--- /dev/null
+From 96b0aba20459f643b368c07d2d2b61aa3dad46f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Jun 2023 02:13:32 +0200
+Subject: Add MODULE_FIRMWARE() for FIRMWARE_TG357766.
+
+From: Tobias Heider <me@tobhe.de>
+
+[ Upstream commit 046f753da6143ee16452966915087ec8b0de3c70 ]
+
+Fixes a bug where on the M1 mac mini initramfs-tools fails to
+include the necessary firmware into the initrd.
+
+Fixes: c4dab50697ff ("tg3: Download 57766 EEE service patch firmware")
+Signed-off-by: Tobias Heider <me@tobhe.de>
+Reviewed-by: Michael Chan <michael.chan@broadcom.com>
+Link: https://lore.kernel.org/r/ZJt7LKzjdz8+dClx@tobhe.de
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/tg3.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
+index 58747292521d8..a52cf9aae4988 100644
+--- a/drivers/net/ethernet/broadcom/tg3.c
++++ b/drivers/net/ethernet/broadcom/tg3.c
+@@ -224,6 +224,7 @@ MODULE_AUTHOR("David S. Miller (davem@redhat.com) and Jeff Garzik (jgarzik@pobox
+ MODULE_DESCRIPTION("Broadcom Tigon3 ethernet driver");
+ MODULE_LICENSE("GPL");
+ MODULE_FIRMWARE(FIRMWARE_TG3);
++MODULE_FIRMWARE(FIRMWARE_TG357766);
+ MODULE_FIRMWARE(FIRMWARE_TG3TSO);
+ MODULE_FIRMWARE(FIRMWARE_TG3TSO5);
+
+--
+2.39.2
+
--- /dev/null
+From 8b9acf5280d10e836fb3ea6be279353858dc4fdb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Jul 2023 20:22:15 +0100
+Subject: afs: Fix accidental truncation when storing data
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit 03275585cabd0240944f19f33d7584a1b099a3a8 ]
+
+When an AFS FS.StoreData RPC call is made, amongst other things it is
+given the resultant file size to be. On the server, this is processed
+by truncating the file to new size and then writing the data.
+
+Now, kafs has a lock (vnode->io_lock) that serves to serialise
+operations against a specific vnode (ie. inode), but the parameters for
+the op are set before the lock is taken. This allows two writebacks
+(say sync and kswapd) to race - and if writes are ongoing the writeback
+for a later write could occur before the writeback for an earlier one if
+the latter gets interrupted.
+
+Note that afs_writepages() cannot take i_mutex and only takes a shared
+lock on vnode->validate_lock.
+
+Also note that the server does the truncation and the write inside a
+lock, so there's no problem at that end.
+
+Fix this by moving the calculation for the proposed new i_size inside
+the vnode->io_lock. Also reset the iterator (which we might have read
+from) and update the mtime setting there.
+
+Fixes: bd80d8a80e12 ("afs: Use ITER_XARRAY for writing")
+Reported-by: Marc Dionne <marc.dionne@auristor.com>
+Signed-off-by: David Howells <dhowells@redhat.com>
+Reviewed-by: Jeffrey Altman <jaltman@auristor.com>
+Reviewed-by: Marc Dionne <marc.dionne@auristor.com>
+cc: linux-afs@lists.infradead.org
+cc: linux-fsdevel@vger.kernel.org
+Link: https://lore.kernel.org/r/3526895.1687960024@warthog.procyon.org.uk/
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/afs/write.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/fs/afs/write.c b/fs/afs/write.c
+index 8750b99c3f566..c1f4391ccd7c6 100644
+--- a/fs/afs/write.c
++++ b/fs/afs/write.c
+@@ -413,17 +413,19 @@ static int afs_store_data(struct afs_vnode *vnode, struct iov_iter *iter, loff_t
+ afs_op_set_vnode(op, 0, vnode);
+ op->file[0].dv_delta = 1;
+ op->file[0].modification = true;
+- op->store.write_iter = iter;
+ op->store.pos = pos;
+ op->store.size = size;
+- op->store.i_size = max(pos + size, vnode->netfs.remote_i_size);
+ op->store.laundering = laundering;
+- op->mtime = vnode->netfs.inode.i_mtime;
+ op->flags |= AFS_OPERATION_UNINTR;
+ op->ops = &afs_store_data_operation;
+
+ try_next_key:
+ afs_begin_vnode_operation(op);
++
++ op->store.write_iter = iter;
++ op->store.i_size = max(pos + size, vnode->netfs.remote_i_size);
++ op->mtime = vnode->netfs.inode.i_mtime;
++
+ afs_wait_for_operation(op);
+
+ switch (op->error) {
+--
+2.39.2
+
--- /dev/null
+From edee5651c4fdc5f8b959f92822e8cada76d8c389 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Apr 2023 00:24:47 -0700
+Subject: apparmor: add missing failure check in compute_xmatch_perms
+
+From: John Johansen <john.johansen@canonical.com>
+
+[ Upstream commit 6600e9f692e36e265ef0828f08337fa294bb330f ]
+
+Add check for failure to allocate the permission table.
+
+Fixes: caa9f579ca72 ("apparmor: isolate policy backwards compatibility to its own file")
+Signed-off-by: John Johansen <john.johansen@canonical.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/apparmor/policy_compat.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/security/apparmor/policy_compat.c b/security/apparmor/policy_compat.c
+index cc89d1e88fb74..6fa185ce8d9dc 100644
+--- a/security/apparmor/policy_compat.c
++++ b/security/apparmor/policy_compat.c
+@@ -179,6 +179,8 @@ static struct aa_perms *compute_xmatch_perms(struct aa_dfa *xmatch)
+ state_count = xmatch->tables[YYTD_ID_BASE]->td_lolen;
+ /* DFAs are restricted from having a state_count of less than 2 */
+ perms = kvcalloc(state_count, sizeof(struct aa_perms), GFP_KERNEL);
++ if (!perms)
++ return NULL;
+
+ /* zero init so skip the trap state (state == 0) */
+ for (state = 1; state < state_count; state++)
+--
+2.39.2
+
--- /dev/null
+From 32e15be51a553269f3f02aa9717949723866760a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Apr 2023 19:05:49 +0000
+Subject: apparmor: fix missing error check for rhashtable_insert_fast
+
+From: Danila Chernetsov <listdansp@mail.ru>
+
+[ Upstream commit 000518bc5aef25d3f703592a0296d578c98b1517 ]
+
+ rhashtable_insert_fast() could return err value when memory allocation is
+ failed. but unpack_profile() do not check values and this always returns
+ success value. This patch just adds error check code.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: e025be0f26d5 ("apparmor: support querying extended trusted helper extra data")
+
+Signed-off-by: Danila Chernetsov <listdansp@mail.ru>
+Signed-off-by: John Johansen <john.johansen@canonical.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/apparmor/policy_unpack.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c
+index 278ed96c30a26..72aac376d3ed7 100644
+--- a/security/apparmor/policy_unpack.c
++++ b/security/apparmor/policy_unpack.c
+@@ -1064,8 +1064,13 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name)
+ goto fail;
+ }
+
+- rhashtable_insert_fast(profile->data, &data->head,
+- profile->data->p);
++ if (rhashtable_insert_fast(profile->data, &data->head,
++ profile->data->p)) {
++ kfree_sensitive(data->key);
++ kfree_sensitive(data);
++ info = "failed to insert data to table";
++ goto fail;
++ }
+ }
+
+ if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL)) {
+--
+2.39.2
+
--- /dev/null
+From 698d2ad90194bccc41c913451e5c547a9d0d4a34 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Mar 2023 15:59:45 -0800
+Subject: apparmor: fix policy_compat permission remap with extended
+ permissions
+
+From: John Johansen <john.johansen@canonical.com>
+
+[ Upstream commit 0bac2002b397fda7c9ea81ee0b06a02242958107 ]
+
+If the extended permission table is present we should not be attempting
+to do a compat_permission remap as the compat_permissions are not
+stored in the dfa accept states.
+
+Fixes: fd1b2b95a211 ("apparmor: add the ability for policy to specify a permission table")
+Signed-off-by: John Johansen <john.johansen@canonical.com>
+Reviewed-by: Jon Tourville <jontourville@me.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/apparmor/policy_unpack.c | 31 +++++++++++++++++++------------
+ 1 file changed, 19 insertions(+), 12 deletions(-)
+
+diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c
+index 72aac376d3ed7..d50774a16494f 100644
+--- a/security/apparmor/policy_unpack.c
++++ b/security/apparmor/policy_unpack.c
+@@ -860,10 +860,12 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name)
+ }
+ profile->attach.xmatch_len = tmp;
+ profile->attach.xmatch.start[AA_CLASS_XMATCH] = DFA_START;
+- error = aa_compat_map_xmatch(&profile->attach.xmatch);
+- if (error) {
+- info = "failed to convert xmatch permission table";
+- goto fail;
++ if (!profile->attach.xmatch.perms) {
++ error = aa_compat_map_xmatch(&profile->attach.xmatch);
++ if (error) {
++ info = "failed to convert xmatch permission table";
++ goto fail;
++ }
+ }
+ }
+
+@@ -983,10 +985,13 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name)
+ AA_CLASS_FILE);
+ if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL))
+ goto fail;
+- error = aa_compat_map_policy(&rules->policy, e->version);
+- if (error) {
+- info = "failed to remap policydb permission table";
+- goto fail;
++ if (!rules->policy.perms) {
++ error = aa_compat_map_policy(&rules->policy,
++ e->version);
++ if (error) {
++ info = "failed to remap policydb permission table";
++ goto fail;
++ }
+ }
+ } else {
+ rules->policy.dfa = aa_get_dfa(nulldfa);
+@@ -1001,10 +1006,12 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name)
+ if (error) {
+ goto fail;
+ } else if (rules->file.dfa) {
+- error = aa_compat_map_file(&rules->file);
+- if (error) {
+- info = "failed to remap file permission table";
+- goto fail;
++ if (!rules->file.perms) {
++ error = aa_compat_map_file(&rules->file);
++ if (error) {
++ info = "failed to remap file permission table";
++ goto fail;
++ }
+ }
+ } else if (rules->policy.dfa &&
+ rules->policy.start[AA_CLASS_FILE]) {
+--
+2.39.2
+
--- /dev/null
+From 758060d91aa3938374ff16394780270d9a6c9614 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Apr 2023 02:57:55 -0700
+Subject: apparmor: fix profile verification and enable it
+
+From: John Johansen <john.johansen@canonical.com>
+
+[ Upstream commit 6f442d42c0d89876994a4a135eadf82b0e6ff6e4 ]
+
+The transition table size was not being set by compat mappings
+resulting in the profile verification code not being run. Unfortunately
+the checks were also buggy not being correctly updated from the old
+accept perms, to the new layout.
+
+Also indicate to userspace that the kernel has the permstable verification
+fixes.
+
+BugLink: http://bugs.launchpad.net/bugs/2017903
+Fixes: 670f31774ab6 ("apparmor: verify permission table indexes")
+Signed-off-by: John Johansen <john.johansen@canonical.com>
+Reviewed-by: Jon Tourville <jontourville@me.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/apparmor/policy_compat.c | 18 ++++++++++------
+ security/apparmor/policy_unpack.c | 34 ++++++++++++++-----------------
+ 2 files changed, 27 insertions(+), 25 deletions(-)
+
+diff --git a/security/apparmor/policy_compat.c b/security/apparmor/policy_compat.c
+index 6fa185ce8d9dc..0cb02da8a3193 100644
+--- a/security/apparmor/policy_compat.c
++++ b/security/apparmor/policy_compat.c
+@@ -146,7 +146,8 @@ static struct aa_perms compute_fperms_other(struct aa_dfa *dfa,
+ *
+ * Returns: remapped perm table
+ */
+-static struct aa_perms *compute_fperms(struct aa_dfa *dfa)
++static struct aa_perms *compute_fperms(struct aa_dfa *dfa,
++ u32 *size)
+ {
+ aa_state_t state;
+ unsigned int state_count;
+@@ -159,6 +160,7 @@ static struct aa_perms *compute_fperms(struct aa_dfa *dfa)
+ table = kvcalloc(state_count * 2, sizeof(struct aa_perms), GFP_KERNEL);
+ if (!table)
+ return NULL;
++ *size = state_count * 2;
+
+ for (state = 0; state < state_count; state++) {
+ table[state * 2] = compute_fperms_user(dfa, state);
+@@ -168,7 +170,8 @@ static struct aa_perms *compute_fperms(struct aa_dfa *dfa)
+ return table;
+ }
+
+-static struct aa_perms *compute_xmatch_perms(struct aa_dfa *xmatch)
++static struct aa_perms *compute_xmatch_perms(struct aa_dfa *xmatch,
++ u32 *size)
+ {
+ struct aa_perms *perms;
+ int state;
+@@ -181,6 +184,7 @@ static struct aa_perms *compute_xmatch_perms(struct aa_dfa *xmatch)
+ perms = kvcalloc(state_count, sizeof(struct aa_perms), GFP_KERNEL);
+ if (!perms)
+ return NULL;
++ *size = state_count;
+
+ /* zero init so skip the trap state (state == 0) */
+ for (state = 1; state < state_count; state++)
+@@ -241,7 +245,8 @@ static struct aa_perms compute_perms_entry(struct aa_dfa *dfa,
+ return perms;
+ }
+
+-static struct aa_perms *compute_perms(struct aa_dfa *dfa, u32 version)
++static struct aa_perms *compute_perms(struct aa_dfa *dfa, u32 version,
++ u32 *size)
+ {
+ unsigned int state;
+ unsigned int state_count;
+@@ -254,6 +259,7 @@ static struct aa_perms *compute_perms(struct aa_dfa *dfa, u32 version)
+ table = kvcalloc(state_count, sizeof(struct aa_perms), GFP_KERNEL);
+ if (!table)
+ return NULL;
++ *size = state_count;
+
+ /* zero init so skip the trap state (state == 0) */
+ for (state = 1; state < state_count; state++)
+@@ -288,7 +294,7 @@ static void remap_dfa_accept(struct aa_dfa *dfa, unsigned int factor)
+ /* TODO: merge different dfa mappings into single map_policy fn */
+ int aa_compat_map_xmatch(struct aa_policydb *policy)
+ {
+- policy->perms = compute_xmatch_perms(policy->dfa);
++ policy->perms = compute_xmatch_perms(policy->dfa, &policy->size);
+ if (!policy->perms)
+ return -ENOMEM;
+
+@@ -299,7 +305,7 @@ int aa_compat_map_xmatch(struct aa_policydb *policy)
+
+ int aa_compat_map_policy(struct aa_policydb *policy, u32 version)
+ {
+- policy->perms = compute_perms(policy->dfa, version);
++ policy->perms = compute_perms(policy->dfa, version, &policy->size);
+ if (!policy->perms)
+ return -ENOMEM;
+
+@@ -310,7 +316,7 @@ int aa_compat_map_policy(struct aa_policydb *policy, u32 version)
+
+ int aa_compat_map_file(struct aa_policydb *policy)
+ {
+- policy->perms = compute_fperms(policy->dfa);
++ policy->perms = compute_fperms(policy->dfa, &policy->size);
+ if (!policy->perms)
+ return -ENOMEM;
+
+diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c
+index d50774a16494f..bc9f436d49cca 100644
+--- a/security/apparmor/policy_unpack.c
++++ b/security/apparmor/policy_unpack.c
+@@ -1164,22 +1164,16 @@ static int verify_header(struct aa_ext *e, int required, const char **ns)
+ return 0;
+ }
+
+-static bool verify_xindex(int xindex, int table_size)
+-{
+- int index, xtype;
+- xtype = xindex & AA_X_TYPE_MASK;
+- index = xindex & AA_X_INDEX_MASK;
+- if (xtype == AA_X_TABLE && index >= table_size)
+- return false;
+- return true;
+-}
+-
+-/* verify dfa xindexes are in range of transition tables */
+-static bool verify_dfa_xindex(struct aa_dfa *dfa, int table_size)
++/**
++ * verify_dfa_accept_xindex - verify accept indexes are in range of perms table
++ * @dfa: the dfa to check accept indexes are in range
++ * table_size: the permission table size the indexes should be within
++ */
++static bool verify_dfa_accept_index(struct aa_dfa *dfa, int table_size)
+ {
+ int i;
+ for (i = 0; i < dfa->tables[YYTD_ID_ACCEPT]->td_lolen; i++) {
+- if (!verify_xindex(ACCEPT_TABLE(dfa)[i], table_size))
++ if (ACCEPT_TABLE(dfa)[i] >= table_size)
+ return false;
+ }
+ return true;
+@@ -1216,11 +1210,13 @@ static bool verify_perms(struct aa_policydb *pdb)
+ if (!verify_perm(&pdb->perms[i]))
+ return false;
+ /* verify indexes into str table */
+- if (pdb->perms[i].xindex >= pdb->trans.size)
++ if ((pdb->perms[i].xindex & AA_X_TYPE_MASK) == AA_X_TABLE &&
++ (pdb->perms[i].xindex & AA_X_INDEX_MASK) >= pdb->trans.size)
+ return false;
+- if (pdb->perms[i].tag >= pdb->trans.size)
++ if (pdb->perms[i].tag && pdb->perms[i].tag >= pdb->trans.size)
+ return false;
+- if (pdb->perms[i].label >= pdb->trans.size)
++ if (pdb->perms[i].label &&
++ pdb->perms[i].label >= pdb->trans.size)
+ return false;
+ }
+
+@@ -1242,10 +1238,10 @@ static int verify_profile(struct aa_profile *profile)
+ if (!rules)
+ return 0;
+
+- if ((rules->file.dfa && !verify_dfa_xindex(rules->file.dfa,
+- rules->file.trans.size)) ||
++ if ((rules->file.dfa && !verify_dfa_accept_index(rules->file.dfa,
++ rules->file.size)) ||
+ (rules->policy.dfa &&
+- !verify_dfa_xindex(rules->policy.dfa, rules->policy.trans.size))) {
++ !verify_dfa_accept_index(rules->policy.dfa, rules->policy.size))) {
+ audit_iface(profile, NULL, NULL,
+ "Unpack: Invalid named transition", NULL, -EPROTO);
+ return -EPROTO;
+--
+2.39.2
+
--- /dev/null
+From 489df5e1cb021511fd781b5f4c979afc0f56cfd3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 May 2023 01:06:31 +0800
+Subject: blk-throttle: Fix io statistics for cgroup v1
+
+From: Jinke Han <hanjinke.666@bytedance.com>
+
+[ Upstream commit ad7c3b41e86b59943a903d23c7b037d820e6270c ]
+
+After commit f382fb0bcef4 ("block: remove legacy IO schedulers"),
+blkio.throttle.io_serviced and blkio.throttle.io_service_bytes become
+the only stable io stats interface of cgroup v1, and these statistics
+are done in the blk-throttle code. But the current code only counts the
+bios that are actually throttled. When the user does not add the throttle
+limit, the io stats for cgroup v1 has nothing. I fix it according to the
+statistical method of v2, and made it count all ios accurately.
+
+Fixes: a7b36ee6ba29 ("block: move blk-throtl fast path inline")
+Tested-by: Andrea Righi <andrea.righi@canonical.com>
+Signed-off-by: Jinke Han <hanjinke.666@bytedance.com>
+Acked-by: Muchun Song <songmuchun@bytedance.com>
+Acked-by: Tejun Heo <tj@kernel.org>
+Link: https://lore.kernel.org/r/20230507170631.89607-1-hanjinke.666@bytedance.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-cgroup.c | 6 ++++--
+ block/blk-throttle.c | 6 ------
+ block/blk-throttle.h | 9 +++++++++
+ 3 files changed, 13 insertions(+), 8 deletions(-)
+
+diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
+index aaf9903ad7b2f..fc49be622e05b 100644
+--- a/block/blk-cgroup.c
++++ b/block/blk-cgroup.c
+@@ -2086,6 +2086,9 @@ void blk_cgroup_bio_start(struct bio *bio)
+ struct blkg_iostat_set *bis;
+ unsigned long flags;
+
++ if (!cgroup_subsys_on_dfl(io_cgrp_subsys))
++ return;
++
+ /* Root-level stats are sourced from system-wide IO stats */
+ if (!cgroup_parent(blkcg->css.cgroup))
+ return;
+@@ -2116,8 +2119,7 @@ void blk_cgroup_bio_start(struct bio *bio)
+ }
+
+ u64_stats_update_end_irqrestore(&bis->sync, flags);
+- if (cgroup_subsys_on_dfl(io_cgrp_subsys))
+- cgroup_rstat_updated(blkcg->css.cgroup, cpu);
++ cgroup_rstat_updated(blkcg->css.cgroup, cpu);
+ put_cpu();
+ }
+
+diff --git a/block/blk-throttle.c b/block/blk-throttle.c
+index 9d010d867fbf4..7397ff199d669 100644
+--- a/block/blk-throttle.c
++++ b/block/blk-throttle.c
+@@ -2178,12 +2178,6 @@ bool __blk_throtl_bio(struct bio *bio)
+
+ rcu_read_lock();
+
+- if (!cgroup_subsys_on_dfl(io_cgrp_subsys)) {
+- blkg_rwstat_add(&tg->stat_bytes, bio->bi_opf,
+- bio->bi_iter.bi_size);
+- blkg_rwstat_add(&tg->stat_ios, bio->bi_opf, 1);
+- }
+-
+ spin_lock_irq(&q->queue_lock);
+
+ throtl_update_latency_buckets(td);
+diff --git a/block/blk-throttle.h b/block/blk-throttle.h
+index ef4b7a4de987d..d1ccbfe9f7978 100644
+--- a/block/blk-throttle.h
++++ b/block/blk-throttle.h
+@@ -185,6 +185,15 @@ static inline bool blk_should_throtl(struct bio *bio)
+ struct throtl_grp *tg = blkg_to_tg(bio->bi_blkg);
+ int rw = bio_data_dir(bio);
+
++ if (!cgroup_subsys_on_dfl(io_cgrp_subsys)) {
++ if (!bio_flagged(bio, BIO_CGROUP_ACCT)) {
++ bio_set_flag(bio, BIO_CGROUP_ACCT);
++ blkg_rwstat_add(&tg->stat_bytes, bio->bi_opf,
++ bio->bi_iter.bi_size);
++ }
++ blkg_rwstat_add(&tg->stat_ios, bio->bi_opf, 1);
++ }
++
+ /* iops limit is always counted */
+ if (tg->has_rules_iops[rw])
+ return true;
+--
+2.39.2
+
--- /dev/null
+From 9fd885713e912788e6dbd3bac539dac10ffd0e54 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 May 2023 11:04:23 +0200
+Subject: Bluetooth: fix invalid-bdaddr quirk for non-persistent setup
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+[ Upstream commit 0cb7365850bacb8c2a9975cae672d65714d8daa1 ]
+
+Devices that lack persistent storage for the device address can indicate
+this by setting the HCI_QUIRK_INVALID_BDADDR which causes the controller
+to be marked as unconfigured until user space has set a valid address.
+
+Once configured, the device address must be set on every setup for
+controllers with HCI_QUIRK_NON_PERSISTENT_SETUP to avoid marking the
+controller as unconfigured and requiring the address to be set again.
+
+Fixes: 740011cfe948 ("Bluetooth: Add new quirk for non-persistent setup settings")
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/hci_sync.c | 28 +++++++++++-----------------
+ 1 file changed, 11 insertions(+), 17 deletions(-)
+
+diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
+index 804cde43b4e02..b5b1b610df335 100644
+--- a/net/bluetooth/hci_sync.c
++++ b/net/bluetooth/hci_sync.c
+@@ -4626,23 +4626,17 @@ static int hci_dev_setup_sync(struct hci_dev *hdev)
+ invalid_bdaddr = test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks);
+
+ if (!ret) {
+- if (test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) {
+- if (!bacmp(&hdev->public_addr, BDADDR_ANY))
+- hci_dev_get_bd_addr_from_property(hdev);
+-
+- if (bacmp(&hdev->public_addr, BDADDR_ANY) &&
+- hdev->set_bdaddr) {
+- ret = hdev->set_bdaddr(hdev,
+- &hdev->public_addr);
+-
+- /* If setting of the BD_ADDR from the device
+- * property succeeds, then treat the address
+- * as valid even if the invalid BD_ADDR
+- * quirk indicates otherwise.
