--- /dev/null
+From d315cb1145a05ff114b017f0a21ea8ecbffc0a71 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Jan 2024 07:53:01 +0100
+Subject: ARM: dts: exynos4212-tab3: add samsung,invert-vclk flag to fimd
+
+From: Artur Weber <aweber.kernel@gmail.com>
+
+[ Upstream commit eab4f56d3e75dad697acf8dc2c8be3c341d6c63e ]
+
+After more investigation, I've found that it's not the panel driver
+config that needs to be modified to invert the data polarity, but
+the FIMD config.
+
+Add the missing invert-vclk option that is required to get the display
+to work correctly.
+
+Fixes: ee37a457af1d ("ARM: dts: exynos: Add Samsung Galaxy Tab 3 8.0 boards")
+Signed-off-by: Artur Weber <aweber.kernel@gmail.com>
+Link: https://lore.kernel.org/r/20240105-tab3-display-fixes-v2-1-904d1207bf6f@gmail.com
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/samsung/exynos4212-tab3.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm/boot/dts/samsung/exynos4212-tab3.dtsi b/arch/arm/boot/dts/samsung/exynos4212-tab3.dtsi
+index d7954ff466b4..e5254e32aa8f 100644
+--- a/arch/arm/boot/dts/samsung/exynos4212-tab3.dtsi
++++ b/arch/arm/boot/dts/samsung/exynos4212-tab3.dtsi
+@@ -434,6 +434,7 @@ &exynos_usbphy {
+ };
+
+ &fimd {
++ samsung,invert-vclk;
+ status = "okay";
+ };
+
+--
+2.43.0
+
--- /dev/null
+From fa419eea174bdbe306d524f45a5ab6c0a2b2e604 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Jan 2024 21:04:01 +0800
+Subject: block: Move checking GENHD_FL_NO_PART to bdev_add_partition()
+
+From: Li Lingfeng <lilingfeng3@huawei.com>
+
+[ Upstream commit 7777f47f2ea64efd1016262e7b59fab34adfb869 ]
+
+Commit 1a721de8489f ("block: don't add or resize partition on the disk
+with GENHD_FL_NO_PART") prevented all operations about partitions on disks
+with GENHD_FL_NO_PART in blkpg_do_ioctl() since they are meaningless.
+However, it changed error code in some scenarios. So move checking
+GENHD_FL_NO_PART to bdev_add_partition() to eliminate impact.
+
+Fixes: 1a721de8489f ("block: don't add or resize partition on the disk with GENHD_FL_NO_PART")
+Reported-by: Allison Karlitskaya <allison.karlitskaya@redhat.com>
+Closes: https://lore.kernel.org/all/CAOYeF9VsmqKMcQjo1k6YkGNujwN-nzfxY17N3F-CMikE1tYp+w@mail.gmail.com/
+Signed-off-by: Li Lingfeng <lilingfeng3@huawei.com>
+Reviewed-by: Yu Kuai <yukuai3@huawei.com>
+Link: https://lore.kernel.org/r/20240118130401.792757-1-lilingfeng@huaweicloud.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/ioctl.c | 2 --
+ block/partitions/core.c | 5 +++++
+ 2 files changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/block/ioctl.c b/block/ioctl.c
+index 9c73a763ef88..438f79c564cf 100644
+--- a/block/ioctl.c
++++ b/block/ioctl.c
+@@ -20,8 +20,6 @@ static int blkpg_do_ioctl(struct block_device *bdev,
+ struct blkpg_partition p;
+ sector_t start, length;
+
+- if (disk->flags & GENHD_FL_NO_PART)
+- return -EINVAL;
+ if (!capable(CAP_SYS_ADMIN))
+ return -EACCES;
+ if (copy_from_user(&p, upart, sizeof(struct blkpg_partition)))
+diff --git a/block/partitions/core.c b/block/partitions/core.c
+index f47ffcfdfcec..f14602022c5e 100644
+--- a/block/partitions/core.c
++++ b/block/partitions/core.c
+@@ -447,6 +447,11 @@ int bdev_add_partition(struct gendisk *disk, int partno, sector_t start,
+ goto out;
+ }
+
++ if (disk->flags & GENHD_FL_NO_PART) {
++ ret = -EINVAL;
++ goto out;
++ }
++
+ if (partition_overlaps(disk, start, length, -1)) {
+ ret = -EBUSY;
+ goto out;
+--
+2.43.0
+
--- /dev/null
+From b0e7ac8c14acacc1ba5a19cd2be944c679a1b72b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Jan 2024 05:07:57 +0000
+Subject: cifs: fix stray unlock in cifs_chan_skip_or_disable
+
+From: Shyam Prasad N <sprasad@microsoft.com>
+
+[ Upstream commit 993d1c346b1a51ac41b2193609a0d4e51e9748f4 ]
+
+A recent change moved the code that decides to skip
+a channel or disable multichannel entirely, into a
+helper function.
+
+During this, a mutex_unlock of the session_mutex
+should have been removed. Doing that here.
+
+Fixes: f591062bdbf4 ("cifs: handle servers that still advertise multichannel after disabling")
+Signed-off-by: Shyam Prasad N <sprasad@microsoft.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/smb2pdu.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/fs/smb/client/smb2pdu.c b/fs/smb/client/smb2pdu.c
+index bfec2ca0f4e6..f5006aa97f5b 100644
+--- a/fs/smb/client/smb2pdu.c
++++ b/fs/smb/client/smb2pdu.c
+@@ -195,7 +195,6 @@ cifs_chan_skip_or_disable(struct cifs_ses *ses,
+ pserver = server->primary_server;
+ cifs_signal_cifsd_for_reconnect(pserver, false);
+ skip_terminate:
+- mutex_unlock(&ses->session_mutex);
+ return -EHOSTDOWN;
+ }
+
+--
+2.43.0
+
--- /dev/null
+From 58a9b7f54a6752f01fca5bb341e247b47abb2bf1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Jan 2024 05:33:19 -0600
+Subject: cpufreq/amd-pstate: Fix setting scaling max/min freq values
+
+From: Mario Limonciello <mario.limonciello@amd.com>
+
+[ Upstream commit 22fb4f041999f5f16ecbda15a2859b4ef4cbf47e ]
+
+Scaling min/max freq values were being cached and lagging a setting
+each time. Fix the ordering of the clamp call to ensure they work.
+
+Closes: https://bugzilla.kernel.org/show_bug.cgi?id=217931
+Fixes: febab20caeba ("cpufreq/amd-pstate: Fix scaling_min_freq and scaling_max_freq update")
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Reviewed-by: Wyes Karny <wkarny@gmail.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/amd-pstate.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/cpufreq/amd-pstate.c b/drivers/cpufreq/amd-pstate.c
+index 1f6186475715..1791d37fbc53 100644
+--- a/drivers/cpufreq/amd-pstate.c
++++ b/drivers/cpufreq/amd-pstate.c
+@@ -1232,14 +1232,13 @@ static void amd_pstate_epp_update_limit(struct cpufreq_policy *policy)
+ max_limit_perf = div_u64(policy->max * cpudata->highest_perf, cpudata->max_freq);
+ min_limit_perf = div_u64(policy->min * cpudata->highest_perf, cpudata->max_freq);
+
++ WRITE_ONCE(cpudata->max_limit_perf, max_limit_perf);
++ WRITE_ONCE(cpudata->min_limit_perf, min_limit_perf);
++
+ max_perf = clamp_t(unsigned long, max_perf, cpudata->min_limit_perf,
+ cpudata->max_limit_perf);
+ min_perf = clamp_t(unsigned long, min_perf, cpudata->min_limit_perf,
+ cpudata->max_limit_perf);
+-
+- WRITE_ONCE(cpudata->max_limit_perf, max_limit_perf);
+- WRITE_ONCE(cpudata->min_limit_perf, min_limit_perf);
+-
+ value = READ_ONCE(cpudata->cppc_req_cached);
+
+ if (cpudata->policy == CPUFREQ_POLICY_PERFORMANCE)
+--
+2.43.0
+
--- /dev/null
+From 0f5c28ac1b9e6a561b2e3e2384c8eebfdb7d991f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Jan 2024 17:58:14 -0800
+Subject: drm/bridge: anx7625: Ensure bridge is suspended in disable()
+
+From: Hsin-Yi Wang <hsinyi@chromium.org>
+
+[ Upstream commit 4d5b7daa3c610af3f322ad1e91fc0c752ff32f0e ]
+
+Similar to commit 26db46bc9c67 ("drm/bridge: parade-ps8640: Ensure bridge
+is suspended in .post_disable()"). Add a mutex to ensure that aux transfer
+won't race with atomic_disable by holding the PM reference and prevent
+the bridge from suspend.
+
+Also we need to use pm_runtime_put_sync_suspend() to suspend the bridge
+instead of idle with pm_runtime_put_sync().
+
+Fixes: 3203e497eb76 ("drm/bridge: anx7625: Synchronously run runtime suspend.")
+Fixes: adca62ec370c ("drm/bridge: anx7625: Support reading edid through aux channel")
+Signed-off-by: Hsin-Yi Wang <hsinyi@chromium.org>
+Tested-by: Xuxin Xiong <xuxinxiong@huaqin.corp-partner.google.com>
+Reviewed-by: Pin-yen Lin <treapking@chromium.org>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240118015916.2296741-1-hsinyi@chromium.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/analogix/anx7625.c | 7 ++++++-
+ drivers/gpu/drm/bridge/analogix/anx7625.h | 2 ++
+ 2 files changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/bridge/analogix/anx7625.c b/drivers/gpu/drm/bridge/analogix/anx7625.c
+index 51abe42c639e..5168628f11cf 100644
+--- a/drivers/gpu/drm/bridge/analogix/anx7625.c
++++ b/drivers/gpu/drm/bridge/analogix/anx7625.c
+@@ -1741,6 +1741,7 @@ static ssize_t anx7625_aux_transfer(struct drm_dp_aux *aux,
+ u8 request = msg->request & ~DP_AUX_I2C_MOT;
+ int ret = 0;
+
++ mutex_lock(&ctx->aux_lock);
+ pm_runtime_get_sync(dev);
+ msg->reply = 0;
+ switch (request) {
+@@ -1757,6 +1758,7 @@ static ssize_t anx7625_aux_transfer(struct drm_dp_aux *aux,
+ msg->size, msg->buffer);
+ pm_runtime_mark_last_busy(dev);
+ pm_runtime_put_autosuspend(dev);
++ mutex_unlock(&ctx->aux_lock);
+
+ return ret;
+ }
+@@ -2453,7 +2455,9 @@ static void anx7625_bridge_atomic_disable(struct drm_bridge *bridge,
+ ctx->connector = NULL;
+ anx7625_dp_stop(ctx);
+
+- pm_runtime_put_sync(dev);
++ mutex_lock(&ctx->aux_lock);
++ pm_runtime_put_sync_suspend(dev);
++ mutex_unlock(&ctx->aux_lock);
+ }
+
+ static enum drm_connector_status
+@@ -2647,6 +2651,7 @@ static int anx7625_i2c_probe(struct i2c_client *client)
+
+ mutex_init(&platform->lock);
+ mutex_init(&platform->hdcp_wq_lock);
++ mutex_init(&platform->aux_lock);
+
+ INIT_DELAYED_WORK(&platform->hdcp_work, hdcp_check_work_func);
+ platform->hdcp_workqueue = create_workqueue("hdcp workqueue");
+diff --git a/drivers/gpu/drm/bridge/analogix/anx7625.h b/drivers/gpu/drm/bridge/analogix/anx7625.h
+index 5af819611ebc..80d3fb4e985f 100644
+--- a/drivers/gpu/drm/bridge/analogix/anx7625.h
++++ b/drivers/gpu/drm/bridge/analogix/anx7625.h
+@@ -471,6 +471,8 @@ struct anx7625_data {
+ struct workqueue_struct *hdcp_workqueue;
+ /* Lock for hdcp work queue */
+ struct mutex hdcp_wq_lock;
++ /* Lock for aux transfer and disable */
++ struct mutex aux_lock;
+ char edid_block;
+ struct display_timing dt;
+ u8 display_timing_valid;
+--
+2.43.0
+
--- /dev/null
+From 62efff1bf6970a63bc254971d556674c1e3a2a7a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Jan 2024 20:04:57 +0800
+Subject: drm/bridge: parade-ps8640: Ensure bridge is suspended in
+ .post_disable()
+
+From: Pin-yen Lin <treapking@chromium.org>
+
+[ Upstream commit 26db46bc9c675e43230cc6accd110110a7654299 ]
+
+The ps8640 bridge seems to expect everything to be power cycled at the
+disable process, but sometimes ps8640_aux_transfer() holds the runtime
+PM reference and prevents the bridge from suspend.
+
+Prevent that by introducing a mutex lock between ps8640_aux_transfer()
+and .post_disable() to make sure the bridge is really powered off.
+
+Fixes: 826cff3f7ebb ("drm/bridge: parade-ps8640: Enable runtime power management")
+Signed-off-by: Pin-yen Lin <treapking@chromium.org>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240109120528.1292601-1-treapking@chromium.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/parade-ps8640.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+diff --git a/drivers/gpu/drm/bridge/parade-ps8640.c b/drivers/gpu/drm/bridge/parade-ps8640.c
+index fb5e9ae9ad81..166bfc725ef4 100644
+--- a/drivers/gpu/drm/bridge/parade-ps8640.c
++++ b/drivers/gpu/drm/bridge/parade-ps8640.c
+@@ -107,6 +107,7 @@ struct ps8640 {
+ struct device_link *link;
+ bool pre_enabled;
+ bool need_post_hpd_delay;
++ struct mutex aux_lock;
+ };
+
+ static const struct regmap_config ps8640_regmap_config[] = {
+@@ -345,6 +346,7 @@ static ssize_t ps8640_aux_transfer(struct drm_dp_aux *aux,
+ struct device *dev = &ps_bridge->page[PAGE0_DP_CNTL]->dev;
+ int ret;
+
++ mutex_lock(&ps_bridge->aux_lock);
+ pm_runtime_get_sync(dev);
+ ret = _ps8640_wait_hpd_asserted(ps_bridge, 200 * 1000);
+ if (ret) {
+@@ -354,6 +356,7 @@ static ssize_t ps8640_aux_transfer(struct drm_dp_aux *aux,
+ ret = ps8640_aux_transfer_msg(aux, msg);
+ pm_runtime_mark_last_busy(dev);
+ pm_runtime_put_autosuspend(dev);
++ mutex_unlock(&ps_bridge->aux_lock);
+
+ return ret;
+ }
+@@ -475,7 +478,18 @@ static void ps8640_atomic_post_disable(struct drm_bridge *bridge,
+ ps_bridge->pre_enabled = false;
+
+ ps8640_bridge_vdo_control(ps_bridge, DISABLE);
++
++ /*
++ * The bridge seems to expect everything to be power cycled at the
++ * disable process, so grab a lock here to make sure
++ * ps8640_aux_transfer() is not holding a runtime PM reference and
++ * preventing the bridge from suspend.
