marex@denx.de>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/imx8mp.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8mp.dtsi b/arch/arm64/boot/dts/freescale/imx8mp.dtsi
+index a237275ee0179..3f9d67341484b 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mp.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx8mp.dtsi
+@@ -1151,7 +1151,7 @@
+
+ media_blk_ctrl: blk-ctrl@32ec0000 {
+ compatible = "fsl,imx8mp-media-blk-ctrl",
+- "simple-bus", "syscon";
++ "syscon";
+ reg = <0x32ec0000 0x10000>;
+ #address-cells = <1>;
+ #size-cells = <1>;
+--
+2.39.2
+
--- /dev/null
+From 88075bfe5662bccd3868ddcae7b2ec56c068cf8e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Mar 2023 10:55:15 +0100
+Subject: arm64: dts: mediatek: mt8192-asurada: Fix voltage constraint for Vgpu
+
+From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+
+[ Upstream commit ff4c868ba8df9dcd144ab4943a50adca1cf33ba2 ]
+
+The MT8192 SoC specifies a maximum voltage for the GPU's digital supply
+of 0.88V and the GPU OPPs are declaring a maximum voltage of 0.80V.
+
+In order to keep the GPU voltage in the safe range, change the maximum
+voltage for mt6315@7's vbuck1 to 0.80V as sending, for any mistake,
+1.193V would be catastrophic.
+
+Fixes: 3183cb62b033 ("arm64: dts: mediatek: asurada: Add SPMI regulators")
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Reviewed-by: Chen-yu Tsai <wenst@chromium.org>
+Tested-by: Chen-Yu Tsai <wenst@chromium.org>
+Link: https://lore.kernel.org/r/20230301095523.428461-12-angelogioacchino.delregno@collabora.com
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8192-asurada.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8192-asurada.dtsi b/arch/arm64/boot/dts/mediatek/mt8192-asurada.dtsi
+index 9f12257ab4e7a..41f9692cbcd47 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8192-asurada.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8192-asurada.dtsi
+@@ -1400,7 +1400,7 @@
+ regulator-compatible = "vbuck1";
+ regulator-name = "Vgpu";
+ regulator-min-microvolt = <606250>;
+- regulator-max-microvolt = <1193750>;
++ regulator-max-microvolt = <800000>;
+ regulator-enable-ramp-delay = <256>;
+ regulator-allowed-modes = <0 1 2>;
+ };
+--
+2.39.2
+
--- /dev/null
+From aa2449a94053851565eb5d80d34f1146e2d38dc1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 12 Mar 2023 19:36:22 +0100
+Subject: arm64: dts: qcom: apq8096-db820c: drop unit address from PMI8994
+ regulator
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit ec57cbce1a6d9384f8ac1ff966b204dc262f4927 ]
+
+The PMIC regulators are not supposed to have unit addresses.
+
+Fixes: 2317b87a2a6f ("arm64: dts: qcom: db820c: Add vdd_gfx and tie it into mmcc")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230312183622.460488-8-krzysztof.kozlowski@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/apq8096-db820c.dts | 3 +--
+ arch/arm64/boot/dts/qcom/pmi8994.dtsi | 2 --
+ 2 files changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/apq8096-db820c.dts b/arch/arm64/boot/dts/qcom/apq8096-db820c.dts
+index fe6c415e82297..5251dbcab4d90 100644
+--- a/arch/arm64/boot/dts/qcom/apq8096-db820c.dts
++++ b/arch/arm64/boot/dts/qcom/apq8096-db820c.dts
+@@ -706,8 +706,7 @@
+ &pmi8994_spmi_regulators {
+ vdd_s2-supply = <&vph_pwr>;
+
+- vdd_gfx: s2@1700 {
+- reg = <0x1700 0x100>;
++ vdd_gfx: s2 {
+ regulator-name = "VDD_GFX";
+ regulator-min-microvolt = <980000>;
+ regulator-max-microvolt = <980000>;
+diff --git a/arch/arm64/boot/dts/qcom/pmi8994.dtsi b/arch/arm64/boot/dts/qcom/pmi8994.dtsi
+index a0af91698d497..0192968f4d9b3 100644
+--- a/arch/arm64/boot/dts/qcom/pmi8994.dtsi
++++ b/arch/arm64/boot/dts/qcom/pmi8994.dtsi
+@@ -49,8 +49,6 @@
+
+ pmi8994_spmi_regulators: regulators {
+ compatible = "qcom,pmi8994-regulators";
+- #address-cells = <1>;
+- #size-cells = <1>;
+ };
+
+ pmi8994_wled: wled@d800 {
+--
+2.39.2
+
--- /dev/null
+From 5f292fb64b0ea17767e2376f93c3c5db56024e63 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Feb 2023 22:17:42 +0530
+Subject: arm64: dts: qcom: ipq6018: Fix the PCI I/O port range
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+
+[ Upstream commit 75a6e1fdb351189f55097741e8460ca3f9b2883f ]
+
+For 64KiB of the I/O region, the I/O ports of the legacy PCI devices are
+located in the range of 0x0 to 0x10000. Hence, fix the bogus PCI address
+(0x20200000) specified in the ranges property for I/O region.
+
+While at it, let's use the missing 0x prefix for the addresses.
+
+Fixes: 095bbdd9a5c3 ("arm64: dts: qcom: ipq6018: Add pcie support")
+Reported-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/linux-arm-msm/7c5dfa87-41df-4ba7-b0e4-72c8386402a8@app.fastmail.com/
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Reviewed-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230228164752.55682-7-manivannan.sadhasivam@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/ipq6018.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/ipq6018.dtsi b/arch/arm64/boot/dts/qcom/ipq6018.dtsi
+index bbd94025ff5d8..9ff4e9d45065b 100644
+--- a/arch/arm64/boot/dts/qcom/ipq6018.dtsi
++++ b/arch/arm64/boot/dts/qcom/ipq6018.dtsi
+@@ -738,8 +738,8 @@
+ phys = <&pcie_phy0>;
+ phy-names = "pciephy";
+
+- ranges = <0x81000000 0 0x20200000 0 0x20200000 0 0x10000>,
+- <0x82000000 0 0x20220000 0 0x20220000 0 0xfde0000>;
++ ranges = <0x81000000 0x0 0x00000000 0x0 0x20200000 0x0 0x10000>,
++ <0x82000000 0x0 0x20220000 0x0 0x20220000 0x0 0xfde0000>;
+
+ interrupts = <GIC_SPI 52 IRQ_TYPE_LEVEL_HIGH>;
+ interrupt-names = "msi";
+--
+2.39.2
+
--- /dev/null
+From b426a700c4a330c7b99b6fdd7df046fc1e6da314 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Feb 2023 22:17:41 +0530
+Subject: arm64: dts: qcom: ipq8074: Fix the PCI I/O port range
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+
+[ Upstream commit e49eafefe5ab325e38dd074f2005076ffc271e54 ]
+
+For 64KiB of the I/O region, the I/O ports of the legacy PCI devices are
+located in the range of 0x0 to 0x10000. Hence, fix the bogus PCI addresses
+(0x10200000, 0x20200000) specified in the ranges property for I/O region.
+
+While at it, let's use the missing 0x prefix for the addresses and align
+them in a single line.
+
+Fixes: 33057e1672fe ("ARM: dts: ipq8074: Add pcie nodes")
+Reported-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/linux-arm-msm/7c5dfa87-41df-4ba7-b0e4-72c8386402a8@app.fastmail.com/
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Reviewed-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230228164752.55682-6-manivannan.sadhasivam@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/ipq8074.dtsi | 12 ++++--------
+ 1 file changed, 4 insertions(+), 8 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/ipq8074.dtsi b/arch/arm64/boot/dts/qcom/ipq8074.dtsi
+index 62d05d740646b..e8dad3ff4fcc7 100644
+--- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi
++++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi
+@@ -780,10 +780,8 @@
+ phys = <&pcie_phy1>;
+ phy-names = "pciephy";
+
+- ranges = <0x81000000 0 0x10200000 0x10200000
+- 0 0x10000>, /* downstream I/O */
+- <0x82000000 0 0x10220000 0x10220000
+- 0 0xfde0000>; /* non-prefetchable memory */
++ ranges = <0x81000000 0x0 0x00000000 0x10200000 0x0 0x10000>, /* I/O */
++ <0x82000000 0x0 0x10220000 0x10220000 0x0 0xfde0000>; /* MEM */
+
+ interrupts = <GIC_SPI 85 IRQ_TYPE_LEVEL_HIGH>;
+ interrupt-names = "msi";
+@@ -844,10 +842,8 @@
+ phys = <&pcie_phy0>;
+ phy-names = "pciephy";
+
+- ranges = <0x81000000 0 0x20200000 0x20200000
+- 0 0x10000>, /* downstream I/O */
+- <0x82000000 0 0x20220000 0x20220000
+- 0 0xfde0000>; /* non-prefetchable memory */
++ ranges = <0x81000000 0x0 0x00000000 0x20200000 0x0 0x10000>, /* I/O */
++ <0x82000000 0x0 0x20220000 0x20220000 0x0 0xfde0000>; /* MEM */
+
+ interrupts = <GIC_SPI 52 IRQ_TYPE_LEVEL_HIGH>;
+ interrupt-names = "msi";
+--
+2.39.2
+
--- /dev/null
+From 0c4d1d2db0282764734fab3cea6d7231aaf4c501 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Mar 2023 13:36:17 +0100
+Subject: arm64: dts: qcom: msm8916: Fix tsens_mode unit address
+
+From: Stephan Gerhold <stephan.gerhold@kernkonzept.com>
+
+[ Upstream commit 608465f798bb3eaf6773a49b893902860858e294 ]
+
+The reg address of the tsens_mode nvmem cell is correct but the unit
+address does not match (0xec vs 0xef). Fix it. No functional change.
+
+Fixes: 24aafd041fb2 ("arm64: dts: qcom: msm8916: specify per-sensor calibration cells")
+Signed-off-by: Stephan Gerhold <stephan.gerhold@kernkonzept.com>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230308123617.101211-1-stephan.gerhold@kernkonzept.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/msm8916.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/msm8916.dtsi b/arch/arm64/boot/dts/qcom/msm8916.dtsi
+index 0733c2f4f3798..0d5283805f42c 100644
+--- a/arch/arm64/boot/dts/qcom/msm8916.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8916.dtsi
+@@ -503,7 +503,7 @@
+ bits = <1 7>;
+ };
+
+- tsens_mode: mode@ec {
++ tsens_mode: mode@ef {
+ reg = <0xef 0x1>;
+ bits = <5 3>;
+ };
+--
+2.39.2
+
--- /dev/null
+From 502ec4507e586c6c2ef54f09339f0141e367459a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Mar 2023 13:30:49 +0100
+Subject: arm64: dts: qcom: msm8976: Add and provide xo clk to rpmcc
+
+From: Adam Skladowski <a39.skl@gmail.com>
+
+[ Upstream commit 4a2c9b9e1215c557c17a48e3fabe9b1674c1d608 ]
+
+In order for consumers of RPMCC XO clock to probe successfully
+their parent needs to be feed with reference clock to obtain proper rate,
+add fixed xo-board clock and supply it to rpmcc to make consumers happy.
+Frequency setting is left per board basis just like on other recent trees.
+
+Fixes: 0484d3ce0902 ("arm64: dts: qcom: Add DTS for MSM8976 and MSM8956 SoCs")
+Fixes: ff7f6d34ca07 ("arm64: dts: qcom: Add support for SONY Xperia X/X Compact")
+Signed-off-by: Adam Skladowski <a39.skl@gmail.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+[bjorn: Squashed the two patches]
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230302123051.12440-1-a39.skl@gmail.com
+Link: https://lore.kernel.org/r/20230302123051.12440-2-a39.skl@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/msm8956-sony-xperia-loire.dtsi | 4 ++++
+ arch/arm64/boot/dts/qcom/msm8976.dtsi | 9 +++++++++
+ 2 files changed, 13 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/qcom/msm8956-sony-xperia-loire.dtsi b/arch/arm64/boot/dts/qcom/msm8956-sony-xperia-loire.dtsi
+index 67baced639c91..085d79542e1bb 100644
+--- a/arch/arm64/boot/dts/qcom/msm8956-sony-xperia-loire.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8956-sony-xperia-loire.dtsi
+@@ -280,3 +280,7 @@
+ vdda3p3-supply = <&pm8950_l13>;
+ status = "okay";
+ };
++
++&xo_board {
++ clock-frequency = <19200000>;
++};
+diff --git a/arch/arm64/boot/dts/qcom/msm8976.dtsi b/arch/arm64/boot/dts/qcom/msm8976.dtsi
+index 2d360d05aa5ef..e55baafd9efd0 100644
+--- a/arch/arm64/boot/dts/qcom/msm8976.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8976.dtsi
+@@ -20,6 +20,13 @@
+
+ chosen { };
+
++ clocks {
++ xo_board: xo-board {
++ compatible = "fixed-clock";
++ #clock-cells = <0>;
++ };
++ };
++
+ cpus {
+ #address-cells = <1>;
+ #size-cells = <0>;
+@@ -351,6 +358,8 @@
+
+ rpmcc: clock-controller {
+ compatible = "qcom,rpmcc-msm8976", "qcom,rpmcc";
++ clocks = <&xo_board>;
++ clock-names = "xo";
+ #clock-cells = <1>;
+ };
+
+--
+2.39.2
+
--- /dev/null
+From a443883d73141d3236229a8c04f4456d6c6f3ac4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Jan 2023 21:04:13 +0100
+Subject: arm64: dts: qcom: msm8994-angler: Fix cont_splash_mem mapping
+
+From: Petr Vorel <pvorel@suse.cz>
+
+[ Upstream commit fe88480a6be92ecbf6f205ff3a7d7e5ded0562dd ]
+
+Angler's cont_splash_mem mapping is shorter in downstream [1],
+therefore 380cd3a34b7f was wrong. Obviously also 0e5ded926f2a was wrong
+(workaround which fixed booting at the time).
+
+This fixes error:
+[ 0.000000] memory@3401000 (0x0000000003401000--0x0000000005601000) overlaps with tzapp@4800000 (0x0000000004800000--0x0000000006100000)
+
+[1] https://android.googlesource.com/kernel/msm/+/refs/heads/android-msm-angler-3.10-marshmallow-mr1/arch/arm64/boot/dts/huawei/huawei_msm8994_angler_row_vn1/huawei-fingerprint.dtsi#16
+
+Fixes: 380cd3a34b7f ("arm64: dts: msm8994-angler: fix the memory map")
+Fixes: 0e5ded926f2a ("arm64: dts: qcom: msm8994-angler: Disable cont_splash_mem")
+
+Signed-off-by: Petr Vorel <pvorel@suse.cz>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230131200414.24373-2-pvorel@suse.cz
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/msm8994-huawei-angler-rev-101.dts | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/msm8994-huawei-angler-rev-101.dts b/arch/arm64/boot/dts/qcom/msm8994-huawei-angler-rev-101.dts
+index 7b0f62144c3ee..59b9ed78cf0cb 100644
+--- a/arch/arm64/boot/dts/qcom/msm8994-huawei-angler-rev-101.dts
++++ b/arch/arm64/boot/dts/qcom/msm8994-huawei-angler-rev-101.dts
+@@ -2,7 +2,7 @@
+ /*
+ * Copyright (c) 2015, Huawei Inc. All rights reserved.
+ * Copyright (c) 2016, The Linux Foundation. All rights reserved.
+- * Copyright (c) 2021-2022, Petr Vorel <petr.vorel@gmail.com>
++ * Copyright (c) 2021-2023, Petr Vorel <petr.vorel@gmail.com>
+ */
+
+ /dts-v1/;
+@@ -31,6 +31,11 @@
+ #size-cells = <2>;
+ ranges;
+
++ cont_splash_mem: memory@3401000 {
++ reg = <0 0x03401000 0 0x1000000>;
++ no-map;
++ };
++
+ tzapp_mem: tzapp@4800000 {
+ reg = <0 0x04800000 0 0x1900000>;
+ no-map;
+--
+2.39.2
+
--- /dev/null
+From 3d52e304ec701aa3300b86c1e6b44d050edc6e73 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Jan 2023 21:04:14 +0100
+Subject: arm64: dts: qcom: msm8994-angler: removed clash with smem_region
+
+From: Petr Vorel <pvorel@suse.cz>
+
+[ Upstream commit c85c8a992794dfcd7cea7a41871710c27c5592a6 ]
+
+This fixes memory overlap error:
+[ 0.000000] reserved@6300000 (0x0000000006300000--0x0000000007000000) overlaps with smem_region@6a00000 (0x0000000006a00000--0x0000000006c00000)
+
+smem_region is the same as in downstream (qcom,smem) [1], therefore
+split reserved memory into two sections on either side of smem_region.
+
+Not adding labels as it's not expected to be used.
+
+[1] https://android.googlesource.com/kernel/msm/+/refs/heads/android-msm-angler-3.10-marshmallow-mr1/arch/arm/boot/dts/qcom/msm8994.dtsi#948
+
+Fixes: 380cd3a34b7f ("arm64: dts: msm8994-angler: fix the memory map")
+
+Signed-off-by: Petr Vorel <pvorel@suse.cz>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230131200414.24373-3-pvorel@suse.cz
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/msm8992-lg-bullhead.dtsi | 5 -----
+ arch/arm64/boot/dts/qcom/msm8994-huawei-angler-rev-101.dts | 4 ++--
+ arch/arm64/boot/dts/qcom/msm8994.dtsi | 5 +++++
+ 3 files changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/msm8992-lg-bullhead.dtsi b/arch/arm64/boot/dts/qcom/msm8992-lg-bullhead.dtsi
+index cd77dcb558722..b8f2a01bcb96c 100644
+--- a/arch/arm64/boot/dts/qcom/msm8992-lg-bullhead.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8992-lg-bullhead.dtsi
+@@ -60,11 +60,6 @@
+ reg = <0x0 0x05000000 0x0 0x1a00000>;
+ no-map;
+ };
+-
+- reserved@6c00000 {
+- reg = <0x0 0x06c00000 0x0 0x400000>;
+- no-map;
+- };
+ };
+ };
+
+diff --git a/arch/arm64/boot/dts/qcom/msm8994-huawei-angler-rev-101.dts b/arch/arm64/boot/dts/qcom/msm8994-huawei-angler-rev-101.dts
+index 59b9ed78cf0cb..29e79ae0849d8 100644
+--- a/arch/arm64/boot/dts/qcom/msm8994-huawei-angler-rev-101.dts
++++ b/arch/arm64/boot/dts/qcom/msm8994-huawei-angler-rev-101.dts
+@@ -41,8 +41,8 @@
+ no-map;
+ };
+
+- removed_region: reserved@6300000 {
+- reg = <0 0x06300000 0 0xD00000>;
++ reserved@6300000 {
++ reg = <0 0x06300000 0 0x700000>;
+ no-map;
+ };
+ };
+diff --git a/arch/arm64/boot/dts/qcom/msm8994.dtsi b/arch/arm64/boot/dts/qcom/msm8994.dtsi
+index 9ff9d35496d21..24c3fced8df71 100644
+--- a/arch/arm64/boot/dts/qcom/msm8994.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8994.dtsi
+@@ -228,6 +228,11 @@
+ reg = <0 0xc9400000 0 0x3f00000>;
+ no-map;
+ };
++
++ reserved@6c00000 {
++ reg = <0 0x06c00000 0 0x400000>;
++ no-map;
++ };
+ };
+
+ smd {
+--
+2.39.2
+
--- /dev/null
+From e89f0e0a567df018a37417448bc08ac5764d716c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 12 Mar 2023 19:36:20 +0100
+Subject: arm64: dts: qcom: msm8994-kitakami: drop unit address from PMI8994
+ regulator
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit 3555dd528ba9c08d6ccd56239c695dbeac3b63e3 ]
+
+The PMIC regulators are not supposed to have unit addresses.
+
+Fixes: e9783584c9b7 ("arm64: dts: qcom: msm8994-kitakami: Add VDD_GFX regulator")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230312183622.460488-6-krzysztof.kozlowski@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/msm8994-sony-xperia-kitakami.dtsi | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/msm8994-sony-xperia-kitakami.dtsi b/arch/arm64/boot/dts/qcom/msm8994-sony-xperia-kitakami.dtsi
+index 3ceb86b06209a..26059f861250f 100644
+--- a/arch/arm64/boot/dts/qcom/msm8994-sony-xperia-kitakami.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8994-sony-xperia-kitakami.dtsi
+@@ -173,8 +173,7 @@
+ * power domain.. which still isn't enough and forces us to bind
+ * OXILI_CX and OXILI_GX together!
+ */
+- vdd_gfx: s2@1700 {
+- reg = <0x1700 0x100>;
++ vdd_gfx: s2 {
+ regulator-name = "VDD_GFX";
+ regulator-min-microvolt = <980000>;
+ regulator-max-microvolt = <980000>;
+--
+2.39.2
+
--- /dev/null
+From bf7c539694750cdd02a711321027f4d319c7f9ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 12 Mar 2023 19:36:21 +0100
+Subject: arm64: dts: qcom: msm8994-msft-lumia-octagon: drop unit address from
+ PMI8994 regulator
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit 7a202df0f3eed006e4a9e7c06d62cf67be56c14c ]
+
+The PMIC regulators are not supposed to have unit addresses.
+
+Fixes: 60b214effb80 ("arm64: dts: qcom: msm8994-octagon: Configure regulators")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230312183622.460488-7-krzysztof.kozlowski@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/msm8994-msft-lumia-octagon.dtsi | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/msm8994-msft-lumia-octagon.dtsi b/arch/arm64/boot/dts/qcom/msm8994-msft-lumia-octagon.dtsi
+index 4520a7e86d5be..0c112b7b57ea1 100644
+--- a/arch/arm64/boot/dts/qcom/msm8994-msft-lumia-octagon.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8994-msft-lumia-octagon.dtsi
+@@ -542,8 +542,7 @@
+ };
+
+ &pmi8994_spmi_regulators {
+- vdd_gfx: s2@1700 {
+- reg = <0x1700 0x100>;
++ vdd_gfx: s2 {
+ regulator-min-microvolt = <980000>;
+ regulator-max-microvolt = <980000>;
+ };
+--
+2.39.2
+
--- /dev/null
+From a4c6b8ac02bc57b8a076e154ddfdbe85c9cb43ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Feb 2023 22:17:43 +0530
+Subject: arm64: dts: qcom: msm8996: Fix the PCI I/O port range
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+
+[ Upstream commit cf0ac10feb17661987d0018eb9475dc03e2a2253 ]
+
+For 1MiB of the I/O region, the I/O ports of the legacy PCI devices are
+located in the range of 0x0 to 0x100000. Hence, fix the bogus PCI addresses
+(0x0c200000, 0x0d200000, 0x0e200000) specified in the ranges property for
+I/O region.
+
+While at it, let's also align the entries.
+
+Fixes: ed965ef89227 ("arm64: dts: qcom: msm8996: add support to pcie")
+Reported-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/linux-arm-msm/7c5dfa87-41df-4ba7-b0e4-72c8386402a8@app.fastmail.com/
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Reviewed-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230228164752.55682-8-manivannan.sadhasivam@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/msm8996.dtsi | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/msm8996.dtsi b/arch/arm64/boot/dts/qcom/msm8996.dtsi
+index 905678e7175d8..66af9526c98ba 100644
+--- a/arch/arm64/boot/dts/qcom/msm8996.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8996.dtsi
+@@ -1851,8 +1851,8 @@
+
+ #address-cells = <3>;
+ #size-cells = <2>;
+- ranges = <0x01000000 0x0 0x0c200000 0x0c200000 0x0 0x100000>,
+- <0x02000000 0x0 0x0c300000 0x0c300000 0x0 0xd00000>;
++ ranges = <0x01000000 0x0 0x00000000 0x0c200000 0x0 0x100000>,
++ <0x02000000 0x0 0x0c300000 0x0c300000 0x0 0xd00000>;
+
+ device_type = "pci";
+
+@@ -1905,8 +1905,8 @@
+
+ #address-cells = <3>;
+ #size-cells = <2>;
+- ranges = <0x01000000 0x0 0x0d200000 0x0d200000 0x0 0x100000>,
+- <0x02000000 0x0 0x0d300000 0x0d300000 0x0 0xd00000>;
++ ranges = <0x01000000 0x0 0x00000000 0x0d200000 0x0 0x100000>,
++ <0x02000000 0x0 0x0d300000 0x0d300000 0x0 0xd00000>;
+
+ device_type = "pci";
+
+@@ -1956,8 +1956,8 @@
+
+ #address-cells = <3>;
+ #size-cells = <2>;
+- ranges = <0x01000000 0x0 0x0e200000 0x0e200000 0x0 0x100000>,
+- <0x02000000 0x0 0x0e300000 0x0e300000 0x0 0x1d00000>;
++ ranges = <0x01000000 0x0 0x00000000 0x0e200000 0x0 0x100000>,
++ <0x02000000 0x0 0x0e300000 0x0e300000 0x0 0x1d00000>;
+
+ device_type = "pci";
+
+--
+2.39.2
+
--- /dev/null
+From 2a0e32741a11ab9b0233220f4f2a40ab6a36a93e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Feb 2023 22:03:31 +0100
+Subject: arm64: dts: qcom: msm8998: Fix stm-stimulus-base reg name
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit b5d08f08377218b1d2ab4026e427a7788b271c8e ]
+
+The name stm-data-base comes from ancient (msm-3.10 or older)
+downstream kernels. Upstream uses stm-stimulus-base instead. Fix it.
+
+Fixes: 783abfa2249a ("arm64: dts: qcom: msm8998: Add Coresight support")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230213210331.2106877-1-konrad.dybcio@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/msm8998.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/msm8998.dtsi b/arch/arm64/boot/dts/qcom/msm8998.dtsi
+index 8bc1c59127e50..adf7258b32695 100644
+--- a/arch/arm64/boot/dts/qcom/msm8998.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8998.dtsi
+@@ -1524,7 +1524,7 @@
+ compatible = "arm,coresight-stm", "arm,primecell";
+ reg = <0x06002000 0x1000>,
+ <0x16280000 0x180000>;
+- reg-names = "stm-base", "stm-data-base";
++ reg-names = "stm-base", "stm-stimulus-base";
+ status = "disabled";
+
+ clocks = <&rpmcc RPM_SMD_QDSS_CLK>, <&rpmcc RPM_SMD_QDSS_A_CLK>;
+--
+2.39.2
+
--- /dev/null
+From e58982faade83b38b5360851e6a5835894e8cbfb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Feb 2023 22:17:38 +0530
+Subject: arm64: dts: qcom: msm8998: Fix the PCI I/O port range
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+
+[ Upstream commit c30a27dcfe4545edbda1578b3a63ed6147519cdd ]
+
+For 1MiB of the I/O region, the I/O ports of the legacy PCI devices are
+located in the range of 0x0 to 0x100000. Hence, fix the bogus PCI address
+(0x1b200000) specified in the ranges property for I/O region.
+
+Fixes: b84dfd175c09 ("arm64: dts: qcom: msm8998: Add PCIe PHY and RC nodes")
+Reported-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/linux-arm-msm/7c5dfa87-41df-4ba7-b0e4-72c8386402a8@app.fastmail.com/
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Reviewed-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230228164752.55682-3-manivannan.sadhasivam@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/msm8998.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/msm8998.dtsi b/arch/arm64/boot/dts/qcom/msm8998.dtsi
+index adf7258b32695..2a2cfa905f5e0 100644
+--- a/arch/arm64/boot/dts/qcom/msm8998.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8998.dtsi
+@@ -922,7 +922,7 @@
+ phy-names = "pciephy";
+ status = "disabled";
+
+- ranges = <0x01000000 0x0 0x1b200000 0x1b200000 0x0 0x100000>,
++ ranges = <0x01000000 0x0 0x00000000 0x1b200000 0x0 0x100000>,
+ <0x02000000 0x0 0x1b300000 0x1b300000 0x0 0xd00000>;
+
+ #interrupt-cells = <1>;
+--
+2.39.2
+
--- /dev/null
+From 742ab90e9d9a095871e7a4c98828189ba262676e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 12 Mar 2023 19:36:19 +0100
+Subject: arm64: dts: qcom: msm8998-oneplus-cheeseburger: revert "fix backlight
+ pin function"
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit 97b4fdc6b82d6d5cfb92a9b164540278720fb700 ]
+
+This reverts commit 46546f28825cf3a5ef6873b9cf947cd85c8a7258 because it
+mistakenly took PMIC pinctrl/GPIO as TLMM. The TLMM pinctrl uses "gpio"
+function, but PMIC uses "normal", so original code was correct:
+
+ msm8998-oneplus-cheeseburger.dtb: pmic@2: gpio@c000:button-backlight-state: 'oneOf' conditional failed, one must be fixed:
+ 'gpio' is not one of ['normal', 'paired', 'func1', 'func2', 'dtest1', 'dtest2', 'dtest3', 'dtest4', 'func3', 'func4']
+
+Fixes: 46546f28825c ("arm64: dts: qcom: msm8998-oneplus-cheeseburger: fix backlight pin function")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230312183622.460488-5-krzysztof.kozlowski@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/msm8998-oneplus-cheeseburger.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/msm8998-oneplus-cheeseburger.dts b/arch/arm64/boot/dts/qcom/msm8998-oneplus-cheeseburger.dts
+index d36b36af49d0b..fac8b3510cd3a 100644
+--- a/arch/arm64/boot/dts/qcom/msm8998-oneplus-cheeseburger.dts
++++ b/arch/arm64/boot/dts/qcom/msm8998-oneplus-cheeseburger.dts
+@@ -34,7 +34,7 @@
+ &pmi8998_gpios {
+ button_backlight_default: button-backlight-state {
+ pins = "gpio5";
+- function = "gpio";
++ function = "normal";
+ bias-pull-down;
+ qcom,drive-strength = <PMIC_GPIO_STRENGTH_NO>;
+ };
+--
+2.39.2
+
--- /dev/null
+From cbd4b2ef88f64037495e7c258dd98ca08984dbbe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Mar 2023 13:58:58 +0100
+Subject: arm64: dts: qcom: qdu1000: drop incorrect serial properties
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit 9b8bfc443349c0c220438c6ac8839774210c9ba2 ]
+
+The serial node does not use/allow address/size cells:
+
+ qdu1000-idp.dtb: geniqup@9c0000: serial@99c000: Unevaluated properties are not allowed ('#address-cells', '#size-cells' were unexpected)
+
+Fixes: 6bd20c54b589 ("arm64: dts: qcom: Add base QDU1000/QRU1000 DTSIs")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230308125906.236885-3-krzysztof.kozlowski@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/qdu1000.dtsi | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/qdu1000.dtsi b/arch/arm64/boot/dts/qcom/qdu1000.dtsi
+index f234159d2060e..c72a51c32a300 100644
+--- a/arch/arm64/boot/dts/qcom/qdu1000.dtsi
++++ b/arch/arm64/boot/dts/qcom/qdu1000.dtsi
+@@ -412,8 +412,6 @@
+ pinctrl-0 = <&qup_uart0_default>;
+ pinctrl-names = "default";
+ interrupts = <GIC_SPI 601 IRQ_TYPE_LEVEL_HIGH>;
+- #address-cells = <1>;
+- #size-cells = <0>;
+ status = "disabled";
+ };
+
+@@ -581,8 +579,6 @@
+ pinctrl-0 = <&qup_uart7_tx>, <&qup_uart7_rx>;
+ pinctrl-names = "default";
+ interrupts = <GIC_SPI 608 IRQ_TYPE_LEVEL_HIGH>;
+- #address-cells = <1>;
+- #size-cells = <0>;
+ status = "disabled";
+ };
+ };
+--
+2.39.2
+
--- /dev/null
+From 1efa3f0d5423eb639a9b7abba6531622d42e81ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 12 Mar 2023 19:36:17 +0100
+Subject: arm64: dts: qcom: sc7180-trogdor-lazor: correct trackpad supply
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit 52e2996f253d82520011340d40dbc1c76ea79208 ]
+
+The hid-over-i2c takes VDD, not VCC supply. Fix copy-pasta from other
+boards which use elan,ekth3000 with valid VCC:
+
+ sc7180-trogdor-lazor-limozeen-nots-r4.dtb: trackpad@2c: 'vcc-supply' does not match any of the regexes: 'pinctrl-[0-9]+'
+
+Fixes: 2c26adb8dbab ("arm64: dts: qcom: Add sc7180-lazor-limozeen skus")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230312183622.460488-3-krzysztof.kozlowski@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../boot/dts/qcom/sc7180-trogdor-lazor-limozeen-nots-r4.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sc7180-trogdor-lazor-limozeen-nots-r4.dts b/arch/arm64/boot/dts/qcom/sc7180-trogdor-lazor-limozeen-nots-r4.dts
+index 850776c5323d1..70d5a7aa88735 100644
+--- a/arch/arm64/boot/dts/qcom/sc7180-trogdor-lazor-limozeen-nots-r4.dts
++++ b/arch/arm64/boot/dts/qcom/sc7180-trogdor-lazor-limozeen-nots-r4.dts
+@@ -26,7 +26,7 @@
+ interrupt-parent = <&tlmm>;
+ interrupts = <58 IRQ_TYPE_EDGE_FALLING>;
+
+- vcc-supply = <&pp3300_fp_tp>;
++ vdd-supply = <&pp3300_fp_tp>;
+ hid-descr-addr = <0x20>;
+
+ wakeup-source;
+--
+2.39.2
+
--- /dev/null
+From 70dcfc2f78b1cad7112538c0dce1691e707e5000 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 12 Mar 2023 19:36:18 +0100
+Subject: arm64: dts: qcom: sc7180-trogdor-pazquel: correct trackpad supply
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit 24f39eec6a70768e7c2eb2f3d8158f45050ff75a ]
+
+The hid-over-i2c takes VDD, not VCC supply. Fix copy-pasta from other
+boards which use elan,ekth3000 with valid VCC:
+
+ sc7180-trogdor-pazquel360-lte.dtb: trackpad@15: 'vcc-supply' does not match any of the regexes: 'pinctrl-[0-9]+'
+
+Fixes: fb69f6adaf88 ("arm64: dts: qcom: sc7180: Add pazquel dts files")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230312183622.460488-4-krzysztof.kozlowski@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sc7180-trogdor-pazquel.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sc7180-trogdor-pazquel.dtsi b/arch/arm64/boot/dts/qcom/sc7180-trogdor-pazquel.dtsi
+index d06cc4ea33756..8823edbb4d6e2 100644
+--- a/arch/arm64/boot/dts/qcom/sc7180-trogdor-pazquel.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc7180-trogdor-pazquel.dtsi
+@@ -39,7 +39,7 @@
+ interrupt-parent = <&tlmm>;
+ interrupts = <0 IRQ_TYPE_EDGE_FALLING>;
+
+- vcc-supply = <&pp3300_fp_tp>;
++ vdd-supply = <&pp3300_fp_tp>;
+ post-power-on-delay-ms = <100>;
+ hid-descr-addr = <0x0001>;
+
+--
+2.39.2
+
--- /dev/null
+From c05f7f943b167710eadc495a76a4b072161782a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Mar 2023 13:59:05 +0100
+Subject: arm64: dts: qcom: sc7280: fix EUD port properties
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit a369c74243ca4ad60b9de0ac5c2207fb4c4117b8 ]
+
+Nodes with unit addresses must have also 'reg' property:
+
+ sc7280-herobrine-crd.dtb: eud@88e0000: ports:port@0: 'reg' is a required property
+
+Fixes: 0b059979090d ("arm64: dts: qcom: sc7280: Add EUD dt node and dwc3 connector")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Reviewed-by: Souradeep Chowdhury <quic_schowdhu@quicinc.com>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230308125906.236885-10-krzysztof.kozlowski@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sc7280.dtsi | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/qcom/sc7280.dtsi b/arch/arm64/boot/dts/qcom/sc7280.dtsi
+index 8f4ab6bd28864..c04bb158f4311 100644
+--- a/arch/arm64/boot/dts/qcom/sc7280.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc7280.dtsi
+@@ -3595,12 +3595,17 @@
+ <0 0x088e2000 0 0x1000>;
+ interrupts-extended = <&pdc 11 IRQ_TYPE_LEVEL_HIGH>;
+ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
++
+ port@0 {
++ reg = <0>;
+ eud_ep: endpoint {
+ remote-endpoint = <&usb2_role_switch>;
+ };
+ };
+ port@1 {
++ reg = <1>;
+ eud_con: endpoint {
+ remote-endpoint = <&con_eud>;
+ };
+@@ -3611,7 +3616,11 @@
+ eud_typec: connector {
+ compatible = "usb-c-connector";
+ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
++
+ port@0 {
++ reg = <0>;
+ con_eud: endpoint {
+ remote-endpoint = <&eud_con>;
+ };
+--
+2.39.2
+
--- /dev/null
+From 5f21e123e4b6f75858c3ca85e1c06a97f162859e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Feb 2023 22:17:39 +0530
+Subject: arm64: dts: qcom: sc7280: Fix the PCI I/O port range
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+
+[ Upstream commit 1d4743d6312582978966d38908b69085621b7693 ]
+
+For 1MiB of the I/O region, the I/O ports of the legacy PCI devices are
+located in the range of 0x0 to 0x100000. Hence, fix the bogus PCI address
+(0x40200000) specified in the ranges property for I/O region.
+
+Fixes: 92e0ee9f83b3 ("arm64: dts: qcom: sc7280: Add PCIe and PHY related nodes")
+Reported-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/linux-arm-msm/7c5dfa87-41df-4ba7-b0e4-72c8386402a8@app.fastmail.com/
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Reviewed-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230228164752.55682-4-manivannan.sadhasivam@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sc7280.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sc7280.dtsi b/arch/arm64/boot/dts/qcom/sc7280.dtsi
+index c04bb158f4311..98c7e534f1ab9 100644
+--- a/arch/arm64/boot/dts/qcom/sc7280.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc7280.dtsi
+@@ -2077,7 +2077,7 @@
+ #address-cells = <3>;
+ #size-cells = <2>;
+
+- ranges = <0x01000000 0x0 0x40200000 0x0 0x40200000 0x0 0x100000>,
++ ranges = <0x01000000 0x0 0x00000000 0x0 0x40200000 0x0 0x100000>,
+ <0x02000000 0x0 0x40300000 0x0 0x40300000 0x0 0x1fd00000>;
+
+ interrupts = <GIC_SPI 307 IRQ_TYPE_LEVEL_HIGH>;
+--
+2.39.2
+
--- /dev/null
+From f6e91d2a8723ece6f2ba083d6dca0dfb242d0b93 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 12 Mar 2023 19:36:16 +0100
+Subject: arm64: dts: qcom: sc7280-herobrine-villager: correct trackpad supply
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit de88b1759b35086d5e63736fb604ea2d06486b1a ]
+
+The hid-over-i2c takes VDD, not VCC supply. Fix copy-pasta from other
+Herobrine boards which use elan,ekth3000 with valid VCC:
+
+ sc7280-herobrine-villager-r1-lte.dtb: trackpad@2c: 'vcc-supply' does not match any of the regexes: 'pinctrl-[0-9]+'
+
+Fixes: ee2a62116015 ("arm64: dts: qcom: sc7280: Add device tree for herobrine villager")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230312183622.460488-2-krzysztof.kozlowski@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sc7280-herobrine-villager.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sc7280-herobrine-villager.dtsi b/arch/arm64/boot/dts/qcom/sc7280-herobrine-villager.dtsi
+index 818d4046d2c7f..38c8a3679fcb3 100644
+--- a/arch/arm64/boot/dts/qcom/sc7280-herobrine-villager.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc7280-herobrine-villager.dtsi
+@@ -33,7 +33,7 @@ ap_tp_i2c: &i2c0 {
+ interrupts = <7 IRQ_TYPE_EDGE_FALLING>;
+
+ hid-descr-addr = <0x20>;
+- vcc-supply = <&pp3300_z1>;
++ vdd-supply = <&pp3300_z1>;
+
+ wakeup-source;
+ };
+--
+2.39.2
+
--- /dev/null
+From f9933534c222fb96396d8154eaa8705a6f1cbfa7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Apr 2023 15:23:28 +0200
+Subject: arm64: dts: qcom: sc8280xp: correct Soundwire wakeup interrupt name
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit 894e258b6a38922f9860a20ca07cf2f745e3b090 ]
+
+The bindings expect second Soundwire interrupt to be "wakeup" (Linux
+driver takes by index):
+
+ sc8280xp-crd.dtb: soundwire-controller@3330000: interrupt-names:1: 'wakeup' was expected
+
+Fixes: c18773d162a6 ("arm64: dts: qcom: sc8280xp: add SoundWire and LPASS")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230403132328.61414-1-krzysztof.kozlowski@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sc8280xp.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi
+index 80401834bb063..03b679b75201d 100644
+--- a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi
+@@ -2598,7 +2598,7 @@
+ reg = <0 0x03330000 0 0x2000>;
+ interrupts-extended = <&intc GIC_SPI 959 IRQ_TYPE_LEVEL_HIGH>,
+ <&intc GIC_SPI 520 IRQ_TYPE_LEVEL_HIGH>;
+- interrupt-names = "core", "wake";
++ interrupt-names = "core", "wakeup";
+
+ clocks = <&txmacro>;
+ clock-names = "iface";
+--
+2.39.2
+
--- /dev/null
+From ac5c4acec52403b0bd54959ae664ff9e84568dbe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Mar 2023 15:12:52 +0100
+Subject: arm64: dts: qcom: sc8280xp: fix external display power domain
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+[ Upstream commit cf386126aef92256245adc8be686f2df4b837013 ]
+
+Fix the external display controller nodes which erroneously described
+the controllers as belonging to CX rather than MMCX.
+
+Fixes: 19d3bb90754f ("arm64: dts: qcom: sc8280xp: Add USB-C-related DP blocks")
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230316141252.2436-1-johan+linaro@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sc8280xp.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi
+index 60433c810f23f..80401834bb063 100644
+--- a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi
+@@ -3253,7 +3253,7 @@
+ #sound-dai-cells = <0>;
+
+ operating-points-v2 = <&mdss0_dp0_opp_table>;
+- power-domains = <&rpmhpd SC8280XP_CX>;
++ power-domains = <&rpmhpd SC8280XP_MMCX>;
+
+ status = "disabled";
+
+@@ -3331,7 +3331,7 @@
+ #sound-dai-cells = <0>;
+
+ operating-points-v2 = <&mdss0_dp1_opp_table>;
+- power-domains = <&rpmhpd SC8280XP_CX>;
++ power-domains = <&rpmhpd SC8280XP_MMCX>;
+
+ status = "disabled";
+
+--
+2.39.2
+
--- /dev/null
+From 33f4e955e6b912210054e7d8d2922c3730358369 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Feb 2023 22:17:46 +0530
+Subject: arm64: dts: qcom: sc8280xp: Fix the PCI I/O port range
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+
+[ Upstream commit 89fe81c01715f81c3a7d371e9e5f7d7ae5bc557c ]
+
+For 1MiB of the I/O region, the I/O ports of the legacy PCI devices are
+located in the range of 0x0 to 0x100000. Hence, fix the bogus PCI addresses
+(0x30200000, 0x32200000, 0x34200000, 0x38200000, 0x3c200000) specified in
+the ranges property for I/O region.
+
+Fixes: 813e83157001 ("arm64: dts: qcom: sc8280xp/sa8540p: add PCIe2-4 nodes")
+Reported-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/linux-arm-msm/7c5dfa87-41df-4ba7-b0e4-72c8386402a8@app.fastmail.com/
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Reviewed-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230228164752.55682-11-manivannan.sadhasivam@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sc8280xp.dtsi | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi
+index 42bfa9fa5b967..60433c810f23f 100644
+--- a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi
+@@ -1657,7 +1657,7 @@
+ reg-names = "parf", "dbi", "elbi", "atu", "config";
+ #address-cells = <3>;
+ #size-cells = <2>;
+- ranges = <0x01000000 0x0 0x30200000 0x0 0x30200000 0x0 0x100000>,
++ ranges = <0x01000000 0x0 0x00000000 0x0 0x30200000 0x0 0x100000>,
+ <0x02000000 0x0 0x30300000 0x0 0x30300000 0x0 0x1d00000>;
+ bus-range = <0x00 0xff>;
+
+@@ -1756,7 +1756,7 @@
+ reg-names = "parf", "dbi", "elbi", "atu", "config";
+ #address-cells = <3>;
+ #size-cells = <2>;
+- ranges = <0x01000000 0x0 0x32200000 0x0 0x32200000 0x0 0x100000>,
++ ranges = <0x01000000 0x0 0x00000000 0x0 0x32200000 0x0 0x100000>,
+ <0x02000000 0x0 0x32300000 0x0 0x32300000 0x0 0x1d00000>;
+ bus-range = <0x00 0xff>;
+
+@@ -1853,7 +1853,7 @@
+ reg-names = "parf", "dbi", "elbi", "atu", "config";
+ #address-cells = <3>;
+ #size-cells = <2>;
+- ranges = <0x01000000 0x0 0x34200000 0x0 0x34200000 0x0 0x100000>,
++ ranges = <0x01000000 0x0 0x00000000 0x0 0x34200000 0x0 0x100000>,
+ <0x02000000 0x0 0x34300000 0x0 0x34300000 0x0 0x1d00000>;
+ bus-range = <0x00 0xff>;
+
+@@ -1953,7 +1953,7 @@
+ reg-names = "parf", "dbi", "elbi", "atu", "config";
+ #address-cells = <3>;
+ #size-cells = <2>;
+- ranges = <0x01000000 0x0 0x38200000 0x0 0x38200000 0x0 0x100000>,
++ ranges = <0x01000000 0x0 0x00000000 0x0 0x38200000 0x0 0x100000>,
+ <0x02000000 0x0 0x38300000 0x0 0x38300000 0x0 0x1d00000>;
+ bus-range = <0x00 0xff>;
+
+@@ -2050,7 +2050,7 @@
+ reg-names = "parf", "dbi", "elbi", "atu", "config";
+ #address-cells = <3>;
+ #size-cells = <2>;
+- ranges = <0x01000000 0x0 0x3c200000 0x0 0x3c200000 0x0 0x100000>,
++ ranges = <0x01000000 0x0 0x00000000 0x0 0x3c200000 0x0 0x100000>,
+ <0x02000000 0x0 0x3c300000 0x0 0x3c300000 0x0 0x1d00000>;
+ bus-range = <0x00 0xff>;
+
+--
+2.39.2
+
--- /dev/null
+From 10168c0ab408a1b624222ae734c8e213c0a65ca8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Jan 2023 17:46:18 +0100
+Subject: arm64: dts: qcom: sdm845: correct dynamic power coefficients
+
+From: Vincent Guittot <vincent.guittot@linaro.org>
+
+[ Upstream commit 44750f153699b6e4f851a399287e5c8df208d696 ]
+
+While stressing EAS on my dragonboard RB3, I have noticed that LITTLE cores
+where never selected as the most energy efficient CPU whatever the
+utilization level of waking task.
+
+energy model framework uses its cost field to estimate the energy with
+the formula:
+
+ nrg = cost of the selected OPP * utilization / CPU's max capacity
+
+which ends up selecting the CPU with lowest cost / max capacity ration
+as long as the utilization fits in the OPP's capacity.
+
+If we compare the cost of a little OPP with similar capacity of a big OPP
+like :
+ OPP(kHz) OPP capacity cost max capacity cost/max capacity
+LITTLE 1766400 407 351114 407 863
+big 1056000 408 520267 1024 508
+
+This can be interpreted as the LITTLE core consumes 70% more than big core
+for the same compute capacity.
+
+According to [1], LITTLE consumes 10% less than big core for Coremark
+benchmark at those OPPs. If we consider that everything else stays
+unchanged, the dynamic-power-coefficient of LITTLE core should be
+only 53% of the current value: 290 * 53% = 154
+
+Set the dynamic-power-coefficient of CPU0-3 to 154 to fix the energy model.
+
+[1] https://github.com/kdrag0n/freqbench/tree/master/results/sdm845/main
+
+Fixes: 0e0a8e35d725 ("arm64: dts: qcom: sdm845: correct dynamic power coefficients")
+Signed-off-by: Vincent Guittot <vincent.guittot@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230106164618.1845281-1-vincent.guittot@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sdm845.dtsi | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sdm845.dtsi b/arch/arm64/boot/dts/qcom/sdm845.dtsi
+index 479859bd8ab33..ac9d327179a65 100644
+--- a/arch/arm64/boot/dts/qcom/sdm845.dtsi
++++ b/arch/arm64/boot/dts/qcom/sdm845.dtsi
+@@ -94,7 +94,7 @@
+ reg = <0x0 0x0>;
+ enable-method = "psci";
+ capacity-dmips-mhz = <611>;
+- dynamic-power-coefficient = <290>;
++ dynamic-power-coefficient = <154>;
+ qcom,freq-domain = <&cpufreq_hw 0>;
+ operating-points-v2 = <&cpu0_opp_table>;
+ interconnects = <&gladiator_noc MASTER_APPSS_PROC 3 &mem_noc SLAVE_EBI1 3>,
+@@ -120,7 +120,7 @@
+ reg = <0x0 0x100>;
+ enable-method = "psci";
+ capacity-dmips-mhz = <611>;
+- dynamic-power-coefficient = <290>;
++ dynamic-power-coefficient = <154>;
+ qcom,freq-domain = <&cpufreq_hw 0>;
+ operating-points-v2 = <&cpu0_opp_table>;
+ interconnects = <&gladiator_noc MASTER_APPSS_PROC 3 &mem_noc SLAVE_EBI1 3>,
+@@ -142,7 +142,7 @@
+ reg = <0x0 0x200>;
+ enable-method = "psci";
+ capacity-dmips-mhz = <611>;
+- dynamic-power-coefficient = <290>;
++ dynamic-power-coefficient = <154>;
+ qcom,freq-domain = <&cpufreq_hw 0>;
+ operating-points-v2 = <&cpu0_opp_table>;
+ interconnects = <&gladiator_noc MASTER_APPSS_PROC 3 &mem_noc SLAVE_EBI1 3>,
+@@ -164,7 +164,7 @@
+ reg = <0x0 0x300>;
+ enable-method = "psci";
+ capacity-dmips-mhz = <611>;
+- dynamic-power-coefficient = <290>;
++ dynamic-power-coefficient = <154>;
+ qcom,freq-domain = <&cpufreq_hw 0>;
+ operating-points-v2 = <&cpu0_opp_table>;
+ interconnects = <&gladiator_noc MASTER_APPSS_PROC 3 &mem_noc SLAVE_EBI1 3>,
+--
+2.39.2
+
--- /dev/null
+From 5b3a125cd1179107284b2f03381a8c23b41bbb5b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Feb 2023 22:17:37 +0530
+Subject: arm64: dts: qcom: sdm845: Fix the PCI I/O port range
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+
+[ Upstream commit 67aa109eee654c76dcc100554e637fa64d5aa099 ]
+
+For 1MiB of the I/O region, the I/O ports of the legacy PCI devices are
+located in the range of 0x0 to 0x100000. Hence, fix the bogus PCI addresses
+(0x60200000, 0x40200000) specified in the ranges property for I/O region.
+
+While at it, let's use the missing 0x prefix for the addresses.
+
+Fixes: 42ad231338c1 ("arm64: dts: qcom: sdm845: Add second PCIe PHY and controller")
+Fixes: 5c538e09cb19 ("arm64: dts: qcom: sdm845: Add first PCIe controller and PHY")
+Reported-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/linux-arm-msm/7c5dfa87-41df-4ba7-b0e4-72c8386402a8@app.fastmail.com/
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Reviewed-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230228164752.55682-2-manivannan.sadhasivam@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sdm845.dtsi | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sdm845.dtsi b/arch/arm64/boot/dts/qcom/sdm845.dtsi
+index ac9d327179a65..5e640e01e8518 100644
+--- a/arch/arm64/boot/dts/qcom/sdm845.dtsi
++++ b/arch/arm64/boot/dts/qcom/sdm845.dtsi
+@@ -2292,8 +2292,8 @@
+ #address-cells = <3>;
+ #size-cells = <2>;
+
+- ranges = <0x01000000 0x0 0x60200000 0 0x60200000 0x0 0x100000>,
+- <0x02000000 0x0 0x60300000 0 0x60300000 0x0 0xd00000>;
++ ranges = <0x01000000 0x0 0x00000000 0x0 0x60200000 0x0 0x100000>,
++ <0x02000000 0x0 0x60300000 0x0 0x60300000 0x0 0xd00000>;
+
+ interrupts = <GIC_SPI 141 IRQ_TYPE_LEVEL_HIGH>;
+ interrupt-names = "msi";
+@@ -2397,7 +2397,7 @@
+ #address-cells = <3>;
+ #size-cells = <2>;
+
+- ranges = <0x01000000 0x0 0x40200000 0x0 0x40200000 0x0 0x100000>,
++ ranges = <0x01000000 0x0 0x00000000 0x0 0x40200000 0x0 0x100000>,
+ <0x02000000 0x0 0x40300000 0x0 0x40300000 0x0 0x1fd00000>;
+
+ interrupts = <GIC_SPI 307 IRQ_TYPE_EDGE_RISING>;
+--
+2.39.2
+
--- /dev/null
+From ffbffdad359ec2bc090b31938fe3aeb52c1b643f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Feb 2023 22:17:47 +0530
+Subject: arm64: dts: qcom: sm8150: Fix the PCI I/O port range
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+
+[ Upstream commit 422b110b9b0af0afd4a4b19e8fc3ceab9e71d842 ]
+
+For 1MiB of the I/O region, the I/O ports of the legacy PCI devices are
+located in the range of 0x0 to 0x100000. Hence, fix the bogus PCI addresses
+(0x60200000, 0x40200000) specified in the ranges property for I/O region.
+
+While at it, let's use the missing 0x prefix for the addresses.
+
+Fixes: a1c86c680533 ("arm64: dts: qcom: sm8150: Add PCIe nodes")
+Reported-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/linux-arm-msm/7c5dfa87-41df-4ba7-b0e4-72c8386402a8@app.fastmail.com/
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Reviewed-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230228164752.55682-12-manivannan.sadhasivam@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm8150.dtsi | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8150.dtsi b/arch/arm64/boot/dts/qcom/sm8150.dtsi
+index 13e0ce8286061..733c896918c83 100644
+--- a/arch/arm64/boot/dts/qcom/sm8150.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm8150.dtsi
+@@ -1799,8 +1799,8 @@
+ #address-cells = <3>;
+ #size-cells = <2>;
+
+- ranges = <0x01000000 0x0 0x60200000 0 0x60200000 0x0 0x100000>,
+- <0x02000000 0x0 0x60300000 0 0x60300000 0x0 0x3d00000>;
++ ranges = <0x01000000 0x0 0x00000000 0x0 0x60200000 0x0 0x100000>,
++ <0x02000000 0x0 0x60300000 0x0 0x60300000 0x0 0x3d00000>;
+
+ interrupts = <GIC_SPI 141 IRQ_TYPE_LEVEL_HIGH>;
+ interrupt-names = "msi";
+@@ -1895,7 +1895,7 @@
+ #address-cells = <3>;
+ #size-cells = <2>;
+
+- ranges = <0x01000000 0x0 0x40200000 0x0 0x40200000 0x0 0x100000>,
++ ranges = <0x01000000 0x0 0x00000000 0x0 0x40200000 0x0 0x100000>,
+ <0x02000000 0x0 0x40300000 0x0 0x40300000 0x0 0x1fd00000>;
+
+ interrupts = <GIC_SPI 307 IRQ_TYPE_EDGE_RISING>;
+--
+2.39.2
+
--- /dev/null
+From f8e9f0ebab0ed741a6060a1ff279c080a2412eed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Feb 2023 22:17:44 +0530
+Subject: arm64: dts: qcom: sm8250: Fix the PCI I/O port range
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+
+[ Upstream commit e115a4495db687898b8d91d4f16c2cf55bbf167c ]
+
+For 1MiB of the I/O region, the I/O ports of the legacy PCI devices are
+located in the range of 0x0 to 0x100000. Hence, fix the bogus PCI addresses
+(0x60200000, 0x40200000, 0x64200000) specified in the ranges property for
+I/O region.
+
+While at it, let's use the missing 0x prefix for the addresses.
+
+Fixes: e53bdfc00977 ("arm64: dts: qcom: sm8250: Add PCIe support")
+Reported-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/linux-arm-msm/7c5dfa87-41df-4ba7-b0e4-72c8386402a8@app.fastmail.com/
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Reviewed-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230228164752.55682-9-manivannan.sadhasivam@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm8250.dtsi | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8250.dtsi b/arch/arm64/boot/dts/qcom/sm8250.dtsi
+index 2f0e460acccdc..e592ddcc0f075 100644
+--- a/arch/arm64/boot/dts/qcom/sm8250.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm8250.dtsi
+@@ -1834,8 +1834,8 @@
+ #address-cells = <3>;
+ #size-cells = <2>;
+
+- ranges = <0x01000000 0x0 0x60200000 0 0x60200000 0x0 0x100000>,
+- <0x02000000 0x0 0x60300000 0 0x60300000 0x0 0x3d00000>;
++ ranges = <0x01000000 0x0 0x00000000 0x0 0x60200000 0x0 0x100000>,
++ <0x02000000 0x0 0x60300000 0x0 0x60300000 0x0 0x3d00000>;
+
+ interrupts = <GIC_SPI 141 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 142 IRQ_TYPE_LEVEL_HIGH>,
+@@ -1943,7 +1943,7 @@
+ #address-cells = <3>;
+ #size-cells = <2>;
+
+- ranges = <0x01000000 0x0 0x40200000 0x0 0x40200000 0x0 0x100000>,
++ ranges = <0x01000000 0x0 0x00000000 0x0 0x40200000 0x0 0x100000>,
+ <0x02000000 0x0 0x40300000 0x0 0x40300000 0x0 0x1fd00000>;
+
+ interrupts = <GIC_SPI 307 IRQ_TYPE_LEVEL_HIGH>;
+@@ -2051,7 +2051,7 @@
+ #address-cells = <3>;
+ #size-cells = <2>;
+
+- ranges = <0x01000000 0x0 0x64200000 0x0 0x64200000 0x0 0x100000>,
++ ranges = <0x01000000 0x0 0x00000000 0x0 0x64200000 0x0 0x100000>,
+ <0x02000000 0x0 0x64300000 0x0 0x64300000 0x0 0x3d00000>;
+
+ interrupts = <GIC_SPI 243 IRQ_TYPE_LEVEL_HIGH>;
+--
+2.39.2
+
--- /dev/null
+From 3b45aff8b75650387a75de382e45bb52554c8377 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 4 Mar 2023 14:03:14 +0100
+Subject: arm64: dts: qcom: sm8250-xiaomi-elish: fix USB maximum speed property
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit 613f14a3a9d7e12a832ff822f85a33ad0ebee952 ]
+
+Fix typo in USB DWC3 node maximum speed property.
+
+Fixes: a41b617530bf ("arm64: dts: qcom: sm8250: Add device tree for Xiaomi Mi Pad 5 Pro")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230304130315.51595-1-krzysztof.kozlowski@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm8250-xiaomi-elish.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8250-xiaomi-elish.dts b/arch/arm64/boot/dts/qcom/sm8250-xiaomi-elish.dts
+index a85d47f7a9e82..7d2e18f3f432e 100644
+--- a/arch/arm64/boot/dts/qcom/sm8250-xiaomi-elish.dts
++++ b/arch/arm64/boot/dts/qcom/sm8250-xiaomi-elish.dts
+@@ -595,7 +595,7 @@
+
+ &usb_1_dwc3 {
+ dr_mode = "peripheral";
+- maximum-spped = "high-speed";
++ maximum-speed = "high-speed";
+ /* Remove USB3 phy */
+ phys = <&usb_1_hsphy>;
+ phy-names = "usb2-phy";
+--
+2.39.2
+
--- /dev/null
+From fbca54df068e865277ad8450c46f03c5d3ecb247 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Feb 2023 22:17:49 +0530
+Subject: arm64: dts: qcom: sm8350: Fix the PCI I/O port range
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+
+[ Upstream commit cf4e716e9a38b32a922a88ac3c5b701137a663dd ]
+
+For 1MiB of the I/O region, the I/O ports of the legacy PCI devices are
+located in the range of 0x0 to 0x100000. Hence, fix the bogus PCI addresses
+(0x60200000, 0x40200000) specified in the ranges property for I/O region.
+
+While at it, let's use the missing 0x prefix for the addresses.
+
+Fixes: 6daee40678a0 ("arm64: dts: qcom: sm8350: add PCIe devices")
+Reported-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/linux-arm-msm/7c5dfa87-41df-4ba7-b0e4-72c8386402a8@app.fastmail.com/
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Reviewed-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230228164752.55682-14-manivannan.sadhasivam@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm8350.dtsi | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8350.dtsi b/arch/arm64/boot/dts/qcom/sm8350.dtsi
+index 1a5a612d4234b..9cb52d7efdd8d 100644
+--- a/arch/arm64/boot/dts/qcom/sm8350.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm8350.dtsi
+@@ -1487,8 +1487,8 @@
+ #address-cells = <3>;
+ #size-cells = <2>;
+
+- ranges = <0x01000000 0x0 0x60200000 0 0x60200000 0x0 0x100000>,
+- <0x02000000 0x0 0x60300000 0 0x60300000 0x0 0x3d00000>;
++ ranges = <0x01000000 0x0 0x00000000 0x0 0x60200000 0x0 0x100000>,
++ <0x02000000 0x0 0x60300000 0x0 0x60300000 0x0 0x3d00000>;
+
+ interrupts = <GIC_SPI 141 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 142 IRQ_TYPE_LEVEL_HIGH>,
+@@ -1581,8 +1581,8 @@
+ #address-cells = <3>;
+ #size-cells = <2>;
+
+- ranges = <0x01000000 0x0 0x40200000 0 0x40200000 0x0 0x100000>,
+- <0x02000000 0x0 0x40300000 0 0x40300000 0x0 0x1fd00000>;
++ ranges = <0x01000000 0x0 0x00000000 0x0 0x40200000 0x0 0x100000>,
++ <0x02000000 0x0 0x40300000 0x0 0x40300000 0x0 0x1fd00000>;
+
+ interrupts = <GIC_SPI 307 IRQ_TYPE_LEVEL_HIGH>;
+ interrupt-names = "msi";
+--
+2.39.2
+
--- /dev/null
+From e7ffa5fb67d760d93c1711d2078cffeb3aa6ccc4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 4 Mar 2023 14:03:15 +0100
+Subject: arm64: dts: qcom: sm8350-microsoft-surface: fix USB dual-role mode
+ property
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit 0beda02e530f8fc571877939645cb20ade113027 ]
+
+The "dr_mode" is a property of USB DWC3 node, not the Qualcomm wrapper
+one:
+ sm8350-microsoft-surface-duo2.dtb: usb@a6f8800: 'dr_mode' does not match any of the regexes: '^usb@[0-9a-f]+$', 'pinctrl-[0-9]+'
+
+Fixes: c16160cfa565 ("arm64: dts: qcom: add minimal DTS for Microsoft Surface Duo 2")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230304130315.51595-2-krzysztof.kozlowski@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm8350-microsoft-surface-duo2.dts | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8350-microsoft-surface-duo2.dts b/arch/arm64/boot/dts/qcom/sm8350-microsoft-surface-duo2.dts
+index b536ae36ae6de..3bd5e57cbcdaa 100644
+--- a/arch/arm64/boot/dts/qcom/sm8350-microsoft-surface-duo2.dts
++++ b/arch/arm64/boot/dts/qcom/sm8350-microsoft-surface-duo2.dts
+@@ -341,6 +341,9 @@
+
+ &usb_1 {
+ status = "okay";
++};
++
++&usb_1_dwc3 {
+ dr_mode = "peripheral";
+ };
+
+--
+2.39.2
+
--- /dev/null
+From dd5f5098221566b118c0256b2a58765ddfa79a6d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Mar 2023 10:28:49 +0100
+Subject: arm64: dts: qcom: sm8450: fix pcie1 gpios properties name
+
+From: Neil Armstrong <neil.armstrong@linaro.org>
+
+[ Upstream commit e57430d2483506f046e39bf8c61159dde88aede2 ]
+
+Add the final "s" to the pgio properties and fix the invalid "enable"
+name to the correct "wake", checked against the HDK8450 schematics.
+
+Fixes: bc6588bc25fb ("arm64: dts: qcom: sm8450: add PCIe1 root device")
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230323-topic-sm8450-upstream-dt-bindings-fixes-v2-4-0ca1bea1a843@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm8450.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8450.dtsi b/arch/arm64/boot/dts/qcom/sm8450.dtsi
+index bcb0eac83ef01..243ef642fcef6 100644
+--- a/arch/arm64/boot/dts/qcom/sm8450.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm8450.dtsi
+@@ -1917,8 +1917,8 @@
+ phys = <&pcie1_lane>;
+ phy-names = "pciephy";
+
+- perst-gpio = <&tlmm 97 GPIO_ACTIVE_LOW>;
+- enable-gpio = <&tlmm 99 GPIO_ACTIVE_HIGH>;
++ perst-gpios = <&tlmm 97 GPIO_ACTIVE_LOW>;
++ wake-gpios = <&tlmm 99 GPIO_ACTIVE_HIGH>;
+
+ pinctrl-names = "default";
+ pinctrl-0 = <&pcie1_default_state>;
+--
+2.39.2
+
--- /dev/null
+From f682a036fd848cd518a8ea8350573bce3bbe939a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Feb 2023 22:17:48 +0530
+Subject: arm64: dts: qcom: sm8450: Fix the PCI I/O port range
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+
+[ Upstream commit f57903c8f4c77938eb71fc67e4652264a9fa14f9 ]
+
+For 1MiB of the I/O region, the I/O ports of the legacy PCI devices are
+located in the range of 0x0 to 0x100000. Hence, fix the bogus PCI addresses
+(0x60200000, 0x40200000) specified in the ranges property for I/O region.
+
+While at it, let's use the missing 0x prefix for the addresses.
+
+Fixes: bc6588bc25fb ("arm64: dts: qcom: sm8450: add PCIe1 root device")
+Fixes: 7b09b1b47335 ("arm64: dts: qcom: sm8450: add PCIe0 RC device")
+Reported-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/linux-arm-msm/7c5dfa87-41df-4ba7-b0e4-72c8386402a8@app.fastmail.com/
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Reviewed-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230228164752.55682-13-manivannan.sadhasivam@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm8450.dtsi | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8450.dtsi b/arch/arm64/boot/dts/qcom/sm8450.dtsi
+index b285b1530c109..bcb0eac83ef01 100644
+--- a/arch/arm64/boot/dts/qcom/sm8450.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm8450.dtsi
+@@ -1746,8 +1746,8 @@
+ #address-cells = <3>;
+ #size-cells = <2>;
+
+- ranges = <0x01000000 0x0 0x60200000 0 0x60200000 0x0 0x100000>,
+- <0x02000000 0x0 0x60300000 0 0x60300000 0x0 0x3d00000>;
++ ranges = <0x01000000 0x0 0x00000000 0x0 0x60200000 0x0 0x100000>,
++ <0x02000000 0x0 0x60300000 0x0 0x60300000 0x0 0x3d00000>;
+
+ /*
+ * MSIs for BDF (1:0.0) only works with Device ID 0x5980.
+@@ -1862,8 +1862,8 @@
+ #address-cells = <3>;
+ #size-cells = <2>;
+
+- ranges = <0x01000000 0x0 0x40200000 0 0x40200000 0x0 0x100000>,
+- <0x02000000 0x0 0x40300000 0 0x40300000 0x0 0x1fd00000>;
++ ranges = <0x01000000 0x0 0x00000000 0x0 0x40200000 0x0 0x100000>,
++ <0x02000000 0x0 0x40300000 0x0 0x40300000 0x0 0x1fd00000>;
+
+ /*
+ * MSIs for BDF (1:0.0) only works with Device ID 0x5a00.
+--
+2.39.2
+
--- /dev/null
+From 9efca2cc7a700ea0ad41ff58e5e104ebdb889f73 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Feb 2023 20:00:20 +0200
+Subject: arm64: dts: qcom: sm8550: Fix PCIe PHYs and controllers nodes
+
+From: Abel Vesa <abel.vesa@linaro.org>
+
+[ Upstream commit 32734bbd1802efbd60ea4f0c3c1d5500bd0b20fe ]
+
+First, move the pinctrl related propeties out from SoC dtsi and into the
+board dts and add blank lines before status properties in the PHY nodes
+to be consistent with the rest of the nodes. Then drop the pipe clock
+from the controller nodes. Rename the aggre0 and aggre1 clocks to more
+generic noc_aggr, and then the cnoc_pcie_sf_axi to cnoc_sf_axi. Add the
+cpu-pcie interconnects to both controller nodes. Rename the pcie1 second
+reset to link_down and drop the unnecessary enable-gpios. Switch the aux
+clock to GCC_PCIE_1_PHY_AUX_CLK for the pcie1 PHY and drop the aux_phy
+from clock-names. Also rename the nocsr reset to phy_nocsr. With this
+changes we are now in line with the SC8280XP bindings.
+
+Fixes: 7d1158c984d3 ("arm64: dts: qcom: sm8550: Add PCIe PHYs and controllers nodes")
+Signed-off-by: Abel Vesa <abel.vesa@linaro.org>
+Reviewed-by: Johan Hovold <johan+linaro@kernel.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230208180020.2761766-12-abel.vesa@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm8550-mtp.dts | 10 +++++
+ arch/arm64/boot/dts/qcom/sm8550.dtsi | 52 +++++++++----------------
+ 2 files changed, 28 insertions(+), 34 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8550-mtp.dts b/arch/arm64/boot/dts/qcom/sm8550-mtp.dts
+index 5db6e789e6b87..44eab9308ff24 100644
+--- a/arch/arm64/boot/dts/qcom/sm8550-mtp.dts
++++ b/arch/arm64/boot/dts/qcom/sm8550-mtp.dts
+@@ -414,18 +414,27 @@
+ &pcie0 {
+ wake-gpios = <&tlmm 96 GPIO_ACTIVE_HIGH>;
+ perst-gpios = <&tlmm 94 GPIO_ACTIVE_LOW>;
++
++ pinctrl-names = "default";
++ pinctrl-0 = <&pcie0_default_state>;
++
+ status = "okay";
+ };
+
+ &pcie0_phy {
+ vdda-phy-supply = <&vreg_l1e_0p88>;
+ vdda-pll-supply = <&vreg_l3e_1p2>;
++
+ status = "okay";
+ };
+
+ &pcie1 {
+ wake-gpios = <&tlmm 99 GPIO_ACTIVE_HIGH>;
+ perst-gpios = <&tlmm 97 GPIO_ACTIVE_LOW>;
++
++ pinctrl-names = "default";
++ pinctrl-0 = <&pcie1_default_state>;
++
+ status = "okay";
+ };
+
+@@ -433,6 +442,7 @@
+ vdda-phy-supply = <&vreg_l3c_0p91>;
+ vdda-pll-supply = <&vreg_l3e_1p2>;
+ vdda-qref-supply = <&vreg_l1e_0p88>;
++
+ status = "okay";
+ };
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8550.dtsi b/arch/arm64/boot/dts/qcom/sm8550.dtsi
+index 5d0888398b3c3..ebc391bf1e4cc 100644
+--- a/arch/arm64/boot/dts/qcom/sm8550.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm8550.dtsi
+@@ -1672,25 +1672,24 @@
+ <0 0 0 3 &intc 0 0 0 151 IRQ_TYPE_LEVEL_HIGH>, /* int_c */
+ <0 0 0 4 &intc 0 0 0 152 IRQ_TYPE_LEVEL_HIGH>; /* int_d */
+
+- clocks = <&gcc GCC_PCIE_0_PIPE_CLK>,
+- <&gcc GCC_PCIE_0_AUX_CLK>,
++ clocks = <&gcc GCC_PCIE_0_AUX_CLK>,
+ <&gcc GCC_PCIE_0_CFG_AHB_CLK>,
+ <&gcc GCC_PCIE_0_MSTR_AXI_CLK>,
+ <&gcc GCC_PCIE_0_SLV_AXI_CLK>,
+ <&gcc GCC_PCIE_0_SLV_Q2A_AXI_CLK>,
+ <&gcc GCC_DDRSS_PCIE_SF_QTB_CLK>,
+ <&gcc GCC_AGGRE_NOC_PCIE_AXI_CLK>;
+- clock-names = "pipe",
+- "aux",
++ clock-names = "aux",
+ "cfg",
+ "bus_master",
+ "bus_slave",
+ "slave_q2a",
+ "ddrss_sf_tbu",
+- "aggre0";
++ "noc_aggr";
+
+- interconnect-names = "pcie-mem";
+- interconnects = <&pcie_noc MASTER_PCIE_0 0 &mc_virt SLAVE_EBI1 0>;
++ interconnects = <&pcie_noc MASTER_PCIE_0 0 &mc_virt SLAVE_EBI1 0>,
++ <&gem_noc MASTER_APPSS_PROC 0 &cnoc_main SLAVE_PCIE_0 0>;
++ interconnect-names = "pcie-mem", "cpu-pcie";
+
+ iommus = <&apps_smmu 0x1400 0x7f>;
+ iommu-map = <0x0 &apps_smmu 0x1400 0x1>,
+@@ -1704,12 +1703,6 @@
+ phys = <&pcie0_phy>;
+ phy-names = "pciephy";
+
+- perst-gpios = <&tlmm 94 GPIO_ACTIVE_LOW>;
+- wake-gpios = <&tlmm 96 GPIO_ACTIVE_HIGH>;
+-
+- pinctrl-names = "default";
+- pinctrl-0 = <&pcie0_default_state>;
+-
+ status = "disabled";
+ };
+
+@@ -1771,8 +1764,7 @@
+ <0 0 0 3 &intc 0 0 0 438 IRQ_TYPE_LEVEL_HIGH>, /* int_c */
+ <0 0 0 4 &intc 0 0 0 439 IRQ_TYPE_LEVEL_HIGH>; /* int_d */
+
+- clocks = <&gcc GCC_PCIE_1_PIPE_CLK>,
+- <&gcc GCC_PCIE_1_AUX_CLK>,
++ clocks = <&gcc GCC_PCIE_1_AUX_CLK>,
+ <&gcc GCC_PCIE_1_CFG_AHB_CLK>,
+ <&gcc GCC_PCIE_1_MSTR_AXI_CLK>,
+ <&gcc GCC_PCIE_1_SLV_AXI_CLK>,
+@@ -1780,21 +1772,21 @@
+ <&gcc GCC_DDRSS_PCIE_SF_QTB_CLK>,
+ <&gcc GCC_AGGRE_NOC_PCIE_AXI_CLK>,
+ <&gcc GCC_CNOC_PCIE_SF_AXI_CLK>;
+- clock-names = "pipe",
+- "aux",
++ clock-names = "aux",
+ "cfg",
+ "bus_master",
+ "bus_slave",
+ "slave_q2a",
+ "ddrss_sf_tbu",
+- "aggre1",
+- "cnoc_pcie_sf_axi";
++ "noc_aggr",
++ "cnoc_sf_axi";
+
+ assigned-clocks = <&gcc GCC_PCIE_1_AUX_CLK>;
+ assigned-clock-rates = <19200000>;
+
+- interconnect-names = "pcie-mem";
+- interconnects = <&pcie_noc MASTER_PCIE_1 0 &mc_virt SLAVE_EBI1 0>;
++ interconnects = <&pcie_noc MASTER_PCIE_1 0 &mc_virt SLAVE_EBI1 0>,
++ <&gem_noc MASTER_APPSS_PROC 0 &cnoc_main SLAVE_PCIE_1 0>;
++ interconnect-names = "pcie-mem", "cpu-pcie";
+
+ iommus = <&apps_smmu 0x1480 0x7f>;
+ iommu-map = <0x0 &apps_smmu 0x1480 0x1>,
+@@ -1802,20 +1794,13 @@
+
+ resets = <&gcc GCC_PCIE_1_BCR>,
+ <&gcc GCC_PCIE_1_LINK_DOWN_BCR>;
+- reset-names = "pci",
+- "pcie_1_link_down_reset";
++ reset-names = "pci", "link_down";
+
+ power-domains = <&gcc PCIE_1_GDSC>;
+
+ phys = <&pcie1_phy>;
+ phy-names = "pciephy";
+
+- perst-gpios = <&tlmm 97 GPIO_ACTIVE_LOW>;
+- enable-gpios = <&tlmm 99 GPIO_ACTIVE_HIGH>;
+-
+- pinctrl-names = "default";
+- pinctrl-0 = <&pcie1_default_state>;
+-
+ status = "disabled";
+ };
+
+@@ -1823,18 +1808,17 @@
+ compatible = "qcom,sm8550-qmp-gen4x2-pcie-phy";
+ reg = <0x0 0x01c0e000 0x0 0x2000>;
+
+- clocks = <&gcc GCC_PCIE_1_AUX_CLK>,
++ clocks = <&gcc GCC_PCIE_1_PHY_AUX_CLK>,
+ <&gcc GCC_PCIE_1_CFG_AHB_CLK>,
+ <&tcsr TCSR_PCIE_1_CLKREF_EN>,
+ <&gcc GCC_PCIE_1_PHY_RCHNG_CLK>,
+- <&gcc GCC_PCIE_1_PIPE_CLK>,
+- <&gcc GCC_PCIE_1_PHY_AUX_CLK>;
++ <&gcc GCC_PCIE_1_PIPE_CLK>;
+ clock-names = "aux", "cfg_ahb", "ref", "rchng",
+- "pipe", "aux_phy";
++ "pipe";
+
+ resets = <&gcc GCC_PCIE_1_PHY_BCR>,
+ <&gcc GCC_PCIE_1_NOCSR_COM_PHY_BCR>;
+- reset-names = "phy", "nocsr";
++ reset-names = "phy", "phy_nocsr";
+
+ assigned-clocks = <&gcc GCC_PCIE_1_PHY_RCHNG_CLK>;
+ assigned-clock-rates = <100000000>;
+--
+2.39.2
+
--- /dev/null
+From 177537fe879be5afc279a80d417e6eec341f44d7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Mar 2023 09:32:53 +0100
+Subject: arm64: dts: qcom: sm8550: fix qup_spi0_cs node
+
+From: Neil Armstrong <neil.armstrong@linaro.org>
+
+[ Upstream commit 7629c7a525d163f2a3a08e260a69ff25163ab357 ]
+
+The node is incomplete and doesn't need a subnode, add the missing
+properties and move everything to the root of qup-spi0-cs-state node.
+
+Fixes: ffc50b2d3828 ("arm64: dts: qcom: Add base SM8550 dtsi")
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230308-topic-sm8550-upstream-dt-fixups-v1-2-595b02067672@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm8550.dtsi | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8550.dtsi b/arch/arm64/boot/dts/qcom/sm8550.dtsi
+index ad42c451891d1..7da28b36470e8 100644
+--- a/arch/arm64/boot/dts/qcom/sm8550.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm8550.dtsi
+@@ -2792,10 +2792,10 @@
+ };
+
+ qup_spi0_cs: qup-spi0-cs-state {
+- cs-pins {
+- pins = "gpio31";
+- function = "qup1_se0";
+- };
++ pins = "gpio31";
++ function = "qup1_se0";
++ drive-strength = <6>;
++ bias-disable;
+ };
+
+ qup_spi0_data_clk: qup-spi0-data-clk-state {
+--
+2.39.2
+
--- /dev/null
+From c873be2db13a3b3c90ba5bbadcbff366f3e8b498 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Feb 2023 22:17:40 +0530
+Subject: arm64: dts: qcom: sm8550: Fix the PCI I/O port range
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+
+[ Upstream commit 565c633940312b4eea7785a0a58e1944258c47e9 ]
+
+For 1MiB of the I/O region, the I/O ports of the legacy PCI devices are
+located in the range of 0x0 to 0x100000. Hence, fix the bogus PCI addresses
+(0x60200000, 0x40200000) specified in the ranges property for I/O region.
+
+While at it, let's use the missing 0x prefix for the addresses.
+
+Fixes: 7d1158c984d3 ("arm64: dts: qcom: sm8550: Add PCIe PHYs and controllers nodes")
+Reported-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/linux-arm-msm/7c5dfa87-41df-4ba7-b0e4-72c8386402a8@app.fastmail.com/
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Reviewed-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230228164752.55682-5-manivannan.sadhasivam@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm8550.dtsi | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8550.dtsi b/arch/arm64/boot/dts/qcom/sm8550.dtsi
+index ebc391bf1e4cc..ad42c451891d1 100644
+--- a/arch/arm64/boot/dts/qcom/sm8550.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm8550.dtsi
+@@ -1653,8 +1653,8 @@
+ reg-names = "parf", "dbi", "elbi", "atu", "config";
+ #address-cells = <3>;
+ #size-cells = <2>;
+- ranges = <0x01000000 0x0 0x60200000 0 0x60200000 0x0 0x100000>,
+- <0x02000000 0x0 0x60300000 0 0x60300000 0x0 0x3d00000>;
++ ranges = <0x01000000 0x0 0x00000000 0x0 0x60200000 0x0 0x100000>,
++ <0x02000000 0x0 0x60300000 0x0 0x60300000 0x0 0x3d00000>;
+ bus-range = <0x00 0xff>;
+
+ dma-coherent;
+@@ -1745,8 +1745,8 @@
+ reg-names = "parf", "dbi", "elbi", "atu", "config";
+ #address-cells = <3>;
+ #size-cells = <2>;
+- ranges = <0x01000000 0x0 0x40200000 0 0x40200000 0x0 0x100000>,
+- <0x02000000 0x0 0x40300000 0 0x40300000 0x0 0x1fd00000>;
++ ranges = <0x01000000 0x0 0x00000000 0x0 0x40200000 0x0 0x100000>,
++ <0x02000000 0x0 0x40300000 0x0 0x40300000 0x0 0x1fd00000>;
+ bus-range = <0x00 0xff>;
+
+ dma-coherent;
+--
+2.39.2
+
--- /dev/null
+From cd40ac32d39712632fc186c386cf75d52a21251e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Mar 2023 09:32:54 +0100
+Subject: arm64: dts: qcom: sm8550: misc style fixes
+
+From: Neil Armstrong <neil.armstrong@linaro.org>
+
+[ Upstream commit f03908b23f84ecd49f12facf4acf34c3ad24f27a ]
+
+Miscellaneous DT fixes to remove spurious blank line and enhance readability.
+
+Fixes: ffc50b2d3828 ("arm64: dts: qcom: Add base SM8550 dtsi")
+Fixes: d7da51db5b81 ("arm64: dts: qcom: sm8550: add display hardware devices")
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230308-topic-sm8550-upstream-dt-fixups-v1-3-595b02067672@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm8550.dtsi | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8550.dtsi b/arch/arm64/boot/dts/qcom/sm8550.dtsi
+index 7da28b36470e8..f05cdb376a175 100644
+--- a/arch/arm64/boot/dts/qcom/sm8550.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm8550.dtsi
+@@ -412,7 +412,6 @@
+ no-map;
+ };
+
+-
+ hyp_tags_reserved_mem: hyp-tags-reserved-region@811d0000 {
+ reg = <0 0x811d0000 0 0x30000>;
+ no-map;
+@@ -2195,7 +2194,8 @@
+
+ assigned-clocks = <&dispcc DISP_CC_MDSS_BYTE0_CLK_SRC>,
+ <&dispcc DISP_CC_MDSS_PCLK0_CLK_SRC>;
+- assigned-clock-parents = <&mdss_dsi0_phy 0>, <&mdss_dsi0_phy 1>;
++ assigned-clock-parents = <&mdss_dsi0_phy 0>,
++ <&mdss_dsi0_phy 1>;
+
+ operating-points-v2 = <&mdss_dsi_opp_table>;
+
+@@ -2287,8 +2287,10 @@
+
+ power-domains = <&rpmhpd SM8550_MMCX>;
+
+- assigned-clocks = <&dispcc DISP_CC_MDSS_BYTE1_CLK_SRC>, <&dispcc DISP_CC_MDSS_PCLK1_CLK_SRC>;
+- assigned-clock-parents = <&mdss_dsi1_phy 0>, <&mdss_dsi1_phy 1>;
++ assigned-clocks = <&dispcc DISP_CC_MDSS_BYTE1_CLK_SRC>,
++ <&dispcc DISP_CC_MDSS_PCLK1_CLK_SRC>;
++ assigned-clock-parents = <&mdss_dsi1_phy 0>,
++ <&mdss_dsi1_phy 1>;
+
+ operating-points-v2 = <&mdss_dsi_opp_table>;
+
+@@ -3156,7 +3158,7 @@
+
+ intc: interrupt-controller@17100000 {
+ compatible = "arm,gic-v3";
+- reg = <0 0x17100000 0 0x10000>, /* GICD */
++ reg = <0 0x17100000 0 0x10000>, /* GICD */
+ <0 0x17180000 0 0x200000>; /* GICR * 8 */
+ ranges;
+ #interrupt-cells = <3>;
+--
+2.39.2
+
--- /dev/null
+From 5e551981e501683ebbe8cabb26d7ccd08583f40b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Feb 2023 16:30:32 +0100
+Subject: arm64: dts: renesas: r8a774c0: Remove bogus voltages from OPP table
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 554edc3e9239bb81e61be9f0f5dbbeb528a69e72 ]
+
+According to the RZ/G Series, 2nd Generation Hardware User’s Manual
+Rev. 1.11, the System CPU cores on RZ/G2E do not have their own power
+supply, but use the common internal power supply (typical 1.03V).
+
+Hence remove the "opp-microvolt" properties from the Operating
+Performance Points table. They are optional, and unused, when none of
+the CPU nodes is tied to a regulator using the "cpu-supply" property.
+
+Fixes: 231d8908a66fa98f ("arm64: dts: renesas: r8a774c0: Add OPPs table for cpu devices")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/8348e18a011ded94e35919cd8e17c0be1f9acf2f.1676560856.git.geert+renesas@glider.be
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/renesas/r8a774c0.dtsi | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/renesas/r8a774c0.dtsi b/arch/arm64/boot/dts/renesas/r8a774c0.dtsi
+index e21653d862282..10abfde329d00 100644
+--- a/arch/arm64/boot/dts/renesas/r8a774c0.dtsi
++++ b/arch/arm64/boot/dts/renesas/r8a774c0.dtsi
+@@ -49,17 +49,14 @@
+ opp-shared;
+ opp-800000000 {
+ opp-hz = /bits/ 64 <800000000>;
+- opp-microvolt = <820000>;
+ clock-latency-ns = <300000>;
+ };
+ opp-1000000000 {
+ opp-hz = /bits/ 64 <1000000000>;
+- opp-microvolt = <820000>;
+ clock-latency-ns = <300000>;
+ };
+ opp-1200000000 {
+ opp-hz = /bits/ 64 <1200000000>;
+- opp-microvolt = <820000>;
+ clock-latency-ns = <300000>;
+ opp-suspend;
+ };
+--
+2.39.2
+
--- /dev/null
+From ca61bcc4fb1966aff73e2bca5198185cb0204e81 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Feb 2023 16:30:31 +0100
+Subject: arm64: dts: renesas: r8a77990: Remove bogus voltages from OPP table
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit fb76b0fae3ca880363214e1dcd6513ab8bd529e7 ]
+
+According to the R-Car Series, 3rd Generation Hardware User’s Manual
+Rev. 2.30, the System CPU cores on R-Car E3 do not have their own power
+supply, but use the common internal power supply (typical 1.03V).
+
+Hence remove the "opp-microvolt" properties from the Operating
+Performance Points table. They are optional, and unused, when none of
+the CPU nodes is tied to a regulator using the "cpu-supply" property.
+
+Fixes: dd7188eb4ed128dc ("arm64: dts: renesas: r8a77990: Add OPPs table for cpu devices")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/9232578d9d395d529f64db3333a371e31327f459.1676560856.git.geert+renesas@glider.be
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/renesas/r8a77990.dtsi | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/renesas/r8a77990.dtsi b/arch/arm64/boot/dts/renesas/r8a77990.dtsi
+index d4718f144e33c..4529e9b57c331 100644
+--- a/arch/arm64/boot/dts/renesas/r8a77990.dtsi
++++ b/arch/arm64/boot/dts/renesas/r8a77990.dtsi
+@@ -49,17 +49,14 @@
+ opp-shared;
+ opp-800000000 {
+ opp-hz = /bits/ 64 <800000000>;
+- opp-microvolt = <820000>;
+ clock-latency-ns = <300000>;
+ };
+ opp-1000000000 {
+ opp-hz = /bits/ 64 <1000000000>;
+- opp-microvolt = <820000>;
+ clock-latency-ns = <300000>;
+ };
+ opp-1200000000 {
+ opp-hz = /bits/ 64 <1200000000>;
+- opp-microvolt = <820000>;
+ clock-latency-ns = <300000>;
+ opp-suspend;
+ };
+--
+2.39.2
+
--- /dev/null
+From c066144e64a9db9c5e2ec685369a02740a807e26 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Feb 2023 18:52:25 +0000
+Subject: arm64: dts: renesas: r9a07g043: Update IRQ numbers for SSI channels
+
+From: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
+
+[ Upstream commit 2a5c9891392dca47f6865a2add1986876e40849c ]
+
+From R01UH0968EJ0100 Rev.1.00 HW manual the interrupt numbers for SSI
+channels have been updated,
+
+SPI 329 - SSIF0 is now marked as reserved
+SPI 333 - SSIF1 is now marked as reserved
+SPI 335 - SSIF2 is now marked as reserved
+SPI 336 - SSIF2 is now marked as reserved
+SPI 341 - SSIF3 is now marked as reserved
+
+This patch drops the above IRQs from SoC DTSI.
+
+Fixes: 559f2b0708c70 ("arm64: dts: renesas: r9a07g043: Add SSI{1,2,3} nodes and fillup the SSI0 stub node")
+Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
+Reviewed-by: Biju Das <biju.das.jz@bp.renesas.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/20230217185225.43310-5-prabhakar.mahadev-lad.rj@bp.renesas.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/renesas/r9a07g043.dtsi | 19 +++++++------------
+ 1 file changed, 7 insertions(+), 12 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/renesas/r9a07g043.dtsi b/arch/arm64/boot/dts/renesas/r9a07g043.dtsi
+index c8a83e42c4f3a..a9700654b4218 100644
+--- a/arch/arm64/boot/dts/renesas/r9a07g043.dtsi
++++ b/arch/arm64/boot/dts/renesas/r9a07g043.dtsi
+@@ -80,9 +80,8 @@
+ reg = <0 0x10049c00 0 0x400>;
+ interrupts = <SOC_PERIPHERAL_IRQ(326) IRQ_TYPE_LEVEL_HIGH>,
+ <SOC_PERIPHERAL_IRQ(327) IRQ_TYPE_EDGE_RISING>,
+- <SOC_PERIPHERAL_IRQ(328) IRQ_TYPE_EDGE_RISING>,
+- <SOC_PERIPHERAL_IRQ(329) IRQ_TYPE_EDGE_RISING>;
+- interrupt-names = "int_req", "dma_rx", "dma_tx", "dma_rt";
++ <SOC_PERIPHERAL_IRQ(328) IRQ_TYPE_EDGE_RISING>;
++ interrupt-names = "int_req", "dma_rx", "dma_tx";
+ clocks = <&cpg CPG_MOD R9A07G043_SSI0_PCLK2>,
+ <&cpg CPG_MOD R9A07G043_SSI0_PCLK_SFR>,
+ <&audio_clk1>, <&audio_clk2>;
+@@ -101,9 +100,8 @@
+ reg = <0 0x1004a000 0 0x400>;
+ interrupts = <SOC_PERIPHERAL_IRQ(330) IRQ_TYPE_LEVEL_HIGH>,
+ <SOC_PERIPHERAL_IRQ(331) IRQ_TYPE_EDGE_RISING>,
+- <SOC_PERIPHERAL_IRQ(332) IRQ_TYPE_EDGE_RISING>,
+- <SOC_PERIPHERAL_IRQ(333) IRQ_TYPE_EDGE_RISING>;
+- interrupt-names = "int_req", "dma_rx", "dma_tx", "dma_rt";
++ <SOC_PERIPHERAL_IRQ(332) IRQ_TYPE_EDGE_RISING>;
++ interrupt-names = "int_req", "dma_rx", "dma_tx";
+ clocks = <&cpg CPG_MOD R9A07G043_SSI1_PCLK2>,
+ <&cpg CPG_MOD R9A07G043_SSI1_PCLK_SFR>,
+ <&audio_clk1>, <&audio_clk2>;
+@@ -121,10 +119,8 @@
+ "renesas,rz-ssi";
+ reg = <0 0x1004a400 0 0x400>;
+ interrupts = <SOC_PERIPHERAL_IRQ(334) IRQ_TYPE_LEVEL_HIGH>,
+- <SOC_PERIPHERAL_IRQ(335) IRQ_TYPE_EDGE_RISING>,
+- <SOC_PERIPHERAL_IRQ(336) IRQ_TYPE_EDGE_RISING>,
+ <SOC_PERIPHERAL_IRQ(337) IRQ_TYPE_EDGE_RISING>;
+- interrupt-names = "int_req", "dma_rx", "dma_tx", "dma_rt";
++ interrupt-names = "int_req", "dma_rt";
+ clocks = <&cpg CPG_MOD R9A07G043_SSI2_PCLK2>,
+ <&cpg CPG_MOD R9A07G043_SSI2_PCLK_SFR>,
+ <&audio_clk1>, <&audio_clk2>;
+@@ -143,9 +139,8 @@
+ reg = <0 0x1004a800 0 0x400>;
+ interrupts = <SOC_PERIPHERAL_IRQ(338) IRQ_TYPE_LEVEL_HIGH>,
+ <SOC_PERIPHERAL_IRQ(339) IRQ_TYPE_EDGE_RISING>,
+- <SOC_PERIPHERAL_IRQ(340) IRQ_TYPE_EDGE_RISING>,
+- <SOC_PERIPHERAL_IRQ(341) IRQ_TYPE_EDGE_RISING>;
+- interrupt-names = "int_req", "dma_rx", "dma_tx", "dma_rt";
++ <SOC_PERIPHERAL_IRQ(340) IRQ_TYPE_EDGE_RISING>;
++ interrupt-names = "int_req", "dma_rx", "dma_tx";
+ clocks = <&cpg CPG_MOD R9A07G043_SSI3_PCLK2>,
+ <&cpg CPG_MOD R9A07G043_SSI3_PCLK_SFR>,
+ <&audio_clk1>, <&audio_clk2>;
+--
+2.39.2
+
--- /dev/null
+From cdca5b634cee6b7c9174fd0f1457a3d474203293 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Feb 2023 18:52:24 +0000
+Subject: arm64: dts: renesas: r9a07g044: Update IRQ numbers for SSI channels
+
+From: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
+
+[ Upstream commit 5da750ddd96454757a3b467e968e3fb70bb12bc8 ]
+
+From R01UH0914EJ0120 Rev.1.20 HW manual the interrupt numbers for SSI
+channels have been updated,
+
+SPI 329 - SSIF0 is now marked as reserved
+SPI 333 - SSIF1 is now marked as reserved
+SPI 335 - SSIF2 is now marked as reserved
+SPI 336 - SSIF2 is now marked as reserved
+SPI 341 - SSIF3 is now marked as reserved
+
+This patch drops the above IRQs from SoC DTSI.
+
+Fixes: 92a341315afc9 ("arm64: dts: renesas: r9a07g044: Add SSI support")
+Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
+Reviewed-by: Biju Das <biju.das.jz@bp.renesas.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/20230217185225.43310-4-prabhakar.mahadev-lad.rj@bp.renesas.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/renesas/r9a07g044.dtsi | 19 +++++++------------
+ 1 file changed, 7 insertions(+), 12 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/renesas/r9a07g044.dtsi b/arch/arm64/boot/dts/renesas/r9a07g044.dtsi
+index 487536696d900..6a42df15440cf 100644
+--- a/arch/arm64/boot/dts/renesas/r9a07g044.dtsi
++++ b/arch/arm64/boot/dts/renesas/r9a07g044.dtsi
+@@ -175,9 +175,8 @@
+ reg = <0 0x10049c00 0 0x400>;
+ interrupts = <GIC_SPI 326 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 327 IRQ_TYPE_EDGE_RISING>,
+- <GIC_SPI 328 IRQ_TYPE_EDGE_RISING>,
+- <GIC_SPI 329 IRQ_TYPE_EDGE_RISING>;
+- interrupt-names = "int_req", "dma_rx", "dma_tx", "dma_rt";
++ <GIC_SPI 328 IRQ_TYPE_EDGE_RISING>;
++ interrupt-names = "int_req", "dma_rx", "dma_tx";
+ clocks = <&cpg CPG_MOD R9A07G044_SSI0_PCLK2>,
+ <&cpg CPG_MOD R9A07G044_SSI0_PCLK_SFR>,
+ <&audio_clk1>, <&audio_clk2>;
+@@ -196,9 +195,8 @@
+ reg = <0 0x1004a000 0 0x400>;
+ interrupts = <GIC_SPI 330 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 331 IRQ_TYPE_EDGE_RISING>,
+- <GIC_SPI 332 IRQ_TYPE_EDGE_RISING>,
+- <GIC_SPI 333 IRQ_TYPE_EDGE_RISING>;
+- interrupt-names = "int_req", "dma_rx", "dma_tx", "dma_rt";
++ <GIC_SPI 332 IRQ_TYPE_EDGE_RISING>;
++ interrupt-names = "int_req", "dma_rx", "dma_tx";
+ clocks = <&cpg CPG_MOD R9A07G044_SSI1_PCLK2>,
+ <&cpg CPG_MOD R9A07G044_SSI1_PCLK_SFR>,
+ <&audio_clk1>, <&audio_clk2>;
+@@ -216,10 +214,8 @@
+ "renesas,rz-ssi";
+ reg = <0 0x1004a400 0 0x400>;
+ interrupts = <GIC_SPI 334 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 335 IRQ_TYPE_EDGE_RISING>,
+- <GIC_SPI 336 IRQ_TYPE_EDGE_RISING>,
+ <GIC_SPI 337 IRQ_TYPE_EDGE_RISING>;
+- interrupt-names = "int_req", "dma_rx", "dma_tx", "dma_rt";
++ interrupt-names = "int_req", "dma_rt";
+ clocks = <&cpg CPG_MOD R9A07G044_SSI2_PCLK2>,
+ <&cpg CPG_MOD R9A07G044_SSI2_PCLK_SFR>,
+ <&audio_clk1>, <&audio_clk2>;
+@@ -238,9 +234,8 @@
+ reg = <0 0x1004a800 0 0x400>;
+ interrupts = <GIC_SPI 338 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 339 IRQ_TYPE_EDGE_RISING>,
+- <GIC_SPI 340 IRQ_TYPE_EDGE_RISING>,
+- <GIC_SPI 341 IRQ_TYPE_EDGE_RISING>;
+- interrupt-names = "int_req", "dma_rx", "dma_tx", "dma_rt";
++ <GIC_SPI 340 IRQ_TYPE_EDGE_RISING>;
++ interrupt-names = "int_req", "dma_rx", "dma_tx";
+ clocks = <&cpg CPG_MOD R9A07G044_SSI3_PCLK2>,
+ <&cpg CPG_MOD R9A07G044_SSI3_PCLK_SFR>,
+ <&audio_clk1>, <&audio_clk2>;
+--
+2.39.2
+
--- /dev/null
+From ce7bc54baef543c750d63170ae11e05c88deae87 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Feb 2023 18:52:24 +0000
+Subject: arm64: dts: renesas: r9a07g054: Update IRQ numbers for SSI channels
+
+From: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
+
+[ Upstream commit c2b0dc0e83ef4a74cbe381fd0c84cea16cf067f0 ]
+
+From R01UH0936EJ0120 Rev.1.20 HW manual the interrupt numbers for SSI
+channels have been updated,
+
+SPI 329 - SSIF0 is now marked as reserved
+SPI 333 - SSIF1 is now marked as reserved
+SPI 335 - SSIF2 is now marked as reserved
+SPI 336 - SSIF2 is now marked as reserved
+SPI 341 - SSIF3 is now marked as reserved
+
+This patch drops the above IRQs from SoC DTSI.
+
+Fixes: cd0339ec25895c0b ("arm64: dts: renesas: r9a07g054: Add SSI{1,2,3} nodes and fillup the SSI0 stub node")
+Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
+Reviewed-by: Biju Das <biju.das.jz@bp.renesas.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/20230217185225.43310-4-prabhakar.mahadev-lad.rj@bp.renesas.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/renesas/r9a07g054.dtsi | 19 +++++++------------
+ 1 file changed, 7 insertions(+), 12 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/renesas/r9a07g054.dtsi b/arch/arm64/boot/dts/renesas/r9a07g054.dtsi
+index 304ade54425bf..fea537d9fce66 100644
+--- a/arch/arm64/boot/dts/renesas/r9a07g054.dtsi
++++ b/arch/arm64/boot/dts/renesas/r9a07g054.dtsi
+@@ -175,9 +175,8 @@
+ reg = <0 0x10049c00 0 0x400>;
+ interrupts = <GIC_SPI 326 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 327 IRQ_TYPE_EDGE_RISING>,
+- <GIC_SPI 328 IRQ_TYPE_EDGE_RISING>,
+- <GIC_SPI 329 IRQ_TYPE_EDGE_RISING>;
+- interrupt-names = "int_req", "dma_rx", "dma_tx", "dma_rt";
++ <GIC_SPI 328 IRQ_TYPE_EDGE_RISING>;
++ interrupt-names = "int_req", "dma_rx", "dma_tx";
+ clocks = <&cpg CPG_MOD R9A07G054_SSI0_PCLK2>,
+ <&cpg CPG_MOD R9A07G054_SSI0_PCLK_SFR>,
+ <&audio_clk1>, <&audio_clk2>;
+@@ -196,9 +195,8 @@
+ reg = <0 0x1004a000 0 0x400>;
+ interrupts = <GIC_SPI 330 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 331 IRQ_TYPE_EDGE_RISING>,
+- <GIC_SPI 332 IRQ_TYPE_EDGE_RISING>,
+- <GIC_SPI 333 IRQ_TYPE_EDGE_RISING>;
+- interrupt-names = "int_req", "dma_rx", "dma_tx", "dma_rt";
++ <GIC_SPI 332 IRQ_TYPE_EDGE_RISING>;
++ interrupt-names = "int_req", "dma_rx", "dma_tx";
+ clocks = <&cpg CPG_MOD R9A07G054_SSI1_PCLK2>,
+ <&cpg CPG_MOD R9A07G054_SSI1_PCLK_SFR>,
+ <&audio_clk1>, <&audio_clk2>;
+@@ -216,10 +214,8 @@
+ "renesas,rz-ssi";
+ reg = <0 0x1004a400 0 0x400>;
+ interrupts = <GIC_SPI 334 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 335 IRQ_TYPE_EDGE_RISING>,
+- <GIC_SPI 336 IRQ_TYPE_EDGE_RISING>,
+ <GIC_SPI 337 IRQ_TYPE_EDGE_RISING>;
+- interrupt-names = "int_req", "dma_rx", "dma_tx", "dma_rt";
++ interrupt-names = "int_req", "dma_rt";
+ clocks = <&cpg CPG_MOD R9A07G054_SSI2_PCLK2>,
+ <&cpg CPG_MOD R9A07G054_SSI2_PCLK_SFR>,
+ <&audio_clk1>, <&audio_clk2>;
+@@ -238,9 +234,8 @@
+ reg = <0 0x1004a800 0 0x400>;
+ interrupts = <GIC_SPI 338 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 339 IRQ_TYPE_EDGE_RISING>,
+- <GIC_SPI 340 IRQ_TYPE_EDGE_RISING>,
+- <GIC_SPI 341 IRQ_TYPE_EDGE_RISING>;
+- interrupt-names = "int_req", "dma_rx", "dma_tx", "dma_rt";
++ <GIC_SPI 340 IRQ_TYPE_EDGE_RISING>;
++ interrupt-names = "int_req", "dma_rx", "dma_tx";
+ clocks = <&cpg CPG_MOD R9A07G054_SSI3_PCLK2>,
+ <&cpg CPG_MOD R9A07G054_SSI3_PCLK_SFR>,
+ <&audio_clk1>, <&audio_clk2>;
+--
+2.39.2
+
--- /dev/null
+From a149a8f2389216a8cfd8b54d787b47484b7421db Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 2 Apr 2023 12:50:51 +0300
+Subject: arm64: dts: rockchip: Assign PLL_PPLL clock rate to 1.1 GHz on
+ rk3588s
+
+From: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+
+[ Upstream commit b46a22dea7530cf530a45c6b84c03300083b813d ]
+
+The clock rate for PLL_PPLL has been wrongly initialized to 100 MHz
+instead of 1.1 GHz. Fix it.
+
+Fixes: c9211fa2602b ("arm64: dts: rockchip: Add base DT for rk3588 SoC")
+Reported-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+Link: https://lore.kernel.org/r/20230402095054.384739-3-cristian.ciocaltea@collabora.com
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3588s.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3588s.dtsi b/arch/arm64/boot/dts/rockchip/rk3588s.dtsi
+index a506948b5572b..f4eae4dde1751 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3588s.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3588s.dtsi
+@@ -423,7 +423,7 @@
+ <&cru ACLK_BUS_ROOT>, <&cru CLK_150M_SRC>,
+ <&cru CLK_GPU>;
+ assigned-clock-rates =
+- <100000000>, <786432000>,
++ <1100000000>, <786432000>,
+ <850000000>, <1188000000>,
+ <702000000>,
+ <400000000>, <500000000>,
+--
+2.39.2
+
--- /dev/null
+From 5da3c40112e186f9b23f72ea7a9ce49dc3ec4fee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Mar 2023 10:30:05 -0700
+Subject: arm64: dts: sc7180: Rename qspi data12 as data23
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit d84f8f2687bdc67f20262e822b206419bcfd0038 ]
+
+There are 4 qspi data pins: data0, data1, data2, and data3. Currently
+we have a shared pin state for data0 and data1 (2 lane config) and a
+pin state for data2 and data3 (you'd enable both this and the 2 lane
+state for 4 lanes). The second state is obviously misnamed. Fix it.
+
+Fixes: ba3fc6496366 ("arm64: dts: sc7180: Add qupv3_0 and qupv3_1")
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Acked-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230323102605.1.Ifc1b5be04653f4ab119698a5944bfecded2080d6@changeid
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sc7180.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sc7180.dtsi b/arch/arm64/boot/dts/qcom/sc7180.dtsi
+index ebfa21e9ed8a8..fe62ce516c4e4 100644
+--- a/arch/arm64/boot/dts/qcom/sc7180.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc7180.dtsi
+@@ -1540,7 +1540,7 @@
+ function = "qspi_data";
+ };
+
+- qspi_data12: qspi-data12-state {
++ qspi_data23: qspi-data23-state {
+ pins = "gpio66", "gpio67";
+ function = "qspi_data";
+ };
+--
+2.39.2
+
--- /dev/null
+From b3e7565f88dc91ba6e2e87b1aa2397c17865f906 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Mar 2023 10:30:06 -0700
+Subject: arm64: dts: sc7280: Rename qspi data12 as data23
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit 14acf21c0d3f7b7298ffcd2e5b5db4a476ec6202 ]
+
+There are 4 qspi data pins: data0, data1, data2, and data3. Currently
+we have a shared pin state for data0 and data1 (2 lane config) and a
+pin state for data2 and data3 (you'd enable both this and the 2 lane
+state for 4 lanes). The second state is obviously misnamed. Fix it.
+
+Fixes: 7720ea001b52 ("arm64: dts: qcom: sc7280: Add QSPI node")
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Acked-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230323102605.2.I4043491bb24b1e92267c5033d76cdb0fe60934da@changeid
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sc7280.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sc7280.dtsi b/arch/arm64/boot/dts/qcom/sc7280.dtsi
+index 98c7e534f1ab9..95b3819bf4c0e 100644
+--- a/arch/arm64/boot/dts/qcom/sc7280.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc7280.dtsi
+@@ -4353,7 +4353,7 @@
+ function = "qspi_data";
+ };
+
+- qspi_data12: qspi-data12-state {
++ qspi_data23: qspi-data23-state {
+ pins = "gpio16", "gpio17";
+ function = "qspi_data";
+ };
+--
+2.39.2
+
--- /dev/null
+From 009f1612fc3f2fb225738b4ef9f41619f60937f3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Mar 2023 10:30:07 -0700
+Subject: arm64: dts: sdm845: Rename qspi data12 as data23
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit 37f7349b56decc91c66f8039712e63740b1f25f9 ]
+
+There are 4 qspi data pins: data0, data1, data2, and data3. Currently
+we have a shared pin state for data0 and data1 (2 lane config) and a
+pin state for data2 and data3 (you'd enable both this and the 2 lane
+state for 4 lanes). The second state is obviously misnamed. Fix it.
+
+Fixes: e1ce853932b7 ("arm64: dts: qcom: sdm845: Add qspi (quad SPI) node")
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Acked-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230323102605.3.I88528d037b7fda4e53a40f661be5ac61628691cd@changeid
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sdm845.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sdm845.dtsi b/arch/arm64/boot/dts/qcom/sdm845.dtsi
+index 5e640e01e8518..c5e92851a4f08 100644
+--- a/arch/arm64/boot/dts/qcom/sdm845.dtsi
++++ b/arch/arm64/boot/dts/qcom/sdm845.dtsi
+@@ -2763,7 +2763,7 @@
+ function = "qspi_data";
+ };
+
+- qspi_data12: qspi-data12-state {
++ qspi_data23: qspi-data23-state {
+ pins = "gpio93", "gpio94";
+ function = "qspi_data";
+ };
+--
+2.39.2
+
--- /dev/null
+From 71189a39fcbc85c098ae9786f4f12438f76b5529 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Feb 2023 14:29:17 +0530
+Subject: arm64: dts: ti: k3-am62-main: Fix GPIO numbers in DT
+
+From: Nitin Yadav <n-yadav@ti.com>
+
+[ Upstream commit 28c8f2189d80c8b37068c367e9864b5aa530f208 ]
+
+Fix number of gpio pins in main_gpio0 & main_gpio1
+DT nodes according to AM62x SK datasheet. The Link
+of datasheet is in the following line:
+https://www.ti.com/lit/ds/symlink/am625.pdf?ts=1673852494660
+
+Section: 6.3.10 GPIO (Page No. 63-67)
+
+Fixes: f1d17330a5be ("arm64: dts: ti: Introduce base support for AM62x SoC")
+Signed-off-by: Nitin Yadav <n-yadav@ti.com>
+Signed-off-by: Nishanth Menon <nm@ti.com>
+Reviewed-by: Bryan Brattlof <bb@ti.com>
+Link: https://lore.kernel.org/r/20230202085917.3044567-1-n-yadav@ti.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/ti/k3-am62-main.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/ti/k3-am62-main.dtsi b/arch/arm64/boot/dts/ti/k3-am62-main.dtsi
+index ea683fd77d6a5..a143ea5e78a52 100644
+--- a/arch/arm64/boot/dts/ti/k3-am62-main.dtsi
++++ b/arch/arm64/boot/dts/ti/k3-am62-main.dtsi
+@@ -461,7 +461,7 @@
+ <193>, <194>, <195>;
+ interrupt-controller;
+ #interrupt-cells = <2>;
+- ti,ngpio = <87>;
++ ti,ngpio = <92>;
+ ti,davinci-gpio-unbanked = <0>;
+ power-domains = <&k3_pds 77 TI_SCI_PD_EXCLUSIVE>;
+ clocks = <&k3_clks 77 0>;
+@@ -478,7 +478,7 @@
+ <183>, <184>, <185>;
+ interrupt-controller;
+ #interrupt-cells = <2>;
+- ti,ngpio = <88>;
++ ti,ngpio = <52>;
+ ti,davinci-gpio-unbanked = <0>;
+ power-domains = <&k3_pds 78 TI_SCI_PD_EXCLUSIVE>;
+ clocks = <&k3_clks 78 0>;
+--
+2.39.2
+
--- /dev/null
+From f70b754bda08530e0108f1333ad1da8319c303b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Mar 2023 10:19:34 +0530
+Subject: arm64: dts: ti: k3-am625: Correct L2 cache size to 512KB
+
+From: Vignesh Raghavendra <vigneshr@ti.com>
+
+[ Upstream commit 6974371cab1c488a53960945cb139b20ebb5f16b ]
+
+Per AM62x SoC datasheet[0] L2 cache is 512KB.
+
+[0] https://www.ti.com/lit/gpn/am625 Page 1.
+
+Fixes: f1d17330a5be ("arm64: dts: ti: Introduce base support for AM62x SoC")
+Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
+Link: https://lore.kernel.org/r/20230320044935.2512288-1-vigneshr@ti.com
+Signed-off-by: Nishanth Menon <nm@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/ti/k3-am625.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/ti/k3-am625.dtsi b/arch/arm64/boot/dts/ti/k3-am625.dtsi
+index acc7f8ab64261..4193c2b3eed60 100644
+--- a/arch/arm64/boot/dts/ti/k3-am625.dtsi
++++ b/arch/arm64/boot/dts/ti/k3-am625.dtsi
+@@ -148,7 +148,7 @@
+ compatible = "cache";
+ cache-unified;
+ cache-level = <2>;
+- cache-size = <0x40000>;
++ cache-size = <0x80000>;
+ cache-line-size = <64>;
+ cache-sets = <512>;
+ };
+--
+2.39.2
+
--- /dev/null
+From 4db1dc9af5344d935b08c8ba144e7d225bcb9c61 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Mar 2023 15:43:14 +0300
+Subject: arm64: dts: ti: k3-am625-sk: Add ti,vbus-divider property to usbss1
+
+From: Dhruva Gole <d-gole@ti.com>
+
+[ Upstream commit 4b71618cb772f20dfeeba826e9d1713a04f9687f ]
+
+The property "ti,vbus-divider" is needed for both usbss0 and usbss1 as
+both USB0 and USB1 have the same external voltage divider circuit.
+
+Fixes: 2d94dfc43885 ("arm64: dts: ti: k3-am625-sk: Add support for USB")
+Signed-off-by: Dhruva Gole <d-gole@ti.com>
+Signed-off-by: Roger Quadros <rogerq@kernel.org>
+Link: https://lore.kernel.org/r/20230328124315.123778-2-rogerq@kernel.org
+Signed-off-by: Nishanth Menon <nm@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/ti/k3-am625-sk.dts | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/boot/dts/ti/k3-am625-sk.dts b/arch/arm64/boot/dts/ti/k3-am625-sk.dts
+index 6bc7d63cf52fe..4d5dec890ad66 100644
+--- a/arch/arm64/boot/dts/ti/k3-am625-sk.dts
++++ b/arch/arm64/boot/dts/ti/k3-am625-sk.dts
+@@ -480,6 +480,7 @@
+
+ &usbss1 {
+ status = "okay";
++ ti,vbus-divider;
+ };
+
+ &usb0 {
+--
+2.39.2
+
--- /dev/null
+From b0f3c8bcf2994b295aa446c6184c1e96fe59bdaf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Mar 2023 10:19:35 +0530
+Subject: arm64: dts: ti: k3-am62a7: Correct L2 cache size to 512KB
+
+From: Vignesh Raghavendra <vigneshr@ti.com>
+
+[ Upstream commit 438b8dc949bf45979c32553e96086ff1c6e2504e ]
+
+Per AM62Ax SoC datasheet[0] L2 cache is 512KB.
+
+[0] https://www.ti.com/lit/gpn/am62a7 Page 1.
+
+Fixes: 5fc6b1b62639 ("arm64: dts: ti: Introduce AM62A7 family of SoCs")
+Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
+Link: https://lore.kernel.org/r/20230320044935.2512288-2-vigneshr@ti.com
+Signed-off-by: Nishanth Menon <nm@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/ti/k3-am62a7.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/ti/k3-am62a7.dtsi b/arch/arm64/boot/dts/ti/k3-am62a7.dtsi
+index 9734549851c06..58f1c43edcf8f 100644
+--- a/arch/arm64/boot/dts/ti/k3-am62a7.dtsi
++++ b/arch/arm64/boot/dts/ti/k3-am62a7.dtsi
+@@ -97,7 +97,7 @@
+ compatible = "cache";
+ cache-unified;
+ cache-level = <2>;
+- cache-size = <0x40000>;
++ cache-size = <0x80000>;
+ cache-line-size = <64>;
+ cache-sets = <512>;
+ };
+--
+2.39.2
+
--- /dev/null
+From 8272149f13ec7bafbb38febfa9bd8f67730defe3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Mar 2023 15:16:45 +0530
+Subject: arm64: dts: ti: k3-am62a7-sk: Fix DDR size to full 4GB
+
+From: Devarsh Thakkar <devarsht@ti.com>
+
+[ Upstream commit a1bc0d6084dba8a31831c65318a8a8e46f00906f ]
+
+All revisions of AM62A7-SK board have 4GB LPDDR4 Micron
+MT53E2G32D4DE-046 AUT:B memory. Commit 38c4a08c820c ("arm64: dts: ti:
+Add support for AM62A7-SK") enabled just 2GB due to a schematics error
+in early revision of the board. Fix it by enabling full 4GB available on
+the platform.
+
+Design docs: https://www.ti.com/lit/zip/sprr459
+
+Fixes: 38c4a08c820c ("arm64: dts: ti: Add support for AM62A7-SK")
+Signed-off-by: Devarsh Thakkar <devarsht@ti.com>
+Signed-off-by: Nishanth Menon <nm@ti.com>
+Reviewed-by: Bryan Brattlof <bb@ti.com>
+Link: https://lore.kernel.org/r/20230314094645.3411599-1-devarsht@ti.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/ti/k3-am62a7-sk.dts | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts b/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts
+index 5c9012141ee23..f6a67f072dca6 100644
+--- a/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts
++++ b/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts
+@@ -27,8 +27,9 @@
+
+ memory@80000000 {
+ device_type = "memory";
+- /* 2G RAM */
+- reg = <0x00000000 0x80000000 0x00000000 0x80000000>;
++ /* 4G RAM */
++ reg = <0x00000000 0x80000000 0x00000000 0x80000000>,
++ <0x00000008 0x80000000 0x00000000 0x80000000>;
+ };
+
+ reserved-memory {
+--
+2.39.2
+
--- /dev/null
+From ce6e714dc41ff755e9cadb1c1baa88ea8e066098 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Feb 2023 13:07:24 +0530
+Subject: arm64: dts: ti: k3-j721e-main: Remove ti,strobe-sel property
+
+From: Bhavya Kapoor <b-kapoor@ti.com>
+
+[ Upstream commit 4f4b30a777d3e61603119297965343a37be36435 ]
+
+According to latest errata of J721e [1], (i2024) 'MMCSD: Peripherals
+Do Not Support HS400' which applies to MMCSD0 subsystem. Speed modes
+supported has been already updated but missed dropping 'ti,strobe-sel'
+property which is only required by HS400 speed mode.
+
+Thus, drop 'ti,strobe-sel' property from kernel dtsi for J721e SoC.
+
+[1] https://www.ti.com/lit/er/sprz455/sprz455.pdf
+
+Fixes: eb8f6194e807 ("arm64: dts: ti: k3-j721e-main: Update the speed modes supported and their itap delay values for MMCSD subsystems")
+Signed-off-by: Bhavya Kapoor <b-kapoor@ti.com>
+Signed-off-by: Nishanth Menon <nm@ti.com>
+Reviewed-by: Diwakar Dhyani <d-dhyani@ti.com>
+Reviewed-by: Nitin Yadav <n-yadav@ti.com>
+Link: https://lore.kernel.org/r/20230203073724.29529-1-b-kapoor@ti.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/ti/k3-j721e-main.dtsi | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/ti/k3-j721e-main.dtsi b/arch/arm64/boot/dts/ti/k3-j721e-main.dtsi
+index c935622f01028..bfa296dce3a31 100644
+--- a/arch/arm64/boot/dts/ti/k3-j721e-main.dtsi
++++ b/arch/arm64/boot/dts/ti/k3-j721e-main.dtsi
+@@ -1180,7 +1180,6 @@
+ ti,itap-del-sel-mmc-hs = <0xa>;
+ ti,itap-del-sel-ddr52 = <0x3>;
+ ti,trm-icp = <0x8>;
+- ti,strobe-sel = <0x77>;
+ dma-coherent;
+ };
+
+--
+2.39.2
+
--- /dev/null
+From 247f1e11f20a16d1da925467676dc558cfb1cd38 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Mar 2023 20:56:10 +0530
+Subject: arm64: dts: ti: k3-j784s4-*: Add 'ti,sci-dev-id' for NAVSS nodes
+
+From: Jayesh Choudhary <j-choudhary@ti.com>
+
+[ Upstream commit 436b288687176bf4d2c1cd25b86173e5a1649a60 ]
+
+TISCI device ID for main_navss and mcu_navss nodes are missing in
+the device tree. Add them.
+
+Fixes: 4664ebd8346a ("arm64: dts: ti: Add initial support for J784S4 SoC")
+Signed-off-by: Jayesh Choudhary <j-choudhary@ti.com>
+Signed-off-by: Nishanth Menon <nm@ti.com>
+Reviewed-by: Kamlesh Gurudasani <kamlesh@ti.com>
+Link: https://lore.kernel.org/r/20230314152611.140969-2-j-choudhary@ti.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/ti/k3-j784s4-main.dtsi | 1 +
+ arch/arm64/boot/dts/ti/k3-j784s4-mcu-wakeup.dtsi | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/ti/k3-j784s4-main.dtsi b/arch/arm64/boot/dts/ti/k3-j784s4-main.dtsi
+index 7edf324ac159b..80a1b08c51a84 100644
+--- a/arch/arm64/boot/dts/ti/k3-j784s4-main.dtsi
++++ b/arch/arm64/boot/dts/ti/k3-j784s4-main.dtsi
+@@ -398,6 +398,7 @@
+ #address-cells = <2>;
+ #size-cells = <2>;
+ ranges = <0x00 0x30000000 0x00 0x30000000 0x00 0x0c400000>;
++ ti,sci-dev-id = <280>;
+ dma-coherent;
+ dma-ranges;
+
+diff --git a/arch/arm64/boot/dts/ti/k3-j784s4-mcu-wakeup.dtsi b/arch/arm64/boot/dts/ti/k3-j784s4-mcu-wakeup.dtsi
+index 93952af618f65..64bd3dee14aa6 100644
+--- a/arch/arm64/boot/dts/ti/k3-j784s4-mcu-wakeup.dtsi
++++ b/arch/arm64/boot/dts/ti/k3-j784s4-mcu-wakeup.dtsi
+@@ -209,6 +209,7 @@
+ #address-cells = <2>;
+ #size-cells = <2>;
+ ranges = <0x00 0x28380000 0x00 0x28380000 0x00 0x03880000>;
++ ti,sci-dev-id = <323>;
+ dma-coherent;
+ dma-ranges;
+
+--
+2.39.2
+
--- /dev/null
+From 4ebbcd10b25bcfe6d41bc78892db0e64b866bb20 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Feb 2023 13:01:48 +0530
+Subject: arm64: kgdb: Set PSTATE.SS to 1 to re-enable single-step
+
+From: Sumit Garg <sumit.garg@linaro.org>
+
+[ Upstream commit af6c0bd59f4f3ad5daad2f7b777954b1954551d5 ]
+
+Currently only the first attempt to single-step has any effect. After
+that all further stepping remains "stuck" at the same program counter
+value.
+
+Refer to the ARM Architecture Reference Manual (ARM DDI 0487E.a) D2.12,
+PSTATE.SS=1 should be set at each step before transferring the PE to the
+'Active-not-pending' state. The problem here is PSTATE.SS=1 is not set
+since the second single-step.
+
+After the first single-step, the PE transferes to the 'Inactive' state,
+with PSTATE.SS=0 and MDSCR.SS=1, thus PSTATE.SS won't be set to 1 due to
+kernel_active_single_step()=true. Then the PE transferes to the
+'Active-pending' state when ERET and returns to the debugger by step
+exception.
+
+Before this patch:
+==================
+Entering kdb (current=0xffff3376039f0000, pid 1) on processor 0 due to Keyboard Entry
+[0]kdb>
+
+[0]kdb>
+[0]kdb> bp write_sysrq_trigger
+Instruction(i) BP #0 at 0xffffa45c13d09290 (write_sysrq_trigger)
+ is enabled addr at ffffa45c13d09290, hardtype=0 installed=0
+
+[0]kdb> go
+$ echo h > /proc/sysrq-trigger
+
+Entering kdb (current=0xffff4f7e453f8000, pid 175) on processor 1 due to Breakpoint @ 0xffffad651a309290
+[1]kdb> ss
+
+Entering kdb (current=0xffff4f7e453f8000, pid 175) on processor 1 due to SS trap @ 0xffffad651a309294
+[1]kdb> ss
+
+Entering kdb (current=0xffff4f7e453f8000, pid 175) on processor 1 due to SS trap @ 0xffffad651a309294
+[1]kdb>
+
+After this patch:
+=================
+Entering kdb (current=0xffff6851c39f0000, pid 1) on processor 0 due to Keyboard Entry
+[0]kdb> bp write_sysrq_trigger
+Instruction(i) BP #0 at 0xffffc02d2dd09290 (write_sysrq_trigger)
+ is enabled addr at ffffc02d2dd09290, hardtype=0 installed=0
+
+[0]kdb> go
+$ echo h > /proc/sysrq-trigger
+
+Entering kdb (current=0xffff6851c53c1840, pid 174) on processor 1 due to Breakpoint @ 0xffffc02d2dd09290
+[1]kdb> ss
+
+Entering kdb (current=0xffff6851c53c1840, pid 174) on processor 1 due to SS trap @ 0xffffc02d2dd09294
+[1]kdb> ss
+
+Entering kdb (current=0xffff6851c53c1840, pid 174) on processor 1 due to SS trap @ 0xffffc02d2dd09298
+[1]kdb> ss
+
+Entering kdb (current=0xffff6851c53c1840, pid 174) on processor 1 due to SS trap @ 0xffffc02d2dd0929c
+[1]kdb>
+
+Fixes: 44679a4f142b ("arm64: KGDB: Add step debugging support")
+Co-developed-by: Wei Li <liwei391@huawei.com>
+Signed-off-by: Wei Li <liwei391@huawei.com>
+Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
+Tested-by: Douglas Anderson <dianders@chromium.org>
+Acked-by: Daniel Thompson <daniel.thompson@linaro.org>
+Tested-by: Daniel Thompson <daniel.thompson@linaro.org>
+Link: https://lore.kernel.org/r/20230202073148.657746-3-sumit.garg@linaro.org
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/include/asm/debug-monitors.h | 1 +
+ arch/arm64/kernel/debug-monitors.c | 5 +++++
+ arch/arm64/kernel/kgdb.c | 2 ++
+ 3 files changed, 8 insertions(+)
+
+diff --git a/arch/arm64/include/asm/debug-monitors.h b/arch/arm64/include/asm/debug-monitors.h
+index 7b7e05c02691c..13d437bcbf58c 100644
+--- a/arch/arm64/include/asm/debug-monitors.h
++++ b/arch/arm64/include/asm/debug-monitors.h
+@@ -104,6 +104,7 @@ void user_regs_reset_single_step(struct user_pt_regs *regs,
+ void kernel_enable_single_step(struct pt_regs *regs);
+ void kernel_disable_single_step(void);
+ int kernel_active_single_step(void);
++void kernel_rewind_single_step(struct pt_regs *regs);
+
+ #ifdef CONFIG_HAVE_HW_BREAKPOINT
+ int reinstall_suspended_bps(struct pt_regs *regs);
+diff --git a/arch/arm64/kernel/debug-monitors.c b/arch/arm64/kernel/debug-monitors.c
+index 3da09778267ec..64f2ecbdfe5c2 100644
+--- a/arch/arm64/kernel/debug-monitors.c
++++ b/arch/arm64/kernel/debug-monitors.c
+@@ -438,6 +438,11 @@ int kernel_active_single_step(void)
+ }
+ NOKPROBE_SYMBOL(kernel_active_single_step);
+
++void kernel_rewind_single_step(struct pt_regs *regs)
++{
++ set_regs_spsr_ss(regs);
++}
++
+ /* ptrace API */
+ void user_enable_single_step(struct task_struct *task)
+ {
+diff --git a/arch/arm64/kernel/kgdb.c b/arch/arm64/kernel/kgdb.c
+index cda9c1e9864f7..4e1f983df3d1c 100644
+--- a/arch/arm64/kernel/kgdb.c
++++ b/arch/arm64/kernel/kgdb.c
+@@ -224,6 +224,8 @@ int kgdb_arch_handle_exception(int exception_vector, int signo,
+ */
+ if (!kernel_active_single_step())
+ kernel_enable_single_step(linux_regs);
++ else
++ kernel_rewind_single_step(linux_regs);
+ err = 0;
+ break;
+ default:
+--
+2.39.2
+
--- /dev/null
+From 41a54a4b2186e8aa9505e4be7cfa262293db7bfa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Feb 2023 08:43:21 +0000
+Subject: ASoC: cs35l41: Only disable internal boost
+
+From: Lucas Tanure <lucas.tanure@collabora.com>
+
+[ Upstream commit 4658de99d43cd740e019e7fd124b4128f8f4027f ]
+
+In error situations, only the internal boost case should be disabled and
+re-enabled.
+Also, for other boost cases re-enabling the boost to the default internal
+boost config is incorrect.
+
+Fixes: 6450ef559056 ("ASoC: cs35l41: CS35L41 Boosted Smart Amplifier")
+Signed-off-by: Lucas Tanure <lucas.tanure@collabora.com>
+Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Reviewed-by: David Rhodes <david.rhodes@cirrus.com>
+Link: https://lore.kernel.org/r/20230223084324.9076-2-lucas.tanure@collabora.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/cs35l41.c | 34 +++++++++++++++++++---------------
+ 1 file changed, 19 insertions(+), 15 deletions(-)
+
+diff --git a/sound/soc/codecs/cs35l41.c b/sound/soc/codecs/cs35l41.c
+index c223d83e02cfb..f2b5032daa6ae 100644
+--- a/sound/soc/codecs/cs35l41.c
++++ b/sound/soc/codecs/cs35l41.c
+@@ -356,6 +356,19 @@ static const struct snd_kcontrol_new cs35l41_aud_controls[] = {
+ WM_ADSP_FW_CONTROL("DSP1", 0),
+ };
+
++static void cs35l41_boost_enable(struct cs35l41_private *cs35l41, unsigned int enable)
++{
++ switch (cs35l41->hw_cfg.bst_type) {
++ case CS35L41_INT_BOOST:
++ enable = enable ? CS35L41_BST_EN_DEFAULT : CS35L41_BST_DIS_FET_OFF;
++ regmap_update_bits(cs35l41->regmap, CS35L41_PWR_CTRL2, CS35L41_BST_EN_MASK,
++ enable << CS35L41_BST_EN_SHIFT);
++ break;
++ default:
++ break;
++ }
++}
++
+ static irqreturn_t cs35l41_irq(int irq, void *data)
+ {
+ struct cs35l41_private *cs35l41 = data;
+@@ -431,8 +444,7 @@ static irqreturn_t cs35l41_irq(int irq, void *data)
+
+ if (status[0] & CS35L41_BST_OVP_ERR) {
+ dev_crit_ratelimited(cs35l41->dev, "VBST Over Voltage error\n");
+- regmap_update_bits(cs35l41->regmap, CS35L41_PWR_CTRL2,
+- CS35L41_BST_EN_MASK, 0);
++ cs35l41_boost_enable(cs35l41, 0);
+ regmap_write(cs35l41->regmap, CS35L41_IRQ1_STATUS1,
+ CS35L41_BST_OVP_ERR);
+ regmap_write(cs35l41->regmap, CS35L41_PROTECT_REL_ERR_IGN, 0);
+@@ -441,16 +453,13 @@ static irqreturn_t cs35l41_irq(int irq, void *data)
+ CS35L41_BST_OVP_ERR_RLS);
+ regmap_update_bits(cs35l41->regmap, CS35L41_PROTECT_REL_ERR_IGN,
+ CS35L41_BST_OVP_ERR_RLS, 0);
+- regmap_update_bits(cs35l41->regmap, CS35L41_PWR_CTRL2,
+- CS35L41_BST_EN_MASK,
+- CS35L41_BST_EN_DEFAULT << CS35L41_BST_EN_SHIFT);
++ cs35l41_boost_enable(cs35l41, 1);
+ ret = IRQ_HANDLED;
+ }
+
+ if (status[0] & CS35L41_BST_DCM_UVP_ERR) {
+ dev_crit_ratelimited(cs35l41->dev, "DCM VBST Under Voltage Error\n");
+- regmap_update_bits(cs35l41->regmap, CS35L41_PWR_CTRL2,
+- CS35L41_BST_EN_MASK, 0);
++ cs35l41_boost_enable(cs35l41, 0);
+ regmap_write(cs35l41->regmap, CS35L41_IRQ1_STATUS1,
+ CS35L41_BST_DCM_UVP_ERR);
+ regmap_write(cs35l41->regmap, CS35L41_PROTECT_REL_ERR_IGN, 0);
+@@ -459,16 +468,13 @@ static irqreturn_t cs35l41_irq(int irq, void *data)
+ CS35L41_BST_UVP_ERR_RLS);
+ regmap_update_bits(cs35l41->regmap, CS35L41_PROTECT_REL_ERR_IGN,
+ CS35L41_BST_UVP_ERR_RLS, 0);
+- regmap_update_bits(cs35l41->regmap, CS35L41_PWR_CTRL2,
+- CS35L41_BST_EN_MASK,
+- CS35L41_BST_EN_DEFAULT << CS35L41_BST_EN_SHIFT);
++ cs35l41_boost_enable(cs35l41, 1);
+ ret = IRQ_HANDLED;
+ }
+
+ if (status[0] & CS35L41_BST_SHORT_ERR) {
+ dev_crit_ratelimited(cs35l41->dev, "LBST error: powering off!\n");
+- regmap_update_bits(cs35l41->regmap, CS35L41_PWR_CTRL2,
+- CS35L41_BST_EN_MASK, 0);
++ cs35l41_boost_enable(cs35l41, 0);
+ regmap_write(cs35l41->regmap, CS35L41_IRQ1_STATUS1,
+ CS35L41_BST_SHORT_ERR);
+ regmap_write(cs35l41->regmap, CS35L41_PROTECT_REL_ERR_IGN, 0);
+@@ -477,9 +483,7 @@ static irqreturn_t cs35l41_irq(int irq, void *data)
+ CS35L41_BST_SHORT_ERR_RLS);
+ regmap_update_bits(cs35l41->regmap, CS35L41_PROTECT_REL_ERR_IGN,
+ CS35L41_BST_SHORT_ERR_RLS, 0);
+- regmap_update_bits(cs35l41->regmap, CS35L41_PWR_CTRL2,
+- CS35L41_BST_EN_MASK,
+- CS35L41_BST_EN_DEFAULT << CS35L41_BST_EN_SHIFT);
++ cs35l41_boost_enable(cs35l41, 1);
+ ret = IRQ_HANDLED;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 98e71c6ca994cdbf9fa69332a5a0e9fe8180bc59 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Mar 2023 12:49:01 +0300
+Subject: ASoC: es8316: Handle optional IRQ assignment
+
+From: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+
+[ Upstream commit 39db65a0a17b54915b269d3685f253a4731f344c ]
+
+The driver is able to work fine without relying on a mandatory interrupt
+being assigned to the I2C device. This is only needed when making use of
+the jack-detect support.
+
+However, the following warning message is always emitted when there is
+no such interrupt available:
+
+ es8316 0-0011: Failed to get IRQ 0: -22
+
+Do not attempt to request an IRQ if it is not available/valid. This also
+ensures the rather misleading message is not displayed anymore.
+
+Also note the IRQ validation relies on commit dab472eb931bc291 ("i2c /
+ACPI: Use 0 to indicate that device does not have interrupt assigned").
+
+Fixes: 822257661031 ("ASoC: es8316: Add jack-detect support")
+Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/20230328094901.50763-1-cristian.ciocaltea@collabora.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/es8316.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+diff --git a/sound/soc/codecs/es8316.c b/sound/soc/codecs/es8316.c
+index 056c3082fe02c..f7d7a9c91e04c 100644
+--- a/sound/soc/codecs/es8316.c
++++ b/sound/soc/codecs/es8316.c
+@@ -842,12 +842,14 @@ static int es8316_i2c_probe(struct i2c_client *i2c_client)
+ es8316->irq = i2c_client->irq;
+ mutex_init(&es8316->lock);
+
+- ret = devm_request_threaded_irq(dev, es8316->irq, NULL, es8316_irq,
+- IRQF_TRIGGER_HIGH | IRQF_ONESHOT | IRQF_NO_AUTOEN,
+- "es8316", es8316);
+- if (ret) {
+- dev_warn(dev, "Failed to get IRQ %d: %d\n", es8316->irq, ret);
+- es8316->irq = -ENXIO;
++ if (es8316->irq > 0) {
++ ret = devm_request_threaded_irq(dev, es8316->irq, NULL, es8316_irq,
++ IRQF_TRIGGER_HIGH | IRQF_ONESHOT | IRQF_NO_AUTOEN,
++ "es8316", es8316);
++ if (ret) {
++ dev_warn(dev, "Failed to get IRQ %d: %d\n", es8316->irq, ret);
++ es8316->irq = -ENXIO;
++ }
+ }
+
+ return devm_snd_soc_register_component(&i2c_client->dev,
+--
+2.39.2
+
--- /dev/null
+From 683d5dd7178060023f9f66ab46b4d6812297d6ef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Apr 2023 23:26:47 +0800
+Subject: ASoC: fsl_mqs: move of_node_put() to the correct location
+
+From: Liliang Ye <yll@hust.edu.cn>
+
+[ Upstream commit 1c34890273a020d61d6127ade3f68ed1cb21c16a ]
+
+of_node_put() should have been done directly after
+mqs_priv->regmap = syscon_node_to_regmap(gpr_np);
+otherwise it creates a reference leak on the success path.
+
+To fix this, of_node_put() is moved to the correct location, and change
+all the gotos to direct returns.
+
+Fixes: a9d273671440 ("ASoC: fsl_mqs: Fix error handling in probe")
+Signed-off-by: Liliang Ye <yll@hust.edu.cn>
+Reviewed-by: Dan Carpenter <error27@gmail.com>
+Link: https://lore.kernel.org/r/20230403152647.17638-1-yll@hust.edu.cn
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/fsl/fsl_mqs.c | 15 +++++----------
+ 1 file changed, 5 insertions(+), 10 deletions(-)
+
+diff --git a/sound/soc/fsl/fsl_mqs.c b/sound/soc/fsl/fsl_mqs.c
+index 4922e6795b73f..32d20d351bbf7 100644
+--- a/sound/soc/fsl/fsl_mqs.c
++++ b/sound/soc/fsl/fsl_mqs.c
+@@ -210,10 +210,10 @@ static int fsl_mqs_probe(struct platform_device *pdev)
+ }
+
+ mqs_priv->regmap = syscon_node_to_regmap(gpr_np);
++ of_node_put(gpr_np);
+ if (IS_ERR(mqs_priv->regmap)) {
+ dev_err(&pdev->dev, "failed to get gpr regmap\n");
+- ret = PTR_ERR(mqs_priv->regmap);
+- goto err_free_gpr_np;
++ return PTR_ERR(mqs_priv->regmap);
+ }
+ } else {
+ regs = devm_platform_ioremap_resource(pdev, 0);
+@@ -242,8 +242,7 @@ static int fsl_mqs_probe(struct platform_device *pdev)
+ if (IS_ERR(mqs_priv->mclk)) {
+ dev_err(&pdev->dev, "failed to get the clock: %ld\n",
+ PTR_ERR(mqs_priv->mclk));
+- ret = PTR_ERR(mqs_priv->mclk);
+- goto err_free_gpr_np;
++ return PTR_ERR(mqs_priv->mclk);
+ }
+
+ dev_set_drvdata(&pdev->dev, mqs_priv);
+@@ -252,13 +251,9 @@ static int fsl_mqs_probe(struct platform_device *pdev)
+ ret = devm_snd_soc_register_component(&pdev->dev, &soc_codec_fsl_mqs,
+ &fsl_mqs_dai, 1);
+ if (ret)
+- goto err_free_gpr_np;
+- return 0;
+-
+-err_free_gpr_np:
+- of_node_put(gpr_np);
++ return ret;
+
+- return ret;
++ return 0;
+ }
+
+ static int fsl_mqs_remove(struct platform_device *pdev)
+--
+2.39.2
+
--- /dev/null
+From 54286c23610b8f96295416e3a527adeea34dc6a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Apr 2023 06:04:31 +0530
+Subject: ASoC: mediatek: common: Fix refcount leak in parse_dai_link_info
+
+From: Aashish Sharma <shraash@google.com>
+
+[ Upstream commit beed115c2ce78f990222a29abed042582df4e87c ]
+
+Add missing of_node_put()s before the returns to balance
+of_node_get()s and of_node_put()s, which may get unbalanced
+in case the for loop 'for_each_available_child_of_node' returns
+early.
+
+Fixes: 4302187d955f ("ASoC: mediatek: common: add soundcard driver common code")
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Julia Lawall <julia.lawall@inria.fr>
+Link: https://lore.kernel.org/r/202304090504.2K8L6soj-lkp@intel.com/
+Signed-off-by: Aashish Sharma <shraash@google.com>
+Reviewed-by: Guenter Roeck <groeck@chromium.org>
+Reviewed-by: Trevor Wu <trevor.wu@mediatek.com>
+Link: https://lore.kernel.org/r/20230411003431.4048700-1-shraash@google.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/mediatek/common/mtk-soundcard-driver.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/sound/soc/mediatek/common/mtk-soundcard-driver.c b/sound/soc/mediatek/common/mtk-soundcard-driver.c
+index 7c55c2cb1f214..738093451ccbf 100644
+--- a/sound/soc/mediatek/common/mtk-soundcard-driver.c
++++ b/sound/soc/mediatek/common/mtk-soundcard-driver.c
+@@ -47,20 +47,26 @@ int parse_dai_link_info(struct snd_soc_card *card)
+ /* Loop over all the dai link sub nodes */
+ for_each_available_child_of_node(dev->of_node, sub_node) {
+ if (of_property_read_string(sub_node, "link-name",
+- &dai_link_name))
++ &dai_link_name)) {
++ of_node_put(sub_node);
+ return -EINVAL;
++ }
+
+ for_each_card_prelinks(card, i, dai_link) {
+ if (!strcmp(dai_link_name, dai_link->name))
+ break;
+ }
+
+- if (i >= card->num_links)
++ if (i >= card->num_links) {
++ of_node_put(sub_node);
+ return -EINVAL;
++ }
+
+ ret = set_card_codec_info(card, sub_node, dai_link);
+- if (ret < 0)
++ if (ret < 0) {
++ of_node_put(sub_node);
+ return ret;
++ }
+ }
+
+ return 0;
+--
+2.39.2
+
--- /dev/null
+From 9ace83847f0b195b9ac6382a657ffe675995be64 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Mar 2023 14:40:19 +0200
+Subject: ASoC: soc-compress: Inherit atomicity from DAI link for Compress FE
+
+From: Daniel Baluta <daniel.baluta@nxp.com>
+
+[ Upstream commit 37b58becc1cee4d591024f2056d7ffa99c6089e0 ]
+
+After commit bbf7d3b1c4f40 ("ASoC: soc-pcm: align BE 'atomicity' with
+that of the FE") BE and FE atomicity must match.
+
+In the case of Compress PCM there is a mismatch in atomicity between FE
+and BE and we get errors like this:
+
+[ 36.434566] sai1-wm8960-hifi: dpcm_be_connect: FE is atomic but BE
+is nonatomic, invalid configuration
+[ 36.444278] PCM Deep Buffer: ASoC: can't connect SAI1.OUT
+
+In order to fix this we must inherit the atomicity from DAI link
+associated with current PCM Compress FE.
+
+Fixes: bbf7d3b1c4f4 ("ASoC: soc-pcm: align BE 'atomicity' with that of the FE")
+Signed-off-by: Daniel Baluta <daniel.baluta@nxp.com>
+Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20230324124019.30826-1-daniel.baluta@oss.nxp.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/soc-compress.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/sound/soc/soc-compress.c b/sound/soc/soc-compress.c
+index e7aa6f360cabe..d649b0cf4744f 100644
+--- a/sound/soc/soc-compress.c
++++ b/sound/soc/soc-compress.c
+@@ -622,6 +622,9 @@ int snd_soc_new_compress(struct snd_soc_pcm_runtime *rtd, int num)
+ return ret;
+ }
+
++ /* inherit atomicity from DAI link */
++ be_pcm->nonatomic = rtd->dai_link->nonatomic;
++
+ rtd->pcm = be_pcm;
+ rtd->fe_compr = 1;
+ if (rtd->dai_link->dpcm_playback)
+--
+2.39.2
+
--- /dev/null
+From cd753cafcc904fb4926189ca61eba7e170e453f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Apr 2023 08:40:38 +0200
+Subject: blk-mq: don't plug for head insertions in blk_execute_rq_nowait
+
+From: Christoph Hellwig <hch@lst.de>
+
+[ Upstream commit 50947d7fe9fa6abe3ddc40769dfb02a51c58edb6 ]
+
+Plugs never insert at head, so don't plug for head insertions.
+
+Fixes: 1c2d2fff6dc0 ("block: wire-up support for passthrough plugging")
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
+Link: https://lore.kernel.org/r/20230413064057.707578-2-hch@lst.de
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-mq.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/block/blk-mq.c b/block/blk-mq.c
+index f5bec5258d32b..ae08c4936743d 100644
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -1345,7 +1345,7 @@ void blk_execute_rq_nowait(struct request *rq, bool at_head)
+ * device, directly accessing the plug instead of using blk_mq_plug()
+ * should not have any consequences.
+ */
+- if (current->plug)
++ if (current->plug && !at_head)
+ blk_add_rq_to_plug(current->plug, rq);
+ else
+ blk_mq_sched_insert_request(rq, at_head, true, false);
+--
+2.39.2
+
--- /dev/null
+From cea72040945a935b4e67534c29655064b13cc2d3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Apr 2023 16:59:07 +0800
+Subject: bpf/btf: Fix is_int_ptr()
+
+From: Feng Zhou <zhoufeng.zf@bytedance.com>
+
+[ Upstream commit 91f2dc6838c19342f7f2993627c622835cc24890 ]
+
+When tracing a kernel function with arg type is u32*, btf_ctx_access()
+would report error: arg2 type INT is not a struct.
+
+The commit bb6728d75611 ("bpf: Allow access to int pointer arguments
+in tracing programs") added support for int pointer, but did not skip
+modifiers before checking it's type. This patch fixes it.
+
+Fixes: bb6728d75611 ("bpf: Allow access to int pointer arguments in tracing programs")
+Co-developed-by: Chengming Zhou <zhouchengming@bytedance.com>
+Signed-off-by: Chengming Zhou <zhouchengming@bytedance.com>
+Signed-off-by: Feng Zhou <zhoufeng.zf@bytedance.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Jiri Olsa <jolsa@kernel.org>
+Link: https://lore.kernel.org/bpf/20230410085908.98493-2-zhoufeng.zf@bytedance.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/btf.c | 8 ++------
+ 1 file changed, 2 insertions(+), 6 deletions(-)
+
+diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
+index 73780748404c2..3140a7881665d 100644
+--- a/kernel/bpf/btf.c
++++ b/kernel/bpf/btf.c
+@@ -5891,12 +5891,8 @@ struct btf *bpf_prog_get_target_btf(const struct bpf_prog *prog)
+
+ static bool is_int_ptr(struct btf *btf, const struct btf_type *t)
+ {
+- /* t comes in already as a pointer */
+- t = btf_type_by_id(btf, t->type);
+-
+- /* allow const */
+- if (BTF_INFO_KIND(t->info) == BTF_KIND_CONST)
+- t = btf_type_by_id(btf, t->type);
++ /* skip modifiers */
++ t = btf_type_skip_modifiers(btf, t->type, NULL);
+
+ return btf_type_is_int(t);
+ }
+--
+2.39.2
+
--- /dev/null
+From 6bfd65db7e3763fd955c9112029c605d78695b17 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Apr 2023 15:53:38 -0700
+Subject: bpf: Don't EFAULT for getsockopt with optval=NULL
+
+From: Stanislav Fomichev <sdf@google.com>
+
+[ Upstream commit 00e74ae0863827d944e36e56a4ce1e77e50edb91 ]
+
+Some socket options do getsockopt with optval=NULL to estimate the size
+of the final buffer (which is returned via optlen). This breaks BPF
+getsockopt assumptions about permitted optval buffer size. Let's enforce
+these assumptions only when non-NULL optval is provided.
+
+Fixes: 0d01da6afc54 ("bpf: implement getsockopt and setsockopt hooks")
+Reported-by: Martin KaFai Lau <martin.lau@kernel.org>
+Signed-off-by: Stanislav Fomichev <sdf@google.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/ZD7Js4fj5YyI2oLd@google.com/T/#mb68daf700f87a9244a15d01d00c3f0e5b08f49f7
+Link: https://lore.kernel.org/bpf/20230418225343.553806-2-sdf@google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/cgroup.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c
+index bf2fdb33fb313..819f011f0a9cd 100644
+--- a/kernel/bpf/cgroup.c
++++ b/kernel/bpf/cgroup.c
+@@ -1921,14 +1921,17 @@ int __cgroup_bpf_run_filter_getsockopt(struct sock *sk, int level,
+ if (ret < 0)
+ goto out;
+
+- if (ctx.optlen > max_optlen || ctx.optlen < 0) {
++ if (optval && (ctx.optlen > max_optlen || ctx.optlen < 0)) {
+ ret = -EFAULT;
+ goto out;
+ }
+
+ if (ctx.optlen != 0) {
+- if (copy_to_user(optval, ctx.optval, ctx.optlen) ||
+- put_user(ctx.optlen, optlen)) {
++ if (optval && copy_to_user(optval, ctx.optval, ctx.optlen)) {
++ ret = -EFAULT;
++ goto out;
++ }
++ if (put_user(ctx.optlen, optlen)) {
+ ret = -EFAULT;
+ goto out;
+ }
+--
+2.39.2
+
--- /dev/null
+From 667181abdbc671fb106a7814c4b8878495254373 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Mar 2023 10:41:14 -0800
+Subject: bpf: factor out fetching basic kfunc metadata
+
+From: Andrii Nakryiko <andrii@kernel.org>
+
+[ Upstream commit 07236eab7a3139da97aef9f5f21f403be82a82ea ]
+
+Factor out logic to fetch basic kfunc metadata based on struct bpf_insn.
+This is not exactly short or trivial code to just copy/paste and this
+information is sometimes necessary in other parts of the verifier logic.
+Subsequent patches will rely on this to determine if an instruction is
+a kfunc call to iterator next method.
+
+No functional changes intended, including that verbose() warning
+behavior when kfunc is not allowed for a particular program type.
+
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/r/20230308184121.1165081-2-andrii@kernel.org
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Stable-dep-of: f6a6a5a97628 ("bpf: Fix struct_meta lookup for bpf_obj_free_fields kfunc call")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/verifier.c | 92 +++++++++++++++++++++++++++----------------
+ 1 file changed, 59 insertions(+), 33 deletions(-)
+
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index f4f5fadb74c4f..559c9137f834d 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -9788,24 +9788,21 @@ static int check_kfunc_args(struct bpf_verifier_env *env, struct bpf_kfunc_call_
+ return 0;
+ }
+
+-static int check_kfunc_call(struct bpf_verifier_env *env, struct bpf_insn *insn,
+- int *insn_idx_p)
++static int fetch_kfunc_meta(struct bpf_verifier_env *env,
++ struct bpf_insn *insn,
++ struct bpf_kfunc_call_arg_meta *meta,
++ const char **kfunc_name)
+ {
+- const struct btf_type *t, *func, *func_proto, *ptr_type;
+- u32 i, nargs, func_id, ptr_type_id, release_ref_obj_id;
+- struct bpf_reg_state *regs = cur_regs(env);
+- const char *func_name, *ptr_type_name;
+- bool sleepable, rcu_lock, rcu_unlock;
+- struct bpf_kfunc_call_arg_meta meta;
+- int err, insn_idx = *insn_idx_p;
+- const struct btf_param *args;
+- const struct btf_type *ret_t;
++ const struct btf_type *func, *func_proto;
++ u32 func_id, *kfunc_flags;
++ const char *func_name;
+ struct btf *desc_btf;
+- u32 *kfunc_flags;
+
+- /* skip for now, but return error when we find this in fixup_kfunc_call */
++ if (kfunc_name)
++ *kfunc_name = NULL;
++
+ if (!insn->imm)
+- return 0;
++ return -EINVAL;
+
+ desc_btf = find_kfunc_desc_btf(env, insn->off);
+ if (IS_ERR(desc_btf))
+@@ -9814,22 +9811,51 @@ static int check_kfunc_call(struct bpf_verifier_env *env, struct bpf_insn *insn,
+ func_id = insn->imm;
+ func = btf_type_by_id(desc_btf, func_id);
+ func_name = btf_name_by_offset(desc_btf, func->name_off);
++ if (kfunc_name)
++ *kfunc_name = func_name;
+ func_proto = btf_type_by_id(desc_btf, func->type);
+
+ kfunc_flags = btf_kfunc_id_set_contains(desc_btf, resolve_prog_type(env->prog), func_id);
+ if (!kfunc_flags) {
+- verbose(env, "calling kernel function %s is not allowed\n",
+- func_name);
+ return -EACCES;
+ }
+
+- /* Prepare kfunc call metadata */
+- memset(&meta, 0, sizeof(meta));
+- meta.btf = desc_btf;
+- meta.func_id = func_id;
+- meta.kfunc_flags = *kfunc_flags;
+- meta.func_proto = func_proto;
+- meta.func_name = func_name;
++ memset(meta, 0, sizeof(*meta));
++ meta->btf = desc_btf;
++ meta->func_id = func_id;
++ meta->kfunc_flags = *kfunc_flags;
++ meta->func_proto = func_proto;
++ meta->func_name = func_name;
++
++ return 0;
++}
++
++static int check_kfunc_call(struct bpf_verifier_env *env, struct bpf_insn *insn,
++ int *insn_idx_p)
++{
++ const struct btf_type *t, *ptr_type;
++ u32 i, nargs, ptr_type_id, release_ref_obj_id;
++ struct bpf_reg_state *regs = cur_regs(env);
++ const char *func_name, *ptr_type_name;
++ bool sleepable, rcu_lock, rcu_unlock;
++ struct bpf_kfunc_call_arg_meta meta;
++ struct bpf_insn_aux_data *insn_aux;
++ int err, insn_idx = *insn_idx_p;
++ const struct btf_param *args;
++ const struct btf_type *ret_t;
++ struct btf *desc_btf;
++
++ /* skip for now, but return error when we find this in fixup_kfunc_call */
++ if (!insn->imm)
++ return 0;
++
++ err = fetch_kfunc_meta(env, insn, &meta, &func_name);
++ if (err == -EACCES && func_name)
++ verbose(env, "calling kernel function %s is not allowed\n", func_name);
++ if (err)
++ return err;
++ desc_btf = meta.btf;
++ insn_aux = &env->insn_aux_data[insn_idx];
+
+ if (is_kfunc_destructive(&meta) && !capable(CAP_SYS_BOOT)) {
+ verbose(env, "destructive kfunc calls require CAP_SYS_BOOT capability\n");
+@@ -9886,7 +9912,7 @@ static int check_kfunc_call(struct bpf_verifier_env *env, struct bpf_insn *insn,
+ err = release_reference(env, regs[meta.release_regno].ref_obj_id);
+ if (err) {
+ verbose(env, "kfunc %s#%d reference has not been acquired before\n",
+- func_name, func_id);
++ func_name, meta.func_id);
+ return err;
+ }
+ }
+@@ -9898,14 +9924,14 @@ static int check_kfunc_call(struct bpf_verifier_env *env, struct bpf_insn *insn,
+ err = ref_convert_owning_non_owning(env, release_ref_obj_id);
+ if (err) {
+ verbose(env, "kfunc %s#%d conversion of owning ref to non-owning failed\n",
+- func_name, func_id);
++ func_name, meta.func_id);
+ return err;
+ }
+
+ err = release_reference(env, release_ref_obj_id);
+ if (err) {
+ verbose(env, "kfunc %s#%d reference has not been acquired before\n",
+- func_name, func_id);
++ func_name, meta.func_id);
+ return err;
+ }
+ }
+@@ -9915,7 +9941,7 @@ static int check_kfunc_call(struct bpf_verifier_env *env, struct bpf_insn *insn,
+ set_rbtree_add_callback_state);
+ if (err) {
+ verbose(env, "kfunc %s#%d failed callback verification\n",
+- func_name, func_id);
++ func_name, meta.func_id);
+ return err;
+ }
+ }
+@@ -9924,7 +9950,7 @@ static int check_kfunc_call(struct bpf_verifier_env *env, struct bpf_insn *insn,
+ mark_reg_not_init(env, regs, caller_saved[i]);
+
+ /* Check return type */
+- t = btf_type_skip_modifiers(desc_btf, func_proto->type, NULL);
++ t = btf_type_skip_modifiers(desc_btf, meta.func_proto->type, NULL);
+
+ if (is_kfunc_acquire(&meta) && !btf_type_is_struct_ptr(meta.btf, t)) {
+ /* Only exception is bpf_obj_new_impl */
+@@ -9973,11 +9999,11 @@ static int check_kfunc_call(struct bpf_verifier_env *env, struct bpf_insn *insn,
+ regs[BPF_REG_0].btf = ret_btf;
+ regs[BPF_REG_0].btf_id = ret_btf_id;
+
+- env->insn_aux_data[insn_idx].obj_new_size = ret_t->size;
+- env->insn_aux_data[insn_idx].kptr_struct_meta =
++ insn_aux->obj_new_size = ret_t->size;
++ insn_aux->kptr_struct_meta =
+ btf_find_struct_meta(ret_btf, ret_btf_id);
+ } else if (meta.func_id == special_kfunc_list[KF_bpf_obj_drop_impl]) {
+- env->insn_aux_data[insn_idx].kptr_struct_meta =
++ insn_aux->kptr_struct_meta =
+ btf_find_struct_meta(meta.arg_obj_drop.btf,
+ meta.arg_obj_drop.btf_id);
+ } else if (meta.func_id == special_kfunc_list[KF_bpf_list_pop_front] ||
+@@ -10066,8 +10092,8 @@ static int check_kfunc_call(struct bpf_verifier_env *env, struct bpf_insn *insn,
+ regs[BPF_REG_0].id = ++env->id_gen;
+ } /* else { add_kfunc_call() ensures it is btf_type_is_void(t) } */
+
+- nargs = btf_type_vlen(func_proto);
+- args = (const struct btf_param *)(func_proto + 1);
++ nargs = btf_type_vlen(meta.func_proto);
++ args = (const struct btf_param *)(meta.func_proto + 1);
+ for (i = 0; i < nargs; i++) {
+ u32 regno = i + 1;
+
+--
+2.39.2
+
--- /dev/null
+From 1ee0970c9884570a8b3339e1d38ea55778d8dd58 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Mar 2023 22:30:55 +0100
+Subject: bpf: Fix __reg_bound_offset 64->32 var_off subreg propagation
+
+From: Daniel Borkmann <daniel@iogearbox.net>
+
+[ Upstream commit 7be14c1c9030f73cc18b4ff23b78a0a081f16188 ]
+
+Xu reports that after commit 3f50f132d840 ("bpf: Verifier, do explicit ALU32
+bounds tracking"), the following BPF program is rejected by the verifier:
+
+ 0: (61) r2 = *(u32 *)(r1 +0) ; R2_w=pkt(off=0,r=0,imm=0)
+ 1: (61) r3 = *(u32 *)(r1 +4) ; R3_w=pkt_end(off=0,imm=0)
+ 2: (bf) r1 = r2
+ 3: (07) r1 += 1
+ 4: (2d) if r1 > r3 goto pc+8
+ 5: (71) r1 = *(u8 *)(r2 +0) ; R1_w=scalar(umax=255,var_off=(0x0; 0xff))
+ 6: (18) r0 = 0x7fffffffffffff10
+ 8: (0f) r1 += r0 ; R1_w=scalar(umin=0x7fffffffffffff10,umax=0x800000000000000f)
+ 9: (18) r0 = 0x8000000000000000
+ 11: (07) r0 += 1
+ 12: (ad) if r0 < r1 goto pc-2
+ 13: (b7) r0 = 0
+ 14: (95) exit
+
+And the verifier log says:
+
+ func#0 @0
+ 0: R1=ctx(off=0,imm=0) R10=fp0
+ 0: (61) r2 = *(u32 *)(r1 +0) ; R1=ctx(off=0,imm=0) R2_w=pkt(off=0,r=0,imm=0)
+ 1: (61) r3 = *(u32 *)(r1 +4) ; R1=ctx(off=0,imm=0) R3_w=pkt_end(off=0,imm=0)
+ 2: (bf) r1 = r2 ; R1_w=pkt(off=0,r=0,imm=0) R2_w=pkt(off=0,r=0,imm=0)
+ 3: (07) r1 += 1 ; R1_w=pkt(off=1,r=0,imm=0)
+ 4: (2d) if r1 > r3 goto pc+8 ; R1_w=pkt(off=1,r=1,imm=0) R3_w=pkt_end(off=0,imm=0)
+ 5: (71) r1 = *(u8 *)(r2 +0) ; R1_w=scalar(umax=255,var_off=(0x0; 0xff)) R2_w=pkt(off=0,r=1,imm=0)
+ 6: (18) r0 = 0x7fffffffffffff10 ; R0_w=9223372036854775568
+ 8: (0f) r1 += r0 ; R0_w=9223372036854775568 R1_w=scalar(umin=9223372036854775568,umax=9223372036854775823,s32_min=-240,s32_max=15)
+ 9: (18) r0 = 0x8000000000000000 ; R0_w=-9223372036854775808
+ 11: (07) r0 += 1 ; R0_w=-9223372036854775807
+ 12: (ad) if r0 < r1 goto pc-2 ; R0_w=-9223372036854775807 R1_w=scalar(umin=9223372036854775568,umax=9223372036854775809)
+ 13: (b7) r0 = 0 ; R0_w=0
+ 14: (95) exit
+
+ from 12 to 11: R0_w=-9223372036854775807 R1_w=scalar(umin=9223372036854775810,umax=9223372036854775823,var_off=(0x8000000000000000; 0xffffffff)) R2_w=pkt(off=0,r=1,imm=0) R3_w=pkt_end(off=0,imm=0) R10=fp0
+ 11: (07) r0 += 1 ; R0_w=-9223372036854775806
+ 12: (ad) if r0 < r1 goto pc-2 ; R0_w=-9223372036854775806 R1_w=scalar(umin=9223372036854775810,umax=9223372036854775810,var_off=(0x8000000000000000; 0xffffffff))
+ 13: safe
+
+ [...]
+
+ from 12 to 11: R0_w=-9223372036854775795 R1=scalar(umin=9223372036854775822,umax=9223372036854775823,var_off=(0x8000000000000000; 0xffffffff)) R2=pkt(off=0,r=1,imm=0) R3=pkt_end(off=0,imm=0) R10=fp0
+ 11: (07) r0 += 1 ; R0_w=-9223372036854775794
+ 12: (ad) if r0 < r1 goto pc-2 ; R0_w=-9223372036854775794 R1=scalar(umin=9223372036854775822,umax=9223372036854775822,var_off=(0x8000000000000000; 0xffffffff))
+ 13: safe
+
+ from 12 to 11: R0_w=-9223372036854775794 R1=scalar(umin=9223372036854775823,umax=9223372036854775823,var_off=(0x8000000000000000; 0xffffffff)) R2=pkt(off=0,r=1,imm=0) R3=pkt_end(off=0,imm=0) R10=fp0
+ 11: (07) r0 += 1 ; R0_w=-9223372036854775793
+ 12: (ad) if r0 < r1 goto pc-2 ; R0_w=-9223372036854775793 R1=scalar(umin=9223372036854775823,umax=9223372036854775823,var_off=(0x8000000000000000; 0xffffffff))
+ 13: safe
+
+ from 12 to 11: R0_w=-9223372036854775793 R1=scalar(umin=9223372036854775824,umax=9223372036854775823,var_off=(0x8000000000000000; 0xffffffff)) R2=pkt(off=0,r=1,imm=0) R3=pkt_end(off=0,imm=0) R10=fp0
+ 11: (07) r0 += 1 ; R0_w=-9223372036854775792
+ 12: (ad) if r0 < r1 goto pc-2 ; R0_w=-9223372036854775792 R1=scalar(umin=9223372036854775824,umax=9223372036854775823,var_off=(0x8000000000000000; 0xffffffff))
+ 13: safe
+
+ [...]
+
+The 64bit umin=9223372036854775810 bound continuously bumps by +1 while
+umax=9223372036854775823 stays as-is until the verifier complexity limit
+is reached and the program gets finally rejected. During this simulation,
+the umin also eventually surpasses umax. Looking at the first 'from 12
+to 11' output line from the loop, R1 has the following state:
+
+ R1_w=scalar(umin=0x8000000000000002 (9223372036854775810),
+ umax=0x800000000000000f (9223372036854775823),
+ var_off=(0x8000000000000000;
+ 0xffffffff))
+
+The var_off has technically not an inconsistent state but it's very
+imprecise and far off surpassing 64bit umax bounds whereas the expected
+output with refined known bits in var_off should have been like:
+
+ R1_w=scalar(umin=0x8000000000000002 (9223372036854775810),
+ umax=0x800000000000000f (9223372036854775823),
+ var_off=(0x8000000000000000;
+ 0xf))
+
+In the above log, var_off stays as var_off=(0x8000000000000000; 0xffffffff)
+and does not converge into a narrower mask where more bits become known,
+eventually transforming R1 into a constant upon umin=9223372036854775823,
+umax=9223372036854775823 case where the verifier would have terminated and
+let the program pass.
+
+The __reg_combine_64_into_32() marks the subregister unknown and propagates
+64bit {s,u}min/{s,u}max bounds to their 32bit equivalents iff they are within
+the 32bit universe. The question came up whether __reg_combine_64_into_32()
+should special case the situation that when 64bit {s,u}min bounds have
+the same value as 64bit {s,u}max bounds to then assign the latter as
+well to the 32bit reg->{s,u}32_{min,max}_value. As can be seen from the
+above example however, that is just /one/ special case and not a /generic/
+solution given above example would still not be addressed this way and
+remain at an imprecise var_off=(0x8000000000000000; 0xffffffff).
+
+The improvement is needed in __reg_bound_offset() to refine var32_off with
+the updated var64_off instead of the prior reg->var_off. The reg_bounds_sync()
+code first refines information about the register's min/max bounds via
+__update_reg_bounds() from the current var_off, then in __reg_deduce_bounds()
+from sign bit and with the potentially learned bits from bounds it'll
+update the var_off tnum in __reg_bound_offset(). For example, intersecting
+with the old var_off might have improved bounds slightly, e.g. if umax
+was 0x7f...f and var_off was (0; 0xf...fc), then new var_off will then
+result in (0; 0x7f...fc). The intersected var64_off holds then the
+universe which is a superset of var32_off. The point for the latter is
+not to broaden, but to further refine known bits based on the intersection
+of var_off with 32 bit bounds, so that we later construct the final var_off
+from upper and lower 32 bits. The final __update_reg_bounds() can then
+potentially still slightly refine bounds if more bits became known from the
+new var_off.
+
+After the improvement, we can see R1 converging successively:
+
+ func#0 @0
+ 0: R1=ctx(off=0,imm=0) R10=fp0
+ 0: (61) r2 = *(u32 *)(r1 +0) ; R1=ctx(off=0,imm=0) R2_w=pkt(off=0,r=0,imm=0)
+ 1: (61) r3 = *(u32 *)(r1 +4) ; R1=ctx(off=0,imm=0) R3_w=pkt_end(off=0,imm=0)
+ 2: (bf) r1 = r2 ; R1_w=pkt(off=0,r=0,imm=0) R2_w=pkt(off=0,r=0,imm=0)
+ 3: (07) r1 += 1 ; R1_w=pkt(off=1,r=0,imm=0)
+ 4: (2d) if r1 > r3 goto pc+8 ; R1_w=pkt(off=1,r=1,imm=0) R3_w=pkt_end(off=0,imm=0)
+ 5: (71) r1 = *(u8 *)(r2 +0) ; R1_w=scalar(umax=255,var_off=(0x0; 0xff)) R2_w=pkt(off=0,r=1,imm=0)
+ 6: (18) r0 = 0x7fffffffffffff10 ; R0_w=9223372036854775568
+ 8: (0f) r1 += r0 ; R0_w=9223372036854775568 R1_w=scalar(umin=9223372036854775568,umax=9223372036854775823,s32_min=-240,s32_max=15)
+ 9: (18) r0 = 0x8000000000000000 ; R0_w=-9223372036854775808
+ 11: (07) r0 += 1 ; R0_w=-9223372036854775807
+ 12: (ad) if r0 < r1 goto pc-2 ; R0_w=-9223372036854775807 R1_w=scalar(umin=9223372036854775568,umax=9223372036854775809)
+ 13: (b7) r0 = 0 ; R0_w=0
+ 14: (95) exit
+
+ from 12 to 11: R0_w=-9223372036854775807 R1_w=scalar(umin=9223372036854775810,umax=9223372036854775823,var_off=(0x8000000000000000; 0xf),s32_min=0,s32_max=15,u32_max=15) R2_w=pkt(off=0,r=1,imm=0) R3_w=pkt_end(off=0,imm=0) R10=fp0
+ 11: (07) r0 += 1 ; R0_w=-9223372036854775806
+ 12: (ad) if r0 < r1 goto pc-2 ; R0_w=-9223372036854775806 R1_w=-9223372036854775806
+ 13: safe
+
+ from 12 to 11: R0_w=-9223372036854775806 R1_w=scalar(umin=9223372036854775811,umax=9223372036854775823,var_off=(0x8000000000000000; 0xf),s32_min=0,s32_max=15,u32_max=15) R2_w=pkt(off=0,r=1,imm=0) R3_w=pkt_end(off=0,imm=0) R10=fp0
+ 11: (07) r0 += 1 ; R0_w=-9223372036854775805
+ 12: (ad) if r0 < r1 goto pc-2 ; R0_w=-9223372036854775805 R1_w=-9223372036854775805
+ 13: safe
+
+ [...]
+
+ from 12 to 11: R0_w=-9223372036854775798 R1=scalar(umin=9223372036854775819,umax=9223372036854775823,var_off=(0x8000000000000008; 0x7),s32_min=8,s32_max=15,u32_min=8,u32_max=15) R2=pkt(off=0,r=1,imm=0) R3=pkt_end(off=0,imm=0) R10=fp0
+ 11: (07) r0 += 1 ; R0_w=-9223372036854775797
+ 12: (ad) if r0 < r1 goto pc-2 ; R0_w=-9223372036854775797 R1=-9223372036854775797
+ 13: safe
+
+ from 12 to 11: R0_w=-9223372036854775797 R1=scalar(umin=9223372036854775820,umax=9223372036854775823,var_off=(0x800000000000000c; 0x3),s32_min=12,s32_max=15,u32_min=12,u32_max=15) R2=pkt(off=0,r=1,imm=0) R3=pkt_end(off=0,imm=0) R10=fp0
+ 11: (07) r0 += 1 ; R0_w=-9223372036854775796
+ 12: (ad) if r0 < r1 goto pc-2 ; R0_w=-9223372036854775796 R1=-9223372036854775796
+ 13: safe
+
+ from 12 to 11: R0_w=-9223372036854775796 R1=scalar(umin=9223372036854775821,umax=9223372036854775823,var_off=(0x800000000000000c; 0x3),s32_min=12,s32_max=15,u32_min=12,u32_max=15) R2=pkt(off=0,r=1,imm=0) R3=pkt_end(off=0,imm=0) R10=fp0
+ 11: (07) r0 += 1 ; R0_w=-9223372036854775795
+ 12: (ad) if r0 < r1 goto pc-2 ; R0_w=-9223372036854775795 R1=-9223372036854775795
+ 13: safe
+
+ from 12 to 11: R0_w=-9223372036854775795 R1=scalar(umin=9223372036854775822,umax=9223372036854775823,var_off=(0x800000000000000e; 0x1),s32_min=14,s32_max=15,u32_min=14,u32_max=15) R2=pkt(off=0,r=1,imm=0) R3=pkt_end(off=0,imm=0) R10=fp0
+ 11: (07) r0 += 1 ; R0_w=-9223372036854775794
+ 12: (ad) if r0 < r1 goto pc-2 ; R0_w=-9223372036854775794 R1=-9223372036854775794
+ 13: safe
+
+ from 12 to 11: R0_w=-9223372036854775794 R1=-9223372036854775793 R2=pkt(off=0,r=1,imm=0) R3=pkt_end(off=0,imm=0) R10=fp0
+ 11: (07) r0 += 1 ; R0_w=-9223372036854775793
+ 12: (ad) if r0 < r1 goto pc-2
+ last_idx 12 first_idx 12
+ parent didn't have regs=1 stack=0 marks: R0_rw=P-9223372036854775801 R1_r=scalar(umin=9223372036854775815,umax=9223372036854775823,var_off=(0x8000000000000000; 0xf),s32_min=0,s32_max=15,u32_max=15) R2=pkt(off=0,r=1,imm=0) R3=pkt_end(off=0,imm=0) R10=fp0
+ last_idx 11 first_idx 11
+ regs=1 stack=0 before 11: (07) r0 += 1
+ parent didn't have regs=1 stack=0 marks: R0_rw=P-9223372036854775805 R1_rw=scalar(umin=9223372036854775812,umax=9223372036854775823,var_off=(0x8000000000000000; 0xf),s32_min=0,s32_max=15,u32_max=15) R2_w=pkt(off=0,r=1,imm=0) R3_w=pkt_end(off=0,imm=0) R10=fp0
+ last_idx 12 first_idx 0
+ regs=1 stack=0 before 12: (ad) if r0 < r1 goto pc-2
+ regs=1 stack=0 before 11: (07) r0 += 1
+ regs=1 stack=0 before 12: (ad) if r0 < r1 goto pc-2
+ regs=1 stack=0 before 11: (07) r0 += 1
+ regs=1 stack=0 before 12: (ad) if r0 < r1 goto pc-2
+ regs=1 stack=0 before 11: (07) r0 += 1
+ regs=1 stack=0 before 9: (18) r0 = 0x8000000000000000
+ last_idx 12 first_idx 12
+ parent didn't have regs=2 stack=0 marks: R0_rw=P-9223372036854775801 R1_r=Pscalar(umin=9223372036854775815,umax=9223372036854775823,var_off=(0x8000000000000000; 0xf),s32_min=0,s32_max=15,u32_max=15) R2=pkt(off=0,r=1,imm=0) R3=pkt_end(off=0,imm=0) R10=fp0
+ last_idx 11 first_idx 11
+ regs=2 stack=0 before 11: (07) r0 += 1
+ parent didn't have regs=2 stack=0 marks: R0_rw=P-9223372036854775805 R1_rw=Pscalar(umin=9223372036854775812,umax=9223372036854775823,var_off=(0x8000000000000000; 0xf),s32_min=0,s32_max=15,u32_max=15) R2_w=pkt(off=0,r=1,imm=0) R3_w=pkt_end(off=0,imm=0) R10=fp0
+ last_idx 12 first_idx 0
+ regs=2 stack=0 before 12: (ad) if r0 < r1 goto pc-2
+ regs=2 stack=0 before 11: (07) r0 += 1
+ regs=2 stack=0 before 12: (ad) if r0 < r1 goto pc-2
+ regs=2 stack=0 before 11: (07) r0 += 1
+ regs=2 stack=0 before 12: (ad) if r0 < r1 goto pc-2
+ regs=2 stack=0 before 11: (07) r0 += 1
+ regs=2 stack=0 before 9: (18) r0 = 0x8000000000000000
+ regs=2 stack=0 before 8: (0f) r1 += r0
+ regs=3 stack=0 before 6: (18) r0 = 0x7fffffffffffff10
+ regs=2 stack=0 before 5: (71) r1 = *(u8 *)(r2 +0)
+ 13: safe
+
+ from 4 to 13: safe
+ verification time 322 usec
+ stack depth 0
+ processed 56 insns (limit 1000000) max_states_per_insn 1 total_states 3 peak_states 3 mark_read 1
+
+This also fixes up a test case along with this improvement where we match
+on the verifier log. The updated log now has a refined var_off, too.
+
+Fixes: 3f50f132d840 ("bpf: Verifier, do explicit ALU32 bounds tracking")
+Reported-by: Xu Kuohai <xukuohai@huaweicloud.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Reviewed-by: John Fastabend <john.fastabend@gmail.com>
+Link: https://lore.kernel.org/bpf/20230314203424.4015351-2-xukuohai@huaweicloud.com
+Link: https://lore.kernel.org/bpf/20230322213056.2470-1-daniel@iogearbox.net
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/verifier.c | 6 +++---
+ tools/testing/selftests/bpf/prog_tests/align.c | 4 ++--
+ 2 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index 14604611a35dd..f4f5fadb74c4f 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -1823,9 +1823,9 @@ static void __reg_bound_offset(struct bpf_reg_state *reg)
+ struct tnum var64_off = tnum_intersect(reg->var_off,
+ tnum_range(reg->umin_value,
+ reg->umax_value));
+- struct tnum var32_off = tnum_intersect(tnum_subreg(reg->var_off),
+- tnum_range(reg->u32_min_value,
+- reg->u32_max_value));
++ struct tnum var32_off = tnum_intersect(tnum_subreg(var64_off),
++ tnum_range(reg->u32_min_value,
++ reg->u32_max_value));
+
+ reg->var_off = tnum_or(tnum_clear_subreg(var64_off), var32_off);
+ }
+diff --git a/tools/testing/selftests/bpf/prog_tests/align.c b/tools/testing/selftests/bpf/prog_tests/align.c
+index 4666f88f2bb4f..8baebb41541dc 100644
+--- a/tools/testing/selftests/bpf/prog_tests/align.c
++++ b/tools/testing/selftests/bpf/prog_tests/align.c
+@@ -575,14 +575,14 @@ static struct bpf_align_test tests[] = {
+ /* New unknown value in R7 is (4n), >= 76 */
+ {14, "R7_w=scalar(umin=76,umax=1096,var_off=(0x0; 0x7fc))"},
+ /* Adding it to packet pointer gives nice bounds again */
+- {16, "R5_w=pkt(id=3,off=0,r=0,umin=2,umax=1082,var_off=(0x2; 0xfffffffc)"},
++ {16, "R5_w=pkt(id=3,off=0,r=0,umin=2,umax=1082,var_off=(0x2; 0x7fc)"},
+ /* At the time the word size load is performed from R5,
+ * its total fixed offset is NET_IP_ALIGN + reg->off (0)
+ * which is 2. Then the variable offset is (4n+2), so
+ * the total offset is 4-byte aligned and meets the
+ * load's requirements.
+ */
+- {20, "R5=pkt(id=3,off=0,r=4,umin=2,umax=1082,var_off=(0x2; 0xfffffffc)"},
++ {20, "R5=pkt(id=3,off=0,r=4,umin=2,umax=1082,var_off=(0x2; 0x7fc)"},
+ },
+ },
+ };
+--
+2.39.2
+
--- /dev/null
+From 438ad26e3ae74b92f16b39db8e9022a3a4fbb9c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Mar 2023 11:40:17 -0700
+Subject: bpf: fix precision propagation verbose logging
+
+From: Andrii Nakryiko <andrii@kernel.org>
+
+[ Upstream commit 34f0677e7afd3a292bc1aadda7ce8e35faedb204 ]
+
+Fix wrong order of frame index vs register/slot index in precision
+propagation verbose (level 2) output. It's wrong and very confusing as is.
+
+Fixes: 529409ea92d5 ("bpf: propagate precision across all frames, not just the last one")
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/r/20230313184017.4083374-1-andrii@kernel.org
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/verifier.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index 63510f8a1c7dc..856e2088289da 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -14229,7 +14229,7 @@ static int propagate_precision(struct bpf_verifier_env *env,
+ !(state_reg->live & REG_LIVE_READ))
+ continue;
+ if (env->log.level & BPF_LOG_LEVEL2)
+- verbose(env, "frame %d: propagating r%d\n", i, fr);
++ verbose(env, "frame %d: propagating r%d\n", fr, i);
+ err = mark_chain_precision_frame(env, fr, i);
+ if (err < 0)
+ return err;
+@@ -14245,7 +14245,7 @@ static int propagate_precision(struct bpf_verifier_env *env,
+ continue;
+ if (env->log.level & BPF_LOG_LEVEL2)
+ verbose(env, "frame %d: propagating fp%d\n",
+- (-i - 1) * BPF_REG_SIZE, fr);
++ fr, (-i - 1) * BPF_REG_SIZE);
+ err = mark_chain_precision_stack_frame(env, fr, i);
+ if (err < 0)
+ return err;
+--
+2.39.2
+
--- /dev/null
+From 9531bae44e765a35189235e59a21289ca2e86eed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Apr 2023 18:49:01 -0700
+Subject: bpf: Fix race between btf_put and btf_idr walk.
+
+From: Alexei Starovoitov <ast@kernel.org>
+
+[ Upstream commit acf1c3d68e9a31f10d92bc67ad4673cdae5e8d92 ]
+
+Florian and Eduard reported hard dead lock:
+[ 58.433327] _raw_spin_lock_irqsave+0x40/0x50
+[ 58.433334] btf_put+0x43/0x90
+[ 58.433338] bpf_find_btf_id+0x157/0x240
+[ 58.433353] btf_parse_fields+0x921/0x11c0
+
+This happens since btf->refcount can be 1 at the time of btf_put() and
+btf_put() will call btf_free_id() which will try to grab btf_idr_lock
+and will dead lock.
+Avoid the issue by doing btf_put() without locking.
+
+Fixes: 3d78417b60fb ("bpf: Add bpf_btf_find_by_name_kind() helper.")
+Fixes: 1e89106da253 ("bpf: Add bpf_core_add_cands() and wire it into bpf_core_apply_relo_insn().")
+Reported-by: Florian Westphal <fw@strlen.de>
+Reported-by: Eduard Zingerman <eddyz87@gmail.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Tested-by: Eduard Zingerman <eddyz87@gmail.com>
+Link: https://lore.kernel.org/bpf/20230421014901.70908-1-alexei.starovoitov@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/btf.c | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
+index 3140a7881665d..46bce5577fb48 100644
+--- a/kernel/bpf/btf.c
++++ b/kernel/bpf/btf.c
+@@ -572,8 +572,8 @@ static s32 bpf_find_btf_id(const char *name, u32 kind, struct btf **btf_p)
+ *btf_p = btf;
+ return ret;
+ }
+- spin_lock_bh(&btf_idr_lock);
+ btf_put(btf);
++ spin_lock_bh(&btf_idr_lock);
+ }
+ spin_unlock_bh(&btf_idr_lock);
+ return ret;
+@@ -8245,12 +8245,10 @@ bpf_core_find_cands(struct bpf_core_ctx *ctx, u32 local_type_id)
+ btf_get(mod_btf);
+ spin_unlock_bh(&btf_idr_lock);
+ cands = bpf_core_add_cands(cands, mod_btf, btf_nr_types(main_btf));
+- if (IS_ERR(cands)) {
+- btf_put(mod_btf);
++ btf_put(mod_btf);
++ if (IS_ERR(cands))
+ return ERR_CAST(cands);
+- }
+ spin_lock_bh(&btf_idr_lock);
+- btf_put(mod_btf);
+ }
+ spin_unlock_bh(&btf_idr_lock);
+ /* cands is a pointer to kmalloced memory here if cands->cnt > 0
+--
+2.39.2
+
--- /dev/null
+From dbca12b7b7492ef5825a7eb459eb9510b8f09438 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Apr 2023 13:00:27 -0700
+Subject: bpf: Fix struct_meta lookup for bpf_obj_free_fields kfunc call
+
+From: Dave Marchevsky <davemarchevsky@fb.com>
+
+[ Upstream commit f6a6a5a976288e4d0d94eb1c6c9e983e8e5cdb31 ]
+
+bpf_obj_drop_impl has a void return type. In check_kfunc_call, the "else
+if" which sets insn_aux->kptr_struct_meta for bpf_obj_drop_impl is
+surrounded by a larger if statement which checks btf_type_is_ptr. As a
+result:
+
+ * The bpf_obj_drop_impl-specific code will never execute
+ * The btf_struct_meta input to bpf_obj_drop is always NULL
+ * __bpf_obj_drop_impl will always see a NULL btf_record when called
+ from BPF program, and won't call bpf_obj_free_fields
+ * program-allocated kptrs which have fields that should be cleaned up
+ by bpf_obj_free_fields may instead leak resources
+
+This patch adds a btf_type_is_void branch to the larger if and moves
+special handling for bpf_obj_drop_impl there, fixing the issue.
+
+Fixes: ac9f06050a35 ("bpf: Introduce bpf_obj_drop")
+Cc: Kumar Kartikeya Dwivedi <memxor@gmail.com>
+Signed-off-by: Dave Marchevsky <davemarchevsky@fb.com>
+Link: https://lore.kernel.org/r/20230403200027.2271029-1-davemarchevsky@fb.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/verifier.c | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index 559c9137f834d..64600acbb4e76 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -10002,10 +10002,6 @@ static int check_kfunc_call(struct bpf_verifier_env *env, struct bpf_insn *insn,
+ insn_aux->obj_new_size = ret_t->size;
+ insn_aux->kptr_struct_meta =
+ btf_find_struct_meta(ret_btf, ret_btf_id);
+- } else if (meta.func_id == special_kfunc_list[KF_bpf_obj_drop_impl]) {
+- insn_aux->kptr_struct_meta =
+- btf_find_struct_meta(meta.arg_obj_drop.btf,
+- meta.arg_obj_drop.btf_id);
+ } else if (meta.func_id == special_kfunc_list[KF_bpf_list_pop_front] ||
+ meta.func_id == special_kfunc_list[KF_bpf_list_pop_back]) {
+ struct btf_field *field = meta.arg_list_head.field;
+@@ -10090,7 +10086,15 @@ static int check_kfunc_call(struct bpf_verifier_env *env, struct bpf_insn *insn,
+
+ if (reg_may_point_to_spin_lock(®s[BPF_REG_0]) && !regs[BPF_REG_0].id)
+ regs[BPF_REG_0].id = ++env->id_gen;
+- } /* else { add_kfunc_call() ensures it is btf_type_is_void(t) } */
++ } else if (btf_type_is_void(t)) {
++ if (meta.btf == btf_vmlinux && btf_id_set_contains(&special_kfunc_set, meta.func_id)) {
++ if (meta.func_id == special_kfunc_list[KF_bpf_obj_drop_impl]) {
++ insn_aux->kptr_struct_meta =
++ btf_find_struct_meta(meta.arg_obj_drop.btf,
++ meta.arg_obj_drop.btf_id);
++ }
++ }
++ }
+
+ nargs = btf_type_vlen(meta.func_proto);
+ args = (const struct btf_param *)(meta.func_proto + 1);
+--
+2.39.2
+
--- /dev/null
+From b5b073e6e9486bc9b16ef198269a6eb5ea9c21fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Mar 2023 00:40:24 -0500
+Subject: bpf: Free struct bpf_cpumask in call_rcu handler
+
+From: David Vernet <void@manifault.com>
+
+[ Upstream commit 77473d1a962f3d4f7ba48324502b6d27b8ef2591 ]
+
+The struct bpf_cpumask type uses the bpf_mem_cache_{alloc,free}() APIs
+to allocate and free its cpumasks. The bpf_mem allocator may currently
+immediately reuse some memory when its freed, without waiting for an RCU
+read cycle to elapse. We want to be able to treat struct bpf_cpumask
+objects as completely RCU safe.
+
+This is necessary for two reasons:
+
+1. bpf_cpumask_kptr_get() currently does an RCU-protected
+ refcnt_inc_not_zero(). This of course assumes that the underlying
+ memory is not reused, and is therefore unsafe in its current form.
+
+2. We want to be able to get rid of bpf_cpumask_kptr_get() entirely, and
+ intead use the superior kptr RCU semantics now afforded by the
+ verifier.
+
+This patch fixes (1), and enables (2), by making struct bpf_cpumask RCU
+safe. A subsequent patch will update the verifier to allow struct
+bpf_cpumask * pointers to be passed to KF_RCU kfuncs, and then a latter
+patch will remove bpf_cpumask_kptr_get().
+
+Fixes: 516f4d3397c9 ("bpf: Enable cpumasks to be queried and used as kptrs")
+Signed-off-by: David Vernet <void@manifault.com>
+Link: https://lore.kernel.org/r/20230316054028.88924-2-void@manifault.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/cpumask.c | 19 ++++++++++++++-----
+ 1 file changed, 14 insertions(+), 5 deletions(-)
+
+diff --git a/kernel/bpf/cpumask.c b/kernel/bpf/cpumask.c
+index 2b3fbbfebdc5f..c08132caca33d 100644
+--- a/kernel/bpf/cpumask.c
++++ b/kernel/bpf/cpumask.c
+@@ -9,6 +9,7 @@
+ /**
+ * struct bpf_cpumask - refcounted BPF cpumask wrapper structure
+ * @cpumask: The actual cpumask embedded in the struct.
++ * @rcu: The RCU head used to free the cpumask with RCU safety.
+ * @usage: Object reference counter. When the refcount goes to 0, the
+ * memory is released back to the BPF allocator, which provides
+ * RCU safety.
+@@ -24,6 +25,7 @@
+ */
+ struct bpf_cpumask {
+ cpumask_t cpumask;
++ struct rcu_head rcu;
+ refcount_t usage;
+ };
+
+@@ -108,6 +110,16 @@ __bpf_kfunc struct bpf_cpumask *bpf_cpumask_kptr_get(struct bpf_cpumask **cpumas
+ return cpumask;
+ }
+
++static void cpumask_free_cb(struct rcu_head *head)
++{
++ struct bpf_cpumask *cpumask;
++
++ cpumask = container_of(head, struct bpf_cpumask, rcu);
++ migrate_disable();
++ bpf_mem_cache_free(&bpf_cpumask_ma, cpumask);
++ migrate_enable();
++}
++
+ /**
+ * bpf_cpumask_release() - Release a previously acquired BPF cpumask.
+ * @cpumask: The cpumask being released.
+@@ -121,11 +133,8 @@ __bpf_kfunc void bpf_cpumask_release(struct bpf_cpumask *cpumask)
+ if (!cpumask)
+ return;
+
+- if (refcount_dec_and_test(&cpumask->usage)) {
+- migrate_disable();
+- bpf_mem_cache_free(&bpf_cpumask_ma, cpumask);
+- migrate_enable();
+- }
++ if (refcount_dec_and_test(&cpumask->usage))
++ call_rcu(&cpumask->rcu, cpumask_free_cb);
+ }
+
+ /**
+--
+2.39.2
+
--- /dev/null
+From a9d8b13a97a82efe9947d2a9df82f8f91b8530a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Feb 2023 10:48:21 +0800
+Subject: bpf: Only allocate one bpf_mem_cache for bpf_cpumask_ma
+
+From: Hou Tao <houtao1@huawei.com>
+
+[ Upstream commit 5d5de3a431d87ac51d43da8d796891d014975ab7 ]
+
+The size of bpf_cpumask is fixed, so there is no need to allocate many
+bpf_mem_caches for bpf_cpumask_ma, just one bpf_mem_cache is enough.
+Also add comments for bpf_mem_alloc_init() in bpf_mem_alloc.h to prevent
+future miuse.
+
+Signed-off-by: Hou Tao <houtao1@huawei.com>
+Acked-by: Jiri Olsa <jolsa@kernel.org>
+Link: https://lore.kernel.org/r/20230216024821.2202916-1-houtao@huaweicloud.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Stable-dep-of: 77473d1a962f ("bpf: Free struct bpf_cpumask in call_rcu handler")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/bpf_mem_alloc.h | 7 +++++++
+ kernel/bpf/cpumask.c | 6 +++---
+ 2 files changed, 10 insertions(+), 3 deletions(-)
+
+diff --git a/include/linux/bpf_mem_alloc.h b/include/linux/bpf_mem_alloc.h
+index 3e164b8efaa92..a7104af61ab4d 100644
+--- a/include/linux/bpf_mem_alloc.h
++++ b/include/linux/bpf_mem_alloc.h
+@@ -14,6 +14,13 @@ struct bpf_mem_alloc {
+ struct work_struct work;
+ };
+
++/* 'size != 0' is for bpf_mem_alloc which manages fixed-size objects.
++ * Alloc and free are done with bpf_mem_cache_{alloc,free}().
++ *
++ * 'size = 0' is for bpf_mem_alloc which manages many fixed-size objects.
++ * Alloc and free are done with bpf_mem_{alloc,free}() and the size of
++ * the returned object is given by the size argument of bpf_mem_alloc().
++ */
+ int bpf_mem_alloc_init(struct bpf_mem_alloc *ma, int size, bool percpu);
+ void bpf_mem_alloc_destroy(struct bpf_mem_alloc *ma);
+
+diff --git a/kernel/bpf/cpumask.c b/kernel/bpf/cpumask.c
+index 52b981512a351..2b3fbbfebdc5f 100644
+--- a/kernel/bpf/cpumask.c
++++ b/kernel/bpf/cpumask.c
+@@ -55,7 +55,7 @@ __bpf_kfunc struct bpf_cpumask *bpf_cpumask_create(void)
+ /* cpumask must be the first element so struct bpf_cpumask be cast to struct cpumask. */
+ BUILD_BUG_ON(offsetof(struct bpf_cpumask, cpumask) != 0);
+
+- cpumask = bpf_mem_alloc(&bpf_cpumask_ma, sizeof(*cpumask));
++ cpumask = bpf_mem_cache_alloc(&bpf_cpumask_ma);
+ if (!cpumask)
+ return NULL;
+
+@@ -123,7 +123,7 @@ __bpf_kfunc void bpf_cpumask_release(struct bpf_cpumask *cpumask)
+
+ if (refcount_dec_and_test(&cpumask->usage)) {
+ migrate_disable();
+- bpf_mem_free(&bpf_cpumask_ma, cpumask);
++ bpf_mem_cache_free(&bpf_cpumask_ma, cpumask);
+ migrate_enable();
+ }
+ }
+@@ -468,7 +468,7 @@ static int __init cpumask_kfunc_init(void)
+ },
+ };
+
+- ret = bpf_mem_alloc_init(&bpf_cpumask_ma, 0, false);
++ ret = bpf_mem_alloc_init(&bpf_cpumask_ma, sizeof(struct bpf_cpumask), false);
+ ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_TRACING, &cpumask_kfunc_set);
+ ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_STRUCT_OPS, &cpumask_kfunc_set);
+ return ret ?: register_btf_id_dtor_kfuncs(cpumask_dtors,
+--
+2.39.2
+
--- /dev/null
+From 5a0100926f13b3307e6a9f0871021be7cea45f9b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Mar 2023 17:54:00 +0100
+Subject: bpf: Remove misleading spec_v1 check on var-offset stack read
+
+From: Luis Gerhorst <gerhorst@cs.fau.de>
+
+[ Upstream commit 082cdc69a4651dd2a77539d69416a359ed1214f5 ]
+
+For every BPF_ADD/SUB involving a pointer, adjust_ptr_min_max_vals()
+ensures that the resulting pointer has a constant offset if
+bypass_spec_v1 is false. This is ensured by calling sanitize_check_bounds()
+which in turn calls check_stack_access_for_ptr_arithmetic(). There,
+-EACCESS is returned if the register's offset is not constant, thereby
+rejecting the program.
+
+In summary, an unprivileged user must never be able to create stack
+pointers with a variable offset. That is also the case, because a
+respective check in check_stack_write() is missing. If they were able
+to create a variable-offset pointer, users could still use it in a
+stack-write operation to trigger unsafe speculative behavior [1].
+
+Because unprivileged users must already be prevented from creating
+variable-offset stack pointers, viable options are to either remove
+this check (replacing it with a clarifying comment), or to turn it
+into a "verifier BUG"-message, also adding a similar check in
+check_stack_write() (for consistency, as a second-level defense).
+This patch implements the first option to reduce verifier bloat.
+
+This check was introduced by commit 01f810ace9ed ("bpf: Allow
+variable-offset stack access") which correctly notes that
+"variable-offset reads and writes are disallowed (they were already
+disallowed for the indirect access case) because the speculative
+execution checking code doesn't support them". However, it does not
+further discuss why the check in check_stack_read() is necessary.
+The code which made this check obsolete was also introduced in this
+commit.
+
+I have compiled ~650 programs from the Linux selftests, Linux samples,
+Cilium, and libbpf/examples projects and confirmed that none of these
+trigger the check in check_stack_read() [2]. Instead, all of these
+programs are, as expected, already rejected when constructing the
+variable-offset pointers. Note that the check in
+check_stack_access_for_ptr_arithmetic() also prints "off=%d" while the
+code removed by this patch does not (the error removed does not appear
+in the "verification_error" values). For reproducibility, the
+repository linked includes the raw data and scripts used to create
+the plot.
+
+ [1] https://arxiv.org/pdf/1807.03757.pdf
+ [2] https://gitlab.cs.fau.de/un65esoq/bpf-spectre/-/raw/53dc19fcf459c186613b1156a81504b39c8d49db/data/plots/23-02-26_23-56_bpftool/bpftool/0004-errors.pdf?inline=false
+
+Fixes: 01f810ace9ed ("bpf: Allow variable-offset stack access")
+Signed-off-by: Luis Gerhorst <gerhorst@cs.fau.de>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/20230315165358.23701-1-gerhorst@cs.fau.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/verifier.c | 16 ++++++----------
+ 1 file changed, 6 insertions(+), 10 deletions(-)
+
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index 856e2088289da..672a667b3d760 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -3977,17 +3977,13 @@ static int check_stack_read(struct bpf_verifier_env *env,
+ }
+ /* Variable offset is prohibited for unprivileged mode for simplicity
+ * since it requires corresponding support in Spectre masking for stack
+- * ALU. See also retrieve_ptr_limit().
++ * ALU. See also retrieve_ptr_limit(). The check in
++ * check_stack_access_for_ptr_arithmetic() called by
++ * adjust_ptr_min_max_vals() prevents users from creating stack pointers
++ * with variable offsets, therefore no check is required here. Further,
++ * just checking it here would be insufficient as speculative stack
++ * writes could still lead to unsafe speculative behaviour.
+ */
+- if (!env->bypass_spec_v1 && var_off) {
+- char tn_buf[48];
+-
+- tnum_strn(tn_buf, sizeof(tn_buf), reg->var_off);
+- verbose(env, "R%d variable offset stack access prohibited for !root, var_off=%s\n",
+- ptr_regno, tn_buf);
+- return -EACCES;
+- }
+-
+ if (!var_off) {
+ off += reg->var_off.value;
+ err = check_stack_read_fixed_off(env, state, off, size,
+--
+2.39.2
+
--- /dev/null
+From dcbfb1fbcc9fcd44f839d2015737908959b8c8e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Mar 2023 12:47:54 -0700
+Subject: bpf: return long from bpf_map_ops funcs
+
+From: JP Kobryn <inwardvessel@gmail.com>
+
+[ Upstream commit d7ba4cc900bf1eea2d8c807c6b1fc6bd61f41237 ]
+
+This patch changes the return types of bpf_map_ops functions to long, where
+previously int was returned. Using long allows for bpf programs to maintain
+the sign bit in the absence of sign extension during situations where
+inlined bpf helper funcs make calls to the bpf_map_ops funcs and a negative
+error is returned.
+
+The definitions of the helper funcs are generated from comments in the bpf
+uapi header at `include/uapi/linux/bpf.h`. The return type of these
+helpers was previously changed from int to long in commit bdb7b79b4ce8. For
+any case where one of the map helpers call the bpf_map_ops funcs that are
+still returning 32-bit int, a compiler might not include sign extension
+instructions to properly convert the 32-bit negative value a 64-bit
+negative value.
+
+For example:
+bpf assembly excerpt of an inlined helper calling a kernel function and
+checking for a specific error:
+
+; err = bpf_map_update_elem(&mymap, &key, &val, BPF_NOEXIST);
+ ...
+ 46: call 0xffffffffe103291c ; htab_map_update_elem
+; if (err && err != -EEXIST) {
+ 4b: cmp $0xffffffffffffffef,%rax ; cmp -EEXIST,%rax
+
+kernel function assembly excerpt of return value from
+`htab_map_update_elem` returning 32-bit int:
+
+movl $0xffffffef, %r9d
+...
+movl %r9d, %eax
+
+...results in the comparison:
+cmp $0xffffffffffffffef, $0x00000000ffffffef
+
+Fixes: bdb7b79b4ce8 ("bpf: Switch most helper return values from 32-bit int to 64-bit long")
+Tested-by: Eduard Zingerman <eddyz87@gmail.com>
+Signed-off-by: JP Kobryn <inwardvessel@gmail.com>
+Link: https://lore.kernel.org/r/20230322194754.185781-3-inwardvessel@gmail.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/bpf.h | 14 ++++++-------
+ include/linux/filter.h | 6 +++---
+ kernel/bpf/arraymap.c | 12 ++++++------
+ kernel/bpf/bloom_filter.c | 12 ++++++------
+ kernel/bpf/bpf_cgrp_storage.c | 6 +++---
+ kernel/bpf/bpf_inode_storage.c | 6 +++---
+ kernel/bpf/bpf_struct_ops.c | 6 +++---
+ kernel/bpf/bpf_task_storage.c | 6 +++---
+ kernel/bpf/cpumap.c | 8 ++++----
+ kernel/bpf/devmap.c | 24 +++++++++++------------
+ kernel/bpf/hashtab.c | 36 +++++++++++++++++-----------------
+ kernel/bpf/local_storage.c | 6 +++---
+ kernel/bpf/lpm_trie.c | 6 +++---
+ kernel/bpf/queue_stack_maps.c | 22 ++++++++++-----------
+ kernel/bpf/reuseport_array.c | 2 +-
+ kernel/bpf/ringbuf.c | 6 +++---
+ kernel/bpf/stackmap.c | 6 +++---
+ kernel/bpf/verifier.c | 14 ++++++-------
+ net/core/bpf_sk_storage.c | 6 +++---
+ net/core/sock_map.c | 8 ++++----
+ net/xdp/xskmap.c | 8 ++++----
+ 21 files changed, 110 insertions(+), 110 deletions(-)
+
+diff --git a/include/linux/bpf.h b/include/linux/bpf.h
+index 520b238abd5a2..5bd6ac04773aa 100644
+--- a/include/linux/bpf.h
++++ b/include/linux/bpf.h
+@@ -96,11 +96,11 @@ struct bpf_map_ops {
+
+ /* funcs callable from userspace and from eBPF programs */
+ void *(*map_lookup_elem)(struct bpf_map *map, void *key);
+- int (*map_update_elem)(struct bpf_map *map, void *key, void *value, u64 flags);
+- int (*map_delete_elem)(struct bpf_map *map, void *key);
+- int (*map_push_elem)(struct bpf_map *map, void *value, u64 flags);
+- int (*map_pop_elem)(struct bpf_map *map, void *value);
+- int (*map_peek_elem)(struct bpf_map *map, void *value);
++ long (*map_update_elem)(struct bpf_map *map, void *key, void *value, u64 flags);
++ long (*map_delete_elem)(struct bpf_map *map, void *key);
++ long (*map_push_elem)(struct bpf_map *map, void *value, u64 flags);
++ long (*map_pop_elem)(struct bpf_map *map, void *value);
++ long (*map_peek_elem)(struct bpf_map *map, void *value);
+ void *(*map_lookup_percpu_elem)(struct bpf_map *map, void *key, u32 cpu);
+
+ /* funcs called by prog_array and perf_event_array map */
+@@ -139,7 +139,7 @@ struct bpf_map_ops {
+ struct bpf_local_storage __rcu ** (*map_owner_storage_ptr)(void *owner);
+
+ /* Misc helpers.*/
+- int (*map_redirect)(struct bpf_map *map, u64 key, u64 flags);
++ long (*map_redirect)(struct bpf_map *map, u64 key, u64 flags);
+
+ /* map_meta_equal must be implemented for maps that can be
+ * used as an inner map. It is a runtime check to ensure
+@@ -157,7 +157,7 @@ struct bpf_map_ops {
+ int (*map_set_for_each_callback_args)(struct bpf_verifier_env *env,
+ struct bpf_func_state *caller,
+ struct bpf_func_state *callee);
+- int (*map_for_each_callback)(struct bpf_map *map,
++ long (*map_for_each_callback)(struct bpf_map *map,
+ bpf_callback_t callback_fn,
+ void *callback_ctx, u64 flags);
+
+diff --git a/include/linux/filter.h b/include/linux/filter.h
+index 1727898f16413..370c96acd7098 100644
+--- a/include/linux/filter.h
++++ b/include/linux/filter.h
+@@ -1504,9 +1504,9 @@ static inline bool bpf_sk_lookup_run_v6(struct net *net, int protocol,
+ }
+ #endif /* IS_ENABLED(CONFIG_IPV6) */
+
+-static __always_inline int __bpf_xdp_redirect_map(struct bpf_map *map, u64 index,
+- u64 flags, const u64 flag_mask,
+- void *lookup_elem(struct bpf_map *map, u32 key))
++static __always_inline long __bpf_xdp_redirect_map(struct bpf_map *map, u64 index,
++ u64 flags, const u64 flag_mask,
++ void *lookup_elem(struct bpf_map *map, u32 key))
+ {
+ struct bpf_redirect_info *ri = this_cpu_ptr(&bpf_redirect_info);
+ const u64 action_mask = XDP_ABORTED | XDP_DROP | XDP_PASS | XDP_TX;
+diff --git a/kernel/bpf/arraymap.c b/kernel/bpf/arraymap.c
+index 4847069595569..cb80bcc880b44 100644
+--- a/kernel/bpf/arraymap.c
++++ b/kernel/bpf/arraymap.c
+@@ -307,8 +307,8 @@ static int array_map_get_next_key(struct bpf_map *map, void *key, void *next_key
+ }
+
+ /* Called from syscall or from eBPF program */
+-static int array_map_update_elem(struct bpf_map *map, void *key, void *value,
+- u64 map_flags)
++static long array_map_update_elem(struct bpf_map *map, void *key, void *value,
++ u64 map_flags)
+ {
+ struct bpf_array *array = container_of(map, struct bpf_array, map);
+ u32 index = *(u32 *)key;
+@@ -386,7 +386,7 @@ int bpf_percpu_array_update(struct bpf_map *map, void *key, void *value,
+ }
+
+ /* Called from syscall or from eBPF program */
+-static int array_map_delete_elem(struct bpf_map *map, void *key)
++static long array_map_delete_elem(struct bpf_map *map, void *key)
+ {
+ return -EINVAL;
+ }
+@@ -686,8 +686,8 @@ static const struct bpf_iter_seq_info iter_seq_info = {
+ .seq_priv_size = sizeof(struct bpf_iter_seq_array_map_info),
+ };
+
+-static int bpf_for_each_array_elem(struct bpf_map *map, bpf_callback_t callback_fn,
+- void *callback_ctx, u64 flags)
++static long bpf_for_each_array_elem(struct bpf_map *map, bpf_callback_t callback_fn,
++ void *callback_ctx, u64 flags)
+ {
+ u32 i, key, num_elems = 0;
+ struct bpf_array *array;
+@@ -847,7 +847,7 @@ int bpf_fd_array_map_update_elem(struct bpf_map *map, struct file *map_file,
+ return 0;
+ }
+
+-static int fd_array_map_delete_elem(struct bpf_map *map, void *key)
++static long fd_array_map_delete_elem(struct bpf_map *map, void *key)
+ {
+ struct bpf_array *array = container_of(map, struct bpf_array, map);
+ void *old_ptr;
+diff --git a/kernel/bpf/bloom_filter.c b/kernel/bpf/bloom_filter.c
+index 48ee750849f25..b386a8fdf28cc 100644
+--- a/kernel/bpf/bloom_filter.c
++++ b/kernel/bpf/bloom_filter.c
+@@ -41,7 +41,7 @@ static u32 hash(struct bpf_bloom_filter *bloom, void *value,
+ return h & bloom->bitset_mask;
+ }
+
+-static int bloom_map_peek_elem(struct bpf_map *map, void *value)
++static long bloom_map_peek_elem(struct bpf_map *map, void *value)
+ {
+ struct bpf_bloom_filter *bloom =
+ container_of(map, struct bpf_bloom_filter, map);
+@@ -56,7 +56,7 @@ static int bloom_map_peek_elem(struct bpf_map *map, void *value)
+ return 0;
+ }
+
+-static int bloom_map_push_elem(struct bpf_map *map, void *value, u64 flags)
++static long bloom_map_push_elem(struct bpf_map *map, void *value, u64 flags)
+ {
+ struct bpf_bloom_filter *bloom =
+ container_of(map, struct bpf_bloom_filter, map);
+@@ -73,12 +73,12 @@ static int bloom_map_push_elem(struct bpf_map *map, void *value, u64 flags)
+ return 0;
+ }
+
+-static int bloom_map_pop_elem(struct bpf_map *map, void *value)
++static long bloom_map_pop_elem(struct bpf_map *map, void *value)
+ {
+ return -EOPNOTSUPP;
+ }
+
+-static int bloom_map_delete_elem(struct bpf_map *map, void *value)
++static long bloom_map_delete_elem(struct bpf_map *map, void *value)
+ {
+ return -EOPNOTSUPP;
+ }
+@@ -177,8 +177,8 @@ static void *bloom_map_lookup_elem(struct bpf_map *map, void *key)
+ return ERR_PTR(-EINVAL);
+ }
+
+-static int bloom_map_update_elem(struct bpf_map *map, void *key,
+- void *value, u64 flags)
++static long bloom_map_update_elem(struct bpf_map *map, void *key,
++ void *value, u64 flags)
+ {
+ /* The eBPF program should use map_push_elem instead */
+ return -EINVAL;
+diff --git a/kernel/bpf/bpf_cgrp_storage.c b/kernel/bpf/bpf_cgrp_storage.c
+index 6cdf6d9ed91df..d4a074247b64d 100644
+--- a/kernel/bpf/bpf_cgrp_storage.c
++++ b/kernel/bpf/bpf_cgrp_storage.c
+@@ -100,8 +100,8 @@ static void *bpf_cgrp_storage_lookup_elem(struct bpf_map *map, void *key)
+ return sdata ? sdata->data : NULL;
+ }
+
+-static int bpf_cgrp_storage_update_elem(struct bpf_map *map, void *key,
+- void *value, u64 map_flags)
++static long bpf_cgrp_storage_update_elem(struct bpf_map *map, void *key,
++ void *value, u64 map_flags)
+ {
+ struct bpf_local_storage_data *sdata;
+ struct cgroup *cgroup;
+@@ -132,7 +132,7 @@ static int cgroup_storage_delete(struct cgroup *cgroup, struct bpf_map *map)
+ return 0;
+ }
+
+-static int bpf_cgrp_storage_delete_elem(struct bpf_map *map, void *key)
++static long bpf_cgrp_storage_delete_elem(struct bpf_map *map, void *key)
+ {
+ struct cgroup *cgroup;
+ int err, fd;
+diff --git a/kernel/bpf/bpf_inode_storage.c b/kernel/bpf/bpf_inode_storage.c
+index 05f4c66c9089f..a8afc656808b2 100644
+--- a/kernel/bpf/bpf_inode_storage.c
++++ b/kernel/bpf/bpf_inode_storage.c
+@@ -97,8 +97,8 @@ static void *bpf_fd_inode_storage_lookup_elem(struct bpf_map *map, void *key)
+ return sdata ? sdata->data : NULL;
+ }
+
+-static int bpf_fd_inode_storage_update_elem(struct bpf_map *map, void *key,
+- void *value, u64 map_flags)
++static long bpf_fd_inode_storage_update_elem(struct bpf_map *map, void *key,
++ void *value, u64 map_flags)
+ {
+ struct bpf_local_storage_data *sdata;
+ struct file *f;
+@@ -133,7 +133,7 @@ static int inode_storage_delete(struct inode *inode, struct bpf_map *map)
+ return 0;
+ }
+
+-static int bpf_fd_inode_storage_delete_elem(struct bpf_map *map, void *key)
++static long bpf_fd_inode_storage_delete_elem(struct bpf_map *map, void *key)
+ {
+ struct file *f;
+ int fd, err;
+diff --git a/kernel/bpf/bpf_struct_ops.c b/kernel/bpf/bpf_struct_ops.c
+index ece9870cab68e..36c17271d38bd 100644
+--- a/kernel/bpf/bpf_struct_ops.c
++++ b/kernel/bpf/bpf_struct_ops.c
+@@ -349,8 +349,8 @@ int bpf_struct_ops_prepare_trampoline(struct bpf_tramp_links *tlinks,
+ model, flags, tlinks, NULL);
+ }
+
+-static int bpf_struct_ops_map_update_elem(struct bpf_map *map, void *key,
+- void *value, u64 flags)
++static long bpf_struct_ops_map_update_elem(struct bpf_map *map, void *key,
++ void *value, u64 flags)
+ {
+ struct bpf_struct_ops_map *st_map = (struct bpf_struct_ops_map *)map;
+ const struct bpf_struct_ops *st_ops = st_map->st_ops;
+@@ -524,7 +524,7 @@ static int bpf_struct_ops_map_update_elem(struct bpf_map *map, void *key,
+ return err;
+ }
+
+-static int bpf_struct_ops_map_delete_elem(struct bpf_map *map, void *key)
++static long bpf_struct_ops_map_delete_elem(struct bpf_map *map, void *key)
+ {
+ enum bpf_struct_ops_state prev_state;
+ struct bpf_struct_ops_map *st_map;
+diff --git a/kernel/bpf/bpf_task_storage.c b/kernel/bpf/bpf_task_storage.c
+index 1e486055a523d..b29f0bf28fd15 100644
+--- a/kernel/bpf/bpf_task_storage.c
++++ b/kernel/bpf/bpf_task_storage.c
+@@ -127,8 +127,8 @@ static void *bpf_pid_task_storage_lookup_elem(struct bpf_map *map, void *key)
+ return ERR_PTR(err);
+ }
+
+-static int bpf_pid_task_storage_update_elem(struct bpf_map *map, void *key,
+- void *value, u64 map_flags)
++static long bpf_pid_task_storage_update_elem(struct bpf_map *map, void *key,
++ void *value, u64 map_flags)
+ {
+ struct bpf_local_storage_data *sdata;
+ struct task_struct *task;
+@@ -180,7 +180,7 @@ static int task_storage_delete(struct task_struct *task, struct bpf_map *map,
+ return 0;
+ }
+
+-static int bpf_pid_task_storage_delete_elem(struct bpf_map *map, void *key)
++static long bpf_pid_task_storage_delete_elem(struct bpf_map *map, void *key)
+ {
+ struct task_struct *task;
+ unsigned int f_flags;
+diff --git a/kernel/bpf/cpumap.c b/kernel/bpf/cpumap.c
+index d2110c1f6fa64..90b95a69acbbc 100644
+--- a/kernel/bpf/cpumap.c
++++ b/kernel/bpf/cpumap.c
+@@ -540,7 +540,7 @@ static void __cpu_map_entry_replace(struct bpf_cpu_map *cmap,
+ }
+ }
+
+-static int cpu_map_delete_elem(struct bpf_map *map, void *key)
++static long cpu_map_delete_elem(struct bpf_map *map, void *key)
+ {
+ struct bpf_cpu_map *cmap = container_of(map, struct bpf_cpu_map, map);
+ u32 key_cpu = *(u32 *)key;
+@@ -553,8 +553,8 @@ static int cpu_map_delete_elem(struct bpf_map *map, void *key)
+ return 0;
+ }
+
+-static int cpu_map_update_elem(struct bpf_map *map, void *key, void *value,
+- u64 map_flags)
++static long cpu_map_update_elem(struct bpf_map *map, void *key, void *value,
++ u64 map_flags)
+ {
+ struct bpf_cpu_map *cmap = container_of(map, struct bpf_cpu_map, map);
+ struct bpf_cpumap_val cpumap_value = {};
+@@ -667,7 +667,7 @@ static int cpu_map_get_next_key(struct bpf_map *map, void *key, void *next_key)
+ return 0;
+ }
+
+-static int cpu_map_redirect(struct bpf_map *map, u64 index, u64 flags)
++static long cpu_map_redirect(struct bpf_map *map, u64 index, u64 flags)
+ {
+ return __bpf_xdp_redirect_map(map, index, flags, 0,
+ __cpu_map_lookup_elem);
+diff --git a/kernel/bpf/devmap.c b/kernel/bpf/devmap.c
+index 2675fefc6cb62..38aa5d16b4d85 100644
+--- a/kernel/bpf/devmap.c
++++ b/kernel/bpf/devmap.c
+@@ -809,7 +809,7 @@ static void __dev_map_entry_free(struct rcu_head *rcu)
+ kfree(dev);
+ }
+
+-static int dev_map_delete_elem(struct bpf_map *map, void *key)
++static long dev_map_delete_elem(struct bpf_map *map, void *key)
+ {
+ struct bpf_dtab *dtab = container_of(map, struct bpf_dtab, map);
+ struct bpf_dtab_netdev *old_dev;
+@@ -824,7 +824,7 @@ static int dev_map_delete_elem(struct bpf_map *map, void *key)
+ return 0;
+ }
+
+-static int dev_map_hash_delete_elem(struct bpf_map *map, void *key)
++static long dev_map_hash_delete_elem(struct bpf_map *map, void *key)
+ {
+ struct bpf_dtab *dtab = container_of(map, struct bpf_dtab, map);
+ struct bpf_dtab_netdev *old_dev;
+@@ -895,8 +895,8 @@ static struct bpf_dtab_netdev *__dev_map_alloc_node(struct net *net,
+ return ERR_PTR(-EINVAL);
+ }
+
+-static int __dev_map_update_elem(struct net *net, struct bpf_map *map,
+- void *key, void *value, u64 map_flags)
++static long __dev_map_update_elem(struct net *net, struct bpf_map *map,
++ void *key, void *value, u64 map_flags)
+ {
+ struct bpf_dtab *dtab = container_of(map, struct bpf_dtab, map);
+ struct bpf_dtab_netdev *dev, *old_dev;
+@@ -935,15 +935,15 @@ static int __dev_map_update_elem(struct net *net, struct bpf_map *map,
+ return 0;
+ }
+
+-static int dev_map_update_elem(struct bpf_map *map, void *key, void *value,
+- u64 map_flags)
++static long dev_map_update_elem(struct bpf_map *map, void *key, void *value,
++ u64 map_flags)
+ {
+ return __dev_map_update_elem(current->nsproxy->net_ns,
+ map, key, value, map_flags);
+ }
+
+-static int __dev_map_hash_update_elem(struct net *net, struct bpf_map *map,
+- void *key, void *value, u64 map_flags)
++static long __dev_map_hash_update_elem(struct net *net, struct bpf_map *map,
++ void *key, void *value, u64 map_flags)
+ {
+ struct bpf_dtab *dtab = container_of(map, struct bpf_dtab, map);
+ struct bpf_dtab_netdev *dev, *old_dev;
+@@ -995,21 +995,21 @@ static int __dev_map_hash_update_elem(struct net *net, struct bpf_map *map,
+ return err;
+ }
+
+-static int dev_map_hash_update_elem(struct bpf_map *map, void *key, void *value,
+- u64 map_flags)
++static long dev_map_hash_update_elem(struct bpf_map *map, void *key, void *value,
++ u64 map_flags)
+ {
+ return __dev_map_hash_update_elem(current->nsproxy->net_ns,
+ map, key, value, map_flags);
+ }
+
+-static int dev_map_redirect(struct bpf_map *map, u64 ifindex, u64 flags)
++static long dev_map_redirect(struct bpf_map *map, u64 ifindex, u64 flags)
+ {
+ return __bpf_xdp_redirect_map(map, ifindex, flags,
+ BPF_F_BROADCAST | BPF_F_EXCLUDE_INGRESS,
+ __dev_map_lookup_elem);
+ }
+
+-static int dev_hash_map_redirect(struct bpf_map *map, u64 ifindex, u64 flags)
++static long dev_hash_map_redirect(struct bpf_map *map, u64 ifindex, u64 flags)
+ {
+ return __bpf_xdp_redirect_map(map, ifindex, flags,
+ BPF_F_BROADCAST | BPF_F_EXCLUDE_INGRESS,
+diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c
+index 5dfcb5ad0d068..90852e0e64f26 100644
+--- a/kernel/bpf/hashtab.c
++++ b/kernel/bpf/hashtab.c
+@@ -1057,8 +1057,8 @@ static int check_flags(struct bpf_htab *htab, struct htab_elem *l_old,
+ }
+
+ /* Called from syscall or from eBPF program */
+-static int htab_map_update_elem(struct bpf_map *map, void *key, void *value,
+- u64 map_flags)
++static long htab_map_update_elem(struct bpf_map *map, void *key, void *value,
++ u64 map_flags)
+ {
+ struct bpf_htab *htab = container_of(map, struct bpf_htab, map);
+ struct htab_elem *l_new = NULL, *l_old;
+@@ -1159,8 +1159,8 @@ static void htab_lru_push_free(struct bpf_htab *htab, struct htab_elem *elem)
+ bpf_lru_push_free(&htab->lru, &elem->lru_node);
+ }
+
+-static int htab_lru_map_update_elem(struct bpf_map *map, void *key, void *value,
+- u64 map_flags)
++static long htab_lru_map_update_elem(struct bpf_map *map, void *key, void *value,
++ u64 map_flags)
+ {
+ struct bpf_htab *htab = container_of(map, struct bpf_htab, map);
+ struct htab_elem *l_new, *l_old = NULL;
+@@ -1226,9 +1226,9 @@ static int htab_lru_map_update_elem(struct bpf_map *map, void *key, void *value,
+ return ret;
+ }
+
+-static int __htab_percpu_map_update_elem(struct bpf_map *map, void *key,
+- void *value, u64 map_flags,
+- bool onallcpus)
++static long __htab_percpu_map_update_elem(struct bpf_map *map, void *key,
++ void *value, u64 map_flags,
++ bool onallcpus)
+ {
+ struct bpf_htab *htab = container_of(map, struct bpf_htab, map);
+ struct htab_elem *l_new = NULL, *l_old;
+@@ -1281,9 +1281,9 @@ static int __htab_percpu_map_update_elem(struct bpf_map *map, void *key,
+ return ret;
+ }
+
+-static int __htab_lru_percpu_map_update_elem(struct bpf_map *map, void *key,
+- void *value, u64 map_flags,
+- bool onallcpus)
++static long __htab_lru_percpu_map_update_elem(struct bpf_map *map, void *key,
++ void *value, u64 map_flags,
++ bool onallcpus)
+ {
+ struct bpf_htab *htab = container_of(map, struct bpf_htab, map);
+ struct htab_elem *l_new = NULL, *l_old;
+@@ -1348,21 +1348,21 @@ static int __htab_lru_percpu_map_update_elem(struct bpf_map *map, void *key,
+ return ret;
+ }
+
+-static int htab_percpu_map_update_elem(struct bpf_map *map, void *key,
+- void *value, u64 map_flags)
++static long htab_percpu_map_update_elem(struct bpf_map *map, void *key,
++ void *value, u64 map_flags)
+ {
+ return __htab_percpu_map_update_elem(map, key, value, map_flags, false);
+ }
+
+-static int htab_lru_percpu_map_update_elem(struct bpf_map *map, void *key,
+- void *value, u64 map_flags)
++static long htab_lru_percpu_map_update_elem(struct bpf_map *map, void *key,
++ void *value, u64 map_flags)
+ {
+ return __htab_lru_percpu_map_update_elem(map, key, value, map_flags,
+ false);
+ }
+
+ /* Called from syscall or from eBPF program */
+-static int htab_map_delete_elem(struct bpf_map *map, void *key)
++static long htab_map_delete_elem(struct bpf_map *map, void *key)
+ {
+ struct bpf_htab *htab = container_of(map, struct bpf_htab, map);
+ struct hlist_nulls_head *head;
+@@ -1398,7 +1398,7 @@ static int htab_map_delete_elem(struct bpf_map *map, void *key)
+ return ret;
+ }
+
+-static int htab_lru_map_delete_elem(struct bpf_map *map, void *key)
++static long htab_lru_map_delete_elem(struct bpf_map *map, void *key)
+ {
+ struct bpf_htab *htab = container_of(map, struct bpf_htab, map);
+ struct hlist_nulls_head *head;
+@@ -2119,8 +2119,8 @@ static const struct bpf_iter_seq_info iter_seq_info = {
+ .seq_priv_size = sizeof(struct bpf_iter_seq_hash_map_info),
+ };
+
+-static int bpf_for_each_hash_elem(struct bpf_map *map, bpf_callback_t callback_fn,
+- void *callback_ctx, u64 flags)
++static long bpf_for_each_hash_elem(struct bpf_map *map, bpf_callback_t callback_fn,
++ void *callback_ctx, u64 flags)
+ {
+ struct bpf_htab *htab = container_of(map, struct bpf_htab, map);
+ struct hlist_nulls_head *head;
+diff --git a/kernel/bpf/local_storage.c b/kernel/bpf/local_storage.c
+index e90d9f63edc5d..66d8ce2ab5b34 100644
+--- a/kernel/bpf/local_storage.c
++++ b/kernel/bpf/local_storage.c
+@@ -141,8 +141,8 @@ static void *cgroup_storage_lookup_elem(struct bpf_map *_map, void *key)
+ return &READ_ONCE(storage->buf)->data[0];
+ }
+
+-static int cgroup_storage_update_elem(struct bpf_map *map, void *key,
+- void *value, u64 flags)
++static long cgroup_storage_update_elem(struct bpf_map *map, void *key,
++ void *value, u64 flags)
+ {
+ struct bpf_cgroup_storage *storage;
+ struct bpf_storage_buffer *new;
+@@ -348,7 +348,7 @@ static void cgroup_storage_map_free(struct bpf_map *_map)
+ bpf_map_area_free(map);
+ }
+
+-static int cgroup_storage_delete_elem(struct bpf_map *map, void *key)
++static long cgroup_storage_delete_elem(struct bpf_map *map, void *key)
+ {
+ return -EINVAL;
+ }
+diff --git a/kernel/bpf/lpm_trie.c b/kernel/bpf/lpm_trie.c
+index d833496e9e426..27980506fc7d5 100644
+--- a/kernel/bpf/lpm_trie.c
++++ b/kernel/bpf/lpm_trie.c
+@@ -300,8 +300,8 @@ static struct lpm_trie_node *lpm_trie_node_alloc(const struct lpm_trie *trie,
+ }
+
+ /* Called from syscall or from eBPF program */
+-static int trie_update_elem(struct bpf_map *map,
+- void *_key, void *value, u64 flags)
++static long trie_update_elem(struct bpf_map *map,
++ void *_key, void *value, u64 flags)
+ {
+ struct lpm_trie *trie = container_of(map, struct lpm_trie, map);
+ struct lpm_trie_node *node, *im_node = NULL, *new_node = NULL;
+@@ -431,7 +431,7 @@ static int trie_update_elem(struct bpf_map *map,
+ }
+
+ /* Called from syscall or from eBPF program */
+-static int trie_delete_elem(struct bpf_map *map, void *_key)
++static long trie_delete_elem(struct bpf_map *map, void *_key)
+ {
+ struct lpm_trie *trie = container_of(map, struct lpm_trie, map);
+ struct bpf_lpm_trie_key *key = _key;
+diff --git a/kernel/bpf/queue_stack_maps.c b/kernel/bpf/queue_stack_maps.c
+index 8a5e060de63bc..80f958ff63966 100644
+--- a/kernel/bpf/queue_stack_maps.c
++++ b/kernel/bpf/queue_stack_maps.c
+@@ -95,7 +95,7 @@ static void queue_stack_map_free(struct bpf_map *map)
+ bpf_map_area_free(qs);
+ }
+
+-static int __queue_map_get(struct bpf_map *map, void *value, bool delete)
++static long __queue_map_get(struct bpf_map *map, void *value, bool delete)
+ {
+ struct bpf_queue_stack *qs = bpf_queue_stack(map);
+ unsigned long flags;
+@@ -124,7 +124,7 @@ static int __queue_map_get(struct bpf_map *map, void *value, bool delete)
+ }
+
+
+-static int __stack_map_get(struct bpf_map *map, void *value, bool delete)
++static long __stack_map_get(struct bpf_map *map, void *value, bool delete)
+ {
+ struct bpf_queue_stack *qs = bpf_queue_stack(map);
+ unsigned long flags;
+@@ -156,32 +156,32 @@ static int __stack_map_get(struct bpf_map *map, void *value, bool delete)
+ }
+
+ /* Called from syscall or from eBPF program */
+-static int queue_map_peek_elem(struct bpf_map *map, void *value)
++static long queue_map_peek_elem(struct bpf_map *map, void *value)
+ {
+ return __queue_map_get(map, value, false);
+ }
+
+ /* Called from syscall or from eBPF program */
+-static int stack_map_peek_elem(struct bpf_map *map, void *value)
++static long stack_map_peek_elem(struct bpf_map *map, void *value)
+ {
+ return __stack_map_get(map, value, false);
+ }
+
+ /* Called from syscall or from eBPF program */
+-static int queue_map_pop_elem(struct bpf_map *map, void *value)
++static long queue_map_pop_elem(struct bpf_map *map, void *value)
+ {
+ return __queue_map_get(map, value, true);
+ }
+
+ /* Called from syscall or from eBPF program */
+-static int stack_map_pop_elem(struct bpf_map *map, void *value)
++static long stack_map_pop_elem(struct bpf_map *map, void *value)
+ {
+ return __stack_map_get(map, value, true);
+ }
+
+ /* Called from syscall or from eBPF program */
+-static int queue_stack_map_push_elem(struct bpf_map *map, void *value,
+- u64 flags)
++static long queue_stack_map_push_elem(struct bpf_map *map, void *value,
++ u64 flags)
+ {
+ struct bpf_queue_stack *qs = bpf_queue_stack(map);
+ unsigned long irq_flags;
+@@ -227,14 +227,14 @@ static void *queue_stack_map_lookup_elem(struct bpf_map *map, void *key)
+ }
+
+ /* Called from syscall or from eBPF program */
+-static int queue_stack_map_update_elem(struct bpf_map *map, void *key,
+- void *value, u64 flags)
++static long queue_stack_map_update_elem(struct bpf_map *map, void *key,
++ void *value, u64 flags)
+ {
+ return -EINVAL;
+ }
+
+ /* Called from syscall or from eBPF program */
+-static int queue_stack_map_delete_elem(struct bpf_map *map, void *key)
++static long queue_stack_map_delete_elem(struct bpf_map *map, void *key)
+ {
+ return -EINVAL;
+ }
+diff --git a/kernel/bpf/reuseport_array.c b/kernel/bpf/reuseport_array.c
+index 82c61612f382a..d1188b0350914 100644
+--- a/kernel/bpf/reuseport_array.c
++++ b/kernel/bpf/reuseport_array.c
+@@ -59,7 +59,7 @@ static void *reuseport_array_lookup_elem(struct bpf_map *map, void *key)
+ }
+
+ /* Called from syscall only */
+-static int reuseport_array_delete_elem(struct bpf_map *map, void *key)
++static long reuseport_array_delete_elem(struct bpf_map *map, void *key)
+ {
+ struct reuseport_array *array = reuseport_array(map);
+ u32 index = *(u32 *)key;
+diff --git a/kernel/bpf/ringbuf.c b/kernel/bpf/ringbuf.c
+index 8732e0aadf366..f9bbc254cd449 100644
+--- a/kernel/bpf/ringbuf.c
++++ b/kernel/bpf/ringbuf.c
+@@ -241,13 +241,13 @@ static void *ringbuf_map_lookup_elem(struct bpf_map *map, void *key)
+ return ERR_PTR(-ENOTSUPP);
+ }
+
+-static int ringbuf_map_update_elem(struct bpf_map *map, void *key, void *value,
+- u64 flags)
++static long ringbuf_map_update_elem(struct bpf_map *map, void *key, void *value,
++ u64 flags)
+ {
+ return -ENOTSUPP;
+ }
+
+-static int ringbuf_map_delete_elem(struct bpf_map *map, void *key)
++static long ringbuf_map_delete_elem(struct bpf_map *map, void *key)
+ {
+ return -ENOTSUPP;
+ }
+diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c
+index aecea7451b610..496ce1695dd89 100644
+--- a/kernel/bpf/stackmap.c
++++ b/kernel/bpf/stackmap.c
+@@ -618,14 +618,14 @@ static int stack_map_get_next_key(struct bpf_map *map, void *key,
+ return 0;
+ }
+
+-static int stack_map_update_elem(struct bpf_map *map, void *key, void *value,
+- u64 map_flags)
++static long stack_map_update_elem(struct bpf_map *map, void *key, void *value,
++ u64 map_flags)
+ {
+ return -EINVAL;
+ }
+
+ /* Called from syscall or from eBPF program */
+-static int stack_map_delete_elem(struct bpf_map *map, void *key)
++static long stack_map_delete_elem(struct bpf_map *map, void *key)
+ {
+ struct bpf_stack_map *smap = container_of(map, struct bpf_stack_map, map);
+ struct stack_map_bucket *old_bucket;
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index 672a667b3d760..14604611a35dd 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -16678,21 +16678,21 @@ static int do_misc_fixups(struct bpf_verifier_env *env)
+ BUILD_BUG_ON(!__same_type(ops->map_lookup_elem,
+ (void *(*)(struct bpf_map *map, void *key))NULL));
+ BUILD_BUG_ON(!__same_type(ops->map_delete_elem,
+- (int (*)(struct bpf_map *map, void *key))NULL));
++ (long (*)(struct bpf_map *map, void *key))NULL));
+ BUILD_BUG_ON(!__same_type(ops->map_update_elem,
+- (int (*)(struct bpf_map *map, void *key, void *value,
++ (long (*)(struct bpf_map *map, void *key, void *value,
+ u64 flags))NULL));
+ BUILD_BUG_ON(!__same_type(ops->map_push_elem,
+- (int (*)(struct bpf_map *map, void *value,
++ (long (*)(struct bpf_map *map, void *value,
+ u64 flags))NULL));
+ BUILD_BUG_ON(!__same_type(ops->map_pop_elem,
+- (int (*)(struct bpf_map *map, void *value))NULL));
++ (long (*)(struct bpf_map *map, void *value))NULL));
+ BUILD_BUG_ON(!__same_type(ops->map_peek_elem,
+- (int (*)(struct bpf_map *map, void *value))NULL));
++ (long (*)(struct bpf_map *map, void *value))NULL));
+ BUILD_BUG_ON(!__same_type(ops->map_redirect,
+- (int (*)(struct bpf_map *map, u64 index, u64 flags))NULL));
++ (long (*)(struct bpf_map *map, u64 index, u64 flags))NULL));
+ BUILD_BUG_ON(!__same_type(ops->map_for_each_callback,
+- (int (*)(struct bpf_map *map,
++ (long (*)(struct bpf_map *map,
+ bpf_callback_t callback_fn,
+ void *callback_ctx,
+ u64 flags))NULL));
+diff --git a/net/core/bpf_sk_storage.c b/net/core/bpf_sk_storage.c
+index bb378c33f542c..6a4b3e9313241 100644
+--- a/net/core/bpf_sk_storage.c
++++ b/net/core/bpf_sk_storage.c
+@@ -100,8 +100,8 @@ static void *bpf_fd_sk_storage_lookup_elem(struct bpf_map *map, void *key)
+ return ERR_PTR(err);
+ }
+
+-static int bpf_fd_sk_storage_update_elem(struct bpf_map *map, void *key,
+- void *value, u64 map_flags)
++static long bpf_fd_sk_storage_update_elem(struct bpf_map *map, void *key,
++ void *value, u64 map_flags)
+ {
+ struct bpf_local_storage_data *sdata;
+ struct socket *sock;
+@@ -120,7 +120,7 @@ static int bpf_fd_sk_storage_update_elem(struct bpf_map *map, void *key,
+ return err;
+ }
+
+-static int bpf_fd_sk_storage_delete_elem(struct bpf_map *map, void *key)
++static long bpf_fd_sk_storage_delete_elem(struct bpf_map *map, void *key)
+ {
+ struct socket *sock;
+ int fd, err;
+diff --git a/net/core/sock_map.c b/net/core/sock_map.c
+index a68a7290a3b2b..a055139f410e2 100644
+--- a/net/core/sock_map.c
++++ b/net/core/sock_map.c
+@@ -437,7 +437,7 @@ static void sock_map_delete_from_link(struct bpf_map *map, struct sock *sk,
+ __sock_map_delete(stab, sk, link_raw);
+ }
+
+-static int sock_map_delete_elem(struct bpf_map *map, void *key)
++static long sock_map_delete_elem(struct bpf_map *map, void *key)
+ {
+ struct bpf_stab *stab = container_of(map, struct bpf_stab, map);
+ u32 i = *(u32 *)key;
+@@ -587,8 +587,8 @@ int sock_map_update_elem_sys(struct bpf_map *map, void *key, void *value,
+ return ret;
+ }
+
+-static int sock_map_update_elem(struct bpf_map *map, void *key,
+- void *value, u64 flags)
++static long sock_map_update_elem(struct bpf_map *map, void *key,
++ void *value, u64 flags)
+ {
+ struct sock *sk = (struct sock *)value;
+ int ret;
+@@ -916,7 +916,7 @@ static void sock_hash_delete_from_link(struct bpf_map *map, struct sock *sk,
+ raw_spin_unlock_bh(&bucket->lock);
+ }
+
+-static int sock_hash_delete_elem(struct bpf_map *map, void *key)
++static long sock_hash_delete_elem(struct bpf_map *map, void *key)
+ {
+ struct bpf_shtab *htab = container_of(map, struct bpf_shtab, map);
+ u32 hash, key_size = map->key_size;
+diff --git a/net/xdp/xskmap.c b/net/xdp/xskmap.c
+index 771d0fa90ef58..3436a8efb8dc7 100644
+--- a/net/xdp/xskmap.c
++++ b/net/xdp/xskmap.c
+@@ -150,8 +150,8 @@ static void *xsk_map_lookup_elem_sys_only(struct bpf_map *map, void *key)
+ return ERR_PTR(-EOPNOTSUPP);
+ }
+
+-static int xsk_map_update_elem(struct bpf_map *map, void *key, void *value,
+- u64 map_flags)
++static long xsk_map_update_elem(struct bpf_map *map, void *key, void *value,
++ u64 map_flags)
+ {
+ struct xsk_map *m = container_of(map, struct xsk_map, map);
+ struct xdp_sock __rcu **map_entry;
+@@ -211,7 +211,7 @@ static int xsk_map_update_elem(struct bpf_map *map, void *key, void *value,
+ return err;
+ }
+
+-static int xsk_map_delete_elem(struct bpf_map *map, void *key)
++static long xsk_map_delete_elem(struct bpf_map *map, void *key)
+ {
+ struct xsk_map *m = container_of(map, struct xsk_map, map);
+ struct xdp_sock __rcu **map_entry;
+@@ -231,7 +231,7 @@ static int xsk_map_delete_elem(struct bpf_map *map, void *key)
+ return 0;
+ }
+
+-static int xsk_map_redirect(struct bpf_map *map, u64 index, u64 flags)
++static long xsk_map_redirect(struct bpf_map *map, u64 index, u64 flags)
+ {
+ return __bpf_xdp_redirect_map(map, index, flags, 0,
+ __xsk_map_lookup_elem);
+--
+2.39.2
+
--- /dev/null
+From 32fe136eade496a5f9ddff4a39e25a61351054a8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Apr 2023 20:26:22 +0800
+Subject: bpf, sockmap: fix deadlocks in the sockhash and sockmap
+
+From: Xin Liu <liuxin350@huawei.com>
+
+[ Upstream commit ed17aa92dc56b6d8883e4b7a8f1c6fbf5ed6cd29 ]
+
+When huang uses sched_switch tracepoint, the tracepoint
+does only one thing in the mounted ebpf program, which
+deletes the fixed elements in sockhash ([0])
+
+It seems that elements in sockhash are rarely actively
+deleted by users or ebpf program. Therefore, we do not
+pay much attention to their deletion. Compared with hash
+maps, sockhash only provides spin_lock_bh protection.
+This causes it to appear to have self-locking behavior
+in the interrupt context.
+
+ [0]:https://lore.kernel.org/all/CABcoxUayum5oOqFMMqAeWuS8+EzojquSOSyDA3J_2omY=2EeAg@mail.gmail.com/
+
+Reported-by: Hsin-Wei Hung <hsinweih@uci.edu>
+Fixes: 604326b41a6f ("bpf, sockmap: convert to generic sk_msg interface")
+Signed-off-by: Xin Liu <liuxin350@huawei.com>
+Acked-by: John Fastabend <john.fastabend@gmail.com>
+Link: https://lore.kernel.org/r/20230406122622.109978-1-liuxin350@huawei.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/sock_map.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/net/core/sock_map.c b/net/core/sock_map.c
+index a055139f410e2..dd5d7b1fa3580 100644
+--- a/net/core/sock_map.c
++++ b/net/core/sock_map.c
+@@ -414,8 +414,9 @@ static int __sock_map_delete(struct bpf_stab *stab, struct sock *sk_test,
+ {
+ struct sock *sk;
+ int err = 0;
++ unsigned long flags;
+
+- raw_spin_lock_bh(&stab->lock);
++ raw_spin_lock_irqsave(&stab->lock, flags);
+ sk = *psk;
+ if (!sk_test || sk_test == sk)
+ sk = xchg(psk, NULL);
+@@ -425,7 +426,7 @@ static int __sock_map_delete(struct bpf_stab *stab, struct sock *sk_test,
+ else
+ err = -EINVAL;
+
+- raw_spin_unlock_bh(&stab->lock);
++ raw_spin_unlock_irqrestore(&stab->lock, flags);
+ return err;
+ }
+
+@@ -923,11 +924,12 @@ static long sock_hash_delete_elem(struct bpf_map *map, void *key)
+ struct bpf_shtab_bucket *bucket;
+ struct bpf_shtab_elem *elem;
+ int ret = -ENOENT;
++ unsigned long flags;
+
+ hash = sock_hash_bucket_hash(key, key_size);
+ bucket = sock_hash_select_bucket(htab, hash);
+
+- raw_spin_lock_bh(&bucket->lock);
++ raw_spin_lock_irqsave(&bucket->lock, flags);
+ elem = sock_hash_lookup_elem_raw(&bucket->head, hash, key, key_size);
+ if (elem) {
+ hlist_del_rcu(&elem->node);
+@@ -935,7 +937,7 @@ static long sock_hash_delete_elem(struct bpf_map *map, void *key)
+ sock_hash_free_elem(htab, elem);
+ ret = 0;
+ }
+- raw_spin_unlock_bh(&bucket->lock);
++ raw_spin_unlock_irqrestore(&bucket->lock, flags);
+ return ret;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 3797e26fbbb65bcba7d3b90ca43b3ac68a5cca83 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Apr 2023 20:28:42 +0200
+Subject: bpf, sockmap: Revert buggy deadlock fix in the sockhash and sockmap
+
+From: Daniel Borkmann <daniel@iogearbox.net>
+
+[ Upstream commit 8c5c2a4898e3d6bad86e29d471e023c8a19ba799 ]
+
+syzbot reported a splat and bisected it to recent commit ed17aa92dc56 ("bpf,
+sockmap: fix deadlocks in the sockhash and sockmap"):
+
+ [...]
+ WARNING: CPU: 1 PID: 9280 at kernel/softirq.c:376 __local_bh_enable_ip+0xbe/0x130 kernel/softirq.c:376
+ Modules linked in:
+ CPU: 1 PID: 9280 Comm: syz-executor.1 Not tainted 6.2.0-syzkaller-13249-gd319f344561d #0
+ Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023
+ RIP: 0010:__local_bh_enable_ip+0xbe/0x130 kernel/softirq.c:376
+ [...]
+ Call Trace:
+ <TASK>
+ spin_unlock_bh include/linux/spinlock.h:395 [inline]
+ sock_map_del_link+0x2ea/0x510 net/core/sock_map.c:165
+ sock_map_unref+0xb0/0x1d0 net/core/sock_map.c:184
+ sock_hash_delete_elem+0x1ec/0x2a0 net/core/sock_map.c:945
+ map_delete_elem kernel/bpf/syscall.c:1536 [inline]
+ __sys_bpf+0x2edc/0x53e0 kernel/bpf/syscall.c:5053
+ __do_sys_bpf kernel/bpf/syscall.c:5166 [inline]
+ __se_sys_bpf kernel/bpf/syscall.c:5164 [inline]
+ __x64_sys_bpf+0x79/0xc0 kernel/bpf/syscall.c:5164
+ do_syscall_x64 arch/x86/entry/common.c:50 [inline]
+ do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
+ entry_SYSCALL_64_after_hwframe+0x63/0xcd
+ RIP: 0033:0x7fe8f7c8c169
+ </TASK>
+ [...]
+
+Revert for now until we have a proper solution.
+
+Fixes: ed17aa92dc56 ("bpf, sockmap: fix deadlocks in the sockhash and sockmap")
+Reported-by: syzbot+49f6cef45247ff249498@syzkaller.appspotmail.com
+Cc: Hsin-Wei Hung <hsinweih@uci.edu>
+Cc: Xin Liu <liuxin350@huawei.com>
+Cc: John Fastabend <john.fastabend@gmail.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/000000000000f1db9605f939720e@google.com/
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/sock_map.c | 10 ++++------
+ 1 file changed, 4 insertions(+), 6 deletions(-)
+
+diff --git a/net/core/sock_map.c b/net/core/sock_map.c
+index dd5d7b1fa3580..a055139f410e2 100644
+--- a/net/core/sock_map.c
++++ b/net/core/sock_map.c
+@@ -414,9 +414,8 @@ static int __sock_map_delete(struct bpf_stab *stab, struct sock *sk_test,
+ {
+ struct sock *sk;
+ int err = 0;
+- unsigned long flags;
+
+- raw_spin_lock_irqsave(&stab->lock, flags);
++ raw_spin_lock_bh(&stab->lock);
+ sk = *psk;
+ if (!sk_test || sk_test == sk)
+ sk = xchg(psk, NULL);
+@@ -426,7 +425,7 @@ static int __sock_map_delete(struct bpf_stab *stab, struct sock *sk_test,
+ else
+ err = -EINVAL;
+
+- raw_spin_unlock_irqrestore(&stab->lock, flags);
++ raw_spin_unlock_bh(&stab->lock);
+ return err;
+ }
+
+@@ -924,12 +923,11 @@ static long sock_hash_delete_elem(struct bpf_map *map, void *key)
+ struct bpf_shtab_bucket *bucket;
+ struct bpf_shtab_elem *elem;
+ int ret = -ENOENT;
+- unsigned long flags;
+
+ hash = sock_hash_bucket_hash(key, key_size);
+ bucket = sock_hash_select_bucket(htab, hash);
+
+- raw_spin_lock_irqsave(&bucket->lock, flags);
++ raw_spin_lock_bh(&bucket->lock);
+ elem = sock_hash_lookup_elem_raw(&bucket->head, hash, key, key_size);
+ if (elem) {
+ hlist_del_rcu(&elem->node);
+@@ -937,7 +935,7 @@ static long sock_hash_delete_elem(struct bpf_map *map, void *key)
+ sock_hash_free_elem(htab, elem);
+ ret = 0;
+ }
+- raw_spin_unlock_irqrestore(&bucket->lock, flags);
++ raw_spin_unlock_bh(&bucket->lock);
+ return ret;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 5513f43755791f25fd0df90f3ee24cec3bfd0d5c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Mar 2023 14:41:31 -0800
+Subject: bpf: take into account liveness when propagating precision
+
+From: Andrii Nakryiko <andrii@kernel.org>
+
+[ Upstream commit 52c2b005a3c18c565fc70cfd0ca49375f301e952 ]
+
+When doing state comparison, if old state has register that is not
+marked as REG_LIVE_READ, then we just skip comparison, regardless what's
+the state of corresponing register in current state. This is because not
+REG_LIVE_READ register is irrelevant for further program execution and
+correctness. All good here.
+
+But when we get to precision propagation, after two states were declared
+equivalent, we don't take into account old register's liveness, and thus
+attempt to propagate precision for register in current state even if
+that register in old state was not REG_LIVE_READ anymore. This is bad,
+because register in current state could be anything at all and this
+could cause -EFAULT due to internal logic bugs.
+
+Fix by taking into account REG_LIVE_READ liveness mark to keep the logic
+in state comparison in sync with precision propagation.
+
+Fixes: a3ce685dd01a ("bpf: fix precision tracking")
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/r/20230309224131.57449-1-andrii@kernel.org
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/verifier.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index 767e8930b0bd5..63510f8a1c7dc 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -14225,7 +14225,8 @@ static int propagate_precision(struct bpf_verifier_env *env,
+ state_reg = state->regs;
+ for (i = 0; i < BPF_REG_FP; i++, state_reg++) {
+ if (state_reg->type != SCALAR_VALUE ||
+- !state_reg->precise)
++ !state_reg->precise ||
++ !(state_reg->live & REG_LIVE_READ))
+ continue;
+ if (env->log.level & BPF_LOG_LEVEL2)
+ verbose(env, "frame %d: propagating r%d\n", i, fr);
+@@ -14239,7 +14240,8 @@ static int propagate_precision(struct bpf_verifier_env *env,
+ continue;
+ state_reg = &state->stack[i].spilled_ptr;
+ if (state_reg->type != SCALAR_VALUE ||
+- !state_reg->precise)
++ !state_reg->precise ||
++ !(state_reg->live & REG_LIVE_READ))
+ continue;
+ if (env->log.level & BPF_LOG_LEVEL2)
+ verbose(env, "frame %d: propagating fp%d\n",
+--
+2.39.2
+
--- /dev/null
+From b776a08103eb1494e135e2cdcc74c9fe664f6d55 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Apr 2023 14:21:15 +0100
+Subject: bpftool: Fix bug for long instructions in program CFG dumps
+
+From: Quentin Monnet <quentin@isovalent.com>
+
+[ Upstream commit 67cf52cdb6c8fa6365d29106555dacf95c9fd374 ]
+
+When dumping the control flow graphs for programs using the 16-byte long
+load instruction, we need to skip the second part of this instruction
+when looking for the next instruction to process. Otherwise, we end up
+printing "BUG_ld_00" from the kernel disassembler in the CFG.
+
+Fixes: efcef17a6d65 ("tools: bpftool: generate .dot graph from CFG information")
+Signed-off-by: Quentin Monnet <quentin@isovalent.com>
+Link: https://lore.kernel.org/r/20230405132120.59886-3-quentin@isovalent.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/bpf/bpftool/xlated_dumper.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/tools/bpf/bpftool/xlated_dumper.c b/tools/bpf/bpftool/xlated_dumper.c
+index 6fe3134ae45d4..3daa05d9bbb73 100644
+--- a/tools/bpf/bpftool/xlated_dumper.c
++++ b/tools/bpf/bpftool/xlated_dumper.c
+@@ -372,8 +372,15 @@ void dump_xlated_for_graph(struct dump_data *dd, void *buf_start, void *buf_end,
+ struct bpf_insn *insn_start = buf_start;
+ struct bpf_insn *insn_end = buf_end;
+ struct bpf_insn *cur = insn_start;
++ bool double_insn = false;
+
+ for (; cur <= insn_end; cur++) {
++ if (double_insn) {
++ double_insn = false;
++ continue;
++ }
++ double_insn = cur->code == (BPF_LD | BPF_IMM | BPF_DW);
++
+ printf("% 4d: ", (int)(cur - insn_start + start_idx));
+ print_bpf_insn(&cbs, cur, true);
+ if (cur != insn_end)
+--
+2.39.2
+
--- /dev/null
+From 3b68d41f76a17585b4232d0a55d212fa0fd99d91 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Apr 2023 10:14:50 +0200
+Subject: cacheinfo: Check cache properties are present in DT
+
+From: Pierre Gondois <pierre.gondois@arm.com>
+
+[ Upstream commit cde0fbff07eff7e4e0e85fa053fe19a24c86b1e0 ]
+
+If a Device Tree (DT) is used, the presence of cache properties is
+assumed. Not finding any is not considered. For arm64 platforms,
+cache information can be fetched from the clidr_el1 register.
+Checking whether cache information is available in the DT
+allows to switch to using clidr_el1.
+
+init_of_cache_level()
+\-of_count_cache_leaves()
+will assume there a 2 cache leaves (L1 data/instruction caches), which
+can be different from clidr_el1 information.
+
+cache_setup_of_node() tries to read cache properties in the DT.
+If there are none, this is considered a success. Knowing no
+information was available would allow to switch to using clidr_el1.
+
+Fixes: de0df442ee49 ("cacheinfo: Check 'cache-unified' property to count cache leaves")
+Reported-by: Alexandre Ghiti <alexghiti@rivosinc.com>
+Link: https://lore.kernel.org/all/20230404-hatred-swimmer-6fecdf33b57a@spud/
+Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
+Reviewed-by: Conor Dooley <conor.dooley@microchip.com>
+Link: https://lore.kernel.org/r/20230414081453.244787-3-pierre.gondois@arm.com
+Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/cacheinfo.c | 32 ++++++++++++++++++++++++++++++++
+ 1 file changed, 32 insertions(+)
+
+diff --git a/drivers/base/cacheinfo.c b/drivers/base/cacheinfo.c
+index c5d2293ac2a63..ea8f416852bd9 100644
+--- a/drivers/base/cacheinfo.c
++++ b/drivers/base/cacheinfo.c
+@@ -78,6 +78,9 @@ bool last_level_cache_is_shared(unsigned int cpu_x, unsigned int cpu_y)
+ }
+
+ #ifdef CONFIG_OF
++
++static bool of_check_cache_nodes(struct device_node *np);
++
+ /* OF properties to query for a given cache type */
+ struct cache_type_info {
+ const char *size_prop;
+@@ -205,6 +208,11 @@ static int cache_setup_of_node(unsigned int cpu)
+ return -ENOENT;
+ }
+
++ if (!of_check_cache_nodes(np)) {
++ of_node_put(np);
++ return -ENOENT;
++ }
++
+ prev = np;
+
+ while (index < cache_leaves(cpu)) {
+@@ -229,6 +237,25 @@ static int cache_setup_of_node(unsigned int cpu)
+ return 0;
+ }
+
++static bool of_check_cache_nodes(struct device_node *np)
++{
++ struct device_node *next;
++
++ if (of_property_present(np, "cache-size") ||
++ of_property_present(np, "i-cache-size") ||
++ of_property_present(np, "d-cache-size") ||
++ of_property_present(np, "cache-unified"))
++ return true;
++
++ next = of_find_next_cache_node(np);
++ if (next) {
++ of_node_put(next);
++ return true;
++ }
++
++ return false;
++}
++
+ static int of_count_cache_leaves(struct device_node *np)
+ {
+ unsigned int leaves = 0;
+@@ -260,6 +287,11 @@ int init_of_cache_level(unsigned int cpu)
+ struct device_node *prev = NULL;
+ unsigned int levels = 0, leaves, level;
+
++ if (!of_check_cache_nodes(np)) {
++ of_node_put(np);
++ return -ENOENT;
++ }
++
+ leaves = of_count_cache_leaves(np);
+ if (leaves > 0)
+ levels = 1;
+--
+2.39.2
+
--- /dev/null
+From e1a1c8d683cdb39ac1ff2586bf74d3644f122a12 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Apr 2023 10:14:49 +0200
+Subject: cacheinfo: Check sib_leaf in cache_leaves_are_shared()
+
+From: Pierre Gondois <pierre.gondois@arm.com>
+
+[ Upstream commit 7a306e3eabf2b2fd8cffa69b87b32dbf814d79ce ]
+
+If there is no ACPI/DT information, it is assumed that L1 caches
+are private and L2 (and higher) caches are shared. A cache is
+'shared' between two CPUs if it is accessible from these two
+CPUs.
+
+Each CPU owns a representation (i.e. has a dedicated cacheinfo struct)
+of the caches it has access to. cache_leaves_are_shared() tries to
+identify whether two representations are designating the same actual
+cache.
+
+In cache_leaves_are_shared(), if 'this_leaf' is a L2 cache (or higher)
+and 'sib_leaf' is a L1 cache, the caches are detected as shared as
+only this_leaf's cache level is checked.
+This is leads to setting sib_leaf as being shared with another CPU,
+which is incorrect as this is a L1 cache.
+
+Check 'sib_leaf->level'. Also update the comment as the function is
+called when populating 'shared_cpu_map'.
+
+Fixes: f16d1becf96f ("cacheinfo: Use cache identifiers to check if the caches are shared if available")
+Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
+Reviewed-by: Conor Dooley <conor.dooley@microchip.com>
+Link: https://lore.kernel.org/r/20230414081453.244787-2-pierre.gondois@arm.com
+Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/cacheinfo.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/base/cacheinfo.c b/drivers/base/cacheinfo.c
+index f3903d002819e..c5d2293ac2a63 100644
+--- a/drivers/base/cacheinfo.c
++++ b/drivers/base/cacheinfo.c
+@@ -38,11 +38,10 @@ static inline bool cache_leaves_are_shared(struct cacheinfo *this_leaf,
+ {
+ /*
+ * For non DT/ACPI systems, assume unique level 1 caches,
+- * system-wide shared caches for all other levels. This will be used
+- * only if arch specific code has not populated shared_cpu_map
++ * system-wide shared caches for all other levels.
+ */
+ if (!(IS_ENABLED(CONFIG_OF) || IS_ENABLED(CONFIG_ACPI)))
+- return !(this_leaf->level == 1);
++ return (this_leaf->level != 1) && (sib_leaf->level != 1);
+
+ if ((sib_leaf->attributes & CACHE_ID) &&
+ (this_leaf->attributes & CACHE_ID))
+--
+2.39.2
+
--- /dev/null
+From f4c36c26edbd8bfbf0a62ea545fdd9c9c9b0b878 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Jan 2023 09:32:27 +0100
+Subject: clk: add missing of_node_put() in "assigned-clocks" property parsing
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Clément Léger <clement.leger@bootlin.com>
+
+[ Upstream commit 27a6e1b09a782517fddac91259970ac466a3f7b6 ]
+
+When returning from of_parse_phandle_with_args(), the np member of the
+of_phandle_args structure should be put after usage. Add missing
+of_node_put() calls in both __set_clk_parents() and __set_clk_rates().
+
+Fixes: 86be408bfbd8 ("clk: Support for clock parents and rates assigned from device tree")
+Signed-off-by: Clément Léger <clement.leger@bootlin.com>
+Link: https://lore.kernel.org/r/20230131083227.10990-1-clement.leger@bootlin.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/clk-conf.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/clk-conf.c b/drivers/clk/clk-conf.c
+index 2ef819606c417..1a4e6340f95ce 100644
+--- a/drivers/clk/clk-conf.c
++++ b/drivers/clk/clk-conf.c
+@@ -33,9 +33,12 @@ static int __set_clk_parents(struct device_node *node, bool clk_supplier)
+ else
+ return rc;
+ }
+- if (clkspec.np == node && !clk_supplier)
++ if (clkspec.np == node && !clk_supplier) {
++ of_node_put(clkspec.np);
+ return 0;
++ }
+ pclk = of_clk_get_from_provider(&clkspec);
++ of_node_put(clkspec.np);
+ if (IS_ERR(pclk)) {
+ if (PTR_ERR(pclk) != -EPROBE_DEFER)
+ pr_warn("clk: couldn't get parent clock %d for %pOF\n",
+@@ -48,10 +51,12 @@ static int __set_clk_parents(struct device_node *node, bool clk_supplier)
+ if (rc < 0)
+ goto err;
+ if (clkspec.np == node && !clk_supplier) {
++ of_node_put(clkspec.np);
+ rc = 0;
+ goto err;
+ }
+ clk = of_clk_get_from_provider(&clkspec);
++ of_node_put(clkspec.np);
+ if (IS_ERR(clk)) {
+ if (PTR_ERR(clk) != -EPROBE_DEFER)
+ pr_warn("clk: couldn't get assigned clock %d for %pOF\n",
+@@ -93,10 +98,13 @@ static int __set_clk_rates(struct device_node *node, bool clk_supplier)
+ else
+ return rc;
+ }
+- if (clkspec.np == node && !clk_supplier)
++ if (clkspec.np == node && !clk_supplier) {
++ of_node_put(clkspec.np);
+ return 0;
++ }
+
+ clk = of_clk_get_from_provider(&clkspec);
++ of_node_put(clkspec.np);
+ if (IS_ERR(clk)) {
+ if (PTR_ERR(clk) != -EPROBE_DEFER)
+ pr_warn("clk: couldn't get clock %d for %pOF\n",
+--
+2.39.2
+
--- /dev/null
+From d0b69f206ea6ebbc01f1e81b14b1729dfe9ded16 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Feb 2023 12:59:31 +0200
+Subject: clk: at91: clk-sam9x60-pll: fix return value check
+
+From: Claudiu Beznea <claudiu.beznea@microchip.com>
+
+[ Upstream commit 1bd8e27fd0db0fe7f489213836dcbab92934f8fa ]
+
+sam9x60_frac_pll_compute_mul_frac() can't return zero. Remove the check
+against zero to reflect this.
+
+Fixes: 43b1bb4a9b3e ("clk: at91: clk-sam9x60-pll: re-factor to support plls with multiple outputs")
+Reported-by: Dan Carpenter <error27@gmail.com>
+Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Link: https://lore.kernel.org/r/20230227105931.2812412-1-claudiu.beznea@microchip.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/at91/clk-sam9x60-pll.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/at91/clk-sam9x60-pll.c b/drivers/clk/at91/clk-sam9x60-pll.c
+index d757003004cbb..0882ed01d5c27 100644
+--- a/drivers/clk/at91/clk-sam9x60-pll.c
++++ b/drivers/clk/at91/clk-sam9x60-pll.c
+@@ -668,7 +668,7 @@ sam9x60_clk_register_frac_pll(struct regmap *regmap, spinlock_t *lock,
+
+ ret = sam9x60_frac_pll_compute_mul_frac(&frac->core, FCORE_MIN,
+ parent_rate, true);
+- if (ret <= 0) {
++ if (ret < 0) {
+ hw = ERR_PTR(ret);
+ goto free;
+ }
+--
+2.39.2
+
--- /dev/null
+From 45eb72ffef31328fdb60727f1d6f671c1c01a035 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Apr 2023 17:52:55 +0800
+Subject: clk: imx: fracn-gppll: disable hardware select control
+
+From: Peng Fan <peng.fan@nxp.com>
+
+[ Upstream commit 4435467b15b069e5a6f50ca9a9260e86b74dbc13 ]
+
+When programming PLL, should disable Hardware control select to make PLL
+controlled by register, not hardware inputs through OSCPLL.
+
+Fixes: 1b26cb8a77a4 ("clk: imx: support fracn gppll")
+Signed-off-by: Peng Fan <peng.fan@nxp.com>
+Reviewed-by: Abel Vesa <abel.vesa@linaro.org>
+Link: https://lore.kernel.org/r/20230403095300.3386988-3-peng.fan@oss.nxp.com
+Signed-off-by: Abel Vesa <abel.vesa@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/imx/clk-fracn-gppll.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/clk/imx/clk-fracn-gppll.c b/drivers/clk/imx/clk-fracn-gppll.c
+index ec50c41e2a4c9..f6674110a88e0 100644
+--- a/drivers/clk/imx/clk-fracn-gppll.c
++++ b/drivers/clk/imx/clk-fracn-gppll.c
+@@ -15,6 +15,7 @@
+ #include "clk.h"
+
+ #define PLL_CTRL 0x0
++#define HW_CTRL_SEL BIT(16)
+ #define CLKMUX_BYPASS BIT(2)
+ #define CLKMUX_EN BIT(1)
+ #define POWERUP_MASK BIT(0)
+@@ -193,6 +194,11 @@ static int clk_fracn_gppll_set_rate(struct clk_hw *hw, unsigned long drate,
+
+ rate = imx_get_pll_settings(pll, drate);
+
++ /* Hardware control select disable. PLL is control by register */
++ tmp = readl_relaxed(pll->base + PLL_CTRL);
++ tmp &= ~HW_CTRL_SEL;
++ writel_relaxed(tmp, pll->base + PLL_CTRL);
++
+ /* Disable output */
+ tmp = readl_relaxed(pll->base + PLL_CTRL);
+ tmp &= ~CLKMUX_EN;
+--
+2.39.2
+
--- /dev/null
+From fa6c2ae7441c4a516331469b7b2d8d81a3428170 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Apr 2023 17:52:54 +0800
+Subject: clk: imx: fracn-gppll: fix the rate table
+
+From: Peng Fan <peng.fan@nxp.com>
+
+[ Upstream commit cf8dccfedce848f67eaa42e8839305d028319161 ]
+
+The Fvco should be range 2.4GHz to 5GHz, the original table voilate the
+spec, so update the table to fix it.
+
+Fixes: c196175acdd3 ("clk: imx: clk-fracn-gppll: Add more freq config for video pll")
+Fixes: 044034efbeea ("clk: imx: clk-fracn-gppll: fix mfd value")
+Fixes: 1b26cb8a77a4 ("clk: imx: support fracn gppll")
+Signed-off-by: Jacky Bai <ping.bai@nxp.com>
+Signed-off-by: Peng Fan <peng.fan@nxp.com>
+Reviewed-by: Abel Vesa <abel.vesa@linaro.org>
+Link: https://lore.kernel.org/r/20230403095300.3386988-2-peng.fan@oss.nxp.com
+Signed-off-by: Abel Vesa <abel.vesa@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/imx/clk-fracn-gppll.c | 16 +++++++++-------
+ 1 file changed, 9 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/clk/imx/clk-fracn-gppll.c b/drivers/clk/imx/clk-fracn-gppll.c
+index a2aaa14fc1aef..ec50c41e2a4c9 100644
+--- a/drivers/clk/imx/clk-fracn-gppll.c
++++ b/drivers/clk/imx/clk-fracn-gppll.c
+@@ -60,18 +60,20 @@ struct clk_fracn_gppll {
+ };
+
+ /*
+- * Fvco = Fref * (MFI + MFN / MFD)
+- * Fout = Fvco / (rdiv * odiv)
++ * Fvco = (Fref / rdiv) * (MFI + MFN / MFD)
++ * Fout = Fvco / odiv
++ * The (Fref / rdiv) should be in range 20MHz to 40MHz
++ * The Fvco should be in range 2.5Ghz to 5Ghz
+ */
+ static const struct imx_fracn_gppll_rate_table fracn_tbl[] = {
+- PLL_FRACN_GP(650000000U, 81, 0, 1, 0, 3),
++ PLL_FRACN_GP(650000000U, 162, 50, 100, 0, 6),
+ PLL_FRACN_GP(594000000U, 198, 0, 1, 0, 8),
+- PLL_FRACN_GP(560000000U, 70, 0, 1, 0, 3),
+- PLL_FRACN_GP(498000000U, 83, 0, 1, 0, 4),
++ PLL_FRACN_GP(560000000U, 140, 0, 1, 0, 6),
++ PLL_FRACN_GP(498000000U, 166, 0, 1, 0, 8),
+ PLL_FRACN_GP(484000000U, 121, 0, 1, 0, 6),
+ PLL_FRACN_GP(445333333U, 167, 0, 1, 0, 9),
+- PLL_FRACN_GP(400000000U, 50, 0, 1, 0, 3),
+- PLL_FRACN_GP(393216000U, 81, 92, 100, 0, 5)
++ PLL_FRACN_GP(400000000U, 200, 0, 1, 0, 12),
++ PLL_FRACN_GP(393216000U, 163, 84, 100, 0, 10)
+ };
+
+ struct imx_fracn_gppll_clk imx_fracn_gppll = {
+--
+2.39.2
+
--- /dev/null
+From 6b6d771f9dc23e5fb303f89677df38bb16c22a97 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 31 Mar 2023 14:38:10 +0800
+Subject: clk: imx: imx8ulp: Fix XBAR_DIVBUS and AD_SLOW clock parents
+
+From: Peng Fan <peng.fan@nxp.com>
+
+[ Upstream commit d608c18018c897b88d66f1340fe274b7181817fa ]
+
+XBAR_DIVBUS and AD_SLOW should set parent to XBAR_AD_DIVPLAT and
+XBAR_DIVBUS respectively, not the NIC_AD. otherwise we will get
+wrong clock rate.
+
+Fixes: c43a801a5789 ("clk: imx: Add clock driver for imx8ulp")
+Reviewed-by: Jacky Bai <ping.bai@nxp.com>
+Signed-off-by: Ye Li <ye.li@nxp.com>
+Signed-off-by: Peng Fan <peng.fan@nxp.com>
+Reviewed-by: Abel Vesa <abel.vesa@linaro.org>
+Link: https://lore.kernel.org/r/20230331063814.2462059-2-peng.fan@oss.nxp.com
+Signed-off-by: Abel Vesa <abel.vesa@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/imx/clk-imx8ulp.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/imx/clk-imx8ulp.c b/drivers/clk/imx/clk-imx8ulp.c
+index a07df3b44703f..89121037a8f0e 100644
+--- a/drivers/clk/imx/clk-imx8ulp.c
++++ b/drivers/clk/imx/clk-imx8ulp.c
+@@ -200,8 +200,8 @@ static int imx8ulp_clk_cgc1_init(struct platform_device *pdev)
+ clks[IMX8ULP_CLK_NIC_AD_DIVPLAT] = imx_clk_hw_divider_flags("nic_ad_divplat", "nic_sel", base + 0x34, 21, 6, CLK_SET_RATE_PARENT | CLK_IS_CRITICAL);
+ clks[IMX8ULP_CLK_NIC_PER_DIVPLAT] = imx_clk_hw_divider_flags("nic_per_divplat", "nic_ad_divplat", base + 0x34, 14, 6, CLK_SET_RATE_PARENT | CLK_IS_CRITICAL);
+ clks[IMX8ULP_CLK_XBAR_AD_DIVPLAT] = imx_clk_hw_divider_flags("xbar_ad_divplat", "nic_ad_divplat", base + 0x38, 14, 6, CLK_SET_RATE_PARENT | CLK_IS_CRITICAL);
+- clks[IMX8ULP_CLK_XBAR_DIVBUS] = imx_clk_hw_divider_flags("xbar_divbus", "nic_ad_divplat", base + 0x38, 7, 6, CLK_SET_RATE_PARENT | CLK_IS_CRITICAL);
+- clks[IMX8ULP_CLK_XBAR_AD_SLOW] = imx_clk_hw_divider_flags("xbar_ad_slow", "nic_ad_divplat", base + 0x38, 0, 6, CLK_SET_RATE_PARENT | CLK_IS_CRITICAL);
++ clks[IMX8ULP_CLK_XBAR_DIVBUS] = imx_clk_hw_divider_flags("xbar_divbus", "xbar_ad_divplat", base + 0x38, 7, 6, CLK_SET_RATE_PARENT | CLK_IS_CRITICAL);
++ clks[IMX8ULP_CLK_XBAR_AD_SLOW] = imx_clk_hw_divider_flags("xbar_ad_slow", "xbar_divbus", base + 0x38, 0, 6, CLK_SET_RATE_PARENT | CLK_IS_CRITICAL);
+
+ clks[IMX8ULP_CLK_SOSC_DIV1_GATE] = imx_clk_hw_gate_dis("sosc_div1_gate", "sosc", base + 0x108, 7);
+ clks[IMX8ULP_CLK_SOSC_DIV2_GATE] = imx_clk_hw_gate_dis("sosc_div2_gate", "sosc", base + 0x108, 15);
+--
+2.39.2
+
--- /dev/null
+From aa31e48aaca364367a2e7557cec09038df57ffd0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Dec 2022 17:29:46 +0800
+Subject: clk: mediatek: clk-pllfh: fix missing of_node_put() in
+ fhctl_parse_dt()
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit f1d97a37f975ac615e4d6875c27516150642d499 ]
+
+The device_node pointer returned by of_find_compatible_node() with
+refcount incremented, when finish using it, the refcount need be
+decreased.
+
+Fixes: d7964de8a8ea ("clk: mediatek: Add new clock driver to handle FHCTL hardware")
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Link: https://lore.kernel.org/r/20221229092946.4162345-1-yangyingliang@huawei.com
+[sboyd@kernel.org: Also unmap on error]
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/mediatek/clk-pllfh.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/mediatek/clk-pllfh.c b/drivers/clk/mediatek/clk-pllfh.c
+index f48780bec5077..f135b32c6dbed 100644
+--- a/drivers/clk/mediatek/clk-pllfh.c
++++ b/drivers/clk/mediatek/clk-pllfh.c
+@@ -75,13 +75,13 @@ void fhctl_parse_dt(const u8 *compatible_node, struct mtk_pllfh_data *pllfhs,
+ base = of_iomap(node, 0);
+ if (!base) {
+ pr_err("%s(): ioremap failed\n", __func__);
+- return;
++ goto out_node_put;
+ }
+
+ num_clocks = of_clk_get_parent_count(node);
+ if (!num_clocks) {
+ pr_err("%s(): failed to get clocks property\n", __func__);
+- return;
++ goto err;
+ }
+
+ for (i = 0; i < num_clocks; i++) {
+@@ -102,6 +102,13 @@ void fhctl_parse_dt(const u8 *compatible_node, struct mtk_pllfh_data *pllfhs,
+ pllfh->state.ssc_rate = ssc_rate;
+ pllfh->state.base = base;
+ }
++
++out_node_put:
++ of_node_put(node);
++ return;
++err:
++ iounmap(base);
++ goto out_node_put;
+ }
+
+ static void pllfh_init(struct mtk_fh *fh, struct mtk_pllfh_data *pllfh_data)
+--
+2.39.2
+
--- /dev/null
+From 2954e059f1f739f7f7f144400ac81efa676f30c1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Mar 2023 15:05:11 +0100
+Subject: clk: mediatek: Consistently use GATE_MTK() macro
+
+From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+
+[ Upstream commit 4c85e20b656607897e3bb06ff565822fa4b4de95 ]
+
+All the various MediaTek clock drivers are, in a way or another,
+redefining the GATE_MTK() macro with different names: while some
+are doing that by actually using GATE_MTK(), others are copying
+it entirely (hence, entirely redefining it).
+
+Change all clock drivers to always and consistently use this macro.