+- */
+- if (!ret)
+- invalid_bdaddr = false;
+- }
++ if (test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks) &&
++ !bacmp(&hdev->public_addr, BDADDR_ANY))
++ hci_dev_get_bd_addr_from_property(hdev);
++
++ if ((invalid_bdaddr ||
++ test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
++ bacmp(&hdev->public_addr, BDADDR_ANY) &&
++ hdev->set_bdaddr) {
++ ret = hdev->set_bdaddr(hdev, &hdev->public_addr);
++ if (!ret)
++ invalid_bdaddr = false;
+ }
+ }
+
+--
+2.39.2
+
--- /dev/null
+From c633b05a4d52a247c3fcfe80c726da2439cf2bf8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 May 2023 11:04:24 +0200
+Subject: Bluetooth: fix use-bdaddr-property quirk
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+[ Upstream commit 6945795bc81ab7be22750ecfb365056688f2fada ]
+
+Devices that lack persistent storage for the device address can indicate
+this by setting the HCI_QUIRK_INVALID_BDADDR which causes the controller
+to be marked as unconfigured until user space has set a valid address.
+
+The related HCI_QUIRK_USE_BDADDR_PROPERTY was later added to similarly
+indicate that the device lacks a valid address but that one may be
+specified in the devicetree.
+
+As is clear from commit 7a0e5b15ca45 ("Bluetooth: Add quirk for reading
+BD_ADDR from fwnode property") that added and documented this quirk and
+commits like de79a9df1692 ("Bluetooth: btqcomsmd: use
+HCI_QUIRK_USE_BDADDR_PROPERTY"), the device address of controllers with
+this flag should be treated as invalid until user space has had a chance
+to configure the controller in case the devicetree property is missing.
+
+As it does not make sense to allow controllers with invalid addresses,
+restore the original semantics, which also makes sure that the
+implementation is consistent (e.g. get_missing_options() indicates that
+the address must be set) and matches the documentation (including
+comments in the code, such as, "In case any of them is set, the
+controller has to start up as unconfigured.").
+
+Fixes: e668eb1e1578 ("Bluetooth: hci_core: Don't stop BT if the BD address missing in dts")
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/hci_sync.c | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
+index b5b1b610df335..8561616abbe5f 100644
+--- a/net/bluetooth/hci_sync.c
++++ b/net/bluetooth/hci_sync.c
+@@ -4623,16 +4623,14 @@ static int hci_dev_setup_sync(struct hci_dev *hdev)
+ * BD_ADDR invalid before creating the HCI device or in
+ * its setup callback.
+ */
+- invalid_bdaddr = test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks);
+-
++ invalid_bdaddr = test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
++ test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks);
+ if (!ret) {
+ if (test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks) &&
+ !bacmp(&hdev->public_addr, BDADDR_ANY))
+ hci_dev_get_bd_addr_from_property(hdev);
+
+- if ((invalid_bdaddr ||
+- test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
+- bacmp(&hdev->public_addr, BDADDR_ANY) &&
++ if (invalid_bdaddr && bacmp(&hdev->public_addr, BDADDR_ANY) &&
+ hdev->set_bdaddr) {
+ ret = hdev->set_bdaddr(hdev, &hdev->public_addr);
+ if (!ret)
+--
+2.39.2
+
--- /dev/null
+From 2cfb11b81d344afe4080da54e6bd057425c7ac0a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Jun 2023 10:19:12 +0200
+Subject: Bluetooth: hci_bcm: do not mark valid bd_addr as invalid
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+[ Upstream commit 56b7f325db139c9255b1eb1d1e741576d5f8fa34 ]
+
+A recent commit restored the original (and still documented) semantics
+for the HCI_QUIRK_USE_BDADDR_PROPERTY quirk so that the device address
+is considered invalid unless an address is provided by firmware.
+
+This specifically means that this flag must only be set for devices with
+invalid addresses, but the Broadcom driver has so far been setting this
+flag unconditionally.
+
+Fortunately the driver already checks for invalid addresses during setup
+and sets the HCI_QUIRK_INVALID_BDADDR flag. Use this flag to indicate
+when the address can be overridden by firmware (long term, this should
+probably just always be allowed).
+
+Fixes: 6945795bc81a ("Bluetooth: fix use-bdaddr-property quirk")
+Reported-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Link: https://lore.kernel.org/lkml/ecef83c8-497f-4011-607b-a63c24764867@samsung.com
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/hci_bcm.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/bluetooth/hci_bcm.c b/drivers/bluetooth/hci_bcm.c
+index 83bf5d4330c40..874d23089b39b 100644
+--- a/drivers/bluetooth/hci_bcm.c
++++ b/drivers/bluetooth/hci_bcm.c
+@@ -643,7 +643,8 @@ static int bcm_setup(struct hci_uart *hu)
+ * Allow the bootloader to set a valid address through the
+ * device tree.
+ */
+- set_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hu->hdev->quirks);
++ if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hu->hdev->quirks))
++ set_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hu->hdev->quirks);
+
+ if (!bcm_request_irq(bcm))
+ err = bcm_setup_sleep(hu);
+--
+2.39.2
+
--- /dev/null
+From b78b6b5cf07b8d1e875665b5b6c0dc7ee86a4a3d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Jun 2023 09:34:43 +0300
+Subject: Bluetooth: ISO: use hci_sync for setting CIG parameters
+
+From: Pauli Virtanen <pav@iki.fi>
+
+[ Upstream commit 6b9545dc9f8ff01d8bc1229103960d9cd265343f ]
+
+When reconfiguring CIG after disconnection of the last CIS, LE Remove
+CIG shall be sent before LE Set CIG Parameters. Otherwise, it fails
+because CIG is in the inactive state and not configurable (Core v5.3
+Vol 6 Part B Sec. 4.5.14.3). This ordering is currently wrong under
+suitable timing conditions, because LE Remove CIG is sent via the
+hci_sync queue and may be delayed, but Set CIG Parameters is via
+hci_send_cmd.
+
+Make the ordering well-defined by sending also Set CIG Parameters via
+hci_sync.
+
+Fixes: 26afbd826ee3 ("Bluetooth: Add initial implementation of CIS connections")
+Signed-off-by: Pauli Virtanen <pav@iki.fi>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/hci_conn.c | 47 +++++++++++++++++++++++++++++++++-------
+ 1 file changed, 39 insertions(+), 8 deletions(-)
+
+diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
+index 1ef952bda97d8..2275e0d9f8419 100644
+--- a/net/bluetooth/hci_conn.c
++++ b/net/bluetooth/hci_conn.c
+@@ -775,6 +775,11 @@ static void le_conn_timeout(struct work_struct *work)
+ hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
+ }
+
++struct iso_cig_params {
++ struct hci_cp_le_set_cig_params cp;
++ struct hci_cis_params cis[0x1f];
++};
++
+ struct iso_list_data {
+ union {
+ u8 cig;
+@@ -786,10 +791,7 @@ struct iso_list_data {
+ u16 sync_handle;
+ };
+ int count;
+- struct {
+- struct hci_cp_le_set_cig_params cp;
+- struct hci_cis_params cis[0x11];
+- } pdu;
++ struct iso_cig_params pdu;
+ };
+
+ static void bis_list(struct hci_conn *conn, void *data)
+@@ -1764,10 +1766,33 @@ static int hci_le_create_big(struct hci_conn *conn, struct bt_iso_qos *qos)
+ return hci_send_cmd(hdev, HCI_OP_LE_CREATE_BIG, sizeof(cp), &cp);
+ }
+
++static void set_cig_params_complete(struct hci_dev *hdev, void *data, int err)
++{
++ struct iso_cig_params *pdu = data;
++
++ bt_dev_dbg(hdev, "");
++
++ if (err)
++ bt_dev_err(hdev, "Unable to set CIG parameters: %d", err);
++
++ kfree(pdu);
++}
++
++static int set_cig_params_sync(struct hci_dev *hdev, void *data)
++{
++ struct iso_cig_params *pdu = data;
++ u32 plen;
++
++ plen = sizeof(pdu->cp) + pdu->cp.num_cis * sizeof(pdu->cis[0]);
++ return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_CIG_PARAMS, plen, pdu,
++ HCI_CMD_TIMEOUT);
++}
++
+ static bool hci_le_set_cig_params(struct hci_conn *conn, struct bt_iso_qos *qos)
+ {
+ struct hci_dev *hdev = conn->hdev;
+ struct iso_list_data data;
++ struct iso_cig_params *pdu;
+
+ memset(&data, 0, sizeof(data));
+
+@@ -1837,12 +1862,18 @@ static bool hci_le_set_cig_params(struct hci_conn *conn, struct bt_iso_qos *qos)
+ if (qos->ucast.cis == BT_ISO_QOS_CIS_UNSET || !data.pdu.cp.num_cis)
+ return false;
+
+- if (hci_send_cmd(hdev, HCI_OP_LE_SET_CIG_PARAMS,
+- sizeof(data.pdu.cp) +
+- (data.pdu.cp.num_cis * sizeof(*data.pdu.cis)),
+- &data.pdu) < 0)
++ pdu = kzalloc(sizeof(*pdu), GFP_KERNEL);
++ if (!pdu)
+ return false;
+
++ memcpy(pdu, &data.pdu, sizeof(*pdu));
++
++ if (hci_cmd_sync_queue(hdev, set_cig_params_sync, pdu,
++ set_cig_params_complete) < 0) {
++ kfree(pdu);
++ return false;
++ }
++
+ return true;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From b6d8f94a9b0ef4cbcaa69ca0fd039ac3a0a9ff7b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Jun 2023 12:33:47 -0700
+Subject: Bluetooth: MGMT: Fix marking SCAN_RSP as not connectable
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+[ Upstream commit 73f55453ea5236a586a7f1b3d5e2ee051d655351 ]
+
+When receiving a scan response there is no way to know if the remote
+device is connectable or not, so when it cannot be merged don't
+make any assumption and instead just mark it with a new flag defined as
+MGMT_DEV_FOUND_SCAN_RSP so userspace can tell it is a standalone
+SCAN_RSP.
+
+Link: https://lore.kernel.org/linux-bluetooth/CABBYNZ+CYMsDSPTxBn09Js3BcdC-x7vZFfyLJ3ppZGGwJKmUTw@mail.gmail.com/
+Fixes: c70a7e4cc8d2 ("Bluetooth: Add support for Not Connectable flag for Device Found events")
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/bluetooth/mgmt.h | 1 +
+ net/bluetooth/hci_event.c | 15 +++++----------
+ 2 files changed, 6 insertions(+), 10 deletions(-)
+
+diff --git a/include/net/bluetooth/mgmt.h b/include/net/bluetooth/mgmt.h
+index a5801649f6196..5e68b3dd44222 100644
+--- a/include/net/bluetooth/mgmt.h
++++ b/include/net/bluetooth/mgmt.h
+@@ -979,6 +979,7 @@ struct mgmt_ev_auth_failed {
+ #define MGMT_DEV_FOUND_NOT_CONNECTABLE BIT(2)
+ #define MGMT_DEV_FOUND_INITIATED_CONN BIT(3)
+ #define MGMT_DEV_FOUND_NAME_REQUEST_FAILED BIT(4)
++#define MGMT_DEV_FOUND_SCAN_RSP BIT(5)
+
+ #define MGMT_EV_DEVICE_FOUND 0x0012
+ struct mgmt_ev_device_found {
+diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
+index 09ba6d8987ee1..21e26d3b286cc 100644
+--- a/net/bluetooth/hci_event.c
++++ b/net/bluetooth/hci_event.c
+@@ -6316,23 +6316,18 @@ static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr,
+ return;
+ }
+
+- /* When receiving non-connectable or scannable undirected
+- * advertising reports, this means that the remote device is
+- * not connectable and then clearly indicate this in the
+- * device found event.
+- *
+- * When receiving a scan response, then there is no way to
++ /* When receiving a scan response, then there is no way to
+ * know if the remote device is connectable or not. However
+ * since scan responses are merged with a previously seen
+ * advertising report, the flags field from that report
+ * will be used.
+ *
+- * In the really unlikely case that a controller get confused
+- * and just sends a scan response event, then it is marked as
+- * not connectable as well.
++ * In the unlikely case that a controller just sends a scan
++ * response event that doesn't match the pending report, then
++ * it is marked as a standalone SCAN_RSP.
+ */
+ if (type == LE_ADV_SCAN_RSP)
+- flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
++ flags = MGMT_DEV_FOUND_SCAN_RSP;
+
+ /* If there's nothing pending either store the data from this
+ * event or send an immediate device found event if the data
+--
+2.39.2
+
--- /dev/null
+From 95eb0da0af12c9fc44a0b40bf8b4cd491770ec3b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 1 Jul 2023 17:14:47 +0000
+Subject: bpf, btf: Warn but return no error for NULL btf from
+ __register_btf_kfunc_id_set()
+
+From: SeongJae Park <sj@kernel.org>
+
+[ Upstream commit 3de4d22cc9ac7c9f38e10edcf54f9a8891a9c2aa ]
+
+__register_btf_kfunc_id_set() assumes .BTF to be part of the module's .ko
+file if CONFIG_DEBUG_INFO_BTF is enabled. If that's not the case, the
+function prints an error message and return an error. As a result, such
+modules cannot be loaded.
+
+However, the section could be stripped out during a build process. It would
+be better to let the modules loaded, because their basic functionalities
+have no problem [0], though the BTF functionalities will not be supported.
+Make the function to lower the level of the message from error to warn, and
+return no error.
+
+ [0] https://lore.kernel.org/bpf/20220219082037.ow2kbq5brktf4f2u@apollo.legion
+
+Fixes: c446fdacb10d ("bpf: fix register_btf_kfunc_id_set for !CONFIG_DEBUG_INFO_BTF")
+Reported-by: Alexander Egorenkov <Alexander.Egorenkov@ibm.com>
+Suggested-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
+Signed-off-by: SeongJae Park <sj@kernel.org>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Jiri Olsa <jolsa@kernel.org>
+Link: https://lore.kernel.org/bpf/87y228q66f.fsf@oc8242746057.ibm.com
+Link: https://lore.kernel.org/bpf/20220219082037.ow2kbq5brktf4f2u@apollo.legion
+Link: https://lore.kernel.org/bpf/20230701171447.56464-1-sj@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/btf.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
+index 72b32b7cd9cd9..25ca17a8e1964 100644
+--- a/kernel/bpf/btf.c
++++ b/kernel/bpf/btf.c
+@@ -7848,10 +7848,8 @@ static int __register_btf_kfunc_id_set(enum btf_kfunc_hook hook,
+ pr_err("missing vmlinux BTF, cannot register kfuncs\n");
+ return -ENOENT;
+ }
+- if (kset->owner && IS_ENABLED(CONFIG_DEBUG_INFO_BTF_MODULES)) {
+- pr_err("missing module BTF, cannot register kfuncs\n");
+- return -ENOENT;
+- }
++ if (kset->owner && IS_ENABLED(CONFIG_DEBUG_INFO_BTF_MODULES))
++ pr_warn("missing module BTF, cannot register kfuncs\n");
+ return 0;
+ }
+ if (IS_ERR(btf))
+--
+2.39.2
+
--- /dev/null
+From 6bd24a6cbaf1407e8b2ddb18e9d4872a72452a9c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Jun 2023 19:07:18 +0300
+Subject: bus: fsl-mc: don't assume child devices are all fsl-mc devices
+
+From: Laurentiu Tudor <laurentiu.tudor@nxp.com>
+
+[ Upstream commit 303c9c63abb9390e906052863f82bb4e9824e5c0 ]
+
+Changes in VFIO caused a pseudo-device to be created as child of
+fsl-mc devices causing a crash [1] when trying to bind a fsl-mc
+device to VFIO. Fix this by checking the device type when enumerating
+fsl-mc child devices.
+
+[1]
+Modules linked in:
+Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP
+CPU: 6 PID: 1289 Comm: sh Not tainted 6.2.0-rc5-00047-g7c46948a6e9c #2
+Hardware name: NXP Layerscape LX2160ARDB (DT)
+pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+pc : mc_send_command+0x24/0x1f0
+lr : dprc_get_obj_region+0xfc/0x1c0
+sp : ffff80000a88b900
+x29: ffff80000a88b900 x28: ffff48a9429e1400 x27: 00000000000002b2
+x26: ffff48a9429e1718 x25: 0000000000000000 x24: 0000000000000000
+x23: ffffd59331ba3918 x22: ffffd59331ba3000 x21: 0000000000000000
+x20: ffff80000a88b9b8 x19: 0000000000000000 x18: 0000000000000001
+x17: 7270642f636d2d6c x16: 73662e3030303030 x15: ffffffffffffffff
+x14: ffffd59330f1d668 x13: ffff48a8727dc389 x12: ffff48a8727dc386
+x11: 0000000000000002 x10: 00008ceaf02f35d4 x9 : 0000000000000012
+x8 : 0000000000000000 x7 : 0000000000000006 x6 : ffff80000a88bab0
+x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff80000a88b9e8
+x2 : ffff80000a88b9e8 x1 : 0000000000000000 x0 : ffff48a945142b80
+Call trace:
+ mc_send_command+0x24/0x1f0
+ dprc_get_obj_region+0xfc/0x1c0
+ fsl_mc_device_add+0x340/0x590
+ fsl_mc_obj_device_add+0xd0/0xf8
+ dprc_scan_objects+0x1c4/0x340
+ dprc_scan_container+0x38/0x60
+ vfio_fsl_mc_probe+0x9c/0xf8
+ fsl_mc_driver_probe+0x24/0x70
+ really_probe+0xbc/0x2a8
+ __driver_probe_device+0x78/0xe0
+ device_driver_attach+0x30/0x68
+ bind_store+0xa8/0x130
+ drv_attr_store+0x24/0x38
+ sysfs_kf_write+0x44/0x60
+ kernfs_fop_write_iter+0x128/0x1b8
+ vfs_write+0x334/0x448
+ ksys_write+0x68/0xf0
+ __arm64_sys_write+0x1c/0x28
+ invoke_syscall+0x44/0x108
+ el0_svc_common.constprop.1+0x94/0xf8
+ do_el0_svc+0x38/0xb0
+ el0_svc+0x20/0x50
+ el0t_64_sync_handler+0x98/0xc0
+ el0t_64_sync+0x174/0x178
+Code: aa0103f4 a9025bf5 d5384100 b9400801 (79401260)
+---[ end trace 0000000000000000 ]---
+
+Fixes: 3c28a76124b2 ("vfio: Add struct device to vfio_device")
+Signed-off-by: Laurentiu Tudor <laurentiu.tudor@nxp.com>
+Tested-by: Ioana Ciornei <ioana.ciornei@nxp.com>
+Reviewed-by: Ioana Ciornei <ioana.ciornei@nxp.com>
+Message-ID: <20230613160718.29500-1-laurentiu.tudor@nxp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bus/fsl-mc/dprc-driver.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/bus/fsl-mc/dprc-driver.c b/drivers/bus/fsl-mc/dprc-driver.c
+index 4c84be378bf27..ec5f26a45641b 100644
+--- a/drivers/bus/fsl-mc/dprc-driver.c
++++ b/drivers/bus/fsl-mc/dprc-driver.c
+@@ -45,6 +45,9 @@ static int __fsl_mc_device_remove_if_not_in_mc(struct device *dev, void *data)
+ struct fsl_mc_child_objs *objs;
+ struct fsl_mc_device *mc_dev;
+
++ if (!dev_is_fsl_mc(dev))
++ return 0;
++
+ mc_dev = to_fsl_mc_device(dev);
+ objs = data;
+
+@@ -64,6 +67,9 @@ static int __fsl_mc_device_remove_if_not_in_mc(struct device *dev, void *data)
+
+ static int __fsl_mc_device_remove(struct device *dev, void *data)
+ {
++ if (!dev_is_fsl_mc(dev))
++ return 0;
++
+ fsl_mc_device_remove(to_fsl_mc_device(dev));
+ return 0;
+ }
+--
+2.39.2
+
--- /dev/null
+From 083cad331436fbcc7cf7df19e1725eea1db6e2c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Jun 2023 18:40:09 +0530
+Subject: cdx: fix driver managed dma support
+
+From: Nipun Gupta <nipun.gupta@amd.com>
+
+[ Upstream commit b8c5ff76059ded3758de3db83e04189a072ac01f ]
+
+The devices on cdx could be bound to drivers with the device
+DMA managed by kernel drivers or user-space applications.
+As multiple devices can be placed in the same IOMMU group, the
+DMA on these devices must either be entirely under kernel control
+or userspace control. Fix the CDX bus driver to acknowlege the
+driver_managed_dma flag and call the appropriate iommu APIs.
+
+Fixes: 2959ab247061 ("cdx: add the cdx bus driver")
+Signed-off-by: Nipun Gupta <nipun.gupta@amd.com>
+Reported-by: Alex Williamson <alex.williamson@redhat.com>
+Closes: https://lore.kernel.org/lkml/20230524134831.28dc97e2.alex.williamson@redhat.com/
+Reviewed-by: Nikhil Agarwal <nikhil.agarwal@amd.com>
+Message-ID: <20230605131009.6869-1-nipun.gupta@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cdx/cdx.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+diff --git a/drivers/cdx/cdx.c b/drivers/cdx/cdx.c
+index 38511fd363257..d2cad4c670a07 100644
+--- a/drivers/cdx/cdx.c
++++ b/drivers/cdx/cdx.c
+@@ -62,6 +62,8 @@
+ #include <linux/mm.h>
+ #include <linux/xarray.h>
+ #include <linux/cdx/cdx_bus.h>
++#include <linux/iommu.h>
++#include <linux/dma-map-ops.h>
+ #include "cdx.h"
+
+ /* Default DMA mask for devices on a CDX bus */
+@@ -257,6 +259,7 @@ static void cdx_shutdown(struct device *dev)
+
+ static int cdx_dma_configure(struct device *dev)
+ {
++ struct cdx_driver *cdx_drv = to_cdx_driver(dev->driver);
+ struct cdx_device *cdx_dev = to_cdx_device(dev);
+ u32 input_id = cdx_dev->req_id;
+ int ret;
+@@ -267,9 +270,23 @@ static int cdx_dma_configure(struct device *dev)
+ return ret;
+ }
+
++ if (!ret && !cdx_drv->driver_managed_dma) {
++ ret = iommu_device_use_default_domain(dev);
++ if (ret)
++ arch_teardown_dma_ops(dev);
++ }
++
+ return 0;
+ }
+
++static void cdx_dma_cleanup(struct device *dev)
++{
++ struct cdx_driver *cdx_drv = to_cdx_driver(dev->driver);
++
++ if (!cdx_drv->driver_managed_dma)
++ iommu_device_unuse_default_domain(dev);
++}
++
+ /* show configuration fields */
+ #define cdx_config_attr(field, format_string) \
+ static ssize_t \
+@@ -405,6 +422,7 @@ struct bus_type cdx_bus_type = {
+ .remove = cdx_remove,
+ .shutdown = cdx_shutdown,
+ .dma_configure = cdx_dma_configure,
++ .dma_cleanup = cdx_dma_cleanup,
+ .bus_groups = cdx_bus_groups,
+ .dev_groups = cdx_dev_groups,
+ };
+--
+2.39.2
+
--- /dev/null
+From 4f389a199bd7f80429877feb40e3789781681e63 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 May 2023 19:59:32 +0530
+Subject: clk: qcom: camcc-sc7180: Add parent dependency to all camera GDSCs
+
+From: Taniya Das <quic_tdas@quicinc.com>
+
+[ Upstream commit 3e4d179532423f299554cd0dedabdd9d2fdd238d ]
+
+Camera titan top GDSC is a parent supply to all other camera GDSCs. Titan
+top GDSC is required to be enabled before enabling any other camera GDSCs
+and it should be disabled only after all other camera GDSCs are disabled.