++ */
++ mutex_lock(&ps_bridge->aux_lock);
++
+ pm_runtime_put_sync_suspend(&ps_bridge->page[PAGE0_DP_CNTL]->dev);
++
++ mutex_unlock(&ps_bridge->aux_lock);
+ }
+
+ static int ps8640_bridge_attach(struct drm_bridge *bridge,
+@@ -624,6 +638,8 @@ static int ps8640_probe(struct i2c_client *client)
+ if (!ps_bridge)
+ return -ENOMEM;
+
++ mutex_init(&ps_bridge->aux_lock);
++
+ ps_bridge->supplies[0].supply = "vdd12";
+ ps_bridge->supplies[1].supply = "vdd33";
+ ret = devm_regulator_bulk_get(dev, ARRAY_SIZE(ps_bridge->supplies),
+--
+2.43.0
+
--- /dev/null
+From 81fc49df427c4c8c7bd0427a3b722dd037e462c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Jan 2024 10:35:03 -0800
+Subject: drm/bridge: parade-ps8640: Make sure we drop the AUX mutex in the
+ error case
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit a20f1b02bafcbf5a32d96a1d4185d6981cf7d016 ]
+
+After commit 26db46bc9c67 ("drm/bridge: parade-ps8640: Ensure bridge
+is suspended in .post_disable()"), if we hit the error case in
+ps8640_aux_transfer() then we return without dropping the mutex. Fix
+this oversight.
+
+Fixes: 26db46bc9c67 ("drm/bridge: parade-ps8640: Ensure bridge is suspended in .post_disable()")
+Reviewed-by: Hsin-Yi Wang <hsinyi@chromium.org>
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240117103502.1.Ib726a0184913925efc7e99c4d4fc801982e1bc24@changeid
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/parade-ps8640.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/bridge/parade-ps8640.c b/drivers/gpu/drm/bridge/parade-ps8640.c
+index 166bfc725ef4..14d4dcf239da 100644
+--- a/drivers/gpu/drm/bridge/parade-ps8640.c
++++ b/drivers/gpu/drm/bridge/parade-ps8640.c
+@@ -351,11 +351,13 @@ static ssize_t ps8640_aux_transfer(struct drm_dp_aux *aux,
+ ret = _ps8640_wait_hpd_asserted(ps_bridge, 200 * 1000);
+ if (ret) {
+ pm_runtime_put_sync_suspend(dev);
+- return ret;
++ goto exit;
+ }
+ ret = ps8640_aux_transfer_msg(aux, msg);
+ pm_runtime_mark_last_busy(dev);
+ pm_runtime_put_autosuspend(dev);
++
++exit:
+ mutex_unlock(&ps_bridge->aux_lock);
+
+ return ret;
+--
+2.43.0
+
--- /dev/null
+From ebd2e72fb4ab946e9e535399c0f53a481e01db3b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Dec 2023 13:55:48 -0800
+Subject: drm/bridge: parade-ps8640: Wait for HPD when doing an AUX transfer
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit 024b32db43a359e0ded3fcc6cd86247cbbed4224 ]
+
+Unlike what is claimed in commit f5aa7d46b0ee ("drm/bridge:
+parade-ps8640: Provide wait_hpd_asserted() in struct drm_dp_aux"), if
+someone manually tries to do an AUX transfer (like via `i2cdump ${bus}
+0x50 i`) while the panel is off we don't just get a simple transfer
+error. Instead, the whole ps8640 gets thrown for a loop and goes into
+a bad state.
+
+Let's put the function to wait for the HPD (and the magical 50 ms
+after first reset) back in when we're doing an AUX transfer. This
+shouldn't actually make things much slower (assuming the panel is on)
+because we should immediately poll and see the HPD high. Mostly this
+is just an extra i2c transfer to the bridge.
+
+Fixes: f5aa7d46b0ee ("drm/bridge: parade-ps8640: Provide wait_hpd_asserted() in struct drm_dp_aux")
+Tested-by: Pin-yen Lin <treapking@chromium.org>
+Reviewed-by: Pin-yen Lin <treapking@chromium.org>
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20231221135548.1.I10f326a9305d57ad32cee7f8d9c60518c8be20fb@changeid
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/parade-ps8640.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/gpu/drm/bridge/parade-ps8640.c b/drivers/gpu/drm/bridge/parade-ps8640.c
+index 541e4f5afc4c..fb5e9ae9ad81 100644
+--- a/drivers/gpu/drm/bridge/parade-ps8640.c
++++ b/drivers/gpu/drm/bridge/parade-ps8640.c
+@@ -346,6 +346,11 @@ static ssize_t ps8640_aux_transfer(struct drm_dp_aux *aux,
+ int ret;
+
+ pm_runtime_get_sync(dev);
++ ret = _ps8640_wait_hpd_asserted(ps_bridge, 200 * 1000);
++ if (ret) {
++ pm_runtime_put_sync_suspend(dev);
++ return ret;
++ }
+ ret = ps8640_aux_transfer_msg(aux, msg);
+ pm_runtime_mark_last_busy(dev);
+ pm_runtime_put_autosuspend(dev);
+--
+2.43.0
+
--- /dev/null
+From 2860fbf5bb4345f45798f33bbf58d39830938647 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Nov 2023 17:43:44 +0100
+Subject: drm: bridge: samsung-dsim: Don't use FORCE_STOP_STATE
+
+From: Michael Walle <mwalle@kernel.org>
+
+[ Upstream commit ff3d5d04db07e5374758baa7e877fde8d683ebab ]
+
+The FORCE_STOP_STATE bit is unsuitable to force the DSI link into LP-11
+mode. It seems the bridge internally queues DSI packets and when the
+FORCE_STOP_STATE bit is cleared, they are sent in close succession
+without any useful timing (this also means that the DSI lanes won't go
+into LP-11 mode). The length of this gibberish varies between 1ms and
+5ms. This sometimes breaks an attached bridge (TI SN65DSI84 in this
+case). In our case, the bridge will fail in about 1 per 500 reboots.
+
+The FORCE_STOP_STATE handling was introduced to have the DSI lanes in
+LP-11 state during the .pre_enable phase. But as it turns out, none of
+this is needed at all. Between samsung_dsim_init() and
+samsung_dsim_set_display_enable() the lanes are already in LP-11 mode.
+The code as it was before commit 20c827683de0 ("drm: bridge:
+samsung-dsim: Fix init during host transfer") and 0c14d3130654 ("drm:
+bridge: samsung-dsim: Fix i.MX8M enable flow to meet spec") was correct
+in this regard.
+
+This patch basically reverts both commits. It was tested on an i.MX8M
+SoC with an SN65DSI84 bridge. The signals were probed and the DSI
+packets were decoded during initialization and link start-up. After this
+patch the first DSI packet on the link is a VSYNC packet and the timing
+is correct.
+
+Command mode between .pre_enable and .enable was also briefly tested by
+a quick hack. There was no DSI link partner which would have responded,
+but it was made sure the DSI packet was send on the link. As a side
+note, the command mode seems to just work in HS mode. I couldn't find
+that the bridge will handle commands in LP mode.
+
+Fixes: 20c827683de0 ("drm: bridge: samsung-dsim: Fix init during host transfer")
+Fixes: 0c14d3130654 ("drm: bridge: samsung-dsim: Fix i.MX8M enable flow to meet spec")
+Signed-off-by: Michael Walle <mwalle@kernel.org>
+Signed-off-by: Inki Dae <inki.dae@samsung.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20231113164344.1612602-1-mwalle@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/samsung-dsim.c | 32 ++-------------------------
+ 1 file changed, 2 insertions(+), 30 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/samsung-dsim.c b/drivers/gpu/drm/bridge/samsung-dsim.c
+index be5914caa17d..63a1a0c88be4 100644
+--- a/drivers/gpu/drm/bridge/samsung-dsim.c
++++ b/drivers/gpu/drm/bridge/samsung-dsim.c
+@@ -969,10 +969,6 @@ static int samsung_dsim_init_link(struct samsung_dsim *dsi)
+ reg = samsung_dsim_read(dsi, DSIM_ESCMODE_REG);
+ reg &= ~DSIM_STOP_STATE_CNT_MASK;
+ reg |= DSIM_STOP_STATE_CNT(driver_data->reg_values[STOP_STATE_CNT]);
+-
+- if (!samsung_dsim_hw_is_exynos(dsi->plat_data->hw_type))
+- reg |= DSIM_FORCE_STOP_STATE;
+-
+ samsung_dsim_write(dsi, DSIM_ESCMODE_REG, reg);
+
+ reg = DSIM_BTA_TIMEOUT(0xff) | DSIM_LPDR_TIMEOUT(0xffff);
+@@ -1431,18 +1427,6 @@ static void samsung_dsim_disable_irq(struct samsung_dsim *dsi)
+ disable_irq(dsi->irq);
+ }
+
+-static void samsung_dsim_set_stop_state(struct samsung_dsim *dsi, bool enable)
+-{
+- u32 reg = samsung_dsim_read(dsi, DSIM_ESCMODE_REG);
+-
+- if (enable)
+- reg |= DSIM_FORCE_STOP_STATE;
+- else
+- reg &= ~DSIM_FORCE_STOP_STATE;
+-
+- samsung_dsim_write(dsi, DSIM_ESCMODE_REG, reg);
+-}
+-
+ static int samsung_dsim_init(struct samsung_dsim *dsi)
+ {
+ const struct samsung_dsim_driver_data *driver_data = dsi->driver_data;
+@@ -1492,9 +1476,6 @@ static void samsung_dsim_atomic_pre_enable(struct drm_bridge *bridge,
+ ret = samsung_dsim_init(dsi);
+ if (ret)
+ return;
+-
+- samsung_dsim_set_display_mode(dsi);
+- samsung_dsim_set_display_enable(dsi, true);
+ }
+ }
+
+@@ -1503,12 +1484,8 @@ static void samsung_dsim_atomic_enable(struct drm_bridge *bridge,
+ {
+ struct samsung_dsim *dsi = bridge_to_dsi(bridge);
+
+- if (samsung_dsim_hw_is_exynos(dsi->plat_data->hw_type)) {
+- samsung_dsim_set_display_mode(dsi);
+- samsung_dsim_set_display_enable(dsi, true);
+- } else {
+- samsung_dsim_set_stop_state(dsi, false);
+- }
++ samsung_dsim_set_display_mode(dsi);
++ samsung_dsim_set_display_enable(dsi, true);
+
+ dsi->state |= DSIM_STATE_VIDOUT_AVAILABLE;
+ }
+@@ -1521,9 +1498,6 @@ static void samsung_dsim_atomic_disable(struct drm_bridge *bridge,
+ if (!(dsi->state & DSIM_STATE_ENABLED))
+ return;
+
+- if (!samsung_dsim_hw_is_exynos(dsi->plat_data->hw_type))
+- samsung_dsim_set_stop_state(dsi, true);
+-
+ dsi->state &= ~DSIM_STATE_VIDOUT_AVAILABLE;
+ }
+
+@@ -1828,8 +1802,6 @@ static ssize_t samsung_dsim_host_transfer(struct mipi_dsi_host *host,
+ if (ret)
+ return ret;
+
+- samsung_dsim_set_stop_state(dsi, false);
+-
+ ret = mipi_dsi_create_packet(&xfer.packet, msg);
+ if (ret < 0)
+ return ret;
+--
+2.43.0
+
--- /dev/null
+From 661e3f0e8adee3a7a39f658731a474127ea8932b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Jan 2024 15:31:08 +0200
+Subject: drm/bridge: sii902x: Fix audio codec unregistration
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+[ Upstream commit 3fc6c76a8d208d3955c9e64b382d0ff370bc61fc ]
+
+The driver never unregisters the audio codec platform device, which can
+lead to a crash on module reloading, nor does it handle the return value
+from sii902x_audio_codec_init().