+
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Reviewed-by: Chen-Yu Tsai <wenst@chromium.org>
+Tested-by: Chen-Yu Tsai <wenst@chromium.org> # MT8183, MT8192, MT8195 Chromebooks
+Link: https://lore.kernel.org/r/20230306140543.1813621-23-angelogioacchino.delregno@collabora.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Stable-dep-of: fa8c0d01df62 ("clk: mediatek: mt7622: Properly use CLK_IS_CRITICAL flag")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/mediatek/clk-mt2701-aud.c | 40 +++--------
+ drivers/clk/mediatek/clk-mt2701-bdp.c | 20 ++----
+ drivers/clk/mediatek/clk-mt2701-eth.c | 10 +--
+ drivers/clk/mediatek/clk-mt2701-g3d.c | 10 +--
+ drivers/clk/mediatek/clk-mt2701-hif.c | 10 +--
+ drivers/clk/mediatek/clk-mt2701-img.c | 10 +--
+ drivers/clk/mediatek/clk-mt2701-mm.c | 20 ++----
+ drivers/clk/mediatek/clk-mt2701-vdec.c | 20 ++----
+ drivers/clk/mediatek/clk-mt2701.c | 40 +++--------
+ drivers/clk/mediatek/clk-mt2712-bdp.c | 10 +--
+ drivers/clk/mediatek/clk-mt2712-img.c | 10 +--
+ drivers/clk/mediatek/clk-mt2712-jpgdec.c | 10 +--
+ drivers/clk/mediatek/clk-mt2712-mfg.c | 10 +--
+ drivers/clk/mediatek/clk-mt2712-mm.c | 34 +++------
+ drivers/clk/mediatek/clk-mt2712-vdec.c | 20 ++----
+ drivers/clk/mediatek/clk-mt2712-venc.c | 10 +--
+ drivers/clk/mediatek/clk-mt2712.c | 60 ++++------------
+ drivers/clk/mediatek/clk-mt6765-audio.c | 20 ++----
+ drivers/clk/mediatek/clk-mt6765-cam.c | 10 +--
+ drivers/clk/mediatek/clk-mt6765-img.c | 10 +--
+ drivers/clk/mediatek/clk-mt6765-mipi0a.c | 10 +--
+ drivers/clk/mediatek/clk-mt6765-mm.c | 10 +--
+ drivers/clk/mediatek/clk-mt6765-vcodec.c | 10 +--
+ drivers/clk/mediatek/clk-mt6765.c | 80 +++++-----------------
+ drivers/clk/mediatek/clk-mt6797-img.c | 10 +--
+ drivers/clk/mediatek/clk-mt6797-mm.c | 20 ++----
+ drivers/clk/mediatek/clk-mt6797-vdec.c | 20 ++----
+ drivers/clk/mediatek/clk-mt6797-venc.c | 10 +--
+ drivers/clk/mediatek/clk-mt6797.c | 42 ++++--------
+ drivers/clk/mediatek/clk-mt7622-aud.c | 40 +++--------
+ drivers/clk/mediatek/clk-mt7622-eth.c | 20 ++----
+ drivers/clk/mediatek/clk-mt7622-hif.c | 22 ++----
+ drivers/clk/mediatek/clk-mt7622.c | 61 ++++-------------
+ drivers/clk/mediatek/clk-mt7629-eth.c | 20 ++----
+ drivers/clk/mediatek/clk-mt7629-hif.c | 22 ++----
+ drivers/clk/mediatek/clk-mt7629.c | 40 +++--------
+ drivers/clk/mediatek/clk-mt7986-eth.c | 24 ++-----
+ drivers/clk/mediatek/clk-mt7986-infracfg.c | 24 ++-----
+ drivers/clk/mediatek/clk-mt8135.c | 30 ++------
+ drivers/clk/mediatek/clk-mt8167-aud.c | 11 +--
+ drivers/clk/mediatek/clk-mt8167-img.c | 10 +--
+ drivers/clk/mediatek/clk-mt8167-mfgcfg.c | 10 +--
+ drivers/clk/mediatek/clk-mt8167-mm.c | 22 ++----
+ drivers/clk/mediatek/clk-mt8167-vdec.c | 20 ++----
+ drivers/clk/mediatek/clk-mt8173-mm.c | 22 ++----
+ drivers/clk/mediatek/clk-mt8516-aud.c | 10 +--
+ drivers/clk/mediatek/clk-mt8516.c | 60 ++++------------
+ 47 files changed, 224 insertions(+), 840 deletions(-)
+
+diff --git a/drivers/clk/mediatek/clk-mt2701-aud.c b/drivers/clk/mediatek/clk-mt2701-aud.c
+index 1a32d8b7db84f..21f7cc106bbe5 100644
+--- a/drivers/clk/mediatek/clk-mt2701-aud.c
++++ b/drivers/clk/mediatek/clk-mt2701-aud.c
+@@ -15,41 +15,17 @@
+
+ #include <dt-bindings/clock/mt2701-clk.h>
+
+-#define GATE_AUDIO0(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &audio0_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_no_setclr, \
+- }
++#define GATE_AUDIO0(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &audio0_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr)
+
+-#define GATE_AUDIO1(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &audio1_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_no_setclr, \
+- }
++#define GATE_AUDIO1(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &audio1_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr)
+
+-#define GATE_AUDIO2(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &audio2_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_no_setclr, \
+- }
++#define GATE_AUDIO2(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &audio2_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr)
+
+-#define GATE_AUDIO3(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &audio3_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_no_setclr, \
+- }
++#define GATE_AUDIO3(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &audio3_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr)
+
+ static const struct mtk_gate_regs audio0_cg_regs = {
+ .set_ofs = 0x0,
+diff --git a/drivers/clk/mediatek/clk-mt2701-bdp.c b/drivers/clk/mediatek/clk-mt2701-bdp.c
+index 435ed4819d563..b0f0572079452 100644
+--- a/drivers/clk/mediatek/clk-mt2701-bdp.c
++++ b/drivers/clk/mediatek/clk-mt2701-bdp.c
+@@ -24,23 +24,11 @@ static const struct mtk_gate_regs bdp1_cg_regs = {
+ .sta_ofs = 0x0110,
+ };
+
+-#define GATE_BDP0(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &bdp0_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_setclr_inv, \
+- }
++#define GATE_BDP0(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &bdp0_cg_regs, _shift, &mtk_clk_gate_ops_setclr_inv)
+
+-#define GATE_BDP1(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &bdp1_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_setclr_inv, \
+- }
++#define GATE_BDP1(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &bdp1_cg_regs, _shift, &mtk_clk_gate_ops_setclr_inv)
+
+ static const struct mtk_gate bdp_clks[] = {
+ GATE_BDP0(CLK_BDP_BRG_BA, "brg_baclk", "mm_sel", 0),
+diff --git a/drivers/clk/mediatek/clk-mt2701-eth.c b/drivers/clk/mediatek/clk-mt2701-eth.c
+index f3cb78e7f6e9e..4c830ebdd7613 100644
+--- a/drivers/clk/mediatek/clk-mt2701-eth.c
++++ b/drivers/clk/mediatek/clk-mt2701-eth.c
+@@ -16,14 +16,8 @@ static const struct mtk_gate_regs eth_cg_regs = {
+ .sta_ofs = 0x0030,
+ };
+
+-#define GATE_ETH(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = ð_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_no_setclr_inv, \
+- }
++#define GATE_ETH(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, ð_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr_inv)
+
+ static const struct mtk_gate eth_clks[] = {
+ GATE_DUMMY(CLK_DUMMY, "eth_dummy"),
+diff --git a/drivers/clk/mediatek/clk-mt2701-g3d.c b/drivers/clk/mediatek/clk-mt2701-g3d.c
+index 499a170ba5f92..ae094046890aa 100644
+--- a/drivers/clk/mediatek/clk-mt2701-g3d.c
++++ b/drivers/clk/mediatek/clk-mt2701-g3d.c
+@@ -16,14 +16,8 @@
+
+ #include <dt-bindings/clock/mt2701-clk.h>
+
+-#define GATE_G3D(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &g3d_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_setclr, \
+- }
++#define GATE_G3D(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &g3d_cg_regs, _shift, &mtk_clk_gate_ops_setclr)
+
+ static const struct mtk_gate_regs g3d_cg_regs = {
+ .sta_ofs = 0x0,
+diff --git a/drivers/clk/mediatek/clk-mt2701-hif.c b/drivers/clk/mediatek/clk-mt2701-hif.c
+index d5465d7829935..3583bd1240d55 100644
+--- a/drivers/clk/mediatek/clk-mt2701-hif.c
++++ b/drivers/clk/mediatek/clk-mt2701-hif.c
+@@ -16,14 +16,8 @@ static const struct mtk_gate_regs hif_cg_regs = {
+ .sta_ofs = 0x0030,
+ };
+
+-#define GATE_HIF(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &hif_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_no_setclr_inv, \
+- }
++#define GATE_HIF(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &hif_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr_inv)
+
+ static const struct mtk_gate hif_clks[] = {
+ GATE_DUMMY(CLK_DUMMY, "hif_dummy"),
+diff --git a/drivers/clk/mediatek/clk-mt2701-img.c b/drivers/clk/mediatek/clk-mt2701-img.c
+index 7e53deb7f9905..eb172473f0755 100644
+--- a/drivers/clk/mediatek/clk-mt2701-img.c
++++ b/drivers/clk/mediatek/clk-mt2701-img.c
+@@ -18,14 +18,8 @@ static const struct mtk_gate_regs img_cg_regs = {
+ .sta_ofs = 0x0000,
+ };
+
+-#define GATE_IMG(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &img_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_setclr, \
+- }
++#define GATE_IMG(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &img_cg_regs, _shift, &mtk_clk_gate_ops_setclr)
+
+ static const struct mtk_gate img_clks[] = {
+ GATE_IMG(CLK_IMG_SMI_COMM, "img_smi_comm", "mm_sel", 0),
+diff --git a/drivers/clk/mediatek/clk-mt2701-mm.c b/drivers/clk/mediatek/clk-mt2701-mm.c
+index 23d5ddcc1d372..f4885dffb324f 100644
+--- a/drivers/clk/mediatek/clk-mt2701-mm.c
++++ b/drivers/clk/mediatek/clk-mt2701-mm.c
+@@ -24,23 +24,11 @@ static const struct mtk_gate_regs disp1_cg_regs = {
+ .sta_ofs = 0x0110,
+ };
+
+-#define GATE_DISP0(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &disp0_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_setclr, \
+- }
++#define GATE_DISP0(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &disp0_cg_regs, _shift, &mtk_clk_gate_ops_setclr)
+
+-#define GATE_DISP1(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &disp1_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_setclr, \
+- }
++#define GATE_DISP1(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &disp1_cg_regs, _shift, &mtk_clk_gate_ops_setclr)
+
+ static const struct mtk_gate mm_clks[] = {
+ GATE_DISP0(CLK_MM_SMI_COMMON, "mm_smi_comm", "mm_sel", 0),
+diff --git a/drivers/clk/mediatek/clk-mt2701-vdec.c b/drivers/clk/mediatek/clk-mt2701-vdec.c
+index d3089da0ab62e..0f07c5d731df6 100644
+--- a/drivers/clk/mediatek/clk-mt2701-vdec.c
++++ b/drivers/clk/mediatek/clk-mt2701-vdec.c
+@@ -24,23 +24,11 @@ static const struct mtk_gate_regs vdec1_cg_regs = {
+ .sta_ofs = 0x0008,
+ };
+
+-#define GATE_VDEC0(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &vdec0_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_setclr_inv, \
+- }
++#define GATE_VDEC0(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &vdec0_cg_regs, _shift, &mtk_clk_gate_ops_setclr_inv)
+
+-#define GATE_VDEC1(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &vdec1_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_setclr_inv, \
+- }
++#define GATE_VDEC1(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &vdec1_cg_regs, _shift, &mtk_clk_gate_ops_setclr_inv)
+
+ static const struct mtk_gate vdec_clks[] = {
+ GATE_VDEC0(CLK_VDEC_CKGEN, "vdec_cken", "vdec_sel", 0),
+diff --git a/drivers/clk/mediatek/clk-mt2701.c b/drivers/clk/mediatek/clk-mt2701.c
+index 06ca81359d350..dfe328f7a44b2 100644
+--- a/drivers/clk/mediatek/clk-mt2701.c
++++ b/drivers/clk/mediatek/clk-mt2701.c
+@@ -636,14 +636,8 @@ static const struct mtk_gate_regs top_aud_cg_regs = {
+ .sta_ofs = 0x012C,
+ };
+
+-#define GATE_TOP_AUD(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &top_aud_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_no_setclr, \
+- }
++#define GATE_TOP_AUD(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &top_aud_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr)
+
+ static const struct mtk_gate top_clks[] = {
+ GATE_TOP_AUD(CLK_TOP_AUD_48K_TIMING, "a1sys_hp_ck", "aud_mux1_div",
+@@ -702,14 +696,8 @@ static const struct mtk_gate_regs infra_cg_regs = {
+ .sta_ofs = 0x0048,
+ };
+
+-#define GATE_ICG(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &infra_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_setclr, \
+- }
++#define GATE_ICG(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &infra_cg_regs, _shift, &mtk_clk_gate_ops_setclr)
+
+ static const struct mtk_gate infra_clks[] = {
+ GATE_ICG(CLK_INFRA_DBG, "dbgclk", "axi_sel", 0),
+@@ -823,23 +811,11 @@ static const struct mtk_gate_regs peri1_cg_regs = {
+ .sta_ofs = 0x001c,
+ };
+
+-#define GATE_PERI0(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &peri0_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_setclr, \
+- }
++#define GATE_PERI0(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &peri0_cg_regs, _shift, &mtk_clk_gate_ops_setclr)
+
+-#define GATE_PERI1(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &peri1_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_setclr, \
+- }
++#define GATE_PERI1(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &peri1_cg_regs, _shift, &mtk_clk_gate_ops_setclr)
+
+ static const struct mtk_gate peri_clks[] = {
+ GATE_PERI0(CLK_PERI_USB0_MCU, "usb0_mcu_ck", "axi_sel", 31),
+diff --git a/drivers/clk/mediatek/clk-mt2712-bdp.c b/drivers/clk/mediatek/clk-mt2712-bdp.c
+index 684d03e9f6de1..5e668651dd901 100644
+--- a/drivers/clk/mediatek/clk-mt2712-bdp.c
++++ b/drivers/clk/mediatek/clk-mt2712-bdp.c
+@@ -18,14 +18,8 @@ static const struct mtk_gate_regs bdp_cg_regs = {
+ .sta_ofs = 0x100,
+ };
+
+-#define GATE_BDP(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &bdp_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_no_setclr, \
+- }
++#define GATE_BDP(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &bdp_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr)
+
+ static const struct mtk_gate bdp_clks[] = {
+ GATE_BDP(CLK_BDP_BRIDGE_B, "bdp_bridge_b", "mm_sel", 0),
+diff --git a/drivers/clk/mediatek/clk-mt2712-img.c b/drivers/clk/mediatek/clk-mt2712-img.c
+index 335049cdc856c..3ffa51384e6b2 100644
+--- a/drivers/clk/mediatek/clk-mt2712-img.c
++++ b/drivers/clk/mediatek/clk-mt2712-img.c
+@@ -18,14 +18,8 @@ static const struct mtk_gate_regs img_cg_regs = {
+ .sta_ofs = 0x0,
+ };
+
+-#define GATE_IMG(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &img_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_no_setclr, \
+- }
++#define GATE_IMG(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &img_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr)
+
+ static const struct mtk_gate img_clks[] = {
+ GATE_IMG(CLK_IMG_SMI_LARB2, "img_smi_larb2", "mm_sel", 0),
+diff --git a/drivers/clk/mediatek/clk-mt2712-jpgdec.c b/drivers/clk/mediatek/clk-mt2712-jpgdec.c
+index 07ba7c5e80aff..8c768d5ce24d5 100644
+--- a/drivers/clk/mediatek/clk-mt2712-jpgdec.c
++++ b/drivers/clk/mediatek/clk-mt2712-jpgdec.c
+@@ -18,14 +18,8 @@ static const struct mtk_gate_regs jpgdec_cg_regs = {
+ .sta_ofs = 0x0,
+ };
+
+-#define GATE_JPGDEC(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &jpgdec_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_setclr_inv, \
+- }
++#define GATE_JPGDEC(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &jpgdec_cg_regs, _shift, &mtk_clk_gate_ops_setclr_inv)
+
+ static const struct mtk_gate jpgdec_clks[] = {
+ GATE_JPGDEC(CLK_JPGDEC_JPGDEC1, "jpgdec_jpgdec1", "jpgdec_sel", 0),
+diff --git a/drivers/clk/mediatek/clk-mt2712-mfg.c b/drivers/clk/mediatek/clk-mt2712-mfg.c
+index 42f8cf3ecf4cb..8949315c2dd20 100644
+--- a/drivers/clk/mediatek/clk-mt2712-mfg.c
++++ b/drivers/clk/mediatek/clk-mt2712-mfg.c
+@@ -18,14 +18,8 @@ static const struct mtk_gate_regs mfg_cg_regs = {
+ .sta_ofs = 0x0,
+ };
+
+-#define GATE_MFG(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &mfg_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_setclr, \
+- }
++#define GATE_MFG(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &mfg_cg_regs, _shift, &mtk_clk_gate_ops_setclr)
+
+ static const struct mtk_gate mfg_clks[] = {
+ GATE_MFG(CLK_MFG_BG3D, "mfg_bg3d", "mfg_sel", 0),
+diff --git a/drivers/clk/mediatek/clk-mt2712-mm.c b/drivers/clk/mediatek/clk-mt2712-mm.c
+index 25b8af640c128..e5264f1ce60d0 100644
+--- a/drivers/clk/mediatek/clk-mt2712-mm.c
++++ b/drivers/clk/mediatek/clk-mt2712-mm.c
+@@ -30,32 +30,14 @@ static const struct mtk_gate_regs mm2_cg_regs = {
+ .sta_ofs = 0x220,
+ };
+
+-#define GATE_MM0(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &mm0_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_setclr, \
+- }
+-
+-#define GATE_MM1(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &mm1_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_setclr, \
+- }
+-
+-#define GATE_MM2(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &mm2_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_setclr, \
+- }
++#define GATE_MM0(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &mm0_cg_regs, _shift, &mtk_clk_gate_ops_setclr)
++
++#define GATE_MM1(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &mm1_cg_regs, _shift, &mtk_clk_gate_ops_setclr)
++
++#define GATE_MM2(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &mm2_cg_regs, _shift, &mtk_clk_gate_ops_setclr)
+
+ static const struct mtk_gate mm_clks[] = {
+ /* MM0 */
+diff --git a/drivers/clk/mediatek/clk-mt2712-vdec.c b/drivers/clk/mediatek/clk-mt2712-vdec.c
+index 6296ed5c5b555..572290dd43c87 100644
+--- a/drivers/clk/mediatek/clk-mt2712-vdec.c
++++ b/drivers/clk/mediatek/clk-mt2712-vdec.c
+@@ -24,23 +24,11 @@ static const struct mtk_gate_regs vdec1_cg_regs = {
+ .sta_ofs = 0x8,
+ };
+
+-#define GATE_VDEC0(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &vdec0_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_setclr_inv, \
+- }
++#define GATE_VDEC0(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &vdec0_cg_regs, _shift, &mtk_clk_gate_ops_setclr_inv)
+
+-#define GATE_VDEC1(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &vdec1_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_setclr_inv, \
+- }
++#define GATE_VDEC1(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &vdec1_cg_regs, _shift, &mtk_clk_gate_ops_setclr_inv)
+
+ static const struct mtk_gate vdec_clks[] = {
+ /* VDEC0 */
+diff --git a/drivers/clk/mediatek/clk-mt2712-venc.c b/drivers/clk/mediatek/clk-mt2712-venc.c
+index b9bfc35de629c..9588eb03016eb 100644
+--- a/drivers/clk/mediatek/clk-mt2712-venc.c
++++ b/drivers/clk/mediatek/clk-mt2712-venc.c
+@@ -18,14 +18,8 @@ static const struct mtk_gate_regs venc_cg_regs = {
+ .sta_ofs = 0x0,
+ };
+
+-#define GATE_VENC(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &venc_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_setclr_inv, \
+- }
++#define GATE_VENC(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &venc_cg_regs, _shift, &mtk_clk_gate_ops_setclr_inv)
+
+ static const struct mtk_gate venc_clks[] = {
+ GATE_VENC(CLK_VENC_SMI_COMMON_CON, "venc_smi", "mm_sel", 0),
+diff --git a/drivers/clk/mediatek/clk-mt2712.c b/drivers/clk/mediatek/clk-mt2712.c
+index aa39d006358a3..79cdb1e72ec52 100644
+--- a/drivers/clk/mediatek/clk-mt2712.c
++++ b/drivers/clk/mediatek/clk-mt2712.c
+@@ -958,23 +958,11 @@ static const struct mtk_gate_regs top1_cg_regs = {
+ .sta_ofs = 0x424,
+ };
+
+-#define GATE_TOP0(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &top0_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_no_setclr, \
+- }
++#define GATE_TOP0(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &top0_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr)
+
+-#define GATE_TOP1(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &top1_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_no_setclr_inv, \
+- }
++#define GATE_TOP1(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &top1_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr_inv)
+
+ static const struct mtk_gate top_clks[] = {
+ /* TOP0 */
+@@ -998,14 +986,8 @@ static const struct mtk_gate_regs infra_cg_regs = {
+ .sta_ofs = 0x48,
+ };
+
+-#define GATE_INFRA(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &infra_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_setclr, \
+- }
++#define GATE_INFRA(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &infra_cg_regs, _shift, &mtk_clk_gate_ops_setclr)
+
+ static const struct mtk_gate infra_clks[] = {
+ GATE_INFRA(CLK_INFRA_DBGCLK, "infra_dbgclk", "axi_sel", 0),
+@@ -1035,32 +1017,14 @@ static const struct mtk_gate_regs peri2_cg_regs = {
+ .sta_ofs = 0x42c,
+ };
+
+-#define GATE_PERI0(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &peri0_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_setclr, \
+- }
++#define GATE_PERI0(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &peri0_cg_regs, _shift, &mtk_clk_gate_ops_setclr)
+
+-#define GATE_PERI1(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &peri1_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_setclr, \
+- }
++#define GATE_PERI1(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &peri1_cg_regs, _shift, &mtk_clk_gate_ops_setclr)
+
+-#define GATE_PERI2(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &peri2_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_no_setclr_inv, \
+- }
++#define GATE_PERI2(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &peri2_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr_inv)
+
+ static const struct mtk_gate peri_clks[] = {
+ /* PERI0 */
+diff --git a/drivers/clk/mediatek/clk-mt6765-audio.c b/drivers/clk/mediatek/clk-mt6765-audio.c
+index 0aa6c0d352ca5..5682e0302eee2 100644
+--- a/drivers/clk/mediatek/clk-mt6765-audio.c
++++ b/drivers/clk/mediatek/clk-mt6765-audio.c
+@@ -24,23 +24,11 @@ static const struct mtk_gate_regs audio1_cg_regs = {
+ .sta_ofs = 0x4,
+ };
+
+-#define GATE_AUDIO0(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &audio0_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_no_setclr, \
+- }
++#define GATE_AUDIO0(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &audio0_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr)
+
+-#define GATE_AUDIO1(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &audio1_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_no_setclr, \
+- }
++#define GATE_AUDIO1(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &audio1_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr)
+
+ static const struct mtk_gate audio_clks[] = {
+ /* AUDIO0 */
+diff --git a/drivers/clk/mediatek/clk-mt6765-cam.c b/drivers/clk/mediatek/clk-mt6765-cam.c
+index 25f2bef38126e..6e7d192c19cb0 100644
+--- a/drivers/clk/mediatek/clk-mt6765-cam.c
++++ b/drivers/clk/mediatek/clk-mt6765-cam.c
+@@ -18,14 +18,8 @@ static const struct mtk_gate_regs cam_cg_regs = {
+ .sta_ofs = 0x0,
+ };
+
+-#define GATE_CAM(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &cam_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_setclr, \
+- }
++#define GATE_CAM(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &cam_cg_regs, _shift, &mtk_clk_gate_ops_setclr)
+
+ static const struct mtk_gate cam_clks[] = {
+ GATE_CAM(CLK_CAM_LARB3, "cam_larb3", "mm_ck", 0),
+diff --git a/drivers/clk/mediatek/clk-mt6765-img.c b/drivers/clk/mediatek/clk-mt6765-img.c
+index a62303ef4f41d..cfbc907988aff 100644
+--- a/drivers/clk/mediatek/clk-mt6765-img.c
++++ b/drivers/clk/mediatek/clk-mt6765-img.c
+@@ -18,14 +18,8 @@ static const struct mtk_gate_regs img_cg_regs = {
+ .sta_ofs = 0x0,
+ };
+
+-#define GATE_IMG(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &img_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_setclr, \
+- }
++#define GATE_IMG(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &img_cg_regs, _shift, &mtk_clk_gate_ops_setclr)
+
+ static const struct mtk_gate img_clks[] = {
+ GATE_IMG(CLK_IMG_LARB2, "img_larb2", "mm_ck", 0),
+diff --git a/drivers/clk/mediatek/clk-mt6765-mipi0a.c b/drivers/clk/mediatek/clk-mt6765-mipi0a.c
+index 25c829fc38661..f2b9dc8084801 100644
+--- a/drivers/clk/mediatek/clk-mt6765-mipi0a.c
++++ b/drivers/clk/mediatek/clk-mt6765-mipi0a.c
+@@ -18,14 +18,8 @@ static const struct mtk_gate_regs mipi0a_cg_regs = {
+ .sta_ofs = 0x80,
+ };
+
+-#define GATE_MIPI0A(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &mipi0a_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_no_setclr_inv, \
+- }
++#define GATE_MIPI0A(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &mipi0a_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr_inv)
+
+ static const struct mtk_gate mipi0a_clks[] = {
+ GATE_MIPI0A(CLK_MIPI0A_CSR_CSI_EN_0A,
+diff --git a/drivers/clk/mediatek/clk-mt6765-mm.c b/drivers/clk/mediatek/clk-mt6765-mm.c
+index bda774668a361..a4570c9dbefa5 100644
+--- a/drivers/clk/mediatek/clk-mt6765-mm.c
++++ b/drivers/clk/mediatek/clk-mt6765-mm.c
+@@ -18,14 +18,8 @@ static const struct mtk_gate_regs mm_cg_regs = {
+ .sta_ofs = 0x100,
+ };
+
+-#define GATE_MM(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &mm_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_setclr, \
+- }
++#define GATE_MM(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &mm_cg_regs, _shift, &mtk_clk_gate_ops_setclr)
+
+ static const struct mtk_gate mm_clks[] = {
+ /* MM */
+diff --git a/drivers/clk/mediatek/clk-mt6765-vcodec.c b/drivers/clk/mediatek/clk-mt6765-vcodec.c
+index 2bc1fbde87da9..75d72b9b4032c 100644
+--- a/drivers/clk/mediatek/clk-mt6765-vcodec.c
++++ b/drivers/clk/mediatek/clk-mt6765-vcodec.c
+@@ -18,14 +18,8 @@ static const struct mtk_gate_regs venc_cg_regs = {
+ .sta_ofs = 0x0,
+ };
+
+-#define GATE_VENC(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &venc_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_setclr_inv, \
+- }
++#define GATE_VENC(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &venc_cg_regs, _shift, &mtk_clk_gate_ops_setclr_inv)
+
+ static const struct mtk_gate venc_clks[] = {
+ GATE_VENC(CLK_VENC_SET0_LARB, "venc_set0_larb", "mm_ck", 0),
+diff --git a/drivers/clk/mediatek/clk-mt6765.c b/drivers/clk/mediatek/clk-mt6765.c
+index 6f5c92a7f6204..0c20ce678350e 100644
+--- a/drivers/clk/mediatek/clk-mt6765.c
++++ b/drivers/clk/mediatek/clk-mt6765.c
+@@ -483,32 +483,14 @@ static const struct mtk_gate_regs top2_cg_regs = {
+ .sta_ofs = 0x320,
+ };
+
+-#define GATE_TOP0(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &top0_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_no_setclr, \
+- }
++#define GATE_TOP0(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &top0_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr)
+
+-#define GATE_TOP1(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &top1_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_no_setclr_inv, \
+- }
++#define GATE_TOP1(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &top1_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr_inv)
+
+-#define GATE_TOP2(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &top2_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_no_setclr, \
+- }
++#define GATE_TOP2(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &top2_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr)
+
+ static const struct mtk_gate top_clks[] = {
+ /* TOP0 */
+@@ -559,41 +541,17 @@ static const struct mtk_gate_regs ifr5_cg_regs = {
+ .sta_ofs = 0xc8,
+ };
+
+-#define GATE_IFR2(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &ifr2_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_setclr, \
+- }
++#define GATE_IFR2(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &ifr2_cg_regs, _shift, &mtk_clk_gate_ops_setclr)
+
+-#define GATE_IFR3(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &ifr3_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_setclr, \
+- }
++#define GATE_IFR3(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &ifr3_cg_regs, _shift, &mtk_clk_gate_ops_setclr)
+
+-#define GATE_IFR4(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &ifr4_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_setclr, \
+- }
++#define GATE_IFR4(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &ifr4_cg_regs, _shift, &mtk_clk_gate_ops_setclr)
+
+-#define GATE_IFR5(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &ifr5_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_setclr, \
+- }
++#define GATE_IFR5(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &ifr5_cg_regs, _shift, &mtk_clk_gate_ops_setclr)
+
+ static const struct mtk_gate ifr_clks[] = {
+ /* INFRA_TOPAXI */
+@@ -674,14 +632,8 @@ static const struct mtk_gate_regs apmixed_cg_regs = {
+ .sta_ofs = 0x14,
+ };
+
+-#define GATE_APMIXED(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &apmixed_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_no_setclr_inv, \
+- }
++#define GATE_APMIXED(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &apmixed_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr_inv)
+
+ static const struct mtk_gate apmixed_clks[] = {
+ /* AUDIO0 */
+diff --git a/drivers/clk/mediatek/clk-mt6797-img.c b/drivers/clk/mediatek/clk-mt6797-img.c
+index 7c6a53fbb8be6..06441393478f6 100644
+--- a/drivers/clk/mediatek/clk-mt6797-img.c
++++ b/drivers/clk/mediatek/clk-mt6797-img.c
+@@ -16,14 +16,8 @@ static const struct mtk_gate_regs img_cg_regs = {
+ .sta_ofs = 0x0000,
+ };
+
+-#define GATE_IMG(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &img_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_setclr, \
+- }
++#define GATE_IMG(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &img_cg_regs, _shift, &mtk_clk_gate_ops_setclr)
+
+ static const struct mtk_gate img_clks[] = {
+ GATE_IMG(CLK_IMG_FDVT, "img_fdvt", "mm_sel", 11),
+diff --git a/drivers/clk/mediatek/clk-mt6797-mm.c b/drivers/clk/mediatek/clk-mt6797-mm.c
+index deb16a6b16a5e..d5e9fe445e308 100644
+--- a/drivers/clk/mediatek/clk-mt6797-mm.c
++++ b/drivers/clk/mediatek/clk-mt6797-mm.c
+@@ -23,23 +23,11 @@ static const struct mtk_gate_regs mm1_cg_regs = {
+ .sta_ofs = 0x0110,
+ };
+
+-#define GATE_MM0(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &mm0_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_setclr, \
+-}
++#define GATE_MM0(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &mm0_cg_regs, _shift, &mtk_clk_gate_ops_setclr)
+
+-#define GATE_MM1(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &mm1_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_setclr, \
+-}
++#define GATE_MM1(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &mm1_cg_regs, _shift, &mtk_clk_gate_ops_setclr)
+
+ static const struct mtk_gate mm_clks[] = {
+ GATE_MM0(CLK_MM_SMI_COMMON, "mm_smi_common", "mm_sel", 0),
+diff --git a/drivers/clk/mediatek/clk-mt6797-vdec.c b/drivers/clk/mediatek/clk-mt6797-vdec.c
+index 6120fccc859f1..8622ddd87a5bb 100644
+--- a/drivers/clk/mediatek/clk-mt6797-vdec.c
++++ b/drivers/clk/mediatek/clk-mt6797-vdec.c
+@@ -24,23 +24,11 @@ static const struct mtk_gate_regs vdec1_cg_regs = {
+ .sta_ofs = 0x0008,
+ };
+
+-#define GATE_VDEC0(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &vdec0_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_setclr_inv, \
+-}
++#define GATE_VDEC0(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &vdec0_cg_regs, _shift, &mtk_clk_gate_ops_setclr_inv)
+
+-#define GATE_VDEC1(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &vdec1_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_setclr_inv, \
+-}
++#define GATE_VDEC1(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &vdec1_cg_regs, _shift, &mtk_clk_gate_ops_setclr_inv)
+
+ static const struct mtk_gate vdec_clks[] = {
+ GATE_VDEC0(CLK_VDEC_CKEN_ENG, "vdec_cken_eng", "vdec_sel", 8),
+diff --git a/drivers/clk/mediatek/clk-mt6797-venc.c b/drivers/clk/mediatek/clk-mt6797-venc.c
+index 834d3834d2bbc..928d611a476e4 100644
+--- a/drivers/clk/mediatek/clk-mt6797-venc.c
++++ b/drivers/clk/mediatek/clk-mt6797-venc.c
+@@ -18,14 +18,8 @@ static const struct mtk_gate_regs venc_cg_regs = {
+ .sta_ofs = 0x0000,
+ };
+
+-#define GATE_VENC(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &venc_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_setclr_inv, \
+- }
++#define GATE_VENC(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &venc_cg_regs, _shift, &mtk_clk_gate_ops_setclr_inv)
+
+ static const struct mtk_gate venc_clks[] = {
+ GATE_VENC(CLK_VENC_0, "venc_0", "mm_sel", 0),
+diff --git a/drivers/clk/mediatek/clk-mt6797.c b/drivers/clk/mediatek/clk-mt6797.c
+index 105a512857b3c..17b23ee4faee6 100644
+--- a/drivers/clk/mediatek/clk-mt6797.c
++++ b/drivers/clk/mediatek/clk-mt6797.c
+@@ -421,40 +421,22 @@ static const struct mtk_gate_regs infra2_cg_regs = {
+ .sta_ofs = 0x00b0,
+ };
+
+-#define GATE_ICG0(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &infra0_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_setclr, \
+-}
++#define GATE_ICG0(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &infra0_cg_regs, _shift, &mtk_clk_gate_ops_setclr)
+
+-#define GATE_ICG1(_id, _name, _parent, _shift) \
+- GATE_ICG1_FLAGS(_id, _name, _parent, _shift, 0)
++#define GATE_ICG1(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &infra1_cg_regs, _shift, &mtk_clk_gate_ops_setclr)
+
+-#define GATE_ICG1_FLAGS(_id, _name, _parent, _shift, _flags) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &infra1_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_setclr, \
+- .flags = _flags, \
+-}
++#define GATE_ICG1_FLAGS(_id, _name, _parent, _shift, _flags) \
++ GATE_MTK_FLAGS(_id, _name, _parent, &infra1_cg_regs, _shift, \
++ &mtk_clk_gate_ops_setclr, _flags)
+
+-#define GATE_ICG2(_id, _name, _parent, _shift) \
+- GATE_ICG2_FLAGS(_id, _name, _parent, _shift, 0)
++#define GATE_ICG2(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &infra2_cg_regs, _shift, &mtk_clk_gate_ops_setclr)
+
+-#define GATE_ICG2_FLAGS(_id, _name, _parent, _shift, _flags) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &infra2_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_setclr, \
+- .flags = _flags, \
+-}
++#define GATE_ICG2_FLAGS(_id, _name, _parent, _shift, _flags) \
++ GATE_MTK_FLAGS(_id, _name, _parent, &infra2_cg_regs, _shift, \
++ &mtk_clk_gate_ops_setclr, _flags)
+
+ /*
+ * Clock gates dramc and dramc_b are needed by the DRAM controller.
+diff --git a/drivers/clk/mediatek/clk-mt7622-aud.c b/drivers/clk/mediatek/clk-mt7622-aud.c
+index b8aabfeb1cba4..27c543759f2ab 100644
+--- a/drivers/clk/mediatek/clk-mt7622-aud.c
++++ b/drivers/clk/mediatek/clk-mt7622-aud.c
+@@ -16,41 +16,17 @@
+
+ #include <dt-bindings/clock/mt7622-clk.h>
+
+-#define GATE_AUDIO0(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &audio0_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_no_setclr, \
+- }
++#define GATE_AUDIO0(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &audio0_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr)
+
+-#define GATE_AUDIO1(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &audio1_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_no_setclr, \
+- }
++#define GATE_AUDIO1(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &audio1_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr)
+
+-#define GATE_AUDIO2(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &audio2_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_no_setclr, \
+- }
++#define GATE_AUDIO2(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &audio2_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr)
+
+-#define GATE_AUDIO3(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &audio3_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_no_setclr, \
+- }
++#define GATE_AUDIO3(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &audio3_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr)
+
+ static const struct mtk_gate_regs audio0_cg_regs = {
+ .set_ofs = 0x0,
+diff --git a/drivers/clk/mediatek/clk-mt7622-eth.c b/drivers/clk/mediatek/clk-mt7622-eth.c
+index aee583fa77d0c..66b163cc16330 100644
+--- a/drivers/clk/mediatek/clk-mt7622-eth.c
++++ b/drivers/clk/mediatek/clk-mt7622-eth.c
+@@ -16,14 +16,8 @@
+
+ #include <dt-bindings/clock/mt7622-clk.h>
+
+-#define GATE_ETH(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = ð_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_no_setclr_inv, \
+- }
++#define GATE_ETH(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, ð_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr_inv)
+
+ static const struct mtk_gate_regs eth_cg_regs = {
+ .set_ofs = 0x30,
+@@ -45,14 +39,8 @@ static const struct mtk_gate_regs sgmii_cg_regs = {
+ .sta_ofs = 0xE4,
+ };
+
+-#define GATE_SGMII(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &sgmii_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_no_setclr_inv, \
+- }
++#define GATE_SGMII(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &sgmii_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr_inv)
+
+ static const struct mtk_gate sgmii_clks[] = {
+ GATE_SGMII(CLK_SGMII_TX250M_EN, "sgmii_tx250m_en",
+diff --git a/drivers/clk/mediatek/clk-mt7622-hif.c b/drivers/clk/mediatek/clk-mt7622-hif.c
+index ab5cad0c2b1c9..bcd1dfc6e8e0c 100644
+--- a/drivers/clk/mediatek/clk-mt7622-hif.c
++++ b/drivers/clk/mediatek/clk-mt7622-hif.c
+@@ -16,23 +16,11 @@
+
+ #include <dt-bindings/clock/mt7622-clk.h>
+
+-#define GATE_PCIE(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &pcie_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_no_setclr_inv, \
+- }
+-
+-#define GATE_SSUSB(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &ssusb_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_no_setclr_inv, \
+- }
++#define GATE_PCIE(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &pcie_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr_inv)
++
++#define GATE_SSUSB(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &ssusb_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr_inv)
+
+ static const struct mtk_gate_regs pcie_cg_regs = {
+ .set_ofs = 0x30,
+diff --git a/drivers/clk/mediatek/clk-mt7622.c b/drivers/clk/mediatek/clk-mt7622.c
+index 5a82c2270bfbc..41af8d420bbf8 100644
+--- a/drivers/clk/mediatek/clk-mt7622.c
++++ b/drivers/clk/mediatek/clk-mt7622.c
+@@ -50,59 +50,24 @@
+ _pd_reg, _pd_shift, _tuner_reg, _pcw_reg, _pcw_shift, \
+ NULL, "clkxtal")
+
+-#define GATE_APMIXED(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &apmixed_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_no_setclr_inv, \
+- }
++#define GATE_APMIXED(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &apmixed_cg_regs, _shift, \
++ &mtk_clk_gate_ops_no_setclr_inv)
+
+-#define GATE_INFRA(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &infra_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_setclr, \
+- }
++#define GATE_INFRA(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &infra_cg_regs, _shift, &mtk_clk_gate_ops_setclr)
+
+-#define GATE_TOP0(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &top0_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_no_setclr, \
+- }
++#define GATE_TOP0(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &top0_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr)
+
+-#define GATE_TOP1(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &top1_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_no_setclr, \
+- }
++#define GATE_TOP1(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &top1_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr)
+
+-#define GATE_PERI0(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &peri0_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_setclr, \
+- }
++#define GATE_PERI0(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &peri0_cg_regs, _shift, &mtk_clk_gate_ops_setclr)
+
+-#define GATE_PERI1(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &peri1_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_setclr, \
+- }
++#define GATE_PERI1(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &peri1_cg_regs, _shift, &mtk_clk_gate_ops_setclr)
+
+ static DEFINE_SPINLOCK(mt7622_clk_lock);
+
+diff --git a/drivers/clk/mediatek/clk-mt7629-eth.c b/drivers/clk/mediatek/clk-mt7629-eth.c
+index a4ae7d6c7a71a..719a47fef7980 100644
+--- a/drivers/clk/mediatek/clk-mt7629-eth.c
++++ b/drivers/clk/mediatek/clk-mt7629-eth.c
+@@ -16,14 +16,8 @@
+
+ #include <dt-bindings/clock/mt7629-clk.h>
+
+-#define GATE_ETH(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = ð_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_no_setclr_inv, \
+- }
++#define GATE_ETH(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, ð_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr_inv)
+
+ static const struct mtk_gate_regs eth_cg_regs = {
+ .set_ofs = 0x30,
+@@ -45,14 +39,8 @@ static const struct mtk_gate_regs sgmii_cg_regs = {
+ .sta_ofs = 0xE4,
+ };
+
+-#define GATE_SGMII(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &sgmii_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_no_setclr_inv, \
+- }
++#define GATE_SGMII(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &sgmii_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr_inv)
+
+ static const struct mtk_gate sgmii_clks[2][4] = {
+ {
+diff --git a/drivers/clk/mediatek/clk-mt7629-hif.c b/drivers/clk/mediatek/clk-mt7629-hif.c
+index c3eb09ea6036f..78d85542e4f17 100644
+--- a/drivers/clk/mediatek/clk-mt7629-hif.c
++++ b/drivers/clk/mediatek/clk-mt7629-hif.c
+@@ -16,23 +16,11 @@
+
+ #include <dt-bindings/clock/mt7629-clk.h>
+
+-#define GATE_PCIE(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &pcie_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_no_setclr_inv, \
+- }
+-
+-#define GATE_SSUSB(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &ssusb_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_no_setclr_inv, \
+- }
++#define GATE_PCIE(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &pcie_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr_inv)
++
++#define GATE_SSUSB(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &ssusb_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr_inv)
+
+ static const struct mtk_gate_regs pcie_cg_regs = {
+ .set_ofs = 0x30,
+diff --git a/drivers/clk/mediatek/clk-mt7629.c b/drivers/clk/mediatek/clk-mt7629.c
+index cf062d4a7ecc4..09c85fda43d84 100644
+--- a/drivers/clk/mediatek/clk-mt7629.c
++++ b/drivers/clk/mediatek/clk-mt7629.c
+@@ -50,41 +50,17 @@
+ _pd_reg, _pd_shift, _tuner_reg, _pcw_reg, _pcw_shift, \
+ NULL, "clk20m")
+
+-#define GATE_APMIXED(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &apmixed_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_no_setclr_inv, \
+- }
++#define GATE_APMIXED(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &apmixed_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr_inv)
+
+-#define GATE_INFRA(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &infra_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_setclr, \
+- }
++#define GATE_INFRA(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &infra_cg_regs, _shift, &mtk_clk_gate_ops_setclr)
+
+-#define GATE_PERI0(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &peri0_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_setclr, \
+- }
++#define GATE_PERI0(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &peri0_cg_regs, _shift, &mtk_clk_gate_ops_setclr)
+
+-#define GATE_PERI1(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &peri1_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_setclr, \
+- }
++#define GATE_PERI1(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &peri1_cg_regs, _shift, &mtk_clk_gate_ops_setclr)
+
+ static DEFINE_SPINLOCK(mt7629_clk_lock);
+
+diff --git a/drivers/clk/mediatek/clk-mt7986-eth.c b/drivers/clk/mediatek/clk-mt7986-eth.c
+index 703872239ecca..e04bc6845ea6d 100644
+--- a/drivers/clk/mediatek/clk-mt7986-eth.c
++++ b/drivers/clk/mediatek/clk-mt7986-eth.c
+@@ -22,12 +22,8 @@ static const struct mtk_gate_regs sgmii0_cg_regs = {
+ .sta_ofs = 0xe4,
+ };
+
+-#define GATE_SGMII0(_id, _name, _parent, _shift) \
+- { \
+- .id = _id, .name = _name, .parent_name = _parent, \
+- .regs = &sgmii0_cg_regs, .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_no_setclr_inv, \
+- }
++#define GATE_SGMII0(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &sgmii0_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr_inv)
+
+ static const struct mtk_gate sgmii0_clks[] __initconst = {
+ GATE_SGMII0(CLK_SGMII0_TX250M_EN, "sgmii0_tx250m_en", "top_xtal", 2),
+@@ -42,12 +38,8 @@ static const struct mtk_gate_regs sgmii1_cg_regs = {
+ .sta_ofs = 0xe4,
+ };
+
+-#define GATE_SGMII1(_id, _name, _parent, _shift) \
+- { \
+- .id = _id, .name = _name, .parent_name = _parent, \
+- .regs = &sgmii1_cg_regs, .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_no_setclr_inv, \
+- }
++#define GATE_SGMII1(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &sgmii1_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr_inv)
+
+ static const struct mtk_gate sgmii1_clks[] __initconst = {
+ GATE_SGMII1(CLK_SGMII1_TX250M_EN, "sgmii1_tx250m_en", "top_xtal", 2),
+@@ -62,12 +54,8 @@ static const struct mtk_gate_regs eth_cg_regs = {
+ .sta_ofs = 0x30,
+ };
+
+-#define GATE_ETH(_id, _name, _parent, _shift) \
+- { \
+- .id = _id, .name = _name, .parent_name = _parent, \
+- .regs = ð_cg_regs, .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_no_setclr_inv, \
+- }
++#define GATE_ETH(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, ð_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr_inv)
+
+ static const struct mtk_gate eth_clks[] __initconst = {
+ GATE_ETH(CLK_ETH_FE_EN, "eth_fe_en", "netsys_2x_sel", 6),
+diff --git a/drivers/clk/mediatek/clk-mt7986-infracfg.c b/drivers/clk/mediatek/clk-mt7986-infracfg.c
+index e80c92167c8fc..0a4bf87ee1607 100644
+--- a/drivers/clk/mediatek/clk-mt7986-infracfg.c
++++ b/drivers/clk/mediatek/clk-mt7986-infracfg.c
+@@ -87,26 +87,14 @@ static const struct mtk_gate_regs infra2_cg_regs = {
+ .sta_ofs = 0x68,
+ };
+
+-#define GATE_INFRA0(_id, _name, _parent, _shift) \
+- { \
+- .id = _id, .name = _name, .parent_name = _parent, \
+- .regs = &infra0_cg_regs, .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_setclr, \
+- }
++#define GATE_INFRA0(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &infra0_cg_regs, _shift, &mtk_clk_gate_ops_setclr)
+
+-#define GATE_INFRA1(_id, _name, _parent, _shift) \
+- { \
+- .id = _id, .name = _name, .parent_name = _parent, \
+- .regs = &infra1_cg_regs, .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_setclr, \
+- }
++#define GATE_INFRA1(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &infra1_cg_regs, _shift, &mtk_clk_gate_ops_setclr)
+
+-#define GATE_INFRA2(_id, _name, _parent, _shift) \
+- { \
+- .id = _id, .name = _name, .parent_name = _parent, \
+- .regs = &infra2_cg_regs, .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_setclr, \
+- }
++#define GATE_INFRA2(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &infra2_cg_regs, _shift, &mtk_clk_gate_ops_setclr)
+
+ static const struct mtk_gate infra_clks[] = {
+ /* INFRA0 */
+diff --git a/drivers/clk/mediatek/clk-mt8135.c b/drivers/clk/mediatek/clk-mt8135.c
+index 2b9c925c2a2ba..97a115d2c3daa 100644
+--- a/drivers/clk/mediatek/clk-mt8135.c
++++ b/drivers/clk/mediatek/clk-mt8135.c
+@@ -401,14 +401,8 @@ static const struct mtk_gate_regs infra_cg_regs = {
+ .sta_ofs = 0x0048,
+ };
+
+-#define GATE_ICG(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &infra_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_setclr, \
+- }
++#define GATE_ICG(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &infra_cg_regs, _shift, &mtk_clk_gate_ops_setclr)
+
+ static const struct mtk_gate infra_clks[] __initconst = {
+ GATE_ICG(CLK_INFRA_PMIC_WRAP, "pmic_wrap_ck", "axi_sel", 23),
+@@ -438,23 +432,11 @@ static const struct mtk_gate_regs peri1_cg_regs = {
+ .sta_ofs = 0x001c,
+ };
+
+-#define GATE_PERI0(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &peri0_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_setclr, \
+- }
++#define GATE_PERI0(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &peri0_cg_regs, _shift, &mtk_clk_gate_ops_setclr)
+
+-#define GATE_PERI1(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &peri1_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_setclr, \
+- }
++#define GATE_PERI1(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &peri1_cg_regs, _shift, &mtk_clk_gate_ops_setclr)
+
+ static const struct mtk_gate peri_gates[] __initconst = {
+ /* PERI0 */
+diff --git a/drivers/clk/mediatek/clk-mt8167-aud.c b/drivers/clk/mediatek/clk-mt8167-aud.c
+index f6bea6e9e6a4e..47a7d89d5777c 100644
+--- a/drivers/clk/mediatek/clk-mt8167-aud.c
++++ b/drivers/clk/mediatek/clk-mt8167-aud.c
+@@ -23,14 +23,9 @@ static const struct mtk_gate_regs aud_cg_regs = {
+ .sta_ofs = 0x0,
+ };
+
+-#define GATE_AUD(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &aud_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_no_setclr, \
+- }
++#define GATE_AUD(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &aud_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr)
++
+
+ static const struct mtk_gate aud_clks[] __initconst = {
+ GATE_AUD(CLK_AUD_AFE, "aud_afe", "clk26m_ck", 2),
+diff --git a/drivers/clk/mediatek/clk-mt8167-img.c b/drivers/clk/mediatek/clk-mt8167-img.c
+index 77db13b177fcc..e196b3b894a16 100644
+--- a/drivers/clk/mediatek/clk-mt8167-img.c
++++ b/drivers/clk/mediatek/clk-mt8167-img.c
+@@ -23,14 +23,8 @@ static const struct mtk_gate_regs img_cg_regs = {
+ .sta_ofs = 0x0,
+ };
+
+-#define GATE_IMG(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &img_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_setclr, \
+- }
++#define GATE_IMG(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &img_cg_regs, _shift, &mtk_clk_gate_ops_setclr)
+
+ static const struct mtk_gate img_clks[] __initconst = {
+ GATE_IMG(CLK_IMG_LARB1_SMI, "img_larb1_smi", "smi_mm", 0),
+diff --git a/drivers/clk/mediatek/clk-mt8167-mfgcfg.c b/drivers/clk/mediatek/clk-mt8167-mfgcfg.c
+index 3c23591b02f7f..602d25f4cb2e2 100644
+--- a/drivers/clk/mediatek/clk-mt8167-mfgcfg.c
++++ b/drivers/clk/mediatek/clk-mt8167-mfgcfg.c
+@@ -23,14 +23,8 @@ static const struct mtk_gate_regs mfg_cg_regs = {
+ .sta_ofs = 0x0,
+ };
+
+-#define GATE_MFG(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &mfg_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_setclr, \
+- }
++#define GATE_MFG(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &mfg_cg_regs, _shift, &mtk_clk_gate_ops_setclr)
+
+ static const struct mtk_gate mfg_clks[] __initconst = {
+ GATE_MFG(CLK_MFG_BAXI, "mfg_baxi", "ahb_infra_sel", 0),
+diff --git a/drivers/clk/mediatek/clk-mt8167-mm.c b/drivers/clk/mediatek/clk-mt8167-mm.c
+index c0b44104c765a..abc70e1221bf9 100644
+--- a/drivers/clk/mediatek/clk-mt8167-mm.c
++++ b/drivers/clk/mediatek/clk-mt8167-mm.c
+@@ -29,23 +29,11 @@ static const struct mtk_gate_regs mm1_cg_regs = {
+ .sta_ofs = 0x110,
+ };
+
+-#define GATE_MM0(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &mm0_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_setclr, \
+- }
+-
+-#define GATE_MM1(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &mm1_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_setclr, \
+- }
++#define GATE_MM0(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &mm0_cg_regs, _shift, &mtk_clk_gate_ops_setclr)
++
++#define GATE_MM1(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &mm1_cg_regs, _shift, &mtk_clk_gate_ops_setclr)
+
+ static const struct mtk_gate mm_clks[] = {
+ /* MM0 */
+diff --git a/drivers/clk/mediatek/clk-mt8167-vdec.c b/drivers/clk/mediatek/clk-mt8167-vdec.c
+index 759e5791599f0..92bc05d997985 100644
+--- a/drivers/clk/mediatek/clk-mt8167-vdec.c
++++ b/drivers/clk/mediatek/clk-mt8167-vdec.c
+@@ -29,23 +29,11 @@ static const struct mtk_gate_regs vdec1_cg_regs = {
+ .sta_ofs = 0x8,
+ };
+
+-#define GATE_VDEC0_I(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &vdec0_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_setclr_inv, \
+- }
++#define GATE_VDEC0_I(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &vdec0_cg_regs, _shift, &mtk_clk_gate_ops_setclr_inv)
+
+-#define GATE_VDEC1_I(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &vdec1_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_setclr_inv, \
+- }
++#define GATE_VDEC1_I(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &vdec1_cg_regs, _shift, &mtk_clk_gate_ops_setclr_inv)
+
+ static const struct mtk_gate vdec_clks[] __initconst = {
+ /* VDEC0 */
+diff --git a/drivers/clk/mediatek/clk-mt8173-mm.c b/drivers/clk/mediatek/clk-mt8173-mm.c
+index 315430ad15814..c11ce453a88aa 100644
+--- a/drivers/clk/mediatek/clk-mt8173-mm.c
++++ b/drivers/clk/mediatek/clk-mt8173-mm.c
+@@ -25,23 +25,11 @@ static const struct mtk_gate_regs mm1_cg_regs = {
+ .sta_ofs = 0x0110,
+ };
+
+-#define GATE_MM0(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &mm0_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_setclr, \
+- }
+-
+-#define GATE_MM1(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &mm1_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_setclr, \
+- }
++#define GATE_MM0(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &mm0_cg_regs, _shift, &mtk_clk_gate_ops_setclr)
++
++#define GATE_MM1(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &mm1_cg_regs, _shift, &mtk_clk_gate_ops_setclr)
+
+ static const struct mtk_gate mt8173_mm_clks[] = {
+ /* MM0 */
+diff --git a/drivers/clk/mediatek/clk-mt8516-aud.c b/drivers/clk/mediatek/clk-mt8516-aud.c
+index 00f356fe7c7a6..a6ae8003b9ff6 100644
+--- a/drivers/clk/mediatek/clk-mt8516-aud.c
++++ b/drivers/clk/mediatek/clk-mt8516-aud.c
+@@ -22,14 +22,8 @@ static const struct mtk_gate_regs aud_cg_regs = {
+ .sta_ofs = 0x0,
+ };
+
+-#define GATE_AUD(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &aud_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_no_setclr, \
+- }
++#define GATE_AUD(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &aud_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr)
+
+ static const struct mtk_gate aud_clks[] __initconst = {
+ GATE_AUD(CLK_AUD_AFE, "aud_afe", "clk26m_ck", 2),
+diff --git a/drivers/clk/mediatek/clk-mt8516.c b/drivers/clk/mediatek/clk-mt8516.c
+index 2c0cae7b3bcfe..6983d3a48dc9a 100644
+--- a/drivers/clk/mediatek/clk-mt8516.c
++++ b/drivers/clk/mediatek/clk-mt8516.c
+@@ -525,59 +525,23 @@ static const struct mtk_gate_regs top5_cg_regs = {
+ .sta_ofs = 0x44,
+ };
+
+-#define GATE_TOP1(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &top1_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_setclr, \
+- }
++#define GATE_TOP1(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &top1_cg_regs, _shift, &mtk_clk_gate_ops_setclr)
+
+-#define GATE_TOP2(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &top2_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_setclr, \
+- }
++#define GATE_TOP2(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &top2_cg_regs, _shift, &mtk_clk_gate_ops_setclr)
+
+-#define GATE_TOP2_I(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &top2_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_setclr_inv, \
+- }
++#define GATE_TOP2_I(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &top2_cg_regs, _shift, &mtk_clk_gate_ops_setclr_inv)
+
+-#define GATE_TOP3(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &top3_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_setclr, \
+- }
++#define GATE_TOP3(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &top3_cg_regs, _shift, &mtk_clk_gate_ops_setclr)
+
+-#define GATE_TOP4_I(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &top4_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_setclr_inv, \
+- }
++#define GATE_TOP4_I(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &top4_cg_regs, _shift, &mtk_clk_gate_ops_setclr_inv)
+
+-#define GATE_TOP5(_id, _name, _parent, _shift) { \
+- .id = _id, \
+- .name = _name, \
+- .parent_name = _parent, \
+- .regs = &top5_cg_regs, \
+- .shift = _shift, \
+- .ops = &mtk_clk_gate_ops_no_setclr, \
+- }
++#define GATE_TOP5(_id, _name, _parent, _shift) \
++ GATE_MTK(_id, _name, _parent, &top5_cg_regs, _shift, &mtk_clk_gate_ops_setclr)
+
+ static const struct mtk_gate top_clks[] __initconst = {
+ /* TOP1 */
+--
+2.39.2
+
--- /dev/null
+From ef362bccdb9d8dc5e721f2df0e7da9c646c9ae3a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Mar 2023 15:04:56 +0100
+Subject: clk: mediatek: mt2712: Add error handling to
+ clk_mt2712_apmixed_probe()
+
+From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+
+[ Upstream commit 20cace1b9d7e33f68f0ee17196bf0df618dbacbe ]
+
+This function was completely missing error handling: add it.
+
+Fixes: e2f744a82d72 ("clk: mediatek: Add MT2712 clock support")
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Reviewed-by: Chen-Yu Tsai <wenst@chromium.org>
+Link: https://lore.kernel.org/r/20230306140543.1813621-8-angelogioacchino.delregno@collabora.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/mediatek/clk-mt2712.c | 18 ++++++++++++++----
+ 1 file changed, 14 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/clk/mediatek/clk-mt2712.c b/drivers/clk/mediatek/clk-mt2712.c
+index 94f8fc2a4f7bd..aa39d006358a3 100644
+--- a/drivers/clk/mediatek/clk-mt2712.c
++++ b/drivers/clk/mediatek/clk-mt2712.c
+@@ -1283,15 +1283,25 @@ static int clk_mt2712_apmixed_probe(struct platform_device *pdev)
+ struct device_node *node = pdev->dev.of_node;
+
+ clk_data = mtk_alloc_clk_data(CLK_APMIXED_NR_CLK);
++ if (!clk_data)
++ return -ENOMEM;
+
+- mtk_clk_register_plls(node, plls, ARRAY_SIZE(plls), clk_data);
++ r = mtk_clk_register_plls(node, plls, ARRAY_SIZE(plls), clk_data);
++ if (r)
++ goto free_clk_data;
+
+ r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data);
++ if (r) {
++ dev_err(&pdev->dev, "Cannot register clock provider: %d\n", r);
++ goto unregister_plls;
++ }
+
+- if (r != 0)
+- pr_err("%s(): could not register clock provider: %d\n",
+- __func__, r);
++ return 0;
+
++unregister_plls:
++ mtk_clk_unregister_plls(plls, ARRAY_SIZE(plls), clk_data);
++free_clk_data:
++ mtk_free_clk_data(clk_data);
+ return r;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 5579a3373abe272484005e9056d45f81852961bf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Mar 2023 15:05:12 +0100
+Subject: clk: mediatek: mt7622: Properly use CLK_IS_CRITICAL flag
+
+From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+
+[ Upstream commit fa8c0d01df62130ff596d560380a6f844f62639e ]
+
+Instead of calling clk_prepare_enable() for clocks that shall stay
+enabled, use the CLK_IS_CRITICAL flag, which purpose is exactly that.
+
+Fixes: 2fc0a509e4ee ("clk: mediatek: add clock support for MT7622 SoC")
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Reviewed-by: Chen-Yu Tsai <wenst@chromium.org>
+Link: https://lore.kernel.org/r/20230306140543.1813621-24-angelogioacchino.delregno@collabora.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/mediatek/clk-mt7622.c | 35 +++++++++++++------------------
+ 1 file changed, 15 insertions(+), 20 deletions(-)
+
+diff --git a/drivers/clk/mediatek/clk-mt7622.c b/drivers/clk/mediatek/clk-mt7622.c
+index 41af8d420bbf8..1c0049fbeb69c 100644
+--- a/drivers/clk/mediatek/clk-mt7622.c
++++ b/drivers/clk/mediatek/clk-mt7622.c
+@@ -50,9 +50,9 @@
+ _pd_reg, _pd_shift, _tuner_reg, _pcw_reg, _pcw_shift, \
+ NULL, "clkxtal")
+
+-#define GATE_APMIXED(_id, _name, _parent, _shift) \
+- GATE_MTK(_id, _name, _parent, &apmixed_cg_regs, _shift, \
+- &mtk_clk_gate_ops_no_setclr_inv)
++#define GATE_APMIXED_AO(_id, _name, _parent, _shift) \
++ GATE_MTK_FLAGS(_id, _name, _parent, &apmixed_cg_regs, _shift, \
++ &mtk_clk_gate_ops_no_setclr_inv, CLK_IS_CRITICAL)
+
+ #define GATE_INFRA(_id, _name, _parent, _shift) \
+ GATE_MTK(_id, _name, _parent, &infra_cg_regs, _shift, &mtk_clk_gate_ops_setclr)
+@@ -66,6 +66,10 @@
+ #define GATE_PERI0(_id, _name, _parent, _shift) \
+ GATE_MTK(_id, _name, _parent, &peri0_cg_regs, _shift, &mtk_clk_gate_ops_setclr)
+
++#define GATE_PERI0_AO(_id, _name, _parent, _shift) \
++ GATE_MTK_FLAGS(_id, _name, _parent, &peri0_cg_regs, _shift, \
++ &mtk_clk_gate_ops_setclr, CLK_IS_CRITICAL)
++
+ #define GATE_PERI1(_id, _name, _parent, _shift) \
+ GATE_MTK(_id, _name, _parent, &peri1_cg_regs, _shift, &mtk_clk_gate_ops_setclr)
+
+@@ -315,7 +319,7 @@ static const struct mtk_pll_data plls[] = {
+ };
+
+ static const struct mtk_gate apmixed_clks[] = {
+- GATE_APMIXED(CLK_APMIXED_MAIN_CORE_EN, "main_core_en", "mainpll", 5),
++ GATE_APMIXED_AO(CLK_APMIXED_MAIN_CORE_EN, "main_core_en", "mainpll", 5),
+ };
+
+ static const struct mtk_gate infra_clks[] = {
+@@ -450,7 +454,7 @@ static const struct mtk_gate peri_clks[] = {
+ GATE_PERI0(CLK_PERI_AP_DMA_PD, "peri_ap_dma_pd", "axi_sel", 12),
+ GATE_PERI0(CLK_PERI_MSDC30_0_PD, "peri_msdc30_0", "msdc30_0_sel", 13),
+ GATE_PERI0(CLK_PERI_MSDC30_1_PD, "peri_msdc30_1", "msdc30_1_sel", 14),
+- GATE_PERI0(CLK_PERI_UART0_PD, "peri_uart0_pd", "axi_sel", 17),
++ GATE_PERI0_AO(CLK_PERI_UART0_PD, "peri_uart0_pd", "axi_sel", 17),
+ GATE_PERI0(CLK_PERI_UART1_PD, "peri_uart1_pd", "axi_sel", 18),
+ GATE_PERI0(CLK_PERI_UART2_PD, "peri_uart2_pd", "axi_sel", 19),
+ GATE_PERI0(CLK_PERI_UART3_PD, "peri_uart3_pd", "axi_sel", 20),
+@@ -478,12 +482,12 @@ static struct mtk_composite infra_muxes[] = {
+
+ static struct mtk_composite top_muxes[] = {
+ /* CLK_CFG_0 */
+- MUX_GATE(CLK_TOP_AXI_SEL, "axi_sel", axi_parents,
+- 0x040, 0, 3, 7),
+- MUX_GATE(CLK_TOP_MEM_SEL, "mem_sel", mem_parents,
+- 0x040, 8, 1, 15),
+- MUX_GATE(CLK_TOP_DDRPHYCFG_SEL, "ddrphycfg_sel", ddrphycfg_parents,
+- 0x040, 16, 1, 23),
++ MUX_GATE_FLAGS(CLK_TOP_AXI_SEL, "axi_sel", axi_parents,
++ 0x040, 0, 3, 7, CLK_IS_CRITICAL),
++ MUX_GATE_FLAGS(CLK_TOP_MEM_SEL, "mem_sel", mem_parents,
++ 0x040, 8, 1, 15, CLK_IS_CRITICAL),
++ MUX_GATE_FLAGS(CLK_TOP_DDRPHYCFG_SEL, "ddrphycfg_sel", ddrphycfg_parents,
++ 0x040, 16, 1, 23, CLK_IS_CRITICAL),
+ MUX_GATE(CLK_TOP_ETH_SEL, "eth_sel", eth_parents,
+ 0x040, 24, 3, 31),
+
+@@ -621,10 +625,6 @@ static int mtk_topckgen_init(struct platform_device *pdev)
+ mtk_clk_register_gates(&pdev->dev, node, top_clks,
+ ARRAY_SIZE(top_clks), clk_data);
+
+- clk_prepare_enable(clk_data->hws[CLK_TOP_AXI_SEL]->clk);
+- clk_prepare_enable(clk_data->hws[CLK_TOP_MEM_SEL]->clk);
+- clk_prepare_enable(clk_data->hws[CLK_TOP_DDRPHYCFG_SEL]->clk);
+-
+ return of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data);
+ }
+
+@@ -667,9 +667,6 @@ static int mtk_apmixedsys_init(struct platform_device *pdev)
+ mtk_clk_register_gates(&pdev->dev, node, apmixed_clks,
+ ARRAY_SIZE(apmixed_clks), clk_data);
+
+- clk_prepare_enable(clk_data->hws[CLK_APMIXED_ARMPLL]->clk);
+- clk_prepare_enable(clk_data->hws[CLK_APMIXED_MAIN_CORE_EN]->clk);
+-
+ return of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data);
+ }
+
+@@ -697,8 +694,6 @@ static int mtk_pericfg_init(struct platform_device *pdev)
+ if (r)
+ return r;
+
+- clk_prepare_enable(clk_data->hws[CLK_PERI_UART0_PD]->clk);
+-
+ mtk_register_reset_controller_with_dev(&pdev->dev, &clk_rst_desc[1]);
+
+ return 0;
+--
+2.39.2
+
--- /dev/null
+From 9063eb5e4e43c0ee457fedc5ba42be83af3f097e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Mar 2023 15:05:40 +0100
+Subject: clk: mediatek: mt8135: Properly use CLK_IS_CRITICAL flag
+
+From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+
+[ Upstream commit f4f9a9c003b52ea3cffda186753bfb3e37b970f8 ]
+
+Instead of calling clk_prepare_enable() for clocks that shall stay
+enabled, use the CLK_IS_CRITICAL flag, which purpose is exactly that.
+
+Fixes: a8aede794843 ("clk: mediatek: Add basic clocks for Mediatek MT8135.")
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Reviewed-by: Chen-Yu Tsai <wenst@chromium.org>
+Link: https://lore.kernel.org/r/20230306140543.1813621-52-angelogioacchino.delregno@collabora.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/mediatek/clk-mt8135.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/clk/mediatek/clk-mt8135.c b/drivers/clk/mediatek/clk-mt8135.c
+index 97a115d2c3daa..a39ad58e27418 100644
+--- a/drivers/clk/mediatek/clk-mt8135.c
++++ b/drivers/clk/mediatek/clk-mt8135.c
+@@ -2,6 +2,8 @@
+ /*
+ * Copyright (c) 2014 MediaTek Inc.
+ * Author: James Liao <jamesjj.liao@mediatek.com>
++ * Copyright (c) 2023 Collabora, Ltd.
++ * AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+ */
+
+ #include <linux/clk.h>
+@@ -390,7 +392,7 @@ static const struct mtk_composite top_muxes[] __initconst = {
+ MUX_GATE(CLK_TOP_GCPU_SEL, "gcpu_sel", gcpu_parents, 0x0164, 24, 3, 31),
+ /* CLK_CFG_9 */
+ MUX_GATE(CLK_TOP_DPI1_SEL, "dpi1_sel", dpi1_parents, 0x0168, 0, 2, 7),
+- MUX_GATE(CLK_TOP_CCI_SEL, "cci_sel", cci_parents, 0x0168, 8, 3, 15),
++ MUX_GATE_FLAGS(CLK_TOP_CCI_SEL, "cci_sel", cci_parents, 0x0168, 8, 3, 15, CLK_IS_CRITICAL),
+ MUX_GATE(CLK_TOP_APLL_SEL, "apll_sel", apll_parents, 0x0168, 16, 3, 23),
+ MUX_GATE(CLK_TOP_HDMIPLL_SEL, "hdmipll_sel", hdmipll_parents, 0x0168, 24, 2, 31),
+ };
+@@ -404,6 +406,10 @@ static const struct mtk_gate_regs infra_cg_regs = {
+ #define GATE_ICG(_id, _name, _parent, _shift) \
+ GATE_MTK(_id, _name, _parent, &infra_cg_regs, _shift, &mtk_clk_gate_ops_setclr)
+
++#define GATE_ICG_AO(_id, _name, _parent, _shift) \
++ GATE_MTK_FLAGS(_id, _name, _parent, &infra_cg_regs, _shift, \
++ &mtk_clk_gate_ops_setclr, CLK_IS_CRITICAL)
++
+ static const struct mtk_gate infra_clks[] __initconst = {
+ GATE_ICG(CLK_INFRA_PMIC_WRAP, "pmic_wrap_ck", "axi_sel", 23),
+ GATE_ICG(CLK_INFRA_PMICSPI, "pmicspi_ck", "pmicspi_sel", 22),
+@@ -411,7 +417,7 @@ static const struct mtk_gate infra_clks[] __initconst = {
+ GATE_ICG(CLK_INFRA_CCIF0_AP_CTRL, "ccif0_ap_ctrl", "axi_sel", 20),
+ GATE_ICG(CLK_INFRA_KP, "kp_ck", "axi_sel", 16),
+ GATE_ICG(CLK_INFRA_CPUM, "cpum_ck", "cpum_tck_in", 15),
+- GATE_ICG(CLK_INFRA_M4U, "m4u_ck", "mem_sel", 8),
++ GATE_ICG_AO(CLK_INFRA_M4U, "m4u_ck", "mem_sel", 8),
+ GATE_ICG(CLK_INFRA_MFGAXI, "mfgaxi_ck", "axi_sel", 7),
+ GATE_ICG(CLK_INFRA_DEVAPC, "devapc_ck", "axi_sel", 6),
+ GATE_ICG(CLK_INFRA_AUDIO, "audio_ck", "aud_intbus_sel", 5),
+@@ -534,8 +540,6 @@ static void __init mtk_topckgen_init(struct device_node *node)
+ ARRAY_SIZE(top_muxes), base,
+ &mt8135_clk_lock, clk_data);
+
+- clk_prepare_enable(clk_data->hws[CLK_TOP_CCI_SEL]->clk);
+-
+ r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data);
+ if (r)
+ pr_err("%s(): could not register clock provider: %d\n",
+@@ -553,8 +557,6 @@ static void __init mtk_infrasys_init(struct device_node *node)
+ mtk_clk_register_gates(NULL, node, infra_clks,
+ ARRAY_SIZE(infra_clks), clk_data);
+
+- clk_prepare_enable(clk_data->hws[CLK_INFRA_M4U]->clk);
+-
+ r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data);
+ if (r)
+ pr_err("%s(): could not register clock provider: %d\n",
+--
+2.39.2
+
--- /dev/null
+From 9b67049c2de8dc39ff6638d42a89ed251ce45c76 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Apr 2023 16:53:06 +0200
+Subject: clk: qcom: dispcc-qcm2290: Remove inexistent DSI1PHY clk
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit 68d1151f03067533827fc50b770954ef33149533 ]
+
+There's only one DSI PHY on this SoC. Remove the ghost entry for the
+clock produced by a secondary one.
+
+Fixes: cc517ea3333f ("clk: qcom: Add display clock controller driver for QCM2290")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230412-topic-qcm_dispcc-v1-2-bf2989a75ae4@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/dispcc-qcm2290.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/drivers/clk/qcom/dispcc-qcm2290.c b/drivers/clk/qcom/dispcc-qcm2290.c
+index 2ebd9a02b8950..24755dc841f9d 100644
+--- a/drivers/clk/qcom/dispcc-qcm2290.c
++++ b/drivers/clk/qcom/dispcc-qcm2290.c
+@@ -26,7 +26,6 @@ enum {
+ P_DISP_CC_PLL0_OUT_MAIN,
+ P_DSI0_PHY_PLL_OUT_BYTECLK,
+ P_DSI0_PHY_PLL_OUT_DSICLK,
+- P_DSI1_PHY_PLL_OUT_DSICLK,
+ P_GPLL0_OUT_MAIN,
+ P_SLEEP_CLK,
+ };
+@@ -106,13 +105,11 @@ static const struct clk_parent_data disp_cc_parent_data_3[] = {
+ static const struct parent_map disp_cc_parent_map_4[] = {
+ { P_BI_TCXO, 0 },
+ { P_DSI0_PHY_PLL_OUT_DSICLK, 1 },
+- { P_DSI1_PHY_PLL_OUT_DSICLK, 2 },
+ };
+
+ static const struct clk_parent_data disp_cc_parent_data_4[] = {
+ { .fw_name = "bi_tcxo" },
+ { .fw_name = "dsi0_phy_pll_out_dsiclk" },
+- { .fw_name = "dsi1_phy_pll_out_dsiclk" },
+ };
+
+ static const struct parent_map disp_cc_parent_map_5[] = {
+--
+2.39.2
+
--- /dev/null
+From 1cb8f4c02cec160493bb4acd21422a9a14f1e912 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Mar 2023 18:30:48 +0100
+Subject: clk: qcom: gcc-qcm2290: Fix up gcc_sdcc2_apps_clk_src
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit 1bf088a9f0e50acd175ba8deef0db11c099fa26e ]
+
+Add the PARENT_ENABLE flag to prevent the clock from getting stuck
+at boot and use floor_ops to avoid SDHCI overclocking.
+
+Fixes: 496d1a13d405 ("clk: qcom: Add Global Clock Controller driver for QCM2290")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230315173048.3497655-1-konrad.dybcio@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/gcc-qcm2290.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/clk/qcom/gcc-qcm2290.c b/drivers/clk/qcom/gcc-qcm2290.c
+index 7792b8f237047..096deff2ba257 100644
+--- a/drivers/clk/qcom/gcc-qcm2290.c
++++ b/drivers/clk/qcom/gcc-qcm2290.c
+@@ -1243,7 +1243,8 @@ static struct clk_rcg2 gcc_sdcc2_apps_clk_src = {
+ .name = "gcc_sdcc2_apps_clk_src",
+ .parent_data = gcc_parents_12,
+ .num_parents = ARRAY_SIZE(gcc_parents_12),
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_floor_ops,
++ .flags = CLK_OPS_PARENT_ENABLE,
+ },
+ };
+
+--
+2.39.2
+
--- /dev/null
+From fddaf53e7a3311a90bf7ddaa6be8e05bf747849a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Apr 2023 00:47:19 +0200
+Subject: clk: qcom: gcc-sm6115: Mark RCGs shared where applicable
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit 996c32b745a15a637e8244a25f06b74acce98976 ]
+
+The vast majority of shared RCGs were not marked as such. Fix it.
+
+Fixes: cbe63bfdc54f ("clk: qcom: Add Global Clock controller (GCC) driver for SM6115")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230404224719.909746-1-konrad.dybcio@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/gcc-sm6115.c | 50 +++++++++++++++++------------------
+ 1 file changed, 25 insertions(+), 25 deletions(-)
+
+diff --git a/drivers/clk/qcom/gcc-sm6115.c b/drivers/clk/qcom/gcc-sm6115.c
+index 5b8222fea2f71..5f09aefa7fb92 100644
+--- a/drivers/clk/qcom/gcc-sm6115.c
++++ b/drivers/clk/qcom/gcc-sm6115.c
+@@ -694,7 +694,7 @@ static struct clk_rcg2 gcc_camss_axi_clk_src = {
+ .parent_data = gcc_parents_7,
+ .num_parents = ARRAY_SIZE(gcc_parents_7),
+ .flags = CLK_SET_RATE_PARENT,
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -715,7 +715,7 @@ static struct clk_rcg2 gcc_camss_cci_clk_src = {
+ .parent_data = gcc_parents_9,
+ .num_parents = ARRAY_SIZE(gcc_parents_9),
+ .flags = CLK_SET_RATE_PARENT | CLK_OPS_PARENT_ENABLE,
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -738,7 +738,7 @@ static struct clk_rcg2 gcc_camss_csi0phytimer_clk_src = {
+ .parent_data = gcc_parents_4,
+ .num_parents = ARRAY_SIZE(gcc_parents_4),
+ .flags = CLK_SET_RATE_PARENT | CLK_OPS_PARENT_ENABLE,
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -753,7 +753,7 @@ static struct clk_rcg2 gcc_camss_csi1phytimer_clk_src = {
+ .parent_data = gcc_parents_4,
+ .num_parents = ARRAY_SIZE(gcc_parents_4),
+ .flags = CLK_SET_RATE_PARENT | CLK_OPS_PARENT_ENABLE,
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -768,7 +768,7 @@ static struct clk_rcg2 gcc_camss_csi2phytimer_clk_src = {
+ .parent_data = gcc_parents_4,
+ .num_parents = ARRAY_SIZE(gcc_parents_4),
+ .flags = CLK_SET_RATE_PARENT | CLK_OPS_PARENT_ENABLE,
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -790,7 +790,7 @@ static struct clk_rcg2 gcc_camss_mclk0_clk_src = {
+ .parent_data = gcc_parents_3,
+ .num_parents = ARRAY_SIZE(gcc_parents_3),
+ .flags = CLK_SET_RATE_PARENT | CLK_OPS_PARENT_ENABLE,
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -805,7 +805,7 @@ static struct clk_rcg2 gcc_camss_mclk1_clk_src = {
+ .parent_data = gcc_parents_3,
+ .num_parents = ARRAY_SIZE(gcc_parents_3),
+ .flags = CLK_SET_RATE_PARENT | CLK_OPS_PARENT_ENABLE,
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -820,7 +820,7 @@ static struct clk_rcg2 gcc_camss_mclk2_clk_src = {
+ .parent_data = gcc_parents_3,
+ .num_parents = ARRAY_SIZE(gcc_parents_3),
+ .flags = CLK_SET_RATE_PARENT | CLK_OPS_PARENT_ENABLE,
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -835,7 +835,7 @@ static struct clk_rcg2 gcc_camss_mclk3_clk_src = {
+ .parent_data = gcc_parents_3,
+ .num_parents = ARRAY_SIZE(gcc_parents_3),
+ .flags = CLK_SET_RATE_PARENT | CLK_OPS_PARENT_ENABLE,
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -857,7 +857,7 @@ static struct clk_rcg2 gcc_camss_ope_ahb_clk_src = {
+ .parent_data = gcc_parents_8,
+ .num_parents = ARRAY_SIZE(gcc_parents_8),
+ .flags = CLK_SET_RATE_PARENT,
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -881,7 +881,7 @@ static struct clk_rcg2 gcc_camss_ope_clk_src = {
+ .parent_data = gcc_parents_8,
+ .num_parents = ARRAY_SIZE(gcc_parents_8),
+ .flags = CLK_SET_RATE_PARENT,
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -916,7 +916,7 @@ static struct clk_rcg2 gcc_camss_tfe_0_clk_src = {
+ .parent_data = gcc_parents_5,
+ .num_parents = ARRAY_SIZE(gcc_parents_5),
+ .flags = CLK_SET_RATE_PARENT,
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -941,7 +941,7 @@ static struct clk_rcg2 gcc_camss_tfe_0_csid_clk_src = {
+ .parent_data = gcc_parents_6,
+ .num_parents = ARRAY_SIZE(gcc_parents_6),
+ .flags = CLK_SET_RATE_PARENT,
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -956,7 +956,7 @@ static struct clk_rcg2 gcc_camss_tfe_1_clk_src = {
+ .parent_data = gcc_parents_5,
+ .num_parents = ARRAY_SIZE(gcc_parents_5),
+ .flags = CLK_SET_RATE_PARENT,
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -971,7 +971,7 @@ static struct clk_rcg2 gcc_camss_tfe_1_csid_clk_src = {
+ .parent_data = gcc_parents_6,
+ .num_parents = ARRAY_SIZE(gcc_parents_6),
+ .flags = CLK_SET_RATE_PARENT,
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -986,7 +986,7 @@ static struct clk_rcg2 gcc_camss_tfe_2_clk_src = {
+ .parent_data = gcc_parents_5,
+ .num_parents = ARRAY_SIZE(gcc_parents_5),
+ .flags = CLK_SET_RATE_PARENT,
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -1001,7 +1001,7 @@ static struct clk_rcg2 gcc_camss_tfe_2_csid_clk_src = {
+ .parent_data = gcc_parents_6,
+ .num_parents = ARRAY_SIZE(gcc_parents_6),
+ .flags = CLK_SET_RATE_PARENT,
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -1024,7 +1024,7 @@ static struct clk_rcg2 gcc_camss_tfe_cphy_rx_clk_src = {
+ .parent_data = gcc_parents_10,
+ .num_parents = ARRAY_SIZE(gcc_parents_10),
+ .flags = CLK_SET_RATE_PARENT | CLK_OPS_PARENT_ENABLE,
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -1046,7 +1046,7 @@ static struct clk_rcg2 gcc_camss_top_ahb_clk_src = {
+ .parent_data = gcc_parents_7,
+ .num_parents = ARRAY_SIZE(gcc_parents_7),
+ .flags = CLK_SET_RATE_PARENT | CLK_OPS_PARENT_ENABLE,
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -1116,7 +1116,7 @@ static struct clk_rcg2 gcc_pdm2_clk_src = {
+ .name = "gcc_pdm2_clk_src",
+ .parent_data = gcc_parents_0,
+ .num_parents = ARRAY_SIZE(gcc_parents_0),
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -1329,7 +1329,7 @@ static struct clk_rcg2 gcc_ufs_phy_axi_clk_src = {
+ .name = "gcc_ufs_phy_axi_clk_src",
+ .parent_data = gcc_parents_0,
+ .num_parents = ARRAY_SIZE(gcc_parents_0),
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -1351,7 +1351,7 @@ static struct clk_rcg2 gcc_ufs_phy_ice_core_clk_src = {
+ .name = "gcc_ufs_phy_ice_core_clk_src",
+ .parent_data = gcc_parents_0,
+ .num_parents = ARRAY_SIZE(gcc_parents_0),
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -1392,7 +1392,7 @@ static struct clk_rcg2 gcc_ufs_phy_unipro_core_clk_src = {
+ .name = "gcc_ufs_phy_unipro_core_clk_src",
+ .parent_data = gcc_parents_0,
+ .num_parents = ARRAY_SIZE(gcc_parents_0),
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -1414,7 +1414,7 @@ static struct clk_rcg2 gcc_usb30_prim_master_clk_src = {
+ .name = "gcc_usb30_prim_master_clk_src",
+ .parent_data = gcc_parents_0,
+ .num_parents = ARRAY_SIZE(gcc_parents_0),
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -1483,7 +1483,7 @@ static struct clk_rcg2 gcc_video_venus_clk_src = {
+ .parent_data = gcc_parents_13,
+ .num_parents = ARRAY_SIZE(gcc_parents_13),
+ .flags = CLK_SET_RATE_PARENT,
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+--
+2.39.2
+
--- /dev/null
+From ee9d376dba404dc55dad9409d0f084935fbbb1f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Apr 2023 16:48:29 +0300
+Subject: clk: qcom: gcc-sm8350: fix PCIe PIPE clocks handling
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit 1a500e0bc97b6cb3c0d9859e81973b8dd07d1b7b ]
+
+On SM8350 platform the PCIe PIPE clocks require additional handling to
+function correctly. They are to be switched to the tcxo source before
+turning PCIe GDSCs off and should be switched to PHY PIPE source once
+they are working. Switch PCIe PHY clocks to use clk_regmap_phy_mux_ops,
+which provide support for this dance.
+
+Fixes: 44c20c9ed37f ("clk: qcom: gcc: Add clock driver for SM8350")
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230412134829.3686467-1-dmitry.baryshkov@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/gcc-sm8350.c | 47 ++++++++++-------------------------
+ 1 file changed, 13 insertions(+), 34 deletions(-)
+
+diff --git a/drivers/clk/qcom/gcc-sm8350.c b/drivers/clk/qcom/gcc-sm8350.c
+index af4a1ea284215..1385a98eb3bbe 100644
+--- a/drivers/clk/qcom/gcc-sm8350.c
++++ b/drivers/clk/qcom/gcc-sm8350.c
+@@ -17,6 +17,7 @@
+ #include "clk-regmap.h"
+ #include "clk-regmap-divider.h"
+ #include "clk-regmap-mux.h"
++#include "clk-regmap-phy-mux.h"
+ #include "gdsc.h"
+ #include "reset.h"
+
+@@ -158,26 +159,6 @@ static const struct clk_parent_data gcc_parent_data_3[] = {
+ { .fw_name = "bi_tcxo" },
+ };
+
+-static const struct parent_map gcc_parent_map_4[] = {
+- { P_PCIE_0_PIPE_CLK, 0 },
+- { P_BI_TCXO, 2 },
+-};
+-
+-static const struct clk_parent_data gcc_parent_data_4[] = {
+- { .fw_name = "pcie_0_pipe_clk", },
+- { .fw_name = "bi_tcxo" },
+-};
+-
+-static const struct parent_map gcc_parent_map_5[] = {
+- { P_PCIE_1_PIPE_CLK, 0 },
+- { P_BI_TCXO, 2 },
+-};
+-
+-static const struct clk_parent_data gcc_parent_data_5[] = {
+- { .fw_name = "pcie_1_pipe_clk" },
+- { .fw_name = "bi_tcxo" },
+-};
+-
+ static const struct parent_map gcc_parent_map_6[] = {
+ { P_BI_TCXO, 0 },
+ { P_GCC_GPLL0_OUT_MAIN, 1 },
+@@ -274,32 +255,30 @@ static const struct clk_parent_data gcc_parent_data_14[] = {
+ { .fw_name = "bi_tcxo" },
+ };
+
+-static struct clk_regmap_mux gcc_pcie_0_pipe_clk_src = {
++static struct clk_regmap_phy_mux gcc_pcie_0_pipe_clk_src = {
+ .reg = 0x6b054,
+- .shift = 0,
+- .width = 2,
+- .parent_map = gcc_parent_map_4,
+ .clkr = {
+ .hw.init = &(struct clk_init_data){
+ .name = "gcc_pcie_0_pipe_clk_src",
+- .parent_data = gcc_parent_data_4,
+- .num_parents = ARRAY_SIZE(gcc_parent_data_4),
+- .ops = &clk_regmap_mux_closest_ops,
++ .parent_data = &(const struct clk_parent_data){
++ .fw_name = "pcie_0_pipe_clk",
++ },
++ .num_parents = 1,
++ .ops = &clk_regmap_phy_mux_ops,
+ },
+ },
+ };
+
+-static struct clk_regmap_mux gcc_pcie_1_pipe_clk_src = {
++static struct clk_regmap_phy_mux gcc_pcie_1_pipe_clk_src = {
+ .reg = 0x8d054,
+- .shift = 0,
+- .width = 2,
+- .parent_map = gcc_parent_map_5,
+ .clkr = {
+ .hw.init = &(struct clk_init_data){
+ .name = "gcc_pcie_1_pipe_clk_src",
+- .parent_data = gcc_parent_data_5,
+- .num_parents = ARRAY_SIZE(gcc_parent_data_5),
+- .ops = &clk_regmap_mux_closest_ops,
++ .parent_data = &(const struct clk_parent_data){
++ .fw_name = "pcie_1_pipe_clk",
++ },
++ .num_parents = 1,
++ .ops = &clk_regmap_phy_mux_ops,
+ },
+ },
+ };
+--
+2.39.2
+
--- /dev/null
+From db62444377b9340b285d665a2ea47e4d08ec957b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Apr 2023 14:52:55 +0530
+Subject: clk: qcom: lpassaudiocc-sc7280: Add required gdsc power domain clks
+ in lpass_cc_sc7280_desc
+
+From: Mohammad Rafi Shaik <quic_mohs@quicinc.com>
+
+[ Upstream commit aad09fc7c4a522892eb64a79627b17a3869936cb ]
+
+Add GDSCs in lpass_cc_sc7280_desc struct.
+When qcom,adsp-pil-mode is enabled, GDSCs required to solve
+dependencies in lpass_audiocc probe().
+
+Fixes: 0cbcfbe50cbf ("clk: qcom: lpass: Handle the regmap overlap of lpasscc and lpass_aon")
+Signed-off-by: Mohammad Rafi Shaik <quic_mohs@quicinc.com>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230407092255.119690-4-quic_mohs@quicinc.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/lpassaudiocc-sc7280.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/clk/qcom/lpassaudiocc-sc7280.c b/drivers/clk/qcom/lpassaudiocc-sc7280.c
+index 1339f9211a149..134eb1529ede2 100644
+--- a/drivers/clk/qcom/lpassaudiocc-sc7280.c
++++ b/drivers/clk/qcom/lpassaudiocc-sc7280.c
+@@ -696,6 +696,8 @@ static const struct qcom_cc_desc lpass_cc_sc7280_desc = {
+ .config = &lpass_audio_cc_sc7280_regmap_config,
+ .clks = lpass_cc_sc7280_clocks,
+ .num_clks = ARRAY_SIZE(lpass_cc_sc7280_clocks),
++ .gdscs = lpass_aon_cc_sc7280_gdscs,
++ .num_gdscs = ARRAY_SIZE(lpass_aon_cc_sc7280_gdscs),
+ };
+
+ static const struct qcom_cc_desc lpass_audio_cc_sc7280_desc = {
+--
+2.39.2
+
--- /dev/null
+From 3f47de8071624a3e2cbbe9c2e21e74274419e169 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Apr 2023 14:52:54 +0530
+Subject: clk: qcom: lpasscc-sc7280: Skip qdsp6ss clock registration
+
+From: Srinivasa Rao Mandadapu <quic_srivasam@quicinc.com>
+
+[ Upstream commit 4fc1c2d9a2b7a394f3b873aae5e03bffd8b5cd31 ]
+
+The qdsp6ss memory region is being shared by ADSP remoteproc device and
+lpasscc clock device, hence causing memory conflict.
+To avoid this, when qdsp6ss clocks are being enabled in remoteproc driver,
+skip qdsp6ss clock registration if "qcom,adsp-pil-mode" is enabled and
+also assign max_register value.
+
+Fixes: 4ab43d171181 ("clk: qcom: Add lpass clock controller driver for SC7280")
+Signed-off-by: Srinivasa Rao Mandadapu <quic_srivasam@quicinc.com>
+Signed-off-by: Mohammad Rafi Shaik <quic_mohs@quicinc.com>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230407092255.119690-3-quic_mohs@quicinc.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/lpasscc-sc7280.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/clk/qcom/lpasscc-sc7280.c b/drivers/clk/qcom/lpasscc-sc7280.c
+index 48432010ce247..0df2b29e95e31 100644
+--- a/drivers/clk/qcom/lpasscc-sc7280.c
++++ b/drivers/clk/qcom/lpasscc-sc7280.c
+@@ -121,14 +121,18 @@ static int lpass_cc_sc7280_probe(struct platform_device *pdev)
+ goto destroy_pm_clk;
+ }
+
+- lpass_regmap_config.name = "qdsp6ss";
+- desc = &lpass_qdsp6ss_sc7280_desc;
+-
+- ret = qcom_cc_probe_by_index(pdev, 0, desc);
+- if (ret)
+- goto destroy_pm_clk;
++ if (!of_property_read_bool(pdev->dev.of_node, "qcom,adsp-pil-mode")) {
++ lpass_regmap_config.name = "qdsp6ss";
++ lpass_regmap_config.max_register = 0x3f;
++ desc = &lpass_qdsp6ss_sc7280_desc;
++
++ ret = qcom_cc_probe_by_index(pdev, 0, desc);
++ if (ret)
++ goto destroy_pm_clk;
++ }
+
+ lpass_regmap_config.name = "top_cc";
++ lpass_regmap_config.max_register = 0x4;
+ desc = &lpass_cc_top_sc7280_desc;
+
+ ret = qcom_cc_probe_by_index(pdev, 1, desc);
+--
+2.39.2
+
--- /dev/null
+From f454014ce787ca59a782e4c629a16439cdbc993e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Apr 2023 13:50:37 +0000
+Subject: clocksource/drivers/davinci: Fix memory leak in
+ davinci_timer_register when init fails
+
+From: Qinrun Dai <flno@hust.edu.cn>
+
+[ Upstream commit fb73556386e074e9bee9fa2d253aeaefe4e063e0 ]
+
+Smatch reports:
+drivers/clocksource/timer-davinci.c:332 davinci_timer_register()
+warn: 'base' from ioremap() not released on lines: 274.
+
+Fix this and other potential memory leak problems
+by adding a set of corresponding exit lables.
+
+Fixes: 721154f972aa ("clocksource/drivers/davinci: Add support for clockevents")
+Signed-off-by: Qinrun Dai <flno@hust.edu.cn>
+Link: https://lore.kernel.org/r/20230413135037.1505799-1-flno@hust.edu.cn
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/timer-davinci.c | 30 +++++++++++++++++++++++------
+ 1 file changed, 24 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/clocksource/timer-davinci.c b/drivers/clocksource/timer-davinci.c
+index 9996c05425200..b1c248498be46 100644
+--- a/drivers/clocksource/timer-davinci.c
++++ b/drivers/clocksource/timer-davinci.c
+@@ -257,21 +257,25 @@ int __init davinci_timer_register(struct clk *clk,
+ resource_size(&timer_cfg->reg),
+ "davinci-timer")) {
+ pr_err("Unable to request memory region\n");
+- return -EBUSY;
++ rv = -EBUSY;
++ goto exit_clk_disable;
+ }
+
+ base = ioremap(timer_cfg->reg.start, resource_size(&timer_cfg->reg));
+ if (!base) {
+ pr_err("Unable to map the register range\n");
+- return -ENOMEM;
++ rv = -ENOMEM;
++ goto exit_mem_region;
+ }
+
+ davinci_timer_init(base);
+ tick_rate = clk_get_rate(clk);
+
+ clockevent = kzalloc(sizeof(*clockevent), GFP_KERNEL);
+- if (!clockevent)
+- return -ENOMEM;
++ if (!clockevent) {
++ rv = -ENOMEM;
++ goto exit_iounmap_base;
++ }
+
+ clockevent->dev.name = "tim12";
+ clockevent->dev.features = CLOCK_EVT_FEAT_ONESHOT;
+@@ -296,7 +300,7 @@ int __init davinci_timer_register(struct clk *clk,
+ "clockevent/tim12", clockevent);
+ if (rv) {
+ pr_err("Unable to request the clockevent interrupt\n");
+- return rv;
++ goto exit_free_clockevent;
+ }
+
+ davinci_clocksource.dev.rating = 300;
+@@ -323,13 +327,27 @@ int __init davinci_timer_register(struct clk *clk,
+ rv = clocksource_register_hz(&davinci_clocksource.dev, tick_rate);
+ if (rv) {
+ pr_err("Unable to register clocksource\n");
+- return rv;
++ goto exit_free_irq;
+ }
+
+ sched_clock_register(davinci_timer_read_sched_clock,
+ DAVINCI_TIMER_CLKSRC_BITS, tick_rate);
+
+ return 0;
++
++exit_free_irq:
++ free_irq(timer_cfg->irq[DAVINCI_TIMER_CLOCKEVENT_IRQ].start,
++ clockevent);
++exit_free_clockevent:
++ kfree(clockevent);
++exit_iounmap_base:
++ iounmap(base);
++exit_mem_region:
++ release_mem_region(timer_cfg->reg.start,
++ resource_size(&timer_cfg->reg));
++exit_clk_disable:
++ clk_disable_unprepare(clk);
++ return rv;
+ }
+
+ static int __init of_davinci_timer_register(struct device_node *np)
+--
+2.39.2
+
--- /dev/null
+From bbf0f229751dc3707c6ca6ee5294c00d0e2a92ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Apr 2023 10:49:22 +0100
+Subject: coresight: etm_pmu: Set the module field
+
+From: Suzuki K Poulose <suzuki.poulose@arm.com>
+
+[ Upstream commit 18996a113f2567aef3057e300e3193ce2df1684c ]
+
+struct pmu::module must be set to the module owning the PMU driver.
+Set this for the coresight etm_pmu.
+
+Fixes: 8e264c52e1dab ("coresight: core: Allow the coresight core driver to be built as a module")
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Link: https://lore.kernel.org/r/20230405094922.667834-1-suzuki.poulose@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/coresight/coresight-etm-perf.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/hwtracing/coresight/coresight-etm-perf.c b/drivers/hwtracing/coresight/coresight-etm-perf.c
+index a48c97da81658..711f451b69469 100644
+--- a/drivers/hwtracing/coresight/coresight-etm-perf.c
++++ b/drivers/hwtracing/coresight/coresight-etm-perf.c
+@@ -901,6 +901,7 @@ int __init etm_perf_init(void)
+ etm_pmu.addr_filters_sync = etm_addr_filters_sync;
+ etm_pmu.addr_filters_validate = etm_addr_filters_validate;
+ etm_pmu.nr_addr_filters = ETM_ADDR_CMP_MAX;
++ etm_pmu.module = THIS_MODULE;
+
+ ret = perf_pmu_register(&etm_pmu, CORESIGHT_ETM_PMU_NAME, -1);
+ if (ret == 0)
+--
+2.39.2
+
--- /dev/null
+From 49399ae2d441f543a523037cf95e106c7cd31035 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Mar 2023 18:11:28 +0800
+Subject: cpufreq: mediatek: fix KP caused by handler usage after
+ regulator_put/clk_put
+
+From: Jia-Wei Chang <jia-wei.chang@mediatek.com>
+
+[ Upstream commit d51e106240bc755cbe59634b70d567c192b045b2 ]
+
+Any kind of failure in mtk_cpu_dvfs_info_init() will lead to calling
+regulator_put() or clk_put() and the KP will occur since the regulator/clk
+handlers are used after released in mtk_cpu_dvfs_info_release().
+
+To prevent the usage after regulator_put()/clk_put(), the regulator/clk
+handlers are addressed in a way of "Free the Last Thing Style".
+
+Signed-off-by: Jia-Wei Chang <jia-wei.chang@mediatek.com>
+Fixes: 4b9ceb757bbb ("cpufreq: mediatek: Enable clocks and regulators")
+Suggested-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Suggested-by: Dan Carpenter <error27@gmail.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/mediatek-cpufreq.c | 62 +++++++++++++++---------------
+ 1 file changed, 30 insertions(+), 32 deletions(-)
+
+diff --git a/drivers/cpufreq/mediatek-cpufreq.c b/drivers/cpufreq/mediatek-cpufreq.c
+index 01d949707c373..6dc225546a8d6 100644
+--- a/drivers/cpufreq/mediatek-cpufreq.c
++++ b/drivers/cpufreq/mediatek-cpufreq.c
+@@ -420,7 +420,7 @@ static int mtk_cpu_dvfs_info_init(struct mtk_cpu_dvfs_info *info, int cpu)
+ ret = PTR_ERR(info->inter_clk);
+ dev_err_probe(cpu_dev, ret,
+ "cpu%d: failed to get intermediate clk\n", cpu);
+- goto out_free_resources;
++ goto out_free_mux_clock;
+ }
+
+ info->proc_reg = regulator_get_optional(cpu_dev, "proc");
+@@ -428,13 +428,13 @@ static int mtk_cpu_dvfs_info_init(struct mtk_cpu_dvfs_info *info, int cpu)
+ ret = PTR_ERR(info->proc_reg);
+ dev_err_probe(cpu_dev, ret,
+ "cpu%d: failed to get proc regulator\n", cpu);
+- goto out_free_resources;
++ goto out_free_inter_clock;
+ }
+
+ ret = regulator_enable(info->proc_reg);
+ if (ret) {
+ dev_warn(cpu_dev, "cpu%d: failed to enable vproc\n", cpu);
+- goto out_free_resources;
++ goto out_free_proc_reg;
+ }
+
+ /* Both presence and absence of sram regulator are valid cases. */
+@@ -442,14 +442,14 @@ static int mtk_cpu_dvfs_info_init(struct mtk_cpu_dvfs_info *info, int cpu)
+ if (IS_ERR(info->sram_reg)) {
+ ret = PTR_ERR(info->sram_reg);
+ if (ret == -EPROBE_DEFER)
+- goto out_free_resources;
++ goto out_disable_proc_reg;
+
+ info->sram_reg = NULL;
+ } else {
+ ret = regulator_enable(info->sram_reg);
+ if (ret) {
+ dev_warn(cpu_dev, "cpu%d: failed to enable vsram\n", cpu);
+- goto out_free_resources;
++ goto out_free_sram_reg;
+ }
+ }
+
+@@ -458,13 +458,13 @@ static int mtk_cpu_dvfs_info_init(struct mtk_cpu_dvfs_info *info, int cpu)
+ if (ret) {
+ dev_err(cpu_dev,
+ "cpu%d: failed to get OPP-sharing information\n", cpu);
+- goto out_free_resources;
++ goto out_disable_sram_reg;
+ }
+
+ ret = dev_pm_opp_of_cpumask_add_table(&info->cpus);
+ if (ret) {
+ dev_warn(cpu_dev, "cpu%d: no OPP table\n", cpu);
+- goto out_free_resources;
++ goto out_disable_sram_reg;
+ }
+
+ ret = clk_prepare_enable(info->cpu_clk);
+@@ -533,43 +533,41 @@ static int mtk_cpu_dvfs_info_init(struct mtk_cpu_dvfs_info *info, int cpu)
+ out_free_opp_table:
+ dev_pm_opp_of_cpumask_remove_table(&info->cpus);
+
+-out_free_resources:
+- if (regulator_is_enabled(info->proc_reg))
+- regulator_disable(info->proc_reg);
+- if (info->sram_reg && regulator_is_enabled(info->sram_reg))
++out_disable_sram_reg:
++ if (info->sram_reg)
+ regulator_disable(info->sram_reg);
+
+- if (!IS_ERR(info->proc_reg))
+- regulator_put(info->proc_reg);
+- if (!IS_ERR(info->sram_reg))
++out_free_sram_reg:
++ if (info->sram_reg)
+ regulator_put(info->sram_reg);
+- if (!IS_ERR(info->cpu_clk))
+- clk_put(info->cpu_clk);
+- if (!IS_ERR(info->inter_clk))
+- clk_put(info->inter_clk);
++
++out_disable_proc_reg:
++ regulator_disable(info->proc_reg);
++
++out_free_proc_reg:
++ regulator_put(info->proc_reg);
++
++out_free_inter_clock:
++ clk_put(info->inter_clk);
++
++out_free_mux_clock:
++ clk_put(info->cpu_clk);
+
+ return ret;
+ }
+
+ static void mtk_cpu_dvfs_info_release(struct mtk_cpu_dvfs_info *info)
+ {
+- if (!IS_ERR(info->proc_reg)) {
+- regulator_disable(info->proc_reg);
+- regulator_put(info->proc_reg);
+- }
+- if (!IS_ERR(info->sram_reg)) {
++ regulator_disable(info->proc_reg);
++ regulator_put(info->proc_reg);
++ if (info->sram_reg) {
+ regulator_disable(info->sram_reg);
+ regulator_put(info->sram_reg);
+ }
+- if (!IS_ERR(info->cpu_clk)) {
+- clk_disable_unprepare(info->cpu_clk);
+- clk_put(info->cpu_clk);
+- }
+- if (!IS_ERR(info->inter_clk)) {
+- clk_disable_unprepare(info->inter_clk);
+- clk_put(info->inter_clk);
+- }
+-
++ clk_disable_unprepare(info->cpu_clk);
++ clk_put(info->cpu_clk);
++ clk_disable_unprepare(info->inter_clk);
++ clk_put(info->inter_clk);
+ dev_pm_opp_of_cpumask_remove_table(&info->cpus);
+ dev_pm_opp_unregister_notifier(info->cpu_dev, &info->opp_nb);
+ }
+--
+2.39.2
+
--- /dev/null
+From 1452b999cfa6f0ef79b33fd0545446afcb348d75 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Mar 2023 18:11:27 +0800
+Subject: cpufreq: mediatek: fix passing zero to 'PTR_ERR'
+
+From: Jia-Wei Chang <jia-wei.chang@mediatek.com>
+
+[ Upstream commit d51c63230994f167126d9d8381011b4cb2b0ad22 ]
+
+In order to prevent passing zero to 'PTR_ERR' in
+mtk_cpu_dvfs_info_init(), we fix the return value of of_get_cci() using
+error pointer by explicitly casting error number.
+
+Signed-off-by: Jia-Wei Chang <jia-wei.chang@mediatek.com>
+Fixes: 0daa47325bae ("cpufreq: mediatek: Link CCI device to CPU")
+Reported-by: Dan Carpenter <error27@gmail.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/mediatek-cpufreq.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/cpufreq/mediatek-cpufreq.c b/drivers/cpufreq/mediatek-cpufreq.c
+index 7f2680bc9a0f4..01d949707c373 100644
+--- a/drivers/cpufreq/mediatek-cpufreq.c
++++ b/drivers/cpufreq/mediatek-cpufreq.c
+@@ -373,13 +373,13 @@ static struct device *of_get_cci(struct device *cpu_dev)
+ struct platform_device *pdev;
+
+ np = of_parse_phandle(cpu_dev->of_node, "mediatek,cci", 0);
+- if (IS_ERR_OR_NULL(np))
+- return NULL;
++ if (!np)
++ return ERR_PTR(-ENODEV);
+
+ pdev = of_find_device_by_node(np);
+ of_node_put(np);
+- if (IS_ERR_OR_NULL(pdev))
+- return NULL;
++ if (!pdev)
++ return ERR_PTR(-ENODEV);
+
+ return &pdev->dev;
+ }
+@@ -401,7 +401,7 @@ static int mtk_cpu_dvfs_info_init(struct mtk_cpu_dvfs_info *info, int cpu)
+ info->ccifreq_bound = false;
+ if (info->soc_data->ccifreq_supported) {
+ info->cci_dev = of_get_cci(info->cpu_dev);
+- if (IS_ERR_OR_NULL(info->cci_dev)) {
++ if (IS_ERR(info->cci_dev)) {
+ ret = PTR_ERR(info->cci_dev);
+ dev_err(cpu_dev, "cpu%d: failed to get cci device\n", cpu);
+ return -ENODEV;
+--
+2.39.2
+
--- /dev/null
+From b417177f6cda59890ba4930f9092b833e77288c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Mar 2023 18:11:30 +0800
+Subject: cpufreq: mediatek: Raise proc and sram max voltage for MT7622/7623
+
+From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+
+[ Upstream commit 0883426fd07e39355362e3f2eb9aee1a154dcaf6 ]
+
+During the addition of SRAM voltage tracking for CCI scaling, this
+driver got some voltage limits set for the vtrack algorithm: these
+were moved to platform data first, then enforced in a later commit
+6a17b3876bc8 ("cpufreq: mediatek: Refine mtk_cpufreq_voltage_tracking()")
+using these as max values for the regulator_set_voltage() calls.
+
+In this case, the vsram/vproc constraints for MT7622 and MT7623
+were supposed to be the same as MT2701 (and a number of other SoCs),
+but that turned out to be a mistake because the aforementioned two
+SoCs' maximum voltage for both VPROC and VPROC_SRAM is 1.36V.
+
+Fix that by adding new platform data for MT7622/7623 declaring the
+right {proc,sram}_max_volt parameter.
+
+Fixes: ead858bd128d ("cpufreq: mediatek: Move voltage limits to platform data")
+Fixes: 6a17b3876bc8 ("cpufreq: mediatek: Refine mtk_cpufreq_voltage_tracking()")
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Jia-Wei Chang <jia-wei.chang@mediatek.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/mediatek-cpufreq.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/cpufreq/mediatek-cpufreq.c b/drivers/cpufreq/mediatek-cpufreq.c
+index 764e4fbdd536c..9a39a7ccfae96 100644
+--- a/drivers/cpufreq/mediatek-cpufreq.c
++++ b/drivers/cpufreq/mediatek-cpufreq.c
+@@ -693,6 +693,15 @@ static const struct mtk_cpufreq_platform_data mt2701_platform_data = {
+ .ccifreq_supported = false,
+ };
+
++static const struct mtk_cpufreq_platform_data mt7622_platform_data = {
++ .min_volt_shift = 100000,
++ .max_volt_shift = 200000,
++ .proc_max_volt = 1360000,
++ .sram_min_volt = 0,
++ .sram_max_volt = 1360000,
++ .ccifreq_supported = false,
++};
++
+ static const struct mtk_cpufreq_platform_data mt8183_platform_data = {
+ .min_volt_shift = 100000,
+ .max_volt_shift = 200000,
+@@ -724,8 +733,8 @@ static const struct mtk_cpufreq_platform_data mt8516_platform_data = {
+ static const struct of_device_id mtk_cpufreq_machines[] __initconst = {
+ { .compatible = "mediatek,mt2701", .data = &mt2701_platform_data },
+ { .compatible = "mediatek,mt2712", .data = &mt2701_platform_data },
+- { .compatible = "mediatek,mt7622", .data = &mt2701_platform_data },
+- { .compatible = "mediatek,mt7623", .data = &mt2701_platform_data },
++ { .compatible = "mediatek,mt7622", .data = &mt7622_platform_data },
++ { .compatible = "mediatek,mt7623", .data = &mt7622_platform_data },
+ { .compatible = "mediatek,mt8167", .data = &mt8516_platform_data },
+ { .compatible = "mediatek,mt817x", .data = &mt2701_platform_data },
+ { .compatible = "mediatek,mt8173", .data = &mt2701_platform_data },
+--
+2.39.2
+
--- /dev/null
+From 933a4f4fc4009435000766e79115d91f270bae0d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Mar 2023 18:11:29 +0800
+Subject: cpufreq: mediatek: raise proc/sram max voltage for MT8516
+
+From: Jia-Wei Chang <jia-wei.chang@mediatek.com>
+
+[ Upstream commit d3296bb4cafd4bad4a5cf2eeab9d19cc94f9e30e ]
+
+Since the upper boundary of proc/sram voltage of MT8516 is 1300 mV,
+which is greater than the value of MT2701 1150 mV, we fix it by adding
+the corresponding platform data and specify proc/sram_max_volt to
+support MT8516.
+
+Signed-off-by: Jia-Wei Chang <jia-wei.chang@mediatek.com>
+Fixes: ead858bd128d ("cpufreq: mediatek: Move voltage limits to platform data")
+Fixes: 6a17b3876bc8 ("cpufreq: mediatek: Refine mtk_cpufreq_voltage_tracking()")
+Reported-by: Nick Hainke <vincent@systemli.org>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/mediatek-cpufreq.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/cpufreq/mediatek-cpufreq.c b/drivers/cpufreq/mediatek-cpufreq.c
+index 6dc225546a8d6..764e4fbdd536c 100644
+--- a/drivers/cpufreq/mediatek-cpufreq.c
++++ b/drivers/cpufreq/mediatek-cpufreq.c
+@@ -711,20 +711,29 @@ static const struct mtk_cpufreq_platform_data mt8186_platform_data = {
+ .ccifreq_supported = true,
+ };
+
++static const struct mtk_cpufreq_platform_data mt8516_platform_data = {
++ .min_volt_shift = 100000,
++ .max_volt_shift = 200000,
++ .proc_max_volt = 1310000,
++ .sram_min_volt = 0,
++ .sram_max_volt = 1310000,
++ .ccifreq_supported = false,
++};
++
+ /* List of machines supported by this driver */
+ static const struct of_device_id mtk_cpufreq_machines[] __initconst = {
+ { .compatible = "mediatek,mt2701", .data = &mt2701_platform_data },
+ { .compatible = "mediatek,mt2712", .data = &mt2701_platform_data },
+ { .compatible = "mediatek,mt7622", .data = &mt2701_platform_data },
+ { .compatible = "mediatek,mt7623", .data = &mt2701_platform_data },
+- { .compatible = "mediatek,mt8167", .data = &mt2701_platform_data },
++ { .compatible = "mediatek,mt8167", .data = &mt8516_platform_data },
+ { .compatible = "mediatek,mt817x", .data = &mt2701_platform_data },
+ { .compatible = "mediatek,mt8173", .data = &mt2701_platform_data },
+ { .compatible = "mediatek,mt8176", .data = &mt2701_platform_data },
+ { .compatible = "mediatek,mt8183", .data = &mt8183_platform_data },
+ { .compatible = "mediatek,mt8186", .data = &mt8186_platform_data },
+ { .compatible = "mediatek,mt8365", .data = &mt2701_platform_data },
+- { .compatible = "mediatek,mt8516", .data = &mt2701_platform_data },
++ { .compatible = "mediatek,mt8516", .data = &mt8516_platform_data },
+ { }
+ };
+ MODULE_DEVICE_TABLE(of, mtk_cpufreq_machines);
+--
+2.39.2
+
--- /dev/null
+From 4304be7ddc483841d08798606a011a70d40bee4d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Mar 2023 15:33:43 -0700
+Subject: cpufreq: qcom-cpufreq-hw: Revert adding cpufreq qos
+
+From: Bjorn Andersson <quic_bjorande@quicinc.com>
+
+[ Upstream commit e2b47e585931a988c856fd4ba31e1296f749aee3 ]
+
+The OSM/EPSS hardware controls the frequency of each CPU cluster based
+on requests from the OS and various throttling events in the system.
+While throttling is in effect the related dcvs interrupt will be kept
+high. The purpose of the code handling this interrupt is to
+continuously report the thermal pressure based on the throttled
+frequency.
+
+The reasoning for adding QoS control to this mechanism is not entirely
+clear, but the introduction of commit 'c4c0efb06f17 ("cpufreq:
+qcom-cpufreq-hw: Add cpufreq qos for LMh")' causes the
+scaling_max_frequncy to be set to the throttled frequency. On the next
+iteration of polling, the throttled frequency is above or equal to the
+newly requested frequency, so the polling is stopped.
+
+With cpufreq limiting the max frequency, the hardware no longer report a
+throttling state and no further updates to thermal pressure or qos
+state are made.
+
+The result of this is that scaling_max_frequency can only go down, and
+the system becomes slower and slower every time a thermal throttling
+event is reported by the hardware.
+
+Even if the logic could be improved, there is no reason for software to
+limit the max freqency in response to the hardware limiting the max
+frequency. At best software will follow the reported hardware state, but
+typically it will cause slower backoff of the throttling.
+
+This reverts commit c4c0efb06f17fa4a37ad99e7752b18a5405c76dc.
+
+Fixes: c4c0efb06f17 ("cpufreq: qcom-cpufreq-hw: Add cpufreq qos for LMh")
+Reported-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Bjorn Andersson <quic_bjorande@quicinc.com>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/qcom-cpufreq-hw.c | 14 --------------
+ 1 file changed, 14 deletions(-)
+
+diff --git a/drivers/cpufreq/qcom-cpufreq-hw.c b/drivers/cpufreq/qcom-cpufreq-hw.c
+index b2d2907200a9a..9e78640096383 100644
+--- a/drivers/cpufreq/qcom-cpufreq-hw.c
++++ b/drivers/cpufreq/qcom-cpufreq-hw.c
+@@ -14,7 +14,6 @@
+ #include <linux/of_address.h>
+ #include <linux/of_platform.h>
+ #include <linux/pm_opp.h>
+-#include <linux/pm_qos.h>
+ #include <linux/slab.h>
+ #include <linux/spinlock.h>
+ #include <linux/units.h>
+@@ -57,8 +56,6 @@ struct qcom_cpufreq_data {
+ struct clk_hw cpu_clk;
+
+ bool per_core_dcvs;
+-
+- struct freq_qos_request throttle_freq_req;
+ };
+
+ static struct {
+@@ -348,8 +345,6 @@ static void qcom_lmh_dcvs_notify(struct qcom_cpufreq_data *data)
+
+ throttled_freq = freq_hz / HZ_PER_KHZ;
+
+- freq_qos_update_request(&data->throttle_freq_req, throttled_freq);
+-
+ /* Update thermal pressure (the boost frequencies are accepted) */
+ arch_update_thermal_pressure(policy->related_cpus, throttled_freq);
+
+@@ -442,14 +437,6 @@ static int qcom_cpufreq_hw_lmh_init(struct cpufreq_policy *policy, int index)
+ if (data->throttle_irq < 0)
+ return data->throttle_irq;
+
+- ret = freq_qos_add_request(&policy->constraints,
+- &data->throttle_freq_req, FREQ_QOS_MAX,
+- FREQ_QOS_MAX_DEFAULT_VALUE);
+- if (ret < 0) {
+- dev_err(&pdev->dev, "Failed to add freq constraint (%d)\n", ret);
+- return ret;
+- }
+-
+ data->cancel_throttle = false;
+ data->policy = policy;
+
+@@ -516,7 +503,6 @@ static void qcom_cpufreq_hw_lmh_exit(struct qcom_cpufreq_data *data)
+ if (data->throttle_irq <= 0)
+ return;
+
+- freq_qos_remove_request(&data->throttle_freq_req);
+ free_irq(data->throttle_irq, data);
+ }
+
+--
+2.39.2
+
--- /dev/null
+From b2897bec96884ec422fce85766a6536c1fe1a7aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Apr 2023 17:04:54 +0530
+Subject: cpufreq: use correct unit when verify cur freq
+
+From: Sanjay Chandrashekara <sanjayc@nvidia.com>
+
+[ Upstream commit 44295af5019f1997d038ad2611086a2d1e2af167 ]
+
+cpufreq_verify_current_freq checks() if the frequency returned by
+the hardware has a slight delta with the valid frequency value
+last set and returns "policy->cur" if the delta is within "1 MHz".
+In the comparison, "policy->cur" is in "kHz" but it's compared
+against HZ_PER_MHZ. So, the comparison range becomes "1 GHz".
+
+Fix this by comparing against KHZ_PER_MHZ instead of HZ_PER_MHZ.
+
+Fixes: f55ae08c8987 ("cpufreq: Avoid unnecessary frequency updates due to mismatch")
+Signed-off-by: Sanjay Chandrashekara <sanjayc@nvidia.com>
+[ sumit gupta: Commit message update ]
+Signed-off-by: Sumit Gupta <sumitg@nvidia.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/cpufreq.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
+index 6d8fd3b8dcb52..a0742c787014d 100644
+--- a/drivers/cpufreq/cpufreq.c
++++ b/drivers/cpufreq/cpufreq.c
+@@ -1727,7 +1727,7 @@ static unsigned int cpufreq_verify_current_freq(struct cpufreq_policy *policy, b
+ * MHz. In such cases it is better to avoid getting into
+ * unnecessary frequency updates.
+ */
+- if (abs(policy->cur - new_freq) < HZ_PER_MHZ)
++ if (abs(policy->cur - new_freq) < KHZ_PER_MHZ)
+ return policy->cur;
+
+ cpufreq_out_of_sync(policy, new_freq);
+--
+2.39.2
+
--- /dev/null
+From 31b5f815c3ec51242c8c18d6e11e3a63af07ad40 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Mar 2023 07:59:30 +0100
+Subject: crypto: caam - Clear some memory in instantiate_rng
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 9c19fb86a8cb2ee82a832c95e139f29ea05c4d08 ]
+
+According to the comment at the end of the 'for' loop just a few lines
+below, it looks needed to clear 'desc'.
+
+So it should also be cleared for the first iteration.
+
+Move the memset() to the beginning of the loop to be safe.
+
+Fixes: 281922a1d4f5 ("crypto: caam - add support for SEC v5.x RNG4")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Reviewed-by: Gaurav Jain <gaurav.jain@nxp.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/caam/ctrl.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/crypto/caam/ctrl.c b/drivers/crypto/caam/ctrl.c
+index 6278afb951c30..71b14269a9979 100644
+--- a/drivers/crypto/caam/ctrl.c
++++ b/drivers/crypto/caam/ctrl.c
+@@ -284,6 +284,10 @@ static int instantiate_rng(struct device *ctrldev, int state_handle_mask,
+ const u32 rdsta_if = RDSTA_IF0 << sh_idx;
+ const u32 rdsta_pr = RDSTA_PR0 << sh_idx;
+ const u32 rdsta_mask = rdsta_if | rdsta_pr;
++
++ /* Clear the contents before using the descriptor */
++ memset(desc, 0x00, CAAM_CMD_SZ * 7);
++
+ /*
+ * If the corresponding bit is set, this state handle
+ * was initialized by somebody else, so it's left alone.
+@@ -327,8 +331,6 @@ static int instantiate_rng(struct device *ctrldev, int state_handle_mask,
+ }
+
+ dev_info(ctrldev, "Instantiated RNG4 SH%d\n", sh_idx);
+- /* Clear the contents before recreating the descriptor */
+- memset(desc, 0x00, CAAM_CMD_SZ * 7);
+ }
+
+ kfree(desc);
+--
+2.39.2
+
--- /dev/null
+From ebd0e006b1627c2f48c1d6a2e0096b01106b2e79 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Mar 2023 11:35:23 +0800
+Subject: crypto: drbg - Only fail when jent is unavailable in FIPS mode
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+[ Upstream commit 686cd976b6ddedeeb1a1fb09ba53a891d3cc9a03 ]
+
+When jent initialisation fails for any reason other than ENOENT,
+the entire drbg fails to initialise, even when we're not in FIPS
+mode. This is wrong because we can still use the kernel RNG when
+we're not in FIPS mode.
+
+Change it so that it only fails when we are in FIPS mode.
+
+Fixes: 57225e679788 ("crypto: drbg - Use callback API for random readiness")
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Reviewed-by: Stephan Mueller <smueller@chronox.de>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/drbg.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/crypto/drbg.c b/crypto/drbg.c
+index 982d4ca4526d8..ff4ebbc68efab 100644
+--- a/crypto/drbg.c
++++ b/crypto/drbg.c
+@@ -1546,7 +1546,7 @@ static int drbg_prepare_hrng(struct drbg_state *drbg)
+ const int err = PTR_ERR(drbg->jent);
+
+ drbg->jent = NULL;
+- if (fips_enabled || err != -ENOENT)
++ if (fips_enabled)
+ return err;
+ pr_info("DRBG: Continuing without Jitter RNG\n");
+ }
+--
+2.39.2
+
--- /dev/null
+From dc37dce8f0858ed201d72c8ce7708f841d052779 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Feb 2023 15:55:42 -0500
+Subject: crypto: qat - fix concurrency issue when device state changes
+
+From: Shashank Gupta <shashank.gupta@intel.com>
+
+[ Upstream commit 1bdc85550a2b59bb7f62ead7173134e66dd2d60e ]
+
+The sysfs `state` attribute is not protected against race conditions.
+If multiple processes perform a device state transition on the same
+device in parallel, unexpected behaviors might occur.
+
+For transitioning the device state, adf_sysfs.c calls the functions
+adf_dev_init(), adf_dev_start(), adf_dev_stop() and adf_dev_shutdown()
+which are unprotected and interdependent on each other. To perform a
+state transition, these functions needs to be called in a specific
+order:
+ * device up: adf_dev_init() -> adf_dev_start()
+ * device down: adf_dev_stop() -> adf_dev_shutdown()
+
+This change introduces the functions adf_dev_up() and adf_dev_down()
+which wrap the state machine functions and protect them with a
+per-device lock. These are then used in adf_sysfs.c instead of the
+individual state transition functions.
+
+Fixes: 5ee52118ac14 ("crypto: qat - expose device state through sysfs for 4xxx")
+Signed-off-by: Shashank Gupta <shashank.gupta@intel.com>
+Reviewed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../crypto/qat/qat_common/adf_accel_devices.h | 1 +
+ .../crypto/qat/qat_common/adf_common_drv.h | 3 +
+ drivers/crypto/qat/qat_common/adf_dev_mgr.c | 2 +
+ drivers/crypto/qat/qat_common/adf_init.c | 64 +++++++++++++++++++
+ drivers/crypto/qat/qat_common/adf_sysfs.c | 23 +------
+ 5 files changed, 73 insertions(+), 20 deletions(-)
+
+diff --git a/drivers/crypto/qat/qat_common/adf_accel_devices.h b/drivers/crypto/qat/qat_common/adf_accel_devices.h
+index 284f5aad3ee0b..7be933d6f0ffa 100644
+--- a/drivers/crypto/qat/qat_common/adf_accel_devices.h
++++ b/drivers/crypto/qat/qat_common/adf_accel_devices.h
+@@ -310,6 +310,7 @@ struct adf_accel_dev {
+ u8 pf_compat_ver;
+ } vf;
+ };
++ struct mutex state_lock; /* protect state of the device */
+ bool is_vf;
+ u32 accel_id;
+ };
+diff --git a/drivers/crypto/qat/qat_common/adf_common_drv.h b/drivers/crypto/qat/qat_common/adf_common_drv.h
+index 7189265573c08..4bf1fceb7052b 100644
+--- a/drivers/crypto/qat/qat_common/adf_common_drv.h
++++ b/drivers/crypto/qat/qat_common/adf_common_drv.h
+@@ -58,6 +58,9 @@ void adf_dev_stop(struct adf_accel_dev *accel_dev);
+ void adf_dev_shutdown(struct adf_accel_dev *accel_dev);
+ int adf_dev_shutdown_cache_cfg(struct adf_accel_dev *accel_dev);
+
++int adf_dev_up(struct adf_accel_dev *accel_dev, bool init_config);
++int adf_dev_down(struct adf_accel_dev *accel_dev, bool cache_config);
++
+ void adf_devmgr_update_class_index(struct adf_hw_device_data *hw_data);
+ void adf_clean_vf_map(bool);
+
+diff --git a/drivers/crypto/qat/qat_common/adf_dev_mgr.c b/drivers/crypto/qat/qat_common/adf_dev_mgr.c
+index 4c752eed10fea..86ee36feefad3 100644
+--- a/drivers/crypto/qat/qat_common/adf_dev_mgr.c
++++ b/drivers/crypto/qat/qat_common/adf_dev_mgr.c
+@@ -223,6 +223,7 @@ int adf_devmgr_add_dev(struct adf_accel_dev *accel_dev,
+ map->attached = true;
+ list_add_tail(&map->list, &vfs_table);
+ }
++ mutex_init(&accel_dev->state_lock);
+ unlock:
+ mutex_unlock(&table_lock);
+ return ret;
+@@ -269,6 +270,7 @@ void adf_devmgr_rm_dev(struct adf_accel_dev *accel_dev,
+ }
+ }
+ unlock:
++ mutex_destroy(&accel_dev->state_lock);
+ list_del(&accel_dev->list);
+ mutex_unlock(&table_lock);
+ }
+diff --git a/drivers/crypto/qat/qat_common/adf_init.c b/drivers/crypto/qat/qat_common/adf_init.c
+index cef7bb8ec0073..988cffd0b8338 100644
+--- a/drivers/crypto/qat/qat_common/adf_init.c
++++ b/drivers/crypto/qat/qat_common/adf_init.c
+@@ -400,3 +400,67 @@ int adf_dev_shutdown_cache_cfg(struct adf_accel_dev *accel_dev)
+
+ return 0;
+ }
++
++int adf_dev_down(struct adf_accel_dev *accel_dev, bool reconfig)
++{
++ int ret = 0;
++
++ if (!accel_dev)
++ return -EINVAL;
++
++ mutex_lock(&accel_dev->state_lock);
++
++ if (!adf_dev_started(accel_dev)) {
++ dev_info(&GET_DEV(accel_dev), "Device qat_dev%d already down\n",
++ accel_dev->accel_id);
++ ret = -EINVAL;
++ goto out;
++ }
++
++ if (reconfig) {
++ ret = adf_dev_shutdown_cache_cfg(accel_dev);
++ goto out;
++ }
++
++ adf_dev_stop(accel_dev);
++ adf_dev_shutdown(accel_dev);
++
++out:
++ mutex_unlock(&accel_dev->state_lock);
++ return ret;
++}
++EXPORT_SYMBOL_GPL(adf_dev_down);
++
++int adf_dev_up(struct adf_accel_dev *accel_dev, bool config)
++{
++ int ret = 0;
++
++ if (!accel_dev)
++ return -EINVAL;
++
++ mutex_lock(&accel_dev->state_lock);
++
++ if (adf_dev_started(accel_dev)) {
++ dev_info(&GET_DEV(accel_dev), "Device qat_dev%d already up\n",
++ accel_dev->accel_id);
++ ret = -EALREADY;
++ goto out;
++ }
++
++ if (config && GET_HW_DATA(accel_dev)->dev_config) {
++ ret = GET_HW_DATA(accel_dev)->dev_config(accel_dev);
++ if (unlikely(ret))
++ goto out;
++ }
++
++ ret = adf_dev_init(accel_dev);
++ if (unlikely(ret))
++ goto out;
++
++ ret = adf_dev_start(accel_dev);
++
++out:
++ mutex_unlock(&accel_dev->state_lock);
++ return ret;
++}
++EXPORT_SYMBOL_GPL(adf_dev_up);
+diff --git a/drivers/crypto/qat/qat_common/adf_sysfs.c b/drivers/crypto/qat/qat_common/adf_sysfs.c
+index e8b078e719c20..3eb6611ab1b11 100644
+--- a/drivers/crypto/qat/qat_common/adf_sysfs.c
++++ b/drivers/crypto/qat/qat_common/adf_sysfs.c
+@@ -50,38 +50,21 @@ static ssize_t state_store(struct device *dev, struct device_attribute *attr,
+
+ switch (ret) {
+ case DEV_DOWN:
+- if (!adf_dev_started(accel_dev)) {
+- dev_info(dev, "Device qat_dev%d already down\n",
+- accel_id);
+- return -EINVAL;
+- }
+-
+ dev_info(dev, "Stopping device qat_dev%d\n", accel_id);
+
+- ret = adf_dev_shutdown_cache_cfg(accel_dev);
++ ret = adf_dev_down(accel_dev, true);
+ if (ret < 0)
+ return -EINVAL;
+
+ break;
+ case DEV_UP:
+- if (adf_dev_started(accel_dev)) {
+- dev_info(dev, "Device qat_dev%d already up\n",
+- accel_id);
+- return -EINVAL;
+- }
+-
+ dev_info(dev, "Starting device qat_dev%d\n", accel_id);
+
+- ret = GET_HW_DATA(accel_dev)->dev_config(accel_dev);
+- if (!ret)
+- ret = adf_dev_init(accel_dev);
+- if (!ret)
+- ret = adf_dev_start(accel_dev);
+-
++ ret = adf_dev_up(accel_dev, true);
+ if (ret < 0) {
+ dev_err(dev, "Failed to start device qat_dev%d\n",
+ accel_id);
+- adf_dev_shutdown_cache_cfg(accel_dev);
++ adf_dev_down(accel_dev, true);
+ return ret;
+ }
+ break;
+--
+2.39.2
+
--- /dev/null
+From e2175ef88fed46548fe0bd3787823370abd25df7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Mar 2023 20:28:12 +0530
+Subject: crypto: sa2ul - Select CRYPTO_DES
+
+From: Suman Anna <s-anna@ti.com>
+
+[ Upstream commit 8832023efd20966e29944dac92118dfbf1fa1bc0 ]
+
+The SA2UL Crypto driver provides support for couple of
+DES3 algos "cbc(des3_ede)" and "ecb(des3_ede)", and enabling
+the crypto selftest throws the following errors (as seen on
+K3 J721E SoCs):
+ saul-crypto 4e00000.crypto: Error allocating fallback algo cbc(des3_ede)
+ alg: skcipher: failed to allocate transform for cbc-des3-sa2ul: -2
+ saul-crypto 4e00000.crypto: Error allocating fallback algo ecb(des3_ede)
+ alg: skcipher: failed to allocate transform for ecb-des3-sa2ul: -2
+
+Fix this by selecting CRYPTO_DES which was missed while
+adding base driver support.
+
+Fixes: 7694b6ca649f ("crypto: sa2ul - Add crypto driver")
+Signed-off-by: Suman Anna <s-anna@ti.com>
+Signed-off-by: Jayesh Choudhary <j-choudhary@ti.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/crypto/Kconfig b/drivers/crypto/Kconfig
+index 3b2516d1433f7..20222e321a436 100644
+--- a/drivers/crypto/Kconfig
++++ b/drivers/crypto/Kconfig
+@@ -810,6 +810,7 @@ config CRYPTO_DEV_SA2UL
+ select CRYPTO_AES
+ select CRYPTO_ALGAPI
+ select CRYPTO_AUTHENC
++ select CRYPTO_DES
+ select CRYPTO_SHA1
+ select CRYPTO_SHA256
+ select CRYPTO_SHA512
+--
+2.39.2
+
--- /dev/null
+From 29c6cfb63736ac5dc7df8772d6b91786257fdd24 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Apr 2023 09:54:39 +0200
+Subject: debugobject: Prevent init race with static objects
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+[ Upstream commit 63a759694eed61025713b3e14dd827c8548daadc ]
+
+Statically initialized objects are usually not initialized via the init()
+function of the subsystem. They are special cased and the subsystem
+provides a function to validate whether an object which is not yet tracked
+by debugobjects is statically initialized. This means the object is started
+to be tracked on first use, e.g. activation.
+
+This works perfectly fine, unless there are two concurrent operations on
+that object. Schspa decoded the problem:
+
+T0 T1
+
+debug_object_assert_init(addr)
+ lock_hash_bucket()
+ obj = lookup_object(addr);
+ if (!obj) {
+ unlock_hash_bucket();
+ - > preemption
+ lock_subsytem_object(addr);
+ activate_object(addr)
+ lock_hash_bucket();
+ obj = lookup_object(addr);
+ if (!obj) {
+ unlock_hash_bucket();
+ if (is_static_object(addr))
+ init_and_track(addr);
+ lock_hash_bucket();
+ obj = lookup_object(addr);
+ obj->state = ACTIVATED;
+ unlock_hash_bucket();
+
+ subsys function modifies content of addr,
+ so static object detection does
+ not longer work.
+
+ unlock_subsytem_object(addr);
+
+ if (is_static_object(addr)) <- Fails
+
+ debugobject emits a warning and invokes the fixup function which
+ reinitializes the already active object in the worst case.
+
+This race exists forever, but was never observed until mod_timer() got a
+debug_object_assert_init() added which is outside of the timer base lock
+held section right at the beginning of the function to cover the lockless
+early exit points too.
+
+Rework the code so that the lookup, the static object check and the
+tracking object association happens atomically under the hash bucket
+lock. This prevents the issue completely as all callers are serialized on
+the hash bucket lock and therefore cannot observe inconsistent state.
+
+Fixes: 3ac7fe5a4aab ("infrastructure to debug (dynamic) objects")
+Reported-by: syzbot+5093ba19745994288b53@syzkaller.appspotmail.com
+Debugged-by: Schspa Shi <schspa@gmail.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Link: https://syzkaller.appspot.com/bug?id=22c8a5938eab640d1c6bcc0e3dc7be519d878462
+Link: https://lore.kernel.org/lkml/20230303161906.831686-1-schspa@gmail.com
+Link: https://lore.kernel.org/r/87zg7dzgao.ffs@tglx
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/debugobjects.c | 125 ++++++++++++++++++++++++---------------------
+ 1 file changed, 66 insertions(+), 59 deletions(-)
+
+diff --git a/lib/debugobjects.c b/lib/debugobjects.c
+index df86e649d8be0..b796799fadb20 100644
+--- a/lib/debugobjects.c
++++ b/lib/debugobjects.c
+@@ -216,10 +216,6 @@ static struct debug_obj *__alloc_object(struct hlist_head *list)
+ return obj;
+ }
+
+-/*
+- * Allocate a new object. If the pool is empty, switch off the debugger.
+- * Must be called with interrupts disabled.
+- */
+ static struct debug_obj *
+ alloc_object(void *addr, struct debug_bucket *b, const struct debug_obj_descr *descr)
+ {
+@@ -552,11 +548,49 @@ static void debug_object_is_on_stack(void *addr, int onstack)
+ WARN_ON(1);
+ }
+
++static struct debug_obj *lookup_object_or_alloc(void *addr, struct debug_bucket *b,
++ const struct debug_obj_descr *descr,
++ bool onstack, bool alloc_ifstatic)
++{
++ struct debug_obj *obj = lookup_object(addr, b);
++ enum debug_obj_state state = ODEBUG_STATE_NONE;
++
++ if (likely(obj))
++ return obj;
++
++ /*
++ * debug_object_init() unconditionally allocates untracked
++ * objects. It does not matter whether it is a static object or
++ * not.
++ *
++ * debug_object_assert_init() and debug_object_activate() allow
++ * allocation only if the descriptor callback confirms that the
++ * object is static and considered initialized. For non-static
++ * objects the allocation needs to be done from the fixup callback.
++ */
++ if (unlikely(alloc_ifstatic)) {
++ if (!descr->is_static_object || !descr->is_static_object(addr))
++ return ERR_PTR(-ENOENT);
++ /* Statically allocated objects are considered initialized */
++ state = ODEBUG_STATE_INIT;
++ }
++
++ obj = alloc_object(addr, b, descr);
++ if (likely(obj)) {
++ obj->state = state;
++ debug_object_is_on_stack(addr, onstack);
++ return obj;
++ }
++
++ /* Out of memory. Do the cleanup outside of the locked region */
++ debug_objects_enabled = 0;
++ return NULL;
++}
++
+ static void
+ __debug_object_init(void *addr, const struct debug_obj_descr *descr, int onstack)
+ {
+ enum debug_obj_state state;
+- bool check_stack = false;
+ struct debug_bucket *db;
+ struct debug_obj *obj;
+ unsigned long flags;
+@@ -572,16 +606,11 @@ __debug_object_init(void *addr, const struct debug_obj_descr *descr, int onstack
+
+ raw_spin_lock_irqsave(&db->lock, flags);
+
+- obj = lookup_object(addr, db);
+- if (!obj) {
+- obj = alloc_object(addr, db, descr);
+- if (!obj) {
+- debug_objects_enabled = 0;
+- raw_spin_unlock_irqrestore(&db->lock, flags);
+- debug_objects_oom();
+- return;
+- }
+- check_stack = true;
++ obj = lookup_object_or_alloc(addr, db, descr, onstack, false);
++ if (unlikely(!obj)) {
++ raw_spin_unlock_irqrestore(&db->lock, flags);
++ debug_objects_oom();
++ return;
+ }
+
+ switch (obj->state) {
+@@ -607,8 +636,6 @@ __debug_object_init(void *addr, const struct debug_obj_descr *descr, int onstack
+ }
+
+ raw_spin_unlock_irqrestore(&db->lock, flags);
+- if (check_stack)
+- debug_object_is_on_stack(addr, onstack);
+ }
+
+ /**
+@@ -648,14 +675,12 @@ EXPORT_SYMBOL_GPL(debug_object_init_on_stack);
+ */
+ int debug_object_activate(void *addr, const struct debug_obj_descr *descr)
+ {
++ struct debug_obj o = { .object = addr, .state = ODEBUG_STATE_NOTAVAILABLE, .descr = descr };
+ enum debug_obj_state state;
+ struct debug_bucket *db;
+ struct debug_obj *obj;
+ unsigned long flags;
+ int ret;
+- struct debug_obj o = { .object = addr,
+- .state = ODEBUG_STATE_NOTAVAILABLE,
+- .descr = descr };
+
+ if (!debug_objects_enabled)
+ return 0;
+@@ -664,8 +689,8 @@ int debug_object_activate(void *addr, const struct debug_obj_descr *descr)
+
+ raw_spin_lock_irqsave(&db->lock, flags);
+
+- obj = lookup_object(addr, db);
+- if (obj) {
++ obj = lookup_object_or_alloc(addr, db, descr, false, true);
++ if (likely(!IS_ERR_OR_NULL(obj))) {
+ bool print_object = false;
+
+ switch (obj->state) {
+@@ -698,24 +723,16 @@ int debug_object_activate(void *addr, const struct debug_obj_descr *descr)
+
+ raw_spin_unlock_irqrestore(&db->lock, flags);
+
+- /*
+- * We are here when a static object is activated. We
+- * let the type specific code confirm whether this is
+- * true or not. if true, we just make sure that the
+- * static object is tracked in the object tracker. If
+- * not, this must be a bug, so we try to fix it up.
+- */
+- if (descr->is_static_object && descr->is_static_object(addr)) {
+- /* track this static object */
+- debug_object_init(addr, descr);
+- debug_object_activate(addr, descr);
+- } else {
+- debug_print_object(&o, "activate");
+- ret = debug_object_fixup(descr->fixup_activate, addr,
+- ODEBUG_STATE_NOTAVAILABLE);
+- return ret ? 0 : -EINVAL;
++ /* If NULL the allocation has hit OOM */
++ if (!obj) {
++ debug_objects_oom();
++ return 0;
+ }
+- return 0;
++
++ /* Object is neither static nor tracked. It's not initialized */
++ debug_print_object(&o, "activate");
++ ret = debug_object_fixup(descr->fixup_activate, addr, ODEBUG_STATE_NOTAVAILABLE);
++ return ret ? 0 : -EINVAL;
+ }
+ EXPORT_SYMBOL_GPL(debug_object_activate);
+
+@@ -869,6 +886,7 @@ EXPORT_SYMBOL_GPL(debug_object_free);
+ */
+ void debug_object_assert_init(void *addr, const struct debug_obj_descr *descr)
+ {
++ struct debug_obj o = { .object = addr, .state = ODEBUG_STATE_NOTAVAILABLE, .descr = descr };
+ struct debug_bucket *db;
+ struct debug_obj *obj;
+ unsigned long flags;
+@@ -879,31 +897,20 @@ void debug_object_assert_init(void *addr, const struct debug_obj_descr *descr)
+ db = get_bucket((unsigned long) addr);
+
+ raw_spin_lock_irqsave(&db->lock, flags);
++ obj = lookup_object_or_alloc(addr, db, descr, false, true);
++ raw_spin_unlock_irqrestore(&db->lock, flags);
++ if (likely(!IS_ERR_OR_NULL(obj)))
++ return;
+
+- obj = lookup_object(addr, db);
++ /* If NULL the allocation has hit OOM */
+ if (!obj) {
+- struct debug_obj o = { .object = addr,
+- .state = ODEBUG_STATE_NOTAVAILABLE,
+- .descr = descr };
+-
+- raw_spin_unlock_irqrestore(&db->lock, flags);
+- /*
+- * Maybe the object is static, and we let the type specific
+- * code confirm. Track this static object if true, else invoke
+- * fixup.
+- */
+- if (descr->is_static_object && descr->is_static_object(addr)) {
+- /* Track this static object */
+- debug_object_init(addr, descr);
+- } else {
+- debug_print_object(&o, "assert_init");
+- debug_object_fixup(descr->fixup_assert_init, addr,
+- ODEBUG_STATE_NOTAVAILABLE);
+- }
++ debug_objects_oom();
+ return;
+ }
+
+- raw_spin_unlock_irqrestore(&db->lock, flags);
++ /* Object is neither tracked nor static. It's not initialized. */
++ debug_print_object(&o, "assert_init");
++ debug_object_fixup(descr->fixup_assert_init, addr, ODEBUG_STATE_NOTAVAILABLE);
+ }
+ EXPORT_SYMBOL_GPL(debug_object_assert_init);
+
+--
+2.39.2
+
--- /dev/null
+From 9c2fa99e0e10f22ba4ce88313af429f6faabce28 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Apr 2023 02:33:55 +0300
+Subject: dma: gpi: remove spurious unlock in gpi_ch_init
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit 91d6a468e335571f1e67e046050dea9af5fa4ebe ]
+
+gpi_ch_init() doesn't lock the ctrl_lock mutex, so there is no need to
+unlock it too. Instead the mutex is handled by the function
+gpi_alloc_chan_resources(), which properly locks and unlocks the mutex.
+
+=====================================
+WARNING: bad unlock balance detected!
+6.3.0-rc5-00253-g99792582ded1-dirty #15 Not tainted
+-------------------------------------
+kworker/u16:0/9 is trying to release lock (&gpii->ctrl_lock) at:
+[<ffffb99d04e1284c>] gpi_alloc_chan_resources+0x108/0x5bc
+but there are no more locks to release!
+
+other info that might help us debug this:
+6 locks held by kworker/u16:0/9:
+ #0: ffff575740010938 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x220/0x594
+ #1: ffff80000809bdd0 (deferred_probe_work){+.+.}-{0:0}, at: process_one_work+0x220/0x594
+ #2: ffff575740f2a0f8 (&dev->mutex){....}-{3:3}, at: __device_attach+0x38/0x188
+ #3: ffff57574b5570f8 (&dev->mutex){....}-{3:3}, at: __device_attach+0x38/0x188
+ #4: ffffb99d06a2f180 (of_dma_lock){+.+.}-{3:3}, at: of_dma_request_slave_channel+0x138/0x280
+ #5: ffffb99d06a2ee20 (dma_list_mutex){+.+.}-{3:3}, at: dma_get_slave_channel+0x28/0x10c
+
+stack backtrace:
+CPU: 7 PID: 9 Comm: kworker/u16:0 Not tainted 6.3.0-rc5-00253-g99792582ded1-dirty #15
+Hardware name: Google Pixel 3 (DT)
+Workqueue: events_unbound deferred_probe_work_func
+Call trace:
+ dump_backtrace+0xa0/0xfc
+ show_stack+0x18/0x24
+ dump_stack_lvl+0x60/0xac
+ dump_stack+0x18/0x24
+ print_unlock_imbalance_bug+0x130/0x148
+ lock_release+0x270/0x300
+ __mutex_unlock_slowpath+0x48/0x2cc
+ mutex_unlock+0x20/0x2c
+ gpi_alloc_chan_resources+0x108/0x5bc
+ dma_chan_get+0x84/0x188
+ dma_get_slave_channel+0x5c/0x10c
+ gpi_of_dma_xlate+0x110/0x1a0
+ of_dma_request_slave_channel+0x174/0x280
+ dma_request_chan+0x3c/0x2d4
+ geni_i2c_probe+0x544/0x63c
+ platform_probe+0x68/0xc4
+ really_probe+0x148/0x2ac
+ __driver_probe_device+0x78/0xe0
+ driver_probe_device+0x3c/0x160
+ __device_attach_driver+0xb8/0x138
+ bus_for_each_drv+0x84/0xe0
+ __device_attach+0x9c/0x188
+ device_initial_probe+0x14/0x20
+ bus_probe_device+0xac/0xb0
+ device_add+0x60c/0x7d8
+ of_device_add+0x44/0x60
+ of_platform_device_create_pdata+0x90/0x124
+ of_platform_bus_create+0x15c/0x3c8
+ of_platform_populate+0x58/0xf8
+ devm_of_platform_populate+0x58/0xbc
+ geni_se_probe+0xf0/0x164
+ platform_probe+0x68/0xc4
+ really_probe+0x148/0x2ac
+ __driver_probe_device+0x78/0xe0
+ driver_probe_device+0x3c/0x160
+ __device_attach_driver+0xb8/0x138
+ bus_for_each_drv+0x84/0xe0
+ __device_attach+0x9c/0x188
+ device_initial_probe+0x14/0x20
+ bus_probe_device+0xac/0xb0
+ deferred_probe_work_func+0x8c/0xc8
+ process_one_work+0x2bc/0x594
+ worker_thread+0x228/0x438
+ kthread+0x108/0x10c
+ ret_from_fork+0x10/0x20
+
+Fixes: 5d0c3533a19f ("dmaengine: qcom: Add GPI dma driver")
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/20230409233355.453741-1-dmitry.baryshkov@linaro.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/qcom/gpi.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/dma/qcom/gpi.c b/drivers/dma/qcom/gpi.c
+index 59a36cbf9b5f7..932628b319c81 100644
+--- a/drivers/dma/qcom/gpi.c
++++ b/drivers/dma/qcom/gpi.c
+@@ -1966,7 +1966,6 @@ static int gpi_ch_init(struct gchan *gchan)
+ error_config_int:
+ gpi_free_ring(&gpii->ev_ring, gpii);
+ exit_gpi_init:
+- mutex_unlock(&gpii->ctrl_lock);
+ return ret;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From a18fab760d231a3341675bca38b20ff3703ba267 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Feb 2023 17:18:21 +0200
+Subject: dmaengine: at_xdmac: disable/enable clock directly on suspend/resume
+
+From: Claudiu Beznea <claudiu.beznea@microchip.com>
+
+[ Upstream commit 2de5ddb5e68c94b781b3789bca1ce52000d7d0e0 ]
+
+Runtime PM APIs for at_xdmac just plays with clk_enable()/clk_disable()
+letting aside the clk_prepare()/clk_unprepare() that needs to be
+executed as the clock is also prepared on probe. Thus instead of using
+runtime PM force suspend/resume APIs use
+clk_disable_unprepare() + pm_runtime_put_noidle() on suspend and
+clk_prepare_enable() + pm_runtime_get_noresume() on resume. This
+approach as been chosen instead of using runtime PM force suspend/resume
+with clk_unprepare()/clk_prepare() as it looks simpler and the final
+code is better.
+
+While at it added the missing pm_runtime_mark_last_busy() on suspend before
+decrementing the reference counter.
+
+Fixes: 650b0e990cbd ("dmaengine: at_xdmac: add runtime pm support")
+Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Link: https://lore.kernel.org/r/20230214151827.1050280-2-claudiu.beznea@microchip.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/at_xdmac.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/dma/at_xdmac.c b/drivers/dma/at_xdmac.c
+index 1f0fab180f8f1..f654ecaafb906 100644
+--- a/drivers/dma/at_xdmac.c
++++ b/drivers/dma/at_xdmac.c
+@@ -2130,7 +2130,11 @@ static int __maybe_unused atmel_xdmac_suspend(struct device *dev)
+ atxdmac->save_gim = at_xdmac_read(atxdmac, AT_XDMAC_GIM);
+
+ at_xdmac_off(atxdmac);
+- return pm_runtime_force_suspend(atxdmac->dev);
++ pm_runtime_mark_last_busy(atxdmac->dev);
++ pm_runtime_put_noidle(atxdmac->dev);
++ clk_disable_unprepare(atxdmac->clk);
++
++ return 0;
+ }
+
+ static int __maybe_unused atmel_xdmac_resume(struct device *dev)
+@@ -2142,10 +2146,12 @@ static int __maybe_unused atmel_xdmac_resume(struct device *dev)
+ int i;
+ int ret;
+
+- ret = pm_runtime_force_resume(atxdmac->dev);
+- if (ret < 0)
++ ret = clk_prepare_enable(atxdmac->clk);
++ if (ret)
+ return ret;
+
++ pm_runtime_get_noresume(atxdmac->dev);
++
+ at_xdmac_axi_config(pdev);
+
+ /* Clear pending interrupts. */
+--
+2.39.2
+
--- /dev/null
+From 70c21fb8664b0cb49c5652127a00a1cae1d62a69 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Feb 2023 17:18:25 +0200
+Subject: dmaengine: at_xdmac: do not enable all cyclic channels
+
+From: Claudiu Beznea <claudiu.beznea@microchip.com>
+
+[ Upstream commit f8435befd81dd85b7b610598551fadf675849bc1 ]
+
+Do not global enable all the cyclic channels in at_xdmac_resume(). Instead
+save the global status in at_xdmac_suspend() and re-enable the cyclic
+channel only if it was active before suspend.
+
+Fixes: e1f7c9eee707 ("dmaengine: at_xdmac: creation of the atmel eXtended DMA Controller driver")
+Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Link: https://lore.kernel.org/r/20230214151827.1050280-6-claudiu.beznea@microchip.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/at_xdmac.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/dma/at_xdmac.c b/drivers/dma/at_xdmac.c
+index 34c004a4b23cb..96f1b69f8a75e 100644
+--- a/drivers/dma/at_xdmac.c
++++ b/drivers/dma/at_xdmac.c
+@@ -246,6 +246,7 @@ struct at_xdmac {
+ int irq;
+ struct clk *clk;
+ u32 save_gim;
++ u32 save_gs;
+ struct dma_pool *at_xdmac_desc_pool;
+ const struct at_xdmac_layout *layout;
+ struct at_xdmac_chan chan[];
+@@ -2162,6 +2163,7 @@ static int __maybe_unused atmel_xdmac_suspend(struct device *dev)
+ }
+ }
+ atxdmac->save_gim = at_xdmac_read(atxdmac, AT_XDMAC_GIM);
++ atxdmac->save_gs = at_xdmac_read(atxdmac, AT_XDMAC_GS);
+
+ at_xdmac_off(atxdmac, false);
+ pm_runtime_mark_last_busy(atxdmac->dev);
+@@ -2224,7 +2226,8 @@ static int __maybe_unused atmel_xdmac_resume(struct device *dev)
+ at_xdmac_chan_write(atchan, AT_XDMAC_CNDC, atchan->save_cndc);
+ at_xdmac_chan_write(atchan, AT_XDMAC_CIE, atchan->save_cim);
+ wmb();
+- at_xdmac_write(atxdmac, AT_XDMAC_GE, atchan->mask);
++ if (atxdmac->save_gs & atchan->mask)
++ at_xdmac_write(atxdmac, AT_XDMAC_GE, atchan->mask);
+ }
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 95378a52c2a4784d634426e32a66d13eb71f00ab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Feb 2023 17:18:23 +0200
+Subject: dmaengine: at_xdmac: do not resume channels paused by consumers
+
+From: Claudiu Beznea <claudiu.beznea@microchip.com>
+
+[ Upstream commit 44fe8440bda545b5d167329df88c47609a645168 ]
+
+In case there are DMA channels not paused by consumers in suspend
+process (valid on AT91 SoCs for serial driver when no_console_suspend) the
+driver pauses them (using at_xdmac_device_pause() which is also the same
+function called by dmaengine_pause()) and then in the resume process the
+driver resumes them calling at_xdmac_device_resume() which is the same
+function called by dmaengine_resume()). This is good for DMA channels
+not paused by consumers but for drivers that calls
+dmaengine_pause()/dmaegine_resume() on suspend/resume path this may lead to
+DMA channel being enabled before the IP is enabled. For IPs that needs
+strict ordering with regards to DMA channel enablement this will lead to
+wrong behavior. To fix this add a new set of functions
+at_xdmac_device_pause_internal()/at_xdmac_device_resume_internal() to be
+called only on suspend/resume.
+
+Fixes: e1f7c9eee707 ("dmaengine: at_xdmac: creation of the atmel eXtended DMA Controller driver")
+Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Link: https://lore.kernel.org/r/20230214151827.1050280-4-claudiu.beznea@microchip.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/at_xdmac.c | 52 ++++++++++++++++++++++++++++++++++++------
+ 1 file changed, 45 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/dma/at_xdmac.c b/drivers/dma/at_xdmac.c
+index af3b494f9ba9b..fa1e2e0da02f5 100644
+--- a/drivers/dma/at_xdmac.c
++++ b/drivers/dma/at_xdmac.c
+@@ -187,6 +187,7 @@
+ enum atc_status {
+ AT_XDMAC_CHAN_IS_CYCLIC = 0,
+ AT_XDMAC_CHAN_IS_PAUSED,
++ AT_XDMAC_CHAN_IS_PAUSED_INTERNAL,
+ };
+
+ struct at_xdmac_layout {
+@@ -347,6 +348,11 @@ static inline int at_xdmac_chan_is_paused(struct at_xdmac_chan *atchan)
+ return test_bit(AT_XDMAC_CHAN_IS_PAUSED, &atchan->status);
+ }
+
++static inline int at_xdmac_chan_is_paused_internal(struct at_xdmac_chan *atchan)
++{
++ return test_bit(AT_XDMAC_CHAN_IS_PAUSED_INTERNAL, &atchan->status);
++}
++
+ static inline bool at_xdmac_chan_is_peripheral_xfer(u32 cfg)
+ {
+ return cfg & AT_XDMAC_CC_TYPE_PER_TRAN;
+@@ -1898,6 +1904,26 @@ static int at_xdmac_device_config(struct dma_chan *chan,
+ return ret;
+ }
+
++static void at_xdmac_device_pause_set(struct at_xdmac *atxdmac,
++ struct at_xdmac_chan *atchan)
++{
++ at_xdmac_write(atxdmac, atxdmac->layout->grws, atchan->mask);
++ while (at_xdmac_chan_read(atchan, AT_XDMAC_CC) &
++ (AT_XDMAC_CC_WRIP | AT_XDMAC_CC_RDIP))
++ cpu_relax();
++}
++
++static void at_xdmac_device_pause_internal(struct at_xdmac_chan *atchan)
++{
++ struct at_xdmac *atxdmac = to_at_xdmac(atchan->chan.device);
++ unsigned long flags;
++
++ spin_lock_irqsave(&atchan->lock, flags);
++ set_bit(AT_XDMAC_CHAN_IS_PAUSED_INTERNAL, &atchan->status);
++ at_xdmac_device_pause_set(atxdmac, atchan);
++ spin_unlock_irqrestore(&atchan->lock, flags);
++}
++
+ static int at_xdmac_device_pause(struct dma_chan *chan)
+ {
+ struct at_xdmac_chan *atchan = to_at_xdmac_chan(chan);
+@@ -1915,11 +1941,8 @@ static int at_xdmac_device_pause(struct dma_chan *chan)
+ return ret;
+
+ spin_lock_irqsave(&atchan->lock, flags);
+- at_xdmac_write(atxdmac, atxdmac->layout->grws, atchan->mask);
+- while (at_xdmac_chan_read(atchan, AT_XDMAC_CC)
+- & (AT_XDMAC_CC_WRIP | AT_XDMAC_CC_RDIP))
+- cpu_relax();
+
++ at_xdmac_device_pause_set(atxdmac, atchan);
+ /* Decrement runtime PM ref counter for each active descriptor. */
+ at_xdmac_runtime_suspend_descriptors(atchan);
+
+@@ -1931,6 +1954,17 @@ static int at_xdmac_device_pause(struct dma_chan *chan)
+ return 0;
+ }
+
++static void at_xdmac_device_resume_internal(struct at_xdmac_chan *atchan)
++{
++ struct at_xdmac *atxdmac = to_at_xdmac(atchan->chan.device);
++ unsigned long flags;
++
++ spin_lock_irqsave(&atchan->lock, flags);
++ at_xdmac_write(atxdmac, atxdmac->layout->grwr, atchan->mask);
++ clear_bit(AT_XDMAC_CHAN_IS_PAUSED_INTERNAL, &atchan->status);
++ spin_unlock_irqrestore(&atchan->lock, flags);
++}
++
+ static int at_xdmac_device_resume(struct dma_chan *chan)
+ {
+ struct at_xdmac_chan *atchan = to_at_xdmac_chan(chan);
+@@ -2119,7 +2153,7 @@ static int __maybe_unused atmel_xdmac_suspend(struct device *dev)
+ atchan->save_cc = at_xdmac_chan_read(atchan, AT_XDMAC_CC);
+ if (at_xdmac_chan_is_cyclic(atchan)) {
+ if (!at_xdmac_chan_is_paused(atchan)) {
+- at_xdmac_device_pause(chan);
++ at_xdmac_device_pause_internal(atchan);
+ at_xdmac_runtime_suspend_descriptors(atchan);
+ }
+ atchan->save_cim = at_xdmac_chan_read(atchan, AT_XDMAC_CIM);
+@@ -2167,11 +2201,15 @@ static int __maybe_unused atmel_xdmac_resume(struct device *dev)
+
+ at_xdmac_chan_write(atchan, AT_XDMAC_CC, atchan->save_cc);
+ if (at_xdmac_chan_is_cyclic(atchan)) {
+- if (at_xdmac_chan_is_paused(atchan)) {
++ /*
++ * Resume only channels not explicitly paused by
++ * consumers.
++ */
++ if (at_xdmac_chan_is_paused_internal(atchan)) {
+ ret = at_xdmac_runtime_resume_descriptors(atchan);
+ if (ret < 0)
+ return ret;
+- at_xdmac_device_resume(chan);
++ at_xdmac_device_resume_internal(atchan);
+ }
+ at_xdmac_chan_write(atchan, AT_XDMAC_CNDA, atchan->save_cnda);
+ at_xdmac_chan_write(atchan, AT_XDMAC_CNDC, atchan->save_cndc);
+--
+2.39.2
+
--- /dev/null
+From 9e01b6de35dd0b370bb388a64d56f1f85dc15526 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Feb 2023 17:18:22 +0200
+Subject: dmaengine: at_xdmac: fix imbalanced runtime PM reference counter
+
+From: Claudiu Beznea <claudiu.beznea@microchip.com>
+
+[ Upstream commit e53957e1ec5196671e49a48f90a5c9555153189a ]
+
+In case there are channels not paused during suspend (which on AT91 case
+is valid for serial driver when no_console_suspend boot argument is used)
+the at_xdmac_runtime_suspend_descriptors() was called more than
+one time due to at_xdmac_off(). To fix this add a new argument to
+at_xdmac_off() to specify if runtime PM reference counter needs to be
+decremented for queued active descriptors. Along with it moved the
+at_xdmac_runtime_suspend_descriptors() call under at_xdmac_chan_is_paused()
+check on suspend path as for the rest of channels the suspend is delayed
+by atmel_xdmac_prepare() in case channel is enabled. Same approach has
+been applied on resume path.
+
+Fixes: 650b0e990cbd ("dmaengine: at_xdmac: add runtime pm support")
+Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Link: https://lore.kernel.org/r/20230214151827.1050280-3-claudiu.beznea@microchip.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/at_xdmac.c | 26 +++++++++++++-------------
+ 1 file changed, 13 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/dma/at_xdmac.c b/drivers/dma/at_xdmac.c
+index f654ecaafb906..af3b494f9ba9b 100644
+--- a/drivers/dma/at_xdmac.c
++++ b/drivers/dma/at_xdmac.c
+@@ -412,7 +412,7 @@ static bool at_xdmac_chan_is_enabled(struct at_xdmac_chan *atchan)
+ return ret;
+ }
+
+-static void at_xdmac_off(struct at_xdmac *atxdmac)
++static void at_xdmac_off(struct at_xdmac *atxdmac, bool suspend_descriptors)
+ {
+ struct dma_chan *chan, *_chan;
+ struct at_xdmac_chan *atchan;
+@@ -431,7 +431,7 @@ static void at_xdmac_off(struct at_xdmac *atxdmac)
+ at_xdmac_write(atxdmac, AT_XDMAC_GID, -1L);
+
+ /* Decrement runtime PM ref counter for each active descriptor. */
+- if (!list_empty(&atxdmac->dma.channels)) {
++ if (!list_empty(&atxdmac->dma.channels) && suspend_descriptors) {
+ list_for_each_entry_safe(chan, _chan, &atxdmac->dma.channels,
+ device_node) {
+ atchan = to_at_xdmac_chan(chan);
+@@ -2118,18 +2118,18 @@ static int __maybe_unused atmel_xdmac_suspend(struct device *dev)
+
+ atchan->save_cc = at_xdmac_chan_read(atchan, AT_XDMAC_CC);
+ if (at_xdmac_chan_is_cyclic(atchan)) {
+- if (!at_xdmac_chan_is_paused(atchan))
++ if (!at_xdmac_chan_is_paused(atchan)) {
+ at_xdmac_device_pause(chan);
++ at_xdmac_runtime_suspend_descriptors(atchan);
++ }
+ atchan->save_cim = at_xdmac_chan_read(atchan, AT_XDMAC_CIM);
+ atchan->save_cnda = at_xdmac_chan_read(atchan, AT_XDMAC_CNDA);
+ atchan->save_cndc = at_xdmac_chan_read(atchan, AT_XDMAC_CNDC);
+ }
+-
+- at_xdmac_runtime_suspend_descriptors(atchan);
+ }
+ atxdmac->save_gim = at_xdmac_read(atxdmac, AT_XDMAC_GIM);
+
+- at_xdmac_off(atxdmac);
++ at_xdmac_off(atxdmac, false);
+ pm_runtime_mark_last_busy(atxdmac->dev);
+ pm_runtime_put_noidle(atxdmac->dev);
+ clk_disable_unprepare(atxdmac->clk);
+@@ -2165,14 +2165,14 @@ static int __maybe_unused atmel_xdmac_resume(struct device *dev)
+ list_for_each_entry_safe(chan, _chan, &atxdmac->dma.channels, device_node) {
+ atchan = to_at_xdmac_chan(chan);
+
+- ret = at_xdmac_runtime_resume_descriptors(atchan);
+- if (ret < 0)
+- return ret;
+-
+ at_xdmac_chan_write(atchan, AT_XDMAC_CC, atchan->save_cc);
+ if (at_xdmac_chan_is_cyclic(atchan)) {
+- if (at_xdmac_chan_is_paused(atchan))
++ if (at_xdmac_chan_is_paused(atchan)) {
++ ret = at_xdmac_runtime_resume_descriptors(atchan);
++ if (ret < 0)
++ return ret;
+ at_xdmac_device_resume(chan);
++ }
+ at_xdmac_chan_write(atchan, AT_XDMAC_CNDA, atchan->save_cnda);
+ at_xdmac_chan_write(atchan, AT_XDMAC_CNDC, atchan->save_cndc);
+ at_xdmac_chan_write(atchan, AT_XDMAC_CIE, atchan->save_cim);
+@@ -2318,7 +2318,7 @@ static int at_xdmac_probe(struct platform_device *pdev)
+ INIT_LIST_HEAD(&atxdmac->dma.channels);
+
+ /* Disable all chans and interrupts. */
+- at_xdmac_off(atxdmac);
++ at_xdmac_off(atxdmac, true);
+
+ for (i = 0; i < nr_channels; i++) {
+ struct at_xdmac_chan *atchan = &atxdmac->chan[i];
+@@ -2382,7 +2382,7 @@ static int at_xdmac_remove(struct platform_device *pdev)
+ struct at_xdmac *atxdmac = (struct at_xdmac *)platform_get_drvdata(pdev);
+ int i;
+
+- at_xdmac_off(atxdmac);
++ at_xdmac_off(atxdmac, true);
+ of_dma_controller_free(pdev->dev.of_node);
+ dma_async_device_unregister(&atxdmac->dma);
+ pm_runtime_disable(atxdmac->dev);
+--
+2.39.2
+
--- /dev/null
+From b7b54126877b7202db945b204e992a8c7919a7a0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Feb 2023 17:18:24 +0200
+Subject: dmaengine: at_xdmac: restore the content of grws register
+
+From: Claudiu Beznea <claudiu.beznea@microchip.com>
+
+[ Upstream commit 7c5eb63d16b01c202aaa95f374ae15a807745a73 ]
+
+In case the system suspends to a deep sleep state where power to DMA
+controller is cut-off we need to restore the content of GRWS register.
+This is a write only register and writing bit X tells the controller
+to suspend read and write requests for channel X. Thus set GRWS before
+restoring the content of GE (Global Enable) regiter.
+
+Fixes: e1f7c9eee707 ("dmaengine: at_xdmac: creation of the atmel eXtended DMA Controller driver")
+Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Link: https://lore.kernel.org/r/20230214151827.1050280-5-claudiu.beznea@microchip.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/at_xdmac.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/dma/at_xdmac.c b/drivers/dma/at_xdmac.c
+index fa1e2e0da02f5..34c004a4b23cb 100644
+--- a/drivers/dma/at_xdmac.c
++++ b/drivers/dma/at_xdmac.c
+@@ -2211,6 +2211,15 @@ static int __maybe_unused atmel_xdmac_resume(struct device *dev)
+ return ret;
+ at_xdmac_device_resume_internal(atchan);
+ }
++
++ /*
++ * We may resume from a deep sleep state where power
++ * to DMA controller is cut-off. Thus, restore the
++ * suspend state of channels set though dmaengine API.
++ */
++ else if (at_xdmac_chan_is_paused(atchan))
++ at_xdmac_device_pause_set(atxdmac, atchan);
++
+ at_xdmac_chan_write(atchan, AT_XDMAC_CNDA, atchan->save_cnda);
+ at_xdmac_chan_write(atchan, AT_XDMAC_CNDC, atchan->save_cndc);
+ at_xdmac_chan_write(atchan, AT_XDMAC_CIE, atchan->save_cim);
+--
+2.39.2
+
--- /dev/null
+From 5eed66afe1639fffcc48cbb2164bda4a9c6d5a85 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Apr 2023 19:17:57 +0900
+Subject: dmaengine: dw-edma: Fix to change for continuous transfer
+
+From: Shunsuke Mie <mie@igel.co.jp>
+
+[ Upstream commit a251994a441ee0a69ba7062c8cd2d08ead3db379 ]
+
+The dw-edma driver stops after processing a DMA request even if a request
+remains in the issued queue, which is not the expected behavior. The DMA
+engine API requires continuous processing.
+
+Add a trigger to start after one processing finished if there are requests
+remain.
+
+Fixes: e63d79d1ffcd ("dmaengine: Add Synopsys eDMA IP core driver")
+Signed-off-by: Shunsuke Mie <mie@igel.co.jp>
+Link: https://lore.kernel.org/r/20230411101758.438472-1-mie@igel.co.jp
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/dw-edma/dw-edma-core.c | 20 +++++++++++---------
+ 1 file changed, 11 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/dma/dw-edma/dw-edma-core.c b/drivers/dma/dw-edma/dw-edma-core.c
+index 1906a836f0aab..26a395d02f5d3 100644
+--- a/drivers/dma/dw-edma/dw-edma-core.c
++++ b/drivers/dma/dw-edma/dw-edma-core.c
+@@ -181,7 +181,7 @@ static void vchan_free_desc(struct virt_dma_desc *vdesc)
+ dw_edma_free_desc(vd2dw_edma_desc(vdesc));
+ }
+
+-static void dw_edma_start_transfer(struct dw_edma_chan *chan)
++static int dw_edma_start_transfer(struct dw_edma_chan *chan)
+ {
+ struct dw_edma_chunk *child;
+ struct dw_edma_desc *desc;
+@@ -189,16 +189,16 @@ static void dw_edma_start_transfer(struct dw_edma_chan *chan)
+
+ vd = vchan_next_desc(&chan->vc);
+ if (!vd)
+- return;
++ return 0;
+
+ desc = vd2dw_edma_desc(vd);
+ if (!desc)
+- return;
++ return 0;
+
+ child = list_first_entry_or_null(&desc->chunk->list,
+ struct dw_edma_chunk, list);
+ if (!child)
+- return;
++ return 0;
+
+ dw_edma_v0_core_start(child, !desc->xfer_sz);
+ desc->xfer_sz += child->ll_region.sz;
+@@ -206,6 +206,8 @@ static void dw_edma_start_transfer(struct dw_edma_chan *chan)
+ list_del(&child->list);
+ kfree(child);
+ desc->chunks_alloc--;
++
++ return 1;
+ }
+
+ static void dw_edma_device_caps(struct dma_chan *dchan,
+@@ -602,14 +604,14 @@ static void dw_edma_done_interrupt(struct dw_edma_chan *chan)
+ switch (chan->request) {
+ case EDMA_REQ_NONE:
+ desc = vd2dw_edma_desc(vd);
+- if (desc->chunks_alloc) {
+- chan->status = EDMA_ST_BUSY;
+- dw_edma_start_transfer(chan);
+- } else {
++ if (!desc->chunks_alloc) {
+ list_del(&vd->node);
+ vchan_cookie_complete(vd);
+- chan->status = EDMA_ST_IDLE;
+ }
++
++ /* Continue transferring if there are remaining chunks or issued requests.
++ */
++ chan->status = dw_edma_start_transfer(chan) ? EDMA_ST_BUSY : EDMA_ST_IDLE;
+ break;
+
+ case EDMA_REQ_STOP:
+--
+2.39.2
+
--- /dev/null
+From 5f8368697bc8f05b20a51af8c65114d9456bc32a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Apr 2023 19:17:58 +0900
+Subject: dmaengine: dw-edma: Fix to enable to issue dma request on DMA
+ processing
+
+From: Shunsuke Mie <mie@igel.co.jp>
+
+[ Upstream commit 970b17dfe264a9085ba4e593730ecfd496b950ab ]
+
+The issue_pending request is ignored while driver is processing a DMA
+request. Fix to issue the pending requests on any dma channel status.
+
+Fixes: e63d79d1ffcd ("dmaengine: Add Synopsys eDMA IP core driver")
+Signed-off-by: Shunsuke Mie <mie@igel.co.jp>
+Link: https://lore.kernel.org/r/20230411101758.438472-2-mie@igel.co.jp
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/dw-edma/dw-edma-core.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/dma/dw-edma/dw-edma-core.c b/drivers/dma/dw-edma/dw-edma-core.c
+index 26a395d02f5d3..7d2b73ef08727 100644
+--- a/drivers/dma/dw-edma/dw-edma-core.c
++++ b/drivers/dma/dw-edma/dw-edma-core.c
+@@ -308,9 +308,12 @@ static void dw_edma_device_issue_pending(struct dma_chan *dchan)
+ struct dw_edma_chan *chan = dchan2dw_edma_chan(dchan);
+ unsigned long flags;
+
++ if (!chan->configured)
++ return;
++
+ spin_lock_irqsave(&chan->vc.lock, flags);
+- if (chan->configured && chan->request == EDMA_REQ_NONE &&
+- chan->status == EDMA_ST_IDLE && vchan_issue_pending(&chan->vc)) {
++ if (vchan_issue_pending(&chan->vc) && chan->request == EDMA_REQ_NONE &&
++ chan->status == EDMA_ST_IDLE) {
+ chan->status = EDMA_ST_BUSY;
+ dw_edma_start_transfer(chan);
+ }
+--
+2.39.2
+
--- /dev/null
+From 845f78ea71f24a56b9e85007d4dcc1ec3a2f2dbf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 26 Mar 2023 09:06:37 +0200
+Subject: dmaengine: mv_xor_v2: Fix an error code.
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 827026ae2e56ec05ef1155661079badbbfc0b038 ]
+
+If the probe is deferred, -EPROBE_DEFER should be returned, not
++EPROBE_DEFER.
+
+Fixes: 3cd2c313f1d6 ("dmaengine: mv_xor_v2: Fix clock resource by adding a register clock")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Link: https://lore.kernel.org/r/201170dff832a3c496d125772e10070cd834ebf2.1679814350.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/mv_xor_v2.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/dma/mv_xor_v2.c b/drivers/dma/mv_xor_v2.c
+index 89790beba3052..0991b82658296 100644
+--- a/drivers/dma/mv_xor_v2.c
++++ b/drivers/dma/mv_xor_v2.c
+@@ -752,7 +752,7 @@ static int mv_xor_v2_probe(struct platform_device *pdev)
+
+ xor_dev->clk = devm_clk_get(&pdev->dev, NULL);
+ if (PTR_ERR(xor_dev->clk) == -EPROBE_DEFER) {
+- ret = EPROBE_DEFER;
++ ret = -EPROBE_DEFER;
+ goto disable_reg_clk;
+ }
+ if (!IS_ERR(xor_dev->clk)) {
+--
+2.39.2
+
--- /dev/null
+From 8a145fc066c742226f3e0280a48609ab806d5fef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Feb 2023 15:53:23 +0100
+Subject: drivers: staging: rtl8723bs: Fix locking in
+ _rtw_join_timeout_handler()
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 215792eda008f6a1e7ed9d77fa20d582d22bb114 ]
+
+Commit 041879b12ddb ("drivers: staging: rtl8192bs: Fix deadlock in
+rtw_joinbss_event_prehandle()") besides fixing the deadlock also
+modified _rtw_join_timeout_handler() to use spin_[un]lock_irq()
+instead of spin_[un]lock_bh().
+
+_rtw_join_timeout_handler() calls rtw_do_join() which takes
+pmlmepriv->scanned_queue.lock using spin_[un]lock_bh(). This
+spin_unlock_bh() call re-enables softirqs which triggers an oops in
+kernel/softirq.c: __local_bh_enable_ip() when it calls
+lockdep_assert_irqs_enabled():
+
+[ 244.506087] WARNING: CPU: 2 PID: 0 at kernel/softirq.c:376 __local_bh_enable_ip+0xa6/0x100
+...
+[ 244.509022] Call Trace:
+[ 244.509048] <IRQ>
+[ 244.509100] _rtw_join_timeout_handler+0x134/0x170 [r8723bs]
+[ 244.509468] ? __pfx__rtw_join_timeout_handler+0x10/0x10 [r8723bs]
+[ 244.509772] ? __pfx__rtw_join_timeout_handler+0x10/0x10 [r8723bs]
+[ 244.510076] call_timer_fn+0x95/0x2a0
+[ 244.510200] __run_timers.part.0+0x1da/0x2d0
+
+This oops is causd by the switch to spin_[un]lock_irq() which disables
+the IRQs for the entire duration of _rtw_join_timeout_handler().
+
+Disabling the IRQs is not necessary since all code taking this lock
+runs from either user contexts or from softirqs, switch back to
+spin_[un]lock_bh() to fix this.
+
+Fixes: 041879b12ddb ("drivers: staging: rtl8192bs: Fix deadlock in rtw_joinbss_event_prehandle()")
+Cc: Duoming Zhou <duoming@zju.edu.cn>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/20230221145326.7808-1-hdegoede@redhat.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/rtl8723bs/core/rtw_mlme.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/staging/rtl8723bs/core/rtw_mlme.c b/drivers/staging/rtl8723bs/core/rtw_mlme.c
+index c6fd6cf741ef6..ea2a6566e51bf 100644
+--- a/drivers/staging/rtl8723bs/core/rtw_mlme.c
++++ b/drivers/staging/rtl8723bs/core/rtw_mlme.c
+@@ -1549,7 +1549,7 @@ void _rtw_join_timeout_handler(struct timer_list *t)
+ if (adapter->bDriverStopped || adapter->bSurpriseRemoved)
+ return;
+
+- spin_lock_irq(&pmlmepriv->lock);
++ spin_lock_bh(&pmlmepriv->lock);
+
+ if (rtw_to_roam(adapter) > 0) { /* join timeout caused by roaming */
+ while (1) {
+@@ -1577,7 +1577,7 @@ void _rtw_join_timeout_handler(struct timer_list *t)
+
+ }
+
+- spin_unlock_irq(&pmlmepriv->lock);
++ spin_unlock_bh(&pmlmepriv->lock);
+ }
+
+ /*
+--
+2.39.2
+
--- /dev/null
+From 59290cd9f7bb001e8a861bb340d05c3247170a5f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Feb 2023 15:53:24 +0100
+Subject: drivers: staging: rtl8723bs: Fix locking in
+ rtw_scan_timeout_handler()
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 3f467036093fedd7e231924327455fc609b5ef02 ]
+
+Commit cc7ad0d77b51 ("drivers: staging: rtl8723bs: Fix deadlock in
+rtw_surveydone_event_callback()") besides fixing the deadlock also
+modified rtw_scan_timeout_handler() to use spin_[un]lock_irq()
+instead of spin_[un]lock_bh().
+
+Disabling the IRQs is not necessary since all code taking this lock
+runs from either user contexts or from softirqs
+
+rtw_scan_timeout_handler() is the only function taking pmlmepriv->lock
+which uses spin_[un]lock_irq() for this. Switch back to
+spin_[un]lock_bh() to make it consistent with the rest of the code.
+
+Fixes: cc7ad0d77b51 ("drivers: staging: rtl8723bs: Fix deadlock in rtw_surveydone_event_callback()")
+Cc: Duoming Zhou <duoming@zju.edu.cn>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/20230221145326.7808-2-hdegoede@redhat.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/rtl8723bs/core/rtw_mlme.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/staging/rtl8723bs/core/rtw_mlme.c b/drivers/staging/rtl8723bs/core/rtw_mlme.c
+index ea2a6566e51bf..091842d70d486 100644
+--- a/drivers/staging/rtl8723bs/core/rtw_mlme.c
++++ b/drivers/staging/rtl8723bs/core/rtw_mlme.c
+@@ -1590,11 +1590,11 @@ void rtw_scan_timeout_handler(struct timer_list *t)
+ mlmepriv.scan_to_timer);
+ struct mlme_priv *pmlmepriv = &adapter->mlmepriv;
+
+- spin_lock_irq(&pmlmepriv->lock);
++ spin_lock_bh(&pmlmepriv->lock);
+
+ _clr_fwstate_(pmlmepriv, _FW_UNDER_SURVEY);
+
+- spin_unlock_irq(&pmlmepriv->lock);
++ spin_unlock_bh(&pmlmepriv->lock);
+
+ rtw_indicate_scan_done(adapter, true);
+ }
+--
+2.39.2
+
--- /dev/null
+From f56ed61c326bce793604199e31d539ed4477f5fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Mar 2023 08:17:16 +0000
+Subject: drm/amd/display/dc/dce60/Makefile: Fix previous attempt to silence
+ known override-init warnings
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Lee Jones <lee@kernel.org>
+
+[ Upstream commit 4082b9f5ead4966797dddcfef0905d59e5a83873 ]
+
+Fixes the following W=1 kernel build warning(s):
+
+ drivers/gpu/drm/amd/amdgpu/../display/dc/dce60/dce60_resource.c:157:21: note: in expansion of macro ‘mmCRTC1_DCFE_MEM_LIGHT_SLEEP_CNTL’
+ drivers/gpu/drm/amd/amdgpu/../display/dc/dce/dce_transform.h:170:9: note: in expansion of macro ‘SRI’
+ drivers/gpu/drm/amd/amdgpu/../display/dc/dce60/dce60_resource.c:183:17: note: in expansion of macro ‘XFM_COMMON_REG_LIST_DCE60’
+ drivers/gpu/drm/amd/amdgpu/../display/dc/dce60/dce60_resource.c:188:17: note: in expansion of macro ‘transform_regs’
+ drivers/gpu/drm/amd/amdgpu/../include/asic_reg/dce/dce_6_0_d.h:722:43: warning: initialized field overwritten [-Woverride-init]
+ drivers/gpu/drm/amd/amdgpu/../display/dc/dce60/dce60_resource.c:157:21: note: in expansion of macro ‘mmCRTC2_DCFE_MEM_LIGHT_SLEEP_CNTL’
+ drivers/gpu/drm/amd/amdgpu/../display/dc/dce/dce_transform.h:170:9: note: in expansion of macro ‘SRI’
+ drivers/gpu/drm/amd/amdgpu/../display/dc/dce60/dce60_resource.c:183:17: note: in expansion of macro ‘XFM_COMMON_REG_LIST_DCE60’
+ drivers/gpu/drm/amd/amdgpu/../display/dc/dce60/dce60_resource.c:189:17: note: in expansion of macro ‘transform_regs’
+ drivers/gpu/drm/amd/amdgpu/../include/asic_reg/dce/dce_6_0_d.h:722:43: note: (near initialization for ‘xfm_regs[2].DCFE_MEM_LIGHT_SLEEP_CN
+
+[100 lines snipped for brevity]
+
+Fixes: ceb3cf476a441 ("drm/amd/display/dc/dce60/Makefile: Ignore -Woverride-init warning")
+Cc: Harry Wentland <harry.wentland@amd.com>
+Cc: Leo Li <sunpeng.li@amd.com>
+Cc: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
+Cc: Alex Deucher <alexander.deucher@amd.com>
+Cc: "Christian König" <christian.koenig@amd.com>
+Cc: "Pan, Xinhui" <Xinhui.Pan@amd.com>
+Cc: David Airlie <airlied@gmail.com>
+Cc: Daniel Vetter <daniel@ffwll.ch>
+Cc: Mauro Rossi <issor.oruam@gmail.com>
+Cc: amd-gfx@lists.freedesktop.org
+Cc: dri-devel@lists.freedesktop.org
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dce60/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dce60/Makefile b/drivers/gpu/drm/amd/display/dc/dce60/Makefile
+index dda596fa1cd76..fee331accc0e7 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce60/Makefile
++++ b/drivers/gpu/drm/amd/display/dc/dce60/Makefile
+@@ -23,7 +23,7 @@
+ # Makefile for the 'controller' sub-component of DAL.
+ # It provides the control and status of HW CRTC block.
+
+-CFLAGS_AMDDALPATH)/dc/dce60/dce60_resource.o = $(call cc-disable-warning, override-init)
++CFLAGS_$(AMDDALPATH)/dc/dce60/dce60_resource.o = $(call cc-disable-warning, override-init)
+
+ DCE60 = dce60_timing_generator.o dce60_hw_sequencer.o \
+ dce60_resource.o
+--
+2.39.2
+
--- /dev/null
+From 9781749895ff6827f295587a8ec81d4568433be6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Apr 2023 16:10:37 +0300
+Subject: drm/amd/display: Fix potential null dereference
+
+From: Igor Artemiev <Igor.A.Artemiev@mcst.ru>
+
+[ Upstream commit 52f1783ff4146344342422c1cd94fcb4ce39b6fe ]
+
+The adev->dm.dc pointer can be NULL and dereferenced in amdgpu_dm_fini()
+without checking.
+
+Add a NULL pointer check before calling dc_dmub_srv_destroy().
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: 9a71c7d31734 ("drm/amd/display: Register DMUB service with DC")
+Signed-off-by: Igor Artemiev <Igor.A.Artemiev@mcst.ru>
+Signed-off-by: Hamza Mahfooz <hamza.mahfooz@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index a01fd41643fc2..62af874f26e01 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -1854,7 +1854,8 @@ static void amdgpu_dm_fini(struct amdgpu_device *adev)
+ dc_deinit_callbacks(adev->dm.dc);
+ #endif
+
+- dc_dmub_srv_destroy(&adev->dm.dc->ctx->dmub_srv);
++ if (adev->dm.dc)
++ dc_dmub_srv_destroy(&adev->dm.dc->ctx->dmub_srv);
+
+ if (dc_enable_dmub_notifications(adev->dm.dc)) {
+ kfree(adev->dm.dmub_notify);
+--
+2.39.2
+
--- /dev/null
+From 9957eeb85242b2bbe54c91b65cde3141b4f95c63 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Mar 2023 22:34:25 +1100
+Subject: drm/amdgpu: register a vga_switcheroo client for MacBooks with
+ apple-gmux
+
+From: Orlando Chamberlain <orlandoch.dev@gmail.com>
+
+[ Upstream commit d37a3929ca0363ed1dce02b2772cd5bc547ca66d ]
+
+Commit 3840c5bcc245 ("drm/amdgpu: disentangle runtime pm and
+vga_switcheroo") made amdgpu only register a vga_switcheroo client for
+GPU's with PX, however AMD GPUs in dual gpu Apple Macbooks do need to
+register, but don't have PX. Instead of AMD's PX, they use apple-gmux.
+
+Use apple_gmux_detect() to identify these gpus, and
+pci_is_thunderbolt_attached() to ensure eGPUs connected to Dual GPU
+Macbooks don't register with vga_switcheroo.
+
+Fixes: 3840c5bcc245 ("drm/amdgpu: disentangle runtime pm and vga_switcheroo")
+Link: https://lore.kernel.org/amd-gfx/20230210044826.9834-10-orlandoch.dev@gmail.com/
+Signed-off-by: Orlando Chamberlain <orlandoch.dev@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 21 ++++++++++++++++-----
+ 1 file changed, 16 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+index 3d98fc2ad36b0..6f715fb930bb4 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+@@ -35,6 +35,7 @@
+ #include <linux/devcoredump.h>
+ #include <generated/utsrelease.h>
+ #include <linux/pci-p2pdma.h>
++#include <linux/apple-gmux.h>
+
+ #include <drm/drm_aperture.h>
+ #include <drm/drm_atomic_helper.h>
+@@ -3945,12 +3946,15 @@ int amdgpu_device_init(struct amdgpu_device *adev,
+ if ((adev->pdev->class >> 8) == PCI_CLASS_DISPLAY_VGA)
+ vga_client_register(adev->pdev, amdgpu_device_vga_set_decode);
+
+- if (amdgpu_device_supports_px(ddev)) {
+- px = true;
++ px = amdgpu_device_supports_px(ddev);
++
++ if (px || (!pci_is_thunderbolt_attached(adev->pdev) &&
++ apple_gmux_detect(NULL, NULL)))
+ vga_switcheroo_register_client(adev->pdev,
+ &amdgpu_switcheroo_ops, px);
++
++ if (px)
+ vga_switcheroo_init_domain_pm_ops(adev->dev, &adev->vga_pm_domain);
+- }
+
+ if (adev->gmc.xgmi.pending_reset)
+ queue_delayed_work(system_wq, &mgpu_info.delayed_reset_work,
+@@ -4054,6 +4058,7 @@ void amdgpu_device_fini_hw(struct amdgpu_device *adev)
+ void amdgpu_device_fini_sw(struct amdgpu_device *adev)
+ {
+ int idx;
++ bool px;
+
+ amdgpu_fence_driver_sw_fini(adev);
+ amdgpu_device_ip_fini(adev);
+@@ -4072,10 +4077,16 @@ void amdgpu_device_fini_sw(struct amdgpu_device *adev)
+
+ kfree(adev->bios);
+ adev->bios = NULL;
+- if (amdgpu_device_supports_px(adev_to_drm(adev))) {
++
++ px = amdgpu_device_supports_px(adev_to_drm(adev));
++
++ if (px || (!pci_is_thunderbolt_attached(adev->pdev) &&
++ apple_gmux_detect(NULL, NULL)))
+ vga_switcheroo_unregister_client(adev->pdev);
++
++ if (px)
+ vga_switcheroo_fini_domain_pm_ops(adev->dev);
+- }
++
+ if ((adev->pdev->class >> 8) == PCI_CLASS_DISPLAY_VGA)
+ vga_client_unregister(adev->pdev);
+
+--
+2.39.2
+
--- /dev/null
+From e0e421c5cba724876f2d46790751eca14e5ffd07 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 19 Mar 2023 07:55:24 -0500
+Subject: drm/bridge: adv7533: Fix adv7533_mode_valid for adv7533 and adv7535
+
+From: Adam Ford <aford173@gmail.com>
+
+[ Upstream commit ee0285e13455fdbce5de315bdbe91b5f198a2a06 ]
+
+When dynamically switching lanes was removed, the intent of the code
+was to check to make sure that higher speed items used 4 lanes, but
+it had the unintended consequence of removing the slower speeds for
+4-lane users.
+
+This attempts to remedy this by doing a check to see that the
+max frequency doesn't exceed the chip limit, and a second
+check to make sure that the max bit-rate doesn't exceed the
+number of lanes * max bit rate / lane.
+
+Fixes: 9a0cdcd6649b ("drm/bridge: adv7533: remove dynamic lane switching from adv7533 bridge")
+Reviewed-by: Robert Foss <rfoss@kernel.org>
+Signed-off-by: Adam Ford <aford173@gmail.com>
+Signed-off-by: Robert Foss <rfoss@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230319125524.58803-1-aford173@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/adv7511/adv7533.c | 25 +++++++++++-------------
+ 1 file changed, 11 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/adv7511/adv7533.c b/drivers/gpu/drm/bridge/adv7511/adv7533.c
+index fdfeadcefe805..7e3e56441aedc 100644
+--- a/drivers/gpu/drm/bridge/adv7511/adv7533.c
++++ b/drivers/gpu/drm/bridge/adv7511/adv7533.c
+@@ -103,22 +103,19 @@ void adv7533_dsi_power_off(struct adv7511 *adv)
+ enum drm_mode_status adv7533_mode_valid(struct adv7511 *adv,
+ const struct drm_display_mode *mode)
+ {
+- int lanes;
++ unsigned long max_lane_freq;
+ struct mipi_dsi_device *dsi = adv->dsi;
++ u8 bpp = mipi_dsi_pixel_format_to_bpp(dsi->format);
+
+- if (mode->clock > 80000)
+- lanes = 4;
+- else
+- lanes = 3;
+-
+- /*
+- * TODO: add support for dynamic switching of lanes
+- * by using the bridge pre_enable() op . Till then filter
+- * out the modes which shall need different number of lanes
+- * than what was configured in the device tree.
+- */
+- if (lanes != dsi->lanes)
+- return MODE_BAD;
++ /* Check max clock for either 7533 or 7535 */
++ if (mode->clock > (adv->type == ADV7533 ? 80000 : 148500))
++ return MODE_CLOCK_HIGH;
++
++ /* Check max clock for each lane */
++ max_lane_freq = (adv->type == ADV7533 ? 800000 : 891000);
++
++ if (mode->clock * bpp > max_lane_freq * adv->num_dsi_lanes)
++ return MODE_CLOCK_HIGH;
+
+ return MODE_OK;
+ }
+--
+2.39.2
+
--- /dev/null
+From 06f453411bda9ffaf320d949b12aed4f82f3a006 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Feb 2023 12:09:05 -0800
+Subject: drm/i915/dg2: Drop one PCI ID
+
+From: Matt Roper <matthew.d.roper@intel.com>
+
+[ Upstream commit 3a38be31ec82920a871963c086393bc0ba26a655 ]
+
+The bspec was recently updated to remove PCI ID 0x5698; this ID is
+actually reserved for future use and should not be treated as DG2-G11.
+
+Bspec: 44477
+Fixes: 8618b8489ba6 ("drm/i915: DG2 and ATS-M device ID updates")
+Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
+Reviewed-by: Gustavo Sousa <gustavo.sousa@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230208200905.680865-1-matthew.d.roper@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/drm/i915_pciids.h | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/include/drm/i915_pciids.h b/include/drm/i915_pciids.h
+index 4a4c190f76984..8f648c32a9657 100644
+--- a/include/drm/i915_pciids.h
++++ b/include/drm/i915_pciids.h
+@@ -706,7 +706,6 @@
+ INTEL_VGA_DEVICE(0x5693, info), \
+ INTEL_VGA_DEVICE(0x5694, info), \
+ INTEL_VGA_DEVICE(0x5695, info), \
+- INTEL_VGA_DEVICE(0x5698, info), \
+ INTEL_VGA_DEVICE(0x56A5, info), \
+ INTEL_VGA_DEVICE(0x56A6, info), \
+ INTEL_VGA_DEVICE(0x56B0, info), \
+--
+2.39.2
+
--- /dev/null
+From 544039bfdbf1ee821abb3c051ab95cec2afb8163 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 15 Apr 2023 00:41:09 +0200
+Subject: drm/i915: Fix memory leaks in i915 selftests
+
+From: Cong Liu <liucong2@kylinos.cn>
+
+[ Upstream commit 803033c148f754f32da1b93926c49c22731ec485 ]
+
+This patch fixes memory leaks on error escapes in function fake_get_pages
+
+Fixes: c3bfba9a2225 ("drm/i915: Check for integer truncation on scatterlist creation")
+Signed-off-by: Cong Liu <liucong2@kylinos.cn>
+Reviewed-by: Andrzej Hajda <andrzej.hajda@intel.com>
+Reviewed-by: Andi Shyti <andi.shyti@linux.intel.com>
+Signed-off-by: Andi Shyti <andi.shyti@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230414224109.1051922-1-andi.shyti@linux.intel.com
+(cherry picked from commit 8bfbdadce85c4c51689da10f39c805a7106d4567)
+Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/selftests/i915_gem_gtt.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/i915/selftests/i915_gem_gtt.c b/drivers/gpu/drm/i915/selftests/i915_gem_gtt.c
+index 01e75160a84ab..22890acd47b78 100644
+--- a/drivers/gpu/drm/i915/selftests/i915_gem_gtt.c
++++ b/drivers/gpu/drm/i915/selftests/i915_gem_gtt.c
+@@ -69,8 +69,10 @@ static int fake_get_pages(struct drm_i915_gem_object *obj)
+
+ rem = round_up(obj->base.size, BIT(31)) >> 31;
+ /* restricted by sg_alloc_table */
+- if (overflows_type(rem, unsigned int))
++ if (overflows_type(rem, unsigned int)) {
++ kfree(pages);
+ return -E2BIG;
++ }
+
+ if (sg_alloc_table(pages, rem, GFP)) {
+ kfree(pages);
+--
+2.39.2
+
--- /dev/null
+From f36516792c773ce0628fa84dd144710682419f35 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Feb 2023 07:53:09 -0800
+Subject: drm/i915/hwmon: Enable PL1 power limit
+
+From: Ashutosh Dixit <ashutosh.dixit@intel.com>
+
+[ Upstream commit 0349c41b05968befaffa5fbb7e73d0ee6004f610 ]
+
+Previous documentation suggested that PL1 power limit is always
+enabled. However we now find this not to be the case on some
+platforms (such as ATSM). Therefore enable PL1 power limit during hwmon
+initialization.
+
+Bspec: 51864
+
+v2: Add Bspec reference (Gwan-gyeong)
+v3: Add Fixes tag
+
+Fixes: 99f55efb79114 ("drm/i915/hwmon: Power PL1 limit and TDP setting")
+Signed-off-by: Ashutosh Dixit <ashutosh.dixit@intel.com>
+Reviewed-by: Gwan-gyeong Mun <gwan-gyeong.mun@intel.com>
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230203155309.1042297-1-ashutosh.dixit@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/i915_hwmon.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/gpu/drm/i915/i915_hwmon.c b/drivers/gpu/drm/i915/i915_hwmon.c
+index 1225bc432f0d5..4683a5b96eff1 100644
+--- a/drivers/gpu/drm/i915/i915_hwmon.c
++++ b/drivers/gpu/drm/i915/i915_hwmon.c
+@@ -687,6 +687,11 @@ hwm_get_preregistration_info(struct drm_i915_private *i915)
+ for_each_gt(gt, i915, i)
+ hwm_energy(&hwmon->ddat_gt[i], &energy);
+ }
++
++ /* Enable PL1 power limit */
++ if (i915_mmio_reg_valid(hwmon->rg.pkg_rapl_limit))
++ hwm_locked_with_pm_intel_uncore_rmw(ddat, hwmon->rg.pkg_rapl_limit,
++ PKG_PWR_LIM_1_EN, PKG_PWR_LIM_1_EN);
+ }
+
+ void i915_hwmon_register(struct drm_i915_private *i915)
+--
+2.39.2
+
--- /dev/null
+From 9ffadefa8d86c0bc18041ef975367c57993d1ef3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Apr 2023 23:06:02 +0300
+Subject: drm/i915: Make intel_get_crtc_new_encoder() less oopsy
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ville Syrjälä <ville.syrjala@linux.intel.com>
+
+[ Upstream commit 631420b06597a33c72b6dcef78d1c2dea17f452d ]
+
+The point of the WARN was to print something, not oops
+straight up. Currently that is precisely what happens
+if we can't find the connector for the crtc in the atomic
+state. Get the dev pointer from the atomic state instead
+of the potentially NULL encoder to avoid that.
+
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230413200602.6037-2-ville.syrjala@linux.intel.com
+Fixes: 3a47ae201e07 ("drm/i915/display: Make WARN* drm specific where encoder ptr is available")
+Reviewed-by: Jani Nikula <jani.nikula@intel.com>
+(cherry picked from commit 3b6692357f70498f617ea1b31a0378070a0acf1c)
+Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/display/intel_display.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/i915/display/intel_display.c b/drivers/gpu/drm/i915/display/intel_display.c
+index 63b4b73f47c6a..2bef50ab0ad19 100644
+--- a/drivers/gpu/drm/i915/display/intel_display.c
++++ b/drivers/gpu/drm/i915/display/intel_display.c
+@@ -1053,7 +1053,7 @@ intel_get_crtc_new_encoder(const struct intel_atomic_state *state,
+ num_encoders++;
+ }
+
+- drm_WARN(encoder->base.dev, num_encoders != 1,
++ drm_WARN(state->base.dev, num_encoders != 1,
+ "%d encoders for pipe %c\n",
+ num_encoders, pipe_name(master_crtc->pipe));
+
+--
+2.39.2
+
--- /dev/null
+From b163849d99ac01fdcd7568eb1b7f9f62300c9216 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Jan 2023 00:26:35 -0800
+Subject: drm/i915/pxp: Invalidate all PXP fw sessions during teardown
+
+From: Alan Previn <alan.previn.teres.alexis@intel.com>
+
+[ Upstream commit d374c047b38e9f1130308aae207dc44045cd5cac ]
+
+A gap was recently discovered where if an application did not
+invalidate all of the stream keys (intentionally or not), and the
+driver did a full PXP global teardown on the GT subsystem, we
+find that future session creation would fail on the security
+firmware's side of the equation. i915 is the entity that needs
+ensure the sessions' state across both iGT and security firmware
+are at a known clean point when performing a full global teardown.
+
+Architecturally speaking, i915 should inspect all active sessions
+and submit the invalidate-stream-key PXP command to the security
+firmware for each of them. However, for the upstream i915 driver
+we only support the arbitration session that can be created
+so that will be the only session we will cleanup.
+
+Signed-off-by: Alan Previn <alan.previn.teres.alexis@intel.com>
+Reviewed-by: Juston Li <justonli@chromium.org>
+Acked-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230125082637.118970-5-alan.previn.teres.alexis@intel.com
+Stable-dep-of: 69e6dd149212 ("drm/i915/pxp: limit drm-errors or warning on firmware API failures")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/pxp/intel_pxp.h | 1 +
+ .../drm/i915/pxp/intel_pxp_cmd_interface_42.h | 15 ++++++++
+ .../i915/pxp/intel_pxp_cmd_interface_cmn.h | 3 ++
+ drivers/gpu/drm/i915/pxp/intel_pxp_session.c | 2 ++
+ drivers/gpu/drm/i915/pxp/intel_pxp_tee.c | 35 +++++++++++++++++++
+ 5 files changed, 56 insertions(+)
+
+diff --git a/drivers/gpu/drm/i915/pxp/intel_pxp.h b/drivers/gpu/drm/i915/pxp/intel_pxp.h
+index 04440fada711a..9658d30052224 100644
+--- a/drivers/gpu/drm/i915/pxp/intel_pxp.h
++++ b/drivers/gpu/drm/i915/pxp/intel_pxp.h
+@@ -24,6 +24,7 @@ void intel_pxp_init_hw(struct intel_pxp *pxp);
+ void intel_pxp_fini_hw(struct intel_pxp *pxp);
+
+ void intel_pxp_mark_termination_in_progress(struct intel_pxp *pxp);
++void intel_pxp_tee_end_arb_fw_session(struct intel_pxp *pxp, u32 arb_session_id);
+
+ int intel_pxp_start(struct intel_pxp *pxp);
+
+diff --git a/drivers/gpu/drm/i915/pxp/intel_pxp_cmd_interface_42.h b/drivers/gpu/drm/i915/pxp/intel_pxp_cmd_interface_42.h
+index 739f9072fa5fb..26f7d9f01bf3f 100644
+--- a/drivers/gpu/drm/i915/pxp/intel_pxp_cmd_interface_42.h
++++ b/drivers/gpu/drm/i915/pxp/intel_pxp_cmd_interface_42.h
+@@ -12,6 +12,9 @@
+ /* PXP-Opcode for Init Session */
+ #define PXP42_CMDID_INIT_SESSION 0x1e
+
++/* PXP-Opcode for Invalidate Stream Key */
++#define PXP42_CMDID_INVALIDATE_STREAM_KEY 0x00000007
++
+ /* PXP-Input-Packet: Init Session (Arb-Session) */
+ struct pxp42_create_arb_in {
+ struct pxp_cmd_header header;
+@@ -25,4 +28,16 @@ struct pxp42_create_arb_out {
+ struct pxp_cmd_header header;
+ } __packed;
+
++/* PXP-Input-Packet: Invalidate Stream Key */
++struct pxp42_inv_stream_key_in {
++ struct pxp_cmd_header header;
++ u32 rsvd[3];
++} __packed;
++
++/* PXP-Output-Packet: Invalidate Stream Key */
++struct pxp42_inv_stream_key_out {
++ struct pxp_cmd_header header;
++ u32 rsvd;
++} __packed;
++
+ #endif /* __INTEL_PXP_FW_INTERFACE_42_H__ */
+diff --git a/drivers/gpu/drm/i915/pxp/intel_pxp_cmd_interface_cmn.h b/drivers/gpu/drm/i915/pxp/intel_pxp_cmd_interface_cmn.h
+index aaa8187a0afbc..ae9b151b7cb77 100644
+--- a/drivers/gpu/drm/i915/pxp/intel_pxp_cmd_interface_cmn.h
++++ b/drivers/gpu/drm/i915/pxp/intel_pxp_cmd_interface_cmn.h
+@@ -28,6 +28,9 @@ struct pxp_cmd_header {
+ union {
+ u32 status; /* out */
+ u32 stream_id; /* in */
++#define PXP_CMDHDR_EXTDATA_SESSION_VALID GENMASK(0, 0)
++#define PXP_CMDHDR_EXTDATA_APP_TYPE GENMASK(1, 1)
++#define PXP_CMDHDR_EXTDATA_SESSION_ID GENMASK(17, 2)
+ };
+ /* Length of the message (excluding the header) */
+ u32 buffer_len;
+diff --git a/drivers/gpu/drm/i915/pxp/intel_pxp_session.c b/drivers/gpu/drm/i915/pxp/intel_pxp_session.c
+index ae413580b81ac..74ed7e16e4811 100644
+--- a/drivers/gpu/drm/i915/pxp/intel_pxp_session.c
++++ b/drivers/gpu/drm/i915/pxp/intel_pxp_session.c
+@@ -110,6 +110,8 @@ static int pxp_terminate_arb_session_and_global(struct intel_pxp *pxp)
+
+ intel_uncore_write(gt->uncore, PXP_GLOBAL_TERMINATE, 1);
+
++ intel_pxp_tee_end_arb_fw_session(pxp, ARB_SESSION);
++
+ return ret;
+ }
+
+diff --git a/drivers/gpu/drm/i915/pxp/intel_pxp_tee.c b/drivers/gpu/drm/i915/pxp/intel_pxp_tee.c
+index 73aa8015f828f..99bc8b1770162 100644
+--- a/drivers/gpu/drm/i915/pxp/intel_pxp_tee.c
++++ b/drivers/gpu/drm/i915/pxp/intel_pxp_tee.c
+@@ -308,3 +308,38 @@ int intel_pxp_tee_cmd_create_arb_session(struct intel_pxp *pxp,
+
+ return ret;
+ }
++
++void intel_pxp_tee_end_arb_fw_session(struct intel_pxp *pxp, u32 session_id)
++{
++ struct drm_i915_private *i915 = pxp->ctrl_gt->i915;
++ struct pxp42_inv_stream_key_in msg_in = {0};
++ struct pxp42_inv_stream_key_out msg_out = {0};
++ int ret, trials = 0;
++
++try_again:
++ memset(&msg_in, 0, sizeof(msg_in));
++ memset(&msg_out, 0, sizeof(msg_out));
++ msg_in.header.api_version = PXP_APIVER(4, 2);
++ msg_in.header.command_id = PXP42_CMDID_INVALIDATE_STREAM_KEY;
++ msg_in.header.buffer_len = sizeof(msg_in) - sizeof(msg_in.header);
++
++ msg_in.header.stream_id = FIELD_PREP(PXP_CMDHDR_EXTDATA_SESSION_VALID, 1);
++ msg_in.header.stream_id |= FIELD_PREP(PXP_CMDHDR_EXTDATA_APP_TYPE, 0);
++ msg_in.header.stream_id |= FIELD_PREP(PXP_CMDHDR_EXTDATA_SESSION_ID, session_id);
++
++ ret = intel_pxp_tee_io_message(pxp,
++ &msg_in, sizeof(msg_in),
++ &msg_out, sizeof(msg_out),
++ NULL);
++
++ /* Cleanup coherency between GT and Firmware is critical, so try again if it fails */
++ if ((ret || msg_out.header.status != 0x0) && ++trials < 3)
++ goto try_again;
++
++ if (ret)
++ drm_err(&i915->drm, "Failed to send tee msg for inv-stream-key-%d, ret=[%d]\n",
++ session_id, ret);
++ else if (msg_out.header.status != 0x0)
++ drm_warn(&i915->drm, "PXP firmware failed inv-stream-key-%d with status 0x%08x\n",
++ session_id, msg_out.header.status);
++}
+--
+2.39.2
+
--- /dev/null
+From fbd6bdf199fa6d0653c2edbeb44b3a466274b5d1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Mar 2023 11:41:56 -0700
+Subject: drm/i915/pxp: limit drm-errors or warning on firmware API failures
+
+From: Alan Previn <alan.previn.teres.alexis@intel.com>
+
+[ Upstream commit 69e6dd149212cdd681201352a79e6634665004e8 ]
+
+MESA driver is creating protected context on every driver handle
+creation to query caps bits for app. So when running CI tests,
+they are observing hundreds of drm_errors when enabling PXP
+in .config but using SOC fusing or BIOS configuration that cannot
+support PXP sessions.
+
+The fixes tag referenced below was to resolve a related issue
+where we wanted to silence error messages, but that case was due
+to outdated IFWI (firmware) that definitely needed an upgrade and
+was, at that point, considered a one-off case as opposed to today's
+realization that default CI was enabling PXP in kernel config for
+all testing.
+
+So with this patch, let's strike a balance between issues that is
+critical but are root-caused from HW/platform gaps (louder drm-warn
+but just ONCE) vs other cases where it could also come from session
+state machine (which cannot be a WARN_ONCE since it can be triggered
+due to runtime operation events).
+
+Let's use helpers for these so as more functions are added in future
+features / HW (or as FW designers continue to bless upstreaming of
+the error codes and meanings), we only need to update the helpers.
+
+NOTE: Don't completely remove FW errors (via drm_debug) or else cusomer
+apps that really needs to know that content protection failed won't
+be aware of it.
+
+v2: - Add fixes tag (Trvtko)
+v3: - Break multi-line drm_dbg strings into separate drm_dbg (Daniele)
+ - Fix couple of typecasting nits (Daniele)
+v4: - Unsuccessful PXP FW cmd due to platform configuration shouldn't
+ use drm_WARN_once (Tvrtko), Switched to use drm_info_once.
+v5: - Added "reported-and-tested" by Eero.
+
+Reported-and-tested-by: Eero Tamminen <eero.t.tamminen@intel.com>
+Fixes: b762787bf767 ("drm/i915/pxp: Use drm_dbg if arb session failed due to fw version")
+Signed-off-by: Alan Previn <alan.previn.teres.alexis@intel.com>
+Reviewed-by: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
+Signed-off-by: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230323184156.4140659-1-alan.previn.teres.alexis@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../i915/pxp/intel_pxp_cmd_interface_cmn.h | 3 +
+ drivers/gpu/drm/i915/pxp/intel_pxp_session.c | 2 +-
+ drivers/gpu/drm/i915/pxp/intel_pxp_tee.c | 77 +++++++++++++++----
+ 3 files changed, 67 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/pxp/intel_pxp_cmd_interface_cmn.h b/drivers/gpu/drm/i915/pxp/intel_pxp_cmd_interface_cmn.h
+index ae9b151b7cb77..6f6541d5e49a6 100644
+--- a/drivers/gpu/drm/i915/pxp/intel_pxp_cmd_interface_cmn.h
++++ b/drivers/gpu/drm/i915/pxp/intel_pxp_cmd_interface_cmn.h
+@@ -18,6 +18,9 @@
+ enum pxp_status {
+ PXP_STATUS_SUCCESS = 0x0,
+ PXP_STATUS_ERROR_API_VERSION = 0x1002,
++ PXP_STATUS_NOT_READY = 0x100e,
++ PXP_STATUS_PLATFCONFIG_KF1_NOVERIF = 0x101a,
++ PXP_STATUS_PLATFCONFIG_KF1_BAD = 0x101f,
+ PXP_STATUS_OP_NOT_PERMITTED = 0x4013
+ };
+
+diff --git a/drivers/gpu/drm/i915/pxp/intel_pxp_session.c b/drivers/gpu/drm/i915/pxp/intel_pxp_session.c
+index 74ed7e16e4811..48fa46091984b 100644
+--- a/drivers/gpu/drm/i915/pxp/intel_pxp_session.c
++++ b/drivers/gpu/drm/i915/pxp/intel_pxp_session.c
+@@ -74,7 +74,7 @@ static int pxp_create_arb_session(struct intel_pxp *pxp)
+
+ ret = pxp_wait_for_session_state(pxp, ARB_SESSION, true);
+ if (ret) {
+- drm_err(>->i915->drm, "arb session failed to go in play\n");
++ drm_dbg(>->i915->drm, "arb session failed to go in play\n");
+ return ret;
+ }
+ drm_dbg(>->i915->drm, "PXP ARB session is alive\n");
+diff --git a/drivers/gpu/drm/i915/pxp/intel_pxp_tee.c b/drivers/gpu/drm/i915/pxp/intel_pxp_tee.c
+index 99bc8b1770162..e9322ec1e0027 100644
+--- a/drivers/gpu/drm/i915/pxp/intel_pxp_tee.c
++++ b/drivers/gpu/drm/i915/pxp/intel_pxp_tee.c
+@@ -19,6 +19,37 @@
+ #include "intel_pxp_tee.h"
+ #include "intel_pxp_types.h"
+
++static bool
++is_fw_err_platform_config(u32 type)
++{
++ switch (type) {
++ case PXP_STATUS_ERROR_API_VERSION:
++ case PXP_STATUS_PLATFCONFIG_KF1_NOVERIF:
++ case PXP_STATUS_PLATFCONFIG_KF1_BAD:
++ return true;
++ default:
++ break;
++ }
++ return false;
++}
++
++static const char *
++fw_err_to_string(u32 type)
++{
++ switch (type) {
++ case PXP_STATUS_ERROR_API_VERSION:
++ return "ERR_API_VERSION";
++ case PXP_STATUS_NOT_READY:
++ return "ERR_NOT_READY";
++ case PXP_STATUS_PLATFCONFIG_KF1_NOVERIF:
++ case PXP_STATUS_PLATFCONFIG_KF1_BAD:
++ return "ERR_PLATFORM_CONFIG";
++ default:
++ break;
++ }
++ return NULL;
++}
++
+ static int intel_pxp_tee_io_message(struct intel_pxp *pxp,
+ void *msg_in, u32 msg_in_size,
+ void *msg_out, u32 msg_out_max_size,
+@@ -296,15 +327,22 @@ int intel_pxp_tee_cmd_create_arb_session(struct intel_pxp *pxp,
+ &msg_out, sizeof(msg_out),
+ NULL);
+
+- if (ret)
+- drm_err(&i915->drm, "Failed to send tee msg ret=[%d]\n", ret);
+- else if (msg_out.header.status == PXP_STATUS_ERROR_API_VERSION)
+- drm_dbg(&i915->drm, "PXP firmware version unsupported, requested: "
+- "CMD-ID-[0x%08x] on API-Ver-[0x%08x]\n",
+- msg_in.header.command_id, msg_in.header.api_version);
+- else if (msg_out.header.status != 0x0)
+- drm_warn(&i915->drm, "PXP firmware failed arb session init request ret=[0x%08x]\n",
+- msg_out.header.status);
++ if (ret) {
++ drm_err(&i915->drm, "Failed to send tee msg init arb session, ret=[%d]\n", ret);
++ } else if (msg_out.header.status != 0) {
++ if (is_fw_err_platform_config(msg_out.header.status)) {
++ drm_info_once(&i915->drm,
++ "PXP init-arb-session-%d failed due to BIOS/SOC:0x%08x:%s\n",
++ arb_session_id, msg_out.header.status,
++ fw_err_to_string(msg_out.header.status));
++ } else {
++ drm_dbg(&i915->drm, "PXP init-arb-session--%d failed 0x%08x:%st:\n",
++ arb_session_id, msg_out.header.status,
++ fw_err_to_string(msg_out.header.status));
++ drm_dbg(&i915->drm, " cmd-detail: ID=[0x%08x],API-Ver-[0x%08x]\n",
++ msg_in.header.command_id, msg_in.header.api_version);
++ }
++ }
+
+ return ret;
+ }
+@@ -336,10 +374,21 @@ void intel_pxp_tee_end_arb_fw_session(struct intel_pxp *pxp, u32 session_id)
+ if ((ret || msg_out.header.status != 0x0) && ++trials < 3)
+ goto try_again;
+
+- if (ret)
+- drm_err(&i915->drm, "Failed to send tee msg for inv-stream-key-%d, ret=[%d]\n",
++ if (ret) {
++ drm_err(&i915->drm, "Failed to send tee msg for inv-stream-key-%u, ret=[%d]\n",
+ session_id, ret);
+- else if (msg_out.header.status != 0x0)
+- drm_warn(&i915->drm, "PXP firmware failed inv-stream-key-%d with status 0x%08x\n",
+- session_id, msg_out.header.status);
++ } else if (msg_out.header.status != 0) {
++ if (is_fw_err_platform_config(msg_out.header.status)) {
++ drm_info_once(&i915->drm,
++ "PXP inv-stream-key-%u failed due to BIOS/SOC :0x%08x:%s\n",
++ session_id, msg_out.header.status,
++ fw_err_to_string(msg_out.header.status));
++ } else {
++ drm_dbg(&i915->drm, "PXP inv-stream-key-%u failed 0x%08x:%s:\n",
++ session_id, msg_out.header.status,
++ fw_err_to_string(msg_out.header.status));
++ drm_dbg(&i915->drm, " cmd-detail: ID=[0x%08x],API-Ver-[0x%08x]\n",
++ msg_in.header.command_id, msg_in.header.api_version);
++ }
++ }
+ }
+--
+2.39.2
+
--- /dev/null
+From fb68047a5f5e099c011ea92b01ae8115be26d46c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Mar 2023 22:27:11 -0700
+Subject: drm/lima/lima_drv: Add missing unwind goto in lima_pdev_probe()
+
+From: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
+
+[ Upstream commit c5647cae2704e58d1c4e5fedbf63f11bca6376c9 ]
+
+Smatch reports:
+drivers/gpu/drm/lima/lima_drv.c:396 lima_pdev_probe() warn:
+ missing unwind goto?
+
+Store return value in err and goto 'err_out0' which has
+lima_sched_slab_fini() before returning.
+
+Fixes: a1d2a6339961 ("drm/lima: driver for ARM Mali4xx GPUs")
+Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
+Signed-off-by: Qiang Yu <yuq825@gmail.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230314052711.4061652-1-harshit.m.mogalapalli@oracle.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/lima/lima_drv.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/lima/lima_drv.c b/drivers/gpu/drm/lima/lima_drv.c
+index 7b8d7178d09aa..39cab4a55f572 100644
+--- a/drivers/gpu/drm/lima/lima_drv.c
++++ b/drivers/gpu/drm/lima/lima_drv.c
+@@ -392,8 +392,10 @@ static int lima_pdev_probe(struct platform_device *pdev)
+
+ /* Allocate and initialize the DRM device. */
+ ddev = drm_dev_alloc(&lima_drm_driver, &pdev->dev);
+- if (IS_ERR(ddev))
+- return PTR_ERR(ddev);
++ if (IS_ERR(ddev)) {
++ err = PTR_ERR(ddev);
++ goto err_out0;
++ }
+
+ ddev->dev_private = ldev;
+ ldev->ddev = ddev;
+--
+2.39.2
+
--- /dev/null
+From 1e305e633aeb3fb51accb32d0732487a9ec1bd8b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Mar 2023 14:43:23 +0800
+Subject: drm/mediatek: dp: Change the aux retries times when receiving
+ AUX_DEFER
+
+From: Xinlei Lee <xinlei.lee@mediatek.com>
+
+[ Upstream commit 9243d70e05c5989f84f840612965f96b524da925 ]
+
+DP 1.4a Section 2.8.7.1.5.6.1:
+A DP Source device shall retry at least seven times upon receiving
+AUX_DEFER before giving up the AUX transaction.
+
+The drm_dp_i2c_do_msg() function in the drm_dp_helper.c file will
+judge the status of the msg->reply parameter passed to aux_transfer
+for different processing.
+
+Fixes: f70ac097a2cf ("drm/mediatek: Add MT8195 Embedded DisplayPort driver")
+Signed-off-by: Xinlei Lee <xinlei.lee@mediatek.com>
+Link: https://patchwork.kernel.org/project/linux-mediatek/patch/1680072203-10394-1-git-send-email-xinlei.lee@mediatek.com/
+Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/mediatek/mtk_dp.c | 12 +++++-------
+ 1 file changed, 5 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/gpu/drm/mediatek/mtk_dp.c b/drivers/gpu/drm/mediatek/mtk_dp.c
+index a82f53e1a1462..64eee77452c04 100644
+--- a/drivers/gpu/drm/mediatek/mtk_dp.c
++++ b/drivers/gpu/drm/mediatek/mtk_dp.c
+@@ -806,10 +806,9 @@ static int mtk_dp_aux_wait_for_completion(struct mtk_dp *mtk_dp, bool is_read)
+ }
+
+ static int mtk_dp_aux_do_transfer(struct mtk_dp *mtk_dp, bool is_read, u8 cmd,
+- u32 addr, u8 *buf, size_t length)
++ u32 addr, u8 *buf, size_t length, u8 *reply_cmd)
+ {
+ int ret;
+- u32 reply_cmd;
+
+ if (is_read && (length > DP_AUX_MAX_PAYLOAD_BYTES ||
+ (cmd == DP_AUX_NATIVE_READ && !length)))
+@@ -841,10 +840,10 @@ static int mtk_dp_aux_do_transfer(struct mtk_dp *mtk_dp, bool is_read, u8 cmd,
+ /* Wait for feedback from sink device. */
+ ret = mtk_dp_aux_wait_for_completion(mtk_dp, is_read);
+
+- reply_cmd = mtk_dp_read(mtk_dp, MTK_DP_AUX_P0_3624) &
+- AUX_RX_REPLY_COMMAND_AUX_TX_P0_MASK;
++ *reply_cmd = mtk_dp_read(mtk_dp, MTK_DP_AUX_P0_3624) &
++ AUX_RX_REPLY_COMMAND_AUX_TX_P0_MASK;
+
+- if (ret || reply_cmd) {
++ if (ret) {
+ u32 phy_status = mtk_dp_read(mtk_dp, MTK_DP_AUX_P0_3628) &
+ AUX_RX_PHY_STATE_AUX_TX_P0_MASK;
+ if (phy_status != AUX_RX_PHY_STATE_AUX_TX_P0_RX_IDLE) {
+@@ -2071,7 +2070,7 @@ static ssize_t mtk_dp_aux_transfer(struct drm_dp_aux *mtk_aux,
+ ret = mtk_dp_aux_do_transfer(mtk_dp, is_read, request,
+ msg->address + accessed_bytes,
+ msg->buffer + accessed_bytes,
+- to_access);
++ to_access, &msg->reply);
+
+ if (ret) {
+ drm_info(mtk_dp->drm_dev,
+@@ -2081,7 +2080,6 @@ static ssize_t mtk_dp_aux_transfer(struct drm_dp_aux *mtk_aux,
+ accessed_bytes += to_access;
+ } while (accessed_bytes < msg->size);
+
+- msg->reply = DP_AUX_NATIVE_REPLY_ACK | DP_AUX_I2C_REPLY_ACK;
+ return msg->size;
+ err:
+ msg->reply = DP_AUX_NATIVE_REPLY_NACK | DP_AUX_I2C_REPLY_NACK;
+--
+2.39.2
+
--- /dev/null
+From 20ef565e7a1a2c1f598bc8ef4d13dd4b14ef656c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Feb 2023 12:57:34 +0800
+Subject: drm/mediatek: dp: Only trigger DRM HPD events if bridge is attached
+
+From: Chen-Yu Tsai <wenst@chromium.org>
+
+[ Upstream commit 36b617f7e4ae663fcadd202ea061ca695ca75539 ]
+
+The MediaTek DisplayPort interface bridge driver starts its interrupts
+as soon as its probed. However when the interrupts trigger the bridge
+might not have been attached to a DRM device. As drm_helper_hpd_irq_event()
+does not check whether the passed in drm_device is valid or not, a NULL
+pointer passed in results in a kernel NULL pointer dereference in it.
+
+Check whether the bridge is attached and only trigger an HPD event if
+it is.
+
+Fixes: f70ac097a2cf ("drm/mediatek: Add MT8195 Embedded DisplayPort driver")
+Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
+Reviewed-by: Guillaume Ranquet <granquet@baylibre.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Reviewed-by: Matthias Brugger <matthias.bgg@gmail.com>
+Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20230202045734.2773503-1-wenst@chromium.org/
+Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/mediatek/mtk_dp.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/mediatek/mtk_dp.c b/drivers/gpu/drm/mediatek/mtk_dp.c
+index 1f94fcc144d3a..a82f53e1a1462 100644
+--- a/drivers/gpu/drm/mediatek/mtk_dp.c
++++ b/drivers/gpu/drm/mediatek/mtk_dp.c
+@@ -1823,7 +1823,8 @@ static irqreturn_t mtk_dp_hpd_event_thread(int hpd, void *dev)
+ spin_unlock_irqrestore(&mtk_dp->irq_thread_lock, flags);
+
+ if (status & MTK_DP_THREAD_CABLE_STATE_CHG) {
+- drm_helper_hpd_irq_event(mtk_dp->bridge.dev);
++ if (mtk_dp->bridge.dev)
++ drm_helper_hpd_irq_event(mtk_dp->bridge.dev);
+
+ if (!mtk_dp->train_info.cable_plugged_in) {
+ mtk_dp_disable_sdp_aui(mtk_dp);
+--
+2.39.2
+
--- /dev/null
+From 76572a5c8472d87c47264e4cfafe915108f0e9bd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Mar 2023 23:17:17 +0100
+Subject: drm: msm: adreno: Disable preemption on Adreno 510
+
+From: Adam Skladowski <a39.skl@gmail.com>
+
+[ Upstream commit 010c8bbad2cb8c33c47963e29f051f1e917e45a5 ]
+
+Downstream driver appears to not support preemption on A510 target,
+trying to use one make device slow and fill log with rings related errors.
+Set num_rings to 1 to disable preemption.
+
+Suggested-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Fixes: e20c9284c8f2 ("drm/msm/adreno: Add support for Adreno 510 GPU")
+Signed-off-by: Adam Skladowski <a39.skl@gmail.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Patchwork: https://patchwork.freedesktop.org/patch/526898/
+Link: https://lore.kernel.org/r/20230314221757.13096-1-a39.skl@gmail.com
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/adreno/a5xx_gpu.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/adreno/a5xx_gpu.c b/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
+index a1e006ec5dcec..0372f89082022 100644
+--- a/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
++++ b/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
+@@ -1743,6 +1743,7 @@ struct msm_gpu *a5xx_gpu_init(struct drm_device *dev)
+ struct a5xx_gpu *a5xx_gpu = NULL;
+ struct adreno_gpu *adreno_gpu;
+ struct msm_gpu *gpu;
++ unsigned int nr_rings;
+ int ret;
+
+ if (!pdev) {
+@@ -1763,7 +1764,12 @@ struct msm_gpu *a5xx_gpu_init(struct drm_device *dev)
+
+ check_speed_bin(&pdev->dev);
+
+- ret = adreno_gpu_init(dev, pdev, adreno_gpu, &funcs, 4);
++ nr_rings = 4;
++
++ if (adreno_is_a510(adreno_gpu))
++ nr_rings = 1;
++
++ ret = adreno_gpu_init(dev, pdev, adreno_gpu, &funcs, nr_rings);
+ if (ret) {
+ a5xx_destroy(&(a5xx_gpu->base.base));
+ return ERR_PTR(ret);
+--
+2.39.2
+
--- /dev/null
+From bf4a14a22b78e98ee1ce375f67559678f0a45ae8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Mar 2023 17:48:06 +0100
+Subject: drm/msm/adreno: drop bogus pm_runtime_set_active()
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+[ Upstream commit db7662d076c973072d788bd0e8130e04430307a1 ]
+
+The runtime PM status can only be updated while runtime PM is disabled.
+
+Drop the bogus pm_runtime_set_active() call that was made after enabling
+runtime PM and which (incidentally but correctly) left the runtime PM
+status set to 'suspended'.
+
+Fixes: 2c087a336676 ("drm/msm/adreno: Load the firmware before bringing up the hardware")
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Patchwork: https://patchwork.freedesktop.org/patch/524972/
+Link: https://lore.kernel.org/r/20230303164807.13124-4-johan+linaro@kernel.org
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/adreno/adreno_device.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/adreno/adreno_device.c b/drivers/gpu/drm/msm/adreno/adreno_device.c
+index c5c4c93b3689c..cd009d56d35d5 100644
+--- a/drivers/gpu/drm/msm/adreno/adreno_device.c
++++ b/drivers/gpu/drm/msm/adreno/adreno_device.c
+@@ -438,9 +438,6 @@ struct msm_gpu *adreno_load_gpu(struct drm_device *dev)
+ */
+ pm_runtime_enable(&pdev->dev);
+
+- /* Make sure pm runtime is active and reset any previous errors */
+- pm_runtime_set_active(&pdev->dev);
+-
+ ret = pm_runtime_get_sync(&pdev->dev);
+ if (ret < 0) {
+ pm_runtime_put_sync(&pdev->dev);
+--
+2.39.2
+
--- /dev/null
+From 20a8c4bc66953efe461e20657fd219ddad1dae68 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Mar 2023 22:03:07 +0530
+Subject: drm/msm/disp/dpu: check for crtc enable rather than crtc active to
+ release shared resources
+
+From: Vinod Polimera <quic_vpolimer@quicinc.com>
+
+[ Upstream commit b6975693846b562c4d3e0e60cc884affc5bdac00 ]
+
+According to KMS documentation, The driver must not release any shared
+resources if active is set to false but enable still true.
+
+Fixes: ccc862b957c6 ("drm/msm/dpu: Fix reservation failures in modeset")
+Signed-off-by: Vinod Polimera <quic_vpolimer@quicinc.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Patchwork: https://patchwork.freedesktop.org/patch/524726/
+Link: https://lore.kernel.org/r/1677774797-31063-5-git-send-email-quic_vpolimer@quicinc.com
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c
+index 758261e8ac739..c237003670137 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c
+@@ -652,7 +652,7 @@ static int dpu_encoder_virt_atomic_check(
+ if (drm_atomic_crtc_needs_modeset(crtc_state)) {
+ dpu_rm_release(global_state, drm_enc);
+
+- if (!crtc_state->active_changed || crtc_state->active)
++ if (!crtc_state->active_changed || crtc_state->enable)
+ ret = dpu_rm_reserve(&dpu_kms->rm, global_state,
+ drm_enc, crtc_state, topology);
+ }
+--
+2.39.2
+
--- /dev/null
+From 7a8a0a37c7fa2c6e1f0363a64bc5270946e06d2e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Mar 2023 10:06:33 +0100
+Subject: drm/msm/dpu: Fix bit-shifting UB in DPU_HW_VER() macro
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 4760be481dc075cd13f95f4650f5d5b53b4b336d ]
+
+With gcc-5 and CONFIG_UBSAN_SHIFT=y:
+
+ drivers/gpu/drm/msm/msm_mdss.c: In function 'msm_mdss_enable':
+ drivers/gpu/drm/msm/msm_mdss.c:296:2: error: case label does not reduce to an integer constant
+ case DPU_HW_VER_800:
+ ^
+ drivers/gpu/drm/msm/msm_mdss.c:299:2: error: case label does not reduce to an integer constant
+ case DPU_HW_VER_810:
+ ^
+ drivers/gpu/drm/msm/msm_mdss.c:300:2: error: case label does not reduce to an integer constant
+ case DPU_HW_VER_900:
+ ^
+
+This happens because for major revisions 8 or greather, the non-sign bit
+of the major revision number is shifted into bit 31 of a signed integer,
+which is undefined behavior.
+
+Fix this by casting the major revision number to unsigned int.
+
+Fixes: efcd0107727c4f04 ("drm/msm/dpu: add support for SM8550")
+Fixes: 4a352c2fc15aec1e ("drm/msm/dpu: Introduce SC8280XP")
+Fixes: 100d7ef6995d1f86 ("drm/msm/dpu: add support for SM8450")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Randy Dunlap <rdunlap@infradead.org>
+Reviewed-by: Rob Clark <robdclark@gmail.com>
+Patchwork: https://patchwork.freedesktop.org/patch/525152/
+Link: https://lore.kernel.org/r/20230306090633.65918-1-geert+renesas@glider.be
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h
+index e6590302b3bfc..2c5bafacd609c 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h
+@@ -19,8 +19,9 @@
+ */
+ #define MAX_BLOCKS 12
+
+-#define DPU_HW_VER(MAJOR, MINOR, STEP) (((MAJOR & 0xF) << 28) |\
+- ((MINOR & 0xFFF) << 16) |\
++#define DPU_HW_VER(MAJOR, MINOR, STEP) \
++ ((((unsigned int)MAJOR & 0xF) << 28) | \
++ ((MINOR & 0xFFF) << 16) | \
+ (STEP & 0xFFFF))
+
+ #define DPU_HW_MAJOR(rev) ((rev) >> 28)
+--
+2.39.2
+
--- /dev/null
+From f12a1431e78b473125d3648613da080fe8e95d6e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 15 Apr 2023 13:00:30 +0200
+Subject: drm/panel: novatek-nt35950: Improve error handling
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit 5dd45b66742a1f3cfa9a92dc0ac8714c7708ee6c ]
+
+In a very peculiar case when probing and registering with the secondary
+DSI host succeeds, but the OF backlight or DSI attachment fails, the
+primary DSI device is automatically cleaned up, but the secondary one
+is not, leading to -EEXIST when the driver core tries to handle
+-EPROBE_DEFER.
+
+Unregister the DSI1 device manually on failure to prevent that.
+
+Fixes: 623a3531e9cf ("drm/panel: Add driver for Novatek NT35950 DSI DriverIC panels")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230415-konrad-longbois-next-v1-1-ce695dc9df84@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panel/panel-novatek-nt35950.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/panel/panel-novatek-nt35950.c b/drivers/gpu/drm/panel/panel-novatek-nt35950.c
+index abf752b36a523..7498fc6258bb0 100644
+--- a/drivers/gpu/drm/panel/panel-novatek-nt35950.c
++++ b/drivers/gpu/drm/panel/panel-novatek-nt35950.c
+@@ -585,8 +585,11 @@ static int nt35950_probe(struct mipi_dsi_device *dsi)
+ DRM_MODE_CONNECTOR_DSI);
+
+ ret = drm_panel_of_backlight(&nt->panel);
+- if (ret)
++ if (ret) {
++ mipi_dsi_device_unregister(nt->dsi[1]);
++
+ return dev_err_probe(dev, ret, "Failed to get backlight\n");
++ }
+
+ drm_panel_add(&nt->panel);
+
+@@ -602,6 +605,9 @@ static int nt35950_probe(struct mipi_dsi_device *dsi)
+
+ ret = mipi_dsi_attach(nt->dsi[i]);
+ if (ret < 0) {
++ /* If we fail to attach to either host, we're done */
++ mipi_dsi_device_unregister(nt->dsi[1]);
++
+ return dev_err_probe(dev, ret,
+ "Cannot attach to DSI%d host.\n", i);
+ }
+--
+2.39.2
+
--- /dev/null
+From 9e6e16834fec4f8a7dae45f6410a9ce92427d6f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Apr 2023 17:41:08 +0200
+Subject: drm/panel: novatek-nt35950: Only unregister DSI1 if it exists
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit a50be876f4fe2349dc8b056a49d87f69c944570f ]
+
+Commit 5dd45b66742a ("drm/panel: novatek-nt35950: Improve error handling")
+introduced logic to unregister DSI1 on any sort of probe failure, as
+that's not done automatically by kernel APIs.
+
+It did not however account for cases where only one DSI host is used.
+Fix that.
+
+Fixes: 5dd45b66742a ("drm/panel: novatek-nt35950: Improve error handling")
+Reported-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230417-topic-maple_panel_fixup-v1-1-07c8db606f5e@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panel/panel-novatek-nt35950.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/panel/panel-novatek-nt35950.c b/drivers/gpu/drm/panel/panel-novatek-nt35950.c
+index 7498fc6258bb0..8b108ac80b556 100644
+--- a/drivers/gpu/drm/panel/panel-novatek-nt35950.c
++++ b/drivers/gpu/drm/panel/panel-novatek-nt35950.c
+@@ -586,7 +586,8 @@ static int nt35950_probe(struct mipi_dsi_device *dsi)
+
+ ret = drm_panel_of_backlight(&nt->panel);
+ if (ret) {
+- mipi_dsi_device_unregister(nt->dsi[1]);
++ if (num_dsis == 2)
++ mipi_dsi_device_unregister(nt->dsi[1]);
+
+ return dev_err_probe(dev, ret, "Failed to get backlight\n");
+ }
+@@ -606,7 +607,8 @@ static int nt35950_probe(struct mipi_dsi_device *dsi)
+ ret = mipi_dsi_attach(nt->dsi[i]);
+ if (ret < 0) {
+ /* If we fail to attach to either host, we're done */
+- mipi_dsi_device_unregister(nt->dsi[1]);
++ if (num_dsis == 2)
++ mipi_dsi_device_unregister(nt->dsi[1]);
+
+ return dev_err_probe(dev, ret,
+ "Cannot attach to DSI%d host.\n", i);
+--
+2.39.2
+
--- /dev/null
+From 0b89759fbf7157f8fd173e64dab382bb17de5e88 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Jan 2023 16:40:52 +0100
+Subject: drm/probe-helper: Cancel previous job before starting new one
+
+From: Dom Cobley <popcornmix@gmail.com>
+
+[ Upstream commit a8e47884f1906cd7440fafa056adc8817568e73e ]
+
+Currently we schedule a call to output_poll_execute from
+drm_kms_helper_poll_enable for 10s in future. Later we try to replace
+that in drm_helper_probe_single_connector_modes with a 0s schedule with
+delayed_event set.
+
+But as there is already a job in the queue this fails, and the immediate
+job we wanted with delayed_event set doesn't occur until 10s later.
+
+And that call acts as if connector state has changed, reprobing modes.
+This has a side effect of waking up a display that has been blanked.
+
+Make sure we cancel the old job before submitting the immediate one.
+
+Fixes: 162b6a57ac50 ("drm/probe-helper: don't lose hotplug event")
+Acked-by: Daniel Vetter <daniel@ffwll.ch>
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+[Maxime: Switched to mod_delayed_work]
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230127154052.452524-1-maxime@cerno.tech
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_probe_helper.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_probe_helper.c b/drivers/gpu/drm/drm_probe_helper.c
+index 8127be134c39e..2fb9bf901a2cc 100644
+--- a/drivers/gpu/drm/drm_probe_helper.c
++++ b/drivers/gpu/drm/drm_probe_helper.c
+@@ -590,8 +590,9 @@ int drm_helper_probe_single_connector_modes(struct drm_connector *connector,
+ */
+ dev->mode_config.delayed_event = true;
+ if (dev->mode_config.poll_enabled)
+- schedule_delayed_work(&dev->mode_config.output_poll_work,
+- 0);
++ mod_delayed_work(system_wq,
++ &dev->mode_config.output_poll_work,
++ 0);
+ }
+
+ /* Re-enable polling in case the global poll config changed. */
+--
+2.39.2
+
--- /dev/null
+From 0daf61907281eeee28e1232cb81c7e6099d6cf54 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Feb 2023 13:06:59 +0300
+Subject: drm: rcar-du: Fix a NULL vs IS_ERR() bug
+
+From: Dan Carpenter <error27@gmail.com>
+
+[ Upstream commit 40f43730f43699ce8557e4fe59622d4f4b69f44a ]
+
+The drmm_encoder_alloc() function returns error pointers. It never
+returns NULL. Fix the check accordingly.
+
+Fixes: 7a1adbd23990 ("drm: rcar-du: Use drmm_encoder_alloc() to manage encoder")
+Signed-off-by: Dan Carpenter <error27@gmail.com>
+Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/rcar-du/rcar_du_encoder.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/rcar-du/rcar_du_encoder.c b/drivers/gpu/drm/rcar-du/rcar_du_encoder.c
+index b1787be31e92c..7ecec7b04a8d0 100644
+--- a/drivers/gpu/drm/rcar-du/rcar_du_encoder.c
++++ b/drivers/gpu/drm/rcar-du/rcar_du_encoder.c
+@@ -109,8 +109,8 @@ int rcar_du_encoder_init(struct rcar_du_device *rcdu,
+ renc = drmm_encoder_alloc(&rcdu->ddev, struct rcar_du_encoder, base,
+ &rcar_du_encoder_funcs, DRM_MODE_ENCODER_NONE,
+ NULL);
+- if (!renc)
+- return -ENOMEM;
++ if (IS_ERR(renc))
++ return PTR_ERR(renc);
+
+ renc->output = output;
+
+--
+2.39.2
+
--- /dev/null
+From e0d3d0f71f2140ea80997caa92358935e871a686 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Jan 2023 15:17:34 -0800
+Subject: drm/rockchip: Drop unbalanced obj unref
+
+From: Rob Clark <robdclark@chromium.org>
+
+[ Upstream commit 8ee3b0e85f6ccd9e6c527bc50eaba774c3bb18d0 ]
+
+In the error path, rockchip_drm_gem_object_mmap() is dropping an obj
+reference that it doesn't own.
+
+Fixes: 41315b793e13 ("drm/rockchip: use drm_gem_mmap helpers")
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230119231734.2884543-1-robdclark@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/rockchip/rockchip_drm_gem.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_gem.c b/drivers/gpu/drm/rockchip/rockchip_drm_gem.c
+index 8ea09d915c3ca..6c0800083aad8 100644
+--- a/drivers/gpu/drm/rockchip/rockchip_drm_gem.c
++++ b/drivers/gpu/drm/rockchip/rockchip_drm_gem.c
+@@ -261,9 +261,6 @@ static int rockchip_drm_gem_object_mmap(struct drm_gem_object *obj,
+ else
+ ret = rockchip_drm_gem_object_mmap_dma(obj, vma);
+
+- if (ret)
+- drm_gem_vm_close(vma);
+-
+ return ret;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From ca898ff0245485cd37da8f7cc0b970a722d05029 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Apr 2023 22:06:48 +0200
+Subject: drm/ttm/pool: Fix ttm_pool_alloc error path
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Hellström <thomas.hellstrom@linux.intel.com>
+
+[ Upstream commit 379989e7cbdc7aa7496a00ee286ec146c7599cf0 ]
+
+When hitting an error, the error path forgot to unmap dma mappings and
+could call set_pages_wb() on already uncached pages.
+
+Fix this by introducing a common ttm_pool_free_range() function that
+does the right thing.
+
+v2:
+- Simplify that common function (Christian König)
+v3:
+- Rename that common function to ttm_pool_free_range() (Christian König)
+
+Fixes: d099fc8f540a ("drm/ttm: new TT backend allocation pool v3")
+Cc: Christian König <christian.koenig@amd.com>
+Cc: Dave Airlie <airlied@redhat.com>
+Cc: Christian Koenig <christian.koenig@amd.com>
+Cc: Huang Rui <ray.huang@amd.com>
+Cc: dri-devel@lists.freedesktop.org
+Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230404200650.11043-2-thomas.hellstrom@linux.intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/ttm/ttm_pool.c | 81 +++++++++++++++++++++-------------
+ 1 file changed, 51 insertions(+), 30 deletions(-)
+
+diff --git a/drivers/gpu/drm/ttm/ttm_pool.c b/drivers/gpu/drm/ttm/ttm_pool.c
+index aa116a7bbae3a..dfce896c4baeb 100644
+--- a/drivers/gpu/drm/ttm/ttm_pool.c
++++ b/drivers/gpu/drm/ttm/ttm_pool.c
+@@ -367,6 +367,43 @@ static int ttm_pool_page_allocated(struct ttm_pool *pool, unsigned int order,
+ return 0;
+ }
+
++/**
++ * ttm_pool_free_range() - Free a range of TTM pages
++ * @pool: The pool used for allocating.
++ * @tt: The struct ttm_tt holding the page pointers.
++ * @caching: The page caching mode used by the range.
++ * @start_page: index for first page to free.
++ * @end_page: index for last page to free + 1.
++ *
++ * During allocation the ttm_tt page-vector may be populated with ranges of
++ * pages with different attributes if allocation hit an error without being
++ * able to completely fulfill the allocation. This function can be used
++ * to free these individual ranges.
++ */
++static void ttm_pool_free_range(struct ttm_pool *pool, struct ttm_tt *tt,
++ enum ttm_caching caching,
++ pgoff_t start_page, pgoff_t end_page)
++{
++ struct page **pages = tt->pages;
++ unsigned int order;
++ pgoff_t i, nr;
++
++ for (i = start_page; i < end_page; i += nr, pages += nr) {
++ struct ttm_pool_type *pt = NULL;
++
++ order = ttm_pool_page_order(pool, *pages);
++ nr = (1UL << order);
++ if (tt->dma_address)
++ ttm_pool_unmap(pool, tt->dma_address[i], nr);
++
++ pt = ttm_pool_select_type(pool, caching, order);
++ if (pt)
++ ttm_pool_type_give(pt, *pages);
++ else
++ ttm_pool_free_page(pool, caching, order, *pages);
++ }
++}
++
+ /**
+ * ttm_pool_alloc - Fill a ttm_tt object
+ *
+@@ -382,12 +419,14 @@ static int ttm_pool_page_allocated(struct ttm_pool *pool, unsigned int order,
+ int ttm_pool_alloc(struct ttm_pool *pool, struct ttm_tt *tt,
+ struct ttm_operation_ctx *ctx)
+ {
+- unsigned long num_pages = tt->num_pages;
++ pgoff_t num_pages = tt->num_pages;
+ dma_addr_t *dma_addr = tt->dma_address;
+ struct page **caching = tt->pages;
+ struct page **pages = tt->pages;
++ enum ttm_caching page_caching;
+ gfp_t gfp_flags = GFP_USER;
+- unsigned int i, order;
++ pgoff_t caching_divide;
++ unsigned int order;
+ struct page *p;
+ int r;
+
+@@ -410,6 +449,7 @@ int ttm_pool_alloc(struct ttm_pool *pool, struct ttm_tt *tt,
+ order = min_t(unsigned int, order, __fls(num_pages))) {
+ struct ttm_pool_type *pt;
+
++ page_caching = tt->caching;
+ pt = ttm_pool_select_type(pool, tt->caching, order);
+ p = pt ? ttm_pool_type_take(pt) : NULL;
+ if (p) {
+@@ -418,6 +458,7 @@ int ttm_pool_alloc(struct ttm_pool *pool, struct ttm_tt *tt,
+ if (r)
+ goto error_free_page;
+
++ caching = pages;
+ do {
+ r = ttm_pool_page_allocated(pool, order, p,
+ &dma_addr,
+@@ -426,14 +467,15 @@ int ttm_pool_alloc(struct ttm_pool *pool, struct ttm_tt *tt,
+ if (r)
+ goto error_free_page;
+
++ caching = pages;
+ if (num_pages < (1 << order))
+ break;
+
+ p = ttm_pool_type_take(pt);
+ } while (p);
+- caching = pages;
+ }
+
++ page_caching = ttm_cached;
+ while (num_pages >= (1 << order) &&
+ (p = ttm_pool_alloc_page(pool, gfp_flags, order))) {
+
+@@ -442,6 +484,7 @@ int ttm_pool_alloc(struct ttm_pool *pool, struct ttm_tt *tt,
+ tt->caching);
+ if (r)
+ goto error_free_page;
++ caching = pages;
+ }
+ r = ttm_pool_page_allocated(pool, order, p, &dma_addr,
+ &num_pages, &pages);
+@@ -468,15 +511,13 @@ int ttm_pool_alloc(struct ttm_pool *pool, struct ttm_tt *tt,
+ return 0;
+
+ error_free_page:
+- ttm_pool_free_page(pool, tt->caching, order, p);
++ ttm_pool_free_page(pool, page_caching, order, p);
+
+ error_free_all:
+ num_pages = tt->num_pages - num_pages;
+- for (i = 0; i < num_pages; ) {
+- order = ttm_pool_page_order(pool, tt->pages[i]);
+- ttm_pool_free_page(pool, tt->caching, order, tt->pages[i]);
+- i += 1 << order;
+- }
++ caching_divide = caching - tt->pages;
++ ttm_pool_free_range(pool, tt, tt->caching, 0, caching_divide);
++ ttm_pool_free_range(pool, tt, ttm_cached, caching_divide, num_pages);
+
+ return r;
+ }
+@@ -492,27 +533,7 @@ EXPORT_SYMBOL(ttm_pool_alloc);
+ */
+ void ttm_pool_free(struct ttm_pool *pool, struct ttm_tt *tt)
+ {
+- unsigned int i;
+-
+- for (i = 0; i < tt->num_pages; ) {
+- struct page *p = tt->pages[i];
+- unsigned int order, num_pages;
+- struct ttm_pool_type *pt;
+-
+- order = ttm_pool_page_order(pool, p);
+- num_pages = 1ULL << order;
+- if (tt->dma_address)
+- ttm_pool_unmap(pool, tt->dma_address[i], num_pages);
+-
+- pt = ttm_pool_select_type(pool, tt->caching, order);
+- if (pt)
+- ttm_pool_type_give(pt, tt->pages[i]);
+- else
+- ttm_pool_free_page(pool, tt->caching, order,
+- tt->pages[i]);
+-
+- i += num_pages;
+- }
++ ttm_pool_free_range(pool, tt, tt->caching, 0, tt->num_pages);
+
+ while (atomic_long_read(&allocated_pages) > page_pool_size)
+ ttm_pool_shrink();
+--
+2.39.2
+
--- /dev/null
+From 25313e8235d5858d8d41f6de85fd52dd7871a7ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Feb 2023 09:55:17 -0300
+Subject: drm/vgem: add missing mutex_destroy
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Maíra Canal <mcanal@igalia.com>
+
+[ Upstream commit 7c18189b14b33c1fbf76480b1bd217877c086e67 ]
+
+vgem_fence_open() instantiates a mutex for a particular fence
+instance, but never destroys it by calling mutex_destroy() in
+vgem_fence_close().
+
+So, add the missing mutex_destroy() to guarantee proper resource
+destruction.
+
+Fixes: 407779848445 ("drm/vgem: Attach sw fences to exported vGEM dma-buf (ioctl)")
+Signed-off-by: Maíra Canal <mcanal@igalia.com>
+Reviewed-by: Stanislaw Gruszka <stanislaw.gruszka@linux.intel.com>
+Signed-off-by: Maíra Canal <mairacanal@riseup.net>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230202125517.427976-1-mcanal@igalia.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vgem/vgem_fence.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/vgem/vgem_fence.c b/drivers/gpu/drm/vgem/vgem_fence.c
+index c2a879734d407..e157541783959 100644
+--- a/drivers/gpu/drm/vgem/vgem_fence.c
++++ b/drivers/gpu/drm/vgem/vgem_fence.c
+@@ -249,4 +249,5 @@ void vgem_fence_close(struct vgem_file *vfile)
+ {
+ idr_for_each(&vfile->fence_idr, __vgem_fence_idr_fini, vfile);
+ idr_destroy(&vfile->fence_idr);
++ mutex_destroy(&vfile->fence_mutex);
+ }
+--
+2.39.2
+
--- /dev/null
+From 140f6f3e1dda409a1ed7be03ff53ad0be62e3ea3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Mar 2023 16:57:12 +0100
+Subject: dt-bindings: serial: snps-dw-apb-uart: correct number of DMAs
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit dedd376e0c7096daf4171d54957a679b4dfeadbf ]
+
+The "minItems" alone does not impose any upper limit of DMAs, so switch
+it to "maxItems" which also implies same value for minItems.
+
+Fixes: 370f696e4474 ("dt-bindings: serial: snps-dw-apb-uart: add dma & dma-names properties")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: Conor Dooley <conor.dooley@microchip.com>
+Acked-by: Rob Herring <robh@kernel.org>
+Link: https://lore.kernel.org/r/20230317155712.99654-1-krzysztof.kozlowski@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/devicetree/bindings/serial/snps-dw-apb-uart.yaml | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Documentation/devicetree/bindings/serial/snps-dw-apb-uart.yaml b/Documentation/devicetree/bindings/serial/snps-dw-apb-uart.yaml
+index 2becdfab4f155..8212a9f483b51 100644
+--- a/Documentation/devicetree/bindings/serial/snps-dw-apb-uart.yaml
++++ b/Documentation/devicetree/bindings/serial/snps-dw-apb-uart.yaml
+@@ -68,7 +68,7 @@ properties:
+ - const: apb_pclk
+
+ dmas:
+- minItems: 2
++ maxItems: 2
+
+ dma-names:
+ items:
+--
+2.39.2
+
--- /dev/null
+From 202be872caf87e2c5d897575cd0d198a1f059904 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 11 Feb 2023 09:17:28 +0800
+Subject: EDAC/skx: Fix overflows on the DRAM row address mapping arrays
+
+From: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
+
+[ Upstream commit 71b1e3ba3fed5a34c5fac6d3a15c2634b04c1eb7 ]
+
+The current DRAM row address mapping arrays skx_{open,close}_row[]
+only support ranks with sizes up to 16G. Decoding a rank address
+to a DRAM row address for a 32G rank by using either one of the
+above arrays by the skx_edac driver, will result in an overflow on
+the array.
+
+For a 32G rank, the most significant DRAM row address bit (the
+bit17) is mapped from the bit34 of the rank address. Add this new
+mapping item to both arrays to fix the overflow issue.
+
+Fixes: 4ec656bdf43a ("EDAC, skx_edac: Add EDAC driver for Skylake")
+Reported-by: Feng Xu <feng.f.xu@intel.com>
+Tested-by: Feng Xu <feng.f.xu@intel.com>
+Signed-off-by: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
+Signed-off-by: Tony Luck <tony.luck@intel.com>
+Link: https://lore.kernel.org/all/20230211011728.71764-1-qiuxu.zhuo@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/edac/skx_base.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/edac/skx_base.c b/drivers/edac/skx_base.c
+index 9397abb42c498..0a862336a7ce8 100644
+--- a/drivers/edac/skx_base.c
++++ b/drivers/edac/skx_base.c
+@@ -510,7 +510,7 @@ static bool skx_rir_decode(struct decoded_addr *res)
+ }
+
+ static u8 skx_close_row[] = {
+- 15, 16, 17, 18, 20, 21, 22, 28, 10, 11, 12, 13, 29, 30, 31, 32, 33
++ 15, 16, 17, 18, 20, 21, 22, 28, 10, 11, 12, 13, 29, 30, 31, 32, 33, 34
+ };
+
+ static u8 skx_close_column[] = {
+@@ -518,7 +518,7 @@ static u8 skx_close_column[] = {
+ };
+
+ static u8 skx_open_row[] = {
+- 14, 15, 16, 20, 28, 21, 22, 23, 24, 25, 26, 27, 29, 30, 31, 32, 33
++ 14, 15, 16, 20, 28, 21, 22, 23, 24, 25, 26, 27, 29, 30, 31, 32, 33, 34
+ };
+
+ static u8 skx_open_column[] = {
+--
+2.39.2
+
--- /dev/null
+From 3f67f07ca2cba32ddcf8dc17ec6c081d6e430d6d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Apr 2023 14:18:10 +0800
+Subject: erofs: fix potential overflow calculating xattr_isize
+
+From: Jingbo Xu <jefflexu@linux.alibaba.com>
+
+[ Upstream commit 1b3567a1969b26f709d82a874498c0754ea841c3 ]
+
+Given on-disk i_xattr_icount is 16 bits and xattr_isize is calculated
+from i_xattr_icount multiplying 4, xattr_isize has a theoretical maximum
+of 256K (64K * 4).
+
+Thus declare xattr_isize as unsigned int to avoid the potential overflow.
+
+Fixes: bfb8674dc044 ("staging: erofs: add erofs in-memory stuffs")
+Signed-off-by: Jingbo Xu <jefflexu@linux.alibaba.com>
+Reviewed-by: Gao Xiang <hsiangkao@linux.alibaba.com>
+Reviewed-by: Chao Yu <chao@kernel.org>
+Link: https://lore.kernel.org/r/20230414061810.6479-1-jefflexu@linux.alibaba.com
+Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/erofs/internal.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/erofs/internal.h b/fs/erofs/internal.h
+index 42444b593cf16..9ebb87e342dcb 100644
+--- a/fs/erofs/internal.h
++++ b/fs/erofs/internal.h
+@@ -307,7 +307,7 @@ struct erofs_inode {
+
+ unsigned char datalayout;
+ unsigned char inode_isize;
+- unsigned short xattr_isize;
++ unsigned int xattr_isize;
+
+ unsigned int xattr_shared_count;
+ unsigned int *xattr_shared_xattrs;
+--
+2.39.2
+
--- /dev/null
+From f10795808f778accde031d35f2c32d7233c1accd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Apr 2023 22:17:05 +0800
+Subject: erofs: initialize packed inode after root inode is assigned
+
+From: Jingbo Xu <jefflexu@linux.alibaba.com>
+
+[ Upstream commit cb9bce79514392a9a216ff67148e05e2d72c28bd ]
+
+As commit 8f7acdae2cd4 ("staging: erofs: kill all failure handling in
+fill_super()"), move the initialization of packed inode after root
+inode is assigned, so that the iput() in .put_super() is adequate as
+the failure handling.
+
+Otherwise, iput() is also needed in .kill_sb(), in case of the mounting
+fails halfway.
+
+Signed-off-by: Jingbo Xu <jefflexu@linux.alibaba.com>
+Reviewed-by: Yue Hu <huyue2@coolpad.com>
+Fixes: b15b2e307c3a ("erofs: support on-disk compressed fragments data")
+Reviewed-by: Gao Xiang <hsiangkao@linux.alibaba.com>
+Acked-by: Chao Yu <chao@kernel.org>
+Link: https://lore.kernel.org/r/20230407141710.113882-3-jefflexu@linux.alibaba.com
+Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/erofs/internal.h | 1 +
+ fs/erofs/super.c | 22 +++++++++++-----------
+ 2 files changed, 12 insertions(+), 11 deletions(-)
+
+diff --git a/fs/erofs/internal.h b/fs/erofs/internal.h
+index 1db018f8c2e89..42444b593cf16 100644
+--- a/fs/erofs/internal.h
++++ b/fs/erofs/internal.h
+@@ -156,6 +156,7 @@ struct erofs_sb_info {
+
+ /* what we really care is nid, rather than ino.. */
+ erofs_nid_t root_nid;
++ erofs_nid_t packed_nid;
+ /* used for statfs, f_files - f_favail */
+ u64 inos;
+
+diff --git a/fs/erofs/super.c b/fs/erofs/super.c
+index 19b1ae79cec41..dbe466295d0e0 100644
+--- a/fs/erofs/super.c
++++ b/fs/erofs/super.c
+@@ -380,17 +380,7 @@ static int erofs_read_superblock(struct super_block *sb)
+ #endif
+ sbi->islotbits = ilog2(sizeof(struct erofs_inode_compact));
+ sbi->root_nid = le16_to_cpu(dsb->root_nid);
+-#ifdef CONFIG_EROFS_FS_ZIP
+- sbi->packed_inode = NULL;
+- if (erofs_sb_has_fragments(sbi) && dsb->packed_nid) {
+- sbi->packed_inode =
+- erofs_iget(sb, le64_to_cpu(dsb->packed_nid));
+- if (IS_ERR(sbi->packed_inode)) {
+- ret = PTR_ERR(sbi->packed_inode);
+- goto out;
+- }
+- }
+-#endif
++ sbi->packed_nid = le64_to_cpu(dsb->packed_nid);
+ sbi->inos = le64_to_cpu(dsb->inos);
+
+ sbi->build_time = le64_to_cpu(dsb->build_time);
+@@ -799,6 +789,16 @@ static int erofs_fc_fill_super(struct super_block *sb, struct fs_context *fc)
+
+ erofs_shrinker_register(sb);
+ /* sb->s_umount is already locked, SB_ACTIVE and SB_BORN are not set */
++#ifdef CONFIG_EROFS_FS_ZIP
++ if (erofs_sb_has_fragments(sbi) && sbi->packed_nid) {
++ sbi->packed_inode = erofs_iget(sb, sbi->packed_nid);
++ if (IS_ERR(sbi->packed_inode)) {
++ err = PTR_ERR(sbi->packed_inode);
++ sbi->packed_inode = NULL;
++ return err;
++ }
++ }
++#endif
+ err = erofs_init_managed_cache(sb);
+ if (err)
+ return err;
+--
+2.39.2
+
--- /dev/null
+From 9a9575c8a50c5f7ebc8ccbb9feba26e297334694 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Apr 2023 01:37:14 +0800
+Subject: erofs: stop parsing non-compact HEAD index if clusterofs is invalid
+
+From: Gao Xiang <hsiangkao@linux.alibaba.com>
+
+[ Upstream commit cc4efd3dd2ac9f89143e5d881609747ecff04164 ]
+
+Syzbot generated a crafted image [1] with a non-compact HEAD index of
+clusterofs 33024 while valid numbers should be 0 ~ lclustersize-1,
+which causes the following unexpected behavior as below:
+
+ BUG: unable to handle page fault for address: fffff52101a3fff9
+ #PF: supervisor read access in kernel mode
+ #PF: error_code(0x0000) - not-present page
+ PGD 23ffed067 P4D 23ffed067 PUD 0
+ Oops: 0000 [#1] PREEMPT SMP KASAN
+ CPU: 1 PID: 4398 Comm: kworker/u5:1 Not tainted 6.3.0-rc6-syzkaller-g09a9639e56c0 #0
+ Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023
+ Workqueue: erofs_worker z_erofs_decompressqueue_work
+ RIP: 0010:z_erofs_decompress_queue+0xb7e/0x2b40
+ ...
+ Call Trace:
+ <TASK>
+ z_erofs_decompressqueue_work+0x99/0xe0
+ process_one_work+0x8f6/0x1170
+ worker_thread+0xa63/0x1210
+ kthread+0x270/0x300
+ ret_from_fork+0x1f/0x30
+
+Note that normal images or images using compact indexes are not
+impacted. Let's fix this now.
+
+[1] https://lore.kernel.org/r/000000000000ec75b005ee97fbaa@google.com
+
+Reported-and-tested-by: syzbot+aafb3f37cfeb6534c4ac@syzkaller.appspotmail.com
+Fixes: 02827e1796b3 ("staging: erofs: add erofs_map_blocks_iter")
+Fixes: 152a333a5895 ("staging: erofs: add compacted compression indexes support")
+Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
+Reviewed-by: Chao Yu <chao@kernel.org>
+Link: https://lore.kernel.org/r/20230410173714.104604-1-hsiangkao@linux.alibaba.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/erofs/zmap.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/fs/erofs/zmap.c b/fs/erofs/zmap.c
+index 655da4d739cb6..b5f4086537548 100644
+--- a/fs/erofs/zmap.c
++++ b/fs/erofs/zmap.c
+@@ -86,6 +86,10 @@ static int legacy_load_cluster_from_disk(struct z_erofs_maprecorder *m,
+ if (advise & Z_EROFS_VLE_DI_PARTIAL_REF)
+ m->partialref = true;
+ m->clusterofs = le16_to_cpu(di->di_clusterofs);
++ if (m->clusterofs >= 1 << vi->z_logical_clusterbits) {
++ DBG_BUGON(1);
++ return -EFSCORRUPTED;
++ }
+ m->pblk = le32_to_cpu(di->di_u.blkaddr);
+ break;
+ default:
+--
+2.39.2
+
--- /dev/null
+From 365e70402d2b7a12202706781411fd0bf8ab411f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Mar 2023 09:37:21 +0800
+Subject: ext4: fix i_disksize exceeding i_size problem in paritally written
+ case
+
+From: Zhihao Cheng <chengzhihao1@huawei.com>
+
+[ Upstream commit 1dedde690303c05ef732b7c5c8356fdf60a4ade3 ]
+
+It is possible for i_disksize can exceed i_size, triggering a warning.
+
+generic_perform_write
+ copied = iov_iter_copy_from_user_atomic(len) // copied < len
+ ext4_da_write_end
+ | ext4_update_i_disksize
+ | new_i_size = pos + copied;
+ | WRITE_ONCE(EXT4_I(inode)->i_disksize, newsize) // update i_disksize
+ | generic_write_end
+ | copied = block_write_end(copied, len) // copied = 0
+ | if (unlikely(copied < len))
+ | if (!PageUptodate(page))
+ | copied = 0;
+ | if (pos + copied > inode->i_size) // return false
+ if (unlikely(copied == 0))
+ goto again;
+ if (unlikely(iov_iter_fault_in_readable(i, bytes))) {
+ status = -EFAULT;
+ break;
+ }
+
+We get i_disksize greater than i_size here, which could trigger WARNING
+check 'i_size_read(inode) < EXT4_I(inode)->i_disksize' while doing dio:
+
+ext4_dio_write_iter
+ iomap_dio_rw
+ __iomap_dio_rw // return err, length is not aligned to 512
+ ext4_handle_inode_extension
+ WARN_ON_ONCE(i_size_read(inode) < EXT4_I(inode)->i_disksize) // Oops
+
+ WARNING: CPU: 2 PID: 2609 at fs/ext4/file.c:319
+ CPU: 2 PID: 2609 Comm: aa Not tainted 6.3.0-rc2
+ RIP: 0010:ext4_file_write_iter+0xbc7
+ Call Trace:
+ vfs_write+0x3b1
+ ksys_write+0x77
+ do_syscall_64+0x39
+
+Fix it by updating 'copied' value before updating i_disksize just like
+ext4_write_inline_data_end() does.
+
+A reproducer can be found in the buganizer link below.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=217209
+Fixes: 64769240bd07 ("ext4: Add delayed allocation support in data=writeback mode")
+Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Link: https://lore.kernel.org/r/20230321013721.89818-1-chengzhihao1@huawei.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/inode.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index bf0b7dea4900a..41ba1c4328449 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -3148,6 +3148,9 @@ static int ext4_da_write_end(struct file *file,
+ ext4_has_inline_data(inode))
+ return ext4_write_inline_data_end(inode, pos, len, copied, page);
+
++ if (unlikely(copied < len) && !PageUptodate(page))
++ copied = 0;
++
+ start = pos & (PAGE_SIZE - 1);
+ end = start + copied - 1;
+
+--
+2.39.2
+
--- /dev/null
+From 455f2acd0d8cd007f5df40cbc05f25a7141dcc58 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Apr 2023 11:16:27 +0000
+Subject: ext4: fix use-after-free read in ext4_find_extent for bigalloc +
+ inline
+
+From: Ye Bin <yebin10@huawei.com>
+
+[ Upstream commit 835659598c67907b98cd2aa57bb951dfaf675c69 ]
+
+Syzbot found the following issue:
+loop0: detected capacity change from 0 to 2048
+EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 without journal. Quota mode: none.
+==================================================================
+BUG: KASAN: use-after-free in ext4_ext_binsearch_idx fs/ext4/extents.c:768 [inline]
+BUG: KASAN: use-after-free in ext4_find_extent+0x76e/0xd90 fs/ext4/extents.c:931
+Read of size 4 at addr ffff888073644750 by task syz-executor420/5067
+
+CPU: 0 PID: 5067 Comm: syz-executor420 Not tainted 6.2.0-rc1-syzkaller #0
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
+Call Trace:
+ <TASK>
+ __dump_stack lib/dump_stack.c:88 [inline]
+ dump_stack_lvl+0x1b1/0x290 lib/dump_stack.c:106
+ print_address_description+0x74/0x340 mm/kasan/report.c:306
+ print_report+0x107/0x1f0 mm/kasan/report.c:417
+ kasan_report+0xcd/0x100 mm/kasan/report.c:517
+ ext4_ext_binsearch_idx fs/ext4/extents.c:768 [inline]
+ ext4_find_extent+0x76e/0xd90 fs/ext4/extents.c:931
+ ext4_clu_mapped+0x117/0x970 fs/ext4/extents.c:5809
+ ext4_insert_delayed_block fs/ext4/inode.c:1696 [inline]
+ ext4_da_map_blocks fs/ext4/inode.c:1806 [inline]
+ ext4_da_get_block_prep+0x9e8/0x13c0 fs/ext4/inode.c:1870
+ ext4_block_write_begin+0x6a8/0x2290 fs/ext4/inode.c:1098
+ ext4_da_write_begin+0x539/0x760 fs/ext4/inode.c:3082
+ generic_perform_write+0x2e4/0x5e0 mm/filemap.c:3772
+ ext4_buffered_write_iter+0x122/0x3a0 fs/ext4/file.c:285
+ ext4_file_write_iter+0x1d0/0x18f0
+ call_write_iter include/linux/fs.h:2186 [inline]
+ new_sync_write fs/read_write.c:491 [inline]
+ vfs_write+0x7dc/0xc50 fs/read_write.c:584
+ ksys_write+0x177/0x2a0 fs/read_write.c:637
+ do_syscall_x64 arch/x86/entry/common.c:50 [inline]
+ do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
+ entry_SYSCALL_64_after_hwframe+0x63/0xcd
+RIP: 0033:0x7f4b7a9737b9
+RSP: 002b:00007ffc5cac3668 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
+RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f4b7a9737b9
+RDX: 00000000175d9003 RSI: 0000000020000200 RDI: 0000000000000004
+RBP: 00007f4b7a933050 R08: 0000000000000000 R09: 0000000000000000
+R10: 000000000000079f R11: 0000000000000246 R12: 00007f4b7a9330e0
+R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
+ </TASK>
+
+Above issue is happens when enable bigalloc and inline data feature. As
+commit 131294c35ed6 fixed delayed allocation bug in ext4_clu_mapped for
+bigalloc + inline. But it only resolved issue when has inline data, if
+inline data has been converted to extent(ext4_da_convert_inline_data_to_extent)
+before writepages, there is no EXT4_STATE_MAY_INLINE_DATA flag. However
+i_data is still store inline data in this scene. Then will trigger UAF
+when find extent.
+To resolve above issue, there is need to add judge "ext4_has_inline_data(inode)"
+in ext4_clu_mapped().
+
+Fixes: 131294c35ed6 ("ext4: fix delayed allocation bug in ext4_clu_mapped for bigalloc + inline")
+Reported-by: syzbot+bf4bb7731ef73b83a3b4@syzkaller.appspotmail.com
+Reviewed-by: Jan Kara <jack@suse.cz>
+Reviewed-by: Ye Bin <yebin10@huawei.com>
+Reviewed-by: Tudor Ambarus <tudor.ambarus@linaro.org>
+Tested-by: Tudor Ambarus <tudor.ambarus@linaro.org>
+Link: https://lore.kernel.org/r/20230406111627.1916759-1-tudor.ambarus@linaro.org
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/extents.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
+index 3559ea6b07818..74251eebf8313 100644
+--- a/fs/ext4/extents.c
++++ b/fs/ext4/extents.c
+@@ -5802,7 +5802,8 @@ int ext4_clu_mapped(struct inode *inode, ext4_lblk_t lclu)
+ * mapped - no physical clusters have been allocated, and the
+ * file has no extents
+ */
+- if (ext4_test_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA))
++ if (ext4_test_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA) ||
++ ext4_has_inline_data(inode))
+ return 0;
+
+ /* search for the extent closest to the first block in the cluster */
+--
+2.39.2
+
--- /dev/null
+From 6d1812d5b88a0a1fd6968729351813c1cca363d5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Mar 2023 15:58:04 -0700
+Subject: f2fs: apply zone capacity to all zone type
+
+From: Jaegeuk Kim <jaegeuk@kernel.org>
+
+[ Upstream commit 0b37ed21e3367539b79284e0b0af2246ffcf0dca ]
+
+If we manage the zone capacity per zone type, it'll break the GC assumption.
+And, the current logic complains valid block count mismatch.
+Let's apply zone capacity to all zone type, if specified.
+
+Fixes: de881df97768 ("f2fs: support zone capacity less than zone size")
+Reviewed-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/segment.c | 65 +++--------------------------------------------
+ fs/f2fs/segment.h | 3 +++
+ 2 files changed, 7 insertions(+), 61 deletions(-)
+
+diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
+index 227e258361734..1ca12ea8723b7 100644
+--- a/fs/f2fs/segment.c
++++ b/fs/f2fs/segment.c
+@@ -4920,48 +4920,6 @@ int f2fs_check_write_pointer(struct f2fs_sb_info *sbi)
+ return 0;
+ }
+
+-static bool is_conv_zone(struct f2fs_sb_info *sbi, unsigned int zone_idx,
+- unsigned int dev_idx)
+-{
+- if (!bdev_is_zoned(FDEV(dev_idx).bdev))
+- return true;
+- return !test_bit(zone_idx, FDEV(dev_idx).blkz_seq);
+-}
+-
+-/* Return the zone index in the given device */
+-static unsigned int get_zone_idx(struct f2fs_sb_info *sbi, unsigned int secno,
+- int dev_idx)
+-{
+- block_t sec_start_blkaddr = START_BLOCK(sbi, GET_SEG_FROM_SEC(sbi, secno));
+-
+- return (sec_start_blkaddr - FDEV(dev_idx).start_blk) >>
+- sbi->log_blocks_per_blkz;
+-}
+-
+-/*
+- * Return the usable segments in a section based on the zone's
+- * corresponding zone capacity. Zone is equal to a section.
+- */
+-static inline unsigned int f2fs_usable_zone_segs_in_sec(
+- struct f2fs_sb_info *sbi, unsigned int segno)
+-{
+- unsigned int dev_idx, zone_idx;
+-
+- dev_idx = f2fs_target_device_index(sbi, START_BLOCK(sbi, segno));
+- zone_idx = get_zone_idx(sbi, GET_SEC_FROM_SEG(sbi, segno), dev_idx);
+-
+- /* Conventional zone's capacity is always equal to zone size */
+- if (is_conv_zone(sbi, zone_idx, dev_idx))
+- return sbi->segs_per_sec;
+-
+- if (!sbi->unusable_blocks_per_sec)
+- return sbi->segs_per_sec;
+-
+- /* Get the segment count beyond zone capacity block */
+- return sbi->segs_per_sec - (sbi->unusable_blocks_per_sec >>
+- sbi->log_blocks_per_seg);
+-}
+-
+ /*
+ * Return the number of usable blocks in a segment. The number of blocks
+ * returned is always equal to the number of blocks in a segment for
+@@ -4974,23 +4932,13 @@ static inline unsigned int f2fs_usable_zone_blks_in_seg(
+ struct f2fs_sb_info *sbi, unsigned int segno)
+ {
+ block_t seg_start, sec_start_blkaddr, sec_cap_blkaddr;
+- unsigned int zone_idx, dev_idx, secno;
+-
+- secno = GET_SEC_FROM_SEG(sbi, segno);
+- seg_start = START_BLOCK(sbi, segno);
+- dev_idx = f2fs_target_device_index(sbi, seg_start);
+- zone_idx = get_zone_idx(sbi, secno, dev_idx);
+-
+- /*
+- * Conventional zone's capacity is always equal to zone size,
+- * so, blocks per segment is unchanged.
+- */
+- if (is_conv_zone(sbi, zone_idx, dev_idx))
+- return sbi->blocks_per_seg;
++ unsigned int secno;
+
+ if (!sbi->unusable_blocks_per_sec)
+ return sbi->blocks_per_seg;
+
++ secno = GET_SEC_FROM_SEG(sbi, segno);
++ seg_start = START_BLOCK(sbi, segno);
+ sec_start_blkaddr = START_BLOCK(sbi, GET_SEG_FROM_SEC(sbi, secno));
+ sec_cap_blkaddr = sec_start_blkaddr + CAP_BLKS_PER_SEC(sbi);
+
+@@ -5024,11 +4972,6 @@ static inline unsigned int f2fs_usable_zone_blks_in_seg(struct f2fs_sb_info *sbi
+ return 0;
+ }
+
+-static inline unsigned int f2fs_usable_zone_segs_in_sec(struct f2fs_sb_info *sbi,
+- unsigned int segno)
+-{
+- return 0;
+-}
+ #endif
+ unsigned int f2fs_usable_blks_in_seg(struct f2fs_sb_info *sbi,
+ unsigned int segno)
+@@ -5043,7 +4986,7 @@ unsigned int f2fs_usable_segs_in_sec(struct f2fs_sb_info *sbi,
+ unsigned int segno)
+ {
+ if (f2fs_sb_has_blkzoned(sbi))
+- return f2fs_usable_zone_segs_in_sec(sbi, segno);
++ return CAP_SEGS_PER_SEC(sbi);
+
+ return sbi->segs_per_sec;
+ }
+diff --git a/fs/f2fs/segment.h b/fs/f2fs/segment.h
+index efdb7fc3b7975..babb29a1c0347 100644
+--- a/fs/f2fs/segment.h
++++ b/fs/f2fs/segment.h
+@@ -104,6 +104,9 @@ static inline void sanity_check_seg_type(struct f2fs_sb_info *sbi,
+ #define CAP_BLKS_PER_SEC(sbi) \
+ ((sbi)->segs_per_sec * (sbi)->blocks_per_seg - \
+ (sbi)->unusable_blocks_per_sec)
++#define CAP_SEGS_PER_SEC(sbi) \
++ ((sbi)->segs_per_sec - ((sbi)->unusable_blocks_per_sec >>\
++ (sbi)->log_blocks_per_seg))
+ #define GET_SEC_FROM_SEG(sbi, segno) \
+ (((segno) == -1) ? -1: (segno) / (sbi)->segs_per_sec)
+ #define GET_SEG_FROM_SEC(sbi, secno) \
+--
+2.39.2
+
--- /dev/null
+From a99d149248e656c8af6677661dc98e460080c507 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Mar 2023 01:22:18 +0800
+Subject: f2fs: compress: fix to call f2fs_wait_on_page_writeback() in
+ f2fs_write_raw_pages()
+
+From: Yangtao Li <frank.li@vivo.com>
+
+[ Upstream commit babedcbac164cec970872b8097401ca913a80e61 ]
+
+BUG_ON() will be triggered when writing files concurrently,
+because the same page is writtenback multiple times.
+
+1597 void folio_end_writeback(struct folio *folio)
+1598 {
+ ......
+1618 if (!__folio_end_writeback(folio))
+1619 BUG();
+ ......
+1625 }
+
+kernel BUG at mm/filemap.c:1619!
+Call Trace:
+ <TASK>
+ f2fs_write_end_io+0x1a0/0x370
+ blk_update_request+0x6c/0x410
+ blk_mq_end_request+0x15/0x130
+ blk_complete_reqs+0x3c/0x50
+ __do_softirq+0xb8/0x29b
+ ? sort_range+0x20/0x20
+ run_ksoftirqd+0x19/0x20
+ smpboot_thread_fn+0x10b/0x1d0
+ kthread+0xde/0x110
+ ? kthread_complete_and_exit+0x20/0x20
+ ret_from_fork+0x22/0x30
+ </TASK>
+
+Below is the concurrency scenario:
+
+[Process A] [Process B] [Process C]
+f2fs_write_raw_pages()
+ - redirty_page_for_writepage()
+ - unlock page()
+ f2fs_do_write_data_page()
+ - lock_page()
+ - clear_page_dirty_for_io()
+ - set_page_writeback() [1st writeback]
+ .....
+ - unlock page()
+
+ generic_perform_write()
+ - f2fs_write_begin()
+ - wait_for_stable_page()
+
+ - f2fs_write_end()
+ - set_page_dirty()
+
+ - lock_page()
+ - f2fs_do_write_data_page()
+ - set_page_writeback() [2st writeback]
+
+This problem was introduced by the previous commit 7377e853967b ("f2fs:
+compress: fix potential deadlock of compress file"). All pagelocks were
+released in f2fs_write_raw_pages(), but whether the page was
+in the writeback state was ignored in the subsequent writing process.
+Let's fix it by waiting for the page to writeback before writing.
+
+Cc: Christoph Hellwig <hch@lst.de>
+Fixes: 4c8ff7095bef ("f2fs: support data compression")
+Fixes: 7377e853967b ("f2fs: compress: fix potential deadlock of compress file")
+Signed-off-by: Qi Han <hanqi@vivo.com>
+Signed-off-by: Yangtao Li <frank.li@vivo.com>
+Reviewed-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/compress.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c
+index b40dec3d7f799..ff7db6c4ee134 100644
+--- a/fs/f2fs/compress.c
++++ b/fs/f2fs/compress.c
+@@ -1456,6 +1456,12 @@ static int f2fs_write_raw_pages(struct compress_ctx *cc,
+ if (!PageDirty(cc->rpages[i]))
+ goto continue_unlock;
+
++ if (PageWriteback(cc->rpages[i])) {
++ if (wbc->sync_mode == WB_SYNC_NONE)
++ goto continue_unlock;
++ f2fs_wait_on_page_writeback(cc->rpages[i], DATA, true, true);
++ }
++
+ if (!clear_page_dirty_for_io(cc->rpages[i]))
+ goto continue_unlock;
+
+--
+2.39.2
+
--- /dev/null
+From 228ad0a9a66b596c5416755a043e4ff3afaf99cf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 31 Mar 2023 17:26:56 +0800
+Subject: f2fs: fix iostat lock protection
+
+From: Qilin Tan <qilin.tan@mediatek.com>
+
+[ Upstream commit 144f1cd40bf91fb3ac1d41806470756ce774f389 ]
+
+Made iostat lock irq safe to avoid potentinal deadlock.