+Ensure this behavior by marking titan top GDSC as parent of all other
+camera GDSCs.
+
+Fixes: 15d09e830bbc ("clk: qcom: camcc: Add camera clock controller driver for SC7180")
+Signed-off-by: Taniya Das <quic_tdas@quicinc.com>
+Acked-by: Stephen Boyd <sboyd@kernel.org>
+Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230501142932.13049-1-quic_tdas@quicinc.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/camcc-sc7180.c | 19 ++++++++++++-------
+ 1 file changed, 12 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/clk/qcom/camcc-sc7180.c b/drivers/clk/qcom/camcc-sc7180.c
+index e2b4804695f37..8a4ba7a19ed12 100644
+--- a/drivers/clk/qcom/camcc-sc7180.c
++++ b/drivers/clk/qcom/camcc-sc7180.c
+@@ -1480,12 +1480,21 @@ static struct clk_branch cam_cc_sys_tmr_clk = {
+ },
+ };
+
++static struct gdsc titan_top_gdsc = {
++ .gdscr = 0xb134,
++ .pd = {
++ .name = "titan_top_gdsc",
++ },
++ .pwrsts = PWRSTS_OFF_ON,
++};
++
+ static struct gdsc bps_gdsc = {
+ .gdscr = 0x6004,
+ .pd = {
+ .name = "bps_gdsc",
+ },
+ .pwrsts = PWRSTS_OFF_ON,
++ .parent = &titan_top_gdsc.pd,
+ .flags = HW_CTRL,
+ };
+
+@@ -1495,6 +1504,7 @@ static struct gdsc ife_0_gdsc = {
+ .name = "ife_0_gdsc",
+ },
+ .pwrsts = PWRSTS_OFF_ON,
++ .parent = &titan_top_gdsc.pd,
+ };
+
+ static struct gdsc ife_1_gdsc = {
+@@ -1503,6 +1513,7 @@ static struct gdsc ife_1_gdsc = {
+ .name = "ife_1_gdsc",
+ },
+ .pwrsts = PWRSTS_OFF_ON,
++ .parent = &titan_top_gdsc.pd,
+ };
+
+ static struct gdsc ipe_0_gdsc = {
+@@ -1512,15 +1523,9 @@ static struct gdsc ipe_0_gdsc = {
+ },
+ .pwrsts = PWRSTS_OFF_ON,
+ .flags = HW_CTRL,
++ .parent = &titan_top_gdsc.pd,
+ };
+
+-static struct gdsc titan_top_gdsc = {
+- .gdscr = 0xb134,
+- .pd = {
+- .name = "titan_top_gdsc",
+- },
+- .pwrsts = PWRSTS_OFF_ON,
+-};
+
+ static struct clk_hw *cam_cc_sc7180_hws[] = {
+ [CAM_CC_PLL2_OUT_EARLY] = &cam_cc_pll2_out_early.hw,
+--
+2.39.2
+
--- /dev/null
+From b41fabfc8c12ebf5d285662135180b6cc3604470 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Apr 2023 13:06:35 +0200
+Subject: clk: qcom: dispcc-qcm2290: Fix BI_TCXO_AO handling
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit 92dfee0fc889b5b00ffb6b1de87ce64c483bcb7b ]
+
+BI_TCXO_AO (.fw_name = "bi_tcxo_ao") was previously made to reuse the
+same parent enum entry as BI_TCXO (.fw_name = "bi_tcxo") in parent_map_2.
+
+Resolve it by introducing its own entry in the parent enum and
+correctly assigning it in disp_cc_parent_map_2[].
+
+Fixes: cc517ea3333f ("clk: qcom: Add display clock controller driver for QCM2290")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230412-topic-qcm_dispcc-v2-1-bce7dd512fe4@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/dispcc-qcm2290.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/qcom/dispcc-qcm2290.c b/drivers/clk/qcom/dispcc-qcm2290.c
+index e9cfe41c04426..ee62aca4e5bb2 100644
+--- a/drivers/clk/qcom/dispcc-qcm2290.c
++++ b/drivers/clk/qcom/dispcc-qcm2290.c
+@@ -24,6 +24,7 @@
+
+ enum {
+ P_BI_TCXO,
++ P_BI_TCXO_AO,
+ P_DISP_CC_PLL0_OUT_MAIN,
+ P_DSI0_PHY_PLL_OUT_BYTECLK,
+ P_DSI0_PHY_PLL_OUT_DSICLK,
+@@ -82,7 +83,7 @@ static const struct clk_parent_data disp_cc_parent_data_1[] = {
+ };
+
+ static const struct parent_map disp_cc_parent_map_2[] = {
+- { P_BI_TCXO, 0 },
++ { P_BI_TCXO_AO, 0 },
+ { P_GPLL0_OUT_MAIN, 4 },
+ };
+
+@@ -151,7 +152,7 @@ static struct clk_regmap_div disp_cc_mdss_byte0_div_clk_src = {
+ };
+
+ static const struct freq_tbl ftbl_disp_cc_mdss_ahb_clk_src[] = {
+- F(19200000, P_BI_TCXO, 1, 0, 0),
++ F(19200000, P_BI_TCXO_AO, 1, 0, 0),
+ F(37500000, P_GPLL0_OUT_MAIN, 8, 0, 0),
+ F(75000000, P_GPLL0_OUT_MAIN, 4, 0, 0),
+ { }
+--
+2.39.2
+
--- /dev/null
+From d3da7e12a5fba23b2fafcc85d28cfb4134300f59 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Apr 2023 13:06:36 +0200
+Subject: clk: qcom: dispcc-qcm2290: Fix GPLL0_OUT_DIV handling
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit 63d56adf04b5795e54440dc5b7afddecb2966863 ]
+
+GPLL0_OUT_DIV (.fw_name = "gcc_disp_gpll0_div_clk_src") was previously
+made to reuse the same parent enum entry as GPLL0_OUT_MAIN
+(.fw_name = "gcc_disp_gpll0_clk_src") in parent_map_2.
+
+Resolve it by introducing its own entry in the parent enum and
+correctly assigning it in disp_cc_parent_map_2[].
+
+Fixes: cc517ea3333f ("clk: qcom: Add display clock controller driver for QCM2290")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230412-topic-qcm_dispcc-v2-2-bce7dd512fe4@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/dispcc-qcm2290.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/clk/qcom/dispcc-qcm2290.c b/drivers/clk/qcom/dispcc-qcm2290.c
+index ee62aca4e5bb2..44dd5cfcc1504 100644
+--- a/drivers/clk/qcom/dispcc-qcm2290.c
++++ b/drivers/clk/qcom/dispcc-qcm2290.c
+@@ -28,6 +28,7 @@ enum {
+ P_DISP_CC_PLL0_OUT_MAIN,
+ P_DSI0_PHY_PLL_OUT_BYTECLK,
+ P_DSI0_PHY_PLL_OUT_DSICLK,
++ P_GPLL0_OUT_DIV,
+ P_GPLL0_OUT_MAIN,
+ P_SLEEP_CLK,
+ };
+@@ -84,7 +85,7 @@ static const struct clk_parent_data disp_cc_parent_data_1[] = {
+
+ static const struct parent_map disp_cc_parent_map_2[] = {
+ { P_BI_TCXO_AO, 0 },
+- { P_GPLL0_OUT_MAIN, 4 },
++ { P_GPLL0_OUT_DIV, 4 },
+ };
+
+ static const struct clk_parent_data disp_cc_parent_data_2[] = {
+@@ -153,8 +154,8 @@ static struct clk_regmap_div disp_cc_mdss_byte0_div_clk_src = {
+
+ static const struct freq_tbl ftbl_disp_cc_mdss_ahb_clk_src[] = {
+ F(19200000, P_BI_TCXO_AO, 1, 0, 0),
+- F(37500000, P_GPLL0_OUT_MAIN, 8, 0, 0),
+- F(75000000, P_GPLL0_OUT_MAIN, 4, 0, 0),
++ F(37500000, P_GPLL0_OUT_DIV, 8, 0, 0),
++ F(75000000, P_GPLL0_OUT_DIV, 4, 0, 0),
+ { }
+ };
+
+--
+2.39.2
+
--- /dev/null
+From e1bd9e16d1b77096287ef7b5c3c7289ca769f850 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 May 2023 22:01:45 +0530
+Subject: clk: qcom: gcc: ipq5332: Use floor ops for SDCC clocks
+
+From: Kathiravan T <quic_kathirav@quicinc.com>
+
+[ Upstream commit a30e62bf6bf4d3230fa9164c7e174e32b9be7ba5 ]
+
+SDCC clocks must be rounded down to avoid overclocking the controller.
+
+Fixes: 3d89d52970fd ("clk: qcom: add Global Clock controller (GCC) driver for IPQ5332 SoC")
+Signed-off-by: Kathiravan T <quic_kathirav@quicinc.com>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230508163145.9678-1-quic_kathirav@quicinc.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/gcc-ipq5332.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/qcom/gcc-ipq5332.c b/drivers/clk/qcom/gcc-ipq5332.c
+index bdb4a0a11d07b..1ad23aa8aa5a9 100644
+--- a/drivers/clk/qcom/gcc-ipq5332.c
++++ b/drivers/clk/qcom/gcc-ipq5332.c
+@@ -963,7 +963,7 @@ static struct clk_rcg2 gcc_sdcc1_apps_clk_src = {
+ .name = "gcc_sdcc1_apps_clk_src",
+ .parent_data = gcc_parent_data_9,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_9),
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_floor_ops,
+ },
+ };
+
+--
+2.39.2
+
--- /dev/null
+From e396801677933a43388df7d1c0905bf5ab33b8c0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Apr 2023 12:11:49 +0300
+Subject: clk: qcom: gcc-ipq6018: Use floor ops for sdcc clocks
+
+From: Mantas Pucka <mantas@8devices.com>
+
+[ Upstream commit 56e5ae0116aef87273cf1812d608645b076e4f02 ]
+
+SDCC clocks must be rounded down to avoid overclocking the controller.
+
+Fixes: d9db07f088af ("clk: qcom: Add ipq6018 Global Clock Controller support")
+Signed-off-by: Mantas Pucka <mantas@8devices.com>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/1682413909-24927-1-git-send-email-mantas@8devices.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/gcc-ipq6018.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/qcom/gcc-ipq6018.c b/drivers/clk/qcom/gcc-ipq6018.c
+index 3f9c2f61a5d93..5c5d1b04ea7af 100644
+--- a/drivers/clk/qcom/gcc-ipq6018.c
++++ b/drivers/clk/qcom/gcc-ipq6018.c
+@@ -1654,7 +1654,7 @@ static struct clk_rcg2 sdcc1_apps_clk_src = {
+ .name = "sdcc1_apps_clk_src",
+ .parent_data = gcc_xo_gpll0_gpll2_gpll0_out_main_div2,
+ .num_parents = 4,
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_floor_ops,
+ },
+ };
+
+--
+2.39.2
+
--- /dev/null
+From 6d04441be3cced83eaeeb7bd2f8c0d034560dae2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Apr 2023 19:48:07 +0200
+Subject: clk: qcom: gcc-qcm2290: Mark RCGs shared where applicable
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit 7bf654a0d95e75b415f454e10627309d650762d0 ]
+
+The vast majority of shared RCGs were not marked as such. Fix it.
+
+Fixes: 496d1a13d405 ("clk: qcom: Add Global Clock Controller driver for QCM2290")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Acked-by: Shawn Guo <shawn.guo@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230403174807.345185-1-konrad.dybcio@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/gcc-qcm2290.c | 62 +++++++++++++++++-----------------
+ 1 file changed, 31 insertions(+), 31 deletions(-)
+
+diff --git a/drivers/clk/qcom/gcc-qcm2290.c b/drivers/clk/qcom/gcc-qcm2290.c
+index 096deff2ba257..48995e50c6bd7 100644
+--- a/drivers/clk/qcom/gcc-qcm2290.c
++++ b/drivers/clk/qcom/gcc-qcm2290.c
+@@ -650,7 +650,7 @@ static struct clk_rcg2 gcc_usb30_prim_mock_utmi_clk_src = {
+ .name = "gcc_usb30_prim_mock_utmi_clk_src",
+ .parent_data = gcc_parents_0,
+ .num_parents = ARRAY_SIZE(gcc_parents_0),
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -686,7 +686,7 @@ static struct clk_rcg2 gcc_camss_axi_clk_src = {
+ .name = "gcc_camss_axi_clk_src",
+ .parent_data = gcc_parents_4,
+ .num_parents = ARRAY_SIZE(gcc_parents_4),
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -706,7 +706,7 @@ static struct clk_rcg2 gcc_camss_cci_clk_src = {
+ .name = "gcc_camss_cci_clk_src",
+ .parent_data = gcc_parents_9,
+ .num_parents = ARRAY_SIZE(gcc_parents_9),
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -728,7 +728,7 @@ static struct clk_rcg2 gcc_camss_csi0phytimer_clk_src = {
+ .name = "gcc_camss_csi0phytimer_clk_src",
+ .parent_data = gcc_parents_5,
+ .num_parents = ARRAY_SIZE(gcc_parents_5),
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -742,7 +742,7 @@ static struct clk_rcg2 gcc_camss_csi1phytimer_clk_src = {
+ .name = "gcc_camss_csi1phytimer_clk_src",
+ .parent_data = gcc_parents_5,
+ .num_parents = ARRAY_SIZE(gcc_parents_5),
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -764,7 +764,7 @@ static struct clk_rcg2 gcc_camss_mclk0_clk_src = {
+ .parent_data = gcc_parents_3,
+ .num_parents = ARRAY_SIZE(gcc_parents_3),
+ .flags = CLK_OPS_PARENT_ENABLE,
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -779,7 +779,7 @@ static struct clk_rcg2 gcc_camss_mclk1_clk_src = {
+ .parent_data = gcc_parents_3,
+ .num_parents = ARRAY_SIZE(gcc_parents_3),
+ .flags = CLK_OPS_PARENT_ENABLE,
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -794,7 +794,7 @@ static struct clk_rcg2 gcc_camss_mclk2_clk_src = {
+ .parent_data = gcc_parents_3,
+ .num_parents = ARRAY_SIZE(gcc_parents_3),
+ .flags = CLK_OPS_PARENT_ENABLE,
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -809,7 +809,7 @@ static struct clk_rcg2 gcc_camss_mclk3_clk_src = {
+ .parent_data = gcc_parents_3,
+ .num_parents = ARRAY_SIZE(gcc_parents_3),
+ .flags = CLK_OPS_PARENT_ENABLE,
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -830,7 +830,7 @@ static struct clk_rcg2 gcc_camss_ope_ahb_clk_src = {
+ .name = "gcc_camss_ope_ahb_clk_src",
+ .parent_data = gcc_parents_6,
+ .num_parents = ARRAY_SIZE(gcc_parents_6),
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -854,7 +854,7 @@ static struct clk_rcg2 gcc_camss_ope_clk_src = {
+ .parent_data = gcc_parents_6,
+ .num_parents = ARRAY_SIZE(gcc_parents_6),
+ .flags = CLK_SET_RATE_PARENT,
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -888,7 +888,7 @@ static struct clk_rcg2 gcc_camss_tfe_0_clk_src = {
+ .name = "gcc_camss_tfe_0_clk_src",
+ .parent_data = gcc_parents_7,
+ .num_parents = ARRAY_SIZE(gcc_parents_7),
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -912,7 +912,7 @@ static struct clk_rcg2 gcc_camss_tfe_0_csid_clk_src = {
+ .name = "gcc_camss_tfe_0_csid_clk_src",
+ .parent_data = gcc_parents_8,
+ .num_parents = ARRAY_SIZE(gcc_parents_8),
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -926,7 +926,7 @@ static struct clk_rcg2 gcc_camss_tfe_1_clk_src = {
+ .name = "gcc_camss_tfe_1_clk_src",
+ .parent_data = gcc_parents_7,
+ .num_parents = ARRAY_SIZE(gcc_parents_7),
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -940,7 +940,7 @@ static struct clk_rcg2 gcc_camss_tfe_1_csid_clk_src = {
+ .name = "gcc_camss_tfe_1_csid_clk_src",
+ .parent_data = gcc_parents_8,
+ .num_parents = ARRAY_SIZE(gcc_parents_8),
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -963,7 +963,7 @@ static struct clk_rcg2 gcc_camss_tfe_cphy_rx_clk_src = {
+ .parent_data = gcc_parents_10,
+ .num_parents = ARRAY_SIZE(gcc_parents_10),
+ .flags = CLK_OPS_PARENT_ENABLE,
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -984,7 +984,7 @@ static struct clk_rcg2 gcc_camss_top_ahb_clk_src = {
+ .name = "gcc_camss_top_ahb_clk_src",
+ .parent_data = gcc_parents_4,
+ .num_parents = ARRAY_SIZE(gcc_parents_4),
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -1006,7 +1006,7 @@ static struct clk_rcg2 gcc_gp1_clk_src = {
+ .name = "gcc_gp1_clk_src",
+ .parent_data = gcc_parents_2,
+ .num_parents = ARRAY_SIZE(gcc_parents_2),
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -1020,7 +1020,7 @@ static struct clk_rcg2 gcc_gp2_clk_src = {
+ .name = "gcc_gp2_clk_src",
+ .parent_data = gcc_parents_2,
+ .num_parents = ARRAY_SIZE(gcc_parents_2),
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -1034,7 +1034,7 @@ static struct clk_rcg2 gcc_gp3_clk_src = {
+ .name = "gcc_gp3_clk_src",
+ .parent_data = gcc_parents_2,
+ .num_parents = ARRAY_SIZE(gcc_parents_2),
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -1054,7 +1054,7 @@ static struct clk_rcg2 gcc_pdm2_clk_src = {
+ .name = "gcc_pdm2_clk_src",
+ .parent_data = gcc_parents_0,
+ .num_parents = ARRAY_SIZE(gcc_parents_0),
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -1082,7 +1082,7 @@ static struct clk_init_data gcc_qupv3_wrap0_s0_clk_src_init = {
+ .name = "gcc_qupv3_wrap0_s0_clk_src",
+ .parent_data = gcc_parents_1,
+ .num_parents = ARRAY_SIZE(gcc_parents_1),
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ };
+
+ static struct clk_rcg2 gcc_qupv3_wrap0_s0_clk_src = {
+@@ -1098,7 +1098,7 @@ static struct clk_init_data gcc_qupv3_wrap0_s1_clk_src_init = {
+ .name = "gcc_qupv3_wrap0_s1_clk_src",
+ .parent_data = gcc_parents_1,
+ .num_parents = ARRAY_SIZE(gcc_parents_1),
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ };
+
+ static struct clk_rcg2 gcc_qupv3_wrap0_s1_clk_src = {
+@@ -1114,7 +1114,7 @@ static struct clk_init_data gcc_qupv3_wrap0_s2_clk_src_init = {
+ .name = "gcc_qupv3_wrap0_s2_clk_src",
+ .parent_data = gcc_parents_1,
+ .num_parents = ARRAY_SIZE(gcc_parents_1),
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ };
+
+ static struct clk_rcg2 gcc_qupv3_wrap0_s2_clk_src = {
+@@ -1130,7 +1130,7 @@ static struct clk_init_data gcc_qupv3_wrap0_s3_clk_src_init = {
+ .name = "gcc_qupv3_wrap0_s3_clk_src",
+ .parent_data = gcc_parents_1,
+ .num_parents = ARRAY_SIZE(gcc_parents_1),
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ };
+
+ static struct clk_rcg2 gcc_qupv3_wrap0_s3_clk_src = {
+@@ -1146,7 +1146,7 @@ static struct clk_init_data gcc_qupv3_wrap0_s4_clk_src_init = {
+ .name = "gcc_qupv3_wrap0_s4_clk_src",
+ .parent_data = gcc_parents_1,
+ .num_parents = ARRAY_SIZE(gcc_parents_1),
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ };
+
+ static struct clk_rcg2 gcc_qupv3_wrap0_s4_clk_src = {
+@@ -1162,7 +1162,7 @@ static struct clk_init_data gcc_qupv3_wrap0_s5_clk_src_init = {
+ .name = "gcc_qupv3_wrap0_s5_clk_src",
+ .parent_data = gcc_parents_1,
+ .num_parents = ARRAY_SIZE(gcc_parents_1),
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ };
+
+ static struct clk_rcg2 gcc_qupv3_wrap0_s5_clk_src = {
+@@ -1219,7 +1219,7 @@ static struct clk_rcg2 gcc_sdcc1_ice_core_clk_src = {
+ .name = "gcc_sdcc1_ice_core_clk_src",
+ .parent_data = gcc_parents_0,
+ .num_parents = ARRAY_SIZE(gcc_parents_0),
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -1266,7 +1266,7 @@ static struct clk_rcg2 gcc_usb30_prim_master_clk_src = {
+ .name = "gcc_usb30_prim_master_clk_src",
+ .parent_data = gcc_parents_0,
+ .num_parents = ARRAY_SIZE(gcc_parents_0),
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -1280,7 +1280,7 @@ static struct clk_rcg2 gcc_usb3_prim_phy_aux_clk_src = {
+ .name = "gcc_usb3_prim_phy_aux_clk_src",
+ .parent_data = gcc_parents_13,
+ .num_parents = ARRAY_SIZE(gcc_parents_13),
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -1303,7 +1303,7 @@ static struct clk_rcg2 gcc_video_venus_clk_src = {
+ .parent_data = gcc_parents_14,
+ .num_parents = ARRAY_SIZE(gcc_parents_14),
+ .flags = CLK_SET_RATE_PARENT,
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+--
+2.39.2
+
--- /dev/null
+From 7149aacb55d4f5aacdf88e3ebfcebb75bebc04b7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Apr 2023 16:26:07 +0530
+Subject: clk: qcom: ipq5332: fix the order of SLEEP_CLK and XO clock
+
+From: Kathiravan T <quic_kathirav@quicinc.com>
+
+[ Upstream commit 7510e80f4ac707efc7e964120525ef759a02f171 ]
+
+The order of DT_SLEEP_CLK and DT_XO are swapped and it is incorrect.
+Due to which the clocks for which the parent should be XO is having parent
+as SLEEP_CLK and vice versa. So fix the same by re-ordering the entries.
+
+Fixes: 3d89d52970fd ("clk: qcom: add Global Clock controller (GCC) driver for IPQ5332 SoC")
+Reported-by: Devi Priya <quic_devipriy@quicinc.com>
+Signed-off-by: Kathiravan T <quic_kathirav@quicinc.com>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230417105607.4091-1-quic_kathirav@quicinc.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/gcc-ipq5332.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/qcom/gcc-ipq5332.c b/drivers/clk/qcom/gcc-ipq5332.c
+index b9ab67649130a..a75ab88ed14c6 100644
+--- a/drivers/clk/qcom/gcc-ipq5332.c
++++ b/drivers/clk/qcom/gcc-ipq5332.c
+@@ -20,8 +20,8 @@
+ #include "reset.h"
+
+ enum {
+- DT_SLEEP_CLK,
+ DT_XO,
++ DT_SLEEP_CLK,
+ DT_PCIE_2LANE_PHY_PIPE_CLK,
+ DT_PCIE_2LANE_PHY_PIPE_CLK_X1,
+ DT_USB_PCIE_WRAPPER_PIPE_CLK,
+--
+2.39.2
+
--- /dev/null
+From 3df8a9b59cf81af34a3b231c95e5862d8c5bc1ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Apr 2023 10:13:42 +0530
+Subject: clk: qcom: ipq5332: fix the src parameter in
+ ftbl_gcc_apss_axi_clk_src
+
+From: Kathiravan T <quic_kathirav@quicinc.com>
+
+[ Upstream commit 81c1ef89a45eccd5603f1e27e281d14fefcb81f9 ]
+
+480MHz is derived from P_GPLL4_OUT_AUX not from P_GPLL4_OUT_MAIN. Update
+the freq_tbl with the correct src.