+
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Fixes: ff5781634c41 ("drm/bridge: sii902x: Implement HDMI audio support")
+Cc: Jyri Sarha <jsarha@ti.com>
+Acked-by: Linus Walleij <linus.walleij@linaro.org>
+Link: https://lore.kernel.org/r/20240103-si902x-fixes-v1-2-b9fd3e448411@ideasonboard.com
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240103-si902x-fixes-v1-2-b9fd3e448411@ideasonboard.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/sii902x.c | 21 +++++++++++++++++----
+ 1 file changed, 17 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/sii902x.c b/drivers/gpu/drm/bridge/sii902x.c
+index 69da73e414a9..4560ae9cbce1 100644
+--- a/drivers/gpu/drm/bridge/sii902x.c
++++ b/drivers/gpu/drm/bridge/sii902x.c
+@@ -1080,7 +1080,9 @@ static int sii902x_init(struct sii902x *sii902x)
+ return ret;
+ }
+
+- sii902x_audio_codec_init(sii902x, dev);
++ ret = sii902x_audio_codec_init(sii902x, dev);
++ if (ret)
++ return ret;
+
+ i2c_set_clientdata(sii902x->i2c, sii902x);
+
+@@ -1088,13 +1090,15 @@ static int sii902x_init(struct sii902x *sii902x)
+ 1, 0, I2C_MUX_GATE,
+ sii902x_i2c_bypass_select,
+ sii902x_i2c_bypass_deselect);
+- if (!sii902x->i2cmux)
+- return -ENOMEM;
++ if (!sii902x->i2cmux) {
++ ret = -ENOMEM;
++ goto err_unreg_audio;
++ }
+
+ sii902x->i2cmux->priv = sii902x;
+ ret = i2c_mux_add_adapter(sii902x->i2cmux, 0, 0, 0);
+ if (ret)
+- return ret;
++ goto err_unreg_audio;
+
+ sii902x->bridge.funcs = &sii902x_bridge_funcs;
+ sii902x->bridge.of_node = dev->of_node;
+@@ -1107,6 +1111,12 @@ static int sii902x_init(struct sii902x *sii902x)
+ drm_bridge_add(&sii902x->bridge);
+
+ return 0;
++
++err_unreg_audio:
++ if (!PTR_ERR_OR_ZERO(sii902x->audio.pdev))
++ platform_device_unregister(sii902x->audio.pdev);
++
++ return ret;
+ }
+
+ static int sii902x_probe(struct i2c_client *client)
+@@ -1179,6 +1189,9 @@ static void sii902x_remove(struct i2c_client *client)
+
+ drm_bridge_remove(&sii902x->bridge);
+ i2c_mux_del_adapters(sii902x->i2cmux);
++
++ if (!PTR_ERR_OR_ZERO(sii902x->audio.pdev))
++ platform_device_unregister(sii902x->audio.pdev);
+ }
+
+ static const struct of_device_id sii902x_dt_ids[] = {
+--
+2.43.0
+
--- /dev/null
+From 391eeffa0041d7cbc2e60fe2528e7ad11e4c39fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Jan 2024 15:31:07 +0200
+Subject: drm/bridge: sii902x: Fix probing race issue
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+[ Upstream commit 08ac6f132dd77e40f786d8af51140c96c6d739c9 ]
+
+A null pointer dereference crash has been observed rarely on TI
+platforms using sii9022 bridge:
+
+[ 53.271356] sii902x_get_edid+0x34/0x70 [sii902x]
+[ 53.276066] sii902x_bridge_get_edid+0x14/0x20 [sii902x]
+[ 53.281381] drm_bridge_get_edid+0x20/0x34 [drm]
+[ 53.286305] drm_bridge_connector_get_modes+0x8c/0xcc [drm_kms_helper]
+[ 53.292955] drm_helper_probe_single_connector_modes+0x190/0x538 [drm_kms_helper]
+[ 53.300510] drm_client_modeset_probe+0x1f0/0xbd4 [drm]
+[ 53.305958] __drm_fb_helper_initial_config_and_unlock+0x50/0x510 [drm_kms_helper]
+[ 53.313611] drm_fb_helper_initial_config+0x48/0x58 [drm_kms_helper]
+[ 53.320039] drm_fbdev_dma_client_hotplug+0x84/0xd4 [drm_dma_helper]
+[ 53.326401] drm_client_register+0x5c/0xa0 [drm]
+[ 53.331216] drm_fbdev_dma_setup+0xc8/0x13c [drm_dma_helper]
+[ 53.336881] tidss_probe+0x128/0x264 [tidss]
+[ 53.341174] platform_probe+0x68/0xc4
+[ 53.344841] really_probe+0x188/0x3c4
+[ 53.348501] __driver_probe_device+0x7c/0x16c
+[ 53.352854] driver_probe_device+0x3c/0x10c
+[ 53.357033] __device_attach_driver+0xbc/0x158
+[ 53.361472] bus_for_each_drv+0x88/0xe8
+[ 53.365303] __device_attach+0xa0/0x1b4
+[ 53.369135] device_initial_probe+0x14/0x20
+[ 53.373314] bus_probe_device+0xb0/0xb4
+[ 53.377145] deferred_probe_work_func+0xcc/0x124
+[ 53.381757] process_one_work+0x1f0/0x518
+[ 53.385770] worker_thread+0x1e8/0x3dc
+[ 53.389519] kthread+0x11c/0x120
+[ 53.392750] ret_from_fork+0x10/0x20
+
+The issue here is as follows:
+
+- tidss probes, but is deferred as sii902x is still missing.
+- sii902x starts probing and enters sii902x_init().
+- sii902x calls drm_bridge_add(). Now the sii902x bridge is ready from
+ DRM's perspective.
+- sii902x calls sii902x_audio_codec_init() and
+ platform_device_register_data()
+- The registration of the audio platform device causes probing of the
+ deferred devices.
+- tidss probes, which eventually causes sii902x_bridge_get_edid() to be
+ called.
+- sii902x_bridge_get_edid() tries to use the i2c to read the edid.
+ However, the sii902x driver has not set up the i2c part yet, leading
+ to the crash.
+
+Fix this by moving the drm_bridge_add() to the end of the
+sii902x_init(), which is also at the very end of sii902x_probe().
+
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Fixes: 21d808405fe4 ("drm/bridge/sii902x: Fix EDID readback")
+Acked-by: Linus Walleij <linus.walleij@linaro.org>
+Link: https://lore.kernel.org/r/20240103-si902x-fixes-v1-1-b9fd3e448411@ideasonboard.com
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240103-si902x-fixes-v1-1-b9fd3e448411@ideasonboard.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/sii902x.c | 29 ++++++++++++++++-------------
+ 1 file changed, 16 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/sii902x.c b/drivers/gpu/drm/bridge/sii902x.c
+index 2bdc5b439beb..69da73e414a9 100644
+--- a/drivers/gpu/drm/bridge/sii902x.c
++++ b/drivers/gpu/drm/bridge/sii902x.c
+@@ -1080,16 +1080,6 @@ static int sii902x_init(struct sii902x *sii902x)
+ return ret;
+ }
+
+- sii902x->bridge.funcs = &sii902x_bridge_funcs;
+- sii902x->bridge.of_node = dev->of_node;
+- sii902x->bridge.timings = &default_sii902x_timings;
+- sii902x->bridge.ops = DRM_BRIDGE_OP_DETECT | DRM_BRIDGE_OP_EDID;
+-
+- if (sii902x->i2c->irq > 0)
+- sii902x->bridge.ops |= DRM_BRIDGE_OP_HPD;
+-
+- drm_bridge_add(&sii902x->bridge);
+-
+ sii902x_audio_codec_init(sii902x, dev);
+
+ i2c_set_clientdata(sii902x->i2c, sii902x);
+@@ -1102,7 +1092,21 @@ static int sii902x_init(struct sii902x *sii902x)
+ return -ENOMEM;
+
+ sii902x->i2cmux->priv = sii902x;
+- return i2c_mux_add_adapter(sii902x->i2cmux, 0, 0, 0);
++ ret = i2c_mux_add_adapter(sii902x->i2cmux, 0, 0, 0);
++ if (ret)
++ return ret;
++
++ sii902x->bridge.funcs = &sii902x_bridge_funcs;
++ sii902x->bridge.of_node = dev->of_node;
++ sii902x->bridge.timings = &default_sii902x_timings;
++ sii902x->bridge.ops = DRM_BRIDGE_OP_DETECT | DRM_BRIDGE_OP_EDID;
++
++ if (sii902x->i2c->irq > 0)
++ sii902x->bridge.ops |= DRM_BRIDGE_OP_HPD;
++
++ drm_bridge_add(&sii902x->bridge);
++
++ return 0;
+ }
+
+ static int sii902x_probe(struct i2c_client *client)
+@@ -1170,12 +1174,11 @@ static int sii902x_probe(struct i2c_client *client)
+ }
+
+ static void sii902x_remove(struct i2c_client *client)
+-
+ {
+ struct sii902x *sii902x = i2c_get_clientdata(client);
+
+- i2c_mux_del_adapters(sii902x->i2cmux);
+ drm_bridge_remove(&sii902x->bridge);
++ i2c_mux_del_adapters(sii902x->i2cmux);
+ }
+
+ static const struct of_device_id sii902x_dt_ids[] = {
+--
+2.43.0
+
--- /dev/null
+From d509e6a0e4ced504ba4ea23c403e1bdbd7b99c27 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Dec 2023 13:32:15 +0100
+Subject: drm/exynos: fix accidental on-stack copy of exynos_drm_plane
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 960b537e91725bcb17dd1b19e48950e62d134078 ]
+
+gcc rightfully complains about excessive stack usage in the fimd_win_set_pixfmt()
+function:
+
+drivers/gpu/drm/exynos/exynos_drm_fimd.c: In function 'fimd_win_set_pixfmt':
+drivers/gpu/drm/exynos/exynos_drm_fimd.c:750:1: error: the frame size of 1032 bytes is larger than 1024 byte
+drivers/gpu/drm/exynos/exynos5433_drm_decon.c: In function 'decon_win_set_pixfmt':
+drivers/gpu/drm/exynos/exynos5433_drm_decon.c:381:1: error: the frame size of 1032 bytes is larger than 1024 bytes
+
+There is really no reason to copy the large exynos_drm_plane
+structure to the stack before using one of its members, so just
+use a pointer instead.
+
+Fixes: 6f8ee5c21722 ("drm/exynos: fimd: Make plane alpha configurable")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Signed-off-by: Inki Dae <inki.dae@samsung.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/exynos/exynos5433_drm_decon.c | 4 ++--
+ drivers/gpu/drm/exynos/exynos_drm_fimd.c | 4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/exynos/exynos5433_drm_decon.c b/drivers/gpu/drm/exynos/exynos5433_drm_decon.c
+index 4d986077738b..bce027552474 100644
+--- a/drivers/gpu/drm/exynos/exynos5433_drm_decon.c
++++ b/drivers/gpu/drm/exynos/exynos5433_drm_decon.c
+@@ -319,9 +319,9 @@ static void decon_win_set_bldmod(struct decon_context *ctx, unsigned int win,
+ static void decon_win_set_pixfmt(struct decon_context *ctx, unsigned int win,
+ struct drm_framebuffer *fb)
+ {
+- struct exynos_drm_plane plane = ctx->planes[win];
++ struct exynos_drm_plane *plane = &ctx->planes[win];
+ struct exynos_drm_plane_state *state =
+- to_exynos_plane_state(plane.base.state);
++ to_exynos_plane_state(plane->base.state);
+ unsigned int alpha = state->base.alpha;
+ unsigned int pixel_alpha;
+ unsigned long val;
+diff --git a/drivers/gpu/drm/exynos/exynos_drm_fimd.c b/drivers/gpu/drm/exynos/exynos_drm_fimd.c
+index 8dde7b1e9b35..5bdc246f5fad 100644
+--- a/drivers/gpu/drm/exynos/exynos_drm_fimd.c
++++ b/drivers/gpu/drm/exynos/exynos_drm_fimd.c
+@@ -661,9 +661,9 @@ static void fimd_win_set_bldmod(struct fimd_context *ctx, unsigned int win,
+ static void fimd_win_set_pixfmt(struct fimd_context *ctx, unsigned int win,
+ struct drm_framebuffer *fb, int width)
+ {
+- struct exynos_drm_plane plane = ctx->planes[win];
++ struct exynos_drm_plane *plane = &ctx->planes[win];
+ struct exynos_drm_plane_state *state =
+- to_exynos_plane_state(plane.base.state);
++ to_exynos_plane_state(plane->base.state);
+ uint32_t pixel_format = fb->format->format;
+ unsigned int alpha = state->base.alpha;
+ u32 val = WINCONx_ENWIN;
+--
+2.43.0
+
--- /dev/null
+From 3629a80be4134d79b70dfb9b39bebf16266a5179 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Dec 2023 12:53:15 +0300
+Subject: drm/exynos: gsc: minor fix for loop iteration in gsc_runtime_resume
+
+From: Fedor Pchelkin <pchelkin@ispras.ru>
+
+[ Upstream commit 4050957c7c2c14aa795dbf423b4180d5ac04e113 ]
+
+Do not forget to call clk_disable_unprepare() on the first element of
+ctx->clocks array.
+
+Found by Linux Verification Center (linuxtesting.org).
+
+Fixes: 8b7d3ec83aba ("drm/exynos: gsc: Convert driver to IPP v2 core API")
+Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
+Reviewed-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Signed-off-by: Inki Dae <inki.dae@samsung.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/exynos/exynos_drm_gsc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/exynos/exynos_drm_gsc.c b/drivers/gpu/drm/exynos/exynos_drm_gsc.c
+index 34cdabc30b4f..5302bebbe38c 100644
+--- a/drivers/gpu/drm/exynos/exynos_drm_gsc.c
++++ b/drivers/gpu/drm/exynos/exynos_drm_gsc.c
+@@ -1342,7 +1342,7 @@ static int __maybe_unused gsc_runtime_resume(struct device *dev)
+ for (i = 0; i < ctx->num_clocks; i++) {
+ ret = clk_prepare_enable(ctx->clocks[i]);
+ if (ret) {
+- while (--i > 0)
++ while (--i >= 0)
+ clk_disable_unprepare(ctx->clocks[i]);
+ return ret;
+ }
+--
+2.43.0
+
--- /dev/null
+From 268babb74274b785274a491fe167d2317b1d891e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Oct 2023 13:55:58 +0200
+Subject: drm/panel/raydium-rm692e5: select CONFIG_DRM_DISPLAY_DP_HELPER
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 589830b13ac21bddf99b9bc5a4ec17813d0869ef ]
+
+As with several other panel drivers, this fails to link without the DP
+helper library:
+
+ld: drivers/gpu/drm/panel/panel-raydium-rm692e5.o: in function `rm692e5_prepare':
+panel-raydium-rm692e5.c:(.text+0x11f4): undefined reference to `drm_dsc_pps_payload_pack'
+
+Select the same symbols that the others already use.
+
+Fixes: 988d0ff29ecf7 ("drm/panel: Add driver for BOE RM692E5 AMOLED panel")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://lore.kernel.org/r/20231023115619.3551348-1-arnd@kernel.org
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20231023115619.3551348-1-arnd@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panel/Kconfig | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/panel/Kconfig b/drivers/gpu/drm/panel/Kconfig
+index 99e14dc212ec..a4ac4b47777f 100644
+--- a/drivers/gpu/drm/panel/Kconfig
++++ b/drivers/gpu/drm/panel/Kconfig
+@@ -530,6 +530,8 @@ config DRM_PANEL_RAYDIUM_RM692E5
+ depends on OF
+ depends on DRM_MIPI_DSI
+ depends on BACKLIGHT_CLASS_DEVICE
++ select DRM_DISPLAY_DP_HELPER
++ select DRM_DISPLAY_HELPER
+ help
+ Say Y here if you want to enable support for Raydium RM692E5-based
+ display panels, such as the one found in the Fairphone 5 smartphone.