+
+Deadlock scenario:
+f2fs_attr_store
+ -> f2fs_sbi_store
+ -> _sbi_store
+ -> spin_lock(sbi->iostat_lock)
+ <interrupt request>
+ -> scsi_end_request
+ -> bio_endio
+ -> f2fs_dio_read_end_io
+ -> f2fs_update_iostat
+ -> spin_lock_irqsave(sbi->iostat_lock) ===> Dead lock here
+
+Fixes: 61803e984307 ("f2fs: fix iostat related lock protection")
+Fixes: a1e09b03e6f5 ("f2fs: use iomap for direct I/O")
+Signed-off-by: Qilin Tan <qilin.tan@mediatek.com>
+Reviewed-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/sysfs.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/f2fs/sysfs.c b/fs/f2fs/sysfs.c
+index 0b19163c90d41..fd238a68017eb 100644
+--- a/fs/f2fs/sysfs.c
++++ b/fs/f2fs/sysfs.c
+@@ -575,9 +575,9 @@ static ssize_t __sbi_store(struct f2fs_attr *a,
+ if (!strcmp(a->attr.name, "iostat_period_ms")) {
+ if (t < MIN_IOSTAT_PERIOD_MS || t > MAX_IOSTAT_PERIOD_MS)
+ return -EINVAL;
+- spin_lock(&sbi->iostat_lock);
++ spin_lock_irq(&sbi->iostat_lock);
+ sbi->iostat_period_ms = (unsigned int)t;
+- spin_unlock(&sbi->iostat_lock);
++ spin_unlock_irq(&sbi->iostat_lock);
+ return count;
+ }
+ #endif
+--
+2.39.2
+
--- /dev/null
+From 0b0e1938ad3b89af17a3fc49b5b9513958801e62 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Mar 2023 15:37:54 -0700
+Subject: f2fs: fix scheduling while atomic in decompression path
+
+From: Jaegeuk Kim <jaegeuk@kernel.org>
+
+[ Upstream commit 1aa161e43106d46ca8e9a86f4aa28d420258134b ]
+
+[ 16.945668][ C0] Call trace:
+[ 16.945678][ C0] dump_backtrace+0x110/0x204
+[ 16.945706][ C0] dump_stack_lvl+0x84/0xbc
+[ 16.945735][ C0] __schedule_bug+0xb8/0x1ac
+[ 16.945756][ C0] __schedule+0x724/0xbdc
+[ 16.945778][ C0] schedule+0x154/0x258
+[ 16.945793][ C0] bit_wait_io+0x48/0xa4
+[ 16.945808][ C0] out_of_line_wait_on_bit+0x114/0x198
+[ 16.945824][ C0] __sync_dirty_buffer+0x1f8/0x2e8
+[ 16.945853][ C0] __f2fs_commit_super+0x140/0x1f4
+[ 16.945881][ C0] f2fs_commit_super+0x110/0x28c
+[ 16.945898][ C0] f2fs_handle_error+0x1f4/0x2f4
+[ 16.945917][ C0] f2fs_decompress_cluster+0xc4/0x450
+[ 16.945942][ C0] f2fs_end_read_compressed_page+0xc0/0xfc
+[ 16.945959][ C0] f2fs_handle_step_decompress+0x118/0x1cc
+[ 16.945978][ C0] f2fs_read_end_io+0x168/0x2b0
+[ 16.945993][ C0] bio_endio+0x25c/0x2c8
+[ 16.946015][ C0] dm_io_dec_pending+0x3e8/0x57c
+[ 16.946052][ C0] clone_endio+0x134/0x254
+[ 16.946069][ C0] bio_endio+0x25c/0x2c8
+[ 16.946084][ C0] blk_update_request+0x1d4/0x478
+[ 16.946103][ C0] scsi_end_request+0x38/0x4cc
+[ 16.946129][ C0] scsi_io_completion+0x94/0x184
+[ 16.946147][ C0] scsi_finish_command+0xe8/0x154
+[ 16.946164][ C0] scsi_complete+0x90/0x1d8
+[ 16.946181][ C0] blk_done_softirq+0xa4/0x11c
+[ 16.946198][ C0] _stext+0x184/0x614
+[ 16.946214][ C0] __irq_exit_rcu+0x78/0x144
+[ 16.946234][ C0] handle_domain_irq+0xd4/0x154
+[ 16.946260][ C0] gic_handle_irq.33881+0x5c/0x27c
+[ 16.946281][ C0] call_on_irq_stack+0x40/0x70
+[ 16.946298][ C0] do_interrupt_handler+0x48/0xa4
+[ 16.946313][ C0] el1_interrupt+0x38/0x68
+[ 16.946346][ C0] el1h_64_irq_handler+0x20/0x30
+[ 16.946362][ C0] el1h_64_irq+0x78/0x7c
+[ 16.946377][ C0] finish_task_switch+0xc8/0x3d8
+[ 16.946394][ C0] __schedule+0x600/0xbdc
+[ 16.946408][ C0] preempt_schedule_common+0x34/0x5c
+[ 16.946423][ C0] preempt_schedule+0x44/0x48
+[ 16.946438][ C0] process_one_work+0x30c/0x550
+[ 16.946456][ C0] worker_thread+0x414/0x8bc
+[ 16.946472][ C0] kthread+0x16c/0x1e0
+[ 16.946486][ C0] ret_from_fork+0x10/0x20
+
+Fixes: bff139b49d9f ("f2fs: handle decompress only post processing in softirq")
+Fixes: 95fa90c9e5a7 ("f2fs: support recording errors into superblock")
+Reviewed-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/compress.c | 7 ++++++-
+ fs/f2fs/f2fs.h | 1 +
+ fs/f2fs/super.c | 2 +-
+ 3 files changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c
+index ff7db6c4ee134..25f8162d292da 100644
+--- a/fs/f2fs/compress.c
++++ b/fs/f2fs/compress.c
+@@ -755,7 +755,12 @@ void f2fs_decompress_cluster(struct decompress_io_ctx *dic, bool in_task)
+
+ if (dic->clen > PAGE_SIZE * dic->nr_cpages - COMPRESS_HEADER_SIZE) {
+ ret = -EFSCORRUPTED;
+- f2fs_handle_error(sbi, ERROR_FAIL_DECOMPRESSION);
++
++ /* Avoid f2fs_commit_super in irq context */
++ if (in_task)
++ f2fs_save_errors(sbi, ERROR_FAIL_DECOMPRESSION);
++ else
++ f2fs_handle_error(sbi, ERROR_FAIL_DECOMPRESSION);
+ goto out_release;
+ }
+
+diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
+index b0ab2062038a0..620343c65ab67 100644
+--- a/fs/f2fs/f2fs.h
++++ b/fs/f2fs/f2fs.h
+@@ -3554,6 +3554,7 @@ int f2fs_quota_sync(struct super_block *sb, int type);
+ loff_t max_file_blocks(struct inode *inode);
+ void f2fs_quota_off_umount(struct super_block *sb);
+ void f2fs_handle_stop(struct f2fs_sb_info *sbi, unsigned char reason);
++void f2fs_save_errors(struct f2fs_sb_info *sbi, unsigned char flag);
+ void f2fs_handle_error(struct f2fs_sb_info *sbi, unsigned char error);
+ int f2fs_commit_super(struct f2fs_sb_info *sbi, bool recover);
+ int f2fs_sync_fs(struct super_block *sb, int sync);
+diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
+index fbaaabbcd6de7..5c1c3a84501fe 100644
+--- a/fs/f2fs/super.c
++++ b/fs/f2fs/super.c
+@@ -3885,7 +3885,7 @@ void f2fs_handle_stop(struct f2fs_sb_info *sbi, unsigned char reason)
+ f2fs_up_write(&sbi->sb_lock);
+ }
+
+-static void f2fs_save_errors(struct f2fs_sb_info *sbi, unsigned char flag)
++void f2fs_save_errors(struct f2fs_sb_info *sbi, unsigned char flag)
+ {
+ spin_lock(&sbi->error_lock);
+ if (!test_bit(flag, (unsigned long *)sbi->errors)) {
+--
+2.39.2
+
--- /dev/null
+From 57fa1af327fa8f1a44d8efff99dc9532afff98cd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Apr 2023 10:14:02 +0800
+Subject: f2fs: fix to avoid use-after-free for cached IPU bio
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit 5cdb422c839134273866208dad5360835ddb9794 ]
+
+xfstest generic/019 reports a bug:
+
+kernel BUG at mm/filemap.c:1619!
+RIP: 0010:folio_end_writeback+0x8a/0x90
+Call Trace:
+ end_page_writeback+0x1c/0x60
+ f2fs_write_end_io+0x199/0x420
+ bio_endio+0x104/0x180
+ submit_bio_noacct+0xa5/0x510
+ submit_bio+0x48/0x80
+ f2fs_submit_write_bio+0x35/0x300
+ f2fs_submit_merged_ipu_write+0x2a0/0x2b0
+ f2fs_write_single_data_page+0x838/0x8b0
+ f2fs_write_cache_pages+0x379/0xa30
+ f2fs_write_data_pages+0x30c/0x340
+ do_writepages+0xd8/0x1b0
+ __writeback_single_inode+0x44/0x370
+ writeback_sb_inodes+0x233/0x4d0
+ __writeback_inodes_wb+0x56/0xf0
+ wb_writeback+0x1dd/0x2d0
+ wb_workfn+0x367/0x4a0
+ process_one_work+0x21d/0x430
+ worker_thread+0x4e/0x3c0
+ kthread+0x103/0x130
+ ret_from_fork+0x2c/0x50
+
+The root cause is: after cp_error is set, f2fs_submit_merged_ipu_write()
+in f2fs_write_single_data_page() tries to flush IPU bio in cache, however
+f2fs_submit_merged_ipu_write() missed to check validity of @bio parameter,
+result in submitting random cached bio which belong to other IO context,
+then it will cause use-after-free issue, fix it by adding additional
+validity check.
+
+Fixes: 0b20fcec8651 ("f2fs: cache global IPU bio")
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/data.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
+index 06b552a0aba23..1034912a61b30 100644
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -874,6 +874,8 @@ void f2fs_submit_merged_ipu_write(struct f2fs_sb_info *sbi,
+ bool found = false;
+ struct bio *target = bio ? *bio : NULL;
+
++ f2fs_bug_on(sbi, !target && !page);
++
+ for (temp = HOT; temp < NR_TEMP_TYPE && !found; temp++) {
+ struct f2fs_bio_info *io = sbi->write_io[DATA] + temp;
+ struct list_head *head = &io->bio_list;
+@@ -2898,7 +2900,8 @@ int f2fs_write_single_data_page(struct page *page, int *submitted,
+
+ if (unlikely(f2fs_cp_error(sbi))) {
+ f2fs_submit_merged_write(sbi, DATA);
+- f2fs_submit_merged_ipu_write(sbi, bio, NULL);
++ if (bio && *bio)
++ f2fs_submit_merged_ipu_write(sbi, bio, NULL);
+ submitted = NULL;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 850a231aa62fccf8d58d47b32c94616b8a1b3067 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Apr 2023 22:44:53 +0800
+Subject: f2fs: fix to check return value of f2fs_do_truncate_blocks()
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit b851ee6ba3cc212641e622ebcf92b950c7bafa07 ]
+
+Otherwise, if truncation on cow_inode failed, remained data may
+pollute current transaction of atomic write.
+
+Cc: Daeho Jeong <daehojeong@google.com>
+Fixes: a46bebd502fe ("f2fs: synchronize atomic write aborts")
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/file.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index 4f684b99ba5a3..16e286cea6301 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -2113,7 +2113,11 @@ static int f2fs_ioc_start_atomic_write(struct file *filp, bool truncate)
+ clear_inode_flag(fi->cow_inode, FI_INLINE_DATA);
+ } else {
+ /* Reuse the already created COW inode */
+- f2fs_do_truncate_blocks(fi->cow_inode, 0, true);
++ ret = f2fs_do_truncate_blocks(fi->cow_inode, 0, true);
++ if (ret) {
++ f2fs_up_write(&fi->i_gc_rwsem[WRITE]);
++ goto out;
++ }
+ }
+
+ f2fs_write_inode(inode, NULL);
+--
+2.39.2
+
--- /dev/null
+From 821ed50be693dbd0ccee59c3ea5513badf3ee711 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Apr 2023 22:45:36 +0800
+Subject: f2fs: fix to check return value of inc_valid_block_count()
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit 935fc6fa6466cf18dd72dd1518ebc7bfc4cd58a4 ]
+
+In __replace_atomic_write_block(), we missed to check return value
+of inc_valid_block_count(), for extreme testcase that f2fs image is
+run out of space, it may cause inconsistent status in between SIT
+table and total valid block count.
+
+Cc: Daeho Jeong <daehojeong@google.com>
+Fixes: 3db1de0e582c ("f2fs: change the current atomic write way")
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/segment.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
+index 1ca12ea8723b7..b2a080c660c86 100644
+--- a/fs/f2fs/segment.c
++++ b/fs/f2fs/segment.c
+@@ -246,10 +246,16 @@ static int __replace_atomic_write_block(struct inode *inode, pgoff_t index,
+ } else {
+ blkcnt_t count = 1;
+
++ err = inc_valid_block_count(sbi, inode, &count);
++ if (err) {
++ f2fs_put_dnode(&dn);
++ return err;
++ }
++
+ *old_addr = dn.data_blkaddr;
+ f2fs_truncate_data_blocks_range(&dn, 1);
+ dec_valid_block_count(sbi, F2FS_I(inode)->cow_inode, count);
+- inc_valid_block_count(sbi, inode, &count);
++
+ f2fs_replace_block(sbi, &dn, dn.data_blkaddr, new_addr,
+ ni.version, true, false);
+ }
+--
+2.39.2
+
--- /dev/null
+From cad68be848d84376c32fa1e77c837b1f3f7ebd83 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Feb 2023 16:13:50 +0900
+Subject: f2fs: fix uninitialized skipped_gc_rwsem
+
+From: Yonggil Song <yonggil.song@samsung.com>
+
+[ Upstream commit c17caf0ba3aa3411b96c71b4ce24be1040b8f3e8 ]
+
+When f2fs skipped a gc round during victim migration, there was a bug which
+would skip all upcoming gc rounds unconditionally because skipped_gc_rwsem
+was not initialized. It fixes the bug by correctly initializing the
+skipped_gc_rwsem inside the gc loop.
+
+Fixes: 6f8d4455060d ("f2fs: avoid fi->i_gc_rwsem[WRITE] lock in f2fs_gc")
+Signed-off-by: Yonggil Song <yonggil.song@samsung.com>
+Reviewed-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/gc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c
+index 0a9dfa4598606..292a17d62f569 100644
+--- a/fs/f2fs/gc.c
++++ b/fs/f2fs/gc.c
+@@ -1791,8 +1791,8 @@ int f2fs_gc(struct f2fs_sb_info *sbi, struct f2fs_gc_control *gc_control)
+ prefree_segments(sbi));
+
+ cpc.reason = __get_cp_reason(sbi);
+- sbi->skipped_gc_rwsem = 0;
+ gc_more:
++ sbi->skipped_gc_rwsem = 0;
+ if (unlikely(!(sbi->sb->s_flags & SB_ACTIVE))) {
+ ret = -EINVAL;
+ goto stop;
+--
+2.39.2
+
--- /dev/null
+From a279b80acad2869bb3d9e4b33fa867d7f8ca7550 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Feb 2023 22:45:50 +0800
+Subject: f2fs: handle dqget error in f2fs_transfer_project_quota()
+
+From: Yangtao Li <frank.li@vivo.com>
+
+[ Upstream commit 8051692f5f23260215bfe9a72e712d93606acc5f ]
+
+We should set the error code when dqget() failed.
+
+Fixes: 2c1d03056991 ("f2fs: support F2FS_IOC_FS{GET,SET}XATTR")
+Signed-off-by: Yangtao Li <frank.li@vivo.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/file.c | 15 ++++++++-------
+ 1 file changed, 8 insertions(+), 7 deletions(-)
+
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index 15dabeac46905..4f684b99ba5a3 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -3009,15 +3009,16 @@ int f2fs_transfer_project_quota(struct inode *inode, kprojid_t kprojid)
+ struct dquot *transfer_to[MAXQUOTAS] = {};
+ struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
+ struct super_block *sb = sbi->sb;
+- int err = 0;
++ int err;
+
+ transfer_to[PRJQUOTA] = dqget(sb, make_kqid_projid(kprojid));
+- if (!IS_ERR(transfer_to[PRJQUOTA])) {
+- err = __dquot_transfer(inode, transfer_to);
+- if (err)
+- set_sbi_flag(sbi, SBI_QUOTA_NEED_REPAIR);
+- dqput(transfer_to[PRJQUOTA]);
+- }
++ if (IS_ERR(transfer_to[PRJQUOTA]))
++ return PTR_ERR(transfer_to[PRJQUOTA]);
++
++ err = __dquot_transfer(inode, transfer_to);
++ if (err)
++ set_sbi_flag(sbi, SBI_QUOTA_NEED_REPAIR);
++ dqput(transfer_to[PRJQUOTA]);
+ return err;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 3b42bd86c1b135e63c02bb29749b4c7ac2abe223 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Apr 2023 21:33:17 +0200
+Subject: fbdev: mmp: Fix deferred clk handling in mmphw_probe()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit b3a7a9ab65ae2f2626c7222fb79cdd433f8c5252 ]
+
+When dev_err_probe() is called, 'ret' holds the value of the previous
+successful devm_request_irq() call.
+'ret' should be assigned with a meaningful value before being used in
+dev_err_probe().
+
+While at it, use and return "PTR_ERR(ctrl->clk)" instead of a hard-coded
+"-ENOENT" so that -EPROBE_DEFER is handled and propagated correctly.
+
+Fixes: 81b63420564d ("fbdev: mmp: Make use of the helper function dev_err_probe()")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/mmp/hw/mmp_ctrl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/video/fbdev/mmp/hw/mmp_ctrl.c b/drivers/video/fbdev/mmp/hw/mmp_ctrl.c
+index a9df8ee798102..51fbf02a03430 100644
+--- a/drivers/video/fbdev/mmp/hw/mmp_ctrl.c
++++ b/drivers/video/fbdev/mmp/hw/mmp_ctrl.c
+@@ -514,9 +514,9 @@ static int mmphw_probe(struct platform_device *pdev)
+ /* get clock */
+ ctrl->clk = devm_clk_get(ctrl->dev, mi->clk_name);
+ if (IS_ERR(ctrl->clk)) {
++ ret = PTR_ERR(ctrl->clk);
+ dev_err_probe(ctrl->dev, ret,
+ "unable to get clk %s\n", mi->clk_name);
+- ret = -ENOENT;
+ goto failed;
+ }
+ clk_prepare_enable(ctrl->clk);
+--
+2.39.2
+
--- /dev/null
+From ab3799d99fe8082bf58a8609eb166f8e9206eb95 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 26 Mar 2023 21:34:49 +0100
+Subject: firmware: arm_scmi: Fix xfers allocation on Rx channel
+
+From: Cristian Marussi <cristian.marussi@arm.com>
+
+[ Upstream commit b2ccba9e8cdc6fb3985cc227844e7c6af309ffb1 ]
+
+Two distinct pools of xfer descriptors are allocated at initialization
+time: one (Tx) used to provide xfers to track commands and their replies
+(or delayed replies) and another (Rx) to pick xfers from to be used for
+processing notifications.
+
+Such pools, though, are allocated globally to be used by the whole SCMI
+instance, they are not allocated per-channel and as such the allocation of
+notifications xfers cannot be simply skipped if no Rx channel was found for
+the base protocol common channel, because there could be defined more
+optional per-protocol dedicated channels that instead support Rx channels.
+
+Change the conditional check to skip allocation for the notification pool
+only if no Rx channel has been detected on any per-channel protocol at all.
+
+Fixes: 4ebd8f6dea81 ("firmware: arm_scmi: Add receive buffer support for notifications")
+Signed-off-by: Cristian Marussi <cristian.marussi@arm.com>
+Link: https://lore.kernel.org/r/20230326203449.3492948-1-cristian.marussi@arm.com
+Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/arm_scmi/driver.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/firmware/arm_scmi/driver.c b/drivers/firmware/arm_scmi/driver.c
+index dbc474ff62b71..e7d97b59963b0 100644
+--- a/drivers/firmware/arm_scmi/driver.c
++++ b/drivers/firmware/arm_scmi/driver.c
+@@ -2289,7 +2289,7 @@ static int scmi_xfer_info_init(struct scmi_info *sinfo)
+ return ret;
+
+ ret = __scmi_xfer_info_init(sinfo, &sinfo->tx_minfo);
+- if (!ret && idr_find(&sinfo->rx_idr, SCMI_PROTOCOL_BASE))
++ if (!ret && !idr_is_empty(&sinfo->rx_idr))
+ ret = __scmi_xfer_info_init(sinfo, &sinfo->rx_minfo);
+
+ return ret;
+--
+2.39.2
+
--- /dev/null
+From 9785a10ff4c54432775276a1fd3462a5e674f84d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Mar 2023 20:44:26 +0530
+Subject: firmware: qcom_scm: Clear download bit during reboot
+
+From: Mukesh Ojha <quic_mojha@quicinc.com>
+
+[ Upstream commit 781d32d1c9709fd25655c4e3e3e15370ae4ae4db ]
+
+During normal restart of a system download bit should
+be cleared irrespective of whether download mode is
+set or not.
+
+Fixes: 8c1b7dc9ba22 ("firmware: qcom: scm: Expose download-mode control")
+Signed-off-by: Mukesh Ojha <quic_mojha@quicinc.com>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/1678979666-551-1-git-send-email-quic_mojha@quicinc.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/qcom_scm.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/firmware/qcom_scm.c b/drivers/firmware/qcom_scm.c
+index b1e11f85b8054..5f281cb1ae6ba 100644
+--- a/drivers/firmware/qcom_scm.c
++++ b/drivers/firmware/qcom_scm.c
+@@ -1506,8 +1506,7 @@ static int qcom_scm_probe(struct platform_device *pdev)
+ static void qcom_scm_shutdown(struct platform_device *pdev)
+ {
+ /* Clean shutdown, disable download mode to allow normal restart */
+- if (download_mode)
+- qcom_scm_set_download_mode(false);
++ qcom_scm_set_download_mode(false);
+ }
+
+ static const struct of_device_id qcom_scm_dt_match[] = {
+--
+2.39.2
+
--- /dev/null
+From 5cc6c2756067b3a78f90253dd71e5ad6e80fd13d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Apr 2023 17:27:03 +0300
+Subject: firmware: stratix10-svc: Fix an NULL vs IS_ERR() bug in probe
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit e1d6ca042e62c2a69513235f8629eb6e62ca79c5 ]
+
+The svc_create_memory_pool() function returns error pointers. It never
+returns NULL. Fix the check.
+
+Fixes: 7ca5ce896524 ("firmware: add Intel Stratix10 service layer driver")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Link: https://lore.kernel.org/r/5f9a8cb4-5a4f-460b-9cdc-2fae6c5b7922@kili.mountain
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/stratix10-svc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/firmware/stratix10-svc.c b/drivers/firmware/stratix10-svc.c
+index bde1f543f5298..80f4e2d14e046 100644
+--- a/drivers/firmware/stratix10-svc.c
++++ b/drivers/firmware/stratix10-svc.c
+@@ -1133,8 +1133,8 @@ static int stratix10_svc_drv_probe(struct platform_device *pdev)
+ return ret;
+
+ genpool = svc_create_memory_pool(pdev, sh_memory);
+- if (!genpool)
+- return -ENOMEM;
++ if (IS_ERR(genpool))
++ return PTR_ERR(genpool);
+
+ /* allocate service controller and supporting channel */
+ controller = devm_kzalloc(dev, sizeof(*controller), GFP_KERNEL);
+--
+2.39.2
+
--- /dev/null
+From 3bcf9b3270312104b244e9af00feb2bfe84f82ff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Mar 2023 15:03:08 +0100
+Subject: fpga: bridge: fix kernel-doc parameter description
+
+From: Marco Pagani <marpagan@redhat.com>
+
+[ Upstream commit 7ef1a2c1c9dffa177ecc3ea50b7f5ee63a621137 ]
+
+Fix the kernel-doc description for the "struct fpga_image_info *info"
+parameter of the fpga_bridge_get() function.
+
+Fixes: 060ac5c8fa7b ("fpga: bridge: kernel-doc fixes")
+Signed-off-by: Marco Pagani <marpagan@redhat.com>
+Reviewed-by: Tom Rix <trix@redhat.com>
+Acked-by: Xu Yilun <yilun.xu@intel.com>
+Link: https://lore.kernel.org/r/20230301140309.512578-1-marpagan@redhat.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/fpga/fpga-bridge.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/fpga/fpga-bridge.c b/drivers/fpga/fpga-bridge.c
+index 0953e6e4db041..c07fcec5ab1b7 100644
+--- a/drivers/fpga/fpga-bridge.c
++++ b/drivers/fpga/fpga-bridge.c
+@@ -115,7 +115,7 @@ static int fpga_bridge_dev_match(struct device *dev, const void *data)
+ /**
+ * fpga_bridge_get - get an exclusive reference to an fpga bridge
+ * @dev: parent device that fpga bridge was registered with
+- * @info: fpga manager info
++ * @info: fpga image specific information
+ *
+ * Given a device, get an exclusive reference to an fpga bridge.
+ *
+--
+2.39.2
+
--- /dev/null
+From 397d219d275e7b302a50dcf06faa672c19c25ed4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Nov 2022 16:48:46 +0800
+Subject: fs/ntfs3: Add check for kmemdup
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit e6c3cef24cb0d045f99d5cb039b344874e3cfd74 ]
+
+Since the kmemdup may return NULL pointer,
+it should be better to add check for the return value
+in order to avoid NULL pointer dereference.
+
+Fixes: b46acd6a6a62 ("fs/ntfs3: Add NTFS journal")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/fslog.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/fs/ntfs3/fslog.c b/fs/ntfs3/fslog.c
+index c6eb371a36951..dc723f03d6bb2 100644
+--- a/fs/ntfs3/fslog.c
++++ b/fs/ntfs3/fslog.c
+@@ -4256,6 +4256,10 @@ int log_replay(struct ntfs_inode *ni, bool *initialized)
+ rec_len -= t32;
+
+ attr_names = kmemdup(Add2Ptr(lrh, t32), rec_len, GFP_NOFS);
++ if (!attr_names) {
++ err = -ENOMEM;
++ goto out;
++ }
+
+ lcb_put(lcb);
+ lcb = NULL;
+--
+2.39.2
+
--- /dev/null
+From d1255892c42b7366d74d07963c2217e233dce0ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Nov 2022 17:24:14 +0800
+Subject: fs/ntfs3: Fix memory leak if ntfs_read_mft failed
+
+From: Chen Zhongjin <chenzhongjin@huawei.com>
+
+[ Upstream commit bfa434c60157c9793e9b12c9b68ade02aff9f803 ]
+
+Label ATTR_ROOT in ntfs_read_mft() sets is_root = true and
+ni->ni_flags |= NI_FLAG_DIR, then next attr will goto label ATTR_ALLOC
+and alloc ni->dir.alloc_run. However two states are not always
+consistent and can make memory leak.
+
+ 1) attr_name in ATTR_ROOT does not fit the condition it will set
+ is_root = true but NI_FLAG_DIR is not set.
+ 2) next attr_name in ATTR_ALLOC fits the condition and alloc
+ ni->dir.alloc_run
+ 3) in cleanup function ni_clear(), when NI_FLAG_DIR is set, it frees
+ ni->dir.alloc_run, otherwise it frees ni->file.run
+ 4) because NI_FLAG_DIR is not set in this case, ni->dir.alloc_run is
+ leaked as kmemleak reported:
+
+unreferenced object 0xffff888003bc5480 (size 64):
+ backtrace:
+ [<000000003d42e6b0>] __kmalloc_node+0x4e/0x1c0
+ [<00000000d8e19b8a>] kvmalloc_node+0x39/0x1f0
+ [<00000000fc3eb5b8>] run_add_entry+0x18a/0xa40 [ntfs3]
+ [<0000000011c9f978>] run_unpack+0x75d/0x8e0 [ntfs3]
+ [<00000000e7cf1819>] run_unpack_ex+0xbc/0x500 [ntfs3]
+ [<00000000bbf0a43d>] ntfs_iget5+0xb25/0x2dd0 [ntfs3]
+ [<00000000a6e50693>] ntfs_fill_super+0x218d/0x3580 [ntfs3]
+ [<00000000b9170608>] get_tree_bdev+0x3fb/0x710
+ [<000000004833798a>] vfs_get_tree+0x8e/0x280
+ [<000000006e20b8e6>] path_mount+0xf3c/0x1930
+ [<000000007bf15a5f>] do_mount+0xf3/0x110
+ ...
+
+Fix this by always setting is_root and NI_FLAG_DIR together.
+
+Fixes: 82cae269cfa9 ("fs/ntfs3: Add initialization of super block")
+Signed-off-by: Chen Zhongjin <chenzhongjin@huawei.com>
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/inode.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/ntfs3/inode.c b/fs/ntfs3/inode.c
+index 309d9b46b5d5c..ce6bb3bd86b6e 100644
+--- a/fs/ntfs3/inode.c
++++ b/fs/ntfs3/inode.c
+@@ -259,7 +259,6 @@ static struct inode *ntfs_read_mft(struct inode *inode,
+ goto out;
+
+ root = Add2Ptr(attr, roff);
+- is_root = true;
+
+ if (attr->name_len != ARRAY_SIZE(I30_NAME) ||
+ memcmp(attr_name(attr), I30_NAME, sizeof(I30_NAME)))
+@@ -272,6 +271,7 @@ static struct inode *ntfs_read_mft(struct inode *inode,
+ if (!is_dir)
+ goto next_attr;
+
++ is_root = true;
+ ni->ni_flags |= NI_FLAG_DIR;
+
+ err = indx_init(&ni->dir, sbi, attr, INDEX_MUTEX_I30);
+--
+2.39.2
+
--- /dev/null
+From 67096543659b764439cfa9f5e4b4803f1a099ed3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Nov 2022 10:21:59 +0000
+Subject: fs/ntfs3: Fix null-ptr-deref on inode->i_op in ntfs_lookup()
+
+From: ZhangPeng <zhangpeng362@huawei.com>
+
+[ Upstream commit 254e69f284d7270e0abdc023ee53b71401c3ba0c ]
+
+Syzbot reported a null-ptr-deref bug:
+
+ntfs3: loop0: Different NTFS' sector size (1024) and media sector size
+(512)
+ntfs3: loop0: Mark volume as dirty due to NTFS errors
+general protection fault, probably for non-canonical address
+0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN
+KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
+RIP: 0010:d_flags_for_inode fs/dcache.c:1980 [inline]
+RIP: 0010:__d_add+0x5ce/0x800 fs/dcache.c:2796
+Call Trace:
+ <TASK>
+ d_splice_alias+0x122/0x3b0 fs/dcache.c:3191
+ lookup_open fs/namei.c:3391 [inline]
+ open_last_lookups fs/namei.c:3481 [inline]
+ path_openat+0x10e6/0x2df0 fs/namei.c:3688
+ do_filp_open+0x264/0x4f0 fs/namei.c:3718
+ do_sys_openat2+0x124/0x4e0 fs/open.c:1310
+ do_sys_open fs/open.c:1326 [inline]
+ __do_sys_open fs/open.c:1334 [inline]
+ __se_sys_open fs/open.c:1330 [inline]
+ __x64_sys_open+0x221/0x270 fs/open.c:1330
+ do_syscall_x64 arch/x86/entry/common.c:50 [inline]
+ do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
+ entry_SYSCALL_64_after_hwframe+0x63/0xcd
+
+If the MFT record of ntfs inode is not a base record, inode->i_op can be
+NULL. And a null-ptr-deref may happen:
+
+ntfs_lookup()
+ dir_search_u() # inode->i_op is set to NULL
+ d_splice_alias()
+ __d_add()
+ d_flags_for_inode() # inode->i_op->get_link null-ptr-deref
+
+Fix this by adding a Check on inode->i_op before calling the
+d_splice_alias() function.
+
+Fixes: 4342306f0f0d ("fs/ntfs3: Add file operations and implementation")
+Reported-by: syzbot+a8f26a403c169b7593fe@syzkaller.appspotmail.com
+Signed-off-by: ZhangPeng <zhangpeng362@huawei.com>
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/namei.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/fs/ntfs3/namei.c b/fs/ntfs3/namei.c
+index 407fe92394e22..8d206770d8c6d 100644
+--- a/fs/ntfs3/namei.c
++++ b/fs/ntfs3/namei.c
+@@ -88,6 +88,16 @@ static struct dentry *ntfs_lookup(struct inode *dir, struct dentry *dentry,
+ __putname(uni);
+ }
+
++ /*
++ * Check for a null pointer
++ * If the MFT record of ntfs inode is not a base record, inode->i_op can be NULL.
++ * This causes null pointer dereference in d_splice_alias().
++ */
++ if (!IS_ERR(inode) && inode->i_op == NULL) {
++ iput(inode);
++ inode = ERR_PTR(-EINVAL);
++ }
++
+ return d_splice_alias(inode, dentry);
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 44750709969d12b735d34434de0266420311fc4e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Dec 2022 09:46:10 +0000
+Subject: fs/ntfs3: Fix OOB read in indx_insert_into_buffer
+
+From: ZhangPeng <zhangpeng362@huawei.com>
+
+[ Upstream commit b8c44949044e5f7f864525fdffe8e95135ce9ce5 ]
+
+Syzbot reported a OOB read bug:
+
+BUG: KASAN: slab-out-of-bounds in indx_insert_into_buffer+0xaa3/0x13b0
+fs/ntfs3/index.c:1755
+Read of size 17168 at addr ffff8880255e06c0 by task syz-executor308/3630
+
+Call Trace:
+ <TASK>
+ memmove+0x25/0x60 mm/kasan/shadow.c:54
+ indx_insert_into_buffer+0xaa3/0x13b0 fs/ntfs3/index.c:1755
+ indx_insert_entry+0x446/0x6b0 fs/ntfs3/index.c:1863
+ ntfs_create_inode+0x1d3f/0x35c0 fs/ntfs3/inode.c:1548
+ ntfs_create+0x3e/0x60 fs/ntfs3/namei.c:100
+ lookup_open fs/namei.c:3413 [inline]
+
+If the member struct INDEX_BUFFER *index of struct indx_node is
+incorrect, that is, the value of __le32 used is greater than the value
+of __le32 total in struct INDEX_HDR. Therefore, OOB read occurs when
+memmove is called in indx_insert_into_buffer().
+Fix this by adding a check in hdr_find_e().
+
+Fixes: 82cae269cfa9 ("fs/ntfs3: Add initialization of super block")
+Reported-by: syzbot+d882d57193079e379309@syzkaller.appspotmail.com
+Signed-off-by: ZhangPeng <zhangpeng362@huawei.com>
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/index.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c
+index 51ab759546403..ae9616becec15 100644
+--- a/fs/ntfs3/index.c
++++ b/fs/ntfs3/index.c
+@@ -725,9 +725,13 @@ static struct NTFS_DE *hdr_find_e(const struct ntfs_index *indx,
+ u32 e_size, e_key_len;
+ u32 end = le32_to_cpu(hdr->used);
+ u32 off = le32_to_cpu(hdr->de_off);
++ u32 total = le32_to_cpu(hdr->total);
+ u16 offs[128];
+
+ fill_table:
++ if (end > total)
++ return NULL;
++
+ if (off + sizeof(struct NTFS_DE) > end)
+ return NULL;
+
+--
+2.39.2
+
--- /dev/null
+From 76061cc1db03e45d0fa102a9cde8442fb436cbe7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Dec 2022 09:31:34 +0800
+Subject: fs/ntfs3: Fix slab-out-of-bounds read in hdr_delete_de()
+
+From: Zeng Heng <zengheng4@huawei.com>
+
+[ Upstream commit ab84eee4c7ab929996602eda7832854c35a6dda2 ]
+
+Here is a BUG report from syzbot:
+
+BUG: KASAN: slab-out-of-bounds in hdr_delete_de+0xe0/0x150 fs/ntfs3/index.c:806
+Read of size 16842960 at addr ffff888079cc0600 by task syz-executor934/3631
+
+Call Trace:
+ memmove+0x25/0x60 mm/kasan/shadow.c:54
+ hdr_delete_de+0xe0/0x150 fs/ntfs3/index.c:806
+ indx_delete_entry+0x74f/0x3670 fs/ntfs3/index.c:2193
+ ni_remove_name+0x27a/0x980 fs/ntfs3/frecord.c:2910
+ ntfs_unlink_inode+0x3d4/0x720 fs/ntfs3/inode.c:1712
+ ntfs_rename+0x41a/0xcb0 fs/ntfs3/namei.c:276
+
+Before using the meta-data in struct INDEX_HDR, we need to
+check index header valid or not. Otherwise, the corruptedi
+(or malicious) fs image can cause out-of-bounds access which
+could make kernel panic.
+
+Fixes: 82cae269cfa9 ("fs/ntfs3: Add initialization of super block")
+Reported-by: syzbot+9c2811fd56591639ff5f@syzkaller.appspotmail.com
+Signed-off-by: Zeng Heng <zengheng4@huawei.com>
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/fslog.c | 2 +-
+ fs/ntfs3/index.c | 4 ++++
+ fs/ntfs3/ntfs_fs.h | 1 +
+ 3 files changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/fs/ntfs3/fslog.c b/fs/ntfs3/fslog.c
+index dc723f03d6bb2..bf73964472845 100644
+--- a/fs/ntfs3/fslog.c
++++ b/fs/ntfs3/fslog.c
+@@ -2575,7 +2575,7 @@ static int read_next_log_rec(struct ntfs_log *log, struct lcb *lcb, u64 *lsn)
+ return find_log_rec(log, *lsn, lcb);
+ }
+
+-static inline bool check_index_header(const struct INDEX_HDR *hdr, size_t bytes)
++bool check_index_header(const struct INDEX_HDR *hdr, size_t bytes)
+ {
+ __le16 mask;
+ u32 min_de, de_off, used, total;
+diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c
+index ae9616becec15..7a1e01a2ed9ae 100644
+--- a/fs/ntfs3/index.c
++++ b/fs/ntfs3/index.c
+@@ -848,6 +848,10 @@ static inline struct NTFS_DE *hdr_delete_de(struct INDEX_HDR *hdr,
+ u32 off = PtrOffset(hdr, re);
+ int bytes = used - (off + esize);
+
++ /* check INDEX_HDR valid before using INDEX_HDR */
++ if (!check_index_header(hdr, le32_to_cpu(hdr->total)))
++ return NULL;
++
+ if (off >= used || esize < sizeof(struct NTFS_DE) ||
+ bytes < sizeof(struct NTFS_DE))
+ return NULL;
+diff --git a/fs/ntfs3/ntfs_fs.h b/fs/ntfs3/ntfs_fs.h
+index 80072e5f96f70..15296f5690b5a 100644
+--- a/fs/ntfs3/ntfs_fs.h
++++ b/fs/ntfs3/ntfs_fs.h
+@@ -581,6 +581,7 @@ int ni_rename(struct ntfs_inode *dir_ni, struct ntfs_inode *new_dir_ni,
+ bool ni_is_dirty(struct inode *inode);
+
+ /* Globals from fslog.c */
++bool check_index_header(const struct INDEX_HDR *hdr, size_t bytes);
+ int log_replay(struct ntfs_inode *ni, bool *initialized);
+
+ /* Globals from fsntfs.c */
+--
+2.39.2
+
--- /dev/null
+From e7591c0e65d0dcdc6903778617da3208d7edd881 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 26 Nov 2022 15:33:15 +0800
+Subject: gpu: host1x: Fix memory leak of device names
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit 55879dad0f3ae8468444b42f785ad79eac05fe5b ]
+
+The device names allocated by dev_set_name() need be freed
+before module unloading, but they can not be freed because
+the kobject's refcount which was set in device_initialize()
+has not be decreased to 0.
+
+As comment of device_add() says, if it fails, use only
+put_device() drop the refcount, then the name will be
+freed in kobejct_cleanup().
+
+device_del() and put_device() can be replaced with
+device_unregister(), so call it to unregister the added
+successfully devices, and just call put_device() to the
+not added device.
+
+Add a release() function to device to avoid null release()
+function WARNING in device_release(), it's empty, because
+the context devices are freed together in
+host1x_memory_context_list_free().
+
+Fixes: 8aa5bcb61612 ("gpu: host1x: Add context device management code")
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Reviewed-by: Mikko Perttunen <mperttunen@nvidia.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/host1x/context.c | 23 +++++++++++++++--------
+ 1 file changed, 15 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/gpu/host1x/context.c b/drivers/gpu/host1x/context.c
+index 5ec18315ff9fe..9ad89d22c0ca7 100644
+--- a/drivers/gpu/host1x/context.c
++++ b/drivers/gpu/host1x/context.c
+@@ -13,6 +13,11 @@
+ #include "context.h"
+ #include "dev.h"
+
++static void host1x_memory_context_release(struct device *dev)
++{
++ /* context device is freed in host1x_memory_context_list_free() */
++}
++
+ int host1x_memory_context_list_init(struct host1x *host1x)
+ {
+ struct host1x_memory_context_list *cdl = &host1x->context_list;
+@@ -51,36 +56,38 @@ int host1x_memory_context_list_init(struct host1x *host1x)
+ dev_set_name(&ctx->dev, "host1x-ctx.%d", i);
+ ctx->dev.bus = &host1x_context_device_bus_type;
+ ctx->dev.parent = host1x->dev;
++ ctx->dev.release = host1x_memory_context_release;
+
+ dma_set_max_seg_size(&ctx->dev, UINT_MAX);
+
+ err = device_add(&ctx->dev);
+ if (err) {
+ dev_err(host1x->dev, "could not add context device %d: %d\n", i, err);
+- goto del_devices;
++ put_device(&ctx->dev);
++ goto unreg_devices;
+ }
+
+ err = of_dma_configure_id(&ctx->dev, node, true, &i);
+ if (err) {
+ dev_err(host1x->dev, "IOMMU configuration failed for context device %d: %d\n",
+ i, err);
+- device_del(&ctx->dev);
+- goto del_devices;
++ device_unregister(&ctx->dev);
++ goto unreg_devices;
+ }
+
+ if (!tegra_dev_iommu_get_stream_id(&ctx->dev, &ctx->stream_id) ||
+ !device_iommu_mapped(&ctx->dev)) {
+ dev_err(host1x->dev, "Context device %d has no IOMMU!\n", i);
+- device_del(&ctx->dev);
+- goto del_devices;
++ device_unregister(&ctx->dev);
++ goto unreg_devices;
+ }
+ }
+
+ return 0;
+
+-del_devices:
++unreg_devices:
+ while (i--)
+- device_del(&cdl->devs[i].dev);
++ device_unregister(&cdl->devs[i].dev);
+
+ kfree(cdl->devs);
+ cdl->devs = NULL;
+@@ -94,7 +101,7 @@ void host1x_memory_context_list_free(struct host1x_memory_context_list *cdl)
+ unsigned int i;
+
+ for (i = 0; i < cdl->len; i++)
+- device_del(&cdl->devs[i].dev);
++ device_unregister(&cdl->devs[i].dev);
+
+ kfree(cdl->devs);
+ cdl->len = 0;
+--
+2.39.2
+
--- /dev/null
+From 76db85afb807d4137cfabbb2545634d131a04694 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 26 Nov 2022 15:33:14 +0800
+Subject: gpu: host1x: Fix potential double free if IOMMU is disabled
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit 8466ff24a37a9a18fb935e90dda64f049131ae28 ]
+
+If context device has no IOMMU, the 'cdl->devs' is freed in
+error path, but host1x_memory_context_list_init() doesn't
+return an error code, so the module can be loaded successfully,
+when it's unloading, the host1x_memory_context_list_free() is
+called in host1x_remove(), it will cause double free. Set the
+'cdl->devs' to NULL after freeing it to avoid double free.
+
+Fixes: 8aa5bcb61612 ("gpu: host1x: Add context device management code")
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Reviewed-by: Mikko Perttunen <mperttunen@nvidia.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/host1x/context.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/host1x/context.c b/drivers/gpu/host1x/context.c
+index 8beedcf080abd..5ec18315ff9fe 100644
+--- a/drivers/gpu/host1x/context.c
++++ b/drivers/gpu/host1x/context.c
+@@ -83,6 +83,7 @@ int host1x_memory_context_list_init(struct host1x *host1x)
+ device_del(&cdl->devs[i].dev);
+
+ kfree(cdl->devs);
++ cdl->devs = NULL;
+ cdl->len = 0;
+
+ return err;
+--
+2.39.2
+
--- /dev/null
+From 6ff86cbeb07ea854d7b2344286907db61d132b77 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Apr 2023 21:40:27 +0530
+Subject: HID: amd_sfh: Add support for shutdown operation
+
+From: Basavaraj Natikar <Basavaraj.Natikar@amd.com>
+
+[ Upstream commit 1353ecaf1830d6d1b74f3225378a9498b4e14fdd ]
+
+As soon as the system is booted after shutdown, the sensors may remain in
+a weird state and fail to initialize. Therefore, all sensors should be
+turned off during shutdown.
+
+Fixes: 4f567b9f8141 ("SFH: PCIe driver to add support of AMD sensor fusion hub")
+Signed-off-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/amd-sfh-hid/amd_sfh_pcie.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/hid/amd-sfh-hid/amd_sfh_pcie.c b/drivers/hid/amd-sfh-hid/amd_sfh_pcie.c
+index 47774b9ab3de0..c936d6a51c0cd 100644
+--- a/drivers/hid/amd-sfh-hid/amd_sfh_pcie.c
++++ b/drivers/hid/amd-sfh-hid/amd_sfh_pcie.c
+@@ -367,6 +367,14 @@ static int amd_mp2_pci_probe(struct pci_dev *pdev, const struct pci_device_id *i
+ return devm_add_action_or_reset(&pdev->dev, privdata->mp2_ops->remove, privdata);
+ }
+
++static void amd_sfh_shutdown(struct pci_dev *pdev)
++{
++ struct amd_mp2_dev *mp2 = pci_get_drvdata(pdev);
++
++ if (mp2 && mp2->mp2_ops)
++ mp2->mp2_ops->stop_all(mp2);
++}
++
+ static int __maybe_unused amd_mp2_pci_resume(struct device *dev)
+ {
+ struct amd_mp2_dev *mp2 = dev_get_drvdata(dev);
+@@ -401,6 +409,7 @@ static struct pci_driver amd_mp2_pci_driver = {
+ .id_table = amd_mp2_pci_tbl,
+ .probe = amd_mp2_pci_probe,
+ .driver.pm = &amd_mp2_pm_ops,
++ .shutdown = amd_sfh_shutdown,
+ };
+ module_pci_driver(amd_mp2_pci_driver);
+
+--
+2.39.2
+
--- /dev/null
+From 092f020a9450bef62e4627a4551b7d2d708c6cf5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Apr 2023 21:40:25 +0530
+Subject: HID: amd_sfh: Correct the sensor enable and disable command
+
+From: Basavaraj Natikar <Basavaraj.Natikar@amd.com>
+
+[ Upstream commit 0b9255bf11baa61cd526e6bd24d6c8e6d1eabf8d ]
+
+In order to start or stop sensors, the firmware command needs to be
+changed to add an additional default subcommand value. For this reason,
+add a subcommand value to enable or disable sensors accordingly.
+
+Fixes: 93ce5e0231d7 ("HID: amd_sfh: Implement SFH1.1 functionality")
+Signed-off-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.c b/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.c
+index c6df959ec7252..6e19ccc124508 100644
+--- a/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.c
++++ b/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.c
+@@ -33,6 +33,7 @@ static void amd_start_sensor(struct amd_mp2_dev *privdata, struct amd_mp2_sensor
+ cmd_base.ul = 0;
+ cmd_base.cmd.cmd_id = ENABLE_SENSOR;
+ cmd_base.cmd.intr_disable = 0;
++ cmd_base.cmd.sub_cmd_value = 1;
+ cmd_base.cmd.sensor_id = info.sensor_idx;
+
+ writel(cmd_base.ul, privdata->mmio + AMD_C2P_MSG(0));
+@@ -45,6 +46,7 @@ static void amd_stop_sensor(struct amd_mp2_dev *privdata, u16 sensor_idx)
+ cmd_base.ul = 0;
+ cmd_base.cmd.cmd_id = DISABLE_SENSOR;
+ cmd_base.cmd.intr_disable = 0;
++ cmd_base.cmd.sub_cmd_value = 1;
+ cmd_base.cmd.sensor_id = sensor_idx;
+
+ writeq(0x0, privdata->mmio + AMD_C2P_MSG(1));
+--
+2.39.2
+
--- /dev/null
+From 1818e2541480619ab89a27debeb693736044d2a0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Apr 2023 21:40:28 +0530
+Subject: HID: amd_sfh: Correct the stop all command
+
+From: Basavaraj Natikar <Basavaraj.Natikar@amd.com>
+
+[ Upstream commit 82c2a0d137794f5ef47982231593a00aee26ce3b ]
+
+Misinterpreted the stop all command in SHF1.1 firmware. Therefore, it is
+necessary to update the stop all command accordingly to disable all
+sensors.
+
+Fixes: 93ce5e0231d7 ("HID: amd_sfh: Implement SFH1.1 functionality")
+Signed-off-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.c b/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.c
+index 6e19ccc124508..6f6047f7f12e9 100644
+--- a/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.c
++++ b/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.c
+@@ -58,8 +58,10 @@ static void amd_stop_all_sensor(struct amd_mp2_dev *privdata)
+ struct sfh_cmd_base cmd_base;
+
+ cmd_base.ul = 0;
+- cmd_base.cmd.cmd_id = STOP_ALL_SENSORS;
++ cmd_base.cmd.cmd_id = DISABLE_SENSOR;
+ cmd_base.cmd.intr_disable = 0;
++ /* 0xf indicates all sensors */
++ cmd_base.cmd.sensor_id = 0xf;
+
+ writel(cmd_base.ul, privdata->mmio + AMD_C2P_MSG(0));
+ }
+--
+2.39.2
+
--- /dev/null
+From e7b06caf6bc69cfc12a310224f1624a2f4171d01 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Apr 2023 21:40:24 +0530
+Subject: HID: amd_sfh: Correct the structure fields
+
+From: Basavaraj Natikar <Basavaraj.Natikar@amd.com>
+
+[ Upstream commit 7e7fdab79899f62de39c9280fb78f3d3b02ac207 ]
+
+Misinterpreted sfh_cmd_base structure member fields. Therefore, adjust
+the structure member fields accordingly to reflect functionality.
+
+Fixes: 93ce5e0231d7 ("HID: amd_sfh: Implement SFH1.1 functionality")
+Signed-off-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.h | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.h b/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.h
+index ae47a369dc05a..a3e0ec289e3f9 100644
+--- a/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.h
++++ b/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.h
+@@ -33,9 +33,9 @@ struct sfh_cmd_base {
+ struct {
+ u32 sensor_id : 4;
+ u32 cmd_id : 4;
+- u32 sub_cmd_id : 6;
+- u32 length : 12;
+- u32 rsvd : 5;
++ u32 sub_cmd_id : 8;
++ u32 sub_cmd_value : 12;
++ u32 rsvd : 3;
+ u32 intr_disable : 1;
+ } cmd;
+ };
+--
+2.39.2
+
--- /dev/null
+From 2ef4972765e57d0295f7f06c60c497e42d6f7ff3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Apr 2023 21:40:26 +0530
+Subject: HID: amd_sfh: Fix illuminance value
+
+From: Basavaraj Natikar <Basavaraj.Natikar@amd.com>
+
+[ Upstream commit a33e5e393171ae8384d3381db5cd159ba877cfcb ]
+
+Illuminance value is actually 32 bits, but is incorrectly trancated to
+16 bits. Hence convert to integer illuminace accordingly to reflect
+correct values.
+
+Fixes: 93ce5e0231d7 ("HID: amd_sfh: Implement SFH1.1 functionality")
+Signed-off-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_desc.c | 2 +-
+ drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.h | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_desc.c b/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_desc.c
+index 0609fea581c96..6f0d332ccf51c 100644
+--- a/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_desc.c
++++ b/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_desc.c
+@@ -218,7 +218,7 @@ static u8 get_input_rep(u8 current_index, int sensor_idx, int report_id,
+ OFFSET_SENSOR_DATA_DEFAULT;
+ memcpy_fromio(&als_data, sensoraddr, sizeof(struct sfh_als_data));
+ get_common_inputs(&als_input.common_property, report_id);
+- als_input.illuminance_value = als_data.lux;
++ als_input.illuminance_value = float_to_int(als_data.lux);
+ report_size = sizeof(als_input);
+ memcpy(input_report, &als_input, sizeof(als_input));
+ break;
+diff --git a/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.h b/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.h
+index a3e0ec289e3f9..9d31d5b510eb4 100644
+--- a/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.h
++++ b/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.h
+@@ -133,7 +133,7 @@ struct sfh_mag_data {
+
+ struct sfh_als_data {
+ struct sfh_common_data commondata;
+- u16 lux;
++ u32 lux;
+ };
+
+ struct hpd_status {
+--
+2.39.2
+
--- /dev/null
+From 32e8d61853bb7fcb765d531fc12d092e83974261 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Apr 2023 21:40:30 +0530
+Subject: HID: amd_sfh: Handle "no sensors" enabled for SFH1.1
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Basavaraj Natikar <Basavaraj.Natikar@amd.com>
+
+[ Upstream commit 8455cbb25927013b3417ab619dced1c0e87708af ]
+
+Based on num_hid_devices, each sensor device is initialized. If
+"no sensors" is initialized, amd_sfh work initialization and scheduling
+doesn’t make sense and returns EOPNOTSUPP to stop driver probe. Hence,
+add a check for "no sensors" enabled to handle the special case.
+
+Fixes: 93ce5e0231d7 ("HID: amd_sfh: Implement SFH1.1 functionality")
+Signed-off-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c b/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c
+index a1d6e08fab7d4..bb8bd7892b674 100644
+--- a/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c
++++ b/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c
+@@ -112,6 +112,7 @@ static int amd_sfh1_1_hid_client_init(struct amd_mp2_dev *privdata)
+ cl_data->num_hid_devices = amd_sfh_get_sensor_num(privdata, &cl_data->sensor_idx[0]);
+ if (cl_data->num_hid_devices == 0)
+ return -ENODEV;
++ cl_data->is_any_sensor_enabled = false;
+
+ INIT_DELAYED_WORK(&cl_data->work, amd_sfh_work);
+ INIT_DELAYED_WORK(&cl_data->work_buffer, amd_sfh_work_buffer);
+@@ -170,6 +171,7 @@ static int amd_sfh1_1_hid_client_init(struct amd_mp2_dev *privdata)
+ status = (status == 0) ? SENSOR_ENABLED : SENSOR_DISABLED;
+
+ if (status == SENSOR_ENABLED) {
++ cl_data->is_any_sensor_enabled = true;
+ cl_data->sensor_sts[i] = SENSOR_ENABLED;
+ rc = amdtp_hid_probe(i, cl_data);
+ if (rc) {
+@@ -186,12 +188,21 @@ static int amd_sfh1_1_hid_client_init(struct amd_mp2_dev *privdata)
+ cl_data->sensor_sts[i]);
+ goto cleanup;
+ }
++ } else {
++ cl_data->sensor_sts[i] = SENSOR_DISABLED;
+ }
+ dev_dbg(dev, "sid 0x%x (%s) status 0x%x\n",
+ cl_data->sensor_idx[i], get_sensor_name(cl_data->sensor_idx[i]),
+ cl_data->sensor_sts[i]);
+ }
+
++ if (!cl_data->is_any_sensor_enabled) {
++ dev_warn(dev, "Failed to discover, sensors not enabled is %d\n",
++ cl_data->is_any_sensor_enabled);
++ rc = -EOPNOTSUPP;
++ goto cleanup;
++ }
++
+ schedule_delayed_work(&cl_data->work_buffer, msecs_to_jiffies(AMD_SFH_IDLE_LOOP));
+ return 0;
+
+--
+2.39.2
+
--- /dev/null
+From 1fcae56a4f88c54afcfb9cf31417e5da208682e6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Apr 2023 21:40:29 +0530
+Subject: HID: amd_sfh: Increase sensor command timeout for SFH1.1
+
+From: Basavaraj Natikar <Basavaraj.Natikar@amd.com>
+
+[ Upstream commit 571dc8f59dd477037bb5a029e8d1b5a4a4d9dd63 ]
+
+The initialization of SFH1.1 sensors may take some time. Hence, increase
+sensor command timeouts in order to obtain status responses within a
+maximum timeout.
+
+Fixes: 93ce5e0231d7 ("HID: amd_sfh: Implement SFH1.1 functionality")
+Signed-off-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.c b/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.c
+index 6f6047f7f12e9..4f81ef2d4f56e 100644
+--- a/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.c
++++ b/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.c
+@@ -16,11 +16,11 @@ static int amd_sfh_wait_response(struct amd_mp2_dev *mp2, u8 sid, u32 cmd_id)
+ {
+ struct sfh_cmd_response cmd_resp;
+
+- /* Get response with status within a max of 1600 ms timeout */
++ /* Get response with status within a max of 10000 ms timeout */
+ if (!readl_poll_timeout(mp2->mmio + AMD_P2C_MSG(0), cmd_resp.resp,
+ (cmd_resp.response.response == 0 &&
+ cmd_resp.response.cmd_id == cmd_id && (sid == 0xff ||
+- cmd_resp.response.sensor_id == sid)), 500, 1600000))
++ cmd_resp.response.sensor_id == sid)), 500, 10000000))
+ return cmd_resp.response.response;
+
+ return -1;
+--
+2.39.2
+
--- /dev/null
+From e03e9722f834bfc6effbd956fa93c4b813aee917 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Apr 2023 17:30:00 +0300
+Subject: hte: tegra-194: Fix off by one in tegra_hte_map_to_line_id()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit e078180d66848a6a890daf0a3ce28dc43cc66790 ]
+
+The "map_sz" is the number of elements in the "m" array so the >
+comparison needs to be changed to >= to prevent an out of bounds
+read.
+
+Fixes: 09574cca6ad6 ("hte: Add Tegra194 HTE kernel provider")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Acked-by: Dipen Patel <dipenp@nvidia.com>
+Signed-off-by: Dipen Patel <dipenp@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hte/hte-tegra194.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hte/hte-tegra194.c b/drivers/hte/hte-tegra194.c
+index 49a27af22742b..d1b579c822797 100644
+--- a/drivers/hte/hte-tegra194.c
++++ b/drivers/hte/hte-tegra194.c
+@@ -251,7 +251,7 @@ static int tegra_hte_map_to_line_id(u32 eid,
+ {
+
+ if (m) {
+- if (eid > map_sz)
++ if (eid >= map_sz)
+ return -EINVAL;
+ if (m[eid].slice == NV_AON_SLICE_INVALID)
+ return -EINVAL;
+--
+2.39.2
+
--- /dev/null
+From 2c2ffb2432893695044a18e96c8938c34e20985a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Dec 2022 17:46:19 +0100
+Subject: hte: tegra: fix 'struct of_device_id' build error
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 6680c835ada1b34e882d0a32612f7294c62e27e0 ]
+
+Without the extra #include, this driver produces a build failure
+in some configurations.
+
+drivers/hte/hte-tegra194-test.c:96:34: error: array type has incomplete element type 'struct of_device_id'
+ 96 | static const struct of_device_id tegra_hte_test_of_match[] = {
+
+Fixes: 9a75a7cd03c9 ("hte: Add Tegra HTE test driver")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Acked-by: Dipen Patel <dipenp@nvidia.com>
+Signed-off-by: Dipen Patel <dipenp@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hte/hte-tegra194-test.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/hte/hte-tegra194-test.c b/drivers/hte/hte-tegra194-test.c
+index 5d776a185bd62..ce8c44e792213 100644
+--- a/drivers/hte/hte-tegra194-test.c
++++ b/drivers/hte/hte-tegra194-test.c
+@@ -6,6 +6,7 @@
+ */
+
+ #include <linux/err.h>
++#include <linux/mod_devicetable.h>
+ #include <linux/module.h>
+ #include <linux/moduleparam.h>
+ #include <linux/interrupt.h>
+--
+2.39.2
+
--- /dev/null
+From 6c3ced8e97909444b7b4cdf79fe3e9e42c6d9695 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Apr 2023 19:19:39 +0200
+Subject: hwmon: (pmbus/fsp-3y) Fix functionality bitmask in FSP-3Y YM-2151E
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Tomáš Pecka <tomas.pecka@cesnet.cz>
+
+[ Upstream commit 93822f5161a2dc57a60b95b35b3cb8589f53413e ]
+
+The bit flags in pmbus_driver_info functionality for YM-2151E chip were
+joined with a comma operator instead of a bitwise OR. This means that
+the last constant PMBUS_HAVE_IIN was not OR-ed with the other
+PM_BUS_HAVE_* constants for this page but it initialized the next element
+of the func array (which was not accessed from anywhere because of the
+number of pages).
+
+However, there is no need for setting PMBUS_HAVE_IIN in the 5Vsb page
+because this command does not seem to be paged. Obviously, the device
+only has one IIN sensor, so it doesn't make sense to query it again from
+the second page.
+
+Fixes: 1734b4135a62 ("hwmon: Add driver for fsp-3y PSUs and PDUs")
+Signed-off-by: Jan Kundrát <jan.kundrat@cesnet.cz>
+Signed-off-by: Tomáš Pecka <tomas.pecka@cesnet.cz>
+Link: https://lore.kernel.org/r/20230420171939.212040-1-tomas.pecka@cesnet.cz
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/pmbus/fsp-3y.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/hwmon/pmbus/fsp-3y.c b/drivers/hwmon/pmbus/fsp-3y.c
+index aec294cc72d1f..c7469d2cdedcf 100644
+--- a/drivers/hwmon/pmbus/fsp-3y.c
++++ b/drivers/hwmon/pmbus/fsp-3y.c
+@@ -180,7 +180,6 @@ static struct pmbus_driver_info fsp3y_info[] = {
+ PMBUS_HAVE_FAN12,
+ .func[YM2151_PAGE_5VSB_LOG] =
+ PMBUS_HAVE_VOUT | PMBUS_HAVE_IOUT,
+- PMBUS_HAVE_IIN,
+ .read_word_data = fsp3y_read_word_data,
+ .read_byte_data = fsp3y_read_byte_data,
+ },
+--
+2.39.2
+
--- /dev/null
+From 6c5394c1ee735e7a84c231b38e527a99803156cd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Apr 2023 19:10:21 -0700
+Subject: i2c: cadence: cdns_i2c_master_xfer(): Fix runtime PM leak on error
+ path
+
+From: Lars-Peter Clausen <lars@metafoo.de>
+
+[ Upstream commit ae1664f04f504a998737f5bb563f16b44357bcca ]
+
+The cdns_i2c_master_xfer() function gets a runtime PM reference when the
+function is entered. This reference is released when the function is
+exited. There is currently one error path where the function exits
+directly, which leads to a leak of the runtime PM reference.
+
+Make sure that this error path also releases the runtime PM reference.
+
+Fixes: 1a351b10b967 ("i2c: cadence: Added slave support")
+Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
+Reviewed-by: Michal Simek <michal.simek@amd.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-cadence.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-cadence.c b/drivers/i2c/busses/i2c-cadence.c
+index b5d22e7282c22..982c207d473b7 100644
+--- a/drivers/i2c/busses/i2c-cadence.c
++++ b/drivers/i2c/busses/i2c-cadence.c
+@@ -827,8 +827,10 @@ static int cdns_i2c_master_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs,
+ #if IS_ENABLED(CONFIG_I2C_SLAVE)
+ /* Check i2c operating mode and switch if possible */
+ if (id->dev_mode == CDNS_I2C_MODE_SLAVE) {
+- if (id->slave_state != CDNS_I2C_SLAVE_STATE_IDLE)
+- return -EAGAIN;
++ if (id->slave_state != CDNS_I2C_SLAVE_STATE_IDLE) {
++ ret = -EAGAIN;
++ goto out;
++ }
+
+ /* Set mode to master */
+ cdns_i2c_set_mode(CDNS_I2C_MODE_MASTER, id);
+--
+2.39.2
+
--- /dev/null
+From 5852067557fe17f6f32c047081618559baf9cf77 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Apr 2023 19:10:22 -0700
+Subject: i2c: xiic: xiic_xfer(): Fix runtime PM leak on error path
+
+From: Lars-Peter Clausen <lars@metafoo.de>
+
+[ Upstream commit d663d93bb47e7ab45602b227701022d8aa16040a ]
+
+The xiic_xfer() function gets a runtime PM reference when the function is
+entered. This reference is released when the function is exited. There is
+currently one error path where the function exits directly, which leads to
+a leak of the runtime PM reference.
+
+Make sure that this error path also releases the runtime PM reference.
+
+Fixes: fdacc3c7405d ("i2c: xiic: Switch from waitqueue to completion")
+Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
+Reviewed-by: Michal Simek <michal.simek@amd.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-xiic.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/i2c/busses/i2c-xiic.c b/drivers/i2c/busses/i2c-xiic.c
+index dbb792fc197ec..3b94b07cb37a6 100644
+--- a/drivers/i2c/busses/i2c-xiic.c
++++ b/drivers/i2c/busses/i2c-xiic.c
+@@ -1164,7 +1164,7 @@ static int xiic_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num)
+ err = xiic_start_xfer(i2c, msgs, num);
+ if (err < 0) {
+ dev_err(adap->dev.parent, "Error xiic_start_xfer\n");
+- return err;
++ goto out;
+ }
+
+ err = wait_for_completion_timeout(&i2c->completion, XIIC_XFER_TIMEOUT);
+@@ -1178,6 +1178,8 @@ static int xiic_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num)
+ err = (i2c->state == STATE_DONE) ? num : -EIO;
+ }
+ mutex_unlock(&i2c->lock);
++
++out:
+ pm_runtime_mark_last_busy(i2c->dev);
+ pm_runtime_put_autosuspend(i2c->dev);
+ return err;
+--
+2.39.2
+
--- /dev/null
+From 3eaa5ec8c81d4edf7fdbe35669184a38f1ee1ce1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Feb 2023 19:42:58 -0800
+Subject: ia64: mm/contig: fix section mismatch warning/error
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 58deeb4ef3b054498747d0929d94ac53ab90981f ]
+
+alloc_per_cpu_data() is called by find_memory(), which is marked as
+__init. Therefore alloc_per_cpu_data() can also be marked as __init to
+remedy this modpost problem.
+
+WARNING: modpost: vmlinux.o: section mismatch in reference: alloc_per_cpu_data (section: .text) -> memblock_alloc_try_nid (section: .init.text)
+
+Link: https://lkml.kernel.org/r/20230223034258.12917-1-rdunlap@infradead.org
+Fixes: 4b9ddc7cf272 ("[IA64] Fix section mismatch in contig.c version of per_cpu_init()")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Cc: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/ia64/mm/contig.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/ia64/mm/contig.c b/arch/ia64/mm/contig.c
+index 24901d8093015..1e9eaa107eb73 100644
+--- a/arch/ia64/mm/contig.c
++++ b/arch/ia64/mm/contig.c
+@@ -77,7 +77,7 @@ void *per_cpu_init(void)
+ return __per_cpu_start + __per_cpu_offset[smp_processor_id()];
+ }
+
+-static inline void
++static inline __init void
+ alloc_per_cpu_data(void)
+ {
+ size_t size = PERCPU_PAGE_SIZE * num_possible_cpus();
+--
+2.39.2
+
--- /dev/null
+From 6f20d32936d16332efebc44cb28abadcce1d5db4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Feb 2023 19:43:09 -0800
+Subject: ia64: salinfo: placate defined-but-not-used warning
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 0de155752b152d6bcd96b5b5bf20af336abd183a ]
+
+When CONFIG_PROC_FS is not set, proc_salinfo_show() is not used. Mark the
+function as __maybe_unused to quieten the warning message.
+
+../arch/ia64/kernel/salinfo.c:584:12: warning: 'proc_salinfo_show' defined but not used [-Wunused-function]
+ 584 | static int proc_salinfo_show(struct seq_file *m, void *v)
+ | ^~~~~~~~~~~~~~~~~
+
+Link: https://lkml.kernel.org/r/20230223034309.13375-1-rdunlap@infradead.org
+Fixes: 3f3942aca6da ("proc: introduce proc_create_single{,_data}")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Cc: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/ia64/kernel/salinfo.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/ia64/kernel/salinfo.c b/arch/ia64/kernel/salinfo.c
+index bd3ba276e69c3..03b632c568995 100644
+--- a/arch/ia64/kernel/salinfo.c
++++ b/arch/ia64/kernel/salinfo.c
+@@ -581,7 +581,7 @@ static int salinfo_cpu_pre_down(unsigned int cpu)
+ * 'data' contains an integer that corresponds to the feature we're
+ * testing
+ */
+-static int proc_salinfo_show(struct seq_file *m, void *v)
++static int __maybe_unused proc_salinfo_show(struct seq_file *m, void *v)
+ {
+ unsigned long data = (unsigned long)v;
+ seq_puts(m, (sal_platform_features & data) ? "1\n" : "0\n");
+--
+2.39.2
+
--- /dev/null
+From d02c25114f8c51e39601ef8ebeb26d1a39e570f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Apr 2023 12:52:44 -0400
+Subject: IB/hfi1: Fix bugs with non-PAGE_SIZE-end multi-iovec user SDMA
+ requests
+
+From: Patrick Kelsey <pat.kelsey@cornelisnetworks.com>
+
+[ Upstream commit 00cbce5cbf88459cd1aa1d60d0f1df15477df127 ]
+
+hfi1 user SDMA request processing has two bugs that can cause data
+corruption for user SDMA requests that have multiple payload iovecs
+where an iovec other than the tail iovec does not run up to the page
+boundary for the buffer pointed to by that iovec.a
+
+Here are the specific bugs:
+1. user_sdma_txadd() does not use struct user_sdma_iovec->iov.iov_len.
+ Rather, user_sdma_txadd() will add up to PAGE_SIZE bytes from iovec
+ to the packet, even if some of those bytes are past
+ iovec->iov.iov_len and are thus not intended to be in the packet.
+2. user_sdma_txadd() and user_sdma_send_pkts() fail to advance to the
+ next iovec in user_sdma_request->iovs when the current iovec
+ is not PAGE_SIZE and does not contain enough data to complete the
+ packet. The transmitted packet will contain the wrong data from the
+ iovec pages.
+
+This has not been an issue with SDMA packets from hfi1 Verbs or PSM2
+because they only produce iovecs that end short of PAGE_SIZE as the tail
+iovec of an SDMA request.
+
+Fixing these bugs exposes other bugs with the SDMA pin cache
+(struct mmu_rb_handler) that get in way of supporting user SDMA requests
+with multiple payload iovecs whose buffers do not end at PAGE_SIZE. So
+this commit fixes those issues as well.
+
+Here are the mmu_rb_handler bugs that non-PAGE_SIZE-end multi-iovec
+payload user SDMA requests can hit:
+1. Overlapping memory ranges in mmu_rb_handler will result in duplicate
+ pinnings.
+2. When extending an existing mmu_rb_handler entry (struct mmu_rb_node),
+ the mmu_rb code (1) removes the existing entry under a lock, (2)
+ releases that lock, pins the new pages, (3) then reacquires the lock
+ to insert the extended mmu_rb_node.
+
+ If someone else comes in and inserts an overlapping entry between (2)
+ and (3), insert in (3) will fail.
+
+ The failure path code in this case unpins _all_ pages in either the
+ original mmu_rb_node or the new mmu_rb_node that was inserted between
+ (2) and (3).
+3. In hfi1_mmu_rb_remove_unless_exact(), mmu_rb_node->refcount is
+ incremented outside of mmu_rb_handler->lock. As a result, mmu_rb_node
+ could be evicted by another thread that gets mmu_rb_handler->lock and
+ checks mmu_rb_node->refcount before mmu_rb_node->refcount is
+ incremented.
+4. Related to #2 above, SDMA request submission failure path does not
+ check mmu_rb_node->refcount before freeing mmu_rb_node object.
+
+ If there are other SDMA requests in progress whose iovecs have
+ pointers to the now-freed mmu_rb_node(s), those pointers to the
+ now-freed mmu_rb nodes will be dereferenced when those SDMA requests
+ complete.
+
+Fixes: 7be85676f1d1 ("IB/hfi1: Don't remove RB entry when not needed.")
+Fixes: 7724105686e7 ("IB/hfi1: add driver files")
+Signed-off-by: Brendan Cunningham <bcunningham@cornelisnetworks.com>
+Signed-off-by: Patrick Kelsey <pat.kelsey@cornelisnetworks.com>
+Signed-off-by: Dennis Dalessandro <dennis.dalessandro@cornelisnetworks.com>
+Link: https://lore.kernel.org/r/168088636445.3027109.10054635277810177889.stgit@252.162.96.66.static.eigbox.net
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hfi1/ipoib_tx.c | 1 +
+ drivers/infiniband/hw/hfi1/mmu_rb.c | 66 +--
+ drivers/infiniband/hw/hfi1/mmu_rb.h | 8 +-
+ drivers/infiniband/hw/hfi1/sdma.c | 21 +-
+ drivers/infiniband/hw/hfi1/sdma.h | 16 +-
+ drivers/infiniband/hw/hfi1/sdma_txreq.h | 1 +
+ drivers/infiniband/hw/hfi1/trace_mmu.h | 4 -
+ drivers/infiniband/hw/hfi1/user_sdma.c | 600 +++++++++++++++---------
+ drivers/infiniband/hw/hfi1/user_sdma.h | 5 -
+ drivers/infiniband/hw/hfi1/verbs.c | 4 +-
+ drivers/infiniband/hw/hfi1/vnic_sdma.c | 1 +
+ 11 files changed, 423 insertions(+), 304 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hfi1/ipoib_tx.c b/drivers/infiniband/hw/hfi1/ipoib_tx.c
+index 349eb41391368..8973a081d641e 100644
+--- a/drivers/infiniband/hw/hfi1/ipoib_tx.c
++++ b/drivers/infiniband/hw/hfi1/ipoib_tx.c
+@@ -215,6 +215,7 @@ static int hfi1_ipoib_build_ulp_payload(struct ipoib_txreq *tx,
+ const skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
+
+ ret = sdma_txadd_page(dd,
++ NULL,
+ txreq,
+ skb_frag_page(frag),
+ frag->bv_offset,
+diff --git a/drivers/infiniband/hw/hfi1/mmu_rb.c b/drivers/infiniband/hw/hfi1/mmu_rb.c
+index af46ff2033426..71b9ac0188875 100644
+--- a/drivers/infiniband/hw/hfi1/mmu_rb.c
++++ b/drivers/infiniband/hw/hfi1/mmu_rb.c
+@@ -126,7 +126,7 @@ int hfi1_mmu_rb_insert(struct mmu_rb_handler *handler,
+ spin_lock_irqsave(&handler->lock, flags);
+ node = __mmu_rb_search(handler, mnode->addr, mnode->len);
+ if (node) {
+- ret = -EINVAL;
++ ret = -EEXIST;
+ goto unlock;
+ }
+ __mmu_int_rb_insert(mnode, &handler->root);
+@@ -143,6 +143,19 @@ int hfi1_mmu_rb_insert(struct mmu_rb_handler *handler,
+ return ret;
+ }
+
++/* Caller must hold handler lock */
++struct mmu_rb_node *hfi1_mmu_rb_get_first(struct mmu_rb_handler *handler,
++ unsigned long addr, unsigned long len)
++{
++ struct mmu_rb_node *node;
++
++ trace_hfi1_mmu_rb_search(addr, len);
++ node = __mmu_int_rb_iter_first(&handler->root, addr, (addr + len) - 1);
++ if (node)
++ list_move_tail(&node->list, &handler->lru_list);
++ return node;
++}
++
+ /* Caller must hold handler lock */
+ static struct mmu_rb_node *__mmu_rb_search(struct mmu_rb_handler *handler,
+ unsigned long addr,
+@@ -167,34 +180,6 @@ static struct mmu_rb_node *__mmu_rb_search(struct mmu_rb_handler *handler,
+ return node;
+ }
+
+-bool hfi1_mmu_rb_remove_unless_exact(struct mmu_rb_handler *handler,
+- unsigned long addr, unsigned long len,
+- struct mmu_rb_node **rb_node)
+-{
+- struct mmu_rb_node *node;
+- unsigned long flags;
+- bool ret = false;
+-
+- if (current->mm != handler->mn.mm)
+- return ret;
+-
+- spin_lock_irqsave(&handler->lock, flags);
+- node = __mmu_rb_search(handler, addr, len);
+- if (node) {
+- if (node->addr == addr && node->len == len) {
+- list_move_tail(&node->list, &handler->lru_list);
+- goto unlock;
+- }
+- __mmu_int_rb_remove(node, &handler->root);
+- list_del(&node->list); /* remove from LRU list */
+- ret = true;
+- }
+-unlock:
+- spin_unlock_irqrestore(&handler->lock, flags);
+- *rb_node = node;
+- return ret;
+-}
+-
+ void hfi1_mmu_rb_evict(struct mmu_rb_handler *handler, void *evict_arg)
+ {
+ struct mmu_rb_node *rbnode, *ptr;
+@@ -225,29 +210,6 @@ void hfi1_mmu_rb_evict(struct mmu_rb_handler *handler, void *evict_arg)
+ }
+ }
+
+-/*
+- * It is up to the caller to ensure that this function does not race with the
+- * mmu invalidate notifier which may be calling the users remove callback on
+- * 'node'.
+- */
+-void hfi1_mmu_rb_remove(struct mmu_rb_handler *handler,
+- struct mmu_rb_node *node)
+-{
+- unsigned long flags;
+-
+- if (current->mm != handler->mn.mm)
+- return;
+-
+- /* Validity of handler and node pointers has been checked by caller. */
+- trace_hfi1_mmu_rb_remove(node->addr, node->len);
+- spin_lock_irqsave(&handler->lock, flags);
+- __mmu_int_rb_remove(node, &handler->root);
+- list_del(&node->list); /* remove from LRU list */
+- spin_unlock_irqrestore(&handler->lock, flags);
+-
+- handler->ops->remove(handler->ops_arg, node);
+-}
+-
+ static int mmu_notifier_range_start(struct mmu_notifier *mn,
+ const struct mmu_notifier_range *range)
+ {
+diff --git a/drivers/infiniband/hw/hfi1/mmu_rb.h b/drivers/infiniband/hw/hfi1/mmu_rb.h
+index 7417be2b9dc8a..ed75acdb7b839 100644
+--- a/drivers/infiniband/hw/hfi1/mmu_rb.h
++++ b/drivers/infiniband/hw/hfi1/mmu_rb.h
+@@ -52,10 +52,8 @@ void hfi1_mmu_rb_unregister(struct mmu_rb_handler *handler);
+ int hfi1_mmu_rb_insert(struct mmu_rb_handler *handler,
+ struct mmu_rb_node *mnode);
+ void hfi1_mmu_rb_evict(struct mmu_rb_handler *handler, void *evict_arg);
+-void hfi1_mmu_rb_remove(struct mmu_rb_handler *handler,
+- struct mmu_rb_node *mnode);
+-bool hfi1_mmu_rb_remove_unless_exact(struct mmu_rb_handler *handler,
+- unsigned long addr, unsigned long len,
+- struct mmu_rb_node **rb_node);
++struct mmu_rb_node *hfi1_mmu_rb_get_first(struct mmu_rb_handler *handler,
++ unsigned long addr,
++ unsigned long len);
+
+ #endif /* _HFI1_MMU_RB_H */
+diff --git a/drivers/infiniband/hw/hfi1/sdma.c b/drivers/infiniband/hw/hfi1/sdma.c
+index 8ed20392e9f0d..bb2552dd29c1e 100644
+--- a/drivers/infiniband/hw/hfi1/sdma.c
++++ b/drivers/infiniband/hw/hfi1/sdma.c
+@@ -1593,22 +1593,7 @@ static inline void sdma_unmap_desc(
+ struct hfi1_devdata *dd,
+ struct sdma_desc *descp)
+ {
+- switch (sdma_mapping_type(descp)) {
+- case SDMA_MAP_SINGLE:
+- dma_unmap_single(
+- &dd->pcidev->dev,
+- sdma_mapping_addr(descp),
+- sdma_mapping_len(descp),
+- DMA_TO_DEVICE);
+- break;
+- case SDMA_MAP_PAGE:
+- dma_unmap_page(
+- &dd->pcidev->dev,
+- sdma_mapping_addr(descp),
+- sdma_mapping_len(descp),
+- DMA_TO_DEVICE);
+- break;
+- }
++ system_descriptor_complete(dd, descp);
+ }
+
+ /*
+@@ -3128,7 +3113,7 @@ int ext_coal_sdma_tx_descs(struct hfi1_devdata *dd, struct sdma_txreq *tx,
+
+ /* Add descriptor for coalesce buffer */
+ tx->desc_limit = MAX_DESC;
+- return _sdma_txadd_daddr(dd, SDMA_MAP_SINGLE, tx,
++ return _sdma_txadd_daddr(dd, SDMA_MAP_SINGLE, NULL, tx,
+ addr, tx->tlen);
+ }
+
+@@ -3167,10 +3152,12 @@ int _pad_sdma_tx_descs(struct hfi1_devdata *dd, struct sdma_txreq *tx)
+ return rval;
+ }
+ }
++
+ /* finish the one just added */
+ make_tx_sdma_desc(
+ tx,
+ SDMA_MAP_NONE,
++ NULL,
+ dd->sdma_pad_phys,
+ sizeof(u32) - (tx->packet_len & (sizeof(u32) - 1)));
+ tx->num_desc++;
+diff --git a/drivers/infiniband/hw/hfi1/sdma.h b/drivers/infiniband/hw/hfi1/sdma.h
+index b023fc461bd51..95aaec14c6c28 100644
+--- a/drivers/infiniband/hw/hfi1/sdma.h
++++ b/drivers/infiniband/hw/hfi1/sdma.h
+@@ -594,6 +594,7 @@ static inline dma_addr_t sdma_mapping_addr(struct sdma_desc *d)
+ static inline void make_tx_sdma_desc(
+ struct sdma_txreq *tx,
+ int type,
++ void *pinning_ctx,
+ dma_addr_t addr,
+ size_t len)
+ {
+@@ -612,6 +613,7 @@ static inline void make_tx_sdma_desc(
+ << SDMA_DESC0_PHY_ADDR_SHIFT) |
+ (((u64)len & SDMA_DESC0_BYTE_COUNT_MASK)
+ << SDMA_DESC0_BYTE_COUNT_SHIFT);
++ desc->pinning_ctx = pinning_ctx;
+ }
+
+ /* helper to extend txreq */
+@@ -643,6 +645,7 @@ static inline void _sdma_close_tx(struct hfi1_devdata *dd,
+ static inline int _sdma_txadd_daddr(
+ struct hfi1_devdata *dd,
+ int type,
++ void *pinning_ctx,
+ struct sdma_txreq *tx,
+ dma_addr_t addr,
+ u16 len)
+@@ -652,6 +655,7 @@ static inline int _sdma_txadd_daddr(
+ make_tx_sdma_desc(
+ tx,
+ type,
++ pinning_ctx,
+ addr, len);
+ WARN_ON(len > tx->tlen);
+ tx->num_desc++;
+@@ -672,6 +676,7 @@ static inline int _sdma_txadd_daddr(
+ /**
+ * sdma_txadd_page() - add a page to the sdma_txreq
+ * @dd: the device to use for mapping
++ * @pinning_ctx: context to be released at descriptor retirement
+ * @tx: tx request to which the page is added
+ * @page: page to map
+ * @offset: offset within the page
+@@ -687,6 +692,7 @@ static inline int _sdma_txadd_daddr(
+ */
+ static inline int sdma_txadd_page(
+ struct hfi1_devdata *dd,
++ void *pinning_ctx,
+ struct sdma_txreq *tx,
+ struct page *page,
+ unsigned long offset,
+@@ -714,8 +720,7 @@ static inline int sdma_txadd_page(
+ return -ENOSPC;
+ }
+
+- return _sdma_txadd_daddr(
+- dd, SDMA_MAP_PAGE, tx, addr, len);
++ return _sdma_txadd_daddr(dd, SDMA_MAP_PAGE, pinning_ctx, tx, addr, len);
+ }
+
+ /**
+@@ -749,7 +754,8 @@ static inline int sdma_txadd_daddr(
+ return rval;
+ }
+
+- return _sdma_txadd_daddr(dd, SDMA_MAP_NONE, tx, addr, len);
++ return _sdma_txadd_daddr(dd, SDMA_MAP_NONE, NULL, tx,
++ addr, len);
+ }
+
+ /**
+@@ -795,8 +801,7 @@ static inline int sdma_txadd_kvaddr(
+ return -ENOSPC;
+ }
+
+- return _sdma_txadd_daddr(
+- dd, SDMA_MAP_SINGLE, tx, addr, len);
++ return _sdma_txadd_daddr(dd, SDMA_MAP_SINGLE, NULL, tx, addr, len);
+ }
+
+ struct iowait_work;
+@@ -1030,4 +1035,5 @@ extern uint mod_num_sdma;
+
+ void sdma_update_lmc(struct hfi1_devdata *dd, u64 mask, u32 lid);
+
++void system_descriptor_complete(struct hfi1_devdata *dd, struct sdma_desc *descp);
+ #endif
+diff --git a/drivers/infiniband/hw/hfi1/sdma_txreq.h b/drivers/infiniband/hw/hfi1/sdma_txreq.h
+index e262fb5c5ec61..fad946cb5e0d8 100644
+--- a/drivers/infiniband/hw/hfi1/sdma_txreq.h
++++ b/drivers/infiniband/hw/hfi1/sdma_txreq.h
+@@ -19,6 +19,7 @@
+ struct sdma_desc {
+ /* private: don't use directly */
+ u64 qw[2];
++ void *pinning_ctx;
+ };
+
+ /**
+diff --git a/drivers/infiniband/hw/hfi1/trace_mmu.h b/drivers/infiniband/hw/hfi1/trace_mmu.h
+index 187e9244fe5ed..57900ebb7702e 100644
+--- a/drivers/infiniband/hw/hfi1/trace_mmu.h
++++ b/drivers/infiniband/hw/hfi1/trace_mmu.h
+@@ -37,10 +37,6 @@ DEFINE_EVENT(hfi1_mmu_rb_template, hfi1_mmu_rb_search,
+ TP_PROTO(unsigned long addr, unsigned long len),
+ TP_ARGS(addr, len));
+
+-DEFINE_EVENT(hfi1_mmu_rb_template, hfi1_mmu_rb_remove,
+- TP_PROTO(unsigned long addr, unsigned long len),
+- TP_ARGS(addr, len));
+-
+ DEFINE_EVENT(hfi1_mmu_rb_template, hfi1_mmu_mem_invalidate,
+ TP_PROTO(unsigned long addr, unsigned long len),
+ TP_ARGS(addr, len));
+diff --git a/drivers/infiniband/hw/hfi1/user_sdma.c b/drivers/infiniband/hw/hfi1/user_sdma.c
+index a71c5a36cebab..ae58b48afe074 100644
+--- a/drivers/infiniband/hw/hfi1/user_sdma.c
++++ b/drivers/infiniband/hw/hfi1/user_sdma.c
+@@ -24,7 +24,6 @@
+
+ #include "hfi.h"
+ #include "sdma.h"
+-#include "mmu_rb.h"
+ #include "user_sdma.h"
+ #include "verbs.h" /* for the headers */
+ #include "common.h" /* for struct hfi1_tid_info */
+@@ -39,11 +38,7 @@ static unsigned initial_pkt_count = 8;
+ static int user_sdma_send_pkts(struct user_sdma_request *req, u16 maxpkts);
+ static void user_sdma_txreq_cb(struct sdma_txreq *txreq, int status);
+ static inline void pq_update(struct hfi1_user_sdma_pkt_q *pq);
+-static void user_sdma_free_request(struct user_sdma_request *req, bool unpin);
+-static int pin_vector_pages(struct user_sdma_request *req,
+- struct user_sdma_iovec *iovec);
+-static void unpin_vector_pages(struct mm_struct *mm, struct page **pages,
+- unsigned start, unsigned npages);
++static void user_sdma_free_request(struct user_sdma_request *req);
+ static int check_header_template(struct user_sdma_request *req,
+ struct hfi1_pkt_header *hdr, u32 lrhlen,
+ u32 datalen);
+@@ -81,6 +76,11 @@ static struct mmu_rb_ops sdma_rb_ops = {
+ .invalidate = sdma_rb_invalidate
+ };
+
++static int add_system_pages_to_sdma_packet(struct user_sdma_request *req,
++ struct user_sdma_txreq *tx,
++ struct user_sdma_iovec *iovec,
++ u32 *pkt_remaining);
++
+ static int defer_packet_queue(
+ struct sdma_engine *sde,
+ struct iowait_work *wait,
+@@ -410,6 +410,7 @@ int hfi1_user_sdma_process_request(struct hfi1_filedata *fd,
+ ret = -EINVAL;
+ goto free_req;
+ }
++
+ /* Copy the header from the user buffer */
+ ret = copy_from_user(&req->hdr, iovec[idx].iov_base + sizeof(info),
+ sizeof(req->hdr));
+@@ -484,9 +485,8 @@ int hfi1_user_sdma_process_request(struct hfi1_filedata *fd,
+ memcpy(&req->iovs[i].iov,
+ iovec + idx++,
+ sizeof(req->iovs[i].iov));
+- ret = pin_vector_pages(req, &req->iovs[i]);
+- if (ret) {
+- req->data_iovs = i;
++ if (req->iovs[i].iov.iov_len == 0) {
++ ret = -EINVAL;
+ goto free_req;
+ }
+ req->data_len += req->iovs[i].iov.iov_len;
+@@ -584,7 +584,7 @@ int hfi1_user_sdma_process_request(struct hfi1_filedata *fd,
+ if (req->seqsubmitted)
+ wait_event(pq->busy.wait_dma,
+ (req->seqcomp == req->seqsubmitted - 1));
+- user_sdma_free_request(req, true);
++ user_sdma_free_request(req);
+ pq_update(pq);
+ set_comp_state(pq, cq, info.comp_idx, ERROR, ret);
+ }
+@@ -696,48 +696,6 @@ static int user_sdma_txadd_ahg(struct user_sdma_request *req,
+ return ret;
+ }
+
+-static int user_sdma_txadd(struct user_sdma_request *req,
+- struct user_sdma_txreq *tx,
+- struct user_sdma_iovec *iovec, u32 datalen,
+- u32 *queued_ptr, u32 *data_sent_ptr,
+- u64 *iov_offset_ptr)
+-{
+- int ret;
+- unsigned int pageidx, len;
+- unsigned long base, offset;
+- u64 iov_offset = *iov_offset_ptr;
+- u32 queued = *queued_ptr, data_sent = *data_sent_ptr;
+- struct hfi1_user_sdma_pkt_q *pq = req->pq;
+-
+- base = (unsigned long)iovec->iov.iov_base;
+- offset = offset_in_page(base + iovec->offset + iov_offset);
+- pageidx = (((iovec->offset + iov_offset + base) - (base & PAGE_MASK)) >>
+- PAGE_SHIFT);
+- len = offset + req->info.fragsize > PAGE_SIZE ?
+- PAGE_SIZE - offset : req->info.fragsize;
+- len = min((datalen - queued), len);
+- ret = sdma_txadd_page(pq->dd, &tx->txreq, iovec->pages[pageidx],
+- offset, len);
+- if (ret) {
+- SDMA_DBG(req, "SDMA txreq add page failed %d\n", ret);
+- return ret;
+- }
+- iov_offset += len;
+- queued += len;
+- data_sent += len;
+- if (unlikely(queued < datalen && pageidx == iovec->npages &&
+- req->iov_idx < req->data_iovs - 1)) {
+- iovec->offset += iov_offset;
+- iovec = &req->iovs[++req->iov_idx];
+- iov_offset = 0;
+- }
+-
+- *queued_ptr = queued;
+- *data_sent_ptr = data_sent;
+- *iov_offset_ptr = iov_offset;
+- return ret;
+-}
+-
+ static int user_sdma_send_pkts(struct user_sdma_request *req, u16 maxpkts)
+ {
+ int ret = 0;
+@@ -769,8 +727,7 @@ static int user_sdma_send_pkts(struct user_sdma_request *req, u16 maxpkts)
+ maxpkts = req->info.npkts - req->seqnum;
+
+ while (npkts < maxpkts) {
+- u32 datalen = 0, queued = 0, data_sent = 0;
+- u64 iov_offset = 0;
++ u32 datalen = 0;
+
+ /*
+ * Check whether any of the completions have come back
+@@ -863,27 +820,17 @@ static int user_sdma_send_pkts(struct user_sdma_request *req, u16 maxpkts)
+ goto free_txreq;
+ }
+
+- /*
+- * If the request contains any data vectors, add up to
+- * fragsize bytes to the descriptor.
+- */
+- while (queued < datalen &&
+- (req->sent + data_sent) < req->data_len) {
+- ret = user_sdma_txadd(req, tx, iovec, datalen,
+- &queued, &data_sent, &iov_offset);
+- if (ret)
+- goto free_txreq;
+- }
+- /*
+- * The txreq was submitted successfully so we can update
+- * the counters.
+- */
+ req->koffset += datalen;
+ if (req_opcode(req->info.ctrl) == EXPECTED)
+ req->tidoffset += datalen;
+- req->sent += data_sent;
+- if (req->data_len)
+- iovec->offset += iov_offset;
++ req->sent += datalen;
++ while (datalen) {
++ ret = add_system_pages_to_sdma_packet(req, tx, iovec,
++ &datalen);
++ if (ret)
++ goto free_txreq;
++ iovec = &req->iovs[req->iov_idx];
++ }
+ list_add_tail(&tx->txreq.list, &req->txps);
+ /*
+ * It is important to increment this here as it is used to
+@@ -920,133 +867,14 @@ static int user_sdma_send_pkts(struct user_sdma_request *req, u16 maxpkts)
+ static u32 sdma_cache_evict(struct hfi1_user_sdma_pkt_q *pq, u32 npages)
+ {
+ struct evict_data evict_data;
++ struct mmu_rb_handler *handler = pq->handler;
+
+ evict_data.cleared = 0;
+ evict_data.target = npages;
+- hfi1_mmu_rb_evict(pq->handler, &evict_data);
++ hfi1_mmu_rb_evict(handler, &evict_data);
+ return evict_data.cleared;
+ }
+
+-static int pin_sdma_pages(struct user_sdma_request *req,
+- struct user_sdma_iovec *iovec,
+- struct sdma_mmu_node *node,
+- int npages)
+-{
+- int pinned, cleared;
+- struct page **pages;
+- struct hfi1_user_sdma_pkt_q *pq = req->pq;
+-
+- pages = kcalloc(npages, sizeof(*pages), GFP_KERNEL);
+- if (!pages)
+- return -ENOMEM;
+- memcpy(pages, node->pages, node->npages * sizeof(*pages));
+-
+- npages -= node->npages;
+-retry:
+- if (!hfi1_can_pin_pages(pq->dd, current->mm,
+- atomic_read(&pq->n_locked), npages)) {
+- cleared = sdma_cache_evict(pq, npages);
+- if (cleared >= npages)
+- goto retry;
+- }
+- pinned = hfi1_acquire_user_pages(current->mm,
+- ((unsigned long)iovec->iov.iov_base +
+- (node->npages * PAGE_SIZE)), npages, 0,
+- pages + node->npages);
+- if (pinned < 0) {
+- kfree(pages);
+- return pinned;
+- }
+- if (pinned != npages) {
+- unpin_vector_pages(current->mm, pages, node->npages, pinned);
+- return -EFAULT;
+- }
+- kfree(node->pages);
+- node->rb.len = iovec->iov.iov_len;
+- node->pages = pages;
+- atomic_add(pinned, &pq->n_locked);
+- return pinned;
+-}
+-
+-static void unpin_sdma_pages(struct sdma_mmu_node *node)
+-{
+- if (node->npages) {
+- unpin_vector_pages(mm_from_sdma_node(node), node->pages, 0,
+- node->npages);
+- atomic_sub(node->npages, &node->pq->n_locked);
+- }
+-}
+-
+-static int pin_vector_pages(struct user_sdma_request *req,
+- struct user_sdma_iovec *iovec)
+-{
+- int ret = 0, pinned, npages;
+- struct hfi1_user_sdma_pkt_q *pq = req->pq;
+- struct sdma_mmu_node *node = NULL;
+- struct mmu_rb_node *rb_node;
+- struct iovec *iov;
+- bool extracted;
+-
+- extracted =
+- hfi1_mmu_rb_remove_unless_exact(pq->handler,
+- (unsigned long)
+- iovec->iov.iov_base,
+- iovec->iov.iov_len, &rb_node);
+- if (rb_node) {
+- node = container_of(rb_node, struct sdma_mmu_node, rb);
+- if (!extracted) {
+- atomic_inc(&node->refcount);
+- iovec->pages = node->pages;
+- iovec->npages = node->npages;
+- iovec->node = node;
+- return 0;
+- }
+- }
+-
+- if (!node) {
+- node = kzalloc(sizeof(*node), GFP_KERNEL);
+- if (!node)
+- return -ENOMEM;
+-
+- node->rb.addr = (unsigned long)iovec->iov.iov_base;
+- node->pq = pq;
+- atomic_set(&node->refcount, 0);
+- }
+-
+- iov = &iovec->iov;
+- npages = num_user_pages((unsigned long)iov->iov_base, iov->iov_len);
+- if (node->npages < npages) {
+- pinned = pin_sdma_pages(req, iovec, node, npages);
+- if (pinned < 0) {
+- ret = pinned;
+- goto bail;
+- }
+- node->npages += pinned;
+- npages = node->npages;
+- }
+- iovec->pages = node->pages;
+- iovec->npages = npages;
+- iovec->node = node;
+-
+- ret = hfi1_mmu_rb_insert(req->pq->handler, &node->rb);
+- if (ret) {
+- iovec->node = NULL;
+- goto bail;
+- }
+- return 0;
+-bail:
+- unpin_sdma_pages(node);
+- kfree(node);
+- return ret;
+-}
+-
+-static void unpin_vector_pages(struct mm_struct *mm, struct page **pages,
+- unsigned start, unsigned npages)
+-{
+- hfi1_release_user_pages(mm, pages + start, npages, false);
+- kfree(pages);
+-}
+-
+ static int check_header_template(struct user_sdma_request *req,
+ struct hfi1_pkt_header *hdr, u32 lrhlen,
+ u32 datalen)
+@@ -1388,7 +1216,7 @@ static void user_sdma_txreq_cb(struct sdma_txreq *txreq, int status)
+ if (req->seqcomp != req->info.npkts - 1)
+ return;
+
+- user_sdma_free_request(req, false);
++ user_sdma_free_request(req);
+ set_comp_state(pq, cq, req->info.comp_idx, state, status);
+ pq_update(pq);
+ }
+@@ -1399,10 +1227,8 @@ static inline void pq_update(struct hfi1_user_sdma_pkt_q *pq)
+ wake_up(&pq->wait);
+ }
+
+-static void user_sdma_free_request(struct user_sdma_request *req, bool unpin)
++static void user_sdma_free_request(struct user_sdma_request *req)
+ {
+- int i;
+-
+ if (!list_empty(&req->txps)) {
+ struct sdma_txreq *t, *p;
+
+@@ -1415,21 +1241,6 @@ static void user_sdma_free_request(struct user_sdma_request *req, bool unpin)
+ }
+ }
+
+- for (i = 0; i < req->data_iovs; i++) {
+- struct sdma_mmu_node *node = req->iovs[i].node;
+-
+- if (!node)
+- continue;
+-
+- req->iovs[i].node = NULL;
+-
+- if (unpin)
+- hfi1_mmu_rb_remove(req->pq->handler,
+- &node->rb);
+- else
+- atomic_dec(&node->refcount);
+- }
+-
+ kfree(req->tids);
+ clear_bit(req->info.comp_idx, req->pq->req_in_use);
+ }
+@@ -1447,6 +1258,368 @@ static inline void set_comp_state(struct hfi1_user_sdma_pkt_q *pq,
+ idx, state, ret);
+ }
+
++static void unpin_vector_pages(struct mm_struct *mm, struct page **pages,
++ unsigned int start, unsigned int npages)
++{
++ hfi1_release_user_pages(mm, pages + start, npages, false);
++ kfree(pages);
++}
++
++static void free_system_node(struct sdma_mmu_node *node)
++{
++ if (node->npages) {
++ unpin_vector_pages(mm_from_sdma_node(node), node->pages, 0,
++ node->npages);
++ atomic_sub(node->npages, &node->pq->n_locked);
++ }
++ kfree(node);
++}
++
++static inline void acquire_node(struct sdma_mmu_node *node)
++{
++ atomic_inc(&node->refcount);
++ WARN_ON(atomic_read(&node->refcount) < 0);
++}
++
++static inline void release_node(struct mmu_rb_handler *handler,
++ struct sdma_mmu_node *node)
++{
++ atomic_dec(&node->refcount);
++ WARN_ON(atomic_read(&node->refcount) < 0);
++}
++
++static struct sdma_mmu_node *find_system_node(struct mmu_rb_handler *handler,
++ unsigned long start,
++ unsigned long end)
++{
++ struct mmu_rb_node *rb_node;
++ struct sdma_mmu_node *node;
++ unsigned long flags;
++
++ spin_lock_irqsave(&handler->lock, flags);
++ rb_node = hfi1_mmu_rb_get_first(handler, start, (end - start));
++ if (!rb_node) {
++ spin_unlock_irqrestore(&handler->lock, flags);
++ return NULL;
++ }
++ node = container_of(rb_node, struct sdma_mmu_node, rb);
++ acquire_node(node);
++ spin_unlock_irqrestore(&handler->lock, flags);
++
++ return node;
++}
++
++static int pin_system_pages(struct user_sdma_request *req,
++ uintptr_t start_address, size_t length,
++ struct sdma_mmu_node *node, int npages)
++{
++ struct hfi1_user_sdma_pkt_q *pq = req->pq;
++ int pinned, cleared;
++ struct page **pages;
++
++ pages = kcalloc(npages, sizeof(*pages), GFP_KERNEL);
++ if (!pages)
++ return -ENOMEM;
++
++retry:
++ if (!hfi1_can_pin_pages(pq->dd, current->mm, atomic_read(&pq->n_locked),
++ npages)) {
++ SDMA_DBG(req, "Evicting: nlocked %u npages %u",
++ atomic_read(&pq->n_locked), npages);
++ cleared = sdma_cache_evict(pq, npages);
++ if (cleared >= npages)
++ goto retry;
++ }
++
++ SDMA_DBG(req, "Acquire user pages start_address %lx node->npages %u npages %u",
++ start_address, node->npages, npages);
++ pinned = hfi1_acquire_user_pages(current->mm, start_address, npages, 0,
++ pages);
++
++ if (pinned < 0) {
++ kfree(pages);
++ SDMA_DBG(req, "pinned %d", pinned);
++ return pinned;
++ }
++ if (pinned != npages) {
++ unpin_vector_pages(current->mm, pages, node->npages, pinned);
++ SDMA_DBG(req, "npages %u pinned %d", npages, pinned);
++ return -EFAULT;
++ }
++ node->rb.addr = start_address;
++ node->rb.len = length;
++ node->pages = pages;
++ node->npages = npages;
++ atomic_add(pinned, &pq->n_locked);
++ SDMA_DBG(req, "done. pinned %d", pinned);
++ return 0;
++}
++
++static int add_system_pinning(struct user_sdma_request *req,
++ struct sdma_mmu_node **node_p,
++ unsigned long start, unsigned long len)
++
++{
++ struct hfi1_user_sdma_pkt_q *pq = req->pq;
++ struct sdma_mmu_node *node;
++ int ret;
++
++ node = kzalloc(sizeof(*node), GFP_KERNEL);
++ if (!node)
++ return -ENOMEM;
++
++ node->pq = pq;
++ ret = pin_system_pages(req, start, len, node, PFN_DOWN(len));
++ if (ret == 0) {
++ ret = hfi1_mmu_rb_insert(pq->handler, &node->rb);
++ if (ret)
++ free_system_node(node);
++ else
++ *node_p = node;
++
++ return ret;
++ }
++
++ kfree(node);
++ return ret;
++}
++
++static int get_system_cache_entry(struct user_sdma_request *req,
++ struct sdma_mmu_node **node_p,
++ size_t req_start, size_t req_len)
++{
++ struct hfi1_user_sdma_pkt_q *pq = req->pq;
++ u64 start = ALIGN_DOWN(req_start, PAGE_SIZE);
++ u64 end = PFN_ALIGN(req_start + req_len);
++ struct mmu_rb_handler *handler = pq->handler;
++ int ret;
++
++ if ((end - start) == 0) {
++ SDMA_DBG(req,
++ "Request for empty cache entry req_start %lx req_len %lx start %llx end %llx",
++ req_start, req_len, start, end);
++ return -EINVAL;
++ }
++
++ SDMA_DBG(req, "req_start %lx req_len %lu", req_start, req_len);
++
++ while (1) {
++ struct sdma_mmu_node *node =
++ find_system_node(handler, start, end);
++ u64 prepend_len = 0;
++
++ SDMA_DBG(req, "node %p start %llx end %llu", node, start, end);
++ if (!node) {
++ ret = add_system_pinning(req, node_p, start,
++ end - start);
++ if (ret == -EEXIST) {
++ /*
++ * Another execution context has inserted a
++ * conficting entry first.
++ */
++ continue;
++ }
++ return ret;
++ }
++
++ if (node->rb.addr <= start) {
++ /*
++ * This entry covers at least part of the region. If it doesn't extend
++ * to the end, then this will be called again for the next segment.
++ */
++ *node_p = node;
++ return 0;
++ }
++
++ SDMA_DBG(req, "prepend: node->rb.addr %lx, node->refcount %d",
++ node->rb.addr, atomic_read(&node->refcount));
++ prepend_len = node->rb.addr - start;
++
++ /*
++ * This node will not be returned, instead a new node
++ * will be. So release the reference.
++ */
++ release_node(handler, node);
++
++ /* Prepend a node to cover the beginning of the allocation */
++ ret = add_system_pinning(req, node_p, start, prepend_len);
++ if (ret == -EEXIST) {
++ /* Another execution context has inserted a conficting entry first. */
++ continue;
++ }
++ return ret;
++ }
++}
++
++static int add_mapping_to_sdma_packet(struct user_sdma_request *req,
++ struct user_sdma_txreq *tx,
++ struct sdma_mmu_node *cache_entry,
++ size_t start,
++ size_t from_this_cache_entry)
++{
++ struct hfi1_user_sdma_pkt_q *pq = req->pq;
++ unsigned int page_offset;
++ unsigned int from_this_page;
++ size_t page_index;
++ void *ctx;
++ int ret;
++
++ /*
++ * Because the cache may be more fragmented than the memory that is being accessed,
++ * it's not strictly necessary to have a descriptor per cache entry.
++ */
++
++ while (from_this_cache_entry) {
++ page_index = PFN_DOWN(start - cache_entry->rb.addr);
++
++ if (page_index >= cache_entry->npages) {
++ SDMA_DBG(req,
++ "Request for page_index %zu >= cache_entry->npages %u",
++ page_index, cache_entry->npages);
++ return -EINVAL;
++ }
++
++ page_offset = start - ALIGN_DOWN(start, PAGE_SIZE);
++ from_this_page = PAGE_SIZE - page_offset;
++
++ if (from_this_page < from_this_cache_entry) {
++ ctx = NULL;
++ } else {
++ /*
++ * In the case they are equal the next line has no practical effect,
++ * but it's better to do a register to register copy than a conditional
++ * branch.
++ */
++ from_this_page = from_this_cache_entry;
++ ctx = cache_entry;
++ }
++
++ ret = sdma_txadd_page(pq->dd, ctx, &tx->txreq,
++ cache_entry->pages[page_index],
++ page_offset, from_this_page);
++ if (ret) {
++ /*
++ * When there's a failure, the entire request is freed by
++ * user_sdma_send_pkts().
++ */
++ SDMA_DBG(req,
++ "sdma_txadd_page failed %d page_index %lu page_offset %u from_this_page %u",
++ ret, page_index, page_offset, from_this_page);
++ return ret;
++ }
++ start += from_this_page;
++ from_this_cache_entry -= from_this_page;
++ }
++ return 0;
++}
++
++static int add_system_iovec_to_sdma_packet(struct user_sdma_request *req,
++ struct user_sdma_txreq *tx,
++ struct user_sdma_iovec *iovec,
++ size_t from_this_iovec)
++{
++ struct mmu_rb_handler *handler = req->pq->handler;
++
++ while (from_this_iovec > 0) {
++ struct sdma_mmu_node *cache_entry;
++ size_t from_this_cache_entry;
++ size_t start;
++ int ret;
++
++ start = (uintptr_t)iovec->iov.iov_base + iovec->offset;
++ ret = get_system_cache_entry(req, &cache_entry, start,
++ from_this_iovec);
++ if (ret) {
++ SDMA_DBG(req, "pin system segment failed %d", ret);
++ return ret;
++ }
++
++ from_this_cache_entry = cache_entry->rb.len - (start - cache_entry->rb.addr);
++ if (from_this_cache_entry > from_this_iovec)
++ from_this_cache_entry = from_this_iovec;
++
++ ret = add_mapping_to_sdma_packet(req, tx, cache_entry, start,
++ from_this_cache_entry);
++ if (ret) {
++ /*
++ * We're guaranteed that there will be no descriptor
++ * completion callback that releases this node
++ * because only the last descriptor referencing it
++ * has a context attached, and a failure means the
++ * last descriptor was never added.
++ */
++ release_node(handler, cache_entry);
++ SDMA_DBG(req, "add system segment failed %d", ret);
++ return ret;
++ }
++
++ iovec->offset += from_this_cache_entry;
++ from_this_iovec -= from_this_cache_entry;
++ }
++
++ return 0;
++}
++
++static int add_system_pages_to_sdma_packet(struct user_sdma_request *req,
++ struct user_sdma_txreq *tx,
++ struct user_sdma_iovec *iovec,
++ u32 *pkt_data_remaining)
++{
++ size_t remaining_to_add = *pkt_data_remaining;
++ /*
++ * Walk through iovec entries, ensure the associated pages
++ * are pinned and mapped, add data to the packet until no more
++ * data remains to be added.
++ */
++ while (remaining_to_add > 0) {
++ struct user_sdma_iovec *cur_iovec;
++ size_t from_this_iovec;
++ int ret;
++
++ cur_iovec = iovec;
++ from_this_iovec = iovec->iov.iov_len - iovec->offset;
++
++ if (from_this_iovec > remaining_to_add) {
++ from_this_iovec = remaining_to_add;
++ } else {
++ /* The current iovec entry will be consumed by this pass. */
++ req->iov_idx++;
++ iovec++;
++ }
++
++ ret = add_system_iovec_to_sdma_packet(req, tx, cur_iovec,
++ from_this_iovec);
++ if (ret)
++ return ret;
++
++ remaining_to_add -= from_this_iovec;
++ }
++ *pkt_data_remaining = remaining_to_add;
++
++ return 0;
++}
++
++void system_descriptor_complete(struct hfi1_devdata *dd,
++ struct sdma_desc *descp)
++{
++ switch (sdma_mapping_type(descp)) {
++ case SDMA_MAP_SINGLE:
++ dma_unmap_single(&dd->pcidev->dev, sdma_mapping_addr(descp),
++ sdma_mapping_len(descp), DMA_TO_DEVICE);
++ break;
++ case SDMA_MAP_PAGE:
++ dma_unmap_page(&dd->pcidev->dev, sdma_mapping_addr(descp),
++ sdma_mapping_len(descp), DMA_TO_DEVICE);
++ break;
++ }
++
++ if (descp->pinning_ctx) {
++ struct sdma_mmu_node *node = descp->pinning_ctx;
++
++ release_node(node->rb.handler, node);
++ }
++}
++
+ static bool sdma_rb_filter(struct mmu_rb_node *node, unsigned long addr,
+ unsigned long len)
+ {
+@@ -1493,8 +1666,7 @@ static void sdma_rb_remove(void *arg, struct mmu_rb_node *mnode)
+ struct sdma_mmu_node *node =
+ container_of(mnode, struct sdma_mmu_node, rb);
+
+- unpin_sdma_pages(node);
+- kfree(node);
++ free_system_node(node);
+ }
+
+ static int sdma_rb_invalidate(void *arg, struct mmu_rb_node *mnode)
+diff --git a/drivers/infiniband/hw/hfi1/user_sdma.h b/drivers/infiniband/hw/hfi1/user_sdma.h
+index ea56eb57e6568..a241836371dc1 100644
+--- a/drivers/infiniband/hw/hfi1/user_sdma.h
++++ b/drivers/infiniband/hw/hfi1/user_sdma.h
+@@ -112,16 +112,11 @@ struct sdma_mmu_node {
+ struct user_sdma_iovec {
+ struct list_head list;
+ struct iovec iov;
+- /* number of pages in this vector */
+- unsigned int npages;
+- /* array of pinned pages for this vector */
+- struct page **pages;
+ /*
+ * offset into the virtual address space of the vector at
+ * which we last left off.
+ */
+ u64 offset;
+- struct sdma_mmu_node *node;
+ };
+
+ /* evict operation argument */
+diff --git a/drivers/infiniband/hw/hfi1/verbs.c b/drivers/infiniband/hw/hfi1/verbs.c
+index 7f6d7fc7951df..fbdcfecb1768c 100644
+--- a/drivers/infiniband/hw/hfi1/verbs.c
++++ b/drivers/infiniband/hw/hfi1/verbs.c
+@@ -778,8 +778,8 @@ static int build_verbs_tx_desc(
+
+ /* add icrc, lt byte, and padding to flit */
+ if (extra_bytes)
+- ret = sdma_txadd_daddr(sde->dd, &tx->txreq,
+- sde->dd->sdma_pad_phys, extra_bytes);
++ ret = sdma_txadd_daddr(sde->dd, &tx->txreq, sde->dd->sdma_pad_phys,
++ extra_bytes);
+
+ bail_txadd:
+ return ret;
+diff --git a/drivers/infiniband/hw/hfi1/vnic_sdma.c b/drivers/infiniband/hw/hfi1/vnic_sdma.c
+index c3f0f8d877c37..727eedfba332a 100644
+--- a/drivers/infiniband/hw/hfi1/vnic_sdma.c
++++ b/drivers/infiniband/hw/hfi1/vnic_sdma.c
+@@ -64,6 +64,7 @@ static noinline int build_vnic_ulp_payload(struct sdma_engine *sde,
+
+ /* combine physically continuous fragments later? */
+ ret = sdma_txadd_page(sde->dd,
++ NULL,
+ &tx->txreq,
+ skb_frag_page(frag),
+ skb_frag_off(frag),
+--
+2.39.2
+
--- /dev/null
+From ee1cc708dc43c2b55d543dbf5ae7b2be95f71ccd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Apr 2023 12:52:39 -0400
+Subject: IB/hfi1: Fix SDMA mmu_rb_node not being evicted in LRU order
+
+From: Patrick Kelsey <pat.kelsey@cornelisnetworks.com>
+
+[ Upstream commit 9fe8fec5e43d5a80f43cbf61aaada1b047a1eb61 ]
+
+hfi1_mmu_rb_remove_unless_exact() did not move mmu_rb_node objects in
+mmu_rb_handler->lru_list after getting a cache hit on an mmu_rb_node.
+
+As a result, hfi1_mmu_rb_evict() was not guaranteed to evict truly
+least-recently used nodes.
+
+This could be a performance issue for an application when that
+application:
+- Uses some long-lived buffers frequently.
+- Uses a large number of buffers once.
+- Hits the mmu_rb_handler cache size or pinned-page limits, forcing
+ mmu_rb_handler cache entries to be evicted.
+
+In this case, the one-time use buffers cause the long-lived buffer
+entries to eventually filter to the end of the LRU list where
+hfi1_mmu_rb_evict() will consider evicting a frequently-used long-lived
+entry instead of evicting one of the one-time use entries.
+
+Fix this by inserting new mmu_rb_node at the tail of
+mmu_rb_handler->lru_list and move mmu_rb_ndoe to the tail of
+mmu_rb_handler->lru_list when the mmu_rb_node is a hit in
+hfi1_mmu_rb_remove_unless_exact(). Change hfi1_mmu_rb_evict() to evict
+from the head of mmu_rb_handler->lru_list instead of the tail.
+
+Fixes: 0636e9ab8355 ("IB/hfi1: Add cache evict LRU list")
+Signed-off-by: Brendan Cunningham <bcunningham@cornelisnetworks.com>
+Signed-off-by: Patrick Kelsey <pat.kelsey@cornelisnetworks.com>
+Signed-off-by: Dennis Dalessandro <dennis.dalessandro@cornelisnetworks.com>
+Link: https://lore.kernel.org/r/168088635931.3027109.10423156330761536044.stgit@252.162.96.66.static.eigbox.net
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hfi1/mmu_rb.c | 13 ++++++-------
+ 1 file changed, 6 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hfi1/mmu_rb.c b/drivers/infiniband/hw/hfi1/mmu_rb.c
+index 7333646021bb8..af46ff2033426 100644
+--- a/drivers/infiniband/hw/hfi1/mmu_rb.c
++++ b/drivers/infiniband/hw/hfi1/mmu_rb.c
+@@ -130,7 +130,7 @@ int hfi1_mmu_rb_insert(struct mmu_rb_handler *handler,
+ goto unlock;
+ }
+ __mmu_int_rb_insert(mnode, &handler->root);
+- list_add(&mnode->list, &handler->lru_list);
++ list_add_tail(&mnode->list, &handler->lru_list);
+
+ ret = handler->ops->insert(handler->ops_arg, mnode);
+ if (ret) {
+@@ -181,8 +181,10 @@ bool hfi1_mmu_rb_remove_unless_exact(struct mmu_rb_handler *handler,
+ spin_lock_irqsave(&handler->lock, flags);
+ node = __mmu_rb_search(handler, addr, len);
+ if (node) {
+- if (node->addr == addr && node->len == len)
++ if (node->addr == addr && node->len == len) {
++ list_move_tail(&node->list, &handler->lru_list);
+ goto unlock;
++ }
+ __mmu_int_rb_remove(node, &handler->root);
+ list_del(&node->list); /* remove from LRU list */
+ ret = true;
+@@ -206,8 +208,7 @@ void hfi1_mmu_rb_evict(struct mmu_rb_handler *handler, void *evict_arg)
+ INIT_LIST_HEAD(&del_list);
+
+ spin_lock_irqsave(&handler->lock, flags);
+- list_for_each_entry_safe_reverse(rbnode, ptr, &handler->lru_list,
+- list) {
++ list_for_each_entry_safe(rbnode, ptr, &handler->lru_list, list) {
+ if (handler->ops->evict(handler->ops_arg, rbnode, evict_arg,
+ &stop)) {
+ __mmu_int_rb_remove(rbnode, &handler->root);
+@@ -219,9 +220,7 @@ void hfi1_mmu_rb_evict(struct mmu_rb_handler *handler, void *evict_arg)
+ }
+ spin_unlock_irqrestore(&handler->lock, flags);
+
+- while (!list_empty(&del_list)) {
+- rbnode = list_first_entry(&del_list, struct mmu_rb_node, list);
+- list_del(&rbnode->list);
++ list_for_each_entry_safe(rbnode, ptr, &del_list, list) {
+ handler->ops->remove(handler->ops_arg, rbnode);
+ }
+ }
+--
+2.39.2
+
--- /dev/null
+From ec5673b26bb7e35cdfa87970523a03e37483f21c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Feb 2023 18:02:12 +0800
+Subject: IB/hifi1: add a null check of kzalloc_node in hfi1_ipoib_txreq_init
+
+From: Kang Chen <void0red@gmail.com>
+
+[ Upstream commit c874ad879c2f29ebe040a34b974389875c0d81eb ]
+
+kzalloc_node may fails, check it and do the cleanup.
+
+Fixes: b1151b74ff68 ("IB/hfi1: Fix alloc failure with larger txqueuelen")
+Signed-off-by: Kang Chen <void0red@gmail.com>
+Link: https://lore.kernel.org/r/20230227100212.910820-1-void0red@gmail.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hfi1/ipoib_tx.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/hfi1/ipoib_tx.c b/drivers/infiniband/hw/hfi1/ipoib_tx.c
+index 5d9a7b09ca37e..349eb41391368 100644
+--- a/drivers/infiniband/hw/hfi1/ipoib_tx.c
++++ b/drivers/infiniband/hw/hfi1/ipoib_tx.c
+@@ -737,10 +737,13 @@ int hfi1_ipoib_txreq_init(struct hfi1_ipoib_dev_priv *priv)
+ txq->tx_ring.shift = ilog2(tx_item_size);
+ txq->tx_ring.avail = hfi1_ipoib_ring_hwat(txq);
+ tx_ring = &txq->tx_ring;
+- for (j = 0; j < tx_ring_size; j++)
++ for (j = 0; j < tx_ring_size; j++) {
+ hfi1_txreq_from_idx(tx_ring, j)->sdma_hdr =
+ kzalloc_node(sizeof(*tx->sdma_hdr),
+ GFP_KERNEL, priv->dd->node);
++ if (!hfi1_txreq_from_idx(tx_ring, j)->sdma_hdr)
++ goto free_txqs;
++ }
+
+ netif_napi_add_tx(dev, &txq->napi, hfi1_ipoib_poll_tx_ring);
+ }
+--
+2.39.2
+
--- /dev/null
+From 93ec555380e261f4603272b619a4e4bfd7652066 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 12 Mar 2023 16:34:28 +0100
+Subject: iio: light: max44009: add missing OF device matching
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit b29c49026c3c05a11f845dba17cad0b3ba06836d ]
+
+The driver currently matches only via i2c_device_id, but also has
+of_device_id table:
+
+ drivers/iio/light/max44009.c:545:34: error: ‘max44009_of_match’ defined but not used [-Werror=unused-const-variable=]
+
+Fixes: 6aef699a7d7e ("iio: light: add driver for MAX44009")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Link: https://lore.kernel.org/r/20230312153429.371702-2-krzysztof.kozlowski@linaro.org
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/light/max44009.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/iio/light/max44009.c b/drivers/iio/light/max44009.c
+index 3dadace09fe2e..176dcad6e8e8a 100644
+--- a/drivers/iio/light/max44009.c
++++ b/drivers/iio/light/max44009.c
+@@ -527,6 +527,12 @@ static int max44009_probe(struct i2c_client *client)
+ return devm_iio_device_register(&client->dev, indio_dev);
+ }
+
++static const struct of_device_id max44009_of_match[] = {
++ { .compatible = "maxim,max44009" },
++ { }
++};
++MODULE_DEVICE_TABLE(of, max44009_of_match);
++
+ static const struct i2c_device_id max44009_id[] = {
+ { "max44009", 0 },
+ { }
+@@ -536,18 +542,13 @@ MODULE_DEVICE_TABLE(i2c, max44009_id);
+ static struct i2c_driver max44009_driver = {
+ .driver = {
+ .name = MAX44009_DRV_NAME,
++ .of_match_table = max44009_of_match,
+ },
+ .probe_new = max44009_probe,
+ .id_table = max44009_id,
+ };
+ module_i2c_driver(max44009_driver);
+
+-static const struct of_device_id max44009_of_match[] = {
+- { .compatible = "maxim,max44009" },
+- { }
+-};
+-MODULE_DEVICE_TABLE(of, max44009_of_match);
+-
+ MODULE_AUTHOR("Robert Eshleman <bobbyeshleman@gmail.com>");
+ MODULE_LICENSE("GPL v2");
+ MODULE_DESCRIPTION("MAX44009 ambient light sensor driver");
+--
+2.39.2
+
--- /dev/null
+From 72f0abaed909278c982bc5bddbdfe739c71dc0db Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Apr 2023 23:05:20 -0700
+Subject: Input: raspberrypi-ts - fix refcount leak in rpi_ts_probe
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit 5bca3688bdbc3b58a2894b8671a8e2378efe28bd ]
+
+rpi_firmware_get() take reference, we need to release it in error paths
+as well. Use devm_rpi_firmware_get() helper to handling the resources.
+Also remove the existing rpi_firmware_put().
+
+Fixes: 0b9f28fed3f7 ("Input: add official Raspberry Pi's touchscreen driver")
+Fixes: 3b8ddff780b7 ("input: raspberrypi-ts: Release firmware handle when not needed")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Reviewed-by: Mattijs Korpershoek <mkorpershoek@baylibre.com>
+Link: https://lore.kernel.org/r/20221223074657.810346-1-linmq006@gmail.com
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/touchscreen/raspberrypi-ts.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/input/touchscreen/raspberrypi-ts.c b/drivers/input/touchscreen/raspberrypi-ts.c
+index 5000f5fd9ec38..45c575df994e0 100644
+--- a/drivers/input/touchscreen/raspberrypi-ts.c
++++ b/drivers/input/touchscreen/raspberrypi-ts.c
+@@ -134,7 +134,7 @@ static int rpi_ts_probe(struct platform_device *pdev)
+ return -ENOENT;
+ }
+
+- fw = rpi_firmware_get(fw_node);
++ fw = devm_rpi_firmware_get(&pdev->dev, fw_node);
+ of_node_put(fw_node);
+ if (!fw)
+ return -EPROBE_DEFER;
+@@ -160,7 +160,6 @@ static int rpi_ts_probe(struct platform_device *pdev)
+ touchbuf = (u32)ts->fw_regs_phys;
+ error = rpi_firmware_property(fw, RPI_FIRMWARE_FRAMEBUFFER_SET_TOUCHBUF,
+ &touchbuf, sizeof(touchbuf));
+- rpi_firmware_put(fw);
+ if (error || touchbuf != 0) {
+ dev_warn(dev, "Failed to set touchbuf, %d\n", error);
+ return error;
+--
+2.39.2
+
--- /dev/null
+From 9d0afeb7473aff4bc0bce89f719e8b12ae5deaa4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Jan 2023 06:57:17 +0200
+Subject: interconnect: qcom: drop obsolete OSM_L3/EPSS defines
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit 4c4161b4c81b632fc29002c324e996cbb79894e7 ]
+
+Since Qualcomm platforms have switched to the separate OSM_L3/EPSS
+driver, old related defines became unused. Drop them now.
+
+Suggested-by: Bjorn Andersson <andersson@kernel.org>
+Fixes: 4529992c9474 ("interconnect: qcom: osm-l3: Use platform-independent node ids")
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20230103045717.1079067-1-dmitry.baryshkov@linaro.org
+Signed-off-by: Georgi Djakov <djakov@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/interconnect/qcom/sc7180.h | 2 --
+ drivers/interconnect/qcom/sc7280.h | 2 --
+ drivers/interconnect/qcom/sc8180x.h | 2 --
+ drivers/interconnect/qcom/sdm845.h | 2 --
+ drivers/interconnect/qcom/sm8150.h | 2 --
+ drivers/interconnect/qcom/sm8250.h | 2 --
+ 6 files changed, 12 deletions(-)
+
+diff --git a/drivers/interconnect/qcom/sc7180.h b/drivers/interconnect/qcom/sc7180.h
+index 7a2b3eb00923c..2b718922c1090 100644
+--- a/drivers/interconnect/qcom/sc7180.h
++++ b/drivers/interconnect/qcom/sc7180.h
+@@ -145,7 +145,5 @@
+ #define SC7180_SLAVE_SERVICE_SNOC 134
+ #define SC7180_SLAVE_QDSS_STM 135
+ #define SC7180_SLAVE_TCU 136
+-#define SC7180_MASTER_OSM_L3_APPS 137
+-#define SC7180_SLAVE_OSM_L3 138
+
+ #endif
+diff --git a/drivers/interconnect/qcom/sc7280.h b/drivers/interconnect/qcom/sc7280.h
+index 1fb9839b2c14b..175e400305c51 100644
+--- a/drivers/interconnect/qcom/sc7280.h
++++ b/drivers/interconnect/qcom/sc7280.h
+@@ -150,7 +150,5 @@
+ #define SC7280_SLAVE_PCIE_1 139
+ #define SC7280_SLAVE_QDSS_STM 140
+ #define SC7280_SLAVE_TCU 141
+-#define SC7280_MASTER_EPSS_L3_APPS 142
+-#define SC7280_SLAVE_EPSS_L3 143
+
+ #endif
+diff --git a/drivers/interconnect/qcom/sc8180x.h b/drivers/interconnect/qcom/sc8180x.h
+index c138dcd350f1d..f8d90598335a1 100644
+--- a/drivers/interconnect/qcom/sc8180x.h
++++ b/drivers/interconnect/qcom/sc8180x.h
+@@ -168,8 +168,6 @@
+ #define SC8180X_SLAVE_EBI_CH0_DISPLAY 158
+ #define SC8180X_SLAVE_MNOC_SF_MEM_NOC_DISPLAY 159
+ #define SC8180X_SLAVE_MNOC_HF_MEM_NOC_DISPLAY 160
+-#define SC8180X_MASTER_OSM_L3_APPS 161
+-#define SC8180X_SLAVE_OSM_L3 162
+
+ #define SC8180X_MASTER_QUP_CORE_0 163
+ #define SC8180X_MASTER_QUP_CORE_1 164
+diff --git a/drivers/interconnect/qcom/sdm845.h b/drivers/interconnect/qcom/sdm845.h
+index 776e9c2acb278..bc7e425ce9852 100644
+--- a/drivers/interconnect/qcom/sdm845.h
++++ b/drivers/interconnect/qcom/sdm845.h
+@@ -136,7 +136,5 @@
+ #define SDM845_SLAVE_SERVICE_SNOC 128
+ #define SDM845_SLAVE_QDSS_STM 129
+ #define SDM845_SLAVE_TCU 130
+-#define SDM845_MASTER_OSM_L3_APPS 131
+-#define SDM845_SLAVE_OSM_L3 132
+
+ #endif /* __DRIVERS_INTERCONNECT_QCOM_SDM845_H__ */
+diff --git a/drivers/interconnect/qcom/sm8150.h b/drivers/interconnect/qcom/sm8150.h
+index 023161681fb87..1d587c94eb06e 100644
+--- a/drivers/interconnect/qcom/sm8150.h
++++ b/drivers/interconnect/qcom/sm8150.h
+@@ -148,7 +148,5 @@
+ #define SM8150_SLAVE_VSENSE_CTRL_CFG 137
+ #define SM8150_SNOC_CNOC_MAS 138
+ #define SM8150_SNOC_CNOC_SLV 139
+-#define SM8150_MASTER_OSM_L3_APPS 140
+-#define SM8150_SLAVE_OSM_L3 141
+
+ #endif
+diff --git a/drivers/interconnect/qcom/sm8250.h b/drivers/interconnect/qcom/sm8250.h
+index e3fc56bc7ca0e..209ab195f21fb 100644
+--- a/drivers/interconnect/qcom/sm8250.h
++++ b/drivers/interconnect/qcom/sm8250.h
+@@ -158,7 +158,5 @@
+ #define SM8250_SLAVE_VSENSE_CTRL_CFG 147
+ #define SM8250_SNOC_CNOC_MAS 148
+ #define SM8250_SNOC_CNOC_SLV 149
+-#define SM8250_MASTER_EPSS_L3_APPS 150
+-#define SM8250_SLAVE_EPSS_L3 151
+
+ #endif
+--
+2.39.2
+
--- /dev/null
+From 9f639ad8ae3fd049f403abdb68d95e8afb7f9789 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Jan 2023 05:11:59 +0200
+Subject: interconnect: qcom: osm-l3: drop unuserd header inclusion
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit f730038fe6a6de170268fd779b2c029aa70a928b ]
+
+The commit 4529992c9474 ("interconnect: qcom: osm-l3: Use
+platform-independent node ids") made osm-l3 driver use
+platform-independent IDs, removing the need to include platform headers.
+
+Fixes: 4529992c9474 ("interconnect: qcom: osm-l3: Use platform-independent node ids")
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Reviewed-by: Bjorn Andersson <andersson@kernel.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20230103031159.1060075-1-dmitry.baryshkov@linaro.org
+Signed-off-by: Georgi Djakov <djakov@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/interconnect/qcom/osm-l3.c | 7 -------
+ 1 file changed, 7 deletions(-)
+
+diff --git a/drivers/interconnect/qcom/osm-l3.c b/drivers/interconnect/qcom/osm-l3.c
+index 1bafb54f14329..a1f4f918b9116 100644
+--- a/drivers/interconnect/qcom/osm-l3.c
++++ b/drivers/interconnect/qcom/osm-l3.c
+@@ -14,13 +14,6 @@
+
+ #include <dt-bindings/interconnect/qcom,osm-l3.h>
+
+-#include "sc7180.h"
+-#include "sc7280.h"
+-#include "sc8180x.h"
+-#include "sdm845.h"
+-#include "sm8150.h"
+-#include "sm8250.h"
+-
+ #define LUT_MAX_ENTRIES 40U
+ #define LUT_SRC GENMASK(31, 30)
+ #define LUT_L_VAL GENMASK(7, 0)
+--
+2.39.2
+
--- /dev/null
+From 48144eca7c7f007e8fed76e2d596a53ea51603d6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Mar 2023 09:49:53 +0100
+Subject: interconnect: qcom: rpm: drop bogus pm domain attach
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+[ Upstream commit 72b2720c18ecde92e6a36c4ac897dd5848e3f379 ]
+
+Any power domain would already have been attached by the platform bus
+code so drop the bogus power domain attach which always succeeds from
+probe.
+
+This effectively reverts commit 7de109c0abe9 ("interconnect: icc-rpm:
+Add support for bus power domain").
+
+Fixes: 7de109c0abe9 ("interconnect: icc-rpm: Add support for bus power domain")
+Cc: Yassine Oudjana <y.oudjana@protonmail.com>
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Tested-by: Konrad Dybcio <konrad.dybcio@linaro.org> # MSM8996 Sony Kagura
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20230313084953.24088-3-johan+linaro@kernel.org
+Signed-off-by: Georgi Djakov <djakov@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/interconnect/qcom/icc-rpm.c | 7 -------
+ drivers/interconnect/qcom/icc-rpm.h | 1 -
+ drivers/interconnect/qcom/msm8996.c | 1 -
+ 3 files changed, 9 deletions(-)
+
+diff --git a/drivers/interconnect/qcom/icc-rpm.c b/drivers/interconnect/qcom/icc-rpm.c
+index 4180a06681b2b..c80819557923e 100644
+--- a/drivers/interconnect/qcom/icc-rpm.c
++++ b/drivers/interconnect/qcom/icc-rpm.c
+@@ -11,7 +11,6 @@
+ #include <linux/of_device.h>
+ #include <linux/of_platform.h>
+ #include <linux/platform_device.h>
+-#include <linux/pm_domain.h>
+ #include <linux/regmap.h>
+ #include <linux/slab.h>
+
+@@ -496,12 +495,6 @@ int qnoc_probe(struct platform_device *pdev)
+ if (ret)
+ return ret;
+
+- if (desc->has_bus_pd) {
+- ret = dev_pm_domain_attach(dev, true);
+- if (ret)
+- return ret;
+- }
+-
+ provider = &qp->provider;
+ provider->dev = dev;
+ provider->set = qcom_icc_set;
+diff --git a/drivers/interconnect/qcom/icc-rpm.h b/drivers/interconnect/qcom/icc-rpm.h
+index a49af844ab13e..02257b0d3d5c6 100644
+--- a/drivers/interconnect/qcom/icc-rpm.h
++++ b/drivers/interconnect/qcom/icc-rpm.h
+@@ -91,7 +91,6 @@ struct qcom_icc_desc {
+ size_t num_nodes;
+ const char * const *clocks;
+ size_t num_clocks;
+- bool has_bus_pd;
+ enum qcom_icc_type type;
+ const struct regmap_config *regmap_cfg;
+ unsigned int qos_offset;
+diff --git a/drivers/interconnect/qcom/msm8996.c b/drivers/interconnect/qcom/msm8996.c
+index 25a1a32bc611f..14efd2761b7ab 100644
+--- a/drivers/interconnect/qcom/msm8996.c
++++ b/drivers/interconnect/qcom/msm8996.c
+@@ -1823,7 +1823,6 @@ static const struct qcom_icc_desc msm8996_a0noc = {
+ .num_nodes = ARRAY_SIZE(a0noc_nodes),
+ .clocks = bus_a0noc_clocks,
+ .num_clocks = ARRAY_SIZE(bus_a0noc_clocks),
+- .has_bus_pd = true,
+ .regmap_cfg = &msm8996_a0noc_regmap_config
+ };
+
+--
+2.39.2
+
--- /dev/null
+From 8e3b92f3ba20f50228e2a5ecbb0ff05c0192ac9b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Apr 2023 15:28:05 +0100
+Subject: io_uring/rsrc: use nospec'ed indexes
+
+From: Pavel Begunkov <asml.silence@gmail.com>
+
+[ Upstream commit 953c37e066f05a3dca2d74643574b8dfe8a83983 ]
+
+We use array_index_nospec() for registered buffer indexes, but don't use
+it while poking into rsrc tags, fix that.
+
+Fixes: 634d00df5e1cf ("io_uring: add full-fledged dynamic buffers support")
+Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
+Link: https://lore.kernel.org/r/f02fafc5a9c0dd69be2b0618c38831c078232ff0.1681395792.git.asml.silence@gmail.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ io_uring/rsrc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c
+index 7a43aed8e395c..e6fec9e971eac 100644
+--- a/io_uring/rsrc.c
++++ b/io_uring/rsrc.c
+@@ -577,7 +577,7 @@ static int __io_sqe_buffers_update(struct io_ring_ctx *ctx,
+ }
+
+ ctx->user_bufs[i] = imu;
+- *io_get_tag_slot(ctx->buf_data, offset) = tag;
++ *io_get_tag_slot(ctx->buf_data, i) = tag;
+ }
+
+ if (needs_switch)
+--
+2.39.2
+
--- /dev/null
+From 5ccad5e1a3a57d97741cffe10b336f608a98cff2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Apr 2023 00:27:42 -0700
+Subject: iommu/amd: Set page size bitmap during V2 domain allocation
+
+From: Jerry Snitselaar <jsnitsel@redhat.com>
+
+[ Upstream commit 8f880d19e6ad645a4b8066d5ff091c980b3231e7 ]
+
+With the addition of the V2 page table support, the domain page size
+bitmap needs to be set prior to iommu core setting up direct mappings
+for reserved regions. When reserved regions are mapped, if this is not
+done, it will be looking at the V1 page size bitmap when determining
+the page size to use in iommu_pgsize(). When it gets into the actual
+amd mapping code, a check of see if the page size is supported can
+fail, because at that point it is checking it against the V2 page size
+bitmap which only supports 4K, 2M, and 1G.
+
+Add a check to __iommu_domain_alloc() to not override the
+bitmap if it was already set by the iommu ops domain_alloc() code path.
+
+Cc: Vasant Hegde <vasant.hegde@amd.com>
+Cc: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
+Cc: Robin Murphy <robin.murphy@arm.com>
+Cc: Will Deacon <will@kernel.org>
+Cc: Joerg Roedel <joro@8bytes.org>
+Fixes: 4db6c41f0946 ("iommu/amd: Add support for using AMD IOMMU v2 page table for DMA-API")
+Signed-off-by: Jerry Snitselaar <jsnitsel@redhat.com>
+Reviewed-by: Vasant Hegde <vasant.hegde@amd.com>
+Link: https://lore.kernel.org/r/20230404072742.1895252-1-jsnitsel@redhat.com
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/amd/iommu.c | 6 ++----
+ drivers/iommu/iommu.c | 9 +++++++--
+ 2 files changed, 9 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/iommu/amd/iommu.c b/drivers/iommu/amd/iommu.c
+index 5a505ba5467e1..167da5b1a5e31 100644
+--- a/drivers/iommu/amd/iommu.c
++++ b/drivers/iommu/amd/iommu.c
+@@ -1666,10 +1666,6 @@ static void do_attach(struct iommu_dev_data *dev_data,
+ domain->dev_iommu[iommu->index] += 1;
+ domain->dev_cnt += 1;
+
+- /* Override supported page sizes */
+- if (domain->flags & PD_GIOV_MASK)
+- domain->domain.pgsize_bitmap = AMD_IOMMU_PGSIZES_V2;
+-
+ /* Update device table */
+ set_dte_entry(iommu, dev_data->devid, domain,
+ ats, dev_data->iommu_v2);
+@@ -2048,6 +2044,8 @@ static int protection_domain_init_v2(struct protection_domain *domain)
+
+ domain->flags |= PD_GIOV_MASK;
+
++ domain->domain.pgsize_bitmap = AMD_IOMMU_PGSIZES_V2;
++
+ if (domain_enable_v2(domain, 1)) {
+ domain_id_free(domain->id);
+ return -ENOMEM;
+diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
+index 10db680acaed5..256a38371120e 100644
+--- a/drivers/iommu/iommu.c
++++ b/drivers/iommu/iommu.c
+@@ -1964,8 +1964,13 @@ static struct iommu_domain *__iommu_domain_alloc(struct bus_type *bus,
+ return NULL;
+
+ domain->type = type;
+- /* Assume all sizes by default; the driver may override this later */
+- domain->pgsize_bitmap = bus->iommu_ops->pgsize_bitmap;
++ /*
++ * If not already set, assume all sizes by default; the driver
++ * may override this later
++ */
++ if (!domain->pgsize_bitmap)
++ domain->pgsize_bitmap = bus->iommu_ops->pgsize_bitmap;
++
+ if (!domain->ops)
+ domain->ops = bus->iommu_ops->default_domain_ops;
+
+--
+2.39.2
+
--- /dev/null
+From 515e5bd71cd8e68ae0a724b559d1c9b7f21f34c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Mar 2023 18:14:45 +0800
+Subject: iommu/mediatek: Set dma_mask for PGTABLE_PA_35_EN
+
+From: Yong Wu <yong.wu@mediatek.com>
+
+[ Upstream commit f045e9df6537175d02565f21616ac1a9dd59b61c ]
+
+When we enable PGTABLE_PA_35_EN, the PA for pgtable may be 35bits.
+Thus add dma_mask for it.
+
+Fixes: 301c3ca12576 ("iommu/mediatek: Allow page table PA up to 35bit")
+Signed-off-by: Chengci.Xu <chengci.xu@mediatek.com>
+Signed-off-by: Yong Wu <yong.wu@mediatek.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20230316101445.12443-1-yong.wu@mediatek.com
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/mtk_iommu.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/iommu/mtk_iommu.c b/drivers/iommu/mtk_iommu.c
+index d5a4955910ff5..6a00ce208dc2b 100644
+--- a/drivers/iommu/mtk_iommu.c
++++ b/drivers/iommu/mtk_iommu.c
+@@ -1258,6 +1258,14 @@ static int mtk_iommu_probe(struct platform_device *pdev)
+ return PTR_ERR(data->bclk);
+ }
+
++ if (MTK_IOMMU_HAS_FLAG(data->plat_data, PGTABLE_PA_35_EN)) {
++ ret = dma_set_mask(dev, DMA_BIT_MASK(35));
++ if (ret) {
++ dev_err(dev, "Failed to set dma_mask 35.\n");
++ return ret;
++ }
++ }
++
+ pm_runtime_enable(dev);
+
+ if (MTK_IOMMU_IS_TYPE(data->plat_data, MTK_IOMMU_TYPE_MM)) {
+--
+2.39.2
+
--- /dev/null
+From 12fbe0d9f8e2463679c007aa9d23b2b4f629f9d8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Mar 2023 13:27:04 -0400
+Subject: iommufd/selftest: Catch overflow of uptr and length
+
+From: Jason Gunthorpe <jgg@nvidia.com>
+
+[ Upstream commit fd8c1a4aee973e87d890a5861e106625a33b2c4e ]
+
+syzkaller hits a WARN_ON when trying to have a uptr close to UINTPTR_MAX:
+
+ WARNING: CPU: 1 PID: 393 at drivers/iommu/iommufd/selftest.c:403 iommufd_test+0xb19/0x16f0
+ Modules linked in:
+ CPU: 1 PID: 393 Comm: repro Not tainted 6.2.0-c9c3395d5e3d #1
+ Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014
+ RIP: 0010:iommufd_test+0xb19/0x16f0
+ Code: 94 c4 31 ff 44 89 e6 e8 a5 54 17 ff 45 84 e4 0f 85 bb 0b 00 00 41 be fb ff ff ff e8 31 53 17 ff e9 a0 f7 ff ff e8 27 53 17 ff <0f> 0b 41 be 8
+ RSP: 0018:ffffc90000eabdc0 EFLAGS: 00010246
+ RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff8214c487
+ RDX: 0000000000000000 RSI: ffff88800f5c8000 RDI: 0000000000000002
+ RBP: ffffc90000eabe48 R08: 0000000000000000 R09: 0000000000000001
+ R10: 0000000000000001 R11: 0000000000000000 R12: 00000000cd2b0000
+ R13: 00000000cd2af000 R14: 0000000000000000 R15: ffffc90000eabe68
+ FS: 00007f94d76d5740(0000) GS:ffff88807dd00000(0000) knlGS:0000000000000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: 0000000020000043 CR3: 0000000006880006 CR4: 0000000000770ee0
+ PKRU: 55555554
+ Call Trace:
+ <TASK>
+ ? write_comp_data+0x2f/0x90
+ iommufd_fops_ioctl+0x1ef/0x310
+ __x64_sys_ioctl+0x10e/0x160
+ ? __pfx_iommufd_fops_ioctl+0x10/0x10
+ do_syscall_64+0x3b/0x90
+ entry_SYSCALL_64_after_hwframe+0x72/0xdc
+
+Check that the user memory range doesn't overflow.
+
+Fixes: f4b20bb34c83 ("iommufd: Add kernel support for testing iommufd")
+Link: https://lore.kernel.org/r/0-v1-95390ed1df8d+8f-iommufd_mock_overflow_jgg@nvidia.com
+Reviewed-by: Kevin Tian <kevin.tian@intel.com>
+Reported-by: Pengfei Xu <pengfei.xu@intel.com>
+Link: https://lore.kernel.org/r/Y/hOiilV1wJvu/Hv@xpf.sh.intel.com
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/iommufd/selftest.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/iommu/iommufd/selftest.c b/drivers/iommu/iommufd/selftest.c
+index cfb5fe9a5e0ee..76c46847dc494 100644
+--- a/drivers/iommu/iommufd/selftest.c
++++ b/drivers/iommu/iommufd/selftest.c
+@@ -339,10 +339,12 @@ static int iommufd_test_md_check_pa(struct iommufd_ucmd *ucmd,
+ {
+ struct iommufd_hw_pagetable *hwpt;
+ struct mock_iommu_domain *mock;
++ uintptr_t end;
+ int rc;
+
+ if (iova % MOCK_IO_PAGE_SIZE || length % MOCK_IO_PAGE_SIZE ||
+- (uintptr_t)uptr % MOCK_IO_PAGE_SIZE)
++ (uintptr_t)uptr % MOCK_IO_PAGE_SIZE ||
++ check_add_overflow((uintptr_t)uptr, (uintptr_t)length, &end))
+ return -EINVAL;
+
+ hwpt = get_md_pagetable(ucmd, mockpt_id, &mock);
+@@ -390,7 +392,10 @@ static int iommufd_test_md_check_refs(struct iommufd_ucmd *ucmd,
+ void __user *uptr, size_t length,
+ unsigned int refs)
+ {
+- if (length % PAGE_SIZE || (uintptr_t)uptr % PAGE_SIZE)
++ uintptr_t end;
++
++ if (length % PAGE_SIZE || (uintptr_t)uptr % PAGE_SIZE ||
++ check_add_overflow((uintptr_t)uptr, (uintptr_t)length, &end))
+ return -EINVAL;
+
+ for (; length; length -= PAGE_SIZE) {
+--
+2.39.2
+
--- /dev/null
+From 76e1c1104168001410d3d8f56184a6ea9b5188b3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 25 Feb 2023 21:39:46 -0800
+Subject: ipmi: ASPEED_BT_IPMI_BMC: select REGMAP_MMIO instead of depending on
+ it
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 2a587b9ad052e7e92e508aea90c1e2ae433c1908 ]
+
+REGMAP is a hidden (not user visible) symbol. Users cannot set it
+directly thru "make *config", so drivers should select it instead of
+depending on it if they need it.
+
+Consistently using "select" or "depends on" can also help reduce
+Kconfig circular dependency issues.
+
+Therefore, change the use of "depends on REGMAP_MMIO" to
+"select REGMAP_MMIO", which will also set REGMAP.
+
+Fixes: eb994594bc22 ("ipmi: bt-bmc: Use a regmap for register access")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Cc: Andrew Jeffery <andrew@aj.id.au>
+Cc: Corey Minyard <minyard@acm.org>
+Cc: openipmi-developer@lists.sourceforge.net
+Cc: Arnd Bergmann <arnd@arndb.de>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Message-Id: <20230226053953.4681-2-rdunlap@infradead.org>
+Signed-off-by: Corey Minyard <cminyard@mvista.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/ipmi/Kconfig | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/char/ipmi/Kconfig b/drivers/char/ipmi/Kconfig
+index b6c0d35fc1a5f..f4adc6feb3b22 100644
+--- a/drivers/char/ipmi/Kconfig
++++ b/drivers/char/ipmi/Kconfig
+@@ -162,7 +162,8 @@ config IPMI_KCS_BMC_SERIO
+
+ config ASPEED_BT_IPMI_BMC
+ depends on ARCH_ASPEED || COMPILE_TEST
+- depends on REGMAP && REGMAP_MMIO && MFD_SYSCON
++ depends on MFD_SYSCON
++ select REGMAP_MMIO
+ tristate "BT IPMI bmc driver"
+ help
+ Provides a driver for the BT (Block Transfer) IPMI interface
+--
+2.39.2
+
--- /dev/null
+From 7b897edad796658c31c56c22d42c8788b7fefcc1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Apr 2023 20:40:35 +0800
+Subject: ipv4: Fix potential uninit variable access bug in __ip_make_skb()
+
+From: Ziyang Xuan <william.xuanziyang@huawei.com>
+
+[ Upstream commit 99e5acae193e369b71217efe6f1dad42f3f18815 ]
+
+Like commit ea30388baebc ("ipv6: Fix an uninit variable access bug in
+__ip6_make_skb()"). icmphdr does not in skb linear region under the
+scenario of SOCK_RAW socket. Access icmp_hdr(skb)->type directly will
+trigger the uninit variable access bug.
+
+Use a local variable icmp_type to carry the correct value in different
+scenarios.
+
+Fixes: 96793b482540 ("[IPV4]: Add ICMPMsgStats MIB (RFC 4293)")
+Reviewed-by: Willem de Bruijn <willemb@google.com>
+Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/ip_output.c | 16 +++++++++++++---
+ 1 file changed, 13 insertions(+), 3 deletions(-)
+
+diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
+index 4e4e308c3230a..89bd7872c6290 100644
+--- a/net/ipv4/ip_output.c
++++ b/net/ipv4/ip_output.c
+@@ -1570,9 +1570,19 @@ struct sk_buff *__ip_make_skb(struct sock *sk,
+ cork->dst = NULL;
+ skb_dst_set(skb, &rt->dst);
+
+- if (iph->protocol == IPPROTO_ICMP)
+- icmp_out_count(net, ((struct icmphdr *)
+- skb_transport_header(skb))->type);
++ if (iph->protocol == IPPROTO_ICMP) {
++ u8 icmp_type;
++
++ /* For such sockets, transhdrlen is zero when do ip_append_data(),
++ * so icmphdr does not in skb linear region and can not get icmp_type
++ * by icmp_hdr(skb)->type.
++ */
++ if (sk->sk_type == SOCK_RAW && !inet_sk(sk)->hdrincl)
++ icmp_type = fl4->fl4_icmp_type;
++ else
++ icmp_type = icmp_hdr(skb)->type;
++ icmp_out_count(net, icmp_type);
++ }
+
+ ip_cork_release(cork);
+ out:
+--
+2.39.2
+
--- /dev/null
+From c7976b7f0e22261d2db6bfe525d6687562379a68 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 16 Apr 2023 19:12:22 +0000
+Subject: ixgbe: Allow flow hash to be set via ethtool
+
+From: Joe Damato <jdamato@fastly.com>
+
+[ Upstream commit 4f3ed1293feb9502dc254b05802faf1ad3317ac6 ]
+
+ixgbe currently returns `EINVAL` whenever the flowhash it set by ethtool
+because the ethtool code in the kernel passes a non-zero value for hfunc
+that ixgbe should allow.
+
+When ethtool is called with `ETHTOOL_SRXFHINDIR`,
+`ethtool_set_rxfh_indir` will call ixgbe's set_rxfh function
+with `ETH_RSS_HASH_NO_CHANGE`. This value should be accepted.
+
+When ethtool is called with `ETHTOOL_SRSSH`, `ethtool_set_rxfh` will
+call ixgbe's set_rxfh function with `rxfh.hfunc`, which appears to be
+hardcoded in ixgbe to always be `ETH_RSS_HASH_TOP`. This value should
+also be accepted.
+
+Before this patch:
+
+$ sudo ethtool -L eth1 combined 10
+$ sudo ethtool -X eth1 default
+Cannot set RX flow hash configuration: Invalid argument
+
+After this patch:
+
+$ sudo ethtool -L eth1 combined 10
+$ sudo ethtool -X eth1 default
+$ sudo ethtool -x eth1
+RX flow hash indirection table for eth1 with 10 RX ring(s):
+ 0: 0 1 2 3 4 5 6 7
+ 8: 8 9 0 1 2 3 4 5
+ 16: 6 7 8 9 0 1 2 3
+ 24: 4 5 6 7 8 9 0 1
+ ...
+
+Fixes: 1c7cf0784e4d ("ixgbe: support for ethtool set_rxfh")
+Signed-off-by: Joe Damato <jdamato@fastly.com>
+Reviewed-by: Sridhar Samudrala <sridhar.samudrala@intel.com>
+Tested-by: Pucha Himasekhar Reddy <himasekharx.reddy.pucha@intel.com> (A Contingent worker at Intel)
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
+index 6cfc9dc165378..821dfd323fa9a 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
+@@ -3131,8 +3131,8 @@ static int ixgbe_set_rxfh(struct net_device *netdev, const u32 *indir,
+ int i;
+ u32 reta_entries = ixgbe_rss_indir_tbl_entries(adapter);
+
+- if (hfunc)
+- return -EINVAL;
++ if (hfunc != ETH_RSS_HASH_NO_CHANGE && hfunc != ETH_RSS_HASH_TOP)
++ return -EOPNOTSUPP;
+
+ /* Fill out the redirection table */
+ if (indir) {
+--
+2.39.2
+
--- /dev/null
+From 1e4733ea14c4d36bd297cc3f43ca013e597c7461 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 16 Apr 2023 19:12:23 +0000
+Subject: ixgbe: Enable setting RSS table to default values
+
+From: Joe Damato <jdamato@fastly.com>
+
+[ Upstream commit e85d3d55875f7a1079edfbc4e4e98d6f8aea9ac7 ]
+
+ethtool uses `ETHTOOL_GRXRINGS` to compute how many queues are supported
+by RSS. The driver should return the smaller of either:
+ - The maximum number of RSS queues the device supports, OR
+ - The number of RX queues configured
+
+Prior to this change, running `ethtool -X $iface default` fails if the
+number of queues configured is larger than the number supported by RSS,
+even though changing the queue count correctly resets the flowhash to
+use all supported queues.
+
+Other drivers (for example, i40e) will succeed but the flow hash will
+reset to support the maximum number of queues supported by RSS, even if
+that amount is smaller than the configured amount.
+
+Prior to this change:
+
+$ sudo ethtool -L eth1 combined 20
+$ sudo ethtool -x eth1
+RX flow hash indirection table for eth1 with 20 RX ring(s):
+ 0: 0 1 2 3 4 5 6 7
+ 8: 8 9 10 11 12 13 14 15
+ 16: 0 1 2 3 4 5 6 7
+ 24: 8 9 10 11 12 13 14 15
+ 32: 0 1 2 3 4 5 6 7
+...
+
+You can see that the flowhash was correctly set to use the maximum
+number of queues supported by the driver (16).
+
+However, asking the NIC to reset to "default" fails:
+
+$ sudo ethtool -X eth1 default
+Cannot set RX flow hash configuration: Invalid argument
+
+After this change, the flowhash can be reset to default which will use
+all of the available RSS queues (16) or the configured queue count,
+whichever is smaller.
+
+Starting with eth1 which has 10 queues and a flowhash distributing to
+all 10 queues:
+
+$ sudo ethtool -x eth1
+RX flow hash indirection table for eth1 with 10 RX ring(s):
+ 0: 0 1 2 3 4 5 6 7
+ 8: 8 9 0 1 2 3 4 5
+ 16: 6 7 8 9 0 1 2 3
+...
+
+Increasing the queue count to 48 resets the flowhash to distribute to 16
+queues, as it did before this patch:
+
+$ sudo ethtool -L eth1 combined 48
+$ sudo ethtool -x eth1
+RX flow hash indirection table for eth1 with 16 RX ring(s):
+ 0: 0 1 2 3 4 5 6 7
+ 8: 8 9 10 11 12 13 14 15
+ 16: 0 1 2 3 4 5 6 7
+...
+
+Due to the other bugfix in this series, the flowhash can be set to use
+queues 0-5:
+
+$ sudo ethtool -X eth1 equal 5
+$ sudo ethtool -x eth1
+RX flow hash indirection table for eth1 with 16 RX ring(s):
+ 0: 0 1 2 3 4 0 1 2
+ 8: 3 4 0 1 2 3 4 0
+ 16: 1 2 3 4 0 1 2 3
+...
+
+Due to this bugfix, the flowhash can be reset to default and use 16
+queues:
+
+$ sudo ethtool -X eth1 default
+$ sudo ethtool -x eth1
+RX flow hash indirection table for eth1 with 16 RX ring(s):
+ 0: 0 1 2 3 4 5 6 7
+ 8: 8 9 10 11 12 13 14 15
+ 16: 0 1 2 3 4 5 6 7
+...
+
+Fixes: 91cd94bfe4f0 ("ixgbe: add basic support for setting and getting nfc controls")
+Signed-off-by: Joe Damato <jdamato@fastly.com>
+Reviewed-by: Sridhar Samudrala <sridhar.samudrala@intel.com>
+Tested-by: Pucha Himasekhar Reddy <himasekharx.reddy.pucha@intel.com> (A Contingent worker at Intel)
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/intel/ixgbe/ixgbe_ethtool.c | 19 ++++++++++---------
+ 1 file changed, 10 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
+index 821dfd323fa9a..0bbad4a5cc2f5 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
+@@ -2665,6 +2665,14 @@ static int ixgbe_get_rss_hash_opts(struct ixgbe_adapter *adapter,
+ return 0;
+ }
+
++static int ixgbe_rss_indir_tbl_max(struct ixgbe_adapter *adapter)
++{
++ if (adapter->hw.mac.type < ixgbe_mac_X550)
++ return 16;
++ else
++ return 64;
++}
++
+ static int ixgbe_get_rxnfc(struct net_device *dev, struct ethtool_rxnfc *cmd,
+ u32 *rule_locs)
+ {
+@@ -2673,7 +2681,8 @@ static int ixgbe_get_rxnfc(struct net_device *dev, struct ethtool_rxnfc *cmd,
+
+ switch (cmd->cmd) {
+ case ETHTOOL_GRXRINGS:
+- cmd->data = adapter->num_rx_queues;
++ cmd->data = min_t(int, adapter->num_rx_queues,
++ ixgbe_rss_indir_tbl_max(adapter));
+ ret = 0;
+ break;
+ case ETHTOOL_GRXCLSRLCNT:
+@@ -3075,14 +3084,6 @@ static int ixgbe_set_rxnfc(struct net_device *dev, struct ethtool_rxnfc *cmd)
+ return ret;
+ }
+
+-static int ixgbe_rss_indir_tbl_max(struct ixgbe_adapter *adapter)
+-{
+- if (adapter->hw.mac.type < ixgbe_mac_X550)
+- return 16;
+- else
+- return 64;
+-}
+-
+ static u32 ixgbe_get_rxfh_key_size(struct net_device *netdev)
+ {
+ return IXGBE_RSS_KEY_SIZE;
+--
+2.39.2
+
--- /dev/null
+From 7e266bbf8e68759570922b10ac56593a31d1078f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Mar 2023 17:49:32 +0200
+Subject: jdb2: Don't refuse invalidation of already invalidated buffers
+
+From: Jan Kara <jack@suse.cz>
+
+[ Upstream commit bd159398a2d2234de07d310132865706964aaaa7 ]
+
+When invalidating buffers under the partial tail page,
+jbd2_journal_invalidate_folio() returns -EBUSY if the buffer is part of
+the committing transaction as we cannot safely modify buffer state.
+However if the buffer is already invalidated (due to previous
+invalidation attempts from ext4_wait_for_tail_page_commit()), there's
+nothing to do and there's no point in returning -EBUSY. This fixes
+occasional warnings from ext4_journalled_invalidate_folio() triggered by
+generic/051 fstest when blocksize < pagesize.
+
+Fixes: 53e872681fed ("ext4: fix deadlock in journal_unmap_buffer()")
+Signed-off-by: Jan Kara <jack@suse.cz>
+Link: https://lore.kernel.org/r/20230329154950.19720-1-jack@suse.cz
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/jbd2/transaction.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
+index 15de1385012eb..18611241f4513 100644
+--- a/fs/jbd2/transaction.c
++++ b/fs/jbd2/transaction.c
+@@ -2387,6 +2387,9 @@ static int journal_unmap_buffer(journal_t *journal, struct buffer_head *bh,
+ spin_unlock(&jh->b_state_lock);
+ write_unlock(&journal->j_state_lock);
+ jbd2_journal_put_journal_head(jh);
++ /* Already zapped buffer? Nothing to do... */
++ if (!bh->b_bdev)
++ return 0;
+ return -EBUSY;
+ }
+ /*
+--
+2.39.2
+
--- /dev/null
+From 2849246bc1ed46f7900b9d3c2552f126722a33ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Mar 2023 20:39:51 +0000
+Subject: kunit: fix bug in the order of lines in debugfs logs
+
+From: Rae Moar <rmoar@google.com>
+
+[ Upstream commit f9a301c3317daa921375da0aec82462ddf019928 ]
+
+Fix bug in debugfs logs that causes an incorrect order of lines in the
+debugfs log.
+
+Currently, the test counts lines that show the number of tests passed,
+failed, and skipped, as well as any suite diagnostic lines,
+appear prior to the individual results, which is a bug.
+
+Ensure the order of printing for the debugfs log is correct. Additionally,
+add a KTAP header to so the debugfs logs can be valid KTAP.
+
+This is an example of a log prior to these fixes:
+
+ KTAP version 1
+
+ # Subtest: kunit_status
+ 1..2
+ # kunit_status: pass:2 fail:0 skip:0 total:2
+ # Totals: pass:2 fail:0 skip:0 total:2
+ ok 1 kunit_status_set_failure_test
+ ok 2 kunit_status_mark_skipped_test
+ ok 1 kunit_status
+
+Note the two lines with stats are out of order. This is the same debugfs
+log after the fixes (in combination with the third patch to remove the
+extra line):
+
+ KTAP version 1
+ 1..1
+ KTAP version 1
+ # Subtest: kunit_status
+ 1..2
+ ok 1 kunit_status_set_failure_test
+ ok 2 kunit_status_mark_skipped_test
+ # kunit_status: pass:2 fail:0 skip:0 total:2
+ # Totals: pass:2 fail:0 skip:0 total:2
+ ok 1 kunit_status
+
+Signed-off-by: Rae Moar <rmoar@google.com>
+Reviewed-by: David Gow <davidgow@google.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/kunit/debugfs.c | 14 ++++++++++++--
+ lib/kunit/test.c | 21 ++++++++++++++-------
+ 2 files changed, 26 insertions(+), 9 deletions(-)
+
+diff --git a/lib/kunit/debugfs.c b/lib/kunit/debugfs.c
+index de0ee2e03ed60..b08bb1fba106d 100644
+--- a/lib/kunit/debugfs.c
++++ b/lib/kunit/debugfs.c
+@@ -55,14 +55,24 @@ static int debugfs_print_results(struct seq_file *seq, void *v)
+ enum kunit_status success = kunit_suite_has_succeeded(suite);
+ struct kunit_case *test_case;
+
+- if (!suite || !suite->log)
++ if (!suite)
+ return 0;
+
+- seq_printf(seq, "%s", suite->log);
++ /* Print KTAP header so the debugfs log can be parsed as valid KTAP. */
++ seq_puts(seq, "KTAP version 1\n");
++ seq_puts(seq, "1..1\n");
++
++ /* Print suite header because it is not stored in the test logs. */
++ seq_puts(seq, KUNIT_SUBTEST_INDENT "KTAP version 1\n");
++ seq_printf(seq, KUNIT_SUBTEST_INDENT "# Subtest: %s\n", suite->name);
++ seq_printf(seq, KUNIT_SUBTEST_INDENT "1..%zd\n", kunit_suite_num_test_cases(suite));
+
+ kunit_suite_for_each_test_case(suite, test_case)
+ debugfs_print_result(seq, suite, test_case);
+
++ if (suite->log)
++ seq_printf(seq, "%s", suite->log);
++
+ seq_printf(seq, "%s %d %s\n",
+ kunit_status_to_ok_not_ok(success), 1, suite->name);
+ return 0;
+diff --git a/lib/kunit/test.c b/lib/kunit/test.c
+index c9e15bb600584..10a5325785f0e 100644
+--- a/lib/kunit/test.c
++++ b/lib/kunit/test.c
+@@ -147,10 +147,18 @@ EXPORT_SYMBOL_GPL(kunit_suite_num_test_cases);
+
+ static void kunit_print_suite_start(struct kunit_suite *suite)
+ {
+- kunit_log(KERN_INFO, suite, KUNIT_SUBTEST_INDENT "KTAP version 1\n");
+- kunit_log(KERN_INFO, suite, KUNIT_SUBTEST_INDENT "# Subtest: %s",
++ /*
++ * We do not log the test suite header as doing so would
++ * mean debugfs display would consist of the test suite
++ * header prior to individual test results.
++ * Hence directly printk the suite status, and we will
++ * separately seq_printf() the suite header for the debugfs
++ * representation.
++ */
++ pr_info(KUNIT_SUBTEST_INDENT "KTAP version 1\n");
++ pr_info(KUNIT_SUBTEST_INDENT "# Subtest: %s\n",
+ suite->name);
+- kunit_log(KERN_INFO, suite, KUNIT_SUBTEST_INDENT "1..%zd",
++ pr_info(KUNIT_SUBTEST_INDENT "1..%zd\n",
+ kunit_suite_num_test_cases(suite));
+ }
+
+@@ -167,10 +175,9 @@ static void kunit_print_ok_not_ok(void *test_or_suite,
+
+ /*
+ * We do not log the test suite results as doing so would
+- * mean debugfs display would consist of the test suite
+- * description and status prior to individual test results.
+- * Hence directly printk the suite status, and we will
+- * separately seq_printf() the suite status for the debugfs
++ * mean debugfs display would consist of an incorrect test
++ * number. Hence directly printk the suite result, and we will
++ * separately seq_printf() the suite results for the debugfs
+ * representation.
+ */
+ if (suite)
+--
+2.39.2
+
--- /dev/null
+From 271469d086fe928f3181c1d94fdce6f16fe4434e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 2 Apr 2023 13:12:59 +0200
+Subject: leds: tca6507: Fix error handling of using
+ fwnode_property_read_string
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: H. Nikolaus Schaller <hns@goldelico.com>
+
+[ Upstream commit c1087c29e96a48e9080377e168d35dcb52fb068b ]
+
+Commit 96f524105b9c ("leds: tca6507: use fwnode API instead of OF")
+
+changed to fwnode API but did not take into account that a missing property
+"linux,default-trigger" now seems to return an error and as a side effect
+sets value to -1. This seems to be different from of_get_property() which
+always returned NULL in any case of error.
+
+Neglecting this side-effect leads to
+
+[ 11.201965] Unable to handle kernel paging request at virtual address ffffffff when read
+
+in the strcmp() of led_trigger_set_default() if there is no led-trigger
+defined in the DTS.
+
+I don't know if this was recently introduced somewhere in the fwnode lib
+or if the effect was missed in initial testing. Anyways it seems to be a
+bug to ignore the error return value of an optional value here in the
+driver.
+
+Fixes: 96f524105b9c ("leds: tca6507: use fwnode API instead of OF")
+Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
+Acked-by: Pavel Machek <pavel@ucw.cz>
+Reviewed-by: Marek Behún <kabel@kernel.org>
+Signed-off-by: Lee Jones <lee@kernel.org>
+Link: https://lore.kernel.org/r/cbae7617db83113de726fcc423a805ebaa1bfca6.1680433978.git.hns@goldelico.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/leds/leds-tca6507.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/leds/leds-tca6507.c b/drivers/leds/leds-tca6507.c
+index 07dd12686a696..634cabd5bb796 100644
+--- a/drivers/leds/leds-tca6507.c
++++ b/drivers/leds/leds-tca6507.c
+@@ -691,8 +691,9 @@ tca6507_led_dt_init(struct device *dev)
+ if (fwnode_property_read_string(child, "label", &led.name))
+ led.name = fwnode_get_name(child);
+
+- fwnode_property_read_string(child, "linux,default-trigger",
+- &led.default_trigger);
++ if (fwnode_property_read_string(child, "linux,default-trigger",
++ &led.default_trigger))
++ led.default_trigger = NULL;
+
+ led.flags = 0;
+ if (fwnode_device_is_compatible(child, "gpio"))
+--
+2.39.2
+
--- /dev/null
+From 765cf35331b57c266e1401aa4eba0b245e713986 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 25 Feb 2023 21:39:49 -0800
+Subject: leds: TI_LMU_COMMON: select REGMAP instead of depending on it
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit a61079efc87888587e463afaed82417b162fbd69 ]
+
+REGMAP is a hidden (not user visible) symbol. Users cannot set it
+directly thru "make *config", so drivers should select it instead of
+depending on it if they need it.
+
+Consistently using "select" or "depends on" can also help reduce
+Kconfig circular dependency issues.
+
+Therefore, change the use of "depends on REGMAP" to "select REGMAP".
+
+Fixes: 3fce8e1eb994 ("leds: TI LMU: Add common code for TI LMU devices")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Acked-by: Pavel Machek <pavel@ucw.cz>
+Signed-off-by: Lee Jones <lee@kernel.org>
+Link: https://lore.kernel.org/r/20230226053953.4681-5-rdunlap@infradead.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/leds/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/leds/Kconfig b/drivers/leds/Kconfig
+index 9dbce09eabacf..aaa9140bc3514 100644
+--- a/drivers/leds/Kconfig
++++ b/drivers/leds/Kconfig
+@@ -795,7 +795,7 @@ config LEDS_SPI_BYTE
+ config LEDS_TI_LMU_COMMON
+ tristate "LED driver for TI LMU"
+ depends on LEDS_CLASS
+- depends on REGMAP
++ select REGMAP
+ help
+ Say Y to enable the LED driver for TI LMU devices.
+ This supports common features between the TI LM3532, LM3631, LM3632,
+--
+2.39.2
+
--- /dev/null
+From 361a40b9bcd5c694efec30bb22569a187f9356ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Feb 2023 09:53:46 +0000
+Subject: libbpf: Fix arm syscall regs spec in bpf_tracing.h
+
+From: Puranjay Mohan <puranjay12@gmail.com>
+
+[ Upstream commit 06943ae675945c762bb8d5edc93d203f2b041d8d ]
+
+The syscall register definitions for ARM in bpf_tracing.h doesn't define
+the fifth parameter for the syscalls. Because of this some KPROBES based
+selftests fail to compile for ARM architecture.
+
+Define the fifth parameter that is passed in the R5 register (uregs[4]).
+
+Fixes: 3a95c42d65d5 ("libbpf: Define arm syscall regs spec in bpf_tracing.h")
+Signed-off-by: Puranjay Mohan <puranjay12@gmail.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20230223095346.10129-1-puranjay12@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/bpf_tracing.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/lib/bpf/bpf_tracing.h b/tools/lib/bpf/bpf_tracing.h
+index 6db88f41fa0df..2cd888733b1c9 100644
+--- a/tools/lib/bpf/bpf_tracing.h
++++ b/tools/lib/bpf/bpf_tracing.h
+@@ -204,6 +204,7 @@ struct pt_regs___s390 {
+ #define __PT_PARM2_SYSCALL_REG __PT_PARM2_REG
+ #define __PT_PARM3_SYSCALL_REG __PT_PARM3_REG
+ #define __PT_PARM4_SYSCALL_REG __PT_PARM4_REG
++#define __PT_PARM5_SYSCALL_REG uregs[4]
+ #define __PT_PARM6_SYSCALL_REG uregs[5]
+ #define __PT_PARM7_SYSCALL_REG uregs[6]
+
+--
+2.39.2
+
--- /dev/null
+From 5e649ac8cddeb4591f6e2bdd67d3cbc535864348 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Feb 2023 14:49:43 -0800
+Subject: libbpf: Fix bpf_xdp_query() in old kernels
+
+From: Yonghong Song <yhs@fb.com>
+
+[ Upstream commit c8ee37bde4021a275d2e4f33bd48d54912bb00c4 ]
+
+Commit 04d58f1b26a4("libbpf: add API to get XDP/XSK supported features")
+added feature_flags to struct bpf_xdp_query_opts. If a user uses
+bpf_xdp_query_opts with feature_flags member, the bpf_xdp_query()
+will check whether 'netdev' family exists or not in the kernel.
+If it does not exist, the bpf_xdp_query() will return -ENOENT.
+
+But 'netdev' family does not exist in old kernels as it is
+introduced in the same patch set as Commit 04d58f1b26a4.
+So old kernel with newer libbpf won't work properly with
+bpf_xdp_query() api call.
+
+To fix this issue, if the return value of
+libbpf_netlink_resolve_genl_family_id() is -ENOENT, bpf_xdp_query()
+will just return 0, skipping the rest of xdp feature query.
+This preserves backward compatibility.
+
+Fixes: 04d58f1b26a4 ("libbpf: add API to get XDP/XSK supported features")
+Signed-off-by: Yonghong Song <yhs@fb.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20230227224943.1153459-1-yhs@fb.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/netlink.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/tools/lib/bpf/netlink.c b/tools/lib/bpf/netlink.c
+index 1653e7a8b0a11..84dd5fa149058 100644
+--- a/tools/lib/bpf/netlink.c
++++ b/tools/lib/bpf/netlink.c
+@@ -468,8 +468,13 @@ int bpf_xdp_query(int ifindex, int xdp_flags, struct bpf_xdp_query_opts *opts)
+ return 0;
+
+ err = libbpf_netlink_resolve_genl_family_id("netdev", sizeof("netdev"), &id);
+- if (err < 0)
++ if (err < 0) {
++ if (err == -ENOENT) {
++ opts->feature_flags = 0;
++ goto skip_feature_flags;
++ }
+ return libbpf_err(err);
++ }
+
+ memset(&req, 0, sizeof(req));
+ req.nh.nlmsg_len = NLMSG_LENGTH(GENL_HDRLEN);
+@@ -489,6 +494,7 @@ int bpf_xdp_query(int ifindex, int xdp_flags, struct bpf_xdp_query_opts *opts)
+
+ opts->feature_flags = md.flags;
+
++skip_feature_flags:
+ return 0;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 0ec2d4cdd84f95473db141a83c1d1c69760a87eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 19 Mar 2023 13:30:13 -0700
+Subject: libbpf: Fix ld_imm64 copy logic for ksym in light skeleton.
+
+From: Alexei Starovoitov <ast@kernel.org>
+
+[ Upstream commit a506d6ce1dd184051037dc9d26c3eb187c9fe625 ]
+
+Unlike normal libbpf the light skeleton 'loader' program is doing
+btf_find_by_name_kind() call at run-time to find ksym in the kernel and
+populate its {btf_id, btf_obj_fd} pair in ld_imm64 insn. To avoid doing the
+search multiple times for the same ksym it remembers the first patched ld_imm64
+insn and copies {btf_id, btf_obj_fd} from it into subsequent ld_imm64 insn.
+Fix a bug in copying logic, since it may incorrectly clear BPF_PSEUDO_BTF_ID flag.
+
+Also replace always true if (btf_obj_fd >= 0) check with unconditional JMP_JA
+to clarify the code.
+
+Fixes: d995816b77eb ("libbpf: Avoid reload of imm for weak, unresolved, repeating ksym")
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20230319203014.55866-1-alexei.starovoitov@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/gen_loader.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/tools/lib/bpf/gen_loader.c b/tools/lib/bpf/gen_loader.c
+index 23f5c46708f8f..b74c82bb831e6 100644
+--- a/tools/lib/bpf/gen_loader.c
++++ b/tools/lib/bpf/gen_loader.c
+@@ -804,11 +804,13 @@ static void emit_relo_ksym_btf(struct bpf_gen *gen, struct ksym_relo_desc *relo,
+ return;
+ /* try to copy from existing ldimm64 insn */
+ if (kdesc->ref > 1) {
+- move_blob2blob(gen, insn + offsetof(struct bpf_insn, imm), 4,
+- kdesc->insn + offsetof(struct bpf_insn, imm));
+ move_blob2blob(gen, insn + sizeof(struct bpf_insn) + offsetof(struct bpf_insn, imm), 4,
+ kdesc->insn + sizeof(struct bpf_insn) + offsetof(struct bpf_insn, imm));
+- /* jump over src_reg adjustment if imm is not 0, reuse BPF_REG_0 from move_blob2blob */
++ move_blob2blob(gen, insn + offsetof(struct bpf_insn, imm), 4,
++ kdesc->insn + offsetof(struct bpf_insn, imm));
++ /* jump over src_reg adjustment if imm (btf_id) is not 0, reuse BPF_REG_0 from move_blob2blob
++ * If btf_id is zero, clear BPF_PSEUDO_BTF_ID flag in src_reg of ld_imm64 insn
++ */
+ emit(gen, BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 3));
+ goto clear_src_reg;
+ }
+@@ -831,7 +833,7 @@ static void emit_relo_ksym_btf(struct bpf_gen *gen, struct ksym_relo_desc *relo,
+ emit(gen, BPF_STX_MEM(BPF_W, BPF_REG_8, BPF_REG_7,
+ sizeof(struct bpf_insn) + offsetof(struct bpf_insn, imm)));
+ /* skip src_reg adjustment */
+- emit(gen, BPF_JMP_IMM(BPF_JSGE, BPF_REG_7, 0, 3));
++ emit(gen, BPF_JMP_IMM(BPF_JA, 0, 0, 3));
+ clear_src_reg:
+ /* clear bpf_object__relocate_data's src_reg assignment, otherwise we get a verifier failure */
+ reg_mask = src_reg_mask();
+--
+2.39.2
+
--- /dev/null
+From 1f53726efd6d0fdcb8569455c8261d5374716f3c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Mar 2023 19:15:29 -0700
+Subject: linux/vt_buffer.h: allow either builtin or modular for macros
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 2b76ffe81e32afd6d318dc4547e2ba8c46207b77 ]
+
+Fix build errors on ARCH=alpha when CONFIG_MDA_CONSOLE=m.
+This allows the ARCH macros to be the only ones defined.
+
+In file included from ../drivers/video/console/mdacon.c:37:
+../arch/alpha/include/asm/vga.h:17:40: error: expected identifier or '(' before 'volatile'
+ 17 | static inline void scr_writew(u16 val, volatile u16 *addr)
+ | ^~~~~~~~
+../include/linux/vt_buffer.h:24:34: note: in definition of macro 'scr_writew'
+ 24 | #define scr_writew(val, addr) (*(addr) = (val))
+ | ^~~~
+../include/linux/vt_buffer.h:24:40: error: expected ')' before '=' token
+ 24 | #define scr_writew(val, addr) (*(addr) = (val))
+ | ^
+../arch/alpha/include/asm/vga.h:17:20: note: in expansion of macro 'scr_writew'
+ 17 | static inline void scr_writew(u16 val, volatile u16 *addr)
+ | ^~~~~~~~~~
+../arch/alpha/include/asm/vga.h:25:29: error: expected identifier or '(' before 'volatile'
+ 25 | static inline u16 scr_readw(volatile const u16 *addr)
+ | ^~~~~~~~
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Jiri Slaby <jirislaby@kernel.org>
+Cc: dri-devel@lists.freedesktop.org
+Cc: linux-fbdev@vger.kernel.org
+Link: https://lore.kernel.org/r/20230329021529.16188-1-rdunlap@infradead.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/vt_buffer.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/vt_buffer.h b/include/linux/vt_buffer.h
+index 848db1b1569ff..919d999a8c1db 100644
+--- a/include/linux/vt_buffer.h
++++ b/include/linux/vt_buffer.h
+@@ -16,7 +16,7 @@
+
+ #include <linux/string.h>
+
+-#if defined(CONFIG_VGA_CONSOLE) || defined(CONFIG_MDA_CONSOLE)
++#if IS_ENABLED(CONFIG_VGA_CONSOLE) || IS_ENABLED(CONFIG_MDA_CONSOLE)
+ #include <asm/vga.h>
+ #endif
+
+--
+2.39.2
+
--- /dev/null
+From 9a16aaf6eafc300d04a137f97808de54e19599ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Feb 2023 17:42:41 -0800
+Subject: macintosh: via-pmu-led: requires ATA to be set
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 05dce4ba125336875cd3eed3c1503fa81cd2f691 ]
+
+LEDS_TRIGGER_DISK depends on ATA, so selecting LEDS_TRIGGER_DISK
+when ATA is not set/enabled causes a Kconfig warning:
+
+WARNING: unmet direct dependencies detected for LEDS_TRIGGER_DISK
+ Depends on [n]: NEW_LEDS [=y] && LEDS_TRIGGERS [=y] && ATA [=n]
+ Selected by [y]:
+ - ADB_PMU_LED_DISK [=y] && MACINTOSH_DRIVERS [=y] && ADB_PMU_LED [=y] && LEDS_CLASS [=y]
+
+Fix this by making ADB_PMU_LED_DISK depend on ATA.
+
+Seen on both PPC32 and PPC64.
+
+Fixes: 0e865a80c135 ("macintosh: Remove dependency on IDE_GD_ATA if ADB_PMU_LED_DISK is selected")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20230223014241.20878-1-rdunlap@infradead.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/macintosh/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/macintosh/Kconfig b/drivers/macintosh/Kconfig
+index 539a2ed4e13dc..a0e717a986dcb 100644
+--- a/drivers/macintosh/Kconfig
++++ b/drivers/macintosh/Kconfig
+@@ -86,6 +86,7 @@ config ADB_PMU_LED
+
+ config ADB_PMU_LED_DISK
+ bool "Use front LED as DISK LED by default"
++ depends on ATA
+ depends on ADB_PMU_LED
+ depends on LEDS_CLASS
+ select LEDS_TRIGGERS
+--
+2.39.2
+
--- /dev/null
+From 09e58c5e653a1c3e37746267a45d109408c15d53 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Mar 2023 11:35:58 +0800
+Subject: macintosh/windfarm_smu_sat: Add missing of_node_put()
+
+From: Liang He <windhl@126.com>
+
+[ Upstream commit 631cf002826007ab7415258ee647dcaf8845ad5a ]
+
+We call of_node_get() in wf_sat_probe() after sat is created,
+so we need the of_node_put() before *kfree(sat)*.
+
+Fixes: ac171c46667c ("[PATCH] powerpc: Thermal control for dual core G5s")
+Signed-off-by: Liang He <windhl@126.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20230330033558.2562778-1-windhl@126.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/macintosh/windfarm_smu_sat.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/macintosh/windfarm_smu_sat.c b/drivers/macintosh/windfarm_smu_sat.c
+index ebc4256a9e4a0..089f2743a070d 100644
+--- a/drivers/macintosh/windfarm_smu_sat.c
++++ b/drivers/macintosh/windfarm_smu_sat.c
+@@ -171,6 +171,7 @@ static void wf_sat_release(struct kref *ref)
+
+ if (sat->nr >= 0)
+ sats[sat->nr] = NULL;
++ of_node_put(sat->node);
+ kfree(sat);
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 5e09df683807f2a71d6bc164203751e36c64bc31 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Mar 2023 20:22:52 +0000
+Subject: mailbox: mpfs: switch to txdone_poll
+
+From: Conor Dooley <conor.dooley@microchip.com>
+
+[ Upstream commit b5984a9844fc45cd301a28fb56f3de95f7e20f3c ]
+
+The system controller on PolarFire SoC has no interrupt to signify that
+the TX has been completed. The interrupt instead signals that a service
+requested by the mailbox client has succeeded. If a service fails, there
+will be no interrupt delivered.
+
+Switch to polling the busy register to determine whether transmission
+has completed.
+
+Fixes: 83d7b1560810 ("mbox: add polarfire soc system controller mailbox")
+Acked-by: Jassi Brar <jaswinder.singh@linaro.org>
+Tested-by: Valentina Fernandez <valentina.fernandezalanis@microchip.com>
+Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mailbox/mailbox-mpfs.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/mailbox/mailbox-mpfs.c b/drivers/mailbox/mailbox-mpfs.c
+index 853901acaeec2..08aa840cccaca 100644
+--- a/drivers/mailbox/mailbox-mpfs.c
++++ b/drivers/mailbox/mailbox-mpfs.c
+@@ -79,6 +79,13 @@ static bool mpfs_mbox_busy(struct mpfs_mbox *mbox)
+ return status & SCB_STATUS_BUSY_MASK;
+ }
+
++static bool mpfs_mbox_last_tx_done(struct mbox_chan *chan)
++{
++ struct mpfs_mbox *mbox = (struct mpfs_mbox *)chan->con_priv;
++
++ return !mpfs_mbox_busy(mbox);
++}
++
+ static int mpfs_mbox_send_data(struct mbox_chan *chan, void *data)
+ {
+ struct mpfs_mbox *mbox = (struct mpfs_mbox *)chan->con_priv;
+@@ -182,7 +189,6 @@ static irqreturn_t mpfs_mbox_inbox_isr(int irq, void *data)
+
+ mpfs_mbox_rx_data(chan);
+
+- mbox_chan_txdone(chan, 0);
+ return IRQ_HANDLED;
+ }
+
+@@ -212,6 +218,7 @@ static const struct mbox_chan_ops mpfs_mbox_ops = {
+ .send_data = mpfs_mbox_send_data,
+ .startup = mpfs_mbox_startup,
+ .shutdown = mpfs_mbox_shutdown,
++ .last_tx_done = mpfs_mbox_last_tx_done,
+ };
+
+ static int mpfs_mbox_probe(struct platform_device *pdev)
+@@ -247,7 +254,8 @@ static int mpfs_mbox_probe(struct platform_device *pdev)
+ mbox->controller.num_chans = 1;
+ mbox->controller.chans = mbox->chans;
+ mbox->controller.ops = &mpfs_mbox_ops;
+- mbox->controller.txdone_irq = true;
++ mbox->controller.txdone_poll = true;
++ mbox->controller.txpoll_period = 10u;
+
+ ret = devm_mbox_controller_register(&pdev->dev, &mbox->controller);
+ if (ret) {
+--
+2.39.2
+
--- /dev/null
+From 5f3a7902a9804dc28a4ef8484b11e8ce54a1d642 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Mar 2023 09:22:58 +0800
+Subject: md/raid10: don't call bio_start_io_acct twice for bio which
+ experienced read error
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit 7cddb055bfda5f7b0be931e8ea750fc28bc18a27 ]
+
+handle_read_error() will resumit r10_bio by raid10_read_request(), which
+will call bio_start_io_acct() again, while bio_end_io_acct() will only
+be called once.
+
+Fix the problem by don't account io again from handle_read_error().
+
+Fixes: 528bc2cf2fcc ("md/raid10: enable io accounting")
+Suggested-by: Song Liu <song@kernel.org>
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Signed-off-by: Song Liu <song@kernel.org>
+Link: https://lore.kernel.org/r/20230314012258.2395894-1-yukuai1@huaweicloud.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/raid10.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
+index 20522af894e0d..0193cc7a6c8e1 100644
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -1248,7 +1248,8 @@ static void raid10_read_request(struct mddev *mddev, struct bio *bio,
+ }
+ slot = r10_bio->read_slot;
+
+- if (blk_queue_io_stat(bio->bi_bdev->bd_disk->queue))
++ if (!r10_bio->start_time &&
++ blk_queue_io_stat(bio->bi_bdev->bd_disk->queue))
+ r10_bio->start_time = bio_start_io_acct(bio);
+ read_bio = bio_alloc_clone(rdev->bdev, bio, gfp, &mddev->bio_set);
+
+@@ -1578,6 +1579,7 @@ static void __make_request(struct mddev *mddev, struct bio *bio, int sectors)
+ r10_bio->sector = bio->bi_iter.bi_sector;
+ r10_bio->state = 0;
+ r10_bio->read_slot = -1;
++ r10_bio->start_time = 0;
+ memset(r10_bio->devs, 0, sizeof(r10_bio->devs[0]) *
+ conf->geo.raid_disks);
+
+--
+2.39.2
+
--- /dev/null
+From 0c232751bc053027494fd1b9b307b48c6fea6949 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Mar 2023 15:38:53 +0800
+Subject: md/raid10: fix leak of 'r10bio->remaining' for recovery
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit 26208a7cffd0c7cbf14237ccd20c7270b3ffeb7e ]
+
+raid10_sync_request() will add 'r10bio->remaining' for both rdev and
+replacement rdev. However, if the read io fails, recovery_request_write()
+returns without issuing the write io, in this case, end_sync_request()
+is only called once and 'remaining' is leaked, cause an io hang.
+
+Fix the problem by decreasing 'remaining' according to if 'bio' and
+'repl_bio' is valid.
+
+Fixes: 24afd80d99f8 ("md/raid10: handle recovery of replacement devices.")
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Signed-off-by: Song Liu <song@kernel.org>
+Link: https://lore.kernel.org/r/20230310073855.1337560-5-yukuai1@huaweicloud.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/raid10.c | 23 +++++++++++++----------
+ 1 file changed, 13 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
+index db9ee3b637d6f..b1c575859218a 100644
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -2613,11 +2613,22 @@ static void recovery_request_write(struct mddev *mddev, struct r10bio *r10_bio)
+ {
+ struct r10conf *conf = mddev->private;
+ int d;
+- struct bio *wbio, *wbio2;
++ struct bio *wbio = r10_bio->devs[1].bio;
++ struct bio *wbio2 = r10_bio->devs[1].repl_bio;
++
++ /* Need to test wbio2->bi_end_io before we call
++ * submit_bio_noacct as if the former is NULL,
++ * the latter is free to free wbio2.
++ */
++ if (wbio2 && !wbio2->bi_end_io)
++ wbio2 = NULL;
+
+ if (!test_bit(R10BIO_Uptodate, &r10_bio->state)) {
+ fix_recovery_read_error(r10_bio);
+- end_sync_request(r10_bio);
++ if (wbio->bi_end_io)
++ end_sync_request(r10_bio);
++ if (wbio2)
++ end_sync_request(r10_bio);
+ return;
+ }
+
+@@ -2626,14 +2637,6 @@ static void recovery_request_write(struct mddev *mddev, struct r10bio *r10_bio)
+ * and submit the write request
+ */
+ d = r10_bio->devs[1].devnum;
+- wbio = r10_bio->devs[1].bio;
+- wbio2 = r10_bio->devs[1].repl_bio;
+- /* Need to test wbio2->bi_end_io before we call
+- * submit_bio_noacct as if the former is NULL,
+- * the latter is free to free wbio2.
+- */
+- if (wbio2 && !wbio2->bi_end_io)
+- wbio2 = NULL;
+ if (wbio->bi_end_io) {
+ atomic_inc(&conf->mirrors[d].rdev->nr_pending);
+ md_sync_acct(conf->mirrors[d].rdev->bdev, bio_sectors(wbio));
+--
+2.39.2
+
--- /dev/null
+From 2778241978aed9ca50d1f15b60e3140c9d0a2a7d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Mar 2023 15:38:54 +0800
+Subject: md/raid10: fix memleak for 'conf->bio_split'
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit c9ac2acde53f5385de185bccf6aaa91cf9ac1541 ]
+
+In the error path of raid10_run(), 'conf' need be freed, however,
+'conf->bio_split' is missed and memory will be leaked.
+
+Since there are 3 places to free 'conf', factor out a helper to fix the
+problem.
+
+Fixes: fc9977dd069e ("md/raid10: simplify the splitting of requests.")
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Signed-off-by: Song Liu <song@kernel.org>
+Link: https://lore.kernel.org/r/20230310073855.1337560-6-yukuai1@huaweicloud.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/raid10.c | 37 +++++++++++++++++--------------------
+ 1 file changed, 17 insertions(+), 20 deletions(-)
+
+diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
+index b1c575859218a..5736ba5932c7f 100644
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -4015,6 +4015,20 @@ static int setup_geo(struct geom *geo, struct mddev *mddev, enum geo_type new)
+ return nc*fc;
+ }
+
++static void raid10_free_conf(struct r10conf *conf)
++{
++ if (!conf)
++ return;
++
++ mempool_exit(&conf->r10bio_pool);
++ kfree(conf->mirrors);
++ kfree(conf->mirrors_old);
++ kfree(conf->mirrors_new);
++ safe_put_page(conf->tmppage);
++ bioset_exit(&conf->bio_split);
++ kfree(conf);
++}
++
+ static struct r10conf *setup_conf(struct mddev *mddev)
+ {
+ struct r10conf *conf = NULL;
+@@ -4097,13 +4111,7 @@ static struct r10conf *setup_conf(struct mddev *mddev)
+ return conf;
+
+ out:
+- if (conf) {
+- mempool_exit(&conf->r10bio_pool);
+- kfree(conf->mirrors);
+- safe_put_page(conf->tmppage);
+- bioset_exit(&conf->bio_split);
+- kfree(conf);
+- }
++ raid10_free_conf(conf);
+ return ERR_PTR(err);
+ }
+
+@@ -4294,10 +4302,7 @@ static int raid10_run(struct mddev *mddev)
+
+ out_free_conf:
+ md_unregister_thread(&mddev->thread);
+- mempool_exit(&conf->r10bio_pool);
+- safe_put_page(conf->tmppage);
+- kfree(conf->mirrors);
+- kfree(conf);
++ raid10_free_conf(conf);
+ mddev->private = NULL;
+ out:
+ return -EIO;
+@@ -4305,15 +4310,7 @@ static int raid10_run(struct mddev *mddev)
+
+ static void raid10_free(struct mddev *mddev, void *priv)
+ {
+- struct r10conf *conf = priv;
+-
+- mempool_exit(&conf->r10bio_pool);
+- safe_put_page(conf->tmppage);
+- kfree(conf->mirrors);
+- kfree(conf->mirrors_old);
+- kfree(conf->mirrors_new);
+- bioset_exit(&conf->bio_split);
+- kfree(conf);
++ raid10_free_conf(priv);
+ }
+
+ static void raid10_quiesce(struct mddev *mddev, int quiesce)
+--
+2.39.2
+
--- /dev/null
+From 4656cfef9467ebaea5429cd1fc08f5ba96b60c18 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Mar 2023 15:38:55 +0800
+Subject: md/raid10: fix memleak of md thread
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit f0ddb83da3cbbf8a1f9087a642c448ff52ee9abd ]
+
+In raid10_run(), if setup_conf() succeed and raid10_run() failed before
+setting 'mddev->thread', then in the error path 'conf->thread' is not
+freed.
+
+Fix the problem by setting 'mddev->thread' right after setup_conf().
+
+Fixes: 43a521238aca ("md-cluster: choose correct label when clustered layout is not supported")
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Signed-off-by: Song Liu <song@kernel.org>
+Link: https://lore.kernel.org/r/20230310073855.1337560-7-yukuai1@huaweicloud.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/raid10.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
+index 5736ba5932c7f..20522af894e0d 100644
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -4148,6 +4148,9 @@ static int raid10_run(struct mddev *mddev)
+ if (!conf)
+ goto out;
+
++ mddev->thread = conf->thread;
++ conf->thread = NULL;
++
+ if (mddev_is_clustered(conf->mddev)) {
+ int fc, fo;
+
+@@ -4160,9 +4163,6 @@ static int raid10_run(struct mddev *mddev)
+ }
+ }
+
+- mddev->thread = conf->thread;
+- conf->thread = NULL;
+-
+ if (mddev->queue) {
+ blk_queue_max_write_zeroes_sectors(mddev->queue, 0);
+ blk_queue_io_min(mddev->queue, mddev->chunk_sectors << 9);
+--
+2.39.2
+
--- /dev/null
+From e9eec9191b0a2487d6c6f9f9ff77c23ed1d2f5cd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Feb 2023 12:09:59 +0800
+Subject: md/raid10: fix task hung in raid10d
+
+From: Li Nan <linan122@huawei.com>
+
+[ Upstream commit 72c215ed8731c88b2d7e09afc51fffc207ae47b8 ]
+
+commit fe630de009d0 ("md/raid10: avoid deadlock on recovery.") allowed
+normal io and sync io to exist at the same time. Task hung will occur as
+below:
+
+T1 T2 T3 T4
+raid10d
+ handle_read_error
+ allow_barrier
+ conf->nr_pending--
+ -> 0
+ //submit sync io
+ raid10_sync_request
+ raise_barrier
+ ->will not be blocked
+ ...
+ //submit to drivers
+ raid10_read_request
+ wait_barrier
+ conf->nr_pending++
+ -> 1
+ //retry read fail
+ raid10_end_read_request
+ reschedule_retry
+ add to retry_list
+ conf->nr_queued++
+ -> 1
+ //sync io fail
+ end_sync_read
+ __end_sync_read
+ reschedule_retry
+ add to retry_list
+ conf->nr_queued++
+ -> 2
+ ...
+ handle_read_error
+ get form retry_list
+ conf->nr_queued--
+ freeze_array
+ wait nr_pending == nr_queued+1
+ ->1 ->2
+ //task hung
+
+retry read and sync io will be added to retry_list(nr_queued->2) if they
+fails. raid10d() called handle_read_error() and hung in freeze_array().
+nr_queued will not decrease because raid10d is blocked, nr_pending will
+not increase because conf->barrier is not released.
+
+Fix it by moving allow_barrier() after raid10_read_request().
+raise_barrier() will wait for nr_waiting to become 0. Therefore, sync io
+and regular io will not be issued at the same time.
+
+Also remove the check of nr_queued in stop_waiting_barrier. It can be 0
+but don't need to be blocking. Remove the check for MD_RECOVERY_RUNNING as
+the check is redundent.
+
+Fixes: fe630de009d0 ("md/raid10: avoid deadlock on recovery.")
+Signed-off-by: Li Nan <linan122@huawei.com>
+Signed-off-by: Song Liu <song@kernel.org>
+Link: https://lore.kernel.org/r/20230222041000.3341651-2-linan666@huaweicloud.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/raid10.c | 18 +++++++++++++-----
+ 1 file changed, 13 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
+index 6c66357f92f55..db9ee3b637d6f 100644
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -995,11 +995,15 @@ static bool stop_waiting_barrier(struct r10conf *conf)
+ (!bio_list_empty(&bio_list[0]) || !bio_list_empty(&bio_list[1])))
+ return true;
+
+- /* move on if recovery thread is blocked by us */
+- if (conf->mddev->thread->tsk == current &&
+- test_bit(MD_RECOVERY_RUNNING, &conf->mddev->recovery) &&
+- conf->nr_queued > 0)
++ /*
++ * move on if io is issued from raid10d(), nr_pending is not released
++ * from original io(see handle_read_error()). All raise barrier is
++ * blocked until this io is done.
++ */
++ if (conf->mddev->thread->tsk == current) {
++ WARN_ON_ONCE(atomic_read(&conf->nr_pending) == 0);
+ return true;
++ }
+
+ return false;
+ }
+@@ -2978,9 +2982,13 @@ static void handle_read_error(struct mddev *mddev, struct r10bio *r10_bio)
+ md_error(mddev, rdev);
+
+ rdev_dec_pending(rdev, mddev);
+- allow_barrier(conf);
+ r10_bio->state = 0;
+ raid10_read_request(mddev, r10_bio->master_bio, r10_bio);
++ /*
++ * allow_barrier after re-submit to ensure no sync io
++ * can be issued while regular io pending.
++ */
++ allow_barrier(conf);
+ }
+
+ static void handle_write_completed(struct r10conf *conf, struct r10bio *r10_bio)
+--
+2.39.2
+
--- /dev/null
+From c15fb14eb34747814ab1d012af3eabde2ecbf431 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Mar 2023 06:34:10 +0100
+Subject: media: amphion: decoder implement display delay enable
+
+From: Ming Qian <ming.qian@nxp.com>
+
+[ Upstream commit ffa331d9bf9407655fc4c4d57dcc92ed2868e326 ]
+
+amphion vpu support a low latency mode,
+when V4L2_CID_MPEG_VIDEO_DEC_DISPLAY_DELAY_ENABLE is enabled,
+decoder can display frame immediately after it's decoded.
+Only h264 is support yet.
+
+Fixes: 6de8d628df6e ("media: amphion: add v4l2 m2m vpu decoder stateful driver")
+Signed-off-by: Ming Qian <ming.qian@nxp.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/amphion/vdec.c | 32 +++++++++++++++++++++
+ drivers/media/platform/amphion/vpu_codec.h | 3 +-
+ drivers/media/platform/amphion/vpu_malone.c | 4 ++-
+ 3 files changed, 37 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/platform/amphion/vdec.c b/drivers/media/platform/amphion/vdec.c
+index 87f9f8e90ab13..70633530d23a1 100644
+--- a/drivers/media/platform/amphion/vdec.c
++++ b/drivers/media/platform/amphion/vdec.c
+@@ -168,7 +168,31 @@ static const struct vpu_format vdec_formats[] = {
+ {0, 0, 0, 0},
+ };
+
++static int vdec_op_s_ctrl(struct v4l2_ctrl *ctrl)
++{
++ struct vpu_inst *inst = ctrl_to_inst(ctrl);
++ struct vdec_t *vdec = inst->priv;
++ int ret = 0;
++
++ vpu_inst_lock(inst);
++ switch (ctrl->id) {
++ case V4L2_CID_MPEG_VIDEO_DEC_DISPLAY_DELAY_ENABLE:
++ vdec->params.display_delay_enable = ctrl->val;
++ break;
++ case V4L2_CID_MPEG_VIDEO_DEC_DISPLAY_DELAY:
++ vdec->params.display_delay = ctrl->val;
++ break;
++ default:
++ ret = -EINVAL;
++ break;
++ }
++ vpu_inst_unlock(inst);
++
++ return ret;
++}
++
+ static const struct v4l2_ctrl_ops vdec_ctrl_ops = {
++ .s_ctrl = vdec_op_s_ctrl,
+ .g_volatile_ctrl = vpu_helper_g_volatile_ctrl,
+ };
+
+@@ -181,6 +205,14 @@ static int vdec_ctrl_init(struct vpu_inst *inst)
+ if (ret)
+ return ret;
+
++ v4l2_ctrl_new_std(&inst->ctrl_handler, &vdec_ctrl_ops,
++ V4L2_CID_MPEG_VIDEO_DEC_DISPLAY_DELAY,
++ 0, 0, 1, 0);
++
++ v4l2_ctrl_new_std(&inst->ctrl_handler, &vdec_ctrl_ops,
++ V4L2_CID_MPEG_VIDEO_DEC_DISPLAY_DELAY_ENABLE,
++ 0, 1, 1, 0);
++
+ ctrl = v4l2_ctrl_new_std(&inst->ctrl_handler, &vdec_ctrl_ops,
+ V4L2_CID_MIN_BUFFERS_FOR_CAPTURE, 1, 32, 1, 2);
+ if (ctrl)
+diff --git a/drivers/media/platform/amphion/vpu_codec.h b/drivers/media/platform/amphion/vpu_codec.h
+index 528a93f08ecd4..bac6d0d94f8a5 100644
+--- a/drivers/media/platform/amphion/vpu_codec.h
++++ b/drivers/media/platform/amphion/vpu_codec.h
+@@ -55,7 +55,8 @@ struct vpu_encode_params {
+ struct vpu_decode_params {
+ u32 codec_format;
+ u32 output_format;
+- u32 b_dis_reorder;
++ u32 display_delay_enable;
++ u32 display_delay;
+ u32 b_non_frame;
+ u32 frame_count;
+ u32 end_flag;
+diff --git a/drivers/media/platform/amphion/vpu_malone.c b/drivers/media/platform/amphion/vpu_malone.c
+index 2c9bfc6a5a72e..feb5c25e31044 100644
+--- a/drivers/media/platform/amphion/vpu_malone.c
++++ b/drivers/media/platform/amphion/vpu_malone.c
+@@ -641,7 +641,9 @@ static int vpu_malone_set_params(struct vpu_shared_addr *shared,
+ hc->jpg[instance].jpg_mjpeg_interlaced = 0;
+ }
+
+- hc->codec_param[instance].disp_imm = params->b_dis_reorder ? 1 : 0;
++ hc->codec_param[instance].disp_imm = params->display_delay_enable ? 1 : 0;
++ if (malone_format != MALONE_FMT_AVC)
++ hc->codec_param[instance].disp_imm = 0;
+ hc->codec_param[instance].dbglog_enable = 0;
+ iface->dbglog_desc.level = 0;
+
+--
+2.39.2
+
--- /dev/null
+From 79f2af0421ba575768eb8c1da70d1fbb0913f10c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Mar 2023 11:00:23 +0100
+Subject: media: av7110: prevent underflow in write_ts_to_decoder()
+
+From: Dan Carpenter <error27@gmail.com>
+
+[ Upstream commit eed9496a0501357aa326ddd6b71408189ed872eb ]
+
+The buf[4] value comes from the user via ts_play(). It is a value in
+the u8 range. The final length we pass to av7110_ipack_instant_repack()
+is "len - (buf[4] + 1) - 4" so add a check to ensure that the length is
+not negative. It's not clear that passing a negative len value does
+anything bad necessarily, but it's not best practice.
+
+With the new bounds checking the "if (!len)" condition is no longer
+possible or required so remove that.
+
+Fixes: fd46d16d602a ("V4L/DVB (11759): dvb-ttpci: Add TS replay capability")
+Signed-off-by: Dan Carpenter <error27@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/av7110/av7110_av.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/staging/media/av7110/av7110_av.c b/drivers/staging/media/av7110/av7110_av.c
+index 0bf513c26b6b5..a5c5bebad3061 100644
+--- a/drivers/staging/media/av7110/av7110_av.c
++++ b/drivers/staging/media/av7110/av7110_av.c
+@@ -823,10 +823,10 @@ static int write_ts_to_decoder(struct av7110 *av7110, int type, const u8 *buf, s
+ av7110_ipack_flush(ipack);
+
+ if (buf[3] & ADAPT_FIELD) {
++ if (buf[4] > len - 1 - 4)
++ return 0;
+ len -= buf[4] + 1;
+ buf += buf[4] + 1;
+- if (!len)
+- return 0;
+ }
+
+ av7110_ipack_instant_repack(buf + 4, len - 4, ipack);
+--
+2.39.2
+
--- /dev/null
+From 63307d1caf183ec805c96acb1690eb4719353d0c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Feb 2023 08:14:42 +0100
+Subject: media: bdisp: Add missing check for create_workqueue
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit 2371adeab717d8fe32144a84f3491a03c5838cfb ]
+
+Add the check for the return value of the create_workqueue
+in order to avoid NULL pointer dereference.
+
+Fixes: 28ffeebbb7bd ("[media] bdisp: 2D blitter driver using v4l2 mem2mem framework")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/st/sti/bdisp/bdisp-v4l2.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/media/platform/st/sti/bdisp/bdisp-v4l2.c b/drivers/media/platform/st/sti/bdisp/bdisp-v4l2.c
+index dd74cc43920d3..080da254b9109 100644
+--- a/drivers/media/platform/st/sti/bdisp/bdisp-v4l2.c
++++ b/drivers/media/platform/st/sti/bdisp/bdisp-v4l2.c
+@@ -1309,6 +1309,8 @@ static int bdisp_probe(struct platform_device *pdev)
+ init_waitqueue_head(&bdisp->irq_queue);
+ INIT_DELAYED_WORK(&bdisp->timeout_work, bdisp_irq_timeout);
+ bdisp->work_queue = create_workqueue(BDISP_NAME);
++ if (!bdisp->work_queue)
++ return -ENOMEM;
+
+ spin_lock_init(&bdisp->slock);
+ mutex_init(&bdisp->lock);
+--
+2.39.2
+
--- /dev/null
+From d2e90d56173584e8f2ab133c1d61a32fe0216b96 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Mar 2023 16:31:20 +0000
+Subject: media: cedrus: fix use after free bug in cedrus_remove due to race
+ condition
+
+From: Zheng Wang <zyytlz.wz@163.com>
+
+[ Upstream commit 50d0a7aea4809cef87979d4669911276aa23b71f ]
+
+In cedrus_probe, dev->watchdog_work is bound with cedrus_watchdog function.
+In cedrus_device_run, it will started by schedule_delayed_work. If there is
+an unfinished work in cedrus_remove, there may be a race condition and
+trigger UAF bug.
+
+CPU0 CPU1
+
+ |cedrus_watchdog
+cedrus_remove |
+ v4l2_m2m_release |
+ kfree(m2m_dev) |
+ |
+ | v4l2_m2m_get_curr_priv
+ | m2m_dev //use
+
+Fix it by canceling the worker in cedrus_remove.
+
+Fixes: 7c38a551bda1 ("media: cedrus: Add watchdog for job completion")
+Signed-off-by: Zheng Wang <zyytlz.wz@163.com>
+Acked-by: Jernej Skrabec <jernej.skrabec@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/sunxi/cedrus/cedrus.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/staging/media/sunxi/cedrus/cedrus.c b/drivers/staging/media/sunxi/cedrus/cedrus.c
+index a43d5ff667163..a50a4d0a8f715 100644
+--- a/drivers/staging/media/sunxi/cedrus/cedrus.c
++++ b/drivers/staging/media/sunxi/cedrus/cedrus.c
+@@ -547,6 +547,7 @@ static int cedrus_remove(struct platform_device *pdev)
+ {
+ struct cedrus_dev *dev = platform_get_drvdata(pdev);
+
++ cancel_delayed_work_sync(&dev->watchdog_work);
+ if (media_devnode_is_registered(dev->mdev.devnode)) {
+ media_device_unregister(&dev->mdev);
+ v4l2_m2m_unregister_media_controller(dev->m2m_dev);
+--
+2.39.2
+
--- /dev/null
+From 33055cd088f525e2dbd4828b2383c4bfa6f1a81b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 18 Mar 2023 16:15:06 +0800
+Subject: media: dm1105: Fix use after free bug in dm1105_remove due to race
+ condition
+
+From: Zheng Wang <zyytlz.wz@163.com>
+
+[ Upstream commit 5abda7a16698d4d1f47af1168d8fa2c640116b4a ]
+
+In dm1105_probe, it called dm1105_ir_init and bound
+&dm1105->ir.work with dm1105_emit_key.
+When it handles IRQ request with dm1105_irq,
+it may call schedule_work to start the work.
+
+When we call dm1105_remove to remove the driver, there
+may be a sequence as follows:
+
+Fix it by finishing the work before cleanup in dm1105_remove
+
+CPU0 CPU1
+
+ |dm1105_emit_key
+dm1105_remove |
+ dm1105_ir_exit |
+ rc_unregister_device |
+ rc_free_device |
+ rc_dev_release |
+ kfree(dev); |
+ |
+ | rc_keydown
+ | //use
+
+Fixes: 34d2f9bf189c ("V4L/DVB: dm1105: use dm1105_dev & dev instead of dm1105dvb")
+Signed-off-by: Zheng Wang <zyytlz.wz@163.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/dm1105/dm1105.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/media/pci/dm1105/dm1105.c b/drivers/media/pci/dm1105/dm1105.c
+index 4ac645a56c14e..9e9c7c071accc 100644
+--- a/drivers/media/pci/dm1105/dm1105.c
++++ b/drivers/media/pci/dm1105/dm1105.c
+@@ -1176,6 +1176,7 @@ static void dm1105_remove(struct pci_dev *pdev)
+ struct dvb_demux *dvbdemux = &dev->demux;
+ struct dmx_demux *dmx = &dvbdemux->dmx;
+
++ cancel_work_sync(&dev->ir.work);
+ dm1105_ir_exit(dev);
+ dmx->close(dmx);
+ dvb_net_release(&dev->dvbnet);
+--
+2.39.2
+
--- /dev/null
+From 41630d94f413625003f17a96143ee40bed6cd6ff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Mar 2023 11:58:09 +0000
+Subject: media: hi846: Fix memleak in hi846_init_controls()
+
+From: Wei Chen <harperchen1110@gmail.com>
+
+[ Upstream commit 2649c1a20e8e399ee955d0e22192f9992662c3d2 ]
+
+hi846_init_controls doesn't clean the allocated ctrl_hdlr
+in case there is a failure, which causes memleak. Add
+v4l2_ctrl_handler_free to free the resource properly.
+
+Fixes: e8c0882685f9 ("media: i2c: add driver for the SK Hynix Hi-846 8M pixel camera")
+Signed-off-by: Wei Chen <harperchen1110@gmail.com>
+Reviewed-by: Martin Kepplinger <martin.kepplinger@puri.sm>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/hi846.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/media/i2c/hi846.c b/drivers/media/i2c/hi846.c
+index 7c61873b71981..306dc35e925fd 100644
+--- a/drivers/media/i2c/hi846.c
++++ b/drivers/media/i2c/hi846.c
+@@ -1472,21 +1472,26 @@ static int hi846_init_controls(struct hi846 *hi846)
+ if (ctrl_hdlr->error) {
+ dev_err(&client->dev, "v4l ctrl handler error: %d\n",
+ ctrl_hdlr->error);
+- return ctrl_hdlr->error;
++ ret = ctrl_hdlr->error;
++ goto error;
+ }
+
+ ret = v4l2_fwnode_device_parse(&client->dev, &props);
+ if (ret)
+- return ret;
++ goto error;
+
+ ret = v4l2_ctrl_new_fwnode_properties(ctrl_hdlr, &hi846_ctrl_ops,
+ &props);
+ if (ret)
+- return ret;
++ goto error;
+
+ hi846->sd.ctrl_handler = ctrl_hdlr;
+
+ return 0;
++
++error:
++ v4l2_ctrl_handler_free(ctrl_hdlr);
++ return ret;
+ }
+
+ static int hi846_set_video_mode(struct hi846 *hi846, int fps)
+--
+2.39.2
+
--- /dev/null
+From 96f2c3991e20732f3a3a7e93eab6591e068fb5fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 14 Jan 2023 22:46:50 +0100
+Subject: media: max9286: Free control handler
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+
+[ Upstream commit bfce6a12e5ba1edde95126aa06778027f16115d4 ]
+
+The control handler is leaked in some probe-time error paths, as well as
+in the remove path. Fix it.
+
+Fixes: 66d8c9d2422d ("media: i2c: Add MAX9286 driver")
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/max9286.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/media/i2c/max9286.c b/drivers/media/i2c/max9286.c
+index 701038d6d19b1..13a986b885889 100644
+--- a/drivers/media/i2c/max9286.c
++++ b/drivers/media/i2c/max9286.c
+@@ -1122,6 +1122,7 @@ static int max9286_v4l2_register(struct max9286_priv *priv)
+ static void max9286_v4l2_unregister(struct max9286_priv *priv)
+ {
+ fwnode_handle_put(priv->sd.fwnode);
++ v4l2_ctrl_handler_free(&priv->ctrls);
+ v4l2_async_unregister_subdev(&priv->sd);
+ max9286_v4l2_notifier_unregister(priv);
+ }
+--
+2.39.2
+
--- /dev/null
+From b1d7d6956064a379a570a29c04e6074553c91b1a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Feb 2023 07:33:13 +0000
+Subject: media: mediatek: vcodec: add core decode done event
+
+From: Yunfei Dong <yunfei.dong@mediatek.com>
+
+[ Upstream commit d227af847ac2d7d90350124a1b2451e4fc1f050c ]
+
+Need to make sure core decode done before current instance is free.
+
+Fixes: 365e4ba01df4 ("media: mtk-vcodec: Add work queue for core hardware decode")
+Signed-off-by: Yunfei Dong <yunfei.dong@mediatek.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c | 4 +++-
+ drivers/media/platform/mediatek/vcodec/vdec_msg_queue.h | 2 ++
+ 2 files changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c b/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c
+index 0da6e3e2ef0b3..ce7c82e38103a 100644
+--- a/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c
++++ b/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c
+@@ -196,7 +196,7 @@ bool vdec_msg_queue_wait_lat_buf_full(struct vdec_msg_queue *msg_queue)
+ spin_unlock(&core_ctx->ready_lock);
+
+ timeout_jiff = msecs_to_jiffies(1000 * (NUM_BUFFER_COUNT + 2));
+- ret = wait_event_timeout(msg_queue->lat_ctx.ready_to_use,
++ ret = wait_event_timeout(msg_queue->ctx->msg_queue.core_dec_done,
+ msg_queue->lat_ctx.ready_num == NUM_BUFFER_COUNT,
+ timeout_jiff);
+ if (ret) {
+@@ -257,6 +257,7 @@ static void vdec_msg_queue_core_work(struct work_struct *work)
+ mtk_vcodec_dec_disable_hardware(ctx, MTK_VDEC_CORE);
+ vdec_msg_queue_qbuf(&ctx->msg_queue.lat_ctx, lat_buf);
+
++ wake_up_all(&ctx->msg_queue.core_dec_done);
+ if (atomic_read(&lat_buf->ctx->msg_queue.core_list_cnt)) {
+ mtk_v4l2_debug(3, "re-schedule to decode for core: %d",
+ dev->msg_queue_core_ctx.ready_num);
+@@ -281,6 +282,7 @@ int vdec_msg_queue_init(struct vdec_msg_queue *msg_queue,
+
+ atomic_set(&msg_queue->lat_list_cnt, 0);
+ atomic_set(&msg_queue->core_list_cnt, 0);
++ init_waitqueue_head(&msg_queue->core_dec_done);
+
+ msg_queue->wdma_addr.size =
+ vde_msg_queue_get_trans_size(ctx->picinfo.buf_w,
+diff --git a/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.h b/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.h
+index 56280d6682c5a..a75c04418f52e 100644
+--- a/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.h
++++ b/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.h
+@@ -76,6 +76,7 @@ struct vdec_lat_buf {
+ *
+ * @lat_list_cnt: used to record each instance lat list count
+ * @core_list_cnt: used to record each instance core list count
++ * @core_dec_done: core work queue decode done event
+ */
+ struct vdec_msg_queue {
+ struct vdec_lat_buf lat_buf[NUM_BUFFER_COUNT];
+@@ -90,6 +91,7 @@ struct vdec_msg_queue {
+
+ atomic_t lat_list_cnt;
+ atomic_t core_list_cnt;
++ wait_queue_head_t core_dec_done;
+ };
+
+ /**
+--
+2.39.2
+
--- /dev/null
+From 5691ff5d997fb971e7c7765cf54bb1338c3756d9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Feb 2023 07:33:10 +0000
+Subject: media: mediatek: vcodec: add params to record lat and core lat_buf
+ count
+
+From: Yunfei Dong <yunfei.dong@mediatek.com>
+
+[ Upstream commit 5bbb6e2ca67477ab41163b32e6b3444faea74a5e ]
+
+Using lat_buf to share decoder information between lat and core work
+queue, adding params to record the buf count.
+
+Fixes: 365e4ba01df4 ("media: mtk-vcodec: Add work queue for core hardware decode")
+Signed-off-by: Yunfei Dong <yunfei.dong@mediatek.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../platform/mediatek/vcodec/vdec_msg_queue.c | 23 ++++++++++++++++++-
+ .../platform/mediatek/vcodec/vdec_msg_queue.h | 6 +++++
+ 2 files changed, 28 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c b/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c
+index dc2004790a472..3f016c87d722c 100644
+--- a/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c
++++ b/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c
+@@ -52,6 +52,22 @@ static struct list_head *vdec_get_buf_list(int hardware_index, struct vdec_lat_b
+ }
+ }
+
++static void vdec_msg_queue_inc(struct vdec_msg_queue *msg_queue, int hardware_index)
++{
++ if (hardware_index == MTK_VDEC_CORE)
++ atomic_inc(&msg_queue->core_list_cnt);
++ else
++ atomic_inc(&msg_queue->lat_list_cnt);
++}
++
++static void vdec_msg_queue_dec(struct vdec_msg_queue *msg_queue, int hardware_index)
++{
++ if (hardware_index == MTK_VDEC_CORE)
++ atomic_dec(&msg_queue->core_list_cnt);
++ else
++ atomic_dec(&msg_queue->lat_list_cnt);
++}
++
+ int vdec_msg_queue_qbuf(struct vdec_msg_queue_ctx *msg_ctx, struct vdec_lat_buf *buf)
+ {
+ struct list_head *head;
+@@ -66,6 +82,7 @@ int vdec_msg_queue_qbuf(struct vdec_msg_queue_ctx *msg_ctx, struct vdec_lat_buf
+ list_add_tail(head, &msg_ctx->ready_queue);
+ msg_ctx->ready_num++;
+
++ vdec_msg_queue_inc(&buf->ctx->msg_queue, msg_ctx->hardware_index);
+ if (msg_ctx->hardware_index != MTK_VDEC_CORE)
+ wake_up_all(&msg_ctx->ready_to_use);
+ else
+@@ -127,6 +144,7 @@ struct vdec_lat_buf *vdec_msg_queue_dqbuf(struct vdec_msg_queue_ctx *msg_ctx)
+ return NULL;
+ }
+ list_del(head);
++ vdec_msg_queue_dec(&buf->ctx->msg_queue, msg_ctx->hardware_index);
+
+ msg_ctx->ready_num--;
+ mtk_v4l2_debug(3, "dqueue buf type:%d addr: 0x%p num: %d",
+@@ -241,10 +259,13 @@ int vdec_msg_queue_init(struct vdec_msg_queue *msg_queue,
+
+ vdec_msg_queue_init_ctx(&msg_queue->lat_ctx, MTK_VDEC_LAT0);
+ INIT_WORK(&msg_queue->core_work, vdec_msg_queue_core_work);
++
++ atomic_set(&msg_queue->lat_list_cnt, 0);
++ atomic_set(&msg_queue->core_list_cnt, 0);
++
+ msg_queue->wdma_addr.size =
+ vde_msg_queue_get_trans_size(ctx->picinfo.buf_w,
+ ctx->picinfo.buf_h);
+-
+ err = mtk_vcodec_mem_alloc(ctx, &msg_queue->wdma_addr);
+ if (err) {
+ mtk_v4l2_err("failed to allocate wdma_addr buf");
+diff --git a/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.h b/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.h
+index c43d427f5f544..b1aa5572ba49f 100644
+--- a/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.h
++++ b/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.h
+@@ -72,6 +72,9 @@ struct vdec_lat_buf {
+ * @wdma_wptr_addr: ube write point
+ * @core_work: core hardware work
+ * @lat_ctx: used to store lat buffer list
++ *
++ * @lat_list_cnt: used to record each instance lat list count
++ * @core_list_cnt: used to record each instance core list count
+ */
+ struct vdec_msg_queue {
+ struct vdec_lat_buf lat_buf[NUM_BUFFER_COUNT];
+@@ -82,6 +85,9 @@ struct vdec_msg_queue {
+
+ struct work_struct core_work;
+ struct vdec_msg_queue_ctx lat_ctx;
++
++ atomic_t lat_list_cnt;
++ atomic_t core_list_cnt;
+ };
+
+ /**
+--
+2.39.2
+
--- /dev/null
+From 4f08b8aa56f60cdb8ed8738ba8aef7ed7cbd6bd0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Mar 2023 10:14:50 +0100
+Subject: media: mediatek: vcodec: add remove function for decoder platform
+ driver
+
+From: Yunfei Dong <yunfei.dong@mediatek.com>
+
+[ Upstream commit e2a10b3801061d05d3e3415b9b824251451cfd6c ]
+
+Need to disable decoder power when remove decoder hardware driver, adding
+remove callback function in the definition of platform driver.
+
+Fixes: c05bada35f01 ("media: mtk-vcodec: Add to support multi hardware decode")
+Signed-off-by: Yunfei Dong <yunfei.dong@mediatek.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../media/platform/mediatek/vcodec/mtk_vcodec_dec_hw.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec_hw.c b/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec_hw.c
+index 376db0e433d75..b753bf54ebd90 100644
+--- a/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec_hw.c
++++ b/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec_hw.c
+@@ -193,8 +193,16 @@ static int mtk_vdec_hw_probe(struct platform_device *pdev)
+ return ret;
+ }
+
++static int mtk_vdec_hw_remove(struct platform_device *pdev)
++{
++ pm_runtime_disable(&pdev->dev);
++
++ return 0;
++}
++
+ static struct platform_driver mtk_vdec_driver = {
+ .probe = mtk_vdec_hw_probe,
++ .remove = mtk_vdec_hw_remove,
+ .driver = {
+ .name = "mtk-vdec-comp",
+ .of_match_table = mtk_vdec_hw_match,
+--
+2.39.2
+
--- /dev/null
+From 1d91460fd173ee4acfe59c8a46fbf54c012c3c61 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Feb 2023 07:33:16 +0000
+Subject: media: mediatek: vcodec: change lat thread decode error condition
+
+From: Yunfei Dong <yunfei.dong@mediatek.com>
+
+[ Upstream commit 960badda95f10fb0c60f6f64978b19eafa9507a7 ]
+
+If lat thread can't get lat buffer, it should be that current instance
+don't be schedulded, the driver can't free the src buffer directly.
+
+Fixes: 7b182b8d9c85 ("media: mediatek: vcodec: Refactor get and put capture buffer flow")
+Signed-off-by: Yunfei Dong <yunfei.dong@mediatek.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../platform/mediatek/vcodec/mtk_vcodec_dec_stateless.c | 6 ++++--
+ .../platform/mediatek/vcodec/vdec/vdec_h264_req_multi_if.c | 2 +-
+ .../platform/mediatek/vcodec/vdec/vdec_vp9_req_lat_if.c | 2 +-
+ 3 files changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec_stateless.c b/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec_stateless.c
+index ab8f642d1e5b0..3000db975e5f5 100644
+--- a/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec_stateless.c
++++ b/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec_stateless.c
+@@ -258,8 +258,10 @@ static void mtk_vdec_worker(struct work_struct *work)
+ if (src_buf_req)
+ v4l2_ctrl_request_complete(src_buf_req, &ctx->ctrl_hdl);
+ } else {
+- v4l2_m2m_src_buf_remove(ctx->m2m_ctx);
+- v4l2_m2m_buf_done(vb2_v4l2_src, state);
++ if (ret != -EAGAIN) {
++ v4l2_m2m_src_buf_remove(ctx->m2m_ctx);
++ v4l2_m2m_buf_done(vb2_v4l2_src, state);
++ }
+ v4l2_m2m_job_finish(dev->m2m_dev_dec, ctx->m2m_ctx);
+ }
+ }
+diff --git a/drivers/media/platform/mediatek/vcodec/vdec/vdec_h264_req_multi_if.c b/drivers/media/platform/mediatek/vcodec/vdec/vdec_h264_req_multi_if.c
+index 955b2d0c8f53f..999ce7ee5fdc2 100644
+--- a/drivers/media/platform/mediatek/vcodec/vdec/vdec_h264_req_multi_if.c
++++ b/drivers/media/platform/mediatek/vcodec/vdec/vdec_h264_req_multi_if.c
+@@ -597,7 +597,7 @@ static int vdec_h264_slice_lat_decode(void *h_vdec, struct mtk_vcodec_mem *bs,
+ lat_buf = vdec_msg_queue_dqbuf(&inst->ctx->msg_queue.lat_ctx);
+ if (!lat_buf) {
+ mtk_vcodec_err(inst, "failed to get lat buffer");
+- return -EINVAL;
++ return -EAGAIN;
+ }
+ share_info = lat_buf->private_data;
+ src_buf_info = container_of(bs, struct mtk_video_dec_buf, bs_buffer);
+diff --git a/drivers/media/platform/mediatek/vcodec/vdec/vdec_vp9_req_lat_if.c b/drivers/media/platform/mediatek/vcodec/vdec/vdec_vp9_req_lat_if.c
+index cbb6728b8a40b..cf16cf2807f07 100644
+--- a/drivers/media/platform/mediatek/vcodec/vdec/vdec_vp9_req_lat_if.c
++++ b/drivers/media/platform/mediatek/vcodec/vdec/vdec_vp9_req_lat_if.c
+@@ -2070,7 +2070,7 @@ static int vdec_vp9_slice_lat_decode(void *h_vdec, struct mtk_vcodec_mem *bs,
+ lat_buf = vdec_msg_queue_dqbuf(&instance->ctx->msg_queue.lat_ctx);
+ if (!lat_buf) {
+ mtk_vcodec_err(instance, "Failed to get VP9 lat buf\n");
+- return -EBUSY;
++ return -EAGAIN;
+ }
+ pfc = (struct vdec_vp9_slice_pfc *)lat_buf->private_data;
+ if (!pfc) {
+--
+2.39.2
+
--- /dev/null
+From 45d6760aa517a4926923e393c1176730902f735c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Mar 2023 10:14:49 +0100
+Subject: media: mediatek: vcodec: fix decoder disable pm crash
+
+From: Yunfei Dong <yunfei.dong@mediatek.com>
+
+[ Upstream commit 9d2f13fb47dcab6d094f34ecfd6a879a409722b3 ]
+
+Can't call pm_runtime_disable when the architecture support sub device for
+'dev->pm.dev' is NUll, or will get below crash log.
+
+[ 10.771551] pc : _raw_spin_lock_irq+0x4c/0xa0
+[ 10.771556] lr : __pm_runtime_disable+0x30/0x130
+[ 10.771558] sp : ffffffc01e4cb800
+[ 10.771559] x29: ffffffc01e4cb800 x28: ffffffdf082108a8
+[ 10.771563] x27: ffffffc01e4cbd70 x26: ffffff8605df55f0
+[ 10.771567] x25: 0000000000000002 x24: 0000000000000002
+[ 10.771570] x23: ffffff85c0dc9c00 x22: 0000000000000001
+[ 10.771573] x21: 0000000000000001 x20: 0000000000000000
+[ 10.771577] x19: 00000000000000f4 x18: ffffffdf2e9fbe18
+[ 10.771580] x17: 0000000000000000 x16: ffffffdf2df13c74
+[ 10.771583] x15: 00000000000002ea x14: 0000000000000058
+[ 10.771587] x13: ffffffdf2de1b62c x12: ffffffdf2e9e30e4
+[ 10.771590] x11: 0000000000000000 x10: 0000000000000001
+[ 10.771593] x9 : 0000000000000000 x8 : 00000000000000f4
+[ 10.771596] x7 : 6bff6264632c6264 x6 : 0000000000008000
+[ 10.771600] x5 : 0080000000000000 x4 : 0000000000000001
+[ 10.771603] x3 : 0000000000000008 x2 : 0000000000000001
+[ 10.771608] x1 : 0000000000000000 x0 : 00000000000000f4
+[ 10.771613] Call trace:
+[ 10.771617] _raw_spin_lock_irq+0x4c/0xa0
+[ 10.771620] __pm_runtime_disable+0x30/0x130
+[ 10.771657] mtk_vcodec_probe+0x69c/0x728 [mtk_vcodec_dec 800cc929d6631f79f9b273254c8db94d0d3500dc]
+[ 10.771662] platform_drv_probe+0x9c/0xbc
+[ 10.771665] really_probe+0x13c/0x3a0
+[ 10.771668] driver_probe_device+0x84/0xc0
+[ 10.771671] device_driver_attach+0x54/0x78
+
+Fixes: ba31a5b39400 ("media: mtk-vcodec: Remove mtk_vcodec_release_dec_pm")
+Signed-off-by: Yunfei Dong <yunfei.dong@mediatek.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec_drv.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec_drv.c b/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec_drv.c
+index 174a6eec2f549..42df901e8beb4 100644
+--- a/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec_drv.c
++++ b/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec_drv.c
+@@ -451,7 +451,8 @@ static int mtk_vcodec_probe(struct platform_device *pdev)
+ if (IS_VDEC_LAT_ARCH(dev->vdec_pdata->hw_arch))
+ destroy_workqueue(dev->core_workqueue);
+ err_res:
+- pm_runtime_disable(dev->pm.dev);
++ if (!dev->vdec_pdata->is_subdev_supported)
++ pm_runtime_disable(dev->pm.dev);
+ err_dec_pm:
+ mtk_vcodec_fw_release(dev->fw_handler);
+ return ret;
+--
+2.39.2
+
--- /dev/null
+From 802aedad6f0255b908f70d8ddb34cb702d26d599 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 18 Mar 2023 03:56:51 +0000
+Subject: media: mediatek: vcodec: Force capture queue format to MM21
+
+From: Yunfei Dong <yunfei.dong@mediatek.com>
+
+[ Upstream commit 68c7df527657a9e962da7b5b9c0308557357d8dc ]
+
+While the decoder can produce frames in both MM21 and MT21C formats, only
+MM21 is currently supported by userspace tools (like gstreamer and libyuv).
+In order to ensure userspace keeps working after the SCP firmware is
+updated to support both MM21 and MT21C formats, force the MM21 format for
+the capture queue.
+
+This is meant as a stopgap solution while dynamic format switching between
+MM21 and MT21C isn't implemented in the driver.
+
+Fixes: 7501edef6b1f ("media: mediatek: vcodec: Different codec using different capture format")
+Signed-off-by: Yunfei Dong <yunfei.dong@mediatek.com>
+Reviewed-by: Nicolas F. R. A. Prado <nfraprado@collabora.com>
+Tested-by: Nicolas F. R. A. Prado <nfraprado@collabora.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../platform/mediatek/vcodec/mtk_vcodec_dec.c | 24 +++----------------
+ 1 file changed, 3 insertions(+), 21 deletions(-)
+
+diff --git a/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec.c b/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec.c
+index 641f533c417fd..c99705681a03e 100644
+--- a/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec.c
++++ b/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec.c
+@@ -39,10 +39,9 @@ static bool mtk_vdec_get_cap_fmt(struct mtk_vcodec_ctx *ctx, int format_index)
+ {
+ const struct mtk_vcodec_dec_pdata *dec_pdata = ctx->dev->vdec_pdata;
+ const struct mtk_video_fmt *fmt;
+- struct mtk_q_data *q_data;
+ int num_frame_count = 0, i;
+- bool ret = true;
+
++ fmt = &dec_pdata->vdec_formats[format_index];
+ for (i = 0; i < *dec_pdata->num_formats; i++) {
+ if (dec_pdata->vdec_formats[i].type != MTK_FMT_FRAME)
+ continue;
+@@ -50,27 +49,10 @@ static bool mtk_vdec_get_cap_fmt(struct mtk_vcodec_ctx *ctx, int format_index)
+ num_frame_count++;
+ }
+
+- if (num_frame_count == 1)
++ if (num_frame_count == 1 || fmt->fourcc == V4L2_PIX_FMT_MM21)
+ return true;
+
+- fmt = &dec_pdata->vdec_formats[format_index];
+- q_data = &ctx->q_data[MTK_Q_DATA_SRC];
+- switch (q_data->fmt->fourcc) {
+- case V4L2_PIX_FMT_VP8_FRAME:
+- if (fmt->fourcc == V4L2_PIX_FMT_MM21)
+- ret = true;
+- break;
+- case V4L2_PIX_FMT_H264_SLICE:
+- case V4L2_PIX_FMT_VP9_FRAME:
+- if (fmt->fourcc == V4L2_PIX_FMT_MM21)
+- ret = false;
+- break;
+- default:
+- ret = true;
+- break;
+- }
+-
+- return ret;
++ return false;
+ }
+
+ static struct mtk_q_data *mtk_vdec_get_q_data(struct mtk_vcodec_ctx *ctx,
+--
+2.39.2
+
--- /dev/null
+From c57420c6c8479c61e611b08825e23ca61a766cd0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 18 Mar 2023 03:56:50 +0000
+Subject: media: mediatek: vcodec: Make MM21 the default capture format
+
+From: Yunfei Dong <yunfei.dong@mediatek.com>
+
+[ Upstream commit 6d020d81b91af80a977061e82de25cafa4456af5 ]
+
+Given that only the MM21 capture format is supported by userspace tools
+(like gstreamer and libyuv), make it the default capture format.
+
+This allows us to force the MM21 format even when a MM21 and MT21C capable
+firmware is available (which is needed while dynamic format switching isn't
+implemented in the driver), without causing the following regressions on
+v4l2-compliance:
+
+ fail: v4l2-test-formats.cpp(478): pixelformat 3132544d (MT21) for buftype 9 not reported by ENUM_FMT
+ test VIDIOC_G_FMT: FAIL
+ fail: v4l2-test-formats.cpp(478): pixelformat 3132544d (MT21) for buftype 9 not reported by ENUM_FMT
+ test VIDIOC_TRY_FMT: FAIL
+ fail: v4l2-test-formats.cpp(478): pixelformat 3132544d (MT21) for buftype 9 not reported by ENUM_FMT
+ test VIDIOC_S_FMT: FAIL
+
+Fixes: 7501edef6b1f ("media: mediatek: vcodec: Different codec using different capture format")
+Signed-off-by: Yunfei Dong <yunfei.dong@mediatek.com>
+Reviewed-by: Nicolas F. R. A. Prado <nfraprado@collabora.com>
+Tested-by: Nicolas F. R. A. Prado <nfraprado@collabora.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../platform/mediatek/vcodec/mtk_vcodec_dec_stateless.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec_stateless.c b/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec_stateless.c
+index ffbcee04dc26f..ab8f642d1e5b0 100644
+--- a/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec_stateless.c
++++ b/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec_stateless.c
+@@ -390,14 +390,14 @@ static void mtk_vcodec_get_supported_formats(struct mtk_vcodec_ctx *ctx)
+ if (num_formats)
+ return;
+
+- if (ctx->dev->dec_capability & MTK_VDEC_FORMAT_MM21) {
+- mtk_vcodec_add_formats(V4L2_PIX_FMT_MM21, ctx);
+- cap_format_count++;
+- }
+ if (ctx->dev->dec_capability & MTK_VDEC_FORMAT_MT21C) {
+ mtk_vcodec_add_formats(V4L2_PIX_FMT_MT21C, ctx);
+ cap_format_count++;
+ }
++ if (ctx->dev->dec_capability & MTK_VDEC_FORMAT_MM21) {
++ mtk_vcodec_add_formats(V4L2_PIX_FMT_MM21, ctx);
++ cap_format_count++;
++ }
+ if (ctx->dev->dec_capability & MTK_VDEC_FORMAT_H264_SLICE) {
+ mtk_vcodec_add_formats(V4L2_PIX_FMT_H264_SLICE, ctx);
+ out_format_count++;
+--
+2.39.2
+
--- /dev/null
+From 61c70e8562683092b5ad20e8cc3485597cd28101 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Feb 2023 07:33:15 +0000
+Subject: media: mediatek: vcodec: making sure queue_work successfully
+
+From: Yunfei Dong <yunfei.dong@mediatek.com>
+
+[ Upstream commit 2e0ef56d81cb2569624d288b7e95a8a2734a7c74 ]
+
+Putting core work to work queue using queue_work maybe fail, call
+queue_work again when the count of core work in work queue is less
+than core_list_cnt, making sure all the buffer in core list can be
+scheduled.
+
+Fixes: 365e4ba01df4 ("media: mtk-vcodec: Add work queue for core hardware decode")
+Signed-off-by: Yunfei Dong <yunfei.dong@mediatek.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../platform/mediatek/vcodec/vdec_msg_queue.c | 31 ++++++++++++++-----
+ .../platform/mediatek/vcodec/vdec_msg_queue.h | 2 ++
+ 2 files changed, 25 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c b/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c
+index cdc539a46cb95..f3073d1e7f420 100644
+--- a/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c
++++ b/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c
+@@ -71,6 +71,7 @@ static void vdec_msg_queue_dec(struct vdec_msg_queue *msg_queue, int hardware_in
+ int vdec_msg_queue_qbuf(struct vdec_msg_queue_ctx *msg_ctx, struct vdec_lat_buf *buf)
+ {
+ struct list_head *head;
++ int status;
+
+ head = vdec_get_buf_list(msg_ctx->hardware_index, buf);
+ if (!head) {
+@@ -83,11 +84,17 @@ int vdec_msg_queue_qbuf(struct vdec_msg_queue_ctx *msg_ctx, struct vdec_lat_buf
+ msg_ctx->ready_num++;
+
+ vdec_msg_queue_inc(&buf->ctx->msg_queue, msg_ctx->hardware_index);
+- if (msg_ctx->hardware_index != MTK_VDEC_CORE)
++ if (msg_ctx->hardware_index != MTK_VDEC_CORE) {
+ wake_up_all(&msg_ctx->ready_to_use);
+- else
+- queue_work(buf->ctx->dev->core_workqueue,
+- &buf->ctx->msg_queue.core_work);
++ } else {
++ if (buf->ctx->msg_queue.core_work_cnt <
++ atomic_read(&buf->ctx->msg_queue.core_list_cnt)) {
++ status = queue_work(buf->ctx->dev->core_workqueue,
++ &buf->ctx->msg_queue.core_work);
++ if (status)
++ buf->ctx->msg_queue.core_work_cnt++;
++ }
++ }
+
+ mtk_v4l2_debug(3, "enqueue buf type: %d addr: 0x%p num: %d",
+ msg_ctx->hardware_index, buf, msg_ctx->ready_num);
+@@ -254,6 +261,7 @@ static void vdec_msg_queue_core_work(struct work_struct *work)
+ container_of(msg_queue, struct mtk_vcodec_ctx, msg_queue);
+ struct mtk_vcodec_dev *dev = ctx->dev;
+ struct vdec_lat_buf *lat_buf;
++ int status;
+
+ lat_buf = vdec_msg_queue_dqbuf(&dev->msg_queue_core_ctx);
+ if (!lat_buf)
+@@ -270,11 +278,17 @@ static void vdec_msg_queue_core_work(struct work_struct *work)
+ vdec_msg_queue_qbuf(&ctx->msg_queue.lat_ctx, lat_buf);
+
+ wake_up_all(&ctx->msg_queue.core_dec_done);
+- if (atomic_read(&lat_buf->ctx->msg_queue.core_list_cnt)) {
+- mtk_v4l2_debug(3, "re-schedule to decode for core: %d",
+- dev->msg_queue_core_ctx.ready_num);
+- queue_work(dev->core_workqueue, &msg_queue->core_work);
++ spin_lock(&dev->msg_queue_core_ctx.ready_lock);
++ lat_buf->ctx->msg_queue.core_work_cnt--;
++
++ if (lat_buf->ctx->msg_queue.core_work_cnt <
++ atomic_read(&lat_buf->ctx->msg_queue.core_list_cnt)) {
++ status = queue_work(lat_buf->ctx->dev->core_workqueue,
++ &lat_buf->ctx->msg_queue.core_work);
++ if (status)
++ lat_buf->ctx->msg_queue.core_work_cnt++;
+ }
++ spin_unlock(&dev->msg_queue_core_ctx.ready_lock);
+ }
+
+ int vdec_msg_queue_init(struct vdec_msg_queue *msg_queue,
+@@ -289,6 +303,7 @@ int vdec_msg_queue_init(struct vdec_msg_queue *msg_queue,
+ return 0;
+
+ msg_queue->ctx = ctx;
++ msg_queue->core_work_cnt = 0;
+ vdec_msg_queue_init_ctx(&msg_queue->lat_ctx, MTK_VDEC_LAT0);
+ INIT_WORK(&msg_queue->core_work, vdec_msg_queue_core_work);
+
+diff --git a/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.h b/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.h
+index a75c04418f52e..a5d44bc97c16b 100644
+--- a/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.h
++++ b/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.h
+@@ -77,6 +77,7 @@ struct vdec_lat_buf {
+ * @lat_list_cnt: used to record each instance lat list count
+ * @core_list_cnt: used to record each instance core list count
+ * @core_dec_done: core work queue decode done event
++ * @core_work_cnt: the number of core work in work queue
+ */
+ struct vdec_msg_queue {
+ struct vdec_lat_buf lat_buf[NUM_BUFFER_COUNT];
+@@ -92,6 +93,7 @@ struct vdec_msg_queue {
+ atomic_t lat_list_cnt;
+ atomic_t core_list_cnt;
+ wait_queue_head_t core_dec_done;
++ int core_work_cnt;
+ };
+
+ /**
+--
+2.39.2
+
--- /dev/null
+From 49eddfc7dc84a5b3e86971be7e5932f8a1ce17f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Feb 2023 07:33:12 +0000
+Subject: media: mediatek: vcodec: move lat_buf to the top of core list
+
+From: Yunfei Dong <yunfei.dong@mediatek.com>
+
+[ Upstream commit 2cfca6c1bf8074175ea7a3b6b47f77ebdef8f701 ]
+
+Current instance will decode done when begin to wait lat buf full,
+move the lat_buf of current instance to the top of core list to make
+sure current instance's lat_buf will be used firstly.
+
+Fixes: 365e4ba01df4 ("media: mtk-vcodec: Add work queue for core hardware decode")
+Signed-off-by: Yunfei Dong <yunfei.dong@mediatek.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../platform/mediatek/vcodec/vdec_msg_queue.c | 21 ++++++++++++++++++-
+ .../platform/mediatek/vcodec/vdec_msg_queue.h | 2 ++
+ 2 files changed, 22 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c b/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c
+index ad5002ca953e0..0da6e3e2ef0b3 100644
+--- a/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c
++++ b/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c
+@@ -174,8 +174,26 @@ void vdec_msg_queue_update_ube_wptr(struct vdec_msg_queue *msg_queue, uint64_t u
+
+ bool vdec_msg_queue_wait_lat_buf_full(struct vdec_msg_queue *msg_queue)
+ {
++ struct vdec_lat_buf *buf, *tmp;
++ struct list_head *list_core[3];
++ struct vdec_msg_queue_ctx *core_ctx;
++ int ret, i, in_core_count = 0;
+ long timeout_jiff;
+- int ret;
++
++ core_ctx = &msg_queue->ctx->dev->msg_queue_core_ctx;
++ spin_lock(&core_ctx->ready_lock);
++ list_for_each_entry_safe(buf, tmp, &core_ctx->ready_queue, core_list) {
++ if (buf && buf->ctx == msg_queue->ctx) {
++ list_core[in_core_count++] = &buf->core_list;
++ list_del(&buf->core_list);
++ }
++ }
++
++ for (i = 0; i < in_core_count; i++) {
++ list_add(list_core[in_core_count - (1 + i)], &core_ctx->ready_queue);
++ queue_work(msg_queue->ctx->dev->core_workqueue, &msg_queue->core_work);
++ }
++ spin_unlock(&core_ctx->ready_lock);
+
+ timeout_jiff = msecs_to_jiffies(1000 * (NUM_BUFFER_COUNT + 2));
+ ret = wait_event_timeout(msg_queue->lat_ctx.ready_to_use,
+@@ -257,6 +275,7 @@ int vdec_msg_queue_init(struct vdec_msg_queue *msg_queue,
+ if (msg_queue->wdma_addr.size)
+ return 0;
+
++ msg_queue->ctx = ctx;
+ vdec_msg_queue_init_ctx(&msg_queue->lat_ctx, MTK_VDEC_LAT0);
+ INIT_WORK(&msg_queue->core_work, vdec_msg_queue_core_work);
+
+diff --git a/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.h b/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.h
+index b1aa5572ba49f..56280d6682c5a 100644
+--- a/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.h
++++ b/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.h
+@@ -72,6 +72,7 @@ struct vdec_lat_buf {
+ * @wdma_wptr_addr: ube write point
+ * @core_work: core hardware work
+ * @lat_ctx: used to store lat buffer list
++ * @ctx: point to mtk_vcodec_ctx
+ *
+ * @lat_list_cnt: used to record each instance lat list count
+ * @core_list_cnt: used to record each instance core list count
+@@ -85,6 +86,7 @@ struct vdec_msg_queue {
+
+ struct work_struct core_work;
+ struct vdec_msg_queue_ctx lat_ctx;
++ struct mtk_vcodec_ctx *ctx;
+
+ atomic_t lat_list_cnt;
+ atomic_t core_list_cnt;
+--
+2.39.2
+
--- /dev/null
+From c23d4e10082e7e3ee5610c2df1e7129423c89948 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Feb 2023 07:33:14 +0000
+Subject: media: mediatek: vcodec: remove unused lat_buf
+
+From: Yunfei Dong <yunfei.dong@mediatek.com>
+
+[ Upstream commit af50b13dd3d7d5dbc1f08add1c462398e926a053 ]
+
+Remove unused lat_buf from core list, or leading to core list access
+NULL point.
+
+Fixes: 365e4ba01df4 ("media: mtk-vcodec: Add work queue for core hardware decode")
+Signed-off-by: Yunfei Dong <yunfei.dong@mediatek.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../platform/mediatek/vcodec/vdec_msg_queue.c | 18 +++++++++++++++---
+ 1 file changed, 15 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c b/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c
+index ce7c82e38103a..cdc539a46cb95 100644
+--- a/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c
++++ b/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c
+@@ -177,7 +177,7 @@ bool vdec_msg_queue_wait_lat_buf_full(struct vdec_msg_queue *msg_queue)
+ struct vdec_lat_buf *buf, *tmp;
+ struct list_head *list_core[3];
+ struct vdec_msg_queue_ctx *core_ctx;
+- int ret, i, in_core_count = 0;
++ int ret, i, in_core_count = 0, count = 0;
+ long timeout_jiff;
+
+ core_ctx = &msg_queue->ctx->dev->msg_queue_core_ctx;
+@@ -204,8 +204,20 @@ bool vdec_msg_queue_wait_lat_buf_full(struct vdec_msg_queue *msg_queue)
+ msg_queue->lat_ctx.ready_num);
+ return true;
+ }
+- mtk_v4l2_err("failed with lat buf isn't full: %d",
+- msg_queue->lat_ctx.ready_num);
++
++ spin_lock(&core_ctx->ready_lock);
++ list_for_each_entry_safe(buf, tmp, &core_ctx->ready_queue, core_list) {
++ if (buf && buf->ctx == msg_queue->ctx) {
++ count++;
++ list_del(&buf->core_list);
++ }
++ }
++ spin_unlock(&core_ctx->ready_lock);
++
++ mtk_v4l2_err("failed with lat buf isn't full: list(%d %d) count:%d",
++ atomic_read(&msg_queue->lat_list_cnt),
++ atomic_read(&msg_queue->core_list_cnt), count);
++
+ return false;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 0242361f926641107c096d767046ffb6b2136dd6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Mar 2023 10:22:41 +0000
+Subject: media: mediatek: vcodec: Use 4K frame size when supported by stateful
+ decoder
+
+From: Pin-yen Lin <treapking@chromium.org>
+
+[ Upstream commit e25528e1dbe52784ac250071653104a8adc848e2 ]
+
+After commit b018be06f3c7 ("media: mediatek: vcodec: Read max resolution
+from dec_capability"), the stateful video decoder driver never really
+sets its output frame size to 4K.
+
+Parse the decoder capability reported by the firmware, and update the
+output frame size in mtk_init_vdec_params to enable 4K frame size when
+available.
+
+Fixes: b018be06f3c7 ("media: mediatek: vcodec: Read max resolution from dec_capability")
+Signed-off-by: Pin-yen Lin <treapking@chromium.org>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../mediatek/vcodec/mtk_vcodec_dec_stateful.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec_stateful.c b/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec_stateful.c
+index 035c86e7809fd..29991551cf614 100644
+--- a/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec_stateful.c
++++ b/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec_stateful.c
+@@ -11,7 +11,7 @@
+ #include "mtk_vcodec_dec_pm.h"
+ #include "vdec_drv_if.h"
+
+-static const struct mtk_video_fmt mtk_video_formats[] = {
++static struct mtk_video_fmt mtk_video_formats[] = {
+ {
+ .fourcc = V4L2_PIX_FMT_H264,
+ .type = MTK_FMT_DEC,
+@@ -580,6 +580,16 @@ static int mtk_vcodec_dec_ctrls_setup(struct mtk_vcodec_ctx *ctx)
+
+ static void mtk_init_vdec_params(struct mtk_vcodec_ctx *ctx)
+ {
++ unsigned int i;
++
++ if (!(ctx->dev->dec_capability & VCODEC_CAPABILITY_4K_DISABLED)) {
++ for (i = 0; i < num_supported_formats; i++) {
++ mtk_video_formats[i].frmsize.max_width =
++ VCODEC_DEC_4K_CODED_WIDTH;
++ mtk_video_formats[i].frmsize.max_height =
++ VCODEC_DEC_4K_CODED_HEIGHT;
++ }
++ }
+ }
+
+ static struct vb2_ops mtk_vdec_frame_vb2_ops = {
+--
+2.39.2
+
--- /dev/null
+From bfae61d52c4b8ad70eef517b5bcb8060f7a5ef23 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Feb 2023 07:33:11 +0000
+Subject: media: mediatek: vcodec: using each instance lat_buf count replace
+ core ready list
+
+From: Yunfei Dong <yunfei.dong@mediatek.com>
+
+[ Upstream commit f7a3780cf96925670736582b9a623a2c9ffb4166 ]
+
+Core Hardware decoder depends on each instance lat_buf count,
+calling queue_work decode again when the lat_buf count of each instance
+isn't zero.
+
+Fixes: 365e4ba01df4 ("media: mtk-vcodec: Add work queue for core hardware decode")
+Signed-off-by: Yunfei Dong <yunfei.dong@mediatek.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c b/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c
+index 3f016c87d722c..ad5002ca953e0 100644
+--- a/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c
++++ b/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c
+@@ -239,7 +239,7 @@ static void vdec_msg_queue_core_work(struct work_struct *work)
+ mtk_vcodec_dec_disable_hardware(ctx, MTK_VDEC_CORE);
+ vdec_msg_queue_qbuf(&ctx->msg_queue.lat_ctx, lat_buf);
+
+- if (!list_empty(&dev->msg_queue_core_ctx.ready_queue)) {
++ if (atomic_read(&lat_buf->ctx->msg_queue.core_list_cnt)) {
+ mtk_v4l2_debug(3, "re-schedule to decode for core: %d",
+ dev->msg_queue_core_ctx.ready_num);
+ queue_work(dev->core_workqueue, &msg_queue->core_work);
+--
+2.39.2
+
--- /dev/null
+From d203d6cd2300d4dd11a7c7d3934cbb5120382ec6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Mar 2023 06:23:51 +0000
+Subject: media: mtk-jpeg: Fixes jpeg enc&dec worker sw flow
+
+From: kyrie wu <kyrie.wu@mediatek.com>
+
+[ Upstream commit 86379bd9d399e2c5fd638a869af223d4910725c3 ]
+
+1. Move removing buffer after sw setting and before hw setting
+in enc&dec worker to prevents the operation of removing
+the buffer twice if the sw setting fails.
+2. Remove the redundant operation of queue work in the
+jpegenc irq handler because the jpegenc worker has called
+v4l2_m2m_job_finish to do it.
+
+Fixes: 5fb1c2361e56 ("mtk-jpegenc: add jpeg encode worker interface")
+Fixes: dedc21500334 ("media: mtk-jpegdec: add jpeg decode worker interface")
+Signed-off-by: kyrie wu <kyrie.wu@mediatek.com>
+Signed-off-by: irui wang <irui.wang@mediatek.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../media/platform/mediatek/jpeg/mtk_jpeg_core.c | 14 +++++++-------
+ .../media/platform/mediatek/jpeg/mtk_jpeg_enc_hw.c | 4 ----
+ 2 files changed, 7 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
+index 6d052747a15e8..d9584fe5033eb 100644
+--- a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
++++ b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
+@@ -1025,9 +1025,6 @@ static void mtk_jpegenc_worker(struct work_struct *work)
+ if (!dst_buf)
+ goto getbuf_fail;
+
+- v4l2_m2m_src_buf_remove(ctx->fh.m2m_ctx);
+- v4l2_m2m_dst_buf_remove(ctx->fh.m2m_ctx);
+-
+ v4l2_m2m_buf_copy_metadata(src_buf, dst_buf, true);
+
+ mtk_jpegenc_set_hw_param(ctx, hw_id, src_buf, dst_buf);
+@@ -1045,6 +1042,9 @@ static void mtk_jpegenc_worker(struct work_struct *work)
+ goto enc_end;
+ }
+
++ v4l2_m2m_src_buf_remove(ctx->fh.m2m_ctx);
++ v4l2_m2m_dst_buf_remove(ctx->fh.m2m_ctx);
++
+ schedule_delayed_work(&comp_jpeg[hw_id]->job_timeout_work,
+ msecs_to_jiffies(MTK_JPEG_HW_TIMEOUT_MSEC));
+
+@@ -1220,9 +1220,6 @@ static void mtk_jpegdec_worker(struct work_struct *work)
+ if (!dst_buf)
+ goto getbuf_fail;
+
+- v4l2_m2m_src_buf_remove(ctx->fh.m2m_ctx);
+- v4l2_m2m_dst_buf_remove(ctx->fh.m2m_ctx);
+-
+ v4l2_m2m_buf_copy_metadata(src_buf, dst_buf, true);
+ jpeg_src_buf = mtk_jpeg_vb2_to_srcbuf(&src_buf->vb2_buf);
+ jpeg_dst_buf = mtk_jpeg_vb2_to_srcbuf(&dst_buf->vb2_buf);
+@@ -1231,7 +1228,7 @@ static void mtk_jpegdec_worker(struct work_struct *work)
+ &jpeg_src_buf->dec_param)) {
+ mtk_jpeg_queue_src_chg_event(ctx);
+ ctx->state = MTK_JPEG_SOURCE_CHANGE;
+- goto dec_end;
++ goto getbuf_fail;
+ }
+
+ jpeg_src_buf->curr_ctx = ctx;
+@@ -1254,6 +1251,9 @@ static void mtk_jpegdec_worker(struct work_struct *work)
+ goto clk_end;
+ }
+
++ v4l2_m2m_src_buf_remove(ctx->fh.m2m_ctx);
++ v4l2_m2m_dst_buf_remove(ctx->fh.m2m_ctx);
++
+ schedule_delayed_work(&comp_jpeg[hw_id]->job_timeout_work,
+ msecs_to_jiffies(MTK_JPEG_HW_TIMEOUT_MSEC));
+
+diff --git a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_enc_hw.c b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_enc_hw.c
+index 1bbb712d78d0e..867f4c1a09fa6 100644
+--- a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_enc_hw.c
++++ b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_enc_hw.c
+@@ -286,10 +286,6 @@ static irqreturn_t mtk_jpegenc_hw_irq_handler(int irq, void *priv)
+ mtk_jpegenc_put_buf(jpeg);
+ pm_runtime_put(ctx->jpeg->dev);
+ clk_disable_unprepare(jpeg->venc_clk.clks->clk);
+- if (!list_empty(&ctx->fh.m2m_ctx->out_q_ctx.rdy_queue) ||
+- !list_empty(&ctx->fh.m2m_ctx->cap_q_ctx.rdy_queue)) {
+- queue_work(master_jpeg->workqueue, &ctx->jpeg_work);
+- }
+
+ jpeg->hw_state = MTK_JPEG_HW_IDLE;
+ wake_up(&master_jpeg->enc_hw_wq);
+--
+2.39.2
+
--- /dev/null
+From 509bb80e987f01c24d15f14c1639900349060620 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Mar 2023 06:23:49 +0000
+Subject: media: mtk-jpeg: Fixes jpeghw multi-core judgement
+
+From: kyrie wu <kyrie.wu@mediatek.com>
+
+[ Upstream commit 75c38caf66a10983acc5a59069bfc9492c43d682 ]
+
+some chips have multi-hw, but others have only one,
+modify the condition of multi-hw judgement
+
+Fixes: 934e8bccac95 ("mtk-jpegenc: support jpegenc multi-hardware")
+Signed-off-by: kyrie wu <kyrie.wu@mediatek.com>
+Signed-off-by: irui wang <irui.wang@mediatek.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c | 5 ++++-
+ drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.h | 2 ++
+ 2 files changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
+index 969516a940ba7..6d052747a15e8 100644
+--- a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
++++ b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
+@@ -1692,7 +1692,7 @@ static int mtk_jpeg_probe(struct platform_device *pdev)
+ return -EINVAL;
+ }
+
+- if (list_empty(&pdev->dev.devres_head)) {
++ if (!jpeg->variant->multi_core) {
+ INIT_DELAYED_WORK(&jpeg->job_timeout_work,
+ mtk_jpeg_job_timeout_work);
+
+@@ -1874,6 +1874,7 @@ static const struct mtk_jpeg_variant mtk_jpeg_drvdata = {
+ .ioctl_ops = &mtk_jpeg_enc_ioctl_ops,
+ .out_q_default_fourcc = V4L2_PIX_FMT_YUYV,
+ .cap_q_default_fourcc = V4L2_PIX_FMT_JPEG,
++ .multi_core = false,
+ };
+
+ static struct mtk_jpeg_variant mtk8195_jpegenc_drvdata = {
+@@ -1885,6 +1886,7 @@ static struct mtk_jpeg_variant mtk8195_jpegenc_drvdata = {
+ .ioctl_ops = &mtk_jpeg_enc_ioctl_ops,
+ .out_q_default_fourcc = V4L2_PIX_FMT_YUYV,
+ .cap_q_default_fourcc = V4L2_PIX_FMT_JPEG,
++ .multi_core = true,
+ };
+
+ static const struct mtk_jpeg_variant mtk8195_jpegdec_drvdata = {
+@@ -1896,6 +1898,7 @@ static const struct mtk_jpeg_variant mtk8195_jpegdec_drvdata = {
+ .ioctl_ops = &mtk_jpeg_dec_ioctl_ops,
+ .out_q_default_fourcc = V4L2_PIX_FMT_JPEG,
+ .cap_q_default_fourcc = V4L2_PIX_FMT_YUV420M,
++ .multi_core = true,
+ };
+
+ #if defined(CONFIG_OF)
+diff --git a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.h b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.h
+index b9126476be8fa..f87358cc9f47f 100644
+--- a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.h
++++ b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.h
+@@ -60,6 +60,7 @@ enum mtk_jpeg_ctx_state {
+ * @ioctl_ops: the callback of jpeg v4l2_ioctl_ops
+ * @out_q_default_fourcc: output queue default fourcc
+ * @cap_q_default_fourcc: capture queue default fourcc
++ * @multi_core: mark jpeg hw is multi_core or not
+ */
+ struct mtk_jpeg_variant {
+ struct clk_bulk_data *clks;
+@@ -74,6 +75,7 @@ struct mtk_jpeg_variant {
+ const struct v4l2_ioctl_ops *ioctl_ops;
+ u32 out_q_default_fourcc;
+ u32 cap_q_default_fourcc;
++ bool multi_core;
+ };
+
+ struct mtk_jpeg_src_buf {
+--
+2.39.2
+
--- /dev/null
+From 3425e1f7054845cf79fc2f5ee24e2466ec49b97d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Mar 2023 15:57:50 +0100
+Subject: media: ov5670: Fix probe on ACPI
+
+From: Sakari Ailus <sakari.ailus@linux.intel.com>
+
+[ Upstream commit 73b41dc51fbeffa4a216b20193274cfe92b5d95b ]
+
+devm_clk_get() will return either an error or NULL, which the driver
+handles, continuing to use the clock of reading the value of the
+clock-frequency property.
+
+However, the value of ov5670->xvclk is left as-is and the other clock
+framework functions aren't capable of handling error values.
+
+Use devm_clk_get_optional() to obtain NULL instead of -ENOENT.
+
+Fixes: 8004c91e2095 ("media: i2c: ov5670: Use common clock framework")
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/ov5670.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/i2c/ov5670.c b/drivers/media/i2c/ov5670.c
+index f79d908f4531b..c5e783a06f06c 100644
+--- a/drivers/media/i2c/ov5670.c
++++ b/drivers/media/i2c/ov5670.c
+@@ -2660,7 +2660,7 @@ static int ov5670_probe(struct i2c_client *client)
+ goto error_print;
+ }
+
+- ov5670->xvclk = devm_clk_get(&client->dev, NULL);
++ ov5670->xvclk = devm_clk_get_optional(&client->dev, NULL);
+ if (!IS_ERR_OR_NULL(ov5670->xvclk))
+ input_clk = clk_get_rate(ov5670->xvclk);
+ else if (PTR_ERR(ov5670->xvclk) == -ENOENT)
+--
+2.39.2
+
--- /dev/null
+From df0b98f2c7b617f7e7002023ec1419f39a0030c6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Feb 2023 14:52:45 +0100
+Subject: media: platform: mtk-mdp3: Add missing check and free for ida_alloc
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit d00f592250782538cda87745607695b0fe27dcd4 ]
+
+Add the check for the return value of the ida_alloc in order to avoid
+NULL pointer dereference.
+Moreover, free allocated "ctx->id" if mdp_m2m_open fails later in order
+to avoid memory leak.
+
+Fixes: 61890ccaefaf ("media: platform: mtk-mdp3: add MediaTek MDP3 driver")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/mediatek/mdp3/mtk-mdp3-m2m.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/mediatek/mdp3/mtk-mdp3-m2m.c b/drivers/media/platform/mediatek/mdp3/mtk-mdp3-m2m.c
+index 5f74ea3b7a524..8612a48bde10f 100644
+--- a/drivers/media/platform/mediatek/mdp3/mtk-mdp3-m2m.c
++++ b/drivers/media/platform/mediatek/mdp3/mtk-mdp3-m2m.c
+@@ -566,7 +566,11 @@ static int mdp_m2m_open(struct file *file)
+ goto err_free_ctx;
+ }
+
+- ctx->id = ida_alloc(&mdp->mdp_ida, GFP_KERNEL);
++ ret = ida_alloc(&mdp->mdp_ida, GFP_KERNEL);
++ if (ret < 0)
++ goto err_unlock_mutex;
++ ctx->id = ret;
++
+ ctx->mdp_dev = mdp;
+
+ v4l2_fh_init(&ctx->fh, vdev);
+@@ -617,6 +621,8 @@ static int mdp_m2m_open(struct file *file)
+ v4l2_fh_del(&ctx->fh);
+ err_exit_fh:
+ v4l2_fh_exit(&ctx->fh);
++ ida_free(&mdp->mdp_ida, ctx->id);
++err_unlock_mutex:
+ mutex_unlock(&mdp->m2m_lock);
+ err_free_ctx:
+ kfree(ctx);
+--
+2.39.2
+
--- /dev/null
+From d1c9aa934354c6e560863a2025d255ae6f4e4237 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Mar 2023 11:13:24 +0800
+Subject: media: platform: mtk-mdp3: fix potential frame size overflow in
+ mdp_try_fmt_mplane()
+
+From: Moudy Ho <moudy.ho@mediatek.com>
+
+[ Upstream commit 4168720753ce6c14c5d3a35302fc2e1841383443 ]
+
+Fix overflow risk when setting certain formats whose frame size exceeds
+a RGB24 with 7723x7723 resolution.
+
+For example, a 7723x7724 RGB24 frame:
+ 1. bpl (byte per line) = 7723 * 3.
+ 2. Overflow occurs when bpl * 7724 * depth.
+
+Fixes: 61890ccaefaf ("media: platform: mtk-mdp3: add MediaTek MDP3 driver")
+Signed-off-by: Moudy Ho <moudy.ho@mediatek.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/mediatek/mdp3/mtk-mdp3-regs.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/media/platform/mediatek/mdp3/mtk-mdp3-regs.c b/drivers/media/platform/mediatek/mdp3/mtk-mdp3-regs.c
+index 4e84a37ecdfc1..36336d169bd91 100644
+--- a/drivers/media/platform/mediatek/mdp3/mtk-mdp3-regs.c
++++ b/drivers/media/platform/mediatek/mdp3/mtk-mdp3-regs.c
+@@ -4,6 +4,7 @@
+ * Author: Ping-Hsun Wu <ping-hsun.wu@mediatek.com>
+ */
+
++#include <linux/math64.h>
+ #include <media/v4l2-common.h>
+ #include <media/videobuf2-v4l2.h>
+ #include <media/videobuf2-dma-contig.h>
+@@ -428,14 +429,15 @@ const struct mdp_format *mdp_try_fmt_mplane(struct v4l2_format *f,
+ u32 bpl = pix_mp->plane_fmt[i].bytesperline;
+ u32 min_si, max_si;
+ u32 si = pix_mp->plane_fmt[i].sizeimage;
++ u64 di;
+
+ bpl = clamp(bpl, min_bpl, max_bpl);
+ pix_mp->plane_fmt[i].bytesperline = bpl;
+
+- min_si = (bpl * pix_mp->height * fmt->depth[i]) /
+- fmt->row_depth[i];
+- max_si = (bpl * s.max_height * fmt->depth[i]) /
+- fmt->row_depth[i];
++ di = (u64)bpl * pix_mp->height * fmt->depth[i];
++ min_si = (u32)div_u64(di, fmt->row_depth[i]);
++ di = (u64)bpl * s.max_height * fmt->depth[i];
++ max_si = (u32)div_u64(di, fmt->row_depth[i]);
+
+ si = clamp(si, min_si, max_si);
+ pix_mp->plane_fmt[i].sizeimage = si;
+--
+2.39.2
+
--- /dev/null
+From 9d8ef7078ab020db10398334b334ed80409e903f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Mar 2023 13:38:33 -0700
+Subject: media: rc: gpio-ir-recv: Fix support for wake-up
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit 9c592f8ab114875fdb3b2040f01818e53de44991 ]
+
+The driver was intended from the start to be a wake-up source for the
+system, however due to the absence of a suitable call to
+device_set_wakeup_capable(), the device_may_wakeup() call used to decide
+whether to enable the GPIO interrupt as a wake-up source would never
+happen. Lookup the DT standard "wakeup-source" property and call
+device_init_wakeup() to ensure the device is flagged as being wakeup
+capable.
+
+Reported-by: Matthew Lear <matthew.lear@broadcom.com>
+Fixes: fd0f6851eb46 ("[media] rc: Add support for GPIO based IR Receiver driver")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/rc/gpio-ir-recv.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/media/rc/gpio-ir-recv.c b/drivers/media/rc/gpio-ir-recv.c
+index 8dbe780dae4e7..41ef8cdba28c4 100644
+--- a/drivers/media/rc/gpio-ir-recv.c
++++ b/drivers/media/rc/gpio-ir-recv.c
+@@ -103,6 +103,8 @@ static int gpio_ir_recv_probe(struct platform_device *pdev)
+ rcdev->map_name = RC_MAP_EMPTY;
+
+ gpio_dev->rcdev = rcdev;
++ if (of_property_read_bool(np, "wakeup-source"))
++ device_init_wakeup(dev, true);
+
+ rc = devm_rc_register_device(dev, rcdev);
+ if (rc < 0) {
+--
+2.39.2
+
--- /dev/null
+From e2c41b78fd1a812ded004c1e9c89246405e4e60a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 26 Mar 2023 16:31:19 +0200
+Subject: media: rcar_fdp1: Convert to platform remove callback returning void
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit 0e82d3715fd208de567b8e4307fbf91ae5e57db4 ]
+
+The .remove() callback for a platform driver returns an int which makes
+many driver authors wrongly assume it's possible to do error handling by
+returning an error code. However the value returned is (mostly) ignored
+and this typically results in resource leaks. To improve here there is a
+quest to make the remove callback return void. In the first step of this
+quest all drivers are converted to .remove_new() which already returns
+void.
+
+Trivially convert this driver from always returning zero in the remove
+callback to the void returning variant.
+
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Stable-dep-of: c766c90faf93 ("media: rcar_fdp1: Fix refcount leak in probe and remove function")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/renesas/rcar_fdp1.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/media/platform/renesas/rcar_fdp1.c b/drivers/media/platform/renesas/rcar_fdp1.c
+index 37ecf489d112e..d80b3214dfae1 100644
+--- a/drivers/media/platform/renesas/rcar_fdp1.c
++++ b/drivers/media/platform/renesas/rcar_fdp1.c
+@@ -2396,7 +2396,7 @@ static int fdp1_probe(struct platform_device *pdev)
+ return ret;
+ }
+
+-static int fdp1_remove(struct platform_device *pdev)
++static void fdp1_remove(struct platform_device *pdev)
+ {
+ struct fdp1_dev *fdp1 = platform_get_drvdata(pdev);
+
+@@ -2404,8 +2404,6 @@ static int fdp1_remove(struct platform_device *pdev)
+ video_unregister_device(&fdp1->vfd);
+ v4l2_device_unregister(&fdp1->v4l2_dev);
+ pm_runtime_disable(&pdev->dev);
+-
+- return 0;
+ }
+
+ static int __maybe_unused fdp1_pm_runtime_suspend(struct device *dev)
+@@ -2441,7 +2439,7 @@ MODULE_DEVICE_TABLE(of, fdp1_dt_ids);
+
+ static struct platform_driver fdp1_pdrv = {
+ .probe = fdp1_probe,
+- .remove = fdp1_remove,
++ .remove_new = fdp1_remove,
+ .driver = {
+ .name = DRIVER_NAME,
+ .of_match_table = fdp1_dt_ids,
+--
+2.39.2
+
--- /dev/null
+From 2aebc3a15ef324d1fa4206fd58e7db68124f5a62 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Jan 2023 11:58:09 +0400
+Subject: media: rcar_fdp1: Fix refcount leak in probe and remove function
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit c766c90faf93897b77c9c5daa603cffab85ba907 ]
+
+rcar_fcp_get() take reference, which should be balanced with
+rcar_fcp_put(). Add missing rcar_fcp_put() in fdp1_remove and
+the error paths of fdp1_probe() to fix this.
+
+Fixes: 4710b752e029 ("[media] v4l: Add Renesas R-Car FDP1 Driver")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+[hverkuil: resolve merge conflict, remove() is now void]
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/renesas/rcar_fdp1.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/media/platform/renesas/rcar_fdp1.c b/drivers/media/platform/renesas/rcar_fdp1.c
+index d80b3214dfae1..c548cb01957b0 100644
+--- a/drivers/media/platform/renesas/rcar_fdp1.c
++++ b/drivers/media/platform/renesas/rcar_fdp1.c
+@@ -2313,8 +2313,10 @@ static int fdp1_probe(struct platform_device *pdev)
+
+ /* Determine our clock rate */
+ clk = clk_get(&pdev->dev, NULL);
+- if (IS_ERR(clk))
+- return PTR_ERR(clk);
++ if (IS_ERR(clk)) {
++ ret = PTR_ERR(clk);
++ goto put_dev;
++ }
+
+ fdp1->clk_rate = clk_get_rate(clk);
+ clk_put(clk);
+@@ -2323,7 +2325,7 @@ static int fdp1_probe(struct platform_device *pdev)
+ ret = v4l2_device_register(&pdev->dev, &fdp1->v4l2_dev);
+ if (ret) {
+ v4l2_err(&fdp1->v4l2_dev, "Failed to register video device\n");
+- return ret;
++ goto put_dev;
+ }
+
+ /* M2M registration */
+@@ -2393,6 +2395,8 @@ static int fdp1_probe(struct platform_device *pdev)
+ unreg_dev:
+ v4l2_device_unregister(&fdp1->v4l2_dev);
+
++put_dev:
++ rcar_fcp_put(fdp1->fcp);
+ return ret;
+ }
+
+@@ -2404,6 +2408,7 @@ static void fdp1_remove(struct platform_device *pdev)
+ video_unregister_device(&fdp1->vfd);
+ v4l2_device_unregister(&fdp1->v4l2_dev);
+ pm_runtime_disable(&pdev->dev);
++ rcar_fcp_put(fdp1->fcp);
+ }
+
+ static int __maybe_unused fdp1_pm_runtime_suspend(struct device *dev)
+--
+2.39.2
+
--- /dev/null
+From a618c20b1d92b224fdd91ee2918ac0298e8042e1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Mar 2023 16:42:20 +0000
+Subject: media: rkvdec: fix use after free bug in rkvdec_remove
+
+From: Zheng Wang <zyytlz.wz@163.com>
+
+[ Upstream commit 3228cec23b8b29215e18090c6ba635840190993d ]
+
+In rkvdec_probe, rkvdec->watchdog_work is bound with
+rkvdec_watchdog_func. Then rkvdec_vp9_run may
+be called to start the work.
+
+If we remove the module which will call rkvdec_remove
+ to make cleanup, there may be a unfinished work.
+ The possible sequence is as follows, which will
+ cause a typical UAF bug.
+
+Fix it by canceling the work before cleanup in rkvdec_remove.
+
+CPU0 CPU1
+
+ |rkvdec_watchdog_func
+rkvdec_remove |
+ rkvdec_v4l2_cleanup|
+ v4l2_m2m_release |
+ kfree(m2m_dev); |
+ |
+ | v4l2_m2m_get_curr_priv
+ | m2m_dev->curr_ctx //use
+
+Fixes: cd33c830448b ("media: rkvdec: Add the rkvdec driver")
+Signed-off-by: Zheng Wang <zyytlz.wz@163.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/rkvdec/rkvdec.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/staging/media/rkvdec/rkvdec.c b/drivers/staging/media/rkvdec/rkvdec.c
+index 7bab7586918c1..82806f198074a 100644
+--- a/drivers/staging/media/rkvdec/rkvdec.c
++++ b/drivers/staging/media/rkvdec/rkvdec.c
+@@ -1066,6 +1066,8 @@ static int rkvdec_remove(struct platform_device *pdev)
+ {
+ struct rkvdec_dev *rkvdec = platform_get_drvdata(pdev);
+
++ cancel_delayed_work_sync(&rkvdec->watchdog_work);
++
+ rkvdec_v4l2_cleanup(rkvdec);
+ pm_runtime_disable(&pdev->dev);
+ pm_runtime_dont_use_autosuspend(&pdev->dev);
+--
+2.39.2
+
--- /dev/null
+From 56f6f117567b496e9a02fe1d4587e345f0329882 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 18 Mar 2023 16:50:23 +0800
+Subject: media: saa7134: fix use after free bug in saa7134_finidev due to race
+ condition
+
+From: Zheng Wang <zyytlz.wz@163.com>
+
+[ Upstream commit 30cf57da176cca80f11df0d9b7f71581fe601389 ]
+
+In saa7134_initdev, it will call saa7134_hwinit1. There are three
+function invoking here: saa7134_video_init1, saa7134_ts_init1
+and saa7134_vbi_init1.
+
+All of them will init a timer with same function. Take
+saa7134_video_init1 as an example. It'll bound &dev->video_q.timeout
+with saa7134_buffer_timeout.