+
+Fixes: 3d89d52970fd ("clk: qcom: add Global Clock controller (GCC) driver for IPQ5332 SoC")
+Reported-by: Manikanta Mylavarapu <quic_mmanikan@quicinc.com>
+Signed-off-by: Kathiravan T <quic_kathirav@quicinc.com>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230417044342.9406-1-quic_kathirav@quicinc.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/gcc-ipq5332.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/qcom/gcc-ipq5332.c b/drivers/clk/qcom/gcc-ipq5332.c
+index 1ad23aa8aa5a9..b9ab67649130a 100644
+--- a/drivers/clk/qcom/gcc-ipq5332.c
++++ b/drivers/clk/qcom/gcc-ipq5332.c
+@@ -366,7 +366,7 @@ static struct clk_rcg2 gcc_adss_pwm_clk_src = {
+ };
+
+ static const struct freq_tbl ftbl_gcc_apss_axi_clk_src[] = {
+- F(480000000, P_GPLL4_OUT_MAIN, 2.5, 0, 0),
++ F(480000000, P_GPLL4_OUT_AUX, 2.5, 0, 0),
+ F(533333333, P_GPLL0_OUT_MAIN, 1.5, 0, 0),
+ { }
+ };
+--
+2.39.2
+
--- /dev/null
+From 2e0aeb2273a7110a841c25fc64bbdbdebc02f834 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 May 2023 21:08:55 +0200
+Subject: clk: qcom: ipq6018: fix networking resets
+
+From: Robert Marko <robimarko@gmail.com>
+
+[ Upstream commit 349b5bed539b491b7894a5186a895751fd8ba6c7 ]
+
+Networking resets in IPQ6018 all use bitmask as they require multiple
+bits to be set and cleared instead of a single bit.
+
+So, current networking resets have the same register and bit 0 set which
+is clearly incorrect.
+
+Fixes: d9db07f088af ("clk: qcom: Add ipq6018 Global Clock Controller support")
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230526190855.2941291-2-robimarko@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/gcc-ipq6018.c | 32 ++++++++++++++++----------------
+ 1 file changed, 16 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/clk/qcom/gcc-ipq6018.c b/drivers/clk/qcom/gcc-ipq6018.c
+index 5c5d1b04ea7af..cde62a11f5736 100644
+--- a/drivers/clk/qcom/gcc-ipq6018.c
++++ b/drivers/clk/qcom/gcc-ipq6018.c
+@@ -4517,24 +4517,24 @@ static const struct qcom_reset_map gcc_ipq6018_resets[] = {
+ [GCC_PCIE0_AHB_ARES] = { 0x75040, 5 },
+ [GCC_PCIE0_AXI_MASTER_STICKY_ARES] = { 0x75040, 6 },
+ [GCC_PCIE0_AXI_SLAVE_STICKY_ARES] = { 0x75040, 7 },
+- [GCC_PPE_FULL_RESET] = { 0x68014, 0 },
+- [GCC_UNIPHY0_SOFT_RESET] = { 0x56004, 0 },
++ [GCC_PPE_FULL_RESET] = { .reg = 0x68014, .bitmask = 0xf0000 },
++ [GCC_UNIPHY0_SOFT_RESET] = { .reg = 0x56004, .bitmask = 0x3ff2 },
+ [GCC_UNIPHY0_XPCS_RESET] = { 0x56004, 2 },
+- [GCC_UNIPHY1_SOFT_RESET] = { 0x56104, 0 },
++ [GCC_UNIPHY1_SOFT_RESET] = { .reg = 0x56104, .bitmask = 0x32 },
+ [GCC_UNIPHY1_XPCS_RESET] = { 0x56104, 2 },
+- [GCC_EDMA_HW_RESET] = { 0x68014, 0 },
+- [GCC_NSSPORT1_RESET] = { 0x68014, 0 },
+- [GCC_NSSPORT2_RESET] = { 0x68014, 0 },
+- [GCC_NSSPORT3_RESET] = { 0x68014, 0 },
+- [GCC_NSSPORT4_RESET] = { 0x68014, 0 },
+- [GCC_NSSPORT5_RESET] = { 0x68014, 0 },
+- [GCC_UNIPHY0_PORT1_ARES] = { 0x56004, 0 },
+- [GCC_UNIPHY0_PORT2_ARES] = { 0x56004, 0 },
+- [GCC_UNIPHY0_PORT3_ARES] = { 0x56004, 0 },
+- [GCC_UNIPHY0_PORT4_ARES] = { 0x56004, 0 },
+- [GCC_UNIPHY0_PORT5_ARES] = { 0x56004, 0 },
+- [GCC_UNIPHY0_PORT_4_5_RESET] = { 0x56004, 0 },
+- [GCC_UNIPHY0_PORT_4_RESET] = { 0x56004, 0 },
++ [GCC_EDMA_HW_RESET] = { .reg = 0x68014, .bitmask = 0x300000 },
++ [GCC_NSSPORT1_RESET] = { .reg = 0x68014, .bitmask = 0x1000003 },
++ [GCC_NSSPORT2_RESET] = { .reg = 0x68014, .bitmask = 0x200000c },
++ [GCC_NSSPORT3_RESET] = { .reg = 0x68014, .bitmask = 0x4000030 },
++ [GCC_NSSPORT4_RESET] = { .reg = 0x68014, .bitmask = 0x8000300 },
++ [GCC_NSSPORT5_RESET] = { .reg = 0x68014, .bitmask = 0x10000c00 },
++ [GCC_UNIPHY0_PORT1_ARES] = { .reg = 0x56004, .bitmask = 0x30 },
++ [GCC_UNIPHY0_PORT2_ARES] = { .reg = 0x56004, .bitmask = 0xc0 },
++ [GCC_UNIPHY0_PORT3_ARES] = { .reg = 0x56004, .bitmask = 0x300 },
++ [GCC_UNIPHY0_PORT4_ARES] = { .reg = 0x56004, .bitmask = 0xc00 },
++ [GCC_UNIPHY0_PORT5_ARES] = { .reg = 0x56004, .bitmask = 0x3000 },
++ [GCC_UNIPHY0_PORT_4_5_RESET] = { .reg = 0x56004, .bitmask = 0x3c02 },
++ [GCC_UNIPHY0_PORT_4_RESET] = { .reg = 0x56004, .bitmask = 0xc02 },
+ [GCC_LPASS_BCR] = {0x1F000, 0},
+ [GCC_UBI32_TBU_BCR] = {0x65000, 0},
+ [GCC_LPASS_TBU_BCR] = {0x6C000, 0},
+--
+2.39.2
+
--- /dev/null
+From ddebbf4ed9c933e34fbc46f4bb75aaec0967beea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 May 2023 20:53:35 +0300
+Subject: clk: qcom: mmcc-msm8974: fix MDSS_GDSC power flags
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit 4e13c7a55cf752887f2b8d8008711dbbc64ea796 ]
+
+Using PWRSTS_RET on msm8974's MDSS_GDSC causes display to stop working.
+The gdsc doesn't fully come out of retention mode. Change it's pwrsts
+flags to PWRSTS_OFF_ON.
+
+Fixes: d399723950c4 ("clk: qcom: gdsc: Fix the handling of PWRSTS_RET support")
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Reviewed-by: Rajendra Nayak <quic_rjendra@quicinc.com>
+Tested-by: Luca Weiss <luca@z3ntu.xyz>
+Link: https://lore.kernel.org/r/20230507175335.2321503-2-dmitry.baryshkov@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/mmcc-msm8974.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/qcom/mmcc-msm8974.c b/drivers/clk/qcom/mmcc-msm8974.c
+index d2fec5d5b22e2..82f6bad144a9a 100644
+--- a/drivers/clk/qcom/mmcc-msm8974.c
++++ b/drivers/clk/qcom/mmcc-msm8974.c
+@@ -2384,7 +2384,7 @@ static struct gdsc mdss_gdsc = {
+ .pd = {
+ .name = "mdss",
+ },
+- .pwrsts = PWRSTS_RET_ON,
++ .pwrsts = PWRSTS_OFF_ON,
+ };
+
+ static struct gdsc camss_jpeg_gdsc = {
+--
+2.39.2
+
--- /dev/null
+From b9af0edd02eab9de111ea055c61fda51436efa45 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 May 2023 18:33:19 +0300
+Subject: clk: qcom: mmcc-msm8974: remove oxili_ocmemgx_clk
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit 853c064b57491d739bfd0cc35ff75c5ea9c5e8f5 ]
+
+After the internal discussions, it looks like this clock is managed by
+RPM itself. Linux kernel should not touch it on its own, as this causes
+disagreement with RPM. Shutting down this clock causes the OCMEM<->GPU
+interface to stop working, resulting in GPU hangchecks/timeouts.
+
+Fixes: d8b212014e69 ("clk: qcom: Add support for MSM8974's multimedia clock controller (MMCC)")
+Suggested-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Tested-by: Luca Weiss <luca@z3ntu.xyz>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230508153319.2371645-1-dmitry.baryshkov@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/mmcc-msm8974.c | 19 -------------------
+ 1 file changed, 19 deletions(-)
+
+diff --git a/drivers/clk/qcom/mmcc-msm8974.c b/drivers/clk/qcom/mmcc-msm8974.c
+index 4273fce9a4a4c..b90a9f362f5f7 100644
+--- a/drivers/clk/qcom/mmcc-msm8974.c
++++ b/drivers/clk/qcom/mmcc-msm8974.c
+@@ -2204,23 +2204,6 @@ static struct clk_branch ocmemcx_ocmemnoc_clk = {
+ },
+ };
+
+-static struct clk_branch oxili_ocmemgx_clk = {
+- .halt_reg = 0x402c,
+- .clkr = {
+- .enable_reg = 0x402c,
+- .enable_mask = BIT(0),
+- .hw.init = &(struct clk_init_data){
+- .name = "oxili_ocmemgx_clk",
+- .parent_data = (const struct clk_parent_data[]){
+- { .fw_name = "gfx3d_clk_src", .name = "gfx3d_clk_src" },
+- },
+- .num_parents = 1,
+- .flags = CLK_SET_RATE_PARENT,
+- .ops = &clk_branch2_ops,
+- },
+- },
+-};
+-
+ static struct clk_branch ocmemnoc_clk = {
+ .halt_reg = 0x50b4,
+ .clkr = {
+@@ -2512,7 +2495,6 @@ static struct clk_regmap *mmcc_msm8226_clocks[] = {
+ [MMSS_MMSSNOC_AXI_CLK] = &mmss_mmssnoc_axi_clk.clkr,
+ [MMSS_S0_AXI_CLK] = &mmss_s0_axi_clk.clkr,
+ [OCMEMCX_AHB_CLK] = &ocmemcx_ahb_clk.clkr,
+- [OXILI_OCMEMGX_CLK] = &oxili_ocmemgx_clk.clkr,
+ [OXILI_GFX3D_CLK] = &oxili_gfx3d_clk.clkr,
+ [OXILICX_AHB_CLK] = &oxilicx_ahb_clk.clkr,
+ [OXILICX_AXI_CLK] = &oxilicx_axi_clk.clkr,
+@@ -2670,7 +2652,6 @@ static struct clk_regmap *mmcc_msm8974_clocks[] = {
+ [MMSS_S0_AXI_CLK] = &mmss_s0_axi_clk.clkr,
+ [OCMEMCX_AHB_CLK] = &ocmemcx_ahb_clk.clkr,
+ [OCMEMCX_OCMEMNOC_CLK] = &ocmemcx_ocmemnoc_clk.clkr,
+- [OXILI_OCMEMGX_CLK] = &oxili_ocmemgx_clk.clkr,
+ [OCMEMNOC_CLK] = &ocmemnoc_clk.clkr,
+ [OXILI_GFX3D_CLK] = &oxili_gfx3d_clk.clkr,
+ [OXILICX_AHB_CLK] = &oxilicx_ahb_clk.clkr,
+--
+2.39.2
+
--- /dev/null
+From 7209e550c85ab9c68eb788e8352583a2e9d9061f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 May 2023 20:53:34 +0300
+Subject: clk: qcom: mmcc-msm8974: use clk_rcg2_shared_ops for mdp_clk_src
+ clock
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit 8fd492e77ff71f68f7311c22f7bc960182465cd7 ]
+
+The mdp_clk_src clock should not be turned off. Instead it should be
+'parked' to the XO, as most of other mdp_clk_src clocks. Fix that by
+using the clk_rcg2_shared_ops.
+
+Fixes: d8b212014e69 ("clk: qcom: Add support for MSM8974's multimedia clock controller (MMCC)")
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Tested-by: Luca Weiss <luca@z3ntu.xyz>
+Acked-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230507175335.2321503-1-dmitry.baryshkov@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/mmcc-msm8974.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/qcom/mmcc-msm8974.c b/drivers/clk/qcom/mmcc-msm8974.c
+index b90a9f362f5f7..d2fec5d5b22e2 100644
+--- a/drivers/clk/qcom/mmcc-msm8974.c
++++ b/drivers/clk/qcom/mmcc-msm8974.c
+@@ -485,7 +485,7 @@ static struct clk_rcg2 mdp_clk_src = {
+ .name = "mdp_clk_src",
+ .parent_data = mmcc_xo_mmpll0_dsi_hdmi_gpll0,
+ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_dsi_hdmi_gpll0),
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+--
+2.39.2
+
--- /dev/null
+From f3c9f47641e1bbb2b33135846621efbda861f2a0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 May 2023 14:30:54 +0100
+Subject: coresight: etm4x: Fix missing trctraceidr file in sysfs
+
+From: Mike Leach <mike.leach@linaro.org>
+
+[ Upstream commit 9f37d3798026f9a7447d851a2cb356610852e426 ]
+
+The trace ID patchset adjusted the handling of the TRCTRACEIDR register
+sysfs to allocate on read.
+
+Although this was initally correct, the final version of the patch series
+introduced an error which resulted in the mgmt/trctraceidr file in sysfs
+not being visible.
+
+This patch fixes that issue.
+
+Fixes: df4871204e5d ("coresight: etm4x: Update ETM4 driver to use Trace ID API")
+Reported-by: Junhao He <hejunhao3@huawei.com>
+Link: https://lists.linaro.org/archives/list/coresight@lists.linaro.org/thread/KK3CVVMRHJWVUORKMFJRSXYCEDFKENQJ/
+Signed-off-by: Mike Leach <mike.leach@linaro.org>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Link: https://lore.kernel.org/r/20230512133054.235073-1-mike.leach@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../coresight/coresight-etm4x-sysfs.c | 27 ++++++++++++-------
+ 1 file changed, 18 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c b/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c
+index 5e62aa40ecd0f..a9f19629f3f84 100644
+--- a/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c
++++ b/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c
+@@ -2411,7 +2411,6 @@ static ssize_t trctraceid_show(struct device *dev,
+
+ return sysfs_emit(buf, "0x%x\n", trace_id);
+ }
+-static DEVICE_ATTR_RO(trctraceid);
+
+ struct etmv4_reg {
+ struct coresight_device *csdev;
+@@ -2528,13 +2527,23 @@ coresight_etm4x_attr_reg_implemented(struct kobject *kobj,
+ return 0;
+ }
+
+-#define coresight_etm4x_reg(name, offset) \
+- &((struct dev_ext_attribute[]) { \
+- { \
+- __ATTR(name, 0444, coresight_etm4x_reg_show, NULL), \
+- (void *)(unsigned long)offset \
+- } \
+- })[0].attr.attr
++/*
++ * Macro to set an RO ext attribute with offset and show function.
++ * Offset is used in mgmt group to ensure only correct registers for
++ * the ETM / ETE variant are visible.
++ */
++#define coresight_etm4x_reg_showfn(name, offset, showfn) ( \
++ &((struct dev_ext_attribute[]) { \
++ { \
++ __ATTR(name, 0444, showfn, NULL), \
++ (void *)(unsigned long)offset \
++ } \
++ })[0].attr.attr \
++ )
++
++/* macro using the default coresight_etm4x_reg_show function */
++#define coresight_etm4x_reg(name, offset) \
++ coresight_etm4x_reg_showfn(name, offset, coresight_etm4x_reg_show)
+
+ static struct attribute *coresight_etmv4_mgmt_attrs[] = {
+ coresight_etm4x_reg(trcpdcr, TRCPDCR),
+@@ -2549,7 +2558,7 @@ static struct attribute *coresight_etmv4_mgmt_attrs[] = {
+ coresight_etm4x_reg(trcpidr3, TRCPIDR3),
+ coresight_etm4x_reg(trcoslsr, TRCOSLSR),
+ coresight_etm4x_reg(trcconfig, TRCCONFIGR),
+- &dev_attr_trctraceid.attr,
++ coresight_etm4x_reg_showfn(trctraceid, TRCTRACEIDR, trctraceid_show),
+ coresight_etm4x_reg(trcdevarch, TRCDEVARCH),
+ NULL,
+ };
+--
+2.39.2
+
--- /dev/null
+From f7f6ea80f542f86c446195edb953ca9c31a3ed9e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Apr 2023 15:35:28 +0100
+Subject: coresight: Fix loss of connection info when a module is unloaded
+
+From: James Clark <james.clark@arm.com>
+
+[ Upstream commit c45b2835e7b205783bdfe08cc98fa86a7c5eeb74 ]
+
+child_fwnode should be a read only property based on the DT or ACPI. If
+it's cleared on the parent device when a child is unloaded, then when
+the child is loaded again the connection won't be remade.
+
+child_dev should be cleared instead which signifies that the connection
+should be remade when the child_fwnode registers a new coresight_device.
+
+Similarly the reference count shouldn't be decremented as long as the
+parent device exists. The correct place to drop the reference is in
+coresight_release_platform_data() which is already done.
+
+Reproducible on Juno with the following steps:
+
+ # load all coresight modules.
+ $ cd /sys/bus/coresight/devices/
+ $ echo 1 > tmc_etr0/enable_sink
+ $ echo 1 > etm0/enable_source
+ # Works fine ^
+
+ $ echo 0 > etm0/enable_source
+ $ rmmod coresight-funnel
+ $ modprobe coresight-funnel
+ $ echo 1 > etm0/enable_source
+ -bash: echo: write error: Invalid argument
+
+Fixes: 37ea1ffddffa ("coresight: Use fwnode handle instead of device names")
+Fixes: 2af89ebacf29 ("coresight: Clear the connection field properly")
+Tested-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Reviewed-by: Mike Leach <mike.leach@linaro.org>
+Signed-off-by: James Clark <james.clark@arm.com>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Link: https://lore.kernel.org/r/20230425143542.2305069-2-james.clark@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/coresight/coresight-core.c | 9 ++-------
+ 1 file changed, 2 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/hwtracing/coresight/coresight-core.c b/drivers/hwtracing/coresight/coresight-core.c
+index d3bf82c0de1d8..5733294ce5cd2 100644
+--- a/drivers/hwtracing/coresight/coresight-core.c
++++ b/drivers/hwtracing/coresight/coresight-core.c
+@@ -1419,13 +1419,8 @@ static int coresight_remove_match(struct device *dev, void *data)
+ if (csdev->dev.fwnode == conn->child_fwnode) {
+ iterator->orphan = true;
+ coresight_remove_links(iterator, conn);
+- /*
+- * Drop the reference to the handle for the remote
+- * device acquired in parsing the connections from
+- * platform data.
+- */
+- fwnode_handle_put(conn->child_fwnode);
+- conn->child_fwnode = NULL;
++
++ conn->child_dev = NULL;
+ /* No need to continue */
+ break;
+ }
+--
+2.39.2
+
--- /dev/null
+From d59a194336b295fae2e3afc1547791ca8de1bd1b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Jun 2023 15:18:12 +0100
+Subject: cpufreq: mediatek: correct voltages for MT7622 and MT7623
+
+From: Daniel Golle <daniel@makrotopia.org>
+
+[ Upstream commit f85534113f5ae90a52521cdb9e9977a43ee42626 ]
+
+The MT6380 regulator typically used together with MT7622 does not
+support the current maximum processor and SRAM voltage in the cpufreq
+driver (1360000uV).
+For MT7622 limit processor and SRAM supply voltages to 1350000uV to
+avoid having the tracking algorithm request unsupported voltages from
+the regulator.
+
+On MT7623 there is no separate SRAM supply and the maximum voltage used
+is 1300000uV. Create dedicated platform data for MT7623 to cover that
+case as well.
+
+Fixes: 0883426fd07e3 ("cpufreq: mediatek: Raise proc and sram max voltage for MT7622/7623")
+Suggested-by: Jia-wei Chang <Jia-wei.Chang@mediatek.com>
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/mediatek-cpufreq.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/cpufreq/mediatek-cpufreq.c b/drivers/cpufreq/mediatek-cpufreq.c
+index 9a39a7ccfae96..fef68cb2b38f7 100644
+--- a/drivers/cpufreq/mediatek-cpufreq.c
++++ b/drivers/cpufreq/mediatek-cpufreq.c
+@@ -696,9 +696,16 @@ static const struct mtk_cpufreq_platform_data mt2701_platform_data = {
+ static const struct mtk_cpufreq_platform_data mt7622_platform_data = {
+ .min_volt_shift = 100000,
+ .max_volt_shift = 200000,
+- .proc_max_volt = 1360000,
++ .proc_max_volt = 1350000,
+ .sram_min_volt = 0,
+- .sram_max_volt = 1360000,
++ .sram_max_volt = 1350000,
++ .ccifreq_supported = false,
++};
++
++static const struct mtk_cpufreq_platform_data mt7623_platform_data = {
++ .min_volt_shift = 100000,
++ .max_volt_shift = 200000,
++ .proc_max_volt = 1300000,
+ .ccifreq_supported = false,
+ };
+
+@@ -734,7 +741,7 @@ static const struct of_device_id mtk_cpufreq_machines[] __initconst = {
+ { .compatible = "mediatek,mt2701", .data = &mt2701_platform_data },
+ { .compatible = "mediatek,mt2712", .data = &mt2701_platform_data },
+ { .compatible = "mediatek,mt7622", .data = &mt7622_platform_data },
+- { .compatible = "mediatek,mt7623", .data = &mt7622_platform_data },
++ { .compatible = "mediatek,mt7623", .data = &mt7623_platform_data },
+ { .compatible = "mediatek,mt8167", .data = &mt8516_platform_data },
+ { .compatible = "mediatek,mt817x", .data = &mt2701_platform_data },
+ { .compatible = "mediatek,mt8173", .data = &mt2701_platform_data },
+--
+2.39.2
+
--- /dev/null
+From 6dbf5e7fd03d75a919c11283dda2eab1135dd626 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Apr 2023 15:11:19 +0200
+Subject: cpufreq: tegra194: Fix an error handling path in
+ tegra194_cpufreq_probe()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 9ab24b0486681ecc059ee766e00d9570c6311e08 ]
+
+If the probe needs to be deferred, some resources still need to be
+released. So branch to the error handling path instead of returning
+directly.