+--
+2.43.0
+
--- /dev/null
+From 81552d2abae99f72b82668fcf0cd99181293e5fd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Jan 2024 07:53:02 +0100
+Subject: drm/panel: samsung-s6d7aa0: drop DRM_BUS_FLAG_DE_HIGH for lsl080al02
+
+From: Artur Weber <aweber.kernel@gmail.com>
+
+[ Upstream commit 62b143b5ec4a14e1ae0dede5aabaf1832e3b0073 ]
+
+It turns out that I had misconfigured the device I was using the panel
+with; the bus data polarity is not high for this panel, I had to change
+the config on the display controller's side.
+
+Fix the panel config to properly reflect its accurate settings.
+
+Fixes: 6810bb390282 ("drm/panel: Add Samsung S6D7AA0 panel controller driver")
+Reviewed-by: Jessica Zhang <quic_jesszhan@quicinc.com>
+Signed-off-by: Artur Weber <aweber.kernel@gmail.com>
+Link: https://lore.kernel.org/r/20240105-tab3-display-fixes-v2-2-904d1207bf6f@gmail.com
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240105-tab3-display-fixes-v2-2-904d1207bf6f@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panel/panel-samsung-s6d7aa0.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/panel/panel-samsung-s6d7aa0.c b/drivers/gpu/drm/panel/panel-samsung-s6d7aa0.c
+index ea5a85779382..f23d8832a1ad 100644
+--- a/drivers/gpu/drm/panel/panel-samsung-s6d7aa0.c
++++ b/drivers/gpu/drm/panel/panel-samsung-s6d7aa0.c
+@@ -309,7 +309,7 @@ static const struct s6d7aa0_panel_desc s6d7aa0_lsl080al02_desc = {
+ .off_func = s6d7aa0_lsl080al02_off,
+ .drm_mode = &s6d7aa0_lsl080al02_mode,
+ .mode_flags = MIPI_DSI_MODE_VSYNC_FLUSH | MIPI_DSI_MODE_VIDEO_NO_HFP,
+- .bus_flags = DRM_BUS_FLAG_DE_HIGH,
++ .bus_flags = 0,
+
+ .has_backlight = false,
+ .use_passwd3 = false,
+--
+2.43.0
+
--- /dev/null
+From 38a88faf9e7c010929d52b253fc65db6dec2e235 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Oct 2023 10:42:08 +0200
+Subject: drm: panel-simple: add missing bus flags for Tianma tm070jvhg[30/33]
+
+From: Markus Niebel <Markus.Niebel@ew.tq-group.com>
+
+[ Upstream commit 45dd7df26cee741b31c25ffdd44fb8794eb45ccd ]
+
+The DE signal is active high on this display, fill in the missing
+bus_flags. This aligns panel_desc with its display_timing.
+
+Fixes: 9a2654c0f62a ("drm/panel: Add and fill drm_panel type field")
+Fixes: b3bfcdf8a3b6 ("drm/panel: simple: add Tianma TM070JVHG33")
+
+Signed-off-by: Markus Niebel <Markus.Niebel@ew.tq-group.com>
+Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Reviewed-by: Sam Ravnborg <sam@ravnborg.org>
+Link: https://lore.kernel.org/r/20231012084208.2731650-1-alexander.stein@ew.tq-group.com
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20231012084208.2731650-1-alexander.stein@ew.tq-group.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panel/panel-simple.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c
+index 9367a4572dcf..1ba633fd5696 100644
+--- a/drivers/gpu/drm/panel/panel-simple.c
++++ b/drivers/gpu/drm/panel/panel-simple.c
+@@ -3861,6 +3861,7 @@ static const struct panel_desc tianma_tm070jdhg30 = {
+ },
+ .bus_format = MEDIA_BUS_FMT_RGB888_1X7X4_SPWG,
+ .connector_type = DRM_MODE_CONNECTOR_LVDS,
++ .bus_flags = DRM_BUS_FLAG_DE_HIGH,
+ };
+
+ static const struct panel_desc tianma_tm070jvhg33 = {
+@@ -3873,6 +3874,7 @@ static const struct panel_desc tianma_tm070jvhg33 = {
+ },
+ .bus_format = MEDIA_BUS_FMT_RGB888_1X7X4_SPWG,
+ .connector_type = DRM_MODE_CONNECTOR_LVDS,
++ .bus_flags = DRM_BUS_FLAG_DE_HIGH,
+ };
+
+ static const struct display_timing tianma_tm070rvhg71_timing = {
+--
+2.43.0
+
--- /dev/null
+From 0798ad1d14fa306b796e56cd485d0b907c0a754c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Jan 2024 12:34:12 +0000
+Subject: firmware: arm_ffa: Add missing rwlock_init() for the driver partition
+
+From: Cristian Marussi <cristian.marussi@arm.com>
+
+[ Upstream commit 5ff30ade16cd9efc2466d3ea22bbaf370772941a ]
+
+Add the missing rwlock initialization for the FF-A partition associated
+the driver in ffa_setup_partitions(). It will the primary scheduler
+partition in the host or the VM partition in the virtualised environment.
+IOW, it corresponds to the partition with VM ID == drv_info->vm_id.
+
+Fixes: 1b6bf41b7a65 ("firmware: arm_ffa: Add notification handling mechanism")
+Signed-off-by: Cristian Marussi <cristian.marussi@arm.com>
+Link: https://lore.kernel.org/r/20240108-ffa_fixes_6-8-v1-2-75bf7035bc50@arm.com
+Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/arm_ffa/driver.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/firmware/arm_ffa/driver.c b/drivers/firmware/arm_ffa/driver.c
+index ed1d6a24934e..8df92c9521f4 100644
+--- a/drivers/firmware/arm_ffa/driver.c
++++ b/drivers/firmware/arm_ffa/driver.c
+@@ -1237,6 +1237,7 @@ static void ffa_setup_partitions(void)
+ info = kzalloc(sizeof(*info), GFP_KERNEL);
+ if (!info)
+ return;
++ rwlock_init(&info->rw_lock);
+ xa_store(&drv_info->partition_info, drv_info->vm_id, info, GFP_KERNEL);
+ drv_info->partition_count++;
+ }
+--
+2.43.0
+
--- /dev/null
+From 760cd70e7368ed3b960c057d0578147a8a5c30ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Jan 2024 12:34:11 +0000
+Subject: firmware: arm_ffa: Add missing rwlock_init() in
+ ffa_setup_partitions()
+
+From: Cristian Marussi <cristian.marussi@arm.com>
+
+[ Upstream commit 59b2e242b13192e50bf47df3780bf8a7e2260e98 ]
+
+Add the missing rwlock initialization for the individual FF-A partition
+information in ffa_setup_partitions().
+
+Fixes: 0184450b8b1e ("firmware: arm_ffa: Add schedule receiver callback mechanism")
+Signed-off-by: Cristian Marussi <cristian.marussi@arm.com>
+Link: https://lore.kernel.org/r/20240108-ffa_fixes_6-8-v1-1-75bf7035bc50@arm.com
+Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/arm_ffa/driver.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/firmware/arm_ffa/driver.c b/drivers/firmware/arm_ffa/driver.c
+index 6146b2927d5c..ed1d6a24934e 100644
+--- a/drivers/firmware/arm_ffa/driver.c
++++ b/drivers/firmware/arm_ffa/driver.c
+@@ -1226,6 +1226,7 @@ static void ffa_setup_partitions(void)
+ ffa_device_unregister(ffa_dev);
+ continue;
+ }
++ rwlock_init(&info->rw_lock);
+ xa_store(&drv_info->partition_info, tpbuf->id, info, GFP_KERNEL);
+ }
+ drv_info->partition_count = count;
+--
+2.43.0
+
--- /dev/null
+From 407375a011519fd5f951fd8b62627a95fc6022bb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Jan 2024 12:34:13 +0000
+Subject: firmware: arm_ffa: Check xa_load() return value
+
+From: Cristian Marussi <cristian.marussi@arm.com>
+
+[ Upstream commit c00d9738fd5fce15dc5494d05b7599dce23e8146 ]
+
+Add a check to verify the result of xa_load() during the partition
+lookups done while registering/unregistering the scheduler receiver
+interrupt callbacks and while executing the main scheduler receiver
+interrupt callback handler.
+
+Fixes: 0184450b8b1e ("firmware: arm_ffa: Add schedule receiver callback mechanism")
+Signed-off-by: Cristian Marussi <cristian.marussi@arm.com>
+Link: https://lore.kernel.org/r/20240108-ffa_fixes_6-8-v1-3-75bf7035bc50@arm.com
+Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/arm_ffa/driver.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/firmware/arm_ffa/driver.c b/drivers/firmware/arm_ffa/driver.c
+index 8df92c9521f4..0ea1dd6e55c4 100644
+--- a/drivers/firmware/arm_ffa/driver.c
++++ b/drivers/firmware/arm_ffa/driver.c
+@@ -733,6 +733,11 @@ static void __do_sched_recv_cb(u16 part_id, u16 vcpu, bool is_per_vcpu)
+ void *cb_data;
+
+ partition = xa_load(&drv_info->partition_info, part_id);
++ if (!partition) {
++ pr_err("%s: Invalid partition ID 0x%x\n", __func__, part_id);
++ return;
++ }
++
+ read_lock(&partition->rw_lock);
+ callback = partition->callback;
+ cb_data = partition->cb_data;
+@@ -915,6 +920,11 @@ static int ffa_sched_recv_cb_update(u16 part_id, ffa_sched_recv_cb callback,
+ return -EOPNOTSUPP;
+
+ partition = xa_load(&drv_info->partition_info, part_id);
++ if (!partition) {
++ pr_err("%s: Invalid partition ID 0x%x\n", __func__, part_id);
++ return -EINVAL;
++ }
++
+ write_lock(&partition->rw_lock);
+
+ cb_valid = !!partition->callback;
+--
+2.43.0
+
--- /dev/null
+From 282ee61f0a34024228575d5784ac23bbed0e2831 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Jan 2024 15:01:06 +0000
+Subject: firmware: arm_scmi: Fix the clock protocol version for v3.2
+
+From: Cristian Marussi <cristian.marussi@arm.com>
+
+[ Upstream commit 27600c96e2ffa6c1b2cb378ddc75c6620c628d04 ]
+
+The clock protocol version as per the SCMI v3.2 specification is 0x30000.
+Enable the v3.0 clock protocol features only when clock protocol version
+equals 0x30000.
+
+The previous beta version of the spec had this value set to 0x20001 and
+th same value trickled down from the initial development. The version
+update were missed in the driver.
+
+Fixes: e49e314a2cf7 ("firmware: arm_scmi: Add clock v3.2 CONFIG_SET support")
+Signed-off-by: Cristian Marussi <cristian.marussi@arm.com>
+Link: https://lore.kernel.org/r/20240109150106.2066739-1-cristian.marussi@arm.com
+Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/arm_scmi/clock.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/firmware/arm_scmi/clock.c b/drivers/firmware/arm_scmi/clock.c
+index 42b81c181d68..96b4f0694fed 100644
+--- a/drivers/firmware/arm_scmi/clock.c
++++ b/drivers/firmware/arm_scmi/clock.c
+@@ -951,8 +951,7 @@ static int scmi_clock_protocol_init(const struct scmi_protocol_handle *ph)
+ scmi_clock_describe_rates_get(ph, clkid, clk);
+ }
+
+- if (PROTOCOL_REV_MAJOR(version) >= 0x2 &&
+- PROTOCOL_REV_MINOR(version) >= 0x1) {
++ if (PROTOCOL_REV_MAJOR(version) >= 0x3) {
+ cinfo->clock_config_set = scmi_clock_config_set_v2;
+ cinfo->clock_config_get = scmi_clock_config_get_v2;
+ } else {
+--
+2.43.0
+
--- /dev/null
+From 0b343b105b5ffe1dd49ceac1b7f7a121216381d9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Jan 2024 18:50:49 +0000
+Subject: firmware: arm_scmi: Use xa_insert() to store opps
+
+From: Cristian Marussi <cristian.marussi@arm.com>
+
+[ Upstream commit e8ef4bbe39b9576a73f104f6af743fb9c7b624ba ]
+
+When storing opps by level or index use xa_insert() instead of xa_store()
+and add error-checking to spot bad duplicates indexes possibly wrongly
+provided by the platform firmware.