+
+In buffer_activate, the timer funtcion is started.
+
+If we remove the module or device which will call saa7134_finidev
+to make cleanup, there may be a unfinished work. The
+possible sequence is as follows, which will cause a
+typical UAF bug.
+
+Fix it by canceling the timer works accordingly before cleanup in
+saa7134_finidev.
+
+CPU0 CPU1
+
+ |saa7134_buffer_timeout
+saa7134_finidev |
+ kfree(dev); |
+ |
+ | saa7134_buffer_next
+ | //use dev
+
+Fixes: 1e7126b4a86a ("media: saa7134: Convert timers to use timer_setup()")
+Signed-off-by: Zheng Wang <zyytlz.wz@163.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/saa7134/saa7134-ts.c | 1 +
+ drivers/media/pci/saa7134/saa7134-vbi.c | 1 +
+ drivers/media/pci/saa7134/saa7134-video.c | 1 +
+ 3 files changed, 3 insertions(+)
+
+diff --git a/drivers/media/pci/saa7134/saa7134-ts.c b/drivers/media/pci/saa7134/saa7134-ts.c
+index 6a5053126237f..437dbe5e75e29 100644
+--- a/drivers/media/pci/saa7134/saa7134-ts.c
++++ b/drivers/media/pci/saa7134/saa7134-ts.c
+@@ -300,6 +300,7 @@ int saa7134_ts_start(struct saa7134_dev *dev)
+
+ int saa7134_ts_fini(struct saa7134_dev *dev)
+ {
++ del_timer_sync(&dev->ts_q.timeout);
+ saa7134_pgtable_free(dev->pci, &dev->ts_q.pt);
+ return 0;
+ }
+diff --git a/drivers/media/pci/saa7134/saa7134-vbi.c b/drivers/media/pci/saa7134/saa7134-vbi.c
+index 3f0b0933eed69..3e773690468bd 100644
+--- a/drivers/media/pci/saa7134/saa7134-vbi.c
++++ b/drivers/media/pci/saa7134/saa7134-vbi.c
+@@ -185,6 +185,7 @@ int saa7134_vbi_init1(struct saa7134_dev *dev)
+ int saa7134_vbi_fini(struct saa7134_dev *dev)
+ {
+ /* nothing */
++ del_timer_sync(&dev->vbi_q.timeout);
+ return 0;
+ }
+
+diff --git a/drivers/media/pci/saa7134/saa7134-video.c b/drivers/media/pci/saa7134/saa7134-video.c
+index 4d8974c9fcc98..29124756a62bc 100644
+--- a/drivers/media/pci/saa7134/saa7134-video.c
++++ b/drivers/media/pci/saa7134/saa7134-video.c
+@@ -2146,6 +2146,7 @@ int saa7134_video_init1(struct saa7134_dev *dev)
+
+ void saa7134_video_fini(struct saa7134_dev *dev)
+ {
++ del_timer_sync(&dev->video_q.timeout);
+ /* free stuff */
+ saa7134_pgtable_free(dev->pci, &dev->video_q.pt);
+ saa7134_pgtable_free(dev->pci, &dev->vbi_q.pt);
+--
+2.39.2
+
--- /dev/null
+From 14ac0020080f572e1e458ea9cf42348dcd4d6760 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Mar 2023 15:49:44 +0200
+Subject: media: v4l: async: Return async sub-devices to subnotifier list
+
+From: Sakari Ailus <sakari.ailus@linux.intel.com>
+
+[ Upstream commit 5276c9df9c2ab9a43b534bfb56bdb10899cd3a22 ]
+
+When an async notifier is unregistered, the async sub-devices in the
+notifier's done list will disappear with the notifier. However this is
+currently also done to the sub-notifiers that remain registered. Their
+sub-devices only need to be unbound while the async sub-devices themselves
+need to be returned to the sub-notifier's waiting list. Do this now.
+
+Fixes: 2cab00bb076b ("media: v4l: async: Allow binding notifiers to sub-devices")
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/v4l2-core/v4l2-async.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/media/v4l2-core/v4l2-async.c b/drivers/media/v4l2-core/v4l2-async.c
+index d7e9ffc7aa237..b16b5f4cb91e2 100644
+--- a/drivers/media/v4l2-core/v4l2-async.c
++++ b/drivers/media/v4l2-core/v4l2-async.c
+@@ -416,7 +416,8 @@ static void v4l2_async_cleanup(struct v4l2_subdev *sd)
+
+ /* Unbind all sub-devices in the notifier tree. */
+ static void
+-v4l2_async_nf_unbind_all_subdevs(struct v4l2_async_notifier *notifier)
++v4l2_async_nf_unbind_all_subdevs(struct v4l2_async_notifier *notifier,
++ bool readd)
+ {
+ struct v4l2_subdev *sd, *tmp;
+
+@@ -425,9 +426,11 @@ v4l2_async_nf_unbind_all_subdevs(struct v4l2_async_notifier *notifier)
+ v4l2_async_find_subdev_notifier(sd);
+
+ if (subdev_notifier)
+- v4l2_async_nf_unbind_all_subdevs(subdev_notifier);
++ v4l2_async_nf_unbind_all_subdevs(subdev_notifier, true);
+
+ v4l2_async_nf_call_unbind(notifier, sd, sd->asd);
++ if (readd)
++ list_add_tail(&sd->asd->list, ¬ifier->waiting);
+ v4l2_async_cleanup(sd);
+
+ list_move(&sd->async_list, &subdev_list);
+@@ -559,7 +562,7 @@ static int __v4l2_async_nf_register(struct v4l2_async_notifier *notifier)
+ /*
+ * On failure, unbind all sub-devices registered through this notifier.
+ */
+- v4l2_async_nf_unbind_all_subdevs(notifier);
++ v4l2_async_nf_unbind_all_subdevs(notifier, false);
+
+ err_unlock:
+ mutex_unlock(&list_lock);
+@@ -609,7 +612,7 @@ __v4l2_async_nf_unregister(struct v4l2_async_notifier *notifier)
+ if (!notifier || (!notifier->v4l2_dev && !notifier->sd))
+ return;
+
+- v4l2_async_nf_unbind_all_subdevs(notifier);
++ v4l2_async_nf_unbind_all_subdevs(notifier, false);
+
+ notifier->sd = NULL;
+ notifier->v4l2_dev = NULL;
+@@ -807,7 +810,7 @@ int v4l2_async_register_subdev(struct v4l2_subdev *sd)
+ */
+ subdev_notifier = v4l2_async_find_subdev_notifier(sd);
+ if (subdev_notifier)
+- v4l2_async_nf_unbind_all_subdevs(subdev_notifier);
++ v4l2_async_nf_unbind_all_subdevs(subdev_notifier, false);
+
+ if (sd->asd)
+ v4l2_async_nf_call_unbind(notifier, sd, sd->asd);
+--
+2.39.2
+
--- /dev/null
+From fce990f2650b36d3c231da3e959e7e36195e4ed4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Feb 2023 16:00:46 +0100
+Subject: media: v4l: subdev: Make link validation safer
+
+From: Sakari Ailus <sakari.ailus@linux.intel.com>
+
+[ Upstream commit 55f1ecb1199000932cf82e357841cc7498ac904f ]
+
+Link validation currently accesses invalid pointers if the link passed to
+it is not between two sub-devices. This is of course a driver bug.
+
+Ignore the error but print a warning message, as this is how it used to
+work previously.
+
+Fixes: a6b995ed03ff ("media: subdev: use streams in v4l2_subdev_link_validate()")
+Reported-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Tested-by: Hans de Goede <hdegoede@redhat.com>
+Reviewed-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/v4l2-core/v4l2-subdev.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/media/v4l2-core/v4l2-subdev.c b/drivers/media/v4l2-core/v4l2-subdev.c
+index b10045c02f434..9a0c23267626d 100644
+--- a/drivers/media/v4l2-core/v4l2-subdev.c
++++ b/drivers/media/v4l2-core/v4l2-subdev.c
+@@ -1236,6 +1236,16 @@ int v4l2_subdev_link_validate(struct media_link *link)
+ struct v4l2_subdev_state *source_state, *sink_state;
+ int ret;
+
++ if (!is_media_entity_v4l2_subdev(link->sink->entity) ||
++ !is_media_entity_v4l2_subdev(link->source->entity)) {
++ pr_warn_once("%s of link '%s':%u->'%s':%u is not a V4L2 sub-device, driver bug!\n",
++ !is_media_entity_v4l2_subdev(link->sink->entity) ?
++ "sink" : "source",
++ link->source->entity->name, link->source->index,
++ link->sink->entity->name, link->sink->index);
++ return 0;
++ }
++
+ sink_sd = media_entity_to_v4l2_subdev(link->sink->entity);
+ source_sd = media_entity_to_v4l2_subdev(link->source->entity);
+
+--
+2.39.2
+
--- /dev/null
+From 801b497860f8d2049af8c184f32ed8066f07760b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Feb 2023 09:18:35 +0100
+Subject: media: venus: dec: Fix capture formats enumeration order
+
+From: Javier Martinez Canillas <javierm@redhat.com>
+
+[ Upstream commit a9d45ec74c8e68aaafe90191928eddbf79f4644f ]
+
+Commit 9593126dae3e ("media: venus: Add a handling of QC08C compressed
+format") and commit cef92b14e653 ("media: venus: Add a handling of QC10C
+compressed format") added support for the QC08C and QC10C compressed
+formats respectively.
+
+But these also caused a regression, because the new formats where added
+at the beginning of the vdec_formats[] array and the vdec_inst_init()
+function sets the default format output and capture using fixed indexes
+of that array:
+
+static void vdec_inst_init(struct venus_inst *inst)
+{
+...
+ inst->fmt_out = &vdec_formats[8];
+ inst->fmt_cap = &vdec_formats[0];
+...
+}
+
+Since now V4L2_PIX_FMT_NV12 is not the first entry in the array anymore,
+the default capture format is not set to that as it was done before.
+
+Both commits changed the first index to keep inst->fmt_out default format
+set to V4L2_PIX_FMT_H264, but did not update the latter to keep .fmt_out
+default format set to V4L2_PIX_FMT_NV12.
+
+Rather than updating the index to the current V4L2_PIX_FMT_NV12 position,
+let's reorder the entries so that this format is the first entry again.
+
+This would also make VIDIOC_ENUM_FMT report the V4L2_PIX_FMT_NV12 format
+with an index 0 as it did before the QC08C and QC10C formats were added.
+
+Fixes: 9593126dae3e ("media: venus: Add a handling of QC08C compressed format")
+Fixes: cef92b14e653 ("media: venus: Add a handling of QC10C compressed format")
+Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
+Signed-off-by: Stanimir Varbanov <stanimir.k.varbanov@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/qcom/venus/vdec.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/media/platform/qcom/venus/vdec.c b/drivers/media/platform/qcom/venus/vdec.c
+index 9d26587716bf6..1a52c2ea2da5b 100644
+--- a/drivers/media/platform/qcom/venus/vdec.c
++++ b/drivers/media/platform/qcom/venus/vdec.c
+@@ -31,15 +31,15 @@
+ */
+ static const struct venus_format vdec_formats[] = {
+ {
+- .pixfmt = V4L2_PIX_FMT_QC08C,
++ .pixfmt = V4L2_PIX_FMT_NV12,
+ .num_planes = 1,
+ .type = V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE,
+ }, {
+- .pixfmt = V4L2_PIX_FMT_QC10C,
++ .pixfmt = V4L2_PIX_FMT_QC08C,
+ .num_planes = 1,
+ .type = V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE,
+- },{
+- .pixfmt = V4L2_PIX_FMT_NV12,
++ }, {
++ .pixfmt = V4L2_PIX_FMT_QC10C,
+ .num_planes = 1,
+ .type = V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE,
+ }, {
+--
+2.39.2
+
--- /dev/null
+From 9484191af50eac37c2676de76555af89bcba6a3e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Jan 2023 13:54:18 +0000
+Subject: media: venus: dec: Fix handling of the start cmd
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michał Krawczyk <mk@semihalf.com>
+
+[ Upstream commit 50248ad9f190d527cbd578190ca769729518b703 ]
+
+The decoder driver should clear the last_buffer_dequeued flag of the
+capture queue upon receiving V4L2_DEC_CMD_START.
+
+The last_buffer_dequeued flag is set upon receiving EOS (which always
+happens upon receiving V4L2_DEC_CMD_STOP).
+
+Without this patch, after issuing the V4L2_DEC_CMD_STOP and
+V4L2_DEC_CMD_START, the vb2_dqbuf() function will always fail, even if
+the buffers are completed by the hardware.
+
+Fixes: beac82904a87 ("media: venus: make decoder compliant with stateful codec API")
+
+Signed-off-by: Michał Krawczyk <mk@semihalf.com>
+Signed-off-by: Stanimir Varbanov <stanimir.k.varbanov@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/qcom/venus/vdec.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/media/platform/qcom/venus/vdec.c b/drivers/media/platform/qcom/venus/vdec.c
+index 4ceaba37e2e57..9d26587716bf6 100644
+--- a/drivers/media/platform/qcom/venus/vdec.c
++++ b/drivers/media/platform/qcom/venus/vdec.c
+@@ -526,6 +526,7 @@ static int
+ vdec_decoder_cmd(struct file *file, void *fh, struct v4l2_decoder_cmd *cmd)
+ {
+ struct venus_inst *inst = to_inst(file);
++ struct vb2_queue *dst_vq;
+ struct hfi_frame_data fdata = {0};
+ int ret;
+
+@@ -556,6 +557,13 @@ vdec_decoder_cmd(struct file *file, void *fh, struct v4l2_decoder_cmd *cmd)
+ inst->codec_state = VENUS_DEC_STATE_DRAIN;
+ inst->drain_active = true;
+ }
++ } else if (cmd->cmd == V4L2_DEC_CMD_START &&
++ inst->codec_state == VENUS_DEC_STATE_STOPPED) {
++ dst_vq = v4l2_m2m_get_vq(inst->fh.m2m_ctx,
++ V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE);
++ vb2_clear_last_buffer_dequeued(dst_vq);
++
++ inst->codec_state = VENUS_DEC_STATE_DECODING;
+ }
+
+ unlock:
+--
+2.39.2
+
--- /dev/null
+From cbce8ab56168685804e2441c8f749e4002f36e01 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Jan 2023 22:20:31 +0200
+Subject: media: vsp1: Replace vb2_is_streaming() with
+ vb2_start_streaming_called()
+
+From: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+
+[ Upstream commit 52d8caca3d533cc499f1255be25576ffd936ec95 ]
+
+The vsp1 driver uses the vb2_is_streaming() function in its .buf_queue()
+handler to check if the .start_streaming() operation has been called,
+and decide whether to just add the buffer to an internal queue, or also
+trigger a hardware run. vb2_is_streaming() relies on the vb2_queue
+structure's streaming field, which used to be set only after calling the
+.start_streaming() operation.
+
+Commit a10b21532574 ("media: vb2: add (un)prepare_streaming queue ops")
+changed this, setting the .streaming field in vb2_core_streamon() before
+enqueuing buffers to the driver and calling .start_streaming(). This
+broke the vsp1 driver which now believes that .start_streaming() has
+been called when it hasn't, leading to a crash:
+
+[ 881.058705] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020
+[ 881.067495] Mem abort info:
+[ 881.070290] ESR = 0x0000000096000006
+[ 881.074042] EC = 0x25: DABT (current EL), IL = 32 bits
+[ 881.079358] SET = 0, FnV = 0
+[ 881.082414] EA = 0, S1PTW = 0
+[ 881.085558] FSC = 0x06: level 2 translation fault
+[ 881.090439] Data abort info:
+[ 881.093320] ISV = 0, ISS = 0x00000006
+[ 881.097157] CM = 0, WnR = 0
+[ 881.100126] user pgtable: 4k pages, 48-bit VAs, pgdp=000000004fa51000
+[ 881.106573] [0000000000000020] pgd=080000004f36e003, p4d=080000004f36e003, pud=080000004f7ec003, pmd=0000000000000000
+[ 881.117217] Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP
+[ 881.123494] Modules linked in: rcar_fdp1 v4l2_mem2mem
+[ 881.128572] CPU: 0 PID: 1271 Comm: yavta Tainted: G B 6.2.0-rc1-00023-g6c94e2e99343 #556
+[ 881.138061] Hardware name: Renesas Salvator-X 2nd version board based on r8a77965 (DT)
+[ 881.145981] pstate: 400000c5 (nZcv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+[ 881.152951] pc : vsp1_dl_list_add_body+0xa8/0xe0
+[ 881.157580] lr : vsp1_dl_list_add_body+0x34/0xe0
+[ 881.162206] sp : ffff80000c267710
+[ 881.165522] x29: ffff80000c267710 x28: ffff000010938ae8 x27: ffff000013a8dd98
+[ 881.172683] x26: ffff000010938098 x25: ffff000013a8dc00 x24: ffff000010ed6ba8
+[ 881.179841] x23: ffff00000faa4000 x22: 0000000000000000 x21: 0000000000000020
+[ 881.186998] x20: ffff00000faa4000 x19: 0000000000000000 x18: 0000000000000000
+[ 881.194154] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
+[ 881.201309] x14: 0000000000000000 x13: 746e696174206c65 x12: ffff70000157043d
+[ 881.208465] x11: 1ffff0000157043c x10: ffff70000157043c x9 : dfff800000000000
+[ 881.215622] x8 : ffff80000ab821e7 x7 : 00008ffffea8fbc4 x6 : 0000000000000001
+[ 881.222779] x5 : ffff80000ab821e0 x4 : ffff70000157043d x3 : 0000000000000020
+[ 881.229936] x2 : 0000000000000020 x1 : ffff00000e4f6400 x0 : 0000000000000000
+[ 881.237092] Call trace:
+[ 881.239542] vsp1_dl_list_add_body+0xa8/0xe0
+[ 881.243822] vsp1_video_pipeline_run+0x270/0x2a0
+[ 881.248449] vsp1_video_buffer_queue+0x1c0/0x1d0
+[ 881.253076] __enqueue_in_driver+0xbc/0x260
+[ 881.257269] vb2_start_streaming+0x48/0x200
+[ 881.261461] vb2_core_streamon+0x13c/0x280
+[ 881.265565] vb2_streamon+0x3c/0x90
+[ 881.269064] vsp1_video_streamon+0x2fc/0x3e0
+[ 881.273344] v4l_streamon+0x50/0x70
+[ 881.276844] __video_do_ioctl+0x2bc/0x5d0
+[ 881.280861] video_usercopy+0x2a8/0xc80
+[ 881.284704] video_ioctl2+0x20/0x40
+[ 881.288201] v4l2_ioctl+0xa4/0xc0
+[ 881.291525] __arm64_sys_ioctl+0xe8/0x110
+[ 881.295543] invoke_syscall+0x68/0x190
+[ 881.299303] el0_svc_common.constprop.0+0x88/0x170
+[ 881.304105] do_el0_svc+0x4c/0xf0
+[ 881.307430] el0_svc+0x4c/0xa0
+[ 881.310494] el0t_64_sync_handler+0xbc/0x140
+[ 881.314773] el0t_64_sync+0x190/0x194
+[ 881.318450] Code: d50323bf d65f03c0 91008263 f9800071 (885f7c60)
+[ 881.324551] ---[ end trace 0000000000000000 ]---
+[ 881.329173] note: yavta[1271] exited with preempt_count 1
+
+A different regression report sent to the linux-media mailing list ([1])
+was answered with a claim that the vb2_is_streaming() function has never
+been meant for this purpose. The document of the function, as well as of
+the struct vb2_queue streaming field, is sparse, so this claim may be
+hard to verify.
+
+The information needed by the vsp1 driver to decide how to process
+queued buffers is also available from the vb2_start_streaming_called()
+function. Use it instead of vb2_is_streaming() to fix the problem.
+
+[1] https://lore.kernel.org/linux-media/545610e7-3446-2b82-60dc-7385fea3774f@redhat.com/
+
+Fixes: a10b21532574 ("media: vb2: add (un)prepare_streaming queue ops")
+Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Reviewed-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Tested-by: Duy Nguyen <duy.nguyen.rh@renesas.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/renesas/vsp1/vsp1_video.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/renesas/vsp1/vsp1_video.c b/drivers/media/platform/renesas/vsp1/vsp1_video.c
+index 544012fd1fe93..3664c87e4afb5 100644
+--- a/drivers/media/platform/renesas/vsp1/vsp1_video.c
++++ b/drivers/media/platform/renesas/vsp1/vsp1_video.c
+@@ -776,7 +776,7 @@ static void vsp1_video_buffer_queue(struct vb2_buffer *vb)
+ video->rwpf->mem = buf->mem;
+ pipe->buffers_ready |= 1 << video->pipe_index;
+
+- if (vb2_is_streaming(&video->queue) &&
++ if (vb2_start_streaming_called(&video->queue) &&
+ vsp1_pipeline_ready(pipe))
+ vsp1_video_pipeline_run(pipe);
+
+--
+2.39.2
+
--- /dev/null
+From 8519fcad151ffd610ffb8c076559ac5fe0af7a0d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Mar 2023 13:41:38 +0000
+Subject: mfd: arizona-spi: Add missing MODULE_DEVICE_TABLE
+
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+
+[ Upstream commit 972c91fd7beddc3f19c8c855f6e60e7dbd435cbd ]
+
+This patch adds missing MODULE_DEVICE_TABLE definition
+which generates correct modalias for automatic loading
+of this driver when it is built as a module.
+
+Fixes: 3f65555c417c ("mfd: arizona: Split of_match table into I2C and SPI versions")
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Signed-off-by: Lee Jones <lee@kernel.org>
+Link: https://lore.kernel.org/r/20230323134138.834369-1-ckeepax@opensource.cirrus.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/arizona-spi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/mfd/arizona-spi.c b/drivers/mfd/arizona-spi.c
+index da05b966d48c6..02cf4f3e91d76 100644
+--- a/drivers/mfd/arizona-spi.c
++++ b/drivers/mfd/arizona-spi.c
+@@ -277,6 +277,7 @@ static const struct of_device_id arizona_spi_of_match[] = {
+ { .compatible = "cirrus,cs47l24", .data = (void *)CS47L24 },
+ {},
+ };
++MODULE_DEVICE_TABLE(of, arizona_spi_of_match);
+ #endif
+
+ static struct spi_driver arizona_spi_driver = {
+--
+2.39.2
+
--- /dev/null
+From 85f1a7c0ceb30d35ffb04c8fd4bd9f97e913cba6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Mar 2023 07:11:30 -0700
+Subject: mfd: ocelot-spi: Fix unsupported bulk read
+
+From: Colin Foster <colin.foster@in-advantage.com>
+
+[ Upstream commit f0484d2f80a72022b7fac72bcb406392900ef1eb ]
+
+Ocelot chips (VSC7511, VSC7512, VSC7513, VSC7514) don't support bulk read
+operations over SPI.
+
+Many SPI buses have hardware that can optimize consecutive reads.
+Essentially an address is written to the chip, and if the SPI controller
+continues to toggle the clock, subsequent register values are reported.
+This can lead to significant optimizations, because the time between
+"address is written to the chip" and "chip starts to report data" can often
+take a fixed amount of time.
+
+When support for Ocelot chips were added in commit f3e893626abe ("mfd:
+ocelot: Add support for the vsc7512 chip via spi") it was believed that
+this optimization was supported. However it is not.
+
+Most register transactions with the Ocelot chips are not done in bulk, so
+this bug could go unnoticed. The one scenario where bulk register
+operations _are_ performed is when polling port statistics counters, which
+was added in commit d87b1c08f38a ("net: mscc: ocelot: use bulk reads for
+stats").
+
+Things get slightly more complicated here...
+
+A bug was introduced in commit d4c367650704 ("net: mscc: ocelot: keep
+ocelot_stat_layout by reg address, not offset") that broke the optimization
+of bulk reads. This means that when Ethernet support for the VSC7512 chip
+was added in commit 3d7316ac81ac ("net: dsa: ocelot: add external ocelot
+switch control") things were actually working "as expected".
+
+The bulk read opmtimization was discovered, and fixed in commit
+6acc72a43eac ("net: mscc: ocelot: fix stats region batching") and the
+timing optimizations for SPI were noticed. A bulk read went from ~14ms to
+~2ms. But this timing improvement came at the cost of every register
+reading zero due the fact that bulk reads don't work.
+
+The read timings increase back to 13-14ms, but that's a price worth paying
+in order to receive valid data. This is verified in a DSA setup (cpsw-new
+switch tied to port 0 on the VSC7512, after having been running overnight)
+
+ Rx Octets: 16222055 # Counters from CPSW switch
+ Tx Octets: 12034702
+ Net Octets: 28256757
+ p00_rx_octets: 12034702 # Counters from Ocelot switch
+ p00_rx_frames_below_65_octets: 0
+ p00_rx_frames_65_to_127_octets: 88188
+ p00_rx_frames_128_to_255_octets: 13
+ p00_rx_frames_256_to_511_octets: 0
+ p00_rx_frames_512_to_1023_octets: 0
+ p00_rx_frames_over_1526_octets: 3306
+ p00_tx_octets: 16222055
+
+Fixes: f3e893626abe ("mfd: ocelot: Add support for the vsc7512 chip via spi")
+Signed-off-by: Colin Foster <colin.foster@in-advantage.com>
+Signed-off-by: Lee Jones <lee@kernel.org>
+Link: https://lore.kernel.org/r/20230322141130.2531256-1-colin.foster@in-advantage.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/ocelot-spi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/mfd/ocelot-spi.c b/drivers/mfd/ocelot-spi.c
+index 2ecd271de2fb9..85021f94e5874 100644
+--- a/drivers/mfd/ocelot-spi.c
++++ b/drivers/mfd/ocelot-spi.c
+@@ -130,6 +130,7 @@ static const struct regmap_config ocelot_spi_regmap_config = {
+
+ .write_flag_mask = 0x80,
+
++ .use_single_read = true,
+ .use_single_write = true,
+ .can_multi_write = false,
+
+--
+2.39.2
+
--- /dev/null
+From ba55a927e535408249e87e1fbd0c07e6b3fa1912 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Feb 2023 12:25:46 +0100
+Subject: mfd: tqmx86: Correct board names for TQMxE39x
+
+From: Matthias Schiffer <matthias.schiffer@ew.tq-group.com>
+
+[ Upstream commit f376c479668557bcc2fd9e9fbc0f53e7819a11cd ]
+
+It seems that this driver was developed based on preliminary documentation.
+Report the correct names for all TQMxE39x variants, as they are used by
+the released hardware revisions:
+
+- Fix names for TQMxE39C1/C2 board IDs
+- Distinguish TQMxE39M and TQMxE39S, which use the same board ID
+
+The TQMxE39M/S are distinguished using the SAUC (Sanctioned Alternate
+Uses Configuration) register of the GPIO controller. This also prepares
+for the correct handling of the differences between the GPIO controllers
+of our COMe and SMARC modules.
+
+Fixes: 2f17dd34ffed ("mfd: tqmx86: IO controller with I2C, Wachdog and GPIO")
+Signed-off-by: Matthias Schiffer <matthias.schiffer@ew.tq-group.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Lee Jones <lee@kernel.org>
+Link: https://lore.kernel.org/r/aca9a7cb42a85181bcb456c437554d2728e708ec.1676892223.git.matthias.schiffer@ew.tq-group.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/tqmx86.c | 32 +++++++++++++++++---------------
+ 1 file changed, 17 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/mfd/tqmx86.c b/drivers/mfd/tqmx86.c
+index 958334f14eb00..fac02875fe7d9 100644
+--- a/drivers/mfd/tqmx86.c
++++ b/drivers/mfd/tqmx86.c
+@@ -30,9 +30,9 @@
+ #define TQMX86_REG_BOARD_ID_50UC 2
+ #define TQMX86_REG_BOARD_ID_E38C 3
+ #define TQMX86_REG_BOARD_ID_60EB 4
+-#define TQMX86_REG_BOARD_ID_E39M 5
+-#define TQMX86_REG_BOARD_ID_E39C 6
+-#define TQMX86_REG_BOARD_ID_E39x 7
++#define TQMX86_REG_BOARD_ID_E39MS 5
++#define TQMX86_REG_BOARD_ID_E39C1 6
++#define TQMX86_REG_BOARD_ID_E39C2 7
+ #define TQMX86_REG_BOARD_ID_70EB 8
+ #define TQMX86_REG_BOARD_ID_80UC 9
+ #define TQMX86_REG_BOARD_ID_110EB 11
+@@ -48,6 +48,7 @@
+ #define TQMX86_REG_IO_EXT_INT_12 3
+ #define TQMX86_REG_IO_EXT_INT_MASK 0x3
+ #define TQMX86_REG_IO_EXT_INT_GPIO_SHIFT 4
++#define TQMX86_REG_SAUC 0x17
+
+ #define TQMX86_REG_I2C_DETECT 0x1a7
+ #define TQMX86_REG_I2C_DETECT_SOFT 0xa5
+@@ -110,7 +111,7 @@ static const struct mfd_cell tqmx86_devs[] = {
+ },
+ };
+
+-static const char *tqmx86_board_id_to_name(u8 board_id)
++static const char *tqmx86_board_id_to_name(u8 board_id, u8 sauc)
+ {
+ switch (board_id) {
+ case TQMX86_REG_BOARD_ID_E38M:
+@@ -121,12 +122,12 @@ static const char *tqmx86_board_id_to_name(u8 board_id)
+ return "TQMxE38C";
+ case TQMX86_REG_BOARD_ID_60EB:
+ return "TQMx60EB";
+- case TQMX86_REG_BOARD_ID_E39M:
+- return "TQMxE39M";
+- case TQMX86_REG_BOARD_ID_E39C:
+- return "TQMxE39C";
+- case TQMX86_REG_BOARD_ID_E39x:
+- return "TQMxE39x";
++ case TQMX86_REG_BOARD_ID_E39MS:
++ return (sauc == 0xff) ? "TQMxE39M" : "TQMxE39S";
++ case TQMX86_REG_BOARD_ID_E39C1:
++ return "TQMxE39C1";
++ case TQMX86_REG_BOARD_ID_E39C2:
++ return "TQMxE39C2";
+ case TQMX86_REG_BOARD_ID_70EB:
+ return "TQMx70EB";
+ case TQMX86_REG_BOARD_ID_80UC:
+@@ -159,9 +160,9 @@ static int tqmx86_board_id_to_clk_rate(struct device *dev, u8 board_id)
+ case TQMX86_REG_BOARD_ID_E40C1:
+ case TQMX86_REG_BOARD_ID_E40C2:
+ return 24000;
+- case TQMX86_REG_BOARD_ID_E39M:
+- case TQMX86_REG_BOARD_ID_E39C:
+- case TQMX86_REG_BOARD_ID_E39x:
++ case TQMX86_REG_BOARD_ID_E39MS:
++ case TQMX86_REG_BOARD_ID_E39C1:
++ case TQMX86_REG_BOARD_ID_E39C2:
+ return 25000;
+ case TQMX86_REG_BOARD_ID_E38M:
+ case TQMX86_REG_BOARD_ID_E38C:
+@@ -175,7 +176,7 @@ static int tqmx86_board_id_to_clk_rate(struct device *dev, u8 board_id)
+
+ static int tqmx86_probe(struct platform_device *pdev)
+ {
+- u8 board_id, rev, i2c_det, io_ext_int_val;
++ u8 board_id, sauc, rev, i2c_det, io_ext_int_val;
+ struct device *dev = &pdev->dev;
+ u8 gpio_irq_cfg, readback;
+ const char *board_name;
+@@ -205,7 +206,8 @@ static int tqmx86_probe(struct platform_device *pdev)
+ return -ENOMEM;
+
+ board_id = ioread8(io_base + TQMX86_REG_BOARD_ID);
+- board_name = tqmx86_board_id_to_name(board_id);
++ sauc = ioread8(io_base + TQMX86_REG_SAUC);
++ board_name = tqmx86_board_id_to_name(board_id, sauc);
+ rev = ioread8(io_base + TQMX86_REG_BOARD_REV);
+
+ dev_info(dev,
+--
+2.39.2
+
--- /dev/null
+From 4f906ff73609e606841df2553f664076f00bf146 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Feb 2023 12:25:44 +0100
+Subject: mfd: tqmx86: Do not access I2C_DETECT register through io_base
+
+From: Matthias Schiffer <matthias.schiffer@ew.tq-group.com>
+
+[ Upstream commit 1be1b23696b3d4b0231c694f5e0767b4471d33a9 ]
+
+The I2C_DETECT register is at IO port 0x1a7, which is outside the range
+passed to devm_ioport_map() for io_base, and was only working because
+there aren't actually any bounds checks for IO port accesses.
+
+Extending the range does not seem like a good solution here, as it would
+then conflict with the IO resource assigned to the I2C controller. As
+this is just a one-off access during probe, use a simple inb() instead.
+
+While we're at it, drop the unused define TQMX86_REG_I2C_INT_EN.
+
+Fixes: 2f17dd34ffed ("mfd: tqmx86: IO controller with I2C, Wachdog and GPIO")
+Signed-off-by: Matthias Schiffer <matthias.schiffer@ew.tq-group.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Lee Jones <lee@kernel.org>
+Link: https://lore.kernel.org/r/e8300a30f0791afb67d79db8089fb6004855f378.1676892223.git.matthias.schiffer@ew.tq-group.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/tqmx86.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/mfd/tqmx86.c b/drivers/mfd/tqmx86.c
+index 7ae906ff8e353..31d0efb5aacf8 100644
+--- a/drivers/mfd/tqmx86.c
++++ b/drivers/mfd/tqmx86.c
+@@ -49,9 +49,8 @@
+ #define TQMX86_REG_IO_EXT_INT_MASK 0x3
+ #define TQMX86_REG_IO_EXT_INT_GPIO_SHIFT 4
+
+-#define TQMX86_REG_I2C_DETECT 0x47
++#define TQMX86_REG_I2C_DETECT 0x1a7
+ #define TQMX86_REG_I2C_DETECT_SOFT 0xa5
+-#define TQMX86_REG_I2C_INT_EN 0x49
+
+ static uint gpio_irq;
+ module_param(gpio_irq, uint, 0);
+@@ -213,7 +212,12 @@ static int tqmx86_probe(struct platform_device *pdev)
+ "Found %s - Board ID %d, PCB Revision %d, PLD Revision %d\n",
+ board_name, board_id, rev >> 4, rev & 0xf);
+
+- i2c_det = ioread8(io_base + TQMX86_REG_I2C_DETECT);
++ /*
++ * The I2C_DETECT register is in the range assigned to the I2C driver
++ * later, so we don't extend TQMX86_IOSIZE. Use inb() for this one-off
++ * access instead of ioport_map + unmap.
++ */
++ i2c_det = inb(TQMX86_REG_I2C_DETECT);
+
+ if (gpio_irq_cfg) {
+ io_ext_int_val =
+--
+2.39.2
+
--- /dev/null
+From dd1038d18289be0ca5e9ce235969fd51591aa857 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Feb 2023 12:25:45 +0100
+Subject: mfd: tqmx86: Specify IO port register range more precisely
+
+From: Matthias Schiffer <matthias.schiffer@ew.tq-group.com>
+
+[ Upstream commit 051c69ff4f607aa114c7bbdd7c41ed881367aeee ]
+
+Registers 0x160..0x17f are unassigned. Use 0x180 as base register and
+update offets accordingly.
+
+Also change the size of the range to include 0x19f. While 0x19f is
+currently reserved for future extensions, so are several of the previous
+registers up to 0x19e, and it is weird to leave out just the last one.
+
+Fixes: 2f17dd34ffed ("mfd: tqmx86: IO controller with I2C, Wachdog and GPIO")
+Signed-off-by: Matthias Schiffer <matthias.schiffer@ew.tq-group.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Lee Jones <lee@kernel.org>
+Link: https://lore.kernel.org/r/db4677ac318b1283c8956f637f409995a30a31c3.1676892223.git.matthias.schiffer@ew.tq-group.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/tqmx86.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/mfd/tqmx86.c b/drivers/mfd/tqmx86.c
+index 31d0efb5aacf8..958334f14eb00 100644
+--- a/drivers/mfd/tqmx86.c
++++ b/drivers/mfd/tqmx86.c
+@@ -16,8 +16,8 @@
+ #include <linux/platform_data/i2c-ocores.h>
+ #include <linux/platform_device.h>
+
+-#define TQMX86_IOBASE 0x160
+-#define TQMX86_IOSIZE 0x3f
++#define TQMX86_IOBASE 0x180
++#define TQMX86_IOSIZE 0x20
+ #define TQMX86_IOBASE_I2C 0x1a0
+ #define TQMX86_IOSIZE_I2C 0xa
+ #define TQMX86_IOBASE_WATCHDOG 0x18b
+@@ -25,7 +25,7 @@
+ #define TQMX86_IOBASE_GPIO 0x18d
+ #define TQMX86_IOSIZE_GPIO 0x4
+
+-#define TQMX86_REG_BOARD_ID 0x20
++#define TQMX86_REG_BOARD_ID 0x00
+ #define TQMX86_REG_BOARD_ID_E38M 1
+ #define TQMX86_REG_BOARD_ID_50UC 2
+ #define TQMX86_REG_BOARD_ID_E38C 3
+@@ -40,8 +40,8 @@
+ #define TQMX86_REG_BOARD_ID_E40S 13
+ #define TQMX86_REG_BOARD_ID_E40C1 14
+ #define TQMX86_REG_BOARD_ID_E40C2 15
+-#define TQMX86_REG_BOARD_REV 0x21
+-#define TQMX86_REG_IO_EXT_INT 0x26
++#define TQMX86_REG_BOARD_REV 0x01
++#define TQMX86_REG_IO_EXT_INT 0x06
+ #define TQMX86_REG_IO_EXT_INT_NONE 0
+ #define TQMX86_REG_IO_EXT_INT_7 1
+ #define TQMX86_REG_IO_EXT_INT_9 2
+--
+2.39.2
+
--- /dev/null
+From 006f86d3a06f5787854c336f855c9d2562acc826 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Mar 2023 23:37:15 +0300
+Subject: mmc: sdhci-of-esdhc: fix quirk to ignore command inhibit for data
+
+From: Georgii Kruglov <georgy.kruglov@yandex.ru>
+
+[ Upstream commit 0dd8316037a2a6d85b2be208bef9991de7b42170 ]
+
+If spec_reg is equal to 'SDHCI_PRESENT_STATE', esdhc_readl_fixup()
+fixes up register value and returns it immediately. As a result, the
+further block
+(spec_reg == SDHCI_PRESENT_STATE)
+ &&(esdhc->quirk_ignore_data_inhibit == true),
+is never executed.
+
+The patch merges the second block into the first one.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: 1f1929f3f2fa ("mmc: sdhci-of-esdhc: add quirk to ignore command inhibit for data")
+Signed-off-by: Georgii Kruglov <georgy.kruglov@yandex.ru>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Link: https://lore.kernel.org/r/20230321203715.3975-1-georgy.kruglov@yandex.ru
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/sdhci-of-esdhc.c | 24 +++++++++++-------------
+ 1 file changed, 11 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/mmc/host/sdhci-of-esdhc.c b/drivers/mmc/host/sdhci-of-esdhc.c
+index 4712adac7f7c0..48ca1cf15b199 100644
+--- a/drivers/mmc/host/sdhci-of-esdhc.c
++++ b/drivers/mmc/host/sdhci-of-esdhc.c
+@@ -133,6 +133,7 @@ static u32 esdhc_readl_fixup(struct sdhci_host *host,
+ return ret;
+ }
+ }
++
+ /*
+ * The DAT[3:0] line signal levels and the CMD line signal level are
+ * not compatible with standard SDHC register. The line signal levels
+@@ -144,6 +145,16 @@ static u32 esdhc_readl_fixup(struct sdhci_host *host,
+ ret = value & 0x000fffff;
+ ret |= (value >> 4) & SDHCI_DATA_LVL_MASK;
+ ret |= (value << 1) & SDHCI_CMD_LVL;
++
++ /*
++ * Some controllers have unreliable Data Line Active
++ * bit for commands with busy signal. This affects
++ * Command Inhibit (data) bit. Just ignore it since
++ * MMC core driver has already polled card status
++ * with CMD13 after any command with busy siganl.
++ */
++ if (esdhc->quirk_ignore_data_inhibit)
++ ret &= ~SDHCI_DATA_INHIBIT;
+ return ret;
+ }
+
+@@ -158,19 +169,6 @@ static u32 esdhc_readl_fixup(struct sdhci_host *host,
+ return ret;
+ }
+
+- /*
+- * Some controllers have unreliable Data Line Active
+- * bit for commands with busy signal. This affects
+- * Command Inhibit (data) bit. Just ignore it since
+- * MMC core driver has already polled card status
+- * with CMD13 after any command with busy siganl.
+- */
+- if ((spec_reg == SDHCI_PRESENT_STATE) &&
+- (esdhc->quirk_ignore_data_inhibit == true)) {
+- ret = value & ~SDHCI_DATA_INHIBIT;
+- return ret;
+- }
+-
+ ret = value;
+ return ret;
+ }
+--
+2.39.2
+
--- /dev/null
+From 73bb5c9539d6aa0a8dac2d8bcd2bb124582b928f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Mar 2023 13:52:56 +0100
+Subject: module/decompress: Never use kunmap() for local un-mappings
+
+From: Fabio M. De Francesco <fmdefrancesco@gmail.com>
+
+[ Upstream commit 3c17655ab13704582fe25e8ea3200a9b2f8bf20a ]
+
+Use kunmap_local() to unmap pages locally mapped with kmap_local_page().
+
+kunmap_local() must be called on the kernel virtual address returned by
+kmap_local_page(), differently from how we use kunmap() which instead
+expects the mapped page as its argument.
+
+In module_zstd_decompress() we currently map with kmap_local_page() and
+unmap with kunmap(). This breaks the code and so it should be fixed.
+
+Cc: Piotr Gorski <piotrgorski@cachyos.org>
+Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Cc: Luis Chamberlain <mcgrof@kernel.org>
+Cc: Stephen Boyd <swboyd@chromium.org>
+Cc: Ira Weiny <ira.weiny@intel.com>
+Fixes: 169a58ad824d ("module/decompress: Support zstd in-kernel decompression")
+Signed-off-by: Fabio M. De Francesco <fmdefrancesco@gmail.com>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Reviewed-by: Ira Weiny <ira.weiny@intel.com>
+Reviewed-by: Piotr Gorski <piotrgorski@cachyos.org>
+Signed-off-by: Luis Chamberlain <mcgrof@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/module/decompress.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/module/decompress.c b/kernel/module/decompress.c
+index bb79ac1a6d8f7..7ddc87bee2741 100644
+--- a/kernel/module/decompress.c
++++ b/kernel/module/decompress.c
+@@ -267,7 +267,7 @@ static ssize_t module_zstd_decompress(struct load_info *info,
+ zstd_dec.size = PAGE_SIZE;
+
+ ret = zstd_decompress_stream(dstream, &zstd_dec, &zstd_buf);
+- kunmap(page);
++ kunmap_local(zstd_dec.dst);
+ retval = zstd_get_error_code(ret);
+ if (retval)
+ break;
+--
+2.39.2
+
--- /dev/null
+From 3347985dde02c0aede46a6185b06eb043f44eafb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Apr 2023 05:23:11 +0800
+Subject: mt76: mt7921: fix kernel panic by accessing unallocated eeprom.data
+
+From: Sean Wang <sean.wang@mediatek.com>
+
+[ Upstream commit 12db28c3ef31f719bd18fa186a40bb152e6a527c ]
+
+The MT7921 driver no longer uses eeprom.data, but the relevant code has not
+been removed completely since
+commit 16d98b548365 ("mt76: mt7921: rely on mcu_get_nic_capability").
+This could result in potential invalid memory access.
+
+To fix the kernel panic issue in mt7921, it is necessary to avoid accessing
+unallocated eeprom.data which can lead to invalid memory access.
+
+Furthermore, it is possible to entirely eliminate the
+mt7921_mcu_parse_eeprom function and solely depend on
+mt7921_mcu_parse_response to divide the RxD header.
+
+[2.702735] BUG: kernel NULL pointer dereference, address: 0000000000000550
+[2.702740] #PF: supervisor write access in kernel mode
+[2.702741] #PF: error_code(0x0002) - not-present page
+[2.702743] PGD 0 P4D 0
+[2.702747] Oops: 0002 [#1] PREEMPT SMP NOPTI
+[2.702755] RIP: 0010:mt7921_mcu_parse_response+0x147/0x170 [mt7921_common]
+[2.702758] RSP: 0018:ffffae7c00fef828 EFLAGS: 00010286
+[2.702760] RAX: ffffa367f57be024 RBX: ffffa367cc7bf500 RCX: 0000000000000000
+[2.702762] RDX: 0000000000000550 RSI: 0000000000000000 RDI: ffffa367cc7bf500
+[2.702763] RBP: ffffae7c00fef840 R08: ffffa367cb167000 R09: 0000000000000005
+[2.702764] R10: 0000000000000000 R11: ffffffffc04702e4 R12: ffffa367e8329f40
+[2.702766] R13: 0000000000000000 R14: 0000000000000001 R15: ffffa367e8329f40
+[2.702768] FS: 000079ee6cf20c40(0000) GS:ffffa36b2f940000(0000) knlGS:0000000000000000
+[2.702769] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[2.702775] CR2: 0000000000000550 CR3: 00000001233c6004 CR4: 0000000000770ee0
+[2.702776] PKRU: 55555554
+[2.702777] Call Trace:
+[2.702782] mt76_mcu_skb_send_and_get_msg+0xc3/0x11e [mt76 <HASH:1bc4 5>]
+[2.702785] mt7921_run_firmware+0x241/0x853 [mt7921_common <HASH:6a2f 6>]
+[2.702789] mt7921e_mcu_init+0x2b/0x56 [mt7921e <HASH:d290 7>]
+[2.702792] mt7921_register_device+0x2eb/0x5a5 [mt7921_common <HASH:6a2f 6>]
+[2.702795] ? mt7921_irq_tasklet+0x1d4/0x1d4 [mt7921e <HASH:d290 7>]
+[2.702797] mt7921_pci_probe+0x2d6/0x319 [mt7921e <HASH:d290 7>]
+[2.702799] pci_device_probe+0x9f/0x12a
+
+Fixes: 16d98b548365 ("mt76: mt7921: rely on mcu_get_nic_capability")
+Signed-off-by: Sean Wang <sean.wang@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/mediatek/mt76/mt7921/mcu.c | 20 -------------------
+ 1 file changed, 20 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
+index c5e7ad06f8777..48f38dbbb91da 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
+@@ -16,24 +16,6 @@ static bool mt7921_disable_clc;
+ module_param_named(disable_clc, mt7921_disable_clc, bool, 0644);
+ MODULE_PARM_DESC(disable_clc, "disable CLC support");
+
+-static int
+-mt7921_mcu_parse_eeprom(struct mt76_dev *dev, struct sk_buff *skb)
+-{
+- struct mt7921_mcu_eeprom_info *res;
+- u8 *buf;
+-
+- if (!skb)
+- return -EINVAL;
+-
+- skb_pull(skb, sizeof(struct mt76_connac2_mcu_rxd));
+-
+- res = (struct mt7921_mcu_eeprom_info *)skb->data;
+- buf = dev->eeprom.data + le32_to_cpu(res->addr);
+- memcpy(buf, res->data, 16);
+-
+- return 0;
+-}
+-
+ int mt7921_mcu_parse_response(struct mt76_dev *mdev, int cmd,
+ struct sk_buff *skb, int seq)
+ {
+@@ -60,8 +42,6 @@ int mt7921_mcu_parse_response(struct mt76_dev *mdev, int cmd,
+ } else if (cmd == MCU_EXT_CMD(THERMAL_CTRL)) {
+ skb_pull(skb, sizeof(*rxd) + 4);
+ ret = le32_to_cpu(*(__le32 *)skb->data);
+- } else if (cmd == MCU_EXT_CMD(EFUSE_ACCESS)) {
+- ret = mt7921_mcu_parse_eeprom(mdev, skb);
+ } else if (cmd == MCU_UNI_CMD(DEV_INFO_UPDATE) ||
+ cmd == MCU_UNI_CMD(BSS_INFO_UPDATE) ||
+ cmd == MCU_UNI_CMD(STA_REC_UPDATE) ||
+--
+2.39.2
+
--- /dev/null
+From f76360d38bcb080f211be5a0f65277cd27e26588 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Apr 2023 23:28:01 +0800
+Subject: net: amd: Fix link leak when verifying config failed
+
+From: Gencen Gan <gangecen@hust.edu.cn>
+
+[ Upstream commit d325c34d9e7e38d371c0a299d415e9b07f66a1fb ]
+
+After failing to verify configuration, it returns directly without
+releasing link, which may cause memory leak.
+
+Paolo Abeni thinks that the whole code of this driver is quite
+"suboptimal" and looks unmainatained since at least ~15y, so he
+suggests that we could simply remove the whole driver, please
+take it into consideration.
+
+Simon Horman suggests that the fix label should be set to
+"Linux-2.6.12-rc2" considering that the problem has existed
+since the driver was introduced and the commit above doesn't
+seem to exist in net/net-next.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Gan Gecen <gangecen@hust.edu.cn>
+Reviewed-by: Dongliang Mu <dzm91@hust.edu.cn>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/amd/nmclan_cs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/amd/nmclan_cs.c b/drivers/net/ethernet/amd/nmclan_cs.c
+index 823a329a921f4..0dd391c84c138 100644
+--- a/drivers/net/ethernet/amd/nmclan_cs.c
++++ b/drivers/net/ethernet/amd/nmclan_cs.c
+@@ -651,7 +651,7 @@ static int nmclan_config(struct pcmcia_device *link)
+ } else {
+ pr_notice("mace id not found: %x %x should be 0x40 0x?9\n",
+ sig[0], sig[1]);
+- return -ENODEV;
++ goto failed;
+ }
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 82c7dc7c17cf8141857e04caa9d9e4fcd65d9cd6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Apr 2023 15:36:07 +0300
+Subject: net: dpaa: Fix uninitialized variable in dpaa_stop()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit 461bb5b97049a149278f2c27a3aa12af16da6a2e ]
+
+The return value is not initialized on the success path.
+
+Fixes: 901bdff2f529 ("net: fman: Change return type of disable to void")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Acked-by: Madalin Bucur <madalin.bucur@oss.nxp.com>
+Reviewed-by: Sean Anderson <sean.anderson@seco.com>
+Link: https://lore.kernel.org/r/8c9dc377-8495-495f-a4e5-4d2d0ee12f0c@kili.mountain
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/dpaa/dpaa_eth.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
+index 9318a2554056d..f961966171210 100644
+--- a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
++++ b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
+@@ -299,7 +299,8 @@ static int dpaa_stop(struct net_device *net_dev)
+ {
+ struct mac_device *mac_dev;
+ struct dpaa_priv *priv;
+- int i, err, error;
++ int i, error;
++ int err = 0;
+
+ priv = netdev_priv(net_dev);
+ mac_dev = priv->mac_dev;
+--
+2.39.2
+
--- /dev/null
+From de3953fc1bdf15357dd300d79aadda56f79dd0ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 19 Mar 2023 12:33:29 +0000
+Subject: net: dsa: qca8k: remove assignment of an_enabled in pcs_get_state()
+
+From: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+
+[ Upstream commit 9ef70d0130f282638b28cfce24222f71ada00c9c ]
+
+pcs_get_state() implementations are not supposed to alter an_enabled.
+Remove this assignment.
+
+Fixes: b3591c2a3661 ("net: dsa: qca8k: Switch to PHYLINK instead of PHYLIB")
+Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Link: https://lore.kernel.org/r/E1pdsE5-00Dl2l-8F@rmk-PC.armlinux.org.uk
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/qca/qca8k-8xxx.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/net/dsa/qca/qca8k-8xxx.c b/drivers/net/dsa/qca/qca8k-8xxx.c
+index 55df4479ea30b..62810903f1b31 100644
+--- a/drivers/net/dsa/qca/qca8k-8xxx.c
++++ b/drivers/net/dsa/qca/qca8k-8xxx.c
+@@ -1483,7 +1483,6 @@ static void qca8k_pcs_get_state(struct phylink_pcs *pcs,
+
+ state->link = !!(reg & QCA8K_PORT_STATUS_LINK_UP);
+ state->an_complete = state->link;
+- state->an_enabled = !!(reg & QCA8K_PORT_STATUS_LINK_AUTO);
+ state->duplex = (reg & QCA8K_PORT_STATUS_DUPLEX) ? DUPLEX_FULL :
+ DUPLEX_HALF;
+
+--
+2.39.2
+
--- /dev/null
+From cfc0b30cc839240198c54c05853441c9bc03195b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Apr 2023 18:11:29 +0200
+Subject: net: ethernet: stmmac: dwmac-rk: fix optional phy regulator handling
+
+From: Sebastian Reichel <sebastian.reichel@collabora.com>
+
+[ Upstream commit db21973263f8c56750cb610f1d5e8bee00a513b9 ]
+
+The usual devm_regulator_get() call already handles "optional"
+regulators by returning a valid dummy and printing a warning
+that the dummy regulator should be described properly. This
+code open coded the same behaviour, but masked any errors that
+are not -EPROBE_DEFER and is quite noisy.
+
+This change effectively unmasks and propagates regulators errors
+not involving -ENODEV, downgrades the error print to warning level
+if no regulator is specified and captures the probe defer message
+for /sys/kernel/debug/devices_deferred.
+
+Fixes: 2e12f536635f ("net: stmmac: dwmac-rk: Use standard devicetree property for phy regulator")
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c | 14 ++++----------
+ 1 file changed, 4 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c
+index 7ac9ca9b49351..4ea31ccf24d09 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c
+@@ -1586,9 +1586,6 @@ static int phy_power_on(struct rk_priv_data *bsp_priv, bool enable)
+ int ret;
+ struct device *dev = &bsp_priv->pdev->dev;
+
+- if (!ldo)
+- return 0;
+-
+ if (enable) {
+ ret = regulator_enable(ldo);
+ if (ret)
+@@ -1636,14 +1633,11 @@ static struct rk_priv_data *rk_gmac_setup(struct platform_device *pdev,
+ }
+ }
+
+- bsp_priv->regulator = devm_regulator_get_optional(dev, "phy");
++ bsp_priv->regulator = devm_regulator_get(dev, "phy");
+ if (IS_ERR(bsp_priv->regulator)) {
+- if (PTR_ERR(bsp_priv->regulator) == -EPROBE_DEFER) {
+- dev_err(dev, "phy regulator is not available yet, deferred probing\n");
+- return ERR_PTR(-EPROBE_DEFER);
+- }
+- dev_err(dev, "no regulator found\n");
+- bsp_priv->regulator = NULL;
++ ret = PTR_ERR(bsp_priv->regulator);
++ dev_err_probe(dev, ret, "failed to get phy regulator\n");
++ return ERR_PTR(ret);
+ }
+
+ ret = of_property_read_string(dev->of_node, "clock_in_out", &strings);
+--
+2.39.2
+
--- /dev/null
+From 46697e479a0475e79001c5c41fe4dbb4f7e757b8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Apr 2023 18:11:28 +0200
+Subject: net: ethernet: stmmac: dwmac-rk: rework optional clock handling
+
+From: Sebastian Reichel <sebastian.reichel@collabora.com>
+
+[ Upstream commit ea449f7fa0bf3fcd02e04a770b9ff707bf5e8f96 ]
+
+The clock requesting code is quite repetitive. Fix this by requesting
+the clocks via devm_clk_bulk_get_optional. The optional variant has been
+used, since this is effectively what the old code did. The exact clocks
+required depend on the platform and configuration. As a side effect
+this change adds correct -EPROBE_DEFER handling.
+
+Suggested-by: Jakub Kicinski <kuba@kernel.org>
+Suggested-by: Andrew Lunn <andrew@lunn.ch>
+Fixes: 7ad269ea1a2b ("GMAC: add driver for Rockchip RK3288 SoCs integrated GMAC")
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/stmicro/stmmac/dwmac-rk.c | 183 +++++++-----------
+ 1 file changed, 70 insertions(+), 113 deletions(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c
+index 4b8fd11563e49..7ac9ca9b49351 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c
+@@ -39,6 +39,24 @@ struct rk_gmac_ops {
+ u32 regs[];
+ };
+
++static const char * const rk_clocks[] = {
++ "aclk_mac", "pclk_mac", "mac_clk_tx", "clk_mac_speed",
++};
++
++static const char * const rk_rmii_clocks[] = {
++ "mac_clk_rx", "clk_mac_ref", "clk_mac_refout",
++};
++
++enum rk_clocks_index {
++ RK_ACLK_MAC = 0,
++ RK_PCLK_MAC,
++ RK_MAC_CLK_TX,
++ RK_CLK_MAC_SPEED,
++ RK_MAC_CLK_RX,
++ RK_CLK_MAC_REF,
++ RK_CLK_MAC_REFOUT,
++};
++
+ struct rk_priv_data {
+ struct platform_device *pdev;
+ phy_interface_t phy_iface;
+@@ -51,15 +69,9 @@ struct rk_priv_data {
+ bool clock_input;
+ bool integrated_phy;
+
++ struct clk_bulk_data *clks;
++ int num_clks;
+ struct clk *clk_mac;
+- struct clk *gmac_clkin;
+- struct clk *mac_clk_rx;
+- struct clk *mac_clk_tx;
+- struct clk *clk_mac_ref;
+- struct clk *clk_mac_refout;
+- struct clk *clk_mac_speed;
+- struct clk *aclk_mac;
+- struct clk *pclk_mac;
+ struct clk *clk_phy;
+
+ struct reset_control *phy_reset;
+@@ -104,10 +116,11 @@ static void px30_set_to_rmii(struct rk_priv_data *bsp_priv)
+
+ static void px30_set_rmii_speed(struct rk_priv_data *bsp_priv, int speed)
+ {
++ struct clk *clk_mac_speed = bsp_priv->clks[RK_CLK_MAC_SPEED].clk;
+ struct device *dev = &bsp_priv->pdev->dev;
+ int ret;
+
+- if (IS_ERR(bsp_priv->clk_mac_speed)) {
++ if (!clk_mac_speed) {
+ dev_err(dev, "%s: Missing clk_mac_speed clock\n", __func__);
+ return;
+ }
+@@ -116,7 +129,7 @@ static void px30_set_rmii_speed(struct rk_priv_data *bsp_priv, int speed)
+ regmap_write(bsp_priv->grf, PX30_GRF_GMAC_CON1,
+ PX30_GMAC_SPEED_10M);
+
+- ret = clk_set_rate(bsp_priv->clk_mac_speed, 2500000);
++ ret = clk_set_rate(clk_mac_speed, 2500000);
+ if (ret)
+ dev_err(dev, "%s: set clk_mac_speed rate 2500000 failed: %d\n",
+ __func__, ret);
+@@ -124,7 +137,7 @@ static void px30_set_rmii_speed(struct rk_priv_data *bsp_priv, int speed)
+ regmap_write(bsp_priv->grf, PX30_GRF_GMAC_CON1,
+ PX30_GMAC_SPEED_100M);
+
+- ret = clk_set_rate(bsp_priv->clk_mac_speed, 25000000);
++ ret = clk_set_rate(clk_mac_speed, 25000000);
+ if (ret)
+ dev_err(dev, "%s: set clk_mac_speed rate 25000000 failed: %d\n",
+ __func__, ret);
+@@ -1066,6 +1079,7 @@ static void rk3568_set_to_rmii(struct rk_priv_data *bsp_priv)
+
+ static void rk3568_set_gmac_speed(struct rk_priv_data *bsp_priv, int speed)
+ {
++ struct clk *clk_mac_speed = bsp_priv->clks[RK_CLK_MAC_SPEED].clk;
+ struct device *dev = &bsp_priv->pdev->dev;
+ unsigned long rate;
+ int ret;
+@@ -1085,7 +1099,7 @@ static void rk3568_set_gmac_speed(struct rk_priv_data *bsp_priv, int speed)
+ return;
+ }
+
+- ret = clk_set_rate(bsp_priv->clk_mac_speed, rate);
++ ret = clk_set_rate(clk_mac_speed, rate);
+ if (ret)
+ dev_err(dev, "%s: set clk_mac_speed rate %ld failed %d\n",
+ __func__, rate, ret);
+@@ -1371,6 +1385,7 @@ static void rv1126_set_to_rmii(struct rk_priv_data *bsp_priv)
+
+ static void rv1126_set_rgmii_speed(struct rk_priv_data *bsp_priv, int speed)
+ {
++ struct clk *clk_mac_speed = bsp_priv->clks[RK_CLK_MAC_SPEED].clk;
+ struct device *dev = &bsp_priv->pdev->dev;
+ unsigned long rate;
+ int ret;
+@@ -1390,7 +1405,7 @@ static void rv1126_set_rgmii_speed(struct rk_priv_data *bsp_priv, int speed)
+ return;
+ }
+
+- ret = clk_set_rate(bsp_priv->clk_mac_speed, rate);
++ ret = clk_set_rate(clk_mac_speed, rate);
+ if (ret)
+ dev_err(dev, "%s: set clk_mac_speed rate %ld failed %d\n",
+ __func__, rate, ret);
+@@ -1398,6 +1413,7 @@ static void rv1126_set_rgmii_speed(struct rk_priv_data *bsp_priv, int speed)
+
+ static void rv1126_set_rmii_speed(struct rk_priv_data *bsp_priv, int speed)
+ {
++ struct clk *clk_mac_speed = bsp_priv->clks[RK_CLK_MAC_SPEED].clk;
+ struct device *dev = &bsp_priv->pdev->dev;
+ unsigned long rate;
+ int ret;
+@@ -1414,7 +1430,7 @@ static void rv1126_set_rmii_speed(struct rk_priv_data *bsp_priv, int speed)
+ return;
+ }
+
+- ret = clk_set_rate(bsp_priv->clk_mac_speed, rate);
++ ret = clk_set_rate(clk_mac_speed, rate);
+ if (ret)
+ dev_err(dev, "%s: set clk_mac_speed rate %ld failed %d\n",
+ __func__, rate, ret);
+@@ -1475,68 +1491,50 @@ static int rk_gmac_clk_init(struct plat_stmmacenet_data *plat)
+ {
+ struct rk_priv_data *bsp_priv = plat->bsp_priv;
+ struct device *dev = &bsp_priv->pdev->dev;
+- int ret;
++ int phy_iface = bsp_priv->phy_iface;
++ int i, j, ret;
+
+ bsp_priv->clk_enabled = false;
+
+- bsp_priv->mac_clk_rx = devm_clk_get(dev, "mac_clk_rx");
+- if (IS_ERR(bsp_priv->mac_clk_rx))
+- dev_err(dev, "cannot get clock %s\n",
+- "mac_clk_rx");
+-
+- bsp_priv->mac_clk_tx = devm_clk_get(dev, "mac_clk_tx");
+- if (IS_ERR(bsp_priv->mac_clk_tx))
+- dev_err(dev, "cannot get clock %s\n",
+- "mac_clk_tx");
++ bsp_priv->num_clks = ARRAY_SIZE(rk_clocks);
++ if (phy_iface == PHY_INTERFACE_MODE_RMII)
++ bsp_priv->num_clks += ARRAY_SIZE(rk_rmii_clocks);
+
+- bsp_priv->aclk_mac = devm_clk_get(dev, "aclk_mac");
+- if (IS_ERR(bsp_priv->aclk_mac))
+- dev_err(dev, "cannot get clock %s\n",
+- "aclk_mac");
++ bsp_priv->clks = devm_kcalloc(dev, bsp_priv->num_clks,
++ sizeof(*bsp_priv->clks), GFP_KERNEL);
++ if (!bsp_priv->clks)
++ return -ENOMEM;
+
+- bsp_priv->pclk_mac = devm_clk_get(dev, "pclk_mac");
+- if (IS_ERR(bsp_priv->pclk_mac))
+- dev_err(dev, "cannot get clock %s\n",
+- "pclk_mac");
++ for (i = 0; i < ARRAY_SIZE(rk_clocks); i++)
++ bsp_priv->clks[i].id = rk_clocks[i];
+
+- bsp_priv->clk_mac = devm_clk_get(dev, "stmmaceth");
+- if (IS_ERR(bsp_priv->clk_mac))
+- dev_err(dev, "cannot get clock %s\n",
+- "stmmaceth");
+-
+- if (bsp_priv->phy_iface == PHY_INTERFACE_MODE_RMII) {
+- bsp_priv->clk_mac_ref = devm_clk_get(dev, "clk_mac_ref");
+- if (IS_ERR(bsp_priv->clk_mac_ref))
+- dev_err(dev, "cannot get clock %s\n",
+- "clk_mac_ref");
+-
+- if (!bsp_priv->clock_input) {
+- bsp_priv->clk_mac_refout =
+- devm_clk_get(dev, "clk_mac_refout");
+- if (IS_ERR(bsp_priv->clk_mac_refout))
+- dev_err(dev, "cannot get clock %s\n",
+- "clk_mac_refout");
+- }
++ if (phy_iface == PHY_INTERFACE_MODE_RMII) {
++ for (j = 0; j < ARRAY_SIZE(rk_rmii_clocks); j++)
++ bsp_priv->clks[i++].id = rk_rmii_clocks[j];
+ }
+
+- bsp_priv->clk_mac_speed = devm_clk_get(dev, "clk_mac_speed");
+- if (IS_ERR(bsp_priv->clk_mac_speed))
+- dev_err(dev, "cannot get clock %s\n", "clk_mac_speed");
++ ret = devm_clk_bulk_get_optional(dev, bsp_priv->num_clks,
++ bsp_priv->clks);
++ if (ret)
++ return dev_err_probe(dev, ret, "Failed to get clocks\n");
++
++ /* "stmmaceth" will be enabled by the core */
++ bsp_priv->clk_mac = devm_clk_get(dev, "stmmaceth");
++ ret = PTR_ERR_OR_ZERO(bsp_priv->clk_mac);
++ if (ret)
++ return dev_err_probe(dev, ret, "Cannot get stmmaceth clock\n");
+
+ if (bsp_priv->clock_input) {
+ dev_info(dev, "clock input from PHY\n");
+- } else {
+- if (bsp_priv->phy_iface == PHY_INTERFACE_MODE_RMII)
+- clk_set_rate(bsp_priv->clk_mac, 50000000);
++ } else if (phy_iface == PHY_INTERFACE_MODE_RMII) {
++ clk_set_rate(bsp_priv->clk_mac, 50000000);
+ }
+
+ if (plat->phy_node && bsp_priv->integrated_phy) {
+ bsp_priv->clk_phy = of_clk_get(plat->phy_node, 0);
+- if (IS_ERR(bsp_priv->clk_phy)) {
+- ret = PTR_ERR(bsp_priv->clk_phy);
+- dev_err(dev, "Cannot get PHY clock: %d\n", ret);
+- return -EINVAL;
+- }
++ ret = PTR_ERR_OR_ZERO(bsp_priv->clk_phy);
++ if (ret)
++ return dev_err_probe(dev, ret, "Cannot get PHY clock\n");
+ clk_set_rate(bsp_priv->clk_phy, 50000000);
+ }
+
+@@ -1545,77 +1543,36 @@ static int rk_gmac_clk_init(struct plat_stmmacenet_data *plat)
+
+ static int gmac_clk_enable(struct rk_priv_data *bsp_priv, bool enable)
+ {
+- int phy_iface = bsp_priv->phy_iface;
++ int ret;
+
+ if (enable) {
+ if (!bsp_priv->clk_enabled) {
+- if (phy_iface == PHY_INTERFACE_MODE_RMII) {
+- if (!IS_ERR(bsp_priv->mac_clk_rx))
+- clk_prepare_enable(
+- bsp_priv->mac_clk_rx);
+-
+- if (!IS_ERR(bsp_priv->clk_mac_ref))
+- clk_prepare_enable(
+- bsp_priv->clk_mac_ref);
+-
+- if (!IS_ERR(bsp_priv->clk_mac_refout))
+- clk_prepare_enable(
+- bsp_priv->clk_mac_refout);
+- }
+-
+- if (!IS_ERR(bsp_priv->clk_phy))
+- clk_prepare_enable(bsp_priv->clk_phy);
+-
+- if (!IS_ERR(bsp_priv->aclk_mac))
+- clk_prepare_enable(bsp_priv->aclk_mac);
+-
+- if (!IS_ERR(bsp_priv->pclk_mac))
+- clk_prepare_enable(bsp_priv->pclk_mac);
+-
+- if (!IS_ERR(bsp_priv->mac_clk_tx))
+- clk_prepare_enable(bsp_priv->mac_clk_tx);
++ ret = clk_bulk_prepare_enable(bsp_priv->num_clks,
++ bsp_priv->clks);
++ if (ret)
++ return ret;
+
+- if (!IS_ERR(bsp_priv->clk_mac_speed))
+- clk_prepare_enable(bsp_priv->clk_mac_speed);
++ ret = clk_prepare_enable(bsp_priv->clk_phy);
++ if (ret)
++ return ret;
+
+ if (bsp_priv->ops && bsp_priv->ops->set_clock_selection)
+ bsp_priv->ops->set_clock_selection(bsp_priv,
+ bsp_priv->clock_input, true);
+
+- /**
+- * if (!IS_ERR(bsp_priv->clk_mac))
+- * clk_prepare_enable(bsp_priv->clk_mac);
+- */
+ mdelay(5);
+ bsp_priv->clk_enabled = true;
+ }
+ } else {
+ if (bsp_priv->clk_enabled) {
+- if (phy_iface == PHY_INTERFACE_MODE_RMII) {
+- clk_disable_unprepare(bsp_priv->mac_clk_rx);
+-
+- clk_disable_unprepare(bsp_priv->clk_mac_ref);
+-
+- clk_disable_unprepare(bsp_priv->clk_mac_refout);
+- }
+-
++ clk_bulk_disable_unprepare(bsp_priv->num_clks,
++ bsp_priv->clks);
+ clk_disable_unprepare(bsp_priv->clk_phy);
+
+- clk_disable_unprepare(bsp_priv->aclk_mac);
+-
+- clk_disable_unprepare(bsp_priv->pclk_mac);
+-
+- clk_disable_unprepare(bsp_priv->mac_clk_tx);
+-
+- clk_disable_unprepare(bsp_priv->clk_mac_speed);
+-
+ if (bsp_priv->ops && bsp_priv->ops->set_clock_selection)
+ bsp_priv->ops->set_clock_selection(bsp_priv,
+ bsp_priv->clock_input, false);
+- /**
+- * if (!IS_ERR(bsp_priv->clk_mac))
+- * clk_disable_unprepare(bsp_priv->clk_mac);
+- */
++
+ bsp_priv->clk_enabled = false;
+ }
+ }
+--
+2.39.2
+
--- /dev/null
+From 72393fa189d53169c8db6d89b6139c098177b2fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Apr 2023 14:54:50 +0800
+Subject: net: libwx: fix memory leak in wx_setup_rx_resources
+
+From: Zhengchao Shao <shaozhengchao@huawei.com>
+
+[ Upstream commit e315e7b83a22043bffee450437d7089ef373cbf6 ]
+
+When wx_alloc_page_pool() failed in wx_setup_rx_resources(), it doesn't
+release DMA buffer. Add dma_free_coherent() in the error path to release
+the DMA buffer.
+
+Fixes: 850b971110b2 ("net: libwx: Allocate Rx and Tx resources")
+Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Link: https://lore.kernel.org/r/20230418065450.2268522-1-shaozhengchao@huawei.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/wangxun/libwx/wx_lib.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/wangxun/libwx/wx_lib.c b/drivers/net/ethernet/wangxun/libwx/wx_lib.c
+index eb89a274083e7..1e8d8b7b0c62e 100644
+--- a/drivers/net/ethernet/wangxun/libwx/wx_lib.c
++++ b/drivers/net/ethernet/wangxun/libwx/wx_lib.c
+@@ -1798,10 +1798,13 @@ static int wx_setup_rx_resources(struct wx_ring *rx_ring)
+ ret = wx_alloc_page_pool(rx_ring);
+ if (ret < 0) {
+ dev_err(rx_ring->dev, "Page pool creation failed: %d\n", ret);
+- goto err;
++ goto err_desc;
+ }
+
+ return 0;
++
++err_desc:
++ dma_free_coherent(dev, rx_ring->size, rx_ring->desc, rx_ring->dma);
+ err:
+ kvfree(rx_ring->rx_buffer_info);
+ rx_ring->rx_buffer_info = NULL;
+--
+2.39.2
+
--- /dev/null
+From 7c405d1d4e730dec92e25d245e834ae4b30ebdc6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Mar 2023 11:06:48 +0200
+Subject: net/mlx5: E-switch, Create per vport table based on devlink encap
+ mode
+
+From: Chris Mi <cmi@nvidia.com>
+
+[ Upstream commit fd745f4c0abe41ebb09d11bf622b054a0f3e7b49 ]
+
+Currently when creating per vport table, create flags are hardcoded.
+Devlink encap mode is set based on user input and HW capability.
+Create per vport table based on devlink encap mode.
+
+Fixes: c796bb7cd230 ("net/mlx5: E-switch, Generalize per vport table API")
+Signed-off-by: Chris Mi <cmi@nvidia.com>
+Reviewed-by: Roi Dayan <roid@nvidia.com>
+Reviewed-by: Maor Dickman <maord@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/mellanox/mlx5/core/en/tc/sample.c | 4 ++--
+ .../net/ethernet/mellanox/mlx5/core/esw/vporttbl.c | 12 +++++++++++-
+ drivers/net/ethernet/mellanox/mlx5/core/eswitch.h | 2 +-
+ .../ethernet/mellanox/mlx5/core/eswitch_offloads.c | 2 +-
+ 4 files changed, 15 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc/sample.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tc/sample.c
+index 558a776359af6..5db239cae8145 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc/sample.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc/sample.c
+@@ -14,10 +14,10 @@
+
+ #define MLX5_ESW_VPORT_TBL_SIZE_SAMPLE (64 * 1024)
+
+-static const struct esw_vport_tbl_namespace mlx5_esw_vport_tbl_sample_ns = {
++static struct esw_vport_tbl_namespace mlx5_esw_vport_tbl_sample_ns = {
+ .max_fte = MLX5_ESW_VPORT_TBL_SIZE_SAMPLE,
+ .max_num_groups = 0, /* default num of groups */
+- .flags = MLX5_FLOW_TABLE_TUNNEL_EN_REFORMAT | MLX5_FLOW_TABLE_TUNNEL_EN_DECAP,
++ .flags = 0,
+ };
+
+ struct mlx5e_tc_psample {
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/esw/vporttbl.c b/drivers/net/ethernet/mellanox/mlx5/core/esw/vporttbl.c
+index 9e72118f2e4c0..749c3957a1280 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/esw/vporttbl.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/vporttbl.c
+@@ -11,7 +11,7 @@ struct mlx5_vport_key {
+ u16 prio;
+ u16 vport;
+ u16 vhca_id;
+- const struct esw_vport_tbl_namespace *vport_ns;
++ struct esw_vport_tbl_namespace *vport_ns;
+ } __packed;
+
+ struct mlx5_vport_table {
+@@ -21,6 +21,14 @@ struct mlx5_vport_table {
+ struct mlx5_vport_key key;
+ };
+
++static void
++esw_vport_tbl_init(struct mlx5_eswitch *esw, struct esw_vport_tbl_namespace *ns)
++{
++ if (esw->offloads.encap != DEVLINK_ESWITCH_ENCAP_MODE_NONE)
++ ns->flags |= (MLX5_FLOW_TABLE_TUNNEL_EN_REFORMAT |
++ MLX5_FLOW_TABLE_TUNNEL_EN_DECAP);
++}
++
+ static struct mlx5_flow_table *
+ esw_vport_tbl_create(struct mlx5_eswitch *esw, struct mlx5_flow_namespace *ns,
+ const struct esw_vport_tbl_namespace *vport_ns)
+@@ -80,6 +88,7 @@ mlx5_esw_vporttbl_get(struct mlx5_eswitch *esw, struct mlx5_vport_tbl_attr *attr
+ u32 hkey;
+
+ mutex_lock(&esw->fdb_table.offloads.vports.lock);
++ esw_vport_tbl_init(esw, attr->vport_ns);
+ hkey = flow_attr_to_vport_key(esw, attr, &skey);
+ e = esw_vport_tbl_lookup(esw, &skey, hkey);
+ if (e) {
+@@ -127,6 +136,7 @@ mlx5_esw_vporttbl_put(struct mlx5_eswitch *esw, struct mlx5_vport_tbl_attr *attr
+ u32 hkey;
+
+ mutex_lock(&esw->fdb_table.offloads.vports.lock);
++ esw_vport_tbl_init(esw, attr->vport_ns);
+ hkey = flow_attr_to_vport_key(esw, attr, &key);
+ e = esw_vport_tbl_lookup(esw, &key, hkey);
+ if (!e || --e->num_rules)
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h
+index 19e9a77c46336..9d5a5756a15a9 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h
++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h
+@@ -674,7 +674,7 @@ struct mlx5_vport_tbl_attr {
+ u32 chain;
+ u16 prio;
+ u16 vport;
+- const struct esw_vport_tbl_namespace *vport_ns;
++ struct esw_vport_tbl_namespace *vport_ns;
+ };
+
+ struct mlx5_flow_table *
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
+index 25a8076a77bff..706746cd10af5 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
+@@ -73,7 +73,7 @@
+
+ #define MLX5_ESW_FT_OFFLOADS_DROP_RULE (1)
+
+-static const struct esw_vport_tbl_namespace mlx5_esw_vport_tbl_mirror_ns = {
++static struct esw_vport_tbl_namespace mlx5_esw_vport_tbl_mirror_ns = {
+ .max_fte = MLX5_ESW_VPORT_TBL_SIZE,
+ .max_num_groups = MLX5_ESW_VPORT_TBL_NUM_GROUPS,
+ .flags = 0,
+--
+2.39.2
+
--- /dev/null
+From 0947dc6765dfc5f9050d6a4e5c1a756257466628 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Mar 2023 09:56:08 +0200
+Subject: net/mlx5: E-switch, Don't destroy indirect table in split rule
+
+From: Chris Mi <cmi@nvidia.com>
+
+[ Upstream commit 4c8189302567f75099a336b0efcff8291ec86ff4 ]
+
+Source port rewrite (forward to ovs internal port or statck device) isn't
+supported in the rule of split action. So there is no indirect table in
+split rule. The cited commit destroyes indirect table in split rule. The
+indirect table for other rules will be destroyed wrongly. It will cause
+traffic loss.
+
+Fix it by removing the destroy function in split rule. And also remove
+the destroy function in error flow.
+
+Fixes: 10742efc20a4 ("net/mlx5e: VF tunnel TX traffic offloading")
+Signed-off-by: Chris Mi <cmi@nvidia.com>
+Reviewed-by: Roi Dayan <roid@nvidia.com>
+Reviewed-by: Maor Dickman <maord@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
+index 706746cd10af5..c99d208722f58 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
+@@ -760,7 +760,6 @@ mlx5_eswitch_add_fwd_rule(struct mlx5_eswitch *esw,
+ kfree(dest);
+ return rule;
+ err_chain_src_rewrite:
+- esw_put_dest_tables_loop(esw, attr, 0, i);
+ mlx5_esw_vporttbl_put(esw, &fwd_attr);
+ err_get_fwd:
+ mlx5_chains_put_table(chains, attr->chain, attr->prio, 0);
+@@ -803,7 +802,6 @@ __mlx5_eswitch_del_rule(struct mlx5_eswitch *esw,
+ if (fwd_rule) {
+ mlx5_esw_vporttbl_put(esw, &fwd_attr);
+ mlx5_chains_put_table(chains, attr->chain, attr->prio, 0);
+- esw_put_dest_tables_loop(esw, attr, 0, esw_attr->split_count);
+ } else {
+ if (split)
+ mlx5_esw_vporttbl_put(esw, &fwd_attr);
+--
+2.39.2
+
--- /dev/null
+From 12c356479c35610c8e5dbbc850ca4325babcfabb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Apr 2023 03:45:04 +0300
+Subject: net/mlx5: Release tunnel device after tc update skb
+
+From: Chris Mi <cmi@nvidia.com>
+
+[ Upstream commit 4fbef0f8ea6350eaea89b1e3175f9325252913ac ]
+
+The cited commit causes a regression. Tunnel device is not released
+after tc update skb if skb needs to be freed. The following error
+message will be printed:
+
+ unregister_netdevice: waiting for vxlan1 to become free. Usage count = 11
+
+Fix it by releasing tunnel device if skb needs to be freed.
+
+Fixes: 93a1ab2c545b ("net/mlx5: Refactor tc miss handling to a single function")
+Signed-off-by: Chris Mi <cmi@nvidia.com>
+Reviewed-by: Maor Dickman <maord@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en/rep/tc.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/rep/tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en/rep/tc.c
+index 8f7452dc00ee3..668fdee9cf057 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en/rep/tc.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/rep/tc.c
+@@ -715,5 +715,6 @@ void mlx5e_rep_tc_receive(struct mlx5_cqe64 *cqe, struct mlx5e_rq *rq,
+ return;
+
+ free_skb:
++ dev_put(tc_priv.fwd_dev);
+ dev_kfree_skb_any(skb);
+ }
+--
+2.39.2
+
--- /dev/null
+From 2ced8cb6a74a0612504436fea5cf472770580c74 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 2 Apr 2023 06:49:53 +0300
+Subject: net/mlx5: Use recovery timeout on sync reset flow
+
+From: Moshe Shemesh <moshe@nvidia.com>
+
+[ Upstream commit dfad99750c0f83b0242572a573afa2c055f85b36 ]
+
+Use the same timeout for sync reset flow and health recovery flow, since
+the former involves driver's recovery from firmware reset, which is
+similar to health recovery. Otherwise, in some cases, such as a firmware
+upgrade on the DPU, the firmware pre-init bit may not be ready within
+current timeout and the driver will abort loading back after reset.
+
+Signed-off-by: Moshe Shemesh <moshe@nvidia.com>
+Fixes: 37ca95e62ee2 ("net/mlx5: Increase FW pre-init timeout for health recovery")
+Reviewed-by: Maher Sanalla <msanalla@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/devlink.c | 2 +-
+ drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c | 4 ++--
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/devlink.c b/drivers/net/ethernet/mellanox/mlx5/core/devlink.c
+index c5d2fdcabd566..e5f03d071a37a 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/devlink.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/devlink.c
+@@ -202,7 +202,7 @@ static int mlx5_devlink_reload_up(struct devlink *devlink, enum devlink_reload_a
+ break;
+ /* On fw_activate action, also driver is reloaded and reinit performed */
+ *actions_performed |= BIT(DEVLINK_RELOAD_ACTION_DRIVER_REINIT);
+- ret = mlx5_load_one_devl_locked(dev, false);
++ ret = mlx5_load_one_devl_locked(dev, true);
+ break;
+ default:
+ /* Unsupported action should not get to this function */
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c
+index 289e915def989..50022e7565f14 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c
+@@ -167,7 +167,7 @@ static void mlx5_fw_reset_complete_reload(struct mlx5_core_dev *dev)
+ if (mlx5_health_wait_pci_up(dev))
+ mlx5_core_err(dev, "reset reload flow aborted, PCI reads still not working\n");
+ else
+- mlx5_load_one(dev, false);
++ mlx5_load_one(dev, true);
+ devlink_remote_reload_actions_performed(priv_to_devlink(dev), 0,
+ BIT(DEVLINK_RELOAD_ACTION_DRIVER_REINIT) |
+ BIT(DEVLINK_RELOAD_ACTION_FW_ACTIVATE));
+@@ -499,7 +499,7 @@ int mlx5_fw_reset_wait_reset_done(struct mlx5_core_dev *dev)
+ err = fw_reset->ret;
+ if (test_and_clear_bit(MLX5_FW_RESET_FLAGS_RELOAD_REQUIRED, &fw_reset->reset_flags)) {
+ mlx5_unload_one_devl_locked(dev, false);
+- mlx5_load_one_devl_locked(dev, false);
++ mlx5_load_one_devl_locked(dev, true);
+ }
+ out:
+ clear_bit(MLX5_FW_RESET_FLAGS_PENDING_COMP, &fw_reset->reset_flags);
+--
+2.39.2
+
--- /dev/null
+From d6ad677d415353ab05e74ee77bacc33983c88666 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Mar 2023 09:52:26 +0100
+Subject: net/mlx5e: Don't clone flow post action attributes second time
+
+From: Vlad Buslov <vladbu@nvidia.com>
+
+[ Upstream commit e9fce818fe003b6c527f25517b9ac08eb4661b5d ]
+
+The code already clones post action attributes in
+mlx5e_clone_flow_attr_for_post_act(). Creating another copy in
+mlx5e_tc_post_act_add() is a erroneous leftover from original
+implementation. Instead, assign handle->attribute to post_attr provided by
+the caller. Note that cloning the attribute second time is not just
+wasteful but also causes issues like second copy not being properly updated
+in neigh update code which leads to following use-after-free:
+
+Feb 21 09:02:00 c-237-177-40-045 kernel: BUG: KASAN: use-after-free in mlx5_cmd_set_fte+0x200d/0x24c0 [mlx5_core]
+Feb 21 09:02:00 c-237-177-40-045 kernel: kasan_report+0xbb/0x1a0
+Feb 21 09:02:00 c-237-177-40-045 kernel: kasan_save_stack+0x1e/0x40
+Feb 21 09:02:00 c-237-177-40-045 kernel: kasan_set_track+0x21/0x30
+Feb 21 09:02:00 c-237-177-40-045 kernel: __kasan_kmalloc+0x7a/0x90
+Feb 21 09:02:00 c-237-177-40-045 kernel: kasan_save_stack+0x1e/0x40
+Feb 21 09:02:00 c-237-177-40-045 kernel: kasan_set_track+0x21/0x30
+Feb 21 09:02:00 c-237-177-40-045 kernel: kasan_save_free_info+0x2a/0x40
+Feb 21 09:02:00 c-237-177-40-045 kernel: ____kasan_slab_free+0x11a/0x1b0
+Feb 21 09:02:00 c-237-177-40-045 kernel: page dumped because: kasan: bad access detected
+Feb 21 09:02:00 c-237-177-40-045 kernel: mlx5_core 0000:08:00.0: mlx5_cmd_out_err:803:(pid 8833): SET_FLOW_TABLE_ENTRY(0x936) op_mod(0x0) failed, status bad resource state(0x9), syndrome (0xf2ff71), err(-22)
+Feb 21 09:02:00 c-237-177-40-045 kernel: mlx5_core 0000:08:00.0 enp8s0f0: Failed to add post action rule
+Feb 21 09:02:00 c-237-177-40-045 kernel: mlx5_core 0000:08:00.0: mlx5e_tc_encap_flows_add:190:(pid 8833): Failed to update flow post acts, -22
+Feb 21 09:02:00 c-237-177-40-045 kernel: Call Trace:
+Feb 21 09:02:00 c-237-177-40-045 kernel: <TASK>
+Feb 21 09:02:00 c-237-177-40-045 kernel: dump_stack_lvl+0x57/0x7d
+Feb 21 09:02:00 c-237-177-40-045 kernel: print_report+0x170/0x471
+Feb 21 09:02:00 c-237-177-40-045 kernel: ? mlx5_cmd_set_fte+0x200d/0x24c0 [mlx5_core]
+Feb 21 09:02:00 c-237-177-40-045 kernel: kasan_report+0xbb/0x1a0
+Feb 21 09:02:00 c-237-177-40-045 kernel: ? mlx5_cmd_set_fte+0x200d/0x24c0 [mlx5_core]
+Feb 21 09:02:00 c-237-177-40-045 kernel: mlx5_cmd_set_fte+0x200d/0x24c0 [mlx5_core]
+Feb 21 09:02:00 c-237-177-40-045 kernel: ? __module_address.part.0+0x62/0x200
+Feb 21 09:02:00 c-237-177-40-045 kernel: ? mlx5_cmd_stub_create_flow_table+0xd0/0xd0 [mlx5_core]
+Feb 21 09:02:00 c-237-177-40-045 kernel: ? __raw_spin_lock_init+0x3b/0x110
+Feb 21 09:02:00 c-237-177-40-045 kernel: mlx5_cmd_create_fte+0x80/0xb0 [mlx5_core]
+Feb 21 09:02:00 c-237-177-40-045 kernel: add_rule_fg+0xe80/0x19c0 [mlx5_core]
+--
+Feb 21 09:02:00 c-237-177-40-045 kernel: Allocated by task 13476:
+Feb 21 09:02:00 c-237-177-40-045 kernel: kasan_save_stack+0x1e/0x40
+Feb 21 09:02:00 c-237-177-40-045 kernel: kasan_set_track+0x21/0x30
+Feb 21 09:02:00 c-237-177-40-045 kernel: __kasan_kmalloc+0x7a/0x90
+Feb 21 09:02:00 c-237-177-40-045 kernel: mlx5_packet_reformat_alloc+0x7b/0x230 [mlx5_core]
+Feb 21 09:02:00 c-237-177-40-045 kernel: mlx5e_tc_tun_create_header_ipv4+0x977/0xf10 [mlx5_core]
+Feb 21 09:02:00 c-237-177-40-045 kernel: mlx5e_attach_encap+0x15b4/0x1e10 [mlx5_core]
+Feb 21 09:02:00 c-237-177-40-045 kernel: post_process_attr+0x305/0xa30 [mlx5_core]
+Feb 21 09:02:00 c-237-177-40-045 kernel: mlx5e_tc_add_fdb_flow+0x4c0/0xcf0 [mlx5_core]
+Feb 21 09:02:00 c-237-177-40-045 kernel: __mlx5e_add_fdb_flow+0x7cf/0xe90 [mlx5_core]
+Feb 21 09:02:00 c-237-177-40-045 kernel: mlx5e_configure_flower+0xcaa/0x4b90 [mlx5_core]
+Feb 21 09:02:00 c-237-177-40-045 kernel: mlx5e_rep_setup_tc_cls_flower+0x99/0x1b0 [mlx5_core]
+Feb 21 09:02:00 c-237-177-40-045 kernel: mlx5e_rep_setup_tc_cb+0x133/0x1e0 [mlx5_core]
+--
+Feb 21 09:02:00 c-237-177-40-045 kernel: Freed by task 8833:
+Feb 21 09:02:00 c-237-177-40-045 kernel: kasan_save_stack+0x1e/0x40
+Feb 21 09:02:00 c-237-177-40-045 kernel: kasan_set_track+0x21/0x30
+Feb 21 09:02:00 c-237-177-40-045 kernel: kasan_save_free_info+0x2a/0x40
+Feb 21 09:02:00 c-237-177-40-045 kernel: ____kasan_slab_free+0x11a/0x1b0
+Feb 21 09:02:00 c-237-177-40-045 kernel: __kmem_cache_free+0x1de/0x400
+Feb 21 09:02:00 c-237-177-40-045 kernel: mlx5_packet_reformat_dealloc+0xad/0x100 [mlx5_core]
+Feb 21 09:02:00 c-237-177-40-045 kernel: mlx5e_tc_encap_flows_del+0x3c0/0x500 [mlx5_core]
+Feb 21 09:02:00 c-237-177-40-045 kernel: mlx5e_rep_update_flows+0x40c/0xa80 [mlx5_core]
+Feb 21 09:02:00 c-237-177-40-045 kernel: mlx5e_rep_neigh_update+0x473/0x7a0 [mlx5_core]
+Feb 21 09:02:00 c-237-177-40-045 kernel: process_one_work+0x7c2/0x1310
+Feb 21 09:02:00 c-237-177-40-045 kernel: worker_thread+0x59d/0xec0
+Feb 21 09:02:00 c-237-177-40-045 kernel: kthread+0x28f/0x330
+
+Fixes: 8300f225268b ("net/mlx5e: Create new flow attr for multi table actions")
+Signed-off-by: Vlad Buslov <vladbu@nvidia.com>
+Reviewed-by: Roi Dayan <roid@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/mellanox/mlx5/core/en/tc/post_act.c | 11 ++---------
+ .../net/ethernet/mellanox/mlx5/core/en/tc/post_act.h | 2 +-
+ 2 files changed, 3 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc/post_act.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tc/post_act.c
+index 4e48946c4c2ac..0290e0dea5390 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc/post_act.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc/post_act.c
+@@ -106,22 +106,17 @@ mlx5e_tc_post_act_offload(struct mlx5e_post_act *post_act,
+ }
+
+ struct mlx5e_post_act_handle *
+-mlx5e_tc_post_act_add(struct mlx5e_post_act *post_act, struct mlx5_flow_attr *attr)
++mlx5e_tc_post_act_add(struct mlx5e_post_act *post_act, struct mlx5_flow_attr *post_attr)
+ {
+- u32 attr_sz = ns_to_attr_sz(post_act->ns_type);
+ struct mlx5e_post_act_handle *handle;
+- struct mlx5_flow_attr *post_attr;
+ int err;
+
+ handle = kzalloc(sizeof(*handle), GFP_KERNEL);
+- post_attr = mlx5_alloc_flow_attr(post_act->ns_type);
+- if (!handle || !post_attr) {
+- kfree(post_attr);
++ if (!handle) {
+ kfree(handle);
+ return ERR_PTR(-ENOMEM);
+ }
+
+- memcpy(post_attr, attr, attr_sz);
+ post_attr->chain = 0;
+ post_attr->prio = 0;
+ post_attr->ft = post_act->ft;
+@@ -145,7 +140,6 @@ mlx5e_tc_post_act_add(struct mlx5e_post_act *post_act, struct mlx5_flow_attr *at
+ return handle;
+
+ err_xarray:
+- kfree(post_attr);
+ kfree(handle);
+ return ERR_PTR(err);
+ }
+@@ -164,7 +158,6 @@ mlx5e_tc_post_act_del(struct mlx5e_post_act *post_act, struct mlx5e_post_act_han
+ if (!IS_ERR_OR_NULL(handle->rule))
+ mlx5e_tc_post_act_unoffload(post_act, handle);
+ xa_erase(&post_act->ids, handle->id);
+- kfree(handle->attr);
+ kfree(handle);
+ }
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc/post_act.h b/drivers/net/ethernet/mellanox/mlx5/core/en/tc/post_act.h
+index f476774c0b75d..40b8df184af51 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc/post_act.h
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc/post_act.h
+@@ -19,7 +19,7 @@ void
+ mlx5e_tc_post_act_destroy(struct mlx5e_post_act *post_act);
+
+ struct mlx5e_post_act_handle *
+-mlx5e_tc_post_act_add(struct mlx5e_post_act *post_act, struct mlx5_flow_attr *attr);
++mlx5e_tc_post_act_add(struct mlx5e_post_act *post_act, struct mlx5_flow_attr *post_attr);
+
+ void
+ mlx5e_tc_post_act_del(struct mlx5e_post_act *post_act, struct mlx5e_post_act_handle *handle);
+--
+2.39.2
+
--- /dev/null
+From 2761476209b1d7a2a6595e508b39273b124d1a72 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Mar 2023 15:24:32 +0300
+Subject: net/mlx5e: Fix error flow in representor failing to add vport rx rule
+
+From: Roi Dayan <roid@nvidia.com>
+
+[ Upstream commit 0a6b069cc60d68d33b4f6e7dd7f1adc3ec749766 ]
+
+On representor init rx error flow the flow steering pointer is being
+released so mlx5e_attach_netdev() doesn't have a valid fs pointer
+in its error flow. Make sure the pointer is nullified when released
+and add a check in mlx5e_fs_cleanup() to verify fs is not null
+as representor cleanup callback would be called anyway.
+
+Fixes: af8bbf730068 ("net/mlx5e: Convert mlx5e_flow_steering member of mlx5e_priv to pointer")
+Signed-off-by: Roi Dayan <roid@nvidia.com>
+Reviewed-by: Maor Dickman <maord@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en_fs.c | 2 ++
+ drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 1 +
+ drivers/net/ethernet/mellanox/mlx5/core/en_rep.c | 2 ++
+ 3 files changed, 5 insertions(+)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c
+index 05796f8b1d7cf..f1dac0244958c 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c
+@@ -1490,6 +1490,8 @@ struct mlx5e_flow_steering *mlx5e_fs_init(const struct mlx5e_profile *profile,
+
+ void mlx5e_fs_cleanup(struct mlx5e_flow_steering *fs)
+ {
++ if (!fs)
++ return;
+ debugfs_remove_recursive(fs->dfs_root);
+ mlx5e_fs_ethtool_free(fs);
+ mlx5e_fs_tc_free(fs);
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+index 7ca7e9b57607f..579c2d217fdc6 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+@@ -5270,6 +5270,7 @@ static void mlx5e_nic_cleanup(struct mlx5e_priv *priv)
+ mlx5e_health_destroy_reporters(priv);
+ mlx5e_ktls_cleanup(priv);
+ mlx5e_fs_cleanup(priv->fs);
++ priv->fs = NULL;
+ }
+
+ static int mlx5e_init_nic_rx(struct mlx5e_priv *priv)
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
+index 8ff654b4e9e14..6e18d91c3d766 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
+@@ -828,6 +828,7 @@ static int mlx5e_init_ul_rep(struct mlx5_core_dev *mdev,
+ static void mlx5e_cleanup_rep(struct mlx5e_priv *priv)
+ {
+ mlx5e_fs_cleanup(priv->fs);
++ priv->fs = NULL;
+ }
+
+ static int mlx5e_create_rep_ttc_table(struct mlx5e_priv *priv)
+@@ -994,6 +995,7 @@ static int mlx5e_init_rep_rx(struct mlx5e_priv *priv)
+ priv->rx_res = NULL;
+ err_free_fs:
+ mlx5e_fs_cleanup(priv->fs);
++ priv->fs = NULL;
+ return err;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 9ac0bdc068247bf099ddc1a987301fe30d50df48 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 12 Mar 2023 16:37:36 +0200
+Subject: net/mlx5e: Nullify table pointer when failing to create
+
+From: Aya Levin <ayal@nvidia.com>
+
+[ Upstream commit 1b540decd03acd736693aabb6cb46c71fca38ae6 ]
+
+On failing to create promisc flow steering table, the pointer is
+returned with an error. Nullify it so unloading the driver won't try to
+destroy a non existing table.
+
+Failing to create promisc table may happen over BF devices when the ARM
+side is going through a firmware tear down. The host side start a
+reload flow. While the driver unloads, it tries to remove the promisc
+table. Remove WARN in this state as it is a valid error flow.
+
+Fixes: 1c46d7409f30 ("net/mlx5e: Optimize promiscuous mode")
+Signed-off-by: Aya Levin <ayal@nvidia.com>
+Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en_fs.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c
+index f1dac0244958c..33bfe4d7338be 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c
+@@ -783,6 +783,7 @@ static int mlx5e_create_promisc_table(struct mlx5e_flow_steering *fs)
+ ft->t = mlx5_create_auto_grouped_flow_table(fs->ns, &ft_attr);
+ if (IS_ERR(ft->t)) {
+ err = PTR_ERR(ft->t);
++ ft->t = NULL;
+ fs_err(fs, "fail to create promisc table err=%d\n", err);
+ return err;
+ }
+@@ -810,7 +811,7 @@ static void mlx5e_del_promisc_rule(struct mlx5e_flow_steering *fs)
+
+ static void mlx5e_destroy_promisc_table(struct mlx5e_flow_steering *fs)
+ {
+- if (WARN(!fs->promisc.ft.t, "Trying to remove non-existing promiscuous table"))
++ if (!fs->promisc.ft.t)
+ return;
+ mlx5e_del_promisc_rule(fs);
+ mlx5_destroy_flow_table(fs->promisc.ft.t);
+--
+2.39.2
+
--- /dev/null
+From 592390fe9c4d99f150ee18f1f6f250b2274366fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Mar 2023 17:52:17 +0100
+Subject: net/mlx5e: Release the label when replacing existing ct entry
+
+From: Vlad Buslov <vladbu@nvidia.com>
+
+[ Upstream commit 8ac04a28144cfa89b61be518268233742c23d88d ]
+
+Cited commit doesn't release the label mapping when replacing existing ct
+entry which leads to following memleak report:
+
+unreferenced object 0xffff8881854cf280 (size 96):
+ comm "kworker/u48:74", pid 23093, jiffies 4296664564 (age 175.944s)
+ hex dump (first 32 bytes):
+ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
+ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
+ backtrace:
+ [<000000002722d368>] __kmalloc+0x4b/0x1c0
+ [<00000000cc44e18f>] mapping_add+0x6e8/0xc90 [mlx5_core]
+ [<000000003ad942a7>] mlx5_get_label_mapping+0x66/0xe0 [mlx5_core]
+ [<00000000266308ac>] mlx5_tc_ct_entry_create_mod_hdr+0x1c4/0xf50 [mlx5_core]
+ [<000000009a768b4f>] mlx5_tc_ct_entry_add_rule+0x16f/0xaf0 [mlx5_core]
+ [<00000000a178f3e5>] mlx5_tc_ct_block_flow_offload_add+0x10cb/0x1f90 [mlx5_core]
+ [<000000007b46c496>] mlx5_tc_ct_block_flow_offload+0x14a/0x630 [mlx5_core]
+ [<00000000a9a18ac5>] nf_flow_offload_tuple+0x1a3/0x390 [nf_flow_table]
+ [<00000000d0881951>] flow_offload_work_handler+0x257/0xd30 [nf_flow_table]
+ [<000000009e4935a4>] process_one_work+0x7c2/0x13e0
+ [<00000000f5cd36a7>] worker_thread+0x59d/0xec0
+ [<00000000baed1daf>] kthread+0x28f/0x330
+ [<0000000063d282a4>] ret_from_fork+0x1f/0x30
+
+Fix the issue by correctly releasing the label mapping.
+
+Fixes: 94ceffb48eac ("net/mlx5e: Implement CT entry update")
+Signed-off-by: Vlad Buslov <vladbu@nvidia.com>
+Reviewed-by: Roi Dayan <roid@nvidia.com>
+Reviewed-by: Paul Blakey <paulb@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c
+index 314983bc6f085..ee49bd2461e46 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c
+@@ -920,6 +920,7 @@ mlx5_tc_ct_entry_replace_rule(struct mlx5_tc_ct_priv *ct_priv,
+ zone_rule->rule = rule;
+ mlx5_tc_ct_entry_destroy_mod_hdr(ct_priv, old_attr, zone_rule->mh);
+ zone_rule->mh = mh;
++ mlx5_put_label_mapping(ct_priv, old_attr->ct_attr.ct_labels_id);
+
+ kfree(old_attr);
+ kvfree(spec);
+--
+2.39.2
+
--- /dev/null
+From 514d8e180104a312a24a38bea769f831d68f8538 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Mar 2023 01:10:06 +0000
+Subject: net/packet: annotate accesses to po->xmit
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit b9d83ab8a708f23a4001d60e9d8d0b3be3d9f607 ]
+
+po->xmit can be set from setsockopt(PACKET_QDISC_BYPASS),
+while read locklessly.
+
+Use READ_ONCE()/WRITE_ONCE() to avoid potential load/store
+tearing issues.
+
+Fixes: d346a3fae3ff ("packet: introduce PACKET_QDISC_BYPASS socket option")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/packet/af_packet.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index d4e76e2ae153e..d25dd9f63cc4f 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -307,7 +307,8 @@ static void packet_cached_dev_reset(struct packet_sock *po)
+
+ static bool packet_use_direct_xmit(const struct packet_sock *po)
+ {
+- return po->xmit == packet_direct_xmit;
++ /* Paired with WRITE_ONCE() in packet_setsockopt() */
++ return READ_ONCE(po->xmit) == packet_direct_xmit;
+ }
+
+ static u16 packet_pick_tx_queue(struct sk_buff *skb)
+@@ -2867,7 +2868,8 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
+ packet_inc_pending(&po->tx_ring);
+
+ status = TP_STATUS_SEND_REQUEST;
+- err = po->xmit(skb);
++ /* Paired with WRITE_ONCE() in packet_setsockopt() */
++ err = READ_ONCE(po->xmit)(skb);
+ if (unlikely(err != 0)) {
+ if (err > 0)
+ err = net_xmit_errno(err);
+@@ -3070,7 +3072,8 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
+ virtio_net_hdr_set_proto(skb, &vnet_hdr);
+ }
+
+- err = po->xmit(skb);
++ /* Paired with WRITE_ONCE() in packet_setsockopt() */
++ err = READ_ONCE(po->xmit)(skb);
+ if (unlikely(err != 0)) {
+ if (err > 0)
+ err = net_xmit_errno(err);
+@@ -4007,7 +4010,8 @@ packet_setsockopt(struct socket *sock, int level, int optname, sockptr_t optval,
+ if (copy_from_sockptr(&val, optval, sizeof(val)))
+ return -EFAULT;
+
+- po->xmit = val ? packet_direct_xmit : dev_queue_xmit;
++ /* Paired with all lockless reads of po->xmit */
++ WRITE_ONCE(po->xmit, val ? packet_direct_xmit : dev_queue_xmit);
+ return 0;
+ }
+ default:
+--
+2.39.2
+
--- /dev/null
+From 4819f43284a34bab45ace7581e583538a9ba3447 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Mar 2023 01:10:08 +0000
+Subject: net/packet: convert po->auxdata to an atomic flag
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit fd53c297aa7b077ae98a3d3d2d3aa278a1686ba6 ]
+
+po->auxdata can be read while another thread
+is changing its value, potentially raising KCSAN splat.
+
+Convert it to PACKET_SOCK_AUXDATA flag.
+
+Fixes: 8dc419447415 ("[PACKET]: Add optional checksum computation for recvmsg")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/packet/af_packet.c | 8 +++-----
+ net/packet/diag.c | 2 +-
+ net/packet/internal.h | 4 ++--
+ 3 files changed, 6 insertions(+), 8 deletions(-)
+
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index af7c44169b869..ecd9fc27e360c 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -3514,7 +3514,7 @@ static int packet_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
+ memcpy(msg->msg_name, &PACKET_SKB_CB(skb)->sa, copy_len);
+ }
+
+- if (pkt_sk(sk)->auxdata) {
++ if (packet_sock_flag(pkt_sk(sk), PACKET_SOCK_AUXDATA)) {
+ struct tpacket_auxdata aux;
+
+ aux.tp_status = TP_STATUS_USER;
+@@ -3900,9 +3900,7 @@ packet_setsockopt(struct socket *sock, int level, int optname, sockptr_t optval,
+ if (copy_from_sockptr(&val, optval, sizeof(val)))
+ return -EFAULT;
+
+- lock_sock(sk);
+- po->auxdata = !!val;
+- release_sock(sk);
++ packet_sock_flag_set(po, PACKET_SOCK_AUXDATA, val);
+ return 0;
+ }
+ case PACKET_ORIGDEV:
+@@ -4060,7 +4058,7 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
+
+ break;
+ case PACKET_AUXDATA:
+- val = po->auxdata;
++ val = packet_sock_flag(po, PACKET_SOCK_AUXDATA);
+ break;
+ case PACKET_ORIGDEV:
+ val = packet_sock_flag(po, PACKET_SOCK_ORIGDEV);
+diff --git a/net/packet/diag.c b/net/packet/diag.c
+index e1ac9bb375b31..d704c7bf51b20 100644
+--- a/net/packet/diag.c
++++ b/net/packet/diag.c
+@@ -23,7 +23,7 @@ static int pdiag_put_info(const struct packet_sock *po, struct sk_buff *nlskb)
+ pinfo.pdi_flags = 0;
+ if (po->running)
+ pinfo.pdi_flags |= PDI_RUNNING;
+- if (po->auxdata)
++ if (packet_sock_flag(po, PACKET_SOCK_AUXDATA))
+ pinfo.pdi_flags |= PDI_AUXDATA;
+ if (packet_sock_flag(po, PACKET_SOCK_ORIGDEV))
+ pinfo.pdi_flags |= PDI_ORIGDEV;
+diff --git a/net/packet/internal.h b/net/packet/internal.h
+index 178cd1852238d..3bae8ea7a36f5 100644
+--- a/net/packet/internal.h
++++ b/net/packet/internal.h
+@@ -118,8 +118,7 @@ struct packet_sock {
+ struct mutex pg_vec_lock;
+ unsigned long flags;
+ unsigned int running; /* bind_lock must be held */
+- unsigned int auxdata:1, /* writer must hold sock lock */
+- has_vnet_hdr:1,
++ unsigned int has_vnet_hdr:1, /* writer must hold sock lock */
+ tp_loss:1,
+ tp_tx_has_off:1;
+ int pressure;
+@@ -146,6 +145,7 @@ static inline struct packet_sock *pkt_sk(struct sock *sk)
+
+ enum packet_sock_flags {
+ PACKET_SOCK_ORIGDEV,
++ PACKET_SOCK_AUXDATA,
+ };
+
+ static inline void packet_sock_flag_set(struct packet_sock *po,
+--
+2.39.2
+
--- /dev/null
+From cbc4050e8aca0c9561134733be510bcd9fd40eef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Mar 2023 01:10:07 +0000
+Subject: net/packet: convert po->origdev to an atomic flag
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit ee5675ecdf7a4e713ed21d98a70c2871d6ebed01 ]
+
+syzbot/KCAN reported that po->origdev can be read
+while another thread is changing its value.
+
+We can avoid this splat by converting this field
+to an actual bit.
+
+Following patches will convert remaining 1bit fields.
+
+Fixes: 80feaacb8a64 ("[AF_PACKET]: Add option to return orig_dev to userspace.")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reported-by: syzbot <syzkaller@googlegroups.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/packet/af_packet.c | 10 ++++------
+ net/packet/diag.c | 2 +-
+ net/packet/internal.h | 22 +++++++++++++++++++++-
+ 3 files changed, 26 insertions(+), 8 deletions(-)
+
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index d25dd9f63cc4f..af7c44169b869 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -2184,7 +2184,7 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev,
+ sll = &PACKET_SKB_CB(skb)->sa.ll;
+ sll->sll_hatype = dev->type;
+ sll->sll_pkttype = skb->pkt_type;
+- if (unlikely(po->origdev))
++ if (unlikely(packet_sock_flag(po, PACKET_SOCK_ORIGDEV)))
+ sll->sll_ifindex = orig_dev->ifindex;
+ else
+ sll->sll_ifindex = dev->ifindex;
+@@ -2461,7 +2461,7 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev,
+ sll->sll_hatype = dev->type;
+ sll->sll_protocol = skb->protocol;
+ sll->sll_pkttype = skb->pkt_type;
+- if (unlikely(po->origdev))
++ if (unlikely(packet_sock_flag(po, PACKET_SOCK_ORIGDEV)))
+ sll->sll_ifindex = orig_dev->ifindex;
+ else
+ sll->sll_ifindex = dev->ifindex;
+@@ -3914,9 +3914,7 @@ packet_setsockopt(struct socket *sock, int level, int optname, sockptr_t optval,
+ if (copy_from_sockptr(&val, optval, sizeof(val)))
+ return -EFAULT;
+
+- lock_sock(sk);
+- po->origdev = !!val;
+- release_sock(sk);
++ packet_sock_flag_set(po, PACKET_SOCK_ORIGDEV, val);
+ return 0;
+ }
+ case PACKET_VNET_HDR:
+@@ -4065,7 +4063,7 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
+ val = po->auxdata;
+ break;
+ case PACKET_ORIGDEV:
+- val = po->origdev;
++ val = packet_sock_flag(po, PACKET_SOCK_ORIGDEV);
+ break;
+ case PACKET_VNET_HDR:
+ val = po->has_vnet_hdr;
+diff --git a/net/packet/diag.c b/net/packet/diag.c
+index 07812ae5ca073..e1ac9bb375b31 100644
+--- a/net/packet/diag.c
++++ b/net/packet/diag.c
+@@ -25,7 +25,7 @@ static int pdiag_put_info(const struct packet_sock *po, struct sk_buff *nlskb)
+ pinfo.pdi_flags |= PDI_RUNNING;
+ if (po->auxdata)
+ pinfo.pdi_flags |= PDI_AUXDATA;
+- if (po->origdev)
++ if (packet_sock_flag(po, PACKET_SOCK_ORIGDEV))
+ pinfo.pdi_flags |= PDI_ORIGDEV;
+ if (po->has_vnet_hdr)
+ pinfo.pdi_flags |= PDI_VNETHDR;
+diff --git a/net/packet/internal.h b/net/packet/internal.h
+index 48af35b1aed25..178cd1852238d 100644
+--- a/net/packet/internal.h
++++ b/net/packet/internal.h
+@@ -116,9 +116,9 @@ struct packet_sock {
+ int copy_thresh;
+ spinlock_t bind_lock;
+ struct mutex pg_vec_lock;
++ unsigned long flags;
+ unsigned int running; /* bind_lock must be held */
+ unsigned int auxdata:1, /* writer must hold sock lock */
+- origdev:1,
+ has_vnet_hdr:1,
+ tp_loss:1,
+ tp_tx_has_off:1;
+@@ -144,4 +144,24 @@ static inline struct packet_sock *pkt_sk(struct sock *sk)
+ return (struct packet_sock *)sk;
+ }
+
++enum packet_sock_flags {
++ PACKET_SOCK_ORIGDEV,
++};
++
++static inline void packet_sock_flag_set(struct packet_sock *po,
++ enum packet_sock_flags flag,
++ bool val)
++{
++ if (val)
++ set_bit(flag, &po->flags);
++ else
++ clear_bit(flag, &po->flags);
++}
++
++static inline bool packet_sock_flag(const struct packet_sock *po,
++ enum packet_sock_flags flag)
++{
++ return test_bit(flag, &po->flags);
++}
++
+ #endif
+--
+2.39.2
+
--- /dev/null
+From 4845b5307b2ea14ef6cb9c7acef6cae7ff0048fd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Mar 2023 14:46:43 +0000
+Subject: net: pcs: xpcs: remove double-read of link state when using AN
+
+From: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+
+[ Upstream commit ef63461caf427a77a04620d74ba90035a712af9c ]
+
+Phylink does not want the current state of the link when reading the
+PCS link state - it wants the latched state. Don't double-read the
+MII status register. Phylink will re-read as necessary to capture
+transient link-down events as of dbae3388ea9c ("net: phylink: Force
+retrigger in case of latched link-fail indicator").
+
+The above referenced commit is a dependency for this change, and thus
+this change should not be backported to any kernel that does not
+contain the above referenced commit.
+
+Fixes: fcb26bd2b6ca ("net: phy: Add Synopsys DesignWare XPCS MDIO module")
+Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/pcs/pcs-xpcs.c | 13 ++-----------
+ 1 file changed, 2 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/net/pcs/pcs-xpcs.c b/drivers/net/pcs/pcs-xpcs.c
+index bc428a816719d..04a6853530418 100644
+--- a/drivers/net/pcs/pcs-xpcs.c
++++ b/drivers/net/pcs/pcs-xpcs.c
+@@ -321,7 +321,7 @@ static int xpcs_read_fault_c73(struct dw_xpcs *xpcs,
+ return 0;
+ }
+
+-static int xpcs_read_link_c73(struct dw_xpcs *xpcs, bool an)
++static int xpcs_read_link_c73(struct dw_xpcs *xpcs)
+ {
+ bool link = true;
+ int ret;
+@@ -333,15 +333,6 @@ static int xpcs_read_link_c73(struct dw_xpcs *xpcs, bool an)
+ if (!(ret & MDIO_STAT1_LSTATUS))
+ link = false;
+
+- if (an) {
+- ret = xpcs_read(xpcs, MDIO_MMD_AN, MDIO_STAT1);
+- if (ret < 0)
+- return ret;
+-
+- if (!(ret & MDIO_STAT1_LSTATUS))
+- link = false;
+- }
+-
+ return link;
+ }
+
+@@ -935,7 +926,7 @@ static int xpcs_get_state_c73(struct dw_xpcs *xpcs,
+ int ret;
+
+ /* Link needs to be read first ... */
+- state->link = xpcs_read_link_c73(xpcs, state->an_enabled) > 0 ? 1 : 0;
++ state->link = xpcs_read_link_c73(xpcs) > 0 ? 1 : 0;
+
+ /* ... and then we check the faults. */
+ ret = xpcs_read_fault_c73(xpcs, state);
+--
+2.39.2
+
--- /dev/null
+From 1b514808b0160de9ac959f0ac4531bd039d70c6d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Apr 2023 17:43:16 +0200
+Subject: net: qrtr: correct types of trace event parameters
+
+From: Simon Horman <horms@kernel.org>
+
+[ Upstream commit 054fbf7ff8143d35ca7d3bb5414bb44ee1574194 ]
+
+The arguments passed to the trace events are of type unsigned int,
+however the signature of the events used __le32 parameters.
+
+I may be missing the point here, but sparse flagged this and it
+does seem incorrect to me.
+
+ net/qrtr/ns.c: note: in included file (through include/trace/trace_events.h, include/trace/define_trace.h, include/trace/events/qrtr.h):
+ ./include/trace/events/qrtr.h:11:1: warning: cast to restricted __le32
+ ./include/trace/events/qrtr.h:11:1: warning: restricted __le32 degrades to integer
+ ./include/trace/events/qrtr.h:11:1: warning: restricted __le32 degrades to integer
+ ... (a lot more similar warnings)
+ net/qrtr/ns.c:115:47: expected restricted __le32 [usertype] service
+ net/qrtr/ns.c:115:47: got unsigned int service
+ net/qrtr/ns.c:115:61: warning: incorrect type in argument 2 (different base types)
+ ... (a lot more similar warnings)
+
+Fixes: dfddb54043f0 ("net: qrtr: Add tracepoint support")
+Reviewed-by: Manivannan Sadhasivam <mani@kernel.org>
+Signed-off-by: Simon Horman <horms@kernel.org>
+Link: https://lore.kernel.org/r/20230402-qrtr-trace-types-v1-1-92ad55008dd3@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/trace/events/qrtr.h | 33 ++++++++++++++++++---------------
+ 1 file changed, 18 insertions(+), 15 deletions(-)
+
+diff --git a/include/trace/events/qrtr.h b/include/trace/events/qrtr.h
+index b1de14c3bb934..441132c67133f 100644
+--- a/include/trace/events/qrtr.h
++++ b/include/trace/events/qrtr.h
+@@ -10,15 +10,16 @@
+
+ TRACE_EVENT(qrtr_ns_service_announce_new,
+
+- TP_PROTO(__le32 service, __le32 instance, __le32 node, __le32 port),
++ TP_PROTO(unsigned int service, unsigned int instance,
++ unsigned int node, unsigned int port),
+
+ TP_ARGS(service, instance, node, port),
+
+ TP_STRUCT__entry(
+- __field(__le32, service)
+- __field(__le32, instance)
+- __field(__le32, node)
+- __field(__le32, port)
++ __field(unsigned int, service)
++ __field(unsigned int, instance)
++ __field(unsigned int, node)
++ __field(unsigned int, port)
+ ),
+
+ TP_fast_assign(
+@@ -36,15 +37,16 @@ TRACE_EVENT(qrtr_ns_service_announce_new,
+
+ TRACE_EVENT(qrtr_ns_service_announce_del,
+
+- TP_PROTO(__le32 service, __le32 instance, __le32 node, __le32 port),
++ TP_PROTO(unsigned int service, unsigned int instance,
++ unsigned int node, unsigned int port),
+
+ TP_ARGS(service, instance, node, port),
+
+ TP_STRUCT__entry(
+- __field(__le32, service)
+- __field(__le32, instance)
+- __field(__le32, node)
+- __field(__le32, port)
++ __field(unsigned int, service)
++ __field(unsigned int, instance)
++ __field(unsigned int, node)
++ __field(unsigned int, port)
+ ),
+
+ TP_fast_assign(
+@@ -62,15 +64,16 @@ TRACE_EVENT(qrtr_ns_service_announce_del,
+
+ TRACE_EVENT(qrtr_ns_server_add,
+
+- TP_PROTO(__le32 service, __le32 instance, __le32 node, __le32 port),
++ TP_PROTO(unsigned int service, unsigned int instance,
++ unsigned int node, unsigned int port),
+
+ TP_ARGS(service, instance, node, port),
+
+ TP_STRUCT__entry(
+- __field(__le32, service)
+- __field(__le32, instance)
+- __field(__le32, node)
+- __field(__le32, port)
++ __field(unsigned int, service)
++ __field(unsigned int, instance)
++ __field(unsigned int, node)
++ __field(unsigned int, port)
+ ),
+
+ TP_fast_assign(
+--
+2.39.2
+
--- /dev/null
+From 4f6d9c9adbbca6d3b4d114436ca89cd5431839a8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Apr 2023 20:36:33 +0200
+Subject: net/sched: cls_api: Initialize miss_cookie_node when action miss is
+ not used
+
+From: Ivan Vecera <ivecera@redhat.com>
+
+[ Upstream commit 2cc8a008d62f3c04eeb7ec6fe59e542802bb8df3 ]
+
+Function tcf_exts_init_ex() sets exts->miss_cookie_node ptr only
+when use_action_miss is true so it assumes in other case that
+the field is set to NULL by the caller. If not then the field
+contains garbage and subsequent tcf_exts_destroy() call results
+in a crash.
+Ensure that the field .miss_cookie_node pointer is NULL when
+use_action_miss parameter is false to avoid this potential scenario.
+
+Fixes: 80cd22c35c90 ("net/sched: cls_api: Support hardware miss to tc action")
+Signed-off-by: Ivan Vecera <ivecera@redhat.com>
+Reviewed-by: Pedro Tammela <pctammela@mojatatu.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Link: https://lore.kernel.org/r/20230420183634.1139391-1-ivecera@redhat.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sched/cls_api.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
+index 35785a36c8029..3c3629c9e7b65 100644
+--- a/net/sched/cls_api.c
++++ b/net/sched/cls_api.c
+@@ -3211,6 +3211,7 @@ int tcf_exts_init_ex(struct tcf_exts *exts, struct net *net, int action,
+ #ifdef CONFIG_NET_CLS_ACT
+ exts->type = 0;
+ exts->nr_actions = 0;
++ exts->miss_cookie_node = NULL;
+ /* Note: we do not own yet a reference on net.
+ * This reference might be taken later from tcf_exts_get_net().
+ */
+--
+2.39.2
+
--- /dev/null
+From d6f8273acc3e685e4196f74e76ce26e04345b50d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Apr 2023 16:59:46 +0200
+Subject: net/sched: sch_fq: fix integer overflow of "credit"
+
+From: Davide Caratti <dcaratti@redhat.com>
+
+[ Upstream commit 7041101ff6c3073fd8f2e99920f535b111c929cb ]
+
+if sch_fq is configured with "initial quantum" having values greater than
+INT_MAX, the first assignment of "credit" does signed integer overflow to
+a very negative value.
+In this situation, the syzkaller script provided by Cristoph triggers the
+CPU soft-lockup warning even with few sockets. It's not an infinite loop,
+but "credit" wasn't probably meant to be minus 2Gb for each new flow.
+Capping "initial quantum" to INT_MAX proved to fix the issue.
+
+v2: validation of "initial quantum" is done in fq_policy, instead of open
+ coding in fq_change() _ suggested by Jakub Kicinski
+
+Reported-by: Christoph Paasch <cpaasch@apple.com>
+Link: https://github.com/multipath-tcp/mptcp_net-next/issues/377
+Fixes: afe4fd062416 ("pkt_sched: fq: Fair Queue packet scheduler")
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: Davide Caratti <dcaratti@redhat.com>
+Link: https://lore.kernel.org/r/7b3a3c7e36d03068707a021760a194a8eb5ad41a.1682002300.git.dcaratti@redhat.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sched/sch_fq.c | 6 ++++-
+ .../tc-testing/tc-tests/qdiscs/fq.json | 22 +++++++++++++++++++
+ 2 files changed, 27 insertions(+), 1 deletion(-)
+
+diff --git a/net/sched/sch_fq.c b/net/sched/sch_fq.c
+index 48d14fb90ba02..f59a2cb2c803d 100644
+--- a/net/sched/sch_fq.c
++++ b/net/sched/sch_fq.c
+@@ -779,13 +779,17 @@ static int fq_resize(struct Qdisc *sch, u32 log)
+ return 0;
+ }
+
++static struct netlink_range_validation iq_range = {
++ .max = INT_MAX,
++};
++
+ static const struct nla_policy fq_policy[TCA_FQ_MAX + 1] = {
+ [TCA_FQ_UNSPEC] = { .strict_start_type = TCA_FQ_TIMER_SLACK },
+
+ [TCA_FQ_PLIMIT] = { .type = NLA_U32 },
+ [TCA_FQ_FLOW_PLIMIT] = { .type = NLA_U32 },
+ [TCA_FQ_QUANTUM] = { .type = NLA_U32 },
+- [TCA_FQ_INITIAL_QUANTUM] = { .type = NLA_U32 },
++ [TCA_FQ_INITIAL_QUANTUM] = NLA_POLICY_FULL_RANGE(NLA_U32, &iq_range),
+ [TCA_FQ_RATE_ENABLE] = { .type = NLA_U32 },
+ [TCA_FQ_FLOW_DEFAULT_RATE] = { .type = NLA_U32 },
+ [TCA_FQ_FLOW_MAX_RATE] = { .type = NLA_U32 },
+diff --git a/tools/testing/selftests/tc-testing/tc-tests/qdiscs/fq.json b/tools/testing/selftests/tc-testing/tc-tests/qdiscs/fq.json
+index 8acb904d14193..3593fb8f79ad3 100644
+--- a/tools/testing/selftests/tc-testing/tc-tests/qdiscs/fq.json
++++ b/tools/testing/selftests/tc-testing/tc-tests/qdiscs/fq.json
+@@ -114,6 +114,28 @@
+ "$IP link del dev $DUMMY type dummy"
+ ]
+ },
++ {
++ "id": "10f7",
++ "name": "Create FQ with invalid initial_quantum setting",
++ "category": [
++ "qdisc",
++ "fq"
++ ],
++ "plugins": {
++ "requires": "nsPlugin"
++ },
++ "setup": [
++ "$IP link add dev $DUMMY type dummy || /bin/true"
++ ],
++ "cmdUnderTest": "$TC qdisc add dev $DUMMY handle 1: root fq initial_quantum 0x80000000",
++ "expExitCode": "2",
++ "verifyCmd": "$TC qdisc show dev $DUMMY",
++ "matchPattern": "qdisc fq 1: root.*initial_quantum 2048Mb",
++ "matchCount": "0",
++ "teardown": [
++ "$IP link del dev $DUMMY type dummy"
++ ]
++ },
+ {
+ "id": "9398",
+ "name": "Create FQ with maxrate setting",
+--
+2.39.2
+
--- /dev/null
+From b213920a9907639583527838c479c567688883a3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Apr 2023 22:13:46 +0800
+Subject: net: stmmac:fix system hang when setting up tag_8021q VLAN for DSA
+ ports
+
+From: Yan Wang <rk.code@outlook.com>
+
+[ Upstream commit 35226750f7ab9d49140d95bc7d38a2a9b0f4fdfc ]
+
+The system hang because of dsa_tag_8021q_port_setup()->
+ stmmac_vlan_rx_add_vid().
+
+I found in stmmac_drv_probe() that cailing pm_runtime_put()
+disabled the clock.
+
+First, when the kernel is compiled with CONFIG_PM=y,The stmmac's
+resume/suspend is active.
+
+Secondly,stmmac as DSA master,the dsa_tag_8021q_port_setup() function
+will callback stmmac_vlan_rx_add_vid when DSA dirver starts. However,
+The system is hanged for the stmmac_vlan_rx_add_vid() accesses its
+registers after stmmac's clock is closed.
+
+I would suggest adding the pm_runtime_resume_and_get() to the
+stmmac_vlan_rx_add_vid().This guarantees that resuming clock output
+while in use.
+
+Fixes: b3dcb3127786 ("net: stmmac: correct clocks enabled in stmmac_vlan_rx_kill_vid()")
+Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
+Signed-off-by: Yan Wang <rk.code@outlook.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+index d7fcab0570322..f9cd063f1fe30 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -6350,6 +6350,10 @@ static int stmmac_vlan_rx_add_vid(struct net_device *ndev, __be16 proto, u16 vid
+ bool is_double = false;
+ int ret;
+
++ ret = pm_runtime_resume_and_get(priv->device);
++ if (ret < 0)
++ return ret;
++
+ if (be16_to_cpu(proto) == ETH_P_8021AD)
+ is_double = true;
+
+@@ -6357,16 +6361,18 @@ static int stmmac_vlan_rx_add_vid(struct net_device *ndev, __be16 proto, u16 vid
+ ret = stmmac_vlan_update(priv, is_double);
+ if (ret) {
+ clear_bit(vid, priv->active_vlans);
+- return ret;
++ goto err_pm_put;
+ }
+
+ if (priv->hw->num_vlan) {
+ ret = stmmac_add_hw_vlan_rx_fltr(priv, ndev, priv->hw, proto, vid);
+ if (ret)
+- return ret;
++ goto err_pm_put;
+ }
++err_pm_put:
++ pm_runtime_put(priv->device);
+
+- return 0;
++ return ret;
+ }
+
+ static int stmmac_vlan_rx_kill_vid(struct net_device *ndev, __be16 proto, u16 vid)
+--
+2.39.2
+
--- /dev/null
+From c35cbe963b8a435dd03285f54afed66737ab1cf5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Mar 2023 13:51:27 -0400
+Subject: net: sunhme: Fix uninitialized return code
+
+From: Sean Anderson <seanga2@gmail.com>
+
+[ Upstream commit d61157414d0a591d10d27d0ce5873916614e5e31 ]
+
+Fix an uninitialized return code if we never found a qfe slot. It would be
+a bug if we ever got into this situation, but it's good to return something
+tracable.
+
+Fixes: acb3f35f920b ("sunhme: forward the error code from pci_enable_device()")
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Dan Carpenter <error27@gmail.com>
+Signed-off-by: Sean Anderson <seanga2@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/sun/sunhme.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/sun/sunhme.c b/drivers/net/ethernet/sun/sunhme.c
+index b0c7ab74a82ed..7cf8210ebbec3 100644
+--- a/drivers/net/ethernet/sun/sunhme.c
++++ b/drivers/net/ethernet/sun/sunhme.c
+@@ -2834,7 +2834,7 @@ static int happy_meal_pci_probe(struct pci_dev *pdev,
+ int i, qfe_slot = -1;
+ char prom_name[64];
+ u8 addr[ETH_ALEN];
+- int err;
++ int err = -ENODEV;
+
+ /* Now make sure pci_dev cookie is there. */
+ #ifdef CONFIG_SPARC
+--
+2.39.2
+
--- /dev/null
+From e47bd80b2a29d1ef74923277662d8329f7480219 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Apr 2023 13:15:26 +0800
+Subject: netfilter: conntrack: fix wrong ct->timeout value
+
+From: Tzung-Bi Shih <tzungbi@kernel.org>
+
+[ Upstream commit 73db1b8f2bb6725b7391e85aab41fdf592b3c0c1 ]
+
+(struct nf_conn)->timeout is an interval before the conntrack
+confirmed. After confirmed, it becomes a timestamp.
+
+It is observed that timeout of an unconfirmed conntrack:
+- Set by calling ctnetlink_change_timeout(). As a result,
+ `nfct_time_stamp` was wrongly added to `ct->timeout` twice.
+- Get by calling ctnetlink_dump_timeout(). As a result,
+ `nfct_time_stamp` was wrongly subtracted.
+
+Call Trace:
+ <TASK>
+ dump_stack_lvl
+ ctnetlink_dump_timeout
+ __ctnetlink_glue_build
+ ctnetlink_glue_build
+ __nfqnl_enqueue_packet
+ nf_queue
+ nf_hook_slow
+ ip_mc_output
+ ? __pfx_ip_finish_output
+ ip_send_skb
+ ? __pfx_dst_output
+ udp_send_skb
+ udp_sendmsg
+ ? __pfx_ip_generic_getfrag
+ sock_sendmsg
+
+Separate the 2 cases in:
+- Setting `ct->timeout` in __nf_ct_set_timeout().
+- Getting `ct->timeout` in ctnetlink_dump_timeout().
+
+Pablo appends:
+
+Update ctnetlink to set up the timeout _after_ the IPS_CONFIRMED flag is
+set on, otherwise conntrack creation via ctnetlink breaks.
+
+Note that the problem described in this patch occurs since the
+introduction of the nfnetlink_queue conntrack support, select a
+sufficiently old Fixes: tag for -stable kernel to pick up this fix.
+
+Fixes: a4b4766c3ceb ("netfilter: nfnetlink_queue: rename related to nfqueue attaching conntrack info")
+Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/netfilter/nf_conntrack_core.h | 6 +++++-
+ net/netfilter/nf_conntrack_netlink.c | 13 +++++++++----
+ 2 files changed, 14 insertions(+), 5 deletions(-)
+
+diff --git a/include/net/netfilter/nf_conntrack_core.h b/include/net/netfilter/nf_conntrack_core.h
+index 71d1269fe4d4f..3384859a89210 100644
+--- a/include/net/netfilter/nf_conntrack_core.h
++++ b/include/net/netfilter/nf_conntrack_core.h
+@@ -89,7 +89,11 @@ static inline void __nf_ct_set_timeout(struct nf_conn *ct, u64 timeout)
+ {
+ if (timeout > INT_MAX)
+ timeout = INT_MAX;
+- WRITE_ONCE(ct->timeout, nfct_time_stamp + (u32)timeout);
++
++ if (nf_ct_is_confirmed(ct))
++ WRITE_ONCE(ct->timeout, nfct_time_stamp + (u32)timeout);
++ else
++ ct->timeout = (u32)timeout;
+ }
+
+ int __nf_ct_change_timeout(struct nf_conn *ct, u64 cta_timeout);
+diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
+index d3ee188546982..6f3b23a6653cc 100644
+--- a/net/netfilter/nf_conntrack_netlink.c
++++ b/net/netfilter/nf_conntrack_netlink.c
+@@ -176,7 +176,12 @@ static int ctnetlink_dump_status(struct sk_buff *skb, const struct nf_conn *ct)
+ static int ctnetlink_dump_timeout(struct sk_buff *skb, const struct nf_conn *ct,
+ bool skip_zero)
+ {
+- long timeout = nf_ct_expires(ct) / HZ;
++ long timeout;
++
++ if (nf_ct_is_confirmed(ct))
++ timeout = nf_ct_expires(ct) / HZ;
++ else
++ timeout = ct->timeout / HZ;
+
+ if (skip_zero && timeout == 0)
+ return 0;
+@@ -2253,9 +2258,6 @@ ctnetlink_create_conntrack(struct net *net,
+ if (!cda[CTA_TIMEOUT])
+ goto err1;
+
+- timeout = (u64)ntohl(nla_get_be32(cda[CTA_TIMEOUT])) * HZ;
+- __nf_ct_set_timeout(ct, timeout);
+-
+ rcu_read_lock();
+ if (cda[CTA_HELP]) {
+ char *helpname = NULL;
+@@ -2319,6 +2321,9 @@ ctnetlink_create_conntrack(struct net *net,
+ /* we must add conntrack extensions before confirmation. */
+ ct->status |= IPS_CONFIRMED;
+
++ timeout = (u64)ntohl(nla_get_be32(cda[CTA_TIMEOUT])) * HZ;
++ __nf_ct_set_timeout(ct, timeout);
++
+ if (cda[CTA_STATUS]) {
+ err = ctnetlink_change_status(ct, cda);
+ if (err < 0)
+--
+2.39.2
+
--- /dev/null
+From cdb4cd2c3976a67c310c06ea018e4fb3d877ed9d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Apr 2023 23:31:26 +0200
+Subject: netfilter: conntrack: restore IPS_CONFIRMED out of
+ nf_conntrack_hash_check_insert()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+[ Upstream commit 2cdaa3eefed83082923cf219c8b6a314e622da74 ]
+
+e6d57e9ff0ae ("netfilter: conntrack: fix rmmod double-free race")
+consolidates IPS_CONFIRMED bit set in nf_conntrack_hash_check_insert().
+However, this breaks ctnetlink:
+
+ # conntrack -I -p tcp --timeout 123 --src 1.2.3.4 --dst 5.6.7.8 --state ESTABLISHED --sport 1 --dport 4 -u SEEN_REPLY
+ conntrack v1.4.6 (conntrack-tools): Operation failed: Device or resource busy
+
+This is a partial revert of the aforementioned commit to restore
+IPS_CONFIRMED.
+
+Fixes: e6d57e9ff0ae ("netfilter: conntrack: fix rmmod double-free race")
+Reported-by: Stéphane Graber <stgraber@stgraber.org>
+Tested-by: Stéphane Graber <stgraber@stgraber.org>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_conntrack_bpf.c | 1 +
+ net/netfilter/nf_conntrack_core.c | 1 -
+ net/netfilter/nf_conntrack_netlink.c | 3 +++
+ 3 files changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/net/netfilter/nf_conntrack_bpf.c b/net/netfilter/nf_conntrack_bpf.c
+index cd99e6dc1f35c..34913521c385a 100644
+--- a/net/netfilter/nf_conntrack_bpf.c
++++ b/net/netfilter/nf_conntrack_bpf.c
+@@ -381,6 +381,7 @@ __bpf_kfunc struct nf_conn *bpf_ct_insert_entry(struct nf_conn___init *nfct_i)
+ struct nf_conn *nfct = (struct nf_conn *)nfct_i;
+ int err;
+
++ nfct->status |= IPS_CONFIRMED;
+ err = nf_conntrack_hash_check_insert(nfct);
+ if (err < 0) {
+ nf_conntrack_free(nfct);
+diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
+index c6a6a6099b4e2..7ba6ab9b54b56 100644
+--- a/net/netfilter/nf_conntrack_core.c
++++ b/net/netfilter/nf_conntrack_core.c
+@@ -932,7 +932,6 @@ nf_conntrack_hash_check_insert(struct nf_conn *ct)
+ goto out;
+ }
+
+- ct->status |= IPS_CONFIRMED;
+ smp_wmb();
+ /* The caller holds a reference to this object */
+ refcount_set(&ct->ct_general.use, 2);
+diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
+index bfc3aaa2c872b..d3ee188546982 100644
+--- a/net/netfilter/nf_conntrack_netlink.c
++++ b/net/netfilter/nf_conntrack_netlink.c
+@@ -2316,6 +2316,9 @@ ctnetlink_create_conntrack(struct net *net,
+ nfct_seqadj_ext_add(ct);
+ nfct_synproxy_ext_add(ct);
+
++ /* we must add conntrack extensions before confirmation. */
++ ct->status |= IPS_CONFIRMED;
++
+ if (cda[CTA_STATUS]) {
+ err = ctnetlink_change_status(ct, cda);
+ if (err < 0)
+--
+2.39.2
+
--- /dev/null
+From 164801c041f39bcf245d468239c17c24f83bba4e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Mar 2023 21:28:44 +0530
+Subject: netfilter: keep conntrack reference until IPsecv6 policy checks are
+ done
+
+From: Madhu Koriginja <madhu.koriginja@nxp.com>
+
+[ Upstream commit b0e214d212030fe497d4d150bb3474e50ad5d093 ]
+
+Keep the conntrack reference until policy checks have been performed for
+IPsec V6 NAT support, just like ipv4.
+
+The reference needs to be dropped before a packet is
+queued to avoid having the conntrack module unloadable.
+
+Fixes: 58a317f1061c ("netfilter: ipv6: add IPv6 NAT support")
+Signed-off-by: Madhu Koriginja <madhu.koriginja@nxp.com>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/dccp/ipv6.c | 1 +
+ net/ipv6/ip6_input.c | 14 ++++++--------
+ net/ipv6/raw.c | 5 ++---
+ net/ipv6/tcp_ipv6.c | 2 ++
+ net/ipv6/udp.c | 2 ++
+ 5 files changed, 13 insertions(+), 11 deletions(-)
+
+diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
+index b9d7c3dd1cb39..c0fd8f5f3b94e 100644
+--- a/net/dccp/ipv6.c
++++ b/net/dccp/ipv6.c
+@@ -783,6 +783,7 @@ static int dccp_v6_rcv(struct sk_buff *skb)
+
+ if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
+ goto discard_and_relse;
++ nf_reset_ct(skb);
+
+ return __sk_receive_skb(sk, skb, 1, dh->dccph_doff * 4,
+ refcounted) ? -1 : 0;
+diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
+index e1ebf5e42ebe9..d94041bb42872 100644
+--- a/net/ipv6/ip6_input.c
++++ b/net/ipv6/ip6_input.c
+@@ -404,10 +404,6 @@ void ip6_protocol_deliver_rcu(struct net *net, struct sk_buff *skb, int nexthdr,
+ /* Only do this once for first final protocol */
+ have_final = true;
+
+- /* Free reference early: we don't need it any more,
+- and it may hold ip_conntrack module loaded
+- indefinitely. */
+- nf_reset_ct(skb);
+
+ skb_postpull_rcsum(skb, skb_network_header(skb),
+ skb_network_header_len(skb));
+@@ -430,10 +426,12 @@ void ip6_protocol_deliver_rcu(struct net *net, struct sk_buff *skb, int nexthdr,
+ goto discard;
+ }
+ }
+- if (!(ipprot->flags & INET6_PROTO_NOPOLICY) &&
+- !xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
+- SKB_DR_SET(reason, XFRM_POLICY);
+- goto discard;
++ if (!(ipprot->flags & INET6_PROTO_NOPOLICY)) {
++ if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
++ SKB_DR_SET(reason, XFRM_POLICY);
++ goto discard;
++ }
++ nf_reset_ct(skb);
+ }
+
+ ret = INDIRECT_CALL_2(ipprot->handler, tcp_v6_rcv, udpv6_rcv,
+diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
+index a327aa481df48..9986e2d15c8be 100644
+--- a/net/ipv6/raw.c
++++ b/net/ipv6/raw.c
+@@ -193,10 +193,8 @@ static bool ipv6_raw_deliver(struct sk_buff *skb, int nexthdr)
+ struct sk_buff *clone = skb_clone(skb, GFP_ATOMIC);
+
+ /* Not releasing hash table! */
+- if (clone) {
+- nf_reset_ct(clone);
++ if (clone)
+ rawv6_rcv(sk, clone);
+- }
+ }
+ }
+ rcu_read_unlock();
+@@ -389,6 +387,7 @@ int rawv6_rcv(struct sock *sk, struct sk_buff *skb)
+ kfree_skb_reason(skb, SKB_DROP_REASON_XFRM_POLICY);
+ return NET_RX_DROP;
+ }
++ nf_reset_ct(skb);
+
+ if (!rp->checksum)
+ skb->ip_summed = CHECKSUM_UNNECESSARY;
+diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
+index 1bf93b61aa06f..1e747241c7710 100644
+--- a/net/ipv6/tcp_ipv6.c
++++ b/net/ipv6/tcp_ipv6.c
+@@ -1722,6 +1722,8 @@ INDIRECT_CALLABLE_SCOPE int tcp_v6_rcv(struct sk_buff *skb)
+ if (drop_reason)
+ goto discard_and_relse;
+
++ nf_reset_ct(skb);
++
+ if (tcp_filter(sk, skb)) {
+ drop_reason = SKB_DROP_REASON_SOCKET_FILTER;
+ goto discard_and_relse;
+diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
+index a675acfb901d1..c519f21632656 100644
+--- a/net/ipv6/udp.c
++++ b/net/ipv6/udp.c
+@@ -704,6 +704,7 @@ static int udpv6_queue_rcv_one_skb(struct sock *sk, struct sk_buff *skb)
+ drop_reason = SKB_DROP_REASON_XFRM_POLICY;
+ goto drop;
+ }
++ nf_reset_ct(skb);
+
+ if (static_branch_unlikely(&udpv6_encap_needed_key) && up->encap_type) {
+ int (*encap_rcv)(struct sock *sk, struct sk_buff *skb);
+@@ -1027,6 +1028,7 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
+
+ if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
+ goto discard;
++ nf_reset_ct(skb);
+
+ if (udp_lib_checksum_complete(skb))
+ goto csum_error;
+--
+2.39.2
+
--- /dev/null
+From 2b8996d99d7ab8beb6c668ceb19a2c0fea52ec09 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Apr 2023 17:13:19 +0200
+Subject: netfilter: nf_tables: don't write table validation state without
+ mutex
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit 9a32e9850686599ed194ccdceb6cd3dd56b2d9b9 ]
+
+The ->cleanup callback needs to be removed, this doesn't work anymore as
+the transaction mutex is already released in the ->abort function.
+
+Just do it after a successful validation pass, this either happens
+from commit or abort phases where transaction mutex is held.
+
+Fixes: f102d66b335a ("netfilter: nf_tables: use dedicated mutex to guard transactions")
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/netfilter/nfnetlink.h | 1 -
+ net/netfilter/nf_tables_api.c | 8 ++------
+ net/netfilter/nfnetlink.c | 2 --
+ 3 files changed, 2 insertions(+), 9 deletions(-)
+
+diff --git a/include/linux/netfilter/nfnetlink.h b/include/linux/netfilter/nfnetlink.h
+index 241e005f290ad..e9a9ab34a7ccc 100644
+--- a/include/linux/netfilter/nfnetlink.h
++++ b/include/linux/netfilter/nfnetlink.h
+@@ -45,7 +45,6 @@ struct nfnetlink_subsystem {
+ int (*commit)(struct net *net, struct sk_buff *skb);
+ int (*abort)(struct net *net, struct sk_buff *skb,
+ enum nfnl_abort_action action);
+- void (*cleanup)(struct net *net);
+ bool (*valid_genid)(struct net *net, u32 genid);
+ };
+
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index e48ab8dfb5410..d67ee2774b273 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -8645,6 +8645,8 @@ static int nf_tables_validate(struct net *net)
+ if (nft_table_validate(net, table) < 0)
+ return -EAGAIN;
+ }
++
++ nft_validate_state_update(net, NFT_VALIDATE_SKIP);
+ break;
+ }
+
+@@ -9586,11 +9588,6 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action)
+ return 0;
+ }
+
+-static void nf_tables_cleanup(struct net *net)
+-{
+- nft_validate_state_update(net, NFT_VALIDATE_SKIP);
+-}
+-
+ static int nf_tables_abort(struct net *net, struct sk_buff *skb,
+ enum nfnl_abort_action action)
+ {
+@@ -9624,7 +9621,6 @@ static const struct nfnetlink_subsystem nf_tables_subsys = {
+ .cb = nf_tables_cb,
+ .commit = nf_tables_commit,
+ .abort = nf_tables_abort,
+- .cleanup = nf_tables_cleanup,
+ .valid_genid = nf_tables_valid_genid,
+ .owner = THIS_MODULE,
+ };
+diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c
+index 81c7737c803a6..ae7146475d17a 100644
+--- a/net/netfilter/nfnetlink.c
++++ b/net/netfilter/nfnetlink.c
+@@ -590,8 +590,6 @@ static void nfnetlink_rcv_batch(struct sk_buff *skb, struct nlmsghdr *nlh,
+ goto replay_abort;
+ }
+ }
+- if (ss->cleanup)
+- ss->cleanup(net);
+
+ nfnl_err_deliver(&err_list, oskb);
+ kfree_skb(skb);
+--
+2.39.2
+
--- /dev/null
+From 29ac2fde722381b919f470c91e57687bbcfdde23 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Apr 2023 11:52:55 -0700
+Subject: netlink: Use copy_to_user() for optval in netlink_getsockopt().
+
+From: Kuniyuki Iwashima <kuniyu@amazon.com>
+
+[ Upstream commit d913d32cc2707e9cd24fe6fa6d7d470e9c728980 ]
+
+Brad Spencer provided a detailed report [0] that when calling getsockopt()
+for AF_NETLINK, some SOL_NETLINK options set only 1 byte even though such
+options require at least sizeof(int) as length.
+
+The options return a flag value that fits into 1 byte, but such behaviour
+confuses users who do not initialise the variable before calling
+getsockopt() and do not strictly check the returned value as char.
+
+Currently, netlink_getsockopt() uses put_user() to copy data to optlen and
+optval, but put_user() casts the data based on the pointer, char *optval.
+As a result, only 1 byte is set to optval.
+
+To avoid this behaviour, we need to use copy_to_user() or cast optval for
+put_user().
+
+Note that this changes the behaviour on big-endian systems, but we document
+that the size of optval is int in the man page.
+
+ $ man 7 netlink
+ ...
+ Socket options
+ To set or get a netlink socket option, call getsockopt(2) to read
+ or setsockopt(2) to write the option with the option level argument
+ set to SOL_NETLINK. Unless otherwise noted, optval is a pointer to
+ an int.
+
+Fixes: 9a4595bc7e67 ("[NETLINK]: Add set/getsockopt options to support more than 32 groups")
+Fixes: be0c22a46cfb ("netlink: add NETLINK_BROADCAST_ERROR socket option")
+Fixes: 38938bfe3489 ("netlink: add NETLINK_NO_ENOBUFS socket flag")
+Fixes: 0a6a3a23ea6e ("netlink: add NETLINK_CAP_ACK socket option")
+Fixes: 2d4bc93368f5 ("netlink: extended ACK reporting")
+Fixes: 89d35528d17d ("netlink: Add new socket option to enable strict checking on dumps")
+Reported-by: Brad Spencer <bspencer@blackberry.com>
+Link: https://lore.kernel.org/netdev/ZD7VkNWFfp22kTDt@datsun.rim.net/
+Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
+Reviewed-by: Johannes Berg <johannes@sipsolutions.net>
+Link: https://lore.kernel.org/r/20230421185255.94606-1-kuniyu@amazon.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netlink/af_netlink.c | 75 ++++++++++++----------------------------
+ 1 file changed, 23 insertions(+), 52 deletions(-)
+
+diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
+index f365dfdd672d7..9b6eb28e6e94f 100644
+--- a/net/netlink/af_netlink.c
++++ b/net/netlink/af_netlink.c
+@@ -1742,7 +1742,8 @@ static int netlink_getsockopt(struct socket *sock, int level, int optname,
+ {
+ struct sock *sk = sock->sk;
+ struct netlink_sock *nlk = nlk_sk(sk);
+- int len, val, err;
++ unsigned int flag;
++ int len, val;
+
+ if (level != SOL_NETLINK)
+ return -ENOPROTOOPT;
+@@ -1754,39 +1755,17 @@ static int netlink_getsockopt(struct socket *sock, int level, int optname,
+
+ switch (optname) {
+ case NETLINK_PKTINFO:
+- if (len < sizeof(int))
+- return -EINVAL;
+- len = sizeof(int);
+- val = nlk->flags & NETLINK_F_RECV_PKTINFO ? 1 : 0;
+- if (put_user(len, optlen) ||
+- put_user(val, optval))
+- return -EFAULT;
+- err = 0;
++ flag = NETLINK_F_RECV_PKTINFO;
+ break;
+ case NETLINK_BROADCAST_ERROR:
+- if (len < sizeof(int))
+- return -EINVAL;
+- len = sizeof(int);
+- val = nlk->flags & NETLINK_F_BROADCAST_SEND_ERROR ? 1 : 0;
+- if (put_user(len, optlen) ||
+- put_user(val, optval))
+- return -EFAULT;
+- err = 0;
++ flag = NETLINK_F_BROADCAST_SEND_ERROR;
+ break;
+ case NETLINK_NO_ENOBUFS:
+- if (len < sizeof(int))
+- return -EINVAL;
+- len = sizeof(int);
+- val = nlk->flags & NETLINK_F_RECV_NO_ENOBUFS ? 1 : 0;
+- if (put_user(len, optlen) ||
+- put_user(val, optval))
+- return -EFAULT;
+- err = 0;
++ flag = NETLINK_F_RECV_NO_ENOBUFS;
+ break;
+ case NETLINK_LIST_MEMBERSHIPS: {
+- int pos, idx, shift;
++ int pos, idx, shift, err = 0;
+
+- err = 0;
+ netlink_lock_table();
+ for (pos = 0; pos * 8 < nlk->ngroups; pos += sizeof(u32)) {
+ if (len - pos < sizeof(u32))
+@@ -1803,40 +1782,32 @@ static int netlink_getsockopt(struct socket *sock, int level, int optname,
+ if (put_user(ALIGN(nlk->ngroups / 8, sizeof(u32)), optlen))
+ err = -EFAULT;
+ netlink_unlock_table();
+- break;
++ return err;
+ }
+ case NETLINK_CAP_ACK:
+- if (len < sizeof(int))
+- return -EINVAL;
+- len = sizeof(int);
+- val = nlk->flags & NETLINK_F_CAP_ACK ? 1 : 0;
+- if (put_user(len, optlen) ||
+- put_user(val, optval))
+- return -EFAULT;
+- err = 0;
++ flag = NETLINK_F_CAP_ACK;
+ break;
+ case NETLINK_EXT_ACK:
+- if (len < sizeof(int))
+- return -EINVAL;
+- len = sizeof(int);
+- val = nlk->flags & NETLINK_F_EXT_ACK ? 1 : 0;
+- if (put_user(len, optlen) || put_user(val, optval))
+- return -EFAULT;
+- err = 0;
++ flag = NETLINK_F_EXT_ACK;
+ break;
+ case NETLINK_GET_STRICT_CHK:
+- if (len < sizeof(int))
+- return -EINVAL;
+- len = sizeof(int);
+- val = nlk->flags & NETLINK_F_STRICT_CHK ? 1 : 0;
+- if (put_user(len, optlen) || put_user(val, optval))
+- return -EFAULT;
+- err = 0;
++ flag = NETLINK_F_STRICT_CHK;
+ break;
+ default:
+- err = -ENOPROTOOPT;
++ return -ENOPROTOOPT;
+ }
+- return err;
++
++ if (len < sizeof(int))
++ return -EINVAL;
++
++ len = sizeof(int);
++ val = nlk->flags & flag ? 1 : 0;
++
++ if (put_user(len, optlen) ||
++ copy_to_user(optval, &val, len))
++ return -EFAULT;
++
++ return 0;
+ }
+
+ static void netlink_cmsg_recv_pktinfo(struct msghdr *msg, struct sk_buff *skb)
+--
+2.39.2
+
--- /dev/null
+From 6784275090c5f4538db0e5b82d9c3eb451b6a8dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Mar 2023 18:45:53 -0400
+Subject: NFSv4.1: Always send a RECLAIM_COMPLETE after establishing lease
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+[ Upstream commit 40882deb83c29d8df4470d4e5e7f137b6acf7ad1 ]
+
+The spec requires that we always at least send a RECLAIM_COMPLETE when
+we're done establishing the lease and recovering any state.
+
+Fixes: fce5c838e133 ("nfs41: RECLAIM_COMPLETE functionality")
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4state.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
+index 2a0ca5c7f082a..660ccfaf463e4 100644
+--- a/fs/nfs/nfs4state.c
++++ b/fs/nfs/nfs4state.c
+@@ -67,6 +67,8 @@
+
+ #define OPENOWNER_POOL_SIZE 8
+
++static void nfs4_state_start_reclaim_reboot(struct nfs_client *clp);
++
+ const nfs4_stateid zero_stateid = {
+ { .data = { 0 } },
+ .type = NFS4_SPECIAL_STATEID_TYPE,
+@@ -330,6 +332,8 @@ int nfs41_init_clientid(struct nfs_client *clp, const struct cred *cred)
+ status = nfs4_proc_create_session(clp, cred);
+ if (status != 0)
+ goto out;
++ if (!(clp->cl_exchange_flags & EXCHGID4_FLAG_CONFIRMED_R))
++ nfs4_state_start_reclaim_reboot(clp);
+ nfs41_finish_session_reset(clp);
+ nfs_mark_client_ready(clp, NFS_CS_READY);
+ out:
+--
+2.39.2
+
--- /dev/null
+From 8c933aade10a0670299817de5324cd85252c13b3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Apr 2023 16:49:04 +0800
+Subject: nvme-fcloop: fix "inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W}
+ usage"
+
+From: Ming Lei <ming.lei@redhat.com>
+
+[ Upstream commit 4f86a6ff6fbd891232dda3ca97fd1b9630b59809 ]
+
+fcloop_fcp_op() could be called from flush request's ->end_io(flush_end_io) in
+which the spinlock of fq->mq_flush_lock is grabbed with irq saved/disabled.
+
+So fcloop_fcp_op() can't call spin_unlock_irq(&tfcp_req->reqlock) simply
+which enables irq unconditionally.
+
+Fixes the warning by switching to spin_lock_irqsave()/spin_unlock_irqrestore()
+
+Fixes: c38dbbfab1bc ("nvme-fcloop: fix inconsistent lock state warnings")
+Reported-by: Yi Zhang <yi.zhang@redhat.com>
+Signed-off-by: Ming Lei <ming.lei@redhat.com>
+Reviewed-by: Ewan D. Milne <emilne@redhat.com>
+Tested-by: Yi Zhang <yi.zhang@redhat.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/target/fcloop.c | 48 ++++++++++++++++++++----------------
+ 1 file changed, 27 insertions(+), 21 deletions(-)
+
+diff --git a/drivers/nvme/target/fcloop.c b/drivers/nvme/target/fcloop.c
+index 5c16372f3b533..c780af36c1d4a 100644
+--- a/drivers/nvme/target/fcloop.c
++++ b/drivers/nvme/target/fcloop.c
+@@ -614,10 +614,11 @@ fcloop_fcp_recv_work(struct work_struct *work)
+ struct fcloop_fcpreq *tfcp_req =
+ container_of(work, struct fcloop_fcpreq, fcp_rcv_work);
+ struct nvmefc_fcp_req *fcpreq = tfcp_req->fcpreq;
++ unsigned long flags;
+ int ret = 0;
+ bool aborted = false;
+
+- spin_lock_irq(&tfcp_req->reqlock);
++ spin_lock_irqsave(&tfcp_req->reqlock, flags);
+ switch (tfcp_req->inistate) {
+ case INI_IO_START:
+ tfcp_req->inistate = INI_IO_ACTIVE;
+@@ -626,11 +627,11 @@ fcloop_fcp_recv_work(struct work_struct *work)
+ aborted = true;
+ break;
+ default:
+- spin_unlock_irq(&tfcp_req->reqlock);
++ spin_unlock_irqrestore(&tfcp_req->reqlock, flags);
+ WARN_ON(1);
+ return;
+ }
+- spin_unlock_irq(&tfcp_req->reqlock);
++ spin_unlock_irqrestore(&tfcp_req->reqlock, flags);
+
+ if (unlikely(aborted))
+ ret = -ECANCELED;
+@@ -655,8 +656,9 @@ fcloop_fcp_abort_recv_work(struct work_struct *work)
+ container_of(work, struct fcloop_fcpreq, abort_rcv_work);
+ struct nvmefc_fcp_req *fcpreq;
+ bool completed = false;
++ unsigned long flags;
+
+- spin_lock_irq(&tfcp_req->reqlock);
++ spin_lock_irqsave(&tfcp_req->reqlock, flags);
+ fcpreq = tfcp_req->fcpreq;
+ switch (tfcp_req->inistate) {
+ case INI_IO_ABORTED:
+@@ -665,11 +667,11 @@ fcloop_fcp_abort_recv_work(struct work_struct *work)
+ completed = true;
+ break;
+ default:
+- spin_unlock_irq(&tfcp_req->reqlock);
++ spin_unlock_irqrestore(&tfcp_req->reqlock, flags);
+ WARN_ON(1);
+ return;
+ }
+- spin_unlock_irq(&tfcp_req->reqlock);
++ spin_unlock_irqrestore(&tfcp_req->reqlock, flags);
+
+ if (unlikely(completed)) {
+ /* remove reference taken in original abort downcall */
+@@ -681,9 +683,9 @@ fcloop_fcp_abort_recv_work(struct work_struct *work)
+ nvmet_fc_rcv_fcp_abort(tfcp_req->tport->targetport,
+ &tfcp_req->tgt_fcp_req);
+
+- spin_lock_irq(&tfcp_req->reqlock);
++ spin_lock_irqsave(&tfcp_req->reqlock, flags);
+ tfcp_req->fcpreq = NULL;
+- spin_unlock_irq(&tfcp_req->reqlock);
++ spin_unlock_irqrestore(&tfcp_req->reqlock, flags);
+
+ fcloop_call_host_done(fcpreq, tfcp_req, -ECANCELED);
+ /* call_host_done releases reference for abort downcall */
+@@ -699,11 +701,12 @@ fcloop_tgt_fcprqst_done_work(struct work_struct *work)
+ struct fcloop_fcpreq *tfcp_req =
+ container_of(work, struct fcloop_fcpreq, tio_done_work);
+ struct nvmefc_fcp_req *fcpreq;
++ unsigned long flags;
+
+- spin_lock_irq(&tfcp_req->reqlock);
++ spin_lock_irqsave(&tfcp_req->reqlock, flags);
+ fcpreq = tfcp_req->fcpreq;
+ tfcp_req->inistate = INI_IO_COMPLETED;
+- spin_unlock_irq(&tfcp_req->reqlock);
++ spin_unlock_irqrestore(&tfcp_req->reqlock, flags);
+
+ fcloop_call_host_done(fcpreq, tfcp_req, tfcp_req->status);
+ }
+@@ -807,13 +810,14 @@ fcloop_fcp_op(struct nvmet_fc_target_port *tgtport,
+ u32 rsplen = 0, xfrlen = 0;
+ int fcp_err = 0, active, aborted;
+ u8 op = tgt_fcpreq->op;
++ unsigned long flags;
+
+- spin_lock_irq(&tfcp_req->reqlock);
++ spin_lock_irqsave(&tfcp_req->reqlock, flags);
+ fcpreq = tfcp_req->fcpreq;
+ active = tfcp_req->active;
+ aborted = tfcp_req->aborted;
+ tfcp_req->active = true;
+- spin_unlock_irq(&tfcp_req->reqlock);
++ spin_unlock_irqrestore(&tfcp_req->reqlock, flags);
+
+ if (unlikely(active))
+ /* illegal - call while i/o active */
+@@ -821,9 +825,9 @@ fcloop_fcp_op(struct nvmet_fc_target_port *tgtport,
+
+ if (unlikely(aborted)) {
+ /* target transport has aborted i/o prior */
+- spin_lock_irq(&tfcp_req->reqlock);
++ spin_lock_irqsave(&tfcp_req->reqlock, flags);
+ tfcp_req->active = false;
+- spin_unlock_irq(&tfcp_req->reqlock);
++ spin_unlock_irqrestore(&tfcp_req->reqlock, flags);
+ tgt_fcpreq->transferred_length = 0;
+ tgt_fcpreq->fcp_error = -ECANCELED;
+ tgt_fcpreq->done(tgt_fcpreq);
+@@ -880,9 +884,9 @@ fcloop_fcp_op(struct nvmet_fc_target_port *tgtport,
+ break;
+ }
+
+- spin_lock_irq(&tfcp_req->reqlock);
++ spin_lock_irqsave(&tfcp_req->reqlock, flags);
+ tfcp_req->active = false;
+- spin_unlock_irq(&tfcp_req->reqlock);
++ spin_unlock_irqrestore(&tfcp_req->reqlock, flags);
+
+ tgt_fcpreq->transferred_length = xfrlen;
+ tgt_fcpreq->fcp_error = fcp_err;
+@@ -896,15 +900,16 @@ fcloop_tgt_fcp_abort(struct nvmet_fc_target_port *tgtport,
+ struct nvmefc_tgt_fcp_req *tgt_fcpreq)
+ {
+ struct fcloop_fcpreq *tfcp_req = tgt_fcp_req_to_fcpreq(tgt_fcpreq);
++ unsigned long flags;
+
+ /*
+ * mark aborted only in case there were 2 threads in transport
+ * (one doing io, other doing abort) and only kills ops posted
+ * after the abort request
+ */
+- spin_lock_irq(&tfcp_req->reqlock);
++ spin_lock_irqsave(&tfcp_req->reqlock, flags);
+ tfcp_req->aborted = true;
+- spin_unlock_irq(&tfcp_req->reqlock);
++ spin_unlock_irqrestore(&tfcp_req->reqlock, flags);
+
+ tfcp_req->status = NVME_SC_INTERNAL;
+
+@@ -946,6 +951,7 @@ fcloop_fcp_abort(struct nvme_fc_local_port *localport,
+ struct fcloop_ini_fcpreq *inireq = fcpreq->private;
+ struct fcloop_fcpreq *tfcp_req;
+ bool abortio = true;
++ unsigned long flags;
+
+ spin_lock(&inireq->inilock);
+ tfcp_req = inireq->tfcp_req;
+@@ -958,7 +964,7 @@ fcloop_fcp_abort(struct nvme_fc_local_port *localport,
+ return;
+
+ /* break initiator/target relationship for io */
+- spin_lock_irq(&tfcp_req->reqlock);
++ spin_lock_irqsave(&tfcp_req->reqlock, flags);
+ switch (tfcp_req->inistate) {
+ case INI_IO_START:
+ case INI_IO_ACTIVE:
+@@ -968,11 +974,11 @@ fcloop_fcp_abort(struct nvme_fc_local_port *localport,
+ abortio = false;
+ break;
+ default:
+- spin_unlock_irq(&tfcp_req->reqlock);
++ spin_unlock_irqrestore(&tfcp_req->reqlock, flags);
+ WARN_ON(1);
+ return;
+ }
+- spin_unlock_irq(&tfcp_req->reqlock);
++ spin_unlock_irqrestore(&tfcp_req->reqlock, flags);
+
+ if (abortio)
+ /* leave the reference while the work item is scheduled */
+--
+2.39.2
+
--- /dev/null
+From 74c66e94dd76fca6e6a646768c14ebd9e6b41046 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Apr 2023 14:57:20 -0700
+Subject: nvme: fix async event trace event
+
+From: Keith Busch <kbusch@kernel.org>
+
+[ Upstream commit 6622b76fe922b94189499a90ccdb714a4a8d0773 ]
+
+Mixing AER Event Type and Event Info has masking clashes. Just print the
+event type, but also include the event info of the AER result in the
+trace.
+
+Fixes: 09bd1ff4b15143b ("nvme-core: add async event trace helper")
+Reported-by: Nate Thornton <nate.thornton@samsung.com>
+Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
+Reviewed-by: Minwoo Im <minwoo.im@samsung.com>
+Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/core.c | 5 +----
+ drivers/nvme/host/trace.h | 15 ++++++---------
+ 2 files changed, 7 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index d6a9bac91a4cd..bdf1601219fc4 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -4819,8 +4819,6 @@ static bool nvme_handle_aen_notice(struct nvme_ctrl *ctrl, u32 result)
+ u32 aer_notice_type = nvme_aer_subtype(result);
+ bool requeue = true;
+
+- trace_nvme_async_event(ctrl, aer_notice_type);
+-
+ switch (aer_notice_type) {
+ case NVME_AER_NOTICE_NS_CHANGED:
+ set_bit(NVME_AER_NOTICE_NS_CHANGED, &ctrl->events);
+@@ -4856,7 +4854,6 @@ static bool nvme_handle_aen_notice(struct nvme_ctrl *ctrl, u32 result)
+
+ static void nvme_handle_aer_persistent_error(struct nvme_ctrl *ctrl)
+ {
+- trace_nvme_async_event(ctrl, NVME_AER_ERROR);
+ dev_warn(ctrl->device, "resetting controller due to AER\n");
+ nvme_reset_ctrl(ctrl);
+ }
+@@ -4872,6 +4869,7 @@ void nvme_complete_async_event(struct nvme_ctrl *ctrl, __le16 status,
+ if (le16_to_cpu(status) >> 1 != NVME_SC_SUCCESS)
+ return;
+
++ trace_nvme_async_event(ctrl, result);
+ switch (aer_type) {
+ case NVME_AER_NOTICE:
+ requeue = nvme_handle_aen_notice(ctrl, result);
+@@ -4889,7 +4887,6 @@ void nvme_complete_async_event(struct nvme_ctrl *ctrl, __le16 status,
+ case NVME_AER_SMART:
+ case NVME_AER_CSS:
+ case NVME_AER_VS:
+- trace_nvme_async_event(ctrl, aer_type);
+ ctrl->aen_result = result;
+ break;
+ default:
+diff --git a/drivers/nvme/host/trace.h b/drivers/nvme/host/trace.h
+index 6f0eaf6a15282..4fb5922ffdac5 100644
+--- a/drivers/nvme/host/trace.h
++++ b/drivers/nvme/host/trace.h
+@@ -127,15 +127,12 @@ TRACE_EVENT(nvme_async_event,
+ ),
+ TP_printk("nvme%d: NVME_AEN=%#08x [%s]",
+ __entry->ctrl_id, __entry->result,
+- __print_symbolic(__entry->result,
+- aer_name(NVME_AER_NOTICE_NS_CHANGED),
+- aer_name(NVME_AER_NOTICE_ANA),
+- aer_name(NVME_AER_NOTICE_FW_ACT_STARTING),
+- aer_name(NVME_AER_NOTICE_DISC_CHANGED),
+- aer_name(NVME_AER_ERROR),
+- aer_name(NVME_AER_SMART),
+- aer_name(NVME_AER_CSS),
+- aer_name(NVME_AER_VS))
++ __print_symbolic(__entry->result & 0x7,
++ aer_name(NVME_AER_ERROR),
++ aer_name(NVME_AER_SMART),
++ aer_name(NVME_AER_NOTICE),
++ aer_name(NVME_AER_CSS),
++ aer_name(NVME_AER_VS))
+ )
+ );
+
+--
+2.39.2
+
--- /dev/null
+From 6a7d8810f5a6bec5fa5839d1704c06503cc0e160 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Mar 2023 15:20:36 +0900
+Subject: nvmet: fix error handling in nvmet_execute_identify_cns_cs_ns()
+
+From: Damien Le Moal <damien.lemoal@opensource.wdc.com>
+
+[ Upstream commit ab76e7206b672b2e8818cb121a04506956d6b223 ]
+
+Nvme specifications state that:
+
+If the I/O Command Set associated with the namespace identified by the
+NSID field does not support the Identify Namespace data structure
+specified by the CSI field, the controller shall abort the command with
+a status code of Invalid Field in Command.
+
+In other words, if nvmet_execute_identify_cns_cs_ns() is called for a
+target with a block device that is not zoned, we should not return any
+data and set the status to NVME_SC_INVALID_FIELD.
+
+While at it, it is also better to revalidate the ns block devie *before*
+checking if the block device is zoned, to ensure that
+nvmet_execute_identify_cns_cs_ns() operates against updated device
+characteristics.
+
+Fixes: aaf2e048af27 ("nvmet: add ZBD over ZNS backend support")
+Signed-off-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
+Reviewed-by: Keith Busch <kbusch@kernel.org>
+Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
+Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/target/zns.c | 16 +++++++++-------
+ 1 file changed, 9 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/nvme/target/zns.c b/drivers/nvme/target/zns.c
+index 7e4292d88016c..77ef0a86ff61f 100644
+--- a/drivers/nvme/target/zns.c
++++ b/drivers/nvme/target/zns.c
+@@ -97,7 +97,7 @@ void nvmet_execute_identify_cns_cs_ctrl(struct nvmet_req *req)
+
+ void nvmet_execute_identify_cns_cs_ns(struct nvmet_req *req)
+ {
+- struct nvme_id_ns_zns *id_zns;
++ struct nvme_id_ns_zns *id_zns = NULL;
+ u64 zsze;
+ u16 status;
+ u32 mar, mor;
+@@ -118,16 +118,18 @@ void nvmet_execute_identify_cns_cs_ns(struct nvmet_req *req)
+ if (status)
+ goto done;
+
+- if (!bdev_is_zoned(req->ns->bdev)) {
+- req->error_loc = offsetof(struct nvme_identify, nsid);
+- goto done;
+- }
+-
+ if (nvmet_ns_revalidate(req->ns)) {
+ mutex_lock(&req->ns->subsys->lock);
+ nvmet_ns_changed(req->ns->subsys, req->ns->nsid);
+ mutex_unlock(&req->ns->subsys->lock);
+ }
++
++ if (!bdev_is_zoned(req->ns->bdev)) {
++ status = NVME_SC_INVALID_FIELD | NVME_SC_DNR;
++ req->error_loc = offsetof(struct nvme_identify, nsid);
++ goto out;
++ }
++
+ zsze = (bdev_zone_sectors(req->ns->bdev) << 9) >>
+ req->ns->blksize_shift;
+ id_zns->lbafe[0].zsze = cpu_to_le64(zsze);
+@@ -148,8 +150,8 @@ void nvmet_execute_identify_cns_cs_ns(struct nvmet_req *req)
+
+ done:
+ status = nvmet_copy_to_sgl(req, 0, id_zns, sizeof(*id_zns));
+- kfree(id_zns);
+ out:
++ kfree(id_zns);
+ nvmet_req_complete(req, status);
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 6453781d0869e7afe33cd7cfbd54efede317b69a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Mar 2023 19:59:38 +0900
+Subject: nvmet: fix I/O Command Set specific Identify Controller
+
+From: Damien Le Moal <damien.lemoal@opensource.wdc.com>
+
+[ Upstream commit a5a6ab0950b46ab1ef4a5c83c80234018b81b38a ]
+
+For an identify command with cns set to NVME_ID_CNS_CS_CTRL, the NVMe
+2.0 specification states that:
+
+If the I/O Command Set specified by the CSI field does not have an
+Identify Controller data structure, then the controller shall return
+a zero filled data structure. If the host requests a data structure for
+an I/O Command Set that the controller does not support, the controller
+shall abort the command with a status code of Invalid Field in Command.
+
+However, the current implementation of this identify command in
+nvmet_execute_identify() only handles the ZNS command set, returning an
+error for the NVM command set, which is not compliant with the
+specifications as we do support this command set.
+
+Fix this by:
+1) Renaming nvmet_execute_identify_cns_cs_ctrl() to
+ nvmet_execute_identify_ctrl_zns() to continue handling the
+ ZNS command set as is.
+2) Introduce a nvmet_execute_identify_ctrl_ns() helper to handle the
+ NVM command set, returning a zero filled nvme_id_ctrl_nvm data
+ structure.
+3) Modify nvmet_execute_identify() to call these helpers based on
+ the csi specified, returning an error for unsupported command sets.
+
+Fixes: aaf2e048af27 ("nvmet: add ZBD over ZNS backend support")
+Signed-off-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
+Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
+Tested-by: Chaitanya Kulkarni <kch@nvidia.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/target/admin-cmd.c | 22 ++++++++++++++++------
+ drivers/nvme/target/nvmet.h | 2 +-
+ drivers/nvme/target/zns.c | 2 +-
+ 3 files changed, 18 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/nvme/target/admin-cmd.c b/drivers/nvme/target/admin-cmd.c
+index 93c441ab9f090..5bfbf5c651db0 100644
+--- a/drivers/nvme/target/admin-cmd.c
++++ b/drivers/nvme/target/admin-cmd.c
+@@ -685,6 +685,13 @@ static bool nvmet_handle_identify_desclist(struct nvmet_req *req)
+ }
+ }
+
++static void nvmet_execute_identify_ctrl_nvm(struct nvmet_req *req)
++{
++ /* Not supported: return zeroes */
++ nvmet_req_complete(req,
++ nvmet_zero_sgl(req, 0, sizeof(struct nvme_id_ctrl_nvm)));
++}
++
+ static void nvmet_execute_identify(struct nvmet_req *req)
+ {
+ if (!nvmet_check_transfer_len(req, NVME_IDENTIFY_DATA_SIZE))
+@@ -708,13 +715,16 @@ static void nvmet_execute_identify(struct nvmet_req *req)
+ nvmet_execute_identify_ctrl(req);
+ return;
+ case NVME_ID_CNS_CS_CTRL:
+- if (IS_ENABLED(CONFIG_BLK_DEV_ZONED)) {
+- switch (req->cmd->identify.csi) {
+- case NVME_CSI_ZNS:
+- return nvmet_execute_identify_cns_cs_ctrl(req);
+- default:
+- break;
++ switch (req->cmd->identify.csi) {
++ case NVME_CSI_NVM:
++ nvmet_execute_identify_ctrl_nvm(req);
++ return;
++ case NVME_CSI_ZNS:
++ if (IS_ENABLED(CONFIG_BLK_DEV_ZONED)) {
++ nvmet_execute_identify_ctrl_zns(req);
++ return;
+ }
++ break;
+ }
+ break;
+ case NVME_ID_CNS_NS_ACTIVE_LIST:
+diff --git a/drivers/nvme/target/nvmet.h b/drivers/nvme/target/nvmet.h
+index 89bedfcd974c4..ed3786140965f 100644
+--- a/drivers/nvme/target/nvmet.h
++++ b/drivers/nvme/target/nvmet.h
+@@ -581,7 +581,7 @@ bool nvmet_ns_revalidate(struct nvmet_ns *ns);
+ u16 blk_to_nvme_status(struct nvmet_req *req, blk_status_t blk_sts);
+
+ bool nvmet_bdev_zns_enable(struct nvmet_ns *ns);
+-void nvmet_execute_identify_cns_cs_ctrl(struct nvmet_req *req);
++void nvmet_execute_identify_ctrl_zns(struct nvmet_req *req);
+ void nvmet_execute_identify_cns_cs_ns(struct nvmet_req *req);
+ void nvmet_bdev_execute_zone_mgmt_recv(struct nvmet_req *req);
+ void nvmet_bdev_execute_zone_mgmt_send(struct nvmet_req *req);
+diff --git a/drivers/nvme/target/zns.c b/drivers/nvme/target/zns.c
+index 77ef0a86ff61f..ae4d9d35e46ae 100644
+--- a/drivers/nvme/target/zns.c
++++ b/drivers/nvme/target/zns.c
+@@ -70,7 +70,7 @@ bool nvmet_bdev_zns_enable(struct nvmet_ns *ns)
+ return true;
+ }
+
+-void nvmet_execute_identify_cns_cs_ctrl(struct nvmet_req *req)
++void nvmet_execute_identify_ctrl_zns(struct nvmet_req *req)
+ {
+ u8 zasl = req->sq->ctrl->subsys->zasl;
+ struct nvmet_ctrl *ctrl = req->sq->ctrl;
+--
+2.39.2
+
--- /dev/null
+From 6529b12e9f4c785b29717bba851ebe9fb6d28feb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Mar 2023 19:59:37 +0900
+Subject: nvmet: fix Identify Active Namespace ID list handling
+
+From: Damien Le Moal <damien.lemoal@opensource.wdc.com>
+
+[ Upstream commit 97416f67d55fb8b866ff1815ca7ef26b6dfa6a5e ]
+
+The identify command with cns set to NVME_ID_CNS_NS_ACTIVE_LIST does
+not depend on the command set. The execution of this command should
+thus not look at the csi field specified in the command. Simplify
+nvmet_execute_identify() to directly call
+nvmet_execute_identify_nslist() without the csi switch-case.
+
+Fixes: ab5d0b38c047 ("nvmet: add Command Set Identifier support")
+Signed-off-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
+Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
+Tested-by: Chaitanya Kulkarni <kch@nvidia.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/target/admin-cmd.c | 9 ++-------
+ 1 file changed, 2 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/nvme/target/admin-cmd.c b/drivers/nvme/target/admin-cmd.c
+index a747c69074daf..93c441ab9f090 100644
+--- a/drivers/nvme/target/admin-cmd.c
++++ b/drivers/nvme/target/admin-cmd.c
+@@ -718,13 +718,8 @@ static void nvmet_execute_identify(struct nvmet_req *req)
+ }
+ break;
+ case NVME_ID_CNS_NS_ACTIVE_LIST:
+- switch (req->cmd->identify.csi) {
+- case NVME_CSI_NVM:
+- return nvmet_execute_identify_nslist(req);
+- default:
+- break;
+- }
+- break;
++ nvmet_execute_identify_nslist(req);
++ return;
+ case NVME_ID_CNS_NS_DESC_LIST:
+ if (nvmet_handle_identify_desclist(req) == true)
+ return;
+--
+2.39.2
+
--- /dev/null
+From 742902832cb97f17045c474462dab45a8e6c7fad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Mar 2023 19:59:36 +0900
+Subject: nvmet: fix Identify Controller handling
+
+From: Damien Le Moal <damien.lemoal@opensource.wdc.com>
+
+[ Upstream commit 62904b3b333e7f3c0f879dc3513295eee5765c9f ]
+
+The identify command with cns set to NVME_ID_CNS_CTRL does not depend on
+the command set. The execution of this command should thus not look at
+the csi specified in the command. Simplify nvmet_execute_identify() to
+directly call nvmet_execute_identify_ctrl() without the csi switch-case.
+
+Fixes: ab5d0b38c047 ("nvmet: add Command Set Identifier support")
+Signed-off-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
+Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
+Tested-by: Chaitanya Kulkarni <kch@nvidia.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/target/admin-cmd.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/nvme/target/admin-cmd.c b/drivers/nvme/target/admin-cmd.c
+index a982f925dfcef..a747c69074daf 100644
+--- a/drivers/nvme/target/admin-cmd.c
++++ b/drivers/nvme/target/admin-cmd.c
+@@ -705,11 +705,8 @@ static void nvmet_execute_identify(struct nvmet_req *req)
+ }
+ break;
+ case NVME_ID_CNS_CTRL:
+- switch (req->cmd->identify.csi) {
+- case NVME_CSI_NVM:
+- return nvmet_execute_identify_ctrl(req);
+- }
+- break;
++ nvmet_execute_identify_ctrl(req);
++ return;
+ case NVME_ID_CNS_CS_CTRL:
+ if (IS_ENABLED(CONFIG_BLK_DEV_ZONED)) {
+ switch (req->cmd->identify.csi) {
+--
+2.39.2
+
--- /dev/null
+From 6dd54560bb2f3b88cd486478c70efee8a0641dfa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Mar 2023 19:59:35 +0900
+Subject: nvmet: fix Identify Namespace handling
+
+From: Damien Le Moal <damien.lemoal@opensource.wdc.com>
+
+[ Upstream commit 8c098aa00118c35108f0c19bd3cdc45e11574948 ]
+
+The identify command with cns set to NVME_ID_CNS_NS does not directly
+depend on the command set. The NVMe specifications is rather confusing
+here as it appears that this command only applies to the NVM command
+set. However, footnote 8 of Figure 273 in the NVMe 2.0 base
+specifications clearly state that this command applies to NVM command
+sets that support logical blocks, that is, NVM and ZNS. Both the NVM and
+ZNS command set specifications also list this identify as mandatory.
+
+The command handling should thus not look at the csi field since it is
+defined as unused for this command. Given that we do not support the
+KV command set, simply remove the csi switch-case for that command
+handling and call directly nvmet_execute_identify_ns() in
+nvmet_execute_identify().
+
+Fixes: ab5d0b38c047 ("nvmet: add Command Set Identifier support")
+Signed-off-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
+Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
+Tested-by: Chaitanya Kulkarni <kch@nvidia.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/target/admin-cmd.c | 9 ++-------
+ 1 file changed, 2 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/nvme/target/admin-cmd.c b/drivers/nvme/target/admin-cmd.c
+index 80099df37314a..a982f925dfcef 100644
+--- a/drivers/nvme/target/admin-cmd.c
++++ b/drivers/nvme/target/admin-cmd.c
+@@ -692,13 +692,8 @@ static void nvmet_execute_identify(struct nvmet_req *req)
+
+ switch (req->cmd->identify.cns) {
+ case NVME_ID_CNS_NS:
+- switch (req->cmd->identify.csi) {
+- case NVME_CSI_NVM:
+- return nvmet_execute_identify_ns(req);
+- default:
+- break;
+- }
+- break;
++ nvmet_execute_identify_ns(req);
++ return;
+ case NVME_ID_CNS_CS_NS:
+ if (IS_ENABLED(CONFIG_BLK_DEV_ZONED)) {
+ switch (req->cmd->identify.csi) {
+--
+2.39.2
+
--- /dev/null
+From 3c1abf804f07fe7416907fdda7a7183444103471 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Apr 2023 18:21:09 +0100
+Subject: of: Fix modalias string generation
+
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+
+[ Upstream commit b19a4266c52de78496fe40f0b37580a3b762e67d ]
+
+The helper generating an OF based modalias (of_device_get_modalias())
+works fine, but due to the use of snprintf() internally it needs a
+buffer one byte longer than what should be needed just for the entire
+string (excluding the '\0'). Most users of this helper are sysfs hooks
+providing the modalias string to users. They all provide a PAGE_SIZE
+buffer which is way above the number of bytes required to fit the
+modalias string and hence do not suffer from this issue.
+
+There is another user though, of_device_request_module(), which is only
+called by drivers/usb/common/ulpi.c. This request module function is
+faulty, but maybe because in most cases there is an alternative, ULPI
+driver users have not noticed it.
+
+In this function, of_device_get_modalias() is called twice. The first
+time without buffer just to get the number of bytes required by the
+modalias string (excluding the null byte), and a second time, after
+buffer allocation, to fill the buffer. The allocation asks for an
+additional byte, in order to store the trailing '\0'. However, the
+buffer *length* provided to of_device_get_modalias() excludes this extra
+byte. The internal use of snprintf() with a length that is exactly the
+number of bytes to be written has the effect of using the last available
+byte to store a '\0', which then smashes the last character of the
+modalias string.
+
+Provide the actual size of the buffer to of_device_get_modalias() to fix
+this issue.
+
+Note: the "str[size - 1] = '\0';" line is not really needed as snprintf
+will anyway end the string with a null byte, but there is a possibility
+that this function might be called on a struct device_node without
+compatible, in this case snprintf() would not be executed. So we keep it
+just to avoid possible unbounded strings.
+
+Cc: Stephen Boyd <sboyd@kernel.org>
+Cc: Peter Chen <peter.chen@kernel.org>
+Fixes: 9c829c097f2f ("of: device: Support loading a module with OF based modalias")
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Reviewed-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230404172148.82422-2-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/of/device.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/of/device.c b/drivers/of/device.c
+index 955bfb3d1a834..c91bb58992567 100644
+--- a/drivers/of/device.c
++++ b/drivers/of/device.c
+@@ -297,12 +297,15 @@ int of_device_request_module(struct device *dev)
+ if (size < 0)
+ return size;
+
+- str = kmalloc(size + 1, GFP_KERNEL);
++ /* Reserve an additional byte for the trailing '\0' */
++ size++;
++
++ str = kmalloc(size, GFP_KERNEL);
+ if (!str)
+ return -ENOMEM;
+
+ of_device_get_modalias(dev, str, size);
+- str[size] = '\0';
++ str[size - 1] = '\0';
+ ret = request_module(str);
+ kfree(str);
+
+--
+2.39.2
+
--- /dev/null
+From d21d09b4927d11c6ad3b9ba08f76d21eb4112764 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 11 Feb 2023 19:14:06 +0900
+Subject: openrisc: Properly store r31 to pt_regs on unhandled exceptions
+
+From: Stafford Horne <shorne@gmail.com>
+
+[ Upstream commit 812489ac4dd91144a74ce65ecf232252a2e406fb ]
+
+In commit 91993c8c2ed5 ("openrisc: use shadow registers to save regs on
+exception") the unhandled exception path was changed to do an early
+store of r30 instead of r31. The entry code was not updated and r31 is
+not getting stored to pt_regs.
+
+This patch updates the entry handler to store r31 instead of r30. We
+also remove some misleading commented out store r30 and r31
+instructrions.
+
+I noticed this while working on adding floating point exception
+handling, This issue probably would never impact anything since we kill
+the process or Oops right away on unhandled exceptions.
+
+Fixes: 91993c8c2ed5 ("openrisc: use shadow registers to save regs on exception")
+Signed-off-by: Stafford Horne <shorne@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/openrisc/kernel/entry.S | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/arch/openrisc/kernel/entry.S b/arch/openrisc/kernel/entry.S
+index 54a87bba35caa..a130c4dac48d3 100644
+--- a/arch/openrisc/kernel/entry.S
++++ b/arch/openrisc/kernel/entry.S
+@@ -173,7 +173,6 @@ handler: ;\
+ l.sw PT_GPR28(r1),r28 ;\
+ l.sw PT_GPR29(r1),r29 ;\
+ /* r30 already save */ ;\
+-/* l.sw PT_GPR30(r1),r30*/ ;\
+ l.sw PT_GPR31(r1),r31 ;\
+ TRACE_IRQS_OFF_ENTRY ;\
+ /* Store -1 in orig_gpr11 for non-syscall exceptions */ ;\
+@@ -211,9 +210,8 @@ handler: ;\
+ l.sw PT_GPR27(r1),r27 ;\
+ l.sw PT_GPR28(r1),r28 ;\
+ l.sw PT_GPR29(r1),r29 ;\
+- /* r31 already saved */ ;\
+- l.sw PT_GPR30(r1),r30 ;\
+-/* l.sw PT_GPR31(r1),r31 */ ;\
++ /* r30 already saved */ ;\
++ l.sw PT_GPR31(r1),r31 ;\
+ /* Store -1 in orig_gpr11 for non-syscall exceptions */ ;\
+ l.addi r30,r0,-1 ;\
+ l.sw PT_ORIG_GPR11(r1),r30 ;\
+--
+2.39.2
+
--- /dev/null
+From 0c0d88e13b15fa2d47d80ddb2687ae267ce2a366 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Mar 2023 16:54:49 -0700
+Subject: PCI/EDR: Clear Device Status after EDR error recovery
+
+From: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
+
+[ Upstream commit c441b1e03da6c680a3e12da59c554f454f2ccf5e ]
+
+During EDR recovery, the OS must clear error status of the port that
+triggered DPC even if firmware retains control of DPC and AER (see the
+implementation note in the PCI Firmware spec r3.3, sec 4.6.12).
+
+Prior to 068c29a248b6 ("PCI/ERR: Clear PCIe Device Status errors only if
+OS owns AER"), the port Device Status was cleared in this path:
+
+ edr_handle_event
+ dpc_process_error(dev) # "dev" triggered DPC
+ pcie_do_recovery(dev, dpc_reset_link)
+ dpc_reset_link # exit DPC
+ pcie_clear_device_status(dev) # clear Device Status
+
+After 068c29a248b6, pcie_do_recovery() no longer clears Device Status when
+firmware controls AER, so the error bit remains set even after recovery.
+
+Per the "Downstream Port Containment configuration control" bit in the
+returned _OSC Control Field (sec 4.5.1), the OS is allowed to clear error
+status until it evaluates _OST, so clear Device Status in
+edr_handle_event() if the error recovery was successful.
+
+[bhelgaas: commit log]
+Fixes: 068c29a248b6 ("PCI/ERR: Clear PCIe Device Status errors only if OS owns AER")
+Link: https://lore.kernel.org/r/20230315235449.1279209-1-sathyanarayanan.kuppuswamy@linux.intel.com
+Reported-by: Tsaur Erwin <erwin.tsaur@intel.com>
+Signed-off-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pcie/edr.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/pci/pcie/edr.c b/drivers/pci/pcie/edr.c
+index a6b9b479b97ad..87734e4c3c204 100644
+--- a/drivers/pci/pcie/edr.c
++++ b/drivers/pci/pcie/edr.c
+@@ -193,6 +193,7 @@ static void edr_handle_event(acpi_handle handle, u32 event, void *data)
+ */
+ if (estate == PCI_ERS_RESULT_RECOVERED) {
+ pci_dbg(edev, "DPC port successfully recovered\n");
++ pcie_clear_device_status(edev);
+ acpi_send_edr_status(pdev, edev, EDR_OST_SUCCESS);
+ } else {
+ pci_dbg(edev, "DPC port recovery failed\n");
+--
+2.39.2
+
--- /dev/null
+From 8a893c473385d68fa771b9533f80a9cc06e49b9b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Mar 2023 17:56:31 +0100
+Subject: PCI: imx6: Install the fault handler only on compatible match
+
+From: H. Nikolaus Schaller <hns@goldelico.com>
+
+[ Upstream commit 5f5ac460dfe7f4e11f99de9870f240e39189cf72 ]
+
+commit bb38919ec56e ("PCI: imx6: Add support for i.MX6 PCIe controller")
+added a fault hook to this driver in the probe function. So it was only
+installed if needed.
+
+commit bde4a5a00e76 ("PCI: imx6: Allow probe deferral by reset GPIO")
+moved it from probe to driver init which installs the hook unconditionally
+as soon as the driver is compiled into a kernel.
+
+When this driver is compiled as a module, the hook is not registered
+until after the driver has been matched with a .compatible and
+loaded.
+
+commit 415b6185c541 ("PCI: imx6: Fix config read timeout handling")
+extended the fault handling code.
+
+commit 2d8ed461dbc9 ("PCI: imx6: Add support for i.MX8MQ")
+added some protection for non-ARM architectures, but this does not
+protect non-i.MX ARM architectures.
+
+Since fault handlers can be triggered on any architecture for different
+reasons, there is no guarantee that they will be triggered only for the
+assumed situation, leading to improper error handling (i.MX6-specific
+imx6q_pcie_abort_handler) on foreign systems.
+
+I had seen strange L3 imprecise external abort messages several times on
+OMAP4 and OMAP5 devices and couldn't make sense of them until I realized
+they were related to this unused imx6q driver because I had
+CONFIG_PCI_IMX6=y.
+
+Note that CONFIG_PCI_IMX6=y is useful for kernel binaries that are designed
+to run on different ARM SoC and be differentiated only by device tree
+binaries. So turning off CONFIG_PCI_IMX6 is not a solution.
+
+Therefore we check the compatible in the init function before registering
+the fault handler.
+
+Link: https://lore.kernel.org/r/e1bcfc3078c82b53aa9b78077a89955abe4ea009.1678380991.git.hns@goldelico.com
+Fixes: bde4a5a00e76 ("PCI: imx6: Allow probe deferral by reset GPIO")
+Fixes: 415b6185c541 ("PCI: imx6: Fix config read timeout handling")
+Fixes: 2d8ed461dbc9 ("PCI: imx6: Add support for i.MX8MQ")
+Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
+Signed-off-by: Lorenzo Pieralisi <lpieralisi@kernel.org>
+Reviewed-by: Richard Zhu <hongxing.zhu@nxp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/dwc/pci-imx6.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/pci/controller/dwc/pci-imx6.c b/drivers/pci/controller/dwc/pci-imx6.c
+index 55a0405b921d6..52906f999f2bb 100644
+--- a/drivers/pci/controller/dwc/pci-imx6.c
++++ b/drivers/pci/controller/dwc/pci-imx6.c
+@@ -1566,6 +1566,13 @@ DECLARE_PCI_FIXUP_CLASS_HEADER(PCI_VENDOR_ID_SYNOPSYS, 0xabcd,
+ static int __init imx6_pcie_init(void)
+ {
+ #ifdef CONFIG_ARM
++ struct device_node *np;
++
++ np = of_find_matching_node(NULL, imx6_pcie_of_match);
++ if (!np)
++ return -ENODEV;
++ of_node_put(np);
++
+ /*
+ * Since probe() can be deferred we need to make sure that
+ * hook_fault_code is not called after __init memory is freed
+--
+2.39.2
+
--- /dev/null
+From 1d85844e8c2e76234ca974b7feddce3b149cf5f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Apr 2023 13:40:42 -0600
+Subject: PCI/PM: Extend D3hot delay for NVIDIA HDA controllers
+
+From: Alex Williamson <alex.williamson@redhat.com>
+
+[ Upstream commit a5a6dd2624698b6e3045c3a1450874d8c790d5d9 ]
+
+Assignment of NVIDIA Ampere-based GPUs have seen a regression since the
+below referenced commit, where the reduced D3hot transition delay appears
+to introduce a small window where a D3hot->D0 transition followed by a bus
+reset can wedge the device. The entire device is subsequently unavailable,
+returning -1 on config space read and is unrecoverable without a host
+reset.
+
+This has been observed with RTX A2000 and A5000 GPU and audio functions
+assigned to a Windows VM, where shutdown of the VM places the devices in
+D3hot prior to vfio-pci performing a bus reset when userspace releases the
+devices. The issue has roughly a 2-3% chance of occurring per shutdown.
+
+Restoring the HDA controller d3hot_delay to the effective value before the
+below commit has been shown to resolve the issue. NVIDIA confirms this
+change should be safe for all of their HDA controllers.
+
+Fixes: 3e347969a577 ("PCI/PM: Reduce D3hot delay with usleep_range()")
+Link: https://lore.kernel.org/r/20230413194042.605768-1-alex.williamson@redhat.com
+Reported-by: Zhiyi Guo <zhguo@redhat.com>
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Tarun Gupta <targupta@nvidia.com>
+Cc: Abhishek Sahu <abhsahu@nvidia.com>
+Cc: Tarun Gupta <targupta@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/quirks.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 44cab813bf951..f4e2a88729fd1 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -1939,6 +1939,19 @@ static void quirk_radeon_pm(struct pci_dev *dev)
+ }
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x6741, quirk_radeon_pm);
+
++/*
++ * NVIDIA Ampere-based HDA controllers can wedge the whole device if a bus
++ * reset is performed too soon after transition to D0, extend d3hot_delay
++ * to previous effective default for all NVIDIA HDA controllers.
++ */
++static void quirk_nvidia_hda_pm(struct pci_dev *dev)
++{
++ quirk_d3hot_delay(dev, 20);
++}
++DECLARE_PCI_FIXUP_CLASS_FINAL(PCI_VENDOR_ID_NVIDIA, PCI_ANY_ID,
++ PCI_CLASS_MULTIMEDIA_HD_AUDIO, 8,
++ quirk_nvidia_hda_pm);
++
+ /*
+ * Ryzen5/7 XHCI controllers fail upon resume from runtime suspend or s2idle.
+ * https://bugzilla.kernel.org/show_bug.cgi?id=205587
+--
+2.39.2
+
--- /dev/null
+From e27a8b80eb2c201e7a23eb8aff7c4bd3588f7e4c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Feb 2023 19:54:01 +0800
+Subject: perf/amlogic: Fix config1/config2 parsing issue
+
+From: Jiucheng Xu <jiucheng.xu@amlogic.com>
+
+[ Upstream commit c61e5720f23273269cc67ffb2908cf9831c8ca9d ]
+
+The 3th argument of for_each_set_bit is incorrect, fix them.
+
+Fixes: 2016e2113d35 ("perf/amlogic: Add support for Amlogic meson G12 SoC DDR PMU driver")
+Signed-off-by: Jiucheng Xu <jiucheng.xu@amlogic.com>
+Link: https://lore.kernel.org/r/20230209115403.521868-1-jiucheng.xu@amlogic.com
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/perf/amlogic/meson_ddr_pmu_core.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/perf/amlogic/meson_ddr_pmu_core.c b/drivers/perf/amlogic/meson_ddr_pmu_core.c
+index b84346dbac2ce..0b24dee1ed3cf 100644
+--- a/drivers/perf/amlogic/meson_ddr_pmu_core.c
++++ b/drivers/perf/amlogic/meson_ddr_pmu_core.c
+@@ -156,10 +156,14 @@ static int meson_ddr_perf_event_add(struct perf_event *event, int flags)
+ u64 config2 = event->attr.config2;
+ int i;
+
+- for_each_set_bit(i, (const unsigned long *)&config1, sizeof(config1))
++ for_each_set_bit(i,
++ (const unsigned long *)&config1,
++ BITS_PER_TYPE(config1))
+ meson_ddr_set_axi_filter(event, i);
+
+- for_each_set_bit(i, (const unsigned long *)&config2, sizeof(config2))
++ for_each_set_bit(i,
++ (const unsigned long *)&config2,
++ BITS_PER_TYPE(config2))
+ meson_ddr_set_axi_filter(event, i + 64);
+
+ if (flags & PERF_EF_START)
+--
+2.39.2
+
--- /dev/null
+From b8895db309a1fee3340524df92352293a6eb369f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Apr 2023 11:29:40 +0100
+Subject: perf/arm-cmn: Fix port detection for CMN-700
+
+From: Robin Murphy <robin.murphy@arm.com>
+
+[ Upstream commit 2ad91e44e6b0c7ef1ed151b3bb2242a2144e6085 ]
+
+When the "extra device ports" configuration was first added, the
+additional mxp_device_port_connect_info registers were added around the
+existing mxp_mesh_port_connect_info registers. What I missed about
+CMN-700 is that it shuffled them around to remove this discontinuity.
+As such, tweak the definitions and factor out a helper for reading these
+registers so we can deal with this discrepancy easily, which does at
+least allow nicely tidying up the callsites. With this we can then also
+do the nice thing and skip accesses completely rather than relying on
+RES0 behaviour where we know the extra registers aren't defined.
+
+Fixes: 23760a014417 ("perf/arm-cmn: Add CMN-700 support")
+Reported-by: Jing Zhang <renyu.zj@linux.alibaba.com>
+Signed-off-by: Robin Murphy <robin.murphy@arm.com>
+Link: https://lore.kernel.org/r/71d129241d4d7923cde72a0e5b4c8d2f6084525f.1681295193.git.robin.murphy@arm.com
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/perf/arm-cmn.c | 57 ++++++++++++++++++++++--------------------
+ 1 file changed, 30 insertions(+), 27 deletions(-)
+
+diff --git a/drivers/perf/arm-cmn.c b/drivers/perf/arm-cmn.c
+index 9f2edc28d16ef..44b719f39c3b3 100644
+--- a/drivers/perf/arm-cmn.c
++++ b/drivers/perf/arm-cmn.c
+@@ -57,14 +57,12 @@
+ #define CMN_INFO_REQ_VC_NUM GENMASK_ULL(1, 0)
+
+ /* XPs also have some local topology info which has uses too */
+-#define CMN_MXP__CONNECT_INFO_P0 0x0008
+-#define CMN_MXP__CONNECT_INFO_P1 0x0010
+-#define CMN_MXP__CONNECT_INFO_P2 0x0028
+-#define CMN_MXP__CONNECT_INFO_P3 0x0030
+-#define CMN_MXP__CONNECT_INFO_P4 0x0038
+-#define CMN_MXP__CONNECT_INFO_P5 0x0040
++#define CMN_MXP__CONNECT_INFO(p) (0x0008 + 8 * (p))
+ #define CMN__CONNECT_INFO_DEVICE_TYPE GENMASK_ULL(4, 0)
+
++#define CMN_MAX_PORTS 6
++#define CI700_CONNECT_INFO_P2_5_OFFSET 0x10
++
+ /* PMU registers occupy the 3rd 4KB page of each node's region */
+ #define CMN_PMU_OFFSET 0x2000
+
+@@ -396,6 +394,25 @@ static struct arm_cmn_node *arm_cmn_node(const struct arm_cmn *cmn,
+ return NULL;
+ }
+
++static u32 arm_cmn_device_connect_info(const struct arm_cmn *cmn,
++ const struct arm_cmn_node *xp, int port)
++{
++ int offset = CMN_MXP__CONNECT_INFO(port);
++
++ if (port >= 2) {
++ if (cmn->model & (CMN600 | CMN650))
++ return 0;
++ /*
++ * CI-700 may have extra ports, but still has the
++ * mesh_port_connect_info registers in the way.
++ */
++ if (cmn->model == CI700)
++ offset += CI700_CONNECT_INFO_P2_5_OFFSET;
++ }
++
++ return readl_relaxed(xp->pmu_base - CMN_PMU_OFFSET + offset);
++}
++
+ static struct dentry *arm_cmn_debugfs;
+
+ #ifdef CONFIG_DEBUG_FS
+@@ -469,7 +486,7 @@ static int arm_cmn_map_show(struct seq_file *s, void *data)
+ y = cmn->mesh_y;
+ while (y--) {
+ int xp_base = cmn->mesh_x * y;
+- u8 port[6][CMN_MAX_DIMENSION];
++ u8 port[CMN_MAX_PORTS][CMN_MAX_DIMENSION];
+
+ for (x = 0; x < cmn->mesh_x; x++)
+ seq_puts(s, "--------+");
+@@ -477,14 +494,9 @@ static int arm_cmn_map_show(struct seq_file *s, void *data)
+ seq_printf(s, "\n%d |", y);
+ for (x = 0; x < cmn->mesh_x; x++) {
+ struct arm_cmn_node *xp = cmn->xps + xp_base + x;
+- void __iomem *base = xp->pmu_base - CMN_PMU_OFFSET;
+-
+- port[0][x] = readl_relaxed(base + CMN_MXP__CONNECT_INFO_P0);
+- port[1][x] = readl_relaxed(base + CMN_MXP__CONNECT_INFO_P1);
+- port[2][x] = readl_relaxed(base + CMN_MXP__CONNECT_INFO_P2);
+- port[3][x] = readl_relaxed(base + CMN_MXP__CONNECT_INFO_P3);
+- port[4][x] = readl_relaxed(base + CMN_MXP__CONNECT_INFO_P4);
+- port[5][x] = readl_relaxed(base + CMN_MXP__CONNECT_INFO_P5);
++
++ for (p = 0; p < CMN_MAX_PORTS; p++)
++ port[p][x] = arm_cmn_device_connect_info(cmn, xp, p);
+ seq_printf(s, " XP #%-2d |", xp_base + x);
+ }
+
+@@ -2083,18 +2095,9 @@ static int arm_cmn_discover(struct arm_cmn *cmn, unsigned int rgn_offset)
+ * from this, since in that case we will see at least one XP
+ * with port 2 connected, for the HN-D.
+ */
+- if (readq_relaxed(xp_region + CMN_MXP__CONNECT_INFO_P0))
+- xp_ports |= BIT(0);
+- if (readq_relaxed(xp_region + CMN_MXP__CONNECT_INFO_P1))
+- xp_ports |= BIT(1);
+- if (readq_relaxed(xp_region + CMN_MXP__CONNECT_INFO_P2))
+- xp_ports |= BIT(2);
+- if (readq_relaxed(xp_region + CMN_MXP__CONNECT_INFO_P3))
+- xp_ports |= BIT(3);
+- if (readq_relaxed(xp_region + CMN_MXP__CONNECT_INFO_P4))
+- xp_ports |= BIT(4);
+- if (readq_relaxed(xp_region + CMN_MXP__CONNECT_INFO_P5))
+- xp_ports |= BIT(5);
++ for (int p = 0; p < CMN_MAX_PORTS; p++)
++ if (arm_cmn_device_connect_info(cmn, xp, p))
++ xp_ports |= BIT(p);
+
+ if (cmn->multi_dtm && (xp_ports & 0xc))
+ arm_cmn_init_dtm(dtm++, xp, 1);
+--
+2.39.2
+
--- /dev/null
+From 3b4d8dee5dc2b3864f572a243b2ebfc550a7075d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Mar 2023 09:55:40 -0800
+Subject: perf/arm-cmn: Move overlapping wp_combine field
+
+From: Ilkka Koskinen <ilkka@os.amperecomputing.com>
+
+[ Upstream commit f87e9114b5e590c2c6658ca21d7b714ca240bdd0 ]
+
+As eventid field was expanded to support new mesh versions, it started to
+overlap with wp_combine field. Move wp_combine to fix the issue.
+
+Fixes: 23760a014417 ("perf/arm-cmn: Add CMN-700 support")
+Signed-off-by: Ilkka Koskinen <ilkka@os.amperecomputing.com>
+Link: https://lore.kernel.org/r/20230301175540.19891-1-ilkka@os.amperecomputing.com
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/perf/arm-cmn.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/perf/arm-cmn.c b/drivers/perf/arm-cmn.c
+index c9689861be3fa..9f2edc28d16ef 100644
+--- a/drivers/perf/arm-cmn.c
++++ b/drivers/perf/arm-cmn.c
+@@ -166,7 +166,7 @@
+ #define CMN_EVENT_BYNODEID(event) FIELD_GET(CMN_CONFIG_BYNODEID, (event)->attr.config)
+ #define CMN_EVENT_NODEID(event) FIELD_GET(CMN_CONFIG_NODEID, (event)->attr.config)
+
+-#define CMN_CONFIG_WP_COMBINE GENMASK_ULL(27, 24)
++#define CMN_CONFIG_WP_COMBINE GENMASK_ULL(30, 27)
+ #define CMN_CONFIG_WP_DEV_SEL GENMASK_ULL(50, 48)
+ #define CMN_CONFIG_WP_CHN_SEL GENMASK_ULL(55, 51)
+ /* Note that we don't yet support the tertiary match group on newer IPs */
+--
+2.39.2
+
--- /dev/null
+From c5845c2b17f31db67aefe12dd9eee7d79cd1e4d2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Feb 2023 10:35:08 +0800
+Subject: perf/core: Fix hardlockup failure caused by perf throttle
+
+From: Yang Jihong <yangjihong1@huawei.com>
+
+[ Upstream commit 15def34e2635ab7e0e96f1bc32e1b69609f14942 ]
+
+commit e050e3f0a71bf ("perf: Fix broken interrupt rate throttling")
+introduces a change in throttling threshold judgment. Before this,
+compare hwc->interrupts and max_samples_per_tick, then increase
+hwc->interrupts by 1, but this commit reverses order of these two
+behaviors, causing the semantics of max_samples_per_tick to change.
+In literal sense of "max_samples_per_tick", if hwc->interrupts ==
+max_samples_per_tick, it should not be throttled, therefore, the judgment
+condition should be changed to "hwc->interrupts > max_samples_per_tick".
+
+In fact, this may cause the hardlockup to fail, The minimum value of
+max_samples_per_tick may be 1, in this case, the return value of
+__perf_event_account_interrupt function is 1.
+As a result, nmi_watchdog gets throttled, which would stop PMU (Use x86
+architecture as an example, see x86_pmu_handle_irq).
+
+Fixes: e050e3f0a71b ("perf: Fix broken interrupt rate throttling")
+Signed-off-by: Yang Jihong <yangjihong1@huawei.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://lkml.kernel.org/r/20230227023508.102230-1-yangjihong1@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/events/core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index 435815d3be3f8..68baa8194d9f8 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -9433,8 +9433,8 @@ __perf_event_account_interrupt(struct perf_event *event, int throttle)
+ hwc->interrupts = 1;
+ } else {
+ hwc->interrupts++;
+- if (unlikely(throttle
+- && hwc->interrupts >= max_samples_per_tick)) {
++ if (unlikely(throttle &&
++ hwc->interrupts > max_samples_per_tick)) {
+ __this_cpu_inc(perf_throttled_count);
+ tick_dep_set_cpu(smp_processor_id(), TICK_DEP_BIT_PERF_EVENTS);
+ hwc->interrupts = MAX_INTERRUPTS;
+--
+2.39.2
+
--- /dev/null
+From 280b16156c3b2f0e65ddcbcf52cbe8b68e78d2f3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Nov 2022 19:16:34 +0800
+Subject: phy: tegra: xusb: Add missing tegra_xusb_port_unregister for
+ usb2_port and ulpi_port
+
+From: Gaosheng Cui <cuigaosheng1@huawei.com>
+
+[ Upstream commit e024854048e733391b31fe5a398704b31b9af803 ]
+
+The tegra_xusb_port_unregister should be called when usb2_port
+and ulpi_port map fails in tegra_xusb_add_usb2_port() or in
+tegra_xusb_add_ulpi_port(), fix it.
+
+Fixes: 53d2a715c240 ("phy: Add Tegra XUSB pad controller support")
+Signed-off-by: Gaosheng Cui <cuigaosheng1@huawei.com>
+Acked-by: Thierry Reding <treding@nvidia.com>
+Link: https://lore.kernel.org/r/20221129111634.1547747-1-cuigaosheng1@huawei.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/tegra/xusb.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/phy/tegra/xusb.c b/drivers/phy/tegra/xusb.c
+index 78045bd6c2140..a90aea33e06ac 100644
+--- a/drivers/phy/tegra/xusb.c
++++ b/drivers/phy/tegra/xusb.c
+@@ -805,6 +805,7 @@ static int tegra_xusb_add_usb2_port(struct tegra_xusb_padctl *padctl,
+ usb2->base.lane = usb2->base.ops->map(&usb2->base);
+ if (IS_ERR(usb2->base.lane)) {
+ err = PTR_ERR(usb2->base.lane);
++ tegra_xusb_port_unregister(&usb2->base);
+ goto out;
+ }
+
+@@ -871,6 +872,7 @@ static int tegra_xusb_add_ulpi_port(struct tegra_xusb_padctl *padctl,
+ ulpi->base.lane = ulpi->base.ops->map(&ulpi->base);
+ if (IS_ERR(ulpi->base.lane)) {
+ err = PTR_ERR(ulpi->base.lane);
++ tegra_xusb_port_unregister(&ulpi->base);
+ goto out;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From fca16302bda63f9059520402cd0441140de343e6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Apr 2023 15:15:52 +0530
+Subject: phy: ti: j721e-wiz: Fix unreachable code in wiz_mode_select()
+
+From: Siddharth Vadapalli <s-vadapalli@ti.com>
+
+[ Upstream commit 57c0e1362fdd57d0cea7ab1e583b58abf4bd8c2d ]
+
+In the wiz_mode_select() function, the configuration performed for
+PHY_TYPE_USXGMII is unreachable. Fix it.
+
+Fixes: b64a85fb8f53 ("phy: ti: phy-j721e-wiz.c: Add usxgmii support in wiz driver")
+Signed-off-by: Siddharth Vadapalli <s-vadapalli@ti.com>
+Reviewed-by: Roger Quadros <rogerq@kernel.org>
+Link: https://lore.kernel.org/r/20230403094552.929108-1-s-vadapalli@ti.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/ti/phy-j721e-wiz.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/phy/ti/phy-j721e-wiz.c b/drivers/phy/ti/phy-j721e-wiz.c
+index 1b83c98a78f0f..1b5f1a5e2b3ba 100644
+--- a/drivers/phy/ti/phy-j721e-wiz.c
++++ b/drivers/phy/ti/phy-j721e-wiz.c
+@@ -443,18 +443,17 @@ static int wiz_mode_select(struct wiz *wiz)
+ int i;
+
+ for (i = 0; i < num_lanes; i++) {
+- if (wiz->lane_phy_type[i] == PHY_TYPE_DP)
++ if (wiz->lane_phy_type[i] == PHY_TYPE_DP) {
+ mode = LANE_MODE_GEN1;
+- else if (wiz->lane_phy_type[i] == PHY_TYPE_QSGMII)
++ } else if (wiz->lane_phy_type[i] == PHY_TYPE_QSGMII) {
+ mode = LANE_MODE_GEN2;
+- else
+- continue;
+-
+- if (wiz->lane_phy_type[i] == PHY_TYPE_USXGMII) {
++ } else if (wiz->lane_phy_type[i] == PHY_TYPE_USXGMII) {
+ ret = regmap_field_write(wiz->p0_mac_src_sel[i], 0x3);
+ ret = regmap_field_write(wiz->p0_rxfclk_sel[i], 0x3);
+ ret = regmap_field_write(wiz->p0_refclk_sel[i], 0x3);
+ mode = LANE_MODE_GEN1;
++ } else {
++ continue;
+ }
+
+ ret = regmap_field_write(wiz->p_standard_mode[i], mode);
+--
+2.39.2
+
--- /dev/null
+From 9830cf948a9196ab87c663771e7453dda8724b57 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Apr 2023 14:47:05 +0200
+Subject: pinctrl-bcm2835.c: fix race condition when setting gpio dir
+
+From: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+
+[ Upstream commit b7badd752de05312fdb1aeb388480f706d0c087f ]
+
+In the past setting the pin direction called pinctrl_gpio_direction()
+which uses a mutex to serialize this. That was changed to set the
+direction directly in the pin controller driver, but that lost the
+serialization mechanism. Since the direction of multiple pins are in
+the same register you can have a race condition, something that was
+in fact observed with the cec-gpio driver.
+
+Add a new spinlock to serialize writing to the FSEL registers.
+
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Fixes: 1a4541b68e25 ("pinctrl-bcm2835: don't call pinctrl_gpio_direction()")
+Link: https://lore.kernel.org/r/4302b66b-ca20-0f19-d2aa-ee8661118863@xs4all.nl
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/bcm/pinctrl-bcm2835.c | 19 +++++++++++++++----
+ 1 file changed, 15 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/pinctrl/bcm/pinctrl-bcm2835.c b/drivers/pinctrl/bcm/pinctrl-bcm2835.c
+index 8e2551a08c372..7435173e10f43 100644
+--- a/drivers/pinctrl/bcm/pinctrl-bcm2835.c
++++ b/drivers/pinctrl/bcm/pinctrl-bcm2835.c
+@@ -90,6 +90,8 @@ struct bcm2835_pinctrl {
+ struct pinctrl_gpio_range gpio_range;
+
+ raw_spinlock_t irq_lock[BCM2835_NUM_BANKS];
++ /* Protect FSEL registers */
++ spinlock_t fsel_lock;
+ };
+
+ /* pins are just named GPIO0..GPIO53 */
+@@ -284,14 +286,19 @@ static inline void bcm2835_pinctrl_fsel_set(
+ struct bcm2835_pinctrl *pc, unsigned pin,
+ enum bcm2835_fsel fsel)
+ {
+- u32 val = bcm2835_gpio_rd(pc, FSEL_REG(pin));
+- enum bcm2835_fsel cur = (val >> FSEL_SHIFT(pin)) & BCM2835_FSEL_MASK;
++ u32 val;
++ enum bcm2835_fsel cur;
++ unsigned long flags;
++
++ spin_lock_irqsave(&pc->fsel_lock, flags);
++ val = bcm2835_gpio_rd(pc, FSEL_REG(pin));
++ cur = (val >> FSEL_SHIFT(pin)) & BCM2835_FSEL_MASK;
+
+ dev_dbg(pc->dev, "read %08x (%u => %s)\n", val, pin,
+- bcm2835_functions[cur]);
++ bcm2835_functions[cur]);
+
+ if (cur == fsel)
+- return;
++ goto unlock;
+
+ if (cur != BCM2835_FSEL_GPIO_IN && fsel != BCM2835_FSEL_GPIO_IN) {
+ /* always transition through GPIO_IN */
+@@ -309,6 +316,9 @@ static inline void bcm2835_pinctrl_fsel_set(
+ dev_dbg(pc->dev, "write %08x (%u <= %s)\n", val, pin,
+ bcm2835_functions[fsel]);
+ bcm2835_gpio_wr(pc, FSEL_REG(pin), val);
++
++unlock:
++ spin_unlock_irqrestore(&pc->fsel_lock, flags);
+ }
+
+ static int bcm2835_gpio_direction_input(struct gpio_chip *chip, unsigned offset)
+@@ -1248,6 +1258,7 @@ static int bcm2835_pinctrl_probe(struct platform_device *pdev)
+ pc->gpio_chip = *pdata->gpio_chip;
+ pc->gpio_chip.parent = dev;
+
++ spin_lock_init(&pc->fsel_lock);
+ for (i = 0; i < BCM2835_NUM_BANKS; i++) {
+ unsigned long events;
+ unsigned offset;
+--
+2.39.2
+
--- /dev/null
+From 3149dd1d5b6aecc721404efef4815f3675f07703 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 18 Mar 2023 00:29:51 +0300
+Subject: pinctrl: ralink: reintroduce ralink,rt2880-pinmux compatible string
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Arınç ÜNAL <arinc.unal@arinc9.com>
+
+[ Upstream commit 7c19147d9cfc0f9328049d2e278279150d7de9ca ]
+
+There have been stable releases with the ralink,rt2880-pinmux compatible
+string included. Having it removed breaks the ABI. Reintroduce it.
+
+Fixes: e5981cd46183 ("pinctrl: ralink: add new compatible strings for each pinctrl subdriver")
+Signed-off-by: Arınç ÜNAL <arinc.unal@arinc9.com>
+Reviewed-by: Sergio Paracuellos <sergio.paracuellos@gmail.com>
+Link: https://lore.kernel.org/r/20230317213011.13656-2-arinc.unal@arinc9.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/ralink/pinctrl-mt7620.c | 1 +
+ drivers/pinctrl/ralink/pinctrl-mt7621.c | 1 +
+ drivers/pinctrl/ralink/pinctrl-rt2880.c | 1 +
+ drivers/pinctrl/ralink/pinctrl-rt305x.c | 1 +
+ drivers/pinctrl/ralink/pinctrl-rt3883.c | 1 +
+ 5 files changed, 5 insertions(+)
+
+diff --git a/drivers/pinctrl/ralink/pinctrl-mt7620.c b/drivers/pinctrl/ralink/pinctrl-mt7620.c
+index 4e8d26bb34302..06b86c7268392 100644
+--- a/drivers/pinctrl/ralink/pinctrl-mt7620.c
++++ b/drivers/pinctrl/ralink/pinctrl-mt7620.c
+@@ -372,6 +372,7 @@ static int mt7620_pinctrl_probe(struct platform_device *pdev)
+
+ static const struct of_device_id mt7620_pinctrl_match[] = {
+ { .compatible = "ralink,mt7620-pinctrl" },
++ { .compatible = "ralink,rt2880-pinmux" },
+ {}
+ };
+ MODULE_DEVICE_TABLE(of, mt7620_pinctrl_match);
+diff --git a/drivers/pinctrl/ralink/pinctrl-mt7621.c b/drivers/pinctrl/ralink/pinctrl-mt7621.c
+index eddc0ba6d468c..fb5824922e788 100644
+--- a/drivers/pinctrl/ralink/pinctrl-mt7621.c
++++ b/drivers/pinctrl/ralink/pinctrl-mt7621.c
+@@ -97,6 +97,7 @@ static int mt7621_pinctrl_probe(struct platform_device *pdev)
+
+ static const struct of_device_id mt7621_pinctrl_match[] = {
+ { .compatible = "ralink,mt7621-pinctrl" },
++ { .compatible = "ralink,rt2880-pinmux" },
+ {}
+ };
+ MODULE_DEVICE_TABLE(of, mt7621_pinctrl_match);
+diff --git a/drivers/pinctrl/ralink/pinctrl-rt2880.c b/drivers/pinctrl/ralink/pinctrl-rt2880.c
+index 3e2f1aaaf0957..d7a65fcc7755a 100644
+--- a/drivers/pinctrl/ralink/pinctrl-rt2880.c
++++ b/drivers/pinctrl/ralink/pinctrl-rt2880.c
+@@ -41,6 +41,7 @@ static int rt2880_pinctrl_probe(struct platform_device *pdev)
+
+ static const struct of_device_id rt2880_pinctrl_match[] = {
+ { .compatible = "ralink,rt2880-pinctrl" },
++ { .compatible = "ralink,rt2880-pinmux" },
+ {}
+ };
+ MODULE_DEVICE_TABLE(of, rt2880_pinctrl_match);
+diff --git a/drivers/pinctrl/ralink/pinctrl-rt305x.c b/drivers/pinctrl/ralink/pinctrl-rt305x.c
+index bdaee5ce1ee08..f6092c64383e5 100644
+--- a/drivers/pinctrl/ralink/pinctrl-rt305x.c
++++ b/drivers/pinctrl/ralink/pinctrl-rt305x.c
+@@ -118,6 +118,7 @@ static int rt305x_pinctrl_probe(struct platform_device *pdev)
+
+ static const struct of_device_id rt305x_pinctrl_match[] = {
+ { .compatible = "ralink,rt305x-pinctrl" },
++ { .compatible = "ralink,rt2880-pinmux" },
+ {}
+ };
+ MODULE_DEVICE_TABLE(of, rt305x_pinctrl_match);
+diff --git a/drivers/pinctrl/ralink/pinctrl-rt3883.c b/drivers/pinctrl/ralink/pinctrl-rt3883.c
+index 392208662355d..5f766d76bafa6 100644
+--- a/drivers/pinctrl/ralink/pinctrl-rt3883.c
++++ b/drivers/pinctrl/ralink/pinctrl-rt3883.c
+@@ -88,6 +88,7 @@ static int rt3883_pinctrl_probe(struct platform_device *pdev)
+
+ static const struct of_device_id rt3883_pinctrl_match[] = {
+ { .compatible = "ralink,rt3883-pinctrl" },
++ { .compatible = "ralink,rt2880-pinmux" },
+ {}
+ };
+ MODULE_DEVICE_TABLE(of, rt3883_pinctrl_match);
+--
+2.39.2
+
--- /dev/null
+From b63844b4f3f57473cabaec58e688458f1b832acb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Jan 2023 14:10:31 +0100
+Subject: pinctrl: renesas: r8a779a0: Remove incorrect AVB[01] pinmux
+ configuration
+
+From: Hai Pham <hai.pham.ud@renesas.com>
+
+[ Upstream commit a145c9a8674ac8fbfa1595276e1b6cbfc5139038 ]
+
+AVB[01]_{MAGIC,MDC,MDIO,TXCREFCLK} are registered as both
+PINMUX_SINGLE(fn) and PINMUX_IPSR_GPSR(fn) in the pinmux_data array.
+
+The latter are correct, hence remove the former.
+Without this fix, the Ethernet PHY is not operational on the MDIO bus.
+
+Signed-off-by: Hai Pham <hai.pham.ud@renesas.com>
+Signed-off-by: LUU HOAI <hoai.luu.ub@renesas.com>
+Fixes: 741a7370fc3b8b54 ("pinctrl: renesas: Initial R8A779A0 (V3U) PFC support")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/6fd217b71e83ba9a8157513ed671a1fa218b23b6.1674824958.git.geert+renesas@glider.be
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/renesas/pfc-r8a779a0.c | 8 --------
+ 1 file changed, 8 deletions(-)
+
+diff --git a/drivers/pinctrl/renesas/pfc-r8a779a0.c b/drivers/pinctrl/renesas/pfc-r8a779a0.c
+index 760c83a8740bd..6069869353bb4 100644
+--- a/drivers/pinctrl/renesas/pfc-r8a779a0.c
++++ b/drivers/pinctrl/renesas/pfc-r8a779a0.c
+@@ -696,16 +696,8 @@ static const u16 pinmux_data[] = {
+ PINMUX_SINGLE(PCIE0_CLKREQ_N),
+
+ PINMUX_SINGLE(AVB0_PHY_INT),
+- PINMUX_SINGLE(AVB0_MAGIC),
+- PINMUX_SINGLE(AVB0_MDC),
+- PINMUX_SINGLE(AVB0_MDIO),
+- PINMUX_SINGLE(AVB0_TXCREFCLK),
+
+ PINMUX_SINGLE(AVB1_PHY_INT),
+- PINMUX_SINGLE(AVB1_MAGIC),
+- PINMUX_SINGLE(AVB1_MDC),
+- PINMUX_SINGLE(AVB1_MDIO),
+- PINMUX_SINGLE(AVB1_TXCREFCLK),
+
+ PINMUX_SINGLE(AVB2_AVTP_PPS),
+ PINMUX_SINGLE(AVB2_AVTP_CAPTURE),
+--
+2.39.2
+
--- /dev/null
+From e27ac19d17e11bfce4f469db4e4f569972647c79 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Jan 2023 14:11:59 +0100
+Subject: pinctrl: renesas: r8a779f0: Fix tsn1_avtp_pps pin group
+
+From: Phong Hoang <phong.hoang.wz@renesas.com>
+
+[ Upstream commit 60003351e99167d8cfa7c161e95856efc016f381 ]
+
+Correct a typo mistake in the definition of the tsn1_avtp_pps pin group
+mux.
+
+Signed-off-by: Phong Hoang <phong.hoang.wz@renesas.com>
+Fixes: babe298e9caaa3d7 ("pinctrl: renesas: r8a779f0: Add Ethernet pins, groups, and functions")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/45ea6e87b91c36fd0b9706cf58ff50a4d1a99c44.1674825039.git.geert+renesas@glider.be
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/renesas/pfc-r8a779f0.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/renesas/pfc-r8a779f0.c b/drivers/pinctrl/renesas/pfc-r8a779f0.c
+index 417c357f16b19..65c141ce909ac 100644
+--- a/drivers/pinctrl/renesas/pfc-r8a779f0.c
++++ b/drivers/pinctrl/renesas/pfc-r8a779f0.c
+@@ -1213,7 +1213,7 @@ static const unsigned int tsn1_avtp_pps_pins[] = {
+ RCAR_GP_PIN(3, 13),
+ };
+ static const unsigned int tsn1_avtp_pps_mux[] = {
+- TSN0_AVTP_PPS_MARK,
++ TSN1_AVTP_PPS_MARK,
+ };
+ static const unsigned int tsn1_avtp_capture_a_pins[] = {
+ /* TSN1_AVTP_CAPTURE_A */
+--
+2.39.2
+
--- /dev/null
+From 36b175622890f81de92e35ccf62d99ed5ae42695 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Nov 2022 14:18:39 +0100
+Subject: pinctrl: renesas: r8a779g0: Fix ERROROUTC function names
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 9da805344d2a2d27a32cc9271230055d8818e887 ]
+
+According to R-Car V4H Series User’s Manual: Hardware Rev. 0.54, the
+ERROROUTC signal is active-low. Hence add the missing "_N" suffix to
+the pin function's names.
+
+Resize column 2 of all IPxSR* definitions to accomodate the longer
+names.
+
+Fixes: b811062e5fd0343c ("pinctrl: renesas: r8a779g0: Add missing ERROROUTC_A")
+Fixes: ad9bb2fec66262b0 ("pinctrl: renesas: Initial R8A779G0 (R-Car V4H) PFC support")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/1774303989e7d61f08fa81f1c2fa1b394505645f.1669036423.git.geert+renesas@glider.be
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/renesas/pfc-r8a779g0.c | 502 ++++++++++++-------------
+ 1 file changed, 251 insertions(+), 251 deletions(-)
+
+diff --git a/drivers/pinctrl/renesas/pfc-r8a779g0.c b/drivers/pinctrl/renesas/pfc-r8a779g0.c
+index 104482a847e94..a47b02bf46863 100644
+--- a/drivers/pinctrl/renesas/pfc-r8a779g0.c
++++ b/drivers/pinctrl/renesas/pfc-r8a779g0.c
+@@ -268,271 +268,271 @@
+ #define GPSR8_0 F_(SCL0, IP0SR8_3_0)
+
+ /* SR0 */
+-/* IP0SR0 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */
+-#define IP0SR0_3_0 F_(0, 0) FM(ERROROUTC_B) FM(TCLK2_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP0SR0_7_4 F_(0, 0) FM(MSIOF3_SS1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP0SR0_11_8 F_(0, 0) FM(MSIOF3_SS2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP0SR0_15_12 FM(IRQ3) FM(MSIOF3_SCK) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP0SR0_19_16 FM(IRQ2) FM(MSIOF3_TXD) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP0SR0_23_20 FM(IRQ1) FM(MSIOF3_RXD) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP0SR0_27_24 FM(IRQ0) FM(MSIOF3_SYNC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP0SR0_31_28 FM(MSIOF5_SS2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-
+-/* IP1SR0 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */
+-#define IP1SR0_3_0 FM(MSIOF5_SS1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP1SR0_7_4 FM(MSIOF5_SYNC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP1SR0_11_8 FM(MSIOF5_TXD) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP1SR0_15_12 FM(MSIOF5_SCK) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP1SR0_19_16 FM(MSIOF5_RXD) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP1SR0_23_20 FM(MSIOF2_SS2) FM(TCLK1) FM(IRQ2_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP1SR0_27_24 FM(MSIOF2_SS1) FM(HTX1) FM(TX1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP1SR0_31_28 FM(MSIOF2_SYNC) FM(HRX1) FM(RX1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-
+-/* IP2SR0 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */
+-#define IP2SR0_3_0 FM(MSIOF2_TXD) FM(HCTS1_N) FM(CTS1_N) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP2SR0_7_4 FM(MSIOF2_SCK) FM(HRTS1_N) FM(RTS1_N) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP2SR0_11_8 FM(MSIOF2_RXD) FM(HSCK1) FM(SCK1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++/* IP0SR0 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */
++#define IP0SR0_3_0 F_(0, 0) FM(ERROROUTC_N_B) FM(TCLK2_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR0_7_4 F_(0, 0) FM(MSIOF3_SS1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR0_11_8 F_(0, 0) FM(MSIOF3_SS2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR0_15_12 FM(IRQ3) FM(MSIOF3_SCK) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR0_19_16 FM(IRQ2) FM(MSIOF3_TXD) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR0_23_20 FM(IRQ1) FM(MSIOF3_RXD) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR0_27_24 FM(IRQ0) FM(MSIOF3_SYNC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR0_31_28 FM(MSIOF5_SS2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++
++/* IP1SR0 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */
++#define IP1SR0_3_0 FM(MSIOF5_SS1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP1SR0_7_4 FM(MSIOF5_SYNC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP1SR0_11_8 FM(MSIOF5_TXD) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP1SR0_15_12 FM(MSIOF5_SCK) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP1SR0_19_16 FM(MSIOF5_RXD) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP1SR0_23_20 FM(MSIOF2_SS2) FM(TCLK1) FM(IRQ2_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP1SR0_27_24 FM(MSIOF2_SS1) FM(HTX1) FM(TX1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP1SR0_31_28 FM(MSIOF2_SYNC) FM(HRX1) FM(RX1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++
++/* IP2SR0 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */
++#define IP2SR0_3_0 FM(MSIOF2_TXD) FM(HCTS1_N) FM(CTS1_N) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP2SR0_7_4 FM(MSIOF2_SCK) FM(HRTS1_N) FM(RTS1_N) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP2SR0_11_8 FM(MSIOF2_RXD) FM(HSCK1) FM(SCK1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+
+ /* SR1 */
+-/* IP0SR1 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */
+-#define IP0SR1_3_0 FM(MSIOF1_SS2) FM(HTX3_A) FM(TX3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP0SR1_7_4 FM(MSIOF1_SS1) FM(HCTS3_N_A) FM(RX3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP0SR1_11_8 FM(MSIOF1_SYNC) FM(HRTS3_N_A) FM(RTS3_N) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP0SR1_15_12 FM(MSIOF1_SCK) FM(HSCK3_A) FM(CTS3_N) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP0SR1_19_16 FM(MSIOF1_TXD) FM(HRX3_A) FM(SCK3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP0SR1_23_20 FM(MSIOF1_RXD) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP0SR1_27_24 FM(MSIOF0_SS2) FM(HTX1_X) FM(TX1_X) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP0SR1_31_28 FM(MSIOF0_SS1) FM(HRX1_X) FM(RX1_X) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-
+-/* IP1SR1 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */
+-#define IP1SR1_3_0 FM(MSIOF0_SYNC) FM(HCTS1_N_X) FM(CTS1_N_X) FM(CANFD5_TX_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP1SR1_7_4 FM(MSIOF0_TXD) FM(HRTS1_N_X) FM(RTS1_N_X) FM(CANFD5_RX_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP1SR1_11_8 FM(MSIOF0_SCK) FM(HSCK1_X) FM(SCK1_X) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP1SR1_15_12 FM(MSIOF0_RXD) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP1SR1_19_16 FM(HTX0) FM(TX0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP1SR1_23_20 FM(HCTS0_N) FM(CTS0_N) FM(PWM8_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP1SR1_27_24 FM(HRTS0_N) FM(RTS0_N) FM(PWM9_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP1SR1_31_28 FM(HSCK0) FM(SCK0) FM(PWM0_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-
+-/* IP2SR1 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */
+-#define IP2SR1_3_0 FM(HRX0) FM(RX0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP2SR1_7_4 FM(SCIF_CLK) FM(IRQ4_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP2SR1_11_8 FM(SSI_SCK) FM(TCLK3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP2SR1_15_12 FM(SSI_WS) FM(TCLK4) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP2SR1_19_16 FM(SSI_SD) FM(IRQ0_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP2SR1_23_20 FM(AUDIO_CLKOUT) FM(IRQ1_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP2SR1_27_24 FM(AUDIO_CLKIN) FM(PWM3_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP2SR1_31_28 F_(0, 0) FM(TCLK2) FM(MSIOF4_SS1) FM(IRQ3_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-
+-/* IP3SR1 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */
+-#define IP3SR1_3_0 FM(HRX3) FM(SCK3_A) FM(MSIOF4_SS2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP3SR1_7_4 FM(HSCK3) FM(CTS3_N_A) FM(MSIOF4_SCK) FM(TPU0TO0_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP3SR1_11_8 FM(HRTS3_N) FM(RTS3_N_A) FM(MSIOF4_TXD) FM(TPU0TO1_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP3SR1_15_12 FM(HCTS3_N) FM(RX3_A) FM(MSIOF4_RXD) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP3SR1_19_16 FM(HTX3) FM(TX3_A) FM(MSIOF4_SYNC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++/* IP0SR1 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */
++#define IP0SR1_3_0 FM(MSIOF1_SS2) FM(HTX3_A) FM(TX3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR1_7_4 FM(MSIOF1_SS1) FM(HCTS3_N_A) FM(RX3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR1_11_8 FM(MSIOF1_SYNC) FM(HRTS3_N_A) FM(RTS3_N) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR1_15_12 FM(MSIOF1_SCK) FM(HSCK3_A) FM(CTS3_N) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR1_19_16 FM(MSIOF1_TXD) FM(HRX3_A) FM(SCK3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR1_23_20 FM(MSIOF1_RXD) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR1_27_24 FM(MSIOF0_SS2) FM(HTX1_X) FM(TX1_X) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR1_31_28 FM(MSIOF0_SS1) FM(HRX1_X) FM(RX1_X) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++
++/* IP1SR1 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */
++#define IP1SR1_3_0 FM(MSIOF0_SYNC) FM(HCTS1_N_X) FM(CTS1_N_X) FM(CANFD5_TX_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP1SR1_7_4 FM(MSIOF0_TXD) FM(HRTS1_N_X) FM(RTS1_N_X) FM(CANFD5_RX_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP1SR1_11_8 FM(MSIOF0_SCK) FM(HSCK1_X) FM(SCK1_X) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP1SR1_15_12 FM(MSIOF0_RXD) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP1SR1_19_16 FM(HTX0) FM(TX0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP1SR1_23_20 FM(HCTS0_N) FM(CTS0_N) FM(PWM8_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP1SR1_27_24 FM(HRTS0_N) FM(RTS0_N) FM(PWM9_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP1SR1_31_28 FM(HSCK0) FM(SCK0) FM(PWM0_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++
++/* IP2SR1 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */
++#define IP2SR1_3_0 FM(HRX0) FM(RX0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP2SR1_7_4 FM(SCIF_CLK) FM(IRQ4_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP2SR1_11_8 FM(SSI_SCK) FM(TCLK3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP2SR1_15_12 FM(SSI_WS) FM(TCLK4) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP2SR1_19_16 FM(SSI_SD) FM(IRQ0_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP2SR1_23_20 FM(AUDIO_CLKOUT) FM(IRQ1_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP2SR1_27_24 FM(AUDIO_CLKIN) FM(PWM3_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP2SR1_31_28 F_(0, 0) FM(TCLK2) FM(MSIOF4_SS1) FM(IRQ3_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++
++/* IP3SR1 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */
++#define IP3SR1_3_0 FM(HRX3) FM(SCK3_A) FM(MSIOF4_SS2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP3SR1_7_4 FM(HSCK3) FM(CTS3_N_A) FM(MSIOF4_SCK) FM(TPU0TO0_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP3SR1_11_8 FM(HRTS3_N) FM(RTS3_N_A) FM(MSIOF4_TXD) FM(TPU0TO1_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP3SR1_15_12 FM(HCTS3_N) FM(RX3_A) FM(MSIOF4_RXD) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP3SR1_19_16 FM(HTX3) FM(TX3_A) FM(MSIOF4_SYNC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+
+ /* SR2 */
+-/* IP0SR2 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */
+-#define IP0SR2_3_0 FM(FXR_TXDA) FM(CANFD1_TX) FM(TPU0TO2_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP0SR2_7_4 FM(FXR_TXENA_N) FM(CANFD1_RX) FM(TPU0TO3_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP0SR2_11_8 FM(RXDA_EXTFXR) FM(CANFD5_TX) FM(IRQ5) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP0SR2_15_12 FM(CLK_EXTFXR) FM(CANFD5_RX) FM(IRQ4_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP0SR2_19_16 FM(RXDB_EXTFXR) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP0SR2_23_20 FM(FXR_TXENB_N) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP0SR2_27_24 FM(FXR_TXDB) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP0SR2_31_28 FM(TPU0TO1) FM(CANFD6_TX) F_(0, 0) FM(TCLK2_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-
+-/* IP1SR2 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */
+-#define IP1SR2_3_0 FM(TPU0TO0) FM(CANFD6_RX) F_(0, 0) FM(TCLK1_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP1SR2_7_4 FM(CAN_CLK) FM(FXR_TXENA_N_X) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP1SR2_11_8 FM(CANFD0_TX) FM(FXR_TXENB_N_X) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP1SR2_15_12 FM(CANFD0_RX) FM(STPWT_EXTFXR) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP1SR2_19_16 FM(CANFD2_TX) FM(TPU0TO2) F_(0, 0) FM(TCLK3_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP1SR2_23_20 FM(CANFD2_RX) FM(TPU0TO3) FM(PWM1_B) FM(TCLK4_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP1SR2_27_24 FM(CANFD3_TX) F_(0, 0) FM(PWM2_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP1SR2_31_28 FM(CANFD3_RX) F_(0, 0) FM(PWM3_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-
+-/* IP2SR2 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */
+-#define IP2SR2_3_0 FM(CANFD4_TX) F_(0, 0) FM(PWM4) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP2SR2_7_4 FM(CANFD4_RX) F_(0, 0) FM(PWM5) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP2SR2_11_8 FM(CANFD7_TX) F_(0, 0) FM(PWM6) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP2SR2_15_12 FM(CANFD7_RX) F_(0, 0) FM(PWM7) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++/* IP0SR2 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */
++#define IP0SR2_3_0 FM(FXR_TXDA) FM(CANFD1_TX) FM(TPU0TO2_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR2_7_4 FM(FXR_TXENA_N) FM(CANFD1_RX) FM(TPU0TO3_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR2_11_8 FM(RXDA_EXTFXR) FM(CANFD5_TX) FM(IRQ5) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR2_15_12 FM(CLK_EXTFXR) FM(CANFD5_RX) FM(IRQ4_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR2_19_16 FM(RXDB_EXTFXR) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR2_23_20 FM(FXR_TXENB_N) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR2_27_24 FM(FXR_TXDB) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR2_31_28 FM(TPU0TO1) FM(CANFD6_TX) F_(0, 0) FM(TCLK2_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++
++/* IP1SR2 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */
++#define IP1SR2_3_0 FM(TPU0TO0) FM(CANFD6_RX) F_(0, 0) FM(TCLK1_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP1SR2_7_4 FM(CAN_CLK) FM(FXR_TXENA_N_X) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP1SR2_11_8 FM(CANFD0_TX) FM(FXR_TXENB_N_X) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP1SR2_15_12 FM(CANFD0_RX) FM(STPWT_EXTFXR) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP1SR2_19_16 FM(CANFD2_TX) FM(TPU0TO2) F_(0, 0) FM(TCLK3_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP1SR2_23_20 FM(CANFD2_RX) FM(TPU0TO3) FM(PWM1_B) FM(TCLK4_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP1SR2_27_24 FM(CANFD3_TX) F_(0, 0) FM(PWM2_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP1SR2_31_28 FM(CANFD3_RX) F_(0, 0) FM(PWM3_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++
++/* IP2SR2 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */
++#define IP2SR2_3_0 FM(CANFD4_TX) F_(0, 0) FM(PWM4) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP2SR2_7_4 FM(CANFD4_RX) F_(0, 0) FM(PWM5) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP2SR2_11_8 FM(CANFD7_TX) F_(0, 0) FM(PWM6) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP2SR2_15_12 FM(CANFD7_RX) F_(0, 0) FM(PWM7) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+
+ /* SR3 */
+-/* IP0SR3 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */
+-#define IP0SR3_3_0 FM(MMC_SD_D1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP0SR3_7_4 FM(MMC_SD_D0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP0SR3_11_8 FM(MMC_SD_D2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP0SR3_15_12 FM(MMC_SD_CLK) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP0SR3_19_16 FM(MMC_DS) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP0SR3_23_20 FM(MMC_SD_D3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP0SR3_27_24 FM(MMC_D5) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP0SR3_31_28 FM(MMC_D4) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-
+-/* IP1SR3 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */
+-#define IP1SR3_3_0 FM(MMC_D7) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP1SR3_7_4 FM(MMC_D6) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP1SR3_11_8 FM(MMC_SD_CMD) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP1SR3_15_12 FM(SD_CD) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP1SR3_19_16 FM(SD_WP) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP1SR3_23_20 FM(IPC_CLKIN) FM(IPC_CLKEN_IN) FM(PWM1_A) FM(TCLK3_X) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP1SR3_27_24 FM(IPC_CLKOUT) FM(IPC_CLKEN_OUT) FM(ERROROUTC_A) FM(TCLK4_X) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP1SR3_31_28 FM(QSPI0_SSL) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-
+-/* IP2SR3 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */
+-#define IP2SR3_3_0 FM(QSPI0_IO3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP2SR3_7_4 FM(QSPI0_IO2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP2SR3_11_8 FM(QSPI0_MISO_IO1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP2SR3_15_12 FM(QSPI0_MOSI_IO0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP2SR3_19_16 FM(QSPI0_SPCLK) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP2SR3_23_20 FM(QSPI1_MOSI_IO0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP2SR3_27_24 FM(QSPI1_SPCLK) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP2SR3_31_28 FM(QSPI1_MISO_IO1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-
+-/* IP3SR3 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */
+-#define IP3SR3_3_0 FM(QSPI1_IO2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP3SR3_7_4 FM(QSPI1_SSL) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP3SR3_11_8 FM(QSPI1_IO3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP3SR3_15_12 FM(RPC_RESET_N) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP3SR3_19_16 FM(RPC_WP_N) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP3SR3_23_20 FM(RPC_INT_N) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++/* IP0SR3 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */
++#define IP0SR3_3_0 FM(MMC_SD_D1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR3_7_4 FM(MMC_SD_D0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR3_11_8 FM(MMC_SD_D2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR3_15_12 FM(MMC_SD_CLK) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR3_19_16 FM(MMC_DS) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR3_23_20 FM(MMC_SD_D3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR3_27_24 FM(MMC_D5) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR3_31_28 FM(MMC_D4) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++
++/* IP1SR3 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */
++#define IP1SR3_3_0 FM(MMC_D7) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP1SR3_7_4 FM(MMC_D6) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP1SR3_11_8 FM(MMC_SD_CMD) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP1SR3_15_12 FM(SD_CD) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP1SR3_19_16 FM(SD_WP) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP1SR3_23_20 FM(IPC_CLKIN) FM(IPC_CLKEN_IN) FM(PWM1_A) FM(TCLK3_X) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP1SR3_27_24 FM(IPC_CLKOUT) FM(IPC_CLKEN_OUT) FM(ERROROUTC_N_A) FM(TCLK4_X) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP1SR3_31_28 FM(QSPI0_SSL) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++
++/* IP2SR3 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */
++#define IP2SR3_3_0 FM(QSPI0_IO3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP2SR3_7_4 FM(QSPI0_IO2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP2SR3_11_8 FM(QSPI0_MISO_IO1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP2SR3_15_12 FM(QSPI0_MOSI_IO0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP2SR3_19_16 FM(QSPI0_SPCLK) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP2SR3_23_20 FM(QSPI1_MOSI_IO0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP2SR3_27_24 FM(QSPI1_SPCLK) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP2SR3_31_28 FM(QSPI1_MISO_IO1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++
++/* IP3SR3 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */
++#define IP3SR3_3_0 FM(QSPI1_IO2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP3SR3_7_4 FM(QSPI1_SSL) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP3SR3_11_8 FM(QSPI1_IO3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP3SR3_15_12 FM(RPC_RESET_N) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP3SR3_19_16 FM(RPC_WP_N) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP3SR3_23_20 FM(RPC_INT_N) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+
+ /* SR4 */
+-/* IP0SR4 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */
+-#define IP0SR4_3_0 FM(TSN0_MDIO) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP0SR4_7_4 FM(TSN0_MDC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP0SR4_11_8 FM(TSN0_AVTP_PPS1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP0SR4_15_12 FM(TSN0_PHY_INT) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP0SR4_19_16 FM(TSN0_LINK) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP0SR4_23_20 FM(TSN0_AVTP_MATCH) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP0SR4_27_24 FM(TSN0_AVTP_CAPTURE) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP0SR4_31_28 FM(TSN0_RX_CTL) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-
+-/* IP1SR4 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */
+-#define IP1SR4_3_0 FM(TSN0_AVTP_PPS0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP1SR4_7_4 FM(TSN0_TX_CTL) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP1SR4_11_8 FM(TSN0_RD0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP1SR4_15_12 FM(TSN0_RXC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP1SR4_19_16 FM(TSN0_TXC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP1SR4_23_20 FM(TSN0_RD1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP1SR4_27_24 FM(TSN0_TD1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP1SR4_31_28 FM(TSN0_TD0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-
+-/* IP2SR4 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */
+-#define IP2SR4_3_0 FM(TSN0_RD3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP2SR4_7_4 FM(TSN0_RD2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP2SR4_11_8 FM(TSN0_TD3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP2SR4_15_12 FM(TSN0_TD2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP2SR4_19_16 FM(TSN0_TXCREFCLK) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP2SR4_23_20 FM(PCIE0_CLKREQ_N) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP2SR4_27_24 FM(PCIE1_CLKREQ_N) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP2SR4_31_28 FM(AVS0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-
+-/* IP3SR4 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */
+-#define IP3SR4_3_0 FM(AVS1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++/* IP0SR4 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */
++#define IP0SR4_3_0 FM(TSN0_MDIO) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR4_7_4 FM(TSN0_MDC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR4_11_8 FM(TSN0_AVTP_PPS1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR4_15_12 FM(TSN0_PHY_INT) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR4_19_16 FM(TSN0_LINK) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR4_23_20 FM(TSN0_AVTP_MATCH) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR4_27_24 FM(TSN0_AVTP_CAPTURE) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR4_31_28 FM(TSN0_RX_CTL) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++
++/* IP1SR4 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */
++#define IP1SR4_3_0 FM(TSN0_AVTP_PPS0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP1SR4_7_4 FM(TSN0_TX_CTL) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP1SR4_11_8 FM(TSN0_RD0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP1SR4_15_12 FM(TSN0_RXC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP1SR4_19_16 FM(TSN0_TXC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP1SR4_23_20 FM(TSN0_RD1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP1SR4_27_24 FM(TSN0_TD1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP1SR4_31_28 FM(TSN0_TD0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++
++/* IP2SR4 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */
++#define IP2SR4_3_0 FM(TSN0_RD3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP2SR4_7_4 FM(TSN0_RD2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP2SR4_11_8 FM(TSN0_TD3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP2SR4_15_12 FM(TSN0_TD2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP2SR4_19_16 FM(TSN0_TXCREFCLK) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP2SR4_23_20 FM(PCIE0_CLKREQ_N) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP2SR4_27_24 FM(PCIE1_CLKREQ_N) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP2SR4_31_28 FM(AVS0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++
++/* IP3SR4 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */
++#define IP3SR4_3_0 FM(AVS1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+
+ /* SR5 */
+-/* IP0SR5 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */
+-#define IP0SR5_3_0 FM(AVB2_AVTP_PPS) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP0SR5_7_4 FM(AVB2_AVTP_CAPTURE) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP0SR5_11_8 FM(AVB2_AVTP_MATCH) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP0SR5_15_12 FM(AVB2_LINK) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP0SR5_19_16 FM(AVB2_PHY_INT) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP0SR5_23_20 FM(AVB2_MAGIC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP0SR5_27_24 FM(AVB2_MDC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP0SR5_31_28 FM(AVB2_TXCREFCLK) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-
+-/* IP1SR5 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */
+-#define IP1SR5_3_0 FM(AVB2_TD3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP1SR5_7_4 FM(AVB2_RD3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP1SR5_11_8 FM(AVB2_MDIO) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP1SR5_15_12 FM(AVB2_TD2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP1SR5_19_16 FM(AVB2_TD1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP1SR5_23_20 FM(AVB2_RD2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP1SR5_27_24 FM(AVB2_RD1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP1SR5_31_28 FM(AVB2_TD0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-
+-/* IP2SR5 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */
+-#define IP2SR5_3_0 FM(AVB2_TXC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP2SR5_7_4 FM(AVB2_RD0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP2SR5_11_8 FM(AVB2_RXC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP2SR5_15_12 FM(AVB2_TX_CTL) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP2SR5_19_16 FM(AVB2_RX_CTL) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++/* IP0SR5 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */
++#define IP0SR5_3_0 FM(AVB2_AVTP_PPS) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR5_7_4 FM(AVB2_AVTP_CAPTURE) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR5_11_8 FM(AVB2_AVTP_MATCH) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR5_15_12 FM(AVB2_LINK) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR5_19_16 FM(AVB2_PHY_INT) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR5_23_20 FM(AVB2_MAGIC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR5_27_24 FM(AVB2_MDC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR5_31_28 FM(AVB2_TXCREFCLK) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++
++/* IP1SR5 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */
++#define IP1SR5_3_0 FM(AVB2_TD3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP1SR5_7_4 FM(AVB2_RD3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP1SR5_11_8 FM(AVB2_MDIO) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP1SR5_15_12 FM(AVB2_TD2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP1SR5_19_16 FM(AVB2_TD1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP1SR5_23_20 FM(AVB2_RD2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP1SR5_27_24 FM(AVB2_RD1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP1SR5_31_28 FM(AVB2_TD0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++
++/* IP2SR5 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */
++#define IP2SR5_3_0 FM(AVB2_TXC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP2SR5_7_4 FM(AVB2_RD0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP2SR5_11_8 FM(AVB2_RXC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP2SR5_15_12 FM(AVB2_TX_CTL) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP2SR5_19_16 FM(AVB2_RX_CTL) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+
+ /* SR6 */
+-/* IP0SR6 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */
+-#define IP0SR6_3_0 FM(AVB1_MDIO) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP0SR6_7_4 FM(AVB1_MAGIC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP0SR6_11_8 FM(AVB1_MDC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP0SR6_15_12 FM(AVB1_PHY_INT) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP0SR6_19_16 FM(AVB1_LINK) FM(AVB1_MII_TX_ER) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP0SR6_23_20 FM(AVB1_AVTP_MATCH) FM(AVB1_MII_RX_ER) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP0SR6_27_24 FM(AVB1_TXC) FM(AVB1_MII_TXC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP0SR6_31_28 FM(AVB1_TX_CTL) FM(AVB1_MII_TX_EN) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-
+-/* IP1SR6 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */
+-#define IP1SR6_3_0 FM(AVB1_RXC) FM(AVB1_MII_RXC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP1SR6_7_4 FM(AVB1_RX_CTL) FM(AVB1_MII_RX_DV) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP1SR6_11_8 FM(AVB1_AVTP_PPS) FM(AVB1_MII_COL) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP1SR6_15_12 FM(AVB1_AVTP_CAPTURE) FM(AVB1_MII_CRS) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP1SR6_19_16 FM(AVB1_TD1) FM(AVB1_MII_TD1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP1SR6_23_20 FM(AVB1_TD0) FM(AVB1_MII_TD0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP1SR6_27_24 FM(AVB1_RD1) FM(AVB1_MII_RD1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP1SR6_31_28 FM(AVB1_RD0) FM(AVB1_MII_RD0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-
+-/* IP2SR6 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */
+-#define IP2SR6_3_0 FM(AVB1_TD2) FM(AVB1_MII_TD2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP2SR6_7_4 FM(AVB1_RD2) FM(AVB1_MII_RD2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP2SR6_11_8 FM(AVB1_TD3) FM(AVB1_MII_TD3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP2SR6_15_12 FM(AVB1_RD3) FM(AVB1_MII_RD3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP2SR6_19_16 FM(AVB1_TXCREFCLK) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++/* IP0SR6 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */
++#define IP0SR6_3_0 FM(AVB1_MDIO) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR6_7_4 FM(AVB1_MAGIC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR6_11_8 FM(AVB1_MDC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR6_15_12 FM(AVB1_PHY_INT) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR6_19_16 FM(AVB1_LINK) FM(AVB1_MII_TX_ER) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR6_23_20 FM(AVB1_AVTP_MATCH) FM(AVB1_MII_RX_ER) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR6_27_24 FM(AVB1_TXC) FM(AVB1_MII_TXC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR6_31_28 FM(AVB1_TX_CTL) FM(AVB1_MII_TX_EN) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++
++/* IP1SR6 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */
++#define IP1SR6_3_0 FM(AVB1_RXC) FM(AVB1_MII_RXC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP1SR6_7_4 FM(AVB1_RX_CTL) FM(AVB1_MII_RX_DV) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP1SR6_11_8 FM(AVB1_AVTP_PPS) FM(AVB1_MII_COL) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP1SR6_15_12 FM(AVB1_AVTP_CAPTURE) FM(AVB1_MII_CRS) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP1SR6_19_16 FM(AVB1_TD1) FM(AVB1_MII_TD1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP1SR6_23_20 FM(AVB1_TD0) FM(AVB1_MII_TD0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP1SR6_27_24 FM(AVB1_RD1) FM(AVB1_MII_RD1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP1SR6_31_28 FM(AVB1_RD0) FM(AVB1_MII_RD0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++
++/* IP2SR6 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */
++#define IP2SR6_3_0 FM(AVB1_TD2) FM(AVB1_MII_TD2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP2SR6_7_4 FM(AVB1_RD2) FM(AVB1_MII_RD2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP2SR6_11_8 FM(AVB1_TD3) FM(AVB1_MII_TD3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP2SR6_15_12 FM(AVB1_RD3) FM(AVB1_MII_RD3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP2SR6_19_16 FM(AVB1_TXCREFCLK) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+
+ /* SR7 */
+-/* IP0SR7 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */
+-#define IP0SR7_3_0 FM(AVB0_AVTP_PPS) FM(AVB0_MII_COL) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP0SR7_7_4 FM(AVB0_AVTP_CAPTURE) FM(AVB0_MII_CRS) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP0SR7_11_8 FM(AVB0_AVTP_MATCH) FM(AVB0_MII_RX_ER) FM(CC5_OSCOUT) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP0SR7_15_12 FM(AVB0_TD3) FM(AVB0_MII_TD3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP0SR7_19_16 FM(AVB0_LINK) FM(AVB0_MII_TX_ER) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP0SR7_23_20 FM(AVB0_PHY_INT) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP0SR7_27_24 FM(AVB0_TD2) FM(AVB0_MII_TD2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP0SR7_31_28 FM(AVB0_TD1) FM(AVB0_MII_TD1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-
+-/* IP1SR7 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */
+-#define IP1SR7_3_0 FM(AVB0_RD3) FM(AVB0_MII_RD3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP1SR7_7_4 FM(AVB0_TXCREFCLK) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP1SR7_11_8 FM(AVB0_MAGIC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP1SR7_15_12 FM(AVB0_TD0) FM(AVB0_MII_TD0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP1SR7_19_16 FM(AVB0_RD2) FM(AVB0_MII_RD2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP1SR7_23_20 FM(AVB0_MDC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP1SR7_27_24 FM(AVB0_MDIO) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP1SR7_31_28 FM(AVB0_TXC) FM(AVB0_MII_TXC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-
+-/* IP2SR7 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */
+-#define IP2SR7_3_0 FM(AVB0_TX_CTL) FM(AVB0_MII_TX_EN) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP2SR7_7_4 FM(AVB0_RD1) FM(AVB0_MII_RD1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP2SR7_11_8 FM(AVB0_RD0) FM(AVB0_MII_RD0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP2SR7_15_12 FM(AVB0_RXC) FM(AVB0_MII_RXC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP2SR7_19_16 FM(AVB0_RX_CTL) FM(AVB0_MII_RX_DV) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++/* IP0SR7 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */
++#define IP0SR7_3_0 FM(AVB0_AVTP_PPS) FM(AVB0_MII_COL) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR7_7_4 FM(AVB0_AVTP_CAPTURE) FM(AVB0_MII_CRS) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR7_11_8 FM(AVB0_AVTP_MATCH) FM(AVB0_MII_RX_ER) FM(CC5_OSCOUT) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR7_15_12 FM(AVB0_TD3) FM(AVB0_MII_TD3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR7_19_16 FM(AVB0_LINK) FM(AVB0_MII_TX_ER) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR7_23_20 FM(AVB0_PHY_INT) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR7_27_24 FM(AVB0_TD2) FM(AVB0_MII_TD2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR7_31_28 FM(AVB0_TD1) FM(AVB0_MII_TD1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++
++/* IP1SR7 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */
++#define IP1SR7_3_0 FM(AVB0_RD3) FM(AVB0_MII_RD3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP1SR7_7_4 FM(AVB0_TXCREFCLK) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP1SR7_11_8 FM(AVB0_MAGIC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP1SR7_15_12 FM(AVB0_TD0) FM(AVB0_MII_TD0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP1SR7_19_16 FM(AVB0_RD2) FM(AVB0_MII_RD2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP1SR7_23_20 FM(AVB0_MDC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP1SR7_27_24 FM(AVB0_MDIO) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP1SR7_31_28 FM(AVB0_TXC) FM(AVB0_MII_TXC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++
++/* IP2SR7 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */
++#define IP2SR7_3_0 FM(AVB0_TX_CTL) FM(AVB0_MII_TX_EN) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP2SR7_7_4 FM(AVB0_RD1) FM(AVB0_MII_RD1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP2SR7_11_8 FM(AVB0_RD0) FM(AVB0_MII_RD0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP2SR7_15_12 FM(AVB0_RXC) FM(AVB0_MII_RXC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP2SR7_19_16 FM(AVB0_RX_CTL) FM(AVB0_MII_RX_DV) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+
+ /* SR8 */
+-/* IP0SR8 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */
+-#define IP0SR8_3_0 FM(SCL0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP0SR8_7_4 FM(SDA0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP0SR8_11_8 FM(SCL1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP0SR8_15_12 FM(SDA1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP0SR8_19_16 FM(SCL2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP0SR8_23_20 FM(SDA2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP0SR8_27_24 FM(SCL3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP0SR8_31_28 FM(SDA3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-
+-/* IP1SR8 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */
+-#define IP1SR8_3_0 FM(SCL4) FM(HRX2) FM(SCK4) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP1SR8_7_4 FM(SDA4) FM(HTX2) FM(CTS4_N) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP1SR8_11_8 FM(SCL5) FM(HRTS2_N) FM(RTS4_N) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP1SR8_15_12 FM(SDA5) FM(SCIF_CLK2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP1SR8_19_16 F_(0, 0) FM(HCTS2_N) FM(TX4) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+-#define IP1SR8_23_20 F_(0, 0) FM(HSCK2) FM(RX4) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++/* IP0SR8 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */
++#define IP0SR8_3_0 FM(SCL0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR8_7_4 FM(SDA0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR8_11_8 FM(SCL1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR8_15_12 FM(SDA1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR8_19_16 FM(SCL2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR8_23_20 FM(SDA2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR8_27_24 FM(SCL3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR8_31_28 FM(SDA3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++
++/* IP1SR8 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */
++#define IP1SR8_3_0 FM(SCL4) FM(HRX2) FM(SCK4) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP1SR8_7_4 FM(SDA4) FM(HTX2) FM(CTS4_N) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP1SR8_11_8 FM(SCL5) FM(HRTS2_N) FM(RTS4_N) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP1SR8_15_12 FM(SDA5) FM(SCIF_CLK2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP1SR8_19_16 F_(0, 0) FM(HCTS2_N) FM(TX4) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP1SR8_23_20 F_(0, 0) FM(HSCK2) FM(RX4) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+
+ #define PINMUX_GPSR \
+ GPSR3_29 \
+@@ -711,7 +711,7 @@ static const u16 pinmux_data[] = {
+ PINMUX_DATA_GP_ALL(),
+
+ /* IP0SR0 */
+- PINMUX_IPSR_GPSR(IP0SR0_3_0, ERROROUTC_B),
++ PINMUX_IPSR_GPSR(IP0SR0_3_0, ERROROUTC_N_B),
+ PINMUX_IPSR_GPSR(IP0SR0_3_0, TCLK2_A),
+
+ PINMUX_IPSR_GPSR(IP0SR0_7_4, MSIOF3_SS1),
+@@ -977,7 +977,7 @@ static const u16 pinmux_data[] = {
+
+ PINMUX_IPSR_GPSR(IP1SR3_27_24, IPC_CLKOUT),
+ PINMUX_IPSR_GPSR(IP1SR3_27_24, IPC_CLKEN_OUT),
+- PINMUX_IPSR_GPSR(IP1SR3_27_24, ERROROUTC_A),
++ PINMUX_IPSR_GPSR(IP1SR3_27_24, ERROROUTC_N_A),
+ PINMUX_IPSR_GPSR(IP1SR3_27_24, TCLK4_X),
+
+ PINMUX_IPSR_GPSR(IP1SR3_31_28, QSPI0_SSL),
+--
+2.39.2
+
--- /dev/null
+From e9bc57d67f1500c8e1b2fdbc82c0adca37c4c39e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Nov 2022 14:18:37 +0100
+Subject: pinctrl: renesas: r8a779g0: Fix Group 4/5 pin functions
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 0a7a5226e7b177c68800985a19a80c1df9bceff6 ]
+
+According to R-Car V4H Series User’s Manual: Hardware Rev. 0.54, pin
+groups 4 and 5 do not use Module Select Registers to configure pin
+functions, but use Peripheral Function Select Registers instead.
+
+Hence:
+ - Remove the non-existent Module Select Registers (MODSEL[45]),
+ - Add the missing Peripheral Function Select Registers (IPxSR[45]),
+ - Correct the GPIO / Peripheral Function Select Register definitions
+ (GPSR]45_*),
+ - Correct the affected PINMUX definitions.