+
+Fixes: f41e1442ac5b ("cpufreq: tegra194: add OPP support and set bandwidth")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Reviewed-by: Sumit Gupta <sumitg@nvidia.com>
+Acked-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/tegra194-cpufreq.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/cpufreq/tegra194-cpufreq.c b/drivers/cpufreq/tegra194-cpufreq.c
+index c8d03346068ab..36dad5ea59475 100644
+--- a/drivers/cpufreq/tegra194-cpufreq.c
++++ b/drivers/cpufreq/tegra194-cpufreq.c
+@@ -686,8 +686,10 @@ static int tegra194_cpufreq_probe(struct platform_device *pdev)
+
+ /* Check for optional OPPv2 and interconnect paths on CPU0 to enable ICC scaling */
+ cpu_dev = get_cpu_device(0);
+- if (!cpu_dev)
+- return -EPROBE_DEFER;
++ if (!cpu_dev) {
++ err = -EPROBE_DEFER;
++ goto err_free_res;
++ }
+
+ if (dev_pm_opp_of_get_opp_desc_node(cpu_dev)) {
+ err = dev_pm_opp_of_find_icc_paths(cpu_dev, NULL);
+--
+2.39.2
+
--- /dev/null
+From d972f07d6a0689c8dfb2dc9b7da1c17d968d80c2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 May 2023 09:22:33 +0300
+Subject: drivers: fwnode: fix fwnode_irq_get[_byname]()
+
+From: Matti Vaittinen <mazziesaccount@gmail.com>
+
+[ Upstream commit 39d422555e43379516d4d13f5b7162a3dee6e646 ]
+
+The fwnode_irq_get() and the fwnode_irq_get_byname() return 0 upon
+device-tree IRQ mapping failure. This is contradicting the
+fwnode_irq_get_byname() function documentation and can potentially be a
+source of errors like:
+
+int probe(...) {
+ ...
+
+ irq = fwnode_irq_get_byname();
+ if (irq <= 0)
+ return irq;
+
+ ...
+}
+
+Here we do correctly check the return value from fwnode_irq_get_byname()
+but the driver probe will now return success. (There was already one
+such user in-tree).
+
+Change the fwnode_irq_get_byname() to work as documented and make also the
+fwnode_irq_get() follow same common convention returning a negative errno
+upon failure.
+
+Fixes: ca0acb511c21 ("device property: Add fwnode_irq_get_byname")
+Suggested-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Suggested-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Matti Vaittinen <mazziesaccount@gmail.com>
+Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+
+Message-ID: <3e64fe592dc99e27ef9a0b247fc49fa26b6b8a58.1685340157.git.mazziesaccount@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/property.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/base/property.c b/drivers/base/property.c
+index f6117ec9805c4..8c40abed78524 100644
+--- a/drivers/base/property.c
++++ b/drivers/base/property.c
+@@ -987,12 +987,18 @@ EXPORT_SYMBOL(fwnode_iomap);
+ * @fwnode: Pointer to the firmware node
+ * @index: Zero-based index of the IRQ
+ *
+- * Return: Linux IRQ number on success. Other values are determined
+- * according to acpi_irq_get() or of_irq_get() operation.
++ * Return: Linux IRQ number on success. Negative errno on failure.
+ */
+ int fwnode_irq_get(const struct fwnode_handle *fwnode, unsigned int index)
+ {
+- return fwnode_call_int_op(fwnode, irq_get, index);
++ int ret;
++
++ ret = fwnode_call_int_op(fwnode, irq_get, index);
++ /* We treat mapping errors as invalid case */
++ if (ret == 0)
++ return -EINVAL;
++
++ return ret;
+ }
+ EXPORT_SYMBOL(fwnode_irq_get);
+
+--
+2.39.2
+
--- /dev/null
+From 2ebc7e61af8e9ca19b64426a728efa54aa616c9e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jun 2023 22:18:39 -0500
+Subject: drm/amd: Don't try to enable secure display TA multiple times
+
+From: Mario Limonciello <mario.limonciello@amd.com>
+
+[ Upstream commit 5c6d52ff4b61e5267b25be714eb5a9ba2a338199 ]
+
+If the securedisplay TA failed to load the first time, it's unlikely
+to work again after a suspend/resume cycle or reset cycle and it appears
+to be causing problems in futher attempts.
+
+Fixes: e42dfa66d592 ("drm/amdgpu: Add secure display TA load for Renoir")
+Reported-by: Filip Hejsek <filip.hejsek@gmail.com>
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/2633
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+index a150b7a4b4aae..e4757a2807d9a 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+@@ -1947,6 +1947,8 @@ static int psp_securedisplay_initialize(struct psp_context *psp)
+ psp_securedisplay_parse_resp_status(psp, securedisplay_cmd->status);
+ dev_err(psp->adev->dev, "SECUREDISPLAY: query securedisplay TA failed. ret 0x%x\n",
+ securedisplay_cmd->securedisplay_out_message.query_ta.query_cmd_ret);
++ /* don't try again */
++ psp->securedisplay_context.context.bin_desc.size_bytes = 0;
+ }
+
+ return 0;
+--
+2.39.2
+
--- /dev/null
+From 4de4045e2da6022a0a4b5ffaab80971ac7cea339 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jun 2023 13:18:13 +0200
+Subject: drm/amdgpu: fix number of fence calculations
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Christian König <christian.koenig@amd.com>
+
+[ Upstream commit 570b295248b00c3cf4cf59e397de5cb2361e10c2 ]
+
+Since adding gang submit we need to take the gang size into account
+while reserving fences.
+
+Signed-off-by: Christian König <christian.koenig@amd.com>
+Fixes: 4624459c84d7 ("drm/amdgpu: add gang submit frontend v6")
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+index 2eb2c66843a88..5612caf77dd65 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+@@ -133,9 +133,6 @@ static int amdgpu_cs_p1_user_fence(struct amdgpu_cs_parser *p,
+ bo = amdgpu_bo_ref(gem_to_amdgpu_bo(gobj));
+ p->uf_entry.priority = 0;
+ p->uf_entry.tv.bo = &bo->tbo;
+- /* One for TTM and two for the CS job */
+- p->uf_entry.tv.num_shared = 3;
+-
+ drm_gem_object_put(gobj);
+
+ size = amdgpu_bo_size(bo);
+@@ -882,15 +879,19 @@ static int amdgpu_cs_parser_bos(struct amdgpu_cs_parser *p,
+
+ mutex_lock(&p->bo_list->bo_list_mutex);
+
+- /* One for TTM and one for the CS job */
++ /* One for TTM and one for each CS job */
+ amdgpu_bo_list_for_each_entry(e, p->bo_list)
+- e->tv.num_shared = 2;
++ e->tv.num_shared = 1 + p->gang_size;
++ p->uf_entry.tv.num_shared = 1 + p->gang_size;
+
+ amdgpu_bo_list_get_list(p->bo_list, &p->validated);
+
+ INIT_LIST_HEAD(&duplicates);
+ amdgpu_vm_get_pd_bo(&fpriv->vm, &p->validated, &p->vm_pd);
+
++ /* Two for VM updates, one for TTM and one for each CS job */
++ p->vm_pd.tv.num_shared = 3 + p->gang_size;
++
+ if (p->uf_entry.tv.bo && !ttm_to_amdgpu_bo(p->uf_entry.tv.bo)->parent)
+ list_add(&p->uf_entry.tv.head, &p->validated);
+
+--
+2.39.2
+
--- /dev/null
+From a3d25a66267ecaf9c884a0ed6ea20fefced0c425 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jun 2023 18:42:57 -0700
+Subject: drm/i915/guc/slpc: Apply min softlimit correctly
+
+From: Vinay Belgaumkar <vinay.belgaumkar@intel.com>
+
+[ Upstream commit 3e49de73fb89272dea01ba420c7ccbcf6b96aed7 ]
+
+The scenario being fixed here is depicted in the following sequence-
+
+modprobe i915
+echo 1 > /sys/class/drm/card0/gt/gt0/slpc_ignore_eff_freq
+echo 300 > /sys/class/drm/card0/gt_min_freq_mhz (RPn)
+cat /sys/class/drm/card0/gt_cur_freq_mhz --> cur == RPn as expected
+echo 1 > /sys/kernel/debug/dri/0/gt0/reset --> reset
+cat /sys/class/drm/card0/gt_min_freq_mhz --> cached freq is RPn
+cat /sys/class/drm/card0/gt_cur_freq_mhz --> it's not RPn, but RPe!!
+
+When SLPC reinitializes, it sets SLPC min freq to efficient frequency.
+Even if we disable efficient freq post that, we should restore the cached
+min freq (via H2G) for it to take effect.
+
+v2: Clarify commit message (Ashutosh)
+
+Fixes: 95ccf312a1e4 ("drm/i915/guc/slpc: Allow SLPC to use efficient frequency")
+Reviewed-by: Ashutosh Dixit <ashutosh.dixit@intel.com>
+Signed-off-by: Vinay Belgaumkar <vinay.belgaumkar@intel.com>
+Signed-off-by: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230621014257.1769564-1-vinay.belgaumkar@intel.com
+(cherry picked from commit da86b2b13f1d1ca26745b951ac94421f3137539a)
+Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/gt/uc/intel_guc_slpc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/i915/gt/uc/intel_guc_slpc.c b/drivers/gpu/drm/i915/gt/uc/intel_guc_slpc.c
+index 56dbba1ef6684..cc18e8f664864 100644
+--- a/drivers/gpu/drm/i915/gt/uc/intel_guc_slpc.c
++++ b/drivers/gpu/drm/i915/gt/uc/intel_guc_slpc.c
+@@ -606,7 +606,7 @@ static int slpc_set_softlimits(struct intel_guc_slpc *slpc)
+ if (unlikely(ret))
+ return ret;
+ slpc_to_gt(slpc)->defaults.min_freq = slpc->min_freq_softlimit;
+- } else if (slpc->min_freq_softlimit != slpc->min_freq) {
++ } else {
+ return intel_guc_slpc_set_min_freq(slpc,
+ slpc->min_freq_softlimit);
+ }
+--
+2.39.2
+
--- /dev/null
+From b11165fd42a835e3f9281547b67751f56457112e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Jun 2023 17:13:53 +0300
+Subject: drm/i915/psr: Fix BDW PSR AUX CH data register offsets
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ville Syrjälä <ville.syrjala@linux.intel.com>
+
+[ Upstream commit fdffb7dbc74f48cb1d404d9ab0c9fd769a59caf0 ]
+
+The multiplication got replaced by an addition in some cleanup.
+This means we never write the correct data to some of the BDW
+PSR data registers and thus we fail to actually wake up the
+panel from PSR.
+
+Fixes: 4ab4fa103217 ("drm/i915/psr: Make PSR registers relative to transcoders")
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230609141404.12729-3-ville.syrjala@linux.intel.com
+Reviewed-by: Jouni Högander <jouni.hogander@intel.com>
+(cherry picked from commit 460dc4ba1442b3e5e543328d11db2702b98d3d7c)
+Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/display/intel_psr_regs.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/i915/display/intel_psr_regs.h b/drivers/gpu/drm/i915/display/intel_psr_regs.h
+index 958d8cabc44b5..5e3fe23ef8eb2 100644
+--- a/drivers/gpu/drm/i915/display/intel_psr_regs.h
++++ b/drivers/gpu/drm/i915/display/intel_psr_regs.h
+@@ -75,7 +75,7 @@
+
+ #define _SRD_AUX_DATA_A 0x60814
+ #define _SRD_AUX_DATA_EDP 0x6f814
+-#define EDP_PSR_AUX_DATA(tran, i) _MMIO_TRANS2(tran, _SRD_AUX_DATA_A + (i) + 4) /* 5 registers */
++#define EDP_PSR_AUX_DATA(tran, i) _MMIO_TRANS2(tran, _SRD_AUX_DATA_A + (i) * 4) /* 5 registers */
+
+ #define _SRD_STATUS_A 0x60840
+ #define _SRD_STATUS_EDP 0x6f840
+--
+2.39.2
+
--- /dev/null
+From 981318d5ae7017ff87e1c083625a9b4df395d4ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jun 2023 14:17:45 +0300
+Subject: drm/i915/psr: Use hw.adjusted mode when calculating io/fast wake
+ times
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jouni Högander <jouni.hogander@intel.com>
+
+[ Upstream commit 5311892a0ad1d301aafd53ca0154091b3eb407ea ]
+
+Encoder compute config is changing hw.adjusted mode. Uapi.adjusted mode
+doesn't get updated before psr compute config gets called. This causes io
+and fast wake line calculation using adjusted mode containing values before
+encoder adjustments. Fix this by using hw.adjusted mode instead of
+uapi.adjusted mode.
+
+Cc: Stanislav Lisovskiy <stanislav.lisovskiy@intel.com>
+
+Signed-off-by: Jouni Högander <jouni.hogander@intel.com>
+Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/8475
+Fixes: cb42e8ede5b4 ("drm/i915/psr: Use calculated io and fast wake lines")
+Reviewed-by: Mika Kahola <mika.kahola@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230620111745.2870706-1-jouni.hogander@intel.com
+(cherry picked from commit ef0af9db2a21257885116949f471fe5565b2f0ab)
+Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/display/intel_psr.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/display/intel_psr.c b/drivers/gpu/drm/i915/display/intel_psr.c
+index 6badfff2b4a28..b7cbc780e672f 100644
+--- a/drivers/gpu/drm/i915/display/intel_psr.c
++++ b/drivers/gpu/drm/i915/display/intel_psr.c
+@@ -851,9 +851,9 @@ static bool _compute_psr2_wake_times(struct intel_dp *intel_dp,
+ }
+
+ io_wake_lines = intel_usecs_to_scanlines(
+- &crtc_state->uapi.adjusted_mode, io_wake_time);
++ &crtc_state->hw.adjusted_mode, io_wake_time);
+ fast_wake_lines = intel_usecs_to_scanlines(
+- &crtc_state->uapi.adjusted_mode, fast_wake_time);
++ &crtc_state->hw.adjusted_mode, fast_wake_time);
+
+ if (io_wake_lines > max_wake_lines ||
+ fast_wake_lines > max_wake_lines)
+--
+2.39.2
+
--- /dev/null
+From a10224fcdb3bb932e1245484637cd54006914dc0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Apr 2023 12:41:06 +0200
+Subject: dt-bindings: power: reset: qcom-pon: Only allow reboot-mode
+ pre-pmk8350
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit d41dab4c031edaa460a484113394327aa52dc0bd ]
+
+As pointed out by Shazad [1], PMICs using a separate HLOS+PBS scheme
+(so PMK8350 and newer) are expected to pass reboot mode data through SDAM,
+as the reboot mode registers are absent in the HLOS reg space.
+
+Limit the reboot-mode.yaml inclusion to PMICs without a separate PBS
+region.
+
+[1] https://lore.kernel.org/linux-arm-msm/12f13183-c381-25f7-459e-62e0c2b19498@quicinc.com/
+
+Fixes: 03fccdc76dce ("dt-bindings: power: reset: qcom-pon: Add new compatible "qcom,pmk8350-pon"")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Acked-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/devicetree/bindings/power/reset/qcom,pon.yaml | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/Documentation/devicetree/bindings/power/reset/qcom,pon.yaml b/Documentation/devicetree/bindings/power/reset/qcom,pon.yaml
+index d96170eecbd22..0b1eca734d3b1 100644
+--- a/Documentation/devicetree/bindings/power/reset/qcom,pon.yaml
++++ b/Documentation/devicetree/bindings/power/reset/qcom,pon.yaml
+@@ -56,7 +56,6 @@ required:
+ unevaluatedProperties: false
+
+ allOf:
+- - $ref: reboot-mode.yaml#
+ - if:
+ properties:
+ compatible:
+@@ -66,6 +65,9 @@ allOf:
+ - qcom,pms405-pon
+ - qcom,pm8998-pon
+ then:
++ allOf:
++ - $ref: reboot-mode.yaml#
++
+ properties:
+ reg:
+ maxItems: 1
+--
+2.39.2
+
--- /dev/null
+From 36e80eb3520dcc784aabb3d9ae70093b08ed2f9f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Mar 2023 16:39:53 +0200
+Subject: extcon: Fix kernel doc of property capability fields to avoid
+ warnings
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 73346b9965ebda2feb7fef8629e9b28baee820e3 ]
+
+Kernel documentation has to be synchronized with a code, otherwise
+the validator is not happy:
+
+ Function parameter or member 'usb_bits' not described in 'extcon_cable'
+ Function parameter or member 'chg_bits' not described in 'extcon_cable'
+ Function parameter or member 'jack_bits' not described in 'extcon_cable'
+ Function parameter or member 'disp_bits' not described in 'extcon_cable'
+
+Describe the fields added in the past.
+
+Fixes: ceaa98f442cf ("extcon: Add the support for the capability of each property")
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/extcon/extcon.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/extcon/extcon.c b/drivers/extcon/extcon.c
+index efaf234582d97..370b5b26d10b7 100644
+--- a/drivers/extcon/extcon.c
++++ b/drivers/extcon/extcon.c
+@@ -210,6 +210,10 @@ static const struct __extcon_info {
+ * @chg_propval: the array of charger connector properties
+ * @jack_propval: the array of jack connector properties
+ * @disp_propval: the array of display connector properties
++ * @usb_bits: the bit array of the USB connector property capabilities
++ * @chg_bits: the bit array of the charger connector property capabilities
++ * @jack_bits: the bit array of the jack connector property capabilities
++ * @disp_bits: the bit array of the display connector property capabilities
+ */
+ struct extcon_cable {
+ struct extcon_dev *edev;
+--
+2.39.2
+
--- /dev/null
+From 357f2b3b1271b3451da490c8c82fb7db226867c4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Mar 2023 16:39:52 +0200
+Subject: extcon: Fix kernel doc of property fields to avoid warnings
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 7e77e0b7a9f4cdf91cb0950749b40c840ea63efc ]
+
+Kernel documentation has to be synchronized with a code, otherwise
+the validator is not happy:
+
+ Function parameter or member 'usb_propval' not described in 'extcon_cable'
+ Function parameter or member 'chg_propval' not described in 'extcon_cable'
+ Function parameter or member 'jack_propval' not described in 'extcon_cable'
+ Function parameter or member 'disp_propval' not described in 'extcon_cable'
+
+Describe the fields added in the past.
+
+Fixes: 067c1652e7a7 ("extcon: Add the support for extcon property according to extcon type")
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/extcon/extcon.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/extcon/extcon.c b/drivers/extcon/extcon.c
+index d43ba8e7260dd..efaf234582d97 100644
+--- a/drivers/extcon/extcon.c
++++ b/drivers/extcon/extcon.c
+@@ -206,6 +206,10 @@ static const struct __extcon_info {
+ * @attr_name: "name" sysfs entry
+ * @attr_state: "state" sysfs entry
+ * @attrs: the array pointing to attr_name and attr_state for attr_g
++ * @usb_propval: the array of USB connector properties
++ * @chg_propval: the array of charger connector properties
++ * @jack_propval: the array of jack connector properties
++ * @disp_propval: the array of display connector properties
+ */
+ struct extcon_cable {
+ struct extcon_dev *edev;
+--
+2.39.2
+
--- /dev/null
+From b82d3f2dcd569a15e91b3484779ee459fb99fffc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Jun 2023 14:19:01 +0800
+Subject: f2fs: check return value of freeze_super()
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit 8bec7dd1b3f7d7769d433d67bde404de948a2d95 ]
+
+freeze_super() can fail, it needs to check its return value and do
+error handling in f2fs_resize_fs().
+
+Fixes: 04f0b2eaa3b3 ("f2fs: ioctl for removing a range from F2FS")
+Fixes: b4b10061ef98 ("f2fs: refactor resize_fs to avoid meta updates in progress")
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/gc.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c
+index 67f1b58d424ed..719b1ba32a78b 100644
+--- a/fs/f2fs/gc.c
++++ b/fs/f2fs/gc.c
+@@ -2175,7 +2175,9 @@ int f2fs_resize_fs(struct file *filp, __u64 block_count)
+ if (err)
+ return err;
+
+- freeze_super(sbi->sb);
++ err = freeze_super(sbi->sb);
++ if (err)
++ return err;
+
+ if (f2fs_readonly(sbi->sb)) {
+ thaw_super(sbi->sb);
+--
+2.39.2
+
--- /dev/null
+From 272d03e0120bdf54da398c97c05b2d68260bd9c2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Apr 2023 00:47:11 +0800
+Subject: f2fs: do not allow to defragment files have FI_COMPRESS_RELEASED
+
+From: Yangtao Li <frank.li@vivo.com>
+
+[ Upstream commit 7cd2e5f75b86a1befa99834f3ed1d735eeff69e6 ]
+
+If a file has FI_COMPRESS_RELEASED, all writes for it should not be
+allowed.
+
+Fixes: 5fdb322ff2c2 ("f2fs: add F2FS_IOC_DECOMPRESS_FILE and F2FS_IOC_COMPRESS_FILE")
+Signed-off-by: Qi Han <hanqi@vivo.com>
+Signed-off-by: Yangtao Li <frank.li@vivo.com>
+Reviewed-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/file.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index 5ac53d2627d20..fa50c6475876c 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -2593,6 +2593,11 @@ static int f2fs_defragment_range(struct f2fs_sb_info *sbi,
+
+ inode_lock(inode);
+
++ if (is_inode_flag_set(inode, FI_COMPRESS_RELEASED)) {
++ err = -EINVAL;
++ goto unlock_out;
++ }
++
+ /* if in-place-update policy is enabled, don't waste time here */
+ set_inode_flag(inode, FI_OPU_WRITE);
+ if (f2fs_should_update_inplace(inode, NULL)) {
+@@ -2717,6 +2722,7 @@ static int f2fs_defragment_range(struct f2fs_sb_info *sbi,
+ clear_inode_flag(inode, FI_SKIP_WRITES);
+ out:
+ clear_inode_flag(inode, FI_OPU_WRITE);
++unlock_out:
+ inode_unlock(inode);
+ if (!err)
+ range->len = (u64)total << PAGE_SHIFT;
+--
+2.39.2
+
--- /dev/null
+From e8a08a15af706bbcb27b980df2f01160c286127e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Jun 2023 09:41:02 +0800
+Subject: f2fs: fix error path handling in truncate_dnode()
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit 0135c482fa97e2fd8245cb462784112a00ed1211 ]
+
+If truncate_node() fails in truncate_dnode(), it missed to call
+f2fs_put_page(), fix it.
+
+Fixes: 7735730d39d7 ("f2fs: fix to propagate error from __get_meta_page()")
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/node.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c
+index 834c6f099c955..6bdb1bed29ec9 100644
+--- a/fs/f2fs/node.c
++++ b/fs/f2fs/node.c
+@@ -943,8 +943,10 @@ static int truncate_dnode(struct dnode_of_data *dn)
+ dn->ofs_in_node = 0;
+ f2fs_truncate_data_blocks(dn);
+ err = truncate_node(dn);
+- if (err)
++ if (err) {
++ f2fs_put_page(page, 1);
+ return err;
++ }
+
+ return 1;
+ }
+--
+2.39.2
+
--- /dev/null
+From 1310968da51b80e1b2c19b06072a1d46e5db8449 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 14 May 2023 16:07:23 +0800
+Subject: f2fs: fix potential deadlock due to unpaired node_write lock use
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit f082c6b205a06953f26c40bdc7621cc5a58ceb7c ]
+
+If S_NOQUOTA is cleared from inode during data page writeback of quota
+file, it may miss to unlock node_write lock, result in potential
+deadlock, fix to use the lock in paired.