+
+Fixes: 31c7c1397a33 ("firmware: arm_scmi: Add v3.2 perf level indexing mode support")
+Signed-off-by: Cristian Marussi <cristian.marussi@arm.com>
+Link: https://lore.kernel.org/r/20240108185050.1628687-1-cristian.marussi@arm.com
+Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/arm_scmi/perf.c | 23 ++++++++++++++++++-----
+ 1 file changed, 18 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/firmware/arm_scmi/perf.c b/drivers/firmware/arm_scmi/perf.c
+index e11555de99ab..d26eca37dc14 100644
+--- a/drivers/firmware/arm_scmi/perf.c
++++ b/drivers/firmware/arm_scmi/perf.c
+@@ -347,8 +347,8 @@ process_response_opp(struct scmi_opp *opp, unsigned int loop_idx,
+ }
+
+ static inline void
+-process_response_opp_v4(struct perf_dom_info *dom, struct scmi_opp *opp,
+- unsigned int loop_idx,
++process_response_opp_v4(struct device *dev, struct perf_dom_info *dom,
++ struct scmi_opp *opp, unsigned int loop_idx,
+ const struct scmi_msg_resp_perf_describe_levels_v4 *r)
+ {
+ opp->perf = le32_to_cpu(r->opp[loop_idx].perf_val);
+@@ -359,10 +359,23 @@ process_response_opp_v4(struct perf_dom_info *dom, struct scmi_opp *opp,
+ /* Note that PERF v4 reports always five 32-bit words */
+ opp->indicative_freq = le32_to_cpu(r->opp[loop_idx].indicative_freq);
+ if (dom->level_indexing_mode) {
++ int ret;
++
+ opp->level_index = le32_to_cpu(r->opp[loop_idx].level_index);
+
+- xa_store(&dom->opps_by_idx, opp->level_index, opp, GFP_KERNEL);
+- xa_store(&dom->opps_by_lvl, opp->perf, opp, GFP_KERNEL);
++ ret = xa_insert(&dom->opps_by_idx, opp->level_index, opp,
++ GFP_KERNEL);
++ if (ret)
++ dev_warn(dev,
++ "Failed to add opps_by_idx at %d - ret:%d\n",
++ opp->level_index, ret);
++
++ ret = xa_insert(&dom->opps_by_lvl, opp->perf, opp, GFP_KERNEL);
++ if (ret)
++ dev_warn(dev,
++ "Failed to add opps_by_lvl at %d - ret:%d\n",
++ opp->perf, ret);
++
+ hash_add(dom->opps_by_freq, &opp->hash, opp->indicative_freq);
+ }
+ }
+@@ -379,7 +392,7 @@ iter_perf_levels_process_response(const struct scmi_protocol_handle *ph,
+ if (PROTOCOL_REV_MAJOR(p->version) <= 0x3)
+ process_response_opp(opp, st->loop_idx, response);
+ else
+- process_response_opp_v4(p->perf_dom, opp, st->loop_idx,
++ process_response_opp_v4(ph->dev, p->perf_dom, opp, st->loop_idx,
+ response);
+ p->perf_dom->opp_count++;
+
+--
+2.43.0
+
--- /dev/null
+From 0b01a8b2d44b26326d43bf948c7063e7768a783c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Jan 2024 18:50:50 +0000
+Subject: firmware: arm_scmi: Use xa_insert() when saving raw queues
+
+From: Cristian Marussi <cristian.marussi@arm.com>
+
+[ Upstream commit b5dc0ffd36560dbadaed9a3d9fd7838055d62d74 ]
+
+Use xa_insert() when saving per-channel raw queues to better check for
+duplicates.
+
+Fixes: 7860701d1e6e ("firmware: arm_scmi: Add per-channel raw injection support")
+Signed-off-by: Cristian Marussi <cristian.marussi@arm.com>
+Link: https://lore.kernel.org/r/20240108185050.1628687-2-cristian.marussi@arm.com
+Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/arm_scmi/raw_mode.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/firmware/arm_scmi/raw_mode.c b/drivers/firmware/arm_scmi/raw_mode.c
+index 0493aa3c12bf..350573518503 100644
+--- a/drivers/firmware/arm_scmi/raw_mode.c
++++ b/drivers/firmware/arm_scmi/raw_mode.c
+@@ -1111,7 +1111,6 @@ static int scmi_raw_mode_setup(struct scmi_raw_mode_info *raw,
+ int i;
+
+ for (i = 0; i < num_chans; i++) {
+- void *xret;
+ struct scmi_raw_queue *q;
+
+ q = scmi_raw_queue_init(raw);
+@@ -1120,13 +1119,12 @@ static int scmi_raw_mode_setup(struct scmi_raw_mode_info *raw,
+ goto err_xa;
+ }
+
+- xret = xa_store(&raw->chans_q, channels[i], q,
++ ret = xa_insert(&raw->chans_q, channels[i], q,
+ GFP_KERNEL);
+- if (xa_err(xret)) {
++ if (ret) {
+ dev_err(dev,
+ "Fail to allocate Raw queue 0x%02X\n",
+ channels[i]);
+- ret = xa_err(xret);
+ goto err_xa;
+ }
+ }
+@@ -1322,6 +1320,12 @@ void scmi_raw_message_report(void *r, struct scmi_xfer *xfer,
+ dev = raw->handle->dev;
+ q = scmi_raw_queue_select(raw, idx,
+ SCMI_XFER_IS_CHAN_SET(xfer) ? chan_id : 0);
++ if (!q) {
++ dev_warn(dev,
++ "RAW[%d] - NO queue for chan 0x%X. Dropping report.\n",
++ idx, chan_id);
++ return;
++ }
+
+ /*
+ * Grab the msg_q_lock upfront to avoid a possible race between
+--
+2.43.0
+
--- /dev/null
+From daed3912693f49cbe547d04b3a17f34e174810f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Jan 2024 12:54:51 +0100
+Subject: futex: Prevent the reuse of stale pi_state
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+[ Upstream commit e626cb02ee8399fd42c415e542d031d185783903 ]
+
+Jiri Slaby reported a futex state inconsistency resulting in -EINVAL during
+a lock operation for a PI futex. It requires that the a lock process is
+interrupted by a timeout or signal:
+
+ T1 Owns the futex in user space.
+
+ T2 Tries to acquire the futex in kernel (futex_lock_pi()). Allocates a
+ pi_state and attaches itself to it.
+
+ T2 Times out and removes its rt_waiter from the rt_mutex. Drops the
+ rtmutex lock and tries to acquire the hash bucket lock to remove
+ the futex_q. The lock is contended and T2 schedules out.
+
+ T1 Unlocks the futex (futex_unlock_pi()). Finds a futex_q but no
+ rt_waiter. Unlocks the futex (do_uncontended) and makes it available
+ to user space.
+
+ T3 Acquires the futex in user space.
+
+ T4 Tries to acquire the futex in kernel (futex_lock_pi()). Finds the
+ existing futex_q of T2 and tries to attach itself to the existing
+ pi_state. This (attach_to_pi_state()) fails with -EINVAL because uval
+ contains the TID of T3 but pi_state points to T1.
+
+It's incorrect to unlock the futex and make it available for user space to
+acquire as long as there is still an existing state attached to it in the
+kernel.
+
+T1 cannot hand over the futex to T2 because T2 already gave up and started
+to clean up and is blocked on the hash bucket lock, so T2's futex_q with
+the pi_state pointing to T1 is still queued.
+
+T2 observes the futex_q, but ignores it as there is no waiter on the
+corresponding rt_mutex and takes the uncontended path which allows the
+subsequent caller of futex_lock_pi() (T4) to observe that stale state.
+
+To prevent this the unlock path must dequeue all futex_q entries which
+point to the same pi_state when there is no waiter on the rt mutex. This
+requires obviously to make the dequeue conditional in the locking path to
+prevent a double dequeue. With that it's guaranteed that user space cannot
+observe an uncontended futex which has kernel state attached.
+
+Fixes: fbeb558b0dd0d ("futex/pi: Fix recursive rt_mutex waiter state")
+Reported-by: Jiri Slaby <jirislaby@kernel.org>
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Tested-by: Jiri Slaby <jirislaby@kernel.org>
+Link: https://lore.kernel.org/r/20240118115451.0TkD_ZhB@linutronix.de
+Closes: https://lore.kernel.org/all/4611bcf2-44d0-4c34-9b84-17406f881003@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/futex/core.c | 15 ++++++++++++---
+ kernel/futex/pi.c | 11 ++++++++---
+ 2 files changed, 20 insertions(+), 6 deletions(-)
+
+diff --git a/kernel/futex/core.c b/kernel/futex/core.c
+index dad981a865b8..52d0bf67e715 100644
+--- a/kernel/futex/core.c
++++ b/kernel/futex/core.c
+@@ -626,12 +626,21 @@ int futex_unqueue(struct futex_q *q)
+ }
+
+ /*
+- * PI futexes can not be requeued and must remove themselves from the
+- * hash bucket. The hash bucket lock (i.e. lock_ptr) is held.
++ * PI futexes can not be requeued and must remove themselves from the hash
++ * bucket. The hash bucket lock (i.e. lock_ptr) is held.
+ */
+ void futex_unqueue_pi(struct futex_q *q)
+ {
+- __futex_unqueue(q);
++ /*
++ * If the lock was not acquired (due to timeout or signal) then the
++ * rt_waiter is removed before futex_q is. If this is observed by
++ * an unlocker after dropping the rtmutex wait lock and before
++ * acquiring the hash bucket lock, then the unlocker dequeues the
++ * futex_q from the hash bucket list to guarantee consistent state
++ * vs. userspace. Therefore the dequeue here must be conditional.
++ */
++ if (!plist_node_empty(&q->list))
++ __futex_unqueue(q);
+
+ BUG_ON(!q->pi_state);
+ put_pi_state(q->pi_state);
+diff --git a/kernel/futex/pi.c b/kernel/futex/pi.c
+index 90e5197f4e56..5722467f2737 100644
+--- a/kernel/futex/pi.c
++++ b/kernel/futex/pi.c
+@@ -1135,6 +1135,7 @@ int futex_unlock_pi(u32 __user *uaddr, unsigned int flags)
+
+ hb = futex_hash(&key);
+ spin_lock(&hb->lock);
++retry_hb:
+
+ /*
+ * Check waiters first. We do not trust user space values at
+@@ -1177,12 +1178,17 @@ int futex_unlock_pi(u32 __user *uaddr, unsigned int flags)
+ /*
+ * Futex vs rt_mutex waiter state -- if there are no rt_mutex
+ * waiters even though futex thinks there are, then the waiter
+- * is leaving and the uncontended path is safe to take.
++ * is leaving. The entry needs to be removed from the list so a
++ * new futex_lock_pi() is not using this stale PI-state while
++ * the futex is available in user space again.
++ * There can be more than one task on its way out so it needs
++ * to retry.
+ */
+ rt_waiter = rt_mutex_top_waiter(&pi_state->pi_mutex);
+ if (!rt_waiter) {
++ __futex_unqueue(top_waiter);
+ raw_spin_unlock_irq(&pi_state->pi_mutex.wait_lock);
+- goto do_uncontended;
++ goto retry_hb;
+ }
+
+ get_pi_state(pi_state);
+@@ -1217,7 +1223,6 @@ int futex_unlock_pi(u32 __user *uaddr, unsigned int flags)
+ return ret;
+ }
+
+-do_uncontended:
+ /*
+ * We have no kernel internal state, i.e. no waiters in the
+ * kernel. Waiters which are about to queue themselves are stuck
+--
+2.43.0
+
--- /dev/null
+From ccc6e77dd9120c50d28f3973338675e30c57c4a7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Jan 2024 15:38:48 +0800
+Subject: gpio: eic-sprd: Clear interrupt after set the interrupt type
+
+From: Wenhua Lin <Wenhua.Lin@unisoc.com>
+
+[ Upstream commit 84aef4ed59705585d629e81d633a83b7d416f5fb ]
+
+The raw interrupt status of eic maybe set before the interrupt is enabled,
+since the eic interrupt has a latch function, which would trigger the
+interrupt event once enabled it from user side. To solve this problem,
+interrupts generated before setting the interrupt trigger type are ignored.