+
+Fixes: 36611d28f5130d8b ("pinctrl: renesas: r8a779g0: Add missing MODSELx for AVBx")
+Fixes: 36fb7b8af55b83e0 ("pinctrl: renesas: r8a779g0: Add missing MODSELx for TSN0")
+Fixes: ad9bb2fec66262b0 ("pinctrl: renesas: Initial R8A779G0 (R-Car V4H) PFC support")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/3d3833d1738f5e8fcc4c1002aa93832464d129a0.1669036423.git.geert+renesas@glider.be
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/renesas/pfc-r8a779g0.c | 467 +++++++++++++++----------
+ 1 file changed, 279 insertions(+), 188 deletions(-)
+
+diff --git a/drivers/pinctrl/renesas/pfc-r8a779g0.c b/drivers/pinctrl/renesas/pfc-r8a779g0.c
+index bf7fcce2d9c6b..bc1352d36d49f 100644
+--- a/drivers/pinctrl/renesas/pfc-r8a779g0.c
++++ b/drivers/pinctrl/renesas/pfc-r8a779g0.c
+@@ -156,54 +156,54 @@
+ #define GPSR3_0 F_(MMC_SD_D1, IP0SR3_3_0)
+
+ /* GPSR4 */
+-#define GPSR4_24 FM(AVS1)
+-#define GPSR4_23 FM(AVS0)
+-#define GPSR4_22 FM(PCIE1_CLKREQ_N)
+-#define GPSR4_21 FM(PCIE0_CLKREQ_N)
+-#define GPSR4_20 FM(TSN0_TXCREFCLK)
+-#define GPSR4_19 FM(TSN0_TD2)
+-#define GPSR4_18 FM(TSN0_TD3)
+-#define GPSR4_17 FM(TSN0_RD2)
+-#define GPSR4_16 FM(TSN0_RD3)
+-#define GPSR4_15 FM(TSN0_TD0)
+-#define GPSR4_14 FM(TSN0_TD1)
+-#define GPSR4_13 FM(TSN0_RD1)
+-#define GPSR4_12 FM(TSN0_TXC)
+-#define GPSR4_11 FM(TSN0_RXC)
+-#define GPSR4_10 FM(TSN0_RD0)
+-#define GPSR4_9 FM(TSN0_TX_CTL)
+-#define GPSR4_8 FM(TSN0_AVTP_PPS0)
+-#define GPSR4_7 FM(TSN0_RX_CTL)
+-#define GPSR4_6 FM(TSN0_AVTP_CAPTURE)
+-#define GPSR4_5 FM(TSN0_AVTP_MATCH)
+-#define GPSR4_4 FM(TSN0_LINK)
+-#define GPSR4_3 FM(TSN0_PHY_INT)
+-#define GPSR4_2 FM(TSN0_AVTP_PPS1)
+-#define GPSR4_1 FM(TSN0_MDC)
+-#define GPSR4_0 FM(TSN0_MDIO)
++#define GPSR4_24 F_(AVS1, IP3SR4_3_0)
++#define GPSR4_23 F_(AVS0, IP2SR4_31_28)
++#define GPSR4_22 F_(PCIE1_CLKREQ_N, IP2SR4_27_24)
++#define GPSR4_21 F_(PCIE0_CLKREQ_N, IP2SR4_23_20)
++#define GPSR4_20 F_(TSN0_TXCREFCLK, IP2SR4_19_16)
++#define GPSR4_19 F_(TSN0_TD2, IP2SR4_15_12)
++#define GPSR4_18 F_(TSN0_TD3, IP2SR4_11_8)
++#define GPSR4_17 F_(TSN0_RD2, IP2SR4_7_4)
++#define GPSR4_16 F_(TSN0_RD3, IP2SR4_3_0)
++#define GPSR4_15 F_(TSN0_TD0, IP1SR4_31_28)
++#define GPSR4_14 F_(TSN0_TD1, IP1SR4_27_24)
++#define GPSR4_13 F_(TSN0_RD1, IP1SR4_23_20)
++#define GPSR4_12 F_(TSN0_TXC, IP1SR4_19_16)
++#define GPSR4_11 F_(TSN0_RXC, IP1SR4_15_12)
++#define GPSR4_10 F_(TSN0_RD0, IP1SR4_11_8)
++#define GPSR4_9 F_(TSN0_TX_CTL, IP1SR4_7_4)
++#define GPSR4_8 F_(TSN0_AVTP_PPS0, IP1SR4_3_0)
++#define GPSR4_7 F_(TSN0_RX_CTL, IP0SR4_31_28)
++#define GPSR4_6 F_(TSN0_AVTP_CAPTURE, IP0SR4_27_24)
++#define GPSR4_5 F_(TSN0_AVTP_MATCH, IP0SR4_23_20)
++#define GPSR4_4 F_(TSN0_LINK, IP0SR4_19_16)
++#define GPSR4_3 F_(TSN0_PHY_INT, IP0SR4_15_12)
++#define GPSR4_2 F_(TSN0_AVTP_PPS1, IP0SR4_11_8)
++#define GPSR4_1 F_(TSN0_MDC, IP0SR4_7_4)
++#define GPSR4_0 F_(TSN0_MDIO, IP0SR4_3_0)
+
+ /* GPSR 5 */
+-#define GPSR5_20 FM(AVB2_RX_CTL)
+-#define GPSR5_19 FM(AVB2_TX_CTL)
+-#define GPSR5_18 FM(AVB2_RXC)
+-#define GPSR5_17 FM(AVB2_RD0)
+-#define GPSR5_16 FM(AVB2_TXC)
+-#define GPSR5_15 FM(AVB2_TD0)
+-#define GPSR5_14 FM(AVB2_RD1)
+-#define GPSR5_13 FM(AVB2_RD2)
+-#define GPSR5_12 FM(AVB2_TD1)
+-#define GPSR5_11 FM(AVB2_TD2)
+-#define GPSR5_10 FM(AVB2_MDIO)
+-#define GPSR5_9 FM(AVB2_RD3)
+-#define GPSR5_8 FM(AVB2_TD3)
+-#define GPSR5_7 FM(AVB2_TXCREFCLK)
+-#define GPSR5_6 FM(AVB2_MDC)
+-#define GPSR5_5 FM(AVB2_MAGIC)
+-#define GPSR5_4 FM(AVB2_PHY_INT)
+-#define GPSR5_3 FM(AVB2_LINK)
+-#define GPSR5_2 FM(AVB2_AVTP_MATCH)
+-#define GPSR5_1 FM(AVB2_AVTP_CAPTURE)
+-#define GPSR5_0 FM(AVB2_AVTP_PPS)
++#define GPSR5_20 F_(AVB2_RX_CTL, IP2SR5_19_16)
++#define GPSR5_19 F_(AVB2_TX_CTL, IP2SR5_15_12)
++#define GPSR5_18 F_(AVB2_RXC, IP2SR5_11_8)
++#define GPSR5_17 F_(AVB2_RD0, IP2SR5_7_4)
++#define GPSR5_16 F_(AVB2_TXC, IP2SR5_3_0)
++#define GPSR5_15 F_(AVB2_TD0, IP1SR5_31_28)
++#define GPSR5_14 F_(AVB2_RD1, IP1SR5_27_24)
++#define GPSR5_13 F_(AVB2_RD2, IP1SR5_23_20)
++#define GPSR5_12 F_(AVB2_TD1, IP1SR5_19_16)
++#define GPSR5_11 F_(AVB2_TD2, IP1SR5_15_12)
++#define GPSR5_10 F_(AVB2_MDIO, IP1SR5_11_8)
++#define GPSR5_9 F_(AVB2_RD3, IP1SR5_7_4)
++#define GPSR5_8 F_(AVB2_TD3, IP1SR5_3_0)
++#define GPSR5_7 F_(AVB2_TXCREFCLK, IP0SR5_31_28)
++#define GPSR5_6 F_(AVB2_MDC, IP0SR5_27_24)
++#define GPSR5_5 F_(AVB2_MAGIC, IP0SR5_23_20)
++#define GPSR5_4 F_(AVB2_PHY_INT, IP0SR5_19_16)
++#define GPSR5_3 F_(AVB2_LINK, IP0SR5_15_12)
++#define GPSR5_2 F_(AVB2_AVTP_MATCH, IP0SR5_11_8)
++#define GPSR5_1 F_(AVB2_AVTP_CAPTURE, IP0SR5_7_4)
++#define GPSR5_0 F_(AVB2_AVTP_PPS, IP0SR5_3_0)
+
+ /* GPSR 6 */
+ #define GPSR6_20 F_(AVB1_TXCREFCLK, IP2SR6_19_16)
+@@ -397,6 +397,68 @@
+ #define IP3SR3_19_16 FM(RPC_WP_N) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+ #define IP3SR3_23_20 FM(RPC_INT_N) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+
++/* SR4 */
++/* IP0SR4 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */
++#define IP0SR4_3_0 FM(TSN0_MDIO) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR4_7_4 FM(TSN0_MDC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR4_11_8 FM(TSN0_AVTP_PPS1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR4_15_12 FM(TSN0_PHY_INT) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR4_19_16 FM(TSN0_LINK) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR4_23_20 FM(TSN0_AVTP_MATCH) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR4_27_24 FM(TSN0_AVTP_CAPTURE) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR4_31_28 FM(TSN0_RX_CTL) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++
++/* IP1SR4 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */
++#define IP1SR4_3_0 FM(TSN0_AVTP_PPS0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP1SR4_7_4 FM(TSN0_TX_CTL) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP1SR4_11_8 FM(TSN0_RD0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP1SR4_15_12 FM(TSN0_RXC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP1SR4_19_16 FM(TSN0_TXC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP1SR4_23_20 FM(TSN0_RD1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP1SR4_27_24 FM(TSN0_TD1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP1SR4_31_28 FM(TSN0_TD0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++
++/* IP2SR4 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */
++#define IP2SR4_3_0 FM(TSN0_RD3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP2SR4_7_4 FM(TSN0_RD2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP2SR4_11_8 FM(TSN0_TD3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP2SR4_15_12 FM(TSN0_TD2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP2SR4_19_16 FM(TSN0_TXCREFCLK) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP2SR4_23_20 FM(PCIE0_CLKREQ_N) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP2SR4_27_24 FM(PCIE1_CLKREQ_N) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP2SR4_31_28 FM(AVS0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++
++/* IP3SR4 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */
++#define IP3SR4_3_0 FM(AVS1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++
++/* SR5 */
++/* IP0SR5 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */
++#define IP0SR5_3_0 FM(AVB2_AVTP_PPS) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR5_7_4 FM(AVB2_AVTP_CAPTURE) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR5_11_8 FM(AVB2_AVTP_MATCH) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR5_15_12 FM(AVB2_LINK) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR5_19_16 FM(AVB2_PHY_INT) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR5_23_20 FM(AVB2_MAGIC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR5_27_24 FM(AVB2_MDC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP0SR5_31_28 FM(AVB2_TXCREFCLK) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++
++/* IP1SR5 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */
++#define IP1SR5_3_0 FM(AVB2_TD3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP1SR5_7_4 FM(AVB2_RD3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP1SR5_11_8 FM(AVB2_MDIO) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP1SR5_15_12 FM(AVB2_TD2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP1SR5_19_16 FM(AVB2_TD1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP1SR5_23_20 FM(AVB2_RD2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP1SR5_27_24 FM(AVB2_RD1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP1SR5_31_28 FM(AVB2_TD0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++
++/* IP2SR5 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */
++#define IP2SR5_3_0 FM(AVB2_TXC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP2SR5_7_4 FM(AVB2_RD0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP2SR5_11_8 FM(AVB2_RXC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP2SR5_15_12 FM(AVB2_TX_CTL) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++#define IP2SR5_19_16 FM(AVB2_RX_CTL) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
++
+ /* SR6 */
+ /* IP0SR6 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */
+ #define IP0SR6_3_0 FM(AVB1_MDIO) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+@@ -542,6 +604,24 @@ FM(IP0SR3_23_20) IP0SR3_23_20 FM(IP1SR3_23_20) IP1SR3_23_20 FM(IP2SR3_23_20) IP2
+ FM(IP0SR3_27_24) IP0SR3_27_24 FM(IP1SR3_27_24) IP1SR3_27_24 FM(IP2SR3_27_24) IP2SR3_27_24 \
+ FM(IP0SR3_31_28) IP0SR3_31_28 FM(IP1SR3_31_28) IP1SR3_31_28 FM(IP2SR3_31_28) IP2SR3_31_28 \
+ \
++FM(IP0SR4_3_0) IP0SR4_3_0 FM(IP1SR4_3_0) IP1SR4_3_0 FM(IP2SR4_3_0) IP2SR4_3_0 FM(IP3SR4_3_0) IP3SR4_3_0 \
++FM(IP0SR4_7_4) IP0SR4_7_4 FM(IP1SR4_7_4) IP1SR4_7_4 FM(IP2SR4_7_4) IP2SR4_7_4 \
++FM(IP0SR4_11_8) IP0SR4_11_8 FM(IP1SR4_11_8) IP1SR4_11_8 FM(IP2SR4_11_8) IP2SR4_11_8 \
++FM(IP0SR4_15_12) IP0SR4_15_12 FM(IP1SR4_15_12) IP1SR4_15_12 FM(IP2SR4_15_12) IP2SR4_15_12 \
++FM(IP0SR4_19_16) IP0SR4_19_16 FM(IP1SR4_19_16) IP1SR4_19_16 FM(IP2SR4_19_16) IP2SR4_19_16 \
++FM(IP0SR4_23_20) IP0SR4_23_20 FM(IP1SR4_23_20) IP1SR4_23_20 FM(IP2SR4_23_20) IP2SR4_23_20 \
++FM(IP0SR4_27_24) IP0SR4_27_24 FM(IP1SR4_27_24) IP1SR4_27_24 FM(IP2SR4_27_24) IP2SR4_27_24 \
++FM(IP0SR4_31_28) IP0SR4_31_28 FM(IP1SR4_31_28) IP1SR4_31_28 FM(IP2SR4_31_28) IP2SR4_31_28 \
++\
++FM(IP0SR5_3_0) IP0SR5_3_0 FM(IP1SR5_3_0) IP1SR5_3_0 FM(IP2SR5_3_0) IP2SR5_3_0 \
++FM(IP0SR5_7_4) IP0SR5_7_4 FM(IP1SR5_7_4) IP1SR5_7_4 FM(IP2SR5_7_4) IP2SR5_7_4 \
++FM(IP0SR5_11_8) IP0SR5_11_8 FM(IP1SR5_11_8) IP1SR5_11_8 FM(IP2SR5_11_8) IP2SR5_11_8 \
++FM(IP0SR5_15_12) IP0SR5_15_12 FM(IP1SR5_15_12) IP1SR5_15_12 FM(IP2SR5_15_12) IP2SR5_15_12 \
++FM(IP0SR5_19_16) IP0SR5_19_16 FM(IP1SR5_19_16) IP1SR5_19_16 FM(IP2SR5_19_16) IP2SR5_19_16 \
++FM(IP0SR5_23_20) IP0SR5_23_20 FM(IP1SR5_23_20) IP1SR5_23_20 \
++FM(IP0SR5_27_24) IP0SR5_27_24 FM(IP1SR5_27_24) IP1SR5_27_24 \
++FM(IP0SR5_31_28) IP0SR5_31_28 FM(IP1SR5_31_28) IP1SR5_31_28 \
++\
+ FM(IP0SR6_3_0) IP0SR6_3_0 FM(IP1SR6_3_0) IP1SR6_3_0 FM(IP2SR6_3_0) IP2SR6_3_0 \
+ FM(IP0SR6_7_4) IP0SR6_7_4 FM(IP1SR6_7_4) IP1SR6_7_4 FM(IP2SR6_7_4) IP2SR6_7_4 \
+ FM(IP0SR6_11_8) IP0SR6_11_8 FM(IP1SR6_11_8) IP1SR6_11_8 FM(IP2SR6_11_8) IP2SR6_11_8 \
+@@ -569,30 +649,6 @@ FM(IP0SR8_23_20) IP0SR8_23_20 FM(IP1SR8_23_20) IP1SR8_23_20 \
+ FM(IP0SR8_27_24) IP0SR8_27_24 \
+ FM(IP0SR8_31_28) IP0SR8_31_28
+
+-/* MOD_SEL4 */ /* 0 */ /* 1 */
+-#define MOD_SEL4_19 FM(SEL_TSN0_TD2_0) FM(SEL_TSN0_TD2_1)
+-#define MOD_SEL4_18 FM(SEL_TSN0_TD3_0) FM(SEL_TSN0_TD3_1)
+-#define MOD_SEL4_15 FM(SEL_TSN0_TD0_0) FM(SEL_TSN0_TD0_1)
+-#define MOD_SEL4_14 FM(SEL_TSN0_TD1_0) FM(SEL_TSN0_TD1_1)
+-#define MOD_SEL4_12 FM(SEL_TSN0_TXC_0) FM(SEL_TSN0_TXC_1)
+-#define MOD_SEL4_9 FM(SEL_TSN0_TX_CTL_0) FM(SEL_TSN0_TX_CTL_1)
+-#define MOD_SEL4_8 FM(SEL_TSN0_AVTP_PPS0_0) FM(SEL_TSN0_AVTP_PPS0_1)
+-#define MOD_SEL4_5 FM(SEL_TSN0_AVTP_MATCH_0) FM(SEL_TSN0_AVTP_MATCH_1)
+-#define MOD_SEL4_2 FM(SEL_TSN0_AVTP_PPS1_0) FM(SEL_TSN0_AVTP_PPS1_1)
+-#define MOD_SEL4_1 FM(SEL_TSN0_MDC_0) FM(SEL_TSN0_MDC_1)
+-
+-/* MOD_SEL5 */ /* 0 */ /* 1 */
+-#define MOD_SEL5_19 FM(SEL_AVB2_TX_CTL_0) FM(SEL_AVB2_TX_CTL_1)
+-#define MOD_SEL5_16 FM(SEL_AVB2_TXC_0) FM(SEL_AVB2_TXC_1)
+-#define MOD_SEL5_15 FM(SEL_AVB2_TD0_0) FM(SEL_AVB2_TD0_1)
+-#define MOD_SEL5_12 FM(SEL_AVB2_TD1_0) FM(SEL_AVB2_TD1_1)
+-#define MOD_SEL5_11 FM(SEL_AVB2_TD2_0) FM(SEL_AVB2_TD2_1)
+-#define MOD_SEL5_8 FM(SEL_AVB2_TD3_0) FM(SEL_AVB2_TD3_1)
+-#define MOD_SEL5_6 FM(SEL_AVB2_MDC_0) FM(SEL_AVB2_MDC_1)
+-#define MOD_SEL5_5 FM(SEL_AVB2_MAGIC_0) FM(SEL_AVB2_MAGIC_1)
+-#define MOD_SEL5_2 FM(SEL_AVB2_AVTP_MATCH_0) FM(SEL_AVB2_AVTP_MATCH_1)
+-#define MOD_SEL5_0 FM(SEL_AVB2_AVTP_PPS_0) FM(SEL_AVB2_AVTP_PPS_1)
+-
+ /* MOD_SEL6 */ /* 0 */ /* 1 */
+ #define MOD_SEL6_18 FM(SEL_AVB1_TD3_0) FM(SEL_AVB1_TD3_1)
+ #define MOD_SEL6_16 FM(SEL_AVB1_TD2_0) FM(SEL_AVB1_TD2_1)
+@@ -633,26 +689,23 @@ FM(IP0SR8_31_28) IP0SR8_31_28
+
+ #define PINMUX_MOD_SELS \
+ \
+-MOD_SEL4_19 MOD_SEL5_19 \
+-MOD_SEL4_18 MOD_SEL6_18 \
+- \
+- MOD_SEL5_16 MOD_SEL6_16 MOD_SEL7_16 \
+-MOD_SEL4_15 MOD_SEL5_15 MOD_SEL7_15 \
+-MOD_SEL4_14 \
+- MOD_SEL6_13 MOD_SEL7_13 \
+-MOD_SEL4_12 MOD_SEL5_12 MOD_SEL6_12 \
+- MOD_SEL5_11 MOD_SEL7_11 MOD_SEL8_11 \
+- MOD_SEL6_10 MOD_SEL7_10 MOD_SEL8_10 \
+-MOD_SEL4_9 MOD_SEL8_9 \
+-MOD_SEL4_8 MOD_SEL5_8 MOD_SEL8_8 \
+- MOD_SEL6_7 MOD_SEL7_7 MOD_SEL8_7 \
+- MOD_SEL5_6 MOD_SEL6_6 MOD_SEL7_6 MOD_SEL8_6 \
+-MOD_SEL4_5 MOD_SEL5_5 MOD_SEL6_5 MOD_SEL8_5 \
+- MOD_SEL8_4 \
+- MOD_SEL7_3 MOD_SEL8_3 \
+-MOD_SEL4_2 MOD_SEL5_2 MOD_SEL6_2 MOD_SEL7_2 MOD_SEL8_2 \
+-MOD_SEL4_1 MOD_SEL6_1 MOD_SEL8_1 \
+- MOD_SEL5_0 MOD_SEL7_0 MOD_SEL8_0
++MOD_SEL6_18 \
++MOD_SEL6_16 MOD_SEL7_16 \
++ MOD_SEL7_15 \
++MOD_SEL6_13 MOD_SEL7_13 \
++MOD_SEL6_12 \
++ MOD_SEL7_11 MOD_SEL8_11 \
++MOD_SEL6_10 MOD_SEL7_10 MOD_SEL8_10 \
++ MOD_SEL8_9 \
++ MOD_SEL8_8 \
++MOD_SEL6_7 MOD_SEL7_7 MOD_SEL8_7 \
++MOD_SEL6_6 MOD_SEL7_6 MOD_SEL8_6 \
++MOD_SEL6_5 MOD_SEL8_5 \
++ MOD_SEL8_4 \
++ MOD_SEL7_3 MOD_SEL8_3 \
++MOD_SEL6_2 MOD_SEL7_2 MOD_SEL8_2 \
++MOD_SEL6_1 MOD_SEL8_1 \
++ MOD_SEL7_0 MOD_SEL8_0
+
+ enum {
+ PINMUX_RESERVED = 0,
+@@ -686,59 +739,6 @@ enum {
+ static const u16 pinmux_data[] = {
+ PINMUX_DATA_GP_ALL(),
+
+- PINMUX_SINGLE(AVS1),
+- PINMUX_SINGLE(AVS0),
+- PINMUX_SINGLE(PCIE1_CLKREQ_N),
+- PINMUX_SINGLE(PCIE0_CLKREQ_N),
+-
+- /* TSN0 without MODSEL4 */
+- PINMUX_SINGLE(TSN0_TXCREFCLK),
+- PINMUX_SINGLE(TSN0_RD2),
+- PINMUX_SINGLE(TSN0_RD3),
+- PINMUX_SINGLE(TSN0_RD1),
+- PINMUX_SINGLE(TSN0_RXC),
+- PINMUX_SINGLE(TSN0_RD0),
+- PINMUX_SINGLE(TSN0_RX_CTL),
+- PINMUX_SINGLE(TSN0_AVTP_CAPTURE),
+- PINMUX_SINGLE(TSN0_LINK),
+- PINMUX_SINGLE(TSN0_PHY_INT),
+- PINMUX_SINGLE(TSN0_MDIO),
+- /* TSN0 with MODSEL4 */
+- PINMUX_IPSR_NOGM(0, TSN0_TD2, SEL_TSN0_TD2_1),
+- PINMUX_IPSR_NOGM(0, TSN0_TD3, SEL_TSN0_TD3_1),
+- PINMUX_IPSR_NOGM(0, TSN0_TD0, SEL_TSN0_TD0_1),
+- PINMUX_IPSR_NOGM(0, TSN0_TD1, SEL_TSN0_TD1_1),
+- PINMUX_IPSR_NOGM(0, TSN0_TXC, SEL_TSN0_TXC_1),
+- PINMUX_IPSR_NOGM(0, TSN0_TX_CTL, SEL_TSN0_TX_CTL_1),
+- PINMUX_IPSR_NOGM(0, TSN0_AVTP_PPS0, SEL_TSN0_AVTP_PPS0_1),
+- PINMUX_IPSR_NOGM(0, TSN0_AVTP_MATCH, SEL_TSN0_AVTP_MATCH_1),
+- PINMUX_IPSR_NOGM(0, TSN0_AVTP_PPS1, SEL_TSN0_AVTP_PPS1_1),
+- PINMUX_IPSR_NOGM(0, TSN0_MDC, SEL_TSN0_MDC_1),
+-
+- /* TSN0 without MODSEL5 */
+- PINMUX_SINGLE(AVB2_RX_CTL),
+- PINMUX_SINGLE(AVB2_RXC),
+- PINMUX_SINGLE(AVB2_RD0),
+- PINMUX_SINGLE(AVB2_RD1),
+- PINMUX_SINGLE(AVB2_RD2),
+- PINMUX_SINGLE(AVB2_MDIO),
+- PINMUX_SINGLE(AVB2_RD3),
+- PINMUX_SINGLE(AVB2_TXCREFCLK),
+- PINMUX_SINGLE(AVB2_PHY_INT),
+- PINMUX_SINGLE(AVB2_LINK),
+- PINMUX_SINGLE(AVB2_AVTP_CAPTURE),
+- /* TSN0 with MODSEL5 */
+- PINMUX_IPSR_NOGM(0, AVB2_TX_CTL, SEL_AVB2_TX_CTL_1),
+- PINMUX_IPSR_NOGM(0, AVB2_TXC, SEL_AVB2_TXC_1),
+- PINMUX_IPSR_NOGM(0, AVB2_TD0, SEL_AVB2_TD0_1),
+- PINMUX_IPSR_NOGM(0, AVB2_TD1, SEL_AVB2_TD1_1),
+- PINMUX_IPSR_NOGM(0, AVB2_TD2, SEL_AVB2_TD2_1),
+- PINMUX_IPSR_NOGM(0, AVB2_TD3, SEL_AVB2_TD3_1),
+- PINMUX_IPSR_NOGM(0, AVB2_MDC, SEL_AVB2_MDC_1),
+- PINMUX_IPSR_NOGM(0, AVB2_MAGIC, SEL_AVB2_MAGIC_1),
+- PINMUX_IPSR_NOGM(0, AVB2_AVTP_MATCH, SEL_AVB2_AVTP_MATCH_1),
+- PINMUX_IPSR_NOGM(0, AVB2_AVTP_PPS, SEL_AVB2_AVTP_PPS_1),
+-
+ /* IP0SR0 */
+ PINMUX_IPSR_GPSR(IP0SR0_3_0, ERROROUTC_B),
+ PINMUX_IPSR_GPSR(IP0SR0_3_0, TCLK2_A),
+@@ -1029,6 +1029,66 @@ static const u16 pinmux_data[] = {
+ PINMUX_IPSR_GPSR(IP3SR3_19_16, RPC_WP_N),
+ PINMUX_IPSR_GPSR(IP3SR3_23_20, RPC_INT_N),
+
++ /* IP0SR4 */
++ PINMUX_IPSR_GPSR(IP0SR4_3_0, TSN0_MDIO),
++ PINMUX_IPSR_GPSR(IP0SR4_7_4, TSN0_MDC),
++ PINMUX_IPSR_GPSR(IP0SR4_11_8, TSN0_AVTP_PPS1),
++ PINMUX_IPSR_GPSR(IP0SR4_15_12, TSN0_PHY_INT),
++ PINMUX_IPSR_GPSR(IP0SR4_19_16, TSN0_LINK),
++ PINMUX_IPSR_GPSR(IP0SR4_23_20, TSN0_AVTP_MATCH),
++ PINMUX_IPSR_GPSR(IP0SR4_27_24, TSN0_AVTP_CAPTURE),
++ PINMUX_IPSR_GPSR(IP0SR4_31_28, TSN0_RX_CTL),
++
++ /* IP1SR4 */
++ PINMUX_IPSR_GPSR(IP1SR4_3_0, TSN0_AVTP_PPS0),
++ PINMUX_IPSR_GPSR(IP1SR4_7_4, TSN0_TX_CTL),
++ PINMUX_IPSR_GPSR(IP1SR4_11_8, TSN0_RD0),
++ PINMUX_IPSR_GPSR(IP1SR4_15_12, TSN0_RXC),
++ PINMUX_IPSR_GPSR(IP1SR4_19_16, TSN0_TXC),
++ PINMUX_IPSR_GPSR(IP1SR4_23_20, TSN0_RD1),
++ PINMUX_IPSR_GPSR(IP1SR4_27_24, TSN0_TD1),
++ PINMUX_IPSR_GPSR(IP1SR4_31_28, TSN0_TD0),
++
++ /* IP2SR4 */
++ PINMUX_IPSR_GPSR(IP2SR4_3_0, TSN0_RD3),
++ PINMUX_IPSR_GPSR(IP2SR4_7_4, TSN0_RD2),
++ PINMUX_IPSR_GPSR(IP2SR4_11_8, TSN0_TD3),
++ PINMUX_IPSR_GPSR(IP2SR4_15_12, TSN0_TD2),
++ PINMUX_IPSR_GPSR(IP2SR4_19_16, TSN0_TXCREFCLK),
++ PINMUX_IPSR_GPSR(IP2SR4_23_20, PCIE0_CLKREQ_N),
++ PINMUX_IPSR_GPSR(IP2SR4_27_24, PCIE1_CLKREQ_N),
++ PINMUX_IPSR_GPSR(IP2SR4_31_28, AVS0),
++
++ /* IP3SR4 */
++ PINMUX_IPSR_GPSR(IP3SR4_3_0, AVS1),
++
++ /* IP0SR5 */
++ PINMUX_IPSR_GPSR(IP0SR5_3_0, AVB2_AVTP_PPS),
++ PINMUX_IPSR_GPSR(IP0SR5_7_4, AVB2_AVTP_CAPTURE),
++ PINMUX_IPSR_GPSR(IP0SR5_11_8, AVB2_AVTP_MATCH),
++ PINMUX_IPSR_GPSR(IP0SR5_15_12, AVB2_LINK),
++ PINMUX_IPSR_GPSR(IP0SR5_19_16, AVB2_PHY_INT),
++ PINMUX_IPSR_GPSR(IP0SR5_23_20, AVB2_MAGIC),
++ PINMUX_IPSR_GPSR(IP0SR5_27_24, AVB2_MDC),
++ PINMUX_IPSR_GPSR(IP0SR5_31_28, AVB2_TXCREFCLK),
++
++ /* IP1SR5 */
++ PINMUX_IPSR_GPSR(IP1SR5_3_0, AVB2_TD3),
++ PINMUX_IPSR_GPSR(IP1SR5_7_4, AVB2_RD3),
++ PINMUX_IPSR_GPSR(IP1SR5_11_8, AVB2_MDIO),
++ PINMUX_IPSR_GPSR(IP1SR5_15_12, AVB2_TD2),
++ PINMUX_IPSR_GPSR(IP1SR5_19_16, AVB2_TD1),
++ PINMUX_IPSR_GPSR(IP1SR5_23_20, AVB2_RD2),
++ PINMUX_IPSR_GPSR(IP1SR5_27_24, AVB2_RD1),
++ PINMUX_IPSR_GPSR(IP1SR5_31_28, AVB2_TD0),
++
++ /* IP2SR5 */
++ PINMUX_IPSR_GPSR(IP2SR5_3_0, AVB2_TXC),
++ PINMUX_IPSR_GPSR(IP2SR5_7_4, AVB2_RD0),
++ PINMUX_IPSR_GPSR(IP2SR5_11_8, AVB2_RXC),
++ PINMUX_IPSR_GPSR(IP2SR5_15_12, AVB2_TX_CTL),
++ PINMUX_IPSR_GPSR(IP2SR5_19_16, AVB2_RX_CTL),
++
+ /* IP0SR6 */
+ PINMUX_IPSR_GPSR(IP0SR6_3_0, AVB1_MDIO),
+
+@@ -3419,6 +3479,82 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
+ IP3SR3_7_4
+ IP3SR3_3_0))
+ },
++ { PINMUX_CFG_REG_VAR("IP0SR4", 0xE6060060, 32,
++ GROUP(4, 4, 4, 4, 4, 4, 4, 4),
++ GROUP(
++ IP0SR4_31_28
++ IP0SR4_27_24
++ IP0SR4_23_20
++ IP0SR4_19_16
++ IP0SR4_15_12
++ IP0SR4_11_8
++ IP0SR4_7_4
++ IP0SR4_3_0))
++ },
++ { PINMUX_CFG_REG_VAR("IP1SR4", 0xE6060064, 32,
++ GROUP(4, 4, 4, 4, 4, 4, 4, 4),
++ GROUP(
++ IP1SR4_31_28
++ IP1SR4_27_24
++ IP1SR4_23_20
++ IP1SR4_19_16
++ IP1SR4_15_12
++ IP1SR4_11_8
++ IP1SR4_7_4
++ IP1SR4_3_0))
++ },
++ { PINMUX_CFG_REG_VAR("IP2SR4", 0xE6060068, 32,
++ GROUP(4, 4, 4, 4, 4, 4, 4, 4),
++ GROUP(
++ IP2SR4_31_28
++ IP2SR4_27_24
++ IP2SR4_23_20
++ IP2SR4_19_16
++ IP2SR4_15_12
++ IP2SR4_11_8
++ IP2SR4_7_4
++ IP2SR4_3_0))
++ },
++ { PINMUX_CFG_REG_VAR("IP3SR4", 0xE606006C, 32,
++ GROUP(-28, 4),
++ GROUP(
++ /* IP3SR4_31_4 RESERVED */
++ IP3SR4_3_0))
++ },
++ { PINMUX_CFG_REG_VAR("IP0SR5", 0xE6060860, 32,
++ GROUP(4, 4, 4, 4, 4, 4, 4, 4),
++ GROUP(
++ IP0SR5_31_28
++ IP0SR5_27_24
++ IP0SR5_23_20
++ IP0SR5_19_16
++ IP0SR5_15_12
++ IP0SR5_11_8
++ IP0SR5_7_4
++ IP0SR5_3_0))
++ },
++ { PINMUX_CFG_REG_VAR("IP1SR5", 0xE6060864, 32,
++ GROUP(4, 4, 4, 4, 4, 4, 4, 4),
++ GROUP(
++ IP1SR5_31_28
++ IP1SR5_27_24
++ IP1SR5_23_20
++ IP1SR5_19_16
++ IP1SR5_15_12
++ IP1SR5_11_8
++ IP1SR5_7_4
++ IP1SR5_3_0))
++ },
++ { PINMUX_CFG_REG_VAR("IP2SR5", 0xE6060868, 32,
++ GROUP(-12, 4, 4, 4, 4, 4),
++ GROUP(
++ /* IP2SR5_31_20 RESERVED */
++ IP2SR5_19_16
++ IP2SR5_15_12
++ IP2SR5_11_8
++ IP2SR5_7_4
++ IP2SR5_3_0))
++ },
+ { PINMUX_CFG_REG("IP0SR6", 0xE6061060, 32, 4, GROUP(
+ IP0SR6_31_28
+ IP0SR6_27_24
+@@ -3505,51 +3641,6 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
+
+ #define F_(x, y) x,
+ #define FM(x) FN_##x,
+- { PINMUX_CFG_REG_VAR("MOD_SEL4", 0xE6060100, 32,
+- GROUP(-12, 1, 1, -2, 1, 1, -1, 1, -2, 1, 1, -2, 1,
+- -2, 1, 1, -1),
+- GROUP(
+- /* RESERVED 31-20 */
+- MOD_SEL4_19
+- MOD_SEL4_18
+- /* RESERVED 17-16 */
+- MOD_SEL4_15
+- MOD_SEL4_14
+- /* RESERVED 13 */
+- MOD_SEL4_12
+- /* RESERVED 11-10 */
+- MOD_SEL4_9
+- MOD_SEL4_8
+- /* RESERVED 7-6 */
+- MOD_SEL4_5
+- /* RESERVED 4-3 */
+- MOD_SEL4_2
+- MOD_SEL4_1
+- /* RESERVED 0 */
+- ))
+- },
+- { PINMUX_CFG_REG_VAR("MOD_SEL5", 0xE6060900, 32,
+- GROUP(-12, 1, -2, 1, 1, -2, 1, 1, -2, 1, -1,
+- 1, 1, -2, 1, -1, 1),
+- GROUP(
+- /* RESERVED 31-20 */
+- MOD_SEL5_19
+- /* RESERVED 18-17 */
+- MOD_SEL5_16
+- MOD_SEL5_15
+- /* RESERVED 14-13 */
+- MOD_SEL5_12
+- MOD_SEL5_11
+- /* RESERVED 10-9 */
+- MOD_SEL5_8
+- /* RESERVED 7 */
+- MOD_SEL5_6
+- MOD_SEL5_5
+- /* RESERVED 4-3 */
+- MOD_SEL5_2
+- /* RESERVED 1 */
+- MOD_SEL5_0))
+- },
+ { PINMUX_CFG_REG_VAR("MOD_SEL6", 0xE6061100, 32,
+ GROUP(-13, 1, -1, 1, -2, 1, 1,
+ -1, 1, -2, 1, 1, 1, -2, 1, 1, -1),
+--
+2.39.2
+
--- /dev/null
+From 8dc515bbd6249edaf59e36fe64f4f0cb9b34faed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Nov 2022 14:18:38 +0100
+Subject: pinctrl: renesas: r8a779g0: Fix Group 6/7 pin functions
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 203734a0419cade9c76016f66e2c7ba354c249b4 ]
+
+According to R-Car V4H Series User’s Manual: Hardware Rev. 0.54, pin
+groups 6 and 7 do not use Module Select Registers to configure pin
+functions.
+
+Hence:
+ - Remove the non-existent Module Select Registers (MODSEL[67]),
+ - Correct the affected PINMUX definitions.
+
+Fixes: 36611d28f5130d8b ("pinctrl: renesas: r8a779g0: Add missing MODSELx for AVBx")
+Fixes: ad9bb2fec66262b0 ("pinctrl: renesas: Initial R8A779G0 (R-Car V4H) PFC support")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/06972cafd0efa4cfb395cfa76000a1bdae5e9e73.1669036423.git.geert+renesas@glider.be
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/renesas/pfc-r8a779g0.c | 171 +++++++------------------
+ 1 file changed, 49 insertions(+), 122 deletions(-)
+
+diff --git a/drivers/pinctrl/renesas/pfc-r8a779g0.c b/drivers/pinctrl/renesas/pfc-r8a779g0.c
+index bc1352d36d49f..104482a847e94 100644
+--- a/drivers/pinctrl/renesas/pfc-r8a779g0.c
++++ b/drivers/pinctrl/renesas/pfc-r8a779g0.c
+@@ -649,30 +649,6 @@ FM(IP0SR8_23_20) IP0SR8_23_20 FM(IP1SR8_23_20) IP1SR8_23_20 \
+ FM(IP0SR8_27_24) IP0SR8_27_24 \
+ FM(IP0SR8_31_28) IP0SR8_31_28
+
+-/* MOD_SEL6 */ /* 0 */ /* 1 */
+-#define MOD_SEL6_18 FM(SEL_AVB1_TD3_0) FM(SEL_AVB1_TD3_1)
+-#define MOD_SEL6_16 FM(SEL_AVB1_TD2_0) FM(SEL_AVB1_TD2_1)
+-#define MOD_SEL6_13 FM(SEL_AVB1_TD0_0) FM(SEL_AVB1_TD0_1)
+-#define MOD_SEL6_12 FM(SEL_AVB1_TD1_0) FM(SEL_AVB1_TD1_1)
+-#define MOD_SEL6_10 FM(SEL_AVB1_AVTP_PPS_0) FM(SEL_AVB1_AVTP_PPS_1)
+-#define MOD_SEL6_7 FM(SEL_AVB1_TX_CTL_0) FM(SEL_AVB1_TX_CTL_1)
+-#define MOD_SEL6_6 FM(SEL_AVB1_TXC_0) FM(SEL_AVB1_TXC_1)
+-#define MOD_SEL6_5 FM(SEL_AVB1_AVTP_MATCH_0) FM(SEL_AVB1_AVTP_MATCH_1)
+-#define MOD_SEL6_2 FM(SEL_AVB1_MDC_0) FM(SEL_AVB1_MDC_1)
+-#define MOD_SEL6_1 FM(SEL_AVB1_MAGIC_0) FM(SEL_AVB1_MAGIC_1)
+-
+-/* MOD_SEL7 */ /* 0 */ /* 1 */
+-#define MOD_SEL7_16 FM(SEL_AVB0_TX_CTL_0) FM(SEL_AVB0_TX_CTL_1)
+-#define MOD_SEL7_15 FM(SEL_AVB0_TXC_0) FM(SEL_AVB0_TXC_1)
+-#define MOD_SEL7_13 FM(SEL_AVB0_MDC_0) FM(SEL_AVB0_MDC_1)
+-#define MOD_SEL7_11 FM(SEL_AVB0_TD0_0) FM(SEL_AVB0_TD0_1)
+-#define MOD_SEL7_10 FM(SEL_AVB0_MAGIC_0) FM(SEL_AVB0_MAGIC_1)
+-#define MOD_SEL7_7 FM(SEL_AVB0_TD1_0) FM(SEL_AVB0_TD1_1)
+-#define MOD_SEL7_6 FM(SEL_AVB0_TD2_0) FM(SEL_AVB0_TD2_1)
+-#define MOD_SEL7_3 FM(SEL_AVB0_TD3_0) FM(SEL_AVB0_TD3_1)
+-#define MOD_SEL7_2 FM(SEL_AVB0_AVTP_MATCH_0) FM(SEL_AVB0_AVTP_MATCH_1)
+-#define MOD_SEL7_0 FM(SEL_AVB0_AVTP_PPS_0) FM(SEL_AVB0_AVTP_PPS_1)
+-
+ /* MOD_SEL8 */ /* 0 */ /* 1 */
+ #define MOD_SEL8_11 FM(SEL_SDA5_0) FM(SEL_SDA5_1)
+ #define MOD_SEL8_10 FM(SEL_SCL5_0) FM(SEL_SCL5_1)
+@@ -689,23 +665,18 @@ FM(IP0SR8_31_28) IP0SR8_31_28
+
+ #define PINMUX_MOD_SELS \
+ \
+-MOD_SEL6_18 \
+-MOD_SEL6_16 MOD_SEL7_16 \
+- MOD_SEL7_15 \
+-MOD_SEL6_13 MOD_SEL7_13 \
+-MOD_SEL6_12 \
+- MOD_SEL7_11 MOD_SEL8_11 \
+-MOD_SEL6_10 MOD_SEL7_10 MOD_SEL8_10 \
+- MOD_SEL8_9 \
+- MOD_SEL8_8 \
+-MOD_SEL6_7 MOD_SEL7_7 MOD_SEL8_7 \
+-MOD_SEL6_6 MOD_SEL7_6 MOD_SEL8_6 \
+-MOD_SEL6_5 MOD_SEL8_5 \
+- MOD_SEL8_4 \
+- MOD_SEL7_3 MOD_SEL8_3 \
+-MOD_SEL6_2 MOD_SEL7_2 MOD_SEL8_2 \
+-MOD_SEL6_1 MOD_SEL8_1 \
+- MOD_SEL7_0 MOD_SEL8_0
++MOD_SEL8_11 \
++MOD_SEL8_10 \
++MOD_SEL8_9 \
++MOD_SEL8_8 \
++MOD_SEL8_7 \
++MOD_SEL8_6 \
++MOD_SEL8_5 \
++MOD_SEL8_4 \
++MOD_SEL8_3 \
++MOD_SEL8_2 \
++MOD_SEL8_1 \
++MOD_SEL8_0
+
+ enum {
+ PINMUX_RESERVED = 0,
+@@ -1092,23 +1063,23 @@ static const u16 pinmux_data[] = {
+ /* IP0SR6 */
+ PINMUX_IPSR_GPSR(IP0SR6_3_0, AVB1_MDIO),
+
+- PINMUX_IPSR_MSEL(IP0SR6_7_4, AVB1_MAGIC, SEL_AVB1_MAGIC_1),
++ PINMUX_IPSR_GPSR(IP0SR6_7_4, AVB1_MAGIC),
+
+- PINMUX_IPSR_MSEL(IP0SR6_11_8, AVB1_MDC, SEL_AVB1_MDC_1),
++ PINMUX_IPSR_GPSR(IP0SR6_11_8, AVB1_MDC),
+
+ PINMUX_IPSR_GPSR(IP0SR6_15_12, AVB1_PHY_INT),
+
+ PINMUX_IPSR_GPSR(IP0SR6_19_16, AVB1_LINK),
+ PINMUX_IPSR_GPSR(IP0SR6_19_16, AVB1_MII_TX_ER),
+
+- PINMUX_IPSR_MSEL(IP0SR6_23_20, AVB1_AVTP_MATCH, SEL_AVB1_AVTP_MATCH_1),
+- PINMUX_IPSR_MSEL(IP0SR6_23_20, AVB1_MII_RX_ER, SEL_AVB1_AVTP_MATCH_0),
++ PINMUX_IPSR_GPSR(IP0SR6_23_20, AVB1_AVTP_MATCH),
++ PINMUX_IPSR_GPSR(IP0SR6_23_20, AVB1_MII_RX_ER),
+
+- PINMUX_IPSR_MSEL(IP0SR6_27_24, AVB1_TXC, SEL_AVB1_TXC_1),
+- PINMUX_IPSR_MSEL(IP0SR6_27_24, AVB1_MII_TXC, SEL_AVB1_TXC_0),
++ PINMUX_IPSR_GPSR(IP0SR6_27_24, AVB1_TXC),
++ PINMUX_IPSR_GPSR(IP0SR6_27_24, AVB1_MII_TXC),
+
+- PINMUX_IPSR_MSEL(IP0SR6_31_28, AVB1_TX_CTL, SEL_AVB1_TX_CTL_1),
+- PINMUX_IPSR_MSEL(IP0SR6_31_28, AVB1_MII_TX_EN, SEL_AVB1_TX_CTL_0),
++ PINMUX_IPSR_GPSR(IP0SR6_31_28, AVB1_TX_CTL),
++ PINMUX_IPSR_GPSR(IP0SR6_31_28, AVB1_MII_TX_EN),
+
+ /* IP1SR6 */
+ PINMUX_IPSR_GPSR(IP1SR6_3_0, AVB1_RXC),
+@@ -1117,17 +1088,17 @@ static const u16 pinmux_data[] = {
+ PINMUX_IPSR_GPSR(IP1SR6_7_4, AVB1_RX_CTL),
+ PINMUX_IPSR_GPSR(IP1SR6_7_4, AVB1_MII_RX_DV),
+
+- PINMUX_IPSR_MSEL(IP1SR6_11_8, AVB1_AVTP_PPS, SEL_AVB1_AVTP_PPS_1),
+- PINMUX_IPSR_MSEL(IP1SR6_11_8, AVB1_MII_COL, SEL_AVB1_AVTP_PPS_0),
++ PINMUX_IPSR_GPSR(IP1SR6_11_8, AVB1_AVTP_PPS),
++ PINMUX_IPSR_GPSR(IP1SR6_11_8, AVB1_MII_COL),
+
+ PINMUX_IPSR_GPSR(IP1SR6_15_12, AVB1_AVTP_CAPTURE),
+ PINMUX_IPSR_GPSR(IP1SR6_15_12, AVB1_MII_CRS),
+
+- PINMUX_IPSR_MSEL(IP1SR6_19_16, AVB1_TD1, SEL_AVB1_TD1_1),
+- PINMUX_IPSR_MSEL(IP1SR6_19_16, AVB1_MII_TD1, SEL_AVB1_TD1_0),
++ PINMUX_IPSR_GPSR(IP1SR6_19_16, AVB1_TD1),
++ PINMUX_IPSR_GPSR(IP1SR6_19_16, AVB1_MII_TD1),
+
+- PINMUX_IPSR_MSEL(IP1SR6_23_20, AVB1_TD0, SEL_AVB1_TD0_1),
+- PINMUX_IPSR_MSEL(IP1SR6_23_20, AVB1_MII_TD0, SEL_AVB1_TD0_0),
++ PINMUX_IPSR_GPSR(IP1SR6_23_20, AVB1_TD0),
++ PINMUX_IPSR_GPSR(IP1SR6_23_20, AVB1_MII_TD0),
+
+ PINMUX_IPSR_GPSR(IP1SR6_27_24, AVB1_RD1),
+ PINMUX_IPSR_GPSR(IP1SR6_27_24, AVB1_MII_RD1),
+@@ -1136,14 +1107,14 @@ static const u16 pinmux_data[] = {
+ PINMUX_IPSR_GPSR(IP1SR6_31_28, AVB1_MII_RD0),
+
+ /* IP2SR6 */
+- PINMUX_IPSR_MSEL(IP2SR6_3_0, AVB1_TD2, SEL_AVB1_TD2_1),
+- PINMUX_IPSR_MSEL(IP2SR6_3_0, AVB1_MII_TD2, SEL_AVB1_TD2_0),
++ PINMUX_IPSR_GPSR(IP2SR6_3_0, AVB1_TD2),
++ PINMUX_IPSR_GPSR(IP2SR6_3_0, AVB1_MII_TD2),
+
+ PINMUX_IPSR_GPSR(IP2SR6_7_4, AVB1_RD2),
+ PINMUX_IPSR_GPSR(IP2SR6_7_4, AVB1_MII_RD2),
+
+- PINMUX_IPSR_MSEL(IP2SR6_11_8, AVB1_TD3, SEL_AVB1_TD3_1),
+- PINMUX_IPSR_MSEL(IP2SR6_11_8, AVB1_MII_TD3, SEL_AVB1_TD3_0),
++ PINMUX_IPSR_GPSR(IP2SR6_11_8, AVB1_TD3),
++ PINMUX_IPSR_GPSR(IP2SR6_11_8, AVB1_MII_TD3),
+
+ PINMUX_IPSR_GPSR(IP2SR6_15_12, AVB1_RD3),
+ PINMUX_IPSR_GPSR(IP2SR6_15_12, AVB1_MII_RD3),
+@@ -1151,29 +1122,29 @@ static const u16 pinmux_data[] = {
+ PINMUX_IPSR_GPSR(IP2SR6_19_16, AVB1_TXCREFCLK),
+
+ /* IP0SR7 */
+- PINMUX_IPSR_MSEL(IP0SR7_3_0, AVB0_AVTP_PPS, SEL_AVB0_AVTP_PPS_1),
+- PINMUX_IPSR_MSEL(IP0SR7_3_0, AVB0_MII_COL, SEL_AVB0_AVTP_PPS_0),
++ PINMUX_IPSR_GPSR(IP0SR7_3_0, AVB0_AVTP_PPS),
++ PINMUX_IPSR_GPSR(IP0SR7_3_0, AVB0_MII_COL),
+
+ PINMUX_IPSR_GPSR(IP0SR7_7_4, AVB0_AVTP_CAPTURE),
+ PINMUX_IPSR_GPSR(IP0SR7_7_4, AVB0_MII_CRS),
+
+- PINMUX_IPSR_MSEL(IP0SR7_11_8, AVB0_AVTP_MATCH, SEL_AVB0_AVTP_MATCH_1),
+- PINMUX_IPSR_MSEL(IP0SR7_11_8, AVB0_MII_RX_ER, SEL_AVB0_AVTP_MATCH_0),
+- PINMUX_IPSR_MSEL(IP0SR7_11_8, CC5_OSCOUT, SEL_AVB0_AVTP_MATCH_0),
++ PINMUX_IPSR_GPSR(IP0SR7_11_8, AVB0_AVTP_MATCH),
++ PINMUX_IPSR_GPSR(IP0SR7_11_8, AVB0_MII_RX_ER),
++ PINMUX_IPSR_GPSR(IP0SR7_11_8, CC5_OSCOUT),
+
+- PINMUX_IPSR_MSEL(IP0SR7_15_12, AVB0_TD3, SEL_AVB0_TD3_1),
+- PINMUX_IPSR_MSEL(IP0SR7_15_12, AVB0_MII_TD3, SEL_AVB0_TD3_0),
++ PINMUX_IPSR_GPSR(IP0SR7_15_12, AVB0_TD3),
++ PINMUX_IPSR_GPSR(IP0SR7_15_12, AVB0_MII_TD3),
+
+ PINMUX_IPSR_GPSR(IP0SR7_19_16, AVB0_LINK),
+ PINMUX_IPSR_GPSR(IP0SR7_19_16, AVB0_MII_TX_ER),
+
+ PINMUX_IPSR_GPSR(IP0SR7_23_20, AVB0_PHY_INT),
+
+- PINMUX_IPSR_MSEL(IP0SR7_27_24, AVB0_TD2, SEL_AVB0_TD2_1),
+- PINMUX_IPSR_MSEL(IP0SR7_27_24, AVB0_MII_TD2, SEL_AVB0_TD2_0),
++ PINMUX_IPSR_GPSR(IP0SR7_27_24, AVB0_TD2),
++ PINMUX_IPSR_GPSR(IP0SR7_27_24, AVB0_MII_TD2),
+
+- PINMUX_IPSR_MSEL(IP0SR7_31_28, AVB0_TD1, SEL_AVB0_TD1_1),
+- PINMUX_IPSR_MSEL(IP0SR7_31_28, AVB0_MII_TD1, SEL_AVB0_TD1_0),
++ PINMUX_IPSR_GPSR(IP0SR7_31_28, AVB0_TD1),
++ PINMUX_IPSR_GPSR(IP0SR7_31_28, AVB0_MII_TD1),
+
+ /* IP1SR7 */
+ PINMUX_IPSR_GPSR(IP1SR7_3_0, AVB0_RD3),
+@@ -1181,24 +1152,24 @@ static const u16 pinmux_data[] = {
+
+ PINMUX_IPSR_GPSR(IP1SR7_7_4, AVB0_TXCREFCLK),
+
+- PINMUX_IPSR_MSEL(IP1SR7_11_8, AVB0_MAGIC, SEL_AVB0_MAGIC_1),
++ PINMUX_IPSR_GPSR(IP1SR7_11_8, AVB0_MAGIC),
+
+- PINMUX_IPSR_MSEL(IP1SR7_15_12, AVB0_TD0, SEL_AVB0_TD0_1),
+- PINMUX_IPSR_MSEL(IP1SR7_15_12, AVB0_MII_TD0, SEL_AVB0_TD0_0),
++ PINMUX_IPSR_GPSR(IP1SR7_15_12, AVB0_TD0),
++ PINMUX_IPSR_GPSR(IP1SR7_15_12, AVB0_MII_TD0),
+
+ PINMUX_IPSR_GPSR(IP1SR7_19_16, AVB0_RD2),
+ PINMUX_IPSR_GPSR(IP1SR7_19_16, AVB0_MII_RD2),
+
+- PINMUX_IPSR_MSEL(IP1SR7_23_20, AVB0_MDC, SEL_AVB0_MDC_1),
++ PINMUX_IPSR_GPSR(IP1SR7_23_20, AVB0_MDC),
+
+ PINMUX_IPSR_GPSR(IP1SR7_27_24, AVB0_MDIO),
+
+- PINMUX_IPSR_MSEL(IP1SR7_31_28, AVB0_TXC, SEL_AVB0_TXC_1),
+- PINMUX_IPSR_MSEL(IP1SR7_31_28, AVB0_MII_TXC, SEL_AVB0_TXC_0),
++ PINMUX_IPSR_GPSR(IP1SR7_31_28, AVB0_TXC),
++ PINMUX_IPSR_GPSR(IP1SR7_31_28, AVB0_MII_TXC),
+
+ /* IP2SR7 */
+- PINMUX_IPSR_MSEL(IP2SR7_3_0, AVB0_TX_CTL, SEL_AVB0_TX_CTL_1),
+- PINMUX_IPSR_MSEL(IP2SR7_3_0, AVB0_MII_TX_EN, SEL_AVB0_TX_CTL_0),
++ PINMUX_IPSR_GPSR(IP2SR7_3_0, AVB0_TX_CTL),
++ PINMUX_IPSR_GPSR(IP2SR7_3_0, AVB0_MII_TX_EN),
+
+ PINMUX_IPSR_GPSR(IP2SR7_7_4, AVB0_RD1),
+ PINMUX_IPSR_GPSR(IP2SR7_7_4, AVB0_MII_RD1),
+@@ -3641,50 +3612,6 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
+
+ #define F_(x, y) x,
+ #define FM(x) FN_##x,
+- { PINMUX_CFG_REG_VAR("MOD_SEL6", 0xE6061100, 32,
+- GROUP(-13, 1, -1, 1, -2, 1, 1,
+- -1, 1, -2, 1, 1, 1, -2, 1, 1, -1),
+- GROUP(
+- /* RESERVED 31-19 */
+- MOD_SEL6_18
+- /* RESERVED 17 */
+- MOD_SEL6_16
+- /* RESERVED 15-14 */
+- MOD_SEL6_13
+- MOD_SEL6_12
+- /* RESERVED 11 */
+- MOD_SEL6_10
+- /* RESERVED 9-8 */
+- MOD_SEL6_7
+- MOD_SEL6_6
+- MOD_SEL6_5
+- /* RESERVED 4-3 */
+- MOD_SEL6_2
+- MOD_SEL6_1
+- /* RESERVED 0 */
+- ))
+- },
+- { PINMUX_CFG_REG_VAR("MOD_SEL7", 0xE6061900, 32,
+- GROUP(-15, 1, 1, -1, 1, -1, 1, 1, -2, 1, 1,
+- -2, 1, 1, -1, 1),
+- GROUP(
+- /* RESERVED 31-17 */
+- MOD_SEL7_16
+- MOD_SEL7_15
+- /* RESERVED 14 */
+- MOD_SEL7_13
+- /* RESERVED 12 */
+- MOD_SEL7_11
+- MOD_SEL7_10
+- /* RESERVED 9-8 */
+- MOD_SEL7_7
+- MOD_SEL7_6
+- /* RESERVED 5-4 */
+- MOD_SEL7_3
+- MOD_SEL7_2
+- /* RESERVED 1 */
+- MOD_SEL7_0))
+- },
+ { PINMUX_CFG_REG_VAR("MOD_SEL8", 0xE6068100, 32,
+ GROUP(-20, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1),
+ GROUP(
+--
+2.39.2
+
--- /dev/null
+From 85dc181be2abac9d5670996fb77ab1522b8aca76 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Mar 2023 12:16:57 +0800
+Subject: platform/chrome: cros_typec_switch: Add missing fwnode_handle_put()
+
+From: Liang He <windhl@126.com>
+
+[ Upstream commit dc70234c408c644505a24362b0f095f713e4697e ]
+
+In cros_typec_register_switches(), we should add fwnode_handle_put()
+when break out of the iteration device_for_each_child_node()
+as it will automatically increase and decrease the refcounter.
+
+Fixes: affc804c44c8 ("platform/chrome: cros_typec_switch: Add switch driver")
+Signed-off-by: Liang He <windhl@126.com>
+Link: https://lore.kernel.org/r/20230322041657.1857001-1-windhl@126.com
+Signed-off-by: Prashant Malani <pmalani@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/chrome/cros_typec_switch.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/platform/chrome/cros_typec_switch.c b/drivers/platform/chrome/cros_typec_switch.c
+index 9ed1605f4071d..752720483753d 100644
+--- a/drivers/platform/chrome/cros_typec_switch.c
++++ b/drivers/platform/chrome/cros_typec_switch.c
+@@ -270,6 +270,7 @@ static int cros_typec_register_switches(struct cros_typec_switch_data *sdata)
+
+ return 0;
+ err_switch:
++ fwnode_handle_put(fwnode);
+ cros_typec_unregister_switches(sdata);
+ return ret;
+ }
+--
+2.39.2
+
--- /dev/null
+From a568103dbb6351a2ed95ea6587ac01deafde1add Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Apr 2023 00:23:43 +0530
+Subject: platform/x86/amd: pmc: Don't dump data after resume from s0i3 on
+ picasso
+
+From: Mario Limonciello <mario.limonciello@amd.com>
+
+[ Upstream commit 7abc3618b65304d409d9489d77e4a8f047842fb7 ]
+
+This command isn't supported on Picasso, so guard against running it
+to avoid errors like `SMU cmd unknown. err: 0xfe` in the logs.
+
+Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2449
+Fixes: 766205674962 ("platform/x86: amd-pmc: Add support for logging SMU metrics")
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Link: https://lore.kernel.org/r/20230409185348.556161-4-Shyam-sundar.S-k@amd.com
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/amd/pmc.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/platform/x86/amd/pmc.c b/drivers/platform/x86/amd/pmc.c
+index 6aa10192a3f3b..d6527dea62b8a 100644
+--- a/drivers/platform/x86/amd/pmc.c
++++ b/drivers/platform/x86/amd/pmc.c
+@@ -834,6 +834,14 @@ static void amd_pmc_s2idle_check(void)
+ dev_err(pdev->dev, "error writing to STB: %d\n", rc);
+ }
+
++static int amd_pmc_dump_data(struct amd_pmc_dev *pdev)
++{
++ if (pdev->cpu_id == AMD_CPU_ID_PCO)
++ return -ENODEV;
++
++ return amd_pmc_send_cmd(pdev, 0, NULL, SMU_MSG_LOG_DUMP_DATA, 0);
++}
++
+ static void amd_pmc_s2idle_restore(void)
+ {
+ struct amd_pmc_dev *pdev = &pmc;
+@@ -846,7 +854,7 @@ static void amd_pmc_s2idle_restore(void)
+ dev_err(pdev->dev, "resume failed: %d\n", rc);
+
+ /* Let SMU know that we are looking for stats */
+- amd_pmc_send_cmd(pdev, 0, NULL, SMU_MSG_LOG_DUMP_DATA, 0);
++ amd_pmc_dump_data(pdev);
+
+ rc = amd_pmc_write_stb(pdev, AMD_PMC_STB_S2IDLE_RESTORE);
+ if (rc)
+--
+2.39.2
+
--- /dev/null
+From 7f4743952198175868cd510b1a85f9d18c8829f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Apr 2023 00:23:41 +0530
+Subject: platform/x86/amd: pmc: Don't try to read SMU version on Picasso
+
+From: Mario Limonciello <mario.limonciello@amd.com>
+
+[ Upstream commit b845772677ea19b8e4c032bc07393ef32de4ee39 ]
+
+Picasso doesn't support the command in the uPEP mailbox to try to
+read the SMU version.
+
+Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2449
+Fixes: f6045de1f532 ("platform/x86: amd-pmc: Export Idlemask values based on the APU")
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Link: https://lore.kernel.org/r/20230409185348.556161-2-Shyam-sundar.S-k@amd.com
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/amd/pmc.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/platform/x86/amd/pmc.c b/drivers/platform/x86/amd/pmc.c
+index 2edaae04a6912..4ffb08d2b01bc 100644
+--- a/drivers/platform/x86/amd/pmc.c
++++ b/drivers/platform/x86/amd/pmc.c
+@@ -403,6 +403,9 @@ static int amd_pmc_get_smu_version(struct amd_pmc_dev *dev)
+ int rc;
+ u32 val;
+
++ if (dev->cpu_id == AMD_CPU_ID_PCO)
++ return -ENODEV;
++
+ rc = amd_pmc_send_cmd(dev, 0, &val, SMU_MSG_GETSMUVERSION, 1);
+ if (rc)
+ return rc;
+--
+2.39.2
+
--- /dev/null
+From 771063393c49d25249802b813b10b40875509b48 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Apr 2023 00:23:42 +0530
+Subject: platform/x86/amd: pmc: Hide SMU version and program attributes for
+ Picasso
+
+From: Mario Limonciello <mario.limonciello@amd.com>
+
+[ Upstream commit 5ec9ee0d464750d72972d5685edf675824e259a1 ]
+
+As the command to get version isn't supported on Picasso, we shouldn't
+be exposing this into sysfs either.
+
+Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2449
+Fixes: 7f1ea75d499a ("platform/x86/amd: pmc: Add sysfs files for SMU")
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Link: https://lore.kernel.org/r/20230409185348.556161-3-Shyam-sundar.S-k@amd.com
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/amd/pmc.c | 21 ++++++++++++++++++++-
+ 1 file changed, 20 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/platform/x86/amd/pmc.c b/drivers/platform/x86/amd/pmc.c
+index 4ffb08d2b01bc..6aa10192a3f3b 100644
+--- a/drivers/platform/x86/amd/pmc.c
++++ b/drivers/platform/x86/amd/pmc.c
+@@ -452,12 +452,31 @@ static ssize_t smu_program_show(struct device *d, struct device_attribute *attr,
+ static DEVICE_ATTR_RO(smu_fw_version);
+ static DEVICE_ATTR_RO(smu_program);
+
++static umode_t pmc_attr_is_visible(struct kobject *kobj, struct attribute *attr, int idx)
++{
++ struct device *dev = kobj_to_dev(kobj);
++ struct amd_pmc_dev *pdev = dev_get_drvdata(dev);
++
++ if (pdev->cpu_id == AMD_CPU_ID_PCO)
++ return 0;
++ return 0444;
++}
++
+ static struct attribute *pmc_attrs[] = {
+ &dev_attr_smu_fw_version.attr,
+ &dev_attr_smu_program.attr,
+ NULL,
+ };
+-ATTRIBUTE_GROUPS(pmc);
++
++static struct attribute_group pmc_attr_group = {
++ .attrs = pmc_attrs,
++ .is_visible = pmc_attr_is_visible,
++};
++
++static const struct attribute_group *pmc_groups[] = {
++ &pmc_attr_group,
++ NULL,
++};
+
+ static int smu_fw_info_show(struct seq_file *s, void *unused)
+ {
+--
+2.39.2
+
--- /dev/null
+From 46c556f10a7dd834e8131f16b501433bd43c0248 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Apr 2023 00:23:44 +0530
+Subject: platform/x86/amd: pmc: Move idlemask check into
+ `amd_pmc_idlemask_read`
+
+From: Mario Limonciello <mario.limonciello@amd.com>
+
+[ Upstream commit 9217bd1d7699f34a01b26ba14ff38c1714ce1185 ]
+
+The version check requirement for idle mask support actually only
+applies to RN/CZN/BRC platforms.
+
+So far no issues have happened because the PMFW version string is
+bigger on other supported systems. This can be reset for any new platform
+so move the check to only RN/CZN/BRC case.
+
+Fixes: f6045de1f532 ("platform/x86: amd-pmc: Export Idlemask values based on the APU")
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Link: https://lore.kernel.org/r/20230409185348.556161-5-Shyam-sundar.S-k@amd.com
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/amd/pmc.c | 74 +++++++++++++++-------------------
+ 1 file changed, 33 insertions(+), 41 deletions(-)
+
+diff --git a/drivers/platform/x86/amd/pmc.c b/drivers/platform/x86/amd/pmc.c
+index d6527dea62b8a..f7acb66556987 100644
+--- a/drivers/platform/x86/amd/pmc.c
++++ b/drivers/platform/x86/amd/pmc.c
+@@ -342,33 +342,6 @@ static int amd_pmc_setup_smu_logging(struct amd_pmc_dev *dev)
+ return 0;
+ }
+
+-static int amd_pmc_idlemask_read(struct amd_pmc_dev *pdev, struct device *dev,
+- struct seq_file *s)
+-{
+- u32 val;
+-
+- switch (pdev->cpu_id) {
+- case AMD_CPU_ID_CZN:
+- val = amd_pmc_reg_read(pdev, AMD_PMC_SCRATCH_REG_CZN);
+- break;
+- case AMD_CPU_ID_YC:
+- case AMD_CPU_ID_CB:
+- case AMD_CPU_ID_PS:
+- val = amd_pmc_reg_read(pdev, AMD_PMC_SCRATCH_REG_YC);
+- break;
+- default:
+- return -EINVAL;
+- }
+-
+- if (dev)
+- dev_dbg(pdev->dev, "SMU idlemask s0i3: 0x%x\n", val);
+-
+- if (s)
+- seq_printf(s, "SMU idlemask : 0x%x\n", val);
+-
+- return 0;
+-}
+-
+ static int get_metrics_table(struct amd_pmc_dev *pdev, struct smu_metrics *table)
+ {
+ if (!pdev->smu_virt_addr) {
+@@ -543,28 +516,47 @@ static int s0ix_stats_show(struct seq_file *s, void *unused)
+ }
+ DEFINE_SHOW_ATTRIBUTE(s0ix_stats);
+
+-static int amd_pmc_idlemask_show(struct seq_file *s, void *unused)
++static int amd_pmc_idlemask_read(struct amd_pmc_dev *pdev, struct device *dev,
++ struct seq_file *s)
+ {
+- struct amd_pmc_dev *dev = s->private;
++ u32 val;
+ int rc;
+
+- /* we haven't yet read SMU version */
+- if (!dev->major) {
+- rc = amd_pmc_get_smu_version(dev);
+- if (rc)
+- return rc;
++ switch (pdev->cpu_id) {
++ case AMD_CPU_ID_CZN:
++ /* we haven't yet read SMU version */
++ if (!pdev->major) {
++ rc = amd_pmc_get_smu_version(pdev);
++ if (rc)
++ return rc;
++ }
++ if (pdev->major > 56 || (pdev->major >= 55 && pdev->minor >= 37))
++ val = amd_pmc_reg_read(pdev, AMD_PMC_SCRATCH_REG_CZN);
++ else
++ return -EINVAL;
++ break;
++ case AMD_CPU_ID_YC:
++ case AMD_CPU_ID_CB:
++ case AMD_CPU_ID_PS:
++ val = amd_pmc_reg_read(pdev, AMD_PMC_SCRATCH_REG_YC);
++ break;
++ default:
++ return -EINVAL;
+ }
+
+- if (dev->major > 56 || (dev->major >= 55 && dev->minor >= 37)) {
+- rc = amd_pmc_idlemask_read(dev, NULL, s);
+- if (rc)
+- return rc;
+- } else {
+- seq_puts(s, "Unsupported SMU version for Idlemask\n");
+- }
++ if (dev)
++ dev_dbg(pdev->dev, "SMU idlemask s0i3: 0x%x\n", val);
++
++ if (s)
++ seq_printf(s, "SMU idlemask : 0x%x\n", val);
+
+ return 0;
+ }
++
++static int amd_pmc_idlemask_show(struct seq_file *s, void *unused)
++{
++ return amd_pmc_idlemask_read(s->private, NULL, s);
++}
+ DEFINE_SHOW_ATTRIBUTE(amd_pmc_idlemask);
+
+ static void amd_pmc_dbgfs_unregister(struct amd_pmc_dev *dev)
+--
+2.39.2
+
--- /dev/null
+From be7c079abd155550d998fb42b7691949cb5efbb1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Apr 2023 00:23:46 +0530
+Subject: platform/x86/amd: pmc: Move out of BIOS SMN pair for STB init
+
+From: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
+
+[ Upstream commit 8d99129eef8f42377b41c1bacee9f8ce806e9f44 ]
+
+The current SMN index used for the driver probe seems to be meant
+for the BIOS pair and there are potential concurrency problems that can
+occur with an inopportune SMI.
+
+It is been advised to use SMN_INDEX_0 instead of SMN_INDEX_6, which is
+what amd_nb.c provides and this function has protections to ensure that
+only one caller can use it at a time.
+
+Fixes: 426c0ff27b83 ("platform/x86: amd-pmc: Add support for AMD Smart Trace Buffer")
+Co-developed-by: Sanket Goswami <Sanket.Goswami@amd.com>
+Signed-off-by: Sanket Goswami <Sanket.Goswami@amd.com>
+Signed-off-by: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
+Link: https://lore.kernel.org/r/20230409185348.556161-7-Shyam-sundar.S-k@amd.com
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/amd/pmc.c | 26 ++++----------------------
+ 1 file changed, 4 insertions(+), 22 deletions(-)
+
+diff --git a/drivers/platform/x86/amd/pmc.c b/drivers/platform/x86/amd/pmc.c
+index 71fb8266133d8..69f305496643f 100644
+--- a/drivers/platform/x86/amd/pmc.c
++++ b/drivers/platform/x86/amd/pmc.c
+@@ -38,8 +38,6 @@
+ #define AMD_PMC_SCRATCH_REG_YC 0xD14
+
+ /* STB Registers */
+-#define AMD_PMC_STB_INDEX_ADDRESS 0xF8
+-#define AMD_PMC_STB_INDEX_DATA 0xFC
+ #define AMD_PMC_STB_PMI_0 0x03E30600
+ #define AMD_PMC_STB_S2IDLE_PREPARE 0xC6000001
+ #define AMD_PMC_STB_S2IDLE_RESTORE 0xC6000002
+@@ -923,17 +921,9 @@ static int amd_pmc_write_stb(struct amd_pmc_dev *dev, u32 data)
+ {
+ int err;
+
+- err = pci_write_config_dword(dev->rdev, AMD_PMC_STB_INDEX_ADDRESS, AMD_PMC_STB_PMI_0);
++ err = amd_smn_write(0, AMD_PMC_STB_PMI_0, data);
+ if (err) {
+- dev_err(dev->dev, "failed to write addr in stb: 0x%X\n",
+- AMD_PMC_STB_INDEX_ADDRESS);
+- return pcibios_err_to_errno(err);
+- }
+-
+- err = pci_write_config_dword(dev->rdev, AMD_PMC_STB_INDEX_DATA, data);
+- if (err) {
+- dev_err(dev->dev, "failed to write data in stb: 0x%X\n",
+- AMD_PMC_STB_INDEX_DATA);
++ dev_err(dev->dev, "failed to write data in stb: 0x%X\n", AMD_PMC_STB_PMI_0);
+ return pcibios_err_to_errno(err);
+ }
+
+@@ -944,18 +934,10 @@ static int amd_pmc_read_stb(struct amd_pmc_dev *dev, u32 *buf)
+ {
+ int i, err;
+
+- err = pci_write_config_dword(dev->rdev, AMD_PMC_STB_INDEX_ADDRESS, AMD_PMC_STB_PMI_0);
+- if (err) {
+- dev_err(dev->dev, "error writing addr to stb: 0x%X\n",
+- AMD_PMC_STB_INDEX_ADDRESS);
+- return pcibios_err_to_errno(err);
+- }
+-
+ for (i = 0; i < FIFO_SIZE; i++) {
+- err = pci_read_config_dword(dev->rdev, AMD_PMC_STB_INDEX_DATA, buf++);
++ err = amd_smn_read(0, AMD_PMC_STB_PMI_0, buf++);
+ if (err) {
+- dev_err(dev->dev, "error reading data from stb: 0x%X\n",
+- AMD_PMC_STB_INDEX_DATA);
++ dev_err(dev->dev, "error reading data from stb: 0x%X\n", AMD_PMC_STB_PMI_0);
+ return pcibios_err_to_errno(err);
+ }
+ }
+--
+2.39.2
+
--- /dev/null
+From 4cc61151153736455e4e976bc33bd6c2193cfa18 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Apr 2023 00:23:45 +0530
+Subject: platform/x86/amd: pmc: Utilize SMN index 0 for driver probe
+
+From: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
+
+[ Upstream commit 310e782a99c7f16fb533a45d8f9c16defefa5aab ]
+
+The current SMN index used for the driver probe seems to be meant
+for the BIOS pair and there are potential concurrency problems that can
+occur with an inopportune SMI.
+
+It is been advised to use SMN_INDEX_0 instead of SMN_INDEX_2, which is
+what amd_nb.c provides and this function has protections to ensure that
+only one caller can use it at a time.
+
+Fixes: 156ec4731cb2 ("platform/x86: amd-pmc: Add AMD platform support for S2Idle")
+Co-developed-by: Sanket Goswami <Sanket.Goswami@amd.com>
+Signed-off-by: Sanket Goswami <Sanket.Goswami@amd.com>
+Signed-off-by: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
+Link: https://lore.kernel.org/r/20230409185348.556161-6-Shyam-sundar.S-k@amd.com
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/amd/Kconfig | 2 +-
+ drivers/platform/x86/amd/pmc.c | 23 +++++------------------
+ 2 files changed, 6 insertions(+), 19 deletions(-)
+
+diff --git a/drivers/platform/x86/amd/Kconfig b/drivers/platform/x86/amd/Kconfig
+index 2ce8cb2170dfc..d9685aef0887d 100644
+--- a/drivers/platform/x86/amd/Kconfig
++++ b/drivers/platform/x86/amd/Kconfig
+@@ -7,7 +7,7 @@ source "drivers/platform/x86/amd/pmf/Kconfig"
+
+ config AMD_PMC
+ tristate "AMD SoC PMC driver"
+- depends on ACPI && PCI && RTC_CLASS
++ depends on ACPI && PCI && RTC_CLASS && AMD_NB
+ select SERIO
+ help
+ The driver provides support for AMD Power Management Controller
+diff --git a/drivers/platform/x86/amd/pmc.c b/drivers/platform/x86/amd/pmc.c
+index f7acb66556987..71fb8266133d8 100644
+--- a/drivers/platform/x86/amd/pmc.c
++++ b/drivers/platform/x86/amd/pmc.c
+@@ -10,6 +10,7 @@
+
+ #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
++#include <asm/amd_nb.h>
+ #include <linux/acpi.h>
+ #include <linux/bitfield.h>
+ #include <linux/bits.h>
+@@ -56,8 +57,6 @@
+ #define S2D_TELEMETRY_DRAMBYTES_MAX 0x1000000
+
+ /* Base address of SMU for mapping physical address to virtual address */
+-#define AMD_PMC_SMU_INDEX_ADDRESS 0xB8
+-#define AMD_PMC_SMU_INDEX_DATA 0xBC
+ #define AMD_PMC_MAPPING_SIZE 0x01000
+ #define AMD_PMC_BASE_ADDR_OFFSET 0x10000
+ #define AMD_PMC_BASE_ADDR_LO 0x13B102E8
+@@ -983,30 +982,18 @@ static int amd_pmc_probe(struct platform_device *pdev)
+
+ dev->cpu_id = rdev->device;
+ dev->rdev = rdev;
+- err = pci_write_config_dword(rdev, AMD_PMC_SMU_INDEX_ADDRESS, AMD_PMC_BASE_ADDR_LO);
+- if (err) {
+- dev_err(dev->dev, "error writing to 0x%x\n", AMD_PMC_SMU_INDEX_ADDRESS);
+- err = pcibios_err_to_errno(err);
+- goto err_pci_dev_put;
+- }
+-
+- err = pci_read_config_dword(rdev, AMD_PMC_SMU_INDEX_DATA, &val);
++ err = amd_smn_read(0, AMD_PMC_BASE_ADDR_LO, &val);
+ if (err) {
++ dev_err(dev->dev, "error reading 0x%x\n", AMD_PMC_BASE_ADDR_LO);
+ err = pcibios_err_to_errno(err);
+ goto err_pci_dev_put;
+ }
+
+ base_addr_lo = val & AMD_PMC_BASE_ADDR_HI_MASK;
+
+- err = pci_write_config_dword(rdev, AMD_PMC_SMU_INDEX_ADDRESS, AMD_PMC_BASE_ADDR_HI);
+- if (err) {
+- dev_err(dev->dev, "error writing to 0x%x\n", AMD_PMC_SMU_INDEX_ADDRESS);
+- err = pcibios_err_to_errno(err);
+- goto err_pci_dev_put;
+- }
+-
+- err = pci_read_config_dword(rdev, AMD_PMC_SMU_INDEX_DATA, &val);
++ err = amd_smn_read(0, AMD_PMC_BASE_ADDR_HI, &val);
+ if (err) {
++ dev_err(dev->dev, "error reading 0x%x\n", AMD_PMC_BASE_ADDR_HI);
+ err = pcibios_err_to_errno(err);
+ goto err_pci_dev_put;
+ }
+--
+2.39.2
+
--- /dev/null
+From c57fc49edd4f53f43484646f869e5701acbbc1ab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Apr 2023 22:18:07 +0530
+Subject: platform/x86/amd/pmf: Move out of BIOS SMN pair for driver probe
+
+From: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
+
+[ Upstream commit aec8298c093f052fc8a86f9411b69b23953b0edb ]
+
+The current SMN index used for the driver probe seems to be meant
+for the BIOS pair and there are potential concurrency problems that can
+occur with an inopportune SMI.
+
+It is been advised to use SMN_INDEX_0 instead of SMN_INDEX_2, which is
+what amd_nb.c provides and this function has protections to ensure that
+only one caller can use it at a time.
+
+Fixes: da5ce22df5fe ("platform/x86/amd/pmf: Add support for PMF core layer")
+Co-developed-by: Patil Rajesh Reddy <Patil.Reddy@amd.com>
+Signed-off-by: Patil Rajesh Reddy <Patil.Reddy@amd.com>
+Signed-off-by: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
+Link: https://lore.kernel.org/r/20230406164807.50969-4-Shyam-sundar.S-k@amd.com
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/amd/pmf/Kconfig | 1 +
+ drivers/platform/x86/amd/pmf/core.c | 22 +++++-----------------
+ 2 files changed, 6 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/platform/x86/amd/pmf/Kconfig b/drivers/platform/x86/amd/pmf/Kconfig
+index 6d89528c31779..d87986adf91e1 100644
+--- a/drivers/platform/x86/amd/pmf/Kconfig
++++ b/drivers/platform/x86/amd/pmf/Kconfig
+@@ -7,6 +7,7 @@ config AMD_PMF
+ tristate "AMD Platform Management Framework"
+ depends on ACPI && PCI
+ depends on POWER_SUPPLY
++ depends on AMD_NB
+ select ACPI_PLATFORM_PROFILE
+ help
+ This driver provides support for the AMD Platform Management Framework.
+diff --git a/drivers/platform/x86/amd/pmf/core.c b/drivers/platform/x86/amd/pmf/core.c
+index da23639071d79..0acc0b6221290 100644
+--- a/drivers/platform/x86/amd/pmf/core.c
++++ b/drivers/platform/x86/amd/pmf/core.c
+@@ -8,6 +8,7 @@
+ * Author: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
+ */
+
++#include <asm/amd_nb.h>
+ #include <linux/debugfs.h>
+ #include <linux/iopoll.h>
+ #include <linux/module.h>
+@@ -22,8 +23,6 @@
+ #define AMD_PMF_REGISTER_ARGUMENT 0xA58
+
+ /* Base address of SMU for mapping physical address to virtual address */
+-#define AMD_PMF_SMU_INDEX_ADDRESS 0xB8
+-#define AMD_PMF_SMU_INDEX_DATA 0xBC
+ #define AMD_PMF_MAPPING_SIZE 0x01000
+ #define AMD_PMF_BASE_ADDR_OFFSET 0x10000
+ #define AMD_PMF_BASE_ADDR_LO 0x13B102E8
+@@ -348,30 +347,19 @@ static int amd_pmf_probe(struct platform_device *pdev)
+ }
+
+ dev->cpu_id = rdev->device;
+- err = pci_write_config_dword(rdev, AMD_PMF_SMU_INDEX_ADDRESS, AMD_PMF_BASE_ADDR_LO);
+- if (err) {
+- dev_err(dev->dev, "error writing to 0x%x\n", AMD_PMF_SMU_INDEX_ADDRESS);
+- pci_dev_put(rdev);
+- return pcibios_err_to_errno(err);
+- }
+
+- err = pci_read_config_dword(rdev, AMD_PMF_SMU_INDEX_DATA, &val);
++ err = amd_smn_read(0, AMD_PMF_BASE_ADDR_LO, &val);
+ if (err) {
++ dev_err(dev->dev, "error in reading from 0x%x\n", AMD_PMF_BASE_ADDR_LO);
+ pci_dev_put(rdev);
+ return pcibios_err_to_errno(err);
+ }
+
+ base_addr_lo = val & AMD_PMF_BASE_ADDR_HI_MASK;
+
+- err = pci_write_config_dword(rdev, AMD_PMF_SMU_INDEX_ADDRESS, AMD_PMF_BASE_ADDR_HI);
+- if (err) {
+- dev_err(dev->dev, "error writing to 0x%x\n", AMD_PMF_SMU_INDEX_ADDRESS);
+- pci_dev_put(rdev);
+- return pcibios_err_to_errno(err);
+- }
+-
+- err = pci_read_config_dword(rdev, AMD_PMF_SMU_INDEX_DATA, &val);
++ err = amd_smn_read(0, AMD_PMF_BASE_ADDR_HI, &val);
+ if (err) {
++ dev_err(dev->dev, "error in reading from 0x%x\n", AMD_PMF_BASE_ADDR_HI);
+ pci_dev_put(rdev);
+ return pcibios_err_to_errno(err);
+ }
+--
+2.39.2
+
--- /dev/null
+From 6384c2233279a447ff451eaafb99290e99c4bf4d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Apr 2023 20:10:42 +0800
+Subject: PM: hibernate: Do not get block device exclusively in test_resume
+ mode
+
+From: Chen Yu <yu.c.chen@intel.com>
+
+[ Upstream commit 5904de0d735bbb3b4afe9375c5b4f9748f882945 ]
+
+The system refused to do a test_resume because it found that the
+swap device has already been taken by someone else. Specifically,
+the swsusp_check()->blkdev_get_by_dev(FMODE_EXCL) is supposed to
+do this check.
+
+Steps to reproduce:
+ dd if=/dev/zero of=/swapfile bs=$(cat /proc/meminfo |
+ awk '/MemTotal/ {print $2}') count=1024 conv=notrunc
+ mkswap /swapfile
+ swapon /swapfile
+ swap-offset /swapfile
+ echo 34816 > /sys/power/resume_offset
+ echo test_resume > /sys/power/disk
+ echo disk > /sys/power/state
+
+ PM: Using 3 thread(s) for compression
+ PM: Compressing and saving image data (293150 pages)...
+ PM: Image saving progress: 0%
+ PM: Image saving progress: 10%
+ ata1: SATA link up 1.5 Gbps (SStatus 113 SControl 300)
+ ata1.00: configured for UDMA/100
+ ata2: SATA link down (SStatus 0 SControl 300)
+ ata5: SATA link down (SStatus 0 SControl 300)
+ ata6: SATA link down (SStatus 0 SControl 300)
+ ata3: SATA link down (SStatus 0 SControl 300)
+ ata4: SATA link down (SStatus 0 SControl 300)
+ PM: Image saving progress: 20%
+ PM: Image saving progress: 30%
+ PM: Image saving progress: 40%
+ PM: Image saving progress: 50%
+ pcieport 0000:00:02.5: pciehp: Slot(0-5): No device found
+ PM: Image saving progress: 60%
+ PM: Image saving progress: 70%
+ PM: Image saving progress: 80%
+ PM: Image saving progress: 90%
+ PM: Image saving done
+ PM: hibernation: Wrote 1172600 kbytes in 2.70 seconds (434.29 MB/s)
+ PM: S|
+ PM: hibernation: Basic memory bitmaps freed
+ PM: Image not found (code -16)
+
+This is because when using the swapfile as the hibernation storage,
+the block device where the swapfile is located has already been mounted
+by the OS distribution(usually mounted as the rootfs). This is not
+an issue for normal hibernation, because software_resume()->swsusp_check()
+happens before the block device(rootfs) mount. But it is a problem for the
+test_resume mode. Because when test_resume happens, the block device has
+been mounted already.
+
+Thus remove the FMODE_EXCL for test_resume mode. This would not be a
+problem because in test_resume stage, the processes have already been
+frozen, and the race condition described in
+Commit 39fbef4b0f77 ("PM: hibernate: Get block device exclusively in swsusp_check()")
+is unlikely to happen.
+
+Fixes: 39fbef4b0f77 ("PM: hibernate: Get block device exclusively in swsusp_check()")
+Reported-by: Yifan Li <yifan2.li@intel.com>
+Suggested-by: Pavankumar Kondeti <quic_pkondeti@quicinc.com>
+Tested-by: Pavankumar Kondeti <quic_pkondeti@quicinc.com>
+Tested-by: Wendy Wang <wendy.wang@intel.com>
+Signed-off-by: Chen Yu <yu.c.chen@intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/power/hibernate.c | 8 ++++++--
+ kernel/power/swap.c | 8 ++++++--
+ 2 files changed, 12 insertions(+), 4 deletions(-)
+
+diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c
+index aa551b093c3f6..30d1274f03f62 100644
+--- a/kernel/power/hibernate.c
++++ b/kernel/power/hibernate.c
+@@ -688,18 +688,22 @@ static int load_image_and_restore(void)
+ {
+ int error;
+ unsigned int flags;
++ fmode_t mode = FMODE_READ;
++
++ if (snapshot_test)
++ mode |= FMODE_EXCL;
+
+ pm_pr_dbg("Loading hibernation image.\n");
+
+ lock_device_hotplug();
+ error = create_basic_memory_bitmaps();
+ if (error) {
+- swsusp_close(FMODE_READ | FMODE_EXCL);
++ swsusp_close(mode);
+ goto Unlock;
+ }
+
+ error = swsusp_read(&flags);
+- swsusp_close(FMODE_READ | FMODE_EXCL);
++ swsusp_close(mode);
+ if (!error)
+ error = hibernation_restore(flags & SF_PLATFORM_MODE);
+
+diff --git a/kernel/power/swap.c b/kernel/power/swap.c
+index 36a1df48280c3..92e41ed292ada 100644
+--- a/kernel/power/swap.c
++++ b/kernel/power/swap.c
+@@ -1518,9 +1518,13 @@ int swsusp_check(void)
+ {
+ int error;
+ void *holder;
++ fmode_t mode = FMODE_READ;
++
++ if (snapshot_test)
++ mode |= FMODE_EXCL;
+
+ hib_resume_bdev = blkdev_get_by_dev(swsusp_resume_device,
+- FMODE_READ | FMODE_EXCL, &holder);
++ mode, &holder);
+ if (!IS_ERR(hib_resume_bdev)) {
+ set_blocksize(hib_resume_bdev, PAGE_SIZE);
+ clear_page(swsusp_header);
+@@ -1547,7 +1551,7 @@ int swsusp_check(void)
+
+ put:
+ if (error)
+- blkdev_put(hib_resume_bdev, FMODE_READ | FMODE_EXCL);
++ blkdev_put(hib_resume_bdev, mode);
+ else
+ pr_debug("Image signature found, resuming\n");
+ } else {
+--
+2.39.2
+
--- /dev/null
+From f76e3383437c408aa58c5c256a401430871ef11f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Apr 2023 20:10:26 +0800
+Subject: PM: hibernate: Turn snapshot_test into global variable
+
+From: Chen Yu <yu.c.chen@intel.com>
+
+[ Upstream commit 08169a162f97819d3e5b4a342bb9cf5137787154 ]
+
+There is need to check snapshot_test and open block device
+in different mode, so as to avoid the race condition.
+
+No functional changes intended.
+
+Suggested-by: Pavankumar Kondeti <quic_pkondeti@quicinc.com>
+Signed-off-by: Chen Yu <yu.c.chen@intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Stable-dep-of: 5904de0d735b ("PM: hibernate: Do not get block device exclusively in test_resume mode")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/power/hibernate.c | 7 ++++++-
+ kernel/power/power.h | 1 +
+ 2 files changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c
+index 793c55a2becba..aa551b093c3f6 100644
+--- a/kernel/power/hibernate.c
++++ b/kernel/power/hibernate.c
+@@ -64,6 +64,7 @@ enum {
+ static int hibernation_mode = HIBERNATION_SHUTDOWN;
+
+ bool freezer_test_done;
++bool snapshot_test;
+
+ static const struct platform_hibernation_ops *hibernation_ops;
+
+@@ -716,7 +717,6 @@ static int load_image_and_restore(void)
+ */
+ int hibernate(void)
+ {
+- bool snapshot_test = false;
+ unsigned int sleep_flags;
+ int error;
+
+@@ -744,6 +744,9 @@ int hibernate(void)
+ if (error)
+ goto Exit;
+
++ /* protected by system_transition_mutex */
++ snapshot_test = false;
++
+ lock_device_hotplug();
+ /* Allocate memory management structures */
+ error = create_basic_memory_bitmaps();
+@@ -940,6 +943,8 @@ static int software_resume(void)
+ */
+ mutex_lock_nested(&system_transition_mutex, SINGLE_DEPTH_NESTING);
+
++ snapshot_test = false;
++
+ if (swsusp_resume_device)
+ goto Check_image;
+
+diff --git a/kernel/power/power.h b/kernel/power/power.h
+index b4f4339432096..b83c8d5e188de 100644
+--- a/kernel/power/power.h
++++ b/kernel/power/power.h
+@@ -59,6 +59,7 @@ asmlinkage int swsusp_save(void);
+
+ /* kernel/power/hibernate.c */
+ extern bool freezer_test_done;
++extern bool snapshot_test;
+
+ extern int hibernation_snapshot(int platform_mode);
+ extern int hibernation_restore(int platform_mode);
+--
+2.39.2
+
--- /dev/null
+From cec72d2bea9960d6b95eec69f3f84eb17d30978f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Mar 2023 23:56:57 +0100
+Subject: power: supply: generic-adc-battery: fix unit scaling
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Sebastian Reichel <sre@kernel.org>
+
+[ Upstream commit 44263f50065969f2344808388bd589740f026167 ]
+
+power-supply properties are reported in µV, µA and µW.
+The IIO API provides mV, mA, mW, so the values need to
+be multiplied by 1000.
+
+Fixes: e60fea794e6e ("power: battery: Generic battery driver using IIO")
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Reviewed-by: Matti Vaittinen <mazziesaccount@gmail.com>
+Signed-off-by: Sebastian Reichel <sre@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/generic-adc-battery.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/power/supply/generic-adc-battery.c b/drivers/power/supply/generic-adc-battery.c
+index 66039c665dd1e..0af536f4932f1 100644
+--- a/drivers/power/supply/generic-adc-battery.c
++++ b/drivers/power/supply/generic-adc-battery.c
+@@ -135,6 +135,9 @@ static int read_channel(struct gab *adc_bat, enum power_supply_property psp,
+ result);
+ if (ret < 0)
+ pr_err("read channel error\n");
++ else
++ *result *= 1000;
++
+ return ret;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From c1632a996acda370002ad4b78d9e59b7fad6ec81 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Apr 2023 11:18:27 -0500
+Subject: power: supply: rk817: Fix low SOC bugs
+
+From: Chris Morgan <macromorgan@hotmail.com>
+
+[ Upstream commit baba1315a74d12772d4940a05d58dc03e6ec0635 ]
+
+When the SOC approaches zero, an integer overflows in the columb
+counter causing the driver to react poorly. This makes the driver
+think it's at (above) the fully charged capacity when in fact it's
+zero. It would then write this full capacity to NVRAM which would be
+used on boot if the device remained off for less than 5 hours and
+not plugged in.
+
+This can be fixed and guarded against by doing the following:
+ - Changing the type of tmp in rk817_read_or_set_full_charge_on_boot()
+ to be an int instead of a u32. That way we can account for negative
+ numbers.
+ - Guard against negative values for the full charge on boot by setting
+ the charge to 0 if the system charge reports less than 0.
+ - Catch scenarios where the battery voltage is below the design
+ minimum voltage and set the system SOC to 0 at that time and update
+ the columb counter with a charge level of 0.
+ - Change the off time value from 5 hours to 30 minutes before we
+ recalculate the current capacity based on the OCV tables.
+
+These changes allow the driver to operate better at low voltage/low
+capacity conditions.
+
+Fixes: 3268a4d9b0b8 ("power: supply: rk817: Fix unsigned comparison with less than zero")
+Fixes: 11cb8da0189b ("power: supply: Add charger driver for Rockchip RK817")
+Signed-off-by: Chris Morgan <macromorgan@hotmail.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/rk817_charger.c | 33 ++++++++++++++++++++++------
+ 1 file changed, 26 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/power/supply/rk817_charger.c b/drivers/power/supply/rk817_charger.c
+index 36f807b5ec442..f1b431aa0e4f2 100644
+--- a/drivers/power/supply/rk817_charger.c
++++ b/drivers/power/supply/rk817_charger.c
+@@ -335,6 +335,20 @@ static int rk817_bat_calib_cap(struct rk817_charger *charger)
+ charger->fcc_mah * 1000);
+ }
+
++ /*
++ * Set the SOC to 0 if we are below the minimum system voltage.
++ */
++ if (volt_avg <= charger->bat_voltage_min_design_uv) {
++ charger->soc = 0;
++ charge_now_adc = CHARGE_TO_ADC(0, charger->res_div);
++ put_unaligned_be32(charge_now_adc, bulk_reg);
++ regmap_bulk_write(rk808->regmap,
++ RK817_GAS_GAUGE_Q_INIT_H3, bulk_reg, 4);
++ dev_warn(charger->dev,
++ "Battery voltage %d below minimum voltage %d\n",
++ volt_avg, charger->bat_voltage_min_design_uv);
++ }
++
+ rk817_record_battery_nvram_values(charger);
+
+ return 0;
+@@ -710,9 +724,10 @@ static int rk817_read_battery_nvram_values(struct rk817_charger *charger)
+
+ /*
+ * Read the nvram for state of charge. Sanity check for values greater
+- * than 100 (10000). If the value is off it should get corrected
+- * automatically when the voltage drops to the min (soc is 0) or when
+- * the battery is full (soc is 100).
++ * than 100 (10000) or less than 0, because other things (BSP kernels,
++ * U-Boot, or even i2cset) can write to this register. If the value is
++ * off it should get corrected automatically when the voltage drops to
++ * the min (soc is 0) or when the battery is full (soc is 100).
+ */
+ ret = regmap_bulk_read(charger->rk808->regmap,
+ RK817_GAS_GAUGE_BAT_R1, bulk_reg, 3);
+@@ -721,6 +736,8 @@ static int rk817_read_battery_nvram_values(struct rk817_charger *charger)
+ charger->soc = get_unaligned_le24(bulk_reg);
+ if (charger->soc > 10000)
+ charger->soc = 10000;
++ if (charger->soc < 0)
++ charger->soc = 0;
+
+ return 0;
+ }
+@@ -731,8 +748,8 @@ rk817_read_or_set_full_charge_on_boot(struct rk817_charger *charger,
+ {
+ struct rk808 *rk808 = charger->rk808;
+ u8 bulk_reg[4];
+- u32 boot_voltage, boot_charge_mah, tmp;
+- int ret, reg, off_time;
++ u32 boot_voltage, boot_charge_mah;
++ int ret, reg, off_time, tmp;
+ bool first_boot;
+
+ /*
+@@ -785,10 +802,12 @@ rk817_read_or_set_full_charge_on_boot(struct rk817_charger *charger,
+ regmap_bulk_read(rk808->regmap, RK817_GAS_GAUGE_Q_PRES_H3,
+ bulk_reg, 4);
+ tmp = get_unaligned_be32(bulk_reg);
++ if (tmp < 0)
++ tmp = 0;
+ boot_charge_mah = ADC_TO_CHARGE_UAH(tmp,
+ charger->res_div) / 1000;
+ /*
+- * Check if the columb counter has been off for more than 300
++ * Check if the columb counter has been off for more than 30
+ * minutes as it tends to drift downward. If so, re-init soc
+ * with the boot voltage instead. Note the unit values for the
+ * OFF_CNT register appear to be in decaminutes and stops
+@@ -799,7 +818,7 @@ rk817_read_or_set_full_charge_on_boot(struct rk817_charger *charger,
+ * than 0 on a reboot anyway.
+ */
+ regmap_read(rk808->regmap, RK817_GAS_GAUGE_OFF_CNT, &off_time);
+- if (off_time >= 30) {
++ if (off_time >= 3) {
+ regmap_bulk_read(rk808->regmap,
+ RK817_GAS_GAUGE_PWRON_VOL_H,
+ bulk_reg, 2);
+--
+2.39.2
+
--- /dev/null
+From d57f9d387fc99df2dd1050565cd440e09a5cf15f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Feb 2023 23:01:13 -0800
+Subject: powerpc/mpc512x: fix resource printk format warning
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 7538c97e2b80ff6b7a8ea2ecf16a04355461b439 ]
+
+Use "%pa" format specifier for resource_size_t to avoid a compiler
+printk format warning.
+
+../arch/powerpc/platforms/512x/clock-commonclk.c: In function 'mpc5121_clk_provide_backwards_compat':
+../arch/powerpc/platforms/512x/clock-commonclk.c:989:44: error: format '%x' expects argument of type 'unsigned int', but argument 4 has type 'resource_size_t' {aka 'long long unsigned int'} [-Werror=format=]
+ 989 | snprintf(devname, sizeof(devname), "%08x.%s", res.start, np->name); \
+ | ^~~~~~~~~ ~~~~~~~~~
+ | |
+ | resource_size_t {aka long long unsigned int}
+
+Prevents 24 such warnings.
+
+Fixes: 01f25c371658 ("clk: mpc512x: add backwards compat to the CCF code")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20230223070116.660-2-rdunlap@infradead.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/512x/clock-commonclk.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/platforms/512x/clock-commonclk.c b/arch/powerpc/platforms/512x/clock-commonclk.c
+index 42abeba4f6983..079cb3627eacd 100644
+--- a/arch/powerpc/platforms/512x/clock-commonclk.c
++++ b/arch/powerpc/platforms/512x/clock-commonclk.c
+@@ -986,7 +986,7 @@ static void __init mpc5121_clk_provide_migration_support(void)
+
+ #define NODE_PREP do { \
+ of_address_to_resource(np, 0, &res); \
+- snprintf(devname, sizeof(devname), "%08x.%s", res.start, np->name); \
++ snprintf(devname, sizeof(devname), "%pa.%s", &res.start, np->name); \
+ } while (0)
+
+ #define NODE_CHK(clkname, clkitem, regnode, regflag) do { \
+--
+2.39.2
+
--- /dev/null
+From ffd5e6220662e260b18bece469059037bfd2870c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Feb 2023 16:54:45 +0100
+Subject: powerpc/perf: Properly detect mpc7450 family
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+[ Upstream commit e7299f961fe5e4496db0bfaa9e819f5e97f3846b ]
+
+Unlike PVR_POWER8, etc ...., PVR_7450 represents a full PVR
+value and not a family value.
+
+To avoid confusion, do like E500 family and define the relevant
+PVR_VER_xxxx values for the 7450 family:
+ 0x8000 ==> 7450
+ 0x8001 ==> 7455
+ 0x8002 ==> 7447
+ 0x8003 ==> 7447A
+ 0x8004 ==> 7448
+
+And use them to detect 7450 family for perf events.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Dan Carpenter <error27@gmail.com>
+Link: https://lore.kernel.org/r/202302260657.7dM9Uwev-lkp@intel.com/
+Fixes: ec3eb9d941a9 ("powerpc/perf: Use PVR rather than oprofile field to determine CPU version")
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/99ca1da2e5a6cf82a8abf4bc034918e500e31781.1677513277.git.christophe.leroy@csgroup.eu
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/include/asm/reg.h | 5 +++++
+ arch/powerpc/perf/mpc7450-pmu.c | 6 +++---
+ 2 files changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h
+index 1e8b2e04e626a..8fda87af2fa5e 100644
+--- a/arch/powerpc/include/asm/reg.h
++++ b/arch/powerpc/include/asm/reg.h
+@@ -1310,6 +1310,11 @@
+ #define PVR_VER_E500MC 0x8023
+ #define PVR_VER_E5500 0x8024
+ #define PVR_VER_E6500 0x8040
++#define PVR_VER_7450 0x8000
++#define PVR_VER_7455 0x8001
++#define PVR_VER_7447 0x8002
++#define PVR_VER_7447A 0x8003
++#define PVR_VER_7448 0x8004
+
+ /*
+ * For the 8xx processors, all of them report the same PVR family for
+diff --git a/arch/powerpc/perf/mpc7450-pmu.c b/arch/powerpc/perf/mpc7450-pmu.c
+index 552d51a925d37..db451b9aac35e 100644
+--- a/arch/powerpc/perf/mpc7450-pmu.c
++++ b/arch/powerpc/perf/mpc7450-pmu.c
+@@ -417,9 +417,9 @@ struct power_pmu mpc7450_pmu = {
+
+ static int __init init_mpc7450_pmu(void)
+ {
+- unsigned int pvr = mfspr(SPRN_PVR);
+-
+- if (PVR_VER(pvr) != PVR_7450)
++ if (!pvr_version_is(PVR_VER_7450) && !pvr_version_is(PVR_VER_7455) &&
++ !pvr_version_is(PVR_VER_7447) && !pvr_version_is(PVR_VER_7447A) &&
++ !pvr_version_is(PVR_VER_7448))
+ return -ENODEV;
+
+ return register_power_pmu(&mpc7450_pmu);
+--
+2.39.2
+
--- /dev/null
+From a5fed728eb0f2563977fdda0900d3c5500061ce0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Mar 2023 15:33:41 -0600
+Subject: powerpc/rtas: use memmove for potentially overlapping buffer copy
+
+From: Nathan Lynch <nathanl@linux.ibm.com>
+
+[ Upstream commit 271208ee5e335cb1ad280d22784940daf7ddf820 ]
+
+Using memcpy() isn't safe when buf is identical to rtas_err_buf, which
+can happen during boot before slab is up. Full context which may not
+be obvious from the diff:
+
+ if (altbuf) {
+ buf = altbuf;
+ } else {
+ buf = rtas_err_buf;
+ if (slab_is_available())
+ buf = kmalloc(RTAS_ERROR_LOG_MAX, GFP_ATOMIC);
+ }
+ if (buf)
+ memcpy(buf, rtas_err_buf, RTAS_ERROR_LOG_MAX);
+
+This was found by inspection and I'm not aware of it causing problems
+in practice. It appears to have been introduced by commit
+033ef338b6e0 ("powerpc: Merge rtas.c into arch/powerpc/kernel"); the
+old ppc64 version of this code did not have this problem.
+
+Use memmove() instead.
+
+Fixes: 033ef338b6e0 ("powerpc: Merge rtas.c into arch/powerpc/kernel")
+Signed-off-by: Nathan Lynch <nathanl@linux.ibm.com>
+Reviewed-by: Andrew Donnellan <ajd@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20230220-rtas-queue-for-6-4-v1-2-010e4416f13f@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/rtas.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c
+index 31175b34856ac..9256cfaa8b6f1 100644
+--- a/arch/powerpc/kernel/rtas.c
++++ b/arch/powerpc/kernel/rtas.c
+@@ -981,7 +981,7 @@ static char *__fetch_rtas_last_error(char *altbuf)
+ buf = kmalloc(RTAS_ERROR_LOG_MAX, GFP_ATOMIC);
+ }
+ if (buf)
+- memcpy(buf, rtas_err_buf, RTAS_ERROR_LOG_MAX);
++ memmove(buf, rtas_err_buf, RTAS_ERROR_LOG_MAX);
+ }
+
+ return buf;
+--
+2.39.2
+
--- /dev/null
+From c7bf2c76d8b11e4d21d0f6529ceb2f987f0cd606 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Feb 2023 23:01:16 -0800
+Subject: powerpc/sysdev/tsi108: fix resource printk format warnings
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 55d8bd02cc1b9f1063993b5c42c9cabf4af67dea ]
+
+Use "%pa" format specifier for resource_size_t to avoid a compiler
+printk format warning.
+
+ arch/powerpc/sysdev/tsi108_pci.c: In function 'tsi108_setup_pci':
+ include/linux/kern_levels.h:5:25: error: format '%x' expects argument of type 'unsigned int', but argument 2 has type 'resource_size_t'
+
+Fixes: c4342ff92bed ("[POWERPC] Update mpc7448hpc2 board irq support using device tree")
+Fixes: 2b9d7467a6db ("[POWERPC] Add tsi108 pci and platform device data register function")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+[mpe: Use pr_info() and unsplit string]
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20230223070116.660-5-rdunlap@infradead.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/sysdev/tsi108_pci.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/arch/powerpc/sysdev/tsi108_pci.c b/arch/powerpc/sysdev/tsi108_pci.c
+index 5af4c35ff5842..0e42f7bad7db1 100644
+--- a/arch/powerpc/sysdev/tsi108_pci.c
++++ b/arch/powerpc/sysdev/tsi108_pci.c
+@@ -217,9 +217,8 @@ int __init tsi108_setup_pci(struct device_node *dev, u32 cfg_phys, int primary)
+
+ (hose)->ops = &tsi108_direct_pci_ops;
+
+- printk(KERN_INFO "Found tsi108 PCI host bridge at 0x%08x. "
+- "Firmware bus number: %d->%d\n",
+- rsrc.start, hose->first_busno, hose->last_busno);
++ pr_info("Found tsi108 PCI host bridge at 0x%pa. Firmware bus number: %d->%d\n",
++ &rsrc.start, hose->first_busno, hose->last_busno);
+
+ /* Interpret the "ranges" property */
+ /* This also maps the I/O region and sets isa_io/mem_base */
+--
+2.39.2
+
--- /dev/null
+From 8fd1eaca538b3c1ea007c4831e74859f3544fb58 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Feb 2023 23:01:14 -0800
+Subject: powerpc/wii: fix resource printk format warnings
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 7b69600d4da0049244e9be2f5ef5a2f8e04fcd9a ]
+
+Use "%pa" format specifier for resource_size_t to avoid compiler
+printk format warnings.
+
+../arch/powerpc/platforms/embedded6xx/flipper-pic.c: In function 'flipper_pic_init':
+../include/linux/kern_levels.h:5:25: error: format '%x' expects argument of type 'unsigned int', but argument 2 has type 'resource_size_t' {aka 'long long unsigned int'} [-Werror=format=]
+../arch/powerpc/platforms/embedded6xx/flipper-pic.c:148:9: note: in expansion of macro 'pr_info'
+ 148 | pr_info("controller at 0x%08x mapped to 0x%p\n", res.start, io_base);
+ | ^~~~~~~
+
+../arch/powerpc/platforms/embedded6xx/hlwd-pic.c: In function 'hlwd_pic_init':
+../include/linux/kern_levels.h:5:25: error: format '%x' expects argument of type 'unsigned int', but argument 2 has type 'resource_size_t' {aka 'long long unsigned int'} [-Werror=format=]
+../arch/powerpc/platforms/embedded6xx/hlwd-pic.c:174:9: note: in expansion of macro 'pr_info'
+ 174 | pr_info("controller at 0x%08x mapped to 0x%p\n", res.start, io_base);
+ | ^~~~~~~
+
+../arch/powerpc/platforms/embedded6xx/wii.c: In function 'wii_ioremap_hw_regs':
+../include/linux/kern_levels.h:5:25: error: format '%x' expects argument of type 'unsigned int', but argument 3 has type 'resource_size_t' {aka 'long long unsigned int'} [-Werror=format=]
+../arch/powerpc/platforms/embedded6xx/wii.c:77:17: note: in expansion of macro 'pr_info'
+ 77 | pr_info("%s at 0x%08x mapped to 0x%p\n", name,
+ | ^~~~~~~
+
+Fixes: 028ee972f032 ("powerpc: gamecube/wii: flipper interrupt controller support")
+Fixes: 9c21025c7845 ("powerpc: wii: hollywood interrupt controller support")
+Fixes: 5a7ee3198dfa ("powerpc: wii: platform support")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20230223070116.660-3-rdunlap@infradead.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/embedded6xx/flipper-pic.c | 2 +-
+ arch/powerpc/platforms/embedded6xx/hlwd-pic.c | 2 +-
+ arch/powerpc/platforms/embedded6xx/wii.c | 4 ++--
+ 3 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/powerpc/platforms/embedded6xx/flipper-pic.c b/arch/powerpc/platforms/embedded6xx/flipper-pic.c
+index 609bda2ad5dd2..4d9200bdba78c 100644
+--- a/arch/powerpc/platforms/embedded6xx/flipper-pic.c
++++ b/arch/powerpc/platforms/embedded6xx/flipper-pic.c
+@@ -145,7 +145,7 @@ static struct irq_domain * __init flipper_pic_init(struct device_node *np)
+ }
+ io_base = ioremap(res.start, resource_size(&res));
+
+- pr_info("controller at 0x%08x mapped to 0x%p\n", res.start, io_base);
++ pr_info("controller at 0x%pa mapped to 0x%p\n", &res.start, io_base);
+
+ __flipper_quiesce(io_base);
+
+diff --git a/arch/powerpc/platforms/embedded6xx/hlwd-pic.c b/arch/powerpc/platforms/embedded6xx/hlwd-pic.c
+index 380b4285cce47..4d2d92de30afd 100644
+--- a/arch/powerpc/platforms/embedded6xx/hlwd-pic.c
++++ b/arch/powerpc/platforms/embedded6xx/hlwd-pic.c
+@@ -171,7 +171,7 @@ static struct irq_domain *__init hlwd_pic_init(struct device_node *np)
+ return NULL;
+ }
+
+- pr_info("controller at 0x%08x mapped to 0x%p\n", res.start, io_base);
++ pr_info("controller at 0x%pa mapped to 0x%p\n", &res.start, io_base);
+
+ __hlwd_quiesce(io_base);
+
+diff --git a/arch/powerpc/platforms/embedded6xx/wii.c b/arch/powerpc/platforms/embedded6xx/wii.c
+index f4e654a9d4ff6..219659f2ede06 100644
+--- a/arch/powerpc/platforms/embedded6xx/wii.c
++++ b/arch/powerpc/platforms/embedded6xx/wii.c
+@@ -74,8 +74,8 @@ static void __iomem *__init wii_ioremap_hw_regs(char *name, char *compatible)
+
+ hw_regs = ioremap(res.start, resource_size(&res));
+ if (hw_regs) {
+- pr_info("%s at 0x%08x mapped to 0x%p\n", name,
+- res.start, hw_regs);
++ pr_info("%s at 0x%pa mapped to 0x%p\n", name,
++ &res.start, hw_regs);
+ }
+
+ out_put:
+--
+2.39.2
+
--- /dev/null
+From a08df61e45e58fd6f6fe5e2b4ba7f3dcd2472399 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Mar 2023 20:40:43 +0000
+Subject: pstore: Revert pmsg_lock back to a normal mutex
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: John Stultz <jstultz@google.com>
+
+[ Upstream commit 5239a89b06d6b199f133bf0ffea421683187f257 ]
+
+This reverts commit 76d62f24db07f22ccf9bc18ca793c27d4ebef721.
+
+So while priority inversion on the pmsg_lock is an occasional
+problem that an rt_mutex would help with, in uses where logging
+is writing to pmsg heavily from multiple threads, the pmsg_lock
+can be heavily contended.
+
+After this change landed, it was reported that cases where the
+mutex locking overhead was commonly adding on the order of 10s
+of usecs delay had suddenly jumped to ~msec delay with rtmutex.
+
+It seems the slight differences in the locks under this level
+of contention causes the normal mutexes to utilize the spinning
+optimizations, while the rtmutexes end up in the sleeping
+slowpath (which allows additional threads to pile on trying
+to take the lock).
+
+In this case, it devolves to a worse case senerio where the lock
+acquisition and scheduling overhead dominates, and each thread
+is waiting on the order of ~ms to do ~us of work.
+
+Obviously, having tons of threads all contending on a single
+lock for logging is non-optimal, so the proper fix is probably
+reworking pstore pmsg to have per-cpu buffers so we don't have
+contention.
+
+Additionally, Steven Rostedt has provided some furhter
+optimizations for rtmutexes that improves the rtmutex spinning
+path, but at least in my testing, I still see the test tripping
+into the sleeping path on rtmutexes while utilizing the spinning
+path with mutexes.
+
+But in the short term, lets revert the change to the rt_mutex
+and go back to normal mutexes to avoid a potentially major
+performance regression. And we can work on optimizations to both
+rtmutexes and finer-grained locking for pstore pmsg in the
+future.
+
+Cc: Wei Wang <wvw@google.com>
+Cc: Midas Chien<midaschieh@google.com>
+Cc: "Chunhui Li (李春辉)" <chunhui.li@mediatek.com>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: Anton Vorontsov <anton@enomsg.org>
+Cc: "Guilherme G. Piccoli" <gpiccoli@igalia.com>
+Cc: Tony Luck <tony.luck@intel.com>
+Cc: kernel-team@android.com
+Fixes: 76d62f24db07 ("pstore: Switch pmsg_lock to an rt_mutex to avoid priority inversion")
+Reported-by: "Chunhui Li (李春辉)" <chunhui.li@mediatek.com>
+Signed-off-by: John Stultz <jstultz@google.com>
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Link: https://lore.kernel.org/r/20230308204043.2061631-1-jstultz@google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/pstore/pmsg.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/fs/pstore/pmsg.c b/fs/pstore/pmsg.c
+index ab82e5f053464..b31c9c72d90b4 100644
+--- a/fs/pstore/pmsg.c
++++ b/fs/pstore/pmsg.c
+@@ -7,10 +7,9 @@
+ #include <linux/device.h>
+ #include <linux/fs.h>
+ #include <linux/uaccess.h>
+-#include <linux/rtmutex.h>
+ #include "internal.h"
+
+-static DEFINE_RT_MUTEX(pmsg_lock);
++static DEFINE_MUTEX(pmsg_lock);
+
+ static ssize_t write_pmsg(struct file *file, const char __user *buf,
+ size_t count, loff_t *ppos)
+@@ -29,9 +28,9 @@ static ssize_t write_pmsg(struct file *file, const char __user *buf,
+ if (!access_ok(buf, count))
+ return -EFAULT;
+
+- rt_mutex_lock(&pmsg_lock);
++ mutex_lock(&pmsg_lock);
+ ret = psinfo->write_user(&record, buf);
+- rt_mutex_unlock(&pmsg_lock);
++ mutex_unlock(&pmsg_lock);
+ return ret ? ret : count;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 15c3fa61728c6d10cc8a359772e153354beafcd3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Apr 2023 15:30:54 +0200
+Subject: pwm: mtk-disp: Configure double buffering before reading in
+ .get_state()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+
+[ Upstream commit b16c310115f2084b8826a35b77ef42bab6786d9f ]
+
+The DISP_PWM controller's default behavior is to always use register
+double buffering: all reads/writes are then performed on shadow
+registers instead of working registers and this becomes an issue
+in case our chosen configuration in Linux is different from the
+default (or from the one that was pre-applied by the bootloader).
+
+An example of broken behavior is when the controller is configured
+to use shadow registers, but this driver wants to configure it
+otherwise: what happens is that the .get_state() callback is called
+right after registering the pwmchip and checks whether the PWM is
+enabled by reading the DISP_PWM_EN register;
+At this point, if shadow registers are enabled but their content
+was not committed before booting Linux, we are *not* reading the
+current PWM enablement status, leading to the kernel knowing that
+the hardware is actually enabled when, in reality, it's not.
+
+The aforementioned issue emerged since this driver was fixed with
+commit 0b5ef3429d8f ("pwm: mtk-disp: Fix the parameters calculated
+by the enabled flag of disp_pwm") making it to read the enablement
+status from the right register.
+
+Configure the controller in the .get_state() callback to avoid
+this desync issue and get the backlight properly working again.
+
+Fixes: 3f2b16734914 ("pwm: mtk-disp: Implement atomic API .get_state()")
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Reviewed-by: Nícolas F. R. A. Prado <nfraprado@collabora.com>
+Tested-by: Nícolas F. R. A. Prado <nfraprado@collabora.com>
+Reviewed-by: Alexandre Mergnat <amergnat@baylibre.com>
+Tested-by: Alexandre Mergnat <amergnat@baylibre.com>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-mtk-disp.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/pwm/pwm-mtk-disp.c b/drivers/pwm/pwm-mtk-disp.c
+index 82b430d881a20..fe9593f968eeb 100644
+--- a/drivers/pwm/pwm-mtk-disp.c
++++ b/drivers/pwm/pwm-mtk-disp.c
+@@ -196,6 +196,16 @@ static int mtk_disp_pwm_get_state(struct pwm_chip *chip,
+ return err;
+ }
+
++ /*
++ * Apply DISP_PWM_DEBUG settings to choose whether to enable or disable
++ * registers double buffer and manual commit to working register before
++ * performing any read/write operation
++ */
++ if (mdp->data->bls_debug)
++ mtk_disp_pwm_update_bits(mdp, mdp->data->bls_debug,
++ mdp->data->bls_debug_mask,
++ mdp->data->bls_debug_mask);
++
+ rate = clk_get_rate(mdp->clk_main);
+ con0 = readl(mdp->base + mdp->data->con0);
+ con1 = readl(mdp->base + mdp->data->con1);
+--
+2.39.2
+
--- /dev/null
+From 5c42ae9a30a22e090bfc3611a4f8c4091e4e78a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Apr 2023 15:30:53 +0200
+Subject: pwm: mtk-disp: Disable shadow registers before setting backlight
+ values
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+
+[ Upstream commit 36dd7f530ae7d9ce9e853ffb8aa337de65c6600b ]
+
+If shadow registers usage is not desired, disable that before performing
+any write to CON0/1 registers in the .apply() callback, otherwise we may
+lose clkdiv or period/width updates.
+
+Fixes: cd4b45ac449a ("pwm: Add MediaTek MT2701 display PWM driver support")
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Reviewed-by: Nícolas F. R. A. Prado <nfraprado@collabora.com>
+Tested-by: Nícolas F. R. A. Prado <nfraprado@collabora.com>
+Reviewed-by: Alexandre Mergnat <amergnat@baylibre.com>
+Tested-by: Alexandre Mergnat <amergnat@baylibre.com>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-mtk-disp.c | 24 +++++++++++++-----------
+ 1 file changed, 13 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/pwm/pwm-mtk-disp.c b/drivers/pwm/pwm-mtk-disp.c
+index 692a06121b286..82b430d881a20 100644
+--- a/drivers/pwm/pwm-mtk-disp.c
++++ b/drivers/pwm/pwm-mtk-disp.c
+@@ -138,6 +138,19 @@ static int mtk_disp_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,
+ high_width = mul_u64_u64_div_u64(state->duty_cycle, rate, div);
+ value = period | (high_width << PWM_HIGH_WIDTH_SHIFT);
+
++ if (mdp->data->bls_debug && !mdp->data->has_commit) {
++ /*
++ * For MT2701, disable double buffer before writing register
++ * and select manual mode and use PWM_PERIOD/PWM_HIGH_WIDTH.
++ */
++ mtk_disp_pwm_update_bits(mdp, mdp->data->bls_debug,
++ mdp->data->bls_debug_mask,
++ mdp->data->bls_debug_mask);
++ mtk_disp_pwm_update_bits(mdp, mdp->data->con0,
++ mdp->data->con0_sel,
++ mdp->data->con0_sel);
++ }
++
+ mtk_disp_pwm_update_bits(mdp, mdp->data->con0,
+ PWM_CLKDIV_MASK,
+ clk_div << PWM_CLKDIV_SHIFT);
+@@ -152,17 +165,6 @@ static int mtk_disp_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,
+ mtk_disp_pwm_update_bits(mdp, mdp->data->commit,
+ mdp->data->commit_mask,
+ 0x0);
+- } else {
+- /*
+- * For MT2701, disable double buffer before writing register
+- * and select manual mode and use PWM_PERIOD/PWM_HIGH_WIDTH.
+- */
+- mtk_disp_pwm_update_bits(mdp, mdp->data->bls_debug,
+- mdp->data->bls_debug_mask,
+- mdp->data->bls_debug_mask);
+- mtk_disp_pwm_update_bits(mdp, mdp->data->con0,
+- mdp->data->con0_sel,
+- mdp->data->con0_sel);
+ }
+
+ mtk_disp_pwm_update_bits(mdp, DISP_PWM_EN, mdp->data->enable_mask,
+--
+2.39.2
+
--- /dev/null
+From 8b9c669f90b883b34886ef9f6c22fe78bb9ae86d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Dec 2022 22:16:25 +0800
+Subject: rcu: Fix missing TICK_DEP_MASK_RCU_EXP dependency check
+
+From: Zqiang <qiang1.zhang@intel.com>
+
+[ Upstream commit db7b464df9d820186e98a65aa6a10f0d51fbf8ce ]
+
+This commit adds checks for the TICK_DEP_MASK_RCU_EXP bit, thus enabling
+RCU expedited grace periods to actually force-enable scheduling-clock
+interrupts on holdout CPUs.
+
+Fixes: df1e849ae455 ("rcu: Enable tick for nohz_full CPUs slow to provide expedited QS")
+Signed-off-by: Zqiang <qiang1.zhang@intel.com>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Cc: Masami Hiramatsu <mhiramat@kernel.org>
+Cc: Frederic Weisbecker <fweisbec@gmail.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Ingo Molnar <mingo@kernel.org>
+Cc: Anna-Maria Behnsen <anna-maria@linutronix.de>
+Acked-by: Frederic Weisbecker <frederic@kernel.org>
+Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
+Signed-off-by: Joel Fernandes (Google) <joel@joelfernandes.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/trace/events/timer.h | 3 ++-
+ kernel/time/tick-sched.c | 5 +++++
+ 2 files changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/include/trace/events/timer.h b/include/trace/events/timer.h
+index 2e713a7d9aa3a..3e8619c72f774 100644
+--- a/include/trace/events/timer.h
++++ b/include/trace/events/timer.h
+@@ -371,7 +371,8 @@ TRACE_EVENT(itimer_expire,
+ tick_dep_name(PERF_EVENTS) \
+ tick_dep_name(SCHED) \
+ tick_dep_name(CLOCK_UNSTABLE) \
+- tick_dep_name_end(RCU)
++ tick_dep_name(RCU) \
++ tick_dep_name_end(RCU_EXP)
+
+ #undef tick_dep_name
+ #undef tick_dep_mask_name
+diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
+index 68d81a4283c89..a46506f7ec6d0 100644
+--- a/kernel/time/tick-sched.c
++++ b/kernel/time/tick-sched.c
+@@ -281,6 +281,11 @@ static bool check_tick_dependency(atomic_t *dep)
+ return true;
+ }
+
++ if (val & TICK_DEP_MASK_RCU_EXP) {
++ trace_tick_stop(0, TICK_DEP_MASK_RCU_EXP);
++ return true;
++ }
++
+ return false;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From aa6343351a2c31c694307596b006ebe4d06a6db6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Mar 2023 10:23:51 +0300
+Subject: RDMA/cm: Trace icm_send_rej event before the cm state is reset
+
+From: Mark Zhang <markzhang@nvidia.com>
+
+[ Upstream commit bd9de1badac7e4ff6780365d4aa38983f5e2a436 ]
+
+Trace icm_send_rej event before the cm state is reset to idle, so that
+correct cm state will be logged. For example when an incoming request is
+rejected, the old trace log was:
+ icm_send_rej: local_id=961102742 remote_id=3829151631 state=IDLE reason=REJ_CONSUMER_DEFINED
+With this patch:
+ icm_send_rej: local_id=312971016 remote_id=3778819983 state=MRA_REQ_SENT reason=REJ_CONSUMER_DEFINED
+
+Fixes: 8dc105befe16 ("RDMA/cm: Add tracepoints to track MAD send operations")
+Signed-off-by: Mark Zhang <markzhang@nvidia.com>
+Link: https://lore.kernel.org/r/20230330072351.481200-1-markzhang@nvidia.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/cm.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c
+index 603c0aecc3614..ff58058aeadca 100644
+--- a/drivers/infiniband/core/cm.c
++++ b/drivers/infiniband/core/cm.c
+@@ -2912,6 +2912,8 @@ static int cm_send_rej_locked(struct cm_id_private *cm_id_priv,
+ (ari && ari_length > IB_CM_REJ_ARI_LENGTH))
+ return -EINVAL;
+
++ trace_icm_send_rej(&cm_id_priv->id, reason);
++
+ switch (state) {
+ case IB_CM_REQ_SENT:
+ case IB_CM_MRA_REQ_RCVD:
+@@ -2942,7 +2944,6 @@ static int cm_send_rej_locked(struct cm_id_private *cm_id_priv,
+ return -EINVAL;
+ }
+
+- trace_icm_send_rej(&cm_id_priv->id, reason);
+ ret = ib_post_send_mad(msg, NULL);
+ if (ret) {
+ cm_free_msg(msg);
+--
+2.39.2
+
--- /dev/null
+From 40c7fa594a6c7cac212f81304b9a54bc08e5c430 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Mar 2023 18:29:23 +0800
+Subject: RDMA/erdma: Use fixed hardware page size
+
+From: Cheng Xu <chengyou@linux.alibaba.com>
+
+[ Upstream commit d649c638dc26f3501da510cf7fceb5c15ca54258 ]
+
+Hardware's page size is 4096, but the kernel's page size may vary. Driver
+should use hardware's page size when communicating with hardware.
+
+Fixes: 155055771704 ("RDMA/erdma: Add verbs implementation")
+Link: https://lore.kernel.org/r/20230307102924.70577-2-chengyou@linux.alibaba.com
+Signed-off-by: Cheng Xu <chengyou@linux.alibaba.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/erdma/erdma_hw.h | 4 ++++
+ drivers/infiniband/hw/erdma/erdma_verbs.c | 17 +++++++++--------
+ 2 files changed, 13 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/infiniband/hw/erdma/erdma_hw.h b/drivers/infiniband/hw/erdma/erdma_hw.h
+index 37ad1bb1917c4..76ce2856be28a 100644
+--- a/drivers/infiniband/hw/erdma/erdma_hw.h
++++ b/drivers/infiniband/hw/erdma/erdma_hw.h
+@@ -112,6 +112,10 @@
+
+ #define ERDMA_PAGE_SIZE_SUPPORT 0x7FFFF000
+
++/* Hardware page size definition */
++#define ERDMA_HW_PAGE_SHIFT 12
++#define ERDMA_HW_PAGE_SIZE 4096
++
+ /* WQE related. */
+ #define EQE_SIZE 16
+ #define EQE_SHIFT 4
+diff --git a/drivers/infiniband/hw/erdma/erdma_verbs.c b/drivers/infiniband/hw/erdma/erdma_verbs.c
+index 9c30d78730aa1..83e1b0d559771 100644
+--- a/drivers/infiniband/hw/erdma/erdma_verbs.c
++++ b/drivers/infiniband/hw/erdma/erdma_verbs.c
+@@ -38,7 +38,7 @@ static int create_qp_cmd(struct erdma_dev *dev, struct erdma_qp *qp)
+ FIELD_PREP(ERDMA_CMD_CREATE_QP_PD_MASK, pd->pdn);
+
+ if (rdma_is_kernel_res(&qp->ibqp.res)) {
+- u32 pgsz_range = ilog2(SZ_1M) - PAGE_SHIFT;
++ u32 pgsz_range = ilog2(SZ_1M) - ERDMA_HW_PAGE_SHIFT;
+
+ req.sq_cqn_mtt_cfg =
+ FIELD_PREP(ERDMA_CMD_CREATE_QP_PAGE_SIZE_MASK,
+@@ -66,13 +66,13 @@ static int create_qp_cmd(struct erdma_dev *dev, struct erdma_qp *qp)
+ user_qp = &qp->user_qp;
+ req.sq_cqn_mtt_cfg = FIELD_PREP(
+ ERDMA_CMD_CREATE_QP_PAGE_SIZE_MASK,
+- ilog2(user_qp->sq_mtt.page_size) - PAGE_SHIFT);
++ ilog2(user_qp->sq_mtt.page_size) - ERDMA_HW_PAGE_SHIFT);
+ req.sq_cqn_mtt_cfg |=
+ FIELD_PREP(ERDMA_CMD_CREATE_QP_CQN_MASK, qp->scq->cqn);
+
+ req.rq_cqn_mtt_cfg = FIELD_PREP(
+ ERDMA_CMD_CREATE_QP_PAGE_SIZE_MASK,
+- ilog2(user_qp->rq_mtt.page_size) - PAGE_SHIFT);
++ ilog2(user_qp->rq_mtt.page_size) - ERDMA_HW_PAGE_SHIFT);
+ req.rq_cqn_mtt_cfg |=
+ FIELD_PREP(ERDMA_CMD_CREATE_QP_CQN_MASK, qp->rcq->cqn);
+
+@@ -162,7 +162,7 @@ static int create_cq_cmd(struct erdma_dev *dev, struct erdma_cq *cq)
+ if (rdma_is_kernel_res(&cq->ibcq.res)) {
+ page_size = SZ_32M;
+ req.cfg0 |= FIELD_PREP(ERDMA_CMD_CREATE_CQ_PAGESIZE_MASK,
+- ilog2(page_size) - PAGE_SHIFT);
++ ilog2(page_size) - ERDMA_HW_PAGE_SHIFT);
+ req.qbuf_addr_l = lower_32_bits(cq->kern_cq.qbuf_dma_addr);
+ req.qbuf_addr_h = upper_32_bits(cq->kern_cq.qbuf_dma_addr);
+
+@@ -175,8 +175,9 @@ static int create_cq_cmd(struct erdma_dev *dev, struct erdma_cq *cq)
+ cq->kern_cq.qbuf_dma_addr + (cq->depth << CQE_SHIFT);
+ } else {
+ mtt = &cq->user_cq.qbuf_mtt;
+- req.cfg0 |= FIELD_PREP(ERDMA_CMD_CREATE_CQ_PAGESIZE_MASK,
+- ilog2(mtt->page_size) - PAGE_SHIFT);
++ req.cfg0 |=
++ FIELD_PREP(ERDMA_CMD_CREATE_CQ_PAGESIZE_MASK,
++ ilog2(mtt->page_size) - ERDMA_HW_PAGE_SHIFT);
+ if (mtt->mtt_nents == 1) {
+ req.qbuf_addr_l = lower_32_bits(*(u64 *)mtt->mtt_buf);
+ req.qbuf_addr_h = upper_32_bits(*(u64 *)mtt->mtt_buf);
+@@ -636,7 +637,7 @@ static int init_user_qp(struct erdma_qp *qp, struct erdma_ucontext *uctx,
+ u32 rq_offset;
+ int ret;
+
+- if (len < (PAGE_ALIGN(qp->attrs.sq_size * SQEBB_SIZE) +
++ if (len < (ALIGN(qp->attrs.sq_size * SQEBB_SIZE, ERDMA_HW_PAGE_SIZE) +
+ qp->attrs.rq_size * RQE_SIZE))
+ return -EINVAL;
+
+@@ -646,7 +647,7 @@ static int init_user_qp(struct erdma_qp *qp, struct erdma_ucontext *uctx,
+ if (ret)
+ return ret;
+
+- rq_offset = PAGE_ALIGN(qp->attrs.sq_size << SQEBB_SHIFT);
++ rq_offset = ALIGN(qp->attrs.sq_size << SQEBB_SHIFT, ERDMA_HW_PAGE_SIZE);
+ qp->user_qp.rq_offset = rq_offset;
+
+ ret = get_mtt_entries(qp->dev, &qp->user_qp.rq_mtt, va + rq_offset,
+--
+2.39.2
+
--- /dev/null
+From b93e1da8265b190b94625117122300ca807e5cb1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Mar 2023 12:51:27 +0300
+Subject: RDMA/mlx4: Prevent shift wrapping in set_user_sq_size()
+
+From: Dan Carpenter <error27@gmail.com>
+
+[ Upstream commit d50b3c73f1ac20dabc53dc6e9d64ce9c79a331eb ]
+
+The ucmd->log_sq_bb_count variable is controlled by the user so this
+shift can wrap. Fix it by using check_shl_overflow() in the same way
+that it was done in commit 515f60004ed9 ("RDMA/hns: Prevent undefined
+behavior in hns_roce_set_user_sq_size()").
+
+Fixes: 839041329fd3 ("IB/mlx4: Sanity check userspace send queue sizes")
+Signed-off-by: Dan Carpenter <error27@gmail.com>
+Link: https://lore.kernel.org/r/a8dfbd1d-c019-4556-930b-bab1ded73b10@kili.mountain
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mlx4/qp.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c
+index 884825b2e5f77..456656617c33f 100644
+--- a/drivers/infiniband/hw/mlx4/qp.c
++++ b/drivers/infiniband/hw/mlx4/qp.c
+@@ -447,9 +447,13 @@ static int set_user_sq_size(struct mlx4_ib_dev *dev,
+ struct mlx4_ib_qp *qp,
+ struct mlx4_ib_create_qp *ucmd)
+ {
++ u32 cnt;
++
+ /* Sanity check SQ size before proceeding */
+- if ((1 << ucmd->log_sq_bb_count) > dev->dev->caps.max_wqes ||
+- ucmd->log_sq_stride >
++ if (check_shl_overflow(1, ucmd->log_sq_bb_count, &cnt) ||
++ cnt > dev->dev->caps.max_wqes)
++ return -EINVAL;
++ if (ucmd->log_sq_stride >
+ ilog2(roundup_pow_of_two(dev->dev->caps.max_sq_desc_sz)) ||
+ ucmd->log_sq_stride < MLX4_IB_MIN_SQ_STRIDE)
+ return -EINVAL;
+--
+2.39.2
+
--- /dev/null
+From 82f1b04f67d41360ddddc93437eb41ea81fc80a7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Apr 2023 16:07:51 +0300
+Subject: RDMA/mlx5: Check pcie_relaxed_ordering_enabled() in UMR
+
+From: Avihai Horon <avihaih@nvidia.com>
+
+[ Upstream commit d43b020b0f82c088ef8ff3196ef00575a97d200e ]
+
+relaxed_ordering_read HCA capability is set if both the device supports
+relaxed ordering (RO) read and RO is set in PCI config space.
+
+RO in PCI config space can change during runtime. This will change the
+value of relaxed_ordering_read HCA capability in FW, but the driver will
+not see it since it queries the capabilities only once.
+
+This can lead to the following scenario:
+1. RO in PCI config space is enabled.
+2. User creates MKey without RO.
+3. RO in PCI config space is disabled.
+ As a result, relaxed_ordering_read HCA capability is turned off in FW
+ but remains on in driver copy of the capabilities.
+4. User requests to reconfig the MKey with RO via UMR.
+5. Driver will try to reconfig the MKey with RO read although it
+ shouldn't (as relaxed_ordering_read HCA capability is really off).
+
+To fix this, check pcie_relaxed_ordering_enabled() before setting RO
+read in UMR.
+
+Fixes: 896ec9735336 ("RDMA/mlx5: Set mkey relaxed ordering by UMR with ConnectX-7")
+Signed-off-by: Avihai Horon <avihaih@nvidia.com>
+Reviewed-by: Shay Drory <shayd@nvidia.com>
+Link: https://lore.kernel.org/r/8d39eb8317e7bed1a354311a20ae707788fd94ed.1681131553.git.leon@kernel.org
+Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mlx5/umr.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/hw/mlx5/umr.c b/drivers/infiniband/hw/mlx5/umr.c
+index 55f4e048d9474..c9e176e8ced46 100644
+--- a/drivers/infiniband/hw/mlx5/umr.c
++++ b/drivers/infiniband/hw/mlx5/umr.c
+@@ -380,6 +380,9 @@ static void mlx5r_umr_set_access_flags(struct mlx5_ib_dev *dev,
+ struct mlx5_mkey_seg *seg,
+ unsigned int access_flags)
+ {
++ bool ro_read = (access_flags & IB_ACCESS_RELAXED_ORDERING) &&
++ pcie_relaxed_ordering_enabled(dev->mdev->pdev);
++
+ MLX5_SET(mkc, seg, a, !!(access_flags & IB_ACCESS_REMOTE_ATOMIC));
+ MLX5_SET(mkc, seg, rw, !!(access_flags & IB_ACCESS_REMOTE_WRITE));
+ MLX5_SET(mkc, seg, rr, !!(access_flags & IB_ACCESS_REMOTE_READ));
+@@ -387,8 +390,7 @@ static void mlx5r_umr_set_access_flags(struct mlx5_ib_dev *dev,
+ MLX5_SET(mkc, seg, lr, 1);
+ MLX5_SET(mkc, seg, relaxed_ordering_write,
+ !!(access_flags & IB_ACCESS_RELAXED_ORDERING));
+- MLX5_SET(mkc, seg, relaxed_ordering_read,
+- !!(access_flags & IB_ACCESS_RELAXED_ORDERING));
++ MLX5_SET(mkc, seg, relaxed_ordering_read, ro_read);
+ }
+
+ int mlx5r_umr_rereg_pd_access(struct mlx5_ib_mr *mr, struct ib_pd *pd,
+--
+2.39.2
+
--- /dev/null
+From 110b9ab4539f63837b6256244f6bc6f0467d441d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Apr 2023 12:23:09 +0300
+Subject: RDMA/mlx5: Fix flow counter query via DEVX
+
+From: Mark Bloch <mbloch@nvidia.com>
+
+[ Upstream commit 3e358ea8614ddfbc59ca7a3f5dff5dde2b350b2c ]
+
+Commit cited in "fixes" tag added bulk support for flow counters but it
+didn't account that's also possible to query a counter using a non-base id
+if the counter was allocated as bulk.
+
+When a user performs a query, validate the flow counter id given in the
+mailbox is inside the valid range taking bulk value into account.
+
+Fixes: 208d70f562e5 ("IB/mlx5: Support flow counters offset for bulk counters")
+Signed-off-by: Mark Bloch <mbloch@nvidia.com>
+Reviewed-by: Maor Gottlieb <maorg@nvidia.com>
+Link: https://lore.kernel.org/r/79d7fbe291690128e44672418934256254d93115.1681377114.git.leon@kernel.org
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mlx5/devx.c | 31 ++++++++++++++++++++++++++-----
+ include/linux/mlx5/mlx5_ifc.h | 3 ++-
+ 2 files changed, 28 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/infiniband/hw/mlx5/devx.c b/drivers/infiniband/hw/mlx5/devx.c
+index 2211a0be16f36..f8e2baed27a5c 100644
+--- a/drivers/infiniband/hw/mlx5/devx.c
++++ b/drivers/infiniband/hw/mlx5/devx.c
+@@ -666,7 +666,21 @@ static bool devx_is_valid_obj_id(struct uverbs_attr_bundle *attrs,
+ obj_id;
+
+ case MLX5_IB_OBJECT_DEVX_OBJ:
+- return ((struct devx_obj *)uobj->object)->obj_id == obj_id;
++ {
++ u16 opcode = MLX5_GET(general_obj_in_cmd_hdr, in, opcode);
++ struct devx_obj *devx_uobj = uobj->object;
++
++ if (opcode == MLX5_CMD_OP_QUERY_FLOW_COUNTER &&
++ devx_uobj->flow_counter_bulk_size) {
++ u64 end;
++
++ end = devx_uobj->obj_id +
++ devx_uobj->flow_counter_bulk_size;
++ return devx_uobj->obj_id <= obj_id && end > obj_id;
++ }
++
++ return devx_uobj->obj_id == obj_id;
++ }
+
+ default:
+ return false;
+@@ -1517,10 +1531,17 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_OBJ_CREATE)(
+ goto obj_free;
+
+ if (opcode == MLX5_CMD_OP_ALLOC_FLOW_COUNTER) {
+- u8 bulk = MLX5_GET(alloc_flow_counter_in,
+- cmd_in,
+- flow_counter_bulk);
+- obj->flow_counter_bulk_size = 128UL * bulk;
++ u32 bulk = MLX5_GET(alloc_flow_counter_in,
++ cmd_in,
++ flow_counter_bulk_log_size);
++
++ if (bulk)
++ bulk = 1 << bulk;
++ else
++ bulk = 128UL * MLX5_GET(alloc_flow_counter_in,
++ cmd_in,
++ flow_counter_bulk);
++ obj->flow_counter_bulk_size = bulk;
+ }
+
+ uobj->object = obj;
+diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h
+index 66d76e97a0876..1636d7f65630a 100644
+--- a/include/linux/mlx5/mlx5_ifc.h
++++ b/include/linux/mlx5/mlx5_ifc.h
+@@ -9271,7 +9271,8 @@ struct mlx5_ifc_alloc_flow_counter_in_bits {
+ u8 reserved_at_20[0x10];
+ u8 op_mod[0x10];
+
+- u8 reserved_at_40[0x38];
++ u8 reserved_at_40[0x33];
++ u8 flow_counter_bulk_log_size[0x5];
+ u8 flow_counter_bulk[0x8];
+ };
+
+--
+2.39.2
+
--- /dev/null
+From a883d1c139f5c7f43c1fb96b8d3285425ab724b0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Apr 2023 04:39:06 +0300
+Subject: RDMA/mlx5: Use correct device num_ports when modify DC
+
+From: Mark Zhang <markzhang@nvidia.com>
+
+[ Upstream commit 746aa3c8cb1a650ff2583497ac646e505831b9b9 ]
+
+Just like other QP types, when modify DC, the port_num should be compared
+with dev->num_ports, instead of HCA_CAP.num_ports. Otherwise Multi-port
+vHCA on DC may not work.
+
+Fixes: 776a3906b692 ("IB/mlx5: Add support for DC target QP")
+Link: https://lore.kernel.org/r/20230420013906.1244185-1-markzhang@nvidia.com
+Signed-off-by: Mark Zhang <markzhang@nvidia.com>
+Reviewed-by: Maor Gottlieb <maorg@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mlx5/qp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
+index 7cc3b973dec7b..86284aba3470d 100644
+--- a/drivers/infiniband/hw/mlx5/qp.c
++++ b/drivers/infiniband/hw/mlx5/qp.c
+@@ -4485,7 +4485,7 @@ static int mlx5_ib_modify_dct(struct ib_qp *ibqp, struct ib_qp_attr *attr,
+ return -EINVAL;
+
+ if (attr->port_num == 0 ||
+- attr->port_num > MLX5_CAP_GEN(dev->mdev, num_ports)) {
++ attr->port_num > dev->num_ports) {
+ mlx5_ib_dbg(dev, "invalid port number %d. number of ports is %d\n",
+ attr->port_num, dev->num_ports);
+ return -EINVAL;
+--
+2.39.2
+
--- /dev/null
+From 79d6f33a0ab01a06413f0b41be76f6ffe7b3bcbf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Mar 2023 15:44:08 +0300
+Subject: RDMA/rdmavt: Delete unnecessary NULL check
+
+From: Natalia Petrova <n.petrova@fintech.ru>
+
+[ Upstream commit b73a0b80c69de77d8d4942abb37066531c0169b2 ]
+
+There is no need to check 'rdi->qp_dev' for NULL. The field 'qp_dev'
+is created in rvt_register_device() which will fail if the 'qp_dev'
+allocation fails in rvt_driver_qp_init(). Overwise this pointer
+doesn't changed and passed to rvt_qp_exit() by the next step.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: 0acb0cc7ecc1 ("IB/rdmavt: Initialize and teardown of qpn table")
+Signed-off-by: Natalia Petrova <n.petrova@fintech.ru>
+Link: https://lore.kernel.org/r/20230303124408.16685-1-n.petrova@fintech.ru
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rdmavt/qp.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/infiniband/sw/rdmavt/qp.c b/drivers/infiniband/sw/rdmavt/qp.c
+index 3acab569fbb94..2bdc4486c3daa 100644
+--- a/drivers/infiniband/sw/rdmavt/qp.c
++++ b/drivers/infiniband/sw/rdmavt/qp.c
+@@ -464,8 +464,6 @@ void rvt_qp_exit(struct rvt_dev_info *rdi)
+ if (qps_inuse)
+ rvt_pr_err(rdi, "QP memory leak! %u still in use\n",
+ qps_inuse);
+- if (!rdi->qp_dev)
+- return;
+
+ kfree(rdi->qp_dev->qp_table);
+ free_qpn_table(&rdi->qp_dev->qpn_table);
+--
+2.39.2
+
--- /dev/null
+From 50c048f946dc9c385b791e397bec6ed1f848c525 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Mar 2023 16:16:24 -0600
+Subject: RDMA/rxe: Add error messages
+
+From: Bob Pearson <rpearsonhpe@gmail.com>
+
+[ Upstream commit 5bf944f24129cbc4b5828348bdce2db94ca9fbd6 ]
+
+This patch adds error and debug messages so that every interaction
+with rdma-core through a verbs API call or a completion error return
+will generate at least one error message backed up by debug messages
+with more detail.
+
+With dynamic debugging one can follow up after seeing an error message
+by turning on the appropriate debug messages.
+
+Link: https://lore.kernel.org/r/20230303221623.8053-5-rpearsonhpe@gmail.com
+Signed-off-by: Bob Pearson <rpearsonhpe@gmail.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Stable-dep-of: 78b26a335310 ("RDMA/rxe: Remove tasklet call from rxe_cq.c")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe_comp.c | 4 +
+ drivers/infiniband/sw/rxe/rxe_loc.h | 1 -
+ drivers/infiniband/sw/rxe/rxe_mr.c | 13 -
+ drivers/infiniband/sw/rxe/rxe_resp.c | 4 +
+ drivers/infiniband/sw/rxe/rxe_verbs.c | 828 +++++++++++++++++++-------
+ 5 files changed, 609 insertions(+), 241 deletions(-)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_comp.c b/drivers/infiniband/sw/rxe/rxe_comp.c
+index 20737fec392bf..876057e3ee3c1 100644
+--- a/drivers/infiniband/sw/rxe/rxe_comp.c
++++ b/drivers/infiniband/sw/rxe/rxe_comp.c
+@@ -428,6 +428,10 @@ static void make_send_cqe(struct rxe_qp *qp, struct rxe_send_wqe *wqe,
+ uwc->wc_flags = IB_WC_WITH_IMM;
+ uwc->byte_len = wqe->dma.length;
+ }
++ } else {
++ if (wqe->status != IB_WC_WR_FLUSH_ERR)
++ rxe_err_qp(qp, "non-flush error status = %d",
++ wqe->status);
+ }
+ }
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_loc.h b/drivers/infiniband/sw/rxe/rxe_loc.h
+index 1bb0cb479eb12..839de34cf4c94 100644
+--- a/drivers/infiniband/sw/rxe/rxe_loc.h
++++ b/drivers/infiniband/sw/rxe/rxe_loc.h
+@@ -80,7 +80,6 @@ int mr_check_range(struct rxe_mr *mr, u64 iova, size_t length);
+ int advance_dma_data(struct rxe_dma_info *dma, unsigned int length);
+ int rxe_invalidate_mr(struct rxe_qp *qp, u32 key);
+ int rxe_reg_fast_mr(struct rxe_qp *qp, struct rxe_send_wqe *wqe);
+-int rxe_dereg_mr(struct ib_mr *ibmr, struct ib_udata *udata);
+ void rxe_mr_cleanup(struct rxe_pool_elem *elem);
+
+ /* rxe_mw.c */
+diff --git a/drivers/infiniband/sw/rxe/rxe_mr.c b/drivers/infiniband/sw/rxe/rxe_mr.c
+index b10aa1580a644..1e17f8086d59a 100644
+--- a/drivers/infiniband/sw/rxe/rxe_mr.c
++++ b/drivers/infiniband/sw/rxe/rxe_mr.c
+@@ -722,19 +722,6 @@ int rxe_reg_fast_mr(struct rxe_qp *qp, struct rxe_send_wqe *wqe)
+ return 0;
+ }
+
+-int rxe_dereg_mr(struct ib_mr *ibmr, struct ib_udata *udata)
+-{
+- struct rxe_mr *mr = to_rmr(ibmr);
+-
+- /* See IBA 10.6.7.2.6 */
+- if (atomic_read(&mr->num_mw) > 0)
+- return -EINVAL;
+-
+- rxe_cleanup(mr);
+- kfree_rcu(mr);
+- return 0;
+-}
+-
+ void rxe_mr_cleanup(struct rxe_pool_elem *elem)
+ {
+ struct rxe_mr *mr = container_of(elem, typeof(*mr), elem);
+diff --git a/drivers/infiniband/sw/rxe/rxe_resp.c b/drivers/infiniband/sw/rxe/rxe_resp.c
+index 0cc1ba91d48cc..4217eec03a943 100644
+--- a/drivers/infiniband/sw/rxe/rxe_resp.c
++++ b/drivers/infiniband/sw/rxe/rxe_resp.c
+@@ -1151,6 +1151,10 @@ static enum resp_states do_complete(struct rxe_qp *qp,
+
+ wc->port_num = qp->attr.port_num;
+ }
++ } else {
++ if (wc->status != IB_WC_WR_FLUSH_ERR)
++ rxe_err_qp(qp, "non-flush error status = %d",
++ wc->status);
+ }
+
+ /* have copy for srq and reference for !srq */
+diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.c b/drivers/infiniband/sw/rxe/rxe_verbs.c
+index f178d0773ff20..84b53c070fc55 100644
+--- a/drivers/infiniband/sw/rxe/rxe_verbs.c
++++ b/drivers/infiniband/sw/rxe/rxe_verbs.c
+@@ -12,31 +12,48 @@
+ #include "rxe_queue.h"
+ #include "rxe_hw_counters.h"
+
+-static int rxe_query_device(struct ib_device *dev,
++static int post_one_recv(struct rxe_rq *rq, const struct ib_recv_wr *ibwr);
++
++/* dev */
++static int rxe_query_device(struct ib_device *ibdev,
+ struct ib_device_attr *attr,
+- struct ib_udata *uhw)
++ struct ib_udata *udata)
+ {
+- struct rxe_dev *rxe = to_rdev(dev);
++ struct rxe_dev *rxe = to_rdev(ibdev);
++ int err;
++
++ if (udata->inlen || udata->outlen) {
++ rxe_dbg_dev(rxe, "malformed udata");
++ err = -EINVAL;
++ goto err_out;
++ }
+
+- if (uhw->inlen || uhw->outlen)
+- return -EINVAL;
++ memcpy(attr, &rxe->attr, sizeof(*attr));
+
+- *attr = rxe->attr;
+ return 0;
++
++err_out:
++ rxe_err_dev(rxe, "returned err = %d", err);
++ return err;
+ }
+
+-static int rxe_query_port(struct ib_device *dev,
++static int rxe_query_port(struct ib_device *ibdev,
+ u32 port_num, struct ib_port_attr *attr)
+ {
+- struct rxe_dev *rxe = to_rdev(dev);
+- int rc;
++ struct rxe_dev *rxe = to_rdev(ibdev);
++ int err, ret;
+
+- /* *attr being zeroed by the caller, avoid zeroing it here */
+- *attr = rxe->port.attr;
++ if (port_num != 1) {
++ err = -EINVAL;
++ rxe_dbg_dev(rxe, "bad port_num = %d", port_num);
++ goto err_out;
++ }
++
++ memcpy(attr, &rxe->port.attr, sizeof(*attr));
+
+ mutex_lock(&rxe->usdev_lock);
+- rc = ib_get_eth_speed(dev, port_num, &attr->active_speed,
+- &attr->active_width);
++ ret = ib_get_eth_speed(ibdev, port_num, &attr->active_speed,
++ &attr->active_width);
+
+ if (attr->state == IB_PORT_ACTIVE)
+ attr->phys_state = IB_PORT_PHYS_STATE_LINK_UP;
+@@ -47,27 +64,45 @@ static int rxe_query_port(struct ib_device *dev,
+
+ mutex_unlock(&rxe->usdev_lock);
+
+- return rc;
++ return ret;
++
++err_out:
++ rxe_err_dev(rxe, "returned err = %d", err);
++ return err;
+ }
+
+-static int rxe_query_pkey(struct ib_device *device,
++static int rxe_query_pkey(struct ib_device *ibdev,
+ u32 port_num, u16 index, u16 *pkey)
+ {
+- if (index > 0)
+- return -EINVAL;
++ struct rxe_dev *rxe = to_rdev(ibdev);
++ int err;
++
++ if (index != 0) {
++ err = -EINVAL;
++ rxe_dbg_dev(rxe, "bad pkey index = %d", index);
++ goto err_out;
++ }
+
+ *pkey = IB_DEFAULT_PKEY_FULL;
+ return 0;
++
++err_out:
++ rxe_err_dev(rxe, "returned err = %d", err);
++ return err;
+ }
+
+-static int rxe_modify_device(struct ib_device *dev,
++static int rxe_modify_device(struct ib_device *ibdev,
+ int mask, struct ib_device_modify *attr)
+ {
+- struct rxe_dev *rxe = to_rdev(dev);
++ struct rxe_dev *rxe = to_rdev(ibdev);
++ int err;
+
+ if (mask & ~(IB_DEVICE_MODIFY_SYS_IMAGE_GUID |
+- IB_DEVICE_MODIFY_NODE_DESC))
+- return -EOPNOTSUPP;
++ IB_DEVICE_MODIFY_NODE_DESC)) {
++ err = -EOPNOTSUPP;
++ rxe_dbg_dev(rxe, "unsupported mask = 0x%x", mask);
++ goto err_out;
++ }
+
+ if (mask & IB_DEVICE_MODIFY_SYS_IMAGE_GUID)
+ rxe->attr.sys_image_guid = cpu_to_be64(attr->sys_image_guid);
+@@ -78,16 +113,33 @@ static int rxe_modify_device(struct ib_device *dev,
+ }
+
+ return 0;
++
++err_out:
++ rxe_err_dev(rxe, "returned err = %d", err);
++ return err;
+ }
+
+-static int rxe_modify_port(struct ib_device *dev,
+- u32 port_num, int mask, struct ib_port_modify *attr)
++static int rxe_modify_port(struct ib_device *ibdev, u32 port_num,
++ int mask, struct ib_port_modify *attr)
+ {
+- struct rxe_dev *rxe = to_rdev(dev);
++ struct rxe_dev *rxe = to_rdev(ibdev);
+ struct rxe_port *port;
++ int err;
+
+- port = &rxe->port;
++ if (port_num != 1) {
++ err = -EINVAL;
++ rxe_dbg_dev(rxe, "bad port_num = %d", port_num);
++ goto err_out;
++ }
+
++ //TODO is shutdown useful
++ if (mask & ~(IB_PORT_RESET_QKEY_CNTR)) {
++ err = -EOPNOTSUPP;
++ rxe_dbg_dev(rxe, "unsupported mask = 0x%x", mask);
++ goto err_out;
++ }
++
++ port = &rxe->port;
+ port->attr.port_cap_flags |= attr->set_port_cap_mask;
+ port->attr.port_cap_flags &= ~attr->clr_port_cap_mask;
+
+@@ -95,73 +147,125 @@ static int rxe_modify_port(struct ib_device *dev,
+ port->attr.qkey_viol_cntr = 0;
+
+ return 0;
+-}
+
+-static enum rdma_link_layer rxe_get_link_layer(struct ib_device *dev,
+- u32 port_num)
+-{
+- return IB_LINK_LAYER_ETHERNET;
++err_out:
++ rxe_err_dev(rxe, "returned err = %d", err);
++ return err;
+ }
+
+-static int rxe_alloc_ucontext(struct ib_ucontext *ibuc, struct ib_udata *udata)
++static enum rdma_link_layer rxe_get_link_layer(struct ib_device *ibdev,
++ u32 port_num)
+ {
+- struct rxe_dev *rxe = to_rdev(ibuc->device);
+- struct rxe_ucontext *uc = to_ruc(ibuc);
++ struct rxe_dev *rxe = to_rdev(ibdev);
++ int err;
+
+- return rxe_add_to_pool(&rxe->uc_pool, uc);
+-}
++ if (port_num != 1) {
++ err = -EINVAL;
++ rxe_dbg_dev(rxe, "bad port_num = %d", port_num);
++ goto err_out;
++ }
+
+-static void rxe_dealloc_ucontext(struct ib_ucontext *ibuc)
+-{
+- struct rxe_ucontext *uc = to_ruc(ibuc);
++ return IB_LINK_LAYER_ETHERNET;
+
+- rxe_cleanup(uc);
++err_out:
++ rxe_err_dev(rxe, "returned err = %d", err);
++ return err;
+ }
+
+-static int rxe_port_immutable(struct ib_device *dev, u32 port_num,
++static int rxe_port_immutable(struct ib_device *ibdev, u32 port_num,
+ struct ib_port_immutable *immutable)
+ {
++ struct rxe_dev *rxe = to_rdev(ibdev);
++ struct ib_port_attr attr = {};
+ int err;
+- struct ib_port_attr attr;
+
+- immutable->core_cap_flags = RDMA_CORE_PORT_IBA_ROCE_UDP_ENCAP;
++ if (port_num != 1) {
++ err = -EINVAL;
++ rxe_dbg_dev(rxe, "bad port_num = %d", port_num);
++ goto err_out;
++ }
+
+- err = ib_query_port(dev, port_num, &attr);
++ err = ib_query_port(ibdev, port_num, &attr);
+ if (err)
+- return err;
++ goto err_out;
+
++ immutable->core_cap_flags = RDMA_CORE_PORT_IBA_ROCE_UDP_ENCAP;
+ immutable->pkey_tbl_len = attr.pkey_tbl_len;
+ immutable->gid_tbl_len = attr.gid_tbl_len;
+ immutable->max_mad_size = IB_MGMT_MAD_SIZE;
+
+ return 0;
++
++err_out:
++ rxe_err_dev(rxe, "returned err = %d", err);
++ return err;
+ }
+
++/* uc */
++static int rxe_alloc_ucontext(struct ib_ucontext *ibuc, struct ib_udata *udata)
++{
++ struct rxe_dev *rxe = to_rdev(ibuc->device);
++ struct rxe_ucontext *uc = to_ruc(ibuc);
++ int err;
++
++ err = rxe_add_to_pool(&rxe->uc_pool, uc);
++ if (err)
++ rxe_err_dev(rxe, "unable to create uc");
++
++ return err;
++}
++
++static void rxe_dealloc_ucontext(struct ib_ucontext *ibuc)
++{
++ struct rxe_ucontext *uc = to_ruc(ibuc);
++ int err;
++
++ err = rxe_cleanup(uc);
++ if (err)
++ rxe_err_uc(uc, "cleanup failed, err = %d", err);
++}
++
++/* pd */
+ static int rxe_alloc_pd(struct ib_pd *ibpd, struct ib_udata *udata)
+ {
+ struct rxe_dev *rxe = to_rdev(ibpd->device);
+ struct rxe_pd *pd = to_rpd(ibpd);
++ int err;
++
++ err = rxe_add_to_pool(&rxe->pd_pool, pd);
++ if (err) {
++ rxe_dbg_dev(rxe, "unable to alloc pd");
++ goto err_out;
++ }
+
+- return rxe_add_to_pool(&rxe->pd_pool, pd);
++ return 0;
++
++err_out:
++ rxe_err_dev(rxe, "returned err = %d", err);
++ return err;
+ }
+
+ static int rxe_dealloc_pd(struct ib_pd *ibpd, struct ib_udata *udata)
+ {
+ struct rxe_pd *pd = to_rpd(ibpd);
++ int err;
++
++ err = rxe_cleanup(pd);
++ if (err)
++ rxe_err_pd(pd, "cleanup failed, err = %d", err);
+
+- rxe_cleanup(pd);
+ return 0;
+ }
+
++/* ah */
+ static int rxe_create_ah(struct ib_ah *ibah,
+ struct rdma_ah_init_attr *init_attr,
+ struct ib_udata *udata)
+-
+ {
+ struct rxe_dev *rxe = to_rdev(ibah->device);
+ struct rxe_ah *ah = to_rah(ibah);
+ struct rxe_create_ah_resp __user *uresp = NULL;
+- int err;
++ int err, cleanup_err;
+
+ if (udata) {
+ /* test if new user provider */
+@@ -174,16 +278,18 @@ static int rxe_create_ah(struct ib_ah *ibah,
+
+ err = rxe_add_to_pool_ah(&rxe->ah_pool, ah,
+ init_attr->flags & RDMA_CREATE_AH_SLEEPABLE);
+- if (err)
+- return err;
++ if (err) {
++ rxe_dbg_dev(rxe, "unable to create ah");
++ goto err_out;
++ }
+
+ /* create index > 0 */
+ ah->ah_num = ah->elem.index;
+
+ err = rxe_ah_chk_attr(ah, init_attr->ah_attr);
+ if (err) {
+- rxe_cleanup(ah);
+- return err;
++ rxe_dbg_ah(ah, "bad attr");
++ goto err_cleanup;
+ }
+
+ if (uresp) {
+@@ -191,8 +297,9 @@ static int rxe_create_ah(struct ib_ah *ibah,
+ err = copy_to_user(&uresp->ah_num, &ah->ah_num,
+ sizeof(uresp->ah_num));
+ if (err) {
+- rxe_cleanup(ah);
+- return -EFAULT;
++ err = -EFAULT;
++ rxe_dbg_ah(ah, "unable to copy to user");
++ goto err_cleanup;
+ }
+ } else if (ah->is_user) {
+ /* only if old user provider */
+@@ -203,19 +310,34 @@ static int rxe_create_ah(struct ib_ah *ibah,
+ rxe_finalize(ah);
+
+ return 0;
++
++err_cleanup:
++ cleanup_err = rxe_cleanup(ah);
++ if (cleanup_err)
++ rxe_err_ah(ah, "cleanup failed, err = %d", cleanup_err);
++err_out:
++ rxe_err_ah(ah, "returned err = %d", err);
++ return err;
+ }
+
+ static int rxe_modify_ah(struct ib_ah *ibah, struct rdma_ah_attr *attr)
+ {
+- int err;
+ struct rxe_ah *ah = to_rah(ibah);
++ int err;
+
+ err = rxe_ah_chk_attr(ah, attr);
+- if (err)
+- return err;
++ if (err) {
++ rxe_dbg_ah(ah, "bad attr");
++ goto err_out;
++ }
+
+ rxe_init_av(attr, &ah->av);
++
+ return 0;
++
++err_out:
++ rxe_err_ah(ah, "returned err = %d", err);
++ return err;
+ }
+
+ static int rxe_query_ah(struct ib_ah *ibah, struct rdma_ah_attr *attr)
+@@ -225,92 +347,77 @@ static int rxe_query_ah(struct ib_ah *ibah, struct rdma_ah_attr *attr)
+ memset(attr, 0, sizeof(*attr));
+ attr->type = ibah->type;
+ rxe_av_to_attr(&ah->av, attr);
++
+ return 0;
+ }
+
+ static int rxe_destroy_ah(struct ib_ah *ibah, u32 flags)
+ {
+ struct rxe_ah *ah = to_rah(ibah);
++ int err;
+
+- rxe_cleanup_ah(ah, flags & RDMA_DESTROY_AH_SLEEPABLE);
+-
+- return 0;
+-}
+-
+-static int post_one_recv(struct rxe_rq *rq, const struct ib_recv_wr *ibwr)
+-{
+- int i;
+- u32 length;
+- struct rxe_recv_wqe *recv_wqe;
+- int num_sge = ibwr->num_sge;
+- int full;
+-
+- full = queue_full(rq->queue, QUEUE_TYPE_FROM_ULP);
+- if (unlikely(full))
+- return -ENOMEM;
+-
+- if (unlikely(num_sge > rq->max_sge))
+- return -EINVAL;
+-
+- length = 0;
+- for (i = 0; i < num_sge; i++)
+- length += ibwr->sg_list[i].length;
+-
+- recv_wqe = queue_producer_addr(rq->queue, QUEUE_TYPE_FROM_ULP);
+- recv_wqe->wr_id = ibwr->wr_id;
+-
+- memcpy(recv_wqe->dma.sge, ibwr->sg_list,
+- num_sge * sizeof(struct ib_sge));
+-
+- recv_wqe->dma.length = length;
+- recv_wqe->dma.resid = length;
+- recv_wqe->dma.num_sge = num_sge;
+- recv_wqe->dma.cur_sge = 0;
+- recv_wqe->dma.sge_offset = 0;
+-
+- queue_advance_producer(rq->queue, QUEUE_TYPE_FROM_ULP);
++ err = rxe_cleanup_ah(ah, flags & RDMA_DESTROY_AH_SLEEPABLE);
++ if (err)
++ rxe_err_ah(ah, "cleanup failed, err = %d", err);
+
+ return 0;
+ }
+
++/* srq */
+ static int rxe_create_srq(struct ib_srq *ibsrq, struct ib_srq_init_attr *init,
+ struct ib_udata *udata)
+ {
+- int err;
+ struct rxe_dev *rxe = to_rdev(ibsrq->device);
+ struct rxe_pd *pd = to_rpd(ibsrq->pd);
+ struct rxe_srq *srq = to_rsrq(ibsrq);
+ struct rxe_create_srq_resp __user *uresp = NULL;
++ int err, cleanup_err;
+
+ if (udata) {
+- if (udata->outlen < sizeof(*uresp))
+- return -EINVAL;
++ if (udata->outlen < sizeof(*uresp)) {
++ err = -EINVAL;
++ rxe_err_dev(rxe, "malformed udata");
++ goto err_out;
++ }
+ uresp = udata->outbuf;
+ }
+
+- if (init->srq_type != IB_SRQT_BASIC)
+- return -EOPNOTSUPP;
++ if (init->srq_type != IB_SRQT_BASIC) {
++ err = -EOPNOTSUPP;
++ rxe_dbg_dev(rxe, "srq type = %d, not supported",
++ init->srq_type);
++ goto err_out;
++ }
+
+ err = rxe_srq_chk_init(rxe, init);
+- if (err)
+- return err;
++ if (err) {
++ rxe_dbg_dev(rxe, "invalid init attributes");
++ goto err_out;
++ }
+
+ err = rxe_add_to_pool(&rxe->srq_pool, srq);
+- if (err)
+- return err;
++ if (err) {
++ rxe_dbg_dev(rxe, "unable to create srq, err = %d", err);
++ goto err_out;
++ }
+
+ rxe_get(pd);
+ srq->pd = pd;
+
+ err = rxe_srq_from_init(rxe, srq, init, udata, uresp);
+- if (err)
++ if (err) {
++ rxe_dbg_srq(srq, "create srq failed, err = %d", err);
+ goto err_cleanup;
++ }
+
+ return 0;
+
+ err_cleanup:
+- rxe_cleanup(srq);
+-
++ cleanup_err = rxe_cleanup(srq);
++ if (cleanup_err)
++ rxe_err_srq(srq, "cleanup failed, err = %d", cleanup_err);
++err_out:
++ rxe_err_dev(rxe, "returned err = %d", err);
+ return err;
+ }
+
+@@ -318,46 +425,64 @@ static int rxe_modify_srq(struct ib_srq *ibsrq, struct ib_srq_attr *attr,
+ enum ib_srq_attr_mask mask,
+ struct ib_udata *udata)
+ {
+- int err;
+ struct rxe_srq *srq = to_rsrq(ibsrq);
+ struct rxe_dev *rxe = to_rdev(ibsrq->device);
+- struct rxe_modify_srq_cmd ucmd = {};
++ struct rxe_modify_srq_cmd cmd = {};
++ int err;
+
+ if (udata) {
+- if (udata->inlen < sizeof(ucmd))
+- return -EINVAL;
++ if (udata->inlen < sizeof(cmd)) {
++ err = -EINVAL;
++ rxe_dbg_srq(srq, "malformed udata");
++ goto err_out;
++ }
+
+- err = ib_copy_from_udata(&ucmd, udata, sizeof(ucmd));
+- if (err)
+- return err;
++ err = ib_copy_from_udata(&cmd, udata, sizeof(cmd));
++ if (err) {
++ err = -EFAULT;
++ rxe_dbg_srq(srq, "unable to read udata");
++ goto err_out;
++ }
+ }
+
+ err = rxe_srq_chk_attr(rxe, srq, attr, mask);
+- if (err)
+- return err;
++ if (err) {
++ rxe_dbg_srq(srq, "bad init attributes");
++ goto err_out;
++ }
++
++ err = rxe_srq_from_attr(rxe, srq, attr, mask, &cmd, udata);
++ if (err) {
++ rxe_dbg_srq(srq, "bad attr");
++ goto err_out;
++ }
++
++ return 0;
+
+- return rxe_srq_from_attr(rxe, srq, attr, mask, &ucmd, udata);
++err_out:
++ rxe_err_srq(srq, "returned err = %d", err);
++ return err;
+ }
+
+ static int rxe_query_srq(struct ib_srq *ibsrq, struct ib_srq_attr *attr)
+ {
+ struct rxe_srq *srq = to_rsrq(ibsrq);
++ int err;
+
+- if (srq->error)
+- return -EINVAL;
++ if (srq->error) {
++ err = -EINVAL;
++ rxe_dbg_srq(srq, "srq in error state");
++ goto err_out;
++ }
+
+ attr->max_wr = srq->rq.queue->buf->index_mask;
+ attr->max_sge = srq->rq.max_sge;
+ attr->srq_limit = srq->limit;
+ return 0;
+-}
+-
+-static int rxe_destroy_srq(struct ib_srq *ibsrq, struct ib_udata *udata)
+-{
+- struct rxe_srq *srq = to_rsrq(ibsrq);
+
+- rxe_cleanup(srq);
+- return 0;
++err_out:
++ rxe_err_srq(srq, "returned err = %d", err);
++ return err;
+ }
+
+ static int rxe_post_srq_recv(struct ib_srq *ibsrq, const struct ib_recv_wr *wr,
+@@ -378,76 +503,116 @@ static int rxe_post_srq_recv(struct ib_srq *ibsrq, const struct ib_recv_wr *wr,
+
+ spin_unlock_irqrestore(&srq->rq.producer_lock, flags);
+
+- if (err)
++ if (err) {
+ *bad_wr = wr;
++ rxe_err_srq(srq, "returned err = %d", err);
++ }
+
+ return err;
+ }
+
++static int rxe_destroy_srq(struct ib_srq *ibsrq, struct ib_udata *udata)
++{
++ struct rxe_srq *srq = to_rsrq(ibsrq);
++ int err;
++
++ err = rxe_cleanup(srq);
++ if (err)
++ rxe_err_srq(srq, "cleanup failed, err = %d", err);
++
++ return 0;
++}
++
++/* qp */
+ static int rxe_create_qp(struct ib_qp *ibqp, struct ib_qp_init_attr *init,
+ struct ib_udata *udata)
+ {
+- int err;
+ struct rxe_dev *rxe = to_rdev(ibqp->device);
+ struct rxe_pd *pd = to_rpd(ibqp->pd);
+ struct rxe_qp *qp = to_rqp(ibqp);
+ struct rxe_create_qp_resp __user *uresp = NULL;
++ int err, cleanup_err;
+
+ if (udata) {
+- if (udata->outlen < sizeof(*uresp))
+- return -EINVAL;
+- uresp = udata->outbuf;
+- }
+-
+- if (init->create_flags)
+- return -EOPNOTSUPP;
+-
+- err = rxe_qp_chk_init(rxe, init);
+- if (err)
+- return err;
++ if (udata->inlen) {
++ err = -EINVAL;
++ rxe_dbg_dev(rxe, "malformed udata, err = %d", err);
++ goto err_out;
++ }
+
+- if (udata) {
+- if (udata->inlen)
+- return -EINVAL;
++ if (udata->outlen < sizeof(*uresp)) {
++ err = -EINVAL;
++ rxe_dbg_dev(rxe, "malformed udata, err = %d", err);
++ goto err_out;
++ }
+
+ qp->is_user = true;
++ uresp = udata->outbuf;
+ } else {
+ qp->is_user = false;
+ }
+
++ if (init->create_flags) {
++ err = -EOPNOTSUPP;
++ rxe_dbg_dev(rxe, "unsupported create_flags, err = %d", err);
++ goto err_out;
++ }
++
++ err = rxe_qp_chk_init(rxe, init);
++ if (err) {
++ rxe_dbg_dev(rxe, "bad init attr, err = %d", err);
++ goto err_out;
++ }
++
+ err = rxe_add_to_pool(&rxe->qp_pool, qp);
+- if (err)
+- return err;
++ if (err) {
++ rxe_dbg_dev(rxe, "unable to create qp, err = %d", err);
++ goto err_out;
++ }
+
+ err = rxe_qp_from_init(rxe, qp, pd, init, uresp, ibqp->pd, udata);
+- if (err)
+- goto qp_init;
++ if (err) {
++ rxe_dbg_qp(qp, "create qp failed, err = %d", err);
++ goto err_cleanup;
++ }
+
+ rxe_finalize(qp);
+ return 0;
+
+-qp_init:
+- rxe_cleanup(qp);
++err_cleanup:
++ cleanup_err = rxe_cleanup(qp);
++ if (cleanup_err)
++ rxe_err_qp(qp, "cleanup failed, err = %d", cleanup_err);
++err_out:
++ rxe_err_dev(rxe, "returned err = %d", err);
+ return err;
+ }
+
+ static int rxe_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,
+ int mask, struct ib_udata *udata)
+ {
+- int err;
+ struct rxe_dev *rxe = to_rdev(ibqp->device);
+ struct rxe_qp *qp = to_rqp(ibqp);
++ int err;
+
+- if (mask & ~IB_QP_ATTR_STANDARD_BITS)
+- return -EOPNOTSUPP;
++ if (mask & ~IB_QP_ATTR_STANDARD_BITS) {
++ err = -EOPNOTSUPP;
++ rxe_dbg_qp(qp, "unsupported mask = 0x%x, err = %d",
++ mask, err);
++ goto err_out;
++ }
+
+ err = rxe_qp_chk_attr(rxe, qp, attr, mask);
+- if (err)
+- return err;
++ if (err) {
++ rxe_dbg_qp(qp, "bad mask/attr, err = %d", err);
++ goto err_out;
++ }
+
+ err = rxe_qp_from_attr(qp, attr, mask, udata);
+- if (err)
+- return err;
++ if (err) {
++ rxe_dbg_qp(qp, "modify qp failed, err = %d", err);
++ goto err_out;
++ }
+
+ if ((mask & IB_QP_AV) && (attr->ah_attr.ah_flags & IB_AH_GRH))
+ qp->src_port = rdma_get_udp_sport(attr->ah_attr.grh.flow_label,
+@@ -455,6 +620,10 @@ static int rxe_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,
+ qp->attr.dest_qp_num);
+
+ return 0;
++
++err_out:
++ rxe_err_qp(qp, "returned err = %d", err);
++ return err;
+ }
+
+ static int rxe_query_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,
+@@ -471,38 +640,59 @@ static int rxe_query_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,
+ static int rxe_destroy_qp(struct ib_qp *ibqp, struct ib_udata *udata)
+ {
+ struct rxe_qp *qp = to_rqp(ibqp);
+- int ret;
++ int err;
++
++ err = rxe_qp_chk_destroy(qp);
++ if (err) {
++ rxe_dbg_qp(qp, "unable to destroy qp, err = %d", err);
++ goto err_out;
++ }
+
+- ret = rxe_qp_chk_destroy(qp);
+- if (ret)
+- return ret;
++ err = rxe_cleanup(qp);
++ if (err)
++ rxe_err_qp(qp, "cleanup failed, err = %d", err);
+
+- rxe_cleanup(qp);
+ return 0;
++
++err_out:
++ rxe_err_qp(qp, "returned err = %d", err);
++ return err;
+ }
+
++/* send wr */
+ static int validate_send_wr(struct rxe_qp *qp, const struct ib_send_wr *ibwr,
+ unsigned int mask, unsigned int length)
+ {
+ int num_sge = ibwr->num_sge;
+ struct rxe_sq *sq = &qp->sq;
+
+- if (unlikely(num_sge > sq->max_sge))
+- return -EINVAL;
++ if (unlikely(num_sge > sq->max_sge)) {
++ rxe_dbg_qp(qp, "num_sge > max_sge");
++ goto err_out;
++ }
+
+ if (unlikely(mask & WR_ATOMIC_MASK)) {
+- if (length < 8)
+- return -EINVAL;
++ if (length != 8) {
++ rxe_dbg_qp(qp, "atomic length != 8");
++ goto err_out;
++ }
+
+- if (atomic_wr(ibwr)->remote_addr & 0x7)
+- return -EINVAL;
++ if (atomic_wr(ibwr)->remote_addr & 0x7) {
++ rxe_dbg_qp(qp, "misaligned atomic address");
++ goto err_out;
++ }
+ }
+
+ if (unlikely((ibwr->send_flags & IB_SEND_INLINE) &&
+- (length > sq->max_inline)))
+- return -EINVAL;
++ (length > sq->max_inline))) {
++ rxe_dbg_qp(qp, "inline length too big");
++ goto err_out;
++ }
+
+ return 0;
++
++err_out:
++ return -EINVAL;
+ }
+
+ static void init_send_wr(struct rxe_qp *qp, struct rxe_send_wr *wr,
+@@ -550,12 +740,12 @@ static void init_send_wr(struct rxe_qp *qp, struct rxe_send_wr *wr,
+ break;
+ case IB_WR_LOCAL_INV:
+ wr->ex.invalidate_rkey = ibwr->ex.invalidate_rkey;
+- break;
++ break;
+ case IB_WR_REG_MR:
+ wr->wr.reg.mr = reg_wr(ibwr)->mr;
+ wr->wr.reg.key = reg_wr(ibwr)->key;
+ wr->wr.reg.access = reg_wr(ibwr)->access;
+- break;
++ break;
+ default:
+ break;
+ }
+@@ -624,9 +814,9 @@ static int post_one_send(struct rxe_qp *qp, const struct ib_send_wr *ibwr,
+ spin_lock_irqsave(&qp->sq.sq_lock, flags);
+
+ full = queue_full(sq->queue, QUEUE_TYPE_FROM_ULP);
+-
+ if (unlikely(full)) {
+ spin_unlock_irqrestore(&qp->sq.sq_lock, flags);
++ rxe_dbg_qp(qp, "queue full");
+ return -ENOMEM;
+ }
+
+@@ -652,6 +842,7 @@ static int rxe_post_send_kernel(struct rxe_qp *qp, const struct ib_send_wr *wr,
+ while (wr) {
+ mask = wr_opcode_mask(wr->opcode, qp);
+ if (unlikely(!mask)) {
++ rxe_dbg_qp(qp, "bad wr opcode for qp");
+ err = -EINVAL;
+ *bad_wr = wr;
+ break;
+@@ -659,6 +850,7 @@ static int rxe_post_send_kernel(struct rxe_qp *qp, const struct ib_send_wr *wr,
+
+ if (unlikely((wr->send_flags & IB_SEND_INLINE) &&
+ !(mask & WR_INLINE_MASK))) {
++ rxe_dbg_qp(qp, "opcode doesn't support inline data");
+ err = -EINVAL;
+ *bad_wr = wr;
+ break;
+@@ -669,17 +861,26 @@ static int rxe_post_send_kernel(struct rxe_qp *qp, const struct ib_send_wr *wr,
+ length = 0;
+ for (i = 0; i < wr->num_sge; i++)
+ length += wr->sg_list[i].length;
++ if (length > 1<<31) {
++ err = -EINVAL;
++ rxe_dbg_qp(qp, "message length too long");
++ *bad_wr = wr;
++ break;
++ }
+
+ err = post_one_send(qp, wr, mask, length);
+-
+ if (err) {
+ *bad_wr = wr;
+ break;
+ }
++
+ wr = next;
+ }
+
+- rxe_sched_task(&qp->req.task);
++ /* if we didn't post anything there's nothing to do */
++ if (!err)
++ rxe_sched_task(&qp->req.task);
++
+ if (unlikely(qp->req.state == QP_STATE_ERROR))
+ rxe_sched_task(&qp->comp.task);
+
+@@ -690,23 +891,90 @@ static int rxe_post_send(struct ib_qp *ibqp, const struct ib_send_wr *wr,
+ const struct ib_send_wr **bad_wr)
+ {
+ struct rxe_qp *qp = to_rqp(ibqp);
++ int err;
+
+ if (unlikely(!qp->valid)) {
+ *bad_wr = wr;
+- return -EINVAL;
++ err = -EINVAL;
++ rxe_dbg_qp(qp, "qp destroyed");
++ goto err_out;
+ }
+
+ if (unlikely(qp->req.state < QP_STATE_READY)) {
+ *bad_wr = wr;
+- return -EINVAL;
++ err = -EINVAL;
++ rxe_dbg_qp(qp, "qp not ready to send");
++ goto err_out;
+ }
+
+ if (qp->is_user) {
+ /* Utilize process context to do protocol processing */
+ rxe_run_task(&qp->req.task);
+- return 0;
+- } else
+- return rxe_post_send_kernel(qp, wr, bad_wr);
++ } else {
++ err = rxe_post_send_kernel(qp, wr, bad_wr);
++ if (err)
++ goto err_out;
++ }
++
++ return 0;
++
++err_out:
++ rxe_err_qp(qp, "returned err = %d", err);
++ return err;
++}
++
++/* recv wr */
++static int post_one_recv(struct rxe_rq *rq, const struct ib_recv_wr *ibwr)
++{
++ int i;
++ unsigned long length;
++ struct rxe_recv_wqe *recv_wqe;
++ int num_sge = ibwr->num_sge;
++ int full;
++ int err;
++
++ full = queue_full(rq->queue, QUEUE_TYPE_FROM_ULP);
++ if (unlikely(full)) {
++ err = -ENOMEM;
++ rxe_dbg("queue full");
++ goto err_out;
++ }
++
++ if (unlikely(num_sge > rq->max_sge)) {
++ err = -EINVAL;
++ rxe_dbg("bad num_sge > max_sge");
++ goto err_out;
++ }
++
++ length = 0;
++ for (i = 0; i < num_sge; i++)
++ length += ibwr->sg_list[i].length;
++
++ /* IBA max message size is 2^31 */
++ if (length >= (1UL<<31)) {
++ err = -EINVAL;
++ rxe_dbg("message length too long");
++ goto err_out;
++ }
++
++ recv_wqe = queue_producer_addr(rq->queue, QUEUE_TYPE_FROM_ULP);
++
++ recv_wqe->wr_id = ibwr->wr_id;
++ recv_wqe->dma.length = length;
++ recv_wqe->dma.resid = length;
++ recv_wqe->dma.num_sge = num_sge;
++ recv_wqe->dma.cur_sge = 0;
++ recv_wqe->dma.sge_offset = 0;
++ memcpy(recv_wqe->dma.sge, ibwr->sg_list,
++ num_sge * sizeof(struct ib_sge));
++
++ queue_advance_producer(rq->queue, QUEUE_TYPE_FROM_ULP);
++
++ return 0;
++
++err_out:
++ rxe_dbg("returned err = %d", err);
++ return err;
+ }
+
+ static int rxe_post_recv(struct ib_qp *ibqp, const struct ib_recv_wr *wr,
+@@ -719,12 +987,16 @@ static int rxe_post_recv(struct ib_qp *ibqp, const struct ib_recv_wr *wr,
+
+ if (unlikely((qp_state(qp) < IB_QPS_INIT) || !qp->valid)) {
+ *bad_wr = wr;
+- return -EINVAL;
++ err = -EINVAL;
++ rxe_dbg_qp(qp, "qp destroyed or not ready to post recv");
++ goto err_out;
+ }
+
+ if (unlikely(qp->srq)) {
+ *bad_wr = wr;
+- return -EINVAL;
++ err = -EINVAL;
++ rxe_dbg_qp(qp, "use post_srq_recv instead");
++ goto err_out;
+ }
+
+ spin_lock_irqsave(&rq->producer_lock, flags);
+@@ -743,73 +1015,101 @@ static int rxe_post_recv(struct ib_qp *ibqp, const struct ib_recv_wr *wr,
+ if (qp->resp.state == QP_STATE_ERROR)
+ rxe_sched_task(&qp->resp.task);
+
++err_out:
++ if (err)
++ rxe_err_qp(qp, "returned err = %d", err);
++
+ return err;
+ }
+
++/* cq */
+ static int rxe_create_cq(struct ib_cq *ibcq, const struct ib_cq_init_attr *attr,
+ struct ib_udata *udata)
+ {
+- int err;
+ struct ib_device *dev = ibcq->device;
+ struct rxe_dev *rxe = to_rdev(dev);
+ struct rxe_cq *cq = to_rcq(ibcq);
+ struct rxe_create_cq_resp __user *uresp = NULL;
++ int err, cleanup_err;
+
+ if (udata) {
+- if (udata->outlen < sizeof(*uresp))
+- return -EINVAL;
++ if (udata->outlen < sizeof(*uresp)) {
++ err = -EINVAL;
++ rxe_dbg_dev(rxe, "malformed udata, err = %d", err);
++ goto err_out;
++ }
+ uresp = udata->outbuf;
+ }
+
+- if (attr->flags)
+- return -EOPNOTSUPP;
++ if (attr->flags) {
++ err = -EOPNOTSUPP;
++ rxe_dbg_dev(rxe, "bad attr->flags, err = %d", err);
++ goto err_out;
++ }
+
+ err = rxe_cq_chk_attr(rxe, NULL, attr->cqe, attr->comp_vector);
+- if (err)
+- return err;
++ if (err) {
++ rxe_dbg_dev(rxe, "bad init attributes, err = %d", err);
++ goto err_out;
++ }
++
++ err = rxe_add_to_pool(&rxe->cq_pool, cq);
++ if (err) {
++ rxe_dbg_dev(rxe, "unable to create cq, err = %d", err);
++ goto err_out;
++ }
+
+ err = rxe_cq_from_init(rxe, cq, attr->cqe, attr->comp_vector, udata,
+ uresp);
+- if (err)
+- return err;
+-
+- return rxe_add_to_pool(&rxe->cq_pool, cq);
+-}
+-
+-static int rxe_destroy_cq(struct ib_cq *ibcq, struct ib_udata *udata)
+-{
+- struct rxe_cq *cq = to_rcq(ibcq);
+-
+- /* See IBA C11-17: The CI shall return an error if this Verb is
+- * invoked while a Work Queue is still associated with the CQ.
+- */
+- if (atomic_read(&cq->num_wq))
+- return -EINVAL;
+-
+- rxe_cq_disable(cq);
++ if (err) {
++ rxe_dbg_cq(cq, "create cq failed, err = %d", err);
++ goto err_cleanup;
++ }
+
+- rxe_cleanup(cq);
+ return 0;
++
++err_cleanup:
++ cleanup_err = rxe_cleanup(cq);
++ if (cleanup_err)
++ rxe_err_cq(cq, "cleanup failed, err = %d", cleanup_err);
++err_out:
++ rxe_err_dev(rxe, "returned err = %d", err);
++ return err;
+ }
+
+ static int rxe_resize_cq(struct ib_cq *ibcq, int cqe, struct ib_udata *udata)
+ {
+- int err;
+ struct rxe_cq *cq = to_rcq(ibcq);
+ struct rxe_dev *rxe = to_rdev(ibcq->device);
+ struct rxe_resize_cq_resp __user *uresp = NULL;
++ int err;
+
+ if (udata) {
+- if (udata->outlen < sizeof(*uresp))
+- return -EINVAL;
++ if (udata->outlen < sizeof(*uresp)) {
++ err = -EINVAL;
++ rxe_dbg_cq(cq, "malformed udata");
++ goto err_out;
++ }
+ uresp = udata->outbuf;
+ }
+
+ err = rxe_cq_chk_attr(rxe, cq, cqe, 0);
+- if (err)
+- return err;
++ if (err) {
++ rxe_dbg_cq(cq, "bad attr, err = %d", err);
++ goto err_out;
++ }
+
+- return rxe_cq_resize_queue(cq, cqe, uresp, udata);
++ err = rxe_cq_resize_queue(cq, cqe, uresp, udata);
++ if (err) {
++ rxe_dbg_cq(cq, "resize cq failed, err = %d", err);
++ goto err_out;
++ }
++
++ return 0;
++
++err_out:
++ rxe_err_cq(cq, "returned err = %d", err);
++ return err;
+ }
+
+ static int rxe_poll_cq(struct ib_cq *ibcq, int num_entries, struct ib_wc *wc)
+@@ -823,7 +1123,7 @@ static int rxe_poll_cq(struct ib_cq *ibcq, int num_entries, struct ib_wc *wc)
+ for (i = 0; i < num_entries; i++) {
+ cqe = queue_head(cq->queue, QUEUE_TYPE_TO_ULP);
+ if (!cqe)
+- break;
++ break; /* queue empty */
+
+ memcpy(wc++, &cqe->ibwc, sizeof(*wc));
+ queue_advance_consumer(cq->queue, QUEUE_TYPE_TO_ULP);
+@@ -864,6 +1164,34 @@ static int rxe_req_notify_cq(struct ib_cq *ibcq, enum ib_cq_notify_flags flags)
+ return ret;
+ }
+
++static int rxe_destroy_cq(struct ib_cq *ibcq, struct ib_udata *udata)
++{
++ struct rxe_cq *cq = to_rcq(ibcq);
++ int err;
++
++ /* See IBA C11-17: The CI shall return an error if this Verb is
++ * invoked while a Work Queue is still associated with the CQ.
++ */
++ if (atomic_read(&cq->num_wq)) {
++ err = -EINVAL;
++ rxe_dbg_cq(cq, "still in use");
++ goto err_out;
++ }
++
++ rxe_cq_disable(cq);
++
++ err = rxe_cleanup(cq);
++ if (err)
++ rxe_err_cq(cq, "cleanup failed, err = %d", err);
++
++ return 0;
++
++err_out:
++ rxe_err_cq(cq, "returned err = %d", err);
++ return err;
++}
++
++/* mr */
+ static struct ib_mr *rxe_get_dma_mr(struct ib_pd *ibpd, int access)
+ {
+ struct rxe_dev *rxe = to_rdev(ibpd->device);
+@@ -874,12 +1202,15 @@ static struct ib_mr *rxe_get_dma_mr(struct ib_pd *ibpd, int access)
+ mr = kzalloc(sizeof(*mr), GFP_KERNEL);
+ if (!mr) {
+ err = -ENOMEM;
++ rxe_dbg_dev(rxe, "no memory for mr");
+ goto err_out;
+ }
+
+ err = rxe_add_to_pool(&rxe->mr_pool, mr);
+- if (err)
++ if (err) {
++ rxe_dbg_dev(rxe, "unable to create mr");
+ goto err_free;
++ }
+
+ rxe_get(pd);
+ mr->ibmr.pd = ibpd;
+@@ -892,46 +1223,53 @@ static struct ib_mr *rxe_get_dma_mr(struct ib_pd *ibpd, int access)
+ err_free:
+ kfree(mr);
+ err_out:
++ rxe_err_pd(pd, "returned err = %d", err);
+ return ERR_PTR(err);
+ }
+
+-static struct ib_mr *rxe_reg_user_mr(struct ib_pd *ibpd,
+- u64 start,
+- u64 length,
+- u64 iova,
+- int access, struct ib_udata *udata)
++static struct ib_mr *rxe_reg_user_mr(struct ib_pd *ibpd, u64 start,
++ u64 length, u64 iova, int access,
++ struct ib_udata *udata)
+ {
+- int err;
+ struct rxe_dev *rxe = to_rdev(ibpd->device);
+ struct rxe_pd *pd = to_rpd(ibpd);
+ struct rxe_mr *mr;
++ int err, cleanup_err;
+
+ mr = kzalloc(sizeof(*mr), GFP_KERNEL);
+ if (!mr) {
+ err = -ENOMEM;
++ rxe_dbg_pd(pd, "no memory for mr");
+ goto err_out;
+ }
+
+ err = rxe_add_to_pool(&rxe->mr_pool, mr);
+- if (err)
++ if (err) {
++ rxe_dbg_pd(pd, "unable to create mr");
+ goto err_free;
++ }
+
+ rxe_get(pd);
+ mr->ibmr.pd = ibpd;
+ mr->ibmr.device = ibpd->device;
+
+ err = rxe_mr_init_user(rxe, start, length, iova, access, mr);
+- if (err)
++ if (err) {
++ rxe_dbg_mr(mr, "reg_user_mr failed, err = %d", err);
+ goto err_cleanup;
++ }
+
+ rxe_finalize(mr);
+ return &mr->ibmr;
+
+ err_cleanup:
+- rxe_cleanup(mr);
++ cleanup_err = rxe_cleanup(mr);
++ if (cleanup_err)
++ rxe_err_mr(mr, "cleanup failed, err = %d", cleanup_err);
+ err_free:
+ kfree(mr);
+ err_out:
++ rxe_err_pd(pd, "returned err = %d", err);
+ return ERR_PTR(err);
+ }
+
+@@ -941,40 +1279,76 @@ static struct ib_mr *rxe_alloc_mr(struct ib_pd *ibpd, enum ib_mr_type mr_type,
+ struct rxe_dev *rxe = to_rdev(ibpd->device);
+ struct rxe_pd *pd = to_rpd(ibpd);
+ struct rxe_mr *mr;
+- int err;
++ int err, cleanup_err;
+
+- if (mr_type != IB_MR_TYPE_MEM_REG)
+- return ERR_PTR(-EINVAL);
++ if (mr_type != IB_MR_TYPE_MEM_REG) {
++ err = -EINVAL;
++ rxe_dbg_pd(pd, "mr type %d not supported, err = %d",
++ mr_type, err);
++ goto err_out;
++ }
+
+ mr = kzalloc(sizeof(*mr), GFP_KERNEL);
+ if (!mr) {
+ err = -ENOMEM;
++ rxe_dbg_mr(mr, "no memory for mr");
+ goto err_out;
+ }
+
+ err = rxe_add_to_pool(&rxe->mr_pool, mr);
+- if (err)
++ if (err) {
++ rxe_dbg_mr(mr, "unable to create mr, err = %d", err);
+ goto err_free;
++ }
+
+ rxe_get(pd);
+ mr->ibmr.pd = ibpd;
+ mr->ibmr.device = ibpd->device;
+
+ err = rxe_mr_init_fast(max_num_sg, mr);
+- if (err)
++ if (err) {
++ rxe_dbg_mr(mr, "alloc_mr failed, err = %d", err);
+ goto err_cleanup;
++ }
+
+ rxe_finalize(mr);
+ return &mr->ibmr;
+
+ err_cleanup:
+- rxe_cleanup(mr);
++ cleanup_err = rxe_cleanup(mr);
++ if (cleanup_err)
++ rxe_err_mr(mr, "cleanup failed, err = %d", err);
+ err_free:
+ kfree(mr);
+ err_out:
++ rxe_err_pd(pd, "returned err = %d", err);
+ return ERR_PTR(err);
+ }
+
++static int rxe_dereg_mr(struct ib_mr *ibmr, struct ib_udata *udata)
++{
++ struct rxe_mr *mr = to_rmr(ibmr);
++ int err, cleanup_err;
++
++ /* See IBA 10.6.7.2.6 */
++ if (atomic_read(&mr->num_mw) > 0) {
++ err = -EINVAL;
++ rxe_dbg_mr(mr, "mr has mw's bound");
++ goto err_out;
++ }
++
++ cleanup_err = rxe_cleanup(mr);
++ if (cleanup_err)
++ rxe_err_mr(mr, "cleanup failed, err = %d", cleanup_err);
++
++ kfree_rcu(mr);
++ return 0;
++
++err_out:
++ rxe_err_mr(mr, "returned err = %d", err);
++ return err;
++}
++
+ static ssize_t parent_show(struct device *device,
+ struct device_attribute *attr, char *buf)
+ {
+--
+2.39.2
+
--- /dev/null
+From c476b6405d404bebae518870115d3e422712b8ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Mar 2023 16:16:22 -0600
+Subject: RDMA/rxe: Change rxe_dbg to rxe_dbg_dev
+
+From: Bob Pearson <rpearsonhpe@gmail.com>
+
+[ Upstream commit a9fb3287211e64b94ceb2b6b4791cc2b829d0d56 ]
+
+Replace the name rxe_dbg with rxe_dbg_dev which better matches
+the remaining rxe_dbg_xxx macros for debug messages with a
+rxe device parameter. Reuse the name rxe_dbg for debug messages
+which do not have a rxe device parameter.
+
+Link: https://lore.kernel.org/r/20230303221623.8053-3-rpearsonhpe@gmail.com
+Signed-off-by: Bob Pearson <rpearsonhpe@gmail.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Stable-dep-of: 78b26a335310 ("RDMA/rxe: Remove tasklet call from rxe_cq.c")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe.c | 2 +-
+ drivers/infiniband/sw/rxe/rxe.h | 3 ++-
+ drivers/infiniband/sw/rxe/rxe_cq.c | 6 +++---
+ drivers/infiniband/sw/rxe/rxe_icrc.c | 4 ++--
+ drivers/infiniband/sw/rxe/rxe_mmap.c | 6 +++---
+ drivers/infiniband/sw/rxe/rxe_net.c | 4 ++--
+ drivers/infiniband/sw/rxe/rxe_qp.c | 16 ++++++++--------
+ drivers/infiniband/sw/rxe/rxe_srq.c | 6 +++---
+ drivers/infiniband/sw/rxe/rxe_verbs.c | 2 +-
+ 9 files changed, 25 insertions(+), 24 deletions(-)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe.c b/drivers/infiniband/sw/rxe/rxe.c
+index a3f05fdd9fac2..d57ba7a5964b9 100644
+--- a/drivers/infiniband/sw/rxe/rxe.c
++++ b/drivers/infiniband/sw/rxe/rxe.c
+@@ -187,7 +187,7 @@ static int rxe_newlink(const char *ibdev_name, struct net_device *ndev)
+ rxe = rxe_get_dev_from_net(ndev);
+ if (rxe) {
+ ib_device_put(&rxe->ib_dev);
+- rxe_dbg(rxe, "already configured on %s\n", ndev->name);
++ rxe_dbg_dev(rxe, "already configured on %s\n", ndev->name);
+ err = -EEXIST;
+ goto err;
+ }
+diff --git a/drivers/infiniband/sw/rxe/rxe.h b/drivers/infiniband/sw/rxe/rxe.h
+index 2415f3704f576..0757acc381038 100644
+--- a/drivers/infiniband/sw/rxe/rxe.h
++++ b/drivers/infiniband/sw/rxe/rxe.h
+@@ -38,7 +38,8 @@
+
+ #define RXE_ROCE_V2_SPORT (0xc000)
+
+-#define rxe_dbg(rxe, fmt, ...) ibdev_dbg(&(rxe)->ib_dev, \
++#define rxe_dbg(fmt, ...) pr_debug("%s: " fmt "\n", __func__, ##__VA_ARGS__)
++#define rxe_dbg_dev(rxe, fmt, ...) ibdev_dbg(&(rxe)->ib_dev, \
+ "%s: " fmt, __func__, ##__VA_ARGS__)
+ #define rxe_dbg_uc(uc, fmt, ...) ibdev_dbg((uc)->ibuc.device, \
+ "uc#%d %s: " fmt, (uc)->elem.index, __func__, ##__VA_ARGS__)
+diff --git a/drivers/infiniband/sw/rxe/rxe_cq.c b/drivers/infiniband/sw/rxe/rxe_cq.c
+index 1df186534639a..22fbc198e5d17 100644
+--- a/drivers/infiniband/sw/rxe/rxe_cq.c
++++ b/drivers/infiniband/sw/rxe/rxe_cq.c
+@@ -14,12 +14,12 @@ int rxe_cq_chk_attr(struct rxe_dev *rxe, struct rxe_cq *cq,
+ int count;
+
+ if (cqe <= 0) {
+- rxe_dbg(rxe, "cqe(%d) <= 0\n", cqe);
++ rxe_dbg_dev(rxe, "cqe(%d) <= 0\n", cqe);
+ goto err1;
+ }
+
+ if (cqe > rxe->attr.max_cqe) {
+- rxe_dbg(rxe, "cqe(%d) > max_cqe(%d)\n",
++ rxe_dbg_dev(rxe, "cqe(%d) > max_cqe(%d)\n",
+ cqe, rxe->attr.max_cqe);
+ goto err1;
+ }
+@@ -65,7 +65,7 @@ int rxe_cq_from_init(struct rxe_dev *rxe, struct rxe_cq *cq, int cqe,
+ cq->queue = rxe_queue_init(rxe, &cqe,
+ sizeof(struct rxe_cqe), type);
+ if (!cq->queue) {
+- rxe_dbg(rxe, "unable to create cq\n");
++ rxe_dbg_dev(rxe, "unable to create cq\n");
+ return -ENOMEM;
+ }
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_icrc.c b/drivers/infiniband/sw/rxe/rxe_icrc.c
+index 71bc2c1895888..fdf5f08cd8f17 100644
+--- a/drivers/infiniband/sw/rxe/rxe_icrc.c
++++ b/drivers/infiniband/sw/rxe/rxe_icrc.c
+@@ -21,7 +21,7 @@ int rxe_icrc_init(struct rxe_dev *rxe)
+
+ tfm = crypto_alloc_shash("crc32", 0, 0);
+ if (IS_ERR(tfm)) {
+- rxe_dbg(rxe, "failed to init crc32 algorithm err: %ld\n",
++ rxe_dbg_dev(rxe, "failed to init crc32 algorithm err: %ld\n",
+ PTR_ERR(tfm));
+ return PTR_ERR(tfm);
+ }
+@@ -51,7 +51,7 @@ static __be32 rxe_crc32(struct rxe_dev *rxe, __be32 crc, void *next, size_t len)
+ *(__be32 *)shash_desc_ctx(shash) = crc;
+ err = crypto_shash_update(shash, next, len);
+ if (unlikely(err)) {
+- rxe_dbg(rxe, "failed crc calculation, err: %d\n", err);
++ rxe_dbg_dev(rxe, "failed crc calculation, err: %d\n", err);
+ return (__force __be32)crc32_le((__force u32)crc, next, len);
+ }
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_mmap.c b/drivers/infiniband/sw/rxe/rxe_mmap.c
+index a47d72dbc5376..6b7f2bd698799 100644
+--- a/drivers/infiniband/sw/rxe/rxe_mmap.c
++++ b/drivers/infiniband/sw/rxe/rxe_mmap.c
+@@ -79,7 +79,7 @@ int rxe_mmap(struct ib_ucontext *context, struct vm_area_struct *vma)
+
+ /* Don't allow a mmap larger than the object. */
+ if (size > ip->info.size) {
+- rxe_dbg(rxe, "mmap region is larger than the object!\n");
++ rxe_dbg_dev(rxe, "mmap region is larger than the object!\n");
+ spin_unlock_bh(&rxe->pending_lock);
+ ret = -EINVAL;
+ goto done;
+@@ -87,7 +87,7 @@ int rxe_mmap(struct ib_ucontext *context, struct vm_area_struct *vma)
+
+ goto found_it;
+ }
+- rxe_dbg(rxe, "unable to find pending mmap info\n");
++ rxe_dbg_dev(rxe, "unable to find pending mmap info\n");
+ spin_unlock_bh(&rxe->pending_lock);
+ ret = -EINVAL;
+ goto done;
+@@ -98,7 +98,7 @@ int rxe_mmap(struct ib_ucontext *context, struct vm_area_struct *vma)
+
+ ret = remap_vmalloc_range(vma, ip->obj, 0);
+ if (ret) {
+- rxe_dbg(rxe, "err %d from remap_vmalloc_range\n", ret);
++ rxe_dbg_dev(rxe, "err %d from remap_vmalloc_range\n", ret);
+ goto done;
+ }
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_net.c b/drivers/infiniband/sw/rxe/rxe_net.c
+index e02e1624bcf4d..a2ace42e95366 100644
+--- a/drivers/infiniband/sw/rxe/rxe_net.c
++++ b/drivers/infiniband/sw/rxe/rxe_net.c
+@@ -596,7 +596,7 @@ static int rxe_notify(struct notifier_block *not_blk,
+ rxe_port_down(rxe);
+ break;
+ case NETDEV_CHANGEMTU:
+- rxe_dbg(rxe, "%s changed mtu to %d\n", ndev->name, ndev->mtu);
++ rxe_dbg_dev(rxe, "%s changed mtu to %d\n", ndev->name, ndev->mtu);
+ rxe_set_mtu(rxe, ndev->mtu);
+ break;
+ case NETDEV_CHANGE:
+@@ -608,7 +608,7 @@ static int rxe_notify(struct notifier_block *not_blk,
+ case NETDEV_CHANGENAME:
+ case NETDEV_FEAT_CHANGE:
+ default:
+- rxe_dbg(rxe, "ignoring netdev event = %ld for %s\n",
++ rxe_dbg_dev(rxe, "ignoring netdev event = %ld for %s\n",
+ event, ndev->name);
+ break;
+ }
+diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c b/drivers/infiniband/sw/rxe/rxe_qp.c
+index ab72db68b58f6..c954dd9394baf 100644
+--- a/drivers/infiniband/sw/rxe/rxe_qp.c
++++ b/drivers/infiniband/sw/rxe/rxe_qp.c
+@@ -19,33 +19,33 @@ static int rxe_qp_chk_cap(struct rxe_dev *rxe, struct ib_qp_cap *cap,
+ int has_srq)
+ {
+ if (cap->max_send_wr > rxe->attr.max_qp_wr) {
+- rxe_dbg(rxe, "invalid send wr = %u > %d\n",
++ rxe_dbg_dev(rxe, "invalid send wr = %u > %d\n",
+ cap->max_send_wr, rxe->attr.max_qp_wr);
+ goto err1;
+ }
+
+ if (cap->max_send_sge > rxe->attr.max_send_sge) {
+- rxe_dbg(rxe, "invalid send sge = %u > %d\n",
++ rxe_dbg_dev(rxe, "invalid send sge = %u > %d\n",
+ cap->max_send_sge, rxe->attr.max_send_sge);
+ goto err1;
+ }
+
+ if (!has_srq) {
+ if (cap->max_recv_wr > rxe->attr.max_qp_wr) {
+- rxe_dbg(rxe, "invalid recv wr = %u > %d\n",
++ rxe_dbg_dev(rxe, "invalid recv wr = %u > %d\n",
+ cap->max_recv_wr, rxe->attr.max_qp_wr);
+ goto err1;
+ }
+
+ if (cap->max_recv_sge > rxe->attr.max_recv_sge) {
+- rxe_dbg(rxe, "invalid recv sge = %u > %d\n",
++ rxe_dbg_dev(rxe, "invalid recv sge = %u > %d\n",
+ cap->max_recv_sge, rxe->attr.max_recv_sge);
+ goto err1;
+ }
+ }
+
+ if (cap->max_inline_data > rxe->max_inline_data) {
+- rxe_dbg(rxe, "invalid max inline data = %u > %d\n",
++ rxe_dbg_dev(rxe, "invalid max inline data = %u > %d\n",
+ cap->max_inline_data, rxe->max_inline_data);
+ goto err1;
+ }
+@@ -73,7 +73,7 @@ int rxe_qp_chk_init(struct rxe_dev *rxe, struct ib_qp_init_attr *init)
+ }
+
+ if (!init->recv_cq || !init->send_cq) {
+- rxe_dbg(rxe, "missing cq\n");
++ rxe_dbg_dev(rxe, "missing cq\n");
+ goto err1;
+ }
+
+@@ -82,14 +82,14 @@ int rxe_qp_chk_init(struct rxe_dev *rxe, struct ib_qp_init_attr *init)
+
+ if (init->qp_type == IB_QPT_GSI) {
+ if (!rdma_is_port_valid(&rxe->ib_dev, port_num)) {
+- rxe_dbg(rxe, "invalid port = %d\n", port_num);
++ rxe_dbg_dev(rxe, "invalid port = %d\n", port_num);
+ goto err1;
+ }
+
+ port = &rxe->port;
+
+ if (init->qp_type == IB_QPT_GSI && port->qp_gsi_index) {
+- rxe_dbg(rxe, "GSI QP exists for port %d\n", port_num);
++ rxe_dbg_dev(rxe, "GSI QP exists for port %d\n", port_num);
+ goto err1;
+ }
+ }
+diff --git a/drivers/infiniband/sw/rxe/rxe_srq.c b/drivers/infiniband/sw/rxe/rxe_srq.c
+index 82e37a41ced40..27ca82ec0826b 100644
+--- a/drivers/infiniband/sw/rxe/rxe_srq.c
++++ b/drivers/infiniband/sw/rxe/rxe_srq.c
+@@ -13,13 +13,13 @@ int rxe_srq_chk_init(struct rxe_dev *rxe, struct ib_srq_init_attr *init)
+ struct ib_srq_attr *attr = &init->attr;
+
+ if (attr->max_wr > rxe->attr.max_srq_wr) {
+- rxe_dbg(rxe, "max_wr(%d) > max_srq_wr(%d)\n",
++ rxe_dbg_dev(rxe, "max_wr(%d) > max_srq_wr(%d)\n",
+ attr->max_wr, rxe->attr.max_srq_wr);
+ goto err1;
+ }
+
+ if (attr->max_wr <= 0) {
+- rxe_dbg(rxe, "max_wr(%d) <= 0\n", attr->max_wr);
++ rxe_dbg_dev(rxe, "max_wr(%d) <= 0\n", attr->max_wr);
+ goto err1;
+ }
+
+@@ -27,7 +27,7 @@ int rxe_srq_chk_init(struct rxe_dev *rxe, struct ib_srq_init_attr *init)
+ attr->max_wr = RXE_MIN_SRQ_WR;
+
+ if (attr->max_sge > rxe->attr.max_srq_sge) {
+- rxe_dbg(rxe, "max_sge(%d) > max_srq_sge(%d)\n",
++ rxe_dbg_dev(rxe, "max_sge(%d) > max_srq_sge(%d)\n",
+ attr->max_sge, rxe->attr.max_srq_sge);
+ goto err1;
+ }
+diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.c b/drivers/infiniband/sw/rxe/rxe_verbs.c
+index e14050a692766..f178d0773ff20 100644
+--- a/drivers/infiniband/sw/rxe/rxe_verbs.c
++++ b/drivers/infiniband/sw/rxe/rxe_verbs.c
+@@ -1095,7 +1095,7 @@ int rxe_register_device(struct rxe_dev *rxe, const char *ibdev_name)
+
+ err = ib_register_device(dev, ibdev_name, NULL);
+ if (err)
+- rxe_dbg(rxe, "failed with error %d\n", err);
++ rxe_dbg_dev(rxe, "failed with error %d\n", err);
+
+ /*
+ * Note that rxe may be invalid at this point if another thread
+--
+2.39.2
+
--- /dev/null
+From 003c4979d16994ce678244c27d97ac5996e3e671 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Mar 2023 21:14:01 +0300
+Subject: RDMA/rxe: Clean kzalloc failure paths
+
+From: Leon Romanovsky <leonro@nvidia.com>
+
+[ Upstream commit b6ba68555d75fd99f7daa9c5a5e476f8635cb155 ]
+
+There is no need to print any debug messages after failure to
+allocate memory, because kernel will print OOM dumps anyway.
+
+Together with removal of these messages, remove useless goto jumps.
+
+Fixes: 5bf944f24129 ("RDMA/rxe: Add error messages")
+Reported-by: Dan Carpenter <error27@gmail.com>
+Link: https://lore.kernel.org/all/ea43486f-43dd-4054-b1d5-3a0d202be621@kili.mountain
+Link: https://lore.kernel.org/r/d3cedf723b84e73e8062a67b7489d33802bafba2.1680113597.git.leon@kernel.org
+Reviewed-by: Bob Pearson <rpearsonhpe@gmail.com>
+Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe_queue.c | 5 ++---
+ drivers/infiniband/sw/rxe/rxe_verbs.c | 27 +++++++--------------------
+ 2 files changed, 9 insertions(+), 23 deletions(-)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_queue.c b/drivers/infiniband/sw/rxe/rxe_queue.c
+index d6dbf5a0058dc..9611ee191a46d 100644
+--- a/drivers/infiniband/sw/rxe/rxe_queue.c
++++ b/drivers/infiniband/sw/rxe/rxe_queue.c
+@@ -61,11 +61,11 @@ struct rxe_queue *rxe_queue_init(struct rxe_dev *rxe, int *num_elem,
+
+ /* num_elem == 0 is allowed, but uninteresting */
+ if (*num_elem < 0)
+- goto err1;
++ return NULL;
+
+ q = kzalloc(sizeof(*q), GFP_KERNEL);
+ if (!q)
+- goto err1;
++ return NULL;
+
+ q->rxe = rxe;
+ q->type = type;
+@@ -100,7 +100,6 @@ struct rxe_queue *rxe_queue_init(struct rxe_dev *rxe, int *num_elem,
+
+ err2:
+ kfree(q);
+-err1:
+ return NULL;
+ }
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.c b/drivers/infiniband/sw/rxe/rxe_verbs.c
+index 090d5bfb1e18d..4e2db7c2e4ed7 100644
+--- a/drivers/infiniband/sw/rxe/rxe_verbs.c
++++ b/drivers/infiniband/sw/rxe/rxe_verbs.c
+@@ -1198,11 +1198,8 @@ static struct ib_mr *rxe_get_dma_mr(struct ib_pd *ibpd, int access)
+ int err;
+
+ mr = kzalloc(sizeof(*mr), GFP_KERNEL);
+- if (!mr) {
+- err = -ENOMEM;
+- rxe_dbg_dev(rxe, "no memory for mr");
+- goto err_out;
+- }
++ if (!mr)
++ return ERR_PTR(-ENOMEM);
+
+ err = rxe_add_to_pool(&rxe->mr_pool, mr);
+ if (err) {
+@@ -1220,7 +1217,6 @@ static struct ib_mr *rxe_get_dma_mr(struct ib_pd *ibpd, int access)
+
+ err_free:
+ kfree(mr);
+-err_out:
+ rxe_err_pd(pd, "returned err = %d", err);
+ return ERR_PTR(err);
+ }
+@@ -1235,11 +1231,8 @@ static struct ib_mr *rxe_reg_user_mr(struct ib_pd *ibpd, u64 start,
+ int err, cleanup_err;
+
+ mr = kzalloc(sizeof(*mr), GFP_KERNEL);
+- if (!mr) {
+- err = -ENOMEM;
+- rxe_dbg_pd(pd, "no memory for mr");
+- goto err_out;
+- }
++ if (!mr)
++ return ERR_PTR(-ENOMEM);
+
+ err = rxe_add_to_pool(&rxe->mr_pool, mr);
+ if (err) {
+@@ -1266,7 +1259,6 @@ static struct ib_mr *rxe_reg_user_mr(struct ib_pd *ibpd, u64 start,
+ rxe_err_mr(mr, "cleanup failed, err = %d", cleanup_err);
+ err_free:
+ kfree(mr);
+-err_out:
+ rxe_err_pd(pd, "returned err = %d", err);
+ return ERR_PTR(err);
+ }
+@@ -1287,17 +1279,12 @@ static struct ib_mr *rxe_alloc_mr(struct ib_pd *ibpd, enum ib_mr_type mr_type,
+ }
+
+ mr = kzalloc(sizeof(*mr), GFP_KERNEL);
+- if (!mr) {
+- err = -ENOMEM;
+- rxe_dbg_mr(mr, "no memory for mr");
+- goto err_out;
+- }
++ if (!mr)
++ return ERR_PTR(-ENOMEM);
+
+ err = rxe_add_to_pool(&rxe->mr_pool, mr);
+- if (err) {
+- rxe_dbg_mr(mr, "unable to create mr, err = %d", err);
++ if (err)
+ goto err_free;
+- }
+
+ rxe_get(pd);
+ mr->ibmr.pd = ibpd;
+--
+2.39.2
+
--- /dev/null
+From ef14cde00ff2752aedc18e9144f9e8b56a0ab29c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 4 Mar 2023 11:45:27 -0600
+Subject: RDMA/rxe: Convert tasklet args to queue pairs
+
+From: Bob Pearson <rpearsonhpe@gmail.com>
+
+[ Upstream commit 3946fc2a42b18cf0b675121158a2625825ce27b5 ]
+
+Originally is was thought that the tasklet machinery in rxe_task.c would
+be used in other applications but that has not happened for years. This
+patch replaces the 'void *arg' by struct 'rxe_qp *qp' in the parameters to
+the tasklet calls. This change will have no affect on performance but may
+make the code a little clearer.
+
+Link: https://lore.kernel.org/r/20230304174533.11296-2-rpearsonhpe@gmail.com
+Signed-off-by: Bob Pearson <rpearsonhpe@gmail.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Stable-dep-of: b2b1ddc45745 ("RDMA/rxe: Fix the error "trying to register non-static key in rxe_cleanup_task"")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe_comp.c | 3 +--
+ drivers/infiniband/sw/rxe/rxe_loc.h | 6 +++---
+ drivers/infiniband/sw/rxe/rxe_req.c | 3 +--
+ drivers/infiniband/sw/rxe/rxe_resp.c | 3 +--
+ drivers/infiniband/sw/rxe/rxe_task.c | 11 ++++++-----
+ drivers/infiniband/sw/rxe/rxe_task.h | 9 +++++----
+ 6 files changed, 17 insertions(+), 18 deletions(-)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_comp.c b/drivers/infiniband/sw/rxe/rxe_comp.c
+index 876057e3ee3c1..cbfa16b3a4902 100644
+--- a/drivers/infiniband/sw/rxe/rxe_comp.c
++++ b/drivers/infiniband/sw/rxe/rxe_comp.c
+@@ -575,9 +575,8 @@ static void free_pkt(struct rxe_pkt_info *pkt)
+ ib_device_put(dev);
+ }
+
+-int rxe_completer(void *arg)
++int rxe_completer(struct rxe_qp *qp)
+ {
+- struct rxe_qp *qp = (struct rxe_qp *)arg;
+ struct rxe_dev *rxe = to_rdev(qp->ibqp.device);
+ struct rxe_send_wqe *wqe = NULL;
+ struct sk_buff *skb = NULL;
+diff --git a/drivers/infiniband/sw/rxe/rxe_loc.h b/drivers/infiniband/sw/rxe/rxe_loc.h
+index 839de34cf4c94..804b15e929dd9 100644
+--- a/drivers/infiniband/sw/rxe/rxe_loc.h
++++ b/drivers/infiniband/sw/rxe/rxe_loc.h
+@@ -170,9 +170,9 @@ void rxe_srq_cleanup(struct rxe_pool_elem *elem);
+
+ void rxe_dealloc(struct ib_device *ib_dev);
+
+-int rxe_completer(void *arg);
+-int rxe_requester(void *arg);
+-int rxe_responder(void *arg);
++int rxe_completer(struct rxe_qp *qp);
++int rxe_requester(struct rxe_qp *qp);
++int rxe_responder(struct rxe_qp *qp);
+
+ /* rxe_icrc.c */
+ int rxe_icrc_init(struct rxe_dev *rxe);
+diff --git a/drivers/infiniband/sw/rxe/rxe_req.c b/drivers/infiniband/sw/rxe/rxe_req.c
+index 899c8779f8001..f2dc2d191e16f 100644
+--- a/drivers/infiniband/sw/rxe/rxe_req.c
++++ b/drivers/infiniband/sw/rxe/rxe_req.c
+@@ -635,9 +635,8 @@ static int rxe_do_local_ops(struct rxe_qp *qp, struct rxe_send_wqe *wqe)
+ return 0;
+ }
+
+-int rxe_requester(void *arg)
++int rxe_requester(struct rxe_qp *qp)
+ {
+- struct rxe_qp *qp = (struct rxe_qp *)arg;
+ struct rxe_dev *rxe = to_rdev(qp->ibqp.device);
+ struct rxe_pkt_info pkt;
+ struct sk_buff *skb;
+diff --git a/drivers/infiniband/sw/rxe/rxe_resp.c b/drivers/infiniband/sw/rxe/rxe_resp.c
+index 4217eec03a943..7cb1b962d6652 100644
+--- a/drivers/infiniband/sw/rxe/rxe_resp.c
++++ b/drivers/infiniband/sw/rxe/rxe_resp.c
+@@ -1443,9 +1443,8 @@ static void rxe_drain_req_pkts(struct rxe_qp *qp, bool notify)
+ queue_advance_consumer(q, q->type);
+ }
+
+-int rxe_responder(void *arg)
++int rxe_responder(struct rxe_qp *qp)
+ {
+- struct rxe_qp *qp = (struct rxe_qp *)arg;
+ struct rxe_dev *rxe = to_rdev(qp->ibqp.device);
+ enum resp_states state;
+ struct rxe_pkt_info *pkt = NULL;
+diff --git a/drivers/infiniband/sw/rxe/rxe_task.c b/drivers/infiniband/sw/rxe/rxe_task.c
+index 60b90e33a8849..959cc6229a34e 100644
+--- a/drivers/infiniband/sw/rxe/rxe_task.c
++++ b/drivers/infiniband/sw/rxe/rxe_task.c
+@@ -11,7 +11,7 @@ int __rxe_do_task(struct rxe_task *task)
+ {
+ int ret;
+
+- while ((ret = task->func(task->arg)) == 0)
++ while ((ret = task->func(task->qp)) == 0)
+ ;
+
+ task->ret = ret;
+@@ -29,7 +29,7 @@ static void do_task(struct tasklet_struct *t)
+ int cont;
+ int ret;
+ struct rxe_task *task = from_tasklet(task, t, tasklet);
+- struct rxe_qp *qp = (struct rxe_qp *)task->arg;
++ struct rxe_qp *qp = (struct rxe_qp *)task->qp;
+ unsigned int iterations = RXE_MAX_ITERATIONS;
+
+ spin_lock_bh(&task->lock);
+@@ -54,7 +54,7 @@ static void do_task(struct tasklet_struct *t)
+
+ do {
+ cont = 0;
+- ret = task->func(task->arg);
++ ret = task->func(task->qp);
+
+ spin_lock_bh(&task->lock);
+ switch (task->state) {
+@@ -91,9 +91,10 @@ static void do_task(struct tasklet_struct *t)
+ task->ret = ret;
+ }
+
+-int rxe_init_task(struct rxe_task *task, void *arg, int (*func)(void *))
++int rxe_init_task(struct rxe_task *task, struct rxe_qp *qp,
++ int (*func)(struct rxe_qp *))
+ {
+- task->arg = arg;
++ task->qp = qp;
+ task->func = func;
+ task->destroyed = false;
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_task.h b/drivers/infiniband/sw/rxe/rxe_task.h
+index 7b88129702ac6..41efd5fd49b03 100644
+--- a/drivers/infiniband/sw/rxe/rxe_task.h
++++ b/drivers/infiniband/sw/rxe/rxe_task.h
+@@ -22,18 +22,19 @@ struct rxe_task {
+ struct tasklet_struct tasklet;
+ int state;
+ spinlock_t lock;
+- void *arg;
+- int (*func)(void *arg);
++ struct rxe_qp *qp;
++ int (*func)(struct rxe_qp *qp);
+ int ret;
+ bool destroyed;
+ };
+
+ /*
+ * init rxe_task structure
+- * arg => parameter to pass to fcn
++ * qp => parameter to pass to func
+ * func => function to call until it returns != 0
+ */
+-int rxe_init_task(struct rxe_task *task, void *arg, int (*func)(void *));
++int rxe_init_task(struct rxe_task *task, struct rxe_qp *qp,
++ int (*func)(struct rxe_qp *));
+
+ /* cleanup task */
+ void rxe_cleanup_task(struct rxe_task *task);
+--
+2.39.2
+
--- /dev/null
+From 70ece68f6a3aa7cc1608da69e564c7d2dd11b30a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Mar 2023 16:16:23 -0600
+Subject: RDMA/rxe: Extend dbg log messages to err and info
+
+From: Bob Pearson <rpearsonhpe@gmail.com>
+
+[ Upstream commit 9ac01f434a1eb56ea94611bd75cf62fa276b41f4 ]
+
+Extend the dbg log messages (e.g. rxe_dbg_xxx) to include
+err and info types. rxe.c is modified to use these new log
+messages as examples.
+
+Link: https://lore.kernel.org/r/20230303221623.8053-4-rpearsonhpe@gmail.com
+Signed-off-by: Bob Pearson <rpearsonhpe@gmail.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Stable-dep-of: 78b26a335310 ("RDMA/rxe: Remove tasklet call from rxe_cq.c")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe.c | 8 ++++---
+ drivers/infiniband/sw/rxe/rxe.h | 42 +++++++++++++++++++++++++++++++++
+ 2 files changed, 47 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe.c b/drivers/infiniband/sw/rxe/rxe.c
+index d57ba7a5964b9..7a7e713de52db 100644
+--- a/drivers/infiniband/sw/rxe/rxe.c
++++ b/drivers/infiniband/sw/rxe/rxe.c
+@@ -160,6 +160,8 @@ void rxe_set_mtu(struct rxe_dev *rxe, unsigned int ndev_mtu)
+
+ port->attr.active_mtu = mtu;
+ port->mtu_cap = ib_mtu_enum_to_int(mtu);
++
++ rxe_info_dev(rxe, "Set mtu to %d", port->mtu_cap);
+ }
+
+ /* called by ifc layer to create new rxe device.
+@@ -179,7 +181,7 @@ static int rxe_newlink(const char *ibdev_name, struct net_device *ndev)
+ int err = 0;
+
+ if (is_vlan_dev(ndev)) {
+- pr_err("rxe creation allowed on top of a real device only\n");
++ rxe_err("rxe creation allowed on top of a real device only");
+ err = -EPERM;
+ goto err;
+ }
+@@ -187,14 +189,14 @@ static int rxe_newlink(const char *ibdev_name, struct net_device *ndev)
+ rxe = rxe_get_dev_from_net(ndev);
+ if (rxe) {
+ ib_device_put(&rxe->ib_dev);
+- rxe_dbg_dev(rxe, "already configured on %s\n", ndev->name);
++ rxe_err_dev(rxe, "already configured on %s", ndev->name);
+ err = -EEXIST;
+ goto err;
+ }
+
+ err = rxe_net_add(ibdev_name, ndev);
+ if (err) {
+- pr_debug("failed to add %s\n", ndev->name);
++ rxe_err("failed to add %s\n", ndev->name);
+ goto err;
+ }
+ err:
+diff --git a/drivers/infiniband/sw/rxe/rxe.h b/drivers/infiniband/sw/rxe/rxe.h
+index 0757acc381038..bd8a8ea4ea8fd 100644
+--- a/drivers/infiniband/sw/rxe/rxe.h
++++ b/drivers/infiniband/sw/rxe/rxe.h
+@@ -58,6 +58,48 @@
+ #define rxe_dbg_mw(mw, fmt, ...) ibdev_dbg((mw)->ibmw.device, \
+ "mw#%d %s: " fmt, (mw)->elem.index, __func__, ##__VA_ARGS__)
+
++#define rxe_err(fmt, ...) pr_err_ratelimited("%s: " fmt "\n", __func__, \
++ ##__VA_ARGS__)
++#define rxe_err_dev(rxe, fmt, ...) ibdev_err_ratelimited(&(rxe)->ib_dev, \
++ "%s: " fmt, __func__, ##__VA_ARGS__)
++#define rxe_err_uc(uc, fmt, ...) ibdev_err_ratelimited((uc)->ibuc.device, \
++ "uc#%d %s: " fmt, (uc)->elem.index, __func__, ##__VA_ARGS__)
++#define rxe_err_pd(pd, fmt, ...) ibdev_err_ratelimited((pd)->ibpd.device, \
++ "pd#%d %s: " fmt, (pd)->elem.index, __func__, ##__VA_ARGS__)
++#define rxe_err_ah(ah, fmt, ...) ibdev_err_ratelimited((ah)->ibah.device, \
++ "ah#%d %s: " fmt, (ah)->elem.index, __func__, ##__VA_ARGS__)
++#define rxe_err_srq(srq, fmt, ...) ibdev_err_ratelimited((srq)->ibsrq.device, \
++ "srq#%d %s: " fmt, (srq)->elem.index, __func__, ##__VA_ARGS__)
++#define rxe_err_qp(qp, fmt, ...) ibdev_err_ratelimited((qp)->ibqp.device, \
++ "qp#%d %s: " fmt, (qp)->elem.index, __func__, ##__VA_ARGS__)
++#define rxe_err_cq(cq, fmt, ...) ibdev_err_ratelimited((cq)->ibcq.device, \
++ "cq#%d %s: " fmt, (cq)->elem.index, __func__, ##__VA_ARGS__)
++#define rxe_err_mr(mr, fmt, ...) ibdev_err_ratelimited((mr)->ibmr.device, \
++ "mr#%d %s: " fmt, (mr)->elem.index, __func__, ##__VA_ARGS__)
++#define rxe_err_mw(mw, fmt, ...) ibdev_err_ratelimited((mw)->ibmw.device, \
++ "mw#%d %s: " fmt, (mw)->elem.index, __func__, ##__VA_ARGS__)
++
++#define rxe_info(fmt, ...) pr_info_ratelimited("%s: " fmt "\n", __func__, \
++ ##__VA_ARGS__)
++#define rxe_info_dev(rxe, fmt, ...) ibdev_info_ratelimited(&(rxe)->ib_dev, \
++ "%s: " fmt, __func__, ##__VA_ARGS__)
++#define rxe_info_uc(uc, fmt, ...) ibdev_info_ratelimited((uc)->ibuc.device, \
++ "uc#%d %s: " fmt, (uc)->elem.index, __func__, ##__VA_ARGS__)
++#define rxe_info_pd(pd, fmt, ...) ibdev_info_ratelimited((pd)->ibpd.device, \
++ "pd#%d %s: " fmt, (pd)->elem.index, __func__, ##__VA_ARGS__)
++#define rxe_info_ah(ah, fmt, ...) ibdev_info_ratelimited((ah)->ibah.device, \
++ "ah#%d %s: " fmt, (ah)->elem.index, __func__, ##__VA_ARGS__)
++#define rxe_info_srq(srq, fmt, ...) ibdev_info_ratelimited((srq)->ibsrq.device, \
++ "srq#%d %s: " fmt, (srq)->elem.index, __func__, ##__VA_ARGS__)
++#define rxe_info_qp(qp, fmt, ...) ibdev_info_ratelimited((qp)->ibqp.device, \
++ "qp#%d %s: " fmt, (qp)->elem.index, __func__, ##__VA_ARGS__)
++#define rxe_info_cq(cq, fmt, ...) ibdev_info_ratelimited((cq)->ibcq.device, \
++ "cq#%d %s: " fmt, (cq)->elem.index, __func__, ##__VA_ARGS__)
++#define rxe_info_mr(mr, fmt, ...) ibdev_info_ratelimited((mr)->ibmr.device, \
++ "mr#%d %s: " fmt, (mr)->elem.index, __func__, ##__VA_ARGS__)
++#define rxe_info_mw(mw, fmt, ...) ibdev_info_ratelimited((mw)->ibmw.device, \
++ "mw#%d %s: " fmt, (mw)->elem.index, __func__, ##__VA_ARGS__)
++
+ /* responder states */
+ enum resp_states {
+ RESPST_NONE,
+--
+2.39.2
+
--- /dev/null
+From 56524ad49d68a14b7d45212c1a203a0c7d359fe8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Apr 2023 18:11:15 +0800
+Subject: RDMA/rxe: Fix the error "trying to register non-static key in
+ rxe_cleanup_task"
+
+From: Zhu Yanjun <yanjun.zhu@linux.dev>
+
+[ Upstream commit b2b1ddc457458fecd1c6f385baa9fbda5f0c63ad ]
+
+In the function rxe_create_qp(), rxe_qp_from_init() is called to
+initialize qp, internally things like rxe_init_task are not setup until
+rxe_qp_init_req().
+
+If an error occurred before this point then the unwind will call
+rxe_cleanup() and eventually to rxe_qp_do_cleanup()/rxe_cleanup_task()
+which will oops when trying to access the uninitialized spinlock.
+
+If rxe_init_task is not executed, rxe_cleanup_task will not be called.
+
+Reported-by: syzbot+cfcc1a3c85be15a40cba@syzkaller.appspotmail.com
+Link: https://syzkaller.appspot.com/bug?id=fd85757b74b3eb59f904138486f755f71e090df8
+Fixes: 8700e3e7c485 ("Soft RoCE driver")
+Fixes: 2d4b21e0a291 ("IB/rxe: Prevent from completer to operate on non valid QP")
+Signed-off-by: Zhu Yanjun <yanjun.zhu@linux.dev>
+Link: https://lore.kernel.org/r/20230413101115.1366068-1-yanjun.zhu@intel.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe_qp.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c b/drivers/infiniband/sw/rxe/rxe_qp.c
+index 49891f8ed4e61..d5de5ba6940f1 100644
+--- a/drivers/infiniband/sw/rxe/rxe_qp.c
++++ b/drivers/infiniband/sw/rxe/rxe_qp.c
+@@ -761,9 +761,14 @@ static void rxe_qp_do_cleanup(struct work_struct *work)
+ del_timer_sync(&qp->rnr_nak_timer);
+ }
+
+- rxe_cleanup_task(&qp->resp.task);
+- rxe_cleanup_task(&qp->req.task);
+- rxe_cleanup_task(&qp->comp.task);
++ if (qp->resp.task.func)
++ rxe_cleanup_task(&qp->resp.task);
++
++ if (qp->req.task.func)
++ rxe_cleanup_task(&qp->req.task);
++
++ if (qp->comp.task.func)
++ rxe_cleanup_task(&qp->comp.task);
+
+ /* flush out any receive wr's or pending requests */
+ rxe_requester(qp);
+--
+2.39.2
+
--- /dev/null
+From c4bf42e984d23847cb4a0ee0a8c2c61fa9f58d0b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 4 Mar 2023 11:45:32 -0600
+Subject: RDMA/rxe: Remove __rxe_do_task()
+
+From: Bob Pearson <rpearsonhpe@gmail.com>
+
+[ Upstream commit 960ebe97e5238565d15063c8f4d1b2108efe2e65 ]
+
+The subroutine __rxe_do_task is not thread safe and it has no way to
+guarantee that the tasks, which are designed with the assumption that they
+are non-reentrant, are not reentered. All of its uses are non-performance
+critical.
+
+This patch replaces calls to __rxe_do_task with calls to
+rxe_sched_task. It also removes irrelevant or unneeded if tests.
+
+Instead of calling the task machinery a single call to the tasklet
+function (rxe_requester, etc.) is sufficient to draing the queues if task
+execution has been disabled or stopped.
+
+Together these changes allow the removal of __rxe_do_task.
+
+Link: https://lore.kernel.org/r/20230304174533.11296-7-rpearsonhpe@gmail.com
+Signed-off-by: Ian Ziemba <ian.ziemba@hpe.com>
+Signed-off-by: Bob Pearson <rpearsonhpe@gmail.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Stable-dep-of: b2b1ddc45745 ("RDMA/rxe: Fix the error "trying to register non-static key in rxe_cleanup_task"")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe_qp.c | 56 +++++++++-------------------
+ drivers/infiniband/sw/rxe/rxe_task.c | 13 -------
+ drivers/infiniband/sw/rxe/rxe_task.h | 6 ---
+ 3 files changed, 17 insertions(+), 58 deletions(-)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c b/drivers/infiniband/sw/rxe/rxe_qp.c
+index c954dd9394baf..49891f8ed4e61 100644
+--- a/drivers/infiniband/sw/rxe/rxe_qp.c
++++ b/drivers/infiniband/sw/rxe/rxe_qp.c
+@@ -473,29 +473,23 @@ static void rxe_qp_reset(struct rxe_qp *qp)
+ {
+ /* stop tasks from running */
+ rxe_disable_task(&qp->resp.task);
+-
+- /* stop request/comp */
+- if (qp->sq.queue) {
+- if (qp_type(qp) == IB_QPT_RC)
+- rxe_disable_task(&qp->comp.task);
+- rxe_disable_task(&qp->req.task);
+- }
++ rxe_disable_task(&qp->comp.task);
++ rxe_disable_task(&qp->req.task);
+
+ /* move qp to the reset state */
+ qp->req.state = QP_STATE_RESET;
+ qp->comp.state = QP_STATE_RESET;
+ qp->resp.state = QP_STATE_RESET;
+
+- /* let state machines reset themselves drain work and packet queues
+- * etc.
+- */
+- __rxe_do_task(&qp->resp.task);
++ /* drain work and packet queuesc */
++ rxe_requester(qp);
++ rxe_completer(qp);
++ rxe_responder(qp);
+
+- if (qp->sq.queue) {
+- __rxe_do_task(&qp->comp.task);
+- __rxe_do_task(&qp->req.task);
++ if (qp->rq.queue)
++ rxe_queue_reset(qp->rq.queue);
++ if (qp->sq.queue)
+ rxe_queue_reset(qp->sq.queue);
+- }
+
+ /* cleanup attributes */
+ atomic_set(&qp->ssn, 0);
+@@ -518,13 +512,8 @@ static void rxe_qp_reset(struct rxe_qp *qp)
+
+ /* reenable tasks */
+ rxe_enable_task(&qp->resp.task);
+-
+- if (qp->sq.queue) {
+- if (qp_type(qp) == IB_QPT_RC)
+- rxe_enable_task(&qp->comp.task);
+-
+- rxe_enable_task(&qp->req.task);
+- }
++ rxe_enable_task(&qp->comp.task);
++ rxe_enable_task(&qp->req.task);
+ }
+
+ /* drain the send queue */
+@@ -533,10 +522,7 @@ static void rxe_qp_drain(struct rxe_qp *qp)
+ if (qp->sq.queue) {
+ if (qp->req.state != QP_STATE_DRAINED) {
+ qp->req.state = QP_STATE_DRAIN;
+- if (qp_type(qp) == IB_QPT_RC)
+- rxe_sched_task(&qp->comp.task);
+- else
+- __rxe_do_task(&qp->comp.task);
++ rxe_sched_task(&qp->comp.task);
+ rxe_sched_task(&qp->req.task);
+ }
+ }
+@@ -552,11 +538,7 @@ void rxe_qp_error(struct rxe_qp *qp)
+
+ /* drain work and packet queues */
+ rxe_sched_task(&qp->resp.task);
+-
+- if (qp_type(qp) == IB_QPT_RC)
+- rxe_sched_task(&qp->comp.task);
+- else
+- __rxe_do_task(&qp->comp.task);
++ rxe_sched_task(&qp->comp.task);
+ rxe_sched_task(&qp->req.task);
+ }
+
+@@ -773,24 +755,20 @@ static void rxe_qp_do_cleanup(struct work_struct *work)
+
+ qp->valid = 0;
+ qp->qp_timeout_jiffies = 0;
+- rxe_cleanup_task(&qp->resp.task);
+
+ if (qp_type(qp) == IB_QPT_RC) {
+ del_timer_sync(&qp->retrans_timer);
+ del_timer_sync(&qp->rnr_nak_timer);
+ }
+
++ rxe_cleanup_task(&qp->resp.task);
+ rxe_cleanup_task(&qp->req.task);
+ rxe_cleanup_task(&qp->comp.task);
+
+ /* flush out any receive wr's or pending requests */
+- if (qp->req.task.func)
+- __rxe_do_task(&qp->req.task);
+-
+- if (qp->sq.queue) {
+- __rxe_do_task(&qp->comp.task);
+- __rxe_do_task(&qp->req.task);
+- }
++ rxe_requester(qp);
++ rxe_completer(qp);
++ rxe_responder(qp);
+
+ if (qp->sq.queue)
+ rxe_queue_cleanup(qp->sq.queue);
+diff --git a/drivers/infiniband/sw/rxe/rxe_task.c b/drivers/infiniband/sw/rxe/rxe_task.c
+index 959cc6229a34e..a67f485454436 100644
+--- a/drivers/infiniband/sw/rxe/rxe_task.c
++++ b/drivers/infiniband/sw/rxe/rxe_task.c
+@@ -6,19 +6,6 @@
+
+ #include "rxe.h"
+
+-int __rxe_do_task(struct rxe_task *task)
+-
+-{
+- int ret;
+-
+- while ((ret = task->func(task->qp)) == 0)
+- ;
+-
+- task->ret = ret;
+-
+- return ret;
+-}
+-
+ /*
+ * this locking is due to a potential race where
+ * a second caller finds the task already running
+diff --git a/drivers/infiniband/sw/rxe/rxe_task.h b/drivers/infiniband/sw/rxe/rxe_task.h
+index 41efd5fd49b03..99585e40cef92 100644
+--- a/drivers/infiniband/sw/rxe/rxe_task.h
++++ b/drivers/infiniband/sw/rxe/rxe_task.h
+@@ -39,12 +39,6 @@ int rxe_init_task(struct rxe_task *task, struct rxe_qp *qp,
+ /* cleanup task */
+ void rxe_cleanup_task(struct rxe_task *task);
+
+-/*
+- * raw call to func in loop without any checking
+- * can call when tasklets are disabled
+- */
+-int __rxe_do_task(struct rxe_task *task);
+-
+ void rxe_run_task(struct rxe_task *task);
+
+ void rxe_sched_task(struct rxe_task *task);
+--
+2.39.2
+
--- /dev/null
+From a107e8f6f8d74622dbe2aea50868f9326390200c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Mar 2023 16:56:44 -0500
+Subject: RDMA/rxe: Remove tasklet call from rxe_cq.c
+
+From: Bob Pearson <rpearsonhpe@gmail.com>
+
+[ Upstream commit 78b26a335310a097d6b22581b706050db42f196c ]
+
+Remove the tasklet call in rxe_cq.c and also the is_dying in the
+cq struct. There is no reason for the rxe driver to defer the call
+to the cq completion handler by scheduling a tasklet. rxe_cq_post()
+is not called in a hard irq context.
+
+The rxe driver currently is incorrect because the tasklet call is
+made without protecting the cq pointer with a reference from having
+the underlying memory freed before the deferred routine is called.
+Executing the comp_handler inline fixes this problem.
+
+Fixes: 8700e3e7c485 ("Soft RoCE driver")
+Signed-off-by: Bob Pearson <rpearsonhpe@gmail.com>
+Link: https://lore.kernel.org/r/20230327215643.10410-1-rpearsonhpe@gmail.com
+Acked-by: Zhu Yanjun <zyjzyj2000@gmail.com>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe_cq.c | 32 +++------------------------
+ drivers/infiniband/sw/rxe/rxe_verbs.c | 2 --
+ drivers/infiniband/sw/rxe/rxe_verbs.h | 2 --
+ 3 files changed, 3 insertions(+), 33 deletions(-)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_cq.c b/drivers/infiniband/sw/rxe/rxe_cq.c
+index 22fbc198e5d17..519ddec29b4ba 100644
+--- a/drivers/infiniband/sw/rxe/rxe_cq.c
++++ b/drivers/infiniband/sw/rxe/rxe_cq.c
+@@ -39,21 +39,6 @@ int rxe_cq_chk_attr(struct rxe_dev *rxe, struct rxe_cq *cq,
+ return -EINVAL;
+ }
+
+-static void rxe_send_complete(struct tasklet_struct *t)
+-{
+- struct rxe_cq *cq = from_tasklet(cq, t, comp_task);
+- unsigned long flags;
+-
+- spin_lock_irqsave(&cq->cq_lock, flags);
+- if (cq->is_dying) {
+- spin_unlock_irqrestore(&cq->cq_lock, flags);
+- return;
+- }
+- spin_unlock_irqrestore(&cq->cq_lock, flags);
+-
+- cq->ibcq.comp_handler(&cq->ibcq, cq->ibcq.cq_context);
+-}
+-
+ int rxe_cq_from_init(struct rxe_dev *rxe, struct rxe_cq *cq, int cqe,
+ int comp_vector, struct ib_udata *udata,
+ struct rxe_create_cq_resp __user *uresp)
+@@ -79,10 +64,6 @@ int rxe_cq_from_init(struct rxe_dev *rxe, struct rxe_cq *cq, int cqe,
+
+ cq->is_user = uresp;
+
+- cq->is_dying = false;
+-
+- tasklet_setup(&cq->comp_task, rxe_send_complete);
+-
+ spin_lock_init(&cq->cq_lock);
+ cq->ibcq.cqe = cqe;
+ return 0;
+@@ -103,6 +84,7 @@ int rxe_cq_resize_queue(struct rxe_cq *cq, int cqe,
+ return err;
+ }
+
++/* caller holds reference to cq */
+ int rxe_cq_post(struct rxe_cq *cq, struct rxe_cqe *cqe, int solicited)
+ {
+ struct ib_event ev;
+@@ -135,21 +117,13 @@ int rxe_cq_post(struct rxe_cq *cq, struct rxe_cqe *cqe, int solicited)
+ if ((cq->notify == IB_CQ_NEXT_COMP) ||
+ (cq->notify == IB_CQ_SOLICITED && solicited)) {
+ cq->notify = 0;
+- tasklet_schedule(&cq->comp_task);
++
++ cq->ibcq.comp_handler(&cq->ibcq, cq->ibcq.cq_context);
+ }
+
+ return 0;
+ }
+
+-void rxe_cq_disable(struct rxe_cq *cq)
+-{
+- unsigned long flags;
+-
+- spin_lock_irqsave(&cq->cq_lock, flags);
+- cq->is_dying = true;
+- spin_unlock_irqrestore(&cq->cq_lock, flags);
+-}
+-
+ void rxe_cq_cleanup(struct rxe_pool_elem *elem)
+ {
+ struct rxe_cq *cq = container_of(elem, typeof(*cq), elem);
+diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.c b/drivers/infiniband/sw/rxe/rxe_verbs.c
+index 84b53c070fc55..090d5bfb1e18d 100644
+--- a/drivers/infiniband/sw/rxe/rxe_verbs.c
++++ b/drivers/infiniband/sw/rxe/rxe_verbs.c
+@@ -1178,8 +1178,6 @@ static int rxe_destroy_cq(struct ib_cq *ibcq, struct ib_udata *udata)
+ goto err_out;
+ }
+
+- rxe_cq_disable(cq);
+-
+ err = rxe_cleanup(cq);
+ if (err)
+ rxe_err_cq(cq, "cleanup failed, err = %d", err);
+diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.h b/drivers/infiniband/sw/rxe/rxe_verbs.h
+index c269ae2a32243..d812093a39166 100644
+--- a/drivers/infiniband/sw/rxe/rxe_verbs.h
++++ b/drivers/infiniband/sw/rxe/rxe_verbs.h
+@@ -63,9 +63,7 @@ struct rxe_cq {
+ struct rxe_queue *queue;
+ spinlock_t cq_lock;
+ u8 notify;
+- bool is_dying;
+ bool is_user;
+- struct tasklet_struct comp_task;
+ atomic_t num_wq;
+ };
+
+--
+2.39.2
+
--- /dev/null
+From 81413767a216363a30ec82b2dac46e47f6501396 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Mar 2023 16:16:21 -0600
+Subject: RDMA/rxe: Replace exists by rxe in rxe.c
+
+From: Bob Pearson <rpearsonhpe@gmail.com>
+
+[ Upstream commit 9168d125ea032ad199275193493c13cb077da5cc ]
+
+'exists' looks like a boolean. This patch replaces it by the
+normal name used for the rxe device, 'rxe', which should be a
+little less confusing. The second rxe_dbg() message is
+incorrect since rxe is known to be NULL and this will cause a
+seg fault if this message were ever sent. Replace it by pr_debug
+for the moment.
+
+Fixes: c6aba5ea0055 ("RDMA/rxe: Replace pr_xxx by rxe_dbg_xxx in rxe.c")
+Link: https://lore.kernel.org/r/20230303221623.8053-2-rpearsonhpe@gmail.com
+Signed-off-by: Bob Pearson <rpearsonhpe@gmail.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe.c b/drivers/infiniband/sw/rxe/rxe.c
+index 136c2efe34660..a3f05fdd9fac2 100644
+--- a/drivers/infiniband/sw/rxe/rxe.c
++++ b/drivers/infiniband/sw/rxe/rxe.c
+@@ -175,7 +175,7 @@ int rxe_add(struct rxe_dev *rxe, unsigned int mtu, const char *ibdev_name)
+
+ static int rxe_newlink(const char *ibdev_name, struct net_device *ndev)
+ {
+- struct rxe_dev *exists;
++ struct rxe_dev *rxe;
+ int err = 0;
+
+ if (is_vlan_dev(ndev)) {
+@@ -184,17 +184,17 @@ static int rxe_newlink(const char *ibdev_name, struct net_device *ndev)
+ goto err;
+ }
+
+- exists = rxe_get_dev_from_net(ndev);
+- if (exists) {
+- ib_device_put(&exists->ib_dev);
+- rxe_dbg(exists, "already configured on %s\n", ndev->name);
++ rxe = rxe_get_dev_from_net(ndev);
++ if (rxe) {
++ ib_device_put(&rxe->ib_dev);
++ rxe_dbg(rxe, "already configured on %s\n", ndev->name);
+ err = -EEXIST;
+ goto err;
+ }
+
+ err = rxe_net_add(ibdev_name, ndev);
+ if (err) {
+- rxe_dbg(exists, "failed to add %s\n", ndev->name);
++ pr_debug("failed to add %s\n", ndev->name);
+ goto err;
+ }
+ err:
+--
+2.39.2
+
--- /dev/null
+From 7bb2c0e7e3889031538d79429dd0263d8e8506d6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Feb 2023 01:17:51 -0800
+Subject: RDMA/siw: Fix potential page_array out of range access
+
+From: Daniil Dulov <d.dulov@aladdin.ru>
+
+[ Upstream commit 271bfcfb83a9f77cbae3d6e1a16e3c14132922f0 ]
+
+When seg is equal to MAX_ARRAY, the loop should break, otherwise
+it will result in out of range access.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: b9be6f18cf9e ("rdma/siw: transmit path")
+Signed-off-by: Daniil Dulov <d.dulov@aladdin.ru>
+Link: https://lore.kernel.org/r/20230227091751.589612-1-d.dulov@aladdin.ru
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/siw/siw_qp_tx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/sw/siw/siw_qp_tx.c b/drivers/infiniband/sw/siw/siw_qp_tx.c
+index 05052b49107f2..6bb9e9e81ff4c 100644
+--- a/drivers/infiniband/sw/siw/siw_qp_tx.c
++++ b/drivers/infiniband/sw/siw/siw_qp_tx.c
+@@ -558,7 +558,7 @@ static int siw_tx_hdt(struct siw_iwarp_tx *c_tx, struct socket *s)
+ data_len -= plen;
+ fp_off = 0;
+
+- if (++seg > (int)MAX_ARRAY) {
++ if (++seg >= (int)MAX_ARRAY) {
+ siw_dbg_qp(tx_qp(c_tx), "to many fragments\n");
+ siw_unmap_pages(iov, kmap_mask, seg-1);
+ wqe->processed -= c_tx->bytes_unsent;
+--
+2.39.2
+
--- /dev/null
+From 4a5989ddae927e7414d571cf55fad736de3064f8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 2 Apr 2023 14:10:13 +0900
+Subject: RDMA/siw: Remove namespace check from siw_netdev_event()
+
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+
+[ Upstream commit 266e9b3475ba82212062771fdbc40be0e3c06ec8 ]
+
+syzbot is reporting that siw_netdev_event(NETDEV_UNREGISTER) cannot destroy
+siw_device created after unshare(CLONE_NEWNET) due to net namespace check.
+It seems that this check was by error there and should be removed.
+
+Reported-by: syzbot <syzbot+5e70d01ee8985ae62a3b@syzkaller.appspotmail.com>
+Link: https://syzkaller.appspot.com/bug?extid=5e70d01ee8985ae62a3b
+Suggested-by: Jason Gunthorpe <jgg@ziepe.ca>
+Suggested-by: Leon Romanovsky <leon@kernel.org>
+Fixes: bdcf26bf9b3a ("rdma/siw: network and RDMA core interface")
+Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Link: https://lore.kernel.org/r/a44e9ac5-44e2-d575-9e30-02483cc7ffd1@I-love.SAKURA.ne.jp
+Reviewed-by: Bernard Metzler <bmt@zurich.ibm.com>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/siw/siw_main.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/drivers/infiniband/sw/siw/siw_main.c b/drivers/infiniband/sw/siw/siw_main.c
+index dacc174604bf2..65b5cda5457ba 100644
+--- a/drivers/infiniband/sw/siw/siw_main.c
++++ b/drivers/infiniband/sw/siw/siw_main.c
+@@ -437,9 +437,6 @@ static int siw_netdev_event(struct notifier_block *nb, unsigned long event,
+
+ dev_dbg(&netdev->dev, "siw: event %lu\n", event);
+
+- if (dev_net(netdev) != &init_net)
+- return NOTIFY_OK;
+-
+ base_dev = ib_device_get_by_netdev(netdev, RDMA_DRIVER_SIW);
+ if (!base_dev)
+ return NOTIFY_OK;
+--
+2.39.2
+
--- /dev/null
+From aa6b6d5f6d6b0a8692d231ad3e218e11f4ebaee0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Apr 2023 21:25:49 -0700
+Subject: RDMA/srpt: Add a check for valid 'mad_agent' pointer
+
+From: Saravanan Vajravel <saravanan.vajravel@broadcom.com>
+
+[ Upstream commit eca5cd9474cd26d62f9756f536e2e656d3f62f3a ]
+
+When unregistering MAD agent, srpt module has a non-null check
+for 'mad_agent' pointer before invoking ib_unregister_mad_agent().
+This check can pass if 'mad_agent' variable holds an error value.
+The 'mad_agent' can have an error value for a short window when
+srpt_add_one() and srpt_remove_one() is executed simultaneously.
+
+In srpt module, added a valid pointer check for 'sport->mad_agent'
+before unregistering MAD agent.
+
+This issue can hit when RoCE driver unregisters ib_device
+
+Stack Trace:
+------------
+BUG: kernel NULL pointer dereference, address: 000000000000004d
+PGD 145003067 P4D 145003067 PUD 2324fe067 PMD 0
+Oops: 0002 [#1] PREEMPT SMP NOPTI
+CPU: 10 PID: 4459 Comm: kworker/u80:0 Kdump: loaded Tainted: P
+Hardware name: Dell Inc. PowerEdge R640/06NR82, BIOS 2.5.4 01/13/2020
+Workqueue: bnxt_re bnxt_re_task [bnxt_re]
+RIP: 0010:_raw_spin_lock_irqsave+0x19/0x40
+Call Trace:
+ ib_unregister_mad_agent+0x46/0x2f0 [ib_core]
+ IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready
+ ? __schedule+0x20b/0x560
+ srpt_unregister_mad_agent+0x93/0xd0 [ib_srpt]
+ srpt_remove_one+0x20/0x150 [ib_srpt]
+ remove_client_context+0x88/0xd0 [ib_core]
+ bond0: (slave p2p1): link status definitely up, 100000 Mbps full duplex
+ disable_device+0x8a/0x160 [ib_core]
+ bond0: active interface up!
+ ? kernfs_name_hash+0x12/0x80
+ (NULL device *): Bonding Info Received: rdev: 000000006c0b8247
+ __ib_unregister_device+0x42/0xb0 [ib_core]
+ (NULL device *): Master: mode: 4 num_slaves:2
+ ib_unregister_device+0x22/0x30 [ib_core]
+ (NULL device *): Slave: id: 105069936 name:p2p1 link:0 state:0
+ bnxt_re_stopqps_and_ib_uninit+0x83/0x90 [bnxt_re]
+ bnxt_re_alloc_lag+0x12e/0x4e0 [bnxt_re]
+
+Fixes: a42d985bd5b2 ("ib_srpt: Initial SRP Target merge for v3.3-rc1")
+Reviewed-by: Selvin Xavier <selvin.xavier@broadcom.com>
+Reviewed-by: Kashyap Desai <kashyap.desai@broadcom.com>
+Signed-off-by: Saravanan Vajravel <saravanan.vajravel@broadcom.com>
+Link: https://lore.kernel.org/r/20230406042549.507328-1-saravanan.vajravel@broadcom.com
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/srpt/ib_srpt.c | 23 +++++++++++++----------
+ 1 file changed, 13 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c
+index 3c3fae738c3ed..25e799dba999e 100644
+--- a/drivers/infiniband/ulp/srpt/ib_srpt.c
++++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
+@@ -549,6 +549,7 @@ static int srpt_format_guid(char *buf, unsigned int size, const __be64 *guid)
+ */
+ static int srpt_refresh_port(struct srpt_port *sport)
+ {
++ struct ib_mad_agent *mad_agent;
+ struct ib_mad_reg_req reg_req;
+ struct ib_port_modify port_modify;
+ struct ib_port_attr port_attr;
+@@ -593,24 +594,26 @@ static int srpt_refresh_port(struct srpt_port *sport)
+ set_bit(IB_MGMT_METHOD_GET, reg_req.method_mask);
+ set_bit(IB_MGMT_METHOD_SET, reg_req.method_mask);
+
+- sport->mad_agent = ib_register_mad_agent(sport->sdev->device,
+- sport->port,
+- IB_QPT_GSI,
+- ®_req, 0,
+- srpt_mad_send_handler,
+- srpt_mad_recv_handler,
+- sport, 0);
+- if (IS_ERR(sport->mad_agent)) {
++ mad_agent = ib_register_mad_agent(sport->sdev->device,
++ sport->port,
++ IB_QPT_GSI,
++ ®_req, 0,
++ srpt_mad_send_handler,
++ srpt_mad_recv_handler,
++ sport, 0);
++ if (IS_ERR(mad_agent)) {
+ pr_err("%s-%d: MAD agent registration failed (%ld). Note: this is expected if SR-IOV is enabled.\n",
+ dev_name(&sport->sdev->device->dev), sport->port,
+- PTR_ERR(sport->mad_agent));
++ PTR_ERR(mad_agent));
+ sport->mad_agent = NULL;
+ memset(&port_modify, 0, sizeof(port_modify));
+ port_modify.clr_port_cap_mask = IB_PORT_DEVICE_MGMT_SUP;
+ ib_modify_port(sport->sdev->device, sport->port, 0,
+ &port_modify);
+-
++ return 0;
+ }
++
++ sport->mad_agent = mad_agent;
+ }
+
+ return 0;
+--
+2.39.2
+
--- /dev/null
+From 85ec1620cfb7bd3d36ca6ffc5ff7d87e13dde3e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Mar 2023 14:33:54 -0700
+Subject: regulator: core: Avoid lockdep reports when resolving supplies
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit cba6cfdc7c3f1516f0d08ddfb24e689af0932573 ]
+
+An automated bot told me that there was a potential lockdep problem
+with regulators. This was on the chromeos-5.15 kernel, but I see
+nothing that would be different downstream compared to upstream. The
+bot said:
+ ============================================
+ WARNING: possible recursive locking detected
+ 5.15.104-lockdep-17461-gc1e499ed6604 #1 Not tainted
+ --------------------------------------------
+ kworker/u16:4/115 is trying to acquire lock:
+ ffffff8083110170 (regulator_ww_class_mutex){+.+.}-{3:3}, at: create_regulator+0x398/0x7ec
+
+ but task is already holding lock:
+ ffffff808378e170 (regulator_ww_class_mutex){+.+.}-{3:3}, at: ww_mutex_trylock+0x3c/0x7b8
+
+ other info that might help us debug this:
+ Possible unsafe locking scenario:
+
+ CPU0
+ ----
+ lock(regulator_ww_class_mutex);
+ lock(regulator_ww_class_mutex);
+
+ *** DEADLOCK ***
+
+ May be due to missing lock nesting notation
+
+ 4 locks held by kworker/u16:4/115:
+ #0: ffffff808006a948 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x520/0x1348
+ #1: ffffffc00e0a7cc0 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: process_one_work+0x55c/0x1348
+ #2: ffffff80828a2260 (&dev->mutex){....}-{3:3}, at: __device_attach_async_helper+0xd0/0x2a4
+ #3: ffffff808378e170 (regulator_ww_class_mutex){+.+.}-{3:3}, at: ww_mutex_trylock+0x3c/0x7b8
+
+ stack backtrace:
+ CPU: 2 PID: 115 Comm: kworker/u16:4 Not tainted 5.15.104-lockdep-17461-gc1e499ed6604 #1 9292e52fa83c0e23762b2b3aa1bacf5787a4d5da
+ Hardware name: Google Quackingstick (rev0+) (DT)
+ Workqueue: events_unbound async_run_entry_fn
+ Call trace:
+ dump_backtrace+0x0/0x4ec
+ show_stack+0x34/0x50
+ dump_stack_lvl+0xdc/0x11c
+ dump_stack+0x1c/0x48
+ __lock_acquire+0x16d4/0x6c74
+ lock_acquire+0x208/0x750
+ __mutex_lock_common+0x11c/0x11f8
+ ww_mutex_lock+0xc0/0x440
+ create_regulator+0x398/0x7ec
+ regulator_resolve_supply+0x654/0x7c4
+ regulator_register_resolve_supply+0x30/0x120
+ class_for_each_device+0x1b8/0x230
+ regulator_register+0x17a4/0x1f40
+ devm_regulator_register+0x60/0xd0
+ reg_fixed_voltage_probe+0x728/0xaec
+ platform_probe+0x150/0x1c8
+ really_probe+0x274/0xa20
+ __driver_probe_device+0x1dc/0x3f4
+ driver_probe_device+0x78/0x1c0
+ __device_attach_driver+0x1ac/0x2c8
+ bus_for_each_drv+0x11c/0x190
+ __device_attach_async_helper+0x1e4/0x2a4
+ async_run_entry_fn+0xa0/0x3ac
+ process_one_work+0x638/0x1348
+ worker_thread+0x4a8/0x9c4
+ kthread+0x2e4/0x3a0
+ ret_from_fork+0x10/0x20
+
+The problem was first reported soon after we made many of the
+regulators probe asynchronously, though nothing I've seen implies that
+the problems couldn't have also happened even without that.
+
+I haven't personally been able to reproduce the lockdep issue, but the
+issue does look somewhat legitimate. Specifically, it looks like in
+regulator_resolve_supply() we are holding a "rdev" lock while calling
+set_supply() -> create_regulator() which grabs the lock of a
+_different_ "rdev" (the one for our supply). This is not necessarily
+safe from a lockdep perspective since there is no documented ordering
+between these two locks.
+
+In reality, we should always be locking a regulator before the
+supplying regulator, so I don't expect there to be any real deadlocks
+in practice. However, the regulator framework in general doesn't
+express this to lockdep.
+
+Let's fix the issue by simply grabbing the two locks involved in the
+same way we grab multiple locks elsewhere in the regulator framework:
+using the "wound/wait" mechanisms.
+
+Fixes: eaa7995c529b ("regulator: core: avoid regulator_resolve_supply() race condition")
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Link: https://lore.kernel.org/r/20230329143317.RFC.v2.2.I30d8e1ca10cfbe5403884cdd192253a2e063eb9e@changeid
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/core.c | 91 ++++++++++++++++++++++++++++++++++++----
+ 1 file changed, 83 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
+index 9a13240f3084f..08726bc0da9d7 100644
+--- a/drivers/regulator/core.c
++++ b/drivers/regulator/core.c
+@@ -207,6 +207,78 @@ static void regulator_unlock(struct regulator_dev *rdev)
+ mutex_unlock(®ulator_nesting_mutex);
+ }
+
++/**
++ * regulator_lock_two - lock two regulators
++ * @rdev1: first regulator
++ * @rdev2: second regulator
++ * @ww_ctx: w/w mutex acquire context
++ *
++ * Locks both rdevs using the regulator_ww_class.
++ */
++static void regulator_lock_two(struct regulator_dev *rdev1,
++ struct regulator_dev *rdev2,
++ struct ww_acquire_ctx *ww_ctx)
++{
++ struct regulator_dev *tmp;
++ int ret;
++
++ ww_acquire_init(ww_ctx, ®ulator_ww_class);
++
++ /* Try to just grab both of them */
++ ret = regulator_lock_nested(rdev1, ww_ctx);
++ WARN_ON(ret);
++ ret = regulator_lock_nested(rdev2, ww_ctx);
++ if (ret != -EDEADLOCK) {
++ WARN_ON(ret);
++ goto exit;
++ }
++
++ while (true) {
++ /*
++ * Start of loop: rdev1 was locked and rdev2 was contended.
++ * Need to unlock rdev1, slowly lock rdev2, then try rdev1
++ * again.
++ */
++ regulator_unlock(rdev1);
++
++ ww_mutex_lock_slow(&rdev2->mutex, ww_ctx);
++ rdev2->ref_cnt++;
++ rdev2->mutex_owner = current;
++ ret = regulator_lock_nested(rdev1, ww_ctx);
++
++ if (ret == -EDEADLOCK) {
++ /* More contention; swap which needs to be slow */
++ tmp = rdev1;
++ rdev1 = rdev2;
++ rdev2 = tmp;
++ } else {
++ WARN_ON(ret);
++ break;
++ }
++ }
++
++exit:
++ ww_acquire_done(ww_ctx);
++}
++
++/**
++ * regulator_unlock_two - unlock two regulators
++ * @rdev1: first regulator
++ * @rdev2: second regulator
++ * @ww_ctx: w/w mutex acquire context
++ *
++ * The inverse of regulator_lock_two().
++ */
++
++static void regulator_unlock_two(struct regulator_dev *rdev1,
++ struct regulator_dev *rdev2,
++ struct ww_acquire_ctx *ww_ctx)
++{
++ regulator_unlock(rdev2);
++ regulator_unlock(rdev1);
++ ww_acquire_fini(ww_ctx);
++}
++
+ static bool regulator_supply_is_couple(struct regulator_dev *rdev)
+ {
+ struct regulator_dev *c_rdev;
+@@ -1627,8 +1699,8 @@ static int set_machine_constraints(struct regulator_dev *rdev)
+
+ /**
+ * set_supply - set regulator supply regulator
+- * @rdev: regulator name
+- * @supply_rdev: supply regulator name
++ * @rdev: regulator (locked)
++ * @supply_rdev: supply regulator (locked))
+ *
+ * Called by platform initialisation code to set the supply regulator for this
+ * regulator. This ensures that a regulators supply will also be enabled by the
+@@ -1800,6 +1872,8 @@ static struct regulator *create_regulator(struct regulator_dev *rdev,
+ struct regulator *regulator;
+ int err = 0;
+
++ lockdep_assert_held_once(&rdev->mutex.base);
++
+ if (dev) {
+ char buf[REG_STR_SIZE];
+ int size;
+@@ -1827,9 +1901,7 @@ static struct regulator *create_regulator(struct regulator_dev *rdev,
+ regulator->rdev = rdev;
+ regulator->supply_name = supply_name;
+
+- regulator_lock(rdev);
+ list_add(®ulator->list, &rdev->consumer_list);
+- regulator_unlock(rdev);
+
+ if (dev) {
+ regulator->dev = dev;
+@@ -1995,6 +2067,7 @@ static int regulator_resolve_supply(struct regulator_dev *rdev)
+ {
+ struct regulator_dev *r;
+ struct device *dev = rdev->dev.parent;
++ struct ww_acquire_ctx ww_ctx;
+ int ret = 0;
+
+ /* No supply to resolve? */
+@@ -2061,23 +2134,23 @@ static int regulator_resolve_supply(struct regulator_dev *rdev)
+ * between rdev->supply null check and setting rdev->supply in
+ * set_supply() from concurrent tasks.
+ */
+- regulator_lock(rdev);
++ regulator_lock_two(rdev, r, &ww_ctx);
+
+ /* Supply just resolved by a concurrent task? */
+ if (rdev->supply) {
+- regulator_unlock(rdev);
++ regulator_unlock_two(rdev, r, &ww_ctx);
+ put_device(&r->dev);
+ goto out;
+ }
+
+ ret = set_supply(rdev, r);
+ if (ret < 0) {
+- regulator_unlock(rdev);
++ regulator_unlock_two(rdev, r, &ww_ctx);
+ put_device(&r->dev);
+ goto out;
+ }
+
+- regulator_unlock(rdev);
++ regulator_unlock_two(rdev, r, &ww_ctx);
+
+ /*
+ * In set_machine_constraints() we may have turned this regulator on
+@@ -2190,7 +2263,9 @@ struct regulator *_regulator_get(struct device *dev, const char *id,
+ return regulator;
+ }
+
++ regulator_lock(rdev);
+ regulator = create_regulator(rdev, dev, id);
++ regulator_unlock(rdev);
+ if (regulator == NULL) {
+ regulator = ERR_PTR(-ENOMEM);
+ module_put(rdev->owner);
+--
+2.39.2
+
--- /dev/null
+From 3a19abbab3b579acacc2b582a37ae4ba8e59a8ff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Mar 2023 14:33:53 -0700
+Subject: regulator: core: Consistently set mutex_owner when using
+ ww_mutex_lock_slow()
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit b83a1772be854f87602de14726737d3e5b06e1f4 ]
+
+When a codepath locks a rdev using ww_mutex_lock_slow() directly then
+that codepath is responsible for incrementing the "ref_cnt" and also
+setting the "mutex_owner" to "current".
+
+The regulator core consistently got that right for "ref_cnt" but
+didn't always get it right for "mutex_owner". Let's fix this.
+
+It's unlikely that this truly matters because the "mutex_owner" is
+only needed if we're going to do subsequent locking of the same
+rdev. However, even though it's not truly needed it seems less
+surprising if we consistently set "mutex_owner" properly.
+
+Fixes: f8702f9e4aa7 ("regulator: core: Use ww_mutex for regulators locking")
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Link: https://lore.kernel.org/r/20230329143317.RFC.v2.1.I4e9d433ea26360c06dd1381d091c82bb1a4ce843@changeid
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/core.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
+index 1490eb40c973a..9a13240f3084f 100644
+--- a/drivers/regulator/core.c
++++ b/drivers/regulator/core.c
+@@ -334,6 +334,7 @@ static void regulator_lock_dependent(struct regulator_dev *rdev,
+ ww_mutex_lock_slow(&new_contended_rdev->mutex, ww_ctx);
+ old_contended_rdev = new_contended_rdev;
+ old_contended_rdev->ref_cnt++;
++ old_contended_rdev->mutex_owner = current;
+ }
+
+ err = regulator_lock_recursive(rdev,
+@@ -6048,6 +6049,7 @@ static void regulator_summary_lock(struct ww_acquire_ctx *ww_ctx)
+ ww_mutex_lock_slow(&new_contended_rdev->mutex, ww_ctx);
+ old_contended_rdev = new_contended_rdev;
+ old_contended_rdev->ref_cnt++;
++ old_contended_rdev->mutex_owner = current;
+ }
+
+ err = regulator_summary_lock_all(ww_ctx,
+--
+2.39.2
+
--- /dev/null
+From 0d5d373c3d1b57da7704c8d8956ed16a6f661459 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Mar 2023 11:18:19 -0700
+Subject: regulator: core: Shorten off-on-delay-us for always-on/boot-on by
+ time since booted
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit 691c1fcda5351ed98a44610b7dccc0e3ee920020 ]
+
+This is very close to a straight revert of commit 218320fec294
+("regulator: core: Fix off-on-delay-us for always-on/boot-on
+regulators"). We've identified that patch as causing a boot speed
+regression on sc7180-trogdor boards. While boot speed certainly isn't
+more important than making sure that power sequencing is correct,
+looking closely at the original change it doesn't seem to have been
+fully justified. It mentions "cycling issues" without describing
+exactly what the issues were. That means it's possible that the
+cycling issues were really a problem that should be fixed in a
+different way.
+
+Let's take a careful look at how we should handle regulators that have
+an off-on-delay and that are boot-on or always-on. Linux currently
+doesn't have any way to identify whether a GPIO regulator was already
+on when the kernel booted. That means that when the kernel boots we
+probe a regulator, see that it wants boot-on / always-on we, and then
+turn the regulator on. We could be in one of two cases when we do
+this:
+
+a) The regulator might have been left on by the bootloader and we're
+ ensuring that it stays on.
+b) The regulator might have been left off by the bootloader and we're
+ just now turning it on.
+
+For case a) we definitely don't need any sort of delay. For case b) we
+_might_ need some delay in case the bootloader turned the regulator
+off _right_ before booting the kernel. To get the proper delay for
+case b) then we can just assume a `last_off` of 0, which is what it
+gets initialized to by default.
+
+As per above, we can't tell whether we're in case a) or case b) so
+we'll assume the longer delay (case b). This basically puts the code
+to how it was before commit 218320fec294 ("regulator: core: Fix
+off-on-delay-us for always-on/boot-on regulators"). However, we add
+one important change: we make sure that the delay is actually honored
+if `last_off` is 0. Though the original "cycling issues" cited were
+vague, I'm hopeful that this important extra change will be enough to
+fix the issues that the initial commit mentioned.
+
+With this fix, I've confined that on a sc7180-trogdor board the delay
+at boot goes down from 500 ms to ~250 ms. That's not as good as the 0
+ms that we had prior to commit 218320fec294 ("regulator: core: Fix
+off-on-delay-us for always-on/boot-on regulators"), but it's probably
+safer because we don't know if the bootloader turned the regulator off
+right before booting.
+
+One note is that it's possible that we could be in a state that's not
+a) or b) if there are other issues in the kernel. The only one I can
+think of is related to pinctrl. If the pinctrl driver being used on a
+board isn't careful about avoiding glitches when setting up a pin then
+it's possible that setting up a pin could cause the regulator to "turn
+off" briefly immediately before the regulator probes. If this is
+indeed causing problems then the pinctrl driver should be fixed,
+perhaps in a similar way to what was done in commit d21f4b7ffc22
+("pinctrl: qcom: Avoid glitching lines when we first mux to output")
+
+Fixes: 218320fec294 ("regulator: core: Fix off-on-delay-us for always-on/boot-on regulators")
+Cc: Christian Kohlschütter <christian@kohlschutter.com>
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Link: https://lore.kernel.org/r/20230313111806.1.I2eaad872be0932a805c239a7c7a102233fb0b03b@changeid
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/core.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
+index 4fcd36055b025..1490eb40c973a 100644
+--- a/drivers/regulator/core.c
++++ b/drivers/regulator/core.c
+@@ -1583,9 +1583,6 @@ static int set_machine_constraints(struct regulator_dev *rdev)
+ rdev->constraints->always_on = true;
+ }
+
+- if (rdev->desc->off_on_delay)
+- rdev->last_off = ktime_get_boottime();
+-
+ /* If the constraints say the regulator should be on at this point
+ * and we have control then make sure it is enabled.
+ */
+@@ -1619,6 +1616,8 @@ static int set_machine_constraints(struct regulator_dev *rdev)
+
+ if (rdev->constraints->always_on)
+ rdev->use_count++;
++ } else if (rdev->desc->off_on_delay) {
++ rdev->last_off = ktime_get();
+ }
+
+ print_constraints(rdev);
+@@ -2668,7 +2667,7 @@ static int _regulator_do_enable(struct regulator_dev *rdev)
+
+ trace_regulator_enable(rdev_get_name(rdev));
+
+- if (rdev->desc->off_on_delay && rdev->last_off) {
++ if (rdev->desc->off_on_delay) {
+ /* if needed, keep a distance of off_on_delay from last time
+ * this regulator was disabled.
+ */
+--
+2.39.2
+
--- /dev/null
+From 74fa79a010dbe4b8d779ad7b4f92e9217a4ebf69 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Apr 2023 11:35:29 +0800
+Subject: regulator: stm32-pwr: fix of_iomap leak
+
+From: YAN SHI <m202071378@hust.edu.cn>
+
+[ Upstream commit c4a413e56d16a2ae84e6d8992f215c4dcc7fac20 ]
+
+Smatch reports:
+drivers/regulator/stm32-pwr.c:166 stm32_pwr_regulator_probe() warn:
+'base' from of_iomap() not released on lines: 151,166.
+
+In stm32_pwr_regulator_probe(), base is not released
+when devm_kzalloc() fails to allocate memory or
+devm_regulator_register() fails to register a new regulator device,
+which may cause a leak.
+
+To fix this issue, replace of_iomap() with
+devm_platform_ioremap_resource(). devm_platform_ioremap_resource()
+is a specialized function for platform devices.
+It allows 'base' to be automatically released whether the probe
+function succeeds or fails.
+
+Besides, use IS_ERR(base) instead of !base
+as the return value of devm_platform_ioremap_resource()
+can either be a pointer to the remapped memory or
+an ERR_PTR() encoded error code if the operation fails.
+
+Fixes: dc62f951a6a8 ("regulator: stm32-pwr: Fix return value check in stm32_pwr_regulator_probe()")
+Signed-off-by: YAN SHI <m202071378@hust.edu.cn>
+Reported-by: kernel test robot <lkp@intel.com>
+Link: https://lore.kernel.org/oe-kbuild-all/202304111750.o2643eJN-lkp@intel.com/
+Reviewed-by: Dongliang Mu <dzm91@hust.edu.cn>
+Link: https://lore.kernel.org/r/20230412033529.18890-1-m202071378@hust.edu.cn
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/stm32-pwr.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/regulator/stm32-pwr.c b/drivers/regulator/stm32-pwr.c
+index 2a42acb7c24e9..e5dd4db6403b2 100644
+--- a/drivers/regulator/stm32-pwr.c
++++ b/drivers/regulator/stm32-pwr.c
+@@ -129,17 +129,16 @@ static const struct regulator_desc stm32_pwr_desc[] = {
+
+ static int stm32_pwr_regulator_probe(struct platform_device *pdev)
+ {
+- struct device_node *np = pdev->dev.of_node;
+ struct stm32_pwr_reg *priv;
+ void __iomem *base;
+ struct regulator_dev *rdev;
+ struct regulator_config config = { };
+ int i, ret = 0;
+
+- base = of_iomap(np, 0);
+- if (!base) {
++ base = devm_platform_ioremap_resource(pdev, 0);
++ if (IS_ERR(base)) {
+ dev_err(&pdev->dev, "Unable to map IO memory\n");
+- return -ENOMEM;
++ return PTR_ERR(base);
+ }
+
+ config.dev = &pdev->dev;
+--
+2.39.2
+
--- /dev/null
+From 8a42c81b17fec5601047fb0946e8aa32322eba09 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Apr 2023 18:30:06 +0800
+Subject: Revert "Bluetooth: btsdio: fix use after free bug in btsdio_remove
+ due to unfinished work"
+
+From: Liu Jian <liujian56@huawei.com>
+
+[ Upstream commit db2bf510bd5d57f064d9e1db395ed86a08320c54 ]
+
+This reverts commit 1e9ac114c4428fdb7ff4635b45d4f46017e8916f.
+
+This patch introduces a possible null-ptr-def problem. Revert it. And the
+fixed bug by this patch have resolved by commit 73f7b171b7c0 ("Bluetooth:
+btsdio: fix use after free bug in btsdio_remove due to race condition").
+
+Fixes: 1e9ac114c442 ("Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work")
+Signed-off-by: Liu Jian <liujian56@huawei.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/btsdio.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/bluetooth/btsdio.c b/drivers/bluetooth/btsdio.c
+index 51000320e1ea8..f19d31ee37ea8 100644
+--- a/drivers/bluetooth/btsdio.c
++++ b/drivers/bluetooth/btsdio.c
+@@ -354,7 +354,6 @@ static void btsdio_remove(struct sdio_func *func)
+
+ BT_DBG("func %p", func);
+
+- cancel_work_sync(&data->work);
+ if (!data)
+ return;
+
+--
+2.39.2
+
--- /dev/null
+From 03539983d05a490db68cc2948b80e8689b263a2d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Mar 2023 11:07:13 +0100
+Subject: Revert "drm/msm: Add missing check and destroy for
+ alloc_ordered_workqueue"
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+[ Upstream commit dfa70344d1b5f5ff08525a8c872c8dd5e82fc5d9 ]
+
+This reverts commit 643b7d0869cc7f1f7a5ac7ca6bd25d88f54e31d0.
+
+A recent patch that tried to fix up the msm_drm_init() paths with
+respect to the workqueue but only ended up making things worse:
+
+First, the newly added calls to msm_drm_uninit() on early errors would
+trigger NULL-pointer dereferences, for example, as the kms pointer would
+not have been initialised. (Note that these paths were also modified by
+a second broken error handling patch which in effect cancelled out this
+part when merged.)
+
+Second, the newly added allocation sanity check would still leak the
+previously allocated drm device.
+
+Instead of trying to salvage what was badly broken (and clearly not
+tested), let's revert the bad commit so that clean and backportable
+fixes can be added in its place.
+
+Fixes: 643b7d0869cc ("drm/msm: Add missing check and destroy for alloc_ordered_workqueue")
+Cc: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Patchwork: https://patchwork.freedesktop.org/patch/525107/
+Link: https://lore.kernel.org/r/20230306100722.28485-2-johan+linaro@kernel.org
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/msm_drv.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c
+index aca48c868c14d..b7f5a78eadd4a 100644
+--- a/drivers/gpu/drm/msm/msm_drv.c
++++ b/drivers/gpu/drm/msm/msm_drv.c
+@@ -420,8 +420,6 @@ static int msm_drm_init(struct device *dev, const struct drm_driver *drv)
+ priv->dev = ddev;
+
+ priv->wq = alloc_ordered_workqueue("msm", 0);
+- if (!priv->wq)
+- return -ENOMEM;
+
+ INIT_LIST_HEAD(&priv->objects);
+ mutex_init(&priv->obj_lock);
+--
+2.39.2
+
--- /dev/null
+From cf6e2748c63199f4ebae4218c10bbfadf0653bd6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Mar 2023 11:07:14 +0100
+Subject: Revert "drm/msm: Fix failure paths in msm_drm_init()"
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+[ Upstream commit 652eadfde81031c7b3d8b21bdbcfdd6eb217dec8 ]
+
+This reverts commit 8636500300a01740d92b345c680b036b94555b1b.
+
+A recent commit tried to address a drm device leak in the early
+msm_drm_uninit() error paths but ended up making things worse.
+
+Specifically, it moved the drm device reference put in msm_drm_uninit()
+to msm_drm_init() which means that the drm would now be leaked on normal
+unbind.
+
+For reasons that were never spelled out, it also added kms NULL pointer
+checks to a couple of helper functions that had nothing to do with the
+paths modified by the patch.
+
+Instead of trying to salvage this incrementally, let's revert the bad
+commit so that clean and backportable fixes can be added in its place.
+
+Fixes: 8636500300a0 ("drm/msm: Fix failure paths in msm_drm_init()")
+Cc: Akhil P Oommen <quic_akhilpo@quicinc.com>
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Patchwork: https://patchwork.freedesktop.org/patch/525092/
+Link: https://lore.kernel.org/r/20230306100722.28485-3-johan+linaro@kernel.org
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/disp/msm_disp_snapshot.c | 3 ---
+ drivers/gpu/drm/msm/msm_drv.c | 11 ++++-------
+ 2 files changed, 4 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/disp/msm_disp_snapshot.c b/drivers/gpu/drm/msm/disp/msm_disp_snapshot.c
+index b73031cd48e48..e75b97127c0d1 100644
+--- a/drivers/gpu/drm/msm/disp/msm_disp_snapshot.c
++++ b/drivers/gpu/drm/msm/disp/msm_disp_snapshot.c
+@@ -129,9 +129,6 @@ void msm_disp_snapshot_destroy(struct drm_device *drm_dev)
+ }
+
+ priv = drm_dev->dev_private;
+- if (!priv->kms)
+- return;
+-
+ kms = priv->kms;
+
+ if (kms->dump_worker)
+diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c
+index b7f5a78eadd4a..9ded384acba46 100644
+--- a/drivers/gpu/drm/msm/msm_drv.c
++++ b/drivers/gpu/drm/msm/msm_drv.c
+@@ -150,9 +150,6 @@ static void msm_irq_uninstall(struct drm_device *dev)
+ struct msm_drm_private *priv = dev->dev_private;
+ struct msm_kms *kms = priv->kms;
+
+- if (!priv->kms)
+- return;
+-
+ kms->funcs->irq_uninstall(kms);
+ if (kms->irq_requested)
+ free_irq(kms->irq, dev);
+@@ -270,6 +267,8 @@ static int msm_drm_uninit(struct device *dev)
+ component_unbind_all(dev, ddev);
+
+ ddev->dev_private = NULL;
++ drm_dev_put(ddev);
++
+ destroy_workqueue(priv->wq);
+
+ return 0;
+@@ -442,12 +441,12 @@ static int msm_drm_init(struct device *dev, const struct drm_driver *drv)
+
+ ret = msm_init_vram(ddev);
+ if (ret)
+- goto err_drm_dev_put;
++ return ret;
+
+ /* Bind all our sub-components: */
+ ret = component_bind_all(dev, ddev);
+ if (ret)
+- goto err_drm_dev_put;
++ return ret;
+
+ dma_set_max_seg_size(dev, UINT_MAX);
+
+@@ -542,8 +541,6 @@ static int msm_drm_init(struct device *dev, const struct drm_driver *drv)
+
+ err_msm_uninit:
+ msm_drm_uninit(dev);
+-err_drm_dev_put:
+- drm_dev_put(ddev);
+ return ret;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 63ff17af063a0017ee19dbe4eaebaac92fca6249 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 9 Apr 2023 10:44:31 +0300
+Subject: Revert "net/mlx5: Remove "recovery" arg from mlx5_load_one()
+ function"
+
+From: Moshe Shemesh <moshe@nvidia.com>
+
+[ Upstream commit 21608a2cf38e9f743636b5f86507ffbca18ecee7 ]
+
+This reverts commit 5977ac3910f1cbaf44dca48179118b25c206ac29.
+
+Revert this patch as we need the "recovery" arg back in mlx5_load_one()
+function. This arg will be used in the next patch for using recovery
+timeout during sync reset flow.
+
+Signed-off-by: Moshe Shemesh <moshe@nvidia.com>
+Reviewed-by: Maher Sanalla <msanalla@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Stable-dep-of: dfad99750c0f ("net/mlx5: Use recovery timeout on sync reset flow")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c | 2 +-
+ drivers/net/ethernet/mellanox/mlx5/core/main.c | 9 +++++----
+ drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h | 2 +-
+ 3 files changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c
+index 4c2dad9d7cfb8..289e915def989 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c
+@@ -167,7 +167,7 @@ static void mlx5_fw_reset_complete_reload(struct mlx5_core_dev *dev)
+ if (mlx5_health_wait_pci_up(dev))
+ mlx5_core_err(dev, "reset reload flow aborted, PCI reads still not working\n");
+ else
+- mlx5_load_one(dev);
++ mlx5_load_one(dev, false);
+ devlink_remote_reload_actions_performed(priv_to_devlink(dev), 0,
+ BIT(DEVLINK_RELOAD_ACTION_DRIVER_REINIT) |
+ BIT(DEVLINK_RELOAD_ACTION_FW_ACTIVATE));
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
+index f1de152a61135..ad90bf125e94f 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
+@@ -1509,13 +1509,13 @@ int mlx5_load_one_devl_locked(struct mlx5_core_dev *dev, bool recovery)
+ return err;
+ }
+
+-int mlx5_load_one(struct mlx5_core_dev *dev)
++int mlx5_load_one(struct mlx5_core_dev *dev, bool recovery)
+ {
+ struct devlink *devlink = priv_to_devlink(dev);
+ int ret;
+
+ devl_lock(devlink);
+- ret = mlx5_load_one_devl_locked(dev, false);
++ ret = mlx5_load_one_devl_locked(dev, recovery);
+ devl_unlock(devlink);
+ return ret;
+ }
+@@ -1912,7 +1912,8 @@ static void mlx5_pci_resume(struct pci_dev *pdev)
+
+ mlx5_pci_trace(dev, "Enter, loading driver..\n");
+
+- err = mlx5_load_one(dev);
++ err = mlx5_load_one(dev, false);
++
+ if (!err)
+ devlink_health_reporter_state_update(dev->priv.health.fw_fatal_reporter,
+ DEVLINK_HEALTH_REPORTER_STATE_HEALTHY);
+@@ -2003,7 +2004,7 @@ static int mlx5_resume(struct pci_dev *pdev)
+ {
+ struct mlx5_core_dev *dev = pci_get_drvdata(pdev);
+
+- return mlx5_load_one(dev);
++ return mlx5_load_one(dev, false);
+ }
+
+ static const struct pci_device_id mlx5_core_pci_table[] = {
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h b/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h
+index be0785f83083a..a3c5c2dab5fd7 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h
++++ b/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h
+@@ -321,7 +321,7 @@ int mlx5_init_one(struct mlx5_core_dev *dev);
+ void mlx5_uninit_one(struct mlx5_core_dev *dev);
+ void mlx5_unload_one(struct mlx5_core_dev *dev, bool suspend);
+ void mlx5_unload_one_devl_locked(struct mlx5_core_dev *dev, bool suspend);
+-int mlx5_load_one(struct mlx5_core_dev *dev);
++int mlx5_load_one(struct mlx5_core_dev *dev, bool recovery);
+ int mlx5_load_one_devl_locked(struct mlx5_core_dev *dev, bool recovery);
+
+ int mlx5_vport_set_other_func_cap(struct mlx5_core_dev *dev, const void *hca_cap, u16 function_id,
+--
+2.39.2
+
--- /dev/null
+From 555e78c0e6c6e22e5b1f9cd7aba86615e1e48ae4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Apr 2023 15:06:59 +0200
+Subject: Revert "net/mlx5e: Don't use termination table when redundant"
+
+From: Vlad Buslov <vladbu@nvidia.com>
+
+[ Upstream commit 081abcacaf0a9505c0d4cc9780b12e6ce5d33630 ]
+
+This reverts commit 14624d7247fcd0f3114a6f5f17b3c8d1020fbbb7.