+
+Kworker Thread
+- writepage
+ if (IS_NOQUOTA())
+ f2fs_down_read(&sbi->node_write);
+ - vfs_cleanup_quota_inode
+ - inode->i_flags &= ~S_NOQUOTA;
+ if (IS_NOQUOTA())
+ f2fs_up_read(&sbi->node_write);
+
+Fixes: 79963d967b49 ("f2fs: shrink node_write lock coverage")
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/compress.c | 7 ++++---
+ fs/f2fs/data.c | 7 ++++---
+ 2 files changed, 8 insertions(+), 6 deletions(-)
+
+diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c
+index 11653fa792897..2ec7cf4544180 100644
+--- a/fs/f2fs/compress.c
++++ b/fs/f2fs/compress.c
+@@ -1215,6 +1215,7 @@ static int f2fs_write_compressed_pages(struct compress_ctx *cc,
+ unsigned int last_index = cc->cluster_size - 1;
+ loff_t psize;
+ int i, err;
++ bool quota_inode = IS_NOQUOTA(inode);
+
+ /* we should bypass data pages to proceed the kworker jobs */
+ if (unlikely(f2fs_cp_error(sbi))) {
+@@ -1222,7 +1223,7 @@ static int f2fs_write_compressed_pages(struct compress_ctx *cc,
+ goto out_free;
+ }
+
+- if (IS_NOQUOTA(inode)) {
++ if (quota_inode) {
+ /*
+ * We need to wait for node_write to avoid block allocation during
+ * checkpoint. This can only happen to quota writes which can cause
+@@ -1344,7 +1345,7 @@ static int f2fs_write_compressed_pages(struct compress_ctx *cc,
+ set_inode_flag(inode, FI_FIRST_BLOCK_WRITTEN);
+
+ f2fs_put_dnode(&dn);
+- if (IS_NOQUOTA(inode))
++ if (quota_inode)
+ f2fs_up_read(&sbi->node_write);
+ else
+ f2fs_unlock_op(sbi);
+@@ -1370,7 +1371,7 @@ static int f2fs_write_compressed_pages(struct compress_ctx *cc,
+ out_put_dnode:
+ f2fs_put_dnode(&dn);
+ out_unlock_op:
+- if (IS_NOQUOTA(inode))
++ if (quota_inode)
+ f2fs_up_read(&sbi->node_write);
+ else
+ f2fs_unlock_op(sbi);
+diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
+index 7165b1202f539..4a0ee9cc43b5d 100644
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -2775,6 +2775,7 @@ int f2fs_write_single_data_page(struct page *page, int *submitted,
+ loff_t psize = (loff_t)(page->index + 1) << PAGE_SHIFT;
+ unsigned offset = 0;
+ bool need_balance_fs = false;
++ bool quota_inode = IS_NOQUOTA(inode);
+ int err = 0;
+ struct f2fs_io_info fio = {
+ .sbi = sbi,
+@@ -2832,19 +2833,19 @@ int f2fs_write_single_data_page(struct page *page, int *submitted,
+ goto out;
+
+ /* Dentry/quota blocks are controlled by checkpoint */
+- if (S_ISDIR(inode->i_mode) || IS_NOQUOTA(inode)) {
++ if (S_ISDIR(inode->i_mode) || quota_inode) {
+ /*
+ * We need to wait for node_write to avoid block allocation during
+ * checkpoint. This can only happen to quota writes which can cause
+ * the below discard race condition.
+ */
+- if (IS_NOQUOTA(inode))
++ if (quota_inode)
+ f2fs_down_read(&sbi->node_write);
+
+ fio.need_lock = LOCK_DONE;
+ err = f2fs_do_write_data_page(&fio);
+
+- if (IS_NOQUOTA(inode))
++ if (quota_inode)
+ f2fs_up_read(&sbi->node_write);
+
+ goto done;
+--
+2.39.2
+
--- /dev/null
+From 8799b689755abe7b50d67957253528e021c5ce52 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 May 2023 12:16:54 -0700
+Subject: f2fs: fix the wrong condition to determine atomic context
+
+From: Jaegeuk Kim <jaegeuk@kernel.org>
+
+[ Upstream commit 633c8b9409f564ce4b7f7944c595ffac27ed1ff4 ]
+
+Should use !in_task for irq context.
+
+Cc: stable@vger.kernel.org
+Fixes: 1aa161e43106 ("f2fs: fix scheduling while atomic in decompression path")
+Reviewed-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Stable-dep-of: 901c12d14457 ("f2fs: flush error flags in workqueue")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/compress.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c
+index 2ec7cf4544180..905b7c39a2b32 100644
+--- a/fs/f2fs/compress.c
++++ b/fs/f2fs/compress.c
+@@ -743,7 +743,7 @@ void f2fs_decompress_cluster(struct decompress_io_ctx *dic, bool in_task)
+ ret = -EFSCORRUPTED;
+
+ /* Avoid f2fs_commit_super in irq context */
+- if (in_task)
++ if (!in_task)
+ f2fs_save_errors(sbi, ERROR_FAIL_DECOMPRESSION);
+ else
+ f2fs_handle_error(sbi, ERROR_FAIL_DECOMPRESSION);
+--
+2.39.2
+
--- /dev/null
+From 2445331de0d07db1302cb4b3e8c08285d33b24b7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 May 2023 14:17:25 +0800
+Subject: f2fs: fix to avoid NULL pointer dereference f2fs_write_end_io()
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit d8189834d4348ae608083e1f1f53792cfcc2a9bc ]
+
+butt3rflyh4ck reports a bug as below:
+
+When a thread always calls F2FS_IOC_RESIZE_FS to resize fs, if resize fs is
+failed, f2fs kernel thread would invoke callback function to update f2fs io
+info, it would call f2fs_write_end_io and may trigger null-ptr-deref in
+NODE_MAPPING.
+
+general protection fault, probably for non-canonical address
+KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]
+RIP: 0010:NODE_MAPPING fs/f2fs/f2fs.h:1972 [inline]
+RIP: 0010:f2fs_write_end_io+0x727/0x1050 fs/f2fs/data.c:370
+ <TASK>
+ bio_endio+0x5af/0x6c0 block/bio.c:1608
+ req_bio_endio block/blk-mq.c:761 [inline]
+ blk_update_request+0x5cc/0x1690 block/blk-mq.c:906
+ blk_mq_end_request+0x59/0x4c0 block/blk-mq.c:1023
+ lo_complete_rq+0x1c6/0x280 drivers/block/loop.c:370
+ blk_complete_reqs+0xad/0xe0 block/blk-mq.c:1101
+ __do_softirq+0x1d4/0x8ef kernel/softirq.c:571
+ run_ksoftirqd kernel/softirq.c:939 [inline]
+ run_ksoftirqd+0x31/0x60 kernel/softirq.c:931
+ smpboot_thread_fn+0x659/0x9e0 kernel/smpboot.c:164
+ kthread+0x33e/0x440 kernel/kthread.c:379
+ ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
+
+The root cause is below race case can cause leaving dirty metadata
+in f2fs after filesystem is remount as ro:
+
+Thread A Thread B
+- f2fs_ioc_resize_fs
+ - f2fs_readonly --- return false
+ - f2fs_resize_fs
+ - f2fs_remount
+ - write_checkpoint
+ - set f2fs as ro
+ - free_segment_range
+ - update meta_inode's data
+
+Then, if f2fs_put_super() fails to write_checkpoint due to readonly
+status, and meta_inode's dirty data will be writebacked after node_inode
+is put, finally, f2fs_write_end_io will access NULL pointer on
+sbi->node_inode.
+
+Thread A IRQ context
+- f2fs_put_super
+ - write_checkpoint fails
+ - iput(node_inode)
+ - node_inode = NULL
+ - iput(meta_inode)
+ - write_inode_now
+ - f2fs_write_meta_page
+ - f2fs_write_end_io
+ - NODE_MAPPING(sbi)
+ : access NULL pointer on node_inode
+
+Fixes: b4b10061ef98 ("f2fs: refactor resize_fs to avoid meta updates in progress")
+Reported-by: butt3rflyh4ck <butterflyhuangxx@gmail.com>
+Closes: https://lore.kernel.org/r/1684480657-2375-1-git-send-email-yangtiezhu@loongson.cn
+Tested-by: butt3rflyh4ck <butterflyhuangxx@gmail.com>
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/f2fs.h | 2 +-
+ fs/f2fs/file.c | 2 +-
+ fs/f2fs/gc.c | 21 ++++++++++++++++++---
+ 3 files changed, 20 insertions(+), 5 deletions(-)
+
+diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
+index d211ee89c1586..25999ed2c4258 100644
+--- a/fs/f2fs/f2fs.h
++++ b/fs/f2fs/f2fs.h
+@@ -3815,7 +3815,7 @@ void f2fs_stop_gc_thread(struct f2fs_sb_info *sbi);
+ block_t f2fs_start_bidx_of_node(unsigned int node_ofs, struct inode *inode);
+ int f2fs_gc(struct f2fs_sb_info *sbi, struct f2fs_gc_control *gc_control);
+ void f2fs_build_gc_manager(struct f2fs_sb_info *sbi);
+-int f2fs_resize_fs(struct f2fs_sb_info *sbi, __u64 block_count);
++int f2fs_resize_fs(struct file *filp, __u64 block_count);
+ int __init f2fs_create_garbage_collection_cache(void);
+ void f2fs_destroy_garbage_collection_cache(void);
+ /* victim selection function for cleaning and SSR */
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index fa50c6475876c..7482af51ab408 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -3284,7 +3284,7 @@ static int f2fs_ioc_resize_fs(struct file *filp, unsigned long arg)
+ sizeof(block_count)))
+ return -EFAULT;
+
+- return f2fs_resize_fs(sbi, block_count);
++ return f2fs_resize_fs(filp, block_count);
+ }
+
+ static int f2fs_ioc_enable_verity(struct file *filp, unsigned long arg)
+diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c
+index 61c5f9d26018e..48cb4700ba3f5 100644
+--- a/fs/f2fs/gc.c
++++ b/fs/f2fs/gc.c
+@@ -2099,8 +2099,9 @@ static void update_fs_metadata(struct f2fs_sb_info *sbi, int secs)
+ }
+ }
+
+-int f2fs_resize_fs(struct f2fs_sb_info *sbi, __u64 block_count)
++int f2fs_resize_fs(struct file *filp, __u64 block_count)
+ {
++ struct f2fs_sb_info *sbi = F2FS_I_SB(file_inode(filp));
+ __u64 old_block_count, shrunk_blocks;
+ struct cp_control cpc = { CP_RESIZE, 0, 0, 0 };
+ unsigned int secs;
+@@ -2138,12 +2139,18 @@ int f2fs_resize_fs(struct f2fs_sb_info *sbi, __u64 block_count)
+ return -EINVAL;
+ }
+
++ err = mnt_want_write_file(filp);
++ if (err)
++ return err;
++
+ shrunk_blocks = old_block_count - block_count;
+ secs = div_u64(shrunk_blocks, BLKS_PER_SEC(sbi));
+
+ /* stop other GC */
+- if (!f2fs_down_write_trylock(&sbi->gc_lock))
+- return -EAGAIN;
++ if (!f2fs_down_write_trylock(&sbi->gc_lock)) {
++ err = -EAGAIN;
++ goto out_drop_write;
++ }
+
+ /* stop CP to protect MAIN_SEC in free_segment_range */
+ f2fs_lock_op(sbi);
+@@ -2163,10 +2170,18 @@ int f2fs_resize_fs(struct f2fs_sb_info *sbi, __u64 block_count)
+ out_unlock:
+ f2fs_unlock_op(sbi);
+ f2fs_up_write(&sbi->gc_lock);
++out_drop_write:
++ mnt_drop_write_file(filp);
+ if (err)
+ return err;
+
+ freeze_super(sbi->sb);
++
++ if (f2fs_readonly(sbi->sb)) {
++ thaw_super(sbi->sb);
++ return -EROFS;
++ }
++
+ f2fs_down_write(&sbi->gc_lock);
+ f2fs_down_write(&sbi->cp_global_sem);
+
+--
+2.39.2
+
--- /dev/null
+From 035e390ae87a76513a9f15eb3a72e30a0f11ca8f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 May 2023 10:14:12 +0800
+Subject: f2fs: flush error flags in workqueue
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit 901c12d144570ed2558f4a6806201453c5b01bea ]
+
+In IRQ context, it wakes up workqueue to record errors into on-disk
+superblock fields rather than in-memory fields.
+
+Fixes: 1aa161e43106 ("f2fs: fix scheduling while atomic in decompression path")
+Fixes: 95fa90c9e5a7 ("f2fs: support recording errors into superblock")
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/compress.c | 2 +-
+ fs/f2fs/f2fs.h | 1 +
+ fs/f2fs/super.c | 26 +++++++++++++++++++++++---
+ 3 files changed, 25 insertions(+), 4 deletions(-)
+
+diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c
+index 905b7c39a2b32..1132d3cd8f337 100644
+--- a/fs/f2fs/compress.c
++++ b/fs/f2fs/compress.c
+@@ -744,7 +744,7 @@ void f2fs_decompress_cluster(struct decompress_io_ctx *dic, bool in_task)
+
+ /* Avoid f2fs_commit_super in irq context */
+ if (!in_task)
+- f2fs_save_errors(sbi, ERROR_FAIL_DECOMPRESSION);
++ f2fs_handle_error_async(sbi, ERROR_FAIL_DECOMPRESSION);
+ else
+ f2fs_handle_error(sbi, ERROR_FAIL_DECOMPRESSION);
+ goto out_release;
+diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
+index 35a025d7e305b..d867056a01f65 100644
+--- a/fs/f2fs/f2fs.h
++++ b/fs/f2fs/f2fs.h
+@@ -3558,6 +3558,7 @@ void f2fs_save_errors(struct f2fs_sb_info *sbi, unsigned char flag);
+ void f2fs_handle_critical_error(struct f2fs_sb_info *sbi, unsigned char reason,
+ bool irq_context);
+ void f2fs_handle_error(struct f2fs_sb_info *sbi, unsigned char error);
++void f2fs_handle_error_async(struct f2fs_sb_info *sbi, unsigned char error);
+ int f2fs_commit_super(struct f2fs_sb_info *sbi, bool recover);
+ int f2fs_sync_fs(struct super_block *sb, int sync);
+ int f2fs_sanity_check_ckpt(struct f2fs_sb_info *sbi);
+diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
+index 51812f4595813..17082dc3c1a34 100644
+--- a/fs/f2fs/super.c
++++ b/fs/f2fs/super.c
+@@ -3980,6 +3980,11 @@ static void f2fs_record_stop_reason(struct f2fs_sb_info *sbi)
+ f2fs_down_write(&sbi->sb_lock);
+
+ spin_lock_irqsave(&sbi->error_lock, flags);
++ if (sbi->error_dirty) {
++ memcpy(F2FS_RAW_SUPER(sbi)->s_errors, sbi->errors,
++ MAX_F2FS_ERRORS);
++ sbi->error_dirty = false;
++ }
+ memcpy(raw_super->s_stop_reason, sbi->stop_reason, MAX_STOP_REASON);
+ spin_unlock_irqrestore(&sbi->error_lock, flags);
+
+@@ -4019,12 +4024,10 @@ static bool f2fs_update_errors(struct f2fs_sb_info *sbi)
+ return need_update;
+ }
+
+-void f2fs_handle_error(struct f2fs_sb_info *sbi, unsigned char error)
++static void f2fs_record_errors(struct f2fs_sb_info *sbi, unsigned char error)
+ {
+ int err;
+
+- f2fs_save_errors(sbi, error);
+-
+ f2fs_down_write(&sbi->sb_lock);
+
+ if (!f2fs_update_errors(sbi))
+@@ -4038,6 +4041,23 @@ void f2fs_handle_error(struct f2fs_sb_info *sbi, unsigned char error)
+ f2fs_up_write(&sbi->sb_lock);
+ }
+
++void f2fs_handle_error(struct f2fs_sb_info *sbi, unsigned char error)
++{
++ f2fs_save_errors(sbi, error);
++ f2fs_record_errors(sbi, error);
++}
++
++void f2fs_handle_error_async(struct f2fs_sb_info *sbi, unsigned char error)
++{
++ f2fs_save_errors(sbi, error);
++
++ if (!sbi->error_dirty)
++ return;
++ if (!test_bit(error, (unsigned long *)sbi->errors))
++ return;
++ schedule_work(&sbi->s_error_work);
++}
++
+ static bool system_going_down(void)
+ {
+ return system_state == SYSTEM_HALT || system_state == SYSTEM_POWER_OFF
+--
+2.39.2
+
--- /dev/null
+From 261d982d265e5f2c3062cfcb77558a664662da81 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 23 Apr 2023 23:49:15 +0800
+Subject: f2fs: support errors=remount-ro|continue|panic mountoption
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit b62e71be2110d8b52bf5faf3c3ed7ca1a0c113a5 ]
+
+This patch supports errors=remount-ro|continue|panic mount option
+for f2fs.
+
+f2fs behaves as below in three different modes:
+mode continue remount-ro panic
+access ops normal noraml N/A
+syscall errors -EIO -EROFS N/A
+mount option rw ro N/A
+pending dir write keep keep N/A
+pending non-dir write drop keep N/A
+pending node write drop keep N/A
+pending meta write keep keep N/A
+
+By default it uses "continue" mode.
+
+[Yangtao helps to clean up function's name]
+Signed-off-by: Yangtao Li <frank.li@vivo.com>
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Stable-dep-of: 901c12d14457 ("f2fs: flush error flags in workqueue")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/filesystems/f2fs.rst | 16 ++++
+ fs/f2fs/checkpoint.c | 7 +-
+ fs/f2fs/data.c | 4 +
+ fs/f2fs/f2fs.h | 20 ++++-
+ fs/f2fs/file.c | 5 --
+ fs/f2fs/gc.c | 2 +-
+ fs/f2fs/node.c | 3 +
+ fs/f2fs/super.c | 134 ++++++++++++++++++++++++++---
+ 8 files changed, 167 insertions(+), 24 deletions(-)
+
+diff --git a/Documentation/filesystems/f2fs.rst b/Documentation/filesystems/f2fs.rst
+index c57745375edbc..9359978a5af26 100644
+--- a/Documentation/filesystems/f2fs.rst
++++ b/Documentation/filesystems/f2fs.rst
+@@ -351,6 +351,22 @@ age_extent_cache Enable an age extent cache based on rb-tree. It records
+ data block update frequency of the extent per inode, in
+ order to provide better temperature hints for data block
+ allocation.
++errors=%s Specify f2fs behavior on critical errors. This supports modes:
++ "panic", "continue" and "remount-ro", respectively, trigger
++ panic immediately, continue without doing anything, and remount
++ the partition in read-only mode. By default it uses "continue"
++ mode.
++ ====================== =============== =============== ========
++ mode continue remount-ro panic
++ ====================== =============== =============== ========
++ access ops normal noraml N/A
++ syscall errors -EIO -EROFS N/A
++ mount option rw ro N/A
++ pending dir write keep keep N/A
++ pending non-dir write drop keep N/A
++ pending node write drop keep N/A
++ pending meta write keep keep N/A
++ ====================== =============== =============== ========
+ ======================== ============================================================
+
+ Debugfs Entries
+diff --git a/fs/f2fs/checkpoint.c b/fs/f2fs/checkpoint.c
+index 64b3860f50ee5..8fd3b7f9fb88e 100644
+--- a/fs/f2fs/checkpoint.c
++++ b/fs/f2fs/checkpoint.c
+@@ -30,12 +30,9 @@ void f2fs_stop_checkpoint(struct f2fs_sb_info *sbi, bool end_io,
+ unsigned char reason)
+ {
+ f2fs_build_fault_attr(sbi, 0, 0);
+- set_ckpt_flags(sbi, CP_ERROR_FLAG);
+- if (!end_io) {
++ if (!end_io)
+ f2fs_flush_merged_writes(sbi);
+-
+- f2fs_handle_stop(sbi, reason);
+- }
++ f2fs_handle_critical_error(sbi, reason, end_io);
+ }
+
+ /*
+diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
+index 4a0ee9cc43b5d..15b6dc2e06410 100644
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -2808,6 +2808,10 @@ int f2fs_write_single_data_page(struct page *page, int *submitted,
+ if (S_ISDIR(inode->i_mode) &&
+ !is_sbi_flag_set(sbi, SBI_IS_CLOSE))
+ goto redirty_out;
++
++ /* keep data pages in remount-ro mode */
++ if (F2FS_OPTION(sbi).errors == MOUNT_ERRORS_READONLY)
++ goto redirty_out;
+ goto out;
+ }
+
+diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
+index 25999ed2c4258..35a025d7e305b 100644
+--- a/fs/f2fs/f2fs.h
++++ b/fs/f2fs/f2fs.h
+@@ -162,6 +162,7 @@ struct f2fs_mount_info {
+ int fs_mode; /* fs mode: LFS or ADAPTIVE */
+ int bggc_mode; /* bggc mode: off, on or sync */
+ int memory_mode; /* memory mode */
++ int errors; /* errors parameter */
+ int discard_unit; /*
+ * discard command's offset/size should
+ * be aligned to this unit: block,
+@@ -1370,6 +1371,12 @@ enum {
+ MEMORY_MODE_LOW, /* memory mode for low memry devices */
+ };
+
++enum errors_option {
++ MOUNT_ERRORS_READONLY, /* remount fs ro on errors */
++ MOUNT_ERRORS_CONTINUE, /* continue on errors */
++ MOUNT_ERRORS_PANIC, /* panic on errors */
++};
++
+ static inline int f2fs_test_bit(unsigned int nr, char *addr);
+ static inline void f2fs_set_bit(unsigned int nr, char *addr);
+ static inline void f2fs_clear_bit(unsigned int nr, char *addr);
+@@ -1721,8 +1728,14 @@ struct f2fs_sb_info {
+
+ struct workqueue_struct *post_read_wq; /* post read workqueue */
+
+- unsigned char errors[MAX_F2FS_ERRORS]; /* error flags */
+- spinlock_t error_lock; /* protect errors array */
++ /*
++ * If we are in irq context, let's update error information into
++ * on-disk superblock in the work.