+
+Fixes: 25518e024e3a ("gpio: Add Spreadtrum EIC driver support")
+Acked-by: Chunyan Zhang <zhang.lyra@gmail.com>
+Signed-off-by: Wenhua Lin <Wenhua.Lin@unisoc.com>
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-eic-sprd.c | 32 ++++++++++++++++++++++++++++----
+ 1 file changed, 28 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpio/gpio-eic-sprd.c b/drivers/gpio/gpio-eic-sprd.c
+index be7f2fa5aa7b..806b88d8dfb7 100644
+--- a/drivers/gpio/gpio-eic-sprd.c
++++ b/drivers/gpio/gpio-eic-sprd.c
+@@ -330,20 +330,27 @@ static int sprd_eic_irq_set_type(struct irq_data *data, unsigned int flow_type)
+ switch (flow_type) {
+ case IRQ_TYPE_LEVEL_HIGH:
+ sprd_eic_update(chip, offset, SPRD_EIC_DBNC_IEV, 1);
++ sprd_eic_update(chip, offset, SPRD_EIC_DBNC_IC, 1);
+ break;
+ case IRQ_TYPE_LEVEL_LOW:
+ sprd_eic_update(chip, offset, SPRD_EIC_DBNC_IEV, 0);
++ sprd_eic_update(chip, offset, SPRD_EIC_DBNC_IC, 1);
+ break;
+ case IRQ_TYPE_EDGE_RISING:
+ case IRQ_TYPE_EDGE_FALLING:
+ case IRQ_TYPE_EDGE_BOTH:
+ state = sprd_eic_get(chip, offset);
+- if (state)
++ if (state) {
+ sprd_eic_update(chip, offset,
+ SPRD_EIC_DBNC_IEV, 0);
+- else
++ sprd_eic_update(chip, offset,
++ SPRD_EIC_DBNC_IC, 1);
++ } else {
+ sprd_eic_update(chip, offset,
+ SPRD_EIC_DBNC_IEV, 1);
++ sprd_eic_update(chip, offset,
++ SPRD_EIC_DBNC_IC, 1);
++ }
+ break;
+ default:
+ return -ENOTSUPP;
+@@ -355,20 +362,27 @@ static int sprd_eic_irq_set_type(struct irq_data *data, unsigned int flow_type)
+ switch (flow_type) {
+ case IRQ_TYPE_LEVEL_HIGH:
+ sprd_eic_update(chip, offset, SPRD_EIC_LATCH_INTPOL, 0);
++ sprd_eic_update(chip, offset, SPRD_EIC_LATCH_INTCLR, 1);
+ break;
+ case IRQ_TYPE_LEVEL_LOW:
+ sprd_eic_update(chip, offset, SPRD_EIC_LATCH_INTPOL, 1);
++ sprd_eic_update(chip, offset, SPRD_EIC_LATCH_INTCLR, 1);
+ break;
+ case IRQ_TYPE_EDGE_RISING:
+ case IRQ_TYPE_EDGE_FALLING:
+ case IRQ_TYPE_EDGE_BOTH:
+ state = sprd_eic_get(chip, offset);
+- if (state)
++ if (state) {
+ sprd_eic_update(chip, offset,
+ SPRD_EIC_LATCH_INTPOL, 0);
+- else
++ sprd_eic_update(chip, offset,
++ SPRD_EIC_LATCH_INTCLR, 1);
++ } else {
+ sprd_eic_update(chip, offset,
+ SPRD_EIC_LATCH_INTPOL, 1);
++ sprd_eic_update(chip, offset,
++ SPRD_EIC_LATCH_INTCLR, 1);
++ }
+ break;
+ default:
+ return -ENOTSUPP;
+@@ -382,29 +396,34 @@ static int sprd_eic_irq_set_type(struct irq_data *data, unsigned int flow_type)
+ sprd_eic_update(chip, offset, SPRD_EIC_ASYNC_INTBOTH, 0);
+ sprd_eic_update(chip, offset, SPRD_EIC_ASYNC_INTMODE, 0);
+ sprd_eic_update(chip, offset, SPRD_EIC_ASYNC_INTPOL, 1);
++ sprd_eic_update(chip, offset, SPRD_EIC_ASYNC_INTCLR, 1);
+ irq_set_handler_locked(data, handle_edge_irq);
+ break;
+ case IRQ_TYPE_EDGE_FALLING:
+ sprd_eic_update(chip, offset, SPRD_EIC_ASYNC_INTBOTH, 0);
+ sprd_eic_update(chip, offset, SPRD_EIC_ASYNC_INTMODE, 0);
+ sprd_eic_update(chip, offset, SPRD_EIC_ASYNC_INTPOL, 0);
++ sprd_eic_update(chip, offset, SPRD_EIC_ASYNC_INTCLR, 1);
+ irq_set_handler_locked(data, handle_edge_irq);
+ break;
+ case IRQ_TYPE_EDGE_BOTH:
+ sprd_eic_update(chip, offset, SPRD_EIC_ASYNC_INTMODE, 0);
+ sprd_eic_update(chip, offset, SPRD_EIC_ASYNC_INTBOTH, 1);
++ sprd_eic_update(chip, offset, SPRD_EIC_ASYNC_INTCLR, 1);
+ irq_set_handler_locked(data, handle_edge_irq);
+ break;
+ case IRQ_TYPE_LEVEL_HIGH:
+ sprd_eic_update(chip, offset, SPRD_EIC_ASYNC_INTBOTH, 0);
+ sprd_eic_update(chip, offset, SPRD_EIC_ASYNC_INTMODE, 1);
+ sprd_eic_update(chip, offset, SPRD_EIC_ASYNC_INTPOL, 1);
++ sprd_eic_update(chip, offset, SPRD_EIC_ASYNC_INTCLR, 1);
+ irq_set_handler_locked(data, handle_level_irq);
+ break;
+ case IRQ_TYPE_LEVEL_LOW:
+ sprd_eic_update(chip, offset, SPRD_EIC_ASYNC_INTBOTH, 0);
+ sprd_eic_update(chip, offset, SPRD_EIC_ASYNC_INTMODE, 1);
+ sprd_eic_update(chip, offset, SPRD_EIC_ASYNC_INTPOL, 0);
++ sprd_eic_update(chip, offset, SPRD_EIC_ASYNC_INTCLR, 1);
+ irq_set_handler_locked(data, handle_level_irq);
+ break;
+ default:
+@@ -417,29 +436,34 @@ static int sprd_eic_irq_set_type(struct irq_data *data, unsigned int flow_type)
+ sprd_eic_update(chip, offset, SPRD_EIC_SYNC_INTBOTH, 0);
+ sprd_eic_update(chip, offset, SPRD_EIC_SYNC_INTMODE, 0);
+ sprd_eic_update(chip, offset, SPRD_EIC_SYNC_INTPOL, 1);
++ sprd_eic_update(chip, offset, SPRD_EIC_SYNC_INTCLR, 1);
+ irq_set_handler_locked(data, handle_edge_irq);
+ break;
+ case IRQ_TYPE_EDGE_FALLING:
+ sprd_eic_update(chip, offset, SPRD_EIC_SYNC_INTBOTH, 0);
+ sprd_eic_update(chip, offset, SPRD_EIC_SYNC_INTMODE, 0);
+ sprd_eic_update(chip, offset, SPRD_EIC_SYNC_INTPOL, 0);
++ sprd_eic_update(chip, offset, SPRD_EIC_SYNC_INTCLR, 1);
+ irq_set_handler_locked(data, handle_edge_irq);
+ break;
+ case IRQ_TYPE_EDGE_BOTH:
+ sprd_eic_update(chip, offset, SPRD_EIC_SYNC_INTMODE, 0);
+ sprd_eic_update(chip, offset, SPRD_EIC_SYNC_INTBOTH, 1);
++ sprd_eic_update(chip, offset, SPRD_EIC_SYNC_INTCLR, 1);
+ irq_set_handler_locked(data, handle_edge_irq);
+ break;
+ case IRQ_TYPE_LEVEL_HIGH:
+ sprd_eic_update(chip, offset, SPRD_EIC_SYNC_INTBOTH, 0);
+ sprd_eic_update(chip, offset, SPRD_EIC_SYNC_INTMODE, 1);
+ sprd_eic_update(chip, offset, SPRD_EIC_SYNC_INTPOL, 1);
++ sprd_eic_update(chip, offset, SPRD_EIC_SYNC_INTCLR, 1);
+ irq_set_handler_locked(data, handle_level_irq);
+ break;
+ case IRQ_TYPE_LEVEL_LOW:
+ sprd_eic_update(chip, offset, SPRD_EIC_SYNC_INTBOTH, 0);
+ sprd_eic_update(chip, offset, SPRD_EIC_SYNC_INTMODE, 1);
+ sprd_eic_update(chip, offset, SPRD_EIC_SYNC_INTPOL, 0);
++ sprd_eic_update(chip, offset, SPRD_EIC_SYNC_INTCLR, 1);
+ irq_set_handler_locked(data, handle_level_irq);
+ break;
+ default:
+--
+2.43.0
+
--- /dev/null
+From c2d61000454daa06a6a1a6ce8f4ce10272d5d328 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Jan 2024 16:22:07 +0800
+Subject: LoongArch/smp: Call rcutree_report_cpu_starting() at tlb_init()
+
+From: Huacai Chen <chenhuacai@loongson.cn>
+
+[ Upstream commit 5056c596c3d1848021a4eaa76ee42f4c05c50346 ]
+
+Machines which have more than 8 nodes fail to boot SMP after commit
+a2ccf46333d7b2cf96 ("LoongArch/smp: Call rcutree_report_cpu_starting()
+earlier"). Because such machines use tlb-based per-cpu base address
+rather than dmw-based per-cpu base address, resulting per-cpu variables
+can only be accessed after tlb_init(). But rcutree_report_cpu_starting()
+is now called before tlb_init() and accesses per-cpu variables indeed.
+
+Since the original patch want to avoid the lockdep warning caused by
+page allocation in tlb_init(), we can move rcutree_report_cpu_starting()
+to tlb_init() where after tlb exception configuration but before page
+allocation.
+
+Fixes: a2ccf46333d7b2cf96 ("LoongArch/smp: Call rcutree_report_cpu_starting() earlier")
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/loongarch/kernel/smp.c | 1 -
+ arch/loongarch/mm/tlb.c | 16 ++++++++++------
+ 2 files changed, 10 insertions(+), 7 deletions(-)
+
+diff --git a/arch/loongarch/kernel/smp.c b/arch/loongarch/kernel/smp.c
+index 5bca12d16e06..2fbf541d7b4f 100644
+--- a/arch/loongarch/kernel/smp.c
++++ b/arch/loongarch/kernel/smp.c
+@@ -506,7 +506,6 @@ asmlinkage void start_secondary(void)
+ sync_counter();
+ cpu = raw_smp_processor_id();
+ set_my_cpu_offset(per_cpu_offset(cpu));
+- rcutree_report_cpu_starting(cpu);
+
+ cpu_probe();
+ constant_clockevent_init();
+diff --git a/arch/loongarch/mm/tlb.c b/arch/loongarch/mm/tlb.c
+index 2c0a411f23aa..0b95d32b30c9 100644
+--- a/arch/loongarch/mm/tlb.c
++++ b/arch/loongarch/mm/tlb.c
+@@ -284,12 +284,16 @@ static void setup_tlb_handler(int cpu)
+ set_handler(EXCCODE_TLBNR * VECSIZE, handle_tlb_protect, VECSIZE);
+ set_handler(EXCCODE_TLBNX * VECSIZE, handle_tlb_protect, VECSIZE);
+ set_handler(EXCCODE_TLBPE * VECSIZE, handle_tlb_protect, VECSIZE);
+- }
++ } else {
++ int vec_sz __maybe_unused;
++ void *addr __maybe_unused;
++ struct page *page __maybe_unused;
++
++ /* Avoid lockdep warning */
++ rcutree_report_cpu_starting(cpu);
++
+ #ifdef CONFIG_NUMA
+- else {
+- void *addr;
+- struct page *page;
+- const int vec_sz = sizeof(exception_handlers);
++ vec_sz = sizeof(exception_handlers);
+
+ if (pcpu_handlers[cpu])
+ return;
+@@ -305,8 +309,8 @@ static void setup_tlb_handler(int cpu)
+ csr_write64(pcpu_handlers[cpu], LOONGARCH_CSR_EENTRY);
+ csr_write64(pcpu_handlers[cpu], LOONGARCH_CSR_MERRENTRY);
+ csr_write64(pcpu_handlers[cpu] + 80*VECSIZE, LOONGARCH_CSR_TLBRENTRY);
+- }
+ #endif
++ }
+ }
+
+ void tlb_init(int cpu)
+--
+2.43.0
+
--- /dev/null
+From 46646d8abe91f917f8821fe61042b29409cd389b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Jan 2024 14:18:53 +0800
+Subject: memblock: fix crash when reserved memory is not added to memory
+
+From: Yajun Deng <yajun.deng@linux.dev>
+
+[ Upstream commit 6a9531c3a88096a26cf3ac582f7ec44f94a7dcb2 ]
+
+After commit 61167ad5fecd ("mm: pass nid to reserve_bootmem_region()")
+nid of a reserved region is used by init_reserved_page() (with
+CONFIG_DEFERRED_STRUCT_PAGE_INIT=y) to access node strucure.
+In many cases the nid of the reserved memory is not set and this causes
+a crash.
+
+When the nid of a reserved region is not set, fall back to
+early_pfn_to_nid(), so that nid of the first_online_node will be passed
+to init_reserved_page().
+
+Fixes: 61167ad5fecd ("mm: pass nid to reserve_bootmem_region()")
+Signed-off-by: Yajun Deng <yajun.deng@linux.dev>
+Link: https://lore.kernel.org/r/20240118061853.2652295-1-yajun.deng@linux.dev
+[rppt: massaged the commit message]
+Signed-off-by: Mike Rapoport (IBM) <rppt@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ mm/memblock.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/mm/memblock.c b/mm/memblock.c
+index 5a88d6d24d79..4823ad979b72 100644
+--- a/mm/memblock.c
++++ b/mm/memblock.c
+@@ -2141,6 +2141,9 @@ static void __init memmap_init_reserved_pages(void)
+ start = region->base;
+ end = start + region->size;
+
++ if (nid == NUMA_NO_NODE || nid >= MAX_NUMNODES)
++ nid = early_pfn_to_nid(PFN_DOWN(start));
++
+ reserve_bootmem_region(start, end, nid);
+ }
+ }
+--
+2.43.0
+
--- /dev/null
+From fb5123412443c1b85b3dc45d8984dc21d7aa54b7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Jan 2024 19:47:09 +0100
+Subject: MIPS: lantiq: register smp_ops on non-smp platforms
+
+From: Aleksander Jan Bajkowski <olek2@wp.pl>
+
+[ Upstream commit 4bf2a626dc4bb46f0754d8ac02ec8584ff114ad5 ]
+
+Lantiq uses a common kernel config for devices with 24Kc and 34Kc cores.
+The changes made previously to add support for interrupts on all cores
+work on 24Kc platforms with SMP disabled and 34Kc platforms with SMP
+enabled. This patch fixes boot issues on Danube (single core 24Kc) with
+SMP enabled.
+
+Fixes: 730320fd770d ("MIPS: lantiq: enable all hardware interrupts on second VPE")
+Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/lantiq/prom.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/arch/mips/lantiq/prom.c b/arch/mips/lantiq/prom.c
+index a3cf29365858..0c45767eacf6 100644
+--- a/arch/mips/lantiq/prom.c
++++ b/arch/mips/lantiq/prom.c
+@@ -108,10 +108,9 @@ void __init prom_init(void)
+ prom_init_cmdline();
+
+ #if defined(CONFIG_MIPS_MT_SMP)
+- if (cpu_has_mipsmt) {
+- lantiq_smp_ops = vsmp_smp_ops;
++ lantiq_smp_ops = vsmp_smp_ops;
++ if (cpu_has_mipsmt)
+ lantiq_smp_ops.init_secondary = lantiq_init_secondary;
+- register_smp_ops(&lantiq_smp_ops);
+- }
++ register_smp_ops(&lantiq_smp_ops);
+ #endif
+ }
+--
+2.43.0
+
--- /dev/null
+From a893c4f0eab8f41f0be3c5486fd264aa99fd2678 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Jan 2024 05:01:34 -0500
+Subject: platform/mellanox: mlxbf-pmc: Fix offset calculation for crspace
+ events
+
+From: Shravan Kumar Ramani <shravankr@nvidia.com>
+
+[ Upstream commit 732c35ce6d4892f7b07cc9aca61a6ad0fd400a26 ]
+
+The event selector fields for 2 counters are contained in one
+32-bit register and the current logic does not account for this.