+
+The termination table usage is requires for DMFS steering mode as firmware
+doesn't support mixed table destinations list which causes following
+syndrome with hairpin rules:
+
+[81922.283225] mlx5_core 0000:08:00.0: mlx5_cmd_out_err:803:(pid 25977): SET_FLOW_TABLE_ENTRY(0x936) op_mod(0x0) failed, status bad parameter(0x3), syndrome (0xaca205), err(-22)
+
+Fixes: 14624d7247fc ("net/mlx5e: Don't use termination table when redundant")
+Signed-off-by: Vlad Buslov <vladbu@nvidia.com>
+Reviewed-by: Roi Dayan <roid@nvidia.com>
+Reviewed-by: Maor Dickman <maord@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../mlx5/core/eswitch_offloads_termtbl.c | 32 +++----------------
+ 1 file changed, 4 insertions(+), 28 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads_termtbl.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads_termtbl.c
+index 3a9a6bb9158de..edd9102583144 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads_termtbl.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads_termtbl.c
+@@ -210,18 +210,6 @@ static bool mlx5_eswitch_offload_is_uplink_port(const struct mlx5_eswitch *esw,
+ return (port_mask & port_value) == MLX5_VPORT_UPLINK;
+ }
+
+-static bool
+-mlx5_eswitch_is_push_vlan_no_cap(struct mlx5_eswitch *esw,
+- struct mlx5_flow_act *flow_act)
+-{
+- if (flow_act->action & MLX5_FLOW_CONTEXT_ACTION_VLAN_PUSH &&
+- !(mlx5_fs_get_capabilities(esw->dev, MLX5_FLOW_NAMESPACE_FDB) &
+- MLX5_FLOW_STEERING_CAP_VLAN_PUSH_ON_RX))
+- return true;
+-
+- return false;
+-}
+-
+ bool
+ mlx5_eswitch_termtbl_required(struct mlx5_eswitch *esw,
+ struct mlx5_flow_attr *attr,
+@@ -237,7 +225,10 @@ mlx5_eswitch_termtbl_required(struct mlx5_eswitch *esw,
+ (!mlx5_eswitch_offload_is_uplink_port(esw, spec) && !esw_attr->int_port))
+ return false;
+
+- if (mlx5_eswitch_is_push_vlan_no_cap(esw, flow_act))
++ /* push vlan on RX */
++ if (flow_act->action & MLX5_FLOW_CONTEXT_ACTION_VLAN_PUSH &&
++ !(mlx5_fs_get_capabilities(esw->dev, MLX5_FLOW_NAMESPACE_FDB) &
++ MLX5_FLOW_STEERING_CAP_VLAN_PUSH_ON_RX))
+ return true;
+
+ /* hairpin */
+@@ -261,31 +252,19 @@ mlx5_eswitch_add_termtbl_rule(struct mlx5_eswitch *esw,
+ struct mlx5_flow_act term_tbl_act = {};
+ struct mlx5_flow_handle *rule = NULL;
+ bool term_table_created = false;
+- bool is_push_vlan_on_rx;
+ int num_vport_dests = 0;
+ int i, curr_dest;
+
+- is_push_vlan_on_rx = mlx5_eswitch_is_push_vlan_no_cap(esw, flow_act);
+ mlx5_eswitch_termtbl_actions_move(flow_act, &term_tbl_act);
+ term_tbl_act.action |= MLX5_FLOW_CONTEXT_ACTION_FWD_DEST;
+
+ for (i = 0; i < num_dest; i++) {
+ struct mlx5_termtbl_handle *tt;
+- bool hairpin = false;
+
+ /* only vport destinations can be terminated */
+ if (dest[i].type != MLX5_FLOW_DESTINATION_TYPE_VPORT)
+ continue;
+
+- if (attr->dests[num_vport_dests].rep &&
+- attr->dests[num_vport_dests].rep->vport == MLX5_VPORT_UPLINK)
+- hairpin = true;
+-
+- if (!is_push_vlan_on_rx && !hairpin) {
+- num_vport_dests++;
+- continue;
+- }
+-
+ if (attr->dests[num_vport_dests].flags & MLX5_ESW_DEST_ENCAP) {
+ term_tbl_act.action |= MLX5_FLOW_CONTEXT_ACTION_PACKET_REFORMAT;
+ term_tbl_act.pkt_reformat = attr->dests[num_vport_dests].pkt_reformat;
+@@ -333,9 +312,6 @@ mlx5_eswitch_add_termtbl_rule(struct mlx5_eswitch *esw,
+ for (curr_dest = 0; curr_dest < num_vport_dests; curr_dest++) {
+ struct mlx5_termtbl_handle *tt = attr->dests[curr_dest].termtbl;
+
+- if (!tt)
+- continue;
+-
+ attr->dests[curr_dest].termtbl = NULL;
+
+ /* search for the destination associated with the
+--
+2.39.2
+
--- /dev/null
+From 4468bbc46ba7cf2f50636863e108df2ddf8aa7ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Apr 2023 10:29:01 -0700
+Subject: Revert "objtool: Support addition to set CFA base"
+
+From: Josh Poimboeuf <jpoimboe@kernel.org>
+
+[ Upstream commit e18398e80c73e3cc7d9c3d2e0bc06a4af8f4f1cb ]
+
+Commit 468af56a7bba ("objtool: Support addition to set CFA base") was
+added as a preparatory patch for arm64 support, but that support never
+came. It triggers a false positive warning on x86, so just revert it
+for now.
+
+Fixes the following warning:
+
+ vmlinux.o: warning: objtool: cdce925_regmap_i2c_write+0xdb: stack state mismatch: cfa1=4+120 cfa2=5+40
+
+Fixes: 468af56a7bba ("objtool: Support addition to set CFA base")
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Josh Poimboeuf <jpoimboe@kernel.org>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://lore.kernel.org/oe-kbuild-all/202304080538.j5G6h1AB-lkp@intel.com/
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/objtool/check.c | 11 -----------
+ 1 file changed, 11 deletions(-)
+
+diff --git a/tools/objtool/check.c b/tools/objtool/check.c
+index f937be1afe65c..f62b85832ae01 100644
+--- a/tools/objtool/check.c
++++ b/tools/objtool/check.c
+@@ -2976,17 +2976,6 @@ static int update_cfi_state(struct instruction *insn,
+ break;
+ }
+
+- if (!cfi->drap && op->src.reg == CFI_SP &&
+- op->dest.reg == CFI_BP && cfa->base == CFI_SP &&
+- check_reg_frame_pos(®s[CFI_BP], -cfa->offset + op->src.offset)) {
+-
+- /* lea disp(%rsp), %rbp */
+- cfa->base = CFI_BP;
+- cfa->offset -= op->src.offset;
+- cfi->bp_scratch = false;
+- break;
+- }
+-
+ if (op->src.reg == CFI_SP && cfa->base == CFI_SP) {
+
+ /* drap: lea disp(%rsp), %drap */
+--
+2.39.2
+
--- /dev/null
+From 4f4f814205edbc1f833d0e3b8525e7aa69b3fd7d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Feb 2023 08:52:31 +0100
+Subject: riscv: Fix ptdump when KASAN is enabled
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alexandre Ghiti <alexghiti@rivosinc.com>
+
+[ Upstream commit ecd7ebaf0b5a094a6180b299a5635c0eea42be4b ]
+
+The KASAN shadow region was moved next to the kernel mapping but the
+ptdump code was not updated and it appears to break the dump of the kernel
+page table, so fix this by moving the KASAN shadow region in ptdump.
+
+Fixes: f7ae02333d13 ("riscv: Move KASAN mapping next to the kernel mapping")
+Signed-off-by: Alexandre Ghiti <alexghiti@rivosinc.com>
+Tested-by: Björn Töpel <bjorn@rivosinc.com>
+Reviewed-by: Björn Töpel <bjorn@rivosinc.com>
+Link: https://lore.kernel.org/r/20230203075232.274282-6-alexghiti@rivosinc.com
+Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/mm/ptdump.c | 24 ++++++++++++------------
+ 1 file changed, 12 insertions(+), 12 deletions(-)
+
+diff --git a/arch/riscv/mm/ptdump.c b/arch/riscv/mm/ptdump.c
+index 830e7de65e3a3..20a9f991a6d74 100644
+--- a/arch/riscv/mm/ptdump.c
++++ b/arch/riscv/mm/ptdump.c
+@@ -59,10 +59,6 @@ struct ptd_mm_info {
+ };
+
+ enum address_markers_idx {
+-#ifdef CONFIG_KASAN
+- KASAN_SHADOW_START_NR,
+- KASAN_SHADOW_END_NR,
+-#endif
+ FIXMAP_START_NR,
+ FIXMAP_END_NR,
+ PCI_IO_START_NR,
+@@ -74,6 +70,10 @@ enum address_markers_idx {
+ VMALLOC_START_NR,
+ VMALLOC_END_NR,
+ PAGE_OFFSET_NR,
++#ifdef CONFIG_KASAN
++ KASAN_SHADOW_START_NR,
++ KASAN_SHADOW_END_NR,
++#endif
+ #ifdef CONFIG_64BIT
+ MODULES_MAPPING_NR,
+ KERNEL_MAPPING_NR,
+@@ -82,10 +82,6 @@ enum address_markers_idx {
+ };
+
+ static struct addr_marker address_markers[] = {
+-#ifdef CONFIG_KASAN
+- {0, "Kasan shadow start"},
+- {0, "Kasan shadow end"},
+-#endif
+ {0, "Fixmap start"},
+ {0, "Fixmap end"},
+ {0, "PCI I/O start"},
+@@ -97,6 +93,10 @@ static struct addr_marker address_markers[] = {
+ {0, "vmalloc() area"},
+ {0, "vmalloc() end"},
+ {0, "Linear mapping"},
++#ifdef CONFIG_KASAN
++ {0, "Kasan shadow start"},
++ {0, "Kasan shadow end"},
++#endif
+ #ifdef CONFIG_64BIT
+ {0, "Modules/BPF mapping"},
+ {0, "Kernel mapping"},
+@@ -362,10 +362,6 @@ static int __init ptdump_init(void)
+ {
+ unsigned int i, j;
+
+-#ifdef CONFIG_KASAN
+- address_markers[KASAN_SHADOW_START_NR].start_address = KASAN_SHADOW_START;
+- address_markers[KASAN_SHADOW_END_NR].start_address = KASAN_SHADOW_END;
+-#endif
+ address_markers[FIXMAP_START_NR].start_address = FIXADDR_START;
+ address_markers[FIXMAP_END_NR].start_address = FIXADDR_TOP;
+ address_markers[PCI_IO_START_NR].start_address = PCI_IO_START;
+@@ -377,6 +373,10 @@ static int __init ptdump_init(void)
+ address_markers[VMALLOC_START_NR].start_address = VMALLOC_START;
+ address_markers[VMALLOC_END_NR].start_address = VMALLOC_END;
+ address_markers[PAGE_OFFSET_NR].start_address = PAGE_OFFSET;
++#ifdef CONFIG_KASAN
++ address_markers[KASAN_SHADOW_START_NR].start_address = KASAN_SHADOW_START;
++ address_markers[KASAN_SHADOW_END_NR].start_address = KASAN_SHADOW_END;
++#endif
+ #ifdef CONFIG_64BIT
+ address_markers[MODULES_MAPPING_NR].start_address = MODULES_VADDR;
+ address_markers[KERNEL_MAPPING_NR].start_address = kernel_map.virt_addr;
+--
+2.39.2
+
--- /dev/null
+From 2ca606d401bb1eb63b2d575062a519cd4a26b776 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Apr 2023 09:30:17 -0700
+Subject: rpmsg: glink: Propagate TX failures in intentless mode as well
+
+From: Bjorn Andersson <quic_bjorande@quicinc.com>
+
+[ Upstream commit 7a68f9fa97357a0f2073c9c31ed4101da4fce93e ]
+
+As support for splitting transmission over several messages using
+TX_DATA_CONT was introduced it does not immediately return the return
+value of qcom_glink_tx().
+
+The result is that in the intentless case (i.e. intent == NULL), the
+code will continue to send all additional chunks. This is wasteful, and
+it's possible that the send operation could incorrectly indicate
+success, if the last chunk fits in the TX fifo.
+
+Fix the condition.
+
+Fixes: 8956927faed3 ("rpmsg: glink: Add TX_DATA_CONT command while sending")
+Reviewed-by: Chris Lew <quic_clew@quicinc.com>
+Signed-off-by: Bjorn Andersson <quic_bjorande@quicinc.com>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230418163018.785524-2-quic_bjorande@quicinc.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rpmsg/qcom_glink_native.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/rpmsg/qcom_glink_native.c b/drivers/rpmsg/qcom_glink_native.c
+index 01d2805fe30f5..62634d020d139 100644
+--- a/drivers/rpmsg/qcom_glink_native.c
++++ b/drivers/rpmsg/qcom_glink_native.c
+@@ -1356,8 +1356,9 @@ static int __qcom_glink_send(struct glink_channel *channel,
+ ret = qcom_glink_tx(glink, &req, sizeof(req), data, chunk_size, wait);
+
+ /* Mark intent available if we failed */
+- if (ret && intent) {
+- intent->in_use = false;
++ if (ret) {
++ if (intent)
++ intent->in_use = false;
+ return ret;
+ }
+
+@@ -1378,8 +1379,9 @@ static int __qcom_glink_send(struct glink_channel *channel,
+ chunk_size, wait);
+
+ /* Mark intent available if we failed */
+- if (ret && intent) {
+- intent->in_use = false;
++ if (ret) {
++ if (intent)
++ intent->in_use = false;
+ break;
+ }
+ }
+--
+2.39.2
+
--- /dev/null
+From 9bd1173b41058983eaf516c74a4222d55aa150e8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 9 Apr 2023 09:25:44 -0700
+Subject: rtc: jz4740: Make sure clock provider gets removed
+
+From: Lars-Peter Clausen <lars@metafoo.de>
+
+[ Upstream commit c7a639dac8e4d7e63450bef2f3a19fb331566fb1 ]
+
+The jz4740 RTC driver registers a clock provider, but never removes it.
+This leaves a stale clock provider behind that references freed clocks when
+the device is unbound.
+
+Use the managed `devm_of_clk_add_hw_provider()` instead of
+`of_clk_add_hw_provider()` to make sure the provider gets automatically
+removed on unbind.
+
+Fixes: 5ddfa148de8c ("rtc: jz4740: Register clock provider for the CLK32K pin")
+Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
+Link: https://lore.kernel.org/r/20230409162544.16155-1-lars@metafoo.de
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-jz4740.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/rtc/rtc-jz4740.c b/drivers/rtc/rtc-jz4740.c
+index 59d279e3e6f5b..36453b008139b 100644
+--- a/drivers/rtc/rtc-jz4740.c
++++ b/drivers/rtc/rtc-jz4740.c
+@@ -414,7 +414,8 @@ static int jz4740_rtc_probe(struct platform_device *pdev)
+ return dev_err_probe(dev, ret,
+ "Unable to register clk32k clock\n");
+
+- ret = of_clk_add_hw_provider(np, of_clk_hw_simple_get, &rtc->clk32k);
++ ret = devm_of_clk_add_hw_provider(dev, of_clk_hw_simple_get,
++ &rtc->clk32k);
+ if (ret)
+ return dev_err_probe(dev, ret,
+ "Unable to register clk32k clock provider\n");
+--
+2.39.2
+
--- /dev/null
+From c491fe442d8228f3e08f6ff18c4c65ec8178a6f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Mar 2023 14:29:04 +0530
+Subject: rtc: k3: handle errors while enabling wake irq
+
+From: Dhruva Gole <d-gole@ti.com>
+
+[ Upstream commit d31d7300ebc0c43021ec48c0e6a3a427386f4617 ]
+
+Due to the potential failure of enable_irq_wake(), it would be better to
+return error if it fails.
+
+Fixes: b09d633575e5 ("rtc: Introduce ti-k3-rtc")
+Cc: Nishanth Menon <nm@ti.com>
+Signed-off-by: Dhruva Gole <d-gole@ti.com>
+Link: https://lore.kernel.org/r/20230323085904.957999-1-d-gole@ti.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-ti-k3.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/rtc/rtc-ti-k3.c b/drivers/rtc/rtc-ti-k3.c
+index ba23163cc0428..0d90fe9233550 100644
+--- a/drivers/rtc/rtc-ti-k3.c
++++ b/drivers/rtc/rtc-ti-k3.c
+@@ -632,7 +632,8 @@ static int __maybe_unused ti_k3_rtc_suspend(struct device *dev)
+ struct ti_k3_rtc *priv = dev_get_drvdata(dev);
+
+ if (device_may_wakeup(dev))
+- enable_irq_wake(priv->irq);
++ return enable_irq_wake(priv->irq);
++
+ return 0;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 3b23ad2971b93fff1a195a7b1cd55ced89d7ca70 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Mar 2023 22:21:42 +0100
+Subject: rtc: meson-vrtc: Use ktime_get_real_ts64() to get the current time
+
+From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+
+[ Upstream commit 0e6255fa3f649170da6bd1a544680589cfae1131 ]
+
+The VRTC alarm register can be programmed with an amount of seconds
+after which the SoC will be woken up by the VRTC timer again. We are
+already converting the alarm time from meson_vrtc_set_alarm() to
+"seconds since 1970". This means we also need to use "seconds since
+1970" for the current time.
+
+This fixes a problem where setting the alarm to one minute in the future
+results in the firmware (which handles wakeup) to output (on the serial
+console) that the system will be woken up in billions of seconds.
+ktime_get_raw_ts64() returns the time since boot, not since 1970. Switch
+to ktime_get_real_ts64() to fix the calculation of the alarm time and to
+make the SoC wake up at the specified date/time. Also the firmware
+(which manages suspend) now prints either 59 or 60 seconds until wakeup
+(depending on how long it takes for the system to enter suspend).
+
+Fixes: 6ef35398e827 ("rtc: Add Amlogic Virtual Wake RTC")
+Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Reviewed-by: Kevin Hilman <khilman@baylibre.com>
+Link: https://lore.kernel.org/r/20230320212142.2355062-1-martin.blumenstingl@googlemail.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-meson-vrtc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/rtc/rtc-meson-vrtc.c b/drivers/rtc/rtc-meson-vrtc.c
+index 1463c86215615..648fa362ec447 100644
+--- a/drivers/rtc/rtc-meson-vrtc.c
++++ b/drivers/rtc/rtc-meson-vrtc.c
+@@ -23,7 +23,7 @@ static int meson_vrtc_read_time(struct device *dev, struct rtc_time *tm)
+ struct timespec64 time;
+
+ dev_dbg(dev, "%s\n", __func__);
+- ktime_get_raw_ts64(&time);
++ ktime_get_real_ts64(&time);
+ rtc_time64_to_tm(time.tv_sec, tm);
+
+ return 0;
+@@ -96,7 +96,7 @@ static int __maybe_unused meson_vrtc_suspend(struct device *dev)
+ long alarm_secs;
+ struct timespec64 time;
+
+- ktime_get_raw_ts64(&time);
++ ktime_get_real_ts64(&time);
+ local_time = time.tv_sec;
+
+ dev_dbg(dev, "alarm_time = %lus, local_time=%lus\n",
+--
+2.39.2
+
--- /dev/null
+From 40f0c415507cf8b4e21280e38f4869f3ea54c717 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 11 Mar 2023 10:40:21 +0100
+Subject: rtc: omap: include header for omap_rtc_power_off_program prototype
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit f69c2b5420497b7a54181ce170d682cbeb1f119f ]
+
+Non-static functions should have a prototype:
+
+ drivers/rtc/rtc-omap.c:410:5: error: no previous prototype for ‘omap_rtc_power_off_program’ [-Werror=missing-prototypes]
+
+Fixes: 6256f7f7f217 ("rtc: OMAP: Add support for rtc-only mode")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Link: https://lore.kernel.org/r/20230311094021.79730-1-krzysztof.kozlowski@linaro.org
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-omap.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/rtc/rtc-omap.c b/drivers/rtc/rtc-omap.c
+index 4d4f3b1a73093..73634a3ccfd3b 100644
+--- a/drivers/rtc/rtc-omap.c
++++ b/drivers/rtc/rtc-omap.c
+@@ -25,6 +25,7 @@
+ #include <linux/platform_device.h>
+ #include <linux/pm_runtime.h>
+ #include <linux/rtc.h>
++#include <linux/rtc/rtc-omap.h>
+
+ /*
+ * The OMAP RTC is a year/month/day/hours/minutes/seconds BCD clock
+--
+2.39.2
+
--- /dev/null
+From 3da4417abea2857bced53e77d041c9b3ca2ba3aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Mar 2023 20:26:42 +0100
+Subject: rtla/timerlat: Fix "Previous IRQ" auto analysis' line
+
+From: Daniel Bristot de Oliveira <bristot@kernel.org>
+
+[ Upstream commit 82253a271aae9271fcf0aaa5e0ecc6dd38fb872b ]
+
+The "Previous IRQ interference" line is misaligned and without
+a \n, breaking the tool's output:
+
+ ## CPU 12 hit stop tracing, analyzing it ##
+ Previous IRQ interference: up to 2.22 us IRQ handler delay: 18.06 us (0.00 %)
+ IRQ latency: 18.52 us
+ Timerlat IRQ duration: 4.41 us (0.00 %)
+ Blocking thread: 216.93 us (0.03 %)
+
+Fix the output:
+
+ ## CPU 7 hit stop tracing, analyzing it ##
+ Previous IRQ interference: up to 8.93 us
+ IRQ handler delay: 0.98 us (0.00 %)
+ IRQ latency: 2.95 us
+ Timerlat IRQ duration: 11.26 us (0.03 %)
+
+Link: https://lore.kernel.org/linux-trace-devel/8b5819077f15ccf24745c9bf3205451e16ee32d9.1679685525.git.bristot@kernel.org
+
+Fixes: 27e348b221f6 ("rtla/timerlat: Add auto-analysis core")
+Cc: Masami Hiramatsu <mhiramat@kernel.org>
+Signed-off-by: Daniel Bristot de Oliveira <bristot@kernel.org>
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/tracing/rtla/src/timerlat_aa.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/tracing/rtla/src/timerlat_aa.c b/tools/tracing/rtla/src/timerlat_aa.c
+index ec4e0f4b0e6cd..1843fff66da5b 100644
+--- a/tools/tracing/rtla/src/timerlat_aa.c
++++ b/tools/tracing/rtla/src/timerlat_aa.c
+@@ -548,7 +548,7 @@ static void timerlat_thread_analysis(struct timerlat_aa_data *taa_data, int cpu,
+ exp_irq_ts = taa_data->timer_irq_start_time - taa_data->timer_irq_start_delay;
+
+ if (exp_irq_ts < taa_data->prev_irq_timstamp + taa_data->prev_irq_duration)
+- printf(" Previous IRQ interference: \t up to %9.2f us",
++ printf(" Previous IRQ interference: \t\t up to %9.2f us\n",
+ ns_to_usf(taa_data->prev_irq_duration));
+
+ /*
+--
+2.39.2
+
--- /dev/null
+From 8dae3a341d4deaabccf9b6d34936eeeba704932e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Apr 2023 10:47:30 +0100
+Subject: rv: Fix addition on an uninitialized variable 'run'
+
+From: Colin Ian King <colin.i.king@gmail.com>
+
+[ Upstream commit 54a0dffa62de0c91b406ff32082a121ccfa0d7f1 ]
+
+The variable run is not initialized however it is being accumulated
+by the return value from the call to ikm_run_monitor. Fix this by
+initializing run to zero at the start of the function.
+
+Link: https://lkml.kernel.org/r/20230424094730.105313-1-colin.i.king@gmail.com
+
+Fixes: 4bc4b131d44c ("rv: Add rv tool")
+
+Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
+Acked-by: Daniel Bristot de Oliveira <bristot@kernel.org>
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/verification/rv/src/rv.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/verification/rv/src/rv.c b/tools/verification/rv/src/rv.c
+index e601cd9c411e1..1ddb855328165 100644
+--- a/tools/verification/rv/src/rv.c
++++ b/tools/verification/rv/src/rv.c
+@@ -74,7 +74,7 @@ static void rv_list(int argc, char **argv)
+ static void rv_mon(int argc, char **argv)
+ {
+ char *monitor_name;
+- int i, run;
++ int i, run = 0;
+
+ static const char *const usage[] = {
+ "",
+--
+2.39.2
+
--- /dev/null
+From 4f50515a96e14fb93001506f50b886ec45a8567a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Apr 2023 17:16:17 +0100
+Subject: rxrpc: Fix error when reading rxrpc tokens
+
+From: Marc Dionne <marc.dionne@auristor.com>
+
+[ Upstream commit fadfc57cc8047080a123b16f288b7138524fb1e2 ]
+
+When converting from ASSERTCMP to WARN_ON, the tested condition must
+be inverted, which was missed for this case.
+
+This would cause an EIO error when trying to read an rxrpc token, for
+instance when trying to display tokens with AuriStor's "tokens" command.
+
+Fixes: 84924aac08a4 ("rxrpc: Fix checker warning")
+Signed-off-by: Marc Dionne <marc.dionne@auristor.com>
+Signed-off-by: David Howells <dhowells@redhat.com>
+cc: "David S. Miller" <davem@davemloft.net>
+cc: Eric Dumazet <edumazet@google.com>
+cc: Jakub Kicinski <kuba@kernel.org>
+cc: Paolo Abeni <pabeni@redhat.com>
+cc: linux-afs@lists.infradead.org
+cc: netdev@vger.kernel.org
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/rxrpc/key.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/rxrpc/key.c b/net/rxrpc/key.c
+index 8d53aded09c42..33e8302a79e33 100644
+--- a/net/rxrpc/key.c
++++ b/net/rxrpc/key.c
+@@ -680,7 +680,7 @@ static long rxrpc_read(const struct key *key,
+ return -ENOPKG;
+ }
+
+- if (WARN_ON((unsigned long)xdr - (unsigned long)oldxdr ==
++ if (WARN_ON((unsigned long)xdr - (unsigned long)oldxdr !=
+ toksize))
+ return -EIO;
+ }
+--
+2.39.2
+
--- /dev/null
+From b860e1cfc52791811685d0324cc1695363e9e9df Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Feb 2023 14:27:45 +0100
+Subject: s390/boot: remove non-functioning image bootable check
+
+From: Vasily Gorbik <gor@linux.ibm.com>
+
+[ Upstream commit 53fcc7dbf17691d8eac382ee315970a75286dd4b ]
+
+check_image_bootable() has been introduced with commit 627c9b62058e
+("s390/boot: block uncompressed vmlinux booting attempts") to make sure
+that users don't try to boot uncompressed vmlinux ELF image in qemu. It
+used to be possible quite some time ago. That commit prevented confusion
+with uncompressed vmlinux image starting to boot and even printing
+kernel messages until it crashed. Users might have tried to report the
+problem without realizing they are doing something which was not intended.
+Since commit f1d3c5323772 ("s390/boot: move sclp early buffer from fixed
+address in asm to C") check_image_bootable() doesn't function properly
+anymore, as well as booting uncompressed vmlinux image in qemu doesn't
+really produce any output and crashes. Moving forward it doesn't make
+sense to fix check_image_bootable() anymore, so simply remove it.
+
+Acked-by: Alexander Gordeev <agordeev@linux.ibm.com>
+Acked-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Stable-dep-of: 81e847964985 ("s390/mm: fix direct map accounting")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/boot/startup.c | 1 -
+ arch/s390/include/asm/setup.h | 2 --
+ arch/s390/kernel/early.c | 14 --------------
+ 3 files changed, 17 deletions(-)
+
+diff --git a/arch/s390/boot/startup.c b/arch/s390/boot/startup.c
+index 11413f0baabcb..16ee3469f7446 100644
+--- a/arch/s390/boot/startup.c
++++ b/arch/s390/boot/startup.c
+@@ -29,7 +29,6 @@ unsigned long __bootdata_preserved(vmemmap_size);
+ unsigned long __bootdata_preserved(MODULES_VADDR);
+ unsigned long __bootdata_preserved(MODULES_END);
+ unsigned long __bootdata(ident_map_size);
+-int __bootdata(is_full_image) = 1;
+ struct initrd_data __bootdata(initrd_data);
+
+ u64 __bootdata_preserved(stfle_fac_list[16]);
+diff --git a/arch/s390/include/asm/setup.h b/arch/s390/include/asm/setup.h
+index 3a1f8825bc7d7..fc887e3e76f84 100644
+--- a/arch/s390/include/asm/setup.h
++++ b/arch/s390/include/asm/setup.h
+@@ -150,8 +150,6 @@ static inline unsigned long kaslr_offset(void)
+ return __kaslr_offset;
+ }
+
+-extern int is_full_image;
+-
+ struct initrd_data {
+ unsigned long start;
+ unsigned long size;
+diff --git a/arch/s390/kernel/early.c b/arch/s390/kernel/early.c
+index d26f02495636e..8225a4c1f2e28 100644
+--- a/arch/s390/kernel/early.c
++++ b/arch/s390/kernel/early.c
+@@ -34,8 +34,6 @@
+ #include <asm/switch_to.h>
+ #include "entry.h"
+
+-int __bootdata(is_full_image);
+-
+ #define decompressor_handled_param(param) \
+ static int __init ignore_decompressor_param_##param(char *s) \
+ { \
+@@ -288,17 +286,6 @@ static void __init setup_boot_command_line(void)
+ strscpy(boot_command_line, early_command_line, COMMAND_LINE_SIZE);
+ }
+
+-static void __init check_image_bootable(void)
+-{
+- if (is_full_image)
+- return;
+-
+- sclp_early_printk("Linux kernel boot failure: An attempt to boot a vmlinux ELF image failed.\n");
+- sclp_early_printk("This image does not contain all parts necessary for starting up. Use\n");
+- sclp_early_printk("bzImage or arch/s390/boot/compressed/vmlinux instead.\n");
+- disabled_wait();
+-}
+-
+ static void __init sort_amode31_extable(void)
+ {
+ sort_extable(__start_amode31_ex_table, __stop_amode31_ex_table);
+@@ -307,7 +294,6 @@ static void __init sort_amode31_extable(void)
+ void __init startup_init(void)
+ {
+ reset_tod_clock();
+- check_image_bootable();
+ time_early_init();
+ init_kernel_storage_key();
+ lockdep_off();
+--
+2.39.2
+
--- /dev/null
+From 252e2d1a9ed8663b59fb8ac6bfc4d0834e092694 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Feb 2023 18:11:25 +0100
+Subject: s390/boot: rename mem_detect to physmem_info
+
+From: Vasily Gorbik <gor@linux.ibm.com>
+
+[ Upstream commit 8c37cb7d4ffcc827a9484282691b018715a5ae1a ]
+
+In preparation to extending mem_detect with additional information like
+reserved ranges rename it to more generic physmem_info. This new naming
+also help to avoid confusion by using more exact terms like "physmem
+online ranges", etc.
+
+Acked-by: Heiko Carstens <hca@linux.ibm.com>
+Reviewed-by: Alexander Gordeev <agordeev@linux.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Stable-dep-of: 81e847964985 ("s390/mm: fix direct map accounting")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/boot/Makefile | 2 +-
+ arch/s390/boot/boot.h | 2 +-
+ arch/s390/boot/kaslr.c | 14 +--
+ .../boot/{mem_detect.c => physmem_info.c} | 76 +++++------
+ arch/s390/boot/startup.c | 6 +-
+ arch/s390/boot/vmem.c | 6 +-
+ arch/s390/include/asm/mem_detect.h | 117 -----------------
+ arch/s390/include/asm/physmem_info.h | 118 ++++++++++++++++++
+ arch/s390/kernel/setup.c | 28 ++---
+ arch/s390/mm/kasan_init.c | 6 +-
+ drivers/s390/char/sclp_early_core.c | 8 +-
+ 11 files changed, 192 insertions(+), 191 deletions(-)
+ rename arch/s390/boot/{mem_detect.c => physmem_info.c} (63%)
+ delete mode 100644 arch/s390/include/asm/mem_detect.h
+ create mode 100644 arch/s390/include/asm/physmem_info.h
+
+diff --git a/arch/s390/boot/Makefile b/arch/s390/boot/Makefile
+index cebd4ca169164..c7c81e5f92189 100644
+--- a/arch/s390/boot/Makefile
++++ b/arch/s390/boot/Makefile
+@@ -35,7 +35,7 @@ endif
+
+ CFLAGS_sclp_early_core.o += -I$(srctree)/drivers/s390/char
+
+-obj-y := head.o als.o startup.o mem_detect.o ipl_parm.o ipl_report.o vmem.o
++obj-y := head.o als.o startup.o physmem_info.o ipl_parm.o ipl_report.o vmem.o
+ obj-y += string.o ebcdic.o sclp_early_core.o mem.o ipl_vmparm.o cmdline.o
+ obj-y += version.o pgm_check_info.o ctype.o ipl_data.o machine_kexec_reloc.o
+ obj-$(findstring y, $(CONFIG_PROTECTED_VIRTUALIZATION_GUEST) $(CONFIG_PGSTE)) += uv.o
+diff --git a/arch/s390/boot/boot.h b/arch/s390/boot/boot.h
+index 58ce701d61104..d39895d5796ed 100644
+--- a/arch/s390/boot/boot.h
++++ b/arch/s390/boot/boot.h
+@@ -34,7 +34,7 @@ struct vmlinux_info {
+
+ void startup_kernel(void);
+ unsigned long detect_memory(unsigned long *safe_addr);
+-void mem_detect_set_usable_limit(unsigned long limit);
++void physmem_set_usable_limit(unsigned long limit);
+ bool is_ipl_block_dump(void);
+ void store_ipl_parmblock(void);
+ unsigned long read_ipl_report(unsigned long safe_addr);
+diff --git a/arch/s390/boot/kaslr.c b/arch/s390/boot/kaslr.c
+index 3e3d846400b4e..22b7c5d8e94a6 100644
+--- a/arch/s390/boot/kaslr.c
++++ b/arch/s390/boot/kaslr.c
+@@ -3,7 +3,7 @@
+ * Copyright IBM Corp. 2019
+ */
+ #include <linux/pgtable.h>
+-#include <asm/mem_detect.h>
++#include <asm/physmem_info.h>
+ #include <asm/cpacf.h>
+ #include <asm/timex.h>
+ #include <asm/sclp.h>
+@@ -93,7 +93,7 @@ static int get_random(unsigned long limit, unsigned long *value)
+
+ /*
+ * To randomize kernel base address we have to consider several facts:
+- * 1. physical online memory might not be continuous and have holes. mem_detect
++ * 1. physical online memory might not be continuous and have holes. physmem
+ * info contains list of online memory ranges we should consider.
+ * 2. we have several memory regions which are occupied and we should not
+ * overlap and destroy them. Currently safe_addr tells us the border below
+@@ -108,7 +108,7 @@ static int get_random(unsigned long limit, unsigned long *value)
+ * (16 pages when the kernel is built with kasan enabled)
+ * Assumptions:
+ * 1. kernel size (including .bss size) and upper memory limit are page aligned.
+- * 2. mem_detect memory region start is THREAD_SIZE aligned / end is PAGE_SIZE
++ * 2. physmem online region start is THREAD_SIZE aligned / end is PAGE_SIZE
+ * aligned (in practice memory configurations granularity on z/VM and LPAR
+ * is 1mb).
+ *
+@@ -132,7 +132,7 @@ static unsigned long count_valid_kernel_positions(unsigned long kernel_size,
+ unsigned long start, end, pos = 0;
+ int i;
+
+- for_each_mem_detect_usable_block(i, &start, &end) {
++ for_each_physmem_usable_range(i, &start, &end) {
+ if (_min >= end)
+ continue;
+ if (start >= _max)
+@@ -153,7 +153,7 @@ static unsigned long position_to_address(unsigned long pos, unsigned long kernel
+ unsigned long start, end;
+ int i;
+
+- for_each_mem_detect_usable_block(i, &start, &end) {
++ for_each_physmem_usable_range(i, &start, &end) {
+ if (_min >= end)
+ continue;
+ if (start >= _max)
+@@ -172,8 +172,8 @@ static unsigned long position_to_address(unsigned long pos, unsigned long kernel
+
+ unsigned long get_random_base(unsigned long safe_addr)
+ {
+- unsigned long usable_total = get_mem_detect_usable_total();
+- unsigned long memory_limit = get_mem_detect_end();
++ unsigned long usable_total = get_physmem_usable_total();
++ unsigned long memory_limit = get_physmem_usable_end();
+ unsigned long base_pos, max_pos, kernel_size;
+ int i;
+
+diff --git a/arch/s390/boot/mem_detect.c b/arch/s390/boot/physmem_info.c
+similarity index 63%
+rename from arch/s390/boot/mem_detect.c
+rename to arch/s390/boot/physmem_info.c
+index 35f4ba11f7fd4..dc2e4d0abfab0 100644
+--- a/arch/s390/boot/mem_detect.c
++++ b/arch/s390/boot/physmem_info.c
+@@ -5,44 +5,44 @@
+ #include <asm/processor.h>
+ #include <asm/sclp.h>
+ #include <asm/sections.h>
+-#include <asm/mem_detect.h>
++#include <asm/physmem_info.h>
+ #include <asm/sparsemem.h>
+ #include "decompressor.h"
+ #include "boot.h"
+
+-struct mem_detect_info __bootdata(mem_detect);
++struct physmem_info __bootdata(physmem_info);
+
+ /* up to 256 storage elements, 1020 subincrements each */
+ #define ENTRIES_EXTENDED_MAX \
+- (256 * (1020 / 2) * sizeof(struct mem_detect_block))
++ (256 * (1020 / 2) * sizeof(struct physmem_range))
+
+-static struct mem_detect_block *__get_mem_detect_block_ptr(u32 n)
++static struct physmem_range *__get_physmem_range_ptr(u32 n)
+ {
+ if (n < MEM_INLINED_ENTRIES)
+- return &mem_detect.entries[n];
+- return &mem_detect.entries_extended[n - MEM_INLINED_ENTRIES];
++ return &physmem_info.online[n];
++ return &physmem_info.online_extended[n - MEM_INLINED_ENTRIES];
+ }
+
+ /*
+- * sequential calls to add_mem_detect_block with adjacent memory areas
+- * are merged together into single memory block.
++ * sequential calls to add_physmem_online_range with adjacent memory ranges
++ * are merged together into single memory range.
+ */
+-void add_mem_detect_block(u64 start, u64 end)
++void add_physmem_online_range(u64 start, u64 end)
+ {
+- struct mem_detect_block *block;
++ struct physmem_range *range;
+
+- if (mem_detect.count) {
+- block = __get_mem_detect_block_ptr(mem_detect.count - 1);
+- if (block->end == start) {
+- block->end = end;
++ if (physmem_info.range_count) {
++ range = __get_physmem_range_ptr(physmem_info.range_count - 1);
++ if (range->end == start) {
++ range->end = end;
+ return;
+ }
+ }
+
+- block = __get_mem_detect_block_ptr(mem_detect.count);
+- block->start = start;
+- block->end = end;
+- mem_detect.count++;
++ range = __get_physmem_range_ptr(physmem_info.range_count);
++ range->start = start;
++ range->end = end;
++ physmem_info.range_count++;
+ }
+
+ static int __diag260(unsigned long rx1, unsigned long rx2)
+@@ -95,7 +95,7 @@ static int diag260(void)
+ return -1;
+
+ for (i = 0; i < min_t(int, rc, ARRAY_SIZE(storage_extents)); i++)
+- add_mem_detect_block(storage_extents[i].start, storage_extents[i].end + 1);
++ add_physmem_online_range(storage_extents[i].start, storage_extents[i].end + 1);
+ return 0;
+ }
+
+@@ -148,44 +148,44 @@ unsigned long detect_memory(unsigned long *safe_addr)
+ unsigned long max_physmem_end = 0;
+
+ sclp_early_get_memsize(&max_physmem_end);
+- mem_detect.entries_extended = (struct mem_detect_block *)ALIGN(*safe_addr, sizeof(u64));
++ physmem_info.online_extended = (struct physmem_range *)ALIGN(*safe_addr, sizeof(u64));
+
+ if (!sclp_early_read_storage_info()) {
+- mem_detect.info_source = MEM_DETECT_SCLP_STOR_INFO;
++ physmem_info.info_source = MEM_DETECT_SCLP_STOR_INFO;
+ } else if (!diag260()) {
+- mem_detect.info_source = MEM_DETECT_DIAG260;
+- max_physmem_end = max_physmem_end ?: get_mem_detect_end();
++ physmem_info.info_source = MEM_DETECT_DIAG260;
++ max_physmem_end = max_physmem_end ?: get_physmem_usable_end();
+ } else if (max_physmem_end) {
+- add_mem_detect_block(0, max_physmem_end);
+- mem_detect.info_source = MEM_DETECT_SCLP_READ_INFO;
++ add_physmem_online_range(0, max_physmem_end);
++ physmem_info.info_source = MEM_DETECT_SCLP_READ_INFO;
+ } else {
+ max_physmem_end = search_mem_end();
+- add_mem_detect_block(0, max_physmem_end);
+- mem_detect.info_source = MEM_DETECT_BIN_SEARCH;
++ add_physmem_online_range(0, max_physmem_end);
++ physmem_info.info_source = MEM_DETECT_BIN_SEARCH;
+ }
+
+- if (mem_detect.count > MEM_INLINED_ENTRIES) {
+- *safe_addr += (mem_detect.count - MEM_INLINED_ENTRIES) *
+- sizeof(struct mem_detect_block);
++ if (physmem_info.range_count > MEM_INLINED_ENTRIES) {
++ *safe_addr += (physmem_info.range_count - MEM_INLINED_ENTRIES) *
++ sizeof(struct physmem_range);
+ }
+
+ return max_physmem_end;
+ }
+
+-void mem_detect_set_usable_limit(unsigned long limit)
++void physmem_set_usable_limit(unsigned long limit)
+ {
+- struct mem_detect_block *block;
++ struct physmem_range *range;
+ int i;
+
+ /* make sure mem_detect.usable ends up within online memory block */
+- for (i = 0; i < mem_detect.count; i++) {
+- block = __get_mem_detect_block_ptr(i);
+- if (block->start >= limit)
++ for (i = 0; i < physmem_info.range_count; i++) {
++ range = __get_physmem_range_ptr(i);
++ if (range->start >= limit)
+ break;
+- if (block->end >= limit) {
+- mem_detect.usable = limit;
++ if (range->end >= limit) {
++ physmem_info.usable = limit;
+ break;
+ }
+- mem_detect.usable = block->end;
++ physmem_info.usable = range->end;
+ }
+ }
+diff --git a/arch/s390/boot/startup.c b/arch/s390/boot/startup.c
+index 16ee3469f7446..50475bf25ecda 100644
+--- a/arch/s390/boot/startup.c
++++ b/arch/s390/boot/startup.c
+@@ -12,7 +12,7 @@
+ #include <asm/diag.h>
+ #include <asm/uv.h>
+ #include <asm/abs_lowcore.h>
+-#include <asm/mem_detect.h>
++#include <asm/physmem_info.h>
+ #include "decompressor.h"
+ #include "boot.h"
+ #include "uv.h"
+@@ -139,7 +139,7 @@ static void handle_relocs(unsigned long offset)
+ *
+ * Consider the following factors:
+ * 1. max_physmem_end - end of physical memory online or standby.
+- * Always <= end of the last online memory block (get_mem_detect_end()).
++ * Always >= end of the last online memory range (get_physmem_online_end()).
+ * 2. CONFIG_MAX_PHYSMEM_BITS - the maximum size of physical memory the
+ * kernel is able to support.
+ * 3. "mem=" kernel command line option which limits physical memory usage.
+@@ -303,7 +303,7 @@ void startup_kernel(void)
+ setup_ident_map_size(max_physmem_end);
+ setup_vmalloc_size();
+ asce_limit = setup_kernel_memory_layout();
+- mem_detect_set_usable_limit(ident_map_size);
++ physmem_set_usable_limit(ident_map_size);
+
+ if (IS_ENABLED(CONFIG_RANDOMIZE_BASE) && kaslr_enabled) {
+ random_lma = get_random_base(safe_addr);
+diff --git a/arch/s390/boot/vmem.c b/arch/s390/boot/vmem.c
+index 4d1d0d8e99cb2..b89a6893f398b 100644
+--- a/arch/s390/boot/vmem.c
++++ b/arch/s390/boot/vmem.c
+@@ -4,7 +4,7 @@
+ #include <asm/pgalloc.h>
+ #include <asm/facility.h>
+ #include <asm/sections.h>
+-#include <asm/mem_detect.h>
++#include <asm/physmem_info.h>
+ #include <asm/maccess.h>
+ #include <asm/abs_lowcore.h>
+ #include "decompressor.h"
+@@ -51,7 +51,7 @@ static void pgtable_populate_init(void)
+ pgalloc_low = max(pgalloc_low, initrd_end);
+ }
+
+- pgalloc_end = round_down(get_mem_detect_end(), PAGE_SIZE);
++ pgalloc_end = round_down(get_physmem_usable_end(), PAGE_SIZE);
+ pgalloc_pos = pgalloc_end;
+
+ boot_check_oom();
+@@ -252,7 +252,7 @@ void setup_vmem(unsigned long asce_limit)
+ */
+ pgtable_populate_init();
+ pgtable_populate(0, sizeof(struct lowcore), POPULATE_ONE2ONE);
+- for_each_mem_detect_usable_block(i, &start, &end)
++ for_each_physmem_usable_range(i, &start, &end)
+ pgtable_populate(start, end, POPULATE_ONE2ONE);
+ pgtable_populate(__abs_lowcore, __abs_lowcore + sizeof(struct lowcore),
+ POPULATE_ABS_LOWCORE);
+diff --git a/arch/s390/include/asm/mem_detect.h b/arch/s390/include/asm/mem_detect.h
+deleted file mode 100644
+index f9e7354036d23..0000000000000
+--- a/arch/s390/include/asm/mem_detect.h
++++ /dev/null
+@@ -1,117 +0,0 @@
+-/* SPDX-License-Identifier: GPL-2.0 */
+-#ifndef _ASM_S390_MEM_DETECT_H
+-#define _ASM_S390_MEM_DETECT_H
+-
+-#include <linux/types.h>
+-
+-enum mem_info_source {
+- MEM_DETECT_NONE = 0,
+- MEM_DETECT_SCLP_STOR_INFO,
+- MEM_DETECT_DIAG260,
+- MEM_DETECT_SCLP_READ_INFO,
+- MEM_DETECT_BIN_SEARCH
+-};
+-
+-struct mem_detect_block {
+- u64 start;
+- u64 end;
+-};
+-
+-/*
+- * Storage element id is defined as 1 byte (up to 256 storage elements).
+- * In practise only storage element id 0 and 1 are used).
+- * According to architecture one storage element could have as much as
+- * 1020 subincrements. 255 mem_detect_blocks are embedded in mem_detect_info.
+- * If more mem_detect_blocks are required, a block of memory from already
+- * known mem_detect_block is taken (entries_extended points to it).
+- */
+-#define MEM_INLINED_ENTRIES 255 /* (PAGE_SIZE - 16) / 16 */
+-
+-struct mem_detect_info {
+- u32 count;
+- u8 info_source;
+- unsigned long usable;
+- struct mem_detect_block entries[MEM_INLINED_ENTRIES];
+- struct mem_detect_block *entries_extended;
+-};
+-extern struct mem_detect_info mem_detect;
+-
+-void add_mem_detect_block(u64 start, u64 end);
+-
+-static inline int __get_mem_detect_block(u32 n, unsigned long *start,
+- unsigned long *end, bool respect_usable_limit)
+-{
+- if (n >= mem_detect.count) {
+- *start = 0;
+- *end = 0;
+- return -1;
+- }
+-
+- if (n < MEM_INLINED_ENTRIES) {
+- *start = (unsigned long)mem_detect.entries[n].start;
+- *end = (unsigned long)mem_detect.entries[n].end;
+- } else {
+- *start = (unsigned long)mem_detect.entries_extended[n - MEM_INLINED_ENTRIES].start;
+- *end = (unsigned long)mem_detect.entries_extended[n - MEM_INLINED_ENTRIES].end;
+- }
+-
+- if (respect_usable_limit && mem_detect.usable) {
+- if (*start >= mem_detect.usable)
+- return -1;
+- if (*end > mem_detect.usable)
+- *end = mem_detect.usable;
+- }
+- return 0;
+-}
+-
+-/**
+- * for_each_mem_detect_usable_block - early online memory range iterator
+- * @i: an integer used as loop variable
+- * @p_start: ptr to unsigned long for start address of the range
+- * @p_end: ptr to unsigned long for end address of the range
+- *
+- * Walks over detected online memory ranges below usable limit.
+- */
+-#define for_each_mem_detect_usable_block(i, p_start, p_end) \
+- for (i = 0; !__get_mem_detect_block(i, p_start, p_end, true); i++)
+-
+-/* Walks over all detected online memory ranges disregarding usable limit. */
+-#define for_each_mem_detect_block(i, p_start, p_end) \
+- for (i = 0; !__get_mem_detect_block(i, p_start, p_end, false); i++)
+-
+-static inline unsigned long get_mem_detect_usable_total(void)
+-{
+- unsigned long start, end, total = 0;
+- int i;
+-
+- for_each_mem_detect_usable_block(i, &start, &end)
+- total += end - start;
+-
+- return total;
+-}
+-
+-static inline void get_mem_detect_reserved(unsigned long *start,
+- unsigned long *size)
+-{
+- *start = (unsigned long)mem_detect.entries_extended;
+- if (mem_detect.count > MEM_INLINED_ENTRIES)
+- *size = (mem_detect.count - MEM_INLINED_ENTRIES) * sizeof(struct mem_detect_block);
+- else
+- *size = 0;
+-}
+-
+-static inline unsigned long get_mem_detect_end(void)
+-{
+- unsigned long start;
+- unsigned long end;
+-
+- if (mem_detect.usable)
+- return mem_detect.usable;
+- if (mem_detect.count) {
+- __get_mem_detect_block(mem_detect.count - 1, &start, &end, false);
+- return end;
+- }
+- return 0;
+-}
+-
+-#endif
+diff --git a/arch/s390/include/asm/physmem_info.h b/arch/s390/include/asm/physmem_info.h
+new file mode 100644
+index 0000000000000..d5e65a5d06e7f
+--- /dev/null
++++ b/arch/s390/include/asm/physmem_info.h
+@@ -0,0 +1,118 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++#ifndef _ASM_S390_MEM_DETECT_H
++#define _ASM_S390_MEM_DETECT_H
++
++#include <linux/types.h>
++
++enum physmem_info_source {
++ MEM_DETECT_NONE = 0,
++ MEM_DETECT_SCLP_STOR_INFO,
++ MEM_DETECT_DIAG260,
++ MEM_DETECT_SCLP_READ_INFO,
++ MEM_DETECT_BIN_SEARCH
++};
++
++struct physmem_range {
++ u64 start;
++ u64 end;
++};
++
++/*
++ * Storage element id is defined as 1 byte (up to 256 storage elements).
++ * In practise only storage element id 0 and 1 are used).
++ * According to architecture one storage element could have as much as
++ * 1020 subincrements. 255 physmem_ranges are embedded in physmem_info.
++ * If more physmem_ranges are required, a block of memory from already
++ * known physmem_range is taken (online_extended points to it).
++ */
++#define MEM_INLINED_ENTRIES 255 /* (PAGE_SIZE - 16) / 16 */
++
++struct physmem_info {
++ u32 range_count;
++ u8 info_source;
++ unsigned long usable;
++ struct physmem_range online[MEM_INLINED_ENTRIES];
++ struct physmem_range *online_extended;
++};
++
++extern struct physmem_info physmem_info;
++
++void add_physmem_online_range(u64 start, u64 end);
++
++static inline int __get_physmem_range(u32 n, unsigned long *start,
++ unsigned long *end, bool respect_usable_limit)
++{
++ if (n >= physmem_info.range_count) {
++ *start = 0;
++ *end = 0;
++ return -1;
++ }
++
++ if (n < MEM_INLINED_ENTRIES) {
++ *start = (unsigned long)physmem_info.online[n].start;
++ *end = (unsigned long)physmem_info.online[n].end;
++ } else {
++ *start = (unsigned long)physmem_info.online_extended[n - MEM_INLINED_ENTRIES].start;
++ *end = (unsigned long)physmem_info.online_extended[n - MEM_INLINED_ENTRIES].end;
++ }
++
++ if (respect_usable_limit && physmem_info.usable) {
++ if (*start >= physmem_info.usable)
++ return -1;
++ if (*end > physmem_info.usable)
++ *end = physmem_info.usable;
++ }
++ return 0;
++}
++
++/**
++ * for_each_physmem_usable_range - early online memory range iterator
++ * @i: an integer used as loop variable
++ * @p_start: ptr to unsigned long for start address of the range
++ * @p_end: ptr to unsigned long for end address of the range
++ *
++ * Walks over detected online memory ranges below usable limit.
++ */
++#define for_each_physmem_usable_range(i, p_start, p_end) \
++ for (i = 0; !__get_physmem_range(i, p_start, p_end, true); i++)
++
++/* Walks over all detected online memory ranges disregarding usable limit. */
++#define for_each_physmem_online_range(i, p_start, p_end) \
++ for (i = 0; !__get_physmem_range(i, p_start, p_end, false); i++)
++
++static inline unsigned long get_physmem_usable_total(void)
++{
++ unsigned long start, end, total = 0;
++ int i;
++
++ for_each_physmem_usable_range(i, &start, &end)
++ total += end - start;
++
++ return total;
++}
++
++static inline void get_physmem_reserved(unsigned long *start, unsigned long *size)
++{
++ *start = (unsigned long)physmem_info.online_extended;
++ if (physmem_info.range_count > MEM_INLINED_ENTRIES)
++ *size = (physmem_info.range_count - MEM_INLINED_ENTRIES) *
++ sizeof(struct physmem_range);
++ else
++ *size = 0;
++}
++
++static inline unsigned long get_physmem_usable_end(void)
++{
++ unsigned long start;
++ unsigned long end;
++
++ if (physmem_info.usable)
++ return physmem_info.usable;
++ if (physmem_info.range_count) {
++ __get_physmem_range(physmem_info.range_count - 1, &start, &end, false);
++ return end;
++ }
++ return 0;
++}
++
++#endif
+diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
+index 8ec5cdf9dadc7..f909a2dc8a5a2 100644
+--- a/arch/s390/kernel/setup.c
++++ b/arch/s390/kernel/setup.c
+@@ -74,7 +74,7 @@
+ #include <asm/numa.h>
+ #include <asm/alternative.h>
+ #include <asm/nospec-branch.h>
+-#include <asm/mem_detect.h>
++#include <asm/physmem_info.h>
+ #include <asm/maccess.h>
+ #include <asm/uv.h>
+ #include <asm/asm-offsets.h>
+@@ -147,7 +147,7 @@ static u32 __amode31_ref *__ctl_duct = __ctl_duct_amode31;
+
+ int __bootdata(noexec_disabled);
+ unsigned long __bootdata(ident_map_size);
+-struct mem_detect_info __bootdata(mem_detect);
++struct physmem_info __bootdata(physmem_info);
+ struct initrd_data __bootdata(initrd_data);
+ unsigned long __bootdata(pgalloc_pos);
+ unsigned long __bootdata(pgalloc_end);
+@@ -730,27 +730,27 @@ static void __init reserve_certificate_list(void)
+ memblock_reserve(ipl_cert_list_addr, ipl_cert_list_size);
+ }
+
+-static void __init reserve_mem_detect_info(void)
++static void __init reserve_physmem_info(void)
+ {
+ unsigned long start, size;
+
+- get_mem_detect_reserved(&start, &size);
++ get_physmem_reserved(&start, &size);
+ if (size)
+ memblock_reserve(start, size);
+ }
+
+-static void __init free_mem_detect_info(void)
++static void __init free_physmem_info(void)
+ {
+ unsigned long start, size;
+
+- get_mem_detect_reserved(&start, &size);
++ get_physmem_reserved(&start, &size);
+ if (size)
+ memblock_phys_free(start, size);
+ }
+
+ static const char * __init get_mem_info_source(void)
+ {
+- switch (mem_detect.info_source) {
++ switch (physmem_info.info_source) {
+ case MEM_DETECT_SCLP_STOR_INFO:
+ return "sclp storage info";
+ case MEM_DETECT_DIAG260:
+@@ -763,18 +763,18 @@ static const char * __init get_mem_info_source(void)
+ return "none";
+ }
+
+-static void __init memblock_add_mem_detect_info(void)
++static void __init memblock_add_physmem_info(void)
+ {
+ unsigned long start, end;
+ int i;
+
+ pr_debug("physmem info source: %s (%hhd)\n",
+- get_mem_info_source(), mem_detect.info_source);
++ get_mem_info_source(), physmem_info.info_source);
+ /* keep memblock lists close to the kernel */
+ memblock_set_bottom_up(true);
+- for_each_mem_detect_usable_block(i, &start, &end)
++ for_each_physmem_usable_range(i, &start, &end)
+ memblock_add(start, end - start);
+- for_each_mem_detect_block(i, &start, &end)
++ for_each_physmem_online_range(i, &start, &end)
+ memblock_physmem_add(start, end - start);
+ memblock_set_bottom_up(false);
+ memblock_set_node(0, ULONG_MAX, &memblock.memory, 0);
+@@ -997,14 +997,14 @@ void __init setup_arch(char **cmdline_p)
+ reserve_kernel();
+ reserve_initrd();
+ reserve_certificate_list();
+- reserve_mem_detect_info();
++ reserve_physmem_info();
+ memblock_set_current_limit(ident_map_size);
+ memblock_allow_resize();
+
+ /* Get information about *all* installed memory */
+- memblock_add_mem_detect_info();
++ memblock_add_physmem_info();
+
+- free_mem_detect_info();
++ free_physmem_info();
+ setup_memory_end();
+ memblock_dump_all();
+ setup_memory();
+diff --git a/arch/s390/mm/kasan_init.c b/arch/s390/mm/kasan_init.c
+index ef89a5f26853d..b0658136264ff 100644
+--- a/arch/s390/mm/kasan_init.c
++++ b/arch/s390/mm/kasan_init.c
+@@ -4,7 +4,7 @@
+ #include <linux/pgtable.h>
+ #include <asm/pgalloc.h>
+ #include <asm/kasan.h>
+-#include <asm/mem_detect.h>
++#include <asm/physmem_info.h>
+ #include <asm/processor.h>
+ #include <asm/sclp.h>
+ #include <asm/facility.h>
+@@ -244,7 +244,7 @@ void __init kasan_early_init(void)
+ memset64((u64 *)kasan_early_shadow_pte, pte_val(pte_z), PTRS_PER_PTE);
+
+ if (has_edat) {
+- shadow_alloc_size = get_mem_detect_usable_total() >> KASAN_SHADOW_SCALE_SHIFT;
++ shadow_alloc_size = get_physmem_usable_total() >> KASAN_SHADOW_SCALE_SHIFT;
+ segment_pos = round_down(pgalloc_pos, _SEGMENT_SIZE);
+ segment_low = segment_pos - shadow_alloc_size;
+ segment_low = round_down(segment_low, _SEGMENT_SIZE);
+@@ -282,7 +282,7 @@ void __init kasan_early_init(void)
+ * +- shadow end ----+---------+- shadow end ---+
+ */
+ /* populate kasan shadow (for identity mapping and zero page mapping) */
+- for_each_mem_detect_usable_block(i, &start, &end)
++ for_each_physmem_usable_range(i, &start, &end)
+ kasan_early_pgtable_populate(__sha(start), __sha(end), POPULATE_MAP);
+ if (IS_ENABLED(CONFIG_KASAN_VMALLOC)) {
+ untracked_end = VMALLOC_START;
+diff --git a/drivers/s390/char/sclp_early_core.c b/drivers/s390/char/sclp_early_core.c
+index ac1d00980fa66..dbd5c53d8edfe 100644
+--- a/drivers/s390/char/sclp_early_core.c
++++ b/drivers/s390/char/sclp_early_core.c
+@@ -10,7 +10,7 @@
+ #include <asm/ebcdic.h>
+ #include <asm/irq.h>
+ #include <asm/sections.h>
+-#include <asm/mem_detect.h>
++#include <asm/physmem_info.h>
+ #include <asm/facility.h>
+ #include "sclp.h"
+ #include "sclp_rw.h"
+@@ -336,7 +336,7 @@ int __init sclp_early_get_hsa_size(unsigned long *hsa_size)
+
+ #define SCLP_STORAGE_INFO_FACILITY 0x0000400000000000UL
+
+-void __weak __init add_mem_detect_block(u64 start, u64 end) {}
++void __weak __init add_physmem_online_range(u64 start, u64 end) {}
+ int __init sclp_early_read_storage_info(void)
+ {
+ struct read_storage_sccb *sccb = (struct read_storage_sccb *)sclp_early_sccb;
+@@ -369,7 +369,7 @@ int __init sclp_early_read_storage_info(void)
+ if (!sccb->entries[sn])
+ continue;
+ rn = sccb->entries[sn] >> 16;
+- add_mem_detect_block((rn - 1) * rzm, rn * rzm);
++ add_physmem_online_range((rn - 1) * rzm, rn * rzm);
+ }
+ break;
+ case 0x0310:
+@@ -382,6 +382,6 @@ int __init sclp_early_read_storage_info(void)
+
+ return 0;
+ fail:
+- mem_detect.count = 0;
++ physmem_info.range_count = 0;
+ return -EIO;
+ }
+--
+2.39.2
+
--- /dev/null
+From 8d395db1c2469a1b857bbc48b7d5375bad842ab1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Feb 2023 13:59:36 +0100
+Subject: s390/boot: rework decompressor reserved tracking
+
+From: Vasily Gorbik <gor@linux.ibm.com>
+
+[ Upstream commit f913a6600491d3f478ea976a9be0fb1001476c10 ]
+
+Currently several approaches for finding unused memory in decompressor
+are utilized. While "safe_addr" grows towards higher addresses, vmem
+code allocates paging structures top down. The former requires careful
+ordering. In addition to that ipl report handling code verifies potential
+intersections with secure boot certificates on its own. Neither of two
+approaches are memory holes aware and consistent with each other in low
+memory conditions.
+
+To solve that, existing approaches are generalized and combined
+together, as well as online memory ranges are now taken into
+consideration.
+
+physmem_info has been extended to contain reserved memory ranges. New
+set of functions allow to handle reserves and find unused memory.
+All reserves and memory allocations are "typed". In case of out of
+memory condition decompressor fails with detailed info on current
+reserved ranges and usable online memory.
+
+Linux version 6.2.0 ...
+Kernel command line: ... mem=100M
+Our of memory allocating 100000 bytes 100000 aligned in range 0:5800000
+Reserved memory ranges:
+0000000000000000 0000000003e33000 DECOMPRESSOR
+0000000003f00000 00000000057648a3 INITRD
+00000000063e0000 00000000063e8000 VMEM
+00000000063eb000 00000000063f4000 VMEM
+00000000063f7800 0000000006400000 VMEM
+0000000005800000 0000000006300000 KASAN
+Usable online memory ranges (info source: sclp read info [3]):
+0000000000000000 0000000006400000
+Usable online memory total: 6400000 Reserved: 61b10a3 Free: 24ef5d
+Call Trace:
+(sp:000000000002bd58 [<0000000000012a70>] physmem_alloc_top_down+0x60/0x14c)
+ sp:000000000002bdc8 [<0000000000013756>] _pa+0x56/0x6a
+ sp:000000000002bdf0 [<0000000000013bcc>] pgtable_populate+0x45c/0x65e
+ sp:000000000002be90 [<00000000000140aa>] setup_vmem+0x2da/0x424
+ sp:000000000002bec8 [<0000000000011c20>] startup_kernel+0x428/0x8b4
+ sp:000000000002bf60 [<00000000000100f4>] startup_normal+0xd4/0xd4
+
+physmem_alloc_range allows to find free memory in specified range. It
+should be used for one time allocations only like finding position for
+amode31 and vmlinux.
+physmem_alloc_top_down can be used just like physmem_alloc_range, but
+it also allows multiple allocations per type and tries to merge sequential
+allocations together. Which is useful for paging structures allocations.
+If sequential allocations cannot be merged together they are "chained",
+allowing easy per type reserved ranges enumeration and migration to
+memblock later. Extra "struct reserved_range" allocated for chaining are
+not tracked or reserved but rely on the fact that both
+physmem_alloc_range and physmem_alloc_top_down search for free memory
+only below current top down allocator position. All reserved ranges
+should be transferred to memblock before memblock allocations are
+enabled.
+
+The startup code has been reordered to delay any memory allocations until
+online memory ranges are detected and occupied memory ranges are marked as
+reserved to be excluded from follow-up allocations.
+Ipl report certificates are a special case, ipl report certificates list
+is checked together with other memory reserves until certificates are
+saved elsewhere.
+KASAN required memory for shadow memory allocation and mapping is reserved
+as 1 large chunk which is later passed to KASAN early initialization code.
+
+Acked-by: Heiko Carstens <hca@linux.ibm.com>
+Reviewed-by: Alexander Gordeev <agordeev@linux.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Stable-dep-of: 81e847964985 ("s390/mm: fix direct map accounting")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/boot/boot.h | 30 ++++-
+ arch/s390/boot/ipl_report.c | 106 +++++++--------
+ arch/s390/boot/kaslr.c | 113 ++--------------
+ arch/s390/boot/pgm_check_info.c | 5 +-
+ arch/s390/boot/physmem_info.c | 188 +++++++++++++++++++++++----
+ arch/s390/boot/startup.c | 86 ++++++------
+ arch/s390/boot/vmem.c | 69 +---------
+ arch/s390/boot/vmlinux.lds.S | 2 +
+ arch/s390/include/asm/physmem_info.h | 112 +++++++++++++---
+ arch/s390/include/asm/setup.h | 9 --
+ arch/s390/kernel/setup.c | 76 +++--------
+ arch/s390/mm/kasan_init.c | 39 +++---
+ 12 files changed, 430 insertions(+), 405 deletions(-)
+
+diff --git a/arch/s390/boot/boot.h b/arch/s390/boot/boot.h
+index d39895d5796ed..2b40481064189 100644
+--- a/arch/s390/boot/boot.h
++++ b/arch/s390/boot/boot.h
+@@ -8,6 +8,8 @@
+
+ #ifndef __ASSEMBLY__
+
++#include <asm/physmem_info.h>
++
+ struct machine_info {
+ unsigned char has_edat1 : 1;
+ unsigned char has_edat2 : 1;
+@@ -33,21 +35,34 @@ struct vmlinux_info {
+ };
+
+ void startup_kernel(void);
+-unsigned long detect_memory(unsigned long *safe_addr);
++unsigned long detect_max_physmem_end(void);
++void detect_physmem_online_ranges(unsigned long max_physmem_end);
+ void physmem_set_usable_limit(unsigned long limit);
++void physmem_reserve(enum reserved_range_type type, unsigned long addr, unsigned long size);
++void physmem_free(enum reserved_range_type type);
++/* for continuous/multiple allocations per type */
++unsigned long physmem_alloc_top_down(enum reserved_range_type type, unsigned long size,
++ unsigned long align);
++/* for single allocations, 1 per type */
++unsigned long physmem_alloc_range(enum reserved_range_type type, unsigned long size,
++ unsigned long align, unsigned long min, unsigned long max,
++ bool die_on_oom);
++bool ipl_report_certs_intersects(unsigned long addr, unsigned long size,
++ unsigned long *intersection_start);
+ bool is_ipl_block_dump(void);
+ void store_ipl_parmblock(void);
+-unsigned long read_ipl_report(unsigned long safe_addr);
++int read_ipl_report(void);
++void save_ipl_cert_comp_list(void);
+ void setup_boot_command_line(void);
+ void parse_boot_command_line(void);
+ void verify_facilities(void);
+ void print_missing_facilities(void);
+ void sclp_early_setup_buffer(void);
+ void print_pgm_check_info(void);
+-unsigned long get_random_base(unsigned long safe_addr);
++unsigned long get_random_base(void);
+ void setup_vmem(unsigned long asce_limit);
+-unsigned long vmem_estimate_memory_needs(unsigned long online_mem_total);
+ void __printf(1, 2) decompressor_printk(const char *fmt, ...);
++void print_stacktrace(unsigned long sp);
+ void error(char *m);
+
+ extern struct machine_info machine;
+@@ -62,7 +77,7 @@ extern char __boot_data_start[], __boot_data_end[];
+ extern char __boot_data_preserved_start[], __boot_data_preserved_end[];
+ extern char _decompressor_syms_start[], _decompressor_syms_end[];
+ extern char _stack_start[], _stack_end[];
+-extern char _end[];
++extern char _end[], _decompressor_end[];
+ extern unsigned char _compressed_start[];
+ extern unsigned char _compressed_end[];
+ extern struct vmlinux_info _vmlinux_info;
+@@ -70,5 +85,10 @@ extern struct vmlinux_info _vmlinux_info;
+
+ #define __abs_lowcore_pa(x) (((unsigned long)(x) - __abs_lowcore) % sizeof(struct lowcore))
+
++static inline bool intersects(unsigned long addr0, unsigned long size0,
++ unsigned long addr1, unsigned long size1)
++{
++ return addr0 + size0 > addr1 && addr1 + size1 > addr0;
++}
+ #endif /* __ASSEMBLY__ */
+ #endif /* BOOT_BOOT_H */
+diff --git a/arch/s390/boot/ipl_report.c b/arch/s390/boot/ipl_report.c
+index 74b5cd2648622..1803035e68d2c 100644
+--- a/arch/s390/boot/ipl_report.c
++++ b/arch/s390/boot/ipl_report.c
+@@ -5,6 +5,7 @@
+ #include <asm/sclp.h>
+ #include <asm/sections.h>
+ #include <asm/boot_data.h>
++#include <asm/physmem_info.h>
+ #include <uapi/asm/ipl.h>
+ #include "boot.h"
+
+@@ -16,20 +17,16 @@ unsigned long __bootdata_preserved(ipl_cert_list_size);
+ unsigned long __bootdata(early_ipl_comp_list_addr);
+ unsigned long __bootdata(early_ipl_comp_list_size);
+
++static struct ipl_rb_certificates *certs;
++static struct ipl_rb_components *comps;
++static bool ipl_report_needs_saving;
++
+ #define for_each_rb_entry(entry, rb) \
+ for (entry = rb->entries; \
+ (void *) entry + sizeof(*entry) <= (void *) rb + rb->len; \
+ entry++)
+
+-static inline bool intersects(unsigned long addr0, unsigned long size0,
+- unsigned long addr1, unsigned long size1)
+-{
+- return addr0 + size0 > addr1 && addr1 + size1 > addr0;
+-}
+-
+-static unsigned long find_bootdata_space(struct ipl_rb_components *comps,
+- struct ipl_rb_certificates *certs,
+- unsigned long safe_addr)
++static unsigned long get_cert_comp_list_size(void)
+ {
+ struct ipl_rb_certificate_entry *cert;
+ struct ipl_rb_component_entry *comp;
+@@ -44,44 +41,27 @@ static unsigned long find_bootdata_space(struct ipl_rb_components *comps,
+ ipl_cert_list_size = 0;
+ for_each_rb_entry(cert, certs)
+ ipl_cert_list_size += sizeof(unsigned int) + cert->len;
+- size = ipl_cert_list_size + early_ipl_comp_list_size;
++ return ipl_cert_list_size + early_ipl_comp_list_size;
++}
+
+- /*
+- * Start from safe_addr to find a free memory area large
+- * enough for the IPL report boot data. This area is used
+- * for ipl_cert_list_addr/ipl_cert_list_size and
+- * early_ipl_comp_list_addr/early_ipl_comp_list_size. It must
+- * not overlap with any component or any certificate.
+- */
+-repeat:
+- if (IS_ENABLED(CONFIG_BLK_DEV_INITRD) && initrd_data.start && initrd_data.size &&
+- intersects(initrd_data.start, initrd_data.size, safe_addr, size))
+- safe_addr = initrd_data.start + initrd_data.size;
+- if (intersects(safe_addr, size, (unsigned long)comps, comps->len)) {
+- safe_addr = (unsigned long)comps + comps->len;
+- goto repeat;
+- }
+- for_each_rb_entry(comp, comps)
+- if (intersects(safe_addr, size, comp->addr, comp->len)) {
+- safe_addr = comp->addr + comp->len;
+- goto repeat;
++bool ipl_report_certs_intersects(unsigned long addr, unsigned long size,
++ unsigned long *intersection_start)
++{
++ struct ipl_rb_certificate_entry *cert;
++
++ if (!ipl_report_needs_saving)
++ return false;
++
++ for_each_rb_entry(cert, certs) {
++ if (intersects(addr, size, cert->addr, cert->len)) {
++ *intersection_start = cert->addr;
++ return true;
+ }
+- if (intersects(safe_addr, size, (unsigned long)certs, certs->len)) {
+- safe_addr = (unsigned long)certs + certs->len;
+- goto repeat;
+ }
+- for_each_rb_entry(cert, certs)
+- if (intersects(safe_addr, size, cert->addr, cert->len)) {
+- safe_addr = cert->addr + cert->len;
+- goto repeat;
+- }
+- early_ipl_comp_list_addr = safe_addr;
+- ipl_cert_list_addr = safe_addr + early_ipl_comp_list_size;
+-
+- return safe_addr + size;
++ return false;
+ }
+
+-static void copy_components_bootdata(struct ipl_rb_components *comps)
++static void copy_components_bootdata(void)
+ {
+ struct ipl_rb_component_entry *comp, *ptr;
+
+@@ -90,7 +70,7 @@ static void copy_components_bootdata(struct ipl_rb_components *comps)
+ memcpy(ptr++, comp, sizeof(*ptr));
+ }
+
+-static void copy_certificates_bootdata(struct ipl_rb_certificates *certs)
++static void copy_certificates_bootdata(void)
+ {
+ struct ipl_rb_certificate_entry *cert;
+ void *ptr;
+@@ -104,10 +84,8 @@ static void copy_certificates_bootdata(struct ipl_rb_certificates *certs)
+ }
+ }
+
+-unsigned long read_ipl_report(unsigned long safe_addr)
++int read_ipl_report(void)
+ {
+- struct ipl_rb_certificates *certs;
+- struct ipl_rb_components *comps;
+ struct ipl_pl_hdr *pl_hdr;
+ struct ipl_rl_hdr *rl_hdr;
+ struct ipl_rb_hdr *rb_hdr;
+@@ -120,7 +98,7 @@ unsigned long read_ipl_report(unsigned long safe_addr)
+ */
+ if (!ipl_block_valid ||
+ !(ipl_block.hdr.flags & IPL_PL_FLAG_IPLSR))
+- return safe_addr;
++ return -1;
+ ipl_secure_flag = !!(ipl_block.hdr.flags & IPL_PL_FLAG_SIPL);
+ /*
+ * There is an IPL report, to find it load the pointer to the
+@@ -158,16 +136,30 @@ unsigned long read_ipl_report(unsigned long safe_addr)
+ * With either the component list or the certificate list
+ * missing the kernel will stay ignorant of secure IPL.
+ */
+- if (!comps || !certs)
+- return safe_addr;
++ if (!comps || !certs) {
++ certs = NULL;
++ return -1;
++ }
+
+- /*
+- * Copy component and certificate list to a safe area
+- * where the decompressed kernel can find them.
+- */
+- safe_addr = find_bootdata_space(comps, certs, safe_addr);
+- copy_components_bootdata(comps);
+- copy_certificates_bootdata(certs);
++ ipl_report_needs_saving = true;
++ physmem_reserve(RR_IPLREPORT, (unsigned long)pl_hdr,
++ (unsigned long)rl_end - (unsigned long)pl_hdr);
++ return 0;
++}
++
++void save_ipl_cert_comp_list(void)
++{
++ unsigned long size;
++
++ if (!ipl_report_needs_saving)
++ return;
++
++ size = get_cert_comp_list_size();
++ early_ipl_comp_list_addr = physmem_alloc_top_down(RR_CERT_COMP_LIST, size, sizeof(int));
++ ipl_cert_list_addr = early_ipl_comp_list_addr + early_ipl_comp_list_size;
+
+- return safe_addr;
++ copy_components_bootdata();
++ copy_certificates_bootdata();
++ physmem_free(RR_IPLREPORT);
++ ipl_report_needs_saving = false;
+ }
+diff --git a/arch/s390/boot/kaslr.c b/arch/s390/boot/kaslr.c
+index 22b7c5d8e94a6..71f75f03f800d 100644
+--- a/arch/s390/boot/kaslr.c
++++ b/arch/s390/boot/kaslr.c
+@@ -91,113 +91,16 @@ static int get_random(unsigned long limit, unsigned long *value)
+ return 0;
+ }
+
+-/*
+- * To randomize kernel base address we have to consider several facts:
+- * 1. physical online memory might not be continuous and have holes. physmem
+- * info contains list of online memory ranges we should consider.
+- * 2. we have several memory regions which are occupied and we should not
+- * overlap and destroy them. Currently safe_addr tells us the border below
+- * which all those occupied regions are. We are safe to use anything above
+- * safe_addr.
+- * 3. the upper limit might apply as well, even if memory above that limit is
+- * online. Currently those limitations are:
+- * 3.1. Limit set by "mem=" kernel command line option
+- * 3.2. memory reserved at the end for kasan initialization.
+- * 4. kernel base address must be aligned to THREAD_SIZE (kernel stack size).
+- * Which is required for CONFIG_CHECK_STACK. Currently THREAD_SIZE is 4 pages
+- * (16 pages when the kernel is built with kasan enabled)
+- * Assumptions:
+- * 1. kernel size (including .bss size) and upper memory limit are page aligned.
+- * 2. physmem online region start is THREAD_SIZE aligned / end is PAGE_SIZE
+- * aligned (in practice memory configurations granularity on z/VM and LPAR
+- * is 1mb).
+- *
+- * To guarantee uniform distribution of kernel base address among all suitable
+- * addresses we generate random value just once. For that we need to build a
+- * continuous range in which every value would be suitable. We can build this
+- * range by simply counting all suitable addresses (let's call them positions)
+- * which would be valid as kernel base address. To count positions we iterate
+- * over online memory ranges. For each range which is big enough for the
+- * kernel image we count all suitable addresses we can put the kernel image at
+- * that is
+- * (end - start - kernel_size) / THREAD_SIZE + 1
+- * Two functions count_valid_kernel_positions and position_to_address help
+- * to count positions in memory range given and then convert position back
+- * to address.
+- */
+-static unsigned long count_valid_kernel_positions(unsigned long kernel_size,
+- unsigned long _min,
+- unsigned long _max)
+-{
+- unsigned long start, end, pos = 0;
+- int i;
+-
+- for_each_physmem_usable_range(i, &start, &end) {
+- if (_min >= end)
+- continue;
+- if (start >= _max)
+- break;
+- start = max(_min, start);
+- end = min(_max, end);
+- if (end - start < kernel_size)
+- continue;
+- pos += (end - start - kernel_size) / THREAD_SIZE + 1;
+- }
+-
+- return pos;
+-}
+-
+-static unsigned long position_to_address(unsigned long pos, unsigned long kernel_size,
+- unsigned long _min, unsigned long _max)
+-{
+- unsigned long start, end;
+- int i;
+-
+- for_each_physmem_usable_range(i, &start, &end) {
+- if (_min >= end)
+- continue;
+- if (start >= _max)
+- break;
+- start = max(_min, start);
+- end = min(_max, end);
+- if (end - start < kernel_size)
+- continue;
+- if ((end - start - kernel_size) / THREAD_SIZE + 1 >= pos)
+- return start + (pos - 1) * THREAD_SIZE;
+- pos -= (end - start - kernel_size) / THREAD_SIZE + 1;
+- }
+-
+- return 0;
+-}
+-
+-unsigned long get_random_base(unsigned long safe_addr)
++unsigned long get_random_base(void)
+ {
+- unsigned long usable_total = get_physmem_usable_total();
+- unsigned long memory_limit = get_physmem_usable_end();
+- unsigned long base_pos, max_pos, kernel_size;
+- int i;
++ unsigned long vmlinux_size = vmlinux.image_size + vmlinux.bss_size;
++ unsigned long minimal_pos = vmlinux.default_lma + vmlinux_size;
++ unsigned long random;
+
+- /*
+- * Avoid putting kernel in the end of physical memory
+- * which vmem and kasan code will use for shadow memory and
+- * pgtable mapping allocations.
+- */
+- memory_limit -= kasan_estimate_memory_needs(usable_total);
+- memory_limit -= vmem_estimate_memory_needs(usable_total);
+-
+- safe_addr = ALIGN(safe_addr, THREAD_SIZE);
+- kernel_size = vmlinux.image_size + vmlinux.bss_size;
+- if (safe_addr + kernel_size > memory_limit)
++ /* [vmlinux.default_lma + vmlinux.image_size + vmlinux.bss_size : physmem_info.usable] */
++ if (get_random(physmem_info.usable - minimal_pos, &random))
+ return 0;
+
+- max_pos = count_valid_kernel_positions(kernel_size, safe_addr, memory_limit);
+- if (!max_pos) {
+- sclp_early_printk("KASLR disabled: not enough memory\n");
+- return 0;
+- }
+-
+- /* we need a value in the range [1, base_pos] inclusive */
+- if (get_random(max_pos, &base_pos))
+- return 0;
+- return position_to_address(base_pos + 1, kernel_size, safe_addr, memory_limit);
++ return physmem_alloc_range(RR_VMLINUX, vmlinux_size, THREAD_SIZE,
++ vmlinux.default_lma, minimal_pos + random, false);
+ }
+diff --git a/arch/s390/boot/pgm_check_info.c b/arch/s390/boot/pgm_check_info.c
+index c2a1defc79daf..0861e3c403f81 100644
+--- a/arch/s390/boot/pgm_check_info.c
++++ b/arch/s390/boot/pgm_check_info.c
+@@ -123,11 +123,10 @@ void decompressor_printk(const char *fmt, ...)
+ sclp_early_printk(buf);
+ }
+
+-static noinline void print_stacktrace(void)
++void print_stacktrace(unsigned long sp)
+ {
+ struct stack_info boot_stack = { STACK_TYPE_TASK, (unsigned long)_stack_start,
+ (unsigned long)_stack_end };
+- unsigned long sp = S390_lowcore.gpregs_save_area[15];
+ bool first = true;
+
+ decompressor_printk("Call Trace:\n");
+@@ -173,7 +172,7 @@ void print_pgm_check_info(void)
+ gpregs[8], gpregs[9], gpregs[10], gpregs[11]);
+ decompressor_printk(" %016lx %016lx %016lx %016lx\n",
+ gpregs[12], gpregs[13], gpregs[14], gpregs[15]);
+- print_stacktrace();
++ print_stacktrace(S390_lowcore.gpregs_save_area[15]);
+ decompressor_printk("Last Breaking-Event-Address:\n");
+ decompressor_printk(" [<%016lx>] %pS\n", (unsigned long)S390_lowcore.pgm_last_break,
+ (void *)S390_lowcore.pgm_last_break);
+diff --git a/arch/s390/boot/physmem_info.c b/arch/s390/boot/physmem_info.c
+index dc2e4d0abfab0..4ee9b73811420 100644
+--- a/arch/s390/boot/physmem_info.c
++++ b/arch/s390/boot/physmem_info.c
+@@ -1,16 +1,21 @@
+ // SPDX-License-Identifier: GPL-2.0
++#include <linux/processor.h>
+ #include <linux/errno.h>
+ #include <linux/init.h>
+-#include <asm/setup.h>
+-#include <asm/processor.h>
+-#include <asm/sclp.h>
+-#include <asm/sections.h>
+ #include <asm/physmem_info.h>
++#include <asm/stacktrace.h>
++#include <asm/boot_data.h>
+ #include <asm/sparsemem.h>
++#include <asm/sections.h>
++#include <asm/setup.h>
++#include <asm/sclp.h>
++#include <asm/uv.h>
+ #include "decompressor.h"
+ #include "boot.h"
+
+ struct physmem_info __bootdata(physmem_info);
++static unsigned int physmem_alloc_ranges;
++static unsigned long physmem_alloc_pos;
+
+ /* up to 256 storage elements, 1020 subincrements each */
+ #define ENTRIES_EXTENDED_MAX \
+@@ -20,6 +25,11 @@ static struct physmem_range *__get_physmem_range_ptr(u32 n)
+ {
+ if (n < MEM_INLINED_ENTRIES)
+ return &physmem_info.online[n];
++ if (unlikely(!physmem_info.online_extended)) {
++ physmem_info.online_extended = (struct physmem_range *)physmem_alloc_range(
++ RR_MEM_DETECT_EXTENDED, ENTRIES_EXTENDED_MAX, sizeof(long), 0,
++ physmem_alloc_pos, true);
++ }
+ return &physmem_info.online_extended[n - MEM_INLINED_ENTRIES];
+ }
+
+@@ -143,49 +153,171 @@ static unsigned long search_mem_end(void)
+ return (offset + 1) << 20;
+ }
+
+-unsigned long detect_memory(unsigned long *safe_addr)
++unsigned long detect_max_physmem_end(void)
+ {
+ unsigned long max_physmem_end = 0;
+
+- sclp_early_get_memsize(&max_physmem_end);
+- physmem_info.online_extended = (struct physmem_range *)ALIGN(*safe_addr, sizeof(u64));
++ if (!sclp_early_get_memsize(&max_physmem_end)) {
++ physmem_info.info_source = MEM_DETECT_SCLP_READ_INFO;
++ } else {
++ max_physmem_end = search_mem_end();
++ physmem_info.info_source = MEM_DETECT_BIN_SEARCH;
++ }
++ return max_physmem_end;
++}
+
++void detect_physmem_online_ranges(unsigned long max_physmem_end)
++{
+ if (!sclp_early_read_storage_info()) {
+ physmem_info.info_source = MEM_DETECT_SCLP_STOR_INFO;
+ } else if (!diag260()) {
+ physmem_info.info_source = MEM_DETECT_DIAG260;
+- max_physmem_end = max_physmem_end ?: get_physmem_usable_end();
+ } else if (max_physmem_end) {
+ add_physmem_online_range(0, max_physmem_end);
+- physmem_info.info_source = MEM_DETECT_SCLP_READ_INFO;
+- } else {
+- max_physmem_end = search_mem_end();
+- add_physmem_online_range(0, max_physmem_end);
+- physmem_info.info_source = MEM_DETECT_BIN_SEARCH;
+ }
++}
+
+- if (physmem_info.range_count > MEM_INLINED_ENTRIES) {
+- *safe_addr += (physmem_info.range_count - MEM_INLINED_ENTRIES) *
+- sizeof(struct physmem_range);
++void physmem_set_usable_limit(unsigned long limit)
++{
++ physmem_info.usable = limit;
++ physmem_alloc_pos = limit;
++}
++
++static void die_oom(unsigned long size, unsigned long align, unsigned long min, unsigned long max)
++{
++ unsigned long start, end, total_mem = 0, total_reserved_mem = 0;
++ struct reserved_range *range;
++ enum reserved_range_type t;
++ int i;
++
++ decompressor_printk("Linux version %s\n", kernel_version);
++ if (!is_prot_virt_guest() && early_command_line[0])
++ decompressor_printk("Kernel command line: %s\n", early_command_line);
++ decompressor_printk("Out of memory allocating %lx bytes %lx aligned in range %lx:%lx\n",
++ size, align, min, max);
++ decompressor_printk("Reserved memory ranges:\n");
++ for_each_physmem_reserved_range(t, range, &start, &end) {
++ decompressor_printk("%016lx %016lx %s\n", start, end, get_rr_type_name(t));
++ total_reserved_mem += end - start;
++ }
++ decompressor_printk("Usable online memory ranges (info source: %s [%x]):\n",
++ get_physmem_info_source(), physmem_info.info_source);
++ for_each_physmem_usable_range(i, &start, &end) {
++ decompressor_printk("%016lx %016lx\n", start, end);
++ total_mem += end - start;
+ }
++ decompressor_printk("Usable online memory total: %lx Reserved: %lx Free: %lx\n",
++ total_mem, total_reserved_mem,
++ total_mem > total_reserved_mem ? total_mem - total_reserved_mem : 0);
++ print_stacktrace(current_frame_address());
++ sclp_early_printk("\n\n -- System halted\n");
++ disabled_wait();
++}
+
+- return max_physmem_end;
++void physmem_reserve(enum reserved_range_type type, unsigned long addr, unsigned long size)
++{
++ physmem_info.reserved[type].start = addr;
++ physmem_info.reserved[type].end = addr + size;
+ }
+
+-void physmem_set_usable_limit(unsigned long limit)
++void physmem_free(enum reserved_range_type type)
+ {
+- struct physmem_range *range;
+- int i;
++ physmem_info.reserved[type].start = 0;
++ physmem_info.reserved[type].end = 0;
++}
+
+- /* make sure mem_detect.usable ends up within online memory block */
+- for (i = 0; i < physmem_info.range_count; i++) {
+- range = __get_physmem_range_ptr(i);
+- if (range->start >= limit)
+- break;
+- if (range->end >= limit) {
+- physmem_info.usable = limit;
++static bool __physmem_alloc_intersects(unsigned long addr, unsigned long size,
++ unsigned long *intersection_start)
++{
++ unsigned long res_addr, res_size;
++ int t;
++
++ for (t = 0; t < RR_MAX; t++) {
++ if (!get_physmem_reserved(t, &res_addr, &res_size))
++ continue;
++ if (intersects(addr, size, res_addr, res_size)) {
++ *intersection_start = res_addr;
++ return true;
++ }
++ }
++ return ipl_report_certs_intersects(addr, size, intersection_start);
++}
++
++static unsigned long __physmem_alloc_range(unsigned long size, unsigned long align,
++ unsigned long min, unsigned long max,
++ unsigned int from_ranges, unsigned int *ranges_left,
++ bool die_on_oom)
++{
++ unsigned int nranges = from_ranges ?: physmem_info.range_count;
++ unsigned long range_start, range_end;
++ unsigned long intersection_start;
++ unsigned long addr, pos = max;
++
++ align = max(align, 8UL);
++ while (nranges) {
++ __get_physmem_range(nranges - 1, &range_start, &range_end, false);
++ pos = min(range_end, pos);
++
++ if (round_up(min, align) + size > pos)
+ break;
++ addr = round_down(pos - size, align);
++ if (range_start > addr) {
++ nranges--;
++ continue;
++ }
++ if (__physmem_alloc_intersects(addr, size, &intersection_start)) {
++ pos = intersection_start;
++ continue;
++ }
++
++ if (ranges_left)
++ *ranges_left = nranges;
++ return addr;
++ }
++ if (die_on_oom)
++ die_oom(size, align, min, max);
++ return 0;
++}
++
++unsigned long physmem_alloc_range(enum reserved_range_type type, unsigned long size,
++ unsigned long align, unsigned long min, unsigned long max,
++ bool die_on_oom)
++{
++ unsigned long addr;
++
++ max = min(max, physmem_alloc_pos);
++ addr = __physmem_alloc_range(size, align, min, max, 0, NULL, die_on_oom);
++ if (addr)
++ physmem_reserve(type, addr, size);
++ return addr;
++}
++
++unsigned long physmem_alloc_top_down(enum reserved_range_type type, unsigned long size,
++ unsigned long align)
++{
++ struct reserved_range *range = &physmem_info.reserved[type];
++ struct reserved_range *new_range;
++ unsigned int ranges_left;
++ unsigned long addr;
++
++ addr = __physmem_alloc_range(size, align, 0, physmem_alloc_pos, physmem_alloc_ranges,
++ &ranges_left, true);
++ /* if not a consecutive allocation of the same type or first allocation */
++ if (range->start != addr + size) {
++ if (range->end) {
++ physmem_alloc_pos = __physmem_alloc_range(
++ sizeof(struct reserved_range), 0, 0, physmem_alloc_pos,
++ physmem_alloc_ranges, &ranges_left, true);
++ new_range = (struct reserved_range *)physmem_alloc_pos;
++ *new_range = *range;
++ range->chain = new_range;
++ addr = __physmem_alloc_range(size, align, 0, physmem_alloc_pos,
++ ranges_left, &ranges_left, true);
+ }
+- physmem_info.usable = range->end;
++ range->end = addr + size;
+ }
++ range->start = addr;
++ physmem_alloc_pos = addr;
++ physmem_alloc_ranges = ranges_left;
++ return addr;
+ }
+diff --git a/arch/s390/boot/startup.c b/arch/s390/boot/startup.c
+index 50475bf25ecda..bc07e24329b95 100644
+--- a/arch/s390/boot/startup.c
++++ b/arch/s390/boot/startup.c
+@@ -21,7 +21,6 @@ unsigned long __bootdata_preserved(__kaslr_offset);
+ unsigned long __bootdata_preserved(__abs_lowcore);
+ unsigned long __bootdata_preserved(__memcpy_real_area);
+ pte_t *__bootdata_preserved(memcpy_real_ptep);
+-unsigned long __bootdata(__amode31_base);
+ unsigned long __bootdata_preserved(VMALLOC_START);
+ unsigned long __bootdata_preserved(VMALLOC_END);
+ struct page *__bootdata_preserved(vmemmap);
+@@ -29,7 +28,6 @@ unsigned long __bootdata_preserved(vmemmap_size);
+ unsigned long __bootdata_preserved(MODULES_VADDR);
+ unsigned long __bootdata_preserved(MODULES_END);
+ unsigned long __bootdata(ident_map_size);
+-struct initrd_data __bootdata(initrd_data);
+
+ u64 __bootdata_preserved(stfle_fac_list[16]);
+ u64 __bootdata_preserved(alt_stfle_fac_list[16]);
+@@ -75,17 +73,20 @@ unsigned long mem_safe_offset(void)
+ }
+ #endif
+
+-static unsigned long rescue_initrd(unsigned long safe_addr)
++static void rescue_initrd(unsigned long min, unsigned long max)
+ {
++ unsigned long old_addr, addr, size;
++
+ if (!IS_ENABLED(CONFIG_BLK_DEV_INITRD))
+- return safe_addr;
+- if (!initrd_data.start || !initrd_data.size)
+- return safe_addr;
+- if (initrd_data.start < safe_addr) {
+- memmove((void *)safe_addr, (void *)initrd_data.start, initrd_data.size);
+- initrd_data.start = safe_addr;
+- }
+- return initrd_data.start + initrd_data.size;
++ return;
++ if (!get_physmem_reserved(RR_INITRD, &addr, &size))
++ return;
++ if (addr >= min && addr + size <= max)
++ return;
++ old_addr = addr;
++ physmem_free(RR_INITRD);
++ addr = physmem_alloc_top_down(RR_INITRD, size, 0);
++ memmove((void *)addr, (void *)old_addr, size);
+ }
+
+ static void copy_bootdata(void)
+@@ -267,46 +268,52 @@ static void offset_vmlinux_info(unsigned long offset)
+ vmlinux.invalid_pg_dir_off += offset;
+ }
+
+-static unsigned long reserve_amode31(unsigned long safe_addr)
+-{
+- __amode31_base = PAGE_ALIGN(safe_addr);
+- return __amode31_base + vmlinux.amode31_size;
+-}
+-
+ void startup_kernel(void)
+ {
+ unsigned long max_physmem_end;
+ unsigned long random_lma;
+- unsigned long safe_addr;
+ unsigned long asce_limit;
++ unsigned long safe_addr;
+ void *img;
+ psw_t psw;
+
+- initrd_data.start = parmarea.initrd_start;
+- initrd_data.size = parmarea.initrd_size;
++ setup_lpp();
++ safe_addr = mem_safe_offset();
++ /*
++ * reserve decompressor memory together with decompression heap, buffer and
++ * memory which might be occupied by uncompressed kernel at default 1Mb
++ * position (if KASLR is off or failed).
++ */
++ physmem_reserve(RR_DECOMPRESSOR, 0, safe_addr);
++ if (IS_ENABLED(CONFIG_BLK_DEV_INITRD) && parmarea.initrd_size)
++ physmem_reserve(RR_INITRD, parmarea.initrd_start, parmarea.initrd_size);
+ oldmem_data.start = parmarea.oldmem_base;
+ oldmem_data.size = parmarea.oldmem_size;
+
+- setup_lpp();
+ store_ipl_parmblock();
+- safe_addr = mem_safe_offset();
+- safe_addr = reserve_amode31(safe_addr);
+- safe_addr = read_ipl_report(safe_addr);
++ read_ipl_report();
+ uv_query_info();
+- safe_addr = rescue_initrd(safe_addr);
+ sclp_early_read_info();
+ setup_boot_command_line();
+ parse_boot_command_line();
+ detect_facilities();
+ sanitize_prot_virt_host();
+- max_physmem_end = detect_memory(&safe_addr);
++ max_physmem_end = detect_max_physmem_end();
+ setup_ident_map_size(max_physmem_end);
+ setup_vmalloc_size();
+ asce_limit = setup_kernel_memory_layout();
++ /* got final ident_map_size, physmem allocations could be performed now */
+ physmem_set_usable_limit(ident_map_size);
++ detect_physmem_online_ranges(max_physmem_end);
++ save_ipl_cert_comp_list();
++ rescue_initrd(safe_addr, ident_map_size);
++#ifdef CONFIG_KASAN
++ physmem_alloc_top_down(RR_KASAN, kasan_estimate_memory_needs(get_physmem_usable_total()),
++ _SEGMENT_SIZE);
++#endif
+
+ if (IS_ENABLED(CONFIG_RANDOMIZE_BASE) && kaslr_enabled) {
+- random_lma = get_random_base(safe_addr);
++ random_lma = get_random_base();
+ if (random_lma) {
+ __kaslr_offset = random_lma - vmlinux.default_lma;
+ img = (void *)vmlinux.default_lma;
+@@ -317,8 +324,16 @@ void startup_kernel(void)
+ if (!IS_ENABLED(CONFIG_KERNEL_UNCOMPRESSED)) {
+ img = decompress_kernel();
+ memmove((void *)vmlinux.default_lma, img, vmlinux.image_size);
+- } else if (__kaslr_offset)
++ } else if (__kaslr_offset) {
+ memcpy((void *)vmlinux.default_lma, img, vmlinux.image_size);
++ memset(img, 0, vmlinux.image_size);
++ }
++
++ /* vmlinux decompression is done, shrink reserved low memory */
++ physmem_reserve(RR_DECOMPRESSOR, 0, (unsigned long)_decompressor_end);
++ if (!__kaslr_offset)
++ physmem_reserve(RR_VMLINUX, vmlinux.default_lma, vmlinux.image_size + vmlinux.bss_size);
++ physmem_alloc_range(RR_AMODE31, vmlinux.amode31_size, PAGE_SIZE, 0, SZ_2G, true);
+
+ /*
+ * The order of the following operations is important:
+@@ -338,16 +353,11 @@ void startup_kernel(void)
+ setup_vmem(asce_limit);
+ copy_bootdata();
+
+- if (__kaslr_offset) {
+- /*
+- * Save KASLR offset for early dumps, before vmcore_info is set.
+- * Mark as uneven to distinguish from real vmcore_info pointer.
+- */
+- S390_lowcore.vmcore_info = __kaslr_offset | 0x1UL;
+- /* Clear non-relocated kernel */
+- if (IS_ENABLED(CONFIG_KERNEL_UNCOMPRESSED))
+- memset(img, 0, vmlinux.image_size);
+- }
++ /*
++ * Save KASLR offset for early dumps, before vmcore_info is set.
++ * Mark as uneven to distinguish from real vmcore_info pointer.
++ */
++ S390_lowcore.vmcore_info = __kaslr_offset ? __kaslr_offset | 0x1UL : 0;
+
+ /*
+ * Jump to the decompressed kernel entry point and switch DAT mode on.
+diff --git a/arch/s390/boot/vmem.c b/arch/s390/boot/vmem.c
+index b89a6893f398b..8f16e6f9fb20f 100644
+--- a/arch/s390/boot/vmem.c
++++ b/arch/s390/boot/vmem.c
+@@ -10,6 +10,8 @@
+ #include "decompressor.h"
+ #include "boot.h"
+
++unsigned long __bootdata_preserved(s390_invalid_asce);
++
+ #define init_mm (*(struct mm_struct *)vmlinux.init_mm_off)
+ #define swapper_pg_dir vmlinux.swapper_pg_dir_off
+ #define invalid_pg_dir vmlinux.invalid_pg_dir_off
+@@ -22,77 +24,27 @@ static inline pte_t *__virt_to_kpte(unsigned long va)
+ return pte_offset_kernel(pmd_offset(pud_offset(p4d_offset(pgd_offset_k(va), va), va), va), va);
+ }
+
+-unsigned long __bootdata_preserved(s390_invalid_asce);
+-unsigned long __bootdata(pgalloc_pos);
+-unsigned long __bootdata(pgalloc_end);
+-unsigned long __bootdata(pgalloc_low);
+-
+ enum populate_mode {
+ POPULATE_NONE,
+ POPULATE_ONE2ONE,
+ POPULATE_ABS_LOWCORE,
+ };
+
+-static void boot_check_oom(void)
+-{
+- if (pgalloc_pos < pgalloc_low)
+- error("out of memory on boot\n");
+-}
+-
+-static void pgtable_populate_init(void)
+-{
+- unsigned long initrd_end;
+- unsigned long kernel_end;
+-
+- kernel_end = vmlinux.default_lma + vmlinux.image_size + vmlinux.bss_size;
+- pgalloc_low = round_up(kernel_end, PAGE_SIZE);
+- if (IS_ENABLED(CONFIG_BLK_DEV_INITRD)) {
+- initrd_end = round_up(initrd_data.start + initrd_data.size, _SEGMENT_SIZE);
+- pgalloc_low = max(pgalloc_low, initrd_end);
+- }
+-
+- pgalloc_end = round_down(get_physmem_usable_end(), PAGE_SIZE);
+- pgalloc_pos = pgalloc_end;
+-
+- boot_check_oom();
+-}
+-
+-static void *boot_alloc_pages(unsigned int order)
+-{
+- unsigned long size = PAGE_SIZE << order;
+-
+- pgalloc_pos -= size;
+- pgalloc_pos = round_down(pgalloc_pos, size);
+-
+- boot_check_oom();
+-
+- return (void *)pgalloc_pos;
+-}
+-
+ static void *boot_crst_alloc(unsigned long val)
+ {
++ unsigned long size = PAGE_SIZE << CRST_ALLOC_ORDER;
+ unsigned long *table;
+
+- table = boot_alloc_pages(CRST_ALLOC_ORDER);
+- if (table)
+- crst_table_init(table, val);
++ table = (unsigned long *)physmem_alloc_top_down(RR_VMEM, size, size);
++ crst_table_init(table, val);
+ return table;
+ }
+
+ static pte_t *boot_pte_alloc(void)
+ {
+- static void *pte_leftover;
+ pte_t *pte;
+
+- BUILD_BUG_ON(_PAGE_TABLE_SIZE * 2 != PAGE_SIZE);
+-
+- if (!pte_leftover) {
+- pte_leftover = boot_alloc_pages(0);
+- pte = pte_leftover + _PAGE_TABLE_SIZE;
+- } else {
+- pte = pte_leftover;
+- pte_leftover = NULL;
+- }
++ pte = (pte_t *)physmem_alloc_top_down(RR_VMEM, _PAGE_TABLE_SIZE, _PAGE_TABLE_SIZE);
+ memset64((u64 *)pte, _PAGE_INVALID, PTRS_PER_PTE);
+ return pte;
+ }
+@@ -126,7 +78,6 @@ static bool can_large_pmd(pmd_t *pm_dir, unsigned long addr, unsigned long end)
+ static void pgtable_pte_populate(pmd_t *pmd, unsigned long addr, unsigned long end,
+ enum populate_mode mode)
+ {
+- unsigned long next;
+ pte_t *pte, entry;
+
+ pte = pte_offset_kernel(pmd, addr);
+@@ -250,7 +201,6 @@ void setup_vmem(unsigned long asce_limit)
+ * To prevent creation of a large page at address 0 first map
+ * the lowcore and create the identity mapping only afterwards.
+ */
+- pgtable_populate_init();
+ pgtable_populate(0, sizeof(struct lowcore), POPULATE_ONE2ONE);
+ for_each_physmem_usable_range(i, &start, &end)
+ pgtable_populate(start, end, POPULATE_ONE2ONE);
+@@ -269,10 +219,3 @@ void setup_vmem(unsigned long asce_limit)
+
+ init_mm.context.asce = S390_lowcore.kernel_asce;
+ }
+-
+-unsigned long vmem_estimate_memory_needs(unsigned long online_mem_total)
+-{
+- unsigned long pages = DIV_ROUND_UP(online_mem_total, PAGE_SIZE);
+-
+- return DIV_ROUND_UP(pages, _PAGE_ENTRIES) * _PAGE_TABLE_SIZE * 2;
+-}
+diff --git a/arch/s390/boot/vmlinux.lds.S b/arch/s390/boot/vmlinux.lds.S
+index fa9d33b01b858..389df0e0d9e5d 100644
+--- a/arch/s390/boot/vmlinux.lds.S
++++ b/arch/s390/boot/vmlinux.lds.S
+@@ -93,6 +93,8 @@ SECTIONS
+ _decompressor_syms_end = .;
+ }
+
++ _decompressor_end = .;
++
+ #ifdef CONFIG_KERNEL_UNCOMPRESSED
+ . = 0x100000;
+ #else
+diff --git a/arch/s390/include/asm/physmem_info.h b/arch/s390/include/asm/physmem_info.h
+index d5e65a5d06e7f..27234fa1da8ea 100644
+--- a/arch/s390/include/asm/physmem_info.h
++++ b/arch/s390/include/asm/physmem_info.h
+@@ -17,6 +17,27 @@ struct physmem_range {
+ u64 end;
+ };
+
++enum reserved_range_type {
++ RR_DECOMPRESSOR,
++ RR_INITRD,
++ RR_VMLINUX,
++ RR_AMODE31,
++ RR_IPLREPORT,
++ RR_CERT_COMP_LIST,
++ RR_MEM_DETECT_EXTENDED,
++ RR_VMEM,
++#ifdef CONFIG_KASAN
++ RR_KASAN,
++#endif
++ RR_MAX
++};
++
++struct reserved_range {
++ unsigned long start;
++ unsigned long end;
++ struct reserved_range *chain;
++};
++
+ /*
+ * Storage element id is defined as 1 byte (up to 256 storage elements).
+ * In practise only storage element id 0 and 1 are used).
+@@ -31,6 +52,7 @@ struct physmem_info {
+ u32 range_count;
+ u8 info_source;
+ unsigned long usable;
++ struct reserved_range reserved[RR_MAX];
+ struct physmem_range online[MEM_INLINED_ENTRIES];
+ struct physmem_range *online_extended;
+ };
+@@ -80,6 +102,70 @@ static inline int __get_physmem_range(u32 n, unsigned long *start,
+ #define for_each_physmem_online_range(i, p_start, p_end) \
+ for (i = 0; !__get_physmem_range(i, p_start, p_end, false); i++)
+
++static inline const char *get_physmem_info_source(void)
++{
++ switch (physmem_info.info_source) {
++ case MEM_DETECT_SCLP_STOR_INFO:
++ return "sclp storage info";
++ case MEM_DETECT_DIAG260:
++ return "diag260";
++ case MEM_DETECT_SCLP_READ_INFO:
++ return "sclp read info";
++ case MEM_DETECT_BIN_SEARCH:
++ return "binary search";
++ }
++ return "none";
++}
++
++#define RR_TYPE_NAME(t) case RR_ ## t: return #t
++static inline const char *get_rr_type_name(enum reserved_range_type t)
++{
++ switch (t) {
++ RR_TYPE_NAME(DECOMPRESSOR);
++ RR_TYPE_NAME(INITRD);
++ RR_TYPE_NAME(VMLINUX);
++ RR_TYPE_NAME(AMODE31);
++ RR_TYPE_NAME(IPLREPORT);
++ RR_TYPE_NAME(CERT_COMP_LIST);
++ RR_TYPE_NAME(MEM_DETECT_EXTENDED);
++ RR_TYPE_NAME(VMEM);
++#ifdef CONFIG_KASAN
++ RR_TYPE_NAME(KASAN);
++#endif
++ default:
++ return "UNKNOWN";
++ }
++}
++
++#define for_each_physmem_reserved_type_range(t, range, p_start, p_end) \
++ for (range = &physmem_info.reserved[t], *p_start = range->start, *p_end = range->end; \
++ range && range->end; range = range->chain, \
++ *p_start = range ? range->start : 0, *p_end = range ? range->end : 0)
++
++static inline struct reserved_range *__physmem_reserved_next(enum reserved_range_type *t,
++ struct reserved_range *range)
++{
++ if (!range) {
++ range = &physmem_info.reserved[*t];
++ if (range->end)
++ return range;
++ }
++ if (range->chain)
++ return range->chain;
++ while (++*t < RR_MAX) {
++ range = &physmem_info.reserved[*t];
++ if (range->end)
++ return range;
++ }
++ return NULL;
++}
++
++#define for_each_physmem_reserved_range(t, range, p_start, p_end) \
++ for (t = 0, range = __physmem_reserved_next(&t, NULL), \
++ *p_start = range ? range->start : 0, *p_end = range ? range->end : 0; \
++ range; range = __physmem_reserved_next(&t, range), \
++ *p_start = range ? range->start : 0, *p_end = range ? range->end : 0)
++
+ static inline unsigned long get_physmem_usable_total(void)
+ {
+ unsigned long start, end, total = 0;
+@@ -91,28 +177,12 @@ static inline unsigned long get_physmem_usable_total(void)
+ return total;
+ }
+
+-static inline void get_physmem_reserved(unsigned long *start, unsigned long *size)
++static inline unsigned long get_physmem_reserved(enum reserved_range_type type,
++ unsigned long *addr, unsigned long *size)
+ {
+- *start = (unsigned long)physmem_info.online_extended;
+- if (physmem_info.range_count > MEM_INLINED_ENTRIES)
+- *size = (physmem_info.range_count - MEM_INLINED_ENTRIES) *
+- sizeof(struct physmem_range);
+- else
+- *size = 0;
+-}
+-
+-static inline unsigned long get_physmem_usable_end(void)
+-{
+- unsigned long start;
+- unsigned long end;
+-
+- if (physmem_info.usable)
+- return physmem_info.usable;
+- if (physmem_info.range_count) {
+- __get_physmem_range(physmem_info.range_count - 1, &start, &end, false);
+- return end;
+- }
+- return 0;
++ *addr = physmem_info.reserved[type].start;
++ *size = physmem_info.reserved[type].end - physmem_info.reserved[type].start;
++ return *size;
+ }
+
+ #endif
+diff --git a/arch/s390/include/asm/setup.h b/arch/s390/include/asm/setup.h
+index fc887e3e76f84..966d569f49b7b 100644
+--- a/arch/s390/include/asm/setup.h
++++ b/arch/s390/include/asm/setup.h
+@@ -74,10 +74,6 @@ extern unsigned int zlib_dfltcc_support;
+
+ extern int noexec_disabled;
+ extern unsigned long ident_map_size;
+-extern unsigned long pgalloc_pos;
+-extern unsigned long pgalloc_end;
+-extern unsigned long pgalloc_low;
+-extern unsigned long __amode31_base;
+
+ /* The Write Back bit position in the physaddr is given by the SLPC PCI */
+ extern unsigned long mio_wb_bit_mask;
+@@ -150,11 +146,6 @@ static inline unsigned long kaslr_offset(void)
+ return __kaslr_offset;
+ }
+
+-struct initrd_data {
+- unsigned long start;
+- unsigned long size;
+-};
+-extern struct initrd_data initrd_data;
+
+ struct oldmem_data {
+ unsigned long start;
+diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
+index f909a2dc8a5a2..d25425b8d0c0d 100644
+--- a/arch/s390/kernel/setup.c
++++ b/arch/s390/kernel/setup.c
+@@ -148,13 +148,8 @@ static u32 __amode31_ref *__ctl_duct = __ctl_duct_amode31;
+ int __bootdata(noexec_disabled);
+ unsigned long __bootdata(ident_map_size);
+ struct physmem_info __bootdata(physmem_info);
+-struct initrd_data __bootdata(initrd_data);
+-unsigned long __bootdata(pgalloc_pos);
+-unsigned long __bootdata(pgalloc_end);
+-unsigned long __bootdata(pgalloc_low);
+
+ unsigned long __bootdata_preserved(__kaslr_offset);
+-unsigned long __bootdata(__amode31_base);
+ unsigned int __bootdata_preserved(zlib_dfltcc_support);
+ EXPORT_SYMBOL(zlib_dfltcc_support);
+ u64 __bootdata_preserved(stfle_fac_list[16]);
+@@ -635,7 +630,11 @@ static struct notifier_block kdump_mem_nb = {
+ */
+ static void __init reserve_pgtables(void)
+ {
+- memblock_reserve(pgalloc_pos, pgalloc_end - pgalloc_pos);
++ unsigned long start, end;
++ struct reserved_range *range;
++
++ for_each_physmem_reserved_type_range(RR_VMEM, range, &start, &end)
++ memblock_reserve(start, end - start);
+ }
+
+ /*
+@@ -712,13 +711,13 @@ static void __init reserve_crashkernel(void)
+ */
+ static void __init reserve_initrd(void)
+ {
+-#ifdef CONFIG_BLK_DEV_INITRD
+- if (!initrd_data.start || !initrd_data.size)
++ unsigned long addr, size;
++
++ if (!IS_ENABLED(CONFIG_BLK_DEV_INITRD) || !get_physmem_reserved(RR_INITRD, &addr, &size))
+ return;
+- initrd_start = (unsigned long)__va(initrd_data.start);
+- initrd_end = initrd_start + initrd_data.size;
+- memblock_reserve(initrd_data.start, initrd_data.size);
+-#endif
++ initrd_start = (unsigned long)__va(addr);
++ initrd_end = initrd_start + size;
++ memblock_reserve(addr, size);
+ }
+
+ /*
+@@ -732,35 +731,18 @@ static void __init reserve_certificate_list(void)
+
+ static void __init reserve_physmem_info(void)
+ {
+- unsigned long start, size;
++ unsigned long addr, size;
+
+- get_physmem_reserved(&start, &size);
+- if (size)
+- memblock_reserve(start, size);
++ if (get_physmem_reserved(RR_MEM_DETECT_EXTENDED, &addr, &size))
++ memblock_reserve(addr, size);
+ }
+
+ static void __init free_physmem_info(void)
+ {
+- unsigned long start, size;
++ unsigned long addr, size;
+
+- get_physmem_reserved(&start, &size);
+- if (size)
+- memblock_phys_free(start, size);
+-}
+-
+-static const char * __init get_mem_info_source(void)
+-{
+- switch (physmem_info.info_source) {
+- case MEM_DETECT_SCLP_STOR_INFO:
+- return "sclp storage info";
+- case MEM_DETECT_DIAG260:
+- return "diag260";
+- case MEM_DETECT_SCLP_READ_INFO:
+- return "sclp read info";
+- case MEM_DETECT_BIN_SEARCH:
+- return "binary search";
+- }
+- return "none";
++ if (get_physmem_reserved(RR_MEM_DETECT_EXTENDED, &addr, &size))
++ memblock_phys_free(addr, size);
+ }
+
+ static void __init memblock_add_physmem_info(void)
+@@ -769,7 +751,7 @@ static void __init memblock_add_physmem_info(void)
+ int i;
+
+ pr_debug("physmem info source: %s (%hhd)\n",
+- get_mem_info_source(), physmem_info.info_source);
++ get_physmem_info_source(), physmem_info.info_source);
+ /* keep memblock lists close to the kernel */
+ memblock_set_bottom_up(true);
+ for_each_physmem_usable_range(i, &start, &end)
+@@ -780,21 +762,6 @@ static void __init memblock_add_physmem_info(void)
+ memblock_set_node(0, ULONG_MAX, &memblock.memory, 0);
+ }
+
+-/*
+- * Check for initrd being in usable memory
+- */
+-static void __init check_initrd(void)
+-{
+-#ifdef CONFIG_BLK_DEV_INITRD
+- if (initrd_data.start && initrd_data.size &&
+- !memblock_is_region_memory(initrd_data.start, initrd_data.size)) {
+- pr_err("The initial RAM disk does not fit into the memory\n");
+- memblock_phys_free(initrd_data.start, initrd_data.size);
+- initrd_start = initrd_end = 0;
+- }
+-#endif
+-}
+-
+ /*
+ * Reserve memory used for lowcore/command line/kernel image.
+ */
+@@ -803,7 +770,7 @@ static void __init reserve_kernel(void)
+ memblock_reserve(0, STARTUP_NORMAL_OFFSET);
+ memblock_reserve(OLDMEM_BASE, sizeof(unsigned long));
+ memblock_reserve(OLDMEM_SIZE, sizeof(unsigned long));
+- memblock_reserve(__amode31_base, __eamode31 - __samode31);
++ memblock_reserve(physmem_info.reserved[RR_AMODE31].start, __eamode31 - __samode31);
+ memblock_reserve(__pa(sclp_early_sccb), EXT_SCCB_READ_SCP);
+ memblock_reserve(__pa(_stext), _end - _stext);
+ }
+@@ -825,13 +792,13 @@ static void __init setup_memory(void)
+ static void __init relocate_amode31_section(void)
+ {
+ unsigned long amode31_size = __eamode31 - __samode31;
+- long amode31_offset = __amode31_base - __samode31;
++ long amode31_offset = physmem_info.reserved[RR_AMODE31].start - __samode31;
+ long *ptr;
+
+ pr_info("Relocating AMODE31 section of size 0x%08lx\n", amode31_size);
+
+ /* Move original AMODE31 section to the new one */
+- memmove((void *)__amode31_base, (void *)__samode31, amode31_size);
++ memmove((void *)physmem_info.reserved[RR_AMODE31].start, (void *)__samode31, amode31_size);
+ /* Zero out the old AMODE31 section to catch invalid accesses within it */
+ memset((void *)__samode31, 0, amode31_size);
+
+@@ -1017,7 +984,6 @@ void __init setup_arch(char **cmdline_p)
+ if (MACHINE_HAS_EDAT2)
+ hugetlb_cma_reserve(PUD_SHIFT - PAGE_SHIFT);
+
+- check_initrd();
+ reserve_crashkernel();
+ #ifdef CONFIG_CRASH_DUMP
+ /*
+diff --git a/arch/s390/mm/kasan_init.c b/arch/s390/mm/kasan_init.c
+index b0658136264ff..2b20382f1bd84 100644
+--- a/arch/s390/mm/kasan_init.c
++++ b/arch/s390/mm/kasan_init.c
+@@ -1,19 +1,15 @@
+ // SPDX-License-Identifier: GPL-2.0
+-#include <linux/kasan.h>
+-#include <linux/sched/task.h>
++#include <linux/memblock.h>
+ #include <linux/pgtable.h>
+-#include <asm/pgalloc.h>
+-#include <asm/kasan.h>
++#include <linux/kasan.h>
+ #include <asm/physmem_info.h>
+ #include <asm/processor.h>
+-#include <asm/sclp.h>
+ #include <asm/facility.h>
+-#include <asm/sections.h>
+-#include <asm/setup.h>
+-#include <asm/uv.h>
++#include <asm/pgalloc.h>
++#include <asm/sclp.h>
+
++static unsigned long pgalloc_pos __initdata;
+ static unsigned long segment_pos __initdata;
+-static unsigned long segment_low __initdata;
+ static bool has_edat __initdata;
+ static bool has_nx __initdata;
+
+@@ -28,19 +24,20 @@ static void __init kasan_early_panic(const char *reason)
+
+ static void * __init kasan_early_alloc_segment(void)
+ {
+- segment_pos -= _SEGMENT_SIZE;
++ unsigned long addr = segment_pos;
+
+- if (segment_pos < segment_low)
++ segment_pos += _SEGMENT_SIZE;
++ if (segment_pos > pgalloc_pos)
+ kasan_early_panic("out of memory during initialisation\n");
+
+- return __va(segment_pos);
++ return __va(addr);
+ }
+
+ static void * __init kasan_early_alloc_pages(unsigned int order)
+ {
+ pgalloc_pos -= (PAGE_SIZE << order);
+
+- if (pgalloc_pos < pgalloc_low)
++ if (segment_pos > pgalloc_pos)
+ kasan_early_panic("out of memory during initialisation\n");
+
+ return __va(pgalloc_pos);
+@@ -225,8 +222,8 @@ void __init kasan_early_init(void)
+ pmd_t pmd_z = __pmd(__pa(kasan_early_shadow_pte) | _SEGMENT_ENTRY);
+ pud_t pud_z = __pud(__pa(kasan_early_shadow_pmd) | _REGION3_ENTRY);
+ p4d_t p4d_z = __p4d(__pa(kasan_early_shadow_pud) | _REGION2_ENTRY);
++ unsigned long pgalloc_pos_initial, segment_pos_initial;
+ unsigned long untracked_end = MODULES_VADDR;
+- unsigned long shadow_alloc_size;
+ unsigned long start, end;
+ int i;
+
+@@ -243,13 +240,11 @@ void __init kasan_early_init(void)
+ crst_table_init((unsigned long *)kasan_early_shadow_pmd, pmd_val(pmd_z));
+ memset64((u64 *)kasan_early_shadow_pte, pte_val(pte_z), PTRS_PER_PTE);
+
+- if (has_edat) {
+- shadow_alloc_size = get_physmem_usable_total() >> KASAN_SHADOW_SCALE_SHIFT;
+- segment_pos = round_down(pgalloc_pos, _SEGMENT_SIZE);
+- segment_low = segment_pos - shadow_alloc_size;
+- segment_low = round_down(segment_low, _SEGMENT_SIZE);
+- pgalloc_pos = segment_low;
+- }
++ /* segment allocations go bottom up -> <- pgalloc go top down */
++ segment_pos_initial = physmem_info.reserved[RR_KASAN].start;
++ segment_pos = segment_pos_initial;
++ pgalloc_pos_initial = physmem_info.reserved[RR_KASAN].end;
++ pgalloc_pos = pgalloc_pos_initial;
+ /*
+ * Current memory layout:
+ * +- 0 -------------+ +- shadow start -+
+@@ -298,4 +293,6 @@ void __init kasan_early_init(void)
+ /* enable kasan */
+ init_task.kasan_depth = 0;
+ sclp_early_printk("KernelAddressSanitizer initialized\n");
++ memblock_reserve(segment_pos_initial, segment_pos - segment_pos_initial);
++ memblock_reserve(pgalloc_pos, pgalloc_pos_initial - pgalloc_pos);
+ }
+--
+2.39.2
+
--- /dev/null
+From 60cfac2a7ec6cfc905638650a70ae6f3cdd50e1f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Mar 2023 12:55:46 +0200
+Subject: s390/checksum: always use cksm instruction
+
+From: Heiko Carstens <hca@linux.ibm.com>
+
+[ Upstream commit e42ac7789df64120d7d3d57433dfc9f37ec0cb99 ]
+
+Commit dfe843dce775 ("s390/checksum: support GENERIC_CSUM, enable it for
+KASAN") switched s390 to use the generic checksum functions, so that KASAN
+instrumentation also works checksum functions by avoiding architecture
+specific inline assemblies.
+
+There is however the problem that the generic csum_partial() function
+returns a 32 bit value with a 16 bit folded checksum, while the original
+s390 variant does not fold to 16 bit. This in turn causes that the
+ipib_checksum in lowcore contains different values depending on kernel
+config options.
+
+The ipib_checksum is used by system dumpers to verify if pointers in
+lowcore point to valid data. Verification is done by comparing checksum
+values. The system dumpers still use 32 bit checksum values which are not
+folded, and therefore the checksum verification fails (incorrectly).
+
+Symptom is that reboot after dump does not work anymore when a KASAN
+instrumented kernel is dumped.
+
+Fix this by not using the generic checksum implementation. Instead add an
+explicit kasan_check_read() so that KASAN knows about the read access from
+within the inline assembly.
+
+Reported-by: Alexander Egorenkov <egorenar@linux.ibm.com>
+Fixes: dfe843dce775 ("s390/checksum: support GENERIC_CSUM, enable it for KASAN")
+Tested-by: Alexander Egorenkov <egorenar@linux.ibm.com>
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/Kconfig | 4 ----
+ arch/s390/include/asm/checksum.h | 9 ++-------
+ 2 files changed, 2 insertions(+), 11 deletions(-)
+
+diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
+index 9809c74e12406..35f15c23c4913 100644
+--- a/arch/s390/Kconfig
++++ b/arch/s390/Kconfig
+@@ -26,10 +26,6 @@ config GENERIC_BUG
+ config GENERIC_BUG_RELATIVE_POINTERS
+ def_bool y
+
+-config GENERIC_CSUM
+- bool
+- default y if KASAN
+-
+ config GENERIC_LOCKBREAK
+ def_bool y if PREEMPTION
+
+diff --git a/arch/s390/include/asm/checksum.h b/arch/s390/include/asm/checksum.h
+index d977a3a2f6190..1b6b992cf18ed 100644
+--- a/arch/s390/include/asm/checksum.h
++++ b/arch/s390/include/asm/checksum.h
+@@ -12,12 +12,7 @@
+ #ifndef _S390_CHECKSUM_H
+ #define _S390_CHECKSUM_H
+
+-#ifdef CONFIG_GENERIC_CSUM
+-
+-#include <asm-generic/checksum.h>
+-
+-#else /* CONFIG_GENERIC_CSUM */
+-
++#include <linux/kasan-checks.h>
+ #include <linux/uaccess.h>
+ #include <linux/in6.h>
+
+@@ -40,6 +35,7 @@ static inline __wsum csum_partial(const void *buff, int len, __wsum sum)
+ .odd = (unsigned long) len,
+ };
+
++ kasan_check_read(buff, len);
+ asm volatile(
+ "0: cksm %[sum],%[rp]\n"
+ " jo 0b\n"
+@@ -135,5 +131,4 @@ static inline __sum16 csum_ipv6_magic(const struct in6_addr *saddr,
+ return csum_fold((__force __wsum)(sum >> 32));
+ }
+
+-#endif /* CONFIG_GENERIC_CSUM */
+ #endif /* _S390_CHECKSUM_H */
+--
+2.39.2
+
--- /dev/null
+From 0c482f0d2e133620ada2bcdc41efebc744a09e05 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Apr 2023 17:50:12 +0000
+Subject: sched/clock: Fix local_clock() before sched_clock_init()
+
+From: Aaron Thompson <dev@aaront.org>
+
+[ Upstream commit f31dcb152a3d0816e2f1deab4e64572336da197d ]
+
+Have local_clock() return sched_clock() if sched_clock_init() has not
+yet run. sched_clock_cpu() has this check but it was not included in the
+new noinstr implementation of local_clock().
+
+The effect can be seen on x86 with CONFIG_PRINTK_TIME enabled, for
+instance. scd->clock quickly reaches the value of TICK_NSEC and that
+value is returned until sched_clock_init() runs.
+
+dmesg without this patch:
+
+ [ 0.000000] kvm-clock: ...
+ [ 0.000002] kvm-clock: ...
+ [ 0.000672] clocksource: ...
+ [ 0.001000] tsc: ...
+ [ 0.001000] e820: ...
+ [ 0.001000] e820: ...
+ ...
+ [ 0.001000] ..TIMER: ...
+ [ 0.001000] clocksource: ...
+ [ 0.378956] Calibrating delay loop ...
+ [ 0.379955] pid_max: ...
+
+dmesg with this patch:
+
+ [ 0.000000] kvm-clock: ...
+ [ 0.000001] kvm-clock: ...
+ [ 0.000675] clocksource: ...
+ [ 0.002685] tsc: ...
+ [ 0.003331] e820: ...
+ [ 0.004190] e820: ...
+ ...
+ [ 0.421939] ..TIMER: ...
+ [ 0.422842] clocksource: ...
+ [ 0.424582] Calibrating delay loop ...
+ [ 0.425580] pid_max: ...
+
+Fixes: 776f22913b8e ("sched/clock: Make local_clock() noinstr")
+Signed-off-by: Aaron Thompson <dev@aaront.org>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://lkml.kernel.org/r/20230413175012.2201-1-dev@aaront.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/clock.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/kernel/sched/clock.c b/kernel/sched/clock.c
+index 5732fa75ebab2..b5cc2b53464de 100644
+--- a/kernel/sched/clock.c
++++ b/kernel/sched/clock.c
+@@ -300,6 +300,9 @@ noinstr u64 local_clock(void)
+ if (static_branch_likely(&__sched_clock_stable))
+ return sched_clock() + __sched_clock_offset;
+
++ if (!static_branch_likely(&sched_clock_running))
++ return sched_clock();
++
+ preempt_disable_notrace();
+ clock = sched_clock_local(this_scd());
+ preempt_enable_notrace();
+--
+2.39.2
+
--- /dev/null
+From f5d74540f2ff3632e6851b2593f34c650560aa58 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Aug 2022 15:33:13 -0700
+Subject: sched/fair: Fix inaccurate tally of ttwu_move_affine
+
+From: Libo Chen <libo.chen@oracle.com>
+
+[ Upstream commit 39afe5d6fc59237ff7738bf3ede5a8856822d59d ]
+
+There are scenarios where non-affine wakeups are incorrectly counted as
+affine wakeups by schedstats.
+
+When wake_affine_idle() returns prev_cpu which doesn't equal to
+nr_cpumask_bits, it will slip through the check: target == nr_cpumask_bits
+in wake_affine() and be counted as if target == this_cpu in schedstats.
+
+Replace target == nr_cpumask_bits with target != this_cpu to make sure
+affine wakeups are accurately tallied.
+
+Fixes: 806486c377e33 (sched/fair: Do not migrate if the prev_cpu is idle)
+Suggested-by: Daniel Jordan <daniel.m.jordan@oracle.com>
+Signed-off-by: Libo Chen <libo.chen@oracle.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Gautham R. Shenoy <gautham.shenoy@amd.com>
+Link: https://lore.kernel.org/r/20220810223313.386614-1-libo.chen@oracle.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/fair.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index 5f6587d94c1dd..ed89be0aa6503 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -6614,7 +6614,7 @@ static int wake_affine(struct sched_domain *sd, struct task_struct *p,
+ target = wake_affine_weight(sd, p, this_cpu, prev_cpu, sync);
+
+ schedstat_inc(p->stats.nr_wakeups_affine_attempts);
+- if (target == nr_cpumask_bits)
++ if (target != this_cpu)
+ return prev_cpu;
+
+ schedstat_inc(sd->ttwu_move_affine);
+--
+2.39.2
+
--- /dev/null
+From 5401fff35dce8aafdd2914513af4b4f8be8dde01 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Aug 2022 01:03:02 +0800
+Subject: sched/rt: Fix bad task migration for rt tasks
+
+From: Schspa Shi <schspa@gmail.com>
+
+[ Upstream commit feffe5bb274dd3442080ef0e4053746091878799 ]
+
+Commit 95158a89dd50 ("sched,rt: Use the full cpumask for balancing")
+allows find_lock_lowest_rq() to pick a task with migration disabled.
+The purpose of the commit is to push the current running task on the
+CPU that has the migrate_disable() task away.
+
+However, there is a race which allows a migrate_disable() task to be
+migrated. Consider:
+
+ CPU0 CPU1
+ push_rt_task
+ check is_migration_disabled(next_task)
+
+ task not running and
+ migration_disabled == 0
+
+ find_lock_lowest_rq(next_task, rq);
+ _double_lock_balance(this_rq, busiest);
+ raw_spin_rq_unlock(this_rq);
+ double_rq_lock(this_rq, busiest);
+ <<wait for busiest rq>>
+ <wakeup>
+ task become running
+ migrate_disable();
+ <context out>
+ deactivate_task(rq, next_task, 0);
+ set_task_cpu(next_task, lowest_rq->cpu);
+ WARN_ON_ONCE(is_migration_disabled(p));
+
+Fixes: 95158a89dd50 ("sched,rt: Use the full cpumask for balancing")
+Signed-off-by: Schspa Shi <schspa@gmail.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Reviewed-by: Dietmar Eggemann <dietmar.eggemann@arm.com>
+Reviewed-by: Valentin Schneider <vschneid@redhat.com>
+Tested-by: Dwaine Gonyier <dgonyier@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/deadline.c | 1 +
+ kernel/sched/rt.c | 4 ++++
+ 2 files changed, 5 insertions(+)
+
+diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c
+index 71b24371a6f77..ac8010f6f3a22 100644
+--- a/kernel/sched/deadline.c
++++ b/kernel/sched/deadline.c
+@@ -2246,6 +2246,7 @@ static struct rq *find_lock_later_rq(struct task_struct *task, struct rq *rq)
+ !cpumask_test_cpu(later_rq->cpu, &task->cpus_mask) ||
+ task_on_cpu(rq, task) ||
+ !dl_task(task) ||
++ is_migration_disabled(task) ||
+ !task_on_rq_queued(task))) {
+ double_unlock_balance(rq, later_rq);
+ later_rq = NULL;
+diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c
+index 0a11f44adee57..4f5796dd26a56 100644
+--- a/kernel/sched/rt.c
++++ b/kernel/sched/rt.c
+@@ -2000,11 +2000,15 @@ static struct rq *find_lock_lowest_rq(struct task_struct *task, struct rq *rq)
+ * the mean time, task could have
+ * migrated already or had its affinity changed.
+ * Also make sure that it wasn't scheduled on its rq.
++ * It is possible the task was scheduled, set
++ * "migrate_disabled" and then got preempted, so we must
++ * check the task migration disable flag here too.
+ */
+ if (unlikely(task_rq(task) != rq ||
+ !cpumask_test_cpu(lowest_rq->cpu, &task->cpus_mask) ||
+ task_on_cpu(rq, task) ||
+ !rt_task(task) ||
++ is_migration_disabled(task) ||
+ !task_on_rq_queued(task))) {
+
+ double_unlock_balance(rq, lowest_rq);
+--
+2.39.2
+
--- /dev/null
+From db8de88ba3369e836cb7a3e9c5a004ef0f687fe6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Mar 2023 12:32:11 +0100
+Subject: scm: fix MSG_CTRUNC setting condition for SO_PASSSEC
+
+From: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@canonical.com>
+
+[ Upstream commit a02d83f9947d8f71904eda4de046630c3eb6802c ]
+
+Currently, kernel would set MSG_CTRUNC flag if msg_control buffer
+wasn't provided and SO_PASSCRED was set or if there was pending SCM_RIGHTS.
+
+For some reason we have no corresponding check for SO_PASSSEC.
+
+In the recvmsg(2) doc we have:
+ MSG_CTRUNC
+ indicates that some control data was discarded due to lack
+ of space in the buffer for ancillary data.
+
+So, we need to set MSG_CTRUNC flag for all types of SCM.
+
+This change can break applications those don't check MSG_CTRUNC flag.
+
+Cc: "David S. Miller" <davem@davemloft.net>
+Cc: Eric Dumazet <edumazet@google.com>
+Cc: Jakub Kicinski <kuba@kernel.org>
+Cc: Paolo Abeni <pabeni@redhat.com>
+Cc: Leon Romanovsky <leon@kernel.org>
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@canonical.com>
+
+v2:
+- commit message was rewritten according to Eric's suggestion
+Acked-by: Paul Moore <paul@paul-moore.com>
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/scm.h | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/include/net/scm.h b/include/net/scm.h
+index 1ce365f4c2560..585adc1346bd0 100644
+--- a/include/net/scm.h
++++ b/include/net/scm.h
+@@ -105,16 +105,27 @@ static inline void scm_passec(struct socket *sock, struct msghdr *msg, struct sc
+ }
+ }
+ }
++
++static inline bool scm_has_secdata(struct socket *sock)
++{
++ return test_bit(SOCK_PASSSEC, &sock->flags);
++}
+ #else
+ static inline void scm_passec(struct socket *sock, struct msghdr *msg, struct scm_cookie *scm)
+ { }
++
++static inline bool scm_has_secdata(struct socket *sock)
++{
++ return false;
++}
+ #endif /* CONFIG_SECURITY_NETWORK */
+
+ static __inline__ void scm_recv(struct socket *sock, struct msghdr *msg,
+ struct scm_cookie *scm, int flags)
+ {
+ if (!msg->msg_control) {
+- if (test_bit(SOCK_PASSCRED, &sock->flags) || scm->fp)
++ if (test_bit(SOCK_PASSCRED, &sock->flags) || scm->fp ||
++ scm_has_secdata(sock))
+ msg->msg_flags |= MSG_CTRUNC;
+ scm_destroy(scm);
+ return;
+--
+2.39.2
+
--- /dev/null
+From ec4033e729ef1b59826a317aa4da50db5349c5da Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Mar 2023 15:52:45 -0700
+Subject: scripts/gdb: bail early if there are no clocks
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit 1d7adbc74c009057ed9dc3112f388e91a9c79acc ]
+
+Avoid generating an exception if there are no clocks registered:
+
+(gdb) lx-clk-summary
+ enable prepare protect
+ clock count count count rate
+------------------------------------------------------------------------
+Python Exception <class 'gdb.error'>: No symbol "clk_root_list" in
+current context.
+Error occurred in Python: No symbol "clk_root_list" in current context.
+
+Link: https://lkml.kernel.org/r/20230323225246.3302977-1-f.fainelli@gmail.com
+Fixes: d1e9710b63d8 ("scripts/gdb: initial clk support: lx-clk-summary")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Cc: Jan Kiszka <jan.kiszka@siemens.com>
+Cc: Kieran Bingham <kbingham@kernel.org>
+Cc: Leonard Crestez <leonard.crestez@nxp.com>
+Cc: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/gdb/linux/clk.py | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/scripts/gdb/linux/clk.py b/scripts/gdb/linux/clk.py
+index 061aecfa294e6..7a01fdc3e8446 100644
+--- a/scripts/gdb/linux/clk.py
++++ b/scripts/gdb/linux/clk.py
+@@ -41,6 +41,8 @@ are cached and potentially out of date"""
+ self.show_subtree(child, level + 1)
+
+ def invoke(self, arg, from_tty):
++ if utils.gdb_eval_or_none("clk_root_list") is None:
++ raise gdb.GdbError("No clocks registered")
+ gdb.write(" enable prepare protect \n")
+ gdb.write(" clock count count count rate \n")
+ gdb.write("------------------------------------------------------------------------\n")
+--
+2.39.2
+
--- /dev/null
+From 639fd61a0c57a151e28ecde824ce14d9031442ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Mar 2023 16:16:57 -0700
+Subject: scripts/gdb: bail early if there are no generic PD
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit f19c3c2959e465209ade1a7a699e6cbf4359ce78 ]
+
+Avoid generating an exception if there are no generic power domain(s)
+registered:
+
+(gdb) lx-genpd-summary
+domain status children
+ /device runtime status
+----------------------------------------------------------------------
+Python Exception <class 'gdb.error'>: No symbol "gpd_list" in current context.
+Error occurred in Python: No symbol "gpd_list" in current context.
+(gdb) quit
+
+[f.fainelli@gmail.com: correctly invoke gdb_eval_or_none]
+ Link: https://lkml.kernel.org/r/20230327185746.3856407-1-f.fainelli@gmail.com
+Link: https://lkml.kernel.org/r/20230323231659.3319941-1-f.fainelli@gmail.com
+Fixes: 8207d4a88e1e ("scripts/gdb: add lx-genpd-summary command")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Cc: Jan Kiszka <jan.kiszka@siemens.com>
+Cc: Kieran Bingham <kbingham@kernel.org>
+Cc: Leonard Crestez <leonard.crestez@nxp.com>
+Cc: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/gdb/linux/genpd.py | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/scripts/gdb/linux/genpd.py b/scripts/gdb/linux/genpd.py
+index 39cd1abd85590..b53649c0a77a6 100644
+--- a/scripts/gdb/linux/genpd.py
++++ b/scripts/gdb/linux/genpd.py
+@@ -5,7 +5,7 @@
+ import gdb
+ import sys
+
+-from linux.utils import CachedType
++from linux.utils import CachedType, gdb_eval_or_none
+ from linux.lists import list_for_each_entry
+
+ generic_pm_domain_type = CachedType('struct generic_pm_domain')
+@@ -70,6 +70,8 @@ Output is similar to /sys/kernel/debug/pm_genpd/pm_genpd_summary'''
+ gdb.write(' %-50s %s\n' % (kobj_path, rtpm_status_str(dev)))
+
+ def invoke(self, arg, from_tty):
++ if gdb_eval_or_none("&gpd_list") is None:
++ raise gdb.GdbError("No power domain(s) registered")
+ gdb.write('domain status children\n');
+ gdb.write(' /device runtime status\n');
+ gdb.write('----------------------------------------------------------------------\n');
+--
+2.39.2
+
--- /dev/null
+From 2e90d0de21c1515b2e79dd20f320a7dd7f2cbbe3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Apr 2023 14:52:51 -0700
+Subject: scripts/gdb: raise error with reduced debugging information
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit 8af055ae25bff48f57227f5e3d48a4306f3dd1c4 ]
+
+If CONFIG_DEBUG_INFO_REDUCED is enabled in the kernel configuration, we
+will typically not be able to load vmlinux-gdb.py and will fail with:
+
+Traceback (most recent call last):
+ File "/home/fainelli/work/buildroot/output/arm64/build/linux-custom/vmlinux-gdb.py", line 25, in <module>
+ import linux.utils
+ File "/home/fainelli/work/buildroot/output/arm64/build/linux-custom/scripts/gdb/linux/utils.py", line 131, in <module>
+ atomic_long_counter_offset = atomic_long_type.get_type()['counter'].bitpos
+KeyError: 'counter'
+
+Rather be left wondering what is happening only to find out that reduced
+debug information is the cause, raise an eror. This was not typically a
+problem until e3c8d33e0d62 ("scripts/gdb: fix 'lx-dmesg' on 32 bits arch")
+but it has since then.
+
+Link: https://lkml.kernel.org/r/20230406215252.1580538-1-f.fainelli@gmail.com
+Fixes: e3c8d33e0d62 ("scripts/gdb: fix 'lx-dmesg' on 32 bits arch")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Cc: Antonio Borneo <antonio.borneo@foss.st.com>
+Cc: Jan Kiszka <jan.kiszka@siemens.com>
+Cc: John Ogness <john.ogness@linutronix.de>
+Cc: Kieran Bingham <kbingham@kernel.org>
+Cc: Petr Mladek <pmladek@suse.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/gdb/linux/constants.py.in | 2 ++
+ scripts/gdb/vmlinux-gdb.py | 5 ++++-
+ 2 files changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/scripts/gdb/linux/constants.py.in b/scripts/gdb/linux/constants.py.in
+index 2efbec6b6b8db..08f0587d15ea1 100644
+--- a/scripts/gdb/linux/constants.py.in
++++ b/scripts/gdb/linux/constants.py.in
+@@ -39,6 +39,8 @@
+
+ import gdb
+
++LX_CONFIG(CONFIG_DEBUG_INFO_REDUCED)
++
+ /* linux/clk-provider.h */
+ if IS_BUILTIN(CONFIG_COMMON_CLK):
+ LX_GDBPARSED(CLK_GET_RATE_NOCACHE)
+diff --git a/scripts/gdb/vmlinux-gdb.py b/scripts/gdb/vmlinux-gdb.py
+index 3a5b44cd6bfe4..7e024c051e77f 100644
+--- a/scripts/gdb/vmlinux-gdb.py
++++ b/scripts/gdb/vmlinux-gdb.py
+@@ -22,6 +22,10 @@ except:
+ gdb.write("NOTE: gdb 7.2 or later required for Linux helper scripts to "
+ "work.\n")
+ else:
++ import linux.constants
++ if linux.constants.LX_CONFIG_DEBUG_INFO_REDUCED:
++ raise gdb.GdbError("Reduced debug information will prevent GDB "
++ "from having complete types.\n")
+ import linux.utils
+ import linux.symbols
+ import linux.modules
+@@ -32,7 +36,6 @@ else:
+ import linux.lists
+ import linux.rbtree
+ import linux.proc
+- import linux.constants
+ import linux.timerlist
+ import linux.clk
+ import linux.genpd
+--
+2.39.2
+
--- /dev/null
+From b5ccf764cd64447e5a88db5779423762b78a525a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Mar 2023 11:34:23 +0800
+Subject: scsi: hisi_sas: Handle NCQ error when IPTT is valid
+
+From: Xingui Yang <yangxingui@huawei.com>
+
+[ Upstream commit bb544224da77b96b2c11a13872bf91ede1e015be ]
+
+If an NCQ error occurs when the IPTT is valid and slot->abort flag is set
+in completion path, sas_task_abort() will be called to abort only one NCQ
+command now, and the host would be set to SHOST_RECOVERY state. But this
+may not kick-off EH Immediately until other outstanding QCs timeouts. As a
+result, the host may remain in the SHOST_RECOVERY state for up to 30
+seconds, such as follows:
+
+[7972317.645234] hisi_sas_v3_hw 0000:74:04.0: erroneous completion iptt=3264 task=00000000466116b8 dev id=2 sas_addr=0x5000000000000502 CQ hdr: 0x1883 0x20cc0 0x40000 0x20420000 Error info: 0x0 0x0 0x200000 0x0
+[7972341.508264] sas: Enter sas_scsi_recover_host busy: 32 failed: 32
+[7972341.984731] sas: --- Exit sas_scsi_recover_host: busy: 0 failed: 32 tries: 1
+
+All NCQ commands that are in the queue should be aborted when an NCQ error
+occurs in this scenario.
+
+Fixes: 05d91b557af9 ("scsi: hisi_sas: Directly trigger SCSI error handling for completion errors")
+Signed-off-by: Xingui Yang <yangxingui@huawei.com>
+Signed-off-by: Xiang Chen <chenxiang66@hisilicon.com>
+Link: https://lore.kernel.org/r/1679283265-115066-3-git-send-email-chenxiang66@hisilicon.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/hisi_sas/hisi_sas_v1_hw.c | 6 +++++-
+ drivers/scsi/hisi_sas/hisi_sas_v2_hw.c | 6 +++++-
+ drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 6 +++++-
+ 3 files changed, 15 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c
+index d643c5a49aa94..70c24377c6a19 100644
+--- a/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c
++++ b/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c
+@@ -1258,7 +1258,11 @@ static void slot_complete_v1_hw(struct hisi_hba *hisi_hba,
+
+ slot_err_v1_hw(hisi_hba, task, slot);
+ if (unlikely(slot->abort)) {
+- sas_task_abort(task);
++ if (dev_is_sata(device) && task->ata_task.use_ncq)
++ sas_ata_device_link_abort(device, true);
++ else
++ sas_task_abort(task);
++
+ return;
+ }
+ goto out;
+diff --git a/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c
+index cded42f4ca445..02575d81afca2 100644
+--- a/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c
++++ b/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c
+@@ -2404,7 +2404,11 @@ static void slot_complete_v2_hw(struct hisi_hba *hisi_hba,
+ error_info[2], error_info[3]);
+
+ if (unlikely(slot->abort)) {
+- sas_task_abort(task);
++ if (dev_is_sata(device) && task->ata_task.use_ncq)
++ sas_ata_device_link_abort(device, true);
++ else
++ sas_task_abort(task);
++
+ return;
+ }
+ goto out;
+diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+index a63279f55d096..9afc23e3a80fc 100644
+--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
++++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+@@ -2320,7 +2320,11 @@ static void slot_complete_v3_hw(struct hisi_hba *hisi_hba,
+ error_info[0], error_info[1],
+ error_info[2], error_info[3]);
+ if (unlikely(slot->abort)) {
+- sas_task_abort(task);
++ if (dev_is_sata(device) && task->ata_task.use_ncq)
++ sas_ata_device_link_abort(device, true);
++ else
++ sas_task_abort(task);
++
+ return;
+ }
+ goto out;
+--
+2.39.2
+
--- /dev/null
+From 3207f368af39ab1d13c07d56d13e8dbf78dc20a5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Apr 2023 15:21:32 +0800
+Subject: scsi: lpfc: Fix ioremap issues in lpfc_sli4_pci_mem_setup()
+
+From: Shuchang Li <lishuchang@hust.edu.cn>
+
+[ Upstream commit 91a0c0c1413239d0548b5aac4c82f38f6d53a91e ]
+
+When if_type equals zero and pci_resource_start(pdev, PCI_64BIT_BAR4)
+returns false, drbl_regs_memmap_p is not remapped. This passes a NULL
+pointer to iounmap(), which can trigger a WARN() on certain arches.
+
+When if_type equals six and pci_resource_start(pdev, PCI_64BIT_BAR4)
+returns true, drbl_regs_memmap_p may has been remapped and
+ctrl_regs_memmap_p is not remapped. This is a resource leak and passes a
+NULL pointer to iounmap().
+
+To fix these issues, we need to add null checks before iounmap(), and
+change some goto labels.
+
+Fixes: 1351e69fc6db ("scsi: lpfc: Add push-to-adapter support to sli4")
+Signed-off-by: Shuchang Li <lishuchang@hust.edu.cn>
+Link: https://lore.kernel.org/r/20230404072133.1022-1-lishuchang@hust.edu.cn
+Reviewed-by: Justin Tee <justin.tee@broadcom.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_init.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
+index 4f7485958c49a..ed75230b02090 100644
+--- a/drivers/scsi/lpfc/lpfc_init.c
++++ b/drivers/scsi/lpfc/lpfc_init.c
+@@ -12026,7 +12026,7 @@ lpfc_sli4_pci_mem_setup(struct lpfc_hba *phba)
+ goto out_iounmap_all;
+ } else {
+ error = -ENOMEM;
+- goto out_iounmap_all;
++ goto out_iounmap_ctrl;
+ }
+ }
+
+@@ -12044,7 +12044,7 @@ lpfc_sli4_pci_mem_setup(struct lpfc_hba *phba)
+ dev_err(&pdev->dev,
+ "ioremap failed for SLI4 HBA dpp registers.\n");
+ error = -ENOMEM;
+- goto out_iounmap_ctrl;
++ goto out_iounmap_all;
+ }
+ phba->pci_bar4_memmap_p = phba->sli4_hba.dpp_regs_memmap_p;
+ }
+@@ -12069,9 +12069,11 @@ lpfc_sli4_pci_mem_setup(struct lpfc_hba *phba)
+ return 0;
+
+ out_iounmap_all:
+- iounmap(phba->sli4_hba.drbl_regs_memmap_p);
++ if (phba->sli4_hba.drbl_regs_memmap_p)
++ iounmap(phba->sli4_hba.drbl_regs_memmap_p);
+ out_iounmap_ctrl:
+- iounmap(phba->sli4_hba.ctrl_regs_memmap_p);
++ if (phba->sli4_hba.ctrl_regs_memmap_p)
++ iounmap(phba->sli4_hba.ctrl_regs_memmap_p);
+ out_iounmap_conf:
+ iounmap(phba->sli4_hba.conf_regs_memmap_p);
+
+--
+2.39.2
+
--- /dev/null
+From 2d4760413af5f66fe4defdb5562b60d33352c110 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Mar 2023 17:51:09 +0000
+Subject: scsi: megaraid: Fix mega_cmd_done() CMDID_INT_CMDS
+
+From: Danila Chernetsov <listdansp@mail.ru>
+
+[ Upstream commit 75cb113cd43f06aaf4f1bda0069cfd5b98e909eb ]
+
+When cmdid == CMDID_INT_CMDS, the 'cmds' pointer is NULL but is
+dereferenced below.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: 0f2bb84d2a68 ("[SCSI] megaraid: simplify internal command handling")
+Signed-off-by: Danila Chernetsov <listdansp@mail.ru>
+Link: https://lore.kernel.org/r/20230317175109.18585-1-listdansp@mail.ru
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/megaraid.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/scsi/megaraid.c b/drivers/scsi/megaraid.c
+index bf491af9f0d65..16e2cf848c6ef 100644
+--- a/drivers/scsi/megaraid.c
++++ b/drivers/scsi/megaraid.c
+@@ -1441,6 +1441,7 @@ mega_cmd_done(adapter_t *adapter, u8 completed[], int nstatus, int status)
+ */
+ if (cmdid == CMDID_INT_CMDS) {
+ scb = &adapter->int_scb;
++ cmd = scb->cmd;
+
+ list_del_init(&scb->list);
+ scb->state = SCB_FREE;
+--
+2.39.2
+
--- /dev/null
+From 13f8f251f3c1576073aed8a65b60ca64de94b6e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 18 Mar 2023 20:56:18 -0500
+Subject: scsi: target: Fix multiple LUN_RESET handling
+
+From: Mike Christie <michael.christie@oracle.com>
+
+[ Upstream commit 673db054d7a2b5a470d7a25baf65956d005ad729 ]
+
+This fixes a bug where an initiator thinks a LUN_RESET has cleaned up
+running commands when it hasn't. The bug was added in commit 51ec502a3266
+("target: Delete tmr from list before processing").
+
+The problem occurs when:
+
+ 1. We have N I/O cmds running in the target layer spread over 2 sessions.
+
+ 2. The initiator sends a LUN_RESET for each session.
+
+ 3. session1's LUN_RESET loops over all the running commands from both
+ sessions and moves them to its local drain_task_list.
+
+ 4. session2's LUN_RESET does not see the LUN_RESET from session1 because
+ the commit above has it remove itself. session2 also does not see any
+ commands since the other reset moved them off the state lists.
+
+ 5. sessions2's LUN_RESET will then complete with a successful response.
+
+ 6. sessions2's inititor believes the running commands on its session are
+ now cleaned up due to the successful response and cleans up the running
+ commands from its side. It then restarts them.
+
+ 7. The commands do eventually complete on the backend and the target
+ starts to return aborted task statuses for them. The initiator will
+ either throw a invalid ITT error or might accidentally lookup a new
+ task if the ITT has been reallocated already.
+
+Fix the bug by reverting the patch, and serialize the execution of
+LUN_RESETs and Preempt and Aborts.
+
+Also prevent us from waiting on LUN_RESETs in core_tmr_drain_tmr_list,
+because it turns out the original patch fixed a bug that was not
+mentioned. For LUN_RESET1 core_tmr_drain_tmr_list can see a second
+LUN_RESET and wait on it. Then the second reset will run
+core_tmr_drain_tmr_list and see the first reset and wait on it resulting in
+a deadlock.
+
+Fixes: 51ec502a3266 ("target: Delete tmr from list before processing")
+Signed-off-by: Mike Christie <michael.christie@oracle.com>
+Link: https://lore.kernel.org/r/20230319015620.96006-8-michael.christie@oracle.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/target/target_core_device.c | 1 +
+ drivers/target/target_core_tmr.c | 26 +++++++++++++++++++++++---
+ include/target/target_core_base.h | 1 +
+ 3 files changed, 25 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c
+index f6e58410ec3f9..aeb03136773d5 100644
+--- a/drivers/target/target_core_device.c
++++ b/drivers/target/target_core_device.c
+@@ -782,6 +782,7 @@ struct se_device *target_alloc_device(struct se_hba *hba, const char *name)
+ spin_lock_init(&dev->t10_alua.lba_map_lock);
+
+ INIT_WORK(&dev->delayed_cmd_work, target_do_delayed_work);
++ mutex_init(&dev->lun_reset_mutex);
+
+ dev->t10_wwn.t10_dev = dev;
+ /*
+diff --git a/drivers/target/target_core_tmr.c b/drivers/target/target_core_tmr.c
+index 2b95b4550a637..4718db628222b 100644
+--- a/drivers/target/target_core_tmr.c
++++ b/drivers/target/target_core_tmr.c
+@@ -188,14 +188,23 @@ static void core_tmr_drain_tmr_list(
+ * LUN_RESET tmr..
+ */
+ spin_lock_irqsave(&dev->se_tmr_lock, flags);
+- if (tmr)
+- list_del_init(&tmr->tmr_list);
+ list_for_each_entry_safe(tmr_p, tmr_pp, &dev->dev_tmr_list, tmr_list) {
++ if (tmr_p == tmr)
++ continue;
++
+ cmd = tmr_p->task_cmd;
+ if (!cmd) {
+ pr_err("Unable to locate struct se_cmd for TMR\n");
+ continue;
+ }
++
++ /*
++ * We only execute one LUN_RESET at a time so we can't wait
++ * on them below.
++ */
++ if (tmr_p->function == TMR_LUN_RESET)
++ continue;
++
+ /*
+ * If this function was called with a valid pr_res_key
+ * parameter (eg: for PROUT PREEMPT_AND_ABORT service action
+@@ -379,14 +388,25 @@ int core_tmr_lun_reset(
+ tmr_nacl->initiatorname);
+ }
+ }
++
++
++ /*
++ * We only allow one reset or preempt and abort to execute at a time
++ * to prevent one call from claiming all the cmds causing a second
++ * call from returning while cmds it should have waited on are still
++ * running.
++ */
++ mutex_lock(&dev->lun_reset_mutex);
++
+ pr_debug("LUN_RESET: %s starting for [%s], tas: %d\n",
+ (preempt_and_abort_list) ? "Preempt" : "TMR",
+ dev->transport->name, tas);
+-
+ core_tmr_drain_tmr_list(dev, tmr, preempt_and_abort_list);
+ core_tmr_drain_state_list(dev, prout_cmd, tmr_sess, tas,
+ preempt_and_abort_list);
+
++ mutex_unlock(&dev->lun_reset_mutex);
++
+ /*
+ * Clear any legacy SPC-2 reservation when called during
+ * LOGICAL UNIT RESET
+diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h
+index bd299790e99c3..8cc42ad65c925 100644
+--- a/include/target/target_core_base.h
++++ b/include/target/target_core_base.h
+@@ -872,6 +872,7 @@ struct se_device {
+ struct rcu_head rcu_head;
+ int queue_cnt;
+ struct se_device_queue *queues;
++ struct mutex lun_reset_mutex;
+ };
+
+ struct target_opcode_descriptor {
+--
+2.39.2
+
--- /dev/null
+From bd39b7181b941bcbb593a2c5bd4e9e57f9f200a8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 18 Mar 2023 20:56:19 -0500
+Subject: scsi: target: iscsit: Fix TAS handling during conn cleanup
+
+From: Mike Christie <michael.christie@oracle.com>
+
+[ Upstream commit cc79da306ebb2edb700c3816b90219223182ac3c ]
+
+Fix a bug added in commit f36199355c64 ("scsi: target: iscsi: Fix cmd abort
+fabric stop race").
+
+If CMD_T_TAS is set on the se_cmd we must call iscsit_free_cmd() to do the
+last put on the cmd and free it, because the connection is down and we will
+not up sending the response and doing the put from the normal I/O
+path.
+
+Add a check for CMD_T_TAS in iscsit_release_commands_from_conn() so we now
+detect this case and run iscsit_free_cmd().
+
+Fixes: f36199355c64 ("scsi: target: iscsi: Fix cmd abort fabric stop race")
+Signed-off-by: Mike Christie <michael.christie@oracle.com>
+Link: https://lore.kernel.org/r/20230319015620.96006-9-michael.christie@oracle.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/target/iscsi/iscsi_target.c | 16 +++++++++-------
+ 1 file changed, 9 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
+index 83b0071412294..3f7a9f7f5f4e3 100644
+--- a/drivers/target/iscsi/iscsi_target.c
++++ b/drivers/target/iscsi/iscsi_target.c
+@@ -4220,9 +4220,12 @@ static void iscsit_release_commands_from_conn(struct iscsit_conn *conn)
+ list_for_each_entry_safe(cmd, cmd_tmp, &tmp_list, i_conn_node) {
+ struct se_cmd *se_cmd = &cmd->se_cmd;
+
+- if (se_cmd->se_tfo != NULL) {
+- spin_lock_irq(&se_cmd->t_state_lock);
+- if (se_cmd->transport_state & CMD_T_ABORTED) {
++ if (!se_cmd->se_tfo)
++ continue;
++
++ spin_lock_irq(&se_cmd->t_state_lock);
++ if (se_cmd->transport_state & CMD_T_ABORTED) {
++ if (!(se_cmd->transport_state & CMD_T_TAS))
+ /*
+ * LIO's abort path owns the cleanup for this,
+ * so put it back on the list and let
+@@ -4230,11 +4233,10 @@ static void iscsit_release_commands_from_conn(struct iscsit_conn *conn)
+ */
+ list_move_tail(&cmd->i_conn_node,
+ &conn->conn_cmd_list);
+- } else {
+- se_cmd->transport_state |= CMD_T_FABRIC_STOP;
+- }
+- spin_unlock_irq(&se_cmd->t_state_lock);
++ } else {
++ se_cmd->transport_state |= CMD_T_FABRIC_STOP;
+ }
++ spin_unlock_irq(&se_cmd->t_state_lock);
+ }
+ spin_unlock_bh(&conn->cmd_lock);
+
+--
+2.39.2
+
--- /dev/null
+From 1d09f2ce0e6b0b2b684323e832af1eb040929063 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 18 Mar 2023 20:56:15 -0500
+Subject: scsi: target: iscsit: isert: Alloc per conn cmd counter
+
+From: Mike Christie <michael.christie@oracle.com>
+
+[ Upstream commit 6d256bee602b131bd4fbc92863b6a1210bcf6325 ]
+
+This has iscsit allocate a per conn cmd counter and converts iscsit/isert
+to use it instead of the per session one.
+
+Signed-off-by: Mike Christie <michael.christie@oracle.com>
+Link: https://lore.kernel.org/r/20230319015620.96006-5-michael.christie@oracle.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Stable-dep-of: 395cee83d02d ("scsi: target: iscsit: Stop/wait on cmds during conn close")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/isert/ib_isert.c | 4 ++--
+ drivers/target/iscsi/iscsi_target.c | 4 ++--
+ drivers/target/iscsi/iscsi_target_login.c | 17 +++++++----------
+ drivers/target/target_core_transport.c | 9 ++++++---
+ include/target/target_core_fabric.h | 3 +++
+ 5 files changed, 20 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
+index 75404885cf981..f290cd49698ea 100644
+--- a/drivers/infiniband/ulp/isert/ib_isert.c
++++ b/drivers/infiniband/ulp/isert/ib_isert.c
+@@ -2506,8 +2506,8 @@ isert_wait4cmds(struct iscsit_conn *conn)
+ isert_info("iscsit_conn %p\n", conn);
+
+ if (conn->sess) {
+- target_stop_session(conn->sess->se_sess);
+- target_wait_for_sess_cmds(conn->sess->se_sess);
++ target_stop_cmd_counter(conn->cmd_cnt);
++ target_wait_for_cmds(conn->cmd_cnt);
+ }
+ }
+
+diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
+index 87927a36f90df..11115c2078446 100644
+--- a/drivers/target/iscsi/iscsi_target.c
++++ b/drivers/target/iscsi/iscsi_target.c
+@@ -1193,7 +1193,7 @@ int iscsit_setup_scsi_cmd(struct iscsit_conn *conn, struct iscsit_cmd *cmd,
+ conn->sess->se_sess, be32_to_cpu(hdr->data_length),
+ cmd->data_direction, sam_task_attr,
+ cmd->sense_buffer + 2, scsilun_to_int(&hdr->lun),
+- conn->sess->se_sess->cmd_cnt);
++ conn->cmd_cnt);
+
+ pr_debug("Got SCSI Command, ITT: 0x%08x, CmdSN: 0x%08x,"
+ " ExpXferLen: %u, Length: %u, CID: %hu\n", hdr->itt,
+@@ -2057,7 +2057,7 @@ iscsit_handle_task_mgt_cmd(struct iscsit_conn *conn, struct iscsit_cmd *cmd,
+ conn->sess->se_sess, 0, DMA_NONE,
+ TCM_SIMPLE_TAG, cmd->sense_buffer + 2,
+ scsilun_to_int(&hdr->lun),
+- conn->sess->se_sess->cmd_cnt);
++ conn->cmd_cnt);
+
+ target_get_sess_cmd(&cmd->se_cmd, true);
+
+diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c
+index 8ab6c0107d89c..274bdd7845ca9 100644
+--- a/drivers/target/iscsi/iscsi_target_login.c
++++ b/drivers/target/iscsi/iscsi_target_login.c
+@@ -324,18 +324,8 @@ static int iscsi_login_zero_tsih_s1(
+ goto free_ops;
+ }
+
+- /*
+- * This is temp for iser. It will be moved to per conn in later
+- * patches for iscsi.
+- */
+- sess->se_sess->cmd_cnt = target_alloc_cmd_counter();
+- if (!sess->se_sess->cmd_cnt)
+- goto free_se_sess;
+-
+ return 0;
+
+-free_se_sess:
+- transport_free_session(sess->se_sess);
+ free_ops:
+ kfree(sess->sess_ops);
+ free_id:
+@@ -1157,8 +1147,14 @@ static struct iscsit_conn *iscsit_alloc_conn(struct iscsi_np *np)
+ goto free_conn_cpumask;
+ }
+
++ conn->cmd_cnt = target_alloc_cmd_counter();
++ if (!conn->cmd_cnt)
++ goto free_conn_allowed_cpumask;
++
+ return conn;
+
++free_conn_allowed_cpumask:
++ free_cpumask_var(conn->allowed_cpumask);
+ free_conn_cpumask:
+ free_cpumask_var(conn->conn_cpumask);
+ free_conn_ops:
+@@ -1172,6 +1168,7 @@ static struct iscsit_conn *iscsit_alloc_conn(struct iscsi_np *np)
+
+ void iscsit_free_conn(struct iscsit_conn *conn)
+ {
++ target_free_cmd_counter(conn->cmd_cnt);
+ free_cpumask_var(conn->allowed_cpumask);
+ free_cpumask_var(conn->conn_cpumask);
+ kfree(conn->conn_ops);
+diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
+index c395606ab1a9c..86adff2a86edd 100644
+--- a/drivers/target/target_core_transport.c
++++ b/drivers/target/target_core_transport.c
+@@ -254,7 +254,7 @@ struct target_cmd_counter *target_alloc_cmd_counter(void)
+ }
+ EXPORT_SYMBOL_GPL(target_alloc_cmd_counter);
+
+-static void target_free_cmd_counter(struct target_cmd_counter *cmd_cnt)
++void target_free_cmd_counter(struct target_cmd_counter *cmd_cnt)
+ {
+ /*
+ * Drivers like loop do not call target_stop_session during session
+@@ -265,6 +265,7 @@ static void target_free_cmd_counter(struct target_cmd_counter *cmd_cnt)
+
+ percpu_ref_exit(&cmd_cnt->refcnt);
+ }
++EXPORT_SYMBOL_GPL(target_free_cmd_counter);
+
+ /**
+ * transport_init_session - initialize a session object
+@@ -3170,13 +3171,14 @@ static void target_stop_cmd_counter_confirm(struct percpu_ref *ref)
+ * target_stop_cmd_counter - Stop new IO from being added to the counter.
+ * @cmd_cnt: counter to stop
+ */
+-static void target_stop_cmd_counter(struct target_cmd_counter *cmd_cnt)
++void target_stop_cmd_counter(struct target_cmd_counter *cmd_cnt)
+ {
+ pr_debug("Stopping command counter.\n");
+ if (!atomic_cmpxchg(&cmd_cnt->stopped, 0, 1))
+ percpu_ref_kill_and_confirm(&cmd_cnt->refcnt,
+ target_stop_cmd_counter_confirm);
+ }
++EXPORT_SYMBOL_GPL(target_stop_cmd_counter);
+
+ /**
+ * target_stop_session - Stop new IO from being queued on the session.
+@@ -3192,7 +3194,7 @@ EXPORT_SYMBOL(target_stop_session);
+ * target_wait_for_cmds - Wait for outstanding cmds.
+ * @cmd_cnt: counter to wait for active I/O for.
+ */
+-static void target_wait_for_cmds(struct target_cmd_counter *cmd_cnt)
++void target_wait_for_cmds(struct target_cmd_counter *cmd_cnt)
+ {
+ int ret;
+
+@@ -3208,6 +3210,7 @@ static void target_wait_for_cmds(struct target_cmd_counter *cmd_cnt)
+ wait_for_completion(&cmd_cnt->stop_done);
+ pr_debug("Waiting for cmds done.\n");
+ }
++EXPORT_SYMBOL_GPL(target_wait_for_cmds);
+
+ /**
+ * target_wait_for_sess_cmds - Wait for outstanding commands
+diff --git a/include/target/target_core_fabric.h b/include/target/target_core_fabric.h
+index d507e7885f17f..b188b1e90e1ed 100644
+--- a/include/target/target_core_fabric.h
++++ b/include/target/target_core_fabric.h
+@@ -133,7 +133,10 @@ struct se_session *target_setup_session(struct se_portal_group *,
+ struct se_session *, void *));
+ void target_remove_session(struct se_session *);
+
++void target_stop_cmd_counter(struct target_cmd_counter *cmd_cnt);
++void target_wait_for_cmds(struct target_cmd_counter *cmd_cnt);
+ struct target_cmd_counter *target_alloc_cmd_counter(void);
++void target_free_cmd_counter(struct target_cmd_counter *cmd_cnt);
+
+ void transport_init_session(struct se_session *se_sess);
+ struct se_session *transport_alloc_session(enum target_prot_op);
+--
+2.39.2
+
--- /dev/null
+From e22a7f4792d2f9af55b03d85834786cc4cc61f87 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 18 Mar 2023 20:56:16 -0500
+Subject: scsi: target: iscsit: Stop/wait on cmds during conn close
+
+From: Mike Christie <michael.christie@oracle.com>
+
+[ Upstream commit 395cee83d02de3073211b04fc85724f4abc663ad ]
+
+This fixes a bug added in commit f36199355c64 ("scsi: target: iscsi: Fix
+cmd abort fabric stop race").
+
+If we have multiple sessions to the same se_device we can hit a race where
+a LUN_RESET on one session cleans up the se_cmds from under another
+session which is being closed. This results in the closing session freeing
+its conn/session structs while they are still in use.
+
+The bug is:
+
+ 1. Session1 has IO se_cmd1.
+
+ 2. Session2 can also have se_cmds for I/O and optionally TMRs for ABORTS
+ but then gets a LUN_RESET.
+
+ 3. The LUN_RESET on session2 sees the se_cmds on session1 and during the
+ drain stages marks them all with CMD_T_ABORTED.
+
+ 4. session1 is now closed so iscsit_release_commands_from_conn() only sees
+ se_cmds with the CMD_T_ABORTED bit set and returns immediately even
+ though we have outstanding commands.
+
+ 5. session1's connection and session are freed.
+
+ 6. The backend request for se_cmd1 completes and it accesses the freed
+ connection/session.
+
+This hooks the iscsit layer into the cmd counter code, so we can wait for
+all outstanding se_cmds before freeing the connection.
+
+Fixes: f36199355c64 ("scsi: target: iscsi: Fix cmd abort fabric stop race")
+Signed-off-by: Mike Christie <michael.christie@oracle.com>
+Link: https://lore.kernel.org/r/20230319015620.96006-6-michael.christie@oracle.com
+Reviewed-by: Maurizio Lombardi <mlombard@redhat.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/target/iscsi/iscsi_target.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
+index 11115c2078446..83b0071412294 100644
+--- a/drivers/target/iscsi/iscsi_target.c
++++ b/drivers/target/iscsi/iscsi_target.c
+@@ -4245,6 +4245,16 @@ static void iscsit_release_commands_from_conn(struct iscsit_conn *conn)
+ iscsit_free_cmd(cmd, true);
+
+ }
++
++ /*
++ * Wait on commands that were cleaned up via the aborted_task path.
++ * LLDs that implement iscsit_wait_conn will already have waited for
++ * commands.
++ */
++ if (!conn->conn_transport->iscsit_wait_conn) {
++ target_stop_cmd_counter(conn->cmd_cnt);
++ target_wait_for_cmds(conn->cmd_cnt);
++ }
+ }
+
+ static void iscsit_stop_timers_for_cmds(
+--
+2.39.2
+
--- /dev/null
+From 28e88afc9260d986cedcaba50d9d8708b050137d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 18 Mar 2023 20:56:13 -0500
+Subject: scsi: target: Move cmd counter allocation
+
+From: Mike Christie <michael.christie@oracle.com>
+
+[ Upstream commit 4edba7e4a8f39112398d3cda94128a8e13a7d527 ]
+
+iSCSI needs to allocate its cmd counter per connection for MCS support
+where we need to stop and wait on commands running on a connection instead
+of per session. This moves the cmd counter allocation to
+target_setup_session() which is used by drivers that need the stop+wait
+behavior per session.
+
+xcopy doesn't need stop+wait at all, so we will be OK moving the cmd
+counter allocation outside of transport_init_session().
+
+Signed-off-by: Mike Christie <michael.christie@oracle.com>
+Link: https://lore.kernel.org/r/20230319015620.96006-3-michael.christie@oracle.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Stable-dep-of: 395cee83d02d ("scsi: target: iscsit: Stop/wait on cmds during conn close")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/target/iscsi/iscsi_target_login.c | 10 +++++
+ drivers/target/target_core_internal.h | 1 -
+ drivers/target/target_core_transport.c | 55 +++++++++++------------
+ drivers/target/target_core_xcopy.c | 15 +------
+ include/target/target_core_fabric.h | 4 +-
+ 5 files changed, 42 insertions(+), 43 deletions(-)
+
+diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c
+index 27e448c2d066c..8ab6c0107d89c 100644
+--- a/drivers/target/iscsi/iscsi_target_login.c
++++ b/drivers/target/iscsi/iscsi_target_login.c
+@@ -324,8 +324,18 @@ static int iscsi_login_zero_tsih_s1(
+ goto free_ops;
+ }
+
++ /*
++ * This is temp for iser. It will be moved to per conn in later
++ * patches for iscsi.
++ */
++ sess->se_sess->cmd_cnt = target_alloc_cmd_counter();
++ if (!sess->se_sess->cmd_cnt)
++ goto free_se_sess;
++
+ return 0;
+
++free_se_sess:
++ transport_free_session(sess->se_sess);
+ free_ops:
+ kfree(sess->sess_ops);
+ free_id:
+diff --git a/drivers/target/target_core_internal.h b/drivers/target/target_core_internal.h
+index 38a6d08f75b34..85e35cf582e50 100644
+--- a/drivers/target/target_core_internal.h
++++ b/drivers/target/target_core_internal.h
+@@ -138,7 +138,6 @@ int init_se_kmem_caches(void);
+ void release_se_kmem_caches(void);
+ u32 scsi_get_new_index(scsi_index_t);
+ void transport_subsystem_check_init(void);
+-void transport_uninit_session(struct se_session *);
+ unsigned char *transport_dump_cmd_direction(struct se_cmd *);
+ void transport_dump_dev_state(struct se_device *, char *, int *);
+ void transport_dump_dev_info(struct se_device *, struct se_lun *,
+diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
+index 3d6034f00dcd8..60647a49a1d31 100644
+--- a/drivers/target/target_core_transport.c
++++ b/drivers/target/target_core_transport.c
+@@ -228,7 +228,7 @@ static void target_release_cmd_refcnt(struct percpu_ref *ref)
+ wake_up(&cmd_cnt->refcnt_wq);
+ }
+
+-static struct target_cmd_counter *target_alloc_cmd_counter(void)
++struct target_cmd_counter *target_alloc_cmd_counter(void)
+ {
+ struct target_cmd_counter *cmd_cnt;
+ int rc;
+@@ -252,6 +252,7 @@ static struct target_cmd_counter *target_alloc_cmd_counter(void)
+ kfree(cmd_cnt);
+ return NULL;
+ }
++EXPORT_SYMBOL_GPL(target_alloc_cmd_counter);
+
+ static void target_free_cmd_counter(struct target_cmd_counter *cmd_cnt)
+ {
+@@ -271,24 +272,14 @@ static void target_free_cmd_counter(struct target_cmd_counter *cmd_cnt)
+ *
+ * The caller must have zero-initialized @se_sess before calling this function.
+ */
+-int transport_init_session(struct se_session *se_sess)
++void transport_init_session(struct se_session *se_sess)
+ {
+ INIT_LIST_HEAD(&se_sess->sess_list);
+ INIT_LIST_HEAD(&se_sess->sess_acl_list);
+ spin_lock_init(&se_sess->sess_cmd_lock);
+- se_sess->cmd_cnt = target_alloc_cmd_counter();
+- if (!se_sess->cmd_cnt)
+- return -ENOMEM;
+-
+- return 0;
+ }
+ EXPORT_SYMBOL(transport_init_session);
+
+-void transport_uninit_session(struct se_session *se_sess)
+-{
+- target_free_cmd_counter(se_sess->cmd_cnt);
+-}
+-
+ /**
+ * transport_alloc_session - allocate a session object and initialize it
+ * @sup_prot_ops: bitmask that defines which T10-PI modes are supported.
+@@ -296,7 +287,6 @@ void transport_uninit_session(struct se_session *se_sess)
+ struct se_session *transport_alloc_session(enum target_prot_op sup_prot_ops)
+ {
+ struct se_session *se_sess;
+- int ret;
+
+ se_sess = kmem_cache_zalloc(se_sess_cache, GFP_KERNEL);
+ if (!se_sess) {
+@@ -304,11 +294,7 @@ struct se_session *transport_alloc_session(enum target_prot_op sup_prot_ops)
+ " se_sess_cache\n");
+ return ERR_PTR(-ENOMEM);
+ }
+- ret = transport_init_session(se_sess);
+- if (ret < 0) {
+- kmem_cache_free(se_sess_cache, se_sess);
+- return ERR_PTR(ret);
+- }
++ transport_init_session(se_sess);
+ se_sess->sup_prot_ops = sup_prot_ops;
+
+ return se_sess;
+@@ -474,8 +460,13 @@ target_setup_session(struct se_portal_group *tpg,
+ int (*callback)(struct se_portal_group *,
+ struct se_session *, void *))
+ {
++ struct target_cmd_counter *cmd_cnt;
+ struct se_session *sess;
++ int rc;
+
++ cmd_cnt = target_alloc_cmd_counter();
++ if (!cmd_cnt)
++ return ERR_PTR(-ENOMEM);
+ /*
+ * If the fabric driver is using percpu-ida based pre allocation
+ * of I/O descriptor tags, go ahead and perform that setup now..
+@@ -485,29 +476,36 @@ target_setup_session(struct se_portal_group *tpg,
+ else
+ sess = transport_alloc_session(prot_op);
+
+- if (IS_ERR(sess))
+- return sess;
++ if (IS_ERR(sess)) {
++ rc = PTR_ERR(sess);
++ goto free_cnt;
++ }
++ sess->cmd_cnt = cmd_cnt;
+
+ sess->se_node_acl = core_tpg_check_initiator_node_acl(tpg,
+ (unsigned char *)initiatorname);
+ if (!sess->se_node_acl) {
+- transport_free_session(sess);
+- return ERR_PTR(-EACCES);
++ rc = -EACCES;
++ goto free_sess;
+ }
+ /*
+ * Go ahead and perform any remaining fabric setup that is
+ * required before transport_register_session().
+ */
+ if (callback != NULL) {
+- int rc = callback(tpg, sess, private);
+- if (rc) {
+- transport_free_session(sess);
+- return ERR_PTR(rc);
+- }
++ rc = callback(tpg, sess, private);
++ if (rc)
++ goto free_sess;
+ }
+
+ transport_register_session(tpg, sess->se_node_acl, sess, private);
+ return sess;
++
++free_sess:
++ transport_free_session(sess);
++free_cnt:
++ target_free_cmd_counter(cmd_cnt);
++ return ERR_PTR(rc);
+ }
+ EXPORT_SYMBOL(target_setup_session);
+
+@@ -632,7 +630,8 @@ void transport_free_session(struct se_session *se_sess)
+ sbitmap_queue_free(&se_sess->sess_tag_pool);
+ kvfree(se_sess->sess_cmd_map);
+ }
+- transport_uninit_session(se_sess);
++ if (se_sess->cmd_cnt)
++ target_free_cmd_counter(se_sess->cmd_cnt);
+ kmem_cache_free(se_sess_cache, se_sess);
+ }
+ EXPORT_SYMBOL(transport_free_session);
+diff --git a/drivers/target/target_core_xcopy.c b/drivers/target/target_core_xcopy.c
+index 49eaee022ef1d..49a83500c8b75 100644
+--- a/drivers/target/target_core_xcopy.c
++++ b/drivers/target/target_core_xcopy.c
+@@ -461,8 +461,6 @@ static const struct target_core_fabric_ops xcopy_pt_tfo = {
+
+ int target_xcopy_setup_pt(void)
+ {
+- int ret;
+-
+ xcopy_wq = alloc_workqueue("xcopy_wq", WQ_MEM_RECLAIM, 0);
+ if (!xcopy_wq) {
+ pr_err("Unable to allocate xcopy_wq\n");
+@@ -479,9 +477,7 @@ int target_xcopy_setup_pt(void)
+ INIT_LIST_HEAD(&xcopy_pt_nacl.acl_list);
+ INIT_LIST_HEAD(&xcopy_pt_nacl.acl_sess_list);
+ memset(&xcopy_pt_sess, 0, sizeof(struct se_session));
+- ret = transport_init_session(&xcopy_pt_sess);
+- if (ret < 0)
+- goto destroy_wq;
++ transport_init_session(&xcopy_pt_sess);
+
+ xcopy_pt_nacl.se_tpg = &xcopy_pt_tpg;
+ xcopy_pt_nacl.nacl_sess = &xcopy_pt_sess;
+@@ -490,19 +486,12 @@ int target_xcopy_setup_pt(void)
+ xcopy_pt_sess.se_node_acl = &xcopy_pt_nacl;
+
+ return 0;
+-
+-destroy_wq:
+- destroy_workqueue(xcopy_wq);
+- xcopy_wq = NULL;
+- return ret;
+ }
+
+ void target_xcopy_release_pt(void)
+ {
+- if (xcopy_wq) {
++ if (xcopy_wq)
+ destroy_workqueue(xcopy_wq);
+- transport_uninit_session(&xcopy_pt_sess);
+- }
+ }
+
+ /*
+diff --git a/include/target/target_core_fabric.h b/include/target/target_core_fabric.h
+index 38f0662476d14..65527174b8bc6 100644
+--- a/include/target/target_core_fabric.h
++++ b/include/target/target_core_fabric.h
+@@ -133,7 +133,9 @@ struct se_session *target_setup_session(struct se_portal_group *,
+ struct se_session *, void *));
+ void target_remove_session(struct se_session *);
+
+-int transport_init_session(struct se_session *se_sess);
++struct target_cmd_counter *target_alloc_cmd_counter(void);
++
++void transport_init_session(struct se_session *se_sess);
+ struct se_session *transport_alloc_session(enum target_prot_op);
+ int transport_alloc_session_tags(struct se_session *, unsigned int,
+ unsigned int);
+--
+2.39.2
+
--- /dev/null
+From 769a2f3e6a9bb2844585315b6eb694c8897a9222 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 18 Mar 2023 20:56:12 -0500
+Subject: scsi: target: Move sess cmd counter to new struct
+
+From: Mike Christie <michael.christie@oracle.com>
+
+[ Upstream commit becd9be6069e7b183c084f460f0eb363e43cc487 ]
+
+iSCSI needs to wait on outstanding commands like how SRP and the FC/FCoE
+drivers do. It can't use target_stop_session() because for MCS support we
+can't stop the entire session during recovery because if other connections
+are OK then we want to be able to continue to execute I/O on them.
+
+Move the per session cmd counters to a new struct so iSCSI can allocate
+them per connection. The xcopy code can also just not allocate in the
+future since it doesn't need to track commands.
+
+Signed-off-by: Mike Christie <michael.christie@oracle.com>
+Link: https://lore.kernel.org/r/20230319015620.96006-2-michael.christie@oracle.com
+Reviewed-by: Maurizio Lombardi <mlombard@redhat.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Stable-dep-of: 395cee83d02d ("scsi: target: iscsit: Stop/wait on cmds during conn close")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/target/target_core_tpg.c | 2 +-
+ drivers/target/target_core_transport.c | 135 ++++++++++++++++-------
+ include/target/iscsi/iscsi_target_core.h | 1 +
+ include/target/target_core_base.h | 13 ++-
+ 4 files changed, 107 insertions(+), 44 deletions(-)
+
+diff --git a/drivers/target/target_core_tpg.c b/drivers/target/target_core_tpg.c
+index 736847c933e5c..8ebccdbd94f0e 100644
+--- a/drivers/target/target_core_tpg.c
++++ b/drivers/target/target_core_tpg.c
+@@ -328,7 +328,7 @@ static void target_shutdown_sessions(struct se_node_acl *acl)
+ restart:
+ spin_lock_irqsave(&acl->nacl_sess_lock, flags);
+ list_for_each_entry(sess, &acl->acl_sess_list, sess_acl_list) {
+- if (atomic_read(&sess->stopped))
++ if (sess->cmd_cnt && atomic_read(&sess->cmd_cnt->stopped))
+ continue;
+
+ list_del_init(&sess->sess_acl_list);
+diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
+index 5926316252eb9..3d6034f00dcd8 100644
+--- a/drivers/target/target_core_transport.c
++++ b/drivers/target/target_core_transport.c
+@@ -220,11 +220,49 @@ void transport_subsystem_check_init(void)
+ sub_api_initialized = 1;
+ }
+
+-static void target_release_sess_cmd_refcnt(struct percpu_ref *ref)
++static void target_release_cmd_refcnt(struct percpu_ref *ref)
+ {
+- struct se_session *sess = container_of(ref, typeof(*sess), cmd_count);
++ struct target_cmd_counter *cmd_cnt = container_of(ref,
++ typeof(*cmd_cnt),
++ refcnt);
++ wake_up(&cmd_cnt->refcnt_wq);
++}
++
++static struct target_cmd_counter *target_alloc_cmd_counter(void)
++{
++ struct target_cmd_counter *cmd_cnt;
++ int rc;
++
++ cmd_cnt = kzalloc(sizeof(*cmd_cnt), GFP_KERNEL);
++ if (!cmd_cnt)
++ return NULL;
+
+- wake_up(&sess->cmd_count_wq);
++ init_completion(&cmd_cnt->stop_done);
++ init_waitqueue_head(&cmd_cnt->refcnt_wq);
++ atomic_set(&cmd_cnt->stopped, 0);
++
++ rc = percpu_ref_init(&cmd_cnt->refcnt, target_release_cmd_refcnt, 0,
++ GFP_KERNEL);
++ if (rc)
++ goto free_cmd_cnt;
++
++ return cmd_cnt;
++
++free_cmd_cnt:
++ kfree(cmd_cnt);
++ return NULL;
++}
++
++static void target_free_cmd_counter(struct target_cmd_counter *cmd_cnt)
++{
++ /*
++ * Drivers like loop do not call target_stop_session during session
++ * shutdown so we have to drop the ref taken at init time here.
++ */
++ if (!atomic_read(&cmd_cnt->stopped))
++ percpu_ref_put(&cmd_cnt->refcnt);
++
++ percpu_ref_exit(&cmd_cnt->refcnt);
+ }
+
+ /**
+@@ -238,25 +276,17 @@ int transport_init_session(struct se_session *se_sess)
+ INIT_LIST_HEAD(&se_sess->sess_list);
+ INIT_LIST_HEAD(&se_sess->sess_acl_list);
+ spin_lock_init(&se_sess->sess_cmd_lock);
+- init_waitqueue_head(&se_sess->cmd_count_wq);
+- init_completion(&se_sess->stop_done);
+- atomic_set(&se_sess->stopped, 0);
+- return percpu_ref_init(&se_sess->cmd_count,
+- target_release_sess_cmd_refcnt, 0, GFP_KERNEL);
++ se_sess->cmd_cnt = target_alloc_cmd_counter();
++ if (!se_sess->cmd_cnt)
++ return -ENOMEM;
++
++ return 0;
+ }
+ EXPORT_SYMBOL(transport_init_session);
+
+ void transport_uninit_session(struct se_session *se_sess)
+ {
+- /*
+- * Drivers like iscsi and loop do not call target_stop_session
+- * during session shutdown so we have to drop the ref taken at init
+- * time here.
+- */
+- if (!atomic_read(&se_sess->stopped))
+- percpu_ref_put(&se_sess->cmd_count);
+-
+- percpu_ref_exit(&se_sess->cmd_count);
++ target_free_cmd_counter(se_sess->cmd_cnt);
+ }
+
+ /**
+@@ -2970,9 +3000,16 @@ int target_get_sess_cmd(struct se_cmd *se_cmd, bool ack_kref)
+ se_cmd->se_cmd_flags |= SCF_ACK_KREF;
+ }
+
+- if (!percpu_ref_tryget_live(&se_sess->cmd_count))
+- ret = -ESHUTDOWN;
+-
++ /*
++ * Users like xcopy do not use counters since they never do a stop
++ * and wait.
++ */
++ if (se_sess->cmd_cnt) {
++ if (!percpu_ref_tryget_live(&se_sess->cmd_cnt->refcnt))
++ ret = -ESHUTDOWN;
++ else
++ se_cmd->cmd_cnt = se_sess->cmd_cnt;
++ }
+ if (ret && ack_kref)
+ target_put_sess_cmd(se_cmd);
+
+@@ -2993,7 +3030,7 @@ static void target_free_cmd_mem(struct se_cmd *cmd)
+ static void target_release_cmd_kref(struct kref *kref)
+ {
+ struct se_cmd *se_cmd = container_of(kref, struct se_cmd, cmd_kref);
+- struct se_session *se_sess = se_cmd->se_sess;
++ struct target_cmd_counter *cmd_cnt = se_cmd->cmd_cnt;
+ struct completion *free_compl = se_cmd->free_compl;
+ struct completion *abrt_compl = se_cmd->abrt_compl;
+
+@@ -3004,7 +3041,8 @@ static void target_release_cmd_kref(struct kref *kref)
+ if (abrt_compl)
+ complete(abrt_compl);
+
+- percpu_ref_put(&se_sess->cmd_count);
++ if (cmd_cnt)
++ percpu_ref_put(&cmd_cnt->refcnt);
+ }
+
+ /**
+@@ -3123,46 +3161,65 @@ void target_show_cmd(const char *pfx, struct se_cmd *cmd)
+ }
+ EXPORT_SYMBOL(target_show_cmd);
+
+-static void target_stop_session_confirm(struct percpu_ref *ref)
++static void target_stop_cmd_counter_confirm(struct percpu_ref *ref)
++{
++ struct target_cmd_counter *cmd_cnt = container_of(ref,
++ struct target_cmd_counter,
++ refcnt);
++ complete_all(&cmd_cnt->stop_done);
++}
++
++/**
++ * target_stop_cmd_counter - Stop new IO from being added to the counter.
++ * @cmd_cnt: counter to stop
++ */
++static void target_stop_cmd_counter(struct target_cmd_counter *cmd_cnt)
+ {
+- struct se_session *se_sess = container_of(ref, struct se_session,
+- cmd_count);
+- complete_all(&se_sess->stop_done);
++ pr_debug("Stopping command counter.\n");
++ if (!atomic_cmpxchg(&cmd_cnt->stopped, 0, 1))
++ percpu_ref_kill_and_confirm(&cmd_cnt->refcnt,
++ target_stop_cmd_counter_confirm);
+ }
+
+ /**
+ * target_stop_session - Stop new IO from being queued on the session.
+- * @se_sess: session to stop
++ * @se_sess: session to stop
+ */
+ void target_stop_session(struct se_session *se_sess)
+ {
+- pr_debug("Stopping session queue.\n");
+- if (atomic_cmpxchg(&se_sess->stopped, 0, 1) == 0)
+- percpu_ref_kill_and_confirm(&se_sess->cmd_count,
+- target_stop_session_confirm);
++ target_stop_cmd_counter(se_sess->cmd_cnt);
+ }
+ EXPORT_SYMBOL(target_stop_session);
+
+ /**
+- * target_wait_for_sess_cmds - Wait for outstanding commands
+- * @se_sess: session to wait for active I/O
++ * target_wait_for_cmds - Wait for outstanding cmds.
++ * @cmd_cnt: counter to wait for active I/O for.
+ */
+-void target_wait_for_sess_cmds(struct se_session *se_sess)
++static void target_wait_for_cmds(struct target_cmd_counter *cmd_cnt)
+ {
+ int ret;
+
+- WARN_ON_ONCE(!atomic_read(&se_sess->stopped));
++ WARN_ON_ONCE(!atomic_read(&cmd_cnt->stopped));
+
+ do {
+ pr_debug("Waiting for running cmds to complete.\n");
+- ret = wait_event_timeout(se_sess->cmd_count_wq,
+- percpu_ref_is_zero(&se_sess->cmd_count),
+- 180 * HZ);
++ ret = wait_event_timeout(cmd_cnt->refcnt_wq,
++ percpu_ref_is_zero(&cmd_cnt->refcnt),
++ 180 * HZ);
+ } while (ret <= 0);
+
+- wait_for_completion(&se_sess->stop_done);
++ wait_for_completion(&cmd_cnt->stop_done);
+ pr_debug("Waiting for cmds done.\n");
+ }
++
++/**
++ * target_wait_for_sess_cmds - Wait for outstanding commands
++ * @se_sess: session to wait for active I/O
++ */
++void target_wait_for_sess_cmds(struct se_session *se_sess)
++{
++ target_wait_for_cmds(se_sess->cmd_cnt);
++}
+ EXPORT_SYMBOL(target_wait_for_sess_cmds);
+
+ /*
+diff --git a/include/target/iscsi/iscsi_target_core.h b/include/target/iscsi/iscsi_target_core.h
+index 94d06ddfd80ad..229118156a1f6 100644
+--- a/include/target/iscsi/iscsi_target_core.h
++++ b/include/target/iscsi/iscsi_target_core.h
+@@ -600,6 +600,7 @@ struct iscsit_conn {
+ struct iscsi_tpg_np *tpg_np;
+ /* Pointer to parent session */
+ struct iscsit_session *sess;
++ struct target_cmd_counter *cmd_cnt;
+ int bitmap_id;
+ int rx_thread_active;
+ struct task_struct *rx_thread;
+diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h
+index 12c9ba16217ef..bd299790e99c3 100644
+--- a/include/target/target_core_base.h
++++ b/include/target/target_core_base.h
+@@ -494,6 +494,7 @@ struct se_cmd {
+ struct se_lun *se_lun;
+ /* Only used for internal passthrough and legacy TCM fabric modules */
+ struct se_session *se_sess;
++ struct target_cmd_counter *cmd_cnt;
+ struct se_tmr_req *se_tmr_req;
+ struct llist_node se_cmd_list;
+ struct completion *free_compl;
+@@ -619,22 +620,26 @@ static inline struct se_node_acl *fabric_stat_to_nacl(struct config_item *item)
+ acl_fabric_stat_group);
+ }
+
+-struct se_session {
++struct target_cmd_counter {
++ struct percpu_ref refcnt;
++ wait_queue_head_t refcnt_wq;
++ struct completion stop_done;
+ atomic_t stopped;
++};
++
++struct se_session {
+ u64 sess_bin_isid;
+ enum target_prot_op sup_prot_ops;
+ enum target_prot_type sess_prot_type;
+ struct se_node_acl *se_node_acl;
+ struct se_portal_group *se_tpg;
+ void *fabric_sess_ptr;
+- struct percpu_ref cmd_count;
+ struct list_head sess_list;
+ struct list_head sess_acl_list;
+ spinlock_t sess_cmd_lock;
+- wait_queue_head_t cmd_count_wq;
+- struct completion stop_done;
+ void *sess_cmd_map;
+ struct sbitmap_queue sess_tag_pool;
++ struct target_cmd_counter *cmd_cnt;
+ };
+
+ struct se_device;
+--
+2.39.2
+
--- /dev/null
+From b23cdb4c8397225bf4f02a357067f816db55f4ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 18 Mar 2023 20:56:14 -0500
+Subject: scsi: target: Pass in cmd counter to use during cmd setup
+
+From: Mike Christie <michael.christie@oracle.com>
+
+[ Upstream commit 8e288be8606ad87c1726618eacfb8fbd3ab4b806 ]
+
+Allow target_get_sess_cmd() users to pass in the cmd counter they want to
+use. Right now we pass in the session's cmd counter but in a subsequent
+commit iSCSI will switch from per session to per conn.
+
+Signed-off-by: Mike Christie <michael.christie@oracle.com>
+Link: https://lore.kernel.org/r/20230319015620.96006-4-michael.christie@oracle.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Stable-dep-of: 395cee83d02d ("scsi: target: iscsit: Stop/wait on cmds during conn close")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/target/iscsi/iscsi_target.c | 10 +++++----
+ drivers/target/target_core_transport.c | 28 ++++++++++++--------------
+ drivers/target/target_core_xcopy.c | 8 ++++----
+ drivers/usb/gadget/function/f_tcm.c | 4 ++--
+ include/target/target_core_fabric.h | 8 +++++---
+ 5 files changed, 30 insertions(+), 28 deletions(-)
+
+diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
+index baf4da7bb3b4e..87927a36f90df 100644
+--- a/drivers/target/iscsi/iscsi_target.c
++++ b/drivers/target/iscsi/iscsi_target.c
+@@ -1190,9 +1190,10 @@ int iscsit_setup_scsi_cmd(struct iscsit_conn *conn, struct iscsit_cmd *cmd,
+ * Initialize struct se_cmd descriptor from target_core_mod infrastructure
+ */
+ __target_init_cmd(&cmd->se_cmd, &iscsi_ops,
+- conn->sess->se_sess, be32_to_cpu(hdr->data_length),
+- cmd->data_direction, sam_task_attr,
+- cmd->sense_buffer + 2, scsilun_to_int(&hdr->lun));
++ conn->sess->se_sess, be32_to_cpu(hdr->data_length),
++ cmd->data_direction, sam_task_attr,
++ cmd->sense_buffer + 2, scsilun_to_int(&hdr->lun),
++ conn->sess->se_sess->cmd_cnt);
+
+ pr_debug("Got SCSI Command, ITT: 0x%08x, CmdSN: 0x%08x,"
+ " ExpXferLen: %u, Length: %u, CID: %hu\n", hdr->itt,
+@@ -2055,7 +2056,8 @@ iscsit_handle_task_mgt_cmd(struct iscsit_conn *conn, struct iscsit_cmd *cmd,
+ __target_init_cmd(&cmd->se_cmd, &iscsi_ops,
+ conn->sess->se_sess, 0, DMA_NONE,
+ TCM_SIMPLE_TAG, cmd->sense_buffer + 2,
+- scsilun_to_int(&hdr->lun));
++ scsilun_to_int(&hdr->lun),
++ conn->sess->se_sess->cmd_cnt);
+
+ target_get_sess_cmd(&cmd->se_cmd, true);
+
+diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
+index 60647a49a1d31..c395606ab1a9c 100644
+--- a/drivers/target/target_core_transport.c
++++ b/drivers/target/target_core_transport.c
+@@ -1441,14 +1441,12 @@ target_cmd_size_check(struct se_cmd *cmd, unsigned int size)
+ *
+ * Preserves the value of @cmd->tag.
+ */
+-void __target_init_cmd(
+- struct se_cmd *cmd,
+- const struct target_core_fabric_ops *tfo,
+- struct se_session *se_sess,
+- u32 data_length,
+- int data_direction,
+- int task_attr,
+- unsigned char *sense_buffer, u64 unpacked_lun)
++void __target_init_cmd(struct se_cmd *cmd,
++ const struct target_core_fabric_ops *tfo,
++ struct se_session *se_sess, u32 data_length,
++ int data_direction, int task_attr,
++ unsigned char *sense_buffer, u64 unpacked_lun,
++ struct target_cmd_counter *cmd_cnt)
+ {
+ INIT_LIST_HEAD(&cmd->se_delayed_node);
+ INIT_LIST_HEAD(&cmd->se_qf_node);
+@@ -1468,6 +1466,7 @@ void __target_init_cmd(
+ cmd->sam_task_attr = task_attr;
+ cmd->sense_buffer = sense_buffer;
+ cmd->orig_fe_lun = unpacked_lun;
++ cmd->cmd_cnt = cmd_cnt;
+
+ if (!(cmd->se_cmd_flags & SCF_USE_CPUID))
+ cmd->cpuid = raw_smp_processor_id();
+@@ -1687,7 +1686,8 @@ int target_init_cmd(struct se_cmd *se_cmd, struct se_session *se_sess,
+ * target_core_fabric_ops->queue_status() callback
+ */
+ __target_init_cmd(se_cmd, se_tpg->se_tpg_tfo, se_sess, data_length,
+- data_dir, task_attr, sense, unpacked_lun);
++ data_dir, task_attr, sense, unpacked_lun,
++ se_sess->cmd_cnt);
+
+ /*
+ * Obtain struct se_cmd->cmd_kref reference. A second kref_get here is
+@@ -1982,7 +1982,8 @@ int target_submit_tmr(struct se_cmd *se_cmd, struct se_session *se_sess,
+ BUG_ON(!se_tpg);
+
+ __target_init_cmd(se_cmd, se_tpg->se_tpg_tfo, se_sess,
+- 0, DMA_NONE, TCM_SIMPLE_TAG, sense, unpacked_lun);
++ 0, DMA_NONE, TCM_SIMPLE_TAG, sense, unpacked_lun,
++ se_sess->cmd_cnt);
+ /*
+ * FIXME: Currently expect caller to handle se_cmd->se_tmr_req
+ * allocation failure.
+@@ -2986,7 +2987,6 @@ EXPORT_SYMBOL(transport_generic_free_cmd);
+ */
+ int target_get_sess_cmd(struct se_cmd *se_cmd, bool ack_kref)
+ {
+- struct se_session *se_sess = se_cmd->se_sess;
+ int ret = 0;
+
+ /*
+@@ -3003,11 +3003,9 @@ int target_get_sess_cmd(struct se_cmd *se_cmd, bool ack_kref)
+ * Users like xcopy do not use counters since they never do a stop
+ * and wait.
+ */
+- if (se_sess->cmd_cnt) {
+- if (!percpu_ref_tryget_live(&se_sess->cmd_cnt->refcnt))
++ if (se_cmd->cmd_cnt) {
++ if (!percpu_ref_tryget_live(&se_cmd->cmd_cnt->refcnt))
+ ret = -ESHUTDOWN;
+- else
+- se_cmd->cmd_cnt = se_sess->cmd_cnt;
+ }
+ if (ret && ack_kref)
+ target_put_sess_cmd(se_cmd);
+diff --git a/drivers/target/target_core_xcopy.c b/drivers/target/target_core_xcopy.c
+index 49a83500c8b75..91ed015b588c6 100644
+--- a/drivers/target/target_core_xcopy.c
++++ b/drivers/target/target_core_xcopy.c
+@@ -591,8 +591,8 @@ static int target_xcopy_read_source(
+ (unsigned long long)src_lba, transfer_length_block, src_bytes);
+
+ __target_init_cmd(se_cmd, &xcopy_pt_tfo, &xcopy_pt_sess, src_bytes,
+- DMA_FROM_DEVICE, 0, &xpt_cmd.sense_buffer[0], 0);
+-
++ DMA_FROM_DEVICE, 0, &xpt_cmd.sense_buffer[0], 0,
++ NULL);
+ rc = target_xcopy_setup_pt_cmd(&xpt_cmd, xop, src_dev, &cdb[0],
+ remote_port);
+ if (rc < 0) {
+@@ -636,8 +636,8 @@ static int target_xcopy_write_destination(
+ (unsigned long long)dst_lba, transfer_length_block, dst_bytes);
+
+ __target_init_cmd(se_cmd, &xcopy_pt_tfo, &xcopy_pt_sess, dst_bytes,
+- DMA_TO_DEVICE, 0, &xpt_cmd.sense_buffer[0], 0);
+-
++ DMA_TO_DEVICE, 0, &xpt_cmd.sense_buffer[0], 0,
++ NULL);
+ rc = target_xcopy_setup_pt_cmd(&xpt_cmd, xop, dst_dev, &cdb[0],
+ remote_port);
+ if (rc < 0) {
+diff --git a/drivers/usb/gadget/function/f_tcm.c b/drivers/usb/gadget/function/f_tcm.c
+index 658e2e21fdd0d..c21acebe8aae5 100644
+--- a/drivers/usb/gadget/function/f_tcm.c
++++ b/drivers/usb/gadget/function/f_tcm.c
+@@ -1054,7 +1054,7 @@ static void usbg_cmd_work(struct work_struct *work)
+ tv_nexus->tvn_se_sess->se_tpg->se_tpg_tfo,
+ tv_nexus->tvn_se_sess, cmd->data_len, DMA_NONE,
+ cmd->prio_attr, cmd->sense_iu.sense,
+- cmd->unpacked_lun);
++ cmd->unpacked_lun, NULL);
+ goto out;
+ }
+
+@@ -1183,7 +1183,7 @@ static void bot_cmd_work(struct work_struct *work)
+ tv_nexus->tvn_se_sess->se_tpg->se_tpg_tfo,
+ tv_nexus->tvn_se_sess, cmd->data_len, DMA_NONE,
+ cmd->prio_attr, cmd->sense_iu.sense,
+- cmd->unpacked_lun);
++ cmd->unpacked_lun, NULL);
+ goto out;
+ }
+
+diff --git a/include/target/target_core_fabric.h b/include/target/target_core_fabric.h
+index 65527174b8bc6..d507e7885f17f 100644
+--- a/include/target/target_core_fabric.h
++++ b/include/target/target_core_fabric.h
+@@ -151,9 +151,11 @@ void transport_deregister_session_configfs(struct se_session *);
+ void transport_deregister_session(struct se_session *);
+
+
+-void __target_init_cmd(struct se_cmd *,
+- const struct target_core_fabric_ops *,
+- struct se_session *, u32, int, int, unsigned char *, u64);
++void __target_init_cmd(struct se_cmd *cmd,
++ const struct target_core_fabric_ops *tfo,
++ struct se_session *sess, u32 data_length, int data_direction,
++ int task_attr, unsigned char *sense_buffer, u64 unpacked_lun,
++ struct target_cmd_counter *cmd_cnt);
+ int target_init_cmd(struct se_cmd *se_cmd, struct se_session *se_sess,
+ unsigned char *sense, u64 unpacked_lun, u32 data_length,
+ int task_attr, int data_dir, int flags);
+--
+2.39.2
+
--- /dev/null
+From c06fa42f6000089d9825a1cc9a915006f55f0ab2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Mar 2023 17:07:26 -0700
+Subject: selftests/bpf: Fix a fd leak in an error path in network_helpers.c
+
+From: Martin KaFai Lau <martin.lau@kernel.org>
+
+[ Upstream commit 226efec2b0efad60d4a6c4b2c3a8710dafc4dc21 ]
+
+In __start_server, it leaks a fd when setsockopt(SO_REUSEPORT) fails.
+This patch fixes it.
+
+Fixes: eed92afdd14c ("bpf: selftest: Test batching and bpf_(get|set)sockopt in bpf tcp iter")
+Reported-by: Andrii Nakryiko <andrii@kernel.org>
+Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Yonghong Song <yhs@fb.com>
+Acked-by: John Fastabend <john.fastabend@gmail.com>
+Link: https://lore.kernel.org/bpf/20230316000726.1016773-2-martin.lau@linux.dev
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/network_helpers.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/bpf/network_helpers.c b/tools/testing/selftests/bpf/network_helpers.c
+index 01de33191226b..596caa1765820 100644
+--- a/tools/testing/selftests/bpf/network_helpers.c
++++ b/tools/testing/selftests/bpf/network_helpers.c
+@@ -95,7 +95,7 @@ static int __start_server(int type, int protocol, const struct sockaddr *addr,
+ if (reuseport &&
+ setsockopt(fd, SOL_SOCKET, SO_REUSEPORT, &on, sizeof(on))) {
+ log_err("Failed to set SO_REUSEPORT");
+- return -1;
++ goto error_close;
+ }
+
+ if (bind(fd, addr, addrlen) < 0) {
+--
+2.39.2
+
--- /dev/null
+From 92bcf0c205535ee9aca4fb0ef18d4a73431635e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Mar 2023 22:02:44 -0800
+Subject: selftests/bpf: Fix flaky fib_lookup test
+
+From: Martin KaFai Lau <martin.lau@kernel.org>
+
+[ Upstream commit a6865576317f6249f3f83cf4c10ab56e627ee153 ]
+
+There is a report that fib_lookup test is flaky when running in parallel.
+A symptom of slowness or delay. An example:
+
+Testing IPv6 stale neigh
+set_lookup_params:PASS:inet_pton(IPV6_IFACE_ADDR) 0 nsec
+test_fib_lookup:PASS:bpf_prog_test_run_opts 0 nsec
+test_fib_lookup:FAIL:fib_lookup_ret unexpected fib_lookup_ret: actual 0 != expected 7
+test_fib_lookup:FAIL:dmac not match unexpected dmac not match: actual 1 != expected 0
+dmac expected 11:11:11:11:11:11 actual 00:00:00:00:00:00
+
+[ Note that the "fib_lookup_ret unexpected fib_lookup_ret actual 0 ..."
+ is reversed in terms of expected and actual value. Fixing in this
+ patch also. ]
+
+One possibility is the testing stale neigh entry was marked dead by the
+gc (in neigh_periodic_work). The default gc_stale_time sysctl is 60s.
+This patch increases it to 15 mins.
+
+It also:
+
+- fixes the reversed arg (actual vs expected) in one of the
+ ASSERT_EQ test
+- removes the nodad command arg when adding v4 neigh entry which
+ currently has a warning.
+
+Fixes: 168de0233586 ("selftests/bpf: Add bpf_fib_lookup test")
+Reported-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/20230309060244.3242491-1-martin.lau@linux.dev
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/prog_tests/fib_lookup.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/prog_tests/fib_lookup.c b/tools/testing/selftests/bpf/prog_tests/fib_lookup.c
+index 429393caf6122..a1e7121058118 100644
+--- a/tools/testing/selftests/bpf/prog_tests/fib_lookup.c
++++ b/tools/testing/selftests/bpf/prog_tests/fib_lookup.c
+@@ -54,11 +54,19 @@ static int setup_netns(void)
+ SYS(fail, "ip link add veth1 type veth peer name veth2");
+ SYS(fail, "ip link set dev veth1 up");
+
++ err = write_sysctl("/proc/sys/net/ipv4/neigh/veth1/gc_stale_time", "900");
++ if (!ASSERT_OK(err, "write_sysctl(net.ipv4.neigh.veth1.gc_stale_time)"))
++ goto fail;
++
++ err = write_sysctl("/proc/sys/net/ipv6/neigh/veth1/gc_stale_time", "900");
++ if (!ASSERT_OK(err, "write_sysctl(net.ipv6.neigh.veth1.gc_stale_time)"))
++ goto fail;
++
+ SYS(fail, "ip addr add %s/64 dev veth1 nodad", IPV6_IFACE_ADDR);
+ SYS(fail, "ip neigh add %s dev veth1 nud failed", IPV6_NUD_FAILED_ADDR);
+ SYS(fail, "ip neigh add %s dev veth1 lladdr %s nud stale", IPV6_NUD_STALE_ADDR, DMAC);
+
+- SYS(fail, "ip addr add %s/24 dev veth1 nodad", IPV4_IFACE_ADDR);
++ SYS(fail, "ip addr add %s/24 dev veth1", IPV4_IFACE_ADDR);
+ SYS(fail, "ip neigh add %s dev veth1 nud failed", IPV4_NUD_FAILED_ADDR);
+ SYS(fail, "ip neigh add %s dev veth1 lladdr %s nud stale", IPV4_NUD_STALE_ADDR, DMAC);
+
+@@ -158,7 +166,7 @@ void test_fib_lookup(void)
+ if (!ASSERT_OK(err, "bpf_prog_test_run_opts"))
+ continue;
+
+- ASSERT_EQ(tests[i].expected_ret, skel->bss->fib_lookup_ret,
++ ASSERT_EQ(skel->bss->fib_lookup_ret, tests[i].expected_ret,
+ "fib_lookup_ret");
+
+ ret = memcmp(tests[i].dmac, fib_params->dmac, sizeof(tests[i].dmac));
+--
+2.39.2
+
--- /dev/null
+From 9d69bf5ee034edf20f57634b72d8879d5bcc12cf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Mar 2023 11:37:13 +0100
+Subject: selftests/bpf: Fix IMA test
+
+From: Roberto Sassu <roberto.sassu@huawei.com>
+
+[ Upstream commit 12fabae03ca6474fd571bf6ddb37d009533305d6 ]
+
+Commit 62622dab0a28 ("ima: return IMA digest value only when IMA_COLLECTED
+flag is set") caused bpf_ima_inode_hash() to refuse to give non-fresh
+digests. IMA test #3 assumed the old behavior, that bpf_ima_inode_hash()
+still returned also non-fresh digests.
+
+Correct the test by accepting both cases. If the samples returned are 1,
+assume that the commit above is applied and that the returned digest is
+fresh. If the samples returned are 2, assume that the commit above is not
+applied, and check both the non-fresh and fresh digest.
+
+Fixes: 62622dab0a28 ("ima: return IMA digest value only when IMA_COLLECTED flag is set")
+Reported-by: David Vernet <void@manifault.com>
+Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Reviewed-by: Matt Bobrowski <mattbobrowski@google.com>
+Link: https://lore.kernel.org/bpf/20230308103713.1681200-1-roberto.sassu@huaweicloud.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../selftests/bpf/prog_tests/test_ima.c | 29 ++++++++++++++-----
+ 1 file changed, 21 insertions(+), 8 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/prog_tests/test_ima.c b/tools/testing/selftests/bpf/prog_tests/test_ima.c
+index b13feceb38f1a..810b14981c2eb 100644
+--- a/tools/testing/selftests/bpf/prog_tests/test_ima.c
++++ b/tools/testing/selftests/bpf/prog_tests/test_ima.c
+@@ -70,7 +70,7 @@ void test_test_ima(void)
+ u64 bin_true_sample;
+ char cmd[256];
+
+- int err, duration = 0;
++ int err, duration = 0, fresh_digest_idx = 0;
+ struct ima *skel = NULL;
+
+ skel = ima__open_and_load();
+@@ -129,7 +129,15 @@ void test_test_ima(void)
+ /*
+ * Test #3
+ * - Goal: confirm that bpf_ima_inode_hash() returns a non-fresh digest
+- * - Expected result: 2 samples (/bin/true: non-fresh, fresh)
++ * - Expected result:
++ * 1 sample (/bin/true: fresh) if commit 62622dab0a28 applied
++ * 2 samples (/bin/true: non-fresh, fresh) if commit 62622dab0a28 is
++ * not applied
++ *
++ * If commit 62622dab0a28 ("ima: return IMA digest value only when
++ * IMA_COLLECTED flag is set") is applied, bpf_ima_inode_hash() refuses
++ * to give a non-fresh digest, hence the correct result is 1 instead of
++ * 2.
+ */
+ test_init(skel->bss);
+
+@@ -144,13 +152,18 @@ void test_test_ima(void)
+ goto close_clean;
+
+ err = ring_buffer__consume(ringbuf);
+- ASSERT_EQ(err, 2, "num_samples_or_err");
+- ASSERT_NEQ(ima_hash_from_bpf[0], 0, "ima_hash");
+- ASSERT_NEQ(ima_hash_from_bpf[1], 0, "ima_hash");
+- ASSERT_EQ(ima_hash_from_bpf[0], bin_true_sample, "sample_equal_or_err");
++ ASSERT_GE(err, 1, "num_samples_or_err");
++ if (err == 2) {
++ ASSERT_NEQ(ima_hash_from_bpf[0], 0, "ima_hash");
++ ASSERT_EQ(ima_hash_from_bpf[0], bin_true_sample,
++ "sample_equal_or_err");
++ fresh_digest_idx = 1;
++ }
++
++ ASSERT_NEQ(ima_hash_from_bpf[fresh_digest_idx], 0, "ima_hash");
+ /* IMA refreshed the digest. */
+- ASSERT_NEQ(ima_hash_from_bpf[1], bin_true_sample,
+- "sample_different_or_err");
++ ASSERT_NEQ(ima_hash_from_bpf[fresh_digest_idx], bin_true_sample,
++ "sample_equal_or_err");
+
+ /*
+ * Test #4
+--
+2.39.2
+
--- /dev/null
+From 895b90f00dab0660d7d5b6ef74cc86eff5970892 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Apr 2023 14:04:22 -0700
+Subject: selftests/bpf: Fix leaked bpf_link in get_stackid_cannot_attach
+
+From: Song Liu <song@kernel.org>
+
+[ Upstream commit c1e07a80cf23d3a6e96172bc9a73bfa912a9fcbc ]
+
+skel->links.oncpu is leaked in one case. This causes test perf_branches
+fails when it runs after get_stackid_cannot_attach:
+
+./test_progs -t get_stackid_cannot_attach,perf_branches
+84 get_stackid_cannot_attach:OK
+test_perf_branches_common:PASS:test_perf_branches_load 0 nsec
+test_perf_branches_common:PASS:attach_perf_event 0 nsec
+test_perf_branches_common:PASS:set_affinity 0 nsec
+check_good_sample:FAIL:output not valid no valid sample from prog
+146/1 perf_branches/perf_branches_hw:FAIL
+146/2 perf_branches/perf_branches_no_hw:OK
+146 perf_branches:FAIL
+
+All error logs:
+test_perf_branches_common:PASS:test_perf_branches_load 0 nsec
+test_perf_branches_common:PASS:attach_perf_event 0 nsec
+test_perf_branches_common:PASS:set_affinity 0 nsec
+check_good_sample:FAIL:output not valid no valid sample from prog
+146/1 perf_branches/perf_branches_hw:FAIL
+146 perf_branches:FAIL
+Summary: 1/1 PASSED, 0 SKIPPED, 1 FAILED
+
+Fix this by adding the missing bpf_link__destroy().
+
+Fixes: 346938e9380c ("selftests/bpf: Add get_stackid_cannot_attach")
+Signed-off-by: Song Liu <song@kernel.org>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/20230412210423.900851-3-song@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../testing/selftests/bpf/prog_tests/get_stackid_cannot_attach.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/testing/selftests/bpf/prog_tests/get_stackid_cannot_attach.c b/tools/testing/selftests/bpf/prog_tests/get_stackid_cannot_attach.c
+index 5308de1ed478e..2715c68301f52 100644
+--- a/tools/testing/selftests/bpf/prog_tests/get_stackid_cannot_attach.c
++++ b/tools/testing/selftests/bpf/prog_tests/get_stackid_cannot_attach.c
+@@ -65,6 +65,7 @@ void test_get_stackid_cannot_attach(void)
+ skel->links.oncpu = bpf_program__attach_perf_event(skel->progs.oncpu,
+ pmu_fd);
+ ASSERT_OK_PTR(skel->links.oncpu, "attach_perf_event_callchain");
++ bpf_link__destroy(skel->links.oncpu);
+ close(pmu_fd);
+
+ /* add exclude_callchain_kernel, attach should fail */
+--
+2.39.2
+
--- /dev/null
+From c0aaaf389bc468a48eee60ecd684c5d9ec4e640b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Feb 2023 14:13:42 +0800
+Subject: selftests/bpf: move SYS() macro into the test_progs.h
+
+From: Hangbin Liu <liuhangbin@gmail.com>
+
+[ Upstream commit b61987d37cbee3c44e80304598c60b163553926b ]
+
+A lot of tests defined SYS() macro to run system calls with goto label.
+Let's move this macro to test_progs.h and add configurable
+"goto_label" as the first arg.
+
+Suggested-by: Martin KaFai Lau <martin.lau@linux.dev>
+Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
+Link: https://lore.kernel.org/r/20230224061343.506571-2-liuhangbin@gmail.com
+Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
+Stable-dep-of: a6865576317f ("selftests/bpf: Fix flaky fib_lookup test")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../selftests/bpf/prog_tests/decap_sanity.c | 16 +--
+ .../selftests/bpf/prog_tests/empty_skb.c | 25 ++---
+ .../selftests/bpf/prog_tests/fib_lookup.c | 28 ++---
+ .../selftests/bpf/prog_tests/tc_redirect.c | 100 ++++++++----------
+ .../selftests/bpf/prog_tests/test_tunnel.c | 71 +++++--------
+ .../selftests/bpf/prog_tests/xdp_bonding.c | 40 +++----
+ .../bpf/prog_tests/xdp_do_redirect.c | 30 ++----
+ .../selftests/bpf/prog_tests/xdp_metadata.c | 23 ++--
+ .../selftests/bpf/prog_tests/xdp_synproxy.c | 41 ++++---
+ .../selftests/bpf/prog_tests/xfrm_info.c | 67 +++++-------
+ tools/testing/selftests/bpf/test_progs.h | 15 +++
+ 11 files changed, 193 insertions(+), 263 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/prog_tests/decap_sanity.c b/tools/testing/selftests/bpf/prog_tests/decap_sanity.c
+index 2853883b7cbb2..5c0ebe6ba8667 100644
+--- a/tools/testing/selftests/bpf/prog_tests/decap_sanity.c
++++ b/tools/testing/selftests/bpf/prog_tests/decap_sanity.c
+@@ -10,14 +10,6 @@
+ #include "network_helpers.h"
+ #include "decap_sanity.skel.h"
+
+-#define SYS(fmt, ...) \
+- ({ \
+- char cmd[1024]; \
+- snprintf(cmd, sizeof(cmd), fmt, ##__VA_ARGS__); \
+- if (!ASSERT_OK(system(cmd), cmd)) \
+- goto fail; \
+- })
+-
+ #define NS_TEST "decap_sanity_ns"
+ #define IPV6_IFACE_ADDR "face::1"
+ #define UDP_TEST_PORT 7777
+@@ -37,9 +29,9 @@ void test_decap_sanity(void)
+ if (!ASSERT_OK_PTR(skel, "skel open_and_load"))
+ return;
+
+- SYS("ip netns add %s", NS_TEST);
+- SYS("ip -net %s -6 addr add %s/128 dev lo nodad", NS_TEST, IPV6_IFACE_ADDR);
+- SYS("ip -net %s link set dev lo up", NS_TEST);
++ SYS(fail, "ip netns add %s", NS_TEST);
++ SYS(fail, "ip -net %s -6 addr add %s/128 dev lo nodad", NS_TEST, IPV6_IFACE_ADDR);
++ SYS(fail, "ip -net %s link set dev lo up", NS_TEST);
+
+ nstoken = open_netns(NS_TEST);
+ if (!ASSERT_OK_PTR(nstoken, "open_netns"))
+@@ -80,6 +72,6 @@ void test_decap_sanity(void)
+ bpf_tc_hook_destroy(&qdisc_hook);
+ close_netns(nstoken);
+ }
+- system("ip netns del " NS_TEST " &> /dev/null");
++ SYS_NOFAIL("ip netns del " NS_TEST " &> /dev/null");
+ decap_sanity__destroy(skel);
+ }
+diff --git a/tools/testing/selftests/bpf/prog_tests/empty_skb.c b/tools/testing/selftests/bpf/prog_tests/empty_skb.c
+index 32dd731e9070c..3b77d8a422dbf 100644
+--- a/tools/testing/selftests/bpf/prog_tests/empty_skb.c
++++ b/tools/testing/selftests/bpf/prog_tests/empty_skb.c
+@@ -4,11 +4,6 @@
+ #include <net/if.h>
+ #include "empty_skb.skel.h"
+
+-#define SYS(cmd) ({ \
+- if (!ASSERT_OK(system(cmd), (cmd))) \
+- goto out; \
+-})
+-
+ void test_empty_skb(void)
+ {
+ LIBBPF_OPTS(bpf_test_run_opts, tattr);
+@@ -93,18 +88,18 @@ void test_empty_skb(void)
+ },
+ };
+
+- SYS("ip netns add empty_skb");
++ SYS(out, "ip netns add empty_skb");
+ tok = open_netns("empty_skb");
+- SYS("ip link add veth0 type veth peer veth1");
+- SYS("ip link set dev veth0 up");
+- SYS("ip link set dev veth1 up");
+- SYS("ip addr add 10.0.0.1/8 dev veth0");
+- SYS("ip addr add 10.0.0.2/8 dev veth1");
++ SYS(out, "ip link add veth0 type veth peer veth1");
++ SYS(out, "ip link set dev veth0 up");
++ SYS(out, "ip link set dev veth1 up");
++ SYS(out, "ip addr add 10.0.0.1/8 dev veth0");
++ SYS(out, "ip addr add 10.0.0.2/8 dev veth1");
+ veth_ifindex = if_nametoindex("veth0");
+
+- SYS("ip link add ipip0 type ipip local 10.0.0.1 remote 10.0.0.2");
+- SYS("ip link set ipip0 up");
+- SYS("ip addr add 192.168.1.1/16 dev ipip0");
++ SYS(out, "ip link add ipip0 type ipip local 10.0.0.1 remote 10.0.0.2");
++ SYS(out, "ip link set ipip0 up");
++ SYS(out, "ip addr add 192.168.1.1/16 dev ipip0");
+ ipip_ifindex = if_nametoindex("ipip0");
+
+ bpf_obj = empty_skb__open_and_load();
+@@ -142,5 +137,5 @@ void test_empty_skb(void)
+ empty_skb__destroy(bpf_obj);
+ if (tok)
+ close_netns(tok);
+- system("ip netns del empty_skb");
++ SYS_NOFAIL("ip netns del empty_skb");
+ }
+diff --git a/tools/testing/selftests/bpf/prog_tests/fib_lookup.c b/tools/testing/selftests/bpf/prog_tests/fib_lookup.c
+index 61ccddccf485e..429393caf6122 100644
+--- a/tools/testing/selftests/bpf/prog_tests/fib_lookup.c
++++ b/tools/testing/selftests/bpf/prog_tests/fib_lookup.c
+@@ -8,14 +8,6 @@
+ #include "network_helpers.h"
+ #include "fib_lookup.skel.h"
+
+-#define SYS(fmt, ...) \
+- ({ \
+- char cmd[1024]; \
+- snprintf(cmd, sizeof(cmd), fmt, ##__VA_ARGS__); \
+- if (!ASSERT_OK(system(cmd), cmd)) \
+- goto fail; \
+- })
+-
+ #define NS_TEST "fib_lookup_ns"
+ #define IPV6_IFACE_ADDR "face::face"
+ #define IPV6_NUD_FAILED_ADDR "face::1"
+@@ -59,16 +51,16 @@ static int setup_netns(void)
+ {
+ int err;
+
+- SYS("ip link add veth1 type veth peer name veth2");
+- SYS("ip link set dev veth1 up");
++ SYS(fail, "ip link add veth1 type veth peer name veth2");
++ SYS(fail, "ip link set dev veth1 up");
+
+- SYS("ip addr add %s/64 dev veth1 nodad", IPV6_IFACE_ADDR);
+- SYS("ip neigh add %s dev veth1 nud failed", IPV6_NUD_FAILED_ADDR);
+- SYS("ip neigh add %s dev veth1 lladdr %s nud stale", IPV6_NUD_STALE_ADDR, DMAC);
++ SYS(fail, "ip addr add %s/64 dev veth1 nodad", IPV6_IFACE_ADDR);
++ SYS(fail, "ip neigh add %s dev veth1 nud failed", IPV6_NUD_FAILED_ADDR);
++ SYS(fail, "ip neigh add %s dev veth1 lladdr %s nud stale", IPV6_NUD_STALE_ADDR, DMAC);
+
+- SYS("ip addr add %s/24 dev veth1 nodad", IPV4_IFACE_ADDR);
+- SYS("ip neigh add %s dev veth1 nud failed", IPV4_NUD_FAILED_ADDR);
+- SYS("ip neigh add %s dev veth1 lladdr %s nud stale", IPV4_NUD_STALE_ADDR, DMAC);
++ SYS(fail, "ip addr add %s/24 dev veth1 nodad", IPV4_IFACE_ADDR);
++ SYS(fail, "ip neigh add %s dev veth1 nud failed", IPV4_NUD_FAILED_ADDR);
++ SYS(fail, "ip neigh add %s dev veth1 lladdr %s nud stale", IPV4_NUD_STALE_ADDR, DMAC);
+
+ err = write_sysctl("/proc/sys/net/ipv4/conf/veth1/forwarding", "1");
+ if (!ASSERT_OK(err, "write_sysctl(net.ipv4.conf.veth1.forwarding)"))
+@@ -140,7 +132,7 @@ void test_fib_lookup(void)
+ return;
+ prog_fd = bpf_program__fd(skel->progs.fib_lookup);
+
+- SYS("ip netns add %s", NS_TEST);
++ SYS(fail, "ip netns add %s", NS_TEST);
+
+ nstoken = open_netns(NS_TEST);
+ if (!ASSERT_OK_PTR(nstoken, "open_netns"))
+@@ -182,6 +174,6 @@ void test_fib_lookup(void)
+ fail:
+ if (nstoken)
+ close_netns(nstoken);
+- system("ip netns del " NS_TEST " &> /dev/null");
++ SYS_NOFAIL("ip netns del " NS_TEST " &> /dev/null");
+ fib_lookup__destroy(skel);
+ }
+diff --git a/tools/testing/selftests/bpf/prog_tests/tc_redirect.c b/tools/testing/selftests/bpf/prog_tests/tc_redirect.c
+index bca5e6839ac48..6ee22c3b251ad 100644
+--- a/tools/testing/selftests/bpf/prog_tests/tc_redirect.c
++++ b/tools/testing/selftests/bpf/prog_tests/tc_redirect.c
+@@ -137,24 +137,16 @@ static int get_ifaddr(const char *name, char *ifaddr)
+ return 0;
+ }
+
+-#define SYS(fmt, ...) \
+- ({ \
+- char cmd[1024]; \
+- snprintf(cmd, sizeof(cmd), fmt, ##__VA_ARGS__); \
+- if (!ASSERT_OK(system(cmd), cmd)) \
+- goto fail; \
+- })
+-
+ static int netns_setup_links_and_routes(struct netns_setup_result *result)
+ {
+ struct nstoken *nstoken = NULL;
+ char veth_src_fwd_addr[IFADDR_STR_LEN+1] = {};
+
+- SYS("ip link add veth_src type veth peer name veth_src_fwd");
+- SYS("ip link add veth_dst type veth peer name veth_dst_fwd");
++ SYS(fail, "ip link add veth_src type veth peer name veth_src_fwd");
++ SYS(fail, "ip link add veth_dst type veth peer name veth_dst_fwd");
+
+- SYS("ip link set veth_dst_fwd address " MAC_DST_FWD);
+- SYS("ip link set veth_dst address " MAC_DST);
++ SYS(fail, "ip link set veth_dst_fwd address " MAC_DST_FWD);
++ SYS(fail, "ip link set veth_dst address " MAC_DST);
+
+ if (get_ifaddr("veth_src_fwd", veth_src_fwd_addr))
+ goto fail;
+@@ -175,27 +167,27 @@ static int netns_setup_links_and_routes(struct netns_setup_result *result)
+ if (!ASSERT_GT(result->ifindex_veth_dst_fwd, 0, "ifindex_veth_dst_fwd"))
+ goto fail;
+
+- SYS("ip link set veth_src netns " NS_SRC);
+- SYS("ip link set veth_src_fwd netns " NS_FWD);
+- SYS("ip link set veth_dst_fwd netns " NS_FWD);
+- SYS("ip link set veth_dst netns " NS_DST);
++ SYS(fail, "ip link set veth_src netns " NS_SRC);
++ SYS(fail, "ip link set veth_src_fwd netns " NS_FWD);
++ SYS(fail, "ip link set veth_dst_fwd netns " NS_FWD);
++ SYS(fail, "ip link set veth_dst netns " NS_DST);
+
+ /** setup in 'src' namespace */
+ nstoken = open_netns(NS_SRC);
+ if (!ASSERT_OK_PTR(nstoken, "setns src"))
+ goto fail;
+
+- SYS("ip addr add " IP4_SRC "/32 dev veth_src");
+- SYS("ip addr add " IP6_SRC "/128 dev veth_src nodad");
+- SYS("ip link set dev veth_src up");
++ SYS(fail, "ip addr add " IP4_SRC "/32 dev veth_src");
++ SYS(fail, "ip addr add " IP6_SRC "/128 dev veth_src nodad");
++ SYS(fail, "ip link set dev veth_src up");
+
+- SYS("ip route add " IP4_DST "/32 dev veth_src scope global");
+- SYS("ip route add " IP4_NET "/16 dev veth_src scope global");
+- SYS("ip route add " IP6_DST "/128 dev veth_src scope global");
++ SYS(fail, "ip route add " IP4_DST "/32 dev veth_src scope global");
++ SYS(fail, "ip route add " IP4_NET "/16 dev veth_src scope global");
++ SYS(fail, "ip route add " IP6_DST "/128 dev veth_src scope global");
+
+- SYS("ip neigh add " IP4_DST " dev veth_src lladdr %s",
++ SYS(fail, "ip neigh add " IP4_DST " dev veth_src lladdr %s",
+ veth_src_fwd_addr);
+- SYS("ip neigh add " IP6_DST " dev veth_src lladdr %s",
++ SYS(fail, "ip neigh add " IP6_DST " dev veth_src lladdr %s",
+ veth_src_fwd_addr);
+
+ close_netns(nstoken);
+@@ -209,15 +201,15 @@ static int netns_setup_links_and_routes(struct netns_setup_result *result)
+ * needs v4 one in order to start ARP probing. IP4_NET route is added
+ * to the endpoints so that the ARP processing will reply.
+ */
+- SYS("ip addr add " IP4_SLL "/32 dev veth_src_fwd");
+- SYS("ip addr add " IP4_DLL "/32 dev veth_dst_fwd");
+- SYS("ip link set dev veth_src_fwd up");
+- SYS("ip link set dev veth_dst_fwd up");
++ SYS(fail, "ip addr add " IP4_SLL "/32 dev veth_src_fwd");
++ SYS(fail, "ip addr add " IP4_DLL "/32 dev veth_dst_fwd");
++ SYS(fail, "ip link set dev veth_src_fwd up");
++ SYS(fail, "ip link set dev veth_dst_fwd up");
+
+- SYS("ip route add " IP4_SRC "/32 dev veth_src_fwd scope global");
+- SYS("ip route add " IP6_SRC "/128 dev veth_src_fwd scope global");
+- SYS("ip route add " IP4_DST "/32 dev veth_dst_fwd scope global");
+- SYS("ip route add " IP6_DST "/128 dev veth_dst_fwd scope global");
++ SYS(fail, "ip route add " IP4_SRC "/32 dev veth_src_fwd scope global");
++ SYS(fail, "ip route add " IP6_SRC "/128 dev veth_src_fwd scope global");
++ SYS(fail, "ip route add " IP4_DST "/32 dev veth_dst_fwd scope global");
++ SYS(fail, "ip route add " IP6_DST "/128 dev veth_dst_fwd scope global");
+
+ close_netns(nstoken);
+
+@@ -226,16 +218,16 @@ static int netns_setup_links_and_routes(struct netns_setup_result *result)
+ if (!ASSERT_OK_PTR(nstoken, "setns dst"))
+ goto fail;
+
+- SYS("ip addr add " IP4_DST "/32 dev veth_dst");
+- SYS("ip addr add " IP6_DST "/128 dev veth_dst nodad");
+- SYS("ip link set dev veth_dst up");
++ SYS(fail, "ip addr add " IP4_DST "/32 dev veth_dst");
++ SYS(fail, "ip addr add " IP6_DST "/128 dev veth_dst nodad");
++ SYS(fail, "ip link set dev veth_dst up");
+
+- SYS("ip route add " IP4_SRC "/32 dev veth_dst scope global");
+- SYS("ip route add " IP4_NET "/16 dev veth_dst scope global");
+- SYS("ip route add " IP6_SRC "/128 dev veth_dst scope global");
++ SYS(fail, "ip route add " IP4_SRC "/32 dev veth_dst scope global");
++ SYS(fail, "ip route add " IP4_NET "/16 dev veth_dst scope global");
++ SYS(fail, "ip route add " IP6_SRC "/128 dev veth_dst scope global");
+
+- SYS("ip neigh add " IP4_SRC " dev veth_dst lladdr " MAC_DST_FWD);
+- SYS("ip neigh add " IP6_SRC " dev veth_dst lladdr " MAC_DST_FWD);
++ SYS(fail, "ip neigh add " IP4_SRC " dev veth_dst lladdr " MAC_DST_FWD);
++ SYS(fail, "ip neigh add " IP6_SRC " dev veth_dst lladdr " MAC_DST_FWD);
+
+ close_netns(nstoken);
+
+@@ -375,7 +367,7 @@ static void test_tcp(int family, const char *addr, __u16 port)
+
+ static int test_ping(int family, const char *addr)
+ {
+- SYS("ip netns exec " NS_SRC " %s " PING_ARGS " %s > /dev/null", ping_command(family), addr);
++ SYS(fail, "ip netns exec " NS_SRC " %s " PING_ARGS " %s > /dev/null", ping_command(family), addr);
+ return 0;
+ fail:
+ return -1;
+@@ -953,7 +945,7 @@ static int tun_open(char *name)
+ if (!ASSERT_OK(err, "ioctl TUNSETIFF"))
+ goto fail;
+
+- SYS("ip link set dev %s up", name);
++ SYS(fail, "ip link set dev %s up", name);
+
+ return fd;
+ fail:
+@@ -1076,23 +1068,23 @@ static void test_tc_redirect_peer_l3(struct netns_setup_result *setup_result)
+ XGRESS_FILTER_ADD(&qdisc_veth_dst_fwd, BPF_TC_EGRESS, skel->progs.tc_chk, 0);
+
+ /* Setup route and neigh tables */
+- SYS("ip -netns " NS_SRC " addr add dev tun_src " IP4_TUN_SRC "/24");
+- SYS("ip -netns " NS_FWD " addr add dev tun_fwd " IP4_TUN_FWD "/24");
++ SYS(fail, "ip -netns " NS_SRC " addr add dev tun_src " IP4_TUN_SRC "/24");
++ SYS(fail, "ip -netns " NS_FWD " addr add dev tun_fwd " IP4_TUN_FWD "/24");
+
+- SYS("ip -netns " NS_SRC " addr add dev tun_src " IP6_TUN_SRC "/64 nodad");
+- SYS("ip -netns " NS_FWD " addr add dev tun_fwd " IP6_TUN_FWD "/64 nodad");
++ SYS(fail, "ip -netns " NS_SRC " addr add dev tun_src " IP6_TUN_SRC "/64 nodad");
++ SYS(fail, "ip -netns " NS_FWD " addr add dev tun_fwd " IP6_TUN_FWD "/64 nodad");
+
+- SYS("ip -netns " NS_SRC " route del " IP4_DST "/32 dev veth_src scope global");
+- SYS("ip -netns " NS_SRC " route add " IP4_DST "/32 via " IP4_TUN_FWD
++ SYS(fail, "ip -netns " NS_SRC " route del " IP4_DST "/32 dev veth_src scope global");
++ SYS(fail, "ip -netns " NS_SRC " route add " IP4_DST "/32 via " IP4_TUN_FWD
+ " dev tun_src scope global");
+- SYS("ip -netns " NS_DST " route add " IP4_TUN_SRC "/32 dev veth_dst scope global");
+- SYS("ip -netns " NS_SRC " route del " IP6_DST "/128 dev veth_src scope global");
+- SYS("ip -netns " NS_SRC " route add " IP6_DST "/128 via " IP6_TUN_FWD
++ SYS(fail, "ip -netns " NS_DST " route add " IP4_TUN_SRC "/32 dev veth_dst scope global");
++ SYS(fail, "ip -netns " NS_SRC " route del " IP6_DST "/128 dev veth_src scope global");
++ SYS(fail, "ip -netns " NS_SRC " route add " IP6_DST "/128 via " IP6_TUN_FWD
+ " dev tun_src scope global");
+- SYS("ip -netns " NS_DST " route add " IP6_TUN_SRC "/128 dev veth_dst scope global");
++ SYS(fail, "ip -netns " NS_DST " route add " IP6_TUN_SRC "/128 dev veth_dst scope global");
+
+- SYS("ip -netns " NS_DST " neigh add " IP4_TUN_SRC " dev veth_dst lladdr " MAC_DST_FWD);
+- SYS("ip -netns " NS_DST " neigh add " IP6_TUN_SRC " dev veth_dst lladdr " MAC_DST_FWD);
++ SYS(fail, "ip -netns " NS_DST " neigh add " IP4_TUN_SRC " dev veth_dst lladdr " MAC_DST_FWD);
++ SYS(fail, "ip -netns " NS_DST " neigh add " IP6_TUN_SRC " dev veth_dst lladdr " MAC_DST_FWD);
+
+ if (!ASSERT_OK(set_forwarding(false), "disable forwarding"))
+ goto fail;
+diff --git a/tools/testing/selftests/bpf/prog_tests/test_tunnel.c b/tools/testing/selftests/bpf/prog_tests/test_tunnel.c
+index 07ad457f33709..47f1d482fe390 100644
+--- a/tools/testing/selftests/bpf/prog_tests/test_tunnel.c
++++ b/tools/testing/selftests/bpf/prog_tests/test_tunnel.c
+@@ -91,30 +91,15 @@
+
+ #define PING_ARGS "-i 0.01 -c 3 -w 10 -q"
+
+-#define SYS(fmt, ...) \
+- ({ \
+- char cmd[1024]; \
+- snprintf(cmd, sizeof(cmd), fmt, ##__VA_ARGS__); \
+- if (!ASSERT_OK(system(cmd), cmd)) \
+- goto fail; \
+- })
+-
+-#define SYS_NOFAIL(fmt, ...) \
+- ({ \
+- char cmd[1024]; \
+- snprintf(cmd, sizeof(cmd), fmt, ##__VA_ARGS__); \
+- system(cmd); \
+- })
+-
+ static int config_device(void)
+ {
+- SYS("ip netns add at_ns0");
+- SYS("ip link add veth0 address " MAC_VETH1 " type veth peer name veth1");
+- SYS("ip link set veth0 netns at_ns0");
+- SYS("ip addr add " IP4_ADDR1_VETH1 "/24 dev veth1");
+- SYS("ip link set dev veth1 up mtu 1500");
+- SYS("ip netns exec at_ns0 ip addr add " IP4_ADDR_VETH0 "/24 dev veth0");
+- SYS("ip netns exec at_ns0 ip link set dev veth0 up mtu 1500");
++ SYS(fail, "ip netns add at_ns0");
++ SYS(fail, "ip link add veth0 address " MAC_VETH1 " type veth peer name veth1");
++ SYS(fail, "ip link set veth0 netns at_ns0");
++ SYS(fail, "ip addr add " IP4_ADDR1_VETH1 "/24 dev veth1");
++ SYS(fail, "ip link set dev veth1 up mtu 1500");
++ SYS(fail, "ip netns exec at_ns0 ip addr add " IP4_ADDR_VETH0 "/24 dev veth0");
++ SYS(fail, "ip netns exec at_ns0 ip link set dev veth0 up mtu 1500");
+
+ return 0;
+ fail:
+@@ -132,23 +117,23 @@ static void cleanup(void)
+ static int add_vxlan_tunnel(void)
+ {
+ /* at_ns0 namespace */
+- SYS("ip netns exec at_ns0 ip link add dev %s type vxlan external gbp dstport 4789",
++ SYS(fail, "ip netns exec at_ns0 ip link add dev %s type vxlan external gbp dstport 4789",
+ VXLAN_TUNL_DEV0);
+- SYS("ip netns exec at_ns0 ip link set dev %s address %s up",
++ SYS(fail, "ip netns exec at_ns0 ip link set dev %s address %s up",
+ VXLAN_TUNL_DEV0, MAC_TUNL_DEV0);
+- SYS("ip netns exec at_ns0 ip addr add dev %s %s/24",
++ SYS(fail, "ip netns exec at_ns0 ip addr add dev %s %s/24",
+ VXLAN_TUNL_DEV0, IP4_ADDR_TUNL_DEV0);
+- SYS("ip netns exec at_ns0 ip neigh add %s lladdr %s dev %s",
++ SYS(fail, "ip netns exec at_ns0 ip neigh add %s lladdr %s dev %s",
+ IP4_ADDR_TUNL_DEV1, MAC_TUNL_DEV1, VXLAN_TUNL_DEV0);
+- SYS("ip netns exec at_ns0 ip neigh add %s lladdr %s dev veth0",
++ SYS(fail, "ip netns exec at_ns0 ip neigh add %s lladdr %s dev veth0",
+ IP4_ADDR2_VETH1, MAC_VETH1);
+
+ /* root namespace */
+- SYS("ip link add dev %s type vxlan external gbp dstport 4789",
++ SYS(fail, "ip link add dev %s type vxlan external gbp dstport 4789",
+ VXLAN_TUNL_DEV1);
+- SYS("ip link set dev %s address %s up", VXLAN_TUNL_DEV1, MAC_TUNL_DEV1);
+- SYS("ip addr add dev %s %s/24", VXLAN_TUNL_DEV1, IP4_ADDR_TUNL_DEV1);
+- SYS("ip neigh add %s lladdr %s dev %s",
++ SYS(fail, "ip link set dev %s address %s up", VXLAN_TUNL_DEV1, MAC_TUNL_DEV1);
++ SYS(fail, "ip addr add dev %s %s/24", VXLAN_TUNL_DEV1, IP4_ADDR_TUNL_DEV1);
++ SYS(fail, "ip neigh add %s lladdr %s dev %s",
+ IP4_ADDR_TUNL_DEV0, MAC_TUNL_DEV0, VXLAN_TUNL_DEV1);
+
+ return 0;
+@@ -165,26 +150,26 @@ static void delete_vxlan_tunnel(void)
+
+ static int add_ip6vxlan_tunnel(void)
+ {
+- SYS("ip netns exec at_ns0 ip -6 addr add %s/96 dev veth0",
++ SYS(fail, "ip netns exec at_ns0 ip -6 addr add %s/96 dev veth0",
+ IP6_ADDR_VETH0);
+- SYS("ip netns exec at_ns0 ip link set dev veth0 up");
+- SYS("ip -6 addr add %s/96 dev veth1", IP6_ADDR1_VETH1);
+- SYS("ip -6 addr add %s/96 dev veth1", IP6_ADDR2_VETH1);
+- SYS("ip link set dev veth1 up");
++ SYS(fail, "ip netns exec at_ns0 ip link set dev veth0 up");
++ SYS(fail, "ip -6 addr add %s/96 dev veth1", IP6_ADDR1_VETH1);
++ SYS(fail, "ip -6 addr add %s/96 dev veth1", IP6_ADDR2_VETH1);
++ SYS(fail, "ip link set dev veth1 up");
+
+ /* at_ns0 namespace */
+- SYS("ip netns exec at_ns0 ip link add dev %s type vxlan external dstport 4789",
++ SYS(fail, "ip netns exec at_ns0 ip link add dev %s type vxlan external dstport 4789",
+ IP6VXLAN_TUNL_DEV0);
+- SYS("ip netns exec at_ns0 ip addr add dev %s %s/24",
++ SYS(fail, "ip netns exec at_ns0 ip addr add dev %s %s/24",
+ IP6VXLAN_TUNL_DEV0, IP4_ADDR_TUNL_DEV0);
+- SYS("ip netns exec at_ns0 ip link set dev %s address %s up",
++ SYS(fail, "ip netns exec at_ns0 ip link set dev %s address %s up",
+ IP6VXLAN_TUNL_DEV0, MAC_TUNL_DEV0);
+
+ /* root namespace */
+- SYS("ip link add dev %s type vxlan external dstport 4789",
++ SYS(fail, "ip link add dev %s type vxlan external dstport 4789",
+ IP6VXLAN_TUNL_DEV1);
+- SYS("ip addr add dev %s %s/24", IP6VXLAN_TUNL_DEV1, IP4_ADDR_TUNL_DEV1);
+- SYS("ip link set dev %s address %s up",
++ SYS(fail, "ip addr add dev %s %s/24", IP6VXLAN_TUNL_DEV1, IP4_ADDR_TUNL_DEV1);
++ SYS(fail, "ip link set dev %s address %s up",
+ IP6VXLAN_TUNL_DEV1, MAC_TUNL_DEV1);
+
+ return 0;
+@@ -205,7 +190,7 @@ static void delete_ip6vxlan_tunnel(void)
+
+ static int test_ping(int family, const char *addr)
+ {
+- SYS("%s %s %s > /dev/null", ping_command(family), PING_ARGS, addr);
++ SYS(fail, "%s %s %s > /dev/null", ping_command(family), PING_ARGS, addr);
+ return 0;
+ fail:
+ return -1;
+diff --git a/tools/testing/selftests/bpf/prog_tests/xdp_bonding.c b/tools/testing/selftests/bpf/prog_tests/xdp_bonding.c
+index 5e3a26b15ec62..d19f79048ff6f 100644
+--- a/tools/testing/selftests/bpf/prog_tests/xdp_bonding.c
++++ b/tools/testing/selftests/bpf/prog_tests/xdp_bonding.c
+@@ -141,41 +141,33 @@ static const char * const xmit_policy_names[] = {
+ static int bonding_setup(struct skeletons *skeletons, int mode, int xmit_policy,
+ int bond_both_attach)
+ {
+-#define SYS(fmt, ...) \
+- ({ \
+- char cmd[1024]; \
+- snprintf(cmd, sizeof(cmd), fmt, ##__VA_ARGS__); \
+- if (!ASSERT_OK(system(cmd), cmd)) \
+- return -1; \
+- })
+-
+- SYS("ip netns add ns_dst");
+- SYS("ip link add veth1_1 type veth peer name veth2_1 netns ns_dst");
+- SYS("ip link add veth1_2 type veth peer name veth2_2 netns ns_dst");
+-
+- SYS("ip link add bond1 type bond mode %s xmit_hash_policy %s",
++ SYS(fail, "ip netns add ns_dst");
++ SYS(fail, "ip link add veth1_1 type veth peer name veth2_1 netns ns_dst");
++ SYS(fail, "ip link add veth1_2 type veth peer name veth2_2 netns ns_dst");
++
++ SYS(fail, "ip link add bond1 type bond mode %s xmit_hash_policy %s",
+ mode_names[mode], xmit_policy_names[xmit_policy]);
+- SYS("ip link set bond1 up address " BOND1_MAC_STR " addrgenmode none");
+- SYS("ip -netns ns_dst link add bond2 type bond mode %s xmit_hash_policy %s",
++ SYS(fail, "ip link set bond1 up address " BOND1_MAC_STR " addrgenmode none");
++ SYS(fail, "ip -netns ns_dst link add bond2 type bond mode %s xmit_hash_policy %s",
+ mode_names[mode], xmit_policy_names[xmit_policy]);
+- SYS("ip -netns ns_dst link set bond2 up address " BOND2_MAC_STR " addrgenmode none");
++ SYS(fail, "ip -netns ns_dst link set bond2 up address " BOND2_MAC_STR " addrgenmode none");
+
+- SYS("ip link set veth1_1 master bond1");
++ SYS(fail, "ip link set veth1_1 master bond1");
+ if (bond_both_attach == BOND_BOTH_AND_ATTACH) {
+- SYS("ip link set veth1_2 master bond1");
++ SYS(fail, "ip link set veth1_2 master bond1");
+ } else {
+- SYS("ip link set veth1_2 up addrgenmode none");
++ SYS(fail, "ip link set veth1_2 up addrgenmode none");
+
+ if (xdp_attach(skeletons, skeletons->xdp_dummy->progs.xdp_dummy_prog, "veth1_2"))
+ return -1;
+ }
+
+- SYS("ip -netns ns_dst link set veth2_1 master bond2");
++ SYS(fail, "ip -netns ns_dst link set veth2_1 master bond2");
+
+ if (bond_both_attach == BOND_BOTH_AND_ATTACH)
+- SYS("ip -netns ns_dst link set veth2_2 master bond2");
++ SYS(fail, "ip -netns ns_dst link set veth2_2 master bond2");
+ else
+- SYS("ip -netns ns_dst link set veth2_2 up addrgenmode none");
++ SYS(fail, "ip -netns ns_dst link set veth2_2 up addrgenmode none");
+
+ /* Load a dummy program on sending side as with veth peer needs to have a
+ * XDP program loaded as well.
+@@ -194,8 +186,8 @@ static int bonding_setup(struct skeletons *skeletons, int mode, int xmit_policy,
+ }
+
+ return 0;
+-
+-#undef SYS
++fail:
++ return -1;
+ }
+
+ static void bonding_cleanup(struct skeletons *skeletons)
+diff --git a/tools/testing/selftests/bpf/prog_tests/xdp_do_redirect.c b/tools/testing/selftests/bpf/prog_tests/xdp_do_redirect.c
+index 8251a0fc6ee94..fde13010980d7 100644
+--- a/tools/testing/selftests/bpf/prog_tests/xdp_do_redirect.c
++++ b/tools/testing/selftests/bpf/prog_tests/xdp_do_redirect.c
+@@ -12,14 +12,6 @@
+ #include <uapi/linux/netdev.h>
+ #include "test_xdp_do_redirect.skel.h"
+
+-#define SYS(fmt, ...) \
+- ({ \
+- char cmd[1024]; \
+- snprintf(cmd, sizeof(cmd), fmt, ##__VA_ARGS__); \
+- if (!ASSERT_OK(system(cmd), cmd)) \
+- goto out; \
+- })
+-
+ struct udp_packet {
+ struct ethhdr eth;
+ struct ipv6hdr iph;
+@@ -127,19 +119,19 @@ void test_xdp_do_redirect(void)
+ * iface and NUM_PKTS-2 in the TC hook. We match the packets on the UDP
+ * payload.
+ */
+- SYS("ip netns add testns");
++ SYS(out, "ip netns add testns");
+ nstoken = open_netns("testns");
+ if (!ASSERT_OK_PTR(nstoken, "setns"))
+ goto out;
+
+- SYS("ip link add veth_src type veth peer name veth_dst");
+- SYS("ip link set dev veth_src address 00:11:22:33:44:55");
+- SYS("ip link set dev veth_dst address 66:77:88:99:aa:bb");
+- SYS("ip link set dev veth_src up");
+- SYS("ip link set dev veth_dst up");
+- SYS("ip addr add dev veth_src fc00::1/64");
+- SYS("ip addr add dev veth_dst fc00::2/64");
+- SYS("ip neigh add fc00::2 dev veth_src lladdr 66:77:88:99:aa:bb");
++ SYS(out, "ip link add veth_src type veth peer name veth_dst");
++ SYS(out, "ip link set dev veth_src address 00:11:22:33:44:55");
++ SYS(out, "ip link set dev veth_dst address 66:77:88:99:aa:bb");
++ SYS(out, "ip link set dev veth_src up");
++ SYS(out, "ip link set dev veth_dst up");
++ SYS(out, "ip addr add dev veth_src fc00::1/64");
++ SYS(out, "ip addr add dev veth_dst fc00::2/64");
++ SYS(out, "ip neigh add fc00::2 dev veth_src lladdr 66:77:88:99:aa:bb");
+
+ /* We enable forwarding in the test namespace because that will cause
+ * the packets that go through the kernel stack (with XDP_PASS) to be
+@@ -152,7 +144,7 @@ void test_xdp_do_redirect(void)
+ * code didn't have this, so we keep the test behaviour to make sure the
+ * bug doesn't resurface.
+ */
+- SYS("sysctl -qw net.ipv6.conf.all.forwarding=1");
++ SYS(out, "sysctl -qw net.ipv6.conf.all.forwarding=1");
+
+ ifindex_src = if_nametoindex("veth_src");
+ ifindex_dst = if_nametoindex("veth_dst");
+@@ -250,6 +242,6 @@ void test_xdp_do_redirect(void)
+ out:
+ if (nstoken)
+ close_netns(nstoken);
+- system("ip netns del testns");
++ SYS_NOFAIL("ip netns del testns");
+ test_xdp_do_redirect__destroy(skel);
+ }
+diff --git a/tools/testing/selftests/bpf/prog_tests/xdp_metadata.c b/tools/testing/selftests/bpf/prog_tests/xdp_metadata.c
+index 8c5e98da9ae9f..626c461fa34d8 100644
+--- a/tools/testing/selftests/bpf/prog_tests/xdp_metadata.c
++++ b/tools/testing/selftests/bpf/prog_tests/xdp_metadata.c
+@@ -34,11 +34,6 @@
+ #define PREFIX_LEN "8"
+ #define FAMILY AF_INET
+
+-#define SYS(cmd) ({ \
+- if (!ASSERT_OK(system(cmd), (cmd))) \
+- goto out; \
+-})
+-
+ struct xsk {
+ void *umem_area;
+ struct xsk_umem *umem;
+@@ -300,16 +295,16 @@ void test_xdp_metadata(void)
+
+ /* Setup new networking namespace, with a veth pair. */
+
+- SYS("ip netns add xdp_metadata");
++ SYS(out, "ip netns add xdp_metadata");
+ tok = open_netns("xdp_metadata");
+- SYS("ip link add numtxqueues 1 numrxqueues 1 " TX_NAME
++ SYS(out, "ip link add numtxqueues 1 numrxqueues 1 " TX_NAME
+ " type veth peer " RX_NAME " numtxqueues 1 numrxqueues 1");
+- SYS("ip link set dev " TX_NAME " address 00:00:00:00:00:01");
+- SYS("ip link set dev " RX_NAME " address 00:00:00:00:00:02");
+- SYS("ip link set dev " TX_NAME " up");
+- SYS("ip link set dev " RX_NAME " up");
+- SYS("ip addr add " TX_ADDR "/" PREFIX_LEN " dev " TX_NAME);
+- SYS("ip addr add " RX_ADDR "/" PREFIX_LEN " dev " RX_NAME);
++ SYS(out, "ip link set dev " TX_NAME " address 00:00:00:00:00:01");
++ SYS(out, "ip link set dev " RX_NAME " address 00:00:00:00:00:02");
++ SYS(out, "ip link set dev " TX_NAME " up");
++ SYS(out, "ip link set dev " RX_NAME " up");
++ SYS(out, "ip addr add " TX_ADDR "/" PREFIX_LEN " dev " TX_NAME);
++ SYS(out, "ip addr add " RX_ADDR "/" PREFIX_LEN " dev " RX_NAME);
+
+ rx_ifindex = if_nametoindex(RX_NAME);
+ tx_ifindex = if_nametoindex(TX_NAME);
+@@ -407,5 +402,5 @@ void test_xdp_metadata(void)
+ xdp_metadata__destroy(bpf_obj);
+ if (tok)
+ close_netns(tok);
+- system("ip netns del xdp_metadata");
++ SYS_NOFAIL("ip netns del xdp_metadata");
+ }
+diff --git a/tools/testing/selftests/bpf/prog_tests/xdp_synproxy.c b/tools/testing/selftests/bpf/prog_tests/xdp_synproxy.c
+index c72083885b6d7..8b50a992d233b 100644
+--- a/tools/testing/selftests/bpf/prog_tests/xdp_synproxy.c
++++ b/tools/testing/selftests/bpf/prog_tests/xdp_synproxy.c
+@@ -8,11 +8,6 @@
+
+ #define CMD_OUT_BUF_SIZE 1023
+
+-#define SYS(cmd) ({ \
+- if (!ASSERT_OK(system(cmd), (cmd))) \
+- goto out; \
+-})
+-
+ #define SYS_OUT(cmd, ...) ({ \
+ char buf[1024]; \
+ snprintf(buf, sizeof(buf), (cmd), ##__VA_ARGS__); \
+@@ -69,37 +64,37 @@ static void test_synproxy(bool xdp)
+ char buf[CMD_OUT_BUF_SIZE];
+ size_t size;
+
+- SYS("ip netns add synproxy");
++ SYS(out, "ip netns add synproxy");
+
+- SYS("ip link add tmp0 type veth peer name tmp1");
+- SYS("ip link set tmp1 netns synproxy");
+- SYS("ip link set tmp0 up");
+- SYS("ip addr replace 198.18.0.1/24 dev tmp0");
++ SYS(out, "ip link add tmp0 type veth peer name tmp1");
++ SYS(out, "ip link set tmp1 netns synproxy");
++ SYS(out, "ip link set tmp0 up");
++ SYS(out, "ip addr replace 198.18.0.1/24 dev tmp0");
+
+ /* When checksum offload is enabled, the XDP program sees wrong
+ * checksums and drops packets.
+ */
+- SYS("ethtool -K tmp0 tx off");
++ SYS(out, "ethtool -K tmp0 tx off");
+ if (xdp)
+ /* Workaround required for veth. */
+- SYS("ip link set tmp0 xdp object xdp_dummy.bpf.o section xdp 2> /dev/null");
++ SYS(out, "ip link set tmp0 xdp object xdp_dummy.bpf.o section xdp 2> /dev/null");
+
+ ns = open_netns("synproxy");
+ if (!ASSERT_OK_PTR(ns, "setns"))
+ goto out;
+
+- SYS("ip link set lo up");
+- SYS("ip link set tmp1 up");
+- SYS("ip addr replace 198.18.0.2/24 dev tmp1");
+- SYS("sysctl -w net.ipv4.tcp_syncookies=2");
+- SYS("sysctl -w net.ipv4.tcp_timestamps=1");
+- SYS("sysctl -w net.netfilter.nf_conntrack_tcp_loose=0");
+- SYS("iptables-legacy -t raw -I PREROUTING \
++ SYS(out, "ip link set lo up");
++ SYS(out, "ip link set tmp1 up");
++ SYS(out, "ip addr replace 198.18.0.2/24 dev tmp1");
++ SYS(out, "sysctl -w net.ipv4.tcp_syncookies=2");
++ SYS(out, "sysctl -w net.ipv4.tcp_timestamps=1");
++ SYS(out, "sysctl -w net.netfilter.nf_conntrack_tcp_loose=0");
++ SYS(out, "iptables-legacy -t raw -I PREROUTING \
+ -i tmp1 -p tcp -m tcp --syn --dport 8080 -j CT --notrack");
+- SYS("iptables-legacy -t filter -A INPUT \
++ SYS(out, "iptables-legacy -t filter -A INPUT \
+ -i tmp1 -p tcp -m tcp --dport 8080 -m state --state INVALID,UNTRACKED \
+ -j SYNPROXY --sack-perm --timestamp --wscale 7 --mss 1460");
+- SYS("iptables-legacy -t filter -A INPUT \
++ SYS(out, "iptables-legacy -t filter -A INPUT \
+ -i tmp1 -m state --state INVALID -j DROP");
+
+ ctrl_file = SYS_OUT("./xdp_synproxy --iface tmp1 --ports 8080 \
+@@ -170,8 +165,8 @@ static void test_synproxy(bool xdp)
+ if (ns)
+ close_netns(ns);
+
+- system("ip link del tmp0");
+- system("ip netns del synproxy");
++ SYS_NOFAIL("ip link del tmp0");
++ SYS_NOFAIL("ip netns del synproxy");
+ }
+
+ void test_xdp_synproxy(void)
+diff --git a/tools/testing/selftests/bpf/prog_tests/xfrm_info.c b/tools/testing/selftests/bpf/prog_tests/xfrm_info.c
+index 8b03c9bb48625..d37f5394e199e 100644
+--- a/tools/testing/selftests/bpf/prog_tests/xfrm_info.c
++++ b/tools/testing/selftests/bpf/prog_tests/xfrm_info.c
+@@ -69,21 +69,6 @@
+ "proto esp aead 'rfc4106(gcm(aes))' " \
+ "0xe4d8f4b4da1df18a3510b3781496daa82488b713 128 mode tunnel "
+
+-#define SYS(fmt, ...) \
+- ({ \
+- char cmd[1024]; \
+- snprintf(cmd, sizeof(cmd), fmt, ##__VA_ARGS__); \
+- if (!ASSERT_OK(system(cmd), cmd)) \
+- goto fail; \
+- })
+-
+-#define SYS_NOFAIL(fmt, ...) \
+- ({ \
+- char cmd[1024]; \
+- snprintf(cmd, sizeof(cmd), fmt, ##__VA_ARGS__); \
+- system(cmd); \
+- })
+-
+ static int attach_tc_prog(struct bpf_tc_hook *hook, int igr_fd, int egr_fd)
+ {
+ LIBBPF_OPTS(bpf_tc_opts, opts1, .handle = 1, .priority = 1,
+@@ -126,23 +111,23 @@ static void cleanup(void)
+
+ static int config_underlay(void)
+ {
+- SYS("ip netns add " NS0);
+- SYS("ip netns add " NS1);
+- SYS("ip netns add " NS2);
++ SYS(fail, "ip netns add " NS0);
++ SYS(fail, "ip netns add " NS1);
++ SYS(fail, "ip netns add " NS2);
+
+ /* NS0 <-> NS1 [veth01 <-> veth10] */
+- SYS("ip link add veth01 netns " NS0 " type veth peer name veth10 netns " NS1);
+- SYS("ip -net " NS0 " addr add " IP4_ADDR_VETH01 "/24 dev veth01");
+- SYS("ip -net " NS0 " link set dev veth01 up");
+- SYS("ip -net " NS1 " addr add " IP4_ADDR_VETH10 "/24 dev veth10");
+- SYS("ip -net " NS1 " link set dev veth10 up");
++ SYS(fail, "ip link add veth01 netns " NS0 " type veth peer name veth10 netns " NS1);
++ SYS(fail, "ip -net " NS0 " addr add " IP4_ADDR_VETH01 "/24 dev veth01");
++ SYS(fail, "ip -net " NS0 " link set dev veth01 up");
++ SYS(fail, "ip -net " NS1 " addr add " IP4_ADDR_VETH10 "/24 dev veth10");
++ SYS(fail, "ip -net " NS1 " link set dev veth10 up");
+
+ /* NS0 <-> NS2 [veth02 <-> veth20] */
+- SYS("ip link add veth02 netns " NS0 " type veth peer name veth20 netns " NS2);
+- SYS("ip -net " NS0 " addr add " IP4_ADDR_VETH02 "/24 dev veth02");
+- SYS("ip -net " NS0 " link set dev veth02 up");
+- SYS("ip -net " NS2 " addr add " IP4_ADDR_VETH20 "/24 dev veth20");
+- SYS("ip -net " NS2 " link set dev veth20 up");
++ SYS(fail, "ip link add veth02 netns " NS0 " type veth peer name veth20 netns " NS2);
++ SYS(fail, "ip -net " NS0 " addr add " IP4_ADDR_VETH02 "/24 dev veth02");
++ SYS(fail, "ip -net " NS0 " link set dev veth02 up");
++ SYS(fail, "ip -net " NS2 " addr add " IP4_ADDR_VETH20 "/24 dev veth20");
++ SYS(fail, "ip -net " NS2 " link set dev veth20 up");
+
+ return 0;
+ fail:
+@@ -153,20 +138,20 @@ static int setup_xfrm_tunnel_ns(const char *ns, const char *ipv4_local,
+ const char *ipv4_remote, int if_id)
+ {
+ /* State: local -> remote */
+- SYS("ip -net %s xfrm state add src %s dst %s spi 1 "
++ SYS(fail, "ip -net %s xfrm state add src %s dst %s spi 1 "
+ ESP_DUMMY_PARAMS "if_id %d", ns, ipv4_local, ipv4_remote, if_id);
+
+ /* State: local <- remote */
+- SYS("ip -net %s xfrm state add src %s dst %s spi 1 "
++ SYS(fail, "ip -net %s xfrm state add src %s dst %s spi 1 "
+ ESP_DUMMY_PARAMS "if_id %d", ns, ipv4_remote, ipv4_local, if_id);
+
+ /* Policy: local -> remote */
+- SYS("ip -net %s xfrm policy add dir out src 0.0.0.0/0 dst 0.0.0.0/0 "
++ SYS(fail, "ip -net %s xfrm policy add dir out src 0.0.0.0/0 dst 0.0.0.0/0 "
+ "if_id %d tmpl src %s dst %s proto esp mode tunnel if_id %d", ns,
+ if_id, ipv4_local, ipv4_remote, if_id);
+
+ /* Policy: local <- remote */
+- SYS("ip -net %s xfrm policy add dir in src 0.0.0.0/0 dst 0.0.0.0/0 "
++ SYS(fail, "ip -net %s xfrm policy add dir in src 0.0.0.0/0 dst 0.0.0.0/0 "
+ "if_id %d tmpl src %s dst %s proto esp mode tunnel if_id %d", ns,
+ if_id, ipv4_remote, ipv4_local, if_id);
+
+@@ -274,16 +259,16 @@ static int config_overlay(void)
+ if (!ASSERT_OK(setup_xfrmi_external_dev(NS0), "xfrmi"))
+ goto fail;
+
+- SYS("ip -net " NS0 " addr add 192.168.1.100/24 dev ipsec0");
+- SYS("ip -net " NS0 " link set dev ipsec0 up");
++ SYS(fail, "ip -net " NS0 " addr add 192.168.1.100/24 dev ipsec0");
++ SYS(fail, "ip -net " NS0 " link set dev ipsec0 up");
+
+- SYS("ip -net " NS1 " link add ipsec0 type xfrm if_id %d", IF_ID_1);
+- SYS("ip -net " NS1 " addr add 192.168.1.200/24 dev ipsec0");
+- SYS("ip -net " NS1 " link set dev ipsec0 up");
++ SYS(fail, "ip -net " NS1 " link add ipsec0 type xfrm if_id %d", IF_ID_1);
++ SYS(fail, "ip -net " NS1 " addr add 192.168.1.200/24 dev ipsec0");
++ SYS(fail, "ip -net " NS1 " link set dev ipsec0 up");
+
+- SYS("ip -net " NS2 " link add ipsec0 type xfrm if_id %d", IF_ID_2);
+- SYS("ip -net " NS2 " addr add 192.168.1.200/24 dev ipsec0");
+- SYS("ip -net " NS2 " link set dev ipsec0 up");
++ SYS(fail, "ip -net " NS2 " link add ipsec0 type xfrm if_id %d", IF_ID_2);
++ SYS(fail, "ip -net " NS2 " addr add 192.168.1.200/24 dev ipsec0");
++ SYS(fail, "ip -net " NS2 " link set dev ipsec0 up");
+
+ return 0;
+ fail:
+@@ -294,7 +279,7 @@ static int test_xfrm_ping(struct xfrm_info *skel, u32 if_id)
+ {
+ skel->bss->req_if_id = if_id;
+
+- SYS("ping -i 0.01 -c 3 -w 10 -q 192.168.1.200 > /dev/null");
++ SYS(fail, "ping -i 0.01 -c 3 -w 10 -q 192.168.1.200 > /dev/null");
+
+ if (!ASSERT_EQ(skel->bss->resp_if_id, if_id, "if_id"))
+ goto fail;
+diff --git a/tools/testing/selftests/bpf/test_progs.h b/tools/testing/selftests/bpf/test_progs.h
+index d5d51ec97ec87..9fbdc57c5b570 100644
+--- a/tools/testing/selftests/bpf/test_progs.h
++++ b/tools/testing/selftests/bpf/test_progs.h
+@@ -376,6 +376,21 @@ int test__join_cgroup(const char *path);
+ ___ok; \
+ })
+
++#define SYS(goto_label, fmt, ...) \
++ ({ \
++ char cmd[1024]; \
++ snprintf(cmd, sizeof(cmd), fmt, ##__VA_ARGS__); \
++ if (!ASSERT_OK(system(cmd), cmd)) \
++ goto goto_label; \
++ })
++
++#define SYS_NOFAIL(fmt, ...) \
++ ({ \
++ char cmd[1024]; \
++ snprintf(cmd, sizeof(cmd), fmt, ##__VA_ARGS__); \
++ system(cmd); \
++ })
++
+ static inline __u64 ptr_to_u64(const void *ptr)
+ {
+ return (__u64) (unsigned long) ptr;
+--
+2.39.2
+
--- /dev/null
+From 2be5d2ff145a4e27d1d13c6e42254ca4aac7a28e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Apr 2023 14:04:21 -0700
+Subject: selftests/bpf: Use read_perf_max_sample_freq() in perf_event_stackmap
+
+From: Song Liu <song@kernel.org>
+
+[ Upstream commit de6d014a09bf12a9a8959d60c0a1d4a41d394a89 ]
+
+Currently, perf_event sample period in perf_event_stackmap is set too low
+that the test fails randomly. Fix this by using the max sample frequency,
+from read_perf_max_sample_freq().
+
+Move read_perf_max_sample_freq() to testing_helpers.c. Replace the CHECK()
+with if-printf, as CHECK is not available in testing_helpers.c.
+
+Fixes: 1da4864c2b20 ("selftests/bpf: Add callchain_stackid")
+Signed-off-by: Song Liu <song@kernel.org>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/20230412210423.900851-2-song@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../bpf/prog_tests/perf_event_stackmap.c | 3 ++-
+ .../bpf/prog_tests/stacktrace_build_id_nmi.c | 15 --------------
+ tools/testing/selftests/bpf/testing_helpers.c | 20 +++++++++++++++++++
+ tools/testing/selftests/bpf/testing_helpers.h | 2 ++
+ 4 files changed, 24 insertions(+), 16 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/prog_tests/perf_event_stackmap.c b/tools/testing/selftests/bpf/prog_tests/perf_event_stackmap.c
+index 33144c9432aeb..f4aad35afae16 100644
+--- a/tools/testing/selftests/bpf/prog_tests/perf_event_stackmap.c
++++ b/tools/testing/selftests/bpf/prog_tests/perf_event_stackmap.c
+@@ -63,7 +63,8 @@ void test_perf_event_stackmap(void)
+ PERF_SAMPLE_BRANCH_NO_FLAGS |
+ PERF_SAMPLE_BRANCH_NO_CYCLES |
+ PERF_SAMPLE_BRANCH_CALL_STACK,
+- .sample_period = 5000,
++ .freq = 1,
++ .sample_freq = read_perf_max_sample_freq(),
+ .size = sizeof(struct perf_event_attr),
+ };
+ struct perf_event_stackmap *skel;
+diff --git a/tools/testing/selftests/bpf/prog_tests/stacktrace_build_id_nmi.c b/tools/testing/selftests/bpf/prog_tests/stacktrace_build_id_nmi.c
+index f4ea1a215ce4d..704f7f6c3704a 100644
+--- a/tools/testing/selftests/bpf/prog_tests/stacktrace_build_id_nmi.c
++++ b/tools/testing/selftests/bpf/prog_tests/stacktrace_build_id_nmi.c
+@@ -2,21 +2,6 @@
+ #include <test_progs.h>
+ #include "test_stacktrace_build_id.skel.h"
+
+-static __u64 read_perf_max_sample_freq(void)
+-{
+- __u64 sample_freq = 5000; /* fallback to 5000 on error */
+- FILE *f;
+- __u32 duration = 0;
+-
+- f = fopen("/proc/sys/kernel/perf_event_max_sample_rate", "r");
+- if (f == NULL)
+- return sample_freq;
+- CHECK(fscanf(f, "%llu", &sample_freq) != 1, "Get max sample rate",
+- "return default value: 5000,err %d\n", -errno);
+- fclose(f);
+- return sample_freq;
+-}
+-
+ void test_stacktrace_build_id_nmi(void)
+ {
+ int control_map_fd, stackid_hmap_fd, stackmap_fd;
+diff --git a/tools/testing/selftests/bpf/testing_helpers.c b/tools/testing/selftests/bpf/testing_helpers.c
+index 6c44153755e66..3fe98ffed38a6 100644
+--- a/tools/testing/selftests/bpf/testing_helpers.c
++++ b/tools/testing/selftests/bpf/testing_helpers.c
+@@ -229,3 +229,23 @@ int bpf_test_load_program(enum bpf_prog_type type, const struct bpf_insn *insns,
+
+ return bpf_prog_load(type, NULL, license, insns, insns_cnt, &opts);
+ }
++
++__u64 read_perf_max_sample_freq(void)
++{
++ __u64 sample_freq = 5000; /* fallback to 5000 on error */
++ FILE *f;
++
++ f = fopen("/proc/sys/kernel/perf_event_max_sample_rate", "r");
++ if (f == NULL) {
++ printf("Failed to open /proc/sys/kernel/perf_event_max_sample_rate: err %d\n"
++ "return default value: 5000\n", -errno);
++ return sample_freq;
++ }
++ if (fscanf(f, "%llu", &sample_freq) != 1) {
++ printf("Failed to parse /proc/sys/kernel/perf_event_max_sample_rate: err %d\n"
++ "return default value: 5000\n", -errno);
++ }
++
++ fclose(f);
++ return sample_freq;
++}
+diff --git a/tools/testing/selftests/bpf/testing_helpers.h b/tools/testing/selftests/bpf/testing_helpers.h
+index 6ec00bf79cb55..eb8790f928e4c 100644
+--- a/tools/testing/selftests/bpf/testing_helpers.h
++++ b/tools/testing/selftests/bpf/testing_helpers.h
+@@ -20,3 +20,5 @@ struct test_filter_set;
+ int parse_test_list(const char *s,
+ struct test_filter_set *test_set,
+ bool is_glob_pattern);
++
++__u64 read_perf_max_sample_freq(void);
+--
+2.39.2
+
--- /dev/null
+From 065d371bf08febc6ed858ff8306eaba4a50c06d9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Apr 2023 19:33:54 +0000
+Subject: selftests/bpf: Wait for receive in cg_storage_multi test
+
+From: YiFei Zhu <zhuyifei@google.com>
+
+[ Upstream commit 5af607a861d43ffff830fc1890033e579ec44799 ]
+
+In some cases the loopback latency might be large enough, causing
+the assertion on invocations to be run before ingress prog getting
+executed. The assertion would fail and the test would flake.
+
+This can be reliably reproduced by arbitrarily increasing the
+loopback latency (thanks to [1]):
+ tc qdisc add dev lo root handle 1: htb default 12
+ tc class add dev lo parent 1:1 classid 1:12 htb rate 20kbps ceil 20kbps
+ tc qdisc add dev lo parent 1:12 netem delay 100ms
+
+Fix this by waiting on the receive end, instead of instantly
+returning to the assert. The call to read() will wait for the
+default SO_RCVTIMEO timeout of 3 seconds provided by
+start_server().