++ */
++ struct work_struct s_error_work;
++ unsigned char errors[MAX_F2FS_ERRORS]; /* error flags */
++ unsigned char stop_reason[MAX_STOP_REASON]; /* stop reason */
++ spinlock_t error_lock; /* protect errors/stop_reason array */
+ bool error_dirty; /* errors of sb is dirty */
+
+ struct kmem_cache *inline_xattr_slab; /* inline xattr entry */
+@@ -3541,8 +3554,9 @@ int f2fs_enable_quota_files(struct f2fs_sb_info *sbi, bool rdonly);
+ int f2fs_quota_sync(struct super_block *sb, int type);
+ loff_t max_file_blocks(struct inode *inode);
+ void f2fs_quota_off_umount(struct super_block *sb);
+-void f2fs_handle_stop(struct f2fs_sb_info *sbi, unsigned char reason);
+ void f2fs_save_errors(struct f2fs_sb_info *sbi, unsigned char flag);
++void f2fs_handle_critical_error(struct f2fs_sb_info *sbi, unsigned char reason,
++ bool irq_context);
+ void f2fs_handle_error(struct f2fs_sb_info *sbi, unsigned char error);
+ int f2fs_commit_super(struct f2fs_sb_info *sbi, bool recover);
+ int f2fs_sync_fs(struct super_block *sb, int sync);
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index 7482af51ab408..015ed274dc312 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -2225,7 +2225,6 @@ static int f2fs_ioc_shutdown(struct file *filp, unsigned long arg)
+ ret = 0;
+ f2fs_stop_checkpoint(sbi, false,
+ STOP_CP_REASON_SHUTDOWN);
+- set_sbi_flag(sbi, SBI_IS_SHUTDOWN);
+ trace_f2fs_shutdown(sbi, in, ret);
+ }
+ return ret;
+@@ -2238,7 +2237,6 @@ static int f2fs_ioc_shutdown(struct file *filp, unsigned long arg)
+ if (ret)
+ goto out;
+ f2fs_stop_checkpoint(sbi, false, STOP_CP_REASON_SHUTDOWN);
+- set_sbi_flag(sbi, SBI_IS_SHUTDOWN);
+ thaw_bdev(sb->s_bdev);
+ break;
+ case F2FS_GOING_DOWN_METASYNC:
+@@ -2247,16 +2245,13 @@ static int f2fs_ioc_shutdown(struct file *filp, unsigned long arg)
+ if (ret)
+ goto out;
+ f2fs_stop_checkpoint(sbi, false, STOP_CP_REASON_SHUTDOWN);
+- set_sbi_flag(sbi, SBI_IS_SHUTDOWN);
+ break;
+ case F2FS_GOING_DOWN_NOSYNC:
+ f2fs_stop_checkpoint(sbi, false, STOP_CP_REASON_SHUTDOWN);
+- set_sbi_flag(sbi, SBI_IS_SHUTDOWN);
+ break;
+ case F2FS_GOING_DOWN_METAFLUSH:
+ f2fs_sync_meta_pages(sbi, META, LONG_MAX, FS_META_IO);
+ f2fs_stop_checkpoint(sbi, false, STOP_CP_REASON_SHUTDOWN);
+- set_sbi_flag(sbi, SBI_IS_SHUTDOWN);
+ break;
+ case F2FS_GOING_DOWN_NEED_FSCK:
+ set_sbi_flag(sbi, SBI_NEED_FSCK);
+diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c
+index 48cb4700ba3f5..67f1b58d424ed 100644
+--- a/fs/f2fs/gc.c
++++ b/fs/f2fs/gc.c
+@@ -59,7 +59,7 @@ static int gc_thread_func(void *data)
+ if (gc_th->gc_wake)
+ gc_th->gc_wake = false;
+
+- if (try_to_freeze()) {
++ if (try_to_freeze() || f2fs_readonly(sbi->sb)) {
+ stat_other_skip_bggc_count(sbi);
+ continue;
+ }
+diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c
+index bd1dad5237967..834c6f099c955 100644
+--- a/fs/f2fs/node.c
++++ b/fs/f2fs/node.c
+@@ -1596,6 +1596,9 @@ static int __write_node_page(struct page *page, bool atomic, bool *submitted,
+ trace_f2fs_writepage(page, NODE);
+
+ if (unlikely(f2fs_cp_error(sbi))) {
++ /* keep node pages in remount-ro mode */
++ if (F2FS_OPTION(sbi).errors == MOUNT_ERRORS_READONLY)
++ goto redirty_out;
+ ClearPageUptodate(page);
+ dec_page_count(sbi, F2FS_DIRTY_NODES);
+ unlock_page(page);
+diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
+index 9f15b03037dba..51812f4595813 100644
+--- a/fs/f2fs/super.c
++++ b/fs/f2fs/super.c
+@@ -164,6 +164,7 @@ enum {
+ Opt_discard_unit,
+ Opt_memory_mode,
+ Opt_age_extent_cache,
++ Opt_errors,
+ Opt_err,
+ };
+
+@@ -243,6 +244,7 @@ static match_table_t f2fs_tokens = {
+ {Opt_discard_unit, "discard_unit=%s"},
+ {Opt_memory_mode, "memory=%s"},
+ {Opt_age_extent_cache, "age_extent_cache"},
++ {Opt_errors, "errors=%s"},
+ {Opt_err, NULL},
+ };
+
+@@ -1268,6 +1270,25 @@ static int parse_options(struct super_block *sb, char *options, bool is_remount)
+ case Opt_age_extent_cache:
+ set_opt(sbi, AGE_EXTENT_CACHE);
+ break;
++ case Opt_errors:
++ name = match_strdup(&args[0]);
++ if (!name)
++ return -ENOMEM;
++ if (!strcmp(name, "remount-ro")) {
++ F2FS_OPTION(sbi).errors =
++ MOUNT_ERRORS_READONLY;
++ } else if (!strcmp(name, "continue")) {
++ F2FS_OPTION(sbi).errors =
++ MOUNT_ERRORS_CONTINUE;
++ } else if (!strcmp(name, "panic")) {
++ F2FS_OPTION(sbi).errors =
++ MOUNT_ERRORS_PANIC;
++ } else {
++ kfree(name);
++ return -EINVAL;
++ }
++ kfree(name);
++ break;
+ default:
+ f2fs_err(sbi, "Unrecognized mount option \"%s\" or missing value",
+ p);
+@@ -1622,6 +1643,9 @@ static void f2fs_put_super(struct super_block *sb)
+ f2fs_destroy_node_manager(sbi);
+ f2fs_destroy_segment_manager(sbi);
+
++ /* flush s_error_work before sbi destroy */
++ flush_work(&sbi->s_error_work);
++
+ f2fs_destroy_post_read_wq(sbi);
+
+ kvfree(sbi->ckpt);
+@@ -2052,6 +2076,13 @@ static int f2fs_show_options(struct seq_file *seq, struct dentry *root)
+ else if (F2FS_OPTION(sbi).memory_mode == MEMORY_MODE_LOW)
+ seq_printf(seq, ",memory=%s", "low");
+
++ if (F2FS_OPTION(sbi).errors == MOUNT_ERRORS_READONLY)
++ seq_printf(seq, ",errors=%s", "remount-ro");
++ else if (F2FS_OPTION(sbi).errors == MOUNT_ERRORS_CONTINUE)
++ seq_printf(seq, ",errors=%s", "continue");
++ else if (F2FS_OPTION(sbi).errors == MOUNT_ERRORS_PANIC)
++ seq_printf(seq, ",errors=%s", "panic");
++
+ return 0;
+ }
+
+@@ -2080,6 +2111,7 @@ static void default_options(struct f2fs_sb_info *sbi)
+ }
+ F2FS_OPTION(sbi).bggc_mode = BGGC_MODE_ON;
+ F2FS_OPTION(sbi).memory_mode = MEMORY_MODE_NORMAL;
++ F2FS_OPTION(sbi).errors = MOUNT_ERRORS_CONTINUE;
+
+ sbi->sb->s_flags &= ~SB_INLINECRYPT;
+
+@@ -2281,6 +2313,9 @@ static int f2fs_remount(struct super_block *sb, int *flags, char *data)
+ if (err)
+ goto restore_opts;
+
++ /* flush outstanding errors before changing fs state */
++ flush_work(&sbi->s_error_work);
++
+ /*
+ * Previous and new state of filesystem is RO,
+ * so skip checking GC and FLUSH_MERGE conditions.
+@@ -3926,45 +3961,60 @@ int f2fs_commit_super(struct f2fs_sb_info *sbi, bool recover)
+ return err;
+ }
+
+-void f2fs_handle_stop(struct f2fs_sb_info *sbi, unsigned char reason)
++static void save_stop_reason(struct f2fs_sb_info *sbi, unsigned char reason)
++{
++ unsigned long flags;
++
++ spin_lock_irqsave(&sbi->error_lock, flags);
++ if (sbi->stop_reason[reason] < GENMASK(BITS_PER_BYTE - 1, 0))
++ sbi->stop_reason[reason]++;
++ spin_unlock_irqrestore(&sbi->error_lock, flags);
++}
++
++static void f2fs_record_stop_reason(struct f2fs_sb_info *sbi)
+ {
+ struct f2fs_super_block *raw_super = F2FS_RAW_SUPER(sbi);
++ unsigned long flags;
+ int err;
+
+ f2fs_down_write(&sbi->sb_lock);
+
+- if (raw_super->s_stop_reason[reason] < GENMASK(BITS_PER_BYTE - 1, 0))
+- raw_super->s_stop_reason[reason]++;
++ spin_lock_irqsave(&sbi->error_lock, flags);
++ memcpy(raw_super->s_stop_reason, sbi->stop_reason, MAX_STOP_REASON);
++ spin_unlock_irqrestore(&sbi->error_lock, flags);
+
+ err = f2fs_commit_super(sbi, false);
+- if (err)
+- f2fs_err(sbi, "f2fs_commit_super fails to record reason:%u err:%d",
+- reason, err);
++
+ f2fs_up_write(&sbi->sb_lock);
++ if (err)
++ f2fs_err(sbi, "f2fs_commit_super fails to record err:%d", err);
+ }
+
+ void f2fs_save_errors(struct f2fs_sb_info *sbi, unsigned char flag)
+ {
+- spin_lock(&sbi->error_lock);
++ unsigned long flags;
++
++ spin_lock_irqsave(&sbi->error_lock, flags);
+ if (!test_bit(flag, (unsigned long *)sbi->errors)) {
+ set_bit(flag, (unsigned long *)sbi->errors);
+ sbi->error_dirty = true;
+ }
+- spin_unlock(&sbi->error_lock);
++ spin_unlock_irqrestore(&sbi->error_lock, flags);
+ }
+
+ static bool f2fs_update_errors(struct f2fs_sb_info *sbi)
+ {
++ unsigned long flags;
+ bool need_update = false;
+
+- spin_lock(&sbi->error_lock);
++ spin_lock_irqsave(&sbi->error_lock, flags);
+ if (sbi->error_dirty) {
+ memcpy(F2FS_RAW_SUPER(sbi)->s_errors, sbi->errors,
+ MAX_F2FS_ERRORS);
+ sbi->error_dirty = false;
+ need_update = true;
+ }
+- spin_unlock(&sbi->error_lock);
++ spin_unlock_irqrestore(&sbi->error_lock, flags);
+
+ return need_update;
+ }
+@@ -3988,6 +4038,66 @@ void f2fs_handle_error(struct f2fs_sb_info *sbi, unsigned char error)
+ f2fs_up_write(&sbi->sb_lock);
+ }
+
++static bool system_going_down(void)
++{
++ return system_state == SYSTEM_HALT || system_state == SYSTEM_POWER_OFF
++ || system_state == SYSTEM_RESTART;
++}
++
++void f2fs_handle_critical_error(struct f2fs_sb_info *sbi, unsigned char reason,
++ bool irq_context)
++{
++ struct super_block *sb = sbi->sb;
++ bool shutdown = reason == STOP_CP_REASON_SHUTDOWN;
++ bool continue_fs = !shutdown &&
++ F2FS_OPTION(sbi).errors == MOUNT_ERRORS_CONTINUE;
++
++ set_ckpt_flags(sbi, CP_ERROR_FLAG);
++
++ if (!f2fs_hw_is_readonly(sbi)) {
++ save_stop_reason(sbi, reason);
++
++ if (irq_context && !shutdown)
++ schedule_work(&sbi->s_error_work);
++ else
++ f2fs_record_stop_reason(sbi);
++ }
++
++ /*
++ * We force ERRORS_RO behavior when system is rebooting. Otherwise we
++ * could panic during 'reboot -f' as the underlying device got already
++ * disabled.
++ */
++ if (F2FS_OPTION(sbi).errors == MOUNT_ERRORS_PANIC &&
++ !shutdown && !system_going_down() &&
++ !is_sbi_flag_set(sbi, SBI_IS_SHUTDOWN))
++ panic("F2FS-fs (device %s): panic forced after error\n",
++ sb->s_id);
++
++ if (shutdown)
++ set_sbi_flag(sbi, SBI_IS_SHUTDOWN);
++
++ /* continue filesystem operators if errors=continue */
++ if (continue_fs || f2fs_readonly(sb))
++ return;
++
++ f2fs_warn(sbi, "Remounting filesystem read-only");
++ /*
++ * Make sure updated value of ->s_mount_flags will be visible before
++ * ->s_flags update
++ */
++ smp_wmb();
++ sb->s_flags |= SB_RDONLY;
++}
++
++static void f2fs_record_error_work(struct work_struct *work)
++{
++ struct f2fs_sb_info *sbi = container_of(work,
++ struct f2fs_sb_info, s_error_work);
++
++ f2fs_record_stop_reason(sbi);
++}
++
+ static int f2fs_scan_devices(struct f2fs_sb_info *sbi)
+ {
+ struct f2fs_super_block *raw_super = F2FS_RAW_SUPER(sbi);
+@@ -4218,7 +4328,9 @@ static int f2fs_fill_super(struct super_block *sb, void *data, int silent)
+ sb->s_fs_info = sbi;
+ sbi->raw_super = raw_super;
+
++ INIT_WORK(&sbi->s_error_work, f2fs_record_error_work);
+ memcpy(sbi->errors, raw_super->s_errors, MAX_F2FS_ERRORS);
++ memcpy(sbi->stop_reason, raw_super->s_stop_reason, MAX_STOP_REASON);
+
+ /* precompute checksum seed for metadata */
+ if (f2fs_sb_has_inode_chksum(sbi))
+@@ -4615,6 +4727,8 @@ static int f2fs_fill_super(struct super_block *sb, void *data, int silent)
+ f2fs_destroy_segment_manager(sbi);
+ stop_ckpt_thread:
+ f2fs_stop_ckpt_thread(sbi);
++ /* flush s_error_work before sbi destroy */
++ flush_work(&sbi->s_error_work);
+ f2fs_destroy_post_read_wq(sbi);
+ free_devices:
+ destroy_device_list(sbi);
+--
+2.39.2
+
--- /dev/null
+From 7a86bdcdb7369eae30a517e6e1879df375f0d513 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Jun 2023 07:20:44 +0300
+Subject: fanotify: disallow mount/sb marks on kernel internal pseudo fs
+
+From: Amir Goldstein <amir73il@gmail.com>
+
+[ Upstream commit 69562eb0bd3e6bb8e522a7b254334e0fb30dff0c ]
+
+Hopefully, nobody is trying to abuse mount/sb marks for watching all
+anonymous pipes/inodes.
+
+I cannot think of a good reason to allow this - it looks like an
+oversight that dated back to the original fanotify API.
+
+Link: https://lore.kernel.org/linux-fsdevel/20230628101132.kvchg544mczxv2pm@quack3/
+Fixes: 0ff21db9fcc3 ("fanotify: hooks the fanotify_mark syscall to the vfsmount code")
+Signed-off-by: Amir Goldstein <amir73il@gmail.com>
+Reviewed-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Message-Id: <20230629042044.25723-1-amir73il@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/notify/fanotify/fanotify_user.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanotify_user.c
+index 22fb1cf7e1fc5..f7e11ac763907 100644
+--- a/fs/notify/fanotify/fanotify_user.c
++++ b/fs/notify/fanotify/fanotify_user.c
+@@ -1623,6 +1623,20 @@ static int fanotify_events_supported(struct fsnotify_group *group,
+ path->mnt->mnt_sb->s_type->fs_flags & FS_DISALLOW_NOTIFY_PERM)
+ return -EINVAL;
+
++ /*
++ * mount and sb marks are not allowed on kernel internal pseudo fs,
++ * like pipe_mnt, because that would subscribe to events on all the
++ * anonynous pipes in the system.
++ *
++ * SB_NOUSER covers all of the internal pseudo fs whose objects are not
++ * exposed to user's mount namespace, but there are other SB_KERNMOUNT
++ * fs, like nsfs, debugfs, for which the value of allowing sb and mount
++ * mark is questionable. For now we leave them alone.
++ */
++ if (mark_type != FAN_MARK_INODE &&
++ path->mnt->mnt_sb->s_flags & SB_NOUSER)
++ return -EINVAL;
++
+ /*
+ * We shouldn't have allowed setting dirent events and the directory
+ * flags FAN_ONDIR and FAN_EVENT_ON_CHILD in mask of non-dir inode,
+--
+2.39.2
+
--- /dev/null
+From fc167ad98760525dae44bf6913726c6916544f46 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jun 2023 12:26:23 -0500
+Subject: gfs2: Fix duplicate should_fault_in_pages() call
+
+From: Bob Peterson <rpeterso@redhat.com>
+
+[ Upstream commit c8ed1b35931245087968fd95b2ec3dfc50f77769 ]
+
+In gfs2_file_buffered_write(), we currently jump from the second call of
+function should_fault_in_pages() to above the first call, so
+should_fault_in_pages() is getting called twice in a row, causing it to
+accidentally fall back to single-page writes rather than trying the more
+efficient multi-page writes first.
+
+Fix that by moving the retry label to the correct place, behind the
+first call to should_fault_in_pages().
+
+Fixes: e1fa9ea85ce8 ("gfs2: Stop using glock holder auto-demotion for now")
+Signed-off-by: Bob Peterson <rpeterso@redhat.com>
+Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/gfs2/file.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/gfs2/file.c b/fs/gfs2/file.c
+index cb62c8f07d1e7..21335d1b67bf2 100644
+--- a/fs/gfs2/file.c
++++ b/fs/gfs2/file.c
+@@ -1030,8 +1030,8 @@ static ssize_t gfs2_file_buffered_write(struct kiocb *iocb,
+ }
+
+ gfs2_holder_init(ip->i_gl, LM_ST_EXCLUSIVE, 0, gh);
+-retry:
+ if (should_fault_in_pages(from, iocb, &prev_count, &window_size)) {
++retry:
+ window_size -= fault_in_iov_iter_readable(from, window_size);
+ if (!window_size) {
+ ret = -EFAULT;
+--
+2.39.2
+
--- /dev/null
+From 8d820851abbc2c90b99309d1258711705542e928 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Jun 2023 17:28:04 +0800
+Subject: hwtracing: hisi_ptt: Fix potential sleep in atomic context
+
+From: Yicong Yang <yangyicong@hisilicon.com>
+
+[ Upstream commit 6c50384ef8b94a527445e3694ae6549e1f15d859 ]
+
+We're using pci_irq_vector() to obtain the interrupt number and then
+bind it to the CPU start perf under the protection of spinlock in
+pmu::start(). pci_irq_vector() might sleep since [1] because it will
+call msi_domain_get_virq() to get the MSI interrupt number and it
+needs to acquire dev->msi.data->mutex. Getting a mutex will sleep on
+contention. So use pci_irq_vector() in an atomic context is problematic.
+
+This patch cached the interrupt number in the probe() and uses the
+cached data instead to avoid potential sleep.
+
+[1] commit 82ff8e6b78fc ("PCI/MSI: Use msi_get_virq() in pci_get_vector()")
+
+Fixes: ff0de066b463 ("hwtracing: hisi_ptt: Add trace function support for HiSilicon PCIe Tune and Trace device")
+Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Yicong Yang <yangyicong@hisilicon.com>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Link: https://lore.kernel.org/r/20230621092804.15120-6-yangyicong@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/ptt/hisi_ptt.c | 12 +++++-------
+ drivers/hwtracing/ptt/hisi_ptt.h | 2 ++
+ 2 files changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/hwtracing/ptt/hisi_ptt.c b/drivers/hwtracing/ptt/hisi_ptt.c
+index 30f1525639b57..4140efd664097 100644
+--- a/drivers/hwtracing/ptt/hisi_ptt.c
++++ b/drivers/hwtracing/ptt/hisi_ptt.c
+@@ -341,13 +341,13 @@ static int hisi_ptt_register_irq(struct hisi_ptt *hisi_ptt)
+ if (ret < 0)
+ return ret;
+
+- ret = devm_request_threaded_irq(&pdev->dev,
+- pci_irq_vector(pdev, HISI_PTT_TRACE_DMA_IRQ),
++ hisi_ptt->trace_irq = pci_irq_vector(pdev, HISI_PTT_TRACE_DMA_IRQ);
++ ret = devm_request_threaded_irq(&pdev->dev, hisi_ptt->trace_irq,
+ NULL, hisi_ptt_isr, 0,
+ DRV_NAME, hisi_ptt);
+ if (ret) {
+ pci_err(pdev, "failed to request irq %d, ret = %d\n",
+- pci_irq_vector(pdev, HISI_PTT_TRACE_DMA_IRQ), ret);
++ hisi_ptt->trace_irq, ret);
+ return ret;
+ }
+
+@@ -757,8 +757,7 @@ static void hisi_ptt_pmu_start(struct perf_event *event, int flags)
+ * core in event_function_local(). If CPU passed is offline we'll fail
+ * here, just log it since we can do nothing here.
+ */
+- ret = irq_set_affinity(pci_irq_vector(hisi_ptt->pdev, HISI_PTT_TRACE_DMA_IRQ),
+- cpumask_of(cpu));
++ ret = irq_set_affinity(hisi_ptt->trace_irq, cpumask_of(cpu));
+ if (ret)
+ dev_warn(dev, "failed to set the affinity of trace interrupt\n");
+
+@@ -1018,8 +1017,7 @@ static int hisi_ptt_cpu_teardown(unsigned int cpu, struct hlist_node *node)
+ * Also make sure the interrupt bind to the migrated CPU as well. Warn
+ * the user on failure here.
+ */
+- if (irq_set_affinity(pci_irq_vector(hisi_ptt->pdev, HISI_PTT_TRACE_DMA_IRQ),
+- cpumask_of(target)))
++ if (irq_set_affinity(hisi_ptt->trace_irq, cpumask_of(target)))
+ dev_warn(dev, "failed to set the affinity of trace interrupt\n");
+
+ hisi_ptt->trace_ctrl.on_cpu = target;
+diff --git a/drivers/hwtracing/ptt/hisi_ptt.h b/drivers/hwtracing/ptt/hisi_ptt.h
+index 5beb1648c93ab..948a4c4231527 100644
+--- a/drivers/hwtracing/ptt/hisi_ptt.h
++++ b/drivers/hwtracing/ptt/hisi_ptt.h
+@@ -166,6 +166,7 @@ struct hisi_ptt_pmu_buf {
+ * @pdev: pci_dev of this PTT device
+ * @tune_lock: lock to serialize the tune process
+ * @pmu_lock: lock to serialize the perf process
++ * @trace_irq: interrupt number used by trace
+ * @upper_bdf: the upper BDF range of the PCI devices managed by this PTT device
+ * @lower_bdf: the lower BDF range of the PCI devices managed by this PTT device
+ * @port_filters: the filter list of root ports
+@@ -180,6 +181,7 @@ struct hisi_ptt {
+ struct pci_dev *pdev;
+ struct mutex tune_lock;
+ spinlock_t pmu_lock;
++ int trace_irq;
+ u32 upper_bdf;
+ u32 lower_bdf;
+
+--
+2.39.2
+
--- /dev/null
+From 5421636d8b68c96cb1e4744e4e463b611bb91ec9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Jun 2023 12:25:58 -0600
+Subject: i2c: xiic: Don't try to handle more interrupt events after error
+
+From: Robert Hancock <robert.hancock@calian.com>
+
+[ Upstream commit cb6e45c9a0ad9e0f8664fd06db0227d185dc76ab ]
+
+In xiic_process, it is possible that error events such as arbitration
+lost or TX error can be raised in conjunction with other interrupt flags
+such as TX FIFO empty or bus not busy. Error events result in the
+controller being reset and the error returned to the calling request,
+but the function could potentially try to keep handling the other
+events, such as by writing more messages into the TX FIFO. Since the
+transaction has already failed, this is not helpful and will just cause
+issues.
+
+This problem has been present ever since:
+
+commit 7f9906bd7f72 ("i2c: xiic: Service all interrupts in isr")
+
+which allowed non-error events to be handled after errors, but became
+more obvious after:
+
+commit 743e227a8959 ("i2c: xiic: Defer xiic_wakeup() and
+__xiic_start_xfer() in xiic_process()")
+
+which reworked the code to add a WARN_ON which triggers if both the
+xfer_more and wakeup_req flags were set, since this combination is
+not supposed to happen, but was occurring in this scenario.
+
+Skip further interrupt handling after error flags are detected to avoid
+this problem.