+
+Fixes: 423c3361855c ("platform/mellanox: mlxbf-pmc: Add support for BlueField-3")
+Signed-off-by: Shravan Kumar Ramani <shravankr@nvidia.com>
+Reviewed-by: David Thompson <davthompson@nvidia.com>
+Reviewed-by: Vadim Pasternak <vadimp@nvidia.com>
+Link: https://lore.kernel.org/r/8834cfa496c97c7c2fcebcfca5a2aa007e20ae96.1705485095.git.shravankr@nvidia.com
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/mellanox/mlxbf-pmc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/platform/mellanox/mlxbf-pmc.c b/drivers/platform/mellanox/mlxbf-pmc.c
+index 1dd84c7a79de..b1995ac268d7 100644
+--- a/drivers/platform/mellanox/mlxbf-pmc.c
++++ b/drivers/platform/mellanox/mlxbf-pmc.c
+@@ -1170,7 +1170,7 @@ static int mlxbf_pmc_program_crspace_counter(int blk_num, uint32_t cnt_num,
+ int ret;
+
+ addr = pmc->block[blk_num].mmio_base +
+- (rounddown(cnt_num, 2) * MLXBF_PMC_CRSPACE_PERFSEL_SZ);
++ ((cnt_num / 2) * MLXBF_PMC_CRSPACE_PERFSEL_SZ);
+ ret = mlxbf_pmc_readl(addr, &word);
+ if (ret)
+ return ret;
+@@ -1413,7 +1413,7 @@ static int mlxbf_pmc_read_crspace_event(int blk_num, uint32_t cnt_num,
+ int ret;
+
+ addr = pmc->block[blk_num].mmio_base +
+- (rounddown(cnt_num, 2) * MLXBF_PMC_CRSPACE_PERFSEL_SZ);
++ ((cnt_num / 2) * MLXBF_PMC_CRSPACE_PERFSEL_SZ);
+ ret = mlxbf_pmc_readl(addr, &word);
+ if (ret)
+ return ret;
+--
+2.43.0
+
--- /dev/null
+From 3feddba66bb6ced7403aefe4a09b9bcdc5b73c74 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Jan 2024 00:22:50 -0800
+Subject: platform/x86/intel/ifs: Call release_firmware() when handling errors.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jithu Joseph <jithu.joseph@intel.com>
+
+[ Upstream commit 8c898ec07a2fc1d4694e81097a48e94a3816308d ]
+
+Missing release_firmware() due to error handling blocked any future image
+loading.
+
+Fix the return code and release_fiwmare() to release the bad image.
+
+Fixes: 25a76dbb36dd ("platform/x86/intel/ifs: Validate image size")
+Reported-by: Pengfei Xu <pengfei.xu@intel.com>
+Signed-off-by: Jithu Joseph <jithu.joseph@intel.com>
+Signed-off-by: Ashok Raj <ashok.raj@intel.com>
+Tested-by: Pengfei Xu <pengfei.xu@intel.com>
+Reviewed-by: Tony Luck <tony.luck@intel.com>
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Link: https://lore.kernel.org/r/20240125082254.424859-2-ashok.raj@intel.com
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/intel/ifs/load.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/platform/x86/intel/ifs/load.c b/drivers/platform/x86/intel/ifs/load.c
+index a1ee1a74fc3c..2cf3b4a8813f 100644
+--- a/drivers/platform/x86/intel/ifs/load.c
++++ b/drivers/platform/x86/intel/ifs/load.c
+@@ -399,7 +399,8 @@ int ifs_load_firmware(struct device *dev)
+ if (fw->size != expected_size) {
+ dev_err(dev, "File size mismatch (expected %u, actual %zu). Corrupted IFS image.\n",
+ expected_size, fw->size);
+- return -EINVAL;
++ ret = -EINVAL;
++ goto release;
+ }
+
+ ret = image_sanity_check(dev, (struct microcode_header_intel *)fw->data);
+--
+2.43.0
+
--- /dev/null
+From 329632aefbc2ae039df2c8cfcfebde824be611bd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Jan 2024 20:27:04 +0100
+Subject: platform/x86: wmi: Fix error handling in legacy WMI notify handler
+ functions
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Armin Wolf <W_Armin@gmx.de>
+
+[ Upstream commit 6ba7843b59b77360812617d071313c7f35f3757a ]
+
+When wmi_install_notify_handler()/wmi_remove_notify_handler() are
+unable to enable/disable the WMI device, they unconditionally return
+an error to the caller.
+When registering legacy WMI notify handlers, this means that the
+callback remains registered despite wmi_install_notify_handler()
+having returned an error.
+When removing legacy WMI notify handlers, this means that the
+callback is removed despite wmi_remove_notify_handler() having
+returned an error.
+
+Fix this by only warning when the WMI device could not be enabled.
+This behaviour matches the bus-based WMI interface.
+
+Tested on a Dell Inspiron 3505 and a Acer Aspire E1-731.
+
+Fixes: 58f6425eb92f ("WMI: Cater for multiple events with same GUID")
+Signed-off-by: Armin Wolf <W_Armin@gmx.de>
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/20240103192707.115512-2-W_Armin@gmx.de
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/wmi.c | 16 +++++++++-------
+ 1 file changed, 9 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c
+index 5dd22258cb3b..bd017478e61b 100644
+--- a/drivers/platform/x86/wmi.c
++++ b/drivers/platform/x86/wmi.c
+@@ -686,9 +686,10 @@ acpi_status wmi_install_notify_handler(const char *guid,
+ block->handler_data = data;
+
+ wmi_status = wmi_method_enable(block, true);
+- if ((wmi_status != AE_OK) ||
+- ((wmi_status == AE_OK) && (status == AE_NOT_EXIST)))
+- status = wmi_status;
++ if (ACPI_FAILURE(wmi_status))
++ dev_warn(&block->dev.dev, "Failed to enable device\n");
++
++ status = AE_OK;
+ }
+ }
+
+@@ -729,12 +730,13 @@ acpi_status wmi_remove_notify_handler(const char *guid)
+ status = AE_OK;
+ } else {
+ wmi_status = wmi_method_enable(block, false);
++ if (ACPI_FAILURE(wmi_status))
++ dev_warn(&block->dev.dev, "Failed to disable device\n");
++
+ block->handler = NULL;
+ block->handler_data = NULL;
+- if ((wmi_status != AE_OK) ||
+- ((wmi_status == AE_OK) &&
+- (status == AE_NOT_EXIST)))
+- status = wmi_status;
++
++ status = AE_OK;
+ }
+ }
+ }
+--
+2.43.0
+
--- /dev/null
+From 802534c05f9fb26f958a480707e56247c184fca5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Jan 2024 17:20:00 +0800
+Subject: riscv: dts: sophgo: separate sg2042 mtime and mtimecmp to fit aclint
+ format
+
+From: Inochi Amaoto <inochiama@outlook.com>
+
+[ Upstream commit 1f4a994be2c3d13852fd5c1054f292bd303352cc ]
+
+Change the timer layout in the dtb to fit the format that needed by
+the SBI.
+
+Fixes: 967a94a92aaa ("riscv: dts: add initial Sophgo SG2042 SoC device tree")
+Reviewed-by: Chen Wang <unicorn_wang@outlook.com>
+Reviewed-by: Guo Ren <guoren@kernel.org>
+Signed-off-by: Inochi Amaoto <inochiama@outlook.com>
+Signed-off-by: Chen Wang <unicorn_wang@outlook.com>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/boot/dts/sophgo/sg2042.dtsi | 80 +++++++++++++++-----------
+ 1 file changed, 48 insertions(+), 32 deletions(-)
+
+diff --git a/arch/riscv/boot/dts/sophgo/sg2042.dtsi b/arch/riscv/boot/dts/sophgo/sg2042.dtsi
+index 93256540d078..ead1cc35d88b 100644
+--- a/arch/riscv/boot/dts/sophgo/sg2042.dtsi
++++ b/arch/riscv/boot/dts/sophgo/sg2042.dtsi
+@@ -93,144 +93,160 @@ clint_mswi: interrupt-controller@7094000000 {
+ <&cpu63_intc 3>;
+ };
+
+- clint_mtimer0: timer@70ac000000 {
++ clint_mtimer0: timer@70ac004000 {
+ compatible = "sophgo,sg2042-aclint-mtimer", "thead,c900-aclint-mtimer";
+- reg = <0x00000070 0xac000000 0x00000000 0x00007ff8>;
++ reg = <0x00000070 0xac004000 0x00000000 0x0000c000>;
++ reg-names = "mtimecmp";
+ interrupts-extended = <&cpu0_intc 7>,
+ <&cpu1_intc 7>,
+ <&cpu2_intc 7>,
+ <&cpu3_intc 7>;
+ };
+
+- clint_mtimer1: timer@70ac010000 {
++ clint_mtimer1: timer@70ac014000 {
+ compatible = "sophgo,sg2042-aclint-mtimer", "thead,c900-aclint-mtimer";
+- reg = <0x00000070 0xac010000 0x00000000 0x00007ff8>;
++ reg = <0x00000070 0xac014000 0x00000000 0x0000c000>;
++ reg-names = "mtimecmp";
+ interrupts-extended = <&cpu4_intc 7>,
+ <&cpu5_intc 7>,
+ <&cpu6_intc 7>,
+ <&cpu7_intc 7>;
+ };
+
+- clint_mtimer2: timer@70ac020000 {
++ clint_mtimer2: timer@70ac024000 {
+ compatible = "sophgo,sg2042-aclint-mtimer", "thead,c900-aclint-mtimer";
+- reg = <0x00000070 0xac020000 0x00000000 0x00007ff8>;
++ reg = <0x00000070 0xac024000 0x00000000 0x0000c000>;
++ reg-names = "mtimecmp";
+ interrupts-extended = <&cpu8_intc 7>,
+ <&cpu9_intc 7>,
+ <&cpu10_intc 7>,
+ <&cpu11_intc 7>;
+ };
+
+- clint_mtimer3: timer@70ac030000 {
++ clint_mtimer3: timer@70ac034000 {
+ compatible = "sophgo,sg2042-aclint-mtimer", "thead,c900-aclint-mtimer";
+- reg = <0x00000070 0xac030000 0x00000000 0x00007ff8>;
++ reg = <0x00000070 0xac034000 0x00000000 0x0000c000>;
++ reg-names = "mtimecmp";
+ interrupts-extended = <&cpu12_intc 7>,
+ <&cpu13_intc 7>,
+ <&cpu14_intc 7>,
+ <&cpu15_intc 7>;
+ };
+
+- clint_mtimer4: timer@70ac040000 {
++ clint_mtimer4: timer@70ac044000 {
+ compatible = "sophgo,sg2042-aclint-mtimer", "thead,c900-aclint-mtimer";
+- reg = <0x00000070 0xac040000 0x00000000 0x00007ff8>;
++ reg = <0x00000070 0xac044000 0x00000000 0x0000c000>;
++ reg-names = "mtimecmp";
+ interrupts-extended = <&cpu16_intc 7>,
+ <&cpu17_intc 7>,
+ <&cpu18_intc 7>,
+ <&cpu19_intc 7>;
+ };
+
+- clint_mtimer5: timer@70ac050000 {
++ clint_mtimer5: timer@70ac054000 {
+ compatible = "sophgo,sg2042-aclint-mtimer", "thead,c900-aclint-mtimer";
+- reg = <0x00000070 0xac050000 0x00000000 0x00007ff8>;
++ reg = <0x00000070 0xac054000 0x00000000 0x0000c000>;
++ reg-names = "mtimecmp";
+ interrupts-extended = <&cpu20_intc 7>,
+ <&cpu21_intc 7>,
+ <&cpu22_intc 7>,
+ <&cpu23_intc 7>;
+ };
+
+- clint_mtimer6: timer@70ac060000 {
++ clint_mtimer6: timer@70ac064000 {
+ compatible = "sophgo,sg2042-aclint-mtimer", "thead,c900-aclint-mtimer";
+- reg = <0x00000070 0xac060000 0x00000000 0x00007ff8>;
++ reg = <0x00000070 0xac064000 0x00000000 0x0000c000>;
++ reg-names = "mtimecmp";
+ interrupts-extended = <&cpu24_intc 7>,
+ <&cpu25_intc 7>,
+ <&cpu26_intc 7>,
+ <&cpu27_intc 7>;
+ };
+
+- clint_mtimer7: timer@70ac070000 {
++ clint_mtimer7: timer@70ac074000 {
+ compatible = "sophgo,sg2042-aclint-mtimer", "thead,c900-aclint-mtimer";
+- reg = <0x00000070 0xac070000 0x00000000 0x00007ff8>;
++ reg = <0x00000070 0xac074000 0x00000000 0x0000c000>;
++ reg-names = "mtimecmp";
+ interrupts-extended = <&cpu28_intc 7>,
+ <&cpu29_intc 7>,
+ <&cpu30_intc 7>,
+ <&cpu31_intc 7>;
+ };
+
+- clint_mtimer8: timer@70ac080000 {
++ clint_mtimer8: timer@70ac084000 {
+ compatible = "sophgo,sg2042-aclint-mtimer", "thead,c900-aclint-mtimer";
+- reg = <0x00000070 0xac080000 0x00000000 0x00007ff8>;
++ reg = <0x00000070 0xac084000 0x00000000 0x0000c000>;
++ reg-names = "mtimecmp";
+ interrupts-extended = <&cpu32_intc 7>,
+ <&cpu33_intc 7>,
+ <&cpu34_intc 7>,
+ <&cpu35_intc 7>;
+ };
+
+- clint_mtimer9: timer@70ac090000 {
++ clint_mtimer9: timer@70ac094000 {
+ compatible = "sophgo,sg2042-aclint-mtimer", "thead,c900-aclint-mtimer";
+- reg = <0x00000070 0xac090000 0x00000000 0x00007ff8>;
++ reg = <0x00000070 0xac094000 0x00000000 0x0000c000>;
++ reg-names = "mtimecmp";
+ interrupts-extended = <&cpu36_intc 7>,
+ <&cpu37_intc 7>,
+ <&cpu38_intc 7>,
+ <&cpu39_intc 7>;
+ };
+
+- clint_mtimer10: timer@70ac0a0000 {
++ clint_mtimer10: timer@70ac0a4000 {
+ compatible = "sophgo,sg2042-aclint-mtimer", "thead,c900-aclint-mtimer";
+- reg = <0x00000070 0xac0a0000 0x00000000 0x00007ff8>;
++ reg = <0x00000070 0xac0a4000 0x00000000 0x0000c000>;
++ reg-names = "mtimecmp";