+
+[1] https://gist.github.com/kstevens715/4598301
+
+Reported-by: Martin KaFai Lau <martin.lau@linux.dev>
+Link: https://lore.kernel.org/bpf/9c5c8b7e-1d89-a3af-5400-14fde81f4429@linux.dev/
+Fixes: 3573f384014f ("selftests/bpf: Test CGROUP_STORAGE behavior on shared egress + ingress")
+Acked-by: Stanislav Fomichev <sdf@google.com>
+Signed-off-by: YiFei Zhu <zhuyifei@google.com>
+Link: https://lore.kernel.org/r/20230405193354.1956209-1-zhuyifei@google.com
+Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/prog_tests/cg_storage_multi.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/prog_tests/cg_storage_multi.c b/tools/testing/selftests/bpf/prog_tests/cg_storage_multi.c
+index 621c572221918..63ee892bc7573 100644
+--- a/tools/testing/selftests/bpf/prog_tests/cg_storage_multi.c
++++ b/tools/testing/selftests/bpf/prog_tests/cg_storage_multi.c
+@@ -56,8 +56,9 @@ static bool assert_storage_noexist(struct bpf_map *map, const void *key)
+
+ static bool connect_send(const char *cgroup_path)
+ {
+- bool res = true;
+ int server_fd = -1, client_fd = -1;
++ char message[] = "message";
++ bool res = true;
+
+ if (join_cgroup(cgroup_path))
+ goto out_clean;
+@@ -70,7 +71,10 @@ static bool connect_send(const char *cgroup_path)
+ if (client_fd < 0)
+ goto out_clean;
+
+- if (send(client_fd, "message", strlen("message"), 0) < 0)
++ if (send(client_fd, &message, sizeof(message), 0) < 0)
++ goto out_clean;
++
++ if (read(server_fd, &message, sizeof(message)) < 0)
+ goto out_clean;
+
+ res = false;
+--
+2.39.2
+
--- /dev/null
+From c9a9d11b421b8c5c750031cb3a0b2ff8badaca7e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Mar 2023 13:34:14 +0100
+Subject: selftests/clone3: fix number of tests in ksft_set_plan
+
+From: Tobias Klauser <tklauser@distanz.ch>
+
+[ Upstream commit d95debbdc528d50042807754d6085c15abc21768 ]
+
+Commit 515bddf0ec41 ("selftests/clone3: test clone3 with CLONE_NEWTIME")
+added an additional test, so the number passed to ksft_set_plan needs to
+be bumped accordingly.
+
+Also use ksft_finished() to print results and exit. This will catch future
+mismatches between ksft_set_plan() and the number of tests being run.
+
+Fixes: 515bddf0ec41 ("selftests/clone3: test clone3 with CLONE_NEWTIME")
+Cc: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
+Reviewed-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/clone3/clone3.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/testing/selftests/clone3/clone3.c b/tools/testing/selftests/clone3/clone3.c
+index 4fce46afe6db8..e495f895a2cdd 100644
+--- a/tools/testing/selftests/clone3/clone3.c
++++ b/tools/testing/selftests/clone3/clone3.c
+@@ -129,7 +129,7 @@ int main(int argc, char *argv[])
+ uid_t uid = getuid();
+
+ ksft_print_header();
+- ksft_set_plan(17);
++ ksft_set_plan(18);
+ test_clone3_supported();
+
+ /* Just a simple clone3() should return 0.*/
+@@ -198,5 +198,5 @@ int main(int argc, char *argv[])
+ /* Do a clone3() in a new time namespace */
+ test_clone3(CLONE_NEWTIME, 0, 0, CLONE3_ARGS_NO_TEST);
+
+- return !ksft_get_fail_cnt() ? ksft_exit_pass() : ksft_exit_fail();
++ ksft_finished();
+ }
+--
+2.39.2
+
--- /dev/null
+From 7920fd2eddde4bc5682b89aaf353ebbd3362ec32 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Mar 2023 22:39:17 +0530
+Subject: selftests/powerpc/pmu: Fix sample field check in the
+ mmcra_thresh_marked_sample_test
+
+From: Kajol Jain <kjain@linux.ibm.com>
+
+[ Upstream commit 8a32341cf04ba05974931b4664683c2c9fb84e56 ]
+
+The testcase verifies the setting of different fields in Monitor Mode
+Control Register A (MMCRA). In the current code, EV_CODE_EXTRACT macro
+is used to extract the "sample" field, which then needs to be further
+processed to fetch rand_samp_elig and rand_samp_mode bits. But the
+current code is not passing valid sample field to EV_CODE_EXTRACT
+macro. Patch addresses this by fixing the input for EV_CODE_EXTRACT.
+
+Fixes: 29cf373c5766 ("selftests/powerpc/pmu: Add interface test for mmcra register fields")
+Reported-by: David Binderman <dcb314@hotmail.com>
+Link: https://lore.kernel.org/r/DB6P189MB0568CF002762C6C43AF6DF169CA89@DB6P189MB0568.EURP189.PROD.OUTLOOK.COM
+Signed-off-by: Kajol Jain <kjain@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20230301170918.69176-1-kjain@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../pmu/sampling_tests/mmcra_thresh_marked_sample_test.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/testing/selftests/powerpc/pmu/sampling_tests/mmcra_thresh_marked_sample_test.c b/tools/testing/selftests/powerpc/pmu/sampling_tests/mmcra_thresh_marked_sample_test.c
+index 022cc1655eb52..75527876ad3c1 100644
+--- a/tools/testing/selftests/powerpc/pmu/sampling_tests/mmcra_thresh_marked_sample_test.c
++++ b/tools/testing/selftests/powerpc/pmu/sampling_tests/mmcra_thresh_marked_sample_test.c
+@@ -63,9 +63,9 @@ static int mmcra_thresh_marked_sample(void)
+ get_mmcra_thd_stop(get_reg_value(intr_regs, "MMCRA"), 4));
+ FAIL_IF(EV_CODE_EXTRACT(event.attr.config, marked) !=
+ get_mmcra_marked(get_reg_value(intr_regs, "MMCRA"), 4));
+- FAIL_IF(EV_CODE_EXTRACT(event.attr.config, sample >> 2) !=
++ FAIL_IF((EV_CODE_EXTRACT(event.attr.config, sample) >> 2) !=
+ get_mmcra_rand_samp_elig(get_reg_value(intr_regs, "MMCRA"), 4));
+- FAIL_IF(EV_CODE_EXTRACT(event.attr.config, sample & 0x3) !=
++ FAIL_IF((EV_CODE_EXTRACT(event.attr.config, sample) & 0x3) !=
+ get_mmcra_sample_mode(get_reg_value(intr_regs, "MMCRA"), 4));
+ FAIL_IF(EV_CODE_EXTRACT(event.attr.config, sm) !=
+ get_mmcra_sm(get_reg_value(intr_regs, "MMCRA"), 4));
+--
+2.39.2
+
--- /dev/null
+From 9615244335c94b84da1a1b04dc6c7fcaeac802d6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Feb 2023 15:05:59 +0200
+Subject: selftests/resctrl: Allow ->setup() to return errors
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+
+[ Upstream commit fa10366cc6f4cc862871f8938426d85c2481f084 ]
+
+resctrl_val() assumes ->setup() always returns either 0 to continue
+tests or < 0 in case of the normal termination of tests after x runs.
+The latter overlaps with normal error returns.
+
+Define END_OF_TESTS (=1) to differentiate the normal termination of
+tests and return errors as negative values. Alter callers of ->setup()
+to handle errors properly.
+
+Fixes: 790bf585b0ee ("selftests/resctrl: Add Cache Allocation Technology (CAT) selftest")
+Fixes: ecdbb911f22d ("selftests/resctrl: Add MBM test")
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Reviewed-by: Reinette Chatre <reinette.chatre@intel.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/resctrl/cache.c | 4 +++-
+ tools/testing/selftests/resctrl/cat_test.c | 2 +-
+ tools/testing/selftests/resctrl/cmt_test.c | 2 +-
+ tools/testing/selftests/resctrl/mba_test.c | 2 +-
+ tools/testing/selftests/resctrl/mbm_test.c | 2 +-
+ tools/testing/selftests/resctrl/resctrl.h | 2 ++
+ tools/testing/selftests/resctrl/resctrl_val.c | 4 +++-
+ 7 files changed, 12 insertions(+), 6 deletions(-)
+
+diff --git a/tools/testing/selftests/resctrl/cache.c b/tools/testing/selftests/resctrl/cache.c
+index 68ff856d36f0b..0485863a169f2 100644
+--- a/tools/testing/selftests/resctrl/cache.c
++++ b/tools/testing/selftests/resctrl/cache.c
+@@ -244,10 +244,12 @@ int cat_val(struct resctrl_val_param *param)
+ while (1) {
+ if (!strncmp(resctrl_val, CAT_STR, sizeof(CAT_STR))) {
+ ret = param->setup(1, param);
+- if (ret) {
++ if (ret == END_OF_TESTS) {
+ ret = 0;
+ break;
+ }
++ if (ret < 0)
++ break;
+ ret = reset_enable_llc_perf(bm_pid, param->cpu_no);
+ if (ret)
+ break;
+diff --git a/tools/testing/selftests/resctrl/cat_test.c b/tools/testing/selftests/resctrl/cat_test.c
+index 1c5e90c632548..2d3c7c77ab6cb 100644
+--- a/tools/testing/selftests/resctrl/cat_test.c
++++ b/tools/testing/selftests/resctrl/cat_test.c
+@@ -40,7 +40,7 @@ static int cat_setup(int num, ...)
+
+ /* Run NUM_OF_RUNS times */
+ if (p->num_of_runs >= NUM_OF_RUNS)
+- return -1;
++ return END_OF_TESTS;
+
+ if (p->num_of_runs == 0) {
+ sprintf(schemata, "%lx", p->mask);
+diff --git a/tools/testing/selftests/resctrl/cmt_test.c b/tools/testing/selftests/resctrl/cmt_test.c
+index 8968e36db99d7..3b0454e7fc826 100644
+--- a/tools/testing/selftests/resctrl/cmt_test.c
++++ b/tools/testing/selftests/resctrl/cmt_test.c
+@@ -32,7 +32,7 @@ static int cmt_setup(int num, ...)
+
+ /* Run NUM_OF_RUNS times */
+ if (p->num_of_runs >= NUM_OF_RUNS)
+- return -1;
++ return END_OF_TESTS;
+
+ p->num_of_runs++;
+
+diff --git a/tools/testing/selftests/resctrl/mba_test.c b/tools/testing/selftests/resctrl/mba_test.c
+index 1a1bdb6180cf2..f32289ae17aeb 100644
+--- a/tools/testing/selftests/resctrl/mba_test.c
++++ b/tools/testing/selftests/resctrl/mba_test.c
+@@ -41,7 +41,7 @@ static int mba_setup(int num, ...)
+ return 0;
+
+ if (allocation < ALLOCATION_MIN || allocation > ALLOCATION_MAX)
+- return -1;
++ return END_OF_TESTS;
+
+ sprintf(allocation_str, "%d", allocation);
+
+diff --git a/tools/testing/selftests/resctrl/mbm_test.c b/tools/testing/selftests/resctrl/mbm_test.c
+index 8392e5c55ed02..280187628054d 100644
+--- a/tools/testing/selftests/resctrl/mbm_test.c
++++ b/tools/testing/selftests/resctrl/mbm_test.c
+@@ -95,7 +95,7 @@ static int mbm_setup(int num, ...)
+
+ /* Run NUM_OF_RUNS times */
+ if (num_of_runs++ >= NUM_OF_RUNS)
+- return -1;
++ return END_OF_TESTS;
+
+ va_start(param, num);
+ p = va_arg(param, struct resctrl_val_param *);
+diff --git a/tools/testing/selftests/resctrl/resctrl.h b/tools/testing/selftests/resctrl/resctrl.h
+index f0ded31fb3c7c..f44fa2de4d986 100644
+--- a/tools/testing/selftests/resctrl/resctrl.h
++++ b/tools/testing/selftests/resctrl/resctrl.h
+@@ -37,6 +37,8 @@
+ #define ARCH_INTEL 1
+ #define ARCH_AMD 2
+
++#define END_OF_TESTS 1
++
+ #define PARENT_EXIT(err_msg) \
+ do { \
+ perror(err_msg); \
+diff --git a/tools/testing/selftests/resctrl/resctrl_val.c b/tools/testing/selftests/resctrl/resctrl_val.c
+index 787546a528493..00864242d76c6 100644
+--- a/tools/testing/selftests/resctrl/resctrl_val.c
++++ b/tools/testing/selftests/resctrl/resctrl_val.c
+@@ -735,10 +735,12 @@ int resctrl_val(char **benchmark_cmd, struct resctrl_val_param *param)
+ /* Test runs until the callback setup() tells the test to stop. */
+ while (1) {
+ ret = param->setup(1, param);
+- if (ret) {
++ if (ret == END_OF_TESTS) {
+ ret = 0;
+ break;
+ }
++ if (ret < 0)
++ break;
+
+ if (!strncmp(resctrl_val, MBM_STR, sizeof(MBM_STR)) ||
+ !strncmp(resctrl_val, MBA_STR, sizeof(MBA_STR))) {
+--
+2.39.2
+
--- /dev/null
+From c3c16319f53cccd3485addcfca88e6c143b729fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Feb 2023 15:06:00 +0200
+Subject: selftests/resctrl: Check for return value after write_schemata()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+
+[ Upstream commit 0d45c83b95da414e98ad333e723141a94f6e2c64 ]
+
+MBA test case writes schemata but it does not check if the write is
+successful or not.
+
+Add the error check and return error properly.
+
+Fixes: 01fee6b4d1f9 ("selftests/resctrl: Add MBA test")
+Co-developed-by: Fenghua Yu <fenghua.yu@intel.com>
+Signed-off-by: Fenghua Yu <fenghua.yu@intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Reviewed-by: Reinette Chatre <reinette.chatre@intel.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/resctrl/mba_test.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/resctrl/mba_test.c b/tools/testing/selftests/resctrl/mba_test.c
+index f32289ae17aeb..97dc98c0c9497 100644
+--- a/tools/testing/selftests/resctrl/mba_test.c
++++ b/tools/testing/selftests/resctrl/mba_test.c
+@@ -28,6 +28,7 @@ static int mba_setup(int num, ...)
+ struct resctrl_val_param *p;
+ char allocation_str[64];
+ va_list param;
++ int ret;
+
+ va_start(param, num);
+ p = va_arg(param, struct resctrl_val_param *);
+@@ -45,7 +46,11 @@ static int mba_setup(int num, ...)
+
+ sprintf(allocation_str, "%d", allocation);
+
+- write_schemata(p->ctrlgrp, allocation_str, p->cpu_no, p->resctrl_val);
++ ret = write_schemata(p->ctrlgrp, allocation_str, p->cpu_no,
++ p->resctrl_val);
++ if (ret < 0)
++ return ret;
++
+ allocation -= ALLOCATION_STEP;
+
+ return 0;
+--
+2.39.2
+
--- /dev/null
+From 49602f95fc0477853388da60f2bb607925f763d2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Feb 2023 15:05:58 +0200
+Subject: selftests/resctrl: Move ->setup() call outside of test specific
+ branches
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+
+[ Upstream commit c90b3b588e369c20087699316259fa5ebbb16f2d ]
+
+resctrl_val() function is called only by MBM, MBA, and CMT tests which
+means the else branch is never used.
+
+Both test branches call param->setup().
+
+Remove the unused else branch and place the ->setup() call outside of
+the test specific branches reducing code duplication.
+
+Co-developed-by: Fenghua Yu <fenghua.yu@intel.com>
+Signed-off-by: Fenghua Yu <fenghua.yu@intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Reviewed-by: Reinette Chatre <reinette.chatre@intel.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Stable-dep-of: fa10366cc6f4 ("selftests/resctrl: Allow ->setup() to return errors")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/resctrl/resctrl_val.c | 19 ++++++-------------
+ 1 file changed, 6 insertions(+), 13 deletions(-)
+
+diff --git a/tools/testing/selftests/resctrl/resctrl_val.c b/tools/testing/selftests/resctrl/resctrl_val.c
+index b32b96356ec70..787546a528493 100644
+--- a/tools/testing/selftests/resctrl/resctrl_val.c
++++ b/tools/testing/selftests/resctrl/resctrl_val.c
+@@ -734,29 +734,22 @@ int resctrl_val(char **benchmark_cmd, struct resctrl_val_param *param)
+
+ /* Test runs until the callback setup() tells the test to stop. */
+ while (1) {
++ ret = param->setup(1, param);
++ if (ret) {
++ ret = 0;
++ break;
++ }
++
+ if (!strncmp(resctrl_val, MBM_STR, sizeof(MBM_STR)) ||
+ !strncmp(resctrl_val, MBA_STR, sizeof(MBA_STR))) {
+- ret = param->setup(1, param);
+- if (ret) {
+- ret = 0;
+- break;
+- }
+-
+ ret = measure_vals(param, &bw_resc_start);
+ if (ret)
+ break;
+ } else if (!strncmp(resctrl_val, CMT_STR, sizeof(CMT_STR))) {
+- ret = param->setup(1, param);
+- if (ret) {
+- ret = 0;
+- break;
+- }
+ sleep(1);
+ ret = measure_cache_vals(param, bm_pid);
+ if (ret)
+ break;
+- } else {
+- break;
+ }
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 617d88176a901d0b50517352efb2c571f4d6964c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Feb 2023 15:05:57 +0200
+Subject: selftests/resctrl: Return NULL if malloc_and_init_memory() did not
+ alloc mem
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+
+[ Upstream commit 22a8be280383812235131dda18a8212a59fadd2d ]
+
+malloc_and_init_memory() in fill_buf isn't checking if memalign()
+successfully allocated memory or not before accessing the memory.
+
+Check the return value of memalign() and return NULL if allocating
+aligned memory fails.
+
+Fixes: a2561b12fe39 ("selftests/resctrl: Add built in benchmark")
+Co-developed-by: Fenghua Yu <fenghua.yu@intel.com>
+Signed-off-by: Fenghua Yu <fenghua.yu@intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Reviewed-by: Reinette Chatre <reinette.chatre@intel.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/resctrl/fill_buf.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/tools/testing/selftests/resctrl/fill_buf.c b/tools/testing/selftests/resctrl/fill_buf.c
+index 56ccbeae0638d..c20d0a7ecbe63 100644
+--- a/tools/testing/selftests/resctrl/fill_buf.c
++++ b/tools/testing/selftests/resctrl/fill_buf.c
+@@ -68,6 +68,8 @@ static void *malloc_and_init_memory(size_t s)
+ size_t s64;
+
+ void *p = memalign(PAGE_SIZE, s);
++ if (!p)
++ return NULL;
+
+ p64 = (uint64_t *)p;
+ s64 = s / sizeof(uint64_t);
+--
+2.39.2
+
--- /dev/null
+From 170e2826400de742be6850face1621a724d27bc1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Apr 2023 14:03:59 +0200
+Subject: selftests: xsk: Deflakify STATS_RX_DROPPED test
+
+From: Kal Conley <kal.conley@dectris.com>
+
+[ Upstream commit 68e7322142f5e731af222892d384d311835db0f1 ]
+
+Fix flaky STATS_RX_DROPPED test. The receiver calls getsockopt after
+receiving the last (valid) packet which is not the final packet sent in
+the test (valid and invalid packets are sent in alternating fashion with
+the final packet being invalid). Since the last packet may or may not
+have been dropped already, both outcomes must be allowed.
+
+This issue could also be fixed by making sure the last packet sent is
+valid. This alternative is left as an exercise to the reader (or the
+benevolent maintainers of this file).
+
+This problem was quite visible on certain setups. On one machine this
+failure was observed 50% of the time.
+
+Also, remove a redundant assignment of pkt_stream->nb_pkts. This field
+is already initialized by __pkt_stream_alloc.
+
+Fixes: 27e934bec35b ("selftests: xsk: make stat tests not spin on getsockopt")
+Signed-off-by: Kal Conley <kal.conley@dectris.com>
+Acked-by: Magnus Karlsson <magnus.karlsson@intel.com>
+Link: https://lore.kernel.org/r/20230403120400.31018-1-kal.conley@dectris.com
+Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/xskxceiver.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/xskxceiver.c b/tools/testing/selftests/bpf/xskxceiver.c
+index 5f1471f84d4bb..b6910df710d1e 100644
+--- a/tools/testing/selftests/bpf/xskxceiver.c
++++ b/tools/testing/selftests/bpf/xskxceiver.c
+@@ -631,7 +631,6 @@ static struct pkt_stream *pkt_stream_generate(struct xsk_umem_info *umem, u32 nb
+ if (!pkt_stream)
+ exit_with_error(ENOMEM);
+
+- pkt_stream->nb_pkts = nb_pkts;
+ for (i = 0; i < nb_pkts; i++) {
+ pkt_set(umem, &pkt_stream->pkts[i], (i % umem->num_frames) * umem->frame_size,
+ pkt_len);
+@@ -1124,7 +1123,14 @@ static int validate_rx_dropped(struct ifobject *ifobject)
+ if (err)
+ return TEST_FAILURE;
+
+- if (stats.rx_dropped == ifobject->pkt_stream->nb_pkts / 2)
++ /* The receiver calls getsockopt after receiving the last (valid)
++ * packet which is not the final packet sent in this test (valid and
++ * invalid packets are sent in alternating fashion with the final
++ * packet being invalid). Since the last packet may or may not have
++ * been dropped already, both outcomes must be allowed.
++ */
++ if (stats.rx_dropped == ifobject->pkt_stream->nb_pkts / 2 ||
++ stats.rx_dropped == ifobject->pkt_stream->nb_pkts / 2 - 1)
+ return TEST_PASS;
+
+ return TEST_FAILURE;
+--
+2.39.2
+
--- /dev/null
+From 8b8f4a317964b87fe5eafa66bdb6460db2cb1fc4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Apr 2023 10:29:04 +0200
+Subject: selftests: xsk: Disable IPv6 on VETH1
+
+From: Kal Conley <kal.conley@dectris.com>
+
+[ Upstream commit f2b50f17268390567bc0e95642170d88f336c8f4 ]
+
+This change fixes flakiness in the BIDIRECTIONAL test:
+
+ # [is_pkt_valid] expected length [60], got length [90]
+ not ok 1 FAIL: SKB BUSY-POLL BIDIRECTIONAL
+
+When IPv6 is enabled, the interface will periodically send MLDv1 and
+MLDv2 packets. These packets can cause the BIDIRECTIONAL test to fail
+since it uses VETH0 for RX.
+
+For other tests, this was not a problem since they only receive on VETH1
+and IPv6 was already disabled on VETH0.
+
+Fixes: a89052572ebb ("selftests/bpf: Xsk selftests framework")
+Signed-off-by: Kal Conley <kal.conley@dectris.com>
+Link: https://lore.kernel.org/r/20230405082905.6303-1-kal.conley@dectris.com
+Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/test_xsk.sh | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/testing/selftests/bpf/test_xsk.sh b/tools/testing/selftests/bpf/test_xsk.sh
+index b077cf58f8258..377fb157a57c5 100755
+--- a/tools/testing/selftests/bpf/test_xsk.sh
++++ b/tools/testing/selftests/bpf/test_xsk.sh
+@@ -116,6 +116,7 @@ setup_vethPairs() {
+ ip link add ${VETH0} numtxqueues 4 numrxqueues 4 type veth peer name ${VETH1} numtxqueues 4 numrxqueues 4
+ if [ -f /proc/net/if_inet6 ]; then
+ echo 1 > /proc/sys/net/ipv6/conf/${VETH0}/disable_ipv6
++ echo 1 > /proc/sys/net/ipv6/conf/${VETH1}/disable_ipv6
+ fi
+ if [[ $verbose -eq 1 ]]; then
+ echo "setting up ${VETH1}"
+--
+2.39.2
+
--- /dev/null
+From d8c21afb778a430503ceb90701220518bd714a8e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Apr 2023 16:50:46 +0200
+Subject: selftests: xsk: Use correct UMEM size in testapp_invalid_desc
+
+From: Kal Conley <kal.conley@dectris.com>
+
+[ Upstream commit 7a2050df244e2c9a4e90882052b7907450ad10ed ]
+
+Avoid UMEM_SIZE macro in testapp_invalid_desc which is incorrect when
+the frame size is not XSK_UMEM__DEFAULT_FRAME_SIZE. Also remove the
+macro since it's no longer being used.
+
+Fixes: 909f0e28207c ("selftests: xsk: Add tests for 2K frame size")
+Signed-off-by: Kal Conley <kal.conley@dectris.com>
+Acked-by: Magnus Karlsson <magnus.karlsson@intel.com>
+Link: https://lore.kernel.org/r/20230403145047.33065-2-kal.conley@dectris.com
+Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/xskxceiver.c | 9 +++++----
+ tools/testing/selftests/bpf/xskxceiver.h | 1 -
+ 2 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/xskxceiver.c b/tools/testing/selftests/bpf/xskxceiver.c
+index a17655107a94c..5f1471f84d4bb 100644
+--- a/tools/testing/selftests/bpf/xskxceiver.c
++++ b/tools/testing/selftests/bpf/xskxceiver.c
+@@ -1635,6 +1635,7 @@ static void testapp_single_pkt(struct test_spec *test)
+
+ static void testapp_invalid_desc(struct test_spec *test)
+ {
++ u64 umem_size = test->ifobj_tx->umem->num_frames * test->ifobj_tx->umem->frame_size;
+ struct pkt pkts[] = {
+ /* Zero packet address allowed */
+ {0, PKT_SIZE, 0, true},
+@@ -1645,9 +1646,9 @@ static void testapp_invalid_desc(struct test_spec *test)
+ /* Packet too large */
+ {0x2000, XSK_UMEM__INVALID_FRAME_SIZE, 0, false},
+ /* After umem ends */
+- {UMEM_SIZE, PKT_SIZE, 0, false},
++ {umem_size, PKT_SIZE, 0, false},
+ /* Straddle the end of umem */
+- {UMEM_SIZE - PKT_SIZE / 2, PKT_SIZE, 0, false},
++ {umem_size - PKT_SIZE / 2, PKT_SIZE, 0, false},
+ /* Straddle a page boundrary */
+ {0x3000 - PKT_SIZE / 2, PKT_SIZE, 0, false},
+ /* Straddle a 2K boundrary */
+@@ -1665,8 +1666,8 @@ static void testapp_invalid_desc(struct test_spec *test)
+ }
+
+ if (test->ifobj_tx->shared_umem) {
+- pkts[4].addr += UMEM_SIZE;
+- pkts[5].addr += UMEM_SIZE;
++ pkts[4].addr += umem_size;
++ pkts[5].addr += umem_size;
+ }
+
+ pkt_stream_generate_custom(test, pkts, ARRAY_SIZE(pkts));
+diff --git a/tools/testing/selftests/bpf/xskxceiver.h b/tools/testing/selftests/bpf/xskxceiver.h
+index 3e8ec7d8ec32a..03ed33a279774 100644
+--- a/tools/testing/selftests/bpf/xskxceiver.h
++++ b/tools/testing/selftests/bpf/xskxceiver.h
+@@ -53,7 +53,6 @@
+ #define THREAD_TMOUT 3
+ #define DEFAULT_PKT_CNT (4 * 1024)
+ #define DEFAULT_UMEM_BUFFERS (DEFAULT_PKT_CNT / 4)
+-#define UMEM_SIZE (DEFAULT_UMEM_BUFFERS * XSK_UMEM__DEFAULT_FRAME_SIZE)
+ #define RX_FULL_RXQSIZE 32
+ #define UMEM_HEADROOM_TEST_SIZE 128
+ #define XSK_UMEM__INVALID_FRAME_SIZE (XSK_UMEM__DEFAULT_FRAME_SIZE + 1)
+--
+2.39.2
+
--- /dev/null
+From 99136eb37da8ddd0447595846172f89d549854b5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Apr 2023 13:29:11 -0400
+Subject: selinux: ensure av_permissions.h is built when needed
+
+From: Paul Moore <paul@paul-moore.com>
+
+[ Upstream commit 4ce1f694eb5d8ca607fed8542d32a33b4f1217a5 ]
+
+The Makefile rule responsible for building flask.h and
+av_permissions.h only lists flask.h as a target which means that
+av_permissions.h is only generated when flask.h needs to be
+generated. This patch fixes this by adding av_permissions.h as a
+target to the rule.
+
+Fixes: 8753f6bec352 ("selinux: generate flask headers during kernel build")
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/selinux/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/security/selinux/Makefile b/security/selinux/Makefile
+index 103c2776478a7..0aecf9334ec31 100644
+--- a/security/selinux/Makefile
++++ b/security/selinux/Makefile
+@@ -26,5 +26,5 @@ quiet_cmd_flask = GEN $(obj)/flask.h $(obj)/av_permissions.h
+ cmd_flask = $< $(obj)/flask.h $(obj)/av_permissions.h
+
+ targets += flask.h av_permissions.h
+-$(obj)/flask.h: scripts/selinux/genheaders/genheaders FORCE
++$(obj)/flask.h $(obj)/av_permissions.h &: scripts/selinux/genheaders/genheaders FORCE
+ $(call if_changed,flask)
+--
+2.39.2
+
--- /dev/null
+From 63a03ea4c89ea56803d4c9fb2939f832623dd673 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Apr 2023 15:59:19 +0200
+Subject: selinux: fix Makefile dependencies of flask.h
+
+From: Ondrej Mosnacek <omosnace@redhat.com>
+
+[ Upstream commit bcab1adeaad4b39a1e04cb98979a367d08253f03 ]
+
+Make the flask.h target depend on the genheaders binary instead of
+classmap.h to ensure that it is rebuilt if any of the dependencies of
+genheaders are changed.
+
+Notably this fixes flask.h not being rebuilt when
+initial_sid_to_string.h is modified.
+
+Fixes: 8753f6bec352 ("selinux: generate flask headers during kernel build")
+Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
+Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/selinux/Makefile | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/security/selinux/Makefile b/security/selinux/Makefile
+index 7761624448826..103c2776478a7 100644
+--- a/security/selinux/Makefile
++++ b/security/selinux/Makefile
+@@ -23,8 +23,8 @@ ccflags-y := -I$(srctree)/security/selinux -I$(srctree)/security/selinux/include
+ $(addprefix $(obj)/,$(selinux-y)): $(obj)/flask.h
+
+ quiet_cmd_flask = GEN $(obj)/flask.h $(obj)/av_permissions.h
+- cmd_flask = scripts/selinux/genheaders/genheaders $(obj)/flask.h $(obj)/av_permissions.h
++ cmd_flask = $< $(obj)/flask.h $(obj)/av_permissions.h
+
+ targets += flask.h av_permissions.h
+-$(obj)/flask.h: $(src)/include/classmap.h FORCE
++$(obj)/flask.h: scripts/selinux/genheaders/genheaders FORCE
+ $(call if_changed,flask)
+--
+2.39.2
+
--- /dev/null
+From 351f4e3e1621b4a931970868b0c7eed5872e1ff7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Apr 2023 10:02:39 -0700
+Subject: serial: 8250: Add missing wakeup event reporting
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit 0ba9e3a13c6adfa99e32b2576d20820ab10ad48a ]
+
+An 8250 UART configured as a wake-up source would not have reported
+itself through sysfs as being the source of wake-up, correct that.
+
+Fixes: b3b708fa2780 ("wake up from a serial port")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Link: https://lore.kernel.org/r/20230414170241.2016255-1-f.fainelli@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/8250/8250_port.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c
+index dfbc501cf9d15..fe8d79c4ae95e 100644
+--- a/drivers/tty/serial/8250/8250_port.c
++++ b/drivers/tty/serial/8250/8250_port.c
+@@ -15,6 +15,7 @@
+ #include <linux/moduleparam.h>
+ #include <linux/ioport.h>
+ #include <linux/init.h>
++#include <linux/irq.h>
+ #include <linux/console.h>
+ #include <linux/gpio/consumer.h>
+ #include <linux/sysrq.h>
+@@ -1932,6 +1933,7 @@ static bool handle_rx_dma(struct uart_8250_port *up, unsigned int iir)
+ int serial8250_handle_irq(struct uart_port *port, unsigned int iir)
+ {
+ struct uart_8250_port *up = up_to_u8250p(port);
++ struct tty_port *tport = &port->state->port;
+ bool skip_rx = false;
+ unsigned long flags;
+ u16 status;
+@@ -1957,6 +1959,8 @@ int serial8250_handle_irq(struct uart_port *port, unsigned int iir)
+ skip_rx = true;
+
+ if (status & (UART_LSR_DR | UART_LSR_BI) && !skip_rx) {
++ if (irqd_is_wakeup_set(irq_get_irq_data(port->irq)))
++ pm_wakeup_event(tport->tty->dev, 0);
+ if (!up->dma || handle_rx_dma(up, iir))
+ status = serial8250_rx_chars(up, status);
+ }
+--
+2.39.2
+
--- /dev/null
+From 7e2eed57897fe05d05b9d0f04cad372b36c62415 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Mar 2023 11:02:24 -0800
+Subject: serial: 8250_bcm7271: Fix arbitration handling
+
+From: Doug Berger <opendmb@gmail.com>
+
+[ Upstream commit 15ac1122fd6d4bf408a03e6f23c7ad4f60b22f9e ]
+
+The arbitration of the UART DMA is mishandled for a few
+exceptional cases when probing and releasing the driver.
+
+It is possible that the DMA register spaces are not defined in
+device tree for an instance of the driver, so attempts to access
+the registers in brcmuart_arbitration() would use NULL pointers.
+
+It is also possible for the probe function to return an error
+while still holding the UART DMA. This would prevent the UART
+DMA from being claimed by an instance that could use it.
+
+These errors are addressed by only releasing the UART DMA if it
+is held by this instance (i.e. priv->dma_enabled == 1) and
+directing early error paths in probe to this common release_dma
+handling.
+
+Fixes: 41a469482de2 ("serial: 8250: Add new 8250-core based Broadcom STB driver")
+Signed-off-by: Doug Berger <opendmb@gmail.com>
+Acked-by: Florian Fainelli <f.fainelli@gmail.com>
+Link: https://lore.kernel.org/r/20230309190224.687380-1-opendmb@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/8250/8250_bcm7271.c | 18 ++++++++++++------
+ 1 file changed, 12 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/tty/serial/8250/8250_bcm7271.c b/drivers/tty/serial/8250/8250_bcm7271.c
+index ed5a947476920..f801b1f5b46c0 100644
+--- a/drivers/tty/serial/8250/8250_bcm7271.c
++++ b/drivers/tty/serial/8250/8250_bcm7271.c
+@@ -1014,14 +1014,16 @@ static int brcmuart_probe(struct platform_device *pdev)
+ /* See if a Baud clock has been specified */
+ baud_mux_clk = of_clk_get_by_name(np, "sw_baud");
+ if (IS_ERR(baud_mux_clk)) {
+- if (PTR_ERR(baud_mux_clk) == -EPROBE_DEFER)
+- return -EPROBE_DEFER;
++ if (PTR_ERR(baud_mux_clk) == -EPROBE_DEFER) {
++ ret = -EPROBE_DEFER;
++ goto release_dma;
++ }
+ dev_dbg(dev, "BAUD MUX clock not specified\n");
+ } else {
+ dev_dbg(dev, "BAUD MUX clock found\n");
+ ret = clk_prepare_enable(baud_mux_clk);
+ if (ret)
+- return ret;
++ goto release_dma;
+ priv->baud_mux_clk = baud_mux_clk;
+ init_real_clk_rates(dev, priv);
+ clk_rate = priv->default_mux_rate;
+@@ -1029,7 +1031,8 @@ static int brcmuart_probe(struct platform_device *pdev)
+
+ if (clk_rate == 0) {
+ dev_err(dev, "clock-frequency or clk not defined\n");
+- return -EINVAL;
++ ret = -EINVAL;
++ goto release_dma;
+ }
+
+ dev_dbg(dev, "DMA is %senabled\n", priv->dma_enabled ? "" : "not ");
+@@ -1116,7 +1119,9 @@ static int brcmuart_probe(struct platform_device *pdev)
+ serial8250_unregister_port(priv->line);
+ err:
+ brcmuart_free_bufs(dev, priv);
+- brcmuart_arbitration(priv, 0);
++release_dma:
++ if (priv->dma_enabled)
++ brcmuart_arbitration(priv, 0);
+ return ret;
+ }
+
+@@ -1128,7 +1133,8 @@ static int brcmuart_remove(struct platform_device *pdev)
+ hrtimer_cancel(&priv->hrt);
+ serial8250_unregister_port(priv->line);
+ brcmuart_free_bufs(&pdev->dev, priv);
+- brcmuart_arbitration(priv, 0);
++ if (priv->dma_enabled)
++ brcmuart_arbitration(priv, 0);
+ return 0;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From f4a972cb265182e1f7587627db871b147679d416 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Feb 2023 05:22:52 +0100
+Subject: serial: stm32: Re-assert RTS/DE GPIO in RS485 mode only if more data
+ are transmitted
+
+From: Marek Vasut <marex@denx.de>
+
+[ Upstream commit c47527cbcc3c50800f34b8c684f29721f75de246 ]
+
+The stm32_usart_transmit_chars() may be called with empty or stopped
+transmit queue, and no XON/OFF character pending. This can happen at
+the end of transmission, where this last call is used to either handle
+the XON/XOFF x_char, or disable TX interrupt if queue is empty or
+stopped.
+
+If that occurs, do not assert the RS485 RTS/DE GPIO anymore, as the
+GPIO would remain asserted past the end of transmission and that would
+block the RS485 bus after the transmission.
+
+Only assert the RS485 RTS/DE GPIO if there is either pending XON/XOFF
+x_char, or at least one character in running transmit queue.
+
+Fixes: d7c76716169d ("serial: stm32: Use TC interrupt to deassert GPIO RTS in RS485 mode")
+Signed-off-by: Marek Vasut <marex@denx.de>
+Link: https://lore.kernel.org/r/20230223042252.95480-2-marex@denx.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/stm32-usart.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c
+index 767ff9fdb2e58..84700016932d6 100644
+--- a/drivers/tty/serial/stm32-usart.c
++++ b/drivers/tty/serial/stm32-usart.c
+@@ -693,8 +693,9 @@ static void stm32_usart_transmit_chars(struct uart_port *port)
+ int ret;
+
+ if (!stm32_port->hw_flow_control &&
+- port->rs485.flags & SER_RS485_ENABLED) {
+- stm32_port->txdone = false;
++ port->rs485.flags & SER_RS485_ENABLED &&
++ (port->x_char ||
++ !(uart_circ_empty(xmit) || uart_tx_stopped(port)))) {
+ stm32_usart_tc_interrupt_disable(port);
+ stm32_usart_rs485_rts_enable(port);
+ }
+--
+2.39.2
+
bus-mhi-host-use-mhi_tryset_pm_state-for-setting-fw-error-state.patch
bus-mhi-host-range-check-chdboff-and-erdboff.patch
asoc-dt-bindings-qcom-lpass-rx-macro-correct-minitems-for-clocks.patch
+kunit-fix-bug-in-the-order-of-lines-in-debugfs-logs.patch
+rcu-fix-missing-tick_dep_mask_rcu_exp-dependency-che.patch
+selftests-resctrl-return-null-if-malloc_and_init_mem.patch
+selftests-resctrl-move-setup-call-outside-of-test-sp.patch
+selftests-resctrl-allow-setup-to-return-errors.patch
+selftests-resctrl-check-for-return-value-after-write.patch
+arm-9292-1-vfp-pass-thread_info-pointer-to-vfp_suppo.patch
+arm-9293-1-vfp-pass-successful-return-address-via-re.patch
+arm-9294-2-vfp-fix-broken-softirq-handling-with-inst.patch
+selinux-fix-makefile-dependencies-of-flask.h.patch
+selinux-ensure-av_permissions.h-is-built-when-needed.patch
+tpm-tpm_tis-do-not-skip-reset-of-original-interrupt-.patch
+tpm-tpm_tis-claim-locality-before-writing-tpm_int_en.patch
+tpm-tpm_tis-disable-interrupts-if-tpm_tis_probe_irq-.patch
+tpm-tpm_tis-claim-locality-before-writing-interrupt-.patch
+tpm-tpm-implement-usage-counter-for-locality.patch
+tpm-tpm_tis-claim-locality-when-interrupts-are-reena.patch
+selftests-clone3-fix-number-of-tests-in-ksft_set_pla.patch
+erofs-stop-parsing-non-compact-head-index-if-cluster.patch
+erofs-initialize-packed-inode-after-root-inode-is-as.patch
+erofs-fix-potential-overflow-calculating-xattr_isize.patch
+accel-ivpu-pm-remove-broken-ivpu_dbg-statements.patch
+drm-rockchip-drop-unbalanced-obj-unref.patch
+drm-i915-hwmon-enable-pl1-power-limit.patch
+drm-i915-dg2-drop-one-pci-id.patch
+drm-vgem-add-missing-mutex_destroy.patch
+drm-probe-helper-cancel-previous-job-before-starting.patch
+arm64-dts-amlogic-meson-g12b-radxa-zero2-fix-pwm-clo.patch
+drm-amdgpu-register-a-vga_switcheroo-client-for-macb.patch
+tools-x86-kcpuid-fix-avx512bw-and-avx512lvl-fields-i.patch
+soc-ti-k3-ringacc-add-try_module_get-to-k3_dmaring_r.patch
+soc-ti-pm33xx-fix-refcount-leak-in-am33xx_pm_probe.patch
+arm64-dts-renesas-r8a77990-remove-bogus-voltages-fro.patch
+arm64-dts-renesas-r8a774c0-remove-bogus-voltages-fro.patch
+arm64-dts-renesas-r9a07g044-update-irq-numbers-for-s.patch
+arm64-dts-renesas-r9a07g054-update-irq-numbers-for-s.patch
+arm64-dts-renesas-r9a07g043-update-irq-numbers-for-s.patch
+drm-mediatek-dp-only-trigger-drm-hpd-events-if-bridg.patch
+drm-msm-disp-dpu-check-for-crtc-enable-rather-than-c.patch
+edac-skx-fix-overflows-on-the-dram-row-address-mappi.patch
+arm-dts-qcom-apq8064-fix-opp-table-child-name.patch
+arm64-dts-imx8mp-drop-simple-bus-from-fsl-imx8mp-med.patch
+regulator-core-shorten-off-on-delay-us-for-always-on.patch
+arm64-dts-ti-k3-am62-main-fix-gpio-numbers-in-dt.patch
+arm64-dts-ti-k3-am62a7-sk-fix-ddr-size-to-full-4gb.patch
+arm64-dts-ti-k3-j721e-main-remove-ti-strobe-sel-prop.patch
+arm64-dts-ti-k3-j784s4-add-ti-sci-dev-id-for-navss-n.patch
+arm64-dts-broadcom-bcmbca-bcm4908-fix-nand-interrupt.patch
+arm64-dts-broadcom-bcmbca-bcm4908-fix-led-nodenames.patch
+arm64-dts-broadcom-bcmbca-bcm4908-fix-procmon-nodena.patch
+arm64-dts-qcom-sm8550-fix-pcie-phys-and-controllers-.patch
+arm64-dts-qcom-msm8998-fix-stm-stimulus-base-reg-nam.patch
+soc-canaan-make-k210_sysctl-depend-on-clk_k210.patch
+arm64-dts-qcom-qdu1000-drop-incorrect-serial-propert.patch
+arm64-dts-qcom-sc7280-fix-eud-port-properties.patch
+arm64-dts-qcom-sdm845-correct-dynamic-power-coeffici.patch
+arm64-dts-qcom-sdm845-fix-the-pci-i-o-port-range.patch
+arm64-dts-qcom-msm8998-fix-the-pci-i-o-port-range.patch
+arm64-dts-qcom-sc7280-fix-the-pci-i-o-port-range.patch
+arm64-dts-qcom-sm8550-fix-the-pci-i-o-port-range.patch
+arm64-dts-qcom-ipq8074-fix-the-pci-i-o-port-range.patch
+arm64-dts-qcom-ipq6018-fix-the-pci-i-o-port-range.patch
+arm64-dts-qcom-msm8996-fix-the-pci-i-o-port-range.patch
+arm64-dts-qcom-sm8250-fix-the-pci-i-o-port-range.patch
+arm64-dts-qcom-sc8280xp-fix-the-pci-i-o-port-range.patch
+arm64-dts-qcom-sm8150-fix-the-pci-i-o-port-range.patch
+arm64-dts-qcom-sm8450-fix-the-pci-i-o-port-range.patch
+arm64-dts-qcom-sm8350-fix-the-pci-i-o-port-range.patch
+arm-dts-qcom-ipq4019-fix-the-pci-i-o-port-range.patch
+arm-dts-qcom-ipq8064-fix-the-pci-i-o-port-range.patch
+arm64-dts-qcom-msm8976-add-and-provide-xo-clk-to-rpm.patch
+arm-dts-qcom-sdx55-fix-the-unit-address-of-pcie-ep-n.patch
+arm64-dts-qcom-sm8550-fix-qup_spi0_cs-node.patch
+arm64-dts-qcom-sm8550-misc-style-fixes.patch
+arm64-dts-qcom-msm8916-fix-tsens_mode-unit-address.patch
+arm64-dts-qcom-sc8280xp-fix-external-display-power-d.patch
+media-v4l-subdev-make-link-validation-safer.patch
+x86-mce-amd-use-an-u64-for-bank_map.patch
+media-bdisp-add-missing-check-for-create_workqueue.patch
+media-platform-mtk-mdp3-add-missing-check-and-free-f.patch
+media-amphion-decoder-implement-display-delay-enable.patch
+media-av7110-prevent-underflow-in-write_ts_to_decode.patch
+firmware-qcom_scm-clear-download-bit-during-reboot.patch
+drm-bridge-adv7533-fix-adv7533_mode_valid-for-adv753.patch
+media-max9286-free-control-handler.patch
+accel-link-to-compute-accelerator-subsystem-intro.patch
+arm64-dts-ti-k3-am625-correct-l2-cache-size-to-512kb.patch
+arm64-dts-ti-k3-am62a7-correct-l2-cache-size-to-512k.patch
+acpi-utils-fix-acpi_evaluate_dsm_typed-redefinition-.patch
+drm-msm-adreno-drop-bogus-pm_runtime_set_active.patch
+drm-msm-adreno-disable-preemption-on-adreno-510.patch
+virt-coco-sev-guest-double-buffer-messages.patch
+arm64-dts-qcom-sm8250-xiaomi-elish-fix-usb-maximum-s.patch
+arm64-dts-qcom-sm8350-microsoft-surface-fix-usb-dual.patch
+drm-amd-display-dc-dce60-makefile-fix-previous-attem.patch
+acpi-processor-fix-evaluating-_pdc-method-when-runni.patch
+mmc-sdhci-of-esdhc-fix-quirk-to-ignore-command-inhib.patch
+arm64-dts-qcom-sm8450-fix-pcie1-gpios-properties-nam.patch
+drm-rcar-du-fix-a-null-vs-is_err-bug.patch
+arm-dts-gta04-fix-excess-dma-channel-usage.patch
+firmware-arm_scmi-fix-xfers-allocation-on-rx-channel.patch
+perf-arm-cmn-move-overlapping-wp_combine-field.patch
+perf-amlogic-fix-config1-config2-parsing-issue.patch
+arm-dts-stm32-fix-spi1-pin-assignment-on-stm32mp15.patch
+arm64-dts-apple-t8103-disable-unused-pcie-ports.patch
+cpufreq-mediatek-fix-passing-zero-to-ptr_err.patch
+cpufreq-mediatek-fix-kp-caused-by-handler-usage-afte.patch
+cpufreq-mediatek-raise-proc-sram-max-voltage-for-mt8.patch
+cpufreq-mediatek-raise-proc-and-sram-max-voltage-for.patch
+cpufreq-qcom-cpufreq-hw-revert-adding-cpufreq-qos.patch
+arm64-dts-mediatek-mt8192-asurada-fix-voltage-constr.patch
+arm64-dts-ti-k3-am625-sk-add-ti-vbus-divider-propert.patch
+acpi-viot-initialize-the-correct-iommu-fwspec.patch
+drm-lima-lima_drv-add-missing-unwind-goto-in-lima_pd.patch
+drm-mediatek-dp-change-the-aux-retries-times-when-re.patch
+mailbox-mpfs-switch-to-txdone_poll.patch
+soc-bcm-brcmstb-biuctrl-fix-of_iomap-leak.patch
+soc-renesas-renesas-soc-release-chipid-from-ioremap.patch
+gpu-host1x-fix-potential-double-free-if-iommu-is-dis.patch
+gpu-host1x-fix-memory-leak-of-device-names.patch
+arm64-dts-qcom-sc7280-herobrine-villager-correct-tra.patch
+arm64-dts-qcom-sc7180-trogdor-lazor-correct-trackpad.patch
+arm64-dts-qcom-sc7180-trogdor-pazquel-correct-trackp.patch
+arm64-dts-qcom-msm8998-oneplus-cheeseburger-revert-f.patch
+arm64-dts-qcom-msm8994-kitakami-drop-unit-address-fr.patch
+arm64-dts-qcom-msm8994-msft-lumia-octagon-drop-unit-.patch
+arm64-dts-qcom-apq8096-db820c-drop-unit-address-from.patch
+arm64-dts-qcom-sc8280xp-correct-soundwire-wakeup-int.patch
+drm-i915-pxp-invalidate-all-pxp-fw-sessions-during-t.patch
+drm-i915-pxp-limit-drm-errors-or-warning-on-firmware.patch
+arm64-dts-rockchip-assign-pll_ppll-clock-rate-to-1.1.patch
+drm-ttm-pool-fix-ttm_pool_alloc-error-path.patch
+regulator-core-consistently-set-mutex_owner-when-usi.patch
+regulator-core-avoid-lockdep-reports-when-resolving-.patch
+revert-drm-msm-add-missing-check-and-destroy-for-all.patch
+revert-drm-msm-fix-failure-paths-in-msm_drm_init.patch
+drm-msm-dpu-fix-bit-shifting-ub-in-dpu_hw_ver-macro.patch
+thermal-drivers-mediatek-lvts_thermal-fix-sensor-1-i.patch
+x86-apic-fix-atomic-update-of-offset-in-reserve_eilv.patch
+soc-qcom-rpmh-rsc-support-rsc-v3-minor-versions.patch
+arm64-dts-qcom-msm8994-angler-fix-cont_splash_mem-ma.patch
+arm64-dts-qcom-msm8994-angler-removed-clash-with-sme.patch
+arm64-dts-sc7180-rename-qspi-data12-as-data23.patch
+arm64-dts-sc7280-rename-qspi-data12-as-data23.patch
+arm64-dts-sdm845-rename-qspi-data12-as-data23.patch
+media-mtk-jpeg-fixes-jpeghw-multi-core-judgement.patch
+media-mtk-jpeg-fixes-jpeg-enc-dec-worker-sw-flow.patch
+media-mediatek-vcodec-use-4k-frame-size-when-support.patch
+media-mediatek-vcodec-make-mm21-the-default-capture-.patch
+media-mediatek-vcodec-force-capture-queue-format-to-.patch
+media-mediatek-vcodec-add-params-to-record-lat-and-c.patch
+media-mediatek-vcodec-using-each-instance-lat_buf-co.patch
+media-mediatek-vcodec-move-lat_buf-to-the-top-of-cor.patch
+media-mediatek-vcodec-add-core-decode-done-event.patch
+media-mediatek-vcodec-remove-unused-lat_buf.patch
+media-mediatek-vcodec-making-sure-queue_work-success.patch
+media-mediatek-vcodec-change-lat-thread-decode-error.patch
+media-cedrus-fix-use-after-free-bug-in-cedrus_remove.patch
+media-rkvdec-fix-use-after-free-bug-in-rkvdec_remove.patch
+platform-x86-amd-pmf-move-out-of-bios-smn-pair-for-d.patch
+platform-x86-amd-pmc-don-t-try-to-read-smu-version-o.patch
+platform-x86-amd-pmc-hide-smu-version-and-program-at.patch
+platform-x86-amd-pmc-don-t-dump-data-after-resume-fr.patch
+platform-x86-amd-pmc-move-idlemask-check-into-amd_pm.patch
+platform-x86-amd-pmc-utilize-smn-index-0-for-driver-.patch
+platform-x86-amd-pmc-move-out-of-bios-smn-pair-for-s.patch
+media-dm1105-fix-use-after-free-bug-in-dm1105_remove.patch
+media-saa7134-fix-use-after-free-bug-in-saa7134_fini.patch
+media-platform-mtk-mdp3-fix-potential-frame-size-ove.patch
+media-vsp1-replace-vb2_is_streaming-with-vb2_start_s.patch
+media-rcar_fdp1-convert-to-platform-remove-callback-.patch
+media-rcar_fdp1-fix-refcount-leak-in-probe-and-remov.patch
+media-v4l-async-return-async-sub-devices-to-subnotif.patch
+media-hi846-fix-memleak-in-hi846_init_controls.patch
+drm-amd-display-fix-potential-null-dereference.patch
+media-rc-gpio-ir-recv-fix-support-for-wake-up.patch
+media-venus-dec-fix-handling-of-the-start-cmd.patch
+media-venus-dec-fix-capture-formats-enumeration-orde.patch
+regulator-stm32-pwr-fix-of_iomap-leak.patch
+x86-ioapic-don-t-return-0-from-arch_dynirq_lower_bou.patch
+arm64-kgdb-set-pstate.ss-to-1-to-re-enable-single-st.patch
+perf-arm-cmn-fix-port-detection-for-cmn-700.patch
+media-mediatek-vcodec-fix-decoder-disable-pm-crash.patch
+media-mediatek-vcodec-add-remove-function-for-decode.patch
+debugobject-prevent-init-race-with-static-objects.patch
+drm-i915-make-intel_get_crtc_new_encoder-less-oopsy.patch
+drm-i915-fix-memory-leaks-in-i915-selftests.patch
+tick-common-align-tick-period-with-the-hz-tick.patch
+acpi-bus-ensure-that-notify-handlers-are-not-running.patch
+cpufreq-use-correct-unit-when-verify-cur-freq.patch
+rpmsg-glink-propagate-tx-failures-in-intentless-mode.patch
+hwmon-pmbus-fsp-3y-fix-functionality-bitmask-in-fsp-.patch
+platform-chrome-cros_typec_switch-add-missing-fwnode.patch
+media-ov5670-fix-probe-on-acpi.patch
+wifi-ath6kl-minor-fix-for-allocation-size.patch
+wifi-ath12k-use-kfree_skb-instead-of-kfree.patch
+wifi-ath11k-fix-return-value-check-in-ath11k_ahb_pro.patch
+wifi-ath9k-hif_usb-fix-memory-leak-of-remain_skbs.patch
+wifi-ath11k-use-platform_get_irq-to-get-the-interrup.patch
+wifi-ath5k-use-platform_get_irq-to-get-the-interrupt.patch
+wifi-ath5k-fix-an-off-by-one-check-in-ath5k_eeprom_r.patch
+wifi-ath11k-fix-sac-bug-on-peer-addition-with-sta-ba.patch
+wifi-rtl8xxxu-remove-always-true-condition-in-rtl8xx.patch
+wifi-brcmfmac-support-cqm-rssi-notification-with-old.patch
+wifi-ath6kl-reduce-warn-to-dev_dbg-in-callback.patch
+tools-bpftool-remove-invalid-json-escape.patch
+libbpf-fix-arm-syscall-regs-spec-in-bpf_tracing.h.patch
+libbpf-fix-bpf_xdp_query-in-old-kernels.patch
+wifi-rtw88-mac-return-the-original-error-from-rtw_pw.patch
+wifi-rtw88-mac-return-the-original-error-from-rtw_ma.patch
+selftests-bpf-fix-ima-test.patch
+selftests-bpf-move-sys-macro-into-the-test_progs.h.patch
+selftests-bpf-fix-flaky-fib_lookup-test.patch
+bpf-take-into-account-liveness-when-propagating-prec.patch
+bpf-fix-precision-propagation-verbose-logging.patch
+crypto-qat-fix-concurrency-issue-when-device-state-c.patch
+scm-fix-msg_ctrunc-setting-condition-for-so_passsec.patch
+wifi-ath12k-add-missing-unwind-goto-in-ath12k_pci_pr.patch
+wifi-ath11k-fix-deinitialization-of-firmware-resourc.patch
+selftests-bpf-fix-a-fd-leak-in-an-error-path-in-netw.patch
+bpf-only-allocate-one-bpf_mem_cache-for-bpf_cpumask_.patch
+bpf-free-struct-bpf_cpumask-in-call_rcu-handler.patch
+bpf-remove-misleading-spec_v1-check-on-var-offset-st.patch
+net-pcs-xpcs-remove-double-read-of-link-state-when-u.patch
+vlan-partially-enable-siocshwtstamp-in-container.patch
+net-packet-annotate-accesses-to-po-xmit.patch
+net-packet-convert-po-origdev-to-an-atomic-flag.patch
+net-packet-convert-po-auxdata-to-an-atomic-flag.patch
+libbpf-fix-ld_imm64-copy-logic-for-ksym-in-light-ske.patch
+net-dsa-qca8k-remove-assignment-of-an_enabled-in-pcs.patch
+netfilter-keep-conntrack-reference-until-ipsecv6-pol.patch
+bpf-return-long-from-bpf_map_ops-funcs.patch
+bpf-fix-__reg_bound_offset-64-32-var_off-subreg-prop.patch
+scsi-target-move-sess-cmd-counter-to-new-struct.patch
+scsi-target-move-cmd-counter-allocation.patch
+scsi-target-pass-in-cmd-counter-to-use-during-cmd-se.patch
+scsi-target-iscsit-isert-alloc-per-conn-cmd-counter.patch
+scsi-target-iscsit-stop-wait-on-cmds-during-conn-clo.patch
+scsi-target-fix-multiple-lun_reset-handling.patch
+scsi-target-iscsit-fix-tas-handling-during-conn-clea.patch
+scsi-megaraid-fix-mega_cmd_done-cmdid_int_cmds.patch
+net-sunhme-fix-uninitialized-return-code.patch
+testing-vsock-add-vsock_perf-to-gitignore.patch
+f2fs-handle-dqget-error-in-f2fs_transfer_project_quo.patch
+f2fs-fix-uninitialized-skipped_gc_rwsem.patch
+f2fs-apply-zone-capacity-to-all-zone-type.patch
+f2fs-compress-fix-to-call-f2fs_wait_on_page_writebac.patch
+f2fs-fix-scheduling-while-atomic-in-decompression-pa.patch
+crypto-caam-clear-some-memory-in-instantiate_rng.patch
+crypto-sa2ul-select-crypto_des.patch
+wifi-rtlwifi-fix-incorrect-error-codes-in-rtl_debugf.patch
+wifi-rtlwifi-fix-incorrect-error-codes-in-rtl_debugf.patch-3201
+scsi-hisi_sas-handle-ncq-error-when-iptt-is-valid.patch
+wifi-rt2x00-fix-memory-leak-when-handling-surveys.patch
+bpf-factor-out-fetching-basic-kfunc-metadata.patch
+bpf-fix-struct_meta-lookup-for-bpf_obj_free_fields-k.patch
+f2fs-fix-iostat-lock-protection.patch
+net-qrtr-correct-types-of-trace-event-parameters.patch
+selftests-xsk-use-correct-umem-size-in-testapp_inval.patch
+selftests-xsk-disable-ipv6-on-veth1.patch
+selftests-xsk-deflakify-stats_rx_dropped-test.patch
+selftests-bpf-wait-for-receive-in-cg_storage_multi-t.patch
+bpftool-fix-bug-for-long-instructions-in-program-cfg.patch
+crypto-drbg-only-fail-when-jent-is-unavailable-in-fi.patch
+xsk-fix-unaligned-descriptor-validation.patch
+f2fs-fix-to-avoid-use-after-free-for-cached-ipu-bio.patch
+wifi-iwlwifi-fix-duplicate-entry-in-iwl_dev_info_tab.patch
+bpf-btf-fix-is_int_ptr.patch
+scsi-lpfc-fix-ioremap-issues-in-lpfc_sli4_pci_mem_se.patch
+net-ethernet-stmmac-dwmac-rk-rework-optional-clock-h.patch
+net-ethernet-stmmac-dwmac-rk-fix-optional-phy-regula.patch
+wifi-ath11k-fix-writing-to-unintended-memory-region.patch
+bpf-sockmap-fix-deadlocks-in-the-sockhash-and-sockma.patch
+nvmet-fix-error-handling-in-nvmet_execute_identify_c.patch
+nvmet-fix-identify-namespace-handling.patch
+nvmet-fix-identify-controller-handling.patch
+nvmet-fix-identify-active-namespace-id-list-handling.patch
+nvmet-fix-i-o-command-set-specific-identify-controll.patch
+nvme-fix-async-event-trace-event.patch
+nvme-fcloop-fix-inconsistent-in-hardirq-w-hardirq-on.patch
+selftests-bpf-use-read_perf_max_sample_freq-in-perf_.patch
+selftests-bpf-fix-leaked-bpf_link-in-get_stackid_can.patch
+blk-mq-don-t-plug-for-head-insertions-in-blk_execute.patch
+wifi-iwlwifi-debug-fix-crash-in-__iwl_err.patch
+wifi-iwlwifi-mvm-fix-a-msdu-checks.patch
+wifi-iwlwifi-trans-don-t-trigger-d3-interrupt-twice.patch
+wifi-iwlwifi-mvm-don-t-set-checksum_complete-for-uns.patch
+bpf-sockmap-revert-buggy-deadlock-fix-in-the-sockhas.patch
+f2fs-fix-to-check-return-value-of-f2fs_do_truncate_b.patch
+f2fs-fix-to-check-return-value-of-inc_valid_block_co.patch
+md-raid10-fix-task-hung-in-raid10d.patch
+md-raid10-fix-leak-of-r10bio-remaining-for-recovery.patch
+md-raid10-fix-memleak-for-conf-bio_split.patch
+md-raid10-fix-memleak-of-md-thread.patch
+md-raid10-don-t-call-bio_start_io_acct-twice-for-bio.patch
+wifi-iwlwifi-mvm-don-t-drop-unencrypted-mcast-frames.patch
+wifi-iwlwifi-yoyo-skip-dump-correctly-on-hw-error.patch
+wifi-iwlwifi-yoyo-fix-possible-division-by-zero.patch
+wifi-iwlwifi-mvm-initialize-seq-variable.patch
+wifi-iwlwifi-fw-move-memset-before-early-return.patch
+jdb2-don-t-refuse-invalidation-of-already-invalidate.patch
+io_uring-rsrc-use-nospec-ed-indexes.patch
+wifi-iwlwifi-make-the-loop-for-card-preparation-effe.patch
+wifi-mt76-remove-redundent-mcu_uni_cmd_-definitions.patch
+wifi-mt76-mt7921-fix-wrong-command-to-set-sta-channe.patch
+wifi-mt76-mt7921-fix-pci-dma-hang-after-reboot.patch
+wifi-mt76-mt7915-unlock-on-error-in-mt7915_thermal_t.patch
+wifi-mt76-mt7996-fix-radiotap-bitfield.patch
+wifi-mt76-mt7915-expose-device-tree-match-table.patch
+wifi-mt76-mt7915-rework-init-flow-in-mt7915_thermal_.patch
+wifi-mt76-handle-failure-of-vzalloc-in-mt7615_coredu.patch
+wifi-mt76-mt7996-let-non-bufferable-mmpdus-use-corre.patch
+wifi-mt76-mt7996-fix-pointer-calculation-in-ie-count.patch
+wifi-mt76-mt7996-fix-eeprom-tx-path-bitfields.patch
+wifi-mt76-mt7921-use-driver-flags-rather-than-mac802.patch
+wifi-mt76-mt7921e-fix-probe-timeout-after-reboot.patch
+wifi-mt76-fix-6ghz-high-channel-not-be-scanned.patch
+mt76-mt7921-fix-kernel-panic-by-accessing-unallocate.patch
+wifi-mt76-mt7921-fix-missing-unwind-goto-in-mt7921u_.patch
+wifi-mt76-mt7921e-improve-reliability-of-dma-reset.patch
+wifi-mt76-mt7921e-stop-chip-reset-worker-in-unregist.patch
+wifi-mt76-connac-fix-txd-multicast-rate-setting.patch
+wifi-iwlwifi-mvm-check-firmware-response-size.patch
+netfilter-conntrack-restore-ips_confirmed-out-of-nf_.patch
+wifi-mt76-mt7996-fill-txd-by-host-driver.patch
+netfilter-conntrack-fix-wrong-ct-timeout-value.patch
+wifi-iwlwifi-fw-fix-memory-leak-in-debugfs.patch
+wifi-iwlwifi-mvm-support-wowlan-info-notification-ve.patch
+wifi-iwlwifi-mvm-fix-potential-memory-leak.patch
+net-libwx-fix-memory-leak-in-wx_setup_rx_resources.patch
+ixgbe-allow-flow-hash-to-be-set-via-ethtool.patch
+ixgbe-enable-setting-rss-table-to-default-values.patch
+net-mlx5e-don-t-clone-flow-post-action-attributes-se.patch
+net-mlx5e-release-the-label-when-replacing-existing-.patch
+net-mlx5-e-switch-create-per-vport-table-based-on-de.patch
+net-mlx5-e-switch-don-t-destroy-indirect-table-in-sp.patch
+net-mlx5-release-tunnel-device-after-tc-update-skb.patch
+net-mlx5e-fix-error-flow-in-representor-failing-to-a.patch
+revert-net-mlx5-remove-recovery-arg-from-mlx5_load_o.patch
+net-mlx5-use-recovery-timeout-on-sync-reset-flow.patch
+net-mlx5e-nullify-table-pointer-when-failing-to-crea.patch
+revert-net-mlx5e-don-t-use-termination-table-when-re.patch
+net-stmmac-fix-system-hang-when-setting-up-tag_8021q.patch
+bpf-fix-race-between-btf_put-and-btf_idr-walk.patch
+bpf-don-t-efault-for-getsockopt-with-optval-null.patch
+netfilter-nf_tables-don-t-write-table-validation-sta.patch
+net-dpaa-fix-uninitialized-variable-in-dpaa_stop.patch
+net-sched-sch_fq-fix-integer-overflow-of-credit.patch
+net-sched-cls_api-initialize-miss_cookie_node-when-a.patch
+ipv4-fix-potential-uninit-variable-access-bug-in-__i.patch
+rxrpc-fix-error-when-reading-rxrpc-tokens.patch
+revert-bluetooth-btsdio-fix-use-after-free-bug-in-bt.patch
+netlink-use-copy_to_user-for-optval-in-netlink_getso.patch
+net-amd-fix-link-leak-when-verifying-config-failed.patch
+tcp-udp-fix-memleaks-of-sk-and-zerocopy-skbs-with-tx.patch
+ipmi-aspeed_bt_ipmi_bmc-select-regmap_mmio-instead-o.patch
+asoc-cs35l41-only-disable-internal-boost.patch
+drivers-staging-rtl8723bs-fix-locking-in-_rtw_join_t.patch
+drivers-staging-rtl8723bs-fix-locking-in-rtw_scan_ti.patch
+pstore-revert-pmsg_lock-back-to-a-normal-mutex.patch
+usb-host-xhci-rcar-remove-leftover-quirk-handling.patch
+usb-dwc3-gadget-change-condition-for-processing-susp.patch
+serial-stm32-re-assert-rts-de-gpio-in-rs485-mode-onl.patch
+fpga-bridge-fix-kernel-doc-parameter-description.patch
+iommufd-selftest-catch-overflow-of-uptr-and-length.patch
+iio-light-max44009-add-missing-of-device-matching.patch
+spi-constify-spi-parameters-of-chip-select-apis.patch
+serial-8250_bcm7271-fix-arbitration-handling.patch
+spi-atmel-quadspi-don-t-leak-clk-enable-count-in-pm-.patch
+spi-atmel-quadspi-free-resources-even-if-runtime-res.patch
+spi-imx-don-t-skip-cleanup-in-remove-s-error-path.patch
+interconnect-qcom-drop-obsolete-osm_l3-epss-defines.patch
+interconnect-qcom-osm-l3-drop-unuserd-header-inclusi.patch
+spi-f_ospi-add-missing-spi_mem_default_supports_op-h.patch
+module-decompress-never-use-kunmap-for-local-un-mapp.patch
+usb-gadget-udc-renesas_usb3-fix-use-after-free-bug-i.patch
+asoc-soc-compress-inherit-atomicity-from-dai-link-fo.patch
+pci-imx6-install-the-fault-handler-only-on-compatibl.patch
+asoc-es8316-handle-optional-irq-assignment.patch
+linux-vt_buffer.h-allow-either-builtin-or-modular-fo.patch
+dt-bindings-serial-snps-dw-apb-uart-correct-number-o.patch
+spi-qup-don-t-skip-cleanup-in-remove-s-error-path.patch
+interconnect-qcom-rpm-drop-bogus-pm-domain-attach.patch
+spi-mchp-pci1xxxx-fix-length-of-spi-transactions-not.patch
+spi-mchp-pci1xxxx-fix-spi-transactions-not-working-a.patch
+spi-mpc5xxx-psc-remove-unused-platform_data.patch
+spi-replace-all-spi-chip_select-and-spi-cs_gpiod-ref.patch
+spi-mchp-pci1xxxx-fix-improper-implementation-of-dis.patch
+spi-fsl-spi-fix-cpm-qe-mode-litte-endian.patch
+vmci_host-fix-a-race-condition-in-vmci_host_poll-cau.patch
+of-fix-modalias-string-generation.patch
+pci-edr-clear-device-status-after-edr-error-recovery.patch
+ia64-mm-contig-fix-section-mismatch-warning-error.patch
+ia64-salinfo-placate-defined-but-not-used-warning.patch
+scripts-gdb-bail-early-if-there-are-no-clocks.patch
+scripts-gdb-bail-early-if-there-are-no-generic-pd.patch
+asoc-mediatek-common-fix-refcount-leak-in-parse_dai_.patch
+hid-amd_sfh-correct-the-structure-fields.patch
+hid-amd_sfh-correct-the-sensor-enable-and-disable-co.patch
+hid-amd_sfh-fix-illuminance-value.patch
+hid-amd_sfh-add-support-for-shutdown-operation.patch
+hid-amd_sfh-correct-the-stop-all-command.patch
+hid-amd_sfh-increase-sensor-command-timeout-for-sfh1.patch
+hid-amd_sfh-handle-no-sensors-enabled-for-sfh1.1.patch
+cacheinfo-check-sib_leaf-in-cache_leaves_are_shared.patch
+cacheinfo-check-cache-properties-are-present-in-dt.patch
+coresight-etm_pmu-set-the-module-field.patch
+drm-panel-novatek-nt35950-improve-error-handling.patch
+asoc-fsl_mqs-move-of_node_put-to-the-correct-locatio.patch
+pci-pm-extend-d3hot-delay-for-nvidia-hda-controllers.patch
+drm-panel-novatek-nt35950-only-unregister-dsi1-if-it.patch
+spi-cadence-quadspi-fix-suspend-resume-implementatio.patch
+i2c-cadence-cdns_i2c_master_xfer-fix-runtime-pm-leak.patch
+i2c-xiic-xiic_xfer-fix-runtime-pm-leak-on-error-path.patch
+scripts-gdb-raise-error-with-reduced-debugging-infor.patch
+uapi-linux-const.h-prefer-iso-friendly-__typeof__.patch
+sh-sq-fix-incorrect-element-size-for-allocating-bitm.patch
+usb-gadget-tegra-xudc-fix-crash-in-vbus_draw.patch
+usb-chipidea-fix-missing-goto-in-ci_hdrc_probe.patch
+usb-mtu3-fix-kernel-panic-at-qmu-transfer-done-irq-h.patch
+firmware-stratix10-svc-fix-an-null-vs-is_err-bug-in-.patch
+tty-serial-fsl_lpuart-adjust-buffer-length-to-the-in.patch
+serial-8250-add-missing-wakeup-event-reporting.patch
+spi-cadence-quadspi-use-macro-define_simple_dev_pm_o.patch
+staging-rtl8192e-fix-w_disable-does-not-work-after-s.patch
+spmi-add-a-check-for-remove-callback-when-removing-a.patch
+vdpa-mlx5-avoid-losing-link-state-updates.patch
+virtio_ring-don-t-update-event-idx-on-get_buf.patch
+spi-bcm63xx-remove-pm_sleep-based-conditional-compil.patch
+fbdev-mmp-fix-deferred-clk-handling-in-mmphw_probe.patch
+selftests-powerpc-pmu-fix-sample-field-check-in-the-.patch
+macintosh-windfarm_smu_sat-add-missing-of_node_put.patch
+powerpc-perf-properly-detect-mpc7450-family.patch
+powerpc-mpc512x-fix-resource-printk-format-warning.patch
+powerpc-wii-fix-resource-printk-format-warnings.patch
+powerpc-sysdev-tsi108-fix-resource-printk-format-war.patch
+macintosh-via-pmu-led-requires-ata-to-be-set.patch
+powerpc-rtas-use-memmove-for-potentially-overlapping.patch
+sched-fair-fix-inaccurate-tally-of-ttwu_move_affine.patch
+perf-core-fix-hardlockup-failure-caused-by-perf-thro.patch
+revert-objtool-support-addition-to-set-cfa-base.patch
+riscv-fix-ptdump-when-kasan-is-enabled.patch
+sched-rt-fix-bad-task-migration-for-rt-tasks.patch
+sched-clock-fix-local_clock-before-sched_clock_init.patch
+rv-fix-addition-on-an-uninitialized-variable-run.patch
+rtla-timerlat-fix-previous-irq-auto-analysis-line.patch
+tracing-user_events-ensure-write-index-cannot-be-neg.patch
+clk-at91-clk-sam9x60-pll-fix-return-value-check.patch
+ib-hifi1-add-a-null-check-of-kzalloc_node-in-hfi1_ip.patch
+rdma-siw-fix-potential-page_array-out-of-range-acces.patch
+clk-mediatek-mt2712-add-error-handling-to-clk_mt2712.patch
+clk-mediatek-consistently-use-gate_mtk-macro.patch
+clk-mediatek-mt7622-properly-use-clk_is_critical-fla.patch
+clk-mediatek-mt8135-properly-use-clk_is_critical-fla.patch
+rdma-rdmavt-delete-unnecessary-null-check.patch
+clk-mediatek-clk-pllfh-fix-missing-of_node_put-in-fh.patch
+clk-qcom-gcc-qcm2290-fix-up-gcc_sdcc2_apps_clk_src.patch
+workqueue-fix-hung-time-report-of-worker-pools.patch
+rtc-omap-include-header-for-omap_rtc_power_off_progr.patch
+rdma-mlx4-prevent-shift-wrapping-in-set_user_sq_size.patch
+rtc-meson-vrtc-use-ktime_get_real_ts64-to-get-the-cu.patch
+rtc-k3-handle-errors-while-enabling-wake-irq.patch
+rdma-rxe-replace-exists-by-rxe-in-rxe.c.patch
+rdma-erdma-use-fixed-hardware-page-size.patch
+fs-ntfs3-fix-memory-leak-if-ntfs_read_mft-failed.patch
+fs-ntfs3-add-check-for-kmemdup.patch
+fs-ntfs3-fix-null-ptr-deref-on-inode-i_op-in-ntfs_lo.patch
+fs-ntfs3-fix-oob-read-in-indx_insert_into_buffer.patch
+fs-ntfs3-fix-slab-out-of-bounds-read-in-hdr_delete_d.patch
+iommu-mediatek-set-dma_mask-for-pgtable_pa_35_en.patch
+rdma-rxe-change-rxe_dbg-to-rxe_dbg_dev.patch
+rdma-rxe-extend-dbg-log-messages-to-err-and-info.patch
+rdma-rxe-add-error-messages.patch
+rdma-rxe-remove-tasklet-call-from-rxe_cq.c.patch
+power-supply-generic-adc-battery-fix-unit-scaling.patch
+clk-add-missing-of_node_put-in-assigned-clocks-prope.patch
+rdma-rxe-clean-kzalloc-failure-paths.patch
+rdma-siw-remove-namespace-check-from-siw_netdev_even.patch
+clk-qcom-gcc-sm6115-mark-rcgs-shared-where-applicabl.patch
+power-supply-rk817-fix-low-soc-bugs.patch
+rdma-cm-trace-icm_send_rej-event-before-the-cm-state.patch
+rdma-srpt-add-a-check-for-valid-mad_agent-pointer.patch
+ib-hfi1-fix-sdma-mmu_rb_node-not-being-evicted-in-lr.patch
+ib-hfi1-fix-bugs-with-non-page_size-end-multi-iovec-.patch
+clk-imx-fracn-gppll-fix-the-rate-table.patch
+clk-imx-fracn-gppll-disable-hardware-select-control.patch
+clk-imx-imx8ulp-fix-xbar_divbus-and-ad_slow-clock-pa.patch
+nfsv4.1-always-send-a-reclaim_complete-after-establi.patch
+iommu-amd-set-page-size-bitmap-during-v2-domain-allo.patch
+s390-checksum-always-use-cksm-instruction.patch
+s390-boot-remove-non-functioning-image-bootable-chec.patch
+s390-boot-rename-mem_detect-to-physmem_info.patch
+s390-boot-rework-decompressor-reserved-tracking.patch
+clk-qcom-lpasscc-sc7280-skip-qdsp6ss-clock-registrat.patch
+clk-qcom-lpassaudiocc-sc7280-add-required-gdsc-power.patch
+clk-qcom-gcc-sm8350-fix-pcie-pipe-clocks-handling.patch
+clk-qcom-dispcc-qcm2290-remove-inexistent-dsi1phy-cl.patch
+input-raspberrypi-ts-fix-refcount-leak-in-rpi_ts_pro.patch
+swiotlb-relocate-pagehighmem-test-away-from-rmem_swi.patch
+swiotlb-fix-debugfs-reporting-of-reserved-memory-poo.patch
+rdma-rxe-convert-tasklet-args-to-queue-pairs.patch
+rdma-rxe-remove-__rxe_do_task.patch
+rdma-rxe-fix-the-error-trying-to-register-non-static.patch
+rdma-mlx5-check-pcie_relaxed_ordering_enabled-in-umr.patch
+rdma-mlx5-fix-flow-counter-query-via-devx.patch
+sunrpc-remove-the-maximum-number-of-retries-in-call_.patch
+rdma-mlx5-use-correct-device-num_ports-when-modify-d.patch
+clocksource-drivers-davinci-fix-memory-leak-in-davin.patch
+openrisc-properly-store-r31-to-pt_regs-on-unhandled-.patch
+timekeeping-fix-references-to-nonexistent-ktime_get_.patch
+smb3-add-missing-locks-to-protect-deferred-close-fil.patch
+smb3-close-deferred-file-handles-in-case-of-handle-l.patch
+rtc-jz4740-make-sure-clock-provider-gets-removed.patch
+ext4-fix-i_disksize-exceeding-i_size-problem-in-pari.patch
+ext4-fix-use-after-free-read-in-ext4_find_extent-for.patch
+pinctrl-renesas-r8a779a0-remove-incorrect-avb-01-pin.patch
+pinctrl-renesas-r8a779f0-fix-tsn1_avtp_pps-pin-group.patch
+pinctrl-renesas-r8a779g0-fix-group-4-5-pin-functions.patch
+pinctrl-renesas-r8a779g0-fix-group-6-7-pin-functions.patch
+pinctrl-renesas-r8a779g0-fix-erroroutc-function-name.patch
+leds-ti_lmu_common-select-regmap-instead-of-dependin.patch
+pinctrl-ralink-reintroduce-ralink-rt2880-pinmux-comp.patch
+dmaengine-mv_xor_v2-fix-an-error-code.patch
+leds-tca6507-fix-error-handling-of-using-fwnode_prop.patch
+pwm-mtk-disp-disable-shadow-registers-before-setting.patch
+pwm-mtk-disp-configure-double-buffering-before-readi.patch
+soundwire-intel-don-t-save-hw_params-for-use-in-prep.patch
+phy-tegra-xusb-add-missing-tegra_xusb_port_unregiste.patch
+phy-ti-j721e-wiz-fix-unreachable-code-in-wiz_mode_se.patch
+dma-gpi-remove-spurious-unlock-in-gpi_ch_init.patch
+dmaengine-dw-edma-fix-to-change-for-continuous-trans.patch
+dmaengine-dw-edma-fix-to-enable-to-issue-dma-request.patch
+dmaengine-at_xdmac-disable-enable-clock-directly-on-.patch
+dmaengine-at_xdmac-fix-imbalanced-runtime-pm-referen.patch
+dmaengine-at_xdmac-do-not-resume-channels-paused-by-.patch
+dmaengine-at_xdmac-restore-the-content-of-grws-regis.patch
+dmaengine-at_xdmac-do-not-enable-all-cyclic-channels.patch
+pinctrl-bcm2835.c-fix-race-condition-when-setting-gp.patch
+thermal-drivers-mediatek-use-devm_of_iomap-to-avoid-.patch
+mfd-tqmx86-do-not-access-i2c_detect-register-through.patch
+mfd-tqmx86-specify-io-port-register-range-more-preci.patch
+mfd-tqmx86-correct-board-names-for-tqmxe39x.patch
+mfd-ocelot-spi-fix-unsupported-bulk-read.patch
+mfd-arizona-spi-add-missing-module_device_table.patch
+hte-tegra-fix-struct-of_device_id-build-error.patch
+hte-tegra-194-fix-off-by-one-in-tegra_hte_map_to_lin.patch
+acpi-pm-do-not-turn-of-unused-power-resources-on-the.patch
+pm-hibernate-turn-snapshot_test-into-global-variable.patch
+pm-hibernate-do-not-get-block-device-exclusively-in-.patch
+afs-fix-updating-of-i_size-with-dv-jump-from-server.patch
+afs-fix-getattr-to-report-server-i_size-on-dirs-not-.patch
+afs-avoid-endless-loop-if-file-is-larger-than-expect.patch
--- /dev/null
+From 6462af8db8e5ddf43257cfca247705fe40c1d96d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Apr 2023 13:48:52 +0200
+Subject: sh: sq: Fix incorrect element size for allocating bitmap buffer
+
+From: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
+
+[ Upstream commit 80f746e2bd0e1da3fdb49a53570e54a1a225faac ]
+
+The Store Queue code allocates a bitmap buffer with the size of
+multiple of sizeof(long) in sq_api_init(). While the buffer size
+is calculated correctly, the code uses the wrong element size to
+allocate the buffer which results in the allocated bitmap buffer
+being too small.
+
+Fix this by allocating the buffer with kcalloc() with element size
+sizeof(long) instead of kzalloc() whose elements size defaults to
+sizeof(char).
+
+Fixes: d7c30c682a27 ("sh: Store Queue API rework.")
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
+Link: https://lore.kernel.org/r/20230419114854.528677-1-glaubitz@physik.fu-berlin.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sh/kernel/cpu/sh4/sq.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/sh/kernel/cpu/sh4/sq.c b/arch/sh/kernel/cpu/sh4/sq.c
+index 27f2e3da5aa22..6e0bb3f47fa5d 100644
+--- a/arch/sh/kernel/cpu/sh4/sq.c
++++ b/arch/sh/kernel/cpu/sh4/sq.c
+@@ -382,7 +382,7 @@ static int __init sq_api_init(void)
+ if (unlikely(!sq_cache))
+ return ret;
+
+- sq_bitmap = kzalloc(size, GFP_KERNEL);
++ sq_bitmap = kcalloc(size, sizeof(long), GFP_KERNEL);
+ if (unlikely(!sq_bitmap))
+ goto out;
+
+--
+2.39.2
+
--- /dev/null
+From 8e8317172f4f3f2f26307d08a1b107130787ba66 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Apr 2023 13:54:33 +0000
+Subject: SMB3: Add missing locks to protect deferred close file list
+
+From: Bharath SM <bharathsm@microsoft.com>
+
+[ Upstream commit ab9ddc87a9055c4bebd6524d5d761d605d52e557 ]
+
+cifs_del_deferred_close function has a critical section which modifies
+the deferred close file list. We must acquire deferred_lock before
+calling cifs_del_deferred_close function.
+
+Fixes: ca08d0eac020 ("cifs: Fix memory leak on the deferred close")
+Signed-off-by: Bharath SM <bharathsm@microsoft.com>
+Acked-off-by: Paulo Alcantara (SUSE) <pc@manguebit.com>
+Acked-by: Ronnie Sahlberg <lsahlber@redhat.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/cifs/misc.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c
+index 7f085ed2d866b..f76e9bb7d7423 100644
+--- a/fs/cifs/misc.c
++++ b/fs/cifs/misc.c
+@@ -749,7 +749,9 @@ cifs_close_deferred_file(struct cifsInodeInfo *cifs_inode)
+ list_for_each_entry(cfile, &cifs_inode->openFileList, flist) {
+ if (delayed_work_pending(&cfile->deferred)) {
+ if (cancel_delayed_work(&cfile->deferred)) {
++ spin_lock(&cifs_inode->deferred_lock);
+ cifs_del_deferred_close(cfile);
++ spin_unlock(&cifs_inode->deferred_lock);
+
+ tmp_list = kmalloc(sizeof(struct file_list), GFP_ATOMIC);
+ if (tmp_list == NULL)
+@@ -780,7 +782,9 @@ cifs_close_all_deferred_files(struct cifs_tcon *tcon)
+ list_for_each_entry(cfile, &tcon->openFileList, tlist) {
+ if (delayed_work_pending(&cfile->deferred)) {
+ if (cancel_delayed_work(&cfile->deferred)) {
++ spin_lock(&CIFS_I(d_inode(cfile->dentry))->deferred_lock);
+ cifs_del_deferred_close(cfile);
++ spin_unlock(&CIFS_I(d_inode(cfile->dentry))->deferred_lock);
+
+ tmp_list = kmalloc(sizeof(struct file_list), GFP_ATOMIC);
+ if (tmp_list == NULL)
+@@ -815,7 +819,9 @@ cifs_close_deferred_file_under_dentry(struct cifs_tcon *tcon, const char *path)
+ if (strstr(full_path, path)) {
+ if (delayed_work_pending(&cfile->deferred)) {
+ if (cancel_delayed_work(&cfile->deferred)) {
++ spin_lock(&CIFS_I(d_inode(cfile->dentry))->deferred_lock);
+ cifs_del_deferred_close(cfile);
++ spin_unlock(&CIFS_I(d_inode(cfile->dentry))->deferred_lock);
+
+ tmp_list = kmalloc(sizeof(struct file_list), GFP_ATOMIC);
+ if (tmp_list == NULL)
+--
+2.39.2
+
--- /dev/null
+From e49466527884a5e763c77af0349ae10adcd1aa13 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Apr 2023 14:05:16 +0000
+Subject: SMB3: Close deferred file handles in case of handle lease break
+
+From: Bharath SM <bharathsm@microsoft.com>
+
+[ Upstream commit d906be3fa571f6fc9381911304a0eca99f1b6951 ]
+
+We should not cache deferred file handles if we dont have
+handle lease on a file. And we should immediately close all
+deferred handles in case of handle lease break.
+
+Fixes: 9e31678fb403 ("SMB3: fix lease break timeout when multiple deferred close handles for the same file.")
+Signed-off-by: Bharath SM <bharathsm@microsoft.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/cifs/file.c | 16 ++++++++++++++++
+ fs/cifs/misc.c | 2 +-
+ 2 files changed, 17 insertions(+), 1 deletion(-)
+
+diff --git a/fs/cifs/file.c b/fs/cifs/file.c
+index b33d2e7b0f984..c5fcefdfd7976 100644
+--- a/fs/cifs/file.c
++++ b/fs/cifs/file.c
+@@ -4882,6 +4882,8 @@ void cifs_oplock_break(struct work_struct *work)
+ struct TCP_Server_Info *server = tcon->ses->server;
+ int rc = 0;
+ bool purge_cache = false;
++ struct cifs_deferred_close *dclose;
++ bool is_deferred = false;
+
+ wait_on_bit(&cinode->flags, CIFS_INODE_PENDING_WRITERS,
+ TASK_UNINTERRUPTIBLE);
+@@ -4917,6 +4919,20 @@ void cifs_oplock_break(struct work_struct *work)
+ cifs_dbg(VFS, "Push locks rc = %d\n", rc);
+
+ oplock_break_ack:
++ /*
++ * When oplock break is received and there are no active
++ * file handles but cached, then schedule deferred close immediately.
++ * So, new open will not use cached handle.
++ */
++ spin_lock(&CIFS_I(inode)->deferred_lock);
++ is_deferred = cifs_is_deferred_close(cfile, &dclose);
++ spin_unlock(&CIFS_I(inode)->deferred_lock);
++
++ if (!CIFS_CACHE_HANDLE(cinode) && is_deferred &&
++ cfile->deferred_close_scheduled && delayed_work_pending(&cfile->deferred)) {
++ cifs_close_deferred_file(cinode);
++ }
++
+ /*
+ * releasing stale oplock after recent reconnect of smb session using
+ * a now incorrect file handle is not a data integrity issue but do
+diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c
+index f76e9bb7d7423..cd914be905b24 100644
+--- a/fs/cifs/misc.c
++++ b/fs/cifs/misc.c
+@@ -764,7 +764,7 @@ cifs_close_deferred_file(struct cifsInodeInfo *cifs_inode)
+ spin_unlock(&cifs_inode->open_file_lock);
+
+ list_for_each_entry_safe(tmp_list, tmp_next_list, &file_head, list) {
+- _cifsFileInfo_put(tmp_list->cfile, true, false);
++ _cifsFileInfo_put(tmp_list->cfile, false, false);
+ list_del(&tmp_list->list);
+ kfree(tmp_list);
+ }
+--
+2.39.2
+
--- /dev/null
+From 33c545fdb3d39433fbd6d2b0892e8186d74ca870 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Mar 2023 19:54:22 +0800
+Subject: soc: bcm: brcmstb: biuctrl: fix of_iomap leak
+
+From: Zhaoyang Li <lizhaoyang04@hust.edu.cn>
+
+[ Upstream commit c3fbced9af885a6f217fd95509a613d6590916ce ]
+
+Smatch reports:
+
+drivers/soc/bcm/brcmstb/biuctrl.c:291 setup_hifcpubiuctrl_regs() warn:
+'cpubiuctrl_base' from of_iomap() not released on lines: 291.
+
+This is because in setup_hifcpubiuctrl_regs(),
+cpubiuctrl_base is not released when handle error, which may cause a leak.
+To fix this, iounmap is added when handle error.
+
+Fixes: 22f7a9116eba ("soc: brcmstb: Correct CPU_CREDIT_REG offset for Brahma-B53 CPUs")
+Signed-off-by: Zhaoyang Li <lizhaoyang04@hust.edu.cn>
+Reviewed-by: Dan Carpenter <error27@gmail.com>
+Reviewed-by: Dongliang Mu <dzm91@hust.edu.cn>
+Link: https://lore.kernel.org/r/20230327115422.1536615-1-lizhaoyang04@hust.edu.cn
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/bcm/brcmstb/biuctrl.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/soc/bcm/brcmstb/biuctrl.c b/drivers/soc/bcm/brcmstb/biuctrl.c
+index e1d7b45432485..364ddbe365c24 100644
+--- a/drivers/soc/bcm/brcmstb/biuctrl.c
++++ b/drivers/soc/bcm/brcmstb/biuctrl.c
+@@ -288,6 +288,10 @@ static int __init setup_hifcpubiuctrl_regs(struct device_node *np)
+ if (BRCM_ID(family_id) == 0x7260 && BRCM_REV(family_id) == 0)
+ cpubiuctrl_regs = b53_cpubiuctrl_no_wb_regs;
+ out:
++ if (ret && cpubiuctrl_base) {
++ iounmap(cpubiuctrl_base);
++ cpubiuctrl_base = NULL;
++ }
+ return ret;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 6fa6a028ddb1ce148962413b2d5945b1c7f5f618 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Mar 2023 17:10:30 -0400
+Subject: soc: canaan: Make K210_SYSCTL depend on CLK_K210
+
+From: Jesse Taube <mr.bossman075@gmail.com>
+
+[ Upstream commit 49f965b6fbca63904d7397ce96066fa992f401a3 ]
+
+CLK_K210 is no longer a dependency of SOC_CANAAN,
+but K210_SYSCTL depends on CLK_K210. This patch makes K210_SYSCTL
+depend on CLK_K210. Also fix whitespace errors.
+
+Reported-by: Randy Dunlap <rdunlap@infradead.org>
+Link: https://lore.kernel.org/all/42446784-a88b-df09-41e9-5f685b4df6ee@infradead.org
+Fixes: 3af577f9826f ("RISC-V: stop directly selecting drivers for SOC_CANAAN")
+Signed-off-by: Jesse Taube <Mr.Bossman075@gmail.com>
+Reviewed-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
+Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/canaan/Kconfig | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/soc/canaan/Kconfig b/drivers/soc/canaan/Kconfig
+index 2527cf5757ec9..43ced2bf84447 100644
+--- a/drivers/soc/canaan/Kconfig
++++ b/drivers/soc/canaan/Kconfig
+@@ -3,8 +3,9 @@
+ config SOC_K210_SYSCTL
+ bool "Canaan Kendryte K210 SoC system controller"
+ depends on RISCV && SOC_CANAAN && OF
++ depends on COMMON_CLK_K210
+ default SOC_CANAAN
+- select PM
+- select MFD_SYSCON
++ select PM
++ select MFD_SYSCON
+ help
+ Canaan Kendryte K210 SoC system controller driver.
+--
+2.39.2
+
--- /dev/null
+From 3c0884b3dd4143dec8d173f90dabe9e4816b514c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Apr 2023 17:27:32 +0530
+Subject: soc: qcom: rpmh-rsc: Support RSC v3 minor versions
+
+From: Tushar Nimkar <quic_tnimkar@quicinc.com>
+
+[ Upstream commit 88704a0cd71909c3107561261412a5d5beb23358 ]
+
+RSC v3 register offsets are same for all minor versions of v3. Fix a
+minor version check to pick correct offsets for all v3 minor versions.
+
+Fixes: 40482e4f7364 ("soc: qcom: rpmh-rsc: Add support for RSC v3 register offsets")
+Signed-off-by: Tushar Nimkar <quic_tnimkar@quicinc.com>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230406115732.9293-1-quic_tnimkar@quicinc.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/qcom/rpmh-rsc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/soc/qcom/rpmh-rsc.c b/drivers/soc/qcom/rpmh-rsc.c
+index 0f8b2249f8894..f93544f6d7961 100644
+--- a/drivers/soc/qcom/rpmh-rsc.c
++++ b/drivers/soc/qcom/rpmh-rsc.c
+@@ -1073,7 +1073,7 @@ static int rpmh_rsc_probe(struct platform_device *pdev)
+ drv->ver.minor = rsc_id & (MINOR_VER_MASK << MINOR_VER_SHIFT);
+ drv->ver.minor >>= MINOR_VER_SHIFT;
+
+- if (drv->ver.major == 3 && drv->ver.minor == 0)
++ if (drv->ver.major == 3 && drv->ver.minor >= 0)
+ drv->regs = rpmh_rsc_reg_offset_ver_3_0;
+ else
+ drv->regs = rpmh_rsc_reg_offset_ver_2_7;
+--
+2.39.2
+
--- /dev/null
+From e2ad9175931c2fc432dbf5c5f23506a280e2ddef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 31 Mar 2023 17:55:44 +0800
+Subject: soc: renesas: renesas-soc: Release 'chipid' from ioremap()
+
+From: Li Yang <lidaxian@hust.edu.cn>
+
+[ Upstream commit fc187a46a8e682f0f1167b230792b88de01ceaa0 ]
+
+Smatch reports:
+
+drivers/soc/renesas/renesas-soc.c:536 renesas_soc_init() warn:
+'chipid' from ioremap() not released on lines: 475.
+
+If soc_dev_atrr allocation is failed, function renesas_soc_init()
+will return without releasing 'chipid' from ioremap().
+
+Fix this by adding function iounmap().
+
+Fixes: cb5508e47e60 ("soc: renesas: Add support for reading product revision for RZ/G2L family")
+Signed-off-by: Li Yang <lidaxian@hust.edu.cn>
+Reviewed-by: Dan Carpenter <error27@gmail.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/20230331095545.31823-1-lidaxian@hust.edu.cn
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/renesas/renesas-soc.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/soc/renesas/renesas-soc.c b/drivers/soc/renesas/renesas-soc.c
+index 468ebce1ea88b..51191d1a6dd1d 100644
+--- a/drivers/soc/renesas/renesas-soc.c
++++ b/drivers/soc/renesas/renesas-soc.c
+@@ -471,8 +471,11 @@ static int __init renesas_soc_init(void)
+ }
+
+ soc_dev_attr = kzalloc(sizeof(*soc_dev_attr), GFP_KERNEL);
+- if (!soc_dev_attr)
++ if (!soc_dev_attr) {
++ if (chipid)
++ iounmap(chipid);
+ return -ENOMEM;
++ }
+
+ np = of_find_node_by_path("/");
+ of_property_read_string(np, "model", &soc_dev_attr->machine);
+--
+2.39.2
+
--- /dev/null
+From 40c123a64184dd2ba6bc523d4e235b7dceeb02a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Dec 2022 01:14:04 +0100
+Subject: soc: ti: k3-ringacc: Add try_module_get() to
+ k3_dmaring_request_dual_ring()
+
+From: Nicolas Frayer <nfrayer@baylibre.com>
+
+[ Upstream commit 5f1732a8683c1da8faaa90d6ffc3bd6d33013a58 ]
+
+When the k3 ring accelerator driver has been modified to add module build
+support, try_module_get() and module_put() have been added to update the
+module refcnt. One code path has not been updated and it has introduced
+an issue where the refcnt is decremented by module_put() in
+k3_ringacc_ring_free() without being incremented previously.
+Adding try_module_get() to k3_dmaring_request_dual_ring() ensures the
+refcnt is kept up to date.
+
+Fixes: c07f216a8b72 ("soc: ti: k3-ringacc: Allow the driver to be built as module")
+Signed-off-by: Nicolas Frayer <nfrayer@baylibre.com>
+Reviewed-by: Peter Ujfalusi <peter.ujfalusi@gmail.com>
+Link: https://lore.kernel.org/r/20221230001404.10902-1-nfrayer@baylibre.com
+Signed-off-by: Nishanth Menon <nm@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/ti/k3-ringacc.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/soc/ti/k3-ringacc.c b/drivers/soc/ti/k3-ringacc.c
+index e01e4d815230a..8f131368a7586 100644
+--- a/drivers/soc/ti/k3-ringacc.c
++++ b/drivers/soc/ti/k3-ringacc.c
+@@ -406,6 +406,11 @@ static int k3_dmaring_request_dual_ring(struct k3_ringacc *ringacc, int fwd_id,
+
+ mutex_lock(&ringacc->req_lock);
+
++ if (!try_module_get(ringacc->dev->driver->owner)) {
++ ret = -EINVAL;
++ goto err_module_get;
++ }
++
+ if (test_bit(fwd_id, ringacc->rings_inuse)) {
+ ret = -EBUSY;
+ goto error;
+@@ -421,6 +426,8 @@ static int k3_dmaring_request_dual_ring(struct k3_ringacc *ringacc, int fwd_id,
+ return 0;
+
+ error:
++ module_put(ringacc->dev->driver->owner);
++err_module_get:
+ mutex_unlock(&ringacc->req_lock);
+ return ret;
+ }
+--
+2.39.2
+
--- /dev/null
+From a12d2a61958f8dfe0a04a61478f80faaa3bbc6f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Jan 2023 09:40:22 +0400
+Subject: soc: ti: pm33xx: Fix refcount leak in am33xx_pm_probe
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit 8f3c307b580a4a6425896007325bddefc36e8d91 ]
+
+wkup_m3_ipc_get() takes refcount, which should be freed by
+wkup_m3_ipc_put(). Add missing refcount release in the error paths.
+
+Fixes: 5a99ae0092fe ("soc: ti: pm33xx: AM437X: Add rtc_only with ddr in self-refresh support")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Link: https://lore.kernel.org/r/20230106054022.947529-1-linmq006@gmail.com
+Signed-off-by: Nishanth Menon <nm@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/ti/pm33xx.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/soc/ti/pm33xx.c b/drivers/soc/ti/pm33xx.c
+index ce09c42eaed25..f04c21157904b 100644
+--- a/drivers/soc/ti/pm33xx.c
++++ b/drivers/soc/ti/pm33xx.c
+@@ -527,7 +527,7 @@ static int am33xx_pm_probe(struct platform_device *pdev)
+
+ ret = am33xx_pm_alloc_sram();
+ if (ret)
+- return ret;
++ goto err_wkup_m3_ipc_put;
+
+ ret = am33xx_pm_rtc_setup();
+ if (ret)
+@@ -572,13 +572,14 @@ static int am33xx_pm_probe(struct platform_device *pdev)
+ pm_runtime_put_sync(dev);
+ err_pm_runtime_disable:
+ pm_runtime_disable(dev);
+- wkup_m3_ipc_put(m3_ipc);
+ err_unsetup_rtc:
+ iounmap(rtc_base_virt);
+ clk_put(rtc_fck);
+ err_free_sram:
+ am33xx_pm_free_sram();
+ pm33xx_dev = NULL;
++err_wkup_m3_ipc_put:
++ wkup_m3_ipc_put(m3_ipc);
+ return ret;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 1819ab4d47dbc80287d72c87edbc977174c710b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Mar 2023 10:26:42 +0800
+Subject: soundwire: intel: don't save hw_params for use in prepare
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+
+[ Upstream commit 0a0d1740bd8fd7dafb81fcb102fb5d0b83b1ce73 ]
+
+The existing code copies the hw_params pointer and reuses it later in
+.prepare, specifically to re-initialize the ALH DMA channel
+information that's lost in suspend-resume cycles.
+
+This is not needed, we can directly access the information from the
+substream/rtd - as done for the HDAudio DAIs in
+sound/soc/sof/intel/hda-dai.c
+
+In addition, using the saved pointer causes the suspend-resume test
+cases to fail on specific platforms, depending on which version of GCC
+is used. Péter Ujfalusi and I have spent long hours to root-cause this
+problem that was reported by the Intel CI first with 6.2-rc1 and again
+v6.3-rc1. In the latter case we were lucky that the problem was 100%
+reproducible on local test devices, and found out that adding a
+dev_dbg() or adding a call to usleep_range() just before accessing the
+saved pointer "fixed" the issue. With errors appearing just by
+changing the compiler version or minor changes in the code generated,
+clearly we have a memory management Heisenbug.
+
+The root-cause seems to be that the hw_params pointer is not
+persistent. The soc-pcm code allocates the hw_params structure on the
+stack, and passes it to the BE dailink hw_params and DAIs
+hw_params. Saving such a pointer and reusing it later during the
+.prepare stage cannot possibly work reliably, it's broken-by-design
+since v5.10. It's astonishing that the problem was not seen earlier.
+
+This simple fix will have to be back-ported to -stable, due to changes
+to avoid the use of the get/set_dmadata routines this patch will only
+apply on kernels older than v6.1.
+
+Fixes: a5a0239c27fe ("soundwire: intel: reinitialize IP+DSP in .prepare(), but only when resuming")
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Reviewed-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Link: https://lore.kernel.org/r/20230321022642.1426611-1-yung-chuan.liao@linux.intel.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soundwire/cadence_master.h | 2 --
+ drivers/soundwire/intel.c | 11 +++++++----
+ 2 files changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/soundwire/cadence_master.h b/drivers/soundwire/cadence_master.h
+index dec0b4f993c1a..6f0092deea4b5 100644
+--- a/drivers/soundwire/cadence_master.h
++++ b/drivers/soundwire/cadence_master.h
+@@ -84,7 +84,6 @@ struct sdw_cdns_stream_config {
+ * @bus: Bus handle
+ * @stream_type: Stream type
+ * @link_id: Master link id
+- * @hw_params: hw_params to be applied in .prepare step
+ * @suspended: status set when suspended, to be used in .prepare
+ * @paused: status set in .trigger, to be used in suspend
+ * @direction: stream direction
+@@ -96,7 +95,6 @@ struct sdw_cdns_dai_runtime {
+ struct sdw_bus *bus;
+ enum sdw_stream_type stream_type;
+ int link_id;
+- struct snd_pcm_hw_params *hw_params;
+ bool suspended;
+ bool paused;
+ int direction;
+diff --git a/drivers/soundwire/intel.c b/drivers/soundwire/intel.c
+index 2651767272c73..0e26aafd403bb 100644
+--- a/drivers/soundwire/intel.c
++++ b/drivers/soundwire/intel.c
+@@ -817,7 +817,6 @@ static int intel_hw_params(struct snd_pcm_substream *substream,
+ dai_runtime->paused = false;
+ dai_runtime->suspended = false;
+ dai_runtime->pdi = pdi;
+- dai_runtime->hw_params = params;
+
+ /* Inform DSP about PDI stream number */
+ ret = intel_params_stream(sdw, substream->stream, dai, params,
+@@ -870,6 +869,11 @@ static int intel_prepare(struct snd_pcm_substream *substream,
+ }
+
+ if (dai_runtime->suspended) {
++ struct snd_soc_pcm_runtime *rtd = asoc_substream_to_rtd(substream);
++ struct snd_pcm_hw_params *hw_params;
++
++ hw_params = &rtd->dpcm[substream->stream].hw_params;
++
+ dai_runtime->suspended = false;
+
+ /*
+@@ -881,7 +885,7 @@ static int intel_prepare(struct snd_pcm_substream *substream,
+ */
+
+ /* configure stream */
+- ch = params_channels(dai_runtime->hw_params);
++ ch = params_channels(hw_params);
+ if (substream->stream == SNDRV_PCM_STREAM_CAPTURE)
+ dir = SDW_DATA_DIR_RX;
+ else
+@@ -893,7 +897,7 @@ static int intel_prepare(struct snd_pcm_substream *substream,
+
+ /* Inform DSP about PDI stream number */
+ ret = intel_params_stream(sdw, substream->stream, dai,
+- dai_runtime->hw_params,
++ hw_params,
+ sdw->instance,
+ dai_runtime->pdi->intel_alh_id);
+ }
+@@ -932,7 +936,6 @@ intel_hw_free(struct snd_pcm_substream *substream, struct snd_soc_dai *dai)
+ return ret;
+ }
+
+- dai_runtime->hw_params = NULL;
+ dai_runtime->pdi = NULL;
+
+ return 0;
+--
+2.39.2
+
--- /dev/null
+From afc327a7856f666caef89940e80b98ec2603a07f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Mar 2023 09:42:30 +0100
+Subject: spi: atmel-quadspi: Don't leak clk enable count in pm resume
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit c18bbac353ffed50be134b0a2a059a2bd540c503 ]
+
+The pm resume call is supposed to enable two clocks. If the second enable
+fails the callback reports failure but doesn't undo the first enable.
+
+So call clk_disable() for the first clock when clk_enable() for the second
+one fails.
+
+Fixes: 4a2f83b7f780 ("spi: atmel-quadspi: add runtime pm support")
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Reviewed-by: Tudor Ambarus <tudor.ambarus@linaro.org>
+Link: https://lore.kernel.org/r/20230317084232.142257-2-u.kleine-koenig@pengutronix.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/atmel-quadspi.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/spi/atmel-quadspi.c b/drivers/spi/atmel-quadspi.c
+index f4632cb074954..0c6f80ddea577 100644
+--- a/drivers/spi/atmel-quadspi.c
++++ b/drivers/spi/atmel-quadspi.c
+@@ -786,7 +786,11 @@ static int __maybe_unused atmel_qspi_runtime_resume(struct device *dev)
+ if (ret)
+ return ret;
+
+- return clk_enable(aq->qspick);
++ ret = clk_enable(aq->qspick);
++ if (ret)
++ clk_disable(aq->pclk);
++
++ return ret;
+ }
+
+ static const struct dev_pm_ops __maybe_unused atmel_qspi_pm_ops = {
+--
+2.39.2
+
--- /dev/null
+From 6a10ba5641a9771fd3f45e50ae4ba6e609e588ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Mar 2023 09:42:31 +0100
+Subject: spi: atmel-quadspi: Free resources even if runtime resume failed in
+ .remove()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit 9448bc1dee65f86c0fe64d9dea8b410af0586886 ]
+
+An early error exit in atmel_qspi_remove() doesn't prevent the device
+unbind. So this results in an spi controller with an unbound parent
+and unmapped register space (because devm_ioremap_resource() is undone).
+So using the remaining spi controller probably results in an oops.
+
+Instead unregister the controller unconditionally and only skip hardware
+access and clk disable.
+
+Also add a warning about resume failing and return zero unconditionally.
+The latter has the only effect to suppress a less helpful error message by
+the spi core.
+
+Fixes: 4a2f83b7f780 ("spi: atmel-quadspi: add runtime pm support")
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Reviewed-by: Tudor Ambarus <tudor.ambarus@linaro.org>
+Link: https://lore.kernel.org/r/20230317084232.142257-3-u.kleine-koenig@pengutronix.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/atmel-quadspi.c | 24 +++++++++++++++++-------
+ 1 file changed, 17 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/spi/atmel-quadspi.c b/drivers/spi/atmel-quadspi.c
+index 0c6f80ddea577..713a4d6700fd0 100644
+--- a/drivers/spi/atmel-quadspi.c
++++ b/drivers/spi/atmel-quadspi.c
+@@ -706,18 +706,28 @@ static int atmel_qspi_remove(struct platform_device *pdev)
+ struct atmel_qspi *aq = spi_controller_get_devdata(ctrl);
+ int ret;
+
+- ret = pm_runtime_resume_and_get(&pdev->dev);
+- if (ret < 0)
+- return ret;
+-
+ spi_unregister_controller(ctrl);
+- atmel_qspi_write(QSPI_CR_QSPIDIS, aq, QSPI_CR);
++
++ ret = pm_runtime_get_sync(&pdev->dev);
++ if (ret >= 0) {
++ atmel_qspi_write(QSPI_CR_QSPIDIS, aq, QSPI_CR);
++ clk_disable(aq->qspick);
++ clk_disable(aq->pclk);
++ } else {
++ /*
++ * atmel_qspi_runtime_{suspend,resume} just disable and enable
++ * the two clks respectively. So after resume failed these are
++ * off, and we skip hardware access and disabling these clks again.
++ */
++ dev_warn(&pdev->dev, "Failed to resume device on remove\n");
++ }
++
++ clk_unprepare(aq->qspick);
++ clk_unprepare(aq->pclk);
+
+ pm_runtime_disable(&pdev->dev);
+ pm_runtime_put_noidle(&pdev->dev);
+
+- clk_disable_unprepare(aq->qspick);
+- clk_disable_unprepare(aq->pclk);
+ return 0;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 144474a4567761e9df8d0a78af4cba5d7c78ed23 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Apr 2023 17:46:15 +0530
+Subject: spi: bcm63xx: remove PM_SLEEP based conditional compilation
+
+From: Dhruva Gole <d-gole@ti.com>
+
+[ Upstream commit 25f0617109496e1aff49594fbae5644286447a0f ]
+
+Get rid of conditional compilation based on CONFIG_PM_SLEEP because
+it may introduce build issues with certain configs where it maybe disabled
+This is because if above config is not enabled the suspend-resume
+functions are never part of the code but the bcm63xx_spi_pm_ops struct
+still inits them to non-existent suspend-resume functions.
+
+Fixes: b42dfed83d95 ("spi: add Broadcom BCM63xx SPI controller driver")
+
+Signed-off-by: Dhruva Gole <d-gole@ti.com>
+Link: https://lore.kernel.org/r/20230420121615.967487-1-d-gole@ti.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-bcm63xx.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/spi/spi-bcm63xx.c b/drivers/spi/spi-bcm63xx.c
+index 787625ce700cb..d500fcbe2198f 100644
+--- a/drivers/spi/spi-bcm63xx.c
++++ b/drivers/spi/spi-bcm63xx.c
+@@ -629,7 +629,6 @@ static int bcm63xx_spi_remove(struct platform_device *pdev)
+ return 0;
+ }
+
+-#ifdef CONFIG_PM_SLEEP
+ static int bcm63xx_spi_suspend(struct device *dev)
+ {
+ struct spi_master *master = dev_get_drvdata(dev);
+@@ -656,7 +655,6 @@ static int bcm63xx_spi_resume(struct device *dev)
+
+ return 0;
+ }
+-#endif
+
+ static const struct dev_pm_ops bcm63xx_spi_pm_ops = {
+ SET_SYSTEM_SLEEP_PM_OPS(bcm63xx_spi_suspend, bcm63xx_spi_resume)
+--
+2.39.2
+
--- /dev/null
+From 54895ddb3ba888ede17527b70730745d99123fec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Apr 2023 14:40:27 +0530
+Subject: spi: cadence-quadspi: fix suspend-resume implementations
+
+From: Dhruva Gole <d-gole@ti.com>
+
+[ Upstream commit 2087e85bb66ee3652dafe732bb9b9b896229eafc ]
+
+The cadence QSPI driver misbehaves after performing a full system suspend
+resume:
+...
+spi-nor spi0.0: resume() failed
+...
+This results in a flash connected via OSPI interface after system suspend-
+resume to be unusable.
+fix these suspend and resume functions.
+
+Fixes: 140623410536 ("mtd: spi-nor: Add driver for Cadence Quad SPI Flash Controller")
+Signed-off-by: Dhruva Gole <d-gole@ti.com>
+Link: https://lore.kernel.org/r/20230417091027.966146-3-d-gole@ti.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-cadence-quadspi.c | 19 ++++++++++++++++---
+ 1 file changed, 16 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/spi/spi-cadence-quadspi.c b/drivers/spi/spi-cadence-quadspi.c
+index fb6d85fd2e864..aab9d6a8ead90 100644
+--- a/drivers/spi/spi-cadence-quadspi.c
++++ b/drivers/spi/spi-cadence-quadspi.c
+@@ -1807,17 +1807,30 @@ static int cqspi_remove(struct platform_device *pdev)
+ static int cqspi_suspend(struct device *dev)
+ {
+ struct cqspi_st *cqspi = dev_get_drvdata(dev);
++ struct spi_master *master = dev_get_drvdata(dev);
++ int ret;
+
++ ret = spi_master_suspend(master);
+ cqspi_controller_enable(cqspi, 0);
+- return 0;
++
++ clk_disable_unprepare(cqspi->clk);
++
++ return ret;
+ }
+
+ static int cqspi_resume(struct device *dev)
+ {
+ struct cqspi_st *cqspi = dev_get_drvdata(dev);
++ struct spi_master *master = dev_get_drvdata(dev);
+
+- cqspi_controller_enable(cqspi, 1);
+- return 0;
++ clk_prepare_enable(cqspi->clk);
++ cqspi_wait_idle(cqspi);
++ cqspi_controller_init(cqspi);
++
++ cqspi->current_cs = -1;
++ cqspi->sclk = 0;
++
++ return spi_master_resume(master);
+ }
+
+ static const struct dev_pm_ops cqspi__dev_pm_ops = {
+--
+2.39.2
+
--- /dev/null
+From c0694f3c8164d8753edbb62009498799ecb1dece Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Apr 2023 11:12:57 +0530
+Subject: spi: cadence-quadspi: use macro DEFINE_SIMPLE_DEV_PM_OPS
+
+From: Dhruva Gole <d-gole@ti.com>
+
+[ Upstream commit be3206e8906e7a93df673ab2e96d69304a008edc ]
+
+Using this macro makes the code more readable.
+It also inits the members of dev_pm_ops in the following manner
+without us explicitly needing to:
+
+.suspend = cqspi_suspend, \
+.resume = cqspi_resume, \
+.freeze = cqspi_suspend, \
+.thaw = cqspi_resume, \
+.poweroff = cqspi_suspend, \
+.restore = cqspi_resume
+
+Also get rid of conditional compilation based on CONFIG_PM_SLEEP because
+it introduces build issues with certain configs when CQSPI_DEV_PM_OPS is
+just NULL.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Link: https://lore.kernel.org/oe-kbuild-all/202304191900.2fARFQW9-lkp@intel.com/
+Fixes: 140623410536 ("mtd: spi-nor: Add driver for Cadence Quad SPI Flash Controller")
+Signed-off-by: Dhruva Gole <d-gole@ti.com>
+Link: https://lore.kernel.org/r/20230420054257.925092-1-d-gole@ti.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-cadence-quadspi.c | 13 ++-----------
+ 1 file changed, 2 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/spi/spi-cadence-quadspi.c b/drivers/spi/spi-cadence-quadspi.c
+index aab9d6a8ead90..6b49d9f650b8b 100644
+--- a/drivers/spi/spi-cadence-quadspi.c
++++ b/drivers/spi/spi-cadence-quadspi.c
+@@ -1803,7 +1803,6 @@ static int cqspi_remove(struct platform_device *pdev)
+ return 0;
+ }
+
+-#ifdef CONFIG_PM_SLEEP
+ static int cqspi_suspend(struct device *dev)
+ {
+ struct cqspi_st *cqspi = dev_get_drvdata(dev);
+@@ -1833,15 +1832,7 @@ static int cqspi_resume(struct device *dev)
+ return spi_master_resume(master);
+ }
+
+-static const struct dev_pm_ops cqspi__dev_pm_ops = {
+- .suspend = cqspi_suspend,
+- .resume = cqspi_resume,
+-};
+-
+-#define CQSPI_DEV_PM_OPS (&cqspi__dev_pm_ops)
+-#else
+-#define CQSPI_DEV_PM_OPS NULL
+-#endif
++static DEFINE_SIMPLE_DEV_PM_OPS(cqspi_dev_pm_ops, cqspi_suspend, cqspi_resume);
+
+ static const struct cqspi_driver_platdata cdns_qspi = {
+ .quirks = CQSPI_DISABLE_DAC_MODE,
+@@ -1908,7 +1899,7 @@ static struct platform_driver cqspi_platform_driver = {
+ .remove = cqspi_remove,
+ .driver = {
+ .name = CQSPI_NAME,
+- .pm = CQSPI_DEV_PM_OPS,
++ .pm = &cqspi_dev_pm_ops,
+ .of_match_table = cqspi_dt_ids,
+ },
+ };
+--
+2.39.2
+
--- /dev/null
+From 16d1263894186dcebe1dceac6c2e52f4f8f364c0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Mar 2023 11:58:37 +0100
+Subject: spi: Constify spi parameters of chip select APIs
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit d2f19eec510424caa55ea949f016ddabe2d8173a ]
+
+The "spi" parameters of spi_get_chipselect() and spi_get_csgpiod() can
+be const.
+
+Fixes: 303feb3cc06ac066 ("spi: Add APIs in spi core to set/get spi->chip_select and spi->cs_gpiod")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/b112de79e7a1e9095a3b6ff22b639f39e39d7748.1678704562.git.geert+renesas@glider.be
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/spi/spi.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/include/linux/spi/spi.h b/include/linux/spi/spi.h
+index 4fa26b9a35725..509bd620a258c 100644
+--- a/include/linux/spi/spi.h
++++ b/include/linux/spi/spi.h
+@@ -266,7 +266,7 @@ static inline void *spi_get_drvdata(struct spi_device *spi)
+ return dev_get_drvdata(&spi->dev);
+ }
+
+-static inline u8 spi_get_chipselect(struct spi_device *spi, u8 idx)
++static inline u8 spi_get_chipselect(const struct spi_device *spi, u8 idx)
+ {
+ return spi->chip_select;
+ }
+@@ -276,7 +276,7 @@ static inline void spi_set_chipselect(struct spi_device *spi, u8 idx, u8 chipsel
+ spi->chip_select = chipselect;
+ }
+
+-static inline struct gpio_desc *spi_get_csgpiod(struct spi_device *spi, u8 idx)
++static inline struct gpio_desc *spi_get_csgpiod(const struct spi_device *spi, u8 idx)
+ {
+ return spi->cs_gpiod;
+ }
+--
+2.39.2
+
--- /dev/null
+From 4f3262177a081746a12509bb892aab58502fd4ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Mar 2023 11:31:01 +0900
+Subject: spi: f_ospi: Add missing spi_mem_default_supports_op() helper
+
+From: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
+
+[ Upstream commit bc43c5ec1a97772269785d19f62d32c91ac5fc36 ]
+
+The .supports_op() callback function returns true by default after
+performing driver-specific checks. Therefore the driver cannot apply
+the buswidth in devicetree.
+
+Call spi_mem_default_supports_op() helper to handle the buswidth
+in devicetree.
+
+Fixes: 1b74dd64c861 ("spi: Add Socionext F_OSPI SPI flash controller driver")
+Signed-off-by: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
+Link: https://lore.kernel.org/r/20230322023101.24490-1-hayashi.kunihiko@socionext.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-sn-f-ospi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-sn-f-ospi.c b/drivers/spi/spi-sn-f-ospi.c
+index 333b22dfd8dba..0aedade8908c4 100644
+--- a/drivers/spi/spi-sn-f-ospi.c
++++ b/drivers/spi/spi-sn-f-ospi.c
+@@ -561,7 +561,7 @@ static bool f_ospi_supports_op(struct spi_mem *mem,
+ if (!f_ospi_supports_op_width(mem, op))
+ return false;
+
+- return true;
++ return spi_mem_default_supports_op(mem, op);
+ }
+
+ static int f_ospi_adjust_op_size(struct spi_mem *mem, struct spi_mem_op *op)
+--
+2.39.2
+
--- /dev/null
+From b0f214030b9113adb2ef8294971022624b07cb5c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 1 Apr 2023 19:59:46 +0200
+Subject: spi: fsl-spi: Fix CPM/QE mode Litte Endian
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+[ Upstream commit c20c57d9868d7f9fd1b2904c7801b07e128f6322 ]
+
+CPM has the same problem as QE so for CPM also use the fix added
+by commit 0398fb70940e ("spi/spi_mpc8xxx: Fix QE mode Litte Endian"):
+
+ CPM mode uses Little Endian so words > 8 bits are byte swapped.
+ Workaround this by always enforcing wordsize 8 for 16 and 32 bits
+ words. Unfortunately this will not work for LSB transfers
+ where wordsize is > 8 bits so disable these for now.
+
+Also limit the workaround to 16 and 32 bits words because it can
+only work for multiples of 8-bits.
+
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Cc: Joakim Tjernlund <Joakim.Tjernlund@infinera.com>
+Fixes: 0398fb70940e ("spi/spi_mpc8xxx: Fix QE mode Litte Endian")
+Link: https://lore.kernel.org/r/1b7d3e84b1128f42c1887dd2fb9cdf390f541bc1.1680371809.git.christophe.leroy@csgroup.eu
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-fsl-spi.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/spi/spi-fsl-spi.c b/drivers/spi/spi-fsl-spi.c
+index 08fa6e38f4eba..cdaaf70cb20b8 100644
+--- a/drivers/spi/spi-fsl-spi.c
++++ b/drivers/spi/spi-fsl-spi.c
+@@ -181,8 +181,8 @@ static int mspi_apply_qe_mode_quirks(struct spi_mpc8xxx_cs *cs,
+ struct spi_device *spi,
+ int bits_per_word)
+ {
+- /* QE uses Little Endian for words > 8
+- * so transform all words > 8 into 8 bits
++ /* CPM/QE uses Little Endian for words > 8
++ * so transform 16 and 32 bits words into 8 bits
+ * Unfortnatly that doesn't work for LSB so
+ * reject these for now */
+ /* Note: 32 bits word, LSB works iff
+@@ -190,9 +190,11 @@ static int mspi_apply_qe_mode_quirks(struct spi_mpc8xxx_cs *cs,
+ if (spi->mode & SPI_LSB_FIRST &&
+ bits_per_word > 8)
+ return -EINVAL;
+- if (bits_per_word > 8)
++ if (bits_per_word <= 8)
++ return bits_per_word;
++ if (bits_per_word == 16 || bits_per_word == 32)
+ return 8; /* pretend its 8 bits */
+- return bits_per_word;
++ return -EINVAL;
+ }
+
+ static int fsl_spi_setup_transfer(struct spi_device *spi,
+@@ -222,7 +224,7 @@ static int fsl_spi_setup_transfer(struct spi_device *spi,
+ bits_per_word = mspi_apply_cpu_mode_quirks(cs, spi,
+ mpc8xxx_spi,
+ bits_per_word);
+- else if (mpc8xxx_spi->flags & SPI_QE)
++ else
+ bits_per_word = mspi_apply_qe_mode_quirks(cs, spi,
+ bits_per_word);
+
+--
+2.39.2
+
--- /dev/null
+From 57e13c6dce86acd8b3a6a915782a279b2c070113 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Mar 2023 07:57:32 +0100
+Subject: spi: imx: Don't skip cleanup in remove's error path
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit 11951c9e3f364d7ae3b568a0e52c8335d43066b5 ]
+
+Returning early in a platform driver's remove callback is wrong. In this
+case the dma resources are not released in the error path. this is never
+retried later and so this is a permanent leak. To fix this, only skip
+hardware disabling if waking the device fails.
+
+Fixes: d593574aff0a ("spi: imx: do not access registers while clocks disabled")
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Link: https://lore.kernel.org/r/20230306065733.2170662-2-u.kleine-koenig@pengutronix.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-imx.c | 12 +++++-------
+ 1 file changed, 5 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c
+index e4ccd0c329d06..6c9c87cd14cae 100644
+--- a/drivers/spi/spi-imx.c
++++ b/drivers/spi/spi-imx.c
+@@ -1856,13 +1856,11 @@ static int spi_imx_remove(struct platform_device *pdev)
+
+ spi_unregister_controller(controller);
+
+- ret = pm_runtime_resume_and_get(spi_imx->dev);
+- if (ret < 0) {
+- dev_err(spi_imx->dev, "failed to enable clock\n");
+- return ret;
+- }
+-
+- writel(0, spi_imx->base + MXC_CSPICTRL);
++ ret = pm_runtime_get_sync(spi_imx->dev);
++ if (ret >= 0)
++ writel(0, spi_imx->base + MXC_CSPICTRL);
++ else
++ dev_warn(spi_imx->dev, "failed to enable clock, skip hw disable\n");
+
+ pm_runtime_dont_use_autosuspend(spi_imx->dev);
+ pm_runtime_put_sync(spi_imx->dev);
+--
+2.39.2
+
--- /dev/null
+From 616ba9cb3c51c60b1683038f4f80dee71b239578 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Apr 2023 22:46:13 +0530
+Subject: spi: mchp-pci1xxxx: Fix improper implementation of disabling chip
+ select lines
+
+From: Tharun Kumar P <tharunkumar.pasumarthi@microchip.com>
+
+[ Upstream commit 45d2af82e0e6f662d0d0db20993b35cb1d8da646 ]
+
+Hardware does not have support to disable individual chip select lines.
+Disable all chip select lines by using SPI_FORCE_CE bit.
+
+Fixes: 1cc0cbea7167 ("spi: microchip: pci1xxxx: Add driver for SPI controller of PCI1XXXX PCIe switch")
+Signed-off-by: Tharun Kumar P <tharunkumar.pasumarthi@microchip.com>
+Link: https://lore.kernel.org/r/20230404171613.1336093-4-tharunkumar.pasumarthi@microchip.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-pci1xxxx.c | 17 +++++------------
+ 1 file changed, 5 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/spi/spi-pci1xxxx.c b/drivers/spi/spi-pci1xxxx.c
+index 82d4bfeea1fa4..4445d82409d6d 100644
+--- a/drivers/spi/spi-pci1xxxx.c
++++ b/drivers/spi/spi-pci1xxxx.c
+@@ -114,17 +114,14 @@ static void pci1xxxx_spi_set_cs(struct spi_device *spi, bool enable)
+
+ /* Set the DEV_SEL bits of the SPI_MST_CTL_REG */
+ regval = readl(par->reg_base + SPI_MST_CTL_REG_OFFSET(p->hw_inst));
+- if (enable) {
++ if (!enable) {
++ regval |= SPI_FORCE_CE;
+ regval &= ~SPI_MST_CTL_DEVSEL_MASK;
+ regval |= (spi_get_chipselect(spi, 0) << 25);
+- writel(regval,
+- par->reg_base + SPI_MST_CTL_REG_OFFSET(p->hw_inst));
+ } else {
+- regval &= ~(spi_get_chipselect(spi, 0) << 25);
+- writel(regval,
+- par->reg_base + SPI_MST_CTL_REG_OFFSET(p->hw_inst));
+-
++ regval &= ~SPI_FORCE_CE;
+ }
++ writel(regval, par->reg_base + SPI_MST_CTL_REG_OFFSET(p->hw_inst));
+ }
+
+ static u8 pci1xxxx_get_clock_div(u32 hz)
+@@ -199,7 +196,7 @@ static int pci1xxxx_spi_transfer_one(struct spi_controller *spi_ctlr,
+ else
+ regval &= ~SPI_MST_CTL_MODE_SEL;
+
+- regval |= ((clkdiv << 5) | SPI_FORCE_CE);
++ regval |= (clkdiv << 5);
+ regval &= ~SPI_MST_CTL_CMD_LEN_MASK;
+ regval |= (len << 8);
+ writel(regval, par->reg_base +
+@@ -223,10 +220,6 @@ static int pci1xxxx_spi_transfer_one(struct spi_controller *spi_ctlr,
+ }
+ }
+ }
+-
+- regval = readl(par->reg_base + SPI_MST_CTL_REG_OFFSET(p->hw_inst));
+- regval &= ~SPI_FORCE_CE;
+- writel(regval, par->reg_base + SPI_MST_CTL_REG_OFFSET(p->hw_inst));
+ p->spi_xfer_in_progress = false;
+
+ return 0;
+--
+2.39.2
+
--- /dev/null
+From c3a7a8d48f61ca178d06ecd1d722f36609b64a51 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Apr 2023 22:46:11 +0530
+Subject: spi: mchp-pci1xxxx: Fix length of SPI transactions not set properly
+ in driver
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Tharun Kumar P <tharunkumar.pasumarthi@microchip.com>
+
+[ Upstream commit 35c8c5e503a82e0a4bf251d32096211eba8c2be6 ]
+
+In pci1xxxx_spi_transfer_one API, length of SPI transaction gets cleared
+by setting of length mask. Set length of transaction only after masking
+length field.
+
+Fixes: 1cc0cbea7167 ("spi: microchip: pci1xxxx: Add driver for SPI controller of PCI1XXXX PCIe switch")
+Signed-off-by: Tharun Kumar P <tharunkumar.pasumarthi@microchip.com>
+Link: https://lore.kernel.org/r/20230404171613.1336093-2-tharunkumar.pasumarthi@microchip.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-pci1xxxx.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-pci1xxxx.c b/drivers/spi/spi-pci1xxxx.c
+index a31c3b612a430..0805c441b4065 100644
+--- a/drivers/spi/spi-pci1xxxx.c
++++ b/drivers/spi/spi-pci1xxxx.c
+@@ -199,8 +199,9 @@ static int pci1xxxx_spi_transfer_one(struct spi_controller *spi_ctlr,
+ else
+ regval &= ~SPI_MST_CTL_MODE_SEL;
+
+- regval |= ((clkdiv << 5) | SPI_FORCE_CE | (len << 8));
++ regval |= ((clkdiv << 5) | SPI_FORCE_CE);
+ regval &= ~SPI_MST_CTL_CMD_LEN_MASK;
++ regval |= (len << 8);
+ writel(regval, par->reg_base +
+ SPI_MST_CTL_REG_OFFSET(p->hw_inst));
+ regval = readl(par->reg_base +
+--
+2.39.2
+
--- /dev/null
+From 064f2cd3c936925982bdf415dae41151dbb653ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Apr 2023 22:46:12 +0530
+Subject: spi: mchp-pci1xxxx: Fix SPI transactions not working after suspend
+ and resume
+
+From: Tharun Kumar P <tharunkumar.pasumarthi@microchip.com>
+
+[ Upstream commit 4266d21669de62cf3fb6774f7d404c1eb95a5ab3 ]
+
+pci1xxxx_spi_resume API masks SPI interrupt bit which prohibits interrupt
+from coming to the host at the end of the transaction after suspend-resume.
+This patch unmasks this bit at resume.
+
+Fixes: 1cc0cbea7167 ("spi: microchip: pci1xxxx: Add driver for SPI controller of PCI1XXXX PCIe switch")
+Signed-off-by: Tharun Kumar P <tharunkumar.pasumarthi@microchip.com>
+Link: https://lore.kernel.org/r/20230404171613.1336093-3-tharunkumar.pasumarthi@microchip.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-pci1xxxx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-pci1xxxx.c b/drivers/spi/spi-pci1xxxx.c
+index 0805c441b4065..13efbfeff92ce 100644
+--- a/drivers/spi/spi-pci1xxxx.c
++++ b/drivers/spi/spi-pci1xxxx.c
+@@ -58,7 +58,7 @@
+ #define VENDOR_ID_MCHP 0x1055
+
+ #define SPI_SUSPEND_CONFIG 0x101
+-#define SPI_RESUME_CONFIG 0x303
++#define SPI_RESUME_CONFIG 0x203
+
+ struct pci1xxxx_spi_internal {
+ u8 hw_inst;
+--
+2.39.2
+
--- /dev/null
+From c30917f0e512f7b2a6becfb1a0b3e565a8df628f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Feb 2023 14:45:40 -0600
+Subject: spi: mpc5xxx-psc: Remove unused platform_data
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit 04725901d9933b3134e6dee6b5bc1efb67f8d43f ]
+
+The platform_data for the MPC5xxx PSC SPI controllers is never used, so
+remove it and the resulting code which depends on it.
+
+Signed-off-by: Rob Herring <robh@kernel.org>
+Link: https://lore.kernel.org/r/20230217-dt-mpc5xxx-spi-v1-1-3be8602fce1e@kernel.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Stable-dep-of: 45d2af82e0e6 ("spi: mchp-pci1xxxx: Fix improper implementation of disabling chip select lines")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-mpc512x-psc.c | 28 ++++---------------------
+ drivers/spi/spi-mpc52xx-psc.c | 39 +++--------------------------------
+ 2 files changed, 7 insertions(+), 60 deletions(-)
+
+diff --git a/drivers/spi/spi-mpc512x-psc.c b/drivers/spi/spi-mpc512x-psc.c
+index 03630359ce70d..0b4d49ef84de8 100644
+--- a/drivers/spi/spi-mpc512x-psc.c
++++ b/drivers/spi/spi-mpc512x-psc.c
+@@ -22,7 +22,6 @@
+ #include <linux/delay.h>
+ #include <linux/clk.h>
+ #include <linux/spi/spi.h>
+-#include <linux/fsl_devices.h>
+ #include <asm/mpc52xx_psc.h>
+
+ enum {
+@@ -51,8 +50,6 @@ enum {
+ __ret; })
+
+ struct mpc512x_psc_spi {
+- void (*cs_control)(struct spi_device *spi, bool on);
+-
+ /* driver internal data */
+ int type;
+ void __iomem *psc;
+@@ -128,26 +125,16 @@ static void mpc512x_psc_spi_activate_cs(struct spi_device *spi)
+ mps->bits_per_word = cs->bits_per_word;
+
+ if (spi->cs_gpiod) {
+- if (mps->cs_control)
+- /* boardfile override */
+- mps->cs_control(spi, (spi->mode & SPI_CS_HIGH) ? 1 : 0);
+- else
+- /* gpiolib will deal with the inversion */
+- gpiod_set_value(spi->cs_gpiod, 1);
++ /* gpiolib will deal with the inversion */
++ gpiod_set_value(spi->cs_gpiod, 1);
+ }
+ }
+
+ static void mpc512x_psc_spi_deactivate_cs(struct spi_device *spi)
+ {
+- struct mpc512x_psc_spi *mps = spi_master_get_devdata(spi->master);
+-
+ if (spi->cs_gpiod) {
+- if (mps->cs_control)
+- /* boardfile override */
+- mps->cs_control(spi, (spi->mode & SPI_CS_HIGH) ? 0 : 1);
+- else
+- /* gpiolib will deal with the inversion */
+- gpiod_set_value(spi->cs_gpiod, 0);
++ /* gpiolib will deal with the inversion */
++ gpiod_set_value(spi->cs_gpiod, 0);
+ }
+ }
+
+@@ -474,7 +461,6 @@ static irqreturn_t mpc512x_psc_spi_isr(int irq, void *dev_id)
+ static int mpc512x_psc_spi_do_probe(struct device *dev, u32 regaddr,
+ u32 size, unsigned int irq)
+ {
+- struct fsl_spi_platform_data *pdata = dev_get_platdata(dev);
+ struct mpc512x_psc_spi *mps;
+ struct spi_master *master;
+ int ret;
+@@ -490,12 +476,6 @@ static int mpc512x_psc_spi_do_probe(struct device *dev, u32 regaddr,
+ mps->type = (int)of_device_get_match_data(dev);
+ mps->irq = irq;
+
+- if (pdata) {
+- mps->cs_control = pdata->cs_control;
+- master->bus_num = pdata->bus_num;
+- master->num_chipselect = pdata->max_chipselect;
+- }
+-
+ master->mode_bits = SPI_CPOL | SPI_CPHA | SPI_CS_HIGH | SPI_LSB_FIRST;
+ master->setup = mpc512x_psc_spi_setup;
+ master->prepare_transfer_hardware = mpc512x_psc_spi_prep_xfer_hw;
+diff --git a/drivers/spi/spi-mpc52xx-psc.c b/drivers/spi/spi-mpc52xx-psc.c
+index 609311231e64b..604868df913c4 100644
+--- a/drivers/spi/spi-mpc52xx-psc.c
++++ b/drivers/spi/spi-mpc52xx-psc.c
+@@ -18,7 +18,6 @@
+ #include <linux/io.h>
+ #include <linux/delay.h>
+ #include <linux/spi/spi.h>
+-#include <linux/fsl_devices.h>
+ #include <linux/slab.h>
+ #include <linux/of_irq.h>
+
+@@ -28,10 +27,6 @@
+ #define MCLK 20000000 /* PSC port MClk in hz */
+
+ struct mpc52xx_psc_spi {
+- /* fsl_spi_platform data */
+- void (*cs_control)(struct spi_device *spi, bool on);
+- u32 sysclk;
+-
+ /* driver internal data */
+ struct mpc52xx_psc __iomem *psc;
+ struct mpc52xx_psc_fifo __iomem *fifo;
+@@ -101,17 +96,6 @@ static void mpc52xx_psc_spi_activate_cs(struct spi_device *spi)
+ ccr |= (MCLK / 1000000 - 1) & 0xFF;
+ out_be16((u16 __iomem *)&psc->ccr, ccr);
+ mps->bits_per_word = cs->bits_per_word;
+-
+- if (mps->cs_control)
+- mps->cs_control(spi, (spi->mode & SPI_CS_HIGH) ? 1 : 0);
+-}
+-
+-static void mpc52xx_psc_spi_deactivate_cs(struct spi_device *spi)
+-{
+- struct mpc52xx_psc_spi *mps = spi_master_get_devdata(spi->master);
+-
+- if (mps->cs_control)
+- mps->cs_control(spi, (spi->mode & SPI_CS_HIGH) ? 0 : 1);
+ }
+
+ #define MPC52xx_PSC_BUFSIZE (MPC52xx_PSC_RFNUM_MASK + 1)
+@@ -220,14 +204,9 @@ int mpc52xx_psc_spi_transfer_one_message(struct spi_controller *ctlr,
+ m->actual_length += t->len;
+
+ spi_transfer_delay_exec(t);
+-
+- if (cs_change)
+- mpc52xx_psc_spi_deactivate_cs(spi);
+ }
+
+ m->status = status;
+- if (status || !cs_change)
+- mpc52xx_psc_spi_deactivate_cs(spi);
+
+ mpc52xx_psc_spi_transfer_setup(spi, NULL);
+
+@@ -269,7 +248,7 @@ static int mpc52xx_psc_spi_port_config(int psc_id, struct mpc52xx_psc_spi *mps)
+ int ret;
+
+ /* default sysclk is 512MHz */
+- mclken_div = (mps->sysclk ? mps->sysclk : 512000000) / MCLK;
++ mclken_div = 512000000 / MCLK;
+ ret = mpc52xx_set_psc_clkdiv(psc_id, mclken_div);
+ if (ret)
+ return ret;
+@@ -317,7 +296,6 @@ static irqreturn_t mpc52xx_psc_spi_isr(int irq, void *dev_id)
+ static int mpc52xx_psc_spi_do_probe(struct device *dev, u32 regaddr,
+ u32 size, unsigned int irq, s16 bus_num)
+ {
+- struct fsl_spi_platform_data *pdata = dev_get_platdata(dev);
+ struct mpc52xx_psc_spi *mps;
+ struct spi_master *master;
+ int ret;
+@@ -333,19 +311,8 @@ static int mpc52xx_psc_spi_do_probe(struct device *dev, u32 regaddr,
+ master->mode_bits = SPI_CPOL | SPI_CPHA | SPI_CS_HIGH | SPI_LSB_FIRST;
+
+ mps->irq = irq;
+- if (pdata == NULL) {
+- dev_warn(dev,
+- "probe called without platform data, no cs_control function will be called\n");
+- mps->cs_control = NULL;
+- mps->sysclk = 0;
+- master->bus_num = bus_num;
+- master->num_chipselect = 255;
+- } else {
+- mps->cs_control = pdata->cs_control;
+- mps->sysclk = pdata->sysclk;
+- master->bus_num = pdata->bus_num;
+- master->num_chipselect = pdata->max_chipselect;
+- }
++ master->bus_num = bus_num;
++ master->num_chipselect = 255;
+ master->setup = mpc52xx_psc_spi_setup;
+ master->transfer_one_message = mpc52xx_psc_spi_transfer_one_message;
+ master->cleanup = mpc52xx_psc_spi_cleanup;
+--
+2.39.2
+
--- /dev/null
+From 0fa67937cad0325294f5f67ebce18571a95f1f54 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Mar 2023 23:03:40 +0200
+Subject: spi: qup: Don't skip cleanup in remove's error path
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit 61f49171a43ab1f80c73c5c88c508770c461e0f2 ]
+
+Returning early in a platform driver's remove callback is wrong. In this
+case the dma resources are not released in the error path. this is never
+retried later and so this is a permanent leak. To fix this, only skip
+hardware disabling if waking the device fails.
+
+Fixes: 64ff247a978f ("spi: Add Qualcomm QUP SPI controller support")
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Link: https://lore.kernel.org/r/20230330210341.2459548-2-u.kleine-koenig@pengutronix.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-qup.c | 22 +++++++++++++---------
+ 1 file changed, 13 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/spi/spi-qup.c b/drivers/spi/spi-qup.c
+index 678dc51ef0174..205e54f157b4a 100644
+--- a/drivers/spi/spi-qup.c
++++ b/drivers/spi/spi-qup.c
+@@ -1277,18 +1277,22 @@ static int spi_qup_remove(struct platform_device *pdev)
+ struct spi_qup *controller = spi_master_get_devdata(master);
+ int ret;
+
+- ret = pm_runtime_resume_and_get(&pdev->dev);
+- if (ret < 0)
+- return ret;
++ ret = pm_runtime_get_sync(&pdev->dev);
+
+- ret = spi_qup_set_state(controller, QUP_STATE_RESET);
+- if (ret)
+- return ret;
++ if (ret >= 0) {
++ ret = spi_qup_set_state(controller, QUP_STATE_RESET);
++ if (ret)
++ dev_warn(&pdev->dev, "failed to reset controller (%pe)\n",
++ ERR_PTR(ret));
+
+- spi_qup_release_dma(master);
++ clk_disable_unprepare(controller->cclk);
++ clk_disable_unprepare(controller->iclk);
++ } else {
++ dev_warn(&pdev->dev, "failed to resume, skip hw disable (%pe)\n",
++ ERR_PTR(ret));
++ }
+
+- clk_disable_unprepare(controller->cclk);
+- clk_disable_unprepare(controller->iclk);
++ spi_qup_release_dma(master);
+
+ pm_runtime_put_noidle(&pdev->dev);
+ pm_runtime_disable(&pdev->dev);
+--
+2.39.2
+
--- /dev/null
+From 37eb046d30e73ab12c596521b75a82ea5e97bbac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Mar 2023 23:02:03 +0530
+Subject: spi: Replace all spi->chip_select and spi->cs_gpiod references with
+ function call
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Amit Kumar Mahapatra via Alsa-devel <alsa-devel@alsa-project.org>
+
+[ Upstream commit 9e264f3f85a56cc109cc2d6010a48aa89d5c1ff1 ]
+
+Supporting multi-cs in spi drivers would require the chip_select & cs_gpiod
+members of struct spi_device to be an array. But changing the type of these
+members to array would break the spi driver functionality. To make the
+transition smoother introduced four new APIs to get/set the
+spi->chip_select & spi->cs_gpiod and replaced all spi->chip_select and
+spi->cs_gpiod references with get or set API calls.
+While adding multi-cs support in further patches the chip_select & cs_gpiod
+members of the spi_device structure would be converted to arrays & the
+"idx" parameter of the APIs would be used as array index i.e.,
+spi->chip_select[idx] & spi->cs_gpiod[idx] respectively.
+
+Signed-off-by: Amit Kumar Mahapatra <amit.kumar-mahapatra@amd.com>
+Acked-by: Heiko Stuebner <heiko@sntech.de> # Rockchip drivers
+Reviewed-by: Michal Simek <michal.simek@amd.com>
+Reviewed-by: Cédric Le Goater <clg@kaod.org> # Aspeed driver
+Reviewed-by: Dhruva Gole <d-gole@ti.com> # SPI Cadence QSPI
+Reviewed-by: Patrice Chotard <patrice.chotard@foss.st.com> # spi-stm32-qspi
+Acked-by: William Zhang <william.zhang@broadcom.com> # bcm63xx-hsspi driver
+Reviewed-by: Serge Semin <fancer.lancer@gmail.com> # DW SSI part
+Link: https://lore.kernel.org/r/167847070432.26.15076794204368669839@mailman-core.alsa-project.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Stable-dep-of: 45d2af82e0e6 ("spi: mchp-pci1xxxx: Fix improper implementation of disabling chip select lines")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-altera-core.c | 2 +-
+ drivers/spi/spi-amd.c | 4 ++--
+ drivers/spi/spi-ar934x.c | 2 +-
+ drivers/spi/spi-armada-3700.c | 4 ++--
+ drivers/spi/spi-aspeed-smc.c | 13 +++++++------
+ drivers/spi/spi-at91-usart.c | 2 +-
+ drivers/spi/spi-ath79.c | 4 ++--
+ drivers/spi/spi-atmel.c | 26 +++++++++++++-------------
+ drivers/spi/spi-au1550.c | 4 ++--
+ drivers/spi/spi-axi-spi-engine.c | 2 +-
+ drivers/spi/spi-bcm-qspi.c | 10 +++++-----
+ drivers/spi/spi-bcm2835.c | 19 ++++++++++---------
+ drivers/spi/spi-bcm2835aux.c | 4 ++--
+ drivers/spi/spi-bcm63xx-hsspi.c | 30 +++++++++++++++---------------
+ drivers/spi/spi-bcm63xx.c | 2 +-
+ drivers/spi/spi-bcmbca-hsspi.c | 30 +++++++++++++++---------------
+ drivers/spi/spi-cadence-quadspi.c | 5 +++--
+ drivers/spi/spi-cadence-xspi.c | 4 ++--
+ drivers/spi/spi-cadence.c | 4 ++--
+ drivers/spi/spi-cavium.c | 8 ++++----
+ drivers/spi/spi-coldfire-qspi.c | 8 ++++----
+ drivers/spi/spi-davinci.c | 18 +++++++++---------
+ drivers/spi/spi-dln2.c | 6 +++---
+ drivers/spi/spi-dw-core.c | 2 +-
+ drivers/spi/spi-dw-mmio.c | 4 ++--
+ drivers/spi/spi-falcon.c | 2 +-
+ drivers/spi/spi-fsi.c | 2 +-
+ drivers/spi/spi-fsl-dspi.c | 16 ++++++++--------
+ drivers/spi/spi-fsl-espi.c | 6 +++---
+ drivers/spi/spi-fsl-lpspi.c | 2 +-
+ drivers/spi/spi-fsl-qspi.c | 6 +++---
+ drivers/spi/spi-fsl-spi.c | 2 +-
+ drivers/spi/spi-geni-qcom.c | 6 +++---
+ drivers/spi/spi-gpio.c | 4 ++--
+ drivers/spi/spi-gxp.c | 4 ++--
+ drivers/spi/spi-hisi-sfc-v3xx.c | 2 +-
+ drivers/spi/spi-img-spfi.c | 14 +++++++-------
+ drivers/spi/spi-imx.c | 30 +++++++++++++++---------------
+ drivers/spi/spi-ingenic.c | 4 ++--
+ drivers/spi/spi-intel.c | 2 +-
+ drivers/spi/spi-jcore.c | 4 ++--
+ drivers/spi/spi-lantiq-ssc.c | 6 +++---
+ drivers/spi/spi-mem.c | 4 ++--
+ drivers/spi/spi-meson-spicc.c | 2 +-
+ drivers/spi/spi-microchip-core.c | 6 +++---
+ drivers/spi/spi-mpc512x-psc.c | 8 ++++----
+ drivers/spi/spi-mpc52xx.c | 2 +-
+ drivers/spi/spi-mt65xx.c | 6 +++---
+ drivers/spi/spi-mt7621.c | 2 +-
+ drivers/spi/spi-mux.c | 8 ++++----
+ drivers/spi/spi-mxic.c | 10 +++++-----
+ drivers/spi/spi-mxs.c | 2 +-
+ drivers/spi/spi-npcm-fiu.c | 20 ++++++++++----------
+ drivers/spi/spi-nxp-fspi.c | 10 +++++-----
+ drivers/spi/spi-omap-uwire.c | 8 ++++----
+ drivers/spi/spi-omap2-mcspi.c | 24 ++++++++++++------------
+ drivers/spi/spi-orion.c | 4 ++--
+ drivers/spi/spi-pci1xxxx.c | 4 ++--
+ drivers/spi/spi-pic32-sqi.c | 2 +-
+ drivers/spi/spi-pic32.c | 4 ++--
+ drivers/spi/spi-pl022.c | 4 ++--
+ drivers/spi/spi-pxa2xx.c | 6 +++---
+ drivers/spi/spi-qcom-qspi.c | 2 +-
+ drivers/spi/spi-rb4xx.c | 2 +-
+ drivers/spi/spi-rockchip-sfc.c | 2 +-
+ drivers/spi/spi-rockchip.c | 26 ++++++++++++++------------
+ drivers/spi/spi-rspi.c | 10 +++++-----
+ drivers/spi/spi-s3c64xx.c | 2 +-
+ drivers/spi/spi-sc18is602.c | 4 ++--
+ drivers/spi/spi-sh-msiof.c | 6 +++---
+ drivers/spi/spi-sh-sci.c | 2 +-
+ drivers/spi/spi-sifive.c | 6 +++---
+ drivers/spi/spi-sn-f-ospi.c | 2 +-
+ drivers/spi/spi-st-ssc4.c | 2 +-
+ drivers/spi/spi-stm32-qspi.c | 12 ++++++------
+ drivers/spi/spi-sun4i.c | 2 +-
+ drivers/spi/spi-sun6i.c | 2 +-
+ drivers/spi/spi-synquacer.c | 6 +++---
+ drivers/spi/spi-tegra114.c | 28 ++++++++++++++--------------
+ drivers/spi/spi-tegra20-sflash.c | 2 +-
+ drivers/spi/spi-tegra20-slink.c | 6 +++---
+ drivers/spi/spi-tegra210-quad.c | 8 ++++----
+ drivers/spi/spi-ti-qspi.c | 16 ++++++++--------
+ drivers/spi/spi-topcliff-pch.c | 4 ++--
+ drivers/spi/spi-wpcm-fiu.c | 12 ++++++------
+ drivers/spi/spi-xcomm.c | 2 +-
+ drivers/spi/spi-xilinx.c | 6 +++---
+ drivers/spi/spi-xlp.c | 4 ++--
+ drivers/spi/spi-zynq-qspi.c | 2 +-
+ drivers/spi/spi-zynqmp-gqspi.c | 2 +-
+ drivers/spi/spidev.c | 6 +++---
+ include/trace/events/spi.h | 10 +++++-----
+ 92 files changed, 333 insertions(+), 328 deletions(-)
+
+diff --git a/drivers/spi/spi-altera-core.c b/drivers/spi/spi-altera-core.c
+index 94fe6bf1b9a6a..87e37f48f196e 100644
+--- a/drivers/spi/spi-altera-core.c
++++ b/drivers/spi/spi-altera-core.c
+@@ -80,7 +80,7 @@ static void altera_spi_set_cs(struct spi_device *spi, bool is_high)
+ altr_spi_writel(hw, ALTERA_SPI_TARGET_SEL, 0);
+ } else {
+ altr_spi_writel(hw, ALTERA_SPI_TARGET_SEL,
+- BIT(spi->chip_select));
++ BIT(spi_get_chipselect(spi, 0)));
+ hw->imr |= ALTERA_SPI_CONTROL_SSO_MSK;
+ altr_spi_writel(hw, ALTERA_SPI_CONTROL, hw->imr);
+ }
+diff --git a/drivers/spi/spi-amd.c b/drivers/spi/spi-amd.c
+index bfc3ab5f39eaa..fecead757a3cd 100644
+--- a/drivers/spi/spi-amd.c
++++ b/drivers/spi/spi-amd.c
+@@ -347,7 +347,7 @@ static inline int amd_spi_fifo_xfer(struct amd_spi *amd_spi,
+ case AMD_SPI_V1:
+ break;
+ case AMD_SPI_V2:
+- amd_spi_clear_chip(amd_spi, message->spi->chip_select);
++ amd_spi_clear_chip(amd_spi, spi_get_chipselect(message->spi, 0));
+ break;
+ default:
+ return -ENODEV;
+@@ -364,7 +364,7 @@ static int amd_spi_master_transfer(struct spi_master *master,
+ struct amd_spi *amd_spi = spi_master_get_devdata(master);
+ struct spi_device *spi = msg->spi;
+
+- amd_spi_select_chip(amd_spi, spi->chip_select);
++ amd_spi_select_chip(amd_spi, spi_get_chipselect(spi, 0));
+
+ /*
+ * Extract spi_transfers from the spi message and
+diff --git a/drivers/spi/spi-ar934x.c b/drivers/spi/spi-ar934x.c
+index 4a6ecaa0a9c9c..41ef6cf5c5851 100644
+--- a/drivers/spi/spi-ar934x.c
++++ b/drivers/spi/spi-ar934x.c
+@@ -125,7 +125,7 @@ static int ar934x_spi_transfer_one_message(struct spi_controller *ctlr,
+ iowrite32(reg, sp->base + AR934X_SPI_DATAOUT);
+ }
+
+- reg = AR934X_SPI_SHIFT_VAL(spi->chip_select, term,
++ reg = AR934X_SPI_SHIFT_VAL(spi_get_chipselect(spi, 0), term,
+ trx_cur * 8);
+ iowrite32(reg, sp->base + AR934X_SPI_REG_SHIFT_CTRL);
+ stat = readl_poll_timeout(
+diff --git a/drivers/spi/spi-armada-3700.c b/drivers/spi/spi-armada-3700.c
+index 4d554b948d711..8584045fc17bb 100644
+--- a/drivers/spi/spi-armada-3700.c
++++ b/drivers/spi/spi-armada-3700.c
+@@ -437,9 +437,9 @@ static void a3700_spi_set_cs(struct spi_device *spi, bool enable)
+ struct a3700_spi *a3700_spi = spi_controller_get_devdata(spi->controller);
+
+ if (!enable)
+- a3700_spi_activate_cs(a3700_spi, spi->chip_select);
++ a3700_spi_activate_cs(a3700_spi, spi_get_chipselect(spi, 0));
+ else
+- a3700_spi_deactivate_cs(a3700_spi, spi->chip_select);
++ a3700_spi_deactivate_cs(a3700_spi, spi_get_chipselect(spi, 0));
+ }
+
+ static void a3700_spi_header_set(struct a3700_spi *a3700_spi)
+diff --git a/drivers/spi/spi-aspeed-smc.c b/drivers/spi/spi-aspeed-smc.c
+index 873ff2cf72c9d..b7a9ec550ba16 100644
+--- a/drivers/spi/spi-aspeed-smc.c
++++ b/drivers/spi/spi-aspeed-smc.c
+@@ -296,7 +296,7 @@ static const struct aspeed_spi_data ast2400_spi_data;
+ static int do_aspeed_spi_exec_op(struct spi_mem *mem, const struct spi_mem_op *op)
+ {
+ struct aspeed_spi *aspi = spi_controller_get_devdata(mem->spi->master);
+- struct aspeed_spi_chip *chip = &aspi->chips[mem->spi->chip_select];
++ struct aspeed_spi_chip *chip = &aspi->chips[spi_get_chipselect(mem->spi, 0)];
+ u32 addr_mode, addr_mode_backup;
+ u32 ctl_val;
+ int ret = 0;
+@@ -377,7 +377,8 @@ static const char *aspeed_spi_get_name(struct spi_mem *mem)
+ struct aspeed_spi *aspi = spi_controller_get_devdata(mem->spi->master);
+ struct device *dev = aspi->dev;
+
+- return devm_kasprintf(dev, GFP_KERNEL, "%s.%d", dev_name(dev), mem->spi->chip_select);
++ return devm_kasprintf(dev, GFP_KERNEL, "%s.%d", dev_name(dev),
++ spi_get_chipselect(mem->spi, 0));
+ }
+
+ struct aspeed_spi_window {
+@@ -553,7 +554,7 @@ static int aspeed_spi_do_calibration(struct aspeed_spi_chip *chip);
+ static int aspeed_spi_dirmap_create(struct spi_mem_dirmap_desc *desc)
+ {
+ struct aspeed_spi *aspi = spi_controller_get_devdata(desc->mem->spi->master);
+- struct aspeed_spi_chip *chip = &aspi->chips[desc->mem->spi->chip_select];
++ struct aspeed_spi_chip *chip = &aspi->chips[spi_get_chipselect(desc->mem->spi, 0)];
+ struct spi_mem_op *op = &desc->info.op_tmpl;
+ u32 ctl_val;
+ int ret = 0;
+@@ -620,7 +621,7 @@ static ssize_t aspeed_spi_dirmap_read(struct spi_mem_dirmap_desc *desc,
+ u64 offset, size_t len, void *buf)
+ {
+ struct aspeed_spi *aspi = spi_controller_get_devdata(desc->mem->spi->master);
+- struct aspeed_spi_chip *chip = &aspi->chips[desc->mem->spi->chip_select];
++ struct aspeed_spi_chip *chip = &aspi->chips[spi_get_chipselect(desc->mem->spi, 0)];
+
+ /* Switch to USER command mode if mapping window is too small */
+ if (chip->ahb_window_size < offset + len) {
+@@ -670,7 +671,7 @@ static int aspeed_spi_setup(struct spi_device *spi)
+ {
+ struct aspeed_spi *aspi = spi_controller_get_devdata(spi->master);
+ const struct aspeed_spi_data *data = aspi->data;
+- unsigned int cs = spi->chip_select;
++ unsigned int cs = spi_get_chipselect(spi, 0);
+ struct aspeed_spi_chip *chip = &aspi->chips[cs];
+
+ chip->aspi = aspi;
+@@ -697,7 +698,7 @@ static int aspeed_spi_setup(struct spi_device *spi)
+ static void aspeed_spi_cleanup(struct spi_device *spi)
+ {
+ struct aspeed_spi *aspi = spi_controller_get_devdata(spi->master);
+- unsigned int cs = spi->chip_select;
++ unsigned int cs = spi_get_chipselect(spi, 0);
+
+ aspeed_spi_chip_enable(aspi, cs, false);
+
+diff --git a/drivers/spi/spi-at91-usart.c b/drivers/spi/spi-at91-usart.c
+index fab9d223e24a0..ca05c42ae4a5f 100644
+--- a/drivers/spi/spi-at91-usart.c
++++ b/drivers/spi/spi-at91-usart.c
+@@ -390,7 +390,7 @@ static int at91_usart_spi_setup(struct spi_device *spi)
+
+ dev_dbg(&spi->dev,
+ "setup: bpw %u mode 0x%x -> mr %d %08x\n",
+- spi->bits_per_word, spi->mode, spi->chip_select, mr);
++ spi->bits_per_word, spi->mode, spi_get_chipselect(spi, 0), mr);
+
+ return 0;
+ }
+diff --git a/drivers/spi/spi-ath79.c b/drivers/spi/spi-ath79.c
+index 795e88dbef1bd..6c2001cfa3d11 100644
+--- a/drivers/spi/spi-ath79.c
++++ b/drivers/spi/spi-ath79.c
+@@ -71,7 +71,7 @@ static void ath79_spi_chipselect(struct spi_device *spi, int is_active)
+ {
+ struct ath79_spi *sp = ath79_spidev_to_sp(spi);
+ int cs_high = (spi->mode & SPI_CS_HIGH) ? is_active : !is_active;
+- u32 cs_bit = AR71XX_SPI_IOC_CS(spi->chip_select);
++ u32 cs_bit = AR71XX_SPI_IOC_CS(spi_get_chipselect(spi, 0));
+
+ if (cs_high)
+ sp->ioc_base |= cs_bit;
+@@ -140,7 +140,7 @@ static int ath79_exec_mem_op(struct spi_mem *mem,
+ struct ath79_spi *sp = ath79_spidev_to_sp(mem->spi);
+
+ /* Ensures that reading is performed on device connected to hardware cs0 */
+- if (mem->spi->chip_select || mem->spi->cs_gpiod)
++ if (spi_get_chipselect(mem->spi, 0) || spi_get_csgpiod(mem->spi, 0))
+ return -ENOTSUPP;
+
+ /* Only use for fast-read op. */
+diff --git a/drivers/spi/spi-atmel.c b/drivers/spi/spi-atmel.c
+index 5c5678f065f33..7b17604a77608 100644
+--- a/drivers/spi/spi-atmel.c
++++ b/drivers/spi/spi-atmel.c
+@@ -327,10 +327,10 @@ static void cs_activate(struct atmel_spi *as, struct spi_device *spi)
+ int chip_select;
+ u32 mr;
+
+- if (spi->cs_gpiod)
++ if (spi_get_csgpiod(spi, 0))
+ chip_select = as->native_cs_for_gpio;
+ else
+- chip_select = spi->chip_select;
++ chip_select = spi_get_chipselect(spi, 0);
+
+ if (atmel_spi_is_v2(as)) {
+ spi_writel(as, CSR0 + 4 * chip_select, asd->csr);
+@@ -378,10 +378,10 @@ static void cs_deactivate(struct atmel_spi *as, struct spi_device *spi)
+ int chip_select;
+ u32 mr;
+
+- if (spi->cs_gpiod)
++ if (spi_get_csgpiod(spi, 0))
+ chip_select = as->native_cs_for_gpio;
+ else
+- chip_select = spi->chip_select;
++ chip_select = spi_get_chipselect(spi, 0);
+
+ /* only deactivate *this* device; sometimes transfers to
+ * another device may be active when this routine is called.
+@@ -394,7 +394,7 @@ static void cs_deactivate(struct atmel_spi *as, struct spi_device *spi)
+
+ dev_dbg(&spi->dev, "DEactivate NPCS, mr %08x\n", mr);
+
+- if (!spi->cs_gpiod)
++ if (!spi_get_csgpiod(spi, 0))
+ spi_writel(as, CR, SPI_BIT(LASTXFER));
+ }
+
+@@ -800,10 +800,10 @@ static int atmel_spi_set_xfer_speed(struct atmel_spi *as,
+ unsigned long bus_hz;
+ int chip_select;
+
+- if (spi->cs_gpiod)
++ if (spi_get_csgpiod(spi, 0))
+ chip_select = as->native_cs_for_gpio;
+ else
+- chip_select = spi->chip_select;
++ chip_select = spi_get_chipselect(spi, 0);
+
+ /* v1 chips start out at half the peripheral bus speed. */
+ bus_hz = as->spi_clk;
+@@ -1189,7 +1189,7 @@ static int atmel_spi_setup(struct spi_device *spi)
+ as = spi_controller_get_devdata(spi->controller);
+
+ /* see notes above re chipselect */
+- if (!spi->cs_gpiod && (spi->mode & SPI_CS_HIGH)) {
++ if (!spi_get_csgpiod(spi, 0) && (spi->mode & SPI_CS_HIGH)) {
+ dev_warn(&spi->dev, "setup: non GPIO CS can't be active-high\n");
+ return -EINVAL;
+ }
+@@ -1201,16 +1201,16 @@ static int atmel_spi_setup(struct spi_device *spi)
+ */
+ initialize_native_cs_for_gpio(as);
+
+- if (spi->cs_gpiod && as->native_cs_free) {
++ if (spi_get_csgpiod(spi, 0) && as->native_cs_free) {
+ dev_err(&spi->dev,
+ "No native CS available to support this GPIO CS\n");
+ return -EBUSY;
+ }
+
+- if (spi->cs_gpiod)
++ if (spi_get_csgpiod(spi, 0))
+ chip_select = as->native_cs_for_gpio;
+ else
+- chip_select = spi->chip_select;
++ chip_select = spi_get_chipselect(spi, 0);
+
+ csr = SPI_BF(BITS, bits - 8);
+ if (spi->mode & SPI_CPOL)
+@@ -1218,7 +1218,7 @@ static int atmel_spi_setup(struct spi_device *spi)
+ if (!(spi->mode & SPI_CPHA))
+ csr |= SPI_BIT(NCPHA);
+
+- if (!spi->cs_gpiod)
++ if (!spi_get_csgpiod(spi, 0))
+ csr |= SPI_BIT(CSAAT);
+ csr |= SPI_BF(DLYBS, 0);
+
+@@ -1244,7 +1244,7 @@ static int atmel_spi_setup(struct spi_device *spi)
+
+ dev_dbg(&spi->dev,
+ "setup: bpw %u mode 0x%x -> csr%d %08x\n",
+- bits, spi->mode, spi->chip_select, csr);
++ bits, spi->mode, spi_get_chipselect(spi, 0), csr);
+
+ if (!atmel_spi_is_v2(as))
+ spi_writel(as, CSR0 + 4 * chip_select, csr);
+diff --git a/drivers/spi/spi-au1550.c b/drivers/spi/spi-au1550.c
+index e008761298da4..da713cdfe0870 100644
+--- a/drivers/spi/spi-au1550.c
++++ b/drivers/spi/spi-au1550.c
+@@ -166,7 +166,7 @@ static void au1550_spi_chipsel(struct spi_device *spi, int value)
+ switch (value) {
+ case BITBANG_CS_INACTIVE:
+ if (hw->pdata->deactivate_cs)
+- hw->pdata->deactivate_cs(hw->pdata, spi->chip_select,
++ hw->pdata->deactivate_cs(hw->pdata, spi_get_chipselect(spi, 0),
+ cspol);
+ break;
+
+@@ -211,7 +211,7 @@ static void au1550_spi_chipsel(struct spi_device *spi, int value)
+ } while ((stat & PSC_SPISTAT_DR) == 0);
+
+ if (hw->pdata->activate_cs)
+- hw->pdata->activate_cs(hw->pdata, spi->chip_select,
++ hw->pdata->activate_cs(hw->pdata, spi_get_chipselect(spi, 0),
+ cspol);
+ break;
+ }
+diff --git a/drivers/spi/spi-axi-spi-engine.c b/drivers/spi/spi-axi-spi-engine.c
+index 80c3e38f5c1b5..1ff28784cfbb6 100644
+--- a/drivers/spi/spi-axi-spi-engine.c
++++ b/drivers/spi/spi-axi-spi-engine.c
+@@ -193,7 +193,7 @@ static void spi_engine_gen_cs(struct spi_engine_program *p, bool dry,
+ unsigned int mask = 0xff;
+
+ if (assert)
+- mask ^= BIT(spi->chip_select);
++ mask ^= BIT(spi_get_chipselect(spi, 0));
+
+ spi_engine_program_add_cmd(p, dry, SPI_ENGINE_CMD_ASSERT(1, mask));
+ }
+diff --git a/drivers/spi/spi-bcm-qspi.c b/drivers/spi/spi-bcm-qspi.c
+index 0eee574d3e1f2..7c2f1d1fb3f70 100644
+--- a/drivers/spi/spi-bcm-qspi.c
++++ b/drivers/spi/spi-bcm-qspi.c
+@@ -986,7 +986,7 @@ static int write_to_hw(struct bcm_qspi *qspi, struct spi_device *spi)
+ if (has_bspi(qspi))
+ mspi_cdram &= ~1;
+ else
+- mspi_cdram |= (~(1 << spi->chip_select) &
++ mspi_cdram |= (~(1 << spi_get_chipselect(spi, 0)) &
+ MSPI_CDRAM_PCS);
+
+ write_cdram_slot(qspi, slot, mspi_cdram);
+@@ -1046,8 +1046,8 @@ static int bcm_qspi_bspi_exec_mem_op(struct spi_device *spi,
+ return -EIO;
+
+ from = op->addr.val;
+- if (!spi->cs_gpiod)
+- bcm_qspi_chip_select(qspi, spi->chip_select);
++ if (!spi_get_csgpiod(spi, 0))
++ bcm_qspi_chip_select(qspi, spi_get_chipselect(spi, 0));
+ bcm_qspi_write(qspi, MSPI, MSPI_WRITE_LOCK, 0);
+
+ /*
+@@ -1126,8 +1126,8 @@ static int bcm_qspi_transfer_one(struct spi_master *master,
+ int slots;
+ unsigned long timeo = msecs_to_jiffies(100);
+
+- if (!spi->cs_gpiod)
+- bcm_qspi_chip_select(qspi, spi->chip_select);
++ if (!spi_get_csgpiod(spi, 0))
++ bcm_qspi_chip_select(qspi, spi_get_chipselect(spi, 0));
+ qspi->trans_pos.trans = trans;
+ qspi->trans_pos.byte = 0;
+
+diff --git a/drivers/spi/spi-bcm2835.c b/drivers/spi/spi-bcm2835.c
+index 747e03228c487..6b7a3fa93fdf6 100644
+--- a/drivers/spi/spi-bcm2835.c
++++ b/drivers/spi/spi-bcm2835.c
+@@ -1274,9 +1274,9 @@ static int bcm2835_spi_setup(struct spi_device *spi)
+ * The SPI core has successfully requested the CS GPIO line from the
+ * device tree, so we are done.
+ */
+- if (spi->cs_gpiod)
++ if (spi_get_csgpiod(spi, 0))
+ return 0;
+- if (spi->chip_select > 1) {
++ if (spi_get_chipselect(spi, 0) > 1) {
+ /* error in the case of native CS requested with CS > 1
+ * officially there is a CS2, but it is not documented
+ * which GPIO is connected with that...
+@@ -1301,18 +1301,19 @@ static int bcm2835_spi_setup(struct spi_device *spi)
+ if (!chip)
+ return 0;
+
+- spi->cs_gpiod = gpiochip_request_own_desc(chip, 8 - spi->chip_select,
+- DRV_NAME,
+- GPIO_LOOKUP_FLAGS_DEFAULT,
+- GPIOD_OUT_LOW);
+- if (IS_ERR(spi->cs_gpiod)) {
+- ret = PTR_ERR(spi->cs_gpiod);
++ spi_set_csgpiod(spi, 0, gpiochip_request_own_desc(chip,
++ 8 - (spi_get_chipselect(spi, 0)),
++ DRV_NAME,
++ GPIO_LOOKUP_FLAGS_DEFAULT,
++ GPIOD_OUT_LOW));
++ if (IS_ERR(spi_get_csgpiod(spi, 0))) {
++ ret = PTR_ERR(spi_get_csgpiod(spi, 0));
+ goto err_cleanup;
+ }
+
+ /* and set up the "mode" and level */
+ dev_info(&spi->dev, "setting up native-CS%i to use GPIO\n",
+- spi->chip_select);
++ spi_get_chipselect(spi, 0));
+
+ return 0;
+
+diff --git a/drivers/spi/spi-bcm2835aux.c b/drivers/spi/spi-bcm2835aux.c
+index e285219223308..a3d8f6108477b 100644
+--- a/drivers/spi/spi-bcm2835aux.c
++++ b/drivers/spi/spi-bcm2835aux.c
+@@ -448,7 +448,7 @@ static int bcm2835aux_spi_setup(struct spi_device *spi)
+ if (spi->mode & SPI_NO_CS)
+ return 0;
+
+- if (spi->cs_gpiod)
++ if (spi_get_csgpiod(spi, 0))
+ return 0;
+
+ /* for dt-backwards compatibility: only support native on CS0
+@@ -465,7 +465,7 @@ static int bcm2835aux_spi_setup(struct spi_device *spi)
+ dev_warn(&spi->dev,
+ "Native CS is not supported - please configure cs-gpio in device-tree\n");
+
+- if (spi->chip_select == 0)
++ if (spi_get_chipselect(spi, 0) == 0)
+ return 0;
+
+ dev_warn(&spi->dev, "Native CS is not working for cs > 0\n");
+diff --git a/drivers/spi/spi-bcm63xx-hsspi.c b/drivers/spi/spi-bcm63xx-hsspi.c
+index cd0a6478f5e7b..d1aeae29fab9c 100644
+--- a/drivers/spi/spi-bcm63xx-hsspi.c
++++ b/drivers/spi/spi-bcm63xx-hsspi.c
+@@ -349,7 +349,7 @@ static int bcm63xx_hsspi_do_prepend_txrx(struct spi_device *spi,
+ struct spi_transfer *t)
+ {
+ struct bcm63xx_hsspi *bs = spi_master_get_devdata(spi->master);
+- unsigned int chip_select = spi->chip_select;
++ unsigned int chip_select = spi_get_chipselect(spi, 0);
+ u16 opcode = 0, val;
+ const u8 *tx = t->tx_buf;
+ u8 *rx = t->rx_buf;
+@@ -441,7 +441,7 @@ static void bcm63xx_hsspi_set_cs(struct bcm63xx_hsspi *bs, unsigned int cs,
+ static void bcm63xx_hsspi_set_clk(struct bcm63xx_hsspi *bs,
+ struct spi_device *spi, int hz)
+ {
+- unsigned int profile = spi->chip_select;
++ unsigned int profile = spi_get_chipselect(spi, 0);
+ u32 reg;
+
+ reg = DIV_ROUND_UP(2048, DIV_ROUND_UP(bs->speed_hz, hz));
+@@ -468,7 +468,7 @@ static void bcm63xx_hsspi_set_clk(struct bcm63xx_hsspi *bs,
+ static int bcm63xx_hsspi_do_txrx(struct spi_device *spi, struct spi_transfer *t)
+ {
+ struct bcm63xx_hsspi *bs = spi_master_get_devdata(spi->master);
+- unsigned int chip_select = spi->chip_select;
++ unsigned int chip_select = spi_get_chipselect(spi, 0);
+ u16 opcode = 0, val;
+ int pending = t->len;
+ int step_size = HSSPI_BUFFER_LEN;
+@@ -478,7 +478,7 @@ static int bcm63xx_hsspi_do_txrx(struct spi_device *spi, struct spi_transfer *t)
+
+ bcm63xx_hsspi_set_clk(bs, spi, t->speed_hz);
+ if (!t->cs_off)
+- bcm63xx_hsspi_set_cs(bs, spi->chip_select, true);
++ bcm63xx_hsspi_set_cs(bs, spi_get_chipselect(spi, 0), true);
+
+ if (tx && rx)
+ opcode = HSSPI_OP_READ_WRITE;
+@@ -545,14 +545,14 @@ static int bcm63xx_hsspi_setup(struct spi_device *spi)
+ u32 reg;
+
+ reg = __raw_readl(bs->regs +
+- HSSPI_PROFILE_SIGNAL_CTRL_REG(spi->chip_select));
++ HSSPI_PROFILE_SIGNAL_CTRL_REG(spi_get_chipselect(spi, 0)));
+ reg &= ~(SIGNAL_CTRL_LAUNCH_RISING | SIGNAL_CTRL_LATCH_RISING);
+ if (spi->mode & SPI_CPHA)
+ reg |= SIGNAL_CTRL_LAUNCH_RISING;
+ else
+ reg |= SIGNAL_CTRL_LATCH_RISING;
+ __raw_writel(reg, bs->regs +
+- HSSPI_PROFILE_SIGNAL_CTRL_REG(spi->chip_select));
++ HSSPI_PROFILE_SIGNAL_CTRL_REG(spi_get_chipselect(spi, 0)));
+
+ mutex_lock(&bs->bus_mutex);
+ reg = __raw_readl(bs->regs + HSSPI_GLOBAL_CTRL_REG);
+@@ -560,16 +560,16 @@ static int bcm63xx_hsspi_setup(struct spi_device *spi)
+ /* only change actual polarities if there is no transfer */
+ if ((reg & GLOBAL_CTRL_CS_POLARITY_MASK) == bs->cs_polarity) {
+ if (spi->mode & SPI_CS_HIGH)
+- reg |= BIT(spi->chip_select);
++ reg |= BIT(spi_get_chipselect(spi, 0));
+ else
+- reg &= ~BIT(spi->chip_select);
++ reg &= ~BIT(spi_get_chipselect(spi, 0));
+ __raw_writel(reg, bs->regs + HSSPI_GLOBAL_CTRL_REG);
+ }
+
+ if (spi->mode & SPI_CS_HIGH)
+- bs->cs_polarity |= BIT(spi->chip_select);
++ bs->cs_polarity |= BIT(spi_get_chipselect(spi, 0));
+ else
+- bs->cs_polarity &= ~BIT(spi->chip_select);
++ bs->cs_polarity &= ~BIT(spi_get_chipselect(spi, 0));
+
+ mutex_unlock(&bs->bus_mutex);
+
+@@ -600,7 +600,7 @@ static int bcm63xx_hsspi_do_dummy_cs_txrx(struct spi_device *spi,
+ * e. At the end restore the polarities again to their default values.
+ */
+
+- dummy_cs = !spi->chip_select;
++ dummy_cs = !spi_get_chipselect(spi, 0);
+ bcm63xx_hsspi_set_cs(bs, dummy_cs, true);
+
+ list_for_each_entry(t, &msg->transfers, transfer_list) {
+@@ -633,22 +633,22 @@ static int bcm63xx_hsspi_do_dummy_cs_txrx(struct spi_device *spi,
+ keep_cs = true;
+ } else {
+ if (!t->cs_off)
+- bcm63xx_hsspi_set_cs(bs, spi->chip_select, false);
++ bcm63xx_hsspi_set_cs(bs, spi_get_chipselect(spi, 0), false);
+
+ spi_transfer_cs_change_delay_exec(msg, t);
+
+ if (!list_next_entry(t, transfer_list)->cs_off)
+- bcm63xx_hsspi_set_cs(bs, spi->chip_select, true);
++ bcm63xx_hsspi_set_cs(bs, spi_get_chipselect(spi, 0), true);
+ }
+ } else if (!list_is_last(&t->transfer_list, &msg->transfers) &&
+ t->cs_off != list_next_entry(t, transfer_list)->cs_off) {
+- bcm63xx_hsspi_set_cs(bs, spi->chip_select, t->cs_off);
++ bcm63xx_hsspi_set_cs(bs, spi_get_chipselect(spi, 0), t->cs_off);
+ }
+ }
+
+ bcm63xx_hsspi_set_cs(bs, dummy_cs, false);
+ if (status || !keep_cs)
+- bcm63xx_hsspi_set_cs(bs, spi->chip_select, false);
++ bcm63xx_hsspi_set_cs(bs, spi_get_chipselect(spi, 0), false);
+
+ return status;
+ }
+diff --git a/drivers/spi/spi-bcm63xx.c b/drivers/spi/spi-bcm63xx.c
+index 3686d78c44a6d..787625ce700cb 100644
+--- a/drivers/spi/spi-bcm63xx.c
++++ b/drivers/spi/spi-bcm63xx.c
+@@ -292,7 +292,7 @@ static int bcm63xx_txrx_bufs(struct spi_device *spi, struct spi_transfer *first,
+ /* Issue the transfer */
+ cmd = SPI_CMD_START_IMMEDIATE;
+ cmd |= (prepend_len << SPI_CMD_PREPEND_BYTE_CNT_SHIFT);
+- cmd |= (spi->chip_select << SPI_CMD_DEVICE_ID_SHIFT);
++ cmd |= (spi_get_chipselect(spi, 0) << SPI_CMD_DEVICE_ID_SHIFT);
+ bcm_spi_writew(bs, cmd, SPI_CMD);
+
+ /* Enable the CMD_DONE interrupt */
+diff --git a/drivers/spi/spi-bcmbca-hsspi.c b/drivers/spi/spi-bcmbca-hsspi.c
+index 3f9e6131ad863..2306bf879784c 100644
+--- a/drivers/spi/spi-bcmbca-hsspi.c
++++ b/drivers/spi/spi-bcmbca-hsspi.c
+@@ -193,7 +193,7 @@ static void bcmbca_hsspi_set_cs(struct bcmbca_hsspi *bs, unsigned int cs,
+ static void bcmbca_hsspi_set_clk(struct bcmbca_hsspi *bs,
+ struct spi_device *spi, int hz)
+ {
+- unsigned int profile = spi->chip_select;
++ unsigned int profile = spi_get_chipselect(spi, 0);
+ u32 reg;
+
+ reg = DIV_ROUND_UP(2048, DIV_ROUND_UP(bs->speed_hz, hz));
+@@ -251,7 +251,7 @@ static int bcmbca_hsspi_do_txrx(struct spi_device *spi, struct spi_transfer *t,
+ struct spi_message *msg)
+ {
+ struct bcmbca_hsspi *bs = spi_master_get_devdata(spi->master);
+- unsigned int chip_select = spi->chip_select;
++ unsigned int chip_select = spi_get_chipselect(spi, 0);
+ u16 opcode = 0, val;
+ int pending = t->len;
+ int step_size = HSSPI_BUFFER_LEN;
+@@ -312,7 +312,7 @@ static int bcmbca_hsspi_do_txrx(struct spi_device *spi, struct spi_transfer *t,
+ PINGPONG_COMMAND_START_NOW;
+ __raw_writel(reg, bs->regs + HSSPI_PINGPONG_COMMAND_REG(0));
+
+- if (bcmbca_hsspi_wait_cmd(bs, spi->chip_select))
++ if (bcmbca_hsspi_wait_cmd(bs, spi_get_chipselect(spi, 0)))
+ return -ETIMEDOUT;
+
+ pending -= curr_step;
+@@ -332,33 +332,33 @@ static int bcmbca_hsspi_setup(struct spi_device *spi)
+ u32 reg;
+
+ reg = __raw_readl(bs->regs +
+- HSSPI_PROFILE_SIGNAL_CTRL_REG(spi->chip_select));
++ HSSPI_PROFILE_SIGNAL_CTRL_REG(spi_get_chipselect(spi, 0)));
+ reg &= ~(SIGNAL_CTRL_LAUNCH_RISING | SIGNAL_CTRL_LATCH_RISING);
+ if (spi->mode & SPI_CPHA)
+ reg |= SIGNAL_CTRL_LAUNCH_RISING;
+ else
+ reg |= SIGNAL_CTRL_LATCH_RISING;
+ __raw_writel(reg, bs->regs +
+- HSSPI_PROFILE_SIGNAL_CTRL_REG(spi->chip_select));
++ HSSPI_PROFILE_SIGNAL_CTRL_REG(spi_get_chipselect(spi, 0)));
+
+ mutex_lock(&bs->bus_mutex);
+ reg = __raw_readl(bs->regs + HSSPI_GLOBAL_CTRL_REG);
+
+ if (spi->mode & SPI_CS_HIGH)
+- reg |= BIT(spi->chip_select);
++ reg |= BIT(spi_get_chipselect(spi, 0));
+ else
+- reg &= ~BIT(spi->chip_select);
++ reg &= ~BIT(spi_get_chipselect(spi, 0));
+ __raw_writel(reg, bs->regs + HSSPI_GLOBAL_CTRL_REG);
+
+ if (spi->mode & SPI_CS_HIGH)
+- bs->cs_polarity |= BIT(spi->chip_select);
++ bs->cs_polarity |= BIT(spi_get_chipselect(spi, 0));
+ else
+- bs->cs_polarity &= ~BIT(spi->chip_select);
++ bs->cs_polarity &= ~BIT(spi_get_chipselect(spi, 0));
+
+ reg = __raw_readl(bs->spim_ctrl);
+- reg &= ~BIT(spi->chip_select + SPIM_CTRL_CS_OVERRIDE_VAL_SHIFT);
++ reg &= ~BIT(spi_get_chipselect(spi, 0) + SPIM_CTRL_CS_OVERRIDE_VAL_SHIFT);
+ if (spi->mode & SPI_CS_HIGH)
+- reg |= BIT(spi->chip_select + SPIM_CTRL_CS_OVERRIDE_VAL_SHIFT);
++ reg |= BIT(spi_get_chipselect(spi, 0) + SPIM_CTRL_CS_OVERRIDE_VAL_SHIFT);
+ __raw_writel(reg, bs->spim_ctrl);
+
+ mutex_unlock(&bs->bus_mutex);
+@@ -388,16 +388,16 @@ static int bcmbca_hsspi_transfer_one(struct spi_master *master,
+ keep_cs = true;
+ } else {
+ if (!t->cs_off)
+- bcmbca_hsspi_set_cs(bs, spi->chip_select, false);
++ bcmbca_hsspi_set_cs(bs, spi_get_chipselect(spi, 0), false);
+
+ spi_transfer_cs_change_delay_exec(msg, t);
+
+ if (!list_next_entry(t, transfer_list)->cs_off)
+- bcmbca_hsspi_set_cs(bs, spi->chip_select, true);
++ bcmbca_hsspi_set_cs(bs, spi_get_chipselect(spi, 0), true);
+ }
+ } else if (!list_is_last(&t->transfer_list, &msg->transfers) &&
+ t->cs_off != list_next_entry(t, transfer_list)->cs_off) {
+- bcmbca_hsspi_set_cs(bs, spi->chip_select, t->cs_off);
++ bcmbca_hsspi_set_cs(bs, spi_get_chipselect(spi, 0), t->cs_off);
+ }
+
+ msg->actual_length += t->len;
+@@ -406,7 +406,7 @@ static int bcmbca_hsspi_transfer_one(struct spi_master *master,
+ mutex_unlock(&bs->msg_mutex);
+
+ if (status || !keep_cs)
+- bcmbca_hsspi_set_cs(bs, spi->chip_select, false);
++ bcmbca_hsspi_set_cs(bs, spi_get_chipselect(spi, 0), false);
+
+ msg->status = status;
+ spi_finalize_current_message(master);
+diff --git a/drivers/spi/spi-cadence-quadspi.c b/drivers/spi/spi-cadence-quadspi.c
+index 64b6a460d739b..fb6d85fd2e864 100644
+--- a/drivers/spi/spi-cadence-quadspi.c
++++ b/drivers/spi/spi-cadence-quadspi.c
+@@ -1355,7 +1355,7 @@ static int cqspi_mem_process(struct spi_mem *mem, const struct spi_mem_op *op)
+ struct cqspi_st *cqspi = spi_master_get_devdata(mem->spi->master);
+ struct cqspi_flash_pdata *f_pdata;
+
+- f_pdata = &cqspi->f_pdata[mem->spi->chip_select];
++ f_pdata = &cqspi->f_pdata[spi_get_chipselect(mem->spi, 0)];
+ cqspi_configure(f_pdata, mem->spi->max_speed_hz);
+
+ if (op->data.dir == SPI_MEM_DATA_IN && op->data.buf.in) {
+@@ -1561,7 +1561,8 @@ static const char *cqspi_get_name(struct spi_mem *mem)
+ struct cqspi_st *cqspi = spi_master_get_devdata(mem->spi->master);
+ struct device *dev = &cqspi->pdev->dev;
+
+- return devm_kasprintf(dev, GFP_KERNEL, "%s.%d", dev_name(dev), mem->spi->chip_select);
++ return devm_kasprintf(dev, GFP_KERNEL, "%s.%d", dev_name(dev),
++ spi_get_chipselect(mem->spi, 0));
+ }
+
+ static const struct spi_controller_mem_ops cqspi_mem_ops = {
+diff --git a/drivers/spi/spi-cadence-xspi.c b/drivers/spi/spi-cadence-xspi.c
+index 91db3c973167b..ce4a3145f065b 100644
+--- a/drivers/spi/spi-cadence-xspi.c
++++ b/drivers/spi/spi-cadence-xspi.c
+@@ -409,8 +409,8 @@ static int cdns_xspi_mem_op(struct cdns_xspi_dev *cdns_xspi,
+ {
+ enum spi_mem_data_dir dir = op->data.dir;
+
+- if (cdns_xspi->cur_cs != mem->spi->chip_select)
+- cdns_xspi->cur_cs = mem->spi->chip_select;
++ if (cdns_xspi->cur_cs != spi_get_chipselect(mem->spi, 0))
++ cdns_xspi->cur_cs = spi_get_chipselect(mem->spi, 0);
+
+ return cdns_xspi_send_stig_command(cdns_xspi, op,
+ (dir != SPI_MEM_NO_DATA));
+diff --git a/drivers/spi/spi-cadence.c b/drivers/spi/spi-cadence.c
+index 6a7f7df1e7764..4ec778de5baf5 100644
+--- a/drivers/spi/spi-cadence.c
++++ b/drivers/spi/spi-cadence.c
+@@ -185,11 +185,11 @@ static void cdns_spi_chipselect(struct spi_device *spi, bool is_high)
+ /* Select the slave */
+ ctrl_reg &= ~CDNS_SPI_CR_SSCTRL;
+ if (!(xspi->is_decoded_cs))
+- ctrl_reg |= ((~(CDNS_SPI_SS0 << spi->chip_select)) <<
++ ctrl_reg |= ((~(CDNS_SPI_SS0 << spi_get_chipselect(spi, 0))) <<
+ CDNS_SPI_SS_SHIFT) &
+ CDNS_SPI_CR_SSCTRL;
+ else
+- ctrl_reg |= (spi->chip_select << CDNS_SPI_SS_SHIFT) &
++ ctrl_reg |= (spi_get_chipselect(spi, 0) << CDNS_SPI_SS_SHIFT) &
+ CDNS_SPI_CR_SSCTRL;
+ }
+
+diff --git a/drivers/spi/spi-cavium.c b/drivers/spi/spi-cavium.c
+index 6854c3ce423b3..dfe224defd6ed 100644
+--- a/drivers/spi/spi-cavium.c
++++ b/drivers/spi/spi-cavium.c
+@@ -57,8 +57,8 @@ static int octeon_spi_do_transfer(struct octeon_spi *p,
+ mpi_cfg.s.cslate = cpha ? 1 : 0;
+ mpi_cfg.s.enable = 1;
+
+- if (spi->chip_select < 4)
+- p->cs_enax |= 1ull << (12 + spi->chip_select);
++ if (spi_get_chipselect(spi, 0) < 4)
++ p->cs_enax |= 1ull << (12 + spi_get_chipselect(spi, 0));
+ mpi_cfg.u64 |= p->cs_enax;
+
+ if (mpi_cfg.u64 != p->last_cfg) {
+@@ -78,7 +78,7 @@ static int octeon_spi_do_transfer(struct octeon_spi *p,
+ writeq(d, p->register_base + OCTEON_SPI_DAT0(p) + (8 * i));
+ }
+ mpi_tx.u64 = 0;
+- mpi_tx.s.csid = spi->chip_select;
++ mpi_tx.s.csid = spi_get_chipselect(spi, 0);
+ mpi_tx.s.leavecs = 1;
+ mpi_tx.s.txnum = tx_buf ? OCTEON_SPI_MAX_BYTES : 0;
+ mpi_tx.s.totnum = OCTEON_SPI_MAX_BYTES;
+@@ -103,7 +103,7 @@ static int octeon_spi_do_transfer(struct octeon_spi *p,
+ }
+
+ mpi_tx.u64 = 0;
+- mpi_tx.s.csid = spi->chip_select;
++ mpi_tx.s.csid = spi_get_chipselect(spi, 0);
+ if (last_xfer)
+ mpi_tx.s.leavecs = xfer->cs_change;
+ else
+diff --git a/drivers/spi/spi-coldfire-qspi.c b/drivers/spi/spi-coldfire-qspi.c
+index 263ce90473277..18e4fd86b2f28 100644
+--- a/drivers/spi/spi-coldfire-qspi.c
++++ b/drivers/spi/spi-coldfire-qspi.c
+@@ -290,9 +290,9 @@ static void mcfqspi_set_cs(struct spi_device *spi, bool enable)
+ bool cs_high = spi->mode & SPI_CS_HIGH;
+
+ if (enable)
+- mcfqspi_cs_select(mcfqspi, spi->chip_select, cs_high);
++ mcfqspi_cs_select(mcfqspi, spi_get_chipselect(spi, 0), cs_high);
+ else
+- mcfqspi_cs_deselect(mcfqspi, spi->chip_select, cs_high);
++ mcfqspi_cs_deselect(mcfqspi, spi_get_chipselect(spi, 0), cs_high);
+ }
+
+ static int mcfqspi_transfer_one(struct spi_master *master,
+@@ -324,11 +324,11 @@ static int mcfqspi_transfer_one(struct spi_master *master,
+ static int mcfqspi_setup(struct spi_device *spi)
+ {
+ mcfqspi_cs_deselect(spi_master_get_devdata(spi->master),
+- spi->chip_select, spi->mode & SPI_CS_HIGH);
++ spi_get_chipselect(spi, 0), spi->mode & SPI_CS_HIGH);
+
+ dev_dbg(&spi->dev,
+ "bits per word %d, chip select %d, speed %d KHz\n",
+- spi->bits_per_word, spi->chip_select,
++ spi->bits_per_word, spi_get_chipselect(spi, 0),
+ (MCFQSPI_BUSCLK / mcfqspi_qmr_baud(spi->max_speed_hz))
+ / 1000);
+
+diff --git a/drivers/spi/spi-davinci.c b/drivers/spi/spi-davinci.c
+index d112c2cac042b..55c9abcb8e3b3 100644
+--- a/drivers/spi/spi-davinci.c
++++ b/drivers/spi/spi-davinci.c
+@@ -199,7 +199,7 @@ static void davinci_spi_chipselect(struct spi_device *spi, int value)
+ {
+ struct davinci_spi *dspi;
+ struct davinci_spi_config *spicfg = spi->controller_data;
+- u8 chip_sel = spi->chip_select;
++ u8 chip_sel = spi_get_chipselect(spi, 0);
+ u16 spidat1 = CS_DEFAULT;
+
+ dspi = spi_master_get_devdata(spi->master);
+@@ -212,11 +212,11 @@ static void davinci_spi_chipselect(struct spi_device *spi, int value)
+ * Board specific chip select logic decides the polarity and cs
+ * line for the controller
+ */
+- if (spi->cs_gpiod) {
++ if (spi_get_csgpiod(spi, 0)) {
+ if (value == BITBANG_CS_ACTIVE)
+- gpiod_set_value(spi->cs_gpiod, 1);
++ gpiod_set_value(spi_get_csgpiod(spi, 0), 1);
+ else
+- gpiod_set_value(spi->cs_gpiod, 0);
++ gpiod_set_value(spi_get_csgpiod(spi, 0), 0);
+ } else {
+ if (value == BITBANG_CS_ACTIVE) {
+ if (!(spi->mode & SPI_CS_WORD))
+@@ -293,11 +293,11 @@ static int davinci_spi_setup_transfer(struct spi_device *spi,
+ if (bits_per_word <= 8) {
+ dspi->get_rx = davinci_spi_rx_buf_u8;
+ dspi->get_tx = davinci_spi_tx_buf_u8;
+- dspi->bytes_per_word[spi->chip_select] = 1;
++ dspi->bytes_per_word[spi_get_chipselect(spi, 0)] = 1;
+ } else {
+ dspi->get_rx = davinci_spi_rx_buf_u16;
+ dspi->get_tx = davinci_spi_tx_buf_u16;
+- dspi->bytes_per_word[spi->chip_select] = 2;
++ dspi->bytes_per_word[spi_get_chipselect(spi, 0)] = 2;
+ }
+
+ if (!hz)
+@@ -415,11 +415,11 @@ static int davinci_spi_setup(struct spi_device *spi)
+ dspi = spi_master_get_devdata(spi->master);
+
+ if (!(spi->mode & SPI_NO_CS)) {
+- if (np && spi->cs_gpiod)
++ if (np && spi_get_csgpiod(spi, 0))
+ internal_cs = false;
+
+ if (internal_cs)
+- set_io_bits(dspi->base + SPIPC0, 1 << spi->chip_select);
++ set_io_bits(dspi->base + SPIPC0, 1 << spi_get_chipselect(spi, 0));
+ }
+
+ if (spi->mode & SPI_READY)
+@@ -579,7 +579,7 @@ static int davinci_spi_bufs(struct spi_device *spi, struct spi_transfer *t)
+ spicfg = &davinci_spi_default_cfg;
+
+ /* convert len to words based on bits_per_word */
+- data_type = dspi->bytes_per_word[spi->chip_select];
++ data_type = dspi->bytes_per_word[spi_get_chipselect(spi, 0)];
+
+ dspi->tx = t->tx_buf;
+ dspi->rx = t->rx_buf;
+diff --git a/drivers/spi/spi-dln2.c b/drivers/spi/spi-dln2.c
+index 0a1fb2bc9e546..5e60e3d5822e7 100644
+--- a/drivers/spi/spi-dln2.c
++++ b/drivers/spi/spi-dln2.c
+@@ -596,12 +596,12 @@ static int dln2_spi_prepare_message(struct spi_master *master,
+ struct dln2_spi *dln2 = spi_master_get_devdata(master);
+ struct spi_device *spi = message->spi;
+
+- if (dln2->cs != spi->chip_select) {
+- ret = dln2_spi_cs_set_one(dln2, spi->chip_select);
++ if (dln2->cs != spi_get_chipselect(spi, 0)) {
++ ret = dln2_spi_cs_set_one(dln2, spi_get_chipselect(spi, 0));
+ if (ret < 0)
+ return ret;
+
+- dln2->cs = spi->chip_select;
++ dln2->cs = spi_get_chipselect(spi, 0);
+ }
+
+ return 0;
+diff --git a/drivers/spi/spi-dw-core.c b/drivers/spi/spi-dw-core.c
+index c3bfb6c84cab2..ae3108c70f508 100644
+--- a/drivers/spi/spi-dw-core.c
++++ b/drivers/spi/spi-dw-core.c
+@@ -103,7 +103,7 @@ void dw_spi_set_cs(struct spi_device *spi, bool enable)
+ * support active-high or active-low CS level.
+ */
+ if (cs_high == enable)
+- dw_writel(dws, DW_SPI_SER, BIT(spi->chip_select));
++ dw_writel(dws, DW_SPI_SER, BIT(spi_get_chipselect(spi, 0)));
+ else
+ dw_writel(dws, DW_SPI_SER, 0);
+ }
+diff --git a/drivers/spi/spi-dw-mmio.c b/drivers/spi/spi-dw-mmio.c
+index 26c40ea6dd129..d511da766ce82 100644
+--- a/drivers/spi/spi-dw-mmio.c
++++ b/drivers/spi/spi-dw-mmio.c
+@@ -65,7 +65,7 @@ static void dw_spi_mscc_set_cs(struct spi_device *spi, bool enable)
+ struct dw_spi *dws = spi_master_get_devdata(spi->master);
+ struct dw_spi_mmio *dwsmmio = container_of(dws, struct dw_spi_mmio, dws);
+ struct dw_spi_mscc *dwsmscc = dwsmmio->priv;
+- u32 cs = spi->chip_select;
++ u32 cs = spi_get_chipselect(spi, 0);
+
+ if (cs < 4) {
+ u32 sw_mode = MSCC_SPI_MST_SW_MODE_SW_PIN_CTRL_MODE;
+@@ -138,7 +138,7 @@ static void dw_spi_sparx5_set_cs(struct spi_device *spi, bool enable)
+ struct dw_spi *dws = spi_master_get_devdata(spi->master);
+ struct dw_spi_mmio *dwsmmio = container_of(dws, struct dw_spi_mmio, dws);
+ struct dw_spi_mscc *dwsmscc = dwsmmio->priv;
+- u8 cs = spi->chip_select;
++ u8 cs = spi_get_chipselect(spi, 0);
+
+ if (!enable) {
+ /* CS override drive enable */
+diff --git a/drivers/spi/spi-falcon.c b/drivers/spi/spi-falcon.c
+index a7d4dffac66b2..4c103dff0d445 100644
+--- a/drivers/spi/spi-falcon.c
++++ b/drivers/spi/spi-falcon.c
+@@ -131,7 +131,7 @@ int falcon_sflash_xfer(struct spi_device *spi, struct spi_transfer *t,
+ * especially alen and dumlen.
+ */
+
+- priv->sfcmd = ((spi->chip_select
++ priv->sfcmd = ((spi_get_chipselect(spi, 0)
+ << SFCMD_CS_OFFSET)
+ & SFCMD_CS_MASK);
+ priv->sfcmd |= SFCMD_KEEP_CS_KEEP_SELECTED;
+diff --git a/drivers/spi/spi-fsi.c b/drivers/spi/spi-fsi.c
+index cf1e4f9ebd727..ba3b17d7c9ec2 100644
+--- a/drivers/spi/spi-fsi.c
++++ b/drivers/spi/spi-fsi.c
+@@ -425,7 +425,7 @@ static int fsi_spi_transfer_one_message(struct spi_controller *ctlr,
+ struct spi_message *mesg)
+ {
+ int rc;
+- u8 seq_slave = SPI_FSI_SEQUENCE_SEL_SLAVE(mesg->spi->chip_select + 1);
++ u8 seq_slave = SPI_FSI_SEQUENCE_SEL_SLAVE(spi_get_chipselect(mesg->spi, 0) + 1);
+ unsigned int len;
+ struct spi_transfer *transfer;
+ struct fsi_spi *ctx = spi_controller_get_devdata(ctlr);
+diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c
+index e419642eb10e5..0f9a97ee2e772 100644
+--- a/drivers/spi/spi-fsl-dspi.c
++++ b/drivers/spi/spi-fsl-dspi.c
+@@ -902,19 +902,19 @@ static irqreturn_t dspi_interrupt(int irq, void *dev_id)
+
+ static void dspi_assert_cs(struct spi_device *spi, bool *cs)
+ {
+- if (!spi->cs_gpiod || *cs)
++ if (!spi_get_csgpiod(spi, 0) || *cs)
+ return;
+
+- gpiod_set_value_cansleep(spi->cs_gpiod, true);
++ gpiod_set_value_cansleep(spi_get_csgpiod(spi, 0), true);
+ *cs = true;
+ }
+
+ static void dspi_deassert_cs(struct spi_device *spi, bool *cs)
+ {
+- if (!spi->cs_gpiod || !*cs)
++ if (!spi_get_csgpiod(spi, 0) || !*cs)
+ return;
+
+- gpiod_set_value_cansleep(spi->cs_gpiod, false);
++ gpiod_set_value_cansleep(spi_get_csgpiod(spi, 0), false);
+ *cs = false;
+ }
+
+@@ -938,8 +938,8 @@ static int dspi_transfer_one_message(struct spi_controller *ctlr,
+
+ /* Prepare command word for CMD FIFO */
+ dspi->tx_cmd = SPI_PUSHR_CMD_CTAS(0);
+- if (!spi->cs_gpiod)
+- dspi->tx_cmd |= SPI_PUSHR_CMD_PCS(spi->chip_select);
++ if (!spi_get_csgpiod(spi, 0))
++ dspi->tx_cmd |= SPI_PUSHR_CMD_PCS(spi_get_chipselect(spi, 0));
+
+ if (list_is_last(&dspi->cur_transfer->transfer_list,
+ &dspi->cur_msg->transfers)) {
+@@ -1058,7 +1058,7 @@ static int dspi_setup(struct spi_device *spi)
+ chip->ctar_val |= SPI_CTAR_LSBFE;
+ }
+
+- gpiod_direction_output(spi->cs_gpiod, false);
++ gpiod_direction_output(spi_get_csgpiod(spi, 0), false);
+ dspi_deassert_cs(spi, &cs);
+
+ spi_set_ctldata(spi, chip);
+@@ -1071,7 +1071,7 @@ static void dspi_cleanup(struct spi_device *spi)
+ struct chip_data *chip = spi_get_ctldata((struct spi_device *)spi);
+
+ dev_dbg(&spi->dev, "spi_device %u.%u cleanup\n",
+- spi->controller->bus_num, spi->chip_select);
++ spi->controller->bus_num, spi_get_chipselect(spi, 0));
+
+ kfree(chip);
+ }
+diff --git a/drivers/spi/spi-fsl-espi.c b/drivers/spi/spi-fsl-espi.c
+index f7066bef7b06f..b593055e3d6d5 100644
+--- a/drivers/spi/spi-fsl-espi.c
++++ b/drivers/spi/spi-fsl-espi.c
+@@ -345,7 +345,7 @@ static void fsl_espi_setup_transfer(struct spi_device *spi,
+
+ /* don't write the mode register if the mode doesn't change */
+ if (cs->hw_mode != hw_mode_old)
+- fsl_espi_write_reg(espi, ESPI_SPMODEx(spi->chip_select),
++ fsl_espi_write_reg(espi, ESPI_SPMODEx(spi_get_chipselect(spi, 0)),
+ cs->hw_mode);
+ }
+
+@@ -359,7 +359,7 @@ static int fsl_espi_bufs(struct spi_device *spi, struct spi_transfer *t)
+ reinit_completion(&espi->done);
+
+ /* Set SPCOM[CS] and SPCOM[TRANLEN] field */
+- spcom = SPCOM_CS(spi->chip_select);
++ spcom = SPCOM_CS(spi_get_chipselect(spi, 0));
+ spcom |= SPCOM_TRANLEN(t->len - 1);
+
+ /* configure RXSKIP mode */
+@@ -492,7 +492,7 @@ static int fsl_espi_setup(struct spi_device *spi)
+
+ pm_runtime_get_sync(espi->dev);
+
+- cs->hw_mode = fsl_espi_read_reg(espi, ESPI_SPMODEx(spi->chip_select));
++ cs->hw_mode = fsl_espi_read_reg(espi, ESPI_SPMODEx(spi_get_chipselect(spi, 0)));
+ /* mask out bits we are going to set */
+ cs->hw_mode &= ~(CSMODE_CP_BEGIN_EDGECLK | CSMODE_CI_INACTIVEHIGH
+ | CSMODE_REV);
+diff --git a/drivers/spi/spi-fsl-lpspi.c b/drivers/spi/spi-fsl-lpspi.c
+index 34488de555871..fe69ec8c9d688 100644
+--- a/drivers/spi/spi-fsl-lpspi.c
++++ b/drivers/spi/spi-fsl-lpspi.c
+@@ -425,7 +425,7 @@ static int fsl_lpspi_setup_transfer(struct spi_controller *controller,
+ if (fsl_lpspi->is_only_cs1)
+ fsl_lpspi->config.chip_select = 1;
+ else
+- fsl_lpspi->config.chip_select = spi->chip_select;
++ fsl_lpspi->config.chip_select = spi_get_chipselect(spi, 0);
+
+ if (!fsl_lpspi->config.speed_hz)
+ fsl_lpspi->config.speed_hz = spi->max_speed_hz;
+diff --git a/drivers/spi/spi-fsl-qspi.c b/drivers/spi/spi-fsl-qspi.c
+index 85cc71ba624a9..4f16d4676650d 100644
+--- a/drivers/spi/spi-fsl-qspi.c
++++ b/drivers/spi/spi-fsl-qspi.c
+@@ -528,7 +528,7 @@ static void fsl_qspi_select_mem(struct fsl_qspi *q, struct spi_device *spi)
+ unsigned long rate = spi->max_speed_hz;
+ int ret;
+
+- if (q->selected == spi->chip_select)
++ if (q->selected == spi_get_chipselect(spi, 0))
+ return;
+
+ if (needs_4x_clock(q))
+@@ -544,7 +544,7 @@ static void fsl_qspi_select_mem(struct fsl_qspi *q, struct spi_device *spi)
+ if (ret)
+ return;
+
+- q->selected = spi->chip_select;
++ q->selected = spi_get_chipselect(spi, 0);
+
+ fsl_qspi_invalidate(q);
+ }
+@@ -823,7 +823,7 @@ static const char *fsl_qspi_get_name(struct spi_mem *mem)
+
+ name = devm_kasprintf(dev, GFP_KERNEL,
+ "%s-%d", dev_name(q->dev),
+- mem->spi->chip_select);
++ spi_get_chipselect(mem->spi, 0));
+
+ if (!name) {
+ dev_err(dev, "failed to get memory for custom flash name\n");
+diff --git a/drivers/spi/spi-fsl-spi.c b/drivers/spi/spi-fsl-spi.c
+index 93152144fd2ec..08fa6e38f4eba 100644
+--- a/drivers/spi/spi-fsl-spi.c
++++ b/drivers/spi/spi-fsl-spi.c
+@@ -503,7 +503,7 @@ static void fsl_spi_grlib_cs_control(struct spi_device *spi, bool on)
+ struct mpc8xxx_spi *mpc8xxx_spi = spi_master_get_devdata(spi->master);
+ struct fsl_spi_reg __iomem *reg_base = mpc8xxx_spi->reg_base;
+ u32 slvsel;
+- u16 cs = spi->chip_select;
++ u16 cs = spi_get_chipselect(spi, 0);
+
+ if (cs < mpc8xxx_spi->native_chipselects) {
+ slvsel = mpc8xxx_spi_read_reg(®_base->slvsel);
+diff --git a/drivers/spi/spi-geni-qcom.c b/drivers/spi/spi-geni-qcom.c
+index babb039bcb431..301e55fcbde9b 100644
+--- a/drivers/spi/spi-geni-qcom.c
++++ b/drivers/spi/spi-geni-qcom.c
+@@ -391,9 +391,9 @@ static int setup_fifo_params(struct spi_device *spi_slv,
+ cpha = CPHA;
+
+ if (spi_slv->mode & SPI_CS_HIGH)
+- demux_output_inv = BIT(spi_slv->chip_select);
++ demux_output_inv = BIT(spi_get_chipselect(spi_slv, 0));
+
+- demux_sel = spi_slv->chip_select;
++ demux_sel = spi_get_chipselect(spi_slv, 0);
+ mas->cur_bits_per_word = spi_slv->bits_per_word;
+
+ spi_setup_word_len(mas, spi_slv->mode, spi_slv->bits_per_word);
+@@ -469,7 +469,7 @@ static int setup_gsi_xfer(struct spi_transfer *xfer, struct spi_geni_master *mas
+ peripheral.loopback_en = !!(spi_slv->mode & SPI_LOOP);
+ peripheral.clock_pol_high = !!(spi_slv->mode & SPI_CPOL);
+ peripheral.data_pol_high = !!(spi_slv->mode & SPI_CPHA);
+- peripheral.cs = spi_slv->chip_select;
++ peripheral.cs = spi_get_chipselect(spi_slv, 0);
+ peripheral.pack_en = true;
+ peripheral.word_len = xfer->bits_per_word - MIN_WORD_LEN;
+
+diff --git a/drivers/spi/spi-gpio.c b/drivers/spi/spi-gpio.c
+index 9c8c7948044ed..092afc7679d40 100644
+--- a/drivers/spi/spi-gpio.c
++++ b/drivers/spi/spi-gpio.c
+@@ -230,7 +230,7 @@ static void spi_gpio_chipselect(struct spi_device *spi, int is_active)
+
+ /* Drive chip select line, if we have one */
+ if (spi_gpio->cs_gpios) {
+- struct gpio_desc *cs = spi_gpio->cs_gpios[spi->chip_select];
++ struct gpio_desc *cs = spi_gpio->cs_gpios[spi_get_chipselect(spi, 0)];
+
+ /* SPI chip selects are normally active-low */
+ gpiod_set_value_cansleep(cs, (spi->mode & SPI_CS_HIGH) ? is_active : !is_active);
+@@ -248,7 +248,7 @@ static int spi_gpio_setup(struct spi_device *spi)
+ * initialized from the descriptor lookup.
+ */
+ if (spi_gpio->cs_gpios) {
+- cs = spi_gpio->cs_gpios[spi->chip_select];
++ cs = spi_gpio->cs_gpios[spi_get_chipselect(spi, 0)];
+ if (!spi->controller_state && cs)
+ status = gpiod_direction_output(cs,
+ !(spi->mode & SPI_CS_HIGH));
+diff --git a/drivers/spi/spi-gxp.c b/drivers/spi/spi-gxp.c
+index c900c2f39b578..684d63f402f34 100644
+--- a/drivers/spi/spi-gxp.c
++++ b/drivers/spi/spi-gxp.c
+@@ -201,7 +201,7 @@ static ssize_t gxp_spi_write(struct gxp_spi_chip *chip, const struct spi_mem_op
+ static int do_gxp_exec_mem_op(struct spi_mem *mem, const struct spi_mem_op *op)
+ {
+ struct gxp_spi *spifi = spi_controller_get_devdata(mem->spi->master);
+- struct gxp_spi_chip *chip = &spifi->chips[mem->spi->chip_select];
++ struct gxp_spi_chip *chip = &spifi->chips[spi_get_chipselect(mem->spi, 0)];
+ int ret;
+
+ if (op->data.dir == SPI_MEM_DATA_IN) {
+@@ -237,7 +237,7 @@ static const struct spi_controller_mem_ops gxp_spi_mem_ops = {
+ static int gxp_spi_setup(struct spi_device *spi)
+ {
+ struct gxp_spi *spifi = spi_controller_get_devdata(spi->master);
+- unsigned int cs = spi->chip_select;
++ unsigned int cs = spi_get_chipselect(spi, 0);
+ struct gxp_spi_chip *chip = &spifi->chips[cs];
+
+ chip->spifi = spifi;
+diff --git a/drivers/spi/spi-hisi-sfc-v3xx.c b/drivers/spi/spi-hisi-sfc-v3xx.c
+index f07d1045a30a2..7cbcb065bb44c 100644
+--- a/drivers/spi/spi-hisi-sfc-v3xx.c
++++ b/drivers/spi/spi-hisi-sfc-v3xx.c
+@@ -361,7 +361,7 @@ static int hisi_sfc_v3xx_exec_op(struct spi_mem *mem,
+ {
+ struct hisi_sfc_v3xx_host *host;
+ struct spi_device *spi = mem->spi;
+- u8 chip_select = spi->chip_select;
++ u8 chip_select = spi_get_chipselect(spi, 0);
+
+ host = spi_controller_get_devdata(spi->master);
+
+diff --git a/drivers/spi/spi-img-spfi.c b/drivers/spi/spi-img-spfi.c
+index 257046f843ffd..1575e78f8b092 100644
+--- a/drivers/spi/spi-img-spfi.c
++++ b/drivers/spi/spi-img-spfi.c
+@@ -413,15 +413,15 @@ static int img_spfi_prepare(struct spi_master *master, struct spi_message *msg)
+ val = spfi_readl(spfi, SPFI_PORT_STATE);
+ val &= ~(SPFI_PORT_STATE_DEV_SEL_MASK <<
+ SPFI_PORT_STATE_DEV_SEL_SHIFT);
+- val |= msg->spi->chip_select << SPFI_PORT_STATE_DEV_SEL_SHIFT;
++ val |= spi_get_chipselect(msg->spi, 0) << SPFI_PORT_STATE_DEV_SEL_SHIFT;
+ if (msg->spi->mode & SPI_CPHA)
+- val |= SPFI_PORT_STATE_CK_PHASE(msg->spi->chip_select);
++ val |= SPFI_PORT_STATE_CK_PHASE(spi_get_chipselect(msg->spi, 0));
+ else
+- val &= ~SPFI_PORT_STATE_CK_PHASE(msg->spi->chip_select);
++ val &= ~SPFI_PORT_STATE_CK_PHASE(spi_get_chipselect(msg->spi, 0));
+ if (msg->spi->mode & SPI_CPOL)
+- val |= SPFI_PORT_STATE_CK_POL(msg->spi->chip_select);
++ val |= SPFI_PORT_STATE_CK_POL(spi_get_chipselect(msg->spi, 0));
+ else
+- val &= ~SPFI_PORT_STATE_CK_POL(msg->spi->chip_select);
++ val &= ~SPFI_PORT_STATE_CK_POL(spi_get_chipselect(msg->spi, 0));
+ spfi_writel(spfi, val, SPFI_PORT_STATE);
+
+ return 0;
+@@ -450,11 +450,11 @@ static void img_spfi_config(struct spi_master *master, struct spi_device *spi,
+ div = DIV_ROUND_UP(clk_get_rate(spfi->spfi_clk), xfer->speed_hz);
+ div = clamp(512 / (1 << get_count_order(div)), 1, 128);
+
+- val = spfi_readl(spfi, SPFI_DEVICE_PARAMETER(spi->chip_select));
++ val = spfi_readl(spfi, SPFI_DEVICE_PARAMETER(spi_get_chipselect(spi, 0)));
+ val &= ~(SPFI_DEVICE_PARAMETER_BITCLK_MASK <<
+ SPFI_DEVICE_PARAMETER_BITCLK_SHIFT);
+ val |= div << SPFI_DEVICE_PARAMETER_BITCLK_SHIFT;
+- spfi_writel(spfi, val, SPFI_DEVICE_PARAMETER(spi->chip_select));
++ spfi_writel(spfi, val, SPFI_DEVICE_PARAMETER(spi_get_chipselect(spi, 0)));
+
+ spfi_writel(spfi, xfer->len << SPFI_TRANSACTION_TSIZE_SHIFT,
+ SPFI_TRANSACTION);
+diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c
+index 6c9c87cd14cae..81221594dd972 100644
+--- a/drivers/spi/spi-imx.c
++++ b/drivers/spi/spi-imx.c
+@@ -528,7 +528,7 @@ static int mx51_ecspi_prepare_message(struct spi_imx_data *spi_imx,
+ ctrl |= MX51_ECSPI_CTRL_DRCTL(spi_imx->spi_drctl);
+
+ /* set chip select to use */
+- ctrl |= MX51_ECSPI_CTRL_CS(spi->chip_select);
++ ctrl |= MX51_ECSPI_CTRL_CS(spi_get_chipselect(spi, 0));
+
+ /*
+ * The ctrl register must be written first, with the EN bit set other
+@@ -549,22 +549,22 @@ static int mx51_ecspi_prepare_message(struct spi_imx_data *spi_imx,
+ * BURST_LENGTH + 1 bits are received
+ */
+ if (spi_imx->slave_mode && is_imx53_ecspi(spi_imx))
+- cfg &= ~MX51_ECSPI_CONFIG_SBBCTRL(spi->chip_select);
++ cfg &= ~MX51_ECSPI_CONFIG_SBBCTRL(spi_get_chipselect(spi, 0));
+ else
+- cfg |= MX51_ECSPI_CONFIG_SBBCTRL(spi->chip_select);
++ cfg |= MX51_ECSPI_CONFIG_SBBCTRL(spi_get_chipselect(spi, 0));
+
+ if (spi->mode & SPI_CPOL) {
+- cfg |= MX51_ECSPI_CONFIG_SCLKPOL(spi->chip_select);
+- cfg |= MX51_ECSPI_CONFIG_SCLKCTL(spi->chip_select);
++ cfg |= MX51_ECSPI_CONFIG_SCLKPOL(spi_get_chipselect(spi, 0));
++ cfg |= MX51_ECSPI_CONFIG_SCLKCTL(spi_get_chipselect(spi, 0));
+ } else {
+- cfg &= ~MX51_ECSPI_CONFIG_SCLKPOL(spi->chip_select);
+- cfg &= ~MX51_ECSPI_CONFIG_SCLKCTL(spi->chip_select);
++ cfg &= ~MX51_ECSPI_CONFIG_SCLKPOL(spi_get_chipselect(spi, 0));
++ cfg &= ~MX51_ECSPI_CONFIG_SCLKCTL(spi_get_chipselect(spi, 0));
+ }
+
+ if (spi->mode & SPI_CS_HIGH)
+- cfg |= MX51_ECSPI_CONFIG_SSBPOL(spi->chip_select);
++ cfg |= MX51_ECSPI_CONFIG_SSBPOL(spi_get_chipselect(spi, 0));
+ else
+- cfg &= ~MX51_ECSPI_CONFIG_SSBPOL(spi->chip_select);
++ cfg &= ~MX51_ECSPI_CONFIG_SSBPOL(spi_get_chipselect(spi, 0));
+
+ if (cfg == current_cfg)
+ return 0;
+@@ -614,9 +614,9 @@ static void mx51_configure_cpha(struct spi_imx_data *spi_imx,
+ cpha ^= flip_cpha;
+
+ if (cpha)
+- cfg |= MX51_ECSPI_CONFIG_SCLKPHA(spi->chip_select);
++ cfg |= MX51_ECSPI_CONFIG_SCLKPHA(spi_get_chipselect(spi, 0));
+ else
+- cfg &= ~MX51_ECSPI_CONFIG_SCLKPHA(spi->chip_select);
++ cfg &= ~MX51_ECSPI_CONFIG_SCLKPHA(spi_get_chipselect(spi, 0));
+
+ writel(cfg, spi_imx->base + MX51_ECSPI_CONFIG);
+ }
+@@ -768,8 +768,8 @@ static int mx31_prepare_transfer(struct spi_imx_data *spi_imx,
+ reg |= MX31_CSPICTRL_POL;
+ if (spi->mode & SPI_CS_HIGH)
+ reg |= MX31_CSPICTRL_SSPOL;
+- if (!spi->cs_gpiod)
+- reg |= (spi->chip_select) <<
++ if (!spi_get_csgpiod(spi, 0))
++ reg |= (spi_get_chipselect(spi, 0)) <<
+ (is_imx35_cspi(spi_imx) ? MX35_CSPICTRL_CS_SHIFT :
+ MX31_CSPICTRL_CS_SHIFT);
+
+@@ -868,8 +868,8 @@ static int mx21_prepare_transfer(struct spi_imx_data *spi_imx,
+ reg |= MX21_CSPICTRL_POL;
+ if (spi->mode & SPI_CS_HIGH)
+ reg |= MX21_CSPICTRL_SSPOL;
+- if (!spi->cs_gpiod)
+- reg |= spi->chip_select << MX21_CSPICTRL_CS_SHIFT;
++ if (!spi_get_csgpiod(spi, 0))
++ reg |= spi_get_chipselect(spi, 0) << MX21_CSPICTRL_CS_SHIFT;
+
+ writel(reg, spi_imx->base + MXC_CSPICTRL);
+
+diff --git a/drivers/spi/spi-ingenic.c b/drivers/spi/spi-ingenic.c
+index 713a238bee63a..7d4b515a160d9 100644
+--- a/drivers/spi/spi-ingenic.c
++++ b/drivers/spi/spi-ingenic.c
+@@ -263,7 +263,7 @@ static int spi_ingenic_prepare_message(struct spi_controller *ctlr,
+ {
+ struct ingenic_spi *priv = spi_controller_get_devdata(ctlr);
+ struct spi_device *spi = message->spi;
+- unsigned int cs = REG_SSICR1_FRMHL << spi->chip_select;
++ unsigned int cs = REG_SSICR1_FRMHL << spi_get_chipselect(spi, 0);
+ unsigned int ssicr0_mask = REG_SSICR0_LOOP | REG_SSICR0_FSEL;
+ unsigned int ssicr1_mask = REG_SSICR1_PHA | REG_SSICR1_POL | cs;
+ unsigned int ssicr0 = 0, ssicr1 = 0;
+@@ -282,7 +282,7 @@ static int spi_ingenic_prepare_message(struct spi_controller *ctlr,
+
+ if (spi->mode & SPI_LOOP)
+ ssicr0 |= REG_SSICR0_LOOP;
+- if (spi->chip_select)
++ if (spi_get_chipselect(spi, 0))
+ ssicr0 |= REG_SSICR0_FSEL;
+
+ if (spi->mode & SPI_CPHA)
+diff --git a/drivers/spi/spi-intel.c b/drivers/spi/spi-intel.c
+index f4679868c49f1..bc6d22149e7e1 100644
+--- a/drivers/spi/spi-intel.c
++++ b/drivers/spi/spi-intel.c
+@@ -451,7 +451,7 @@ static u32 intel_spi_chip_addr(const struct intel_spi *ispi,
+ /* Pick up the correct start address */
+ if (!mem)
+ return 0;
+- return mem->spi->chip_select == 1 ? ispi->chip0_size : 0;
++ return (spi_get_chipselect(mem->spi, 0) == 1) ? ispi->chip0_size : 0;
+ }
+
+ static int intel_spi_read_reg(struct intel_spi *ispi, const struct spi_mem *mem,
+diff --git a/drivers/spi/spi-jcore.c b/drivers/spi/spi-jcore.c
+index 74c8319c29f17..c42a3358e8c9a 100644
+--- a/drivers/spi/spi-jcore.c
++++ b/drivers/spi/spi-jcore.c
+@@ -68,9 +68,9 @@ static void jcore_spi_program(struct jcore_spi *hw)
+ static void jcore_spi_chipsel(struct spi_device *spi, bool value)
+ {
+ struct jcore_spi *hw = spi_master_get_devdata(spi->master);
+- u32 csbit = 1U << (2 * spi->chip_select);
++ u32 csbit = 1U << (2 * spi_get_chipselect(spi, 0));
+
+- dev_dbg(hw->master->dev.parent, "chipselect %d\n", spi->chip_select);
++ dev_dbg(hw->master->dev.parent, "chipselect %d\n", spi_get_chipselect(spi, 0));
+
+ if (value)
+ hw->cs_reg |= csbit;
+diff --git a/drivers/spi/spi-lantiq-ssc.c b/drivers/spi/spi-lantiq-ssc.c
+index aae26f62ea87a..6b191cefb0d4f 100644
+--- a/drivers/spi/spi-lantiq-ssc.c
++++ b/drivers/spi/spi-lantiq-ssc.c
+@@ -388,11 +388,11 @@ static int lantiq_ssc_setup(struct spi_device *spidev)
+ {
+ struct spi_master *master = spidev->master;
+ struct lantiq_ssc_spi *spi = spi_master_get_devdata(master);
+- unsigned int cs = spidev->chip_select;
++ unsigned int cs = spi_get_chipselect(spidev, 0);
+ u32 gpocon;
+
+ /* GPIOs are used for CS */
+- if (spidev->cs_gpiod)
++ if (spi_get_csgpiod(spidev, 0))
+ return 0;
+
+ dev_dbg(spi->dev, "using internal chipselect %u\n", cs);
+@@ -796,7 +796,7 @@ static void lantiq_ssc_handle_err(struct spi_master *master,
+ static void lantiq_ssc_set_cs(struct spi_device *spidev, bool enable)
+ {
+ struct lantiq_ssc_spi *spi = spi_master_get_devdata(spidev->master);
+- unsigned int cs = spidev->chip_select;
++ unsigned int cs = spi_get_chipselect(spidev, 0);
+ u32 fgpo;
+
+ if (!!(spidev->mode & SPI_CS_HIGH) == enable)
+diff --git a/drivers/spi/spi-mem.c b/drivers/spi/spi-mem.c
+index 701838b6f0c40..edd7430d4c052 100644
+--- a/drivers/spi/spi-mem.c
++++ b/drivers/spi/spi-mem.c
+@@ -325,7 +325,7 @@ int spi_mem_exec_op(struct spi_mem *mem, const struct spi_mem_op *op)
+ if (!spi_mem_internal_supports_op(mem, op))
+ return -ENOTSUPP;
+
+- if (ctlr->mem_ops && ctlr->mem_ops->exec_op && !mem->spi->cs_gpiod) {
++ if (ctlr->mem_ops && ctlr->mem_ops->exec_op && !spi_get_csgpiod(mem->spi, 0)) {
+ ret = spi_mem_access_start(mem);
+ if (ret)
+ return ret;
+@@ -808,7 +808,7 @@ int spi_mem_poll_status(struct spi_mem *mem,
+ op->data.dir != SPI_MEM_DATA_IN)
+ return -EINVAL;
+
+- if (ctlr->mem_ops && ctlr->mem_ops->poll_status && !mem->spi->cs_gpiod) {
++ if (ctlr->mem_ops && ctlr->mem_ops->poll_status && !spi_get_csgpiod(mem->spi, 0)) {
+ ret = spi_mem_access_start(mem);
+ if (ret)
+ return ret;
+diff --git a/drivers/spi/spi-meson-spicc.c b/drivers/spi/spi-meson-spicc.c
+index d47f2623a60fa..0d45cf8a2e723 100644
+--- a/drivers/spi/spi-meson-spicc.c
++++ b/drivers/spi/spi-meson-spicc.c
+@@ -505,7 +505,7 @@ static int meson_spicc_prepare_message(struct spi_master *master,
+ conf |= FIELD_PREP(SPICC_DRCTL_MASK, SPICC_DRCTL_IGNORE);
+
+ /* Select CS */
+- conf |= FIELD_PREP(SPICC_CS_MASK, spi->chip_select);
++ conf |= FIELD_PREP(SPICC_CS_MASK, spi_get_chipselect(spi, 0));
+
+ /* Default 8bit word */
+ conf |= FIELD_PREP(SPICC_BITLENGTH_MASK, 8 - 1);
+diff --git a/drivers/spi/spi-microchip-core.c b/drivers/spi/spi-microchip-core.c
+index aeaa1da88f39e..1a90fcfe60151 100644
+--- a/drivers/spi/spi-microchip-core.c
++++ b/drivers/spi/spi-microchip-core.c
+@@ -247,8 +247,8 @@ static void mchp_corespi_set_cs(struct spi_device *spi, bool disable)
+ struct mchp_corespi *corespi = spi_master_get_devdata(spi->master);
+
+ reg = mchp_corespi_read(corespi, REG_SLAVE_SELECT);
+- reg &= ~BIT(spi->chip_select);
+- reg |= !disable << spi->chip_select;
++ reg &= ~BIT(spi_get_chipselect(spi, 0));
++ reg |= !disable << spi_get_chipselect(spi, 0);
+
+ mchp_corespi_write(corespi, REG_SLAVE_SELECT, reg);
+ }
+@@ -265,7 +265,7 @@ static int mchp_corespi_setup(struct spi_device *spi)
+ */
+ if (spi->mode & SPI_CS_HIGH) {
+ reg = mchp_corespi_read(corespi, REG_SLAVE_SELECT);
+- reg |= BIT(spi->chip_select);
++ reg |= BIT(spi_get_chipselect(spi, 0));
+ mchp_corespi_write(corespi, REG_SLAVE_SELECT, reg);
+ }
+ return 0;
+diff --git a/drivers/spi/spi-mpc512x-psc.c b/drivers/spi/spi-mpc512x-psc.c
+index 0b4d49ef84de8..1e7d081c141ae 100644
+--- a/drivers/spi/spi-mpc512x-psc.c
++++ b/drivers/spi/spi-mpc512x-psc.c
+@@ -124,17 +124,17 @@ static void mpc512x_psc_spi_activate_cs(struct spi_device *spi)
+ out_be32(psc_addr(mps, ccr), ccr);
+ mps->bits_per_word = cs->bits_per_word;
+
+- if (spi->cs_gpiod) {
++ if (spi_get_csgpiod(spi, 0)) {
+ /* gpiolib will deal with the inversion */
+- gpiod_set_value(spi->cs_gpiod, 1);
++ gpiod_set_value(spi_get_csgpiod(spi, 0), 1);
+ }
+ }
+
+ static void mpc512x_psc_spi_deactivate_cs(struct spi_device *spi)
+ {
+- if (spi->cs_gpiod) {
++ if (spi_get_csgpiod(spi, 0)) {
+ /* gpiolib will deal with the inversion */
+- gpiod_set_value(spi->cs_gpiod, 0);
++ gpiod_set_value(spi_get_csgpiod(spi, 0), 0);
+ }
+ }
+
+diff --git a/drivers/spi/spi-mpc52xx.c b/drivers/spi/spi-mpc52xx.c
+index 7b64e64c65cfe..c474a767fc484 100644
+--- a/drivers/spi/spi-mpc52xx.c
++++ b/drivers/spi/spi-mpc52xx.c
+@@ -101,7 +101,7 @@ static void mpc52xx_spi_chipsel(struct mpc52xx_spi *ms, int value)
+ int cs;
+
+ if (ms->gpio_cs_count > 0) {
+- cs = ms->message->spi->chip_select;
++ cs = spi_get_chipselect(ms->message->spi, 0);
+ gpiod_set_value(ms->gpio_cs[cs], value);
+ } else {
+ out_8(ms->regs + SPI_PORTDATA, value ? 0 : 0x08);
+diff --git a/drivers/spi/spi-mt65xx.c b/drivers/spi/spi-mt65xx.c
+index 9eab6c20dbc56..21c321f437667 100644
+--- a/drivers/spi/spi-mt65xx.c
++++ b/drivers/spi/spi-mt65xx.c
+@@ -421,7 +421,7 @@ static int mtk_spi_hw_init(struct spi_master *master,
+
+ /* pad select */
+ if (mdata->dev_comp->need_pad_sel)
+- writel(mdata->pad_sel[spi->chip_select],
++ writel(mdata->pad_sel[spi_get_chipselect(spi, 0)],
+ mdata->base + SPI_PAD_SEL_REG);
+
+ /* tick delay */
+@@ -735,9 +735,9 @@ static int mtk_spi_setup(struct spi_device *spi)
+ if (!spi->controller_data)
+ spi->controller_data = (void *)&mtk_default_chip_info;
+
+- if (mdata->dev_comp->need_pad_sel && spi->cs_gpiod)
++ if (mdata->dev_comp->need_pad_sel && spi_get_csgpiod(spi, 0))
+ /* CS de-asserted, gpiolib will handle inversion */
+- gpiod_direction_output(spi->cs_gpiod, 0);
++ gpiod_direction_output(spi_get_csgpiod(spi, 0), 0);
+
+ return 0;
+ }
+diff --git a/drivers/spi/spi-mt7621.c b/drivers/spi/spi-mt7621.c
+index c4cc8e2f85e2f..3e9d396b33bd3 100644
+--- a/drivers/spi/spi-mt7621.c
++++ b/drivers/spi/spi-mt7621.c
+@@ -76,7 +76,7 @@ static inline void mt7621_spi_write(struct mt7621_spi *rs, u32 reg, u32 val)
+ static void mt7621_spi_set_cs(struct spi_device *spi, int enable)
+ {
+ struct mt7621_spi *rs = spidev_to_mt7621_spi(spi);
+- int cs = spi->chip_select;
++ int cs = spi_get_chipselect(spi, 0);
+ u32 polar = 0;
+ u32 master;
+
+diff --git a/drivers/spi/spi-mux.c b/drivers/spi/spi-mux.c
+index 0709e987bd5ab..fa8c1f740c702 100644
+--- a/drivers/spi/spi-mux.c
++++ b/drivers/spi/spi-mux.c
+@@ -51,22 +51,22 @@ static int spi_mux_select(struct spi_device *spi)
+ struct spi_mux_priv *priv = spi_controller_get_devdata(spi->controller);
+ int ret;
+
+- ret = mux_control_select(priv->mux, spi->chip_select);
++ ret = mux_control_select(priv->mux, spi_get_chipselect(spi, 0));
+ if (ret)
+ return ret;
+
+- if (priv->current_cs == spi->chip_select)
++ if (priv->current_cs == spi_get_chipselect(spi, 0))
+ return 0;
+
+ dev_dbg(&priv->spi->dev, "setting up the mux for cs %d\n",
+- spi->chip_select);
++ spi_get_chipselect(spi, 0));
+
+ /* copy the child device's settings except for the cs */
+ priv->spi->max_speed_hz = spi->max_speed_hz;
+ priv->spi->mode = spi->mode;
+ priv->spi->bits_per_word = spi->bits_per_word;
+
+- priv->current_cs = spi->chip_select;
++ priv->current_cs = spi_get_chipselect(spi, 0);
+
+ return 0;
+ }
+diff --git a/drivers/spi/spi-mxic.c b/drivers/spi/spi-mxic.c
+index a3dba17390eba..52bd2c49c34e2 100644
+--- a/drivers/spi/spi-mxic.c
++++ b/drivers/spi/spi-mxic.c
+@@ -306,8 +306,8 @@ static u32 mxic_spi_prep_hc_cfg(struct spi_device *spi, u32 flags)
+ nio = 2;
+
+ return flags | HC_CFG_NIO(nio) |
+- HC_CFG_TYPE(spi->chip_select, HC_CFG_TYPE_SPI_NOR) |
+- HC_CFG_SLV_ACT(spi->chip_select) | HC_CFG_IDLE_SIO_LVL(1);
++ HC_CFG_TYPE(spi_get_chipselect(spi, 0), HC_CFG_TYPE_SPI_NOR) |
++ HC_CFG_SLV_ACT(spi_get_chipselect(spi, 0)) | HC_CFG_IDLE_SIO_LVL(1);
+ }
+
+ static u32 mxic_spi_mem_prep_op_cfg(const struct spi_mem_op *op,
+@@ -405,7 +405,7 @@ static ssize_t mxic_spi_mem_dirmap_read(struct spi_mem_dirmap_desc *desc,
+ len = min_t(size_t, len, mxic->linear.size);
+ writel(len, mxic->regs + LRD_RANGE);
+ writel(LMODE_CMD0(desc->info.op_tmpl.cmd.opcode) |
+- LMODE_SLV_ACT(desc->mem->spi->chip_select) |
++ LMODE_SLV_ACT(spi_get_chipselect(desc->mem->spi, 0)) |
+ LMODE_EN,
+ mxic->regs + LRD_CTRL);
+
+@@ -449,7 +449,7 @@ static ssize_t mxic_spi_mem_dirmap_write(struct spi_mem_dirmap_desc *desc,
+ len = min_t(size_t, len, mxic->linear.size);
+ writel(len, mxic->regs + LWR_RANGE);
+ writel(LMODE_CMD0(desc->info.op_tmpl.cmd.opcode) |
+- LMODE_SLV_ACT(desc->mem->spi->chip_select) |
++ LMODE_SLV_ACT(spi_get_chipselect(desc->mem->spi, 0)) |
+ LMODE_EN,
+ mxic->regs + LWR_CTRL);
+
+@@ -524,7 +524,7 @@ static int mxic_spi_mem_exec_op(struct spi_mem *mem,
+ writel(HC_EN_BIT, mxic->regs + HC_EN);
+
+ writel(mxic_spi_mem_prep_op_cfg(op, op->data.nbytes),
+- mxic->regs + SS_CTRL(mem->spi->chip_select));
++ mxic->regs + SS_CTRL(spi_get_chipselect(mem->spi, 0)));
+
+ writel(readl(mxic->regs + HC_CFG) | HC_CFG_MAN_CS_ASSERT,
+ mxic->regs + HC_CFG);
+diff --git a/drivers/spi/spi-mxs.c b/drivers/spi/spi-mxs.c
+index 55178579f3c6f..98076aa4b1c7e 100644
+--- a/drivers/spi/spi-mxs.c
++++ b/drivers/spi/spi-mxs.c
+@@ -369,7 +369,7 @@ static int mxs_spi_transfer_one(struct spi_master *master,
+ /* Program CS register bits here, it will be used for all transfers. */
+ writel(BM_SSP_CTRL0_WAIT_FOR_CMD | BM_SSP_CTRL0_WAIT_FOR_IRQ,
+ ssp->base + HW_SSP_CTRL0 + STMP_OFFSET_REG_CLR);
+- writel(mxs_spi_cs_to_reg(m->spi->chip_select),
++ writel(mxs_spi_cs_to_reg(spi_get_chipselect(m->spi, 0)),
+ ssp->base + HW_SSP_CTRL0 + STMP_OFFSET_REG_SET);
+
+ list_for_each_entry(t, &m->transfers, transfer_list) {
+diff --git a/drivers/spi/spi-npcm-fiu.c b/drivers/spi/spi-npcm-fiu.c
+index 559d3a5b4062c..86e3978883fef 100644
+--- a/drivers/spi/spi-npcm-fiu.c
++++ b/drivers/spi/spi-npcm-fiu.c
+@@ -288,7 +288,7 @@ static ssize_t npcm_fiu_direct_read(struct spi_mem_dirmap_desc *desc,
+ {
+ struct npcm_fiu_spi *fiu =
+ spi_controller_get_devdata(desc->mem->spi->master);
+- struct npcm_fiu_chip *chip = &fiu->chip[desc->mem->spi->chip_select];
++ struct npcm_fiu_chip *chip = &fiu->chip[spi_get_chipselect(desc->mem->spi, 0)];
+ void __iomem *src = (void __iomem *)(chip->flash_region_mapped_ptr +
+ offs);
+ u8 *buf_rx = buf;
+@@ -315,7 +315,7 @@ static ssize_t npcm_fiu_direct_write(struct spi_mem_dirmap_desc *desc,
+ {
+ struct npcm_fiu_spi *fiu =
+ spi_controller_get_devdata(desc->mem->spi->master);
+- struct npcm_fiu_chip *chip = &fiu->chip[desc->mem->spi->chip_select];
++ struct npcm_fiu_chip *chip = &fiu->chip[spi_get_chipselect(desc->mem->spi, 0)];
+ void __iomem *dst = (void __iomem *)(chip->flash_region_mapped_ptr +
+ offs);
+ const u8 *buf_tx = buf;
+@@ -344,7 +344,7 @@ static int npcm_fiu_uma_read(struct spi_mem *mem,
+
+ regmap_update_bits(fiu->regmap, NPCM_FIU_UMA_CTS,
+ NPCM_FIU_UMA_CTS_DEV_NUM,
+- (mem->spi->chip_select <<
++ (spi_get_chipselect(mem->spi, 0) <<
+ NPCM_FIU_UMA_CTS_DEV_NUM_SHIFT));
+ regmap_update_bits(fiu->regmap, NPCM_FIU_UMA_CMD,
+ NPCM_FIU_UMA_CMD_CMD, op->cmd.opcode);
+@@ -398,7 +398,7 @@ static int npcm_fiu_uma_write(struct spi_mem *mem,
+
+ regmap_update_bits(fiu->regmap, NPCM_FIU_UMA_CTS,
+ NPCM_FIU_UMA_CTS_DEV_NUM,
+- (mem->spi->chip_select <<
++ (spi_get_chipselect(mem->spi, 0) <<
+ NPCM_FIU_UMA_CTS_DEV_NUM_SHIFT));
+
+ regmap_update_bits(fiu->regmap, NPCM_FIU_UMA_CMD,
+@@ -451,7 +451,7 @@ static int npcm_fiu_manualwrite(struct spi_mem *mem,
+
+ regmap_update_bits(fiu->regmap, NPCM_FIU_UMA_CTS,
+ NPCM_FIU_UMA_CTS_DEV_NUM,
+- (mem->spi->chip_select <<
++ (spi_get_chipselect(mem->spi, 0) <<
+ NPCM_FIU_UMA_CTS_DEV_NUM_SHIFT));
+ regmap_update_bits(fiu->regmap, NPCM_FIU_UMA_CTS,
+ NPCM_FIU_UMA_CTS_SW_CS, 0);
+@@ -545,7 +545,7 @@ static int npcm_fiu_exec_op(struct spi_mem *mem, const struct spi_mem_op *op)
+ {
+ struct npcm_fiu_spi *fiu =
+ spi_controller_get_devdata(mem->spi->master);
+- struct npcm_fiu_chip *chip = &fiu->chip[mem->spi->chip_select];
++ struct npcm_fiu_chip *chip = &fiu->chip[spi_get_chipselect(mem->spi, 0)];
+ int ret = 0;
+ u8 *buf;
+
+@@ -605,7 +605,7 @@ static int npcm_fiu_dirmap_create(struct spi_mem_dirmap_desc *desc)
+ {
+ struct npcm_fiu_spi *fiu =
+ spi_controller_get_devdata(desc->mem->spi->master);
+- struct npcm_fiu_chip *chip = &fiu->chip[desc->mem->spi->chip_select];
++ struct npcm_fiu_chip *chip = &fiu->chip[spi_get_chipselect(desc->mem->spi, 0)];
+ struct regmap *gcr_regmap;
+
+ if (!fiu->res_mem) {
+@@ -624,7 +624,7 @@ static int npcm_fiu_dirmap_create(struct spi_mem_dirmap_desc *desc)
+ chip->flash_region_mapped_ptr =
+ devm_ioremap(fiu->dev, (fiu->res_mem->start +
+ (fiu->info->max_map_size *
+- desc->mem->spi->chip_select)),
++ spi_get_chipselect(desc->mem->spi, 0))),
+ (u32)desc->info.length);
+ if (!chip->flash_region_mapped_ptr) {
+ dev_warn(fiu->dev, "Error mapping memory region, direct read disabled\n");
+@@ -669,9 +669,9 @@ static int npcm_fiu_setup(struct spi_device *spi)
+ struct npcm_fiu_spi *fiu = spi_controller_get_devdata(ctrl);
+ struct npcm_fiu_chip *chip;
+
+- chip = &fiu->chip[spi->chip_select];
++ chip = &fiu->chip[spi_get_chipselect(spi, 0)];
+ chip->fiu = fiu;
+- chip->chipselect = spi->chip_select;
++ chip->chipselect = spi_get_chipselect(spi, 0);
+ chip->clkrate = spi->max_speed_hz;
+
+ fiu->clkrate = clk_get_rate(fiu->clk);
+diff --git a/drivers/spi/spi-nxp-fspi.c b/drivers/spi/spi-nxp-fspi.c
+index 1c1991a26c153..e9baf93aef7e1 100644
+--- a/drivers/spi/spi-nxp-fspi.c
++++ b/drivers/spi/spi-nxp-fspi.c
+@@ -663,7 +663,7 @@ static void nxp_fspi_select_mem(struct nxp_fspi *f, struct spi_device *spi)
+ * Return, if previously selected slave device is same as current
+ * requested slave device.
+ */
+- if (f->selected == spi->chip_select)
++ if (f->selected == spi_get_chipselect(spi, 0))
+ return;
+
+ /* Reset FLSHxxCR0 registers */
+@@ -676,9 +676,9 @@ static void nxp_fspi_select_mem(struct nxp_fspi *f, struct spi_device *spi)
+ size_kb = FSPI_FLSHXCR0_SZ(f->memmap_phy_size);
+
+ fspi_writel(f, size_kb, f->iobase + FSPI_FLSHA1CR0 +
+- 4 * spi->chip_select);
++ 4 * spi_get_chipselect(spi, 0));
+
+- dev_dbg(f->dev, "Slave device [CS:%x] selected\n", spi->chip_select);
++ dev_dbg(f->dev, "Slave device [CS:%x] selected\n", spi_get_chipselect(spi, 0));
+
+ nxp_fspi_clk_disable_unprep(f);
+
+@@ -690,7 +690,7 @@ static void nxp_fspi_select_mem(struct nxp_fspi *f, struct spi_device *spi)
+ if (ret)
+ return;
+
+- f->selected = spi->chip_select;
++ f->selected = spi_get_chipselect(spi, 0);
+ }
+
+ static int nxp_fspi_read_ahb(struct nxp_fspi *f, const struct spi_mem_op *op)
+@@ -1055,7 +1055,7 @@ static const char *nxp_fspi_get_name(struct spi_mem *mem)
+
+ name = devm_kasprintf(dev, GFP_KERNEL,
+ "%s-%d", dev_name(f->dev),
+- mem->spi->chip_select);
++ spi_get_chipselect(mem->spi, 0));
+
+ if (!name) {
+ dev_err(dev, "failed to get memory for custom flash name\n");
+diff --git a/drivers/spi/spi-omap-uwire.c b/drivers/spi/spi-omap-uwire.c
+index 20c87163d612e..5b3a5e654ddd4 100644
+--- a/drivers/spi/spi-omap-uwire.c
++++ b/drivers/spi/spi-omap-uwire.c
+@@ -179,7 +179,7 @@ static void uwire_chipselect(struct spi_device *spi, int value)
+
+ w = uwire_read_reg(UWIRE_CSR);
+ old_cs = (w >> 10) & 0x03;
+- if (value == BITBANG_CS_INACTIVE || old_cs != spi->chip_select) {
++ if (value == BITBANG_CS_INACTIVE || old_cs != spi_get_chipselect(spi, 0)) {
+ /* Deselect this CS, or the previous CS */
+ w &= ~CS_CMD;
+ uwire_write_reg(UWIRE_CSR, w);
+@@ -193,7 +193,7 @@ static void uwire_chipselect(struct spi_device *spi, int value)
+ else
+ uwire_write_reg(UWIRE_SR4, 0);
+
+- w = spi->chip_select << 10;
++ w = spi_get_chipselect(spi, 0) << 10;
+ w |= CS_CMD;
+ uwire_write_reg(UWIRE_CSR, w);
+ }
+@@ -210,7 +210,7 @@ static int uwire_txrx(struct spi_device *spi, struct spi_transfer *t)
+ if (!t->tx_buf && !t->rx_buf)
+ return 0;
+
+- w = spi->chip_select << 10;
++ w = spi_get_chipselect(spi, 0) << 10;
+ w |= CS_CMD;
+
+ if (t->tx_buf) {
+@@ -408,7 +408,7 @@ static int uwire_setup_transfer(struct spi_device *spi, struct spi_transfer *t)
+ rate /= 8;
+ break;
+ }
+- omap_uwire_configure_mode(spi->chip_select, flags);
++ omap_uwire_configure_mode(spi_get_chipselect(spi, 0), flags);
+ pr_debug("%s: uwire flags %02x, armxor %lu KHz, SCK %lu KHz\n",
+ __func__, flags,
+ clk_get_rate(uwire->ck) / 1000,
+diff --git a/drivers/spi/spi-omap2-mcspi.c b/drivers/spi/spi-omap2-mcspi.c
+index 6ba9b0d7710b0..5e404da112a2f 100644
+--- a/drivers/spi/spi-omap2-mcspi.c
++++ b/drivers/spi/spi-omap2-mcspi.c
+@@ -379,7 +379,7 @@ static void omap2_mcspi_rx_callback(void *data)
+ {
+ struct spi_device *spi = data;
+ struct omap2_mcspi *mcspi = spi_master_get_devdata(spi->master);
+- struct omap2_mcspi_dma *mcspi_dma = &mcspi->dma_channels[spi->chip_select];
++ struct omap2_mcspi_dma *mcspi_dma = &mcspi->dma_channels[spi_get_chipselect(spi, 0)];
+
+ /* We must disable the DMA RX request */
+ omap2_mcspi_set_dma_req(spi, 1, 0);
+@@ -391,7 +391,7 @@ static void omap2_mcspi_tx_callback(void *data)
+ {
+ struct spi_device *spi = data;
+ struct omap2_mcspi *mcspi = spi_master_get_devdata(spi->master);
+- struct omap2_mcspi_dma *mcspi_dma = &mcspi->dma_channels[spi->chip_select];
++ struct omap2_mcspi_dma *mcspi_dma = &mcspi->dma_channels[spi_get_chipselect(spi, 0)];
+
+ /* We must disable the DMA TX request */
+ omap2_mcspi_set_dma_req(spi, 0, 0);
+@@ -408,7 +408,7 @@ static void omap2_mcspi_tx_dma(struct spi_device *spi,
+ struct dma_async_tx_descriptor *tx;
+
+ mcspi = spi_master_get_devdata(spi->master);
+- mcspi_dma = &mcspi->dma_channels[spi->chip_select];
++ mcspi_dma = &mcspi->dma_channels[spi_get_chipselect(spi, 0)];
+
+ dmaengine_slave_config(mcspi_dma->dma_tx, &cfg);
+
+@@ -446,7 +446,7 @@ omap2_mcspi_rx_dma(struct spi_device *spi, struct spi_transfer *xfer,
+ struct dma_async_tx_descriptor *tx;
+
+ mcspi = spi_master_get_devdata(spi->master);
+- mcspi_dma = &mcspi->dma_channels[spi->chip_select];
++ mcspi_dma = &mcspi->dma_channels[spi_get_chipselect(spi, 0)];
+ count = xfer->len;
+
+ /*
+@@ -591,7 +591,7 @@ omap2_mcspi_txrx_dma(struct spi_device *spi, struct spi_transfer *xfer)
+ int wait_res;
+
+ mcspi = spi_master_get_devdata(spi->master);
+- mcspi_dma = &mcspi->dma_channels[spi->chip_select];
++ mcspi_dma = &mcspi->dma_channels[spi_get_chipselect(spi, 0)];
+
+ if (cs->word_len <= 8) {
+ width = DMA_SLAVE_BUSWIDTH_1_BYTE;
+@@ -1062,8 +1062,8 @@ static int omap2_mcspi_setup(struct spi_device *spi)
+ cs = kzalloc(sizeof(*cs), GFP_KERNEL);
+ if (!cs)
+ return -ENOMEM;
+- cs->base = mcspi->base + spi->chip_select * 0x14;
+- cs->phys = mcspi->phys + spi->chip_select * 0x14;
++ cs->base = mcspi->base + spi_get_chipselect(spi, 0) * 0x14;
++ cs->phys = mcspi->phys + spi_get_chipselect(spi, 0) * 0x14;
+ cs->mode = 0;
+ cs->chconf0 = 0;
+ cs->chctrl0 = 0;
+@@ -1142,7 +1142,7 @@ static int omap2_mcspi_transfer_one(struct spi_master *master,
+ u32 chconf;
+
+ mcspi = spi_master_get_devdata(master);
+- mcspi_dma = mcspi->dma_channels + spi->chip_select;
++ mcspi_dma = mcspi->dma_channels + spi_get_chipselect(spi, 0);
+ cs = spi->controller_state;
+ cd = spi->controller_data;
+
+@@ -1158,7 +1158,7 @@ static int omap2_mcspi_transfer_one(struct spi_master *master,
+
+ omap2_mcspi_set_enable(spi, 0);
+
+- if (spi->cs_gpiod)
++ if (spi_get_csgpiod(spi, 0))
+ omap2_mcspi_set_cs(spi, spi->mode & SPI_CS_HIGH);
+
+ if (par_override ||
+@@ -1247,7 +1247,7 @@ static int omap2_mcspi_transfer_one(struct spi_master *master,
+
+ omap2_mcspi_set_enable(spi, 0);
+
+- if (spi->cs_gpiod)
++ if (spi_get_csgpiod(spi, 0))
+ omap2_mcspi_set_cs(spi, !(spi->mode & SPI_CS_HIGH));
+
+ if (mcspi->fifo_depth > 0 && t)
+@@ -1289,7 +1289,7 @@ static bool omap2_mcspi_can_dma(struct spi_master *master,
+ {
+ struct omap2_mcspi *mcspi = spi_master_get_devdata(spi->master);
+ struct omap2_mcspi_dma *mcspi_dma =
+- &mcspi->dma_channels[spi->chip_select];
++ &mcspi->dma_channels[spi_get_chipselect(spi, 0)];
+
+ if (!mcspi_dma->dma_rx || !mcspi_dma->dma_tx)
+ return false;
+@@ -1307,7 +1307,7 @@ static size_t omap2_mcspi_max_xfer_size(struct spi_device *spi)
+ {
+ struct omap2_mcspi *mcspi = spi_master_get_devdata(spi->master);
+ struct omap2_mcspi_dma *mcspi_dma =
+- &mcspi->dma_channels[spi->chip_select];
++ &mcspi->dma_channels[spi_get_chipselect(spi, 0)];
+
+ if (mcspi->max_xfer_len && mcspi_dma->dma_rx)
+ return mcspi->max_xfer_len;
+diff --git a/drivers/spi/spi-orion.c b/drivers/spi/spi-orion.c
+index 565cd4c48d7bd..13e60976692cc 100644
+--- a/drivers/spi/spi-orion.c
++++ b/drivers/spi/spi-orion.c
+@@ -346,7 +346,7 @@ static void orion_spi_set_cs(struct spi_device *spi, bool enable)
+ * as it is handled by a GPIO, but that doesn't matter. What we need
+ * is to deassert the old chip select and assert some other chip select.
+ */
+- val |= ORION_SPI_CS(spi->chip_select);
++ val |= ORION_SPI_CS(spi_get_chipselect(spi, 0));
+
+ /*
+ * Chip select logic is inverted from spi_set_cs(). For lines using a
+@@ -470,7 +470,7 @@ orion_spi_write_read(struct spi_device *spi, struct spi_transfer *xfer)
+ unsigned int count;
+ int word_len;
+ struct orion_spi *orion_spi;
+- int cs = spi->chip_select;
++ int cs = spi_get_chipselect(spi, 0);
+ void __iomem *vaddr;
+
+ word_len = spi->bits_per_word;
+diff --git a/drivers/spi/spi-pci1xxxx.c b/drivers/spi/spi-pci1xxxx.c
+index 13efbfeff92ce..82d4bfeea1fa4 100644
+--- a/drivers/spi/spi-pci1xxxx.c
++++ b/drivers/spi/spi-pci1xxxx.c
+@@ -116,11 +116,11 @@ static void pci1xxxx_spi_set_cs(struct spi_device *spi, bool enable)
+ regval = readl(par->reg_base + SPI_MST_CTL_REG_OFFSET(p->hw_inst));
+ if (enable) {
+ regval &= ~SPI_MST_CTL_DEVSEL_MASK;
+- regval |= (spi->chip_select << 25);
++ regval |= (spi_get_chipselect(spi, 0) << 25);
+ writel(regval,
+ par->reg_base + SPI_MST_CTL_REG_OFFSET(p->hw_inst));
+ } else {
+- regval &= ~(spi->chip_select << 25);
++ regval &= ~(spi_get_chipselect(spi, 0) << 25);
+ writel(regval,
+ par->reg_base + SPI_MST_CTL_REG_OFFSET(p->hw_inst));
+
+diff --git a/drivers/spi/spi-pic32-sqi.c b/drivers/spi/spi-pic32-sqi.c
+index 86ad17597f5fd..ed02d17897d19 100644
+--- a/drivers/spi/spi-pic32-sqi.c
++++ b/drivers/spi/spi-pic32-sqi.c
+@@ -267,7 +267,7 @@ static int pic32_sqi_one_transfer(struct pic32_sqi *sqi,
+ u32 nbits;
+
+ /* Device selection */
+- bd_ctrl = spi->chip_select << BD_DEVSEL_SHIFT;
++ bd_ctrl = spi_get_chipselect(spi, 0) << BD_DEVSEL_SHIFT;
+
+ /* half-duplex: select transfer buffer, direction and lane */
+ if (xfer->rx_buf) {
+diff --git a/drivers/spi/spi-pic32.c b/drivers/spi/spi-pic32.c
+index 7e5c09a7d4890..387673694f911 100644
+--- a/drivers/spi/spi-pic32.c
++++ b/drivers/spi/spi-pic32.c
+@@ -591,7 +591,7 @@ static int pic32_spi_setup(struct spi_device *spi)
+ * unreliable/erroneous SPI transactions.
+ * To avoid that we will always handle /CS by toggling GPIO.
+ */
+- if (!spi->cs_gpiod)
++ if (!spi_get_csgpiod(spi, 0))
+ return -EINVAL;
+
+ return 0;
+@@ -600,7 +600,7 @@ static int pic32_spi_setup(struct spi_device *spi)
+ static void pic32_spi_cleanup(struct spi_device *spi)
+ {
+ /* de-activate cs-gpio, gpiolib will handle inversion */
+- gpiod_direction_output(spi->cs_gpiod, 0);
++ gpiod_direction_output(spi_get_csgpiod(spi, 0), 0);
+ }
+
+ static int pic32_spi_dma_prep(struct pic32_spi *pic32s, struct device *dev)
+diff --git a/drivers/spi/spi-pl022.c b/drivers/spi/spi-pl022.c
+index a17ff839117f9..982407bc5d9f9 100644
+--- a/drivers/spi/spi-pl022.c
++++ b/drivers/spi/spi-pl022.c
+@@ -1587,9 +1587,9 @@ static int pl022_transfer_one_message(struct spi_master *master,
+
+ /* Setup the SPI using the per chip configuration */
+ pl022->cur_chip = spi_get_ctldata(msg->spi);
+- pl022->cur_cs = msg->spi->chip_select;
++ pl022->cur_cs = spi_get_chipselect(msg->spi, 0);
+ /* This is always available but may be set to -ENOENT */
+- pl022->cur_gpiod = msg->spi->cs_gpiod;
++ pl022->cur_gpiod = spi_get_csgpiod(msg->spi, 0);
+
+ restore_state(pl022);
+ flush(pl022);
+diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c
+index 32cc82a89ec1e..abcdc1eb1a40f 100644
+--- a/drivers/spi/spi-pxa2xx.c
++++ b/drivers/spi/spi-pxa2xx.c
+@@ -368,7 +368,7 @@ static void lpss_ssp_select_cs(struct spi_device *spi,
+
+ value = __lpss_ssp_read_priv(drv_data, config->reg_cs_ctrl);
+
+- cs = spi->chip_select;
++ cs = spi_get_chipselect(spi, 0);
+ cs <<= config->cs_sel_shift;
+ if (cs != (value & config->cs_sel_mask)) {
+ /*
+@@ -429,7 +429,7 @@ static void cs_assert(struct spi_device *spi)
+ spi_controller_get_devdata(spi->controller);
+
+ if (drv_data->ssp_type == CE4100_SSP) {
+- pxa2xx_spi_write(drv_data, SSSR, spi->chip_select);
++ pxa2xx_spi_write(drv_data, SSSR, spi_get_chipselect(spi, 0));
+ return;
+ }
+
+@@ -1217,7 +1217,7 @@ static int setup(struct spi_device *spi)
+ return -ENOMEM;
+
+ if (drv_data->ssp_type == CE4100_SSP) {
+- if (spi->chip_select > 4) {
++ if (spi_get_chipselect(spi, 0) > 4) {
+ dev_err(&spi->dev,
+ "failed setup: cs number must not be > 4.\n");
+ kfree(chip);
+diff --git a/drivers/spi/spi-qcom-qspi.c b/drivers/spi/spi-qcom-qspi.c
+index c334dfec4117a..33c056fd5f4b7 100644
+--- a/drivers/spi/spi-qcom-qspi.c
++++ b/drivers/spi/spi-qcom-qspi.c
+@@ -311,7 +311,7 @@ static int qcom_qspi_prepare_message(struct spi_master *master,
+
+ mstr_cfg = readl(ctrl->base + MSTR_CONFIG);
+ mstr_cfg &= ~CHIP_SELECT_NUM;
+- if (message->spi->chip_select)
++ if (spi_get_chipselect(message->spi, 0))
+ mstr_cfg |= CHIP_SELECT_NUM;
+
+ mstr_cfg |= FB_CLK_EN | PIN_WPN | PIN_HOLDN | SBL_EN | FULL_CYCLE_MODE;
+diff --git a/drivers/spi/spi-rb4xx.c b/drivers/spi/spi-rb4xx.c
+index 9f97d18a05c10..3c79a5d85ac26 100644
+--- a/drivers/spi/spi-rb4xx.c
++++ b/drivers/spi/spi-rb4xx.c
+@@ -107,7 +107,7 @@ static int rb4xx_transfer_one(struct spi_master *master,
+ * command set was designed to almost not clash with that of the
+ * boot flash.
+ */
+- if (spi->chip_select == 2)
++ if (spi_get_chipselect(spi, 0) == 2)
+ /* MMC */
+ spi_ioc = AR71XX_SPI_IOC_CS0;
+ else
+diff --git a/drivers/spi/spi-rockchip-sfc.c b/drivers/spi/spi-rockchip-sfc.c
+index 69347b6bf60cd..ce658295579a4 100644
+--- a/drivers/spi/spi-rockchip-sfc.c
++++ b/drivers/spi/spi-rockchip-sfc.c
+@@ -346,7 +346,7 @@ static int rockchip_sfc_xfer_setup(struct rockchip_sfc *sfc,
+
+ /* set the Controller */
+ ctrl |= SFC_CTRL_PHASE_SEL_NEGETIVE;
+- cmd |= mem->spi->chip_select << SFC_CMD_CS_SHIFT;
++ cmd |= spi_get_chipselect(mem->spi, 0) << SFC_CMD_CS_SHIFT;
+
+ dev_dbg(sfc->dev, "sfc addr.nbytes=%x(x%d) dummy.nbytes=%x(x%d)\n",
+ op->addr.nbytes, op->addr.buswidth,
+diff --git a/drivers/spi/spi-rockchip.c b/drivers/spi/spi-rockchip.c
+index 79242dc5272de..adc5638eff4ba 100644
+--- a/drivers/spi/spi-rockchip.c
++++ b/drivers/spi/spi-rockchip.c
+@@ -246,28 +246,30 @@ static void rockchip_spi_set_cs(struct spi_device *spi, bool enable)
+ bool cs_asserted = spi->mode & SPI_CS_HIGH ? enable : !enable;
+
+ /* Return immediately for no-op */
+- if (cs_asserted == rs->cs_asserted[spi->chip_select])
++ if (cs_asserted == rs->cs_asserted[spi_get_chipselect(spi, 0)])
+ return;
+
+ if (cs_asserted) {
+ /* Keep things powered as long as CS is asserted */
+ pm_runtime_get_sync(rs->dev);
+
+- if (spi->cs_gpiod)
++ if (spi_get_csgpiod(spi, 0))
+ ROCKCHIP_SPI_SET_BITS(rs->regs + ROCKCHIP_SPI_SER, 1);
+ else
+- ROCKCHIP_SPI_SET_BITS(rs->regs + ROCKCHIP_SPI_SER, BIT(spi->chip_select));
++ ROCKCHIP_SPI_SET_BITS(rs->regs + ROCKCHIP_SPI_SER,
++ BIT(spi_get_chipselect(spi, 0)));
+ } else {
+- if (spi->cs_gpiod)
++ if (spi_get_csgpiod(spi, 0))
+ ROCKCHIP_SPI_CLR_BITS(rs->regs + ROCKCHIP_SPI_SER, 1);
+ else
+- ROCKCHIP_SPI_CLR_BITS(rs->regs + ROCKCHIP_SPI_SER, BIT(spi->chip_select));
++ ROCKCHIP_SPI_CLR_BITS(rs->regs + ROCKCHIP_SPI_SER,
++ BIT(spi_get_chipselect(spi, 0)));
+
+ /* Drop reference from when we first asserted CS */
+ pm_runtime_put(rs->dev);
+ }
+
+- rs->cs_asserted[spi->chip_select] = cs_asserted;
++ rs->cs_asserted[spi_get_chipselect(spi, 0)] = cs_asserted;
+ }
+
+ static void rockchip_spi_handle_err(struct spi_controller *ctlr,
+@@ -541,7 +543,7 @@ static int rockchip_spi_config(struct rockchip_spi *rs,
+ if (spi->mode & SPI_LSB_FIRST)
+ cr0 |= CR0_FBM_LSB << CR0_FBM_OFFSET;
+ if (spi->mode & SPI_CS_HIGH)
+- cr0 |= BIT(spi->chip_select) << CR0_SOI_OFFSET;
++ cr0 |= BIT(spi_get_chipselect(spi, 0)) << CR0_SOI_OFFSET;
+
+ if (xfer->rx_buf && xfer->tx_buf)
+ cr0 |= CR0_XFM_TR << CR0_XFM_OFFSET;
+@@ -724,7 +726,7 @@ static int rockchip_spi_setup(struct spi_device *spi)
+ struct rockchip_spi *rs = spi_controller_get_devdata(spi->controller);
+ u32 cr0;
+
+- if (!spi->cs_gpiod && (spi->mode & SPI_CS_HIGH) && !rs->cs_high_supported) {
++ if (!spi_get_csgpiod(spi, 0) && (spi->mode & SPI_CS_HIGH) && !rs->cs_high_supported) {
+ dev_warn(&spi->dev, "setup: non GPIO CS can't be active-high\n");
+ return -EINVAL;
+ }
+@@ -735,10 +737,10 @@ static int rockchip_spi_setup(struct spi_device *spi)
+
+ cr0 &= ~(0x3 << CR0_SCPH_OFFSET);
+ cr0 |= ((spi->mode & 0x3) << CR0_SCPH_OFFSET);
+- if (spi->mode & SPI_CS_HIGH && spi->chip_select <= 1)
+- cr0 |= BIT(spi->chip_select) << CR0_SOI_OFFSET;
+- else if (spi->chip_select <= 1)
+- cr0 &= ~(BIT(spi->chip_select) << CR0_SOI_OFFSET);
++ if (spi->mode & SPI_CS_HIGH && spi_get_chipselect(spi, 0) <= 1)
++ cr0 |= BIT(spi_get_chipselect(spi, 0)) << CR0_SOI_OFFSET;
++ else if (spi_get_chipselect(spi, 0) <= 1)
++ cr0 &= ~(BIT(spi_get_chipselect(spi, 0)) << CR0_SOI_OFFSET);
+
+ writel_relaxed(cr0, rs->regs + ROCKCHIP_SPI_CTRLR0);
+
+diff --git a/drivers/spi/spi-rspi.c b/drivers/spi/spi-rspi.c
+index 411b1307b7fd8..4d4b98f8eb80f 100644
+--- a/drivers/spi/spi-rspi.c
++++ b/drivers/spi/spi-rspi.c
+@@ -950,7 +950,7 @@ static int rspi_setup(struct spi_device *spi)
+ struct rspi_data *rspi = spi_controller_get_devdata(spi->controller);
+ u8 sslp;
+
+- if (spi->cs_gpiod)
++ if (spi_get_csgpiod(spi, 0))
+ return 0;
+
+ pm_runtime_get_sync(&rspi->pdev->dev);
+@@ -958,9 +958,9 @@ static int rspi_setup(struct spi_device *spi)
+
+ sslp = rspi_read8(rspi, RSPI_SSLP);
+ if (spi->mode & SPI_CS_HIGH)
+- sslp |= SSLP_SSLP(spi->chip_select);
++ sslp |= SSLP_SSLP(spi_get_chipselect(spi, 0));
+ else
+- sslp &= ~SSLP_SSLP(spi->chip_select);
++ sslp &= ~SSLP_SSLP(spi_get_chipselect(spi, 0));
+ rspi_write8(rspi, sslp, RSPI_SSLP);
+
+ spin_unlock_irq(&rspi->lock);
+@@ -1001,8 +1001,8 @@ static int rspi_prepare_message(struct spi_controller *ctlr,
+ rspi->spcmd |= SPCMD_LSBF;
+
+ /* Configure slave signal to assert */
+- rspi->spcmd |= SPCMD_SSLA(spi->cs_gpiod ? rspi->ctlr->unused_native_cs
+- : spi->chip_select);
++ rspi->spcmd |= SPCMD_SSLA(spi_get_csgpiod(spi, 0) ? rspi->ctlr->unused_native_cs
++ : spi_get_chipselect(spi, 0));
+
+ /* CMOS output mode and MOSI signal from previous transfer */
+ rspi->sppcr = 0;
+diff --git a/drivers/spi/spi-s3c64xx.c b/drivers/spi/spi-s3c64xx.c
+index 71d324ec9a70a..f6682bfe484c2 100644
+--- a/drivers/spi/spi-s3c64xx.c
++++ b/drivers/spi/spi-s3c64xx.c
+@@ -891,7 +891,7 @@ static int s3c64xx_spi_setup(struct spi_device *spi)
+
+ /* NULL is fine, we just avoid using the FB delay (=0) */
+ if (IS_ERR(cs)) {
+- dev_err(&spi->dev, "No CS for SPI(%d)\n", spi->chip_select);
++ dev_err(&spi->dev, "No CS for SPI(%d)\n", spi_get_chipselect(spi, 0));
+ return -ENODEV;
+ }
+
+diff --git a/drivers/spi/spi-sc18is602.c b/drivers/spi/spi-sc18is602.c
+index 983b3621bc2ad..a12adc68731b3 100644
+--- a/drivers/spi/spi-sc18is602.c
++++ b/drivers/spi/spi-sc18is602.c
+@@ -70,7 +70,7 @@ static int sc18is602_txrx(struct sc18is602 *hw, struct spi_message *msg,
+
+ if (hw->tlen == 0) {
+ /* First byte (I2C command) is chip select */
+- hw->buffer[0] = 1 << msg->spi->chip_select;
++ hw->buffer[0] = 1 << spi_get_chipselect(msg->spi, 0);
+ hw->tlen = 1;
+ hw->rindex = 0;
+ }
+@@ -229,7 +229,7 @@ static int sc18is602_setup(struct spi_device *spi)
+ struct sc18is602 *hw = spi_master_get_devdata(spi->master);
+
+ /* SC18IS602 does not support CS2 */
+- if (hw->id == sc18is602 && spi->chip_select == 2)
++ if (hw->id == sc18is602 && (spi_get_chipselect(spi, 0) == 2))
+ return -ENXIO;
+
+ return 0;
+diff --git a/drivers/spi/spi-sh-msiof.c b/drivers/spi/spi-sh-msiof.c
+index 9bca3d076f053..87cb975ce9dc0 100644
+--- a/drivers/spi/spi-sh-msiof.c
++++ b/drivers/spi/spi-sh-msiof.c
+@@ -554,7 +554,7 @@ static int sh_msiof_spi_setup(struct spi_device *spi)
+ spi_controller_get_devdata(spi->controller);
+ u32 clr, set, tmp;
+
+- if (spi->cs_gpiod || spi_controller_is_slave(p->ctlr))
++ if (spi_get_csgpiod(spi, 0) || spi_controller_is_slave(p->ctlr))
+ return 0;
+
+ if (p->native_cs_inited &&
+@@ -587,11 +587,11 @@ static int sh_msiof_prepare_message(struct spi_controller *ctlr,
+ u32 ss, cs_high;
+
+ /* Configure pins before asserting CS */
+- if (spi->cs_gpiod) {
++ if (spi_get_csgpiod((struct spi_device *)spi, 0)) {
+ ss = ctlr->unused_native_cs;
+ cs_high = p->native_cs_high;
+ } else {
+- ss = spi->chip_select;
++ ss = spi_get_chipselect((struct spi_device *)spi, 0);
+ cs_high = !!(spi->mode & SPI_CS_HIGH);
+ }
+ sh_msiof_spi_set_pin_regs(p, ss, !!(spi->mode & SPI_CPOL),
+diff --git a/drivers/spi/spi-sh-sci.c b/drivers/spi/spi-sh-sci.c
+index 8f30531e14186..3003dd7c72c8a 100644
+--- a/drivers/spi/spi-sh-sci.c
++++ b/drivers/spi/spi-sh-sci.c
+@@ -108,7 +108,7 @@ static void sh_sci_spi_chipselect(struct spi_device *dev, int value)
+ struct sh_sci_spi *sp = spi_master_get_devdata(dev->master);
+
+ if (sp->info->chip_select)
+- (sp->info->chip_select)(sp->info, dev->chip_select, value);
++ (sp->info->chip_select)(sp->info, spi_get_chipselect(dev, 0), value);
+ }
+
+ static int sh_sci_spi_probe(struct platform_device *dev)
+diff --git a/drivers/spi/spi-sifive.c b/drivers/spi/spi-sifive.c
+index e29e85cee88a2..7840ef940ff8e 100644
+--- a/drivers/spi/spi-sifive.c
++++ b/drivers/spi/spi-sifive.c
+@@ -135,13 +135,13 @@ sifive_spi_prepare_message(struct spi_master *master, struct spi_message *msg)
+
+ /* Update the chip select polarity */
+ if (device->mode & SPI_CS_HIGH)
+- spi->cs_inactive &= ~BIT(device->chip_select);
++ spi->cs_inactive &= ~BIT(spi_get_chipselect(device, 0));
+ else
+- spi->cs_inactive |= BIT(device->chip_select);
++ spi->cs_inactive |= BIT(spi_get_chipselect(device, 0));
+ sifive_spi_write(spi, SIFIVE_SPI_REG_CSDEF, spi->cs_inactive);
+
+ /* Select the correct device */
+- sifive_spi_write(spi, SIFIVE_SPI_REG_CSID, device->chip_select);
++ sifive_spi_write(spi, SIFIVE_SPI_REG_CSID, spi_get_chipselect(device, 0));
+
+ /* Set clock mode */
+ sifive_spi_write(spi, SIFIVE_SPI_REG_SCKMODE,
+diff --git a/drivers/spi/spi-sn-f-ospi.c b/drivers/spi/spi-sn-f-ospi.c
+index 0aedade8908c4..93fc1f6f39b83 100644
+--- a/drivers/spi/spi-sn-f-ospi.c
++++ b/drivers/spi/spi-sn-f-ospi.c
+@@ -267,7 +267,7 @@ static void f_ospi_config_indir_protocol(struct f_ospi *ospi,
+ int unit;
+
+ /* Set one chip select */
+- writel(BIT(spi->chip_select), ospi->base + OSPI_SSEL);
++ writel(BIT(spi_get_chipselect(spi, 0)), ospi->base + OSPI_SSEL);
+
+ mode = f_ospi_get_mode(ospi, op->cmd.buswidth, 1);
+ prot |= FIELD_PREP(OSPI_PROT_MODE_CODE_MASK, mode);
+diff --git a/drivers/spi/spi-st-ssc4.c b/drivers/spi/spi-st-ssc4.c
+index 843be803696bc..57aaae39e5f84 100644
+--- a/drivers/spi/spi-st-ssc4.c
++++ b/drivers/spi/spi-st-ssc4.c
+@@ -183,7 +183,7 @@ static int spi_st_setup(struct spi_device *spi)
+ return -EINVAL;
+ }
+
+- if (!spi->cs_gpiod) {
++ if (!spi_get_csgpiod(spi, 0)) {
+ dev_err(&spi->dev, "no valid gpio assigned\n");
+ return -EINVAL;
+ }
+diff --git a/drivers/spi/spi-stm32-qspi.c b/drivers/spi/spi-stm32-qspi.c
+index 9131660c1afb2..b9e61372dcfbd 100644
+--- a/drivers/spi/spi-stm32-qspi.c
++++ b/drivers/spi/spi-stm32-qspi.c
+@@ -359,7 +359,7 @@ static int stm32_qspi_get_mode(u8 buswidth)
+ static int stm32_qspi_send(struct spi_device *spi, const struct spi_mem_op *op)
+ {
+ struct stm32_qspi *qspi = spi_controller_get_devdata(spi->master);
+- struct stm32_qspi_flash *flash = &qspi->flash[spi->chip_select];
++ struct stm32_qspi_flash *flash = &qspi->flash[spi_get_chipselect(spi, 0)];
+ u32 ccr, cr;
+ int timeout, err = 0, err_poll_status = 0;
+
+@@ -564,7 +564,7 @@ static int stm32_qspi_transfer_one_message(struct spi_controller *ctrl,
+ struct spi_mem_op op;
+ int ret = 0;
+
+- if (!spi->cs_gpiod)
++ if (!spi_get_csgpiod(spi, 0))
+ return -EOPNOTSUPP;
+
+ ret = pm_runtime_resume_and_get(qspi->dev);
+@@ -573,7 +573,7 @@ static int stm32_qspi_transfer_one_message(struct spi_controller *ctrl,
+
+ mutex_lock(&qspi->lock);
+
+- gpiod_set_value_cansleep(spi->cs_gpiod, true);
++ gpiod_set_value_cansleep(spi_get_csgpiod(spi, 0), true);
+
+ list_for_each_entry(transfer, &msg->transfers, transfer_list) {
+ u8 dummy_bytes = 0;
+@@ -626,7 +626,7 @@ static int stm32_qspi_transfer_one_message(struct spi_controller *ctrl,
+ }
+
+ end_of_transfer:
+- gpiod_set_value_cansleep(spi->cs_gpiod, false);
++ gpiod_set_value_cansleep(spi_get_csgpiod(spi, 0), false);
+
+ mutex_unlock(&qspi->lock);
+
+@@ -669,8 +669,8 @@ static int stm32_qspi_setup(struct spi_device *spi)
+
+ presc = DIV_ROUND_UP(qspi->clk_rate, spi->max_speed_hz) - 1;
+
+- flash = &qspi->flash[spi->chip_select];
+- flash->cs = spi->chip_select;
++ flash = &qspi->flash[spi_get_chipselect(spi, 0)];
++ flash->cs = spi_get_chipselect(spi, 0);
+ flash->presc = presc;
+
+ mutex_lock(&qspi->lock);
+diff --git a/drivers/spi/spi-sun4i.c b/drivers/spi/spi-sun4i.c
+index 6000d0761206c..1e3b1922059e3 100644
+--- a/drivers/spi/spi-sun4i.c
++++ b/drivers/spi/spi-sun4i.c
+@@ -167,7 +167,7 @@ static void sun4i_spi_set_cs(struct spi_device *spi, bool enable)
+ reg = sun4i_spi_read(sspi, SUN4I_CTL_REG);
+
+ reg &= ~SUN4I_CTL_CS_MASK;
+- reg |= SUN4I_CTL_CS(spi->chip_select);
++ reg |= SUN4I_CTL_CS(spi_get_chipselect(spi, 0));
+
+ /* We want to control the chip select manually */
+ reg |= SUN4I_CTL_CS_MANUAL;
+diff --git a/drivers/spi/spi-sun6i.c b/drivers/spi/spi-sun6i.c
+index 23ad052528dbe..46e7c446503a5 100644
+--- a/drivers/spi/spi-sun6i.c
++++ b/drivers/spi/spi-sun6i.c
+@@ -174,7 +174,7 @@ static void sun6i_spi_set_cs(struct spi_device *spi, bool enable)
+
+ reg = sun6i_spi_read(sspi, SUN6I_TFR_CTL_REG);
+ reg &= ~SUN6I_TFR_CTL_CS_MASK;
+- reg |= SUN6I_TFR_CTL_CS(spi->chip_select);
++ reg |= SUN6I_TFR_CTL_CS(spi_get_chipselect(spi, 0));
+
+ if (enable)
+ reg |= SUN6I_TFR_CTL_CS_LEVEL;
+diff --git a/drivers/spi/spi-synquacer.c b/drivers/spi/spi-synquacer.c
+index dc188f9202c97..733dc8c52b083 100644
+--- a/drivers/spi/spi-synquacer.c
++++ b/drivers/spi/spi-synquacer.c
+@@ -250,7 +250,7 @@ static int synquacer_spi_config(struct spi_master *master,
+ }
+
+ mode = spi->mode;
+- cs = spi->chip_select;
++ cs = spi_get_chipselect(spi, 0);
+ speed = xfer->speed_hz;
+ bpw = xfer->bits_per_word;
+
+@@ -344,7 +344,7 @@ static int synquacer_spi_config(struct spi_master *master,
+ sspi->bpw = bpw;
+ sspi->mode = mode;
+ sspi->speed = speed;
+- sspi->cs = spi->chip_select;
++ sspi->cs = spi_get_chipselect(spi, 0);
+ sspi->bus_width = bus_width;
+
+ return 0;
+@@ -488,7 +488,7 @@ static void synquacer_spi_set_cs(struct spi_device *spi, bool enable)
+ val = readl(sspi->regs + SYNQUACER_HSSPI_REG_DMSTART);
+ val &= ~(SYNQUACER_HSSPI_DMPSEL_CS_MASK <<
+ SYNQUACER_HSSPI_DMPSEL_CS_SHIFT);
+- val |= spi->chip_select << SYNQUACER_HSSPI_DMPSEL_CS_SHIFT;
++ val |= spi_get_chipselect(spi, 0) << SYNQUACER_HSSPI_DMPSEL_CS_SHIFT;
+
+ if (!enable)
+ val |= SYNQUACER_HSSPI_DMSTOP_STOP;
+diff --git a/drivers/spi/spi-tegra114.c b/drivers/spi/spi-tegra114.c
+index d9be80e3e1bcb..e334183241d72 100644
+--- a/drivers/spi/spi-tegra114.c
++++ b/drivers/spi/spi-tegra114.c
+@@ -747,7 +747,7 @@ static int tegra_spi_set_hw_cs_timing(struct spi_device *spi)
+ if (setup_dly && hold_dly) {
+ setup_hold = SPI_SETUP_HOLD(setup_dly - 1, hold_dly - 1);
+ spi_cs_timing = SPI_CS_SETUP_HOLD(tspi->spi_cs_timing1,
+- spi->chip_select,
++ spi_get_chipselect(spi, 0),
+ setup_hold);
+ if (tspi->spi_cs_timing1 != spi_cs_timing) {
+ tspi->spi_cs_timing1 = spi_cs_timing;
+@@ -760,9 +760,9 @@ static int tegra_spi_set_hw_cs_timing(struct spi_device *spi)
+ inactive_cycles--;
+ cs_state = inactive_cycles ? 0 : 1;
+ spi_cs_timing = tspi->spi_cs_timing2;
+- SPI_SET_CS_ACTIVE_BETWEEN_PACKETS(spi_cs_timing, spi->chip_select,
++ SPI_SET_CS_ACTIVE_BETWEEN_PACKETS(spi_cs_timing, spi_get_chipselect(spi, 0),
+ cs_state);
+- SPI_SET_CYCLES_BETWEEN_PACKETS(spi_cs_timing, spi->chip_select,
++ SPI_SET_CYCLES_BETWEEN_PACKETS(spi_cs_timing, spi_get_chipselect(spi, 0),
+ inactive_cycles);
+ if (tspi->spi_cs_timing2 != spi_cs_timing) {
+ tspi->spi_cs_timing2 = spi_cs_timing;
+@@ -831,8 +831,8 @@ static u32 tegra_spi_setup_transfer_one(struct spi_device *spi,
+ tegra_spi_writel(tspi, command1, SPI_COMMAND1);
+
+ /* GPIO based chip select control */
+- if (spi->cs_gpiod)
+- gpiod_set_value(spi->cs_gpiod, 1);
++ if (spi_get_csgpiod(spi, 0))
++ gpiod_set_value(spi_get_csgpiod(spi, 0), 1);
+
+ if (is_single_xfer && !(t->cs_change)) {
+ tspi->use_hw_based_cs = true;
+@@ -846,7 +846,7 @@ static u32 tegra_spi_setup_transfer_one(struct spi_device *spi,
+ command1 &= ~SPI_CS_SW_VAL;
+ }
+
+- if (tspi->last_used_cs != spi->chip_select) {
++ if (tspi->last_used_cs != spi_get_chipselect(spi, 0)) {
+ if (cdata && cdata->tx_clk_tap_delay)
+ tx_tap = cdata->tx_clk_tap_delay;
+ if (cdata && cdata->rx_clk_tap_delay)
+@@ -855,7 +855,7 @@ static u32 tegra_spi_setup_transfer_one(struct spi_device *spi,
+ SPI_RX_TAP_DELAY(rx_tap);
+ if (command2 != tspi->def_command2_reg)
+ tegra_spi_writel(tspi, command2, SPI_COMMAND2);
+- tspi->last_used_cs = spi->chip_select;
++ tspi->last_used_cs = spi_get_chipselect(spi, 0);
+ }
+
+ } else {
+@@ -896,7 +896,7 @@ static int tegra_spi_start_transfer_one(struct spi_device *spi,
+ command1 |= SPI_TX_EN;
+ tspi->cur_direction |= DATA_DIR_TX;
+ }
+- command1 |= SPI_CS_SEL(spi->chip_select);
++ command1 |= SPI_CS_SEL(spi_get_chipselect(spi, 0));
+ tegra_spi_writel(tspi, command1, SPI_COMMAND1);
+ tspi->command1_reg = command1;
+
+@@ -980,14 +980,14 @@ static int tegra_spi_setup(struct spi_device *spi)
+
+ spin_lock_irqsave(&tspi->lock, flags);
+ /* GPIO based chip select control */
+- if (spi->cs_gpiod)
+- gpiod_set_value(spi->cs_gpiod, 0);
++ if (spi_get_csgpiod(spi, 0))
++ gpiod_set_value(spi_get_csgpiod(spi, 0), 0);
+
+ val = tspi->def_command1_reg;
+ if (spi->mode & SPI_CS_HIGH)
+- val &= ~SPI_CS_POL_INACTIVE(spi->chip_select);
++ val &= ~SPI_CS_POL_INACTIVE(spi_get_chipselect(spi, 0));
+ else
+- val |= SPI_CS_POL_INACTIVE(spi->chip_select);
++ val |= SPI_CS_POL_INACTIVE(spi_get_chipselect(spi, 0));
+ tspi->def_command1_reg = val;
+ tegra_spi_writel(tspi, tspi->def_command1_reg, SPI_COMMAND1);
+ spin_unlock_irqrestore(&tspi->lock, flags);
+@@ -1002,8 +1002,8 @@ static void tegra_spi_transfer_end(struct spi_device *spi)
+ int cs_val = (spi->mode & SPI_CS_HIGH) ? 0 : 1;
+
+ /* GPIO based chip select control */
+- if (spi->cs_gpiod)
+- gpiod_set_value(spi->cs_gpiod, 0);
++ if (spi_get_csgpiod(spi, 0))
++ gpiod_set_value(spi_get_csgpiod(spi, 0), 0);
+
+ if (!tspi->use_hw_based_cs) {
+ if (cs_val)
+diff --git a/drivers/spi/spi-tegra20-sflash.c b/drivers/spi/spi-tegra20-sflash.c
+index 220ee08c4a06c..f67d0aafa744c 100644
+--- a/drivers/spi/spi-tegra20-sflash.c
++++ b/drivers/spi/spi-tegra20-sflash.c
+@@ -280,7 +280,7 @@ static int tegra_sflash_start_transfer_one(struct spi_device *spi,
+ command |= SPI_ACTIVE_SCLK_DRIVE_HIGH;
+ else
+ command |= SPI_ACTIVE_SCLK_DRIVE_LOW;
+- command |= SPI_CS0_EN << spi->chip_select;
++ command |= SPI_CS0_EN << spi_get_chipselect(spi, 0);
+ } else {
+ command = tsd->command_reg;
+ command &= ~SPI_BIT_LENGTH(~0);
+diff --git a/drivers/spi/spi-tegra20-slink.c b/drivers/spi/spi-tegra20-slink.c
+index 148043d0c2b84..0afba7dbd93aa 100644
+--- a/drivers/spi/spi-tegra20-slink.c
++++ b/drivers/spi/spi-tegra20-slink.c
+@@ -758,9 +758,9 @@ static int tegra_slink_setup(struct spi_device *spi)
+ spin_lock_irqsave(&tspi->lock, flags);
+ val = tspi->def_command_reg;
+ if (spi->mode & SPI_CS_HIGH)
+- val |= cs_pol_bit[spi->chip_select];
++ val |= cs_pol_bit[spi_get_chipselect(spi, 0)];
+ else
+- val &= ~cs_pol_bit[spi->chip_select];
++ val &= ~cs_pol_bit[spi_get_chipselect(spi, 0)];
+ tspi->def_command_reg = val;
+ tegra_slink_writel(tspi, tspi->def_command_reg, SLINK_COMMAND);
+ spin_unlock_irqrestore(&tspi->lock, flags);
+@@ -781,7 +781,7 @@ static int tegra_slink_prepare_message(struct spi_master *master,
+ tspi->command_reg |= SLINK_CS_SW | SLINK_CS_VALUE;
+
+ tspi->command2_reg = tspi->def_command2_reg;
+- tspi->command2_reg |= SLINK_SS_EN_CS(spi->chip_select);
++ tspi->command2_reg |= SLINK_SS_EN_CS(spi_get_chipselect(spi, 0));
+
+ tspi->command_reg &= ~SLINK_MODES;
+ if (spi->mode & SPI_CPHA)
+diff --git a/drivers/spi/spi-tegra210-quad.c b/drivers/spi/spi-tegra210-quad.c
+index 0b9bc3b7f53a7..80c3bd9f8bc15 100644
+--- a/drivers/spi/spi-tegra210-quad.c
++++ b/drivers/spi/spi-tegra210-quad.c
+@@ -829,7 +829,7 @@ static u32 tegra_qspi_setup_transfer_one(struct spi_device *spi, struct spi_tran
+ tegra_qspi_mask_clear_irq(tqspi);
+
+ command1 = tqspi->def_command1_reg;
+- command1 |= QSPI_CS_SEL(spi->chip_select);
++ command1 |= QSPI_CS_SEL(spi_get_chipselect(spi, 0));
+ command1 |= QSPI_BIT_LENGTH(bits_per_word - 1);
+
+ command1 &= ~QSPI_CONTROL_MODE_MASK;
+@@ -960,11 +960,11 @@ static int tegra_qspi_setup(struct spi_device *spi)
+
+ /* keep default cs state to inactive */
+ val = tqspi->def_command1_reg;
+- val |= QSPI_CS_SEL(spi->chip_select);
++ val |= QSPI_CS_SEL(spi_get_chipselect(spi, 0));
+ if (spi->mode & SPI_CS_HIGH)
+- val &= ~QSPI_CS_POL_INACTIVE(spi->chip_select);
++ val &= ~QSPI_CS_POL_INACTIVE(spi_get_chipselect(spi, 0));
+ else
+- val |= QSPI_CS_POL_INACTIVE(spi->chip_select);
++ val |= QSPI_CS_POL_INACTIVE(spi_get_chipselect(spi, 0));
+
+ tqspi->def_command1_reg = val;
+ tegra_qspi_writel(tqspi, tqspi->def_command1_reg, QSPI_COMMAND1);
+diff --git a/drivers/spi/spi-ti-qspi.c b/drivers/spi/spi-ti-qspi.c
+index 60086869bcae4..5914335ff63db 100644
+--- a/drivers/spi/spi-ti-qspi.c
++++ b/drivers/spi/spi-ti-qspi.c
+@@ -533,10 +533,10 @@ static void ti_qspi_enable_memory_map(struct spi_device *spi)
+ if (qspi->ctrl_base) {
+ regmap_update_bits(qspi->ctrl_base, qspi->ctrl_reg,
+ MEM_CS_MASK,
+- MEM_CS_EN(spi->chip_select));
++ MEM_CS_EN(spi_get_chipselect(spi, 0)));
+ }
+ qspi->mmap_enabled = true;
+- qspi->current_cs = spi->chip_select;
++ qspi->current_cs = spi_get_chipselect(spi, 0);
+ }
+
+ static void ti_qspi_disable_memory_map(struct spi_device *spi)
+@@ -572,7 +572,7 @@ static void ti_qspi_setup_mmap_read(struct spi_device *spi, u8 opcode,
+ memval |= ((addr_width - 1) << QSPI_SETUP_ADDR_SHIFT |
+ dummy_bytes << QSPI_SETUP_DUMMY_SHIFT);
+ ti_qspi_write(qspi, memval,
+- QSPI_SPI_SETUP_REG(spi->chip_select));
++ QSPI_SPI_SETUP_REG(spi_get_chipselect(spi, 0)));
+ }
+
+ static int ti_qspi_adjust_op_size(struct spi_mem *mem, struct spi_mem_op *op)
+@@ -623,7 +623,7 @@ static int ti_qspi_exec_mem_op(struct spi_mem *mem,
+
+ mutex_lock(&qspi->list_lock);
+
+- if (!qspi->mmap_enabled || qspi->current_cs != mem->spi->chip_select) {
++ if (!qspi->mmap_enabled || qspi->current_cs != spi_get_chipselect(mem->spi, 0)) {
+ ti_qspi_setup_clk(qspi, mem->spi->max_speed_hz);
+ ti_qspi_enable_memory_map(mem->spi);
+ }
+@@ -673,11 +673,11 @@ static int ti_qspi_start_transfer_one(struct spi_master *master,
+ qspi->dc = 0;
+
+ if (spi->mode & SPI_CPHA)
+- qspi->dc |= QSPI_CKPHA(spi->chip_select);
++ qspi->dc |= QSPI_CKPHA(spi_get_chipselect(spi, 0));
+ if (spi->mode & SPI_CPOL)
+- qspi->dc |= QSPI_CKPOL(spi->chip_select);
++ qspi->dc |= QSPI_CKPOL(spi_get_chipselect(spi, 0));
+ if (spi->mode & SPI_CS_HIGH)
+- qspi->dc |= QSPI_CSPOL(spi->chip_select);
++ qspi->dc |= QSPI_CSPOL(spi_get_chipselect(spi, 0));
+
+ frame_len_words = 0;
+ list_for_each_entry(t, &m->transfers, transfer_list)
+@@ -686,7 +686,7 @@ static int ti_qspi_start_transfer_one(struct spi_master *master,
+
+ /* setup command reg */
+ qspi->cmd = 0;
+- qspi->cmd |= QSPI_EN_CS(spi->chip_select);
++ qspi->cmd |= QSPI_EN_CS(spi_get_chipselect(spi, 0));
+ qspi->cmd |= QSPI_FLEN(frame_len_words);
+
+ ti_qspi_write(qspi, qspi->dc, QSPI_SPI_DC_REG);
+diff --git a/drivers/spi/spi-topcliff-pch.c b/drivers/spi/spi-topcliff-pch.c
+index cbb60198a7f00..11cfe84714e71 100644
+--- a/drivers/spi/spi-topcliff-pch.c
++++ b/drivers/spi/spi-topcliff-pch.c
+@@ -499,7 +499,7 @@ static inline void pch_spi_select_chip(struct pch_spi_data *data,
+ struct spi_device *pspi)
+ {
+ if (data->current_chip != NULL) {
+- if (pspi->chip_select != data->n_curnt_chip) {
++ if (spi_get_chipselect(pspi, 0) != data->n_curnt_chip) {
+ dev_dbg(&pspi->dev, "%s : different slave\n", __func__);
+ data->current_chip = NULL;
+ }
+@@ -507,7 +507,7 @@ static inline void pch_spi_select_chip(struct pch_spi_data *data,
+
+ data->current_chip = pspi;
+
+- data->n_curnt_chip = data->current_chip->chip_select;
++ data->n_curnt_chip = spi_get_chipselect(data->current_chip, 0);
+
+ dev_dbg(&pspi->dev, "%s :Invoking pch_spi_setup_transfer\n", __func__);
+ pch_spi_setup_transfer(pspi);
+diff --git a/drivers/spi/spi-wpcm-fiu.c b/drivers/spi/spi-wpcm-fiu.c
+index ab33710d50ac8..f15312fdcdaf0 100644
+--- a/drivers/spi/spi-wpcm-fiu.c
++++ b/drivers/spi/spi-wpcm-fiu.c
+@@ -158,7 +158,7 @@ static int wpcm_fiu_normal_exec(struct spi_mem *mem, const struct spi_mem_op *op
+ if (op->data.dir == SPI_MEM_DATA_OUT)
+ wpcm_fiu_set_data(fiu, op->data.buf.out, op->data.nbytes);
+
+- ret = wpcm_fiu_do_uma(fiu, mem->spi->chip_select, op->addr.nbytes == 3,
++ ret = wpcm_fiu_do_uma(fiu, spi_get_chipselect(mem->spi, 0), op->addr.nbytes == 3,
+ op->data.dir == SPI_MEM_DATA_OUT, op->data.nbytes);
+
+ if (op->data.dir == SPI_MEM_DATA_IN)
+@@ -196,7 +196,7 @@ static bool wpcm_fiu_4ba_match(const struct spi_mem_op *op)
+ static int wpcm_fiu_4ba_exec(struct spi_mem *mem, const struct spi_mem_op *op)
+ {
+ struct wpcm_fiu_spi *fiu = spi_controller_get_devdata(mem->spi->controller);
+- int cs = mem->spi->chip_select;
++ int cs = spi_get_chipselect(mem->spi, 0);
+
+ wpcm_fiu_ects_assert(fiu, cs);
+
+@@ -241,7 +241,7 @@ static bool wpcm_fiu_rdid_match(const struct spi_mem_op *op)
+ static int wpcm_fiu_rdid_exec(struct spi_mem *mem, const struct spi_mem_op *op)
+ {
+ struct wpcm_fiu_spi *fiu = spi_controller_get_devdata(mem->spi->controller);
+- int cs = mem->spi->chip_select;
++ int cs = spi_get_chipselect(mem->spi, 0);
+
+ /* First transfer */
+ wpcm_fiu_set_opcode(fiu, op->cmd.opcode);
+@@ -278,7 +278,7 @@ static bool wpcm_fiu_dummy_match(const struct spi_mem_op *op)
+ static int wpcm_fiu_dummy_exec(struct spi_mem *mem, const struct spi_mem_op *op)
+ {
+ struct wpcm_fiu_spi *fiu = spi_controller_get_devdata(mem->spi->controller);
+- int cs = mem->spi->chip_select;
++ int cs = spi_get_chipselect(mem->spi, 0);
+
+ wpcm_fiu_ects_assert(fiu, cs);
+
+@@ -376,7 +376,7 @@ static int wpcm_fiu_adjust_op_size(struct spi_mem *mem, struct spi_mem_op *op)
+ static int wpcm_fiu_dirmap_create(struct spi_mem_dirmap_desc *desc)
+ {
+ struct wpcm_fiu_spi *fiu = spi_controller_get_devdata(desc->mem->spi->controller);
+- int cs = desc->mem->spi->chip_select;
++ int cs = spi_get_chipselect(desc->mem->spi, 0);
+
+ if (desc->info.op_tmpl.data.dir != SPI_MEM_DATA_IN)
+ return -ENOTSUPP;
+@@ -400,7 +400,7 @@ static int wpcm_fiu_dirmap_create(struct spi_mem_dirmap_desc *desc)
+ static ssize_t wpcm_fiu_direct_read(struct spi_mem_dirmap_desc *desc, u64 offs, size_t len, void *buf)
+ {
+ struct wpcm_fiu_spi *fiu = spi_controller_get_devdata(desc->mem->spi->controller);
+- int cs = desc->mem->spi->chip_select;
++ int cs = spi_get_chipselect(desc->mem->spi, 0);
+
+ if (offs >= MAX_MEMORY_SIZE_PER_CS)
+ return -ENOTSUPP;
+diff --git a/drivers/spi/spi-xcomm.c b/drivers/spi/spi-xcomm.c
+index 8628241ec99e4..5d23411f2a3e9 100644
+--- a/drivers/spi/spi-xcomm.c
++++ b/drivers/spi/spi-xcomm.c
+@@ -58,7 +58,7 @@ static int spi_xcomm_sync_config(struct spi_xcomm *spi_xcomm, unsigned int len)
+ static void spi_xcomm_chipselect(struct spi_xcomm *spi_xcomm,
+ struct spi_device *spi, int is_active)
+ {
+- unsigned long cs = spi->chip_select;
++ unsigned long cs = spi_get_chipselect(spi, 0);
+ uint16_t chipselect = spi_xcomm->chipselect;
+
+ if (is_active)
+diff --git a/drivers/spi/spi-xilinx.c b/drivers/spi/spi-xilinx.c
+index 1411548f42553..a2422c1636f4c 100644
+--- a/drivers/spi/spi-xilinx.c
++++ b/drivers/spi/spi-xilinx.c
+@@ -213,7 +213,7 @@ static void xilinx_spi_chipselect(struct spi_device *spi, int is_on)
+ */
+
+ cs = xspi->cs_inactive;
+- cs ^= BIT(spi->chip_select);
++ cs ^= BIT(spi_get_chipselect(spi, 0));
+
+ /* Activate the chip select */
+ xspi->write_fn(cs, xspi->regs + XSPI_SSR_OFFSET);
+@@ -228,9 +228,9 @@ static int xilinx_spi_setup_transfer(struct spi_device *spi,
+ struct xilinx_spi *xspi = spi_master_get_devdata(spi->master);
+
+ if (spi->mode & SPI_CS_HIGH)
+- xspi->cs_inactive &= ~BIT(spi->chip_select);
++ xspi->cs_inactive &= ~BIT(spi_get_chipselect(spi, 0));
+ else
+- xspi->cs_inactive |= BIT(spi->chip_select);
++ xspi->cs_inactive |= BIT(spi_get_chipselect(spi, 0));
+
+ return 0;
+ }
+diff --git a/drivers/spi/spi-xlp.c b/drivers/spi/spi-xlp.c
+index e5707fe5c8f15..3b91cdd5ae21e 100644
+--- a/drivers/spi/spi-xlp.c
++++ b/drivers/spi/spi-xlp.c
+@@ -139,7 +139,7 @@ static int xlp_spi_setup(struct spi_device *spi)
+ int cs;
+
+ xspi = spi_master_get_devdata(spi->master);
+- cs = spi->chip_select;
++ cs = spi_get_chipselect(spi, 0);
+ /*
+ * The value of fdiv must be between 4 and 65535.
+ */
+@@ -350,7 +350,7 @@ static int xlp_spi_transfer_one(struct spi_master *master,
+ struct xlp_spi_priv *xspi = spi_master_get_devdata(master);
+ int ret = 0;
+
+- xspi->cs = spi->chip_select;
++ xspi->cs = spi_get_chipselect(spi, 0);
+ xspi->dev = spi->dev;
+
+ if (spi_transfer_is_last(master, t))
+diff --git a/drivers/spi/spi-zynq-qspi.c b/drivers/spi/spi-zynq-qspi.c
+index 78f31b61a2aac..debb53ef19a09 100644
+--- a/drivers/spi/spi-zynq-qspi.c
++++ b/drivers/spi/spi-zynq-qspi.c
+@@ -296,7 +296,7 @@ static void zynq_qspi_chipselect(struct spi_device *spi, bool assert)
+ /* Select the lower (CS0) or upper (CS1) memory */
+ if (ctlr->num_chipselect > 1) {
+ config_reg = zynq_qspi_read(xqspi, ZYNQ_QSPI_LINEAR_CFG_OFFSET);
+- if (!spi->chip_select)
++ if (!spi_get_chipselect(spi, 0))
+ config_reg &= ~ZYNQ_QSPI_LCFG_U_PAGE;
+ else
+ config_reg |= ZYNQ_QSPI_LCFG_U_PAGE;
+diff --git a/drivers/spi/spi-zynqmp-gqspi.c b/drivers/spi/spi-zynqmp-gqspi.c
+index 95ff15665d448..319cdd5a0bdcb 100644
+--- a/drivers/spi/spi-zynqmp-gqspi.c
++++ b/drivers/spi/spi-zynqmp-gqspi.c
+@@ -468,7 +468,7 @@ static void zynqmp_qspi_chipselect(struct spi_device *qspi, bool is_high)
+ genfifoentry |= GQSPI_GENFIFO_MODE_SPI;
+
+ if (!is_high) {
+- if (!qspi->chip_select) {
++ if (!spi_get_chipselect(qspi, 0)) {
+ xqspi->genfifobus = GQSPI_GENFIFO_BUS_LOWER;
+ xqspi->genfifocs = GQSPI_GENFIFO_CS_LOWER;
+ } else {
+diff --git a/drivers/spi/spidev.c b/drivers/spi/spidev.c
+index 5a038c6674018..a399c617ca25f 100644
+--- a/drivers/spi/spidev.c
++++ b/drivers/spi/spidev.c
+@@ -393,7 +393,7 @@ spidev_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
+ struct spi_controller *ctlr = spi->controller;
+
+ if (ctlr->use_gpio_descriptors && ctlr->cs_gpiods &&
+- ctlr->cs_gpiods[spi->chip_select])
++ ctlr->cs_gpiods[spi_get_chipselect(spi, 0)])
+ tmp &= ~SPI_CS_HIGH;
+ }
+
+@@ -432,7 +432,7 @@ spidev_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
+ }
+
+ if (ctlr->use_gpio_descriptors && ctlr->cs_gpiods &&
+- ctlr->cs_gpiods[spi->chip_select])
++ ctlr->cs_gpiods[spi_get_chipselect(spi, 0)])
+ tmp |= SPI_CS_HIGH;
+
+ tmp |= spi->mode & ~SPI_MODE_MASK;
+@@ -805,7 +805,7 @@ static int spidev_probe(struct spi_device *spi)
+ spidev->devt = MKDEV(SPIDEV_MAJOR, minor);
+ dev = device_create(spidev_class, &spi->dev, spidev->devt,
+ spidev, "spidev%d.%d",
+- spi->master->bus_num, spi->chip_select);
++ spi->master->bus_num, spi_get_chipselect(spi, 0));
+ status = PTR_ERR_OR_ZERO(dev);
+ } else {
+ dev_dbg(&spi->dev, "no minor number available!\n");
+diff --git a/include/trace/events/spi.h b/include/trace/events/spi.h
+index c0d9844befd7a..c0248a8fa79c9 100644
+--- a/include/trace/events/spi.h
++++ b/include/trace/events/spi.h
+@@ -57,7 +57,7 @@ TRACE_EVENT(spi_setup,
+
+ TP_fast_assign(
+ __entry->bus_num = spi->controller->bus_num;
+- __entry->chip_select = spi->chip_select;
++ __entry->chip_select = spi_get_chipselect(spi, 0);
+ __entry->mode = spi->mode;
+ __entry->bits_per_word = spi->bits_per_word;
+ __entry->max_speed_hz = spi->max_speed_hz;
+@@ -88,7 +88,7 @@ TRACE_EVENT(spi_set_cs,
+
+ TP_fast_assign(
+ __entry->bus_num = spi->controller->bus_num;
+- __entry->chip_select = spi->chip_select;
++ __entry->chip_select = spi_get_chipselect(spi, 0);
+ __entry->mode = spi->mode;
+ __entry->enable = enable;
+ ),
+@@ -113,7 +113,7 @@ DECLARE_EVENT_CLASS(spi_message,
+
+ TP_fast_assign(
+ __entry->bus_num = msg->spi->controller->bus_num;
+- __entry->chip_select = msg->spi->chip_select;
++ __entry->chip_select = spi_get_chipselect(msg->spi, 0);
+ __entry->msg = msg;
+ ),
+
+@@ -154,7 +154,7 @@ TRACE_EVENT(spi_message_done,
+
+ TP_fast_assign(
+ __entry->bus_num = msg->spi->controller->bus_num;
+- __entry->chip_select = msg->spi->chip_select;
++ __entry->chip_select = spi_get_chipselect(msg->spi, 0);
+ __entry->msg = msg;
+ __entry->frame = msg->frame_length;
+ __entry->actual = msg->actual_length;
+@@ -197,7 +197,7 @@ DECLARE_EVENT_CLASS(spi_transfer,
+
+ TP_fast_assign(
+ __entry->bus_num = msg->spi->controller->bus_num;
+- __entry->chip_select = msg->spi->chip_select;
++ __entry->chip_select = spi_get_chipselect(msg->spi, 0);
+ __entry->xfer = xfer;
+ __entry->len = xfer->len;
+
+--
+2.39.2
+
--- /dev/null
+From 72cfb16e926783f5bcf5d980643a4dd8e3c5d557 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Apr 2023 15:38:34 -0700
+Subject: spmi: Add a check for remove callback when removing a SPMI driver
+
+From: Jishnu Prakash <quic_jprakash@quicinc.com>
+
+[ Upstream commit b56eef3e16d888883fefab47425036de80dd38fc ]
+
+When removing a SPMI driver, there can be a crash due to NULL pointer
+dereference if it does not have a remove callback defined. This is
+one such call trace observed when removing the QCOM SPMI PMIC driver:
+
+ dump_backtrace.cfi_jt+0x0/0x8
+ dump_stack_lvl+0xd8/0x16c
+ panic+0x188/0x498
+ __cfi_slowpath+0x0/0x214
+ __cfi_slowpath+0x1dc/0x214
+ spmi_drv_remove+0x16c/0x1e0
+ device_release_driver_internal+0x468/0x79c
+ driver_detach+0x11c/0x1a0
+ bus_remove_driver+0xc4/0x124
+ driver_unregister+0x58/0x84
+ cleanup_module+0x1c/0xc24 [qcom_spmi_pmic]
+ __do_sys_delete_module+0x3ec/0x53c
+ __arm64_sys_delete_module+0x18/0x28
+ el0_svc_common+0xdc/0x294
+ el0_svc+0x38/0x9c
+ el0_sync_handler+0x8c/0xf0
+ el0_sync+0x1b4/0x1c0
+
+If a driver has all its resources allocated through devm_() APIs and
+does not need any other explicit cleanup, it would not require a
+remove callback to be defined. Hence, add a check for remove callback
+presence before calling it when removing a SPMI driver.
+
+Link: https://lore.kernel.org/r/1671601032-18397-2-git-send-email-quic_jprakash@quicinc.com
+Fixes: 6f00f8c8635f ("mfd: qcom-spmi-pmic: Use devm_of_platform_populate()")
+Fixes: 5a86bf343976 ("spmi: Linux driver framework for SPMI")
+Signed-off-by: Jishnu Prakash <quic_jprakash@quicinc.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Link: https://lore.kernel.org/r/20230413223834.4084793-7-sboyd@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spmi/spmi.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/spmi/spmi.c b/drivers/spmi/spmi.c
+index 73551531ed437..dbc8585e8d6d0 100644
+--- a/drivers/spmi/spmi.c
++++ b/drivers/spmi/spmi.c
+@@ -350,7 +350,8 @@ static void spmi_drv_remove(struct device *dev)
+ const struct spmi_driver *sdrv = to_spmi_driver(dev->driver);
+
+ pm_runtime_get_sync(dev);
+- sdrv->remove(to_spmi_device(dev));
++ if (sdrv->remove)
++ sdrv->remove(to_spmi_device(dev));
+ pm_runtime_put_noidle(dev);
+
+ pm_runtime_disable(dev);
+--
+2.39.2
+
--- /dev/null
+From 3eb1ba77cb8d75da50e482285f80bb5483918d42 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Apr 2023 22:02:01 +0200
+Subject: staging: rtl8192e: Fix W_DISABLE# does not work after stop/start
+
+From: Philipp Hortmann <philipp.g.hortmann@gmail.com>
+
+[ Upstream commit 3fac2397f562eb669ddc2f45867a253f3fc26184 ]
+
+When loading the driver for rtl8192e, the W_DISABLE# switch is working as
+intended. But when the WLAN is turned off in software and then turned on
+again the W_DISABLE# does not work anymore. Reason for this is that in
+the function _rtl92e_dm_check_rf_ctrl_gpio() the bfirst_after_down is
+checked and returned when true. bfirst_after_down is set true when
+switching the WLAN off in software. But it is not set to false again
+when WLAN is turned on again.
+
+Add bfirst_after_down = false in _rtl92e_sta_up to reset bit and fix
+above described bug.
+
+Fixes: 94a799425eee ("From: wlanfae <wlanfae@realtek.com> [PATCH 1/8] rtl8192e: Import new version of driver from realtek")
+Signed-off-by: Philipp Hortmann <philipp.g.hortmann@gmail.com>
+Link: https://lore.kernel.org/r/20230418200201.GA17398@matrix-ESPRIMO-P710
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/rtl8192e/rtl8192e/rtl_core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/staging/rtl8192e/rtl8192e/rtl_core.c b/drivers/staging/rtl8192e/rtl8192e/rtl_core.c
+index 104b16cfa9790..72d76dc7df781 100644
+--- a/drivers/staging/rtl8192e/rtl8192e/rtl_core.c
++++ b/drivers/staging/rtl8192e/rtl8192e/rtl_core.c
+@@ -713,6 +713,7 @@ static int _rtl92e_sta_up(struct net_device *dev, bool is_silent_reset)
+ else
+ netif_wake_queue(dev);
+
++ priv->bfirst_after_down = false;
+ return 0;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From dcbbe5b5fb9555c626589b1edd34dd6dfc68f2e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Apr 2023 13:19:02 -0700
+Subject: SUNRPC: remove the maximum number of retries in call_bind_status
+
+From: Dai Ngo <dai.ngo@oracle.com>
+
+[ Upstream commit 691d0b782066a6eeeecbfceb7910a8f6184e6105 ]
+
+Currently call_bind_status places a hard limit of 3 to the number of
+retries on EACCES error. This limit was done to prevent NLM unlock
+requests from being hang forever when the server keeps returning garbage.
+However this change causes problem for cases when NLM service takes
+longer than 9 seconds to register with the port mapper after a restart.
+
+This patch removes this hard coded limit and let the RPC handles
+the retry based on the standard hard/soft task semantics.
+
+Fixes: 0b760113a3a1 ("NLM: Don't hang forever on NLM unlock requests")
+Reported-by: Helen Chao <helen.chao@oracle.com>
+Tested-by: Helen Chao <helen.chao@oracle.com>
+Signed-off-by: Dai Ngo <dai.ngo@oracle.com>
+Reviewed-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/sunrpc/sched.h | 3 +--
+ net/sunrpc/clnt.c | 3 ---
+ net/sunrpc/sched.c | 1 -
+ 3 files changed, 1 insertion(+), 6 deletions(-)
+
+diff --git a/include/linux/sunrpc/sched.h b/include/linux/sunrpc/sched.h
+index b8ca3ecaf8d76..8ada7dc802d30 100644
+--- a/include/linux/sunrpc/sched.h
++++ b/include/linux/sunrpc/sched.h
+@@ -90,8 +90,7 @@ struct rpc_task {
+ #endif
+ unsigned char tk_priority : 2,/* Task priority */
+ tk_garb_retry : 2,
+- tk_cred_retry : 2,
+- tk_rebind_retry : 2;
++ tk_cred_retry : 2;
+ };
+
+ typedef void (*rpc_action)(struct rpc_task *);
+diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
+index fd7e1c630493e..d2ee566343083 100644
+--- a/net/sunrpc/clnt.c
++++ b/net/sunrpc/clnt.c
+@@ -2050,9 +2050,6 @@ call_bind_status(struct rpc_task *task)
+ status = -EOPNOTSUPP;
+ break;
+ }
+- if (task->tk_rebind_retry == 0)
+- break;
+- task->tk_rebind_retry--;
+ rpc_delay(task, 3*HZ);
+ goto retry_timeout;
+ case -ENOBUFS:
+diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
+index be587a308e05a..c8321de341eea 100644
+--- a/net/sunrpc/sched.c
++++ b/net/sunrpc/sched.c
+@@ -817,7 +817,6 @@ rpc_init_task_statistics(struct rpc_task *task)
+ /* Initialize retry counters */
+ task->tk_garb_retry = 2;
+ task->tk_cred_retry = 2;
+- task->tk_rebind_retry = 2;
+
+ /* starting timestamp */
+ task->tk_start = ktime_get();
+--
+2.39.2
+
--- /dev/null
+From e575c76f2b3ef8bc0a57c82c5ba7173efd8b86c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Apr 2023 08:37:30 -0700
+Subject: swiotlb: fix debugfs reporting of reserved memory pools
+
+From: Michael Kelley <mikelley@microsoft.com>
+
+[ Upstream commit 5499d01c029069044a3b3e50501c77b474c96178 ]
+
+For io_tlb_nslabs, the debugfs code reports the correct value for a
+specific reserved memory pool. But for io_tlb_used, the value reported
+is always for the default pool, not the specific reserved pool. Fix this.
+
+Fixes: 5c850d31880e ("swiotlb: fix passing local variable to debugfs_create_ulong()")
+Signed-off-by: Michael Kelley <mikelley@microsoft.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/dma/swiotlb.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/dma/swiotlb.c b/kernel/dma/swiotlb.c
+index 2bb9e3b023802..09d2f4877d0f4 100644
+--- a/kernel/dma/swiotlb.c
++++ b/kernel/dma/swiotlb.c
+@@ -930,7 +930,9 @@ EXPORT_SYMBOL_GPL(is_swiotlb_active);
+
+ static int io_tlb_used_get(void *data, u64 *val)
+ {
+- *val = mem_used(&io_tlb_default_mem);
++ struct io_tlb_mem *mem = data;
++
++ *val = mem_used(mem);
+ return 0;
+ }
+ DEFINE_DEBUGFS_ATTRIBUTE(fops_io_tlb_used, io_tlb_used_get, NULL, "%llu\n");
+@@ -943,7 +945,7 @@ static void swiotlb_create_debugfs_files(struct io_tlb_mem *mem,
+ return;
+
+ debugfs_create_ulong("io_tlb_nslabs", 0400, mem->debugfs, &mem->nslabs);
+- debugfs_create_file("io_tlb_used", 0400, mem->debugfs, NULL,
++ debugfs_create_file("io_tlb_used", 0400, mem->debugfs, mem,
+ &fops_io_tlb_used);
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 94dadf4b8d6ef7ef01365a07e6c9dc0d0bc10c0c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Apr 2023 14:29:25 -0700
+Subject: swiotlb: relocate PageHighMem test away from rmem_swiotlb_setup
+
+From: Doug Berger <opendmb@gmail.com>
+
+[ Upstream commit a90922fa25370902322e9de6640e58737d459a50 ]
+
+The reservedmem_of_init_fn's are invoked very early at boot before the
+memory zones have even been defined. This makes it inappropriate to test
+whether the page corresponding to a PFN is in ZONE_HIGHMEM from within
+one.
+
+Removing the check allows an ARM 32-bit kernel with SPARSEMEM enabled to
+boot properly since otherwise we would be de-referencing an
+uninitialized sparsemem map to perform pfn_to_page() check.
+
+The arm64 architecture happens to work (and also has no high memory) but
+other 32-bit architectures could also be having similar issues.
+
+While it would be nice to provide early feedback about a reserved DMA
+pool residing in highmem, it is not possible to do that until the first
+time we try to use it, which is where the check is moved to.
+
+Fixes: 0b84e4f8b793 ("swiotlb: Add restricted DMA pool initialization")
+Signed-off-by: Doug Berger <opendmb@gmail.com>
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/dma/swiotlb.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/kernel/dma/swiotlb.c b/kernel/dma/swiotlb.c
+index dac42a2ad5883..2bb9e3b023802 100644
+--- a/kernel/dma/swiotlb.c
++++ b/kernel/dma/swiotlb.c
+@@ -998,6 +998,11 @@ static int rmem_swiotlb_device_init(struct reserved_mem *rmem,
+ /* Set Per-device io tlb area to one */
+ unsigned int nareas = 1;
+
++ if (PageHighMem(pfn_to_page(PHYS_PFN(rmem->base)))) {
++ dev_err(dev, "Restricted DMA pool must be accessible within the linear mapping.");
++ return -EINVAL;
++ }
++
+ /*
+ * Since multiple devices can share the same pool, the private data,
+ * io_tlb_mem struct, will be initialized by the first device attached
+@@ -1059,11 +1064,6 @@ static int __init rmem_swiotlb_setup(struct reserved_mem *rmem)
+ of_get_flat_dt_prop(node, "no-map", NULL))
+ return -EINVAL;
+
+- if (PageHighMem(pfn_to_page(PHYS_PFN(rmem->base)))) {
+- pr_err("Restricted DMA pool must be accessible within the linear mapping.");
+- return -EINVAL;
+- }
+-
+ rmem->ops = &rmem_swiotlb_ops;
+ pr_info("Reserved memory: created restricted DMA pool at %pa, size %ld MiB\n",
+ &rmem->base, (unsigned long)rmem->size / SZ_1M);
+--
+2.39.2
+
--- /dev/null
+From 3645530b9d878bc700a0350491b688fe78aaeaf1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Apr 2023 15:20:22 -0700
+Subject: tcp/udp: Fix memleaks of sk and zerocopy skbs with TX timestamp.
+
+From: Kuniyuki Iwashima <kuniyu@amazon.com>
+
+[ Upstream commit 50749f2dd6854a41830996ad302aef2ffaf011d8 ]
+
+syzkaller reported [0] memory leaks of an UDP socket and ZEROCOPY
+skbs. We can reproduce the problem with these sequences:
+
+ sk = socket(AF_INET, SOCK_DGRAM, 0)
+ sk.setsockopt(SOL_SOCKET, SO_TIMESTAMPING, SOF_TIMESTAMPING_TX_SOFTWARE)
+ sk.setsockopt(SOL_SOCKET, SO_ZEROCOPY, 1)
+ sk.sendto(b'', MSG_ZEROCOPY, ('127.0.0.1', 53))
+ sk.close()
+
+sendmsg() calls msg_zerocopy_alloc(), which allocates a skb, sets
+skb->cb->ubuf.refcnt to 1, and calls sock_hold(). Here, struct
+ubuf_info_msgzc indirectly holds a refcnt of the socket. When the
+skb is sent, __skb_tstamp_tx() clones it and puts the clone into
+the socket's error queue with the TX timestamp.
+
+When the original skb is received locally, skb_copy_ubufs() calls
+skb_unclone(), and pskb_expand_head() increments skb->cb->ubuf.refcnt.
+This additional count is decremented while freeing the skb, but struct
+ubuf_info_msgzc still has a refcnt, so __msg_zerocopy_callback() is
+not called.
+
+The last refcnt is not released unless we retrieve the TX timestamped
+skb by recvmsg(). Since we clear the error queue in inet_sock_destruct()
+after the socket's refcnt reaches 0, there is a circular dependency.
+If we close() the socket holding such skbs, we never call sock_put()
+and leak the count, sk, and skb.
+
+TCP has the same problem, and commit e0c8bccd40fc ("net: stream:
+purge sk_error_queue in sk_stream_kill_queues()") tried to fix it
+by calling skb_queue_purge() during close(). However, there is a
+small chance that skb queued in a qdisc or device could be put
+into the error queue after the skb_queue_purge() call.
+
+In __skb_tstamp_tx(), the cloned skb should not have a reference
+to the ubuf to remove the circular dependency, but skb_clone() does
+not call skb_copy_ubufs() for zerocopy skb. So, we need to call
+skb_orphan_frags_rx() for the cloned skb to call skb_copy_ubufs().
+
+[0]:
+BUG: memory leak
+unreferenced object 0xffff88800c6d2d00 (size 1152):
+ comm "syz-executor392", pid 264, jiffies 4294785440 (age 13.044s)
+ hex dump (first 32 bytes):
+ 00 00 00 00 00 00 00 00 cd af e8 81 00 00 00 00 ................
+ 02 00 07 40 00 00 00 00 00 00 00 00 00 00 00 00 ...@............
+ backtrace:
+ [<0000000055636812>] sk_prot_alloc+0x64/0x2a0 net/core/sock.c:2024
+ [<0000000054d77b7a>] sk_alloc+0x3b/0x800 net/core/sock.c:2083
+ [<0000000066f3c7e0>] inet_create net/ipv4/af_inet.c:319 [inline]
+ [<0000000066f3c7e0>] inet_create+0x31e/0xe40 net/ipv4/af_inet.c:245
+ [<000000009b83af97>] __sock_create+0x2ab/0x550 net/socket.c:1515
+ [<00000000b9b11231>] sock_create net/socket.c:1566 [inline]
+ [<00000000b9b11231>] __sys_socket_create net/socket.c:1603 [inline]
+ [<00000000b9b11231>] __sys_socket_create net/socket.c:1588 [inline]
+ [<00000000b9b11231>] __sys_socket+0x138/0x250 net/socket.c:1636
+ [<000000004fb45142>] __do_sys_socket net/socket.c:1649 [inline]
+ [<000000004fb45142>] __se_sys_socket net/socket.c:1647 [inline]
+ [<000000004fb45142>] __x64_sys_socket+0x73/0xb0 net/socket.c:1647
+ [<0000000066999e0e>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
+ [<0000000066999e0e>] do_syscall_64+0x38/0x90 arch/x86/entry/common.c:80
+ [<0000000017f238c1>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
+
+BUG: memory leak
+unreferenced object 0xffff888017633a00 (size 240):
+ comm "syz-executor392", pid 264, jiffies 4294785440 (age 13.044s)
+ hex dump (first 32 bytes):
+ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
+ 00 00 00 00 00 00 00 00 00 2d 6d 0c 80 88 ff ff .........-m.....
+ backtrace:
+ [<000000002b1c4368>] __alloc_skb+0x229/0x320 net/core/skbuff.c:497
+ [<00000000143579a6>] alloc_skb include/linux/skbuff.h:1265 [inline]
+ [<00000000143579a6>] sock_omalloc+0xaa/0x190 net/core/sock.c:2596
+ [<00000000be626478>] msg_zerocopy_alloc net/core/skbuff.c:1294 [inline]
+ [<00000000be626478>] msg_zerocopy_realloc+0x1ce/0x7f0 net/core/skbuff.c:1370
+ [<00000000cbfc9870>] __ip_append_data+0x2adf/0x3b30 net/ipv4/ip_output.c:1037
+ [<0000000089869146>] ip_make_skb+0x26c/0x2e0 net/ipv4/ip_output.c:1652
+ [<00000000098015c2>] udp_sendmsg+0x1bac/0x2390 net/ipv4/udp.c:1253
+ [<0000000045e0e95e>] inet_sendmsg+0x10a/0x150 net/ipv4/af_inet.c:819
+ [<000000008d31bfde>] sock_sendmsg_nosec net/socket.c:714 [inline]
+ [<000000008d31bfde>] sock_sendmsg+0x141/0x190 net/socket.c:734
+ [<0000000021e21aa4>] __sys_sendto+0x243/0x360 net/socket.c:2117
+ [<00000000ac0af00c>] __do_sys_sendto net/socket.c:2129 [inline]
+ [<00000000ac0af00c>] __se_sys_sendto net/socket.c:2125 [inline]
+ [<00000000ac0af00c>] __x64_sys_sendto+0xe1/0x1c0 net/socket.c:2125
+ [<0000000066999e0e>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
+ [<0000000066999e0e>] do_syscall_64+0x38/0x90 arch/x86/entry/common.c:80
+ [<0000000017f238c1>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
+
+Fixes: f214f915e7db ("tcp: enable MSG_ZEROCOPY")
+Fixes: b5947e5d1e71 ("udp: msg_zerocopy")
+Reported-by: syzbot <syzkaller@googlegroups.com>
+Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
+Reviewed-by: Willem de Bruijn <willemb@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/skbuff.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/net/core/skbuff.c b/net/core/skbuff.c
+index 4c0879798eb8a..2f9bb98170ab0 100644
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -5162,6 +5162,9 @@ void __skb_tstamp_tx(struct sk_buff *orig_skb,
+ skb = alloc_skb(0, GFP_ATOMIC);
+ } else {
+ skb = skb_clone(orig_skb, GFP_ATOMIC);
++
++ if (skb_orphan_frags_rx(skb, GFP_ATOMIC))
++ return;
+ }
+ if (!skb)
+ return;
+--
+2.39.2
+
--- /dev/null
+From ac7026bd13ad36b6b643ae3c81d749f8b0147091 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Mar 2023 22:16:06 +0000
+Subject: testing/vsock: add vsock_perf to gitignore
+
+From: Bobby Eshleman <bobby.eshleman@bytedance.com>
+
+[ Upstream commit 24265c2c91ad6aae9446e18472566cd83e92b602 ]
+
+This adds the vsock_perf binary to the gitignore file.
+
+Fixes: 8abbffd27ced ("test/vsock: vsock_perf utility")
+Signed-off-by: Bobby Eshleman <bobby.eshleman@bytedance.com>
+Reviewed-by: Arseniy Krasnov <AVKrasnov@sberdevices.ru>
+Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
+Link: https://lore.kernel.org/r/20230327-vsock-add-vsock-perf-to-ignore-v1-1-f28a84f3606b@bytedance.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/vsock/.gitignore | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/testing/vsock/.gitignore b/tools/testing/vsock/.gitignore
+index 87ca2731cff94..a8adcfdc292ba 100644
+--- a/tools/testing/vsock/.gitignore
++++ b/tools/testing/vsock/.gitignore
+@@ -2,3 +2,4 @@
+ *.d
+ vsock_test
+ vsock_diag_test
++vsock_perf
+--
+2.39.2
+
--- /dev/null
+From bf6819aef877b953d9de15a38280ab250963372a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Mar 2023 11:10:17 +0800
+Subject: thermal/drivers/mediatek/lvts_thermal: Fix sensor 1 interrupt status
+ bitmask
+
+From: Chen-Yu Tsai <wenst@chromium.org>
+
+[ Upstream commit 13f03bcd02e4b0498c8ccb066b4eddf61dee6681 ]
+
+The binary representation for sensor 1 interrupt status was incorrectly
+assembled, when compared to the full table given in the same comment
+section. The conversion into hex was also incorrect, leading to
+incorrect interrupt status bitmask for sensor 1. This would cause the
+driver to incorrectly identify changes for sensor 1, when in fact it
+was sensor 0, or a sensor access time out.
+
+Fix the binary and hex representations in the comments, and the actual
+bitmask macro.
+
+Fixes: f5f633b18234 ("thermal/drivers/mediatek: Add the Low Voltage Thermal Sensor driver")
+Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Link: https://lore.kernel.org/r/20230328031017.1360976-1-wenst@chromium.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/thermal/mediatek/lvts_thermal.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/thermal/mediatek/lvts_thermal.c b/drivers/thermal/mediatek/lvts_thermal.c
+index 84ba65a27acf7..acce1321a1a23 100644
+--- a/drivers/thermal/mediatek/lvts_thermal.c
++++ b/drivers/thermal/mediatek/lvts_thermal.c
+@@ -66,7 +66,7 @@
+ #define LVTS_MONINT_CONF 0x9FBF7BDE
+
+ #define LVTS_INT_SENSOR0 0x0009001F
+-#define LVTS_INT_SENSOR1 0X000881F0
++#define LVTS_INT_SENSOR1 0x001203E0
+ #define LVTS_INT_SENSOR2 0x00247C00
+ #define LVTS_INT_SENSOR3 0x1FC00000
+
+@@ -393,8 +393,8 @@ static irqreturn_t lvts_ctrl_irq_handler(struct lvts_ctrl *lvts_ctrl)
+ * => 0x1FC00000
+ * sensor 2 interrupt: 0000 0000 0010 0100 0111 1100 0000 0000
+ * => 0x00247C00
+- * sensor 1 interrupt: 0000 0000 0001 0001 0000 0011 1110 0000
+- * => 0X000881F0
++ * sensor 1 interrupt: 0000 0000 0001 0010 0000 0011 1110 0000
++ * => 0X001203E0
+ * sensor 0 interrupt: 0000 0000 0000 1001 0000 0000 0001 1111
+ * => 0x0009001F
+ */
+--
+2.39.2
+
--- /dev/null
+From 6c9ea5fad179c100629d9d353af53847b55b5462 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Apr 2023 10:07:48 +0800
+Subject: thermal/drivers/mediatek: Use devm_of_iomap to avoid resource leak in
+ mtk_thermal_probe
+
+From: Kang Chen <void0red@hust.edu.cn>
+
+[ Upstream commit f05c7b7d9ea9477fcc388476c6f4ade8c66d2d26 ]
+
+Smatch reports:
+1. mtk_thermal_probe() warn: 'apmixed_base' from of_iomap() not released.
+2. mtk_thermal_probe() warn: 'auxadc_base' from of_iomap() not released.
+
+The original code forgets to release iomap resource when handling errors,
+fix it by switch to devm_of_iomap.
+
+Fixes: 89945047b166 ("thermal: mediatek: Add tsensor support for V2 thermal system")
+Signed-off-by: Kang Chen <void0red@hust.edu.cn>
+Reviewed-by: Dongliang Mu <dzm91@hust.edu.cn>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Link: https://lore.kernel.org/r/20230419020749.621257-1-void0red@hust.edu.cn
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/thermal/mediatek/auxadc_thermal.c | 14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/thermal/mediatek/auxadc_thermal.c b/drivers/thermal/mediatek/auxadc_thermal.c
+index ab730f9552d0e..3372f7c29626c 100644
+--- a/drivers/thermal/mediatek/auxadc_thermal.c
++++ b/drivers/thermal/mediatek/auxadc_thermal.c
+@@ -1142,7 +1142,12 @@ static int mtk_thermal_probe(struct platform_device *pdev)
+ return -ENODEV;
+ }
+
+- auxadc_base = of_iomap(auxadc, 0);
++ auxadc_base = devm_of_iomap(&pdev->dev, auxadc, 0, NULL);
++ if (IS_ERR(auxadc_base)) {
++ of_node_put(auxadc);
++ return PTR_ERR(auxadc_base);
++ }
++
+ auxadc_phys_base = of_get_phys_base(auxadc);
+
+ of_node_put(auxadc);
+@@ -1158,7 +1163,12 @@ static int mtk_thermal_probe(struct platform_device *pdev)
+ return -ENODEV;
+ }
+
+- apmixed_base = of_iomap(apmixedsys, 0);
++ apmixed_base = devm_of_iomap(&pdev->dev, apmixedsys, 0, NULL);
++ if (IS_ERR(apmixed_base)) {
++ of_node_put(apmixedsys);
++ return PTR_ERR(apmixed_base);
++ }
++
+ apmixed_phys_base = of_get_phys_base(apmixedsys);
+
+ of_node_put(apmixedsys);
+--
+2.39.2
+
--- /dev/null
+From 701df836161c2d531e785e32dd2090d9af9a2699 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Apr 2023 14:26:39 +0200
+Subject: tick/common: Align tick period with the HZ tick.
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+[ Upstream commit e9523a0d81899361214d118ad60ef76f0e92f71d ]
+
+With HIGHRES enabled tick_sched_timer() is programmed every jiffy to
+expire the timer_list timers. This timer is programmed accurate in
+respect to CLOCK_MONOTONIC so that 0 seconds and nanoseconds is the
+first tick and the next one is 1000/CONFIG_HZ ms later. For HZ=250 it is
+every 4 ms and so based on the current time the next tick can be
+computed.
+
+This accuracy broke since the commit mentioned below because the jiffy
+based clocksource is initialized with higher accuracy in
+read_persistent_wall_and_boot_offset(). This higher accuracy is
+inherited during the setup in tick_setup_device(). The timer still fires
+every 4ms with HZ=250 but timer is no longer aligned with
+CLOCK_MONOTONIC with 0 as it origin but has an offset in the us/ns part
+of the timestamp. The offset differs with every boot and makes it
+impossible for user land to align with the tick.
+
+Align the tick period with CLOCK_MONOTONIC ensuring that it is always a
+multiple of 1000/CONFIG_HZ ms.
+
+Fixes: 857baa87b6422 ("sched/clock: Enable sched clock early")
+Reported-by: Gusenleitner Klaus <gus@keba.com>
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/20230406095735.0_14edn3@linutronix.de
+Link: https://lore.kernel.org/r/20230418122639.ikgfvu3f@linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/time/tick-common.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/kernel/time/tick-common.c b/kernel/time/tick-common.c
+index 46789356f856e..65b8658da829e 100644
+--- a/kernel/time/tick-common.c
++++ b/kernel/time/tick-common.c
+@@ -218,9 +218,19 @@ static void tick_setup_device(struct tick_device *td,
+ * this cpu:
+ */
+ if (tick_do_timer_cpu == TICK_DO_TIMER_BOOT) {
++ ktime_t next_p;
++ u32 rem;
++
+ tick_do_timer_cpu = cpu;
+
+- tick_next_period = ktime_get();
++ next_p = ktime_get();
++ div_u64_rem(next_p, TICK_NSEC, &rem);
++ if (rem) {
++ next_p -= rem;
++ next_p += TICK_NSEC;
++ }
++
++ tick_next_period = next_p;
+ #ifdef CONFIG_NO_HZ_FULL
+ /*
+ * The boot CPU may be nohz_full, in which case set
+--
+2.39.2
+
--- /dev/null
+From b9ddb3aa7c0a3e2ce0beb3ae0c1c1873aa5e72f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Apr 2023 15:43:34 +0200
+Subject: timekeeping: Fix references to nonexistent ktime_get_fast_ns()
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 158009f1b4a33bc0f354b994eea361362bd83226 ]
+
+There was never a function named ktime_get_fast_ns().
+Presumably these should refer to ktime_get_mono_fast_ns() instead.
+
+Fixes: c1ce406e80fb15fa ("timekeeping: Fix up function documentation for the NMI safe accessors")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Acked-by: John Stultz <jstultz@google.com>
+Link: https://lore.kernel.org/r/06df7b3cbd94f016403bbf6cd2b38e4368e7468f.1682516546.git.geert+renesas@glider.be
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/time/timekeeping.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
+index 5579ead449f25..09d594900ee0b 100644
+--- a/kernel/time/timekeeping.c
++++ b/kernel/time/timekeeping.c
+@@ -526,7 +526,7 @@ EXPORT_SYMBOL_GPL(ktime_get_raw_fast_ns);
+ * partially updated. Since the tk->offs_boot update is a rare event, this
+ * should be a rare occurrence which postprocessing should be able to handle.
+ *
+- * The caveats vs. timestamp ordering as documented for ktime_get_fast_ns()
++ * The caveats vs. timestamp ordering as documented for ktime_get_mono_fast_ns()
+ * apply as well.
+ */
+ u64 notrace ktime_get_boot_fast_ns(void)
+@@ -576,7 +576,7 @@ static __always_inline u64 __ktime_get_real_fast(struct tk_fast *tkf, u64 *mono)
+ /**
+ * ktime_get_real_fast_ns: - NMI safe and fast access to clock realtime.
+ *
+- * See ktime_get_fast_ns() for documentation of the time stamp ordering.
++ * See ktime_get_mono_fast_ns() for documentation of the time stamp ordering.
+ */
+ u64 ktime_get_real_fast_ns(void)
+ {
+--
+2.39.2
+
--- /dev/null
+From 0b0c9cba90c261eaf36681e7b1ebd12779aaa0ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Feb 2023 16:08:54 +0100
+Subject: tools: bpftool: Remove invalid \' json escape
+
+From: Luis Gerhorst <gerhorst@cs.fau.de>
+
+[ Upstream commit c679bbd611c08b0559ffae079330bc4e5574696a ]
+
+RFC8259 ("The JavaScript Object Notation (JSON) Data Interchange
+Format") only specifies \", \\, \/, \b, \f, \n, \r, and \r as valid
+two-character escape sequences. This does not include \', which is not
+required in JSON because it exclusively uses double quotes as string
+separators.
+
+Solidus (/) may be escaped, but does not have to. Only reverse
+solidus (\), double quotes ("), and the control characters have to be
+escaped. Therefore, with this fix, bpftool correctly supports all valid
+two-character escape sequences (but still does not support characters
+that require multi-character escape sequences).
+
+Witout this fix, attempting to load a JSON file generated by bpftool
+using Python 3.10.6's default json.load() may fail with the error
+"Invalid \escape" if the file contains the invalid escaped single
+quote (\').
+
+Fixes: b66e907cfee2 ("tools: bpftool: copy JSON writer from iproute2 repository")
+Signed-off-by: Luis Gerhorst <gerhorst@cs.fau.de>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Reviewed-by: Quentin Monnet <quentin@isovalent.com>
+Link: https://lore.kernel.org/bpf/20230227150853.16863-1-gerhorst@cs.fau.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/bpf/bpftool/json_writer.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/tools/bpf/bpftool/json_writer.c b/tools/bpf/bpftool/json_writer.c
+index 7fea83bedf488..bca5dd0a59e34 100644
+--- a/tools/bpf/bpftool/json_writer.c
++++ b/tools/bpf/bpftool/json_writer.c
+@@ -80,9 +80,6 @@ static void jsonw_puts(json_writer_t *self, const char *str)
+ case '"':
+ fputs("\\\"", self->out);
+ break;
+- case '\'':
+- fputs("\\\'", self->out);
+- break;
+ default:
+ putc(*str, self->out);
+ }
+--
+2.39.2
+
--- /dev/null
+From 094df83f5a28f4e4c9a92b3ecececc3d222b2efd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Feb 2023 08:18:30 -0600
+Subject: tools/x86/kcpuid: Fix avx512bw and avx512lvl fields in Fn00000007
+
+From: Terry Bowman <terry.bowman@amd.com>
+
+[ Upstream commit 4e347bdf44c1fd4296a7b9657a2c0e1bd900fa50 ]
+
+Leaf Fn00000007 contains avx512bw at bit 26 and avx512vl at bit 28. This
+is incorrect per the SDM. Correct avx512bw to be bit 30 and avx512lvl to
+be bit 31.
+
+Fixes: c6b2f240bf8d ("tools/x86: Add a kcpuid tool to show raw CPU features")
+Signed-off-by: Terry Bowman <terry.bowman@amd.com>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Reviewed-by: Feng Tang <feng.tang@intel.com>
+Link: https://lore.kernel.org/r/20230206141832.4162264-2-terry.bowman@amd.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/arch/x86/kcpuid/cpuid.csv | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/arch/x86/kcpuid/cpuid.csv b/tools/arch/x86/kcpuid/cpuid.csv
+index 4f1c4b0c29e98..9914bdf4fc9ec 100644
+--- a/tools/arch/x86/kcpuid/cpuid.csv
++++ b/tools/arch/x86/kcpuid/cpuid.csv
+@@ -184,8 +184,8 @@
+ 7, 0, EBX, 27, avx512er, AVX512 Exponent Reciproca instr
+ 7, 0, EBX, 28, avx512cd, AVX512 Conflict Detection instr
+ 7, 0, EBX, 29, sha, Intel Secure Hash Algorithm Extensions instr
+- 7, 0, EBX, 26, avx512bw, AVX512 Byte & Word instr
+- 7, 0, EBX, 28, avx512vl, AVX512 Vector Length Extentions (VL)
++ 7, 0, EBX, 30, avx512bw, AVX512 Byte & Word instr
++ 7, 0, EBX, 31, avx512vl, AVX512 Vector Length Extentions (VL)
+ 7, 0, ECX, 0, prefetchwt1, X
+ 7, 0, ECX, 1, avx512vbmi, AVX512 Vector Byte Manipulation Instructions
+ 7, 0, ECX, 2, umip, User-mode Instruction Prevention
+--
+2.39.2
+
--- /dev/null
+From 3acd95079157b3baaeda0c69ccbb73006e39e60d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Nov 2022 14:55:33 +0100
+Subject: tpm, tpm: Implement usage counter for locality
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Lino Sanfilippo <l.sanfilippo@kunbus.com>
+
+[ Upstream commit 7a2f55d0be296c4e81fd782f3d6c43ed4ec7e265 ]
+
+Implement a usage counter for the (default) locality used by the TPM TIS
+driver:
+Request the locality from the TPM if it has not been claimed yet, otherwise
+only increment the counter. Also release the locality if the counter is 0
+otherwise only decrement the counter. Since in case of SPI the register
+accesses are locked by means of the SPI bus mutex use a sleepable lock
+(i.e. also a mutex) to ensure thread-safety of the counter which may be
+accessed by both a userspace thread and the interrupt handler.
+
+By doing this refactor the names of the amended functions to use a more
+appropriate prefix.
+
+Signed-off-by: Lino Sanfilippo <l.sanfilippo@kunbus.com>
+Tested-by: Michael Niewöhner <linux@mniewoehner.de>
+Tested-by: Jarkko Sakkinen <jarkko@kernel.org>
+Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
+Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
+Stable-dep-of: 955df4f87760 ("tpm, tpm_tis: Claim locality when interrupts are reenabled on resume")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/tpm/tpm_tis_core.c | 63 +++++++++++++++++++++++----------
+ drivers/char/tpm/tpm_tis_core.h | 2 ++
+ 2 files changed, 47 insertions(+), 18 deletions(-)
+
+diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c
+index 39f27edb32879..c5fef63c6179d 100644
+--- a/drivers/char/tpm/tpm_tis_core.c
++++ b/drivers/char/tpm/tpm_tis_core.c
+@@ -136,16 +136,27 @@ static bool check_locality(struct tpm_chip *chip, int l)
+ return false;
+ }
+
+-static int release_locality(struct tpm_chip *chip, int l)
++static int __tpm_tis_relinquish_locality(struct tpm_tis_data *priv, int l)
++{
++ tpm_tis_write8(priv, TPM_ACCESS(l), TPM_ACCESS_ACTIVE_LOCALITY);
++
++ return 0;
++}
++
++static int tpm_tis_relinquish_locality(struct tpm_chip *chip, int l)
+ {
+ struct tpm_tis_data *priv = dev_get_drvdata(&chip->dev);
+
+- tpm_tis_write8(priv, TPM_ACCESS(l), TPM_ACCESS_ACTIVE_LOCALITY);
++ mutex_lock(&priv->locality_count_mutex);
++ priv->locality_count--;
++ if (priv->locality_count == 0)
++ __tpm_tis_relinquish_locality(priv, l);
++ mutex_unlock(&priv->locality_count_mutex);
+
+ return 0;
+ }
+
+-static int request_locality(struct tpm_chip *chip, int l)
++static int __tpm_tis_request_locality(struct tpm_chip *chip, int l)
+ {
+ struct tpm_tis_data *priv = dev_get_drvdata(&chip->dev);
+ unsigned long stop, timeout;
+@@ -186,6 +197,20 @@ static int request_locality(struct tpm_chip *chip, int l)
+ return -1;
+ }
+
++static int tpm_tis_request_locality(struct tpm_chip *chip, int l)
++{
++ struct tpm_tis_data *priv = dev_get_drvdata(&chip->dev);
++ int ret = 0;
++
++ mutex_lock(&priv->locality_count_mutex);
++ if (priv->locality_count == 0)
++ ret = __tpm_tis_request_locality(chip, l);
++ if (!ret)
++ priv->locality_count++;
++ mutex_unlock(&priv->locality_count_mutex);
++ return ret;
++}
++
+ static u8 tpm_tis_status(struct tpm_chip *chip)
+ {
+ struct tpm_tis_data *priv = dev_get_drvdata(&chip->dev);
+@@ -652,7 +677,7 @@ static int probe_itpm(struct tpm_chip *chip)
+ if (vendor != TPM_VID_INTEL)
+ return 0;
+
+- if (request_locality(chip, 0) != 0)
++ if (tpm_tis_request_locality(chip, 0) != 0)
+ return -EBUSY;
+
+ rc = tpm_tis_send_data(chip, cmd_getticks, len);
+@@ -673,7 +698,7 @@ static int probe_itpm(struct tpm_chip *chip)
+
+ out:
+ tpm_tis_ready(chip);
+- release_locality(chip, priv->locality);
++ tpm_tis_relinquish_locality(chip, priv->locality);
+
+ return rc;
+ }
+@@ -765,14 +790,14 @@ static int tpm_tis_probe_irq_single(struct tpm_chip *chip, u32 intmask,
+ }
+ priv->irq = irq;
+
+- rc = request_locality(chip, 0);
++ rc = tpm_tis_request_locality(chip, 0);
+ if (rc < 0)
+ return rc;
+
+ rc = tpm_tis_read8(priv, TPM_INT_VECTOR(priv->locality),
+ &original_int_vec);
+ if (rc < 0) {
+- release_locality(chip, priv->locality);
++ tpm_tis_relinquish_locality(chip, priv->locality);
+ return rc;
+ }
+
+@@ -811,7 +836,7 @@ static int tpm_tis_probe_irq_single(struct tpm_chip *chip, u32 intmask,
+ rc = -1;
+ }
+
+- release_locality(chip, priv->locality);
++ tpm_tis_relinquish_locality(chip, priv->locality);
+
+ return rc;
+ }
+@@ -927,8 +952,8 @@ static const struct tpm_class_ops tpm_tis = {
+ .req_complete_mask = TPM_STS_DATA_AVAIL | TPM_STS_VALID,
+ .req_complete_val = TPM_STS_DATA_AVAIL | TPM_STS_VALID,
+ .req_canceled = tpm_tis_req_canceled,
+- .request_locality = request_locality,
+- .relinquish_locality = release_locality,
++ .request_locality = tpm_tis_request_locality,
++ .relinquish_locality = tpm_tis_relinquish_locality,
+ .clk_enable = tpm_tis_clkrun_enable,
+ };
+
+@@ -962,6 +987,8 @@ int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq,
+ priv->timeout_min = TPM_TIMEOUT_USECS_MIN;
+ priv->timeout_max = TPM_TIMEOUT_USECS_MAX;
+ priv->phy_ops = phy_ops;
++ priv->locality_count = 0;
++ mutex_init(&priv->locality_count_mutex);
+
+ dev_set_drvdata(&chip->dev, priv);
+
+@@ -1008,14 +1035,14 @@ int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq,
+ TPM_INTF_DATA_AVAIL_INT | TPM_INTF_STS_VALID_INT;
+ intmask &= ~TPM_GLOBAL_INT_ENABLE;
+
+- rc = request_locality(chip, 0);
++ rc = tpm_tis_request_locality(chip, 0);
+ if (rc < 0) {
+ rc = -ENODEV;
+ goto out_err;
+ }
+
+ tpm_tis_write32(priv, TPM_INT_ENABLE(priv->locality), intmask);
+- release_locality(chip, 0);
++ tpm_tis_relinquish_locality(chip, 0);
+
+ rc = tpm_chip_start(chip);
+ if (rc)
+@@ -1075,13 +1102,13 @@ int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq,
+ * proper timeouts for the driver.
+ */
+
+- rc = request_locality(chip, 0);
++ rc = tpm_tis_request_locality(chip, 0);
+ if (rc < 0)
+ goto out_err;
+
+ rc = tpm_get_timeouts(chip);
+
+- release_locality(chip, 0);
++ tpm_tis_relinquish_locality(chip, 0);
+
+ if (rc) {
+ dev_err(dev, "Could not get TPM timeouts and durations\n");
+@@ -1099,11 +1126,11 @@ int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq,
+ dev_err(&chip->dev, FW_BUG
+ "TPM interrupt not working, polling instead\n");
+
+- rc = request_locality(chip, 0);
++ rc = tpm_tis_request_locality(chip, 0);
+ if (rc < 0)
+ goto out_err;
+ disable_interrupts(chip);
+- release_locality(chip, 0);
++ tpm_tis_relinquish_locality(chip, 0);
+ }
+ }
+
+@@ -1176,13 +1203,13 @@ int tpm_tis_resume(struct device *dev)
+ * an error code but for unknown reason it isn't handled.
+ */
+ if (!(chip->flags & TPM_CHIP_FLAG_TPM2)) {
+- ret = request_locality(chip, 0);
++ ret = tpm_tis_request_locality(chip, 0);
+ if (ret < 0)
+ return ret;
+
+ tpm1_do_selftest(chip);
+
+- release_locality(chip, 0);
++ tpm_tis_relinquish_locality(chip, 0);
+ }
+
+ return 0;
+diff --git a/drivers/char/tpm/tpm_tis_core.h b/drivers/char/tpm/tpm_tis_core.h
+index b68479e0de10f..1d51d5168fb6e 100644
+--- a/drivers/char/tpm/tpm_tis_core.h
++++ b/drivers/char/tpm/tpm_tis_core.h
+@@ -91,6 +91,8 @@ enum tpm_tis_flags {
+
+ struct tpm_tis_data {
+ u16 manufacturer_id;
++ struct mutex locality_count_mutex;
++ unsigned int locality_count;
+ int locality;
+ int irq;
+ bool irq_tested;
+--
+2.39.2
+
--- /dev/null
+From 8e843f7ef41eb436046155dfd343c602c2b6fd0a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Nov 2022 14:55:29 +0100
+Subject: tpm, tpm_tis: Claim locality before writing interrupt registers
+
+From: Lino Sanfilippo <l.sanfilippo@kunbus.com>
+
+[ Upstream commit 15d7aa4e46eba87242a320f39773aa16faddadee ]
+
+In tpm_tis_probe_single_irq() interrupt registers TPM_INT_VECTOR,
+TPM_INT_STATUS and TPM_INT_ENABLE are modified to setup the interrupts.
+Currently these modifications are done without holding a locality thus they
+have no effect. Fix this by claiming the (default) locality before the
+registers are written.
+
+Since now tpm_tis_gen_interrupt() is called with the locality already
+claimed remove locality request and release from this function.
+
+Signed-off-by: Lino Sanfilippo <l.sanfilippo@kunbus.com>
+Tested-by: Jarkko Sakkinen <jarkko@kernel.org>
+Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
+Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
+Stable-dep-of: 955df4f87760 ("tpm, tpm_tis: Claim locality when interrupts are reenabled on resume")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/tpm/tpm_tis_core.c | 20 +++++++++++---------
+ 1 file changed, 11 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c
+index 4e6075d4e2643..39f27edb32879 100644
+--- a/drivers/char/tpm/tpm_tis_core.c
++++ b/drivers/char/tpm/tpm_tis_core.c
+@@ -739,16 +739,10 @@ static void tpm_tis_gen_interrupt(struct tpm_chip *chip)
+ cap_t cap;
+ int ret;
+
+- ret = request_locality(chip, 0);
+- if (ret < 0)
+- return;
+-
+ if (chip->flags & TPM_CHIP_FLAG_TPM2)
+ ret = tpm2_get_tpm_pt(chip, 0x100, &cap2, desc);
+ else
+ ret = tpm1_getcap(chip, TPM_CAP_PROP_TIS_TIMEOUT, &cap, desc, 0);
+-
+- release_locality(chip, 0);
+ }
+
+ /* Register the IRQ and issue a command that will cause an interrupt. If an
+@@ -771,10 +765,16 @@ static int tpm_tis_probe_irq_single(struct tpm_chip *chip, u32 intmask,
+ }
+ priv->irq = irq;
+
++ rc = request_locality(chip, 0);
++ if (rc < 0)
++ return rc;
++
+ rc = tpm_tis_read8(priv, TPM_INT_VECTOR(priv->locality),
+ &original_int_vec);
+- if (rc < 0)
++ if (rc < 0) {
++ release_locality(chip, priv->locality);
+ return rc;
++ }
+
+ rc = tpm_tis_write8(priv, TPM_INT_VECTOR(priv->locality), irq);
+ if (rc < 0)
+@@ -808,10 +808,12 @@ static int tpm_tis_probe_irq_single(struct tpm_chip *chip, u32 intmask,
+ if (!(chip->flags & TPM_CHIP_FLAG_IRQ)) {
+ tpm_tis_write8(priv, original_int_vec,
+ TPM_INT_VECTOR(priv->locality));
+- return -1;
++ rc = -1;
+ }
+
+- return 0;
++ release_locality(chip, priv->locality);
++
++ return rc;
+ }
+
+ /* Try to find the IRQ the TPM is using. This is for legacy x86 systems that
+--
+2.39.2
+
--- /dev/null
+From 0b38542c3a8e093e5d211ca1d035a8259602ae98 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Nov 2022 14:55:26 +0100
+Subject: tpm, tpm_tis: Claim locality before writing TPM_INT_ENABLE register
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Lino Sanfilippo <l.sanfilippo@kunbus.com>
+
+[ Upstream commit 282657a8bd7fddcf511b834f43705001668b33a7 ]
+
+In disable_interrupts() the TPM_GLOBAL_INT_ENABLE bit is unset in the
+TPM_INT_ENABLE register to shut the interrupts off. However modifying the
+register is only possible with a held locality. So claim the locality
+before disable_interrupts() is called.
+
+Signed-off-by: Lino Sanfilippo <l.sanfilippo@kunbus.com>
+Tested-by: Michael Niewöhner <linux@mniewoehner.de>
+Tested-by: Jarkko Sakkinen <jarkko@kernel.org>
+Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
+Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
+Stable-dep-of: 955df4f87760 ("tpm, tpm_tis: Claim locality when interrupts are reenabled on resume")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/tpm/tpm_tis_core.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c
+index 33d98f3e0f7a6..a2cbf9b6f4c92 100644
+--- a/drivers/char/tpm/tpm_tis_core.c
++++ b/drivers/char/tpm/tpm_tis_core.c
+@@ -1094,7 +1094,11 @@ int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq,
+ dev_err(&chip->dev, FW_BUG
+ "TPM interrupt not working, polling instead\n");
+
++ rc = request_locality(chip, 0);
++ if (rc < 0)
++ goto out_err;
+ disable_interrupts(chip);
++ release_locality(chip, 0);
+ }
+ } else {
+ tpm_tis_probe_irq(chip, intmask);
+--
+2.39.2
+
--- /dev/null
+From 00efbf3a5ea8d6e775e8c2c7d626d885b1abb8e5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Nov 2022 14:55:36 +0100
+Subject: tpm, tpm_tis: Claim locality when interrupts are reenabled on resume
+
+From: Lino Sanfilippo <l.sanfilippo@kunbus.com>
+
+[ Upstream commit 955df4f87760b3bb2af253d3fbb12fb712b3ffa6 ]
+
+In tpm_tis_resume() make sure that the locality has been claimed when
+tpm_tis_reenable_interrupts() is called. Otherwise the writings to the
+register might not have any effect.
+
+Fixes: 45baa1d1fa39 ("tpm_tis: Re-enable interrupts upon (S3) resume")
+Signed-off-by: Lino Sanfilippo <l.sanfilippo@kunbus.com>
+Tested-by: Jarkko Sakkinen <jarkko@kernel.org>
+Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
+Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/tpm/tpm_tis_core.c | 19 +++++++++----------
+ 1 file changed, 9 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c
+index c5fef63c6179d..eecfbd7e97867 100644
+--- a/drivers/char/tpm/tpm_tis_core.c
++++ b/drivers/char/tpm/tpm_tis_core.c
+@@ -1191,28 +1191,27 @@ int tpm_tis_resume(struct device *dev)
+ struct tpm_chip *chip = dev_get_drvdata(dev);
+ int ret;
+
++ ret = tpm_tis_request_locality(chip, 0);
++ if (ret < 0)
++ return ret;
++
+ if (chip->flags & TPM_CHIP_FLAG_IRQ)
+ tpm_tis_reenable_interrupts(chip);
+
+ ret = tpm_pm_resume(dev);
+ if (ret)
+- return ret;
++ goto out;
+
+ /*
+ * TPM 1.2 requires self-test on resume. This function actually returns
+ * an error code but for unknown reason it isn't handled.
+ */
+- if (!(chip->flags & TPM_CHIP_FLAG_TPM2)) {
+- ret = tpm_tis_request_locality(chip, 0);
+- if (ret < 0)
+- return ret;
+-
++ if (!(chip->flags & TPM_CHIP_FLAG_TPM2))
+ tpm1_do_selftest(chip);
++out:
++ tpm_tis_relinquish_locality(chip, 0);
+
+- tpm_tis_relinquish_locality(chip, 0);
+- }
+-
+- return 0;
++ return ret;
+ }
+ EXPORT_SYMBOL_GPL(tpm_tis_resume);
+ #endif
+--
+2.39.2
+
--- /dev/null
+From 49b17895b944a74dfbfacacbabd07f484cbac025 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Nov 2022 14:55:27 +0100
+Subject: tpm, tpm_tis: Disable interrupts if tpm_tis_probe_irq() failed
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Lino Sanfilippo <l.sanfilippo@kunbus.com>
+
+[ Upstream commit 6d789ad726950e612a7f31044260337237c5b490 ]
+
+Both functions tpm_tis_probe_irq_single() and tpm_tis_probe_irq() may setup
+the interrupts and then return with an error. This case is indicated by a
+missing TPM_CHIP_FLAG_IRQ flag in chip->flags.
+Currently the interrupt setup is only undone if tpm_tis_probe_irq_single()
+fails. Undo the setup also if tpm_tis_probe_irq() fails.
+
+Signed-off-by: Lino Sanfilippo <l.sanfilippo@kunbus.com>
+Tested-by: Michael Niewöhner <linux@mniewoehner.de>
+Tested-by: Jarkko Sakkinen <jarkko@kernel.org>
+Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
+Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
+Stable-dep-of: 955df4f87760 ("tpm, tpm_tis: Claim locality when interrupts are reenabled on resume")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/tpm/tpm_tis_core.c | 22 +++++++++++-----------
+ 1 file changed, 11 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c
+index a2cbf9b6f4c92..4e6075d4e2643 100644
+--- a/drivers/char/tpm/tpm_tis_core.c
++++ b/drivers/char/tpm/tpm_tis_core.c
+@@ -1087,21 +1087,21 @@ int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq,
+ goto out_err;
+ }
+
+- if (irq) {
++ if (irq)
+ tpm_tis_probe_irq_single(chip, intmask, IRQF_SHARED,
+ irq);
+- if (!(chip->flags & TPM_CHIP_FLAG_IRQ)) {
+- dev_err(&chip->dev, FW_BUG
++ else
++ tpm_tis_probe_irq(chip, intmask);
++
++ if (!(chip->flags & TPM_CHIP_FLAG_IRQ)) {
++ dev_err(&chip->dev, FW_BUG
+ "TPM interrupt not working, polling instead\n");
+
+- rc = request_locality(chip, 0);
+- if (rc < 0)
+- goto out_err;
+- disable_interrupts(chip);
+- release_locality(chip, 0);
+- }
+- } else {
+- tpm_tis_probe_irq(chip, intmask);
++ rc = request_locality(chip, 0);
++ if (rc < 0)
++ goto out_err;
++ disable_interrupts(chip);
++ release_locality(chip, 0);
+ }
+ }
+
+--
+2.39.2
+
--- /dev/null
+From c673f1e5b7c0bd6c5a5513e83a84389ae2935802 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Nov 2022 14:55:28 +0100
+Subject: tpm, tpm_tis: Do not skip reset of original interrupt vector
+
+From: Lino Sanfilippo <l.sanfilippo@kunbus.com>
+
+[ Upstream commit ed9be0e6c892a783800d77a41ca4c7255c6af8c5 ]
+
+If in tpm_tis_probe_irq_single() an error occurs after the original
+interrupt vector has been read, restore the interrupts before the error is
+returned.
+
+Since the caller does not check the error value, return -1 in any case that
+the TPM_CHIP_FLAG_IRQ flag is not set. Since the return value of function
+tpm_tis_gen_interrupt() is not longer used, make it a void function.
+
+Fixes: 1107d065fdf1 ("tpm_tis: Introduce intermediate layer for TPM access")
+Signed-off-by: Lino Sanfilippo <l.sanfilippo@kunbus.com>
+Tested-by: Jarkko Sakkinen <jarkko@kernel.org>
+Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
+Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/tpm/tpm_tis_core.c | 29 +++++++++++------------------
+ 1 file changed, 11 insertions(+), 18 deletions(-)
+
+diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c
+index 3f98e587b3e84..33d98f3e0f7a6 100644
+--- a/drivers/char/tpm/tpm_tis_core.c
++++ b/drivers/char/tpm/tpm_tis_core.c
+@@ -732,7 +732,7 @@ static irqreturn_t tis_int_handler(int dummy, void *dev_id)
+ return IRQ_HANDLED;
+ }
+
+-static int tpm_tis_gen_interrupt(struct tpm_chip *chip)
++static void tpm_tis_gen_interrupt(struct tpm_chip *chip)
+ {
+ const char *desc = "attempting to generate an interrupt";
+ u32 cap2;
+@@ -741,7 +741,7 @@ static int tpm_tis_gen_interrupt(struct tpm_chip *chip)
+
+ ret = request_locality(chip, 0);
+ if (ret < 0)
+- return ret;
++ return;
+
+ if (chip->flags & TPM_CHIP_FLAG_TPM2)
+ ret = tpm2_get_tpm_pt(chip, 0x100, &cap2, desc);
+@@ -749,8 +749,6 @@ static int tpm_tis_gen_interrupt(struct tpm_chip *chip)
+ ret = tpm1_getcap(chip, TPM_CAP_PROP_TIS_TIMEOUT, &cap, desc, 0);
+
+ release_locality(chip, 0);
+-
+- return ret;
+ }
+
+ /* Register the IRQ and issue a command that will cause an interrupt. If an
+@@ -780,42 +778,37 @@ static int tpm_tis_probe_irq_single(struct tpm_chip *chip, u32 intmask,
+
+ rc = tpm_tis_write8(priv, TPM_INT_VECTOR(priv->locality), irq);
+ if (rc < 0)
+- return rc;
++ goto restore_irqs;
+
+ rc = tpm_tis_read32(priv, TPM_INT_STATUS(priv->locality), &int_status);
+ if (rc < 0)
+- return rc;
++ goto restore_irqs;
+
+ /* Clear all existing */
+ rc = tpm_tis_write32(priv, TPM_INT_STATUS(priv->locality), int_status);
+ if (rc < 0)
+- return rc;
+-
++ goto restore_irqs;
+ /* Turn on */
+ rc = tpm_tis_write32(priv, TPM_INT_ENABLE(priv->locality),
+ intmask | TPM_GLOBAL_INT_ENABLE);
+ if (rc < 0)
+- return rc;
++ goto restore_irqs;
+
+ priv->irq_tested = false;
+
+ /* Generate an interrupt by having the core call through to
+ * tpm_tis_send
+ */
+- rc = tpm_tis_gen_interrupt(chip);
+- if (rc < 0)
+- return rc;
++ tpm_tis_gen_interrupt(chip);
+
++restore_irqs:
+ /* tpm_tis_send will either confirm the interrupt is working or it
+ * will call disable_irq which undoes all of the above.
+ */
+ if (!(chip->flags & TPM_CHIP_FLAG_IRQ)) {
+- rc = tpm_tis_write8(priv, original_int_vec,
+- TPM_INT_VECTOR(priv->locality));
+- if (rc < 0)
+- return rc;
+-
+- return 1;
++ tpm_tis_write8(priv, original_int_vec,
++ TPM_INT_VECTOR(priv->locality));
++ return -1;
+ }
+
+ return 0;
+--
+2.39.2
+
--- /dev/null
+From 68e923db1513c41045534cd31c1486165d432a32 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Apr 2023 15:51:04 -0700
+Subject: tracing/user_events: Ensure write index cannot be negative
+
+From: Beau Belgrave <beaub@linux.microsoft.com>
+
+[ Upstream commit cd98c93286a30cc4588dfd02453bec63c2f4acf4 ]
+
+The write index indicates which event the data is for and accesses a
+per-file array. The index is passed by user processes during write()
+calls as the first 4 bytes. Ensure that it cannot be negative by
+returning -EINVAL to prevent out of bounds accesses.
+
+Update ftrace self-test to ensure this occurs properly.
+
+Link: https://lkml.kernel.org/r/20230425225107.8525-2-beaub@linux.microsoft.com
+
+Fixes: 7f5a08c79df3 ("user_events: Add minimal support for trace_event into ftrace")
+Reported-by: Doug Cook <dcook@linux.microsoft.com>
+Signed-off-by: Beau Belgrave <beaub@linux.microsoft.com>
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/trace_events_user.c | 3 +++
+ tools/testing/selftests/user_events/ftrace_test.c | 5 +++++
+ 2 files changed, 8 insertions(+)
+
+diff --git a/kernel/trace/trace_events_user.c b/kernel/trace/trace_events_user.c
+index 908e8a13c675b..625cab4b9d945 100644
+--- a/kernel/trace/trace_events_user.c
++++ b/kernel/trace/trace_events_user.c
+@@ -1398,6 +1398,9 @@ static ssize_t user_events_write_core(struct file *file, struct iov_iter *i)
+ if (unlikely(copy_from_iter(&idx, sizeof(idx), i) != sizeof(idx)))
+ return -EFAULT;
+
++ if (idx < 0)
++ return -EINVAL;
++
+ rcu_read_lock_sched();
+
+ refs = rcu_dereference_sched(info->refs);
+diff --git a/tools/testing/selftests/user_events/ftrace_test.c b/tools/testing/selftests/user_events/ftrace_test.c
+index 404a2713dcae8..1bc26e6476fc3 100644
+--- a/tools/testing/selftests/user_events/ftrace_test.c
++++ b/tools/testing/selftests/user_events/ftrace_test.c
+@@ -294,6 +294,11 @@ TEST_F(user, write_events) {
+ ASSERT_NE(-1, writev(self->data_fd, (const struct iovec *)io, 3));
+ after = trace_bytes();
+ ASSERT_GT(after, before);
++
++ /* Negative index should fail with EINVAL */
++ reg.write_index = -1;
++ ASSERT_EQ(-1, writev(self->data_fd, (const struct iovec *)io, 3));
++ ASSERT_EQ(EINVAL, errno);
+ }
+
+ TEST_F(user, write_fault) {
+--
+2.39.2
+
--- /dev/null
+From 803bfdb82136c0ffe06216db3b88c6a501bfe732 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Apr 2023 14:55:55 -0500
+Subject: tty: serial: fsl_lpuart: adjust buffer length to the intended size
+
+From: Shenwei Wang <shenwei.wang@nxp.com>
+
+[ Upstream commit f73fd750552524b06b5d77ebfdd106ccc8fcac61 ]
+
+Based on the fls function definition provided below, we should not
+subtract 1 to obtain the correct buffer length:
+
+fls(0) = 0, fls(1) = 1, fls(0x80000000) = 32.
+
+Fixes: 5887ad43ee02 ("tty: serial: fsl_lpuart: Use cyclic DMA for Rx")
+Signed-off-by: Shenwei Wang <shenwei.wang@nxp.com>
+Link: https://lore.kernel.org/r/20230410195555.1003900-1-shenwei.wang@nxp.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/fsl_lpuart.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
+index 074bfed57fc9e..aef9be3e73c15 100644
+--- a/drivers/tty/serial/fsl_lpuart.c
++++ b/drivers/tty/serial/fsl_lpuart.c
+@@ -1296,7 +1296,7 @@ static inline int lpuart_start_rx_dma(struct lpuart_port *sport)
+ * 10ms at any baud rate.
+ */
+ sport->rx_dma_rng_buf_len = (DMA_RX_TIMEOUT * baud / bits / 1000) * 2;
+- sport->rx_dma_rng_buf_len = (1 << (fls(sport->rx_dma_rng_buf_len) - 1));
++ sport->rx_dma_rng_buf_len = (1 << fls(sport->rx_dma_rng_buf_len));
+ if (sport->rx_dma_rng_buf_len < 16)
+ sport->rx_dma_rng_buf_len = 16;
+
+--
+2.39.2
+
--- /dev/null
+From 6277331eb65feff550f211ea9de30b25aecaedfc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Apr 2023 10:27:47 +0100
+Subject: uapi/linux/const.h: prefer ISO-friendly __typeof__
+
+From: Kevin Brodsky <kevin.brodsky@arm.com>
+
+[ Upstream commit 31088f6f7906253ef4577f6a9b84e2d42447dba0 ]
+
+typeof is (still) a GNU extension, which means that it cannot be used when
+building ISO C (e.g. -std=c99). It should therefore be avoided in uapi
+headers in favour of the ISO-friendly __typeof__.
+
+Unfortunately this issue could not be detected by
+CONFIG_UAPI_HEADER_TEST=y as the __ALIGN_KERNEL() macro is not expanded in
+any uapi header.
+
+This matters from a userspace perspective, not a kernel one. uapi
+headers and their contents are expected to be usable in a variety of
+situations, and in particular when building ISO C applications (with
+-std=c99 or similar).
+
+This particular problem can be reproduced by trying to use the
+__ALIGN_KERNEL macro directly in application code, say:
+
+#include <linux/const.h>
+
+int align(int x, int a)
+{
+ return __KERNEL_ALIGN(x, a);
+}
+
+and trying to build that with -std=c99.
+
+Link: https://lkml.kernel.org/r/20230411092747.3759032-1-kevin.brodsky@arm.com
+Fixes: a79ff731a1b2 ("netfilter: xtables: make XT_ALIGN() usable in exported headers by exporting __ALIGN_KERNEL()")
+Signed-off-by: Kevin Brodsky <kevin.brodsky@arm.com>
+Reported-by: Ruben Ayrapetyan <ruben.ayrapetyan@arm.com>
+Tested-by: Ruben Ayrapetyan <ruben.ayrapetyan@arm.com>
+Reviewed-by: Petr Vorel <pvorel@suse.cz>
+Tested-by: Petr Vorel <pvorel@suse.cz>
+Reviewed-by: Masahiro Yamada <masahiroy@kernel.org>
+Cc: Sam Ravnborg <sam@ravnborg.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/uapi/linux/const.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/uapi/linux/const.h b/include/uapi/linux/const.h
+index af2a44c08683d..a429381e7ca50 100644
+--- a/include/uapi/linux/const.h
++++ b/include/uapi/linux/const.h
+@@ -28,7 +28,7 @@
+ #define _BITUL(x) (_UL(1) << (x))
+ #define _BITULL(x) (_ULL(1) << (x))
+
+-#define __ALIGN_KERNEL(x, a) __ALIGN_KERNEL_MASK(x, (typeof(x))(a) - 1)
++#define __ALIGN_KERNEL(x, a) __ALIGN_KERNEL_MASK(x, (__typeof__(x))(a) - 1)
+ #define __ALIGN_KERNEL_MASK(x, mask) (((x) + (mask)) & ~(mask))
+
+ #define __KERNEL_DIV_ROUND_UP(n, d) (((n) + (d) - 1) / (d))
+--
+2.39.2
+
--- /dev/null
+From 29b72a44f9abc0f8d9b889fa0fef7b1b03bd6d8c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Apr 2023 13:58:52 +0800
+Subject: usb: chipidea: fix missing goto in `ci_hdrc_probe`
+
+From: Yinhao Hu <dddddd@hust.edu.cn>
+
+[ Upstream commit d6f712f53b79f5017cdcefafb7a5aea9ec52da5d ]
+
+From the comment of ci_usb_phy_init, it returns an error code if
+usb_phy_init has failed, and it should do some clean up, not just
+return directly.
+
+Fix this by goto the error handling.
+
+Fixes: 74475ede784d ("usb: chipidea: move PHY operation to core")
+Reviewed-by: Dongliang Mu <dzm91@hust.edu.cn>
+Acked-by: Peter Chen <peter.chen@kernel.org>
+Signed-off-by: Yinhao Hu <dddddd@hust.edu.cn>
+Link: https://lore.kernel.org/r/20230412055852.971991-1-dddddd@hust.edu.cn
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/chipidea/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/chipidea/core.c b/drivers/usb/chipidea/core.c
+index 281fc51720cea..25084ce7c297b 100644
+--- a/drivers/usb/chipidea/core.c
++++ b/drivers/usb/chipidea/core.c
+@@ -1108,7 +1108,7 @@ static int ci_hdrc_probe(struct platform_device *pdev)
+ ret = ci_usb_phy_init(ci);
+ if (ret) {
+ dev_err(dev, "unable to init phy: %d\n", ret);
+- return ret;
++ goto ulpi_exit;
+ }
+
+ ci->hw_bank.phys = res->start;
+--
+2.39.2
+
--- /dev/null
+From 464f5aab5025464abf01e9b4b7bc6e0cf439c2a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Feb 2023 11:16:58 +0530
+Subject: usb: dwc3: gadget: Change condition for processing suspend event
+
+From: Prashanth K <quic_prashk@quicinc.com>
+
+[ Upstream commit 4decf4060ecfee1f7a710999fcd421645ac0c419 ]
+
+Currently we process the suspend interrupt event only if the
+device is in configured state. Consider a case where device
+is not configured and got suspend interrupt, in that case our
+gadget will still use 100mA as composite_suspend didn't happen.
+But battery charging specification (BC1.2) expects a downstream
+device to draw less than 2.5mA when unconnected OR suspended.
+
+Fix this by removing the condition for processing suspend event,
+and thus composite_resume would set vbus draw to 2.
+
+Fixes: 72704f876f50 ("dwc3: gadget: Implement the suspend entry event handler")
+Signed-off-by: Prashanth K <quic_prashk@quicinc.com>
+Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Link: https://lore.kernel.org/r/1677217619-10261-2-git-send-email-quic_prashk@quicinc.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc3/gadget.c | 11 ++---------
+ 1 file changed, 2 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index 743186c26e01b..3faac3244c7db 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -4262,15 +4262,8 @@ static void dwc3_gadget_interrupt(struct dwc3 *dwc,
+ break;
+ case DWC3_DEVICE_EVENT_SUSPEND:
+ /* It changed to be suspend event for version 2.30a and above */
+- if (!DWC3_VER_IS_PRIOR(DWC3, 230A)) {
+- /*
+- * Ignore suspend event until the gadget enters into
+- * USB_STATE_CONFIGURED state.
+- */
+- if (dwc->gadget->state >= USB_STATE_CONFIGURED)
+- dwc3_gadget_suspend_interrupt(dwc,
+- event->event_info);
+- }
++ if (!DWC3_VER_IS_PRIOR(DWC3, 230A))
++ dwc3_gadget_suspend_interrupt(dwc, event->event_info);
+ break;
+ case DWC3_DEVICE_EVENT_SOF:
+ case DWC3_DEVICE_EVENT_ERRATIC_ERROR:
+--
+2.39.2
+
--- /dev/null
+From 949e7a0cf62ceaccfc38b2acd7b858c166f0fb48 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Apr 2023 19:18:53 +0100
+Subject: usb: gadget: tegra-xudc: Fix crash in vbus_draw
+
+From: Jon Hunter <jonathanh@nvidia.com>
+
+[ Upstream commit 5629d31955297ca47b9283c64fff70f2f34aa528 ]
+
+Commit ac82b56bda5f ("usb: gadget: tegra-xudc: Add vbus_draw support")
+populated the vbus_draw callback for the Tegra XUDC driver. The function
+tegra_xudc_gadget_vbus_draw(), that was added by this commit, assumes
+that the pointer 'curr_usbphy' has been initialised, which is not always
+the case because this is only initialised when the USB role is updated.
+Fix this crash, by checking that the 'curr_usbphy' is valid before
+dereferencing.
+
+Fixes: ac82b56bda5f ("usb: gadget: tegra-xudc: Add vbus_draw support")
+Reviewed-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Jon Hunter <jonathanh@nvidia.com>
+Link: https://lore.kernel.org/r/20230405181854.42355-1-jonathanh@nvidia.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/udc/tegra-xudc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/gadget/udc/tegra-xudc.c b/drivers/usb/gadget/udc/tegra-xudc.c
+index 2b71b33725f17..5bccd64847ff7 100644
+--- a/drivers/usb/gadget/udc/tegra-xudc.c
++++ b/drivers/usb/gadget/udc/tegra-xudc.c
+@@ -2167,7 +2167,7 @@ static int tegra_xudc_gadget_vbus_draw(struct usb_gadget *gadget,
+
+ dev_dbg(xudc->dev, "%s: %u mA\n", __func__, m_a);
+
+- if (xudc->curr_usbphy->chg_type == SDP_TYPE)
++ if (xudc->curr_usbphy && xudc->curr_usbphy->chg_type == SDP_TYPE)
+ ret = usb_phy_set_power(xudc->curr_usbphy, m_a);
+
+ return ret;
+--
+2.39.2
+
--- /dev/null
+From b473bc47b3bd10a309e03e27df01198b31021d55 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Mar 2023 14:29:31 +0800
+Subject: usb: gadget: udc: renesas_usb3: Fix use after free bug in
+ renesas_usb3_remove due to race condition
+
+From: Zheng Wang <zyytlz.wz@163.com>
+
+[ Upstream commit 2b947f8769be8b8181dc795fd292d3e7120f5204 ]
+
+In renesas_usb3_probe, role_work is bound with renesas_usb3_role_work.
+renesas_usb3_start will be called to start the work.
+
+If we remove the driver which will call usbhs_remove, there may be
+an unfinished work. The possible sequence is as follows:
+
+CPU0 CPU1
+
+ renesas_usb3_role_work
+renesas_usb3_remove
+usb_role_switch_unregister
+device_unregister
+kfree(sw)
+//free usb3->role_sw
+ usb_role_switch_set_role
+ //use usb3->role_sw
+
+The usb3->role_sw could be freed under such circumstance and then
+used in usb_role_switch_set_role.
+
+This bug was found by static analysis. And note that removing a
+driver is a root-only operation, and should never happen in normal
+case. But the root user may directly remove the device which
+will also trigger the remove function.
+
+Fix it by canceling the work before cleanup in the renesas_usb3_remove.
+
+Fixes: 39facfa01c9f ("usb: gadget: udc: renesas_usb3: Add register of usb role switch")
+Signed-off-by: Zheng Wang <zyytlz.wz@163.com>
+Reviewed-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Link: https://lore.kernel.org/r/20230320062931.505170-1-zyytlz.wz@163.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/udc/renesas_usb3.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/usb/gadget/udc/renesas_usb3.c b/drivers/usb/gadget/udc/renesas_usb3.c
+index bee6bceafc4fa..a301af66bd912 100644
+--- a/drivers/usb/gadget/udc/renesas_usb3.c
++++ b/drivers/usb/gadget/udc/renesas_usb3.c
+@@ -2661,6 +2661,7 @@ static int renesas_usb3_remove(struct platform_device *pdev)
+ debugfs_remove_recursive(usb3->dentry);
+ device_remove_file(&pdev->dev, &dev_attr_role);
+
++ cancel_work_sync(&usb3->role_work);
+ usb_role_switch_unregister(usb3->role_sw);
+
+ usb_del_gadget_udc(&usb3->gadget);
+--
+2.39.2
+
--- /dev/null
+From a4503ce1920bc9390ebece20d4461a7fcfbee9ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Mar 2023 17:30:37 +0100
+Subject: usb: host: xhci-rcar: remove leftover quirk handling
+
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+
+[ Upstream commit 5d67f4861884762ebc2bddb5d667444e45f25782 ]
+
+Loading V3 firmware does not need a quirk anymore, remove the leftover
+code.
+
+Fixes: ed8603e11124 ("usb: host: xhci-rcar: Simplify getting the firmware name for R-Car Gen3")
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Link: https://lore.kernel.org/r/20230307163041.3815-10-wsa+renesas@sang-engineering.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/xhci-rcar.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/drivers/usb/host/xhci-rcar.c b/drivers/usb/host/xhci-rcar.c
+index 7f18509a1d397..567b096a24e93 100644
+--- a/drivers/usb/host/xhci-rcar.c
++++ b/drivers/usb/host/xhci-rcar.c
+@@ -80,7 +80,6 @@ MODULE_FIRMWARE(XHCI_RCAR_FIRMWARE_NAME_V3);
+
+ /* For soc_device_attribute */
+ #define RCAR_XHCI_FIRMWARE_V2 BIT(0) /* FIRMWARE V2 */
+-#define RCAR_XHCI_FIRMWARE_V3 BIT(1) /* FIRMWARE V3 */
+
+ static const struct soc_device_attribute rcar_quirks_match[] = {
+ {
+@@ -152,8 +151,6 @@ static int xhci_rcar_download_firmware(struct usb_hcd *hcd)
+
+ if (quirks & RCAR_XHCI_FIRMWARE_V2)
+ firmware_name = XHCI_RCAR_FIRMWARE_NAME_V2;
+- else if (quirks & RCAR_XHCI_FIRMWARE_V3)
+- firmware_name = XHCI_RCAR_FIRMWARE_NAME_V3;
+ else
+ firmware_name = priv->firmware_name;
+
+--
+2.39.2
+
--- /dev/null
+From af26cb45acd036d6c90b38d99e2a7411039fc153 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Apr 2023 10:51:59 +0800
+Subject: usb: mtu3: fix kernel panic at qmu transfer done irq handler
+
+From: Chunfeng Yun <chunfeng.yun@mediatek.com>
+
+[ Upstream commit d28f4091ea7ec3510fd6a3c6d433234e7a2bef14 ]
+
+When handle qmu transfer irq, it will unlock @mtu->lock before give back
+request, if another thread handle disconnect event at the same time, and
+try to disable ep, it may lock @mtu->lock and free qmu ring, then qmu
+irq hanlder may get a NULL gpd, avoid the KE by checking gpd's value before
+handling it.
+
+e.g.
+qmu done irq on cpu0 thread running on cpu1
+
+qmu_done_tx()
+ handle gpd [0]
+ mtu3_requ_complete() mtu3_gadget_ep_disable()
+ unlock @mtu->lock
+ give back request lock @mtu->lock
+ mtu3_ep_disable()
+ mtu3_gpd_ring_free()
+ unlock @mtu->lock
+ lock @mtu->lock
+ get next gpd [1]
+
+[1]: goto [0] to handle next gpd, and next gpd may be NULL.
+
+Fixes: 48e0d3735aa5 ("usb: mtu3: supports new QMU format")
+Signed-off-by: Chunfeng Yun <chunfeng.yun@mediatek.com>
+Link: https://lore.kernel.org/r/20230417025203.18097-3-chunfeng.yun@mediatek.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/mtu3/mtu3_qmu.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/mtu3/mtu3_qmu.c b/drivers/usb/mtu3/mtu3_qmu.c
+index a2fdab8b63b28..3b68a0a19cc76 100644
+--- a/drivers/usb/mtu3/mtu3_qmu.c
++++ b/drivers/usb/mtu3/mtu3_qmu.c
+@@ -210,6 +210,7 @@ static struct qmu_gpd *advance_enq_gpd(struct mtu3_gpd_ring *ring)
+ return ring->enqueue;
+ }
+
++/* @dequeue may be NULL if ring is unallocated or freed */
+ static struct qmu_gpd *advance_deq_gpd(struct mtu3_gpd_ring *ring)
+ {
+ if (ring->dequeue < ring->end)
+@@ -491,7 +492,7 @@ static void qmu_done_tx(struct mtu3 *mtu, u8 epnum)
+ dev_dbg(mtu->dev, "%s EP%d, last=%p, current=%p, enq=%p\n",
+ __func__, epnum, gpd, gpd_current, ring->enqueue);
+
+- while (gpd != gpd_current && !GET_GPD_HWO(gpd)) {
++ while (gpd && gpd != gpd_current && !GET_GPD_HWO(gpd)) {
+
+ mreq = next_request(mep);
+
+@@ -530,7 +531,7 @@ static void qmu_done_rx(struct mtu3 *mtu, u8 epnum)
+ dev_dbg(mtu->dev, "%s EP%d, last=%p, current=%p, enq=%p\n",
+ __func__, epnum, gpd, gpd_current, ring->enqueue);
+
+- while (gpd != gpd_current && !GET_GPD_HWO(gpd)) {
++ while (gpd && gpd != gpd_current && !GET_GPD_HWO(gpd)) {
+
+ mreq = next_request(mep);
+
+--
+2.39.2
+
--- /dev/null
+From fed84c5fa77a79fac712ac65e1b19e0f3704f52d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Apr 2023 14:03:43 +0300
+Subject: vdpa/mlx5: Avoid losing link state updates
+
+From: Eli Cohen <elic@nvidia.com>
+
+[ Upstream commit c384c2401eed99a2e1f84191e573f15b898babe6 ]
+
+Current code ignores link state updates if VIRTIO_NET_F_STATUS was not
+negotiated. However, link state updates could be received before feature
+negotiation was completed , therefore causing link state events to be
+lost, possibly leaving the link state down.
+
+Modify the code so link state notifier is registered after DRIVER_OK was
+negotiated and carry the registration only if
+VIRTIO_NET_F_STATUS was negotiated. Unregister the notifier when the
+device is reset.
+
+Fixes: 033779a708f0 ("vdpa/mlx5: make MTU/STATUS presence conditional on feature bits")
+Acked-by: Jason Wang <jasowang@redhat.com>
+Signed-off-by: Eli Cohen <elic@nvidia.com>
+Message-Id: <20230417110343.138319-1-elic@nvidia.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vdpa/mlx5/net/mlx5_vnet.c | 203 +++++++++++++++++-------------
+ 1 file changed, 114 insertions(+), 89 deletions(-)
+
+diff --git a/drivers/vdpa/mlx5/net/mlx5_vnet.c b/drivers/vdpa/mlx5/net/mlx5_vnet.c
+index 195963b82b636..97a16f7eb8941 100644
+--- a/drivers/vdpa/mlx5/net/mlx5_vnet.c
++++ b/drivers/vdpa/mlx5/net/mlx5_vnet.c
+@@ -2298,6 +2298,113 @@ static void update_cvq_info(struct mlx5_vdpa_dev *mvdev)
+ }
+ }
+
++static u8 query_vport_state(struct mlx5_core_dev *mdev, u8 opmod, u16 vport)
++{
++ u32 out[MLX5_ST_SZ_DW(query_vport_state_out)] = {};
++ u32 in[MLX5_ST_SZ_DW(query_vport_state_in)] = {};
++ int err;
++
++ MLX5_SET(query_vport_state_in, in, opcode, MLX5_CMD_OP_QUERY_VPORT_STATE);
++ MLX5_SET(query_vport_state_in, in, op_mod, opmod);
++ MLX5_SET(query_vport_state_in, in, vport_number, vport);
++ if (vport)
++ MLX5_SET(query_vport_state_in, in, other_vport, 1);
++
++ err = mlx5_cmd_exec_inout(mdev, query_vport_state, in, out);
++ if (err)
++ return 0;
++
++ return MLX5_GET(query_vport_state_out, out, state);
++}
++
++static bool get_link_state(struct mlx5_vdpa_dev *mvdev)
++{
++ if (query_vport_state(mvdev->mdev, MLX5_VPORT_STATE_OP_MOD_VNIC_VPORT, 0) ==
++ VPORT_STATE_UP)
++ return true;
++
++ return false;
++}
++
++static void update_carrier(struct work_struct *work)
++{
++ struct mlx5_vdpa_wq_ent *wqent;
++ struct mlx5_vdpa_dev *mvdev;
++ struct mlx5_vdpa_net *ndev;
++
++ wqent = container_of(work, struct mlx5_vdpa_wq_ent, work);
++ mvdev = wqent->mvdev;
++ ndev = to_mlx5_vdpa_ndev(mvdev);
++ if (get_link_state(mvdev))
++ ndev->config.status |= cpu_to_mlx5vdpa16(mvdev, VIRTIO_NET_S_LINK_UP);
++ else
++ ndev->config.status &= cpu_to_mlx5vdpa16(mvdev, ~VIRTIO_NET_S_LINK_UP);
++
++ if (ndev->config_cb.callback)
++ ndev->config_cb.callback(ndev->config_cb.private);
++
++ kfree(wqent);
++}
++
++static int queue_link_work(struct mlx5_vdpa_net *ndev)
++{
++ struct mlx5_vdpa_wq_ent *wqent;
++
++ wqent = kzalloc(sizeof(*wqent), GFP_ATOMIC);
++ if (!wqent)
++ return -ENOMEM;
++
++ wqent->mvdev = &ndev->mvdev;
++ INIT_WORK(&wqent->work, update_carrier);
++ queue_work(ndev->mvdev.wq, &wqent->work);
++ return 0;
++}
++
++static int event_handler(struct notifier_block *nb, unsigned long event, void *param)
++{
++ struct mlx5_vdpa_net *ndev = container_of(nb, struct mlx5_vdpa_net, nb);
++ struct mlx5_eqe *eqe = param;
++ int ret = NOTIFY_DONE;
++
++ if (event == MLX5_EVENT_TYPE_PORT_CHANGE) {
++ switch (eqe->sub_type) {
++ case MLX5_PORT_CHANGE_SUBTYPE_DOWN:
++ case MLX5_PORT_CHANGE_SUBTYPE_ACTIVE:
++ if (queue_link_work(ndev))
++ return NOTIFY_DONE;
++
++ ret = NOTIFY_OK;
++ break;
++ default:
++ return NOTIFY_DONE;
++ }
++ return ret;
++ }
++ return ret;
++}
++
++static void register_link_notifier(struct mlx5_vdpa_net *ndev)
++{
++ if (!(ndev->mvdev.actual_features & BIT_ULL(VIRTIO_NET_F_STATUS)))
++ return;
++
++ ndev->nb.notifier_call = event_handler;
++ mlx5_notifier_register(ndev->mvdev.mdev, &ndev->nb);
++ ndev->nb_registered = true;
++ queue_link_work(ndev);
++}
++
++static void unregister_link_notifier(struct mlx5_vdpa_net *ndev)
++{
++ if (!ndev->nb_registered)
++ return;
++
++ ndev->nb_registered = false;
++ mlx5_notifier_unregister(ndev->mvdev.mdev, &ndev->nb);
++ if (ndev->mvdev.wq)
++ flush_workqueue(ndev->mvdev.wq);
++}
++
+ static int mlx5_vdpa_set_driver_features(struct vdpa_device *vdev, u64 features)
+ {
+ struct mlx5_vdpa_dev *mvdev = to_mvdev(vdev);
+@@ -2567,10 +2674,11 @@ static void mlx5_vdpa_set_status(struct vdpa_device *vdev, u8 status)
+ mlx5_vdpa_warn(mvdev, "failed to setup control VQ vring\n");
+ goto err_setup;
+ }
++ register_link_notifier(ndev);
+ err = setup_driver(mvdev);
+ if (err) {
+ mlx5_vdpa_warn(mvdev, "failed to setup driver\n");
+- goto err_setup;
++ goto err_driver;
+ }
+ } else {
+ mlx5_vdpa_warn(mvdev, "did not expect DRIVER_OK to be cleared\n");
+@@ -2582,6 +2690,8 @@ static void mlx5_vdpa_set_status(struct vdpa_device *vdev, u8 status)
+ up_write(&ndev->reslock);
+ return;
+
++err_driver:
++ unregister_link_notifier(ndev);
+ err_setup:
+ mlx5_vdpa_destroy_mr(&ndev->mvdev);
+ ndev->mvdev.status |= VIRTIO_CONFIG_S_FAILED;
+@@ -2607,6 +2717,7 @@ static int mlx5_vdpa_reset(struct vdpa_device *vdev)
+ mlx5_vdpa_info(mvdev, "performing device reset\n");
+
+ down_write(&ndev->reslock);
++ unregister_link_notifier(ndev);
+ teardown_driver(ndev);
+ clear_vqs_ready(ndev);
+ mlx5_vdpa_destroy_mr(&ndev->mvdev);
+@@ -2861,9 +2972,7 @@ static int mlx5_vdpa_suspend(struct vdpa_device *vdev)
+ mlx5_vdpa_info(mvdev, "suspending device\n");
+
+ down_write(&ndev->reslock);
+- ndev->nb_registered = false;
+- mlx5_notifier_unregister(mvdev->mdev, &ndev->nb);
+- flush_workqueue(ndev->mvdev.wq);
++ unregister_link_notifier(ndev);
+ for (i = 0; i < ndev->cur_num_vqs; i++) {
+ mvq = &ndev->vqs[i];
+ suspend_vq(ndev, mvq);
+@@ -3000,84 +3109,6 @@ struct mlx5_vdpa_mgmtdev {
+ struct mlx5_vdpa_net *ndev;
+ };
+
+-static u8 query_vport_state(struct mlx5_core_dev *mdev, u8 opmod, u16 vport)
+-{
+- u32 out[MLX5_ST_SZ_DW(query_vport_state_out)] = {};
+- u32 in[MLX5_ST_SZ_DW(query_vport_state_in)] = {};
+- int err;
+-
+- MLX5_SET(query_vport_state_in, in, opcode, MLX5_CMD_OP_QUERY_VPORT_STATE);
+- MLX5_SET(query_vport_state_in, in, op_mod, opmod);
+- MLX5_SET(query_vport_state_in, in, vport_number, vport);
+- if (vport)
+- MLX5_SET(query_vport_state_in, in, other_vport, 1);
+-
+- err = mlx5_cmd_exec_inout(mdev, query_vport_state, in, out);
+- if (err)
+- return 0;
+-
+- return MLX5_GET(query_vport_state_out, out, state);
+-}
+-
+-static bool get_link_state(struct mlx5_vdpa_dev *mvdev)
+-{
+- if (query_vport_state(mvdev->mdev, MLX5_VPORT_STATE_OP_MOD_VNIC_VPORT, 0) ==
+- VPORT_STATE_UP)
+- return true;
+-
+- return false;
+-}
+-
+-static void update_carrier(struct work_struct *work)
+-{
+- struct mlx5_vdpa_wq_ent *wqent;
+- struct mlx5_vdpa_dev *mvdev;
+- struct mlx5_vdpa_net *ndev;
+-
+- wqent = container_of(work, struct mlx5_vdpa_wq_ent, work);
+- mvdev = wqent->mvdev;
+- ndev = to_mlx5_vdpa_ndev(mvdev);
+- if (get_link_state(mvdev))
+- ndev->config.status |= cpu_to_mlx5vdpa16(mvdev, VIRTIO_NET_S_LINK_UP);
+- else
+- ndev->config.status &= cpu_to_mlx5vdpa16(mvdev, ~VIRTIO_NET_S_LINK_UP);
+-
+- if (ndev->nb_registered && ndev->config_cb.callback)
+- ndev->config_cb.callback(ndev->config_cb.private);
+-
+- kfree(wqent);
+-}
+-
+-static int event_handler(struct notifier_block *nb, unsigned long event, void *param)
+-{
+- struct mlx5_vdpa_net *ndev = container_of(nb, struct mlx5_vdpa_net, nb);
+- struct mlx5_eqe *eqe = param;
+- int ret = NOTIFY_DONE;
+- struct mlx5_vdpa_wq_ent *wqent;
+-
+- if (event == MLX5_EVENT_TYPE_PORT_CHANGE) {
+- if (!(ndev->mvdev.actual_features & BIT_ULL(VIRTIO_NET_F_STATUS)))
+- return NOTIFY_DONE;
+- switch (eqe->sub_type) {
+- case MLX5_PORT_CHANGE_SUBTYPE_DOWN:
+- case MLX5_PORT_CHANGE_SUBTYPE_ACTIVE:
+- wqent = kzalloc(sizeof(*wqent), GFP_ATOMIC);
+- if (!wqent)
+- return NOTIFY_DONE;
+-
+- wqent->mvdev = &ndev->mvdev;
+- INIT_WORK(&wqent->work, update_carrier);
+- queue_work(ndev->mvdev.wq, &wqent->work);
+- ret = NOTIFY_OK;
+- break;
+- default:
+- return NOTIFY_DONE;
+- }
+- return ret;
+- }
+- return ret;
+-}
+-
+ static int config_func_mtu(struct mlx5_core_dev *mdev, u16 mtu)
+ {
+ int inlen = MLX5_ST_SZ_BYTES(modify_nic_vport_context_in);
+@@ -3258,9 +3289,6 @@ static int mlx5_vdpa_dev_add(struct vdpa_mgmt_dev *v_mdev, const char *name,
+ goto err_res2;
+ }
+
+- ndev->nb.notifier_call = event_handler;
+- mlx5_notifier_register(mdev, &ndev->nb);
+- ndev->nb_registered = true;
+ mvdev->vdev.mdev = &mgtdev->mgtdev;
+ err = _vdpa_register_device(&mvdev->vdev, max_vqs + 1);
+ if (err)
+@@ -3294,10 +3322,7 @@ static void mlx5_vdpa_dev_del(struct vdpa_mgmt_dev *v_mdev, struct vdpa_device *
+
+ mlx5_vdpa_remove_debugfs(ndev->debugfs);
+ ndev->debugfs = NULL;
+- if (ndev->nb_registered) {
+- ndev->nb_registered = false;
+- mlx5_notifier_unregister(mvdev->mdev, &ndev->nb);
+- }
++ unregister_link_notifier(ndev);
+ wq = mvdev->wq;
+ mvdev->wq = NULL;
+ destroy_workqueue(wq);
+--
+2.39.2
+
--- /dev/null
+From f0763e7d8b78d6e72a3d759be413358b51fed259 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Mar 2023 20:24:48 +0100
+Subject: virt/coco/sev-guest: Double-buffer messages
+
+From: Dionna Glaze <dionnaglaze@google.com>
+
+[ Upstream commit 965006103a14703cc42043bbf9b5e0cdf7a468ad ]
+
+The encryption algorithms read and write directly to shared unencrypted
+memory, which may leak information as well as permit the host to tamper
+with the message integrity. Instead, copy whole messages in or out as
+needed before doing any computation on them.
+
+Fixes: d5af44dde546 ("x86/sev: Provide support for SNP guest request NAEs")
+Signed-off-by: Dionna Glaze <dionnaglaze@google.com>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Link: https://lore.kernel.org/r/20230214164638.1189804-3-dionnaglaze@google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/virt/coco/sev-guest/sev-guest.c | 27 +++++++++++++++++++++----
+ 1 file changed, 23 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/virt/coco/sev-guest/sev-guest.c b/drivers/virt/coco/sev-guest/sev-guest.c
+index 46f1a8d558b0b..0c7b47acba2a8 100644
+--- a/drivers/virt/coco/sev-guest/sev-guest.c
++++ b/drivers/virt/coco/sev-guest/sev-guest.c
+@@ -46,7 +46,15 @@ struct snp_guest_dev {
+
+ void *certs_data;
+ struct snp_guest_crypto *crypto;
++ /* request and response are in unencrypted memory */
+ struct snp_guest_msg *request, *response;
++
++ /*
++ * Avoid information leakage by double-buffering shared messages
++ * in fields that are in regular encrypted memory.
++ */
++ struct snp_guest_msg secret_request, secret_response;
++
+ struct snp_secrets_page_layout *layout;
+ struct snp_req_data input;
+ u32 *os_area_msg_seqno;
+@@ -266,14 +274,17 @@ static int dec_payload(struct snp_guest_dev *snp_dev, struct snp_guest_msg *msg,
+ static int verify_and_dec_payload(struct snp_guest_dev *snp_dev, void *payload, u32 sz)
+ {
+ struct snp_guest_crypto *crypto = snp_dev->crypto;
+- struct snp_guest_msg *resp = snp_dev->response;
+- struct snp_guest_msg *req = snp_dev->request;
++ struct snp_guest_msg *resp = &snp_dev->secret_response;
++ struct snp_guest_msg *req = &snp_dev->secret_request;
+ struct snp_guest_msg_hdr *req_hdr = &req->hdr;
+ struct snp_guest_msg_hdr *resp_hdr = &resp->hdr;
+
+ dev_dbg(snp_dev->dev, "response [seqno %lld type %d version %d sz %d]\n",
+ resp_hdr->msg_seqno, resp_hdr->msg_type, resp_hdr->msg_version, resp_hdr->msg_sz);
+
++ /* Copy response from shared memory to encrypted memory. */
++ memcpy(resp, snp_dev->response, sizeof(*resp));
++
+ /* Verify that the sequence counter is incremented by 1 */
+ if (unlikely(resp_hdr->msg_seqno != (req_hdr->msg_seqno + 1)))
+ return -EBADMSG;
+@@ -297,7 +308,7 @@ static int verify_and_dec_payload(struct snp_guest_dev *snp_dev, void *payload,
+ static int enc_payload(struct snp_guest_dev *snp_dev, u64 seqno, int version, u8 type,
+ void *payload, size_t sz)
+ {
+- struct snp_guest_msg *req = snp_dev->request;
++ struct snp_guest_msg *req = &snp_dev->secret_request;
+ struct snp_guest_msg_hdr *hdr = &req->hdr;
+
+ memset(req, 0, sizeof(*req));
+@@ -417,13 +428,21 @@ static int handle_guest_request(struct snp_guest_dev *snp_dev, u64 exit_code, in
+ if (!seqno)
+ return -EIO;
+
++ /* Clear shared memory's response for the host to populate. */
+ memset(snp_dev->response, 0, sizeof(struct snp_guest_msg));
+
+- /* Encrypt the userspace provided payload */
++ /* Encrypt the userspace provided payload in snp_dev->secret_request. */
+ rc = enc_payload(snp_dev, seqno, msg_ver, type, req_buf, req_sz);
+ if (rc)
+ return rc;
+
++ /*
++ * Write the fully encrypted request to the shared unencrypted
++ * request page.
++ */
++ memcpy(snp_dev->request, &snp_dev->secret_request,
++ sizeof(snp_dev->secret_request));
++
+ rc = __handle_guest_request(snp_dev, exit_code, fw_err);
+ if (rc) {
+ if (rc == -EIO && *fw_err == SNP_GUEST_REQ_INVALID_LEN)
+--
+2.39.2
+
--- /dev/null
+From 5cfd9018301eb0b784cca493a1a99cbb0ba24000 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Mar 2023 18:23:00 +0800
+Subject: virtio_ring: don't update event idx on get_buf
+
+From: Albert Huang <huangjie.albert@bytedance.com>
+
+[ Upstream commit 6c0b057cec5eade4c3afec3908821176931a9997 ]
+
+In virtio_net, if we disable napi_tx, when we trigger a tx interrupt,
+the vq->event_triggered will be set to true. It is then never reset
+until we explicitly call virtqueue_enable_cb_delayed or
+virtqueue_enable_cb_prepare.
+
+If we disable the napi_tx, virtqueue_enable_cb* will only be called when
+the tx ring is getting relatively empty.
+
+Since event_triggered is true, VRING_AVAIL_F_NO_INTERRUPT or
+VRING_PACKED_EVENT_FLAG_DISABLE will not be set. As a result we update
+vring_used_event(&vq->split.vring) or vq->packed.vring.driver->off_wrap
+every time we call virtqueue_get_buf_ctx. This causes more interrupts.
+
+To summarize:
+1) event_triggered was set to true in vring_interrupt()
+2) after this nothing will happen in virtqueue_disable_cb() so
+ VRING_AVAIL_F_NO_INTERRUPT is not set in avail_flags_shadow
+3) virtqueue_get_buf_ctx_split() will still think the cb is enabled
+ and then it will publish a new event index
+
+To fix:
+update VRING_AVAIL_F_NO_INTERRUPT or VRING_PACKED_EVENT_FLAG_DISABLE in
+the vq when we call virtqueue_disable_cb even when event_triggered is
+true.
+
+Tested with iperf:
+iperf3 tcp stream:
+vm1 -----------------> vm2
+vm2 just receives tcp data stream from vm1, and sends acks to vm1,
+there are many tx interrupts in vm2.
+with the patch applied there are just a few tx interrupts.
+
+v2->v3:
+-update the interrupt disable flag even with the event_triggered is set,
+-instead of checking whether event_triggered is set in
+-virtqueue_get_buf_ctx_{packed/split}, will cause the drivers which have
+-not called virtqueue_{enable/disable}_cb to miss notifications.
+
+v3->v4:
+-remove change for
+-"if (vq->packed.event_flags_shadow != VRING_PACKED_EVENT_FLAG_DISABLE)"
+-in virtqueue_disable_cb_packed
+
+Fixes: 8d622d21d248 ("virtio: fix up virtio_disable_cb")
+Signed-off-by: Albert Huang <huangjie.albert@bytedance.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+Message-Id: <20230329102300.61000-1-huangjie.albert@bytedance.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/virtio/virtio_ring.c | 22 ++++++++++++++++------
+ 1 file changed, 16 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
+index 41144b5246a8a..7a78ff05998ad 100644
+--- a/drivers/virtio/virtio_ring.c
++++ b/drivers/virtio/virtio_ring.c
+@@ -854,6 +854,14 @@ static void virtqueue_disable_cb_split(struct virtqueue *_vq)
+
+ if (!(vq->split.avail_flags_shadow & VRING_AVAIL_F_NO_INTERRUPT)) {
+ vq->split.avail_flags_shadow |= VRING_AVAIL_F_NO_INTERRUPT;
++
++ /*
++ * If device triggered an event already it won't trigger one again:
++ * no need to disable.
++ */
++ if (vq->event_triggered)
++ return;
++
+ if (vq->event)
+ /* TODO: this is a hack. Figure out a cleaner value to write. */
+ vring_used_event(&vq->split.vring) = 0x0;
+@@ -1699,6 +1707,14 @@ static void virtqueue_disable_cb_packed(struct virtqueue *_vq)
+
+ if (vq->packed.event_flags_shadow != VRING_PACKED_EVENT_FLAG_DISABLE) {
+ vq->packed.event_flags_shadow = VRING_PACKED_EVENT_FLAG_DISABLE;
++
++ /*
++ * If device triggered an event already it won't trigger one again:
++ * no need to disable.
++ */
++ if (vq->event_triggered)
++ return;
++
+ vq->packed.vring.driver->flags =
+ cpu_to_le16(vq->packed.event_flags_shadow);
+ }
+@@ -2330,12 +2346,6 @@ void virtqueue_disable_cb(struct virtqueue *_vq)
+ {
+ struct vring_virtqueue *vq = to_vvq(_vq);
+
+- /* If device triggered an event already it won't trigger one again:
+- * no need to disable.
+- */
+- if (vq->event_triggered)
+- return;
+-
+ if (vq->packed_ring)
+ virtqueue_disable_cb_packed(_vq);
+ else
+--
+2.39.2
+
--- /dev/null
+From a68fc15b009b63f39f93cf28add4ef1c24dfbb85 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Mar 2023 08:33:02 -0700
+Subject: vlan: partially enable SIOCSHWTSTAMP in container
+
+From: Vadim Fedorenko <vadim.fedorenko@linux.dev>
+
+[ Upstream commit 731b73dba359e3ff00517c13aa0daa82b34ff466 ]
+
+Setting timestamp filter was explicitly disabled on vlan devices in
+containers because it might affect other processes on the host. But it's
+absolutely legit in case when real device is in the same namespace.
+
+Fixes: 873017af7784 ("vlan: disable SIOCSHWTSTAMP in container")
+Signed-off-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/8021q/vlan_dev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
+index 296d0145932f4..5920544e93e82 100644
+--- a/net/8021q/vlan_dev.c
++++ b/net/8021q/vlan_dev.c
+@@ -365,7 +365,7 @@ static int vlan_dev_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
+
+ switch (cmd) {
+ case SIOCSHWTSTAMP:
+- if (!net_eq(dev_net(dev), &init_net))
++ if (!net_eq(dev_net(dev), dev_net(real_dev)))
+ break;
+ fallthrough;
+ case SIOCGMIIPHY:
+--
+2.39.2
+
--- /dev/null
+From 5c9152521df4c921e1ec407c0a8088a608509ebd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Mar 2023 21:01:53 +0900
+Subject: vmci_host: fix a race condition in vmci_host_poll() causing GPF
+
+From: Dae R. Jeong <threeearcat@gmail.com>
+
+[ Upstream commit ae13381da5ff0e8e084c0323c3cc0a945e43e9c7 ]
+
+During fuzzing, a general protection fault is observed in
+vmci_host_poll().
+
+general protection fault, probably for non-canonical address 0xdffffc0000000019: 0000 [#1] PREEMPT SMP KASAN
+KASAN: null-ptr-deref in range [0x00000000000000c8-0x00000000000000cf]
+RIP: 0010:__lock_acquire+0xf3/0x5e00 kernel/locking/lockdep.c:4926
+<- omitting registers ->
+Call Trace:
+ <TASK>
+ lock_acquire+0x1a4/0x4a0 kernel/locking/lockdep.c:5672
+ __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
+ _raw_spin_lock_irqsave+0xb3/0x100 kernel/locking/spinlock.c:162
+ add_wait_queue+0x3d/0x260 kernel/sched/wait.c:22
+ poll_wait include/linux/poll.h:49 [inline]
+ vmci_host_poll+0xf8/0x2b0 drivers/misc/vmw_vmci/vmci_host.c:174
+ vfs_poll include/linux/poll.h:88 [inline]
+ do_pollfd fs/select.c:873 [inline]
+ do_poll fs/select.c:921 [inline]
+ do_sys_poll+0xc7c/0x1aa0 fs/select.c:1015
+ __do_sys_ppoll fs/select.c:1121 [inline]
+ __se_sys_ppoll+0x2cc/0x330 fs/select.c:1101
+ do_syscall_x64 arch/x86/entry/common.c:51 [inline]
+ do_syscall_64+0x4e/0xa0 arch/x86/entry/common.c:82
+ entry_SYSCALL_64_after_hwframe+0x46/0xb0
+
+Example thread interleaving that causes the general protection fault
+is as follows:
+
+CPU1 (vmci_host_poll) CPU2 (vmci_host_do_init_context)
+----- -----
+// Read uninitialized context
+context = vmci_host_dev->context;
+ // Initialize context
+ vmci_host_dev->context = vmci_ctx_create();
+ vmci_host_dev->ct_type = VMCIOBJ_CONTEXT;
+
+if (vmci_host_dev->ct_type == VMCIOBJ_CONTEXT) {
+ // Dereferencing the wrong pointer
+ poll_wait(..., &context->host_context);
+}
+
+In this scenario, vmci_host_poll() reads vmci_host_dev->context first,
+and then reads vmci_host_dev->ct_type to check that
+vmci_host_dev->context is initialized. However, since these two reads
+are not atomically executed, there is a chance of a race condition as
+described above.
+
+To fix this race condition, read vmci_host_dev->context after checking
+the value of vmci_host_dev->ct_type so that vmci_host_poll() always
+reads an initialized context.
+
+Reported-by: Dae R. Jeong <threeearcat@gmail.com>
+Fixes: 8bf503991f87 ("VMCI: host side driver implementation.")
+Signed-off-by: Dae R. Jeong <threeearcat@gmail.com>
+Link: https://lore.kernel.org/r/ZCGFsdBAU4cYww5l@dragonet
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/vmw_vmci/vmci_host.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/misc/vmw_vmci/vmci_host.c b/drivers/misc/vmw_vmci/vmci_host.c
+index 857b9851402a6..abe79f6fd2a79 100644
+--- a/drivers/misc/vmw_vmci/vmci_host.c
++++ b/drivers/misc/vmw_vmci/vmci_host.c
+@@ -165,10 +165,16 @@ static int vmci_host_close(struct inode *inode, struct file *filp)
+ static __poll_t vmci_host_poll(struct file *filp, poll_table *wait)
+ {
+ struct vmci_host_dev *vmci_host_dev = filp->private_data;
+- struct vmci_ctx *context = vmci_host_dev->context;
++ struct vmci_ctx *context;
+ __poll_t mask = 0;
+
+ if (vmci_host_dev->ct_type == VMCIOBJ_CONTEXT) {
++ /*
++ * Read context only if ct_type == VMCIOBJ_CONTEXT to make
++ * sure that context is initialized
++ */
++ context = vmci_host_dev->context;
++
+ /* Check for VMCI calls to this VM context. */
+ if (wait)
+ poll_wait(filp, &context->host_context.wait_queue,
+--
+2.39.2
+
--- /dev/null
+From d97b7bdd087b4376a707841b3f3490354dbbc2eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Mar 2023 15:23:08 +0530
+Subject: wifi: ath11k: fix deinitialization of firmware resources
+
+From: Aditya Kumar Singh <quic_adisi@quicinc.com>
+
+[ Upstream commit 5a78ac33e3cb8822da64dd1af196e83664b332b0 ]
+
+Currently, in ath11k_ahb_fw_resources_init(), iommu domain
+mapping is done only for the chipsets having fixed firmware
+memory. Also, for such chipsets, mapping is done only if it
+does not have TrustZone support.
+
+During deinitialization, only if TrustZone support is not there,
+iommu is unmapped back. However, for non fixed firmware memory
+chipsets, TrustZone support is not there and this makes the
+condition check to true and it tries to unmap the memory which
+was not mapped during initialization.
+
+This leads to the following trace -
+
+[ 83.198790] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008
+[ 83.259537] Modules linked in: ath11k_ahb ath11k qmi_helpers
+.. snip ..
+[ 83.280286] pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+[ 83.287228] pc : __iommu_unmap+0x30/0x140
+[ 83.293907] lr : iommu_unmap+0x5c/0xa4
+[ 83.298072] sp : ffff80000b3abad0
+.. snip ..
+[ 83.369175] Call trace:
+[ 83.376282] __iommu_unmap+0x30/0x140
+[ 83.378541] iommu_unmap+0x5c/0xa4
+[ 83.382360] ath11k_ahb_fw_resource_deinit.part.12+0x2c/0xac [ath11k_ahb]
+[ 83.385666] ath11k_ahb_free_resources+0x140/0x17c [ath11k_ahb]
+[ 83.392521] ath11k_ahb_shutdown+0x34/0x40 [ath11k_ahb]
+[ 83.398248] platform_shutdown+0x20/0x2c
+[ 83.403455] device_shutdown+0x16c/0x1c4
+[ 83.407621] kernel_restart_prepare+0x34/0x3c
+[ 83.411529] kernel_restart+0x14/0x74
+[ 83.415781] __do_sys_reboot+0x1c4/0x22c
+[ 83.419427] __arm64_sys_reboot+0x1c/0x24
+[ 83.423420] invoke_syscall+0x44/0xfc
+[ 83.427326] el0_svc_common.constprop.3+0xac/0xe8
+[ 83.430974] do_el0_svc+0xa0/0xa8
+[ 83.435659] el0_svc+0x1c/0x44
+[ 83.438957] el0t_64_sync_handler+0x60/0x144
+[ 83.441910] el0t_64_sync+0x15c/0x160
+[ 83.446343] Code: aa0103f4 f9400001 f90027a1 d2800001 (f94006a0)
+[ 83.449903] ---[ end trace 0000000000000000 ]---
+
+This can be reproduced by probing an AHB chipset which is not
+having a fixed memory region. During reboot (or rmmod) trace
+can be seen.
+
+Fix this issue by adding a condition check on firmware fixed memory
+hw_param as done in the counter initialization function.
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+
+Fixes: f9eec4947add ("ath11k: Add support for targets without trustzone")
+Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230309095308.24937-1-quic_adisi@quicinc.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath11k/ahb.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/net/wireless/ath/ath11k/ahb.c b/drivers/net/wireless/ath/ath11k/ahb.c
+index b549576d0b513..5cbba9a8b6ba9 100644
+--- a/drivers/net/wireless/ath/ath11k/ahb.c
++++ b/drivers/net/wireless/ath/ath11k/ahb.c
+@@ -1078,6 +1078,12 @@ static int ath11k_ahb_fw_resource_deinit(struct ath11k_base *ab)
+ struct iommu_domain *iommu;
+ size_t unmapped_size;
+
++ /* Chipsets not requiring MSA would have not initialized
++ * MSA resources, return success in such cases.
++ */
++ if (!ab->hw_params.fixed_fw_mem)
++ return 0;
++
+ if (ab_ahb->fw.use_tz)
+ return 0;
+
+--
+2.39.2
+
--- /dev/null
+From 53a656edf7c2c40185e971e47cce3ff1759d55cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Feb 2023 11:00:31 +0800
+Subject: wifi: ath11k: fix return value check in ath11k_ahb_probe()
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit 342fcde9d91460f01f65707e16368a1571271a3a ]
+
+ioremap() returns NULL pointer not PTR_ERR() when it fails,
+so replace the IS_ERR() check with NULL pointer check.
+
+Fixes: b42b3678c91f ("wifi: ath11k: remap ce register space for IPQ5018")
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230217030031.4021289-1-yangyingliang@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath11k/ahb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath11k/ahb.c b/drivers/net/wireless/ath/ath11k/ahb.c
+index 920abce9053a5..bad3946b44bf6 100644
+--- a/drivers/net/wireless/ath/ath11k/ahb.c
++++ b/drivers/net/wireless/ath/ath11k/ahb.c
+@@ -1174,7 +1174,7 @@ static int ath11k_ahb_probe(struct platform_device *pdev)
+ * to a new space for accessing them.
+ */
+ ab->mem_ce = ioremap(ce_remap->base, ce_remap->size);
+- if (IS_ERR(ab->mem_ce)) {
++ if (!ab->mem_ce) {
+ dev_err(&pdev->dev, "ce ioremap error\n");
+ ret = -ENOMEM;
+ goto err_core_free;
+--
+2.39.2
+
--- /dev/null
+From 236f94564e7de1dc35a79a63c0eddc721f067fcf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Feb 2023 23:26:22 +0100
+Subject: wifi: ath11k: fix SAC bug on peer addition with sta band migration
+
+From: Christian Marangi <ansuelsmth@gmail.com>
+
+[ Upstream commit 60b7d62ba8cdbd073997bff0f1cdae8d844002c0 ]
+
+Fix sleep in atomic context warning detected by Smatch static checker
+analyzer.
+
+Following the locking pattern for peer_rhash_add lock tbl_mtx_lock mutex
+always even if sta is not transitioning to another band.
+This is peer_add function and a more secure locking should not cause
+performance regression.
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.5.0.1-01208-QCAHKSWPL_SILICONZ-1
+
+Fixes: d673cb6fe6c0 ("wifi: ath11k: fix peer addition/deletion error on sta band migration")
+Reported-by: Dan Carpenter <error27@gmail.com>
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230209222622.1751-1-ansuelsmth@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath11k/peer.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath11k/peer.c b/drivers/net/wireless/ath/ath11k/peer.c
+index 1ae7af02c364e..1380811827a84 100644
+--- a/drivers/net/wireless/ath/ath11k/peer.c
++++ b/drivers/net/wireless/ath/ath11k/peer.c
+@@ -382,22 +382,23 @@ int ath11k_peer_create(struct ath11k *ar, struct ath11k_vif *arvif,
+ return -ENOBUFS;
+ }
+
++ mutex_lock(&ar->ab->tbl_mtx_lock);
+ spin_lock_bh(&ar->ab->base_lock);
+ peer = ath11k_peer_find_by_addr(ar->ab, param->peer_addr);
+ if (peer) {
+ if (peer->vdev_id == param->vdev_id) {
+ spin_unlock_bh(&ar->ab->base_lock);
++ mutex_unlock(&ar->ab->tbl_mtx_lock);
+ return -EINVAL;
+ }
+
+ /* Assume sta is transitioning to another band.
+ * Remove here the peer from rhash.
+ */
+- mutex_lock(&ar->ab->tbl_mtx_lock);
+ ath11k_peer_rhash_delete(ar->ab, peer);
+- mutex_unlock(&ar->ab->tbl_mtx_lock);
+ }
+ spin_unlock_bh(&ar->ab->base_lock);
++ mutex_unlock(&ar->ab->tbl_mtx_lock);
+
+ ret = ath11k_wmi_send_peer_create_cmd(ar, param);
+ if (ret) {
+--
+2.39.2
+
--- /dev/null
+From 6e079ef882a8ea1ae35aaa8debb69216219c3a67 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Mar 2023 16:57:01 +0200
+Subject: wifi: ath11k: fix writing to unintended memory region
+
+From: P Praneesh <quic_ppranees@quicinc.com>
+
+[ Upstream commit 756a7f90878f0866fd2fe167ef37e90b47326b96 ]
+
+While initializing spectral, the magic value is getting written to the
+invalid memory address leading to random boot-up crash. This occurs
+due to the incorrect index increment in ath11k_dbring_fill_magic_value
+function. Fix it by replacing the existing logic with memset32 to ensure
+there is no invalid memory access.
+
+Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.4.0.1-01838-QCAHKSWPL_SILICONZ-1
+
+Fixes: d3d358efc553 ("ath11k: add spectral/CFR buffer validation support")
+Signed-off-by: P Praneesh <quic_ppranees@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230321052900.16895-1-quic_ppranees@quicinc.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath11k/dbring.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath11k/dbring.c b/drivers/net/wireless/ath/ath11k/dbring.c
+index 2107ec05d14fd..5536e86423312 100644
+--- a/drivers/net/wireless/ath/ath11k/dbring.c
++++ b/drivers/net/wireless/ath/ath11k/dbring.c
+@@ -26,13 +26,13 @@ int ath11k_dbring_validate_buffer(struct ath11k *ar, void *buffer, u32 size)
+ static void ath11k_dbring_fill_magic_value(struct ath11k *ar,
+ void *buffer, u32 size)
+ {
+- u32 *temp;
+- int idx;
+-
+- size = size >> 2;
++ /* memset32 function fills buffer payload with the ATH11K_DB_MAGIC_VALUE
++ * and the variable size is expected to be the number of u32 values
++ * to be stored, not the number of bytes.
++ */
++ size = size / sizeof(u32);
+
+- for (idx = 0, temp = buffer; idx < size; idx++, temp++)
+- *temp++ = ATH11K_DB_MAGIC_VALUE;
++ memset32(buffer, ATH11K_DB_MAGIC_VALUE, size);
+ }
+
+ static int ath11k_dbring_bufs_replenish(struct ath11k *ar,
+--
+2.39.2
+
--- /dev/null
+From e121d0bd1d735be757689bdf953fdac6fc28154f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Feb 2023 08:54:42 -0800
+Subject: wifi: ath11k: Use platform_get_irq() to get the interrupt
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit f117276638b7600b981b3fe28550823cfbe1ef23 ]
+
+As of commit a1a2b7125e10 ("of/platform: Drop static setup of IRQ
+resource from DT core"), we need to use platform_get_irq() instead of
+platform_get_resource() to get our IRQs because
+platform_get_resource() simply won't get them anymore.
+
+This was already fixed in several other Atheros WiFi drivers,
+apparently in response to Zeal Robot reports. An example of another
+fix is commit 9503a1fc123d ("ath9k: Use platform_get_irq() to get the
+interrupt"). ath11k seems to have been missed in this effort, though.
+
+Without this change, WiFi wasn't coming up on my Qualcomm sc7280-based
+hardware. Specifically, "platform_get_resource(pdev, IORESOURCE_IRQ,
+i)" was failing even for i=0.
+
+Tested-on: WCN6750 hw1.0 AHB WLAN.MSL.1.0.1-00887-QCAMSLSWPLZ-1
+
+Fixes: a1a2b7125e10 ("of/platform: Drop static setup of IRQ resource from DT core")
+Fixes: 00402f49d26f ("ath11k: Add support for WCN6750 device")
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Tested-by: Jun Yu <junyuu@chromium.org>
+Reviewed-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230201084131.v2.1.I69cf3d56c97098287fe3a70084ee515098390b70@changeid
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath11k/ahb.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath11k/ahb.c b/drivers/net/wireless/ath/ath11k/ahb.c
+index bad3946b44bf6..b549576d0b513 100644
+--- a/drivers/net/wireless/ath/ath11k/ahb.c
++++ b/drivers/net/wireless/ath/ath11k/ahb.c
+@@ -874,11 +874,11 @@ static int ath11k_ahb_setup_msi_resources(struct ath11k_base *ab)
+ ab->pci.msi.ep_base_data = int_prop + 32;
+
+ for (i = 0; i < ab->pci.msi.config->total_vectors; i++) {
+- res = platform_get_resource(pdev, IORESOURCE_IRQ, i);
+- if (!res)
+- return -ENODEV;
++ ret = platform_get_irq(pdev, i);
++ if (ret < 0)
++ return ret;
+
+- ab->pci.msi.irqs[i] = res->start;
++ ab->pci.msi.irqs[i] = ret;
+ }
+
+ set_bit(ATH11K_FLAG_MULTI_MSI_VECTORS, &ab->dev_flags);
+--
+2.39.2
+
--- /dev/null
+From e41fee13e4aef88e373d2ec237a706da7249da92 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Mar 2023 02:47:06 -0800
+Subject: wifi: ath12k: Add missing unwind goto in ath12k_pci_probe()
+
+From: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
+
+[ Upstream commit 488d9a484f96eee4f0e8e108aed42a057a1c7295 ]
+
+Smatch Warns:
+ drivers/net/wireless/ath/ath12k/pci.c:1198 ath12k_pci_probe()
+ warn: missing unwind goto?
+
+Store the error value in ret and use correct label with a goto.
+
+Only Compile tested, found with Smatch.
+
+Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices")
+Reported-by: Dan Carpenter <error27@gmail.com>
+Link: https://lore.kernel.org/all/Y+426q6cfkEdb5Bv@kili/
+Suggested-by: Dan Carpenter <error27@gmail.com>
+Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230307104706.240119-1-harshit.m.mogalapalli@oracle.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath12k/pci.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath12k/pci.c b/drivers/net/wireless/ath/ath12k/pci.c
+index ae7f6083c9fc2..f523aa15885f6 100644
+--- a/drivers/net/wireless/ath/ath12k/pci.c
++++ b/drivers/net/wireless/ath/ath12k/pci.c
+@@ -1195,7 +1195,8 @@ static int ath12k_pci_probe(struct pci_dev *pdev,
+ dev_err(&pdev->dev,
+ "Unknown hardware version found for QCN9274: 0x%x\n",
+ soc_hw_version_major);
+- return -EOPNOTSUPP;
++ ret = -EOPNOTSUPP;
++ goto err_pci_free_region;
+ }
+ break;
+ case WCN7850_DEVICE_ID:
+--
+2.39.2
+
--- /dev/null
+From 61e3c4f9b62d3b09adf910cd1401e0252c60d383 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Feb 2023 15:16:14 +0300
+Subject: wifi: ath12k: use kfree_skb() instead of kfree()
+
+From: Dan Carpenter <error27@gmail.com>
+
+[ Upstream commit 8c464d16809fa02982f6341ea598ec5d07457f19 ]
+
+Sk_buffs are supposed to be freed with kfree_skb().
+
+Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices")
+Signed-off-by: Dan Carpenter <error27@gmail.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/Y+4ejiYakhEvEw7c@kili
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath12k/dp_tx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath12k/dp_tx.c b/drivers/net/wireless/ath/ath12k/dp_tx.c
+index 95294f35155c4..fd8d850f9818f 100644
+--- a/drivers/net/wireless/ath/ath12k/dp_tx.c
++++ b/drivers/net/wireless/ath/ath12k/dp_tx.c
+@@ -270,7 +270,7 @@ int ath12k_dp_tx(struct ath12k *ar, struct ath12k_vif *arvif,
+ skb_ext_desc->len, DMA_TO_DEVICE);
+ ret = dma_mapping_error(ab->dev, ti.paddr);
+ if (ret) {
+- kfree(skb_ext_desc);
++ kfree_skb(skb_ext_desc);
+ goto fail_unmap_dma;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 153bda4e33394d8e679d4a05c71b4ff0f2070d75 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Feb 2023 16:15:48 +0300
+Subject: wifi: ath5k: fix an off by one check in ath5k_eeprom_read_freq_list()
+
+From: Dan Carpenter <error27@gmail.com>
+
+[ Upstream commit 4c856ee12df85aabd437c3836ed9f68d94268358 ]
+
+This loop checks that i < max at the start of loop but then it does
+i++ which could put it past the end of the array. It's harmless to
+check again and prevent a potential out of bounds.
+
+Fixes: 1048643ea94d ("ath5k: Clean up eeprom parsing and add missing calibration data")
+Signed-off-by: Dan Carpenter <error27@gmail.com>
+Reviewed-by: Luis Chamberlain <mcgrof@kernel.org>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/Y+D9hPQrHfWBJhXz@kili
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath5k/eeprom.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath5k/eeprom.c b/drivers/net/wireless/ath/ath5k/eeprom.c
+index d444b3d70ba2e..58d3e86f6256d 100644
+--- a/drivers/net/wireless/ath/ath5k/eeprom.c
++++ b/drivers/net/wireless/ath/ath5k/eeprom.c
+@@ -529,7 +529,7 @@ ath5k_eeprom_read_freq_list(struct ath5k_hw *ah, int *offset, int max,
+ ee->ee_n_piers[mode]++;
+
+ freq2 = (val >> 8) & 0xff;
+- if (!freq2)
++ if (!freq2 || i >= max)
+ break;
+
+ pc[i++].freq = ath5k_eeprom_bin2freq(ee,
+--
+2.39.2
+
--- /dev/null
+From 2af6a8f85dfdbdcb8612814d5c53e5ac1fd6bd1a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Feb 2023 08:54:43 -0800
+Subject: wifi: ath5k: Use platform_get_irq() to get the interrupt
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit 95c95251d0547b46d6571e4fbd51b42865c15a4a ]
+
+As of commit a1a2b7125e10 ("of/platform: Drop static setup of IRQ
+resource from DT core"), we need to use platform_get_irq() instead of
+platform_get_resource() to get our IRQs because
+platform_get_resource() simply won't get them anymore.
+
+This was already fixed in several other Atheros WiFi drivers,
+apparently in response to Zeal Robot reports. An example of another
+fix is commit 9503a1fc123d ("ath9k: Use platform_get_irq() to get the
+interrupt"). ath5k seems to have been missed in this effort, though.
+
+Fixes: a1a2b7125e10 ("of/platform: Drop static setup of IRQ resource from DT core")
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Reviewed-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230201084131.v2.2.Ic4f8542b0588d7eb4bc6e322d4af3d2064e84ff0@changeid
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath5k/ahb.c | 10 ++++------
+ 1 file changed, 4 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath5k/ahb.c b/drivers/net/wireless/ath/ath5k/ahb.c
+index 2c9cec8b53d9e..28a1e5eff204e 100644
+--- a/drivers/net/wireless/ath/ath5k/ahb.c
++++ b/drivers/net/wireless/ath/ath5k/ahb.c
+@@ -113,15 +113,13 @@ static int ath_ahb_probe(struct platform_device *pdev)
+ goto err_out;
+ }
+
+- res = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
+- if (res == NULL) {
+- dev_err(&pdev->dev, "no IRQ resource found\n");
+- ret = -ENXIO;
++ irq = platform_get_irq(pdev, 0);
++ if (irq < 0) {
++ dev_err(&pdev->dev, "no IRQ resource found: %d\n", irq);
++ ret = irq;
+ goto err_iounmap;
+ }
+
+- irq = res->start;
+-
+ hw = ieee80211_alloc_hw(sizeof(struct ath5k_hw), &ath5k_hw_ops);
+ if (hw == NULL) {
+ dev_err(&pdev->dev, "no memory for ieee80211_hw\n");
+--
+2.39.2
+
--- /dev/null
+From 1e422b9213594db477d5c4593990b0881b9aa091 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Feb 2023 20:31:37 +0200
+Subject: wifi: ath6kl: minor fix for allocation size
+
+From: Alexey V. Vissarionov <gremlin@altlinux.org>
+
+[ Upstream commit 778f83f889e7fca37780d9640fcbd0229ae38eaa ]
+
+Although the "param" pointer occupies more or equal space compared
+to "*param", the allocation size should use the size of variable
+itself.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: bdcd81707973cf8a ("Add ath6kl cleaned up driver")
+Signed-off-by: Alexey V. Vissarionov <gremlin@altlinux.org>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230117110414.GC12547@altlinux.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath6kl/bmi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath6kl/bmi.c b/drivers/net/wireless/ath/ath6kl/bmi.c
+index bde5a10d470c8..af98e871199d3 100644
+--- a/drivers/net/wireless/ath/ath6kl/bmi.c
++++ b/drivers/net/wireless/ath/ath6kl/bmi.c
+@@ -246,7 +246,7 @@ int ath6kl_bmi_execute(struct ath6kl *ar, u32 addr, u32 *param)
+ return -EACCES;
+ }
+
+- size = sizeof(cid) + sizeof(addr) + sizeof(param);
++ size = sizeof(cid) + sizeof(addr) + sizeof(*param);
+ if (size > ar->bmi.max_cmd_size) {
+ WARN_ON(1);
+ return -EINVAL;
+--
+2.39.2
+
--- /dev/null
+From 0cb542f5a4fe8a53aff9d9e94c50c5e24e810ab4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Feb 2023 12:28:05 +0200
+Subject: wifi: ath6kl: reduce WARN to dev_dbg() in callback
+
+From: Fedor Pchelkin <pchelkin@ispras.ru>
+
+[ Upstream commit 75c4a8154cb6c7239fb55d5550f481f6765fb83c ]
+
+The warn is triggered on a known race condition, documented in the code above
+the test, that is correctly handled. Using WARN() hinders automated testing.
+Reducing severity.
+
+Fixes: de2070fc4aa7 ("ath6kl: Fix kernel panic on continuous driver load/unload")
+Reported-and-tested-by: syzbot+555908813b2ea35dae9a@syzkaller.appspotmail.com
+Signed-off-by: Oliver Neukum <oneukum@suse.com>
+Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
+Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230126182431.867984-1-pchelkin@ispras.ru
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath6kl/htc_pipe.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath6kl/htc_pipe.c b/drivers/net/wireless/ath/ath6kl/htc_pipe.c
+index c68848819a52d..9b88d96bfe96c 100644
+--- a/drivers/net/wireless/ath/ath6kl/htc_pipe.c
++++ b/drivers/net/wireless/ath/ath6kl/htc_pipe.c
+@@ -960,8 +960,8 @@ static int ath6kl_htc_pipe_rx_complete(struct ath6kl *ar, struct sk_buff *skb,
+ * Thus the possibility of ar->htc_target being NULL
+ * via ath6kl_recv_complete -> ath6kl_usb_io_comp_work.
+ */
+- if (WARN_ON_ONCE(!target)) {
+- ath6kl_err("Target not yet initialized\n");
++ if (!target) {
++ ath6kl_dbg(ATH6KL_DBG_HTC, "Target not yet initialized\n");
+ status = -EINVAL;
+ goto free_skb;
+ }
+--
+2.39.2
+
--- /dev/null
+From de1bac2bc756e3b5900951b5b728b3c95b5506da Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Feb 2023 22:23:01 +0300
+Subject: wifi: ath9k: hif_usb: fix memory leak of remain_skbs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Fedor Pchelkin <pchelkin@ispras.ru>
+
+[ Upstream commit 7654cc03eb699297130b693ec34e25f77b17c947 ]
+
+hif_dev->remain_skb is allocated and used exclusively in
+ath9k_hif_usb_rx_stream(). It is implied that an allocated remain_skb is
+processed and subsequently freed (in error paths) only during the next
+call of ath9k_hif_usb_rx_stream().
+
+So, if the urbs are deallocated between those two calls due to the device
+deinitialization or suspend, it is possible that ath9k_hif_usb_rx_stream()
+is not called next time and the allocated remain_skb is leaked. Our local
+Syzkaller instance was able to trigger that.
+
+remain_skb makes sense when receiving two consecutive urbs which are
+logically linked together, i.e. a specific data field from the first skb
+indicates a cached skb to be allocated, memcpy'd with some data and
+subsequently processed in the next call to ath9k_hif_usb_rx_stream(). Urbs
+deallocation supposedly makes that link irrelevant so we need to free the
+cached skb in those cases.
+
+Fix the leak by introducing a function to explicitly free remain_skb (if
+it is not NULL) when the rx urbs have been deallocated. remain_skb is NULL
+when it has not been allocated at all (hif_dev struct is kzalloced) or
+when it has been processed in next call to ath9k_hif_usb_rx_stream().
+
+Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
+
+Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.")
+Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
+Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
+Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230216192301.171225-1-pchelkin@ispras.ru
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath9k/hif_usb.c | 19 +++++++++++++++++++
+ 1 file changed, 19 insertions(+)
+
+diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c
+index f521dfa2f1945..e0130beb304df 100644
+--- a/drivers/net/wireless/ath/ath9k/hif_usb.c
++++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
+@@ -534,6 +534,24 @@ static struct ath9k_htc_hif hif_usb = {
+ .send = hif_usb_send,
+ };
+
++/* Need to free remain_skb allocated in ath9k_hif_usb_rx_stream
++ * in case ath9k_hif_usb_rx_stream wasn't called next time to
++ * process the buffer and subsequently free it.
++ */
++static void ath9k_hif_usb_free_rx_remain_skb(struct hif_device_usb *hif_dev)
++{
++ unsigned long flags;
++
++ spin_lock_irqsave(&hif_dev->rx_lock, flags);
++ if (hif_dev->remain_skb) {
++ dev_kfree_skb_any(hif_dev->remain_skb);
++ hif_dev->remain_skb = NULL;
++ hif_dev->rx_remain_len = 0;
++ RX_STAT_INC(hif_dev, skb_dropped);
++ }
++ spin_unlock_irqrestore(&hif_dev->rx_lock, flags);
++}
++
+ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev,
+ struct sk_buff *skb)
+ {
+@@ -868,6 +886,7 @@ static int ath9k_hif_usb_alloc_tx_urbs(struct hif_device_usb *hif_dev)
+ static void ath9k_hif_usb_dealloc_rx_urbs(struct hif_device_usb *hif_dev)
+ {
+ usb_kill_anchored_urbs(&hif_dev->rx_submitted);
++ ath9k_hif_usb_free_rx_remain_skb(hif_dev);
+ }
+
+ static int ath9k_hif_usb_alloc_rx_urbs(struct hif_device_usb *hif_dev)
+--
+2.39.2
+
--- /dev/null
+From 960694372176229e3d4d4dd551453690364ef3a8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Jan 2023 10:42:48 +0000
+Subject: wifi: brcmfmac: support CQM RSSI notification with older firmware
+
+From: John Keeping <john@metanate.com>
+
+[ Upstream commit ec52d77d077529f198fd874c550a26b9cc86a331 ]
+
+Using the BCM4339 firmware from linux-firmware (version "BCM4339/2 wl0:
+Sep 5 2019 11:05:52 version 6.37.39.113 (r722271 CY)" from
+cypress/cyfmac4339-sdio.bin) the RSSI respose is only 4 bytes, which
+results in an error being logged.
+
+It seems that older devices send only the RSSI field and neither SNR nor
+noise is included. Handle this by accepting a 4 byte message and
+reading only the RSSI from it.
+
+Fixes: 7dd56ea45a66 ("brcmfmac: add support for CQM RSSI notifications")
+Signed-off-by: John Keeping <john@metanate.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20230124104248.2917465-1-john@metanate.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../broadcom/brcm80211/brcmfmac/cfg80211.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+index 5a9f713ea703e..3d33e687964ad 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -6494,18 +6494,20 @@ static s32 brcmf_notify_rssi(struct brcmf_if *ifp,
+ {
+ struct brcmf_cfg80211_vif *vif = ifp->vif;
+ struct brcmf_rssi_be *info = data;
+- s32 rssi, snr, noise;
++ s32 rssi, snr = 0, noise = 0;
+ s32 low, high, last;
+
+- if (e->datalen < sizeof(*info)) {
++ if (e->datalen >= sizeof(*info)) {
++ rssi = be32_to_cpu(info->rssi);
++ snr = be32_to_cpu(info->snr);
++ noise = be32_to_cpu(info->noise);
++ } else if (e->datalen >= sizeof(rssi)) {
++ rssi = be32_to_cpu(*(__be32 *)data);
++ } else {
+ brcmf_err("insufficient RSSI event data\n");
+ return 0;
+ }
+
+- rssi = be32_to_cpu(info->rssi);
+- snr = be32_to_cpu(info->snr);
+- noise = be32_to_cpu(info->noise);
+-
+ low = vif->cqm_rssi_low;
+ high = vif->cqm_rssi_high;
+ last = vif->cqm_rssi_last;
+--
+2.39.2
+
--- /dev/null
+From 53359569d5418992dd3cb34e5a0af06f909d1bac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Apr 2023 10:44:01 +0300
+Subject: wifi: iwlwifi: debug: fix crash in __iwl_err()
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 634c7b1bd08ca322537ab389f8cbd7bb543b5e45 ]
+
+In __iwl_err(), if we rate-limit the message away, then
+vaf.va is still NULL-initialized by the time we get to
+the tracing code, which then crashes. When it doesn't
+get rate-limited out, it's still wrong to reuse the old
+args2 that was already printed, which is why we bother
+making a copy in the first place.
+
+Assign vaf.va properly to fix this.
+
+Fixes: e5f1cc98cc1b ("iwlwifi: allow rate-limited error messages")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
+Link: https://lore.kernel.org/r/20230413102635.e27134c6bcd4.Ib3894cd2ba7a5ad5e75912a7634f146ceaa569e2@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/iwl-debug.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-debug.c b/drivers/net/wireless/intel/iwlwifi/iwl-debug.c
+index ae4c2a3d63d5b..3a3c13a41fc61 100644
+--- a/drivers/net/wireless/intel/iwlwifi/iwl-debug.c
++++ b/drivers/net/wireless/intel/iwlwifi/iwl-debug.c
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
+ /*
+- * Copyright (C) 2005-2011, 2021 Intel Corporation
++ * Copyright (C) 2005-2011, 2021-2022 Intel Corporation
+ */
+ #include <linux/device.h>
+ #include <linux/interrupt.h>
+@@ -57,6 +57,7 @@ void __iwl_err(struct device *dev, enum iwl_err_mode mode, const char *fmt, ...)
+ default:
+ break;
+ }
++ vaf.va = &args;
+ trace_iwlwifi_err(&vaf);
+ va_end(args);
+ }
+--
+2.39.2
+
--- /dev/null
+From 68c0fee45b80e8bb7be4cdc7efc7047ed8939c3e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Apr 2023 17:07:21 +0300
+Subject: wifi: iwlwifi: fix duplicate entry in iwl_dev_info_table
+
+From: Gregory Greenman <gregory.greenman@intel.com>
+
+[ Upstream commit fc3c2f0ed86b65dff4b6844c59c597b977cae533 ]
+
+There're two identical entries for ax1650 device in
+iwl_dev_info_table. Remove one of the duplicate entries.
+
+Fixes: 953e66a7238b ("iwlwifi: add new ax1650 killer device")
+Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
+Link: https://lore.kernel.org/r/20230410140721.897683-2-gregory.greenman@intel.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
+index 99768d6a60322..a0bf19b18635c 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
+@@ -565,7 +565,6 @@ static const struct iwl_dev_info iwl_dev_info_table[] = {
+ IWL_DEV_INFO(0x43F0, 0x1652, killer1650i_2ax_cfg_qu_b0_hr_b0, iwl_ax201_killer_1650i_name),
+ IWL_DEV_INFO(0x43F0, 0x2074, iwl_ax201_cfg_qu_hr, NULL),
+ IWL_DEV_INFO(0x43F0, 0x4070, iwl_ax201_cfg_qu_hr, NULL),
+- IWL_DEV_INFO(0x43F0, 0x1651, killer1650s_2ax_cfg_qu_b0_hr_b0, iwl_ax201_killer_1650s_name),
+ IWL_DEV_INFO(0xA0F0, 0x0070, iwl_ax201_cfg_qu_hr, NULL),
+ IWL_DEV_INFO(0xA0F0, 0x0074, iwl_ax201_cfg_qu_hr, NULL),
+ IWL_DEV_INFO(0xA0F0, 0x0078, iwl_ax201_cfg_qu_hr, NULL),
+--
+2.39.2
+
--- /dev/null
+From a9f321432eccccbee7928a6a9059153cfb940dff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Apr 2023 12:28:05 +0300
+Subject: wifi: iwlwifi: fw: fix memory leak in debugfs
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 3d90d2f4a018fe8cfd65068bc6350b6222be4852 ]
+
+Fix a memory leak that occurs when reading the fw_info
+file all the way, since we return NULL indicating no
+more data, but don't free the status tracking object.
+
+Fixes: 36dfe9ac6e8b ("iwlwifi: dump api version in yaml format")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
+Link: https://lore.kernel.org/r/20230418122405.239e501b3b8d.I4268f87809ef91209cbcd748eee0863195e70fa2@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/fw/debugfs.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/fw/debugfs.c b/drivers/net/wireless/intel/iwlwifi/fw/debugfs.c
+index 43e997283db0f..607e07ed2477c 100644
+--- a/drivers/net/wireless/intel/iwlwifi/fw/debugfs.c
++++ b/drivers/net/wireless/intel/iwlwifi/fw/debugfs.c
+@@ -317,8 +317,10 @@ static void *iwl_dbgfs_fw_info_seq_next(struct seq_file *seq,
+ const struct iwl_fw *fw = priv->fwrt->fw;
+
+ *pos = ++state->pos;
+- if (*pos >= fw->ucode_capa.n_cmd_versions)
++ if (*pos >= fw->ucode_capa.n_cmd_versions) {
++ kfree(state);
+ return NULL;
++ }
+
+ return state;
+ }
+--
+2.39.2
+
--- /dev/null
+From 8a4ed82dc7474da6b6bf7197427c71f0bf959bd3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Apr 2023 13:11:58 +0300
+Subject: wifi: iwlwifi: fw: move memset before early return
+
+From: Tom Rix <trix@redhat.com>
+
+[ Upstream commit 8ce437dd5b2e4adef13aa4ecce07392f9966b1ab ]
+
+Clang static analysis reports this representative issue
+dbg.c:1455:6: warning: Branch condition evaluates to
+a garbage value
+ if (!rxf_data.size)
+ ^~~~~~~~~~~~~~
+
+This check depends on iwl_ini_get_rxf_data() to clear
+rxf_data but the function can return early without
+doing the clear. So move the memset before the early
+return.
+
+Fixes: cc9b6012d34b ("iwlwifi: yoyo: use hweight_long instead of bit manipulating")
+Signed-off-by: Tom Rix <trix@redhat.com>
+Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
+Link: https://lore.kernel.org/r/20230414130637.872a7175f1ff.I33802a77a91998276992b088fbe25f61c87c33ac@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/fw/dbg.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/fw/dbg.c b/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
+index bde6f0764a538..027360e63b926 100644
+--- a/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
++++ b/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
+@@ -1388,13 +1388,13 @@ static void iwl_ini_get_rxf_data(struct iwl_fw_runtime *fwrt,
+ if (!data)
+ return;
+
++ memset(data, 0, sizeof(*data));
++
+ /* make sure only one bit is set in only one fid */
+ if (WARN_ONCE(hweight_long(fid1) + hweight_long(fid2) != 1,
+ "fid1=%x, fid2=%x\n", fid1, fid2))
+ return;
+
+- memset(data, 0, sizeof(*data));
+-
+ if (fid1) {
+ fifo_idx = ffs(fid1) - 1;
+ if (WARN_ONCE(fifo_idx >= MAX_NUM_LMAC, "fifo_idx=%d\n",
+--
+2.39.2
+
--- /dev/null
+From 31b8dec3b3f0ae62f73a113e60a38453844e4e9e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 16 Apr 2023 15:47:38 +0300
+Subject: wifi: iwlwifi: make the loop for card preparation effective
+
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+
+[ Upstream commit 28965ec0b5d9112585f725660e2ff13218505ace ]
+
+Since we didn't reset t to 0, only the first iteration of the loop
+did checked the ready bit several times.
+From the second iteration and on, we just tested the bit once and
+continued to the next iteration.
+
+Reported-and-tested-by: Lorenzo Zolfanelli <lorenzo@zolfa.nl>
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=216452
+Fixes: 289e5501c314 ("iwlwifi: fix the preparation of the card")
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
+Link: https://lore.kernel.org/r/20230416154301.615b683ab9c8.Ic52c3229d3345b0064fa34263293db095d88daf8@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/pcie/trans.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+index 40283fe622daa..171b6bf4a65a0 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+@@ -599,7 +599,6 @@ static int iwl_pcie_set_hw_ready(struct iwl_trans *trans)
+ int iwl_pcie_prepare_card_hw(struct iwl_trans *trans)
+ {
+ int ret;
+- int t = 0;
+ int iter;
+
+ IWL_DEBUG_INFO(trans, "iwl_trans_prepare_card_hw enter\n");
+@@ -616,6 +615,8 @@ int iwl_pcie_prepare_card_hw(struct iwl_trans *trans)
+ usleep_range(1000, 2000);
+
+ for (iter = 0; iter < 10; iter++) {
++ int t = 0;
++
+ /* If HW is not ready, prepare the conditions to check again */
+ iwl_set_bit(trans, CSR_HW_IF_CONFIG_REG,
+ CSR_HW_IF_CONFIG_REG_PREPARE);
+--
+2.39.2
+
--- /dev/null
+From c15cb4bf55bdb1b23353d132af5400c96fae3294 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Apr 2023 11:41:33 +0300
+Subject: wifi: iwlwifi: mvm: check firmware response size
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 13513cec93ac9902d0b896976d8bab3758a9881c ]
+
+Check the firmware response size for responses to the
+memory read/write command in debugfs before using it.
+
+Fixes: 2b55f43f8e47 ("iwlwifi: mvm: Add mem debugfs entry")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
+Link: https://lore.kernel.org/r/20230417113648.0d56fcaf68ee.I70e9571f3ed7263929b04f8fabad23c9b999e4ea@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c b/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c
+index 85b99316d029a..e3fc2f4be0045 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c
+@@ -1745,6 +1745,11 @@ static ssize_t iwl_dbgfs_mem_read(struct file *file, char __user *user_buf,
+ if (ret < 0)
+ return ret;
+
++ if (iwl_rx_packet_payload_len(hcmd.resp_pkt) < sizeof(*rsp)) {
++ ret = -EIO;
++ goto out;
++ }
++
+ rsp = (void *)hcmd.resp_pkt->data;
+ if (le32_to_cpu(rsp->status) != DEBUG_MEM_STATUS_SUCCESS) {
+ ret = -ENXIO;
+@@ -1821,6 +1826,11 @@ static ssize_t iwl_dbgfs_mem_write(struct file *file,
+ if (ret < 0)
+ return ret;
+
++ if (iwl_rx_packet_payload_len(hcmd.resp_pkt) < sizeof(*rsp)) {
++ ret = -EIO;
++ goto out;
++ }
++
+ rsp = (void *)hcmd.resp_pkt->data;
+ if (rsp->status != DEBUG_MEM_STATUS_SUCCESS) {
+ ret = -ENXIO;
+--
+2.39.2
+
--- /dev/null
+From 9b441d4640e4820e394dd24709377c791aa472fc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Apr 2023 21:40:22 +0300
+Subject: wifi: iwlwifi: mvm: don't drop unencrypted MCAST frames
+
+From: Ayala Beker <ayala.beker@intel.com>
+
+[ Upstream commit 8e5a26360cbe29b896b6758518280d41c3704d43 ]
+
+MCAST frames are filtered out by the driver if we are not
+authorized yet.
+Fix it to filter out only protected frames.
+
+Fixes: 147eb05f24e6 ("iwlwifi: mvm: always tell the firmware to accept MCAST frames in BSS")
+Signed-off-by: Ayala Beker <ayala.beker@intel.com>
+Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
+Link: https://lore.kernel.org/r/20230413213309.9cedcc27db60.I8fb7057981392660da482dd215e85c15946d3f4b@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/rx.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rx.c b/drivers/net/wireless/intel/iwlwifi/mvm/rx.c
+index 49ca1e168fc5b..eee98cebbb46a 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/rx.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/rx.c
+@@ -384,9 +384,10 @@ void iwl_mvm_rx_rx_mpdu(struct iwl_mvm *mvm, struct napi_struct *napi,
+ * Don't even try to decrypt a MCAST frame that was received
+ * before the managed vif is authorized, we'd fail anyway.
+ */
+- if (vif->type == NL80211_IFTYPE_STATION &&
++ if (is_multicast_ether_addr(hdr->addr1) &&
++ vif->type == NL80211_IFTYPE_STATION &&
+ !mvmvif->authorized &&
+- is_multicast_ether_addr(hdr->addr1)) {
++ ieee80211_has_protected(hdr->frame_control)) {
+ IWL_DEBUG_DROP(mvm, "MCAST before the vif is authorized\n");
+ kfree_skb(skb);
+ rcu_read_unlock();
+--
+2.39.2
+
--- /dev/null
+From 906f8336d847b4b553bb57cb8dcd2e0bf179818f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Apr 2023 10:44:15 +0300
+Subject: wifi: iwlwifi: mvm: don't set CHECKSUM_COMPLETE for unsupported
+ protocols
+
+From: Avraham Stern <avraham.stern@intel.com>
+
+[ Upstream commit 217f3c52f00d3419ecdd38a99a7eceecb11679b2 ]
+
+On Bz devices, CHECKSUM_COMPLETE was set for unsupported protocols
+which results in a warning. Fix it.
+
+Fixes: b6f5b647f694 ("iwlwifi: mvm: handle RX checksum on Bz devices")
+Signed-off-by: Avraham Stern <avraham.stern@intel.com>
+Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
+Link: https://lore.kernel.org/r/20230413102635.a2a35286f0ca.I50daa9445a6465514c44f5096c32adef64beba5f@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
+index 549dbe0be223a..e685113172c52 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
+@@ -171,8 +171,7 @@ static int iwl_mvm_create_skb(struct iwl_mvm *mvm, struct sk_buff *skb,
+ * Starting from Bz hardware, it calculates starting directly after
+ * the MAC header, so that matches mac80211's expectation.
+ */
+- if (skb->ip_summed == CHECKSUM_COMPLETE &&
+- mvm->trans->trans_cfg->device_family < IWL_DEVICE_FAMILY_BZ) {
++ if (skb->ip_summed == CHECKSUM_COMPLETE) {
+ struct {
+ u8 hdr[6];
+ __be16 type;
+@@ -187,7 +186,7 @@ static int iwl_mvm_create_skb(struct iwl_mvm *mvm, struct sk_buff *skb,
+ shdr->type != htons(ETH_P_PAE) &&
+ shdr->type != htons(ETH_P_TDLS))))
+ skb->ip_summed = CHECKSUM_NONE;
+- else
++ else if (mvm->trans->trans_cfg->device_family < IWL_DEVICE_FAMILY_BZ)
+ /* mac80211 assumes full CSUM including SNAP header */
+ skb_postpush_rcsum(skb, shdr, sizeof(*shdr));
+ }
+--
+2.39.2
+
--- /dev/null
+From 34b82204ece741612b3adb982444ef040c16dd70 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Apr 2023 10:44:08 +0300
+Subject: wifi: iwlwifi: mvm: fix A-MSDU checks
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit d34d11aea2d5d71a66f2f90507c3f7202b964175 ]
+
+Since Gl A-step devices use the old checksum hardware,
+we shouldn't use the Bz code to check for A-MSDU
+combining ability; fix that.
+
+Fixes: ec18e7d4d20d ("wifi: iwlwifi: mvm: use old checksum for Bz A-step")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
+Link: https://lore.kernel.org/r/20230413102635.8c445b943fee.Ibf772102ca712f59e2ee0cdd4c344011fcf445aa@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+index b55b1b17f4d19..9fc2d5d8b7d75 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+@@ -5525,7 +5525,10 @@ static bool iwl_mvm_mac_can_aggregate(struct ieee80211_hw *hw,
+ {
+ struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
+
+- if (mvm->trans->trans_cfg->device_family >= IWL_DEVICE_FAMILY_BZ)
++ if (mvm->trans->trans_cfg->device_family > IWL_DEVICE_FAMILY_BZ ||
++ (mvm->trans->trans_cfg->device_family == IWL_DEVICE_FAMILY_BZ &&
++ !(CSR_HW_REV_TYPE(mvm->trans->hw_rev) == IWL_CFG_MAC_TYPE_GL &&
++ mvm->trans->hw_rev_step == SILICON_A_STEP)))
+ return iwl_mvm_tx_csum_bz(mvm, head, true) ==
+ iwl_mvm_tx_csum_bz(mvm, skb, true);
+
+--
+2.39.2
+
--- /dev/null
+From 7bcee8de904033713d80b12328e1e9debab3418d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Apr 2023 12:28:08 +0300
+Subject: wifi: iwlwifi: mvm: fix potential memory leak
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 457d7fb03e6c3d73fbb509bd85fc4b02d1ab405e ]
+
+If we do get multiple notifications from firmware, then
+we might have allocated 'notif', but don't free it. Fix
+that by checking for duplicates before allocation.
+
+Fixes: 4da46a06d443 ("wifi: iwlwifi: mvm: Add support for wowlan info notification")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
+Link: https://lore.kernel.org/r/20230418122405.116758321cc4.I8bdbcbb38c89ac637eaa20dda58fa9165b25893a@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/d3.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
+index 236694b43e8b7..d75fec8d0afd4 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
+@@ -2719,6 +2719,13 @@ static bool iwl_mvm_wait_d3_notif(struct iwl_notif_wait_data *notif_wait,
+ case WIDE_ID(PROT_OFFLOAD_GROUP, WOWLAN_INFO_NOTIFICATION): {
+ struct iwl_wowlan_info_notif *notif;
+
++ if (d3_data->notif_received & IWL_D3_NOTIF_WOWLAN_INFO) {
++ /* We might get two notifications due to dual bss */
++ IWL_DEBUG_WOWLAN(mvm,
++ "Got additional wowlan info notification\n");
++ break;
++ }
++
+ if (wowlan_info_ver < 2) {
+ struct iwl_wowlan_info_notif_v1 *notif_v1 = (void *)pkt->data;
+
+@@ -2737,13 +2744,6 @@ static bool iwl_mvm_wait_d3_notif(struct iwl_notif_wait_data *notif_wait,
+ notif = (void *)pkt->data;
+ }
+
+- if (d3_data->notif_received & IWL_D3_NOTIF_WOWLAN_INFO) {
+- /* We might get two notifications due to dual bss */
+- IWL_DEBUG_WOWLAN(mvm,
+- "Got additional wowlan info notification\n");
+- break;
+- }
+-
+ d3_data->notif_received |= IWL_D3_NOTIF_WOWLAN_INFO;
+ len = iwl_rx_packet_payload_len(pkt);
+ iwl_mvm_parse_wowlan_info_notif(mvm, notif, d3_data->status,
+--
+2.39.2
+
--- /dev/null
+From 7a29359d109230e31f50a609c6e5a538b2193b2f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Apr 2023 13:11:57 +0300
+Subject: wifi: iwlwifi: mvm: initialize seq variable
+
+From: Tom Rix <trix@redhat.com>
+
+[ Upstream commit 11e94d2bcd88dea5d9ce99555b6b172f5232d3e2 ]
+
+Clang static analysis reports this issue
+d3.c:567:22: warning: The left operand of '>' is
+ a garbage value
+ if (seq.tkip.iv32 > cur_rx_iv32)
+ ~~~~~~~~~~~~~ ^
+
+seq is never initialized. Call ieee80211_get_key_rx_seq() to
+initialize seq.
+
+Fixes: 0419e5e672d6 ("iwlwifi: mvm: d3: separate TKIP data from key iteration")
+Signed-off-by: Tom Rix <trix@redhat.com>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
+Link: https://lore.kernel.org/r/20230414130637.6dd372f84f93.If1f708c90e6424a935b4eba3917dfb7582e0dd0a@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/d3.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
+index c5ad34b063df6..29f75948ab00c 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
+@@ -563,6 +563,7 @@ static void iwl_mvm_wowlan_get_tkip_data(struct ieee80211_hw *hw,
+ }
+
+ for (i = 0; i < IWL_NUM_RSC; i++) {
++ ieee80211_get_key_rx_seq(key, i, &seq);
+ /* wrapping isn't allowed, AP must rekey */
+ if (seq.tkip.iv32 > cur_rx_iv32)
+ cur_rx_iv32 = seq.tkip.iv32;
+--
+2.39.2
+
--- /dev/null
+From dbd46d0e3e74442b44e2d280193cb740758be3cb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Apr 2023 21:40:27 +0300
+Subject: wifi: iwlwifi: mvm: support wowlan info notification version 2
+
+From: Haim Dreyfuss <haim.dreyfuss@intel.com>
+
+[ Upstream commit 905d50ddbc83bef0d7f3386e7f3472b0324b405b ]
+
+As part of version 2 we don't need to have wake_packet_bufsize
+and wake_packet_length. The first one is already calculated by the driver,
+the latter is sent as part of the wake packet notification.
+
+Signed-off-by: Haim Dreyfuss <haim.dreyfuss@intel.com>
+Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
+Link: https://lore.kernel.org/r/20230413213309.3b53213b10d4.Ibf2f15aca614def2d262dd267d1aad65931b58f1@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Stable-dep-of: 457d7fb03e6c ("wifi: iwlwifi: mvm: fix potential memory leak")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/intel/iwlwifi/fw/api/d3.h | 37 ++++++++++++++++++-
+ drivers/net/wireless/intel/iwlwifi/mvm/d3.c | 35 +++++++++++++++++-
+ 2 files changed, 69 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/fw/api/d3.h b/drivers/net/wireless/intel/iwlwifi/fw/api/d3.h
+index df0833890e55a..8a613e150a024 100644
+--- a/drivers/net/wireless/intel/iwlwifi/fw/api/d3.h
++++ b/drivers/net/wireless/intel/iwlwifi/fw/api/d3.h
+@@ -767,7 +767,7 @@ struct iwl_wowlan_status_v12 {
+ } __packed; /* WOWLAN_STATUSES_RSP_API_S_VER_12 */
+
+ /**
+- * struct iwl_wowlan_info_notif - WoWLAN information notification
++ * struct iwl_wowlan_info_notif_v1 - WoWLAN information notification
+ * @gtk: GTK data
+ * @igtk: IGTK data
+ * @replay_ctr: GTK rekey replay counter
+@@ -785,7 +785,7 @@ struct iwl_wowlan_status_v12 {
+ * @station_id: station id
+ * @reserved2: reserved
+ */
+-struct iwl_wowlan_info_notif {
++struct iwl_wowlan_info_notif_v1 {
+ struct iwl_wowlan_gtk_status_v3 gtk[WOWLAN_GTK_KEYS_NUM];
+ struct iwl_wowlan_igtk_status igtk[WOWLAN_IGTK_KEYS_NUM];
+ __le64 replay_ctr;
+@@ -803,6 +803,39 @@ struct iwl_wowlan_info_notif {
+ u8 reserved2[2];
+ } __packed; /* WOWLAN_INFO_NTFY_API_S_VER_1 */
+
++/**
++ * struct iwl_wowlan_info_notif - WoWLAN information notification
++ * @gtk: GTK data
++ * @igtk: IGTK data
++ * @replay_ctr: GTK rekey replay counter
++ * @pattern_number: number of the matched patterns
++ * @reserved1: reserved
++ * @qos_seq_ctr: QoS sequence counters to use next
++ * @wakeup_reasons: wakeup reasons, see &enum iwl_wowlan_wakeup_reason
++ * @num_of_gtk_rekeys: number of GTK rekeys
++ * @transmitted_ndps: number of transmitted neighbor discovery packets
++ * @received_beacons: number of received beacons
++ * @tid_tear_down: bit mask of tids whose BA sessions were closed
++ * in suspend state
++ * @station_id: station id
++ * @reserved2: reserved
++ */
++struct iwl_wowlan_info_notif {
++ struct iwl_wowlan_gtk_status_v3 gtk[WOWLAN_GTK_KEYS_NUM];
++ struct iwl_wowlan_igtk_status igtk[WOWLAN_IGTK_KEYS_NUM];
++ __le64 replay_ctr;
++ __le16 pattern_number;
++ __le16 reserved1;
++ __le16 qos_seq_ctr[8];
++ __le32 wakeup_reasons;
++ __le32 num_of_gtk_rekeys;
++ __le32 transmitted_ndps;
++ __le32 received_beacons;
++ u8 tid_tear_down;
++ u8 station_id;
++ u8 reserved2[2];
++} __packed; /* WOWLAN_INFO_NTFY_API_S_VER_2 */
++
+ /**
+ * struct iwl_wowlan_wake_pkt_notif - WoWLAN wake packet notification
+ * @wake_packet_length: wakeup packet length
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
+index 29f75948ab00c..236694b43e8b7 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
+@@ -2016,6 +2016,12 @@ static void iwl_mvm_parse_wowlan_info_notif(struct iwl_mvm *mvm,
+ {
+ u32 i;
+
++ if (!data) {
++ IWL_ERR(mvm, "iwl_wowlan_info_notif data is NULL\n");
++ status = NULL;
++ return;
++ }
++
+ if (len < sizeof(*data)) {
+ IWL_ERR(mvm, "Invalid WoWLAN info notification!\n");
+ status = NULL;
+@@ -2703,10 +2709,33 @@ static bool iwl_mvm_wait_d3_notif(struct iwl_notif_wait_data *notif_wait,
+ struct iwl_d3_data *d3_data = data;
+ u32 len;
+ int ret;
++ int wowlan_info_ver = iwl_fw_lookup_notif_ver(mvm->fw,
++ PROT_OFFLOAD_GROUP,
++ WOWLAN_INFO_NOTIFICATION,
++ IWL_FW_CMD_VER_UNKNOWN);
++
+
+ switch (WIDE_ID(pkt->hdr.group_id, pkt->hdr.cmd)) {
+ case WIDE_ID(PROT_OFFLOAD_GROUP, WOWLAN_INFO_NOTIFICATION): {
+- struct iwl_wowlan_info_notif *notif = (void *)pkt->data;
++ struct iwl_wowlan_info_notif *notif;
++
++ if (wowlan_info_ver < 2) {
++ struct iwl_wowlan_info_notif_v1 *notif_v1 = (void *)pkt->data;
++
++ notif = kmemdup(notif_v1,
++ offsetofend(struct iwl_wowlan_info_notif,
++ received_beacons),
++ GFP_ATOMIC);
++
++ if (!notif)
++ return false;
++
++ notif->tid_tear_down = notif_v1->tid_tear_down;
++ notif->station_id = notif_v1->station_id;
++
++ } else {
++ notif = (void *)pkt->data;
++ }
+
+ if (d3_data->notif_received & IWL_D3_NOTIF_WOWLAN_INFO) {
+ /* We might get two notifications due to dual bss */
+@@ -2719,6 +2748,10 @@ static bool iwl_mvm_wait_d3_notif(struct iwl_notif_wait_data *notif_wait,
+ len = iwl_rx_packet_payload_len(pkt);
+ iwl_mvm_parse_wowlan_info_notif(mvm, notif, d3_data->status,
+ len);
++
++ if (wowlan_info_ver < 2)
++ kfree(notif);
++
+ if (d3_data->status &&
+ d3_data->status->wakeup_reasons & IWL_WOWLAN_WAKEUP_REASON_HAS_WAKEUP_PKT)
+ /* We are supposed to get also wake packet notif */
+--
+2.39.2
+
--- /dev/null
+From f3b0959ea8fe43c0fb9dd5a2a3c5bec44e931bb2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Apr 2023 10:44:14 +0300
+Subject: wifi: iwlwifi: trans: don't trigger d3 interrupt twice
+
+From: Avraham Stern <avraham.stern@intel.com>
+
+[ Upstream commit 277f56a141fc54ef7f9e09dba65fb2e12021411d ]
+
+When the IPC registers are used for sleep control, setting
+the IPC sleep bit already triggers an interrupt to the fw, so
+there is no need to also set the doorbell. Setting also the
+doorbell triggers the sleep interrupt twice which lead to
+an assert.
+
+Fixes: af08571d3925 ("iwlwifi: pcie: support Bz suspend/resume trigger")
+Signed-off-by: Avraham Stern <avraham.stern@intel.com>
+Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
+Link: https://lore.kernel.org/r/20230413102635.b5f2f6e44d38.I4cb5b6ad4914db47a714e731c4c8b4db679cabce@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/pcie/trans.c | 9 +++------
+ 1 file changed, 3 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+index 0a9af1ad1f206..40283fe622daa 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+@@ -1522,19 +1522,16 @@ static int iwl_pcie_d3_handshake(struct iwl_trans *trans, bool suspend)
+ struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
+ int ret;
+
+- if (trans->trans_cfg->device_family == IWL_DEVICE_FAMILY_AX210) {
++ if (trans->trans_cfg->device_family == IWL_DEVICE_FAMILY_AX210)
+ iwl_write_umac_prph(trans, UREG_DOORBELL_TO_ISR6,
+ suspend ? UREG_DOORBELL_TO_ISR6_SUSPEND :
+ UREG_DOORBELL_TO_ISR6_RESUME);
+- } else if (trans->trans_cfg->device_family >= IWL_DEVICE_FAMILY_BZ) {
++ else if (trans->trans_cfg->device_family >= IWL_DEVICE_FAMILY_BZ)
+ iwl_write32(trans, CSR_IPC_SLEEP_CONTROL,
+ suspend ? CSR_IPC_SLEEP_CONTROL_SUSPEND :
+ CSR_IPC_SLEEP_CONTROL_RESUME);
+- iwl_write_umac_prph(trans, UREG_DOORBELL_TO_ISR6,
+- UREG_DOORBELL_TO_ISR6_SLEEP_CTRL);
+- } else {
++ else
+ return 0;
+- }
+
+ ret = wait_event_timeout(trans_pcie->sx_waitq,
+ trans_pcie->sx_complete, 2 * HZ);
+--
+2.39.2
+
--- /dev/null
+From 7a70f8d761fd75fba0003ce9627cfc79cc051cf7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Apr 2023 21:40:34 +0300
+Subject: wifi: iwlwifi: yoyo: Fix possible division by zero
+
+From: Daniel Gabay <daniel.gabay@intel.com>
+
+[ Upstream commit ba30415118eee374a08b39a0460a1d1e52c24a25 ]
+
+Don't allow buffer allocation TLV with zero req_size since it
+leads later to division by zero in iwl_dbg_tlv_alloc_fragments().
+Also, NPK/SRAM locations are allowed to have zero buffer req_size,
+don't discard them.
+
+Fixes: a9248de42464 ("iwlwifi: dbg_ini: add TLV allocation new API support")
+Signed-off-by: Daniel Gabay <daniel.gabay@intel.com>
+Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
+Link: https://lore.kernel.org/r/20230413213309.5d6688ed74d8.I5c2f3a882b50698b708d54f4524dc5bdf11e3d32@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c b/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c
+index 48e7376a5fea7..7ed4991f8dab9 100644
+--- a/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c
++++ b/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c
+@@ -138,6 +138,12 @@ static int iwl_dbg_tlv_alloc_buf_alloc(struct iwl_trans *trans,
+ alloc_id != IWL_FW_INI_ALLOCATION_ID_DBGC1)
+ goto err;
+
++ if (buf_location == IWL_FW_INI_LOCATION_DRAM_PATH &&
++ alloc->req_size == 0) {
++ IWL_ERR(trans, "WRT: Invalid DRAM buffer allocation requested size (0)\n");
++ return -EINVAL;
++ }
++
+ trans->dbg.fw_mon_cfg[alloc_id] = *alloc;
+
+ return 0;
+--
+2.39.2
+
--- /dev/null
+From 548849e8daa5bf30348bf8db2ea48274261fba16 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Apr 2023 21:40:33 +0300
+Subject: wifi: iwlwifi: yoyo: skip dump correctly on hw error
+
+From: Daniel Gabay <daniel.gabay@intel.com>
+
+[ Upstream commit 11195ab0d6f3202cf7af1a4c69570f59c377d8ad ]
+
+When NIC is in a bad state, reading data will return 28 bits as
+0xa5a5a5a and the lowest 4 bits are not fixed value.
+
+Mask these bits in a few places to skip the dump correctly.
+
+Fixes: 89639e06d0f3 ("iwlwifi: yoyo: support for new DBGI_SRAM region")
+Signed-off-by: Daniel Gabay <daniel.gabay@intel.com>
+Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
+Link: https://lore.kernel.org/r/20230413213309.df6c0663179d.I36d8487b2419c6fefa65e5514855d94327c3b1eb@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/fw/dbg.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/fw/dbg.c b/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
+index abf49022edbe4..bde6f0764a538 100644
+--- a/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
++++ b/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
+@@ -1038,7 +1038,7 @@ iwl_dump_ini_prph_mac_iter(struct iwl_fw_runtime *fwrt,
+ range->range_data_size = reg->dev_addr.size;
+ for (i = 0; i < le32_to_cpu(reg->dev_addr.size); i += 4) {
+ prph_val = iwl_read_prph(fwrt->trans, addr + i);
+- if (prph_val == 0x5a5a5a5a)
++ if ((prph_val & ~0xf) == 0xa5a5a5a0)
+ return -EBUSY;
+ *val++ = cpu_to_le32(prph_val);
+ }
+@@ -1562,7 +1562,7 @@ iwl_dump_ini_dbgi_sram_iter(struct iwl_fw_runtime *fwrt,
+ prph_data = iwl_read_prph_no_grab(fwrt->trans, (i % 2) ?
+ DBGI_SRAM_TARGET_ACCESS_RDATA_MSB :
+ DBGI_SRAM_TARGET_ACCESS_RDATA_LSB);
+- if (prph_data == 0x5a5a5a5a) {
++ if ((prph_data & ~0xf) == 0xa5a5a5a0) {
+ iwl_trans_release_nic_access(fwrt->trans);
+ return -EBUSY;
+ }
+--
+2.39.2
+
--- /dev/null
+From cf6335cd56454aa373de6e692d157a8d1b31adb1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Apr 2023 04:23:29 +0800
+Subject: wifi: mt76: connac: fix txd multicast rate setting
+
+From: Ryder Lee <ryder.lee@mediatek.com>
+
+[ Upstream commit 3d2892e05086d09aecf14ea64b2debbf495e313c ]
+
+The vif->bss_conf.mcast_rate should be applied to multicast data frame
+only.
+
+Fixes: 182071cdd594 ("mt76: connac: move connac2_mac_write_txwi in mt76_connac module")
+Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c b/drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c
+index aed4ee95fb2ec..82aac0a04655f 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c
++++ b/drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c
+@@ -537,7 +537,8 @@ void mt76_connac2_mac_write_txwi(struct mt76_dev *dev, __le32 *txwi,
+ if (txwi[2] & cpu_to_le32(MT_TXD2_FIX_RATE)) {
+ /* Fixed rata is available just for 802.11 txd */
+ struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+- bool multicast = is_multicast_ether_addr(hdr->addr1);
++ bool multicast = ieee80211_is_data(hdr->frame_control) &&
++ is_multicast_ether_addr(hdr->addr1);
+ u16 rate = mt76_connac2_mac_tx_rate_val(mphy, vif, beacon,
+ multicast);
+ u32 val = MT_TXD6_FIXED_BW;
+--
+2.39.2
+
--- /dev/null
+From e2223f51bc90b0e20f195f241526e5bd1894e2c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Mar 2023 21:26:12 +0800
+Subject: wifi: mt76: fix 6GHz high channel not be scanned
+
+From: Ming Yen Hsieh <mingyen.hsieh@mediatek.com>
+
+[ Upstream commit 23792cedaff02351b57bddd8957fc917fa88f2e0 ]
+
+mt76 scan command only support 64 channels currently. If the
+channel count is larger than 64(for 2+5+6GHz), some channels will
+not be scanned. Hence change the scan type to full channel scan
+in case of the command cannot include proper list for chip.
+
+Fixes: 399090ef9605 ("mt76: mt76_connac: move hw_scan and sched_scan routine in mt76_connac_mcu module")
+Reported-by: Ben Greear <greearb@candelatech.com>
+Tested-by: Isaac Konikoff <konikofi@candelatech.com>
+Signed-off-by: Ming Yen Hsieh <mingyen.hsieh@mediatek.com>
+Signed-off-by: Deren Wu <deren.wu@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/mediatek/mt76/mt76_connac_mcu.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c
+index 008ece1b16f8e..cb27885b5da7c 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c
++++ b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c
+@@ -1678,8 +1678,16 @@ int mt76_connac_mcu_hw_scan(struct mt76_phy *phy, struct ieee80211_vif *vif,
+ req->channel_min_dwell_time = cpu_to_le16(duration);
+ req->channel_dwell_time = cpu_to_le16(duration);
+
+- req->channels_num = min_t(u8, sreq->n_channels, 32);
+- req->ext_channels_num = min_t(u8, ext_channels_num, 32);
++ if (sreq->n_channels == 0 || sreq->n_channels > 64) {
++ req->channel_type = 0;
++ req->channels_num = 0;
++ req->ext_channels_num = 0;
++ } else {
++ req->channel_type = 4;
++ req->channels_num = min_t(u8, sreq->n_channels, 32);
++ req->ext_channels_num = min_t(u8, ext_channels_num, 32);
++ }
++
+ for (i = 0; i < req->channels_num + req->ext_channels_num; i++) {
+ if (i >= 32)
+ chan = &req->ext_channels[i - 32];
+@@ -1699,7 +1707,6 @@ int mt76_connac_mcu_hw_scan(struct mt76_phy *phy, struct ieee80211_vif *vif,
+ }
+ chan->channel_num = scan_list[i]->hw_value;
+ }
+- req->channel_type = sreq->n_channels ? 4 : 0;
+
+ if (sreq->ie_len > 0) {
+ memcpy(req->ies, sreq->ie, sreq->ie_len);
+--
+2.39.2
+
--- /dev/null
+From 969c03cd5f12b261555604585d3f862887eb89f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Feb 2023 22:48:23 +0800
+Subject: wifi: mt76: handle failure of vzalloc in mt7615_coredump_work
+
+From: Kang Chen <void0red@gmail.com>
+
+[ Upstream commit 9e47dd9f64a47ae00ca0123017584c37209ee900 ]
+
+vzalloc may fails, dump might be null and will cause
+illegal address access later.
+
+Link: https://lore.kernel.org/all/Y%2Fy5Asxw3T3m4jCw@lore-desk
+Fixes: d2bf7959d9c0 ("mt76: mt7663: introduce coredump support")
+Signed-off-by: Kang Chen <void0red@gmail.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7615/mac.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c
+index 5c41ad5955f4b..eafa0f204c1f8 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c
+@@ -2355,7 +2355,7 @@ void mt7615_coredump_work(struct work_struct *work)
+ break;
+
+ skb_pull(skb, sizeof(struct mt7615_mcu_rxd));
+- if (data + skb->len - dump > MT76_CONNAC_COREDUMP_SZ) {
++ if (!dump || data + skb->len - dump > MT76_CONNAC_COREDUMP_SZ) {
+ dev_kfree_skb(skb);
+ continue;
+ }
+@@ -2365,6 +2365,8 @@ void mt7615_coredump_work(struct work_struct *work)
+
+ dev_kfree_skb(skb);
+ }
+- dev_coredumpv(dev->mt76.dev, dump, MT76_CONNAC_COREDUMP_SZ,
+- GFP_KERNEL);
++
++ if (dump)
++ dev_coredumpv(dev->mt76.dev, dump, MT76_CONNAC_COREDUMP_SZ,
++ GFP_KERNEL);
+ }
+--
+2.39.2
+
--- /dev/null
+From 09be00f42db766ef4f89658354a0528eecd34163 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 18 Feb 2023 12:29:45 +0100
+Subject: wifi: mt76: mt7915: expose device tree match table
+
+From: Lorenz Brun <lorenz@brun.one>
+
+[ Upstream commit 90fb69212c60e26ef70ed0e8532b116c7649ac88 ]
+
+On MT7986 the WiFi driver currently does not get automatically loaded,
+requiring manual modprobing because the device tree compatibles are not
+exported into metadata.
+
+Add the missing MODULE_DEVICE_TABLE macro to fix this.
+
+Fixes: 99ad32a4ca3a2 ("mt76: mt7915: add support for MT7986")
+Signed-off-by: Lorenz Brun <lorenz@brun.one>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7915/soc.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/soc.c b/drivers/net/wireless/mediatek/mt76/mt7915/soc.c
+index 2ac0a0f2859cb..32c137066e7f7 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7915/soc.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7915/soc.c
+@@ -1239,6 +1239,8 @@ static const struct of_device_id mt7986_wmac_of_match[] = {
+ {},
+ };
+
++MODULE_DEVICE_TABLE(of, mt7986_wmac_of_match);
++
+ struct platform_driver mt7986_wmac_driver = {
+ .driver = {
+ .name = "mt7986-wmac",
+--
+2.39.2
+
--- /dev/null
+From 2fe7a98567fe480a63e204be59aaf3e4fb5b6bdb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Feb 2023 14:24:57 +0800
+Subject: wifi: mt76: mt7915: rework init flow in mt7915_thermal_init()
+
+From: Howard Hsu <howard-yh.hsu@mediatek.com>
+
+[ Upstream commit 9c97df11dfe68b548a47744ba9fa6beddcfba2bc ]
+
+If kernel do not enable CONFIG_HWMON, it may cause thermal
+initialization to be done with temperature value 0 and then can not
+transmit. This commit fixes it by setting trigger/restore temperature
+before checking CONFIG_HWMON.
+
+Fixes: 7d12b38ab6f6 ("wifi: mt76: mt7915: call mt7915_mcu_set_thermal_throttling() only after init_work")
+Signed-off-by: Howard Hsu <howard-yh.hsu@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7915/init.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/init.c b/drivers/net/wireless/mediatek/mt76/mt7915/init.c
+index 4f3efc942a4d8..71ccefd39cb20 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7915/init.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7915/init.c
+@@ -203,6 +203,10 @@ static int mt7915_thermal_init(struct mt7915_phy *phy)
+ phy->cdev = cdev;
+ }
+
++ /* initialize critical/maximum high temperature */
++ phy->throttle_temp[MT7915_CRIT_TEMP_IDX] = MT7915_CRIT_TEMP;
++ phy->throttle_temp[MT7915_MAX_TEMP_IDX] = MT7915_MAX_TEMP;
++
+ if (!IS_REACHABLE(CONFIG_HWMON))
+ return 0;
+
+@@ -211,10 +215,6 @@ static int mt7915_thermal_init(struct mt7915_phy *phy)
+ if (IS_ERR(hwmon))
+ return PTR_ERR(hwmon);
+
+- /* initialize critical/maximum high temperature */
+- phy->throttle_temp[MT7915_CRIT_TEMP_IDX] = MT7915_CRIT_TEMP;
+- phy->throttle_temp[MT7915_MAX_TEMP_IDX] = MT7915_MAX_TEMP;
+-
+ return 0;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From ad39e31f944380fed0155a660f4d21237ada820a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Feb 2023 15:15:05 +0300
+Subject: wifi: mt76: mt7915: unlock on error in mt7915_thermal_temp_store()
+
+From: Dan Carpenter <error27@gmail.com>
+
+[ Upstream commit cdc215c2c8d74b3c8886650e979b47f16c1f7f92 ]
+
+Drop the lock before returning -EINVAL.
+
+Fixes: ecaccdae7a7e ("wifi: mt76: mt7915: rework mt7915_thermal_temp_store()")
+Signed-off-by: Dan Carpenter <error27@gmail.com>
+Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7915/init.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/init.c b/drivers/net/wireless/mediatek/mt76/mt7915/init.c
+index 5e288116b1b01..4f3efc942a4d8 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7915/init.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7915/init.c
+@@ -89,6 +89,7 @@ static ssize_t mt7915_thermal_temp_store(struct device *dev,
+ val < phy->throttle_temp[MT7915_CRIT_TEMP_IDX])) {
+ dev_err(phy->dev->mt76.dev,
+ "temp1_max shall be greater than temp1_crit.");
++ mutex_unlock(&phy->dev->mt76.mutex);
+ return -EINVAL;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From d4e5511d51b69a48388f1af5d9db40cabcfcf36c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Apr 2023 14:22:34 +0800
+Subject: wifi: mt76: mt7921: fix missing unwind goto in `mt7921u_probe`
+
+From: Jiefeng Li <jiefeng_li@hust.edu.cn>
+
+[ Upstream commit 5c47cdebbaeb7724df6f9f46917c93e53f791547 ]
+
+`mt7921u_dma_init` can only return zero or negative number according to its
+definition. When it returns non-zero number, there exists an error and this
+function should handle this error rather than return directly.
+
+Fixes: 0d2afe09fad5 ("mt76: mt7921: add mt7921u driver")
+Signed-off-by: Jiefeng Li <jiefeng_li@hust.edu.cn>
+Reviewed-by: Dongliang Mu <dzm91@hust.edu.cn>
+Reviewed-by: Sridhar Samudrala <sridhar.samudrala@intel.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7921/usb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/usb.c b/drivers/net/wireless/mediatek/mt76/mt7921/usb.c
+index 8fef09ed29c91..70c9bbdbf60e9 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7921/usb.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7921/usb.c
+@@ -272,7 +272,7 @@ static int mt7921u_probe(struct usb_interface *usb_intf,
+
+ ret = mt7921u_dma_init(dev, false);
+ if (ret)
+- return ret;
++ goto error;
+
+ hw = mt76_hw(dev);
+ /* check hw sg support in order to enable AMSDU */
+--
+2.39.2
+
--- /dev/null
+From 8cef365999d2f931bdeb9cd51d645f824a603a30 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Feb 2023 10:49:57 +0800
+Subject: wifi: mt76: mt7921: fix PCI DMA hang after reboot
+
+From: Deren Wu <deren.wu@mediatek.com>
+
+[ Upstream commit 9270270d62191b7549296721e8d5f3dc0df01563 ]
+
+mt7921 just stop some workers and clean up chip status before reboot.
+In stress test, there are working activities still running at the period
+of .shutdown callback and that would cause some hosts cannot recover
+DMA after reboot. To avoid the floating state in reboot, we use
+mt7921_pci_remove() to fully deinit all resources.
+
+Fixes: f23a0cea8bd6 ("wifi: mt76: mt7921e: add pci .shutdown() support")
+Signed-off-by: Deren Wu <deren.wu@mediatek.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7921/pci.c | 12 +-----------
+ 1 file changed, 1 insertion(+), 11 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/pci.c b/drivers/net/wireless/mediatek/mt76/mt7921/pci.c
+index 41be108e1d5a1..bda92d8359692 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7921/pci.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7921/pci.c
+@@ -515,17 +515,7 @@ static int mt7921_pci_resume(struct device *device)
+
+ static void mt7921_pci_shutdown(struct pci_dev *pdev)
+ {
+- struct mt76_dev *mdev = pci_get_drvdata(pdev);
+- struct mt7921_dev *dev = container_of(mdev, struct mt7921_dev, mt76);
+- struct mt76_connac_pm *pm = &dev->pm;
+-
+- cancel_delayed_work_sync(&pm->ps_work);
+- cancel_work_sync(&pm->wake_work);
+-
+- /* chip cleanup before reboot */
+- mt7921_mcu_drv_pmctrl(dev);
+- mt7921_dma_cleanup(dev);
+- mt7921_wfsys_reset(dev);
++ mt7921_pci_remove(pdev);
+ }
+
+ static DEFINE_SIMPLE_DEV_PM_OPS(mt7921_pm_ops, mt7921_pci_suspend, mt7921_pci_resume);
+--
+2.39.2
+
--- /dev/null
+From 1177747c4096832034984a33d73ebe1cc547de64 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 11 Feb 2023 09:01:58 +0800
+Subject: wifi: mt76: mt7921: fix wrong command to set STA channel
+
+From: Deren Wu <deren.wu@mediatek.com>
+
+[ Upstream commit fcc51acfebb85dbc3ab1bea3ce4997d7c0a3a38d ]
+
+Should not use AND operator to check vif type NL80211_IFTYPE_MONITOR, and
+that will cause we go into sniffer command for both STA and MONITOR
+mode. However, the sniffer command would set channel properly (with some
+extra options), the STA mode still works even if using the wrong
+command.
+
+Fix vif type check to make sure we using the right command to update
+channel.
+
+Fixes: 914189af23b8 ("wifi: mt76: mt7921: fix channel switch fail in monitor mode")
+Signed-off-by: Deren Wu <deren.wu@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7921/main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/main.c b/drivers/net/wireless/mediatek/mt76/mt7921/main.c
+index 42933a6b7334b..058aa581ff4f3 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7921/main.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7921/main.c
+@@ -1694,7 +1694,7 @@ static void mt7921_ctx_iter(void *priv, u8 *mac,
+ if (ctx != mvif->ctx)
+ return;
+
+- if (vif->type & NL80211_IFTYPE_MONITOR)
++ if (vif->type == NL80211_IFTYPE_MONITOR)
+ mt7921_mcu_config_sniffer(mvif, ctx);
+ else
+ mt76_connac_mcu_uni_set_chctx(mvif->phy->mt76, &mvif->mt76, ctx);
+--
+2.39.2
+
--- /dev/null
+From 67f14bb00c58b3b8e5a48766c4f0cb2c2f64e7ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Mar 2023 19:22:49 +0800
+Subject: wifi: mt76: mt7921: use driver flags rather than mac80211 flags to
+ mcu
+
+From: Neil Chen <yn.chen@mediatek.com>
+
+[ Upstream commit a5af1481a85679a9812f728ee5cf64ee7edbe669 ]
+
+FIF_* flags from mac80211 is not ABI. mt7921 should not pass it into mcu
+directly. Remap FIF_* to driver defined flags as mcu command input.
+
+Fixes: c222f77fd421 ("wifi: mt76: mt7921: fix rx filter incorrect by drv/fw inconsistent")
+Signed-off-by: Neil Chen <yn.chen@mediatek.com>
+Signed-off-by: Deren Wu <deren.wu@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/mediatek/mt76/mt7921/main.c | 17 ++++++++++++++++-
+ 1 file changed, 16 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/main.c b/drivers/net/wireless/mediatek/mt76/mt7921/main.c
+index 058aa581ff4f3..2c5e4ad3a0c69 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7921/main.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7921/main.c
+@@ -702,10 +702,25 @@ static void mt7921_configure_filter(struct ieee80211_hw *hw,
+ unsigned int *total_flags,
+ u64 multicast)
+ {
++#define MT7921_FILTER_FCSFAIL BIT(2)
++#define MT7921_FILTER_CONTROL BIT(5)
++#define MT7921_FILTER_OTHER_BSS BIT(6)
++#define MT7921_FILTER_ENABLE BIT(31)
++
+ struct mt7921_dev *dev = mt7921_hw_dev(hw);
++ u32 flags = MT7921_FILTER_ENABLE;
++
++#define MT7921_FILTER(_fif, _type) do { \
++ if (*total_flags & (_fif)) \
++ flags |= MT7921_FILTER_##_type; \
++ } while (0)
++
++ MT7921_FILTER(FIF_FCSFAIL, FCSFAIL);
++ MT7921_FILTER(FIF_CONTROL, CONTROL);
++ MT7921_FILTER(FIF_OTHER_BSS, OTHER_BSS);
+
+ mt7921_mutex_acquire(dev);
+- mt7921_mcu_set_rxfilter(dev, *total_flags, 0, 0);
++ mt7921_mcu_set_rxfilter(dev, flags, 0, 0);
+ mt7921_mutex_release(dev);
+
+ *total_flags &= (FIF_OTHER_BSS | FIF_FCSFAIL | FIF_CONTROL);
+--
+2.39.2
+
--- /dev/null
+From b1bb0d34d7feb3e4f8fbe9a34a9a40ce3c51b3bf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 18 Mar 2023 15:41:12 +0800
+Subject: wifi: mt76: mt7921e: fix probe timeout after reboot
+
+From: Quan Zhou <quan.zhou@mediatek.com>
+
+[ Upstream commit c397fc1e6365a2a9e5540a85b2c1d4ea412aa0e2 ]
+
+In system warm reboot scene, due to the polling timeout(now 1000us)
+is too short to wait dma idle in time, it may make driver probe fail
+with error code -ETIMEDOUT. Meanwhile, we also found the dma may take
+around 70ms to enter idle state. Change the polling idle timeout to
+100ms to avoid the probabilistic probe fail.
+
+Tested pass with 5000 times warm reboot on x86 platform.
+
+[4.477496] pci 0000:01:00.0: attach allowed to drvr mt7921e [internal device]
+[4.478306] mt7921e 0000:01:00.0: ASIC revision: 79610010
+[4.480063] mt7921e: probe of 0000:01:00.0 failed with error -110
+
+Fixes: 0a1059d0f060 ("mt76: mt7921: move mt7921_dma_reset in dma.c")
+Signed-off-by: Quan Zhou <quan.zhou@mediatek.com>
+Signed-off-by: Deren Wu <deren.wu@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7921/dma.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/dma.c b/drivers/net/wireless/mediatek/mt76/mt7921/dma.c
+index d1f10f6d9adc3..dc4ccfef4b048 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7921/dma.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7921/dma.c
+@@ -90,9 +90,9 @@ static int mt7921_dma_disable(struct mt7921_dev *dev, bool force)
+ MT_WFDMA0_GLO_CFG_OMIT_RX_INFO |
+ MT_WFDMA0_GLO_CFG_OMIT_RX_INFO_PFET2);
+
+- if (!mt76_poll(dev, MT_WFDMA0_GLO_CFG,
+- MT_WFDMA0_GLO_CFG_TX_DMA_BUSY |
+- MT_WFDMA0_GLO_CFG_RX_DMA_BUSY, 0, 1000))
++ if (!mt76_poll_msec_tick(dev, MT_WFDMA0_GLO_CFG,
++ MT_WFDMA0_GLO_CFG_TX_DMA_BUSY |
++ MT_WFDMA0_GLO_CFG_RX_DMA_BUSY, 0, 100, 1))
+ return -ETIMEDOUT;
+
+ return 0;
+--
+2.39.2
+
--- /dev/null
+From 03e5188ce7282c86313f7b994f4be454c0ebf4ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Apr 2023 05:11:13 +0800
+Subject: wifi: mt76: mt7921e: improve reliability of dma reset
+
+From: Quan Zhou <quan.zhou@mediatek.com>
+
+[ Upstream commit 87714bf6ed1589813e473db5471e6e9857755764 ]
+
+The hardware team has advised the driver that it is necessary to first put
+WFDMA into an idle state before resetting the WFDMA. Otherwise, the WFDMA
+may enter an unknown state where it cannot be polled with the right state
+successfully. To ensure that the DMA can work properly while a stressful
+cold reboot test was being made, we have reordered the programming sequence
+in the driver based on the hardware team's guidance.
+
+The patch would modify the WFDMA disabling flow from
+
+"DMA reset -> disabling DMASHDL -> disabling WFDMA -> polling and waiting
+until DMA idle" to "disabling WFDMA -> polling and waiting for DMA idle ->
+disabling DMASHDL -> DMA reset.
+
+Where he polling and waiting until WFDMA is idle is coordinated with the
+operation of disabling WFDMA. Even while WFDMA is being disabled, it can
+still handle Tx/Rx requests. The additional polling allows sufficient time
+for WFDMA to process the last T/Rx request. When the idle state of WFDMA is
+reached, it is a reliable indication that DMASHDL is also idle to ensure it
+is safe to disable it and perform the DMA reset.
+
+Fixes: 0a1059d0f060 ("mt76: mt7921: move mt7921_dma_reset in dma.c")
+Co-developed-by: Sean Wang <sean.wang@mediatek.com>
+Signed-off-by: Sean Wang <sean.wang@mediatek.com>
+Co-developed-by: Deren Wu <deren.wu@mediatek.com>
+Signed-off-by: Deren Wu <deren.wu@mediatek.com>
+Co-developed-by: Wang Zhao <wang.zhao@mediatek.com>
+Signed-off-by: Wang Zhao <wang.zhao@mediatek.com>
+Signed-off-by: Quan Zhou <quan.zhou@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/mediatek/mt76/mt7921/dma.c | 36 ++++++++++---------
+ 1 file changed, 20 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/dma.c b/drivers/net/wireless/mediatek/mt76/mt7921/dma.c
+index dc4ccfef4b048..fd57c87a29ae3 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7921/dma.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7921/dma.c
+@@ -66,22 +66,6 @@ static void mt7921_dma_prefetch(struct mt7921_dev *dev)
+
+ static int mt7921_dma_disable(struct mt7921_dev *dev, bool force)
+ {
+- if (force) {
+- /* reset */
+- mt76_clear(dev, MT_WFDMA0_RST,
+- MT_WFDMA0_RST_DMASHDL_ALL_RST |
+- MT_WFDMA0_RST_LOGIC_RST);
+-
+- mt76_set(dev, MT_WFDMA0_RST,
+- MT_WFDMA0_RST_DMASHDL_ALL_RST |
+- MT_WFDMA0_RST_LOGIC_RST);
+- }
+-
+- /* disable dmashdl */
+- mt76_clear(dev, MT_WFDMA0_GLO_CFG_EXT0,
+- MT_WFDMA0_CSR_TX_DMASHDL_ENABLE);
+- mt76_set(dev, MT_DMASHDL_SW_CONTROL, MT_DMASHDL_DMASHDL_BYPASS);
+-
+ /* disable WFDMA0 */
+ mt76_clear(dev, MT_WFDMA0_GLO_CFG,
+ MT_WFDMA0_GLO_CFG_TX_DMA_EN | MT_WFDMA0_GLO_CFG_RX_DMA_EN |
+@@ -95,6 +79,22 @@ static int mt7921_dma_disable(struct mt7921_dev *dev, bool force)
+ MT_WFDMA0_GLO_CFG_RX_DMA_BUSY, 0, 100, 1))
+ return -ETIMEDOUT;
+
++ /* disable dmashdl */
++ mt76_clear(dev, MT_WFDMA0_GLO_CFG_EXT0,
++ MT_WFDMA0_CSR_TX_DMASHDL_ENABLE);
++ mt76_set(dev, MT_DMASHDL_SW_CONTROL, MT_DMASHDL_DMASHDL_BYPASS);
++
++ if (force) {
++ /* reset */
++ mt76_clear(dev, MT_WFDMA0_RST,
++ MT_WFDMA0_RST_DMASHDL_ALL_RST |
++ MT_WFDMA0_RST_LOGIC_RST);
++
++ mt76_set(dev, MT_WFDMA0_RST,
++ MT_WFDMA0_RST_DMASHDL_ALL_RST |
++ MT_WFDMA0_RST_LOGIC_RST);
++ }
++
+ return 0;
+ }
+
+@@ -301,6 +301,10 @@ void mt7921_dma_cleanup(struct mt7921_dev *dev)
+ MT_WFDMA0_GLO_CFG_OMIT_RX_INFO |
+ MT_WFDMA0_GLO_CFG_OMIT_RX_INFO_PFET2);
+
++ mt76_poll_msec_tick(dev, MT_WFDMA0_GLO_CFG,
++ MT_WFDMA0_GLO_CFG_TX_DMA_BUSY |
++ MT_WFDMA0_GLO_CFG_RX_DMA_BUSY, 0, 100, 1);
++
+ /* reset */
+ mt76_clear(dev, MT_WFDMA0_RST,
+ MT_WFDMA0_RST_DMASHDL_ALL_RST |
+--
+2.39.2
+
--- /dev/null
+From e9130d12052dbef76fefcc085c595cbbb5f955dd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Apr 2023 05:11:14 +0800
+Subject: wifi: mt76: mt7921e: stop chip reset worker in unregister hook
+
+From: Quan Zhou <quan.zhou@mediatek.com>
+
+[ Upstream commit 3d78c46423c6567ed25ca033e086865b1b4d5ae1 ]
+
+If the chip reset worker is triggered during the remove process, the chip
+DMA may not be properly pushed back to the idle state. This can lead to
+corruption of the DMA flow due to the chip reset. Therefore, it is
+necessary to stop the chip reset before the DMA is finalized.
+
+To avoid resetting the chip after the reset worker is cancelled, use
+__mt7921_mcu_drv_pmctrl() instead of mt7921_mcu_drv_pmctrl(). It is safe to
+ignore the pm mutex because the pm worker and wake worker have already been
+cancelled.
+
+Fixes: 033ae79b3830 ("mt76: mt7921: refactor init.c to be bus independent")
+Co-developed-by: Sean Wang <sean.wang@mediatek.com>
+Signed-off-by: Sean Wang <sean.wang@mediatek.com>
+Co-developed-by: Deren Wu <deren.wu@mediatek.com>
+Signed-off-by: Deren Wu <deren.wu@mediatek.com>
+Co-developed-by: Wang Zhao <wang.zhao@mediatek.com>
+Signed-off-by: Wang Zhao <wang.zhao@mediatek.com>
+Signed-off-by: Quan Zhou <quan.zhou@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7921/pci.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/pci.c b/drivers/net/wireless/mediatek/mt76/mt7921/pci.c
+index bda92d8359692..aa4ecf008a3c9 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7921/pci.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7921/pci.c
+@@ -115,9 +115,10 @@ static void mt7921e_unregister_device(struct mt7921_dev *dev)
+ napi_disable(&dev->mt76.napi[i]);
+ cancel_delayed_work_sync(&pm->ps_work);
+ cancel_work_sync(&pm->wake_work);
++ cancel_work_sync(&dev->reset_work);
+
+ mt7921_tx_token_put(dev);
+- mt7921_mcu_drv_pmctrl(dev);
++ __mt7921_mcu_drv_pmctrl(dev);
+ mt7921_dma_cleanup(dev);
+ mt7921_wfsys_reset(dev);
+ skb_queue_purge(&dev->mt76.mcu.res_q);
+--
+2.39.2
+
--- /dev/null
+From 56fa9b0fe86b41d45a17ecd2e6336022b0075678 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Apr 2023 13:58:40 +0800
+Subject: wifi: mt76: mt7996: fill txd by host driver
+
+From: Ryder Lee <ryder.lee@mediatek.com>
+
+[ Upstream commit 3b522cadedfe6e9e0e8193d7d4ab5aa8d0c73209 ]
+
+The hardware SDO has issue to fill txd for the moment, so fallback to
+driver filling method.
+
+Fixes: 98686cd21624 (wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices)
+Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7996/mac.c | 13 ++++---------
+ 1 file changed, 4 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
+index 6a635b03a602b..1a715d01b0a3b 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
+@@ -1120,11 +1120,8 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+ return id;
+
+ pid = mt76_tx_status_skb_add(mdev, wcid, tx_info->skb);
+- memset(txwi_ptr, 0, MT_TXD_SIZE);
+- /* Transmit non qos data by 802.11 header and need to fill txd by host*/
+- if (!is_8023 || pid >= MT_PACKET_ID_FIRST)
+- mt7996_mac_write_txwi(dev, txwi_ptr, tx_info->skb, wcid, key,
+- pid, qid, 0);
++ mt7996_mac_write_txwi(dev, txwi_ptr, tx_info->skb, wcid, key,
++ pid, qid, 0);
+
+ txp = (struct mt76_connac_txp_common *)(txwi + MT_TXD_SIZE);
+ for (i = 0; i < nbuf; i++) {
+@@ -1133,10 +1130,8 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+ }
+ txp->fw.nbuf = nbuf;
+
+- txp->fw.flags = cpu_to_le16(MT_CT_INFO_FROM_HOST);
+-
+- if (!is_8023 || pid >= MT_PACKET_ID_FIRST)
+- txp->fw.flags |= cpu_to_le16(MT_CT_INFO_APPLY_TXD);
++ txp->fw.flags =
++ cpu_to_le16(MT_CT_INFO_FROM_HOST | MT_CT_INFO_APPLY_TXD);
+
+ if (!key)
+ txp->fw.flags |= cpu_to_le16(MT_CT_INFO_NONE_CIPHER_FRAME);
+--
+2.39.2
+
--- /dev/null
+From 7a720652094875dcaf444c4c164e708bc9349bd7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Mar 2023 16:35:58 +0800
+Subject: wifi: mt76: mt7996: fix eeprom tx path bitfields
+
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+
+[ Upstream commit 72fc0df3006ce5c109f9c68f0724e44c47b4ec7b ]
+
+Swap the tx path bitfields of band1 and band2 to read correct setting.
+
+Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7996/eeprom.h | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/eeprom.h b/drivers/net/wireless/mediatek/mt76/mt7996/eeprom.h
+index 8da599e0abeac..cfc48698539b3 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/eeprom.h
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/eeprom.h
+@@ -31,11 +31,11 @@ enum mt7996_eeprom_field {
+ #define MT_EE_WIFI_CONF2_BAND_SEL GENMASK(2, 0)
+
+ #define MT_EE_WIFI_CONF1_TX_PATH_BAND0 GENMASK(5, 3)
+-#define MT_EE_WIFI_CONF2_TX_PATH_BAND1 GENMASK(5, 3)
+-#define MT_EE_WIFI_CONF2_TX_PATH_BAND2 GENMASK(2, 0)
++#define MT_EE_WIFI_CONF2_TX_PATH_BAND1 GENMASK(2, 0)
++#define MT_EE_WIFI_CONF2_TX_PATH_BAND2 GENMASK(5, 3)
+ #define MT_EE_WIFI_CONF4_STREAM_NUM_BAND0 GENMASK(5, 3)
+-#define MT_EE_WIFI_CONF5_STREAM_NUM_BAND1 GENMASK(5, 3)
+-#define MT_EE_WIFI_CONF5_STREAM_NUM_BAND2 GENMASK(2, 0)
++#define MT_EE_WIFI_CONF5_STREAM_NUM_BAND1 GENMASK(2, 0)
++#define MT_EE_WIFI_CONF5_STREAM_NUM_BAND2 GENMASK(5, 3)
+
+ #define MT_EE_RATE_DELTA_MASK GENMASK(5, 0)
+ #define MT_EE_RATE_DELTA_SIGN BIT(6)
+--
+2.39.2
+
--- /dev/null
+From 561a374cc04c1b6080d20f40d6864f9415356eef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Mar 2023 16:35:55 +0800
+Subject: wifi: mt76: mt7996: fix pointer calculation in ie countdown event
+
+From: Peter Chiu <chui-hao.chiu@mediatek.com>
+
+[ Upstream commit 8b14ce24a0297175bc4ebdf26d45a22b5a33847f ]
+
+Fix the tail and data pointers. The rxd->len in mt7996_mcu_rxd does not
+include the length of general rxd. It only includes the length of
+firmware event rxd. Use skb->length to get the correct length.
+
+Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
+Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
+Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
+index 954e581f863ce..9ad6c889549c5 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
+@@ -422,7 +422,8 @@ mt7996_mcu_ie_countdown(struct mt7996_dev *dev, struct sk_buff *skb)
+ if (hdr->band && dev->mt76.phys[hdr->band])
+ mphy = dev->mt76.phys[hdr->band];
+
+- tail = skb->data + le16_to_cpu(rxd->len);
++ tail = skb->data + skb->len;
++ data += sizeof(struct header);
+ while (data + sizeof(struct tlv) < tail && le16_to_cpu(tlv->len)) {
+ switch (le16_to_cpu(tlv->tag)) {
+ case UNI_EVENT_IE_COUNTDOWN_CSA:
+--
+2.39.2
+
--- /dev/null
+From 5c0d53789ec92e8f5ff734600ce10c68f7b3654d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 18 Feb 2023 01:46:54 +0800
+Subject: wifi: mt76: mt7996: fix radiotap bitfield
+
+From: Ryder Lee <ryder.lee@mediatek.com>
+
+[ Upstream commit 63a3724632464559d1e98d90d2c63d43ec6ef6f5 ]
+
+The 11be generation's radiotap bitfields were wrongly copy-and-pasted
+from 11ax driver, so fix them accordingly.
+
+Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
+Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/mediatek/mt76/mt7996/mac.c | 54 ++++++++++---------
+ .../net/wireless/mediatek/mt76/mt7996/mac.h | 41 +++++++-------
+ 2 files changed, 47 insertions(+), 48 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
+index c9a9f0e317716..3c3506c7c87af 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
+@@ -260,12 +260,9 @@ mt7996_mac_decode_he_radiotap_ru(struct mt76_rx_status *status,
+ struct ieee80211_radiotap_he *he,
+ __le32 *rxv)
+ {
+- u32 ru_h, ru_l;
+- u8 ru, offs = 0;
++ u32 ru, offs = 0;
+
+- ru_l = le32_get_bits(rxv[0], MT_PRXV_HE_RU_ALLOC_L);
+- ru_h = le32_get_bits(rxv[1], MT_PRXV_HE_RU_ALLOC_H);
+- ru = (u8)(ru_l | ru_h << 4);
++ ru = le32_get_bits(rxv[0], MT_PRXV_HE_RU_ALLOC);
+
+ status->bw = RATE_INFO_BW_HE_RU;
+
+@@ -330,18 +327,23 @@ mt7996_mac_decode_he_mu_radiotap(struct sk_buff *skb, __le32 *rxv)
+
+ he_mu->flags2 |= MU_PREP(FLAGS2_BW_FROM_SIG_A_BW, status->bw) |
+ MU_PREP(FLAGS2_SIG_B_SYMS_USERS,
+- le32_get_bits(rxv[2], MT_CRXV_HE_NUM_USER));
++ le32_get_bits(rxv[4], MT_CRXV_HE_NUM_USER));
+
+- he_mu->ru_ch1[0] = le32_get_bits(rxv[3], MT_CRXV_HE_RU0);
++ he_mu->ru_ch1[0] = le32_get_bits(rxv[16], MT_CRXV_HE_RU0) & 0xff;
+
+ if (status->bw >= RATE_INFO_BW_40) {
+ he_mu->flags1 |= HE_BITS(MU_FLAGS1_CH2_RU_KNOWN);
+- he_mu->ru_ch2[0] = le32_get_bits(rxv[3], MT_CRXV_HE_RU1);
++ he_mu->ru_ch2[0] = le32_get_bits(rxv[16], MT_CRXV_HE_RU1) & 0xff;
+ }
+
+ if (status->bw >= RATE_INFO_BW_80) {
+- he_mu->ru_ch1[1] = le32_get_bits(rxv[3], MT_CRXV_HE_RU2);
+- he_mu->ru_ch2[1] = le32_get_bits(rxv[3], MT_CRXV_HE_RU3);
++ u32 ru_h, ru_l;
++
++ he_mu->ru_ch1[1] = le32_get_bits(rxv[16], MT_CRXV_HE_RU2) & 0xff;
++
++ ru_l = le32_get_bits(rxv[16], MT_CRXV_HE_RU3_L);
++ ru_h = le32_get_bits(rxv[17], MT_CRXV_HE_RU3_H) & 0x7;
++ he_mu->ru_ch2[1] = (u8)(ru_l | ru_h << 4);
+ }
+ }
+
+@@ -364,23 +366,23 @@ mt7996_mac_decode_he_radiotap(struct sk_buff *skb, __le32 *rxv, u8 mode)
+ HE_BITS(DATA2_TXOP_KNOWN),
+ };
+ struct ieee80211_radiotap_he *he = NULL;
+- u32 ltf_size = le32_get_bits(rxv[2], MT_CRXV_HE_LTF_SIZE) + 1;
++ u32 ltf_size = le32_get_bits(rxv[4], MT_CRXV_HE_LTF_SIZE) + 1;
+
+ status->flag |= RX_FLAG_RADIOTAP_HE;
+
+ he = skb_push(skb, sizeof(known));
+ memcpy(he, &known, sizeof(known));
+
+- he->data3 = HE_PREP(DATA3_BSS_COLOR, BSS_COLOR, rxv[14]) |
+- HE_PREP(DATA3_LDPC_XSYMSEG, LDPC_EXT_SYM, rxv[2]);
+- he->data4 = HE_PREP(DATA4_SU_MU_SPTL_REUSE, SR_MASK, rxv[11]);
+- he->data5 = HE_PREP(DATA5_PE_DISAMBIG, PE_DISAMBIG, rxv[2]) |
++ he->data3 = HE_PREP(DATA3_BSS_COLOR, BSS_COLOR, rxv[9]) |
++ HE_PREP(DATA3_LDPC_XSYMSEG, LDPC_EXT_SYM, rxv[4]);
++ he->data4 = HE_PREP(DATA4_SU_MU_SPTL_REUSE, SR_MASK, rxv[13]);
++ he->data5 = HE_PREP(DATA5_PE_DISAMBIG, PE_DISAMBIG, rxv[5]) |
+ le16_encode_bits(ltf_size,
+ IEEE80211_RADIOTAP_HE_DATA5_LTF_SIZE);
+ if (le32_to_cpu(rxv[0]) & MT_PRXV_TXBF)
+ he->data5 |= HE_BITS(DATA5_TXBF);
+- he->data6 = HE_PREP(DATA6_TXOP, TXOP_DUR, rxv[14]) |
+- HE_PREP(DATA6_DOPPLER, DOPPLER, rxv[14]);
++ he->data6 = HE_PREP(DATA6_TXOP, TXOP_DUR, rxv[9]) |
++ HE_PREP(DATA6_DOPPLER, DOPPLER, rxv[9]);
+
+ switch (mode) {
+ case MT_PHY_TYPE_HE_SU:
+@@ -389,22 +391,22 @@ mt7996_mac_decode_he_radiotap(struct sk_buff *skb, __le32 *rxv, u8 mode)
+ HE_BITS(DATA1_BEAM_CHANGE_KNOWN) |
+ HE_BITS(DATA1_BW_RU_ALLOC_KNOWN);
+
+- he->data3 |= HE_PREP(DATA3_BEAM_CHANGE, BEAM_CHNG, rxv[14]) |
+- HE_PREP(DATA3_UL_DL, UPLINK, rxv[2]);
++ he->data3 |= HE_PREP(DATA3_BEAM_CHANGE, BEAM_CHNG, rxv[8]) |
++ HE_PREP(DATA3_UL_DL, UPLINK, rxv[5]);
+ break;
+ case MT_PHY_TYPE_HE_EXT_SU:
+ he->data1 |= HE_BITS(DATA1_FORMAT_EXT_SU) |
+ HE_BITS(DATA1_UL_DL_KNOWN) |
+ HE_BITS(DATA1_BW_RU_ALLOC_KNOWN);
+
+- he->data3 |= HE_PREP(DATA3_UL_DL, UPLINK, rxv[2]);
++ he->data3 |= HE_PREP(DATA3_UL_DL, UPLINK, rxv[5]);
+ break;
+ case MT_PHY_TYPE_HE_MU:
+ he->data1 |= HE_BITS(DATA1_FORMAT_MU) |
+ HE_BITS(DATA1_UL_DL_KNOWN);
+
+- he->data3 |= HE_PREP(DATA3_UL_DL, UPLINK, rxv[2]);
+- he->data4 |= HE_PREP(DATA4_MU_STA_ID, MU_AID, rxv[7]);
++ he->data3 |= HE_PREP(DATA3_UL_DL, UPLINK, rxv[5]);
++ he->data4 |= HE_PREP(DATA4_MU_STA_ID, MU_AID, rxv[8]);
+
+ mt7996_mac_decode_he_radiotap_ru(status, he, rxv);
+ mt7996_mac_decode_he_mu_radiotap(skb, rxv);
+@@ -415,10 +417,10 @@ mt7996_mac_decode_he_radiotap(struct sk_buff *skb, __le32 *rxv, u8 mode)
+ HE_BITS(DATA1_SPTL_REUSE3_KNOWN) |
+ HE_BITS(DATA1_SPTL_REUSE4_KNOWN);
+
+- he->data4 |= HE_PREP(DATA4_TB_SPTL_REUSE1, SR_MASK, rxv[11]) |
+- HE_PREP(DATA4_TB_SPTL_REUSE2, SR1_MASK, rxv[11]) |
+- HE_PREP(DATA4_TB_SPTL_REUSE3, SR2_MASK, rxv[11]) |
+- HE_PREP(DATA4_TB_SPTL_REUSE4, SR3_MASK, rxv[11]);
++ he->data4 |= HE_PREP(DATA4_TB_SPTL_REUSE1, SR_MASK, rxv[13]) |
++ HE_PREP(DATA4_TB_SPTL_REUSE2, SR1_MASK, rxv[13]) |
++ HE_PREP(DATA4_TB_SPTL_REUSE3, SR2_MASK, rxv[13]) |
++ HE_PREP(DATA4_TB_SPTL_REUSE4, SR3_MASK, rxv[13]);
+
+ mt7996_mac_decode_he_radiotap_ru(status, he, rxv);
+ break;
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mac.h b/drivers/net/wireless/mediatek/mt76/mt7996/mac.h
+index 27184cbac619b..2cc218f735d88 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/mac.h
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mac.h
+@@ -102,8 +102,7 @@ enum rx_pkt_type {
+ #define MT_PRXV_NSTS GENMASK(10, 7)
+ #define MT_PRXV_TXBF BIT(11)
+ #define MT_PRXV_HT_AD_CODE BIT(12)
+-#define MT_PRXV_HE_RU_ALLOC_L GENMASK(31, 28)
+-#define MT_PRXV_HE_RU_ALLOC_H GENMASK(3, 0)
++#define MT_PRXV_HE_RU_ALLOC GENMASK(30, 22)
+ #define MT_PRXV_RCPI3 GENMASK(31, 24)
+ #define MT_PRXV_RCPI2 GENMASK(23, 16)
+ #define MT_PRXV_RCPI1 GENMASK(15, 8)
+@@ -113,34 +112,32 @@ enum rx_pkt_type {
+ #define MT_PRXV_TX_MODE GENMASK(14, 11)
+ #define MT_PRXV_FRAME_MODE GENMASK(2, 0)
+ #define MT_PRXV_DCM BIT(5)
+-#define MT_PRXV_NUM_RX BIT(8, 6)
+
+ /* C-RXV */
+-#define MT_CRXV_HT_STBC GENMASK(1, 0)
+-#define MT_CRXV_TX_MODE GENMASK(7, 4)
+-#define MT_CRXV_FRAME_MODE GENMASK(10, 8)
+-#define MT_CRXV_HT_SHORT_GI GENMASK(14, 13)
+-#define MT_CRXV_HE_LTF_SIZE GENMASK(18, 17)
+-#define MT_CRXV_HE_LDPC_EXT_SYM BIT(20)
+-#define MT_CRXV_HE_PE_DISAMBIG BIT(23)
+-#define MT_CRXV_HE_NUM_USER GENMASK(30, 24)
+-#define MT_CRXV_HE_UPLINK BIT(31)
+-#define MT_CRXV_HE_RU0 GENMASK(7, 0)
+-#define MT_CRXV_HE_RU1 GENMASK(15, 8)
+-#define MT_CRXV_HE_RU2 GENMASK(23, 16)
+-#define MT_CRXV_HE_RU3 GENMASK(31, 24)
+-
+-#define MT_CRXV_HE_MU_AID GENMASK(30, 20)
++#define MT_CRXV_HE_NUM_USER GENMASK(26, 20)
++#define MT_CRXV_HE_LTF_SIZE GENMASK(28, 27)
++#define MT_CRXV_HE_LDPC_EXT_SYM BIT(30)
++
++#define MT_CRXV_HE_PE_DISAMBIG BIT(1)
++#define MT_CRXV_HE_UPLINK BIT(2)
++
++#define MT_CRXV_HE_MU_AID GENMASK(27, 17)
++#define MT_CRXV_HE_BEAM_CHNG BIT(29)
++
++#define MT_CRXV_HE_DOPPLER BIT(0)
++#define MT_CRXV_HE_BSS_COLOR GENMASK(15, 10)
++#define MT_CRXV_HE_TXOP_DUR GENMASK(19, 17)
+
+ #define MT_CRXV_HE_SR_MASK GENMASK(11, 8)
+ #define MT_CRXV_HE_SR1_MASK GENMASK(16, 12)
+ #define MT_CRXV_HE_SR2_MASK GENMASK(20, 17)
+ #define MT_CRXV_HE_SR3_MASK GENMASK(24, 21)
+
+-#define MT_CRXV_HE_BSS_COLOR GENMASK(5, 0)
+-#define MT_CRXV_HE_TXOP_DUR GENMASK(12, 6)
+-#define MT_CRXV_HE_BEAM_CHNG BIT(13)
+-#define MT_CRXV_HE_DOPPLER BIT(16)
++#define MT_CRXV_HE_RU0 GENMASK(8, 0)
++#define MT_CRXV_HE_RU1 GENMASK(17, 9)
++#define MT_CRXV_HE_RU2 GENMASK(26, 18)
++#define MT_CRXV_HE_RU3_L GENMASK(31, 27)
++#define MT_CRXV_HE_RU3_H GENMASK(3, 0)
+
+ enum tx_header_format {
+ MT_HDR_FORMAT_802_3,
+--
+2.39.2
+
--- /dev/null
+From e4e7180214c71f2a91ad9fb6589f960cde87de2c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Mar 2023 16:35:53 +0800
+Subject: wifi: mt76: mt7996: let non-bufferable MMPDUs use correct hw queue
+
+From: Shayne Chen <shayne.chen@mediatek.com>
+
+[ Upstream commit d0b6f86fdbefa62fd4ad2acd1aea6c45f9b518ba ]
+
+Pass qid into mt7996_mac_write_txwi() to let the tx descriptor of
+non-bufferable MMPDUs be filled with correct hw queue index.
+
+Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
+Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7996/mac.c | 11 ++++++-----
+ drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 6 +++---
+ drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h | 5 +++--
+ 3 files changed, 12 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
+index 3c3506c7c87af..6a635b03a602b 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
+@@ -981,8 +981,9 @@ mt7996_mac_write_txwi_80211(struct mt7996_dev *dev, __le32 *txwi,
+ }
+
+ void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi,
+- struct sk_buff *skb, struct mt76_wcid *wcid, int pid,
+- struct ieee80211_key_conf *key, u32 changed)
++ struct sk_buff *skb, struct mt76_wcid *wcid,
++ struct ieee80211_key_conf *key, int pid,
++ enum mt76_txq_id qid, u32 changed)
+ {
+ struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+ struct ieee80211_vif *vif = info->control.vif;
+@@ -1013,7 +1014,7 @@ void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi,
+ } else if (beacon) {
+ p_fmt = MT_TX_TYPE_FW;
+ q_idx = MT_LMAC_BCN0;
+- } else if (skb_get_queue_mapping(skb) >= MT_TXQ_PSD) {
++ } else if (qid >= MT_TXQ_PSD) {
+ p_fmt = MT_TX_TYPE_CT;
+ q_idx = MT_LMAC_ALTX0;
+ } else {
+@@ -1122,8 +1123,8 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+ memset(txwi_ptr, 0, MT_TXD_SIZE);
+ /* Transmit non qos data by 802.11 header and need to fill txd by host*/
+ if (!is_8023 || pid >= MT_PACKET_ID_FIRST)
+- mt7996_mac_write_txwi(dev, txwi_ptr, tx_info->skb, wcid, pid,
+- key, 0);
++ mt7996_mac_write_txwi(dev, txwi_ptr, tx_info->skb, wcid, key,
++ pid, qid, 0);
+
+ txp = (struct mt76_connac_txp_common *)(txwi + MT_TXD_SIZE);
+ for (i = 0; i < nbuf; i++) {
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
+index dbe30832fd88b..954e581f863ce 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
+@@ -1906,8 +1906,9 @@ mt7996_mcu_beacon_cont(struct mt7996_dev *dev, struct ieee80211_vif *vif,
+ }
+
+ buf = (u8 *)bcn + sizeof(*bcn) - MAX_BEACON_SIZE;
+- mt7996_mac_write_txwi(dev, (__le32 *)buf, skb, wcid, 0, NULL,
++ mt7996_mac_write_txwi(dev, (__le32 *)buf, skb, wcid, NULL, 0, 0,
+ BSS_CHANGED_BEACON);
++
+ memcpy(buf + MT_TXD_SIZE, skb->data, skb->len);
+ }
+
+@@ -2115,8 +2116,7 @@ int mt7996_mcu_beacon_inband_discov(struct mt7996_dev *dev,
+
+ buf = (u8 *)tlv + sizeof(*discov) - MAX_INBAND_FRAME_SIZE;
+
+- mt7996_mac_write_txwi(dev, (__le32 *)buf, skb, wcid, 0, NULL,
+- changed);
++ mt7996_mac_write_txwi(dev, (__le32 *)buf, skb, wcid, NULL, 0, 0, changed);
+
+ memcpy(buf + MT_TXD_SIZE, skb->data, skb->len);
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
+index 018dfd2b36b00..ae1210b0a82cd 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
+@@ -487,8 +487,9 @@ void mt7996_mac_enable_nf(struct mt7996_dev *dev, u8 band);
+ void mt7996_mac_enable_rtscts(struct mt7996_dev *dev,
+ struct ieee80211_vif *vif, bool enable);
+ void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi,
+- struct sk_buff *skb, struct mt76_wcid *wcid, int pid,
+- struct ieee80211_key_conf *key, u32 changed);
++ struct sk_buff *skb, struct mt76_wcid *wcid,
++ struct ieee80211_key_conf *key, int pid,
++ enum mt76_txq_id qid, u32 changed);
+ void mt7996_mac_set_timing(struct mt7996_phy *phy);
+ int mt7996_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+ struct ieee80211_sta *sta);
+--
+2.39.2
+
--- /dev/null
+From d0262a31798222f4024b8ab89584a3f9acb03b55 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 4 Feb 2023 14:53:04 +0800
+Subject: wifi: mt76: remove redundent MCU_UNI_CMD_* definitions
+
+From: Deren Wu <deren.wu@mediatek.com>
+
+[ Upstream commit 532f0482fc577a78c0086893ab39acb406ac3e65 ]
+
+clear redundent definitions only
+
+Fixes: 5b55b6da982c ("wifi: mt76: mt7921: add unified ROC cmd/event support")
+Signed-off-by: Deren Wu <deren.wu@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h
+index a5e6ee4daf92e..40a99e0caded8 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h
++++ b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h
+@@ -967,9 +967,6 @@ enum {
+ DEV_INFO_MAX_NUM
+ };
+
+-#define MCU_UNI_CMD_EVENT BIT(1)
+-#define MCU_UNI_CMD_UNSOLICITED_EVENT BIT(2)
+-
+ /* event table */
+ enum {
+ MCU_EVENT_TARGET_ADDRESS_LEN = 0x01,
+--
+2.39.2
+
--- /dev/null
+From 2f1368c10851e45b02c7b5923ff0954ef06aa18c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Mar 2023 23:56:37 +0200
+Subject: wifi: rt2x00: Fix memory leak when handling surveys
+
+From: Armin Wolf <W_Armin@gmx.de>
+
+[ Upstream commit cbef9a83c51dfcb07f77cfa6ac26f53a1ea86f49 ]
+
+When removing a rt2x00 device, its associated channel surveys
+are not freed, causing a memory leak observable with kmemleak:
+
+unreferenced object 0xffff9620f0881a00 (size 512):
+ comm "systemd-udevd", pid 2290, jiffies 4294906974 (age 33.768s)
+ hex dump (first 32 bytes):
+ 70 44 12 00 00 00 00 00 92 8a 00 00 00 00 00 00 pD..............
+ 00 00 00 00 00 00 00 00 ab 87 01 00 00 00 00 00 ................
+ backtrace:
+ [<ffffffffb0ed858b>] __kmalloc+0x4b/0x130
+ [<ffffffffc1b0f29b>] rt2800_probe_hw+0xc2b/0x1380 [rt2800lib]
+ [<ffffffffc1a9496e>] rt2800usb_probe_hw+0xe/0x60 [rt2800usb]
+ [<ffffffffc1ae491a>] rt2x00lib_probe_dev+0x21a/0x7d0 [rt2x00lib]
+ [<ffffffffc1b3b83e>] rt2x00usb_probe+0x1be/0x980 [rt2x00usb]
+ [<ffffffffc05981e2>] usb_probe_interface+0xe2/0x310 [usbcore]
+ [<ffffffffb13be2d5>] really_probe+0x1a5/0x410
+ [<ffffffffb13be5c8>] __driver_probe_device+0x78/0x180
+ [<ffffffffb13be6fe>] driver_probe_device+0x1e/0x90
+ [<ffffffffb13be972>] __driver_attach+0xd2/0x1c0
+ [<ffffffffb13bbc57>] bus_for_each_dev+0x77/0xd0
+ [<ffffffffb13bd2a2>] bus_add_driver+0x112/0x210
+ [<ffffffffb13bfc6c>] driver_register+0x5c/0x120
+ [<ffffffffc0596ae8>] usb_register_driver+0x88/0x150 [usbcore]
+ [<ffffffffb0c011c4>] do_one_initcall+0x44/0x220
+ [<ffffffffb0d6134c>] do_init_module+0x4c/0x220
+
+Fix this by freeing the channel surveys on device removal.
+
+Tested with a RT3070 based USB wireless adapter.
+
+Fixes: 5447626910f5 ("rt2x00: save survey for every channel visited")
+Signed-off-by: Armin Wolf <W_Armin@gmx.de>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20230330215637.4332-1-W_Armin@gmx.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ralink/rt2x00/rt2x00dev.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
+index 3a035afcf7f99..9a9cfd0ce402d 100644
+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
+@@ -1091,6 +1091,7 @@ static void rt2x00lib_remove_hw(struct rt2x00_dev *rt2x00dev)
+ }
+
+ kfree(rt2x00dev->spec.channels_info);
++ kfree(rt2x00dev->chan_survey);
+ }
+
+ static const struct ieee80211_tpt_blink rt2x00_tpt_blink[] = {
+--
+2.39.2
+
--- /dev/null
+From aa89d5f021c945bddbe9aacb853dbcf4e2f26570 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Feb 2023 20:49:12 +0200
+Subject: wifi: rtl8xxxu: Remove always true condition in
+ rtl8xxxu_print_chipinfo
+
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+
+[ Upstream commit b9b1e4fe2957f361c86e288ecf373dc7895cf7c7 ]
+
+Fix a new smatch warning:
+drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c:1580 rtl8xxxu_print_chipinfo() warn: always true condition '(priv->chip_cut <= 15) => (0-15 <= 15)'
+
+Reported-by: kernel test robot <lkp@intel.com>
+Link: https://lore.kernel.org/oe-kbuild-all/202302140753.71IgU77A-lkp@intel.com/
+Fixes: 7b0ac469e331 ("wifi: rtl8xxxu: Recognise all possible chip cuts")
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Reviewed-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/68eff98b-a022-5a00-f330-adf623a35772@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
+index 620a5cc2bfdd1..54ca6f2ced3f3 100644
+--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
+@@ -1575,11 +1575,7 @@ rtl8xxxu_set_spec_sifs(struct rtl8xxxu_priv *priv, u16 cck, u16 ofdm)
+ static void rtl8xxxu_print_chipinfo(struct rtl8xxxu_priv *priv)
+ {
+ struct device *dev = &priv->udev->dev;
+- char cut = '?';
+-
+- /* Currently always true: chip_cut is 4 bits. */
+- if (priv->chip_cut <= 15)
+- cut = 'A' + priv->chip_cut;
++ char cut = 'A' + priv->chip_cut;
+
+ dev_info(dev,
+ "RTL%s rev %c (%s) romver %d, %iT%iR, TX queues %i, WiFi=%i, BT=%i, GPS=%i, HI PA=%i\n",
+--
+2.39.2
+
--- /dev/null
+From 134ab91d12c6d3a86f006c149ef4f697520bf79d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 26 Mar 2023 05:31:38 +0000
+Subject: wifi: rtlwifi: fix incorrect error codes in
+ rtl_debugfs_set_write_rfreg()
+
+From: Wei Chen <harperchen1110@gmail.com>
+
+[ Upstream commit 905a9241e4e8c15d2c084fee916280514848fe35 ]
+
+If there is a failure during copy_from_user or user-provided data buffer
+is invalid, rtl_debugfs_set_write_rfreg should return negative error code
+instead of a positive value count.
+
+Fix this bug by returning correct error code. Moreover, the check of buffer
+against null is removed since it will be handled by copy_from_user.
+
+Fixes: 610247f46feb ("rtlwifi: Improve debugging by using debugfs")
+Signed-off-by: Wei Chen <harperchen1110@gmail.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20230326053138.91338-1-harperchen1110@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtlwifi/debug.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/debug.c b/drivers/net/wireless/realtek/rtlwifi/debug.c
+index 0b1bc04cb6adb..602717928887d 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/debug.c
++++ b/drivers/net/wireless/realtek/rtlwifi/debug.c
+@@ -375,8 +375,8 @@ static ssize_t rtl_debugfs_set_write_rfreg(struct file *filp,
+
+ tmp_len = (count > sizeof(tmp) - 1 ? sizeof(tmp) - 1 : count);
+
+- if (!buffer || copy_from_user(tmp, buffer, tmp_len))
+- return count;
++ if (copy_from_user(tmp, buffer, tmp_len))
++ return -EFAULT;
+
+ tmp[tmp_len] = '\0';
+
+@@ -386,7 +386,7 @@ static ssize_t rtl_debugfs_set_write_rfreg(struct file *filp,
+ if (num != 4) {
+ rtl_dbg(rtlpriv, COMP_ERR, DBG_DMESG,
+ "Format is <path> <addr> <mask> <data>\n");
+- return count;
++ return -EINVAL;
+ }
+
+ rtl_set_rfreg(hw, path, addr, bitmask, data);
+--
+2.39.2
+
--- /dev/null
+From 3abfdb5e84990399c19386fbe4306a838fbd526d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 26 Mar 2023 05:42:17 +0000
+Subject: wifi: rtlwifi: fix incorrect error codes in
+ rtl_debugfs_set_write_reg()
+
+From: Wei Chen <harperchen1110@gmail.com>
+
+[ Upstream commit 5dbe1f8eb8c5ac69394400a5b86fd81775e96c43 ]
+
+If there is a failure during copy_from_user or user-provided data buffer is
+invalid, rtl_debugfs_set_write_reg should return negative error code instead
+of a positive value count.
+
+Fix this bug by returning correct error code. Moreover, the check of buffer
+against null is removed since it will be handled by copy_from_user.
+
+Fixes: 610247f46feb ("rtlwifi: Improve debugging by using debugfs")
+Signed-off-by: Wei Chen <harperchen1110@gmail.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20230326054217.93492-1-harperchen1110@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtlwifi/debug.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/debug.c b/drivers/net/wireless/realtek/rtlwifi/debug.c
+index 602717928887d..9eb26dfe4ca92 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/debug.c
++++ b/drivers/net/wireless/realtek/rtlwifi/debug.c
+@@ -278,8 +278,8 @@ static ssize_t rtl_debugfs_set_write_reg(struct file *filp,
+
+ tmp_len = (count > sizeof(tmp) - 1 ? sizeof(tmp) - 1 : count);
+
+- if (!buffer || copy_from_user(tmp, buffer, tmp_len))
+- return count;
++ if (copy_from_user(tmp, buffer, tmp_len))
++ return -EFAULT;
+
+ tmp[tmp_len] = '\0';
+
+@@ -287,7 +287,7 @@ static ssize_t rtl_debugfs_set_write_reg(struct file *filp,
+ num = sscanf(tmp, "%x %x %x", &addr, &val, &len);
+
+ if (num != 3)
+- return count;
++ return -EINVAL;
+
+ switch (len) {
+ case 1:
+--
+2.39.2
+
--- /dev/null
+From c0f5958b68cd3782efba451b9613359ebc653fba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 26 Feb 2023 23:10:04 +0100
+Subject: wifi: rtw88: mac: Return the original error from
+ rtw_mac_power_switch()
+
+From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+
+[ Upstream commit 15c8e267dfa62f207ee1db666c822324e3362b84 ]
+
+rtw_mac_power_switch() calls rtw_pwr_seq_parser() which can return
+-EINVAL, -EBUSY or 0. Propagate the original error code instead of
+unconditionally returning -EINVAL in case of an error.
+
+Fixes: e3037485c68e ("rtw88: new Realtek 802.11ac driver")
+Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Reviewed-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20230226221004.138331-3-martin.blumenstingl@googlemail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw88/mac.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw88/mac.c b/drivers/net/wireless/realtek/rtw88/mac.c
+index 663907c38327f..eda05a5d9cffd 100644
+--- a/drivers/net/wireless/realtek/rtw88/mac.c
++++ b/drivers/net/wireless/realtek/rtw88/mac.c
+@@ -247,6 +247,7 @@ static int rtw_mac_power_switch(struct rtw_dev *rtwdev, bool pwr_on)
+ const struct rtw_pwr_seq_cmd **pwr_seq;
+ u8 rpwm;
+ bool cur_pwr;
++ int ret;
+
+ if (rtw_chip_wcpu_11ac(rtwdev)) {
+ rpwm = rtw_read8(rtwdev, rtwdev->hci.rpwm_addr);
+@@ -270,8 +271,9 @@ static int rtw_mac_power_switch(struct rtw_dev *rtwdev, bool pwr_on)
+ return -EALREADY;
+
+ pwr_seq = pwr_on ? chip->pwr_on_seq : chip->pwr_off_seq;
+- if (rtw_pwr_seq_parser(rtwdev, pwr_seq))
+- return -EINVAL;
++ ret = rtw_pwr_seq_parser(rtwdev, pwr_seq);
++ if (ret)
++ return ret;
+
+ if (pwr_on)
+ set_bit(RTW_FLAG_POWERON, rtwdev->flags);
+--
+2.39.2
+
--- /dev/null
+From d72db487a397308927a1c1f92cc8798164648117 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 26 Feb 2023 23:10:03 +0100
+Subject: wifi: rtw88: mac: Return the original error from rtw_pwr_seq_parser()
+
+From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+
+[ Upstream commit b7ed9fa2cb76ca7a3c3cd4a6d35748fe1fbda9f6 ]
+
+rtw_pwr_seq_parser() calls rtw_sub_pwr_seq_parser() which can either
+return -EBUSY, -EINVAL or 0. Propagate the original error code instead
+of unconditionally returning -EBUSY in case of an error.
+
+Fixes: e3037485c68e ("rtw88: new Realtek 802.11ac driver")
+Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Reviewed-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20230226221004.138331-2-martin.blumenstingl@googlemail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw88/mac.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw88/mac.c b/drivers/net/wireless/realtek/rtw88/mac.c
+index dae64901bac5a..663907c38327f 100644
+--- a/drivers/net/wireless/realtek/rtw88/mac.c
++++ b/drivers/net/wireless/realtek/rtw88/mac.c
+@@ -233,7 +233,7 @@ static int rtw_pwr_seq_parser(struct rtw_dev *rtwdev,
+
+ ret = rtw_sub_pwr_seq_parser(rtwdev, intf_mask, cut_mask, cmd);
+ if (ret)
+- return -EBUSY;
++ return ret;
+
+ idx++;
+ } while (1);
+--
+2.39.2
+
--- /dev/null
+From f4a736fdc40cd74ccd096b98a02f15d5a9707f26 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Mar 2023 13:53:31 +0100
+Subject: workqueue: Fix hung time report of worker pools
+
+From: Petr Mladek <pmladek@suse.com>
+
+[ Upstream commit 335a42ebb0ca8ee9997a1731aaaae6dcd704c113 ]
+
+The workqueue watchdog prints a warning when there is no progress in
+a worker pool. Where the progress means that the pool started processing
+a pending work item.
+
+Note that it is perfectly fine to process work items much longer.
+The progress should be guaranteed by waking up or creating idle
+workers.
+
+show_one_worker_pool() prints state of non-idle worker pool. It shows
+a delay since the last pool->watchdog_ts.
+
+The timestamp is updated when a first pending work is queued in
+__queue_work(). Also it is updated when a work is dequeued for
+processing in worker_thread() and rescuer_thread().
+
+The delay is misleading when there is no pending work item. In this
+case it shows how long the last work item is being proceed. Show
+zero instead. There is no stall if there is no pending work.
+
+Fixes: 82607adcf9cdf40fb7b ("workqueue: implement lockup detector")
+Signed-off-by: Petr Mladek <pmladek@suse.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/workqueue.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/kernel/workqueue.c b/kernel/workqueue.c
+index b8b541caed485..2be9b0ecf22ce 100644
+--- a/kernel/workqueue.c
++++ b/kernel/workqueue.c
+@@ -5002,10 +5002,16 @@ static void show_one_worker_pool(struct worker_pool *pool)
+ struct worker *worker;
+ bool first = true;
+ unsigned long flags;
++ unsigned long hung = 0;
+
+ raw_spin_lock_irqsave(&pool->lock, flags);
+ if (pool->nr_workers == pool->nr_idle)
+ goto next_pool;
++
++ /* How long the first pending work is waiting for a worker. */
++ if (!list_empty(&pool->worklist))
++ hung = jiffies_to_msecs(jiffies - pool->watchdog_ts) / 1000;
++
+ /*
+ * Defer printing to avoid deadlocks in console drivers that
+ * queue work while holding locks also taken in their write
+@@ -5014,9 +5020,7 @@ static void show_one_worker_pool(struct worker_pool *pool)
+ printk_deferred_enter();
+ pr_info("pool %d:", pool->id);
+ pr_cont_pool_info(pool);
+- pr_cont(" hung=%us workers=%d",
+- jiffies_to_msecs(jiffies - pool->watchdog_ts) / 1000,
+- pool->nr_workers);
++ pr_cont(" hung=%lus workers=%d", hung, pool->nr_workers);
+ if (pool->manager)
+ pr_cont(" manager: %d",
+ task_pid_nr(pool->manager->task));
+--
+2.39.2
+
--- /dev/null
+From 9ba2b5d89097652eef740242c34e31f17e25205c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Feb 2023 17:09:17 +0100
+Subject: x86/apic: Fix atomic update of offset in reserve_eilvt_offset()
+
+From: Uros Bizjak <ubizjak@gmail.com>
+
+[ Upstream commit f96fb2df3eb31ede1b34b0521560967310267750 ]
+
+The detection of atomic update failure in reserve_eilvt_offset() is
+not correct. The value returned by atomic_cmpxchg() should be compared
+to the old value from the location to be updated.
+
+If these two are the same, then atomic update succeeded and
+"eilvt_offsets[offset]" location is updated to "new" in an atomic way.
+
+Otherwise, the atomic update failed and it should be retried with the
+value from "eilvt_offsets[offset]" - exactly what atomic_try_cmpxchg()
+does in a correct and more optimal way.
+
+Fixes: a68c439b1966c ("apic, x86: Check if EILVT APIC registers are available (AMD only)")
+Signed-off-by: Uros Bizjak <ubizjak@gmail.com>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Link: https://lore.kernel.org/r/20230227160917.107820-1-ubizjak@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/apic/apic.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
+index 20d9a604da7c4..7705571100518 100644
+--- a/arch/x86/kernel/apic/apic.c
++++ b/arch/x86/kernel/apic/apic.c
+@@ -422,10 +422,9 @@ static unsigned int reserve_eilvt_offset(int offset, unsigned int new)
+ if (vector && !eilvt_entry_is_changeable(vector, new))
+ /* may not change if vectors are different */
+ return rsvd;
+- rsvd = atomic_cmpxchg(&eilvt_offsets[offset], rsvd, new);
+- } while (rsvd != new);
++ } while (!atomic_try_cmpxchg(&eilvt_offsets[offset], &rsvd, new));
+
+- rsvd &= ~APIC_EILVT_MASKED;
++ rsvd = new & ~APIC_EILVT_MASKED;
+ if (rsvd && rsvd != vector)
+ pr_info("LVT offset %d assigned for vector 0x%02x\n",
+ offset, rsvd);
+--
+2.39.2
+
--- /dev/null
+From 94f2c7f4e7a9f947dac618497caa297a50a5a814 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Mar 2023 00:30:04 -0700
+Subject: x86/ioapic: Don't return 0 from arch_dynirq_lower_bound()
+
+From: Saurabh Sengar <ssengar@linux.microsoft.com>
+
+[ Upstream commit 5af507bef93c09a94fb8f058213b489178f4cbe5 ]
+
+arch_dynirq_lower_bound() is invoked by the core interrupt code to
+retrieve the lowest possible Linux interrupt number for dynamically
+allocated interrupts like MSI.
+
+The x86 implementation uses this to exclude the IO/APIC GSI space.
+This works correctly as long as there is an IO/APIC registered, but
+returns 0 if not. This has been observed in VMs where the BIOS does
+not advertise an IO/APIC.
+
+0 is an invalid interrupt number except for the legacy timer interrupt
+on x86. The return value is unchecked in the core code, so it ends up
+to allocate interrupt number 0 which is subsequently considered to be
+invalid by the caller, e.g. the MSI allocation code.
+
+The function has already a check for 0 in the case that an IO/APIC is
+registered, as ioapic_dynirq_base is 0 in case of device tree setups.
+
+Consolidate this and zero check for both ioapic_dynirq_base and gsi_top,
+which is used in the case that no IO/APIC is registered.
+
+Fixes: 3e5bedc2c258 ("x86/apic: Fix arch_dynirq_lower_bound() bug for DT enabled machines")
+Signed-off-by: Saurabh Sengar <ssengar@linux.microsoft.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/r/1679988604-20308-1-git-send-email-ssengar@linux.microsoft.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/apic/io_apic.c | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
+index 1f83b052bb74e..f980b38b0227e 100644
+--- a/arch/x86/kernel/apic/io_apic.c
++++ b/arch/x86/kernel/apic/io_apic.c
+@@ -2477,17 +2477,21 @@ static int io_apic_get_redir_entries(int ioapic)
+
+ unsigned int arch_dynirq_lower_bound(unsigned int from)
+ {
++ unsigned int ret;
++
+ /*
+ * dmar_alloc_hwirq() may be called before setup_IO_APIC(), so use
+ * gsi_top if ioapic_dynirq_base hasn't been initialized yet.
+ */
+- if (!ioapic_initialized)
+- return gsi_top;
++ ret = ioapic_dynirq_base ? : gsi_top;
++
+ /*
+- * For DT enabled machines ioapic_dynirq_base is irrelevant and not
+- * updated. So simply return @from if ioapic_dynirq_base == 0.
++ * For DT enabled machines ioapic_dynirq_base is irrelevant and
++ * always 0. gsi_top can be 0 if there is no IO/APIC registered.
++ * 0 is an invalid interrupt number for dynamic allocations. Return
++ * @from instead.
+ */
+- return ioapic_dynirq_base ? : from;
++ return ret ? : from;
+ }
+
+ #ifdef CONFIG_X86_32
+--
+2.39.2
+
--- /dev/null
+From 4d39e9b483695f3f9fcb891b5389ffef36d8c154 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Jan 2023 15:16:01 +0000
+Subject: x86/MCE/AMD: Use an u64 for bank_map
+
+From: Muralidhara M K <muralimk@amd.com>
+
+[ Upstream commit 4c1cdec319b9aadb65737c3eb1f5cb74bd6aa156 ]
+
+Thee maximum number of MCA banks is 64 (MAX_NR_BANKS), see
+
+ a0bc32b3cacf ("x86/mce: Increase maximum number of banks to 64").
+
+However, the bank_map which contains a bitfield of which banks to
+initialize is of type unsigned int and that overflows when those bit
+numbers are >= 32, leading to UBSAN complaining correctly:
+
+ UBSAN: shift-out-of-bounds in arch/x86/kernel/cpu/mce/amd.c:1365:38
+ shift exponent 32 is too large for 32-bit type 'int'
+
+Change the bank_map to a u64 and use the proper BIT_ULL() macro when
+modifying bits in there.
+
+ [ bp: Rewrite commit message. ]
+
+Fixes: a0bc32b3cacf ("x86/mce: Increase maximum number of banks to 64")
+Signed-off-by: Muralidhara M K <muralimk@amd.com>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Link: https://lore.kernel.org/r/20230127151601.1068324-1-muralimk@amd.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/cpu/mce/amd.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/arch/x86/kernel/cpu/mce/amd.c b/arch/x86/kernel/cpu/mce/amd.c
+index 23c5072fbbb76..06cd3bef62e90 100644
+--- a/arch/x86/kernel/cpu/mce/amd.c
++++ b/arch/x86/kernel/cpu/mce/amd.c
+@@ -235,10 +235,10 @@ static DEFINE_PER_CPU(struct threshold_bank **, threshold_banks);
+ * A list of the banks enabled on each logical CPU. Controls which respective
+ * descriptors to initialize later in mce_threshold_create_device().
+ */
+-static DEFINE_PER_CPU(unsigned int, bank_map);
++static DEFINE_PER_CPU(u64, bank_map);
+
+ /* Map of banks that have more than MCA_MISC0 available. */
+-static DEFINE_PER_CPU(u32, smca_misc_banks_map);
++static DEFINE_PER_CPU(u64, smca_misc_banks_map);
+
+ static void amd_threshold_interrupt(void);
+ static void amd_deferred_error_interrupt(void);
+@@ -267,7 +267,7 @@ static void smca_set_misc_banks_map(unsigned int bank, unsigned int cpu)
+ return;
+
+ if (low & MASK_BLKPTR_LO)
+- per_cpu(smca_misc_banks_map, cpu) |= BIT(bank);
++ per_cpu(smca_misc_banks_map, cpu) |= BIT_ULL(bank);
+
+ }
+
+@@ -530,7 +530,7 @@ static u32 smca_get_block_address(unsigned int bank, unsigned int block,
+ if (!block)
+ return MSR_AMD64_SMCA_MCx_MISC(bank);
+
+- if (!(per_cpu(smca_misc_banks_map, cpu) & BIT(bank)))
++ if (!(per_cpu(smca_misc_banks_map, cpu) & BIT_ULL(bank)))
+ return 0;
+
+ return MSR_AMD64_SMCA_MCx_MISCy(bank, block - 1);
+@@ -574,7 +574,7 @@ prepare_threshold_block(unsigned int bank, unsigned int block, u32 addr,
+ int new;
+
+ if (!block)
+- per_cpu(bank_map, cpu) |= (1 << bank);
++ per_cpu(bank_map, cpu) |= BIT_ULL(bank);
+
+ memset(&b, 0, sizeof(b));
+ b.cpu = cpu;
+@@ -878,7 +878,7 @@ static void amd_threshold_interrupt(void)
+ return;
+
+ for (bank = 0; bank < this_cpu_read(mce_num_banks); ++bank) {
+- if (!(per_cpu(bank_map, cpu) & (1 << bank)))
++ if (!(per_cpu(bank_map, cpu) & BIT_ULL(bank)))
+ continue;
+
+ first_block = bp[bank]->blocks;
+@@ -1356,7 +1356,7 @@ int mce_threshold_create_device(unsigned int cpu)
+ return -ENOMEM;
+
+ for (bank = 0; bank < numbanks; ++bank) {
+- if (!(this_cpu_read(bank_map) & (1 << bank)))
++ if (!(this_cpu_read(bank_map) & BIT_ULL(bank)))
+ continue;
+ err = threshold_create_bank(bp, cpu, bank);
+ if (err) {
+--
+2.39.2
+
--- /dev/null
+From 3d7166f4c371ade0db5c47c25d3a72a19f303048 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Apr 2023 01:59:18 +0200
+Subject: xsk: Fix unaligned descriptor validation
+
+From: Kal Conley <kal.conley@dectris.com>
+
+[ Upstream commit d769ccaf957fe7391f357c0a923de71f594b8a2b ]
+
+Make sure unaligned descriptors that straddle the end of the UMEM are
+considered invalid. Currently, descriptor validation is broken for
+zero-copy mode which only checks descriptors at page granularity.
+For example, descriptors in zero-copy mode that overrun the end of the
+UMEM but not a page boundary are (incorrectly) considered valid. The
+UMEM boundary check needs to happen before the page boundary and
+contiguity checks in xp_desc_crosses_non_contig_pg(). Do this check in
+xp_unaligned_validate_desc() instead like xp_check_unaligned() already
+does.
+
+Fixes: 2b43470add8c ("xsk: Introduce AF_XDP buffer allocation API")
+Signed-off-by: Kal Conley <kal.conley@dectris.com>
+Acked-by: Magnus Karlsson <magnus.karlsson@intel.com>
+Link: https://lore.kernel.org/r/20230405235920.7305-2-kal.conley@dectris.com
+Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/xsk_buff_pool.h | 9 ++-------
+ net/xdp/xsk_queue.h | 1 +
+ 2 files changed, 3 insertions(+), 7 deletions(-)
+
+diff --git a/include/net/xsk_buff_pool.h b/include/net/xsk_buff_pool.h
+index 3e952e5694188..d318c769b4454 100644
+--- a/include/net/xsk_buff_pool.h
++++ b/include/net/xsk_buff_pool.h
+@@ -180,13 +180,8 @@ static inline bool xp_desc_crosses_non_contig_pg(struct xsk_buff_pool *pool,
+ if (likely(!cross_pg))
+ return false;
+
+- if (pool->dma_pages_cnt) {
+- return !(pool->dma_pages[addr >> PAGE_SHIFT] &
+- XSK_NEXT_PG_CONTIG_MASK);
+- }
+-
+- /* skb path */
+- return addr + len > pool->addrs_cnt;
++ return pool->dma_pages_cnt &&
++ !(pool->dma_pages[addr >> PAGE_SHIFT] & XSK_NEXT_PG_CONTIG_MASK);
+ }
+
+ static inline u64 xp_aligned_extract_addr(struct xsk_buff_pool *pool, u64 addr)
+diff --git a/net/xdp/xsk_queue.h b/net/xdp/xsk_queue.h
+index bfb2a7e50c261..66c6f57c9c447 100644
+--- a/net/xdp/xsk_queue.h
++++ b/net/xdp/xsk_queue.h
+@@ -162,6 +162,7 @@ static inline bool xp_unaligned_validate_desc(struct xsk_buff_pool *pool,
+ return false;
+
+ if (base_addr >= pool->addrs_cnt || addr >= pool->addrs_cnt ||
++ addr + desc->len > pool->addrs_cnt ||
+ xp_desc_crosses_non_contig_pg(pool, addr, desc->len))
+ return false;
+
+--
+2.39.2
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