+ interrupts-extended = <&cpu40_intc 7>,
+ <&cpu41_intc 7>,
+ <&cpu42_intc 7>,
+ <&cpu43_intc 7>;
+ };
+
+- clint_mtimer11: timer@70ac0b0000 {
++ clint_mtimer11: timer@70ac0b4000 {
+ compatible = "sophgo,sg2042-aclint-mtimer", "thead,c900-aclint-mtimer";
+- reg = <0x00000070 0xac0b0000 0x00000000 0x00007ff8>;
++ reg = <0x00000070 0xac0b4000 0x00000000 0x0000c000>;
++ reg-names = "mtimecmp";
+ interrupts-extended = <&cpu44_intc 7>,
+ <&cpu45_intc 7>,
+ <&cpu46_intc 7>,
+ <&cpu47_intc 7>;
+ };
+
+- clint_mtimer12: timer@70ac0c0000 {
++ clint_mtimer12: timer@70ac0c4000 {
+ compatible = "sophgo,sg2042-aclint-mtimer", "thead,c900-aclint-mtimer";
+- reg = <0x00000070 0xac0c0000 0x00000000 0x00007ff8>;
++ reg = <0x00000070 0xac0c4000 0x00000000 0x0000c000>;
++ reg-names = "mtimecmp";
+ interrupts-extended = <&cpu48_intc 7>,
+ <&cpu49_intc 7>,
+ <&cpu50_intc 7>,
+ <&cpu51_intc 7>;
+ };
+
+- clint_mtimer13: timer@70ac0d0000 {
++ clint_mtimer13: timer@70ac0d4000 {
+ compatible = "sophgo,sg2042-aclint-mtimer", "thead,c900-aclint-mtimer";
+- reg = <0x00000070 0xac0d0000 0x00000000 0x00007ff8>;
++ reg = <0x00000070 0xac0d4000 0x00000000 0x0000c000>;
++ reg-names = "mtimecmp";
+ interrupts-extended = <&cpu52_intc 7>,
+ <&cpu53_intc 7>,
+ <&cpu54_intc 7>,
+ <&cpu55_intc 7>;
+ };
+
+- clint_mtimer14: timer@70ac0e0000 {
++ clint_mtimer14: timer@70ac0e4000 {
+ compatible = "sophgo,sg2042-aclint-mtimer", "thead,c900-aclint-mtimer";
+- reg = <0x00000070 0xac0e0000 0x00000000 0x00007ff8>;
++ reg = <0x00000070 0xac0e4000 0x00000000 0x0000c000>;
++ reg-names = "mtimecmp";
+ interrupts-extended = <&cpu56_intc 7>,
+ <&cpu57_intc 7>,
+ <&cpu58_intc 7>,
+ <&cpu59_intc 7>;
+ };
+
+- clint_mtimer15: timer@70ac0f0000 {
++ clint_mtimer15: timer@70ac0f4000 {
+ compatible = "sophgo,sg2042-aclint-mtimer", "thead,c900-aclint-mtimer";
+- reg = <0x00000070 0xac0f0000 0x00000000 0x00007ff8>;
++ reg = <0x00000070 0xac0f4000 0x00000000 0x0000c000>;
++ reg-names = "mtimecmp";
+ interrupts-extended = <&cpu60_intc 7>,
+ <&cpu61_intc 7>,
+ <&cpu62_intc 7>,
+--
+2.43.0
+
drm-amdgpu-enable-tunneling-on-high-priority-compute.patch
drm-amdgpu-gfx10-set-unord_dispatch-in-compute-mqds.patch
drm-amdgpu-gfx11-set-unord_dispatch-in-compute-mqds.patch
+drm-bridge-parade-ps8640-wait-for-hpd-when-doing-an-.patch
+drm-panel-simple-add-missing-bus-flags-for-tianma-tm.patch
+drm-panel-samsung-s6d7aa0-drop-drm_bus_flag_de_high-.patch
+drm-panel-raydium-rm692e5-select-config_drm_display_.patch
+drm-bridge-sii902x-fix-probing-race-issue.patch
+drm-bridge-sii902x-fix-audio-codec-unregistration.patch
+drm-bridge-parade-ps8640-ensure-bridge-is-suspended-.patch
+drm-bridge-parade-ps8640-make-sure-we-drop-the-aux-m.patch
+memblock-fix-crash-when-reserved-memory-is-not-added.patch
+futex-prevent-the-reuse-of-stale-pi_state.patch
+drm-exynos-fix-accidental-on-stack-copy-of-exynos_dr.patch
+drm-exynos-gsc-minor-fix-for-loop-iteration-in-gsc_r.patch
+firmware-arm_scmi-use-xa_insert-to-store-opps.patch
+firmware-arm_scmi-use-xa_insert-when-saving-raw-queu.patch
+firmware-arm_scmi-fix-the-clock-protocol-version-for.patch
+firmware-arm_ffa-add-missing-rwlock_init-in-ffa_setu.patch
+firmware-arm_ffa-add-missing-rwlock_init-for-the-dri.patch
+firmware-arm_ffa-check-xa_load-return-value.patch
+platform-x86-wmi-fix-error-handling-in-legacy-wmi-no.patch
+gpio-eic-sprd-clear-interrupt-after-set-the-interrup.patch
+arm-dts-exynos4212-tab3-add-samsung-invert-vclk-flag.patch
+platform-mellanox-mlxbf-pmc-fix-offset-calculation-f.patch
+spi-intel-pci-remove-meteor-lake-s-soc-pci-id-from-t.patch
+block-move-checking-genhd_fl_no_part-to-bdev_add_par.patch
+drm-bridge-anx7625-ensure-bridge-is-suspended-in-dis.patch
+cpufreq-amd-pstate-fix-setting-scaling-max-min-freq-.patch
+spi-bcm-qspi-fix-sfdp-bfpt-read-by-usig-mspi-read.patch
+spi-spi-cadence-reverse-the-order-of-interleaved-wri.patch
+cifs-fix-stray-unlock-in-cifs_chan_skip_or_disable.patch
+spi-fix-finalize-message-on-error-return.patch
+loongarch-smp-call-rcutree_report_cpu_starting-at-tl.patch
+mips-lantiq-register-smp_ops-on-non-smp-platforms.patch
+riscv-dts-sophgo-separate-sg2042-mtime-and-mtimecmp-.patch
+drm-bridge-samsung-dsim-don-t-use-force_stop_state.patch
+platform-x86-intel-ifs-call-release_firmware-when-ha.patch
--- /dev/null
+From 7bc5c640746e53d9842b6e1ecfad9463dd4999b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Jan 2024 16:00:32 -0500
+Subject: spi: bcm-qspi: fix SFDP BFPT read by usig mspi read
+
+From: Kamal Dasu <kamal.dasu@broadcom.com>
+
+[ Upstream commit 574bf7bbe83794a902679846770f75a9b7f28176 ]
+
+SFDP read shall use the mspi reads when using the bcm_qspi_exec_mem_op()
+call. This fixes SFDP parameter page read failures seen with parts that
+now use SFDP protocol to read the basic flash parameter table.
+
+Fixes: 5f195ee7d830 ("spi: bcm-qspi: Implement the spi_mem interface")
+Signed-off-by: Kamal Dasu <kamal.dasu@broadcom.com>
+Tested-by: Florian Fainelli <florian.fainelli@broadcom.com>
+Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
+Link: https://msgid.link/r/20240109210033.43249-1-kamal.dasu@broadcom.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-bcm-qspi.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/spi/spi-bcm-qspi.c b/drivers/spi/spi-bcm-qspi.c
+index ef08fcac2f6d..0407b91183ca 100644
+--- a/drivers/spi/spi-bcm-qspi.c
++++ b/drivers/spi/spi-bcm-qspi.c
+@@ -19,7 +19,7 @@
+ #include <linux/platform_device.h>
+ #include <linux/slab.h>
+ #include <linux/spi/spi.h>
+-#include <linux/spi/spi-mem.h>
++#include <linux/mtd/spi-nor.h>
+ #include <linux/sysfs.h>
+ #include <linux/types.h>
+ #include "spi-bcm-qspi.h"
+@@ -1221,7 +1221,7 @@ static int bcm_qspi_exec_mem_op(struct spi_mem *mem,
+
+ /* non-aligned and very short transfers are handled by MSPI */
+ if (!IS_ALIGNED((uintptr_t)addr, 4) || !IS_ALIGNED((uintptr_t)buf, 4) ||
+- len < 4)
++ len < 4 || op->cmd.opcode == SPINOR_OP_RDSFDP)
+ mspi_read = true;
+
+ if (!has_bspi(qspi) || mspi_read)
+--
+2.43.0
+
--- /dev/null
+From 614db1c2aeb592475e9d28fe2126d33f22797776 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Jan 2024 14:53:09 -0600
+Subject: spi: fix finalize message on error return
+
+From: David Lechner <dlechner@baylibre.com>
+
+[ Upstream commit 8c2ae772fe08e33f3d7a83849e85539320701abd ]
+
+In __spi_pump_transfer_message(), the message was not finalized in the
+first error return as it is in the other error return paths. Not
+finalizing the message could cause anything waiting on the message to
+complete to hang forever.
+
+This adds the missing call to spi_finalize_current_message().
+
+Fixes: ae7d2346dc89 ("spi: Don't use the message queue if possible in spi_sync")
+Signed-off-by: David Lechner <dlechner@baylibre.com>
+Link: https://msgid.link/r/20240125205312.3458541-2-dlechner@baylibre.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
+index 8ead7acb99f3..4adc56dabf55 100644
+--- a/drivers/spi/spi.c
++++ b/drivers/spi/spi.c
+@@ -1624,6 +1624,10 @@ static int __spi_pump_transfer_message(struct spi_controller *ctlr,
+ pm_runtime_put_noidle(ctlr->dev.parent);
+ dev_err(&ctlr->dev, "Failed to power device: %d\n",
+ ret);
++
++ msg->status = ret;
++ spi_finalize_current_message(ctlr);
++
+ return ret;
+ }
+ }
+--
+2.43.0
+
--- /dev/null
+From b6a4358c6fcf988447a7bfecf5b3b985521e09a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Jan 2024 14:00:33 +0200
+Subject: spi: intel-pci: Remove Meteor Lake-S SoC PCI ID from the list
+
+From: Mika Westerberg <mika.westerberg@linux.intel.com>
+
+[ Upstream commit 6c314425b9ef6b247cefd0903e287eb072580c3b ]
+
+Turns out this "SoC" side controller does not support certain commands,
+such as reading chip JEDEC ID, so the controller is pretty much unusable
+in Linux. We should be using the "PCH" side controller instead. For this
+reason remove this PCI ID from the list.
+
+Fixes: c2912d42e86e ("spi: intel-pci: Add support for Meteor Lake-S SPI serial flash")
+Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Link: https://msgid.link/r/20240122120034.2664812-2-mika.westerberg@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-intel-pci.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/spi/spi-intel-pci.c b/drivers/spi/spi-intel-pci.c
+index 57d767a68e7b..b9918dcc3802 100644
+--- a/drivers/spi/spi-intel-pci.c
++++ b/drivers/spi/spi-intel-pci.c
+@@ -84,7 +84,6 @@ static const struct pci_device_id intel_spi_pci_ids[] = {
+ { PCI_VDEVICE(INTEL, 0xa2a4), (unsigned long)&cnl_info },
+ { PCI_VDEVICE(INTEL, 0xa324), (unsigned long)&cnl_info },
+ { PCI_VDEVICE(INTEL, 0xa3a4), (unsigned long)&cnl_info },
+- { PCI_VDEVICE(INTEL, 0xae23), (unsigned long)&cnl_info },
+ { },
+ };
+ MODULE_DEVICE_TABLE(pci, intel_spi_pci_ids);
+--
+2.43.0
+
--- /dev/null
+From c0fc58fd437b9b4b7572c19e39fc9534793b9171 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Dec 2023 14:36:52 +0530
+Subject: spi: spi-cadence: Reverse the order of interleaved write and read
+ operations
+
+From: Amit Kumar Mahapatra <amit.kumar-mahapatra@amd.com>
+
+[ Upstream commit 633cd6fe6e1993ba80e0954c2db127a0b1a3e66f ]
+
+In the existing implementation, when executing interleaved write and read
+operations in the ISR for a transfer length greater than the FIFO size,
+the TXFIFO write precedes the RXFIFO read. Consequently, the initially
+received data in the RXFIFO is pushed out and lost, leading to a failure
+in data integrity. To address this issue, reverse the order of interleaved
+operations and conduct the RXFIFO read followed by the TXFIFO write.
+
+Fixes: 6afe2ae8dc48 ("spi: spi-cadence: Interleave write of TX and read of RX FIFO")
+Signed-off-by: Amit Kumar Mahapatra <amit.kumar-mahapatra@amd.com>
+Link: https://msgid.link/r/20231218090652.18403-1-amit.kumar-mahapatra@amd.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-cadence.c | 17 +++++++++--------
+ 1 file changed, 9 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/spi/spi-cadence.c b/drivers/spi/spi-cadence.c
+index a50eb4db79de..e5140532071d 100644
+--- a/drivers/spi/spi-cadence.c
++++ b/drivers/spi/spi-cadence.c
+@@ -317,6 +317,15 @@ static void cdns_spi_process_fifo(struct cdns_spi *xspi, int ntx, int nrx)
+ xspi->rx_bytes -= nrx;
+
+ while (ntx || nrx) {
++ if (nrx) {
++ u8 data = cdns_spi_read(xspi, CDNS_SPI_RXD);
++
++ if (xspi->rxbuf)
++ *xspi->rxbuf++ = data;
++
++ nrx--;
++ }
++
+ if (ntx) {
+ if (xspi->txbuf)
+ cdns_spi_write(xspi, CDNS_SPI_TXD, *xspi->txbuf++);
+@@ -326,14 +335,6 @@ static void cdns_spi_process_fifo(struct cdns_spi *xspi, int ntx, int nrx)
+ ntx--;
+ }
+
+- if (nrx) {
+- u8 data = cdns_spi_read(xspi, CDNS_SPI_RXD);
+-
+- if (xspi->rxbuf)
+- *xspi->rxbuf++ = data;
+-
+- nrx--;
+- }
+ }
+ }
+
+--
+2.43.0
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