+
+Fixes: 7f9906bd7f72 ("i2c: xiic: Service all interrupts in isr")
+Signed-off-by: Robert Hancock <robert.hancock@calian.com>
+Acked-by: Andi Shyti <andi.shyti@kernel.org>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-xiic.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/i2c/busses/i2c-xiic.c b/drivers/i2c/busses/i2c-xiic.c
+index 8a3d9817cb41c..ee6edc963deac 100644
+--- a/drivers/i2c/busses/i2c-xiic.c
++++ b/drivers/i2c/busses/i2c-xiic.c
+@@ -721,6 +721,8 @@ static irqreturn_t xiic_process(int irq, void *dev_id)
+ wakeup_req = 1;
+ wakeup_code = STATE_ERROR;
+ }
++ /* don't try to handle other events */
++ goto out;
+ }
+ if (pend & XIIC_INTR_RX_FULL_MASK) {
+ /* Receive register/FIFO is full */
+--
+2.39.2
+
--- /dev/null
+From 24b569214a16c94e5d9e6e469109b73ce5daedb9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 May 2023 11:30:29 +0800
+Subject: i3c: master: svc: fix cpu schedule in spin lock
+
+From: Clark Wang <xiaoning.wang@nxp.com>
+
+[ Upstream commit 33beadb3b1ab74e69db2c49d9663f3a93a273943 ]
+
+pm_runtime_resume_and_get() may call sleep(). It cannot be used in
+svc_i3c_master_start_xfer_locked(), because it is in a spin lock.
+
+Move the pm runtime operations to svc_i3c_master_enqueue_xfer().
+
+Signed-off-by: Clark Wang <xiaoning.wang@nxp.com>
+Fixes: 05be23ef78f7 ("i3c: master: svc: add runtime pm support")
+Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/r/20230517033030.3068085-2-xiaoning.wang@nxp.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i3c/master/svc-i3c-master.c | 19 ++++++++++---------
+ 1 file changed, 10 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/i3c/master/svc-i3c-master.c b/drivers/i3c/master/svc-i3c-master.c
+index e3f454123805e..79b08942a925d 100644
+--- a/drivers/i3c/master/svc-i3c-master.c
++++ b/drivers/i3c/master/svc-i3c-master.c
+@@ -1090,12 +1090,6 @@ static void svc_i3c_master_start_xfer_locked(struct svc_i3c_master *master)
+ if (!xfer)
+ return;
+
+- ret = pm_runtime_resume_and_get(master->dev);
+- if (ret < 0) {
+- dev_err(master->dev, "<%s> Cannot get runtime PM.\n", __func__);
+- return;
+- }
+-
+ svc_i3c_master_clear_merrwarn(master);
+ svc_i3c_master_flush_fifo(master);
+
+@@ -1110,9 +1104,6 @@ static void svc_i3c_master_start_xfer_locked(struct svc_i3c_master *master)
+ break;
+ }
+
+- pm_runtime_mark_last_busy(master->dev);
+- pm_runtime_put_autosuspend(master->dev);
+-
+ xfer->ret = ret;
+ complete(&xfer->comp);
+
+@@ -1133,6 +1124,13 @@ static void svc_i3c_master_enqueue_xfer(struct svc_i3c_master *master,
+ struct svc_i3c_xfer *xfer)
+ {
+ unsigned long flags;
++ int ret;
++
++ ret = pm_runtime_resume_and_get(master->dev);
++ if (ret < 0) {
++ dev_err(master->dev, "<%s> Cannot get runtime PM.\n", __func__);
++ return;
++ }
+
+ init_completion(&xfer->comp);
+ spin_lock_irqsave(&master->xferqueue.lock, flags);
+@@ -1143,6 +1141,9 @@ static void svc_i3c_master_enqueue_xfer(struct svc_i3c_master *master,
+ svc_i3c_master_start_xfer_locked(master);
+ }
+ spin_unlock_irqrestore(&master->xferqueue.lock, flags);
++
++ pm_runtime_mark_last_busy(master->dev);
++ pm_runtime_put_autosuspend(master->dev);
+ }
+
+ static bool
+--
+2.39.2
+
--- /dev/null
+From 8342e0704dc73a6792f994e398deb060b723f1c4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Jun 2023 13:22:44 -0500
+Subject: ibmvnic: Do not reset dql stats on NON_FATAL err
+
+From: Nick Child <nnac123@linux.ibm.com>
+
+[ Upstream commit 48538ccb825b05544ec308a509e2cc9c013402db ]
+
+All ibmvnic resets, make a call to netdev_tx_reset_queue() when
+re-opening the device. netdev_tx_reset_queue() resets the num_queued
+and num_completed byte counters. These stats are used in Byte Queue
+Limit (BQL) algorithms. The difference between these two stats tracks
+the number of bytes currently sitting on the physical NIC. ibmvnic
+increases the number of queued bytes though calls to
+netdev_tx_sent_queue() in the drivers xmit function. When, VIOS reports
+that it is done transmitting bytes, the ibmvnic device increases the
+number of completed bytes through calls to netdev_tx_completed_queue().
+It is important to note that the driver batches its transmit calls and
+num_queued is increased every time that an skb is added to the next
+batch, not necessarily when the batch is sent to VIOS for transmission.
+
+Unlike other reset types, a NON FATAL reset will not flush the sub crq
+tx buffers. Therefore, it is possible for the batched skb array to be
+partially full. So if there is call to netdev_tx_reset_queue() when
+re-opening the device, the value of num_queued (0) would not account
+for the skb's that are currently batched. Eventually, when the batch
+is sent to VIOS, the call to netdev_tx_completed_queue() would increase
+num_completed to a value greater than the num_queued. This causes a
+BUG_ON crash:
+
+ibmvnic 30000002: Firmware reports error, cause: adapter problem.
+Starting recovery...
+ibmvnic 30000002: tx error 600
+ibmvnic 30000002: tx error 600
+ibmvnic 30000002: tx error 600
+ibmvnic 30000002: tx error 600
+------------[ cut here ]------------
+kernel BUG at lib/dynamic_queue_limits.c:27!
+Oops: Exception in kernel mode, sig: 5
+[....]
+NIP dql_completed+0x28/0x1c0
+LR ibmvnic_complete_tx.isra.0+0x23c/0x420 [ibmvnic]
+Call Trace:
+ibmvnic_complete_tx.isra.0+0x3f8/0x420 [ibmvnic] (unreliable)
+ibmvnic_interrupt_tx+0x40/0x70 [ibmvnic]
+__handle_irq_event_percpu+0x98/0x270
+---[ end trace ]---
+
+Therefore, do not reset the dql stats when performing a NON_FATAL reset.
+
+Fixes: 0d973388185d ("ibmvnic: Introduce xmit_more support using batched subCRQ hcalls")
+Signed-off-by: Nick Child <nnac123@linux.ibm.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/ibm/ibmvnic.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
+index c63d3ec9d3284..763d613adbcc0 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -1816,7 +1816,14 @@ static int __ibmvnic_open(struct net_device *netdev)
+ if (prev_state == VNIC_CLOSED)
+ enable_irq(adapter->tx_scrq[i]->irq);
+ enable_scrq_irq(adapter, adapter->tx_scrq[i]);
+- netdev_tx_reset_queue(netdev_get_tx_queue(netdev, i));
++ /* netdev_tx_reset_queue will reset dql stats. During NON_FATAL
++ * resets, don't reset the stats because there could be batched
++ * skb's waiting to be sent. If we reset dql stats, we risk
++ * num_completed being greater than num_queued. This will cause
++ * a BUG_ON in dql_completed().
++ */
++ if (adapter->reset_reason != VNIC_RESET_NON_FATAL)
++ netdev_tx_reset_queue(netdev_get_tx_queue(netdev, i));
+ }
+
+ rc = set_link_state(adapter, IBMVNIC_LOGICAL_LNK_UP);
+--
+2.39.2
+
--- /dev/null
+From d8a5111bafff346389b53af943e23780ce84a637 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Apr 2023 22:14:49 +0200
+Subject: interconnect: qcom: rpm: Don't use clk_get_optional for bus clocks
+ anymore
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit 1ff7aedcdcdd4fe02201269ab428b09491e5cf6e ]
+
+Commit dd42ec8ea5b9 ("interconnect: qcom: rpm: Use _optional func for provider clocks")
+relaxed the requirements around probing bus clocks. This was a decent
+solution for making sure MSM8996 would still boot with old DTs, but
+now that there's a proper fix in place that both old and new DTs
+will be happy about, revert back to the safer variant of the
+function.
+
+Fixes: dd42ec8ea5b9 ("interconnect: qcom: rpm: Use _optional func for provider clocks")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20230228-topic-qos-v8-7-ee696a2c15a9@linaro.org
+Signed-off-by: Georgi Djakov <djakov@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/interconnect/qcom/icc-rpm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/interconnect/qcom/icc-rpm.c b/drivers/interconnect/qcom/icc-rpm.c
+index ec39861c1764c..8d3138e8c1ee3 100644
+--- a/drivers/interconnect/qcom/icc-rpm.c
++++ b/drivers/interconnect/qcom/icc-rpm.c
+@@ -494,7 +494,7 @@ int qnoc_probe(struct platform_device *pdev)
+ }
+
+ regmap_done:
+- ret = devm_clk_bulk_get_optional(dev, qp->num_bus_clks, qp->bus_clks);
++ ret = devm_clk_bulk_get(dev, qp->num_bus_clks, qp->bus_clks);
+ if (ret)
+ return ret;
+
+--
+2.39.2
+
--- /dev/null
+From 73aff5edd8d4a06f707d78898741d04347cf411b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Apr 2023 22:14:44 +0200
+Subject: interconnect: qcom: rpm: Rename icc provider num_clocks to
+ num_bus_clocks
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit 1a12928e25627e02126ad2d1c12cfdba79d6bd94 ]
+
+In preparation for handling non-scaling clocks that we still have to
+enable, rename num_clocks to more descriptive num_bus_clocks.
+
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20230228-topic-qos-v8-2-ee696a2c15a9@linaro.org
+Signed-off-by: Georgi Djakov <djakov@kernel.org>
+Stable-dep-of: 1ff7aedcdcdd ("interconnect: qcom: rpm: Don't use clk_get_optional for bus clocks anymore")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/interconnect/qcom/icc-rpm.c | 12 ++++++------
+ drivers/interconnect/qcom/icc-rpm.h | 4 ++--
+ 2 files changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/interconnect/qcom/icc-rpm.c b/drivers/interconnect/qcom/icc-rpm.c
+index 5341fa169dbf1..ec39861c1764c 100644
+--- a/drivers/interconnect/qcom/icc-rpm.c
++++ b/drivers/interconnect/qcom/icc-rpm.c
+@@ -379,7 +379,7 @@ static int qcom_icc_set(struct icc_node *src, struct icc_node *dst)
+ return ret;
+ }
+
+- for (i = 0; i < qp->num_clks; i++) {
++ for (i = 0; i < qp->num_bus_clks; i++) {
+ /*
+ * Use WAKE bucket for active clock, otherwise, use SLEEP bucket
+ * for other clocks. If a platform doesn't set interconnect
+@@ -464,7 +464,7 @@ int qnoc_probe(struct platform_device *pdev)
+
+ for (i = 0; i < cd_num; i++)
+ qp->bus_clks[i].id = cds[i];
+- qp->num_clks = cd_num;
++ qp->num_bus_clks = cd_num;
+
+ qp->type = desc->type;
+ qp->qos_offset = desc->qos_offset;
+@@ -494,11 +494,11 @@ int qnoc_probe(struct platform_device *pdev)
+ }
+
+ regmap_done:
+- ret = devm_clk_bulk_get_optional(dev, qp->num_clks, qp->bus_clks);
++ ret = devm_clk_bulk_get_optional(dev, qp->num_bus_clks, qp->bus_clks);
+ if (ret)
+ return ret;
+
+- ret = clk_bulk_prepare_enable(qp->num_clks, qp->bus_clks);
++ ret = clk_bulk_prepare_enable(qp->num_bus_clks, qp->bus_clks);
+ if (ret)
+ return ret;
+
+@@ -551,7 +551,7 @@ int qnoc_probe(struct platform_device *pdev)
+ icc_provider_deregister(provider);
+ err_remove_nodes:
+ icc_nodes_remove(provider);
+- clk_bulk_disable_unprepare(qp->num_clks, qp->bus_clks);
++ clk_bulk_disable_unprepare(qp->num_bus_clks, qp->bus_clks);
+
+ return ret;
+ }
+@@ -563,7 +563,7 @@ int qnoc_remove(struct platform_device *pdev)
+
+ icc_provider_deregister(&qp->provider);
+ icc_nodes_remove(&qp->provider);
+- clk_bulk_disable_unprepare(qp->num_clks, qp->bus_clks);
++ clk_bulk_disable_unprepare(qp->num_bus_clks, qp->bus_clks);
+
+ return 0;
+ }
+diff --git a/drivers/interconnect/qcom/icc-rpm.h b/drivers/interconnect/qcom/icc-rpm.h
+index 22bdb1e4bb123..838f3fa82278e 100644
+--- a/drivers/interconnect/qcom/icc-rpm.h
++++ b/drivers/interconnect/qcom/icc-rpm.h
+@@ -23,7 +23,7 @@ enum qcom_icc_type {
+ /**
+ * struct qcom_icc_provider - Qualcomm specific interconnect provider
+ * @provider: generic interconnect provider
+- * @num_clks: the total number of clk_bulk_data entries
++ * @num_bus_clks: the total number of bus_clks clk_bulk_data entries
+ * @type: the ICC provider type
+ * @regmap: regmap for QoS registers read/write access
+ * @qos_offset: offset to QoS registers
+@@ -32,7 +32,7 @@ enum qcom_icc_type {
+ */
+ struct qcom_icc_provider {
+ struct icc_provider provider;
+- int num_clks;
++ int num_bus_clks;
+ enum qcom_icc_type type;
+ struct regmap *regmap;
+ unsigned int qos_offset;
+--
+2.39.2
+
--- /dev/null
+From d36ee012fa013c53e4990db2f5b3ffb96d7edcd7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 May 2023 10:40:17 +0800
+Subject: kernfs: fix missing kernfs_idr_lock to remove an ID from the IDR
+
+From: Muchun Song <songmuchun@bytedance.com>
+
+[ Upstream commit 30480b988f88c279752f3202a26b6fee5f586aef ]
+
+The root->ino_idr is supposed to be protected by kernfs_idr_lock, fix
+it.
+
+Fixes: 488dee96bb62 ("kernfs: allow creating kernfs objects with arbitrary uid/gid")
+Signed-off-by: Muchun Song <songmuchun@bytedance.com>
+Acked-by: Tejun Heo <tj@kernel.org>
+Link: https://lore.kernel.org/r/20230523024017.24851-1-songmuchun@bytedance.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/kernfs/dir.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/kernfs/dir.c b/fs/kernfs/dir.c
+index 45b6919903e6b..5a1a4af9d3d29 100644
+--- a/fs/kernfs/dir.c
++++ b/fs/kernfs/dir.c
+@@ -655,7 +655,9 @@ static struct kernfs_node *__kernfs_new_node(struct kernfs_root *root,
+ return kn;
+
+ err_out3:
++ spin_lock(&kernfs_idr_lock);
+ idr_remove(&root->ino_idr, (u32)kernfs_ino(kn));
++ spin_unlock(&kernfs_idr_lock);
+ err_out2:
+ kmem_cache_free(kernfs_node_cache, kn);
+ err_out1:
+--
+2.39.2
+
--- /dev/null
+From bae0036b51963a467b99e02a574182c145afafaa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 May 2023 10:42:34 +0200
+Subject: KVM: s390/diag: fix racy access of physical cpu number in diag 9c
+ handler
+
+From: Christian Borntraeger <borntraeger@linux.ibm.com>
+
+[ Upstream commit 0bc380beb78aa352eadbc21d934dd9606fcee808 ]
+
+We do check for target CPU == -1, but this might change at the time we
+are going to use it. Hold the physical target CPU in a local variable to
+avoid out-of-bound accesses to the cpu arrays.
+
+Cc: Pierre Morel <pmorel@linux.ibm.com>
+Fixes: 87e28a15c42c ("KVM: s390: diag9c (directed yield) forwarding")
+Reported-by: Marc Hartmayer <mhartmay@linux.ibm.com>
+Reviewed-by: Nico Boehr <nrb@linux.ibm.com>
+Reviewed-by: Pierre Morel <pmorel@linux.ibm.com>
+Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
+Signed-off-by: Janosch Frank <frankja@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/kvm/diag.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/arch/s390/kvm/diag.c b/arch/s390/kvm/diag.c
+index 807fa9da1e721..3c65b8258ae67 100644
+--- a/arch/s390/kvm/diag.c
++++ b/arch/s390/kvm/diag.c
+@@ -166,6 +166,7 @@ static int diag9c_forwarding_overrun(void)
+ static int __diag_time_slice_end_directed(struct kvm_vcpu *vcpu)
+ {
+ struct kvm_vcpu *tcpu;
++ int tcpu_cpu;
+ int tid;
+
+ tid = vcpu->run->s.regs.gprs[(vcpu->arch.sie_block->ipa & 0xf0) >> 4];
+@@ -181,14 +182,15 @@ static int __diag_time_slice_end_directed(struct kvm_vcpu *vcpu)
+ goto no_yield;
+
+ /* target guest VCPU already running */
+- if (READ_ONCE(tcpu->cpu) >= 0) {
++ tcpu_cpu = READ_ONCE(tcpu->cpu);
++ if (tcpu_cpu >= 0) {
+ if (!diag9c_forwarding_hz || diag9c_forwarding_overrun())
+ goto no_yield;
+
+ /* target host CPU already running */
+- if (!vcpu_is_preempted(tcpu->cpu))
++ if (!vcpu_is_preempted(tcpu_cpu))
+ goto no_yield;
+- smp_yield_cpu(tcpu->cpu);
++ smp_yield_cpu(tcpu_cpu);
+ VCPU_EVENT(vcpu, 5,
+ "diag time slice end directed to %d: yield forwarded",
+ tid);
+--
+2.39.2
+
--- /dev/null
+From d5bf6408318a0a102b4e2d717e604e437e98d566 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Mar 2023 15:54:23 +0100
+Subject: KVM: s390: fix KVM_S390_GET_CMMA_BITS for GFNs in memslot holes
+
+From: Nico Boehr <nrb@linux.ibm.com>
+
+[ Upstream commit 285cff4c0454340a4dc53f46e67f2cb1c293bd74 ]
+
+The KVM_S390_GET_CMMA_BITS ioctl may return incorrect values when userspace
+specifies a start_gfn outside of memslots.
+
+This can occur when a VM has multiple memslots with a hole in between:
+
++-----+----------+--------+--------+
+| ... | Slot N-1 | <hole> | Slot N |
++-----+----------+--------+--------+
+ ^ ^ ^ ^
+ | | | |
+GFN A A+B | |
+ A+B+C |
+ A+B+C+D
+
+When userspace specifies a GFN in [A+B, A+B+C), it would expect to get the
+CMMA values of the first dirty page in Slot N. However, userspace may get a
+start_gfn of A+B+C+D with a count of 0, hence completely skipping over any
+dirty pages in slot N.
+
+The error is in kvm_s390_next_dirty_cmma(), which assumes
+gfn_to_memslot_approx() will return the memslot _below_ the specified GFN
+when the specified GFN lies outside a memslot. In reality it may return
+either the memslot below or above the specified GFN.
+
+When a memslot above the specified GFN is returned this happens:
+
+- ofs is calculated, but since the memslot's base_gfn is larger than the
+ specified cur_gfn, ofs will underflow to a huge number.
+- ofs is passed to find_next_bit(). Since ofs will exceed the memslot's
+ number of pages, the number of pages in the memslot is returned,
+ completely skipping over all bits in the memslot userspace would be
+ interested in.
+
+Fix this by resetting ofs to zero when a memslot _above_ cur_gfn is
+returned (cur_gfn < ms->base_gfn).
+
+Signed-off-by: Nico Boehr <nrb@linux.ibm.com>
+Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
+Fixes: afdad61615cc ("KVM: s390: Fix storage attributes migration with memory slots")
+Message-Id: <20230324145424.293889-2-nrb@linux.ibm.com>
+Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
+Signed-off-by: Janosch Frank <frankja@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/kvm/kvm-s390.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
+index 17b81659cdb20..6700196964648 100644
+--- a/arch/s390/kvm/kvm-s390.c
++++ b/arch/s390/kvm/kvm-s390.c
+@@ -2156,6 +2156,10 @@ static unsigned long kvm_s390_next_dirty_cmma(struct kvm_memslots *slots,
+ ms = container_of(mnode, struct kvm_memory_slot, gfn_node[slots->node_idx]);
+ ofs = 0;
+ }
++
++ if (cur_gfn < ms->base_gfn)
++ ofs = 0;
++
+ ofs = find_next_bit(kvm_second_dirty_bitmap(ms), ms->npages, ofs);
+ while (ofs >= ms->npages && (mnode = rb_next(mnode))) {
+ ms = container_of(mnode, struct kvm_memory_slot, gfn_node[slots->node_idx]);
+--
+2.39.2
+
--- /dev/null
+From b7da2f58d43cbb8469bf8e12a0097748aa062cf0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 May 2023 17:42:58 +0200
+Subject: KVM: s390: vsie: fix the length of APCB bitmap
+
+From: Pierre Morel <pmorel@linux.ibm.com>
+
+[ Upstream commit 246be7d2720ea9a795b576067ecc5e5c7a1e7848 ]
+
+bit_and() uses the count of bits as the woking length.
+Fix the previous implementation and effectively use
+the right bitmap size.
+
+Fixes: 19fd83a64718 ("KVM: s390: vsie: allow CRYCB FORMAT-1")
+Fixes: 56019f9aca22 ("KVM: s390: vsie: Allow CRYCB FORMAT-2")
+
+Signed-off-by: Pierre Morel <pmorel@linux.ibm.com>
+Reviewed-by: Janosch Frank <frankja@linux.ibm.com>
+Link: https://lore.kernel.org/kvm/20230511094719.9691-1-pmorel@linux.ibm.com/
+Signed-off-by: Janosch Frank <frankja@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/kvm/vsie.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/arch/s390/kvm/vsie.c b/arch/s390/kvm/vsie.c
+index 8d6b765abf29b..0333ee482eb89 100644
+--- a/arch/s390/kvm/vsie.c
++++ b/arch/s390/kvm/vsie.c
+@@ -177,7 +177,8 @@ static int setup_apcb00(struct kvm_vcpu *vcpu, unsigned long *apcb_s,
+ sizeof(struct kvm_s390_apcb0)))
+ return -EFAULT;
+
+- bitmap_and(apcb_s, apcb_s, apcb_h, sizeof(struct kvm_s390_apcb0));
++ bitmap_and(apcb_s, apcb_s, apcb_h,
++ BITS_PER_BYTE * sizeof(struct kvm_s390_apcb0));
+
+ return 0;
+ }
+@@ -203,7 +204,8 @@ static int setup_apcb11(struct kvm_vcpu *vcpu, unsigned long *apcb_s,
+ sizeof(struct kvm_s390_apcb1)))
+ return -EFAULT;
+
+- bitmap_and(apcb_s, apcb_s, apcb_h, sizeof(struct kvm_s390_apcb1));
++ bitmap_and(apcb_s, apcb_s, apcb_h,
++ BITS_PER_BYTE * sizeof(struct kvm_s390_apcb1));
+
+ return 0;
+ }
+--
+2.39.2
+
--- /dev/null
+From 652c15b135e8e0e0922f7097ec5eebbed6966040 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Feb 2023 11:24:36 -0800
+Subject: lib/bitmap: drop optimization of bitmap_{from,to}_arr64
+
+From: Yury Norov <yury.norov@gmail.com>
+
+[ Upstream commit c1d2ba10f594046831d14b03f194e8d05e78abad ]
+
+bitmap_{from,to}_arr64() optimization is overly optimistic on 32-bit LE
+architectures when it's wired to bitmap_copy_clear_tail().
+
+bitmap_copy_clear_tail() takes care of unused bits in the bitmap up to
+the next word boundary. But on 32-bit machines when copying bits from
+bitmap to array of 64-bit words, it's expected that the unused part of
+a recipient array must be cleared up to 64-bit boundary, so the last 4
+bytes may stay untouched when nbits % 64 <= 32.
+
+While the copying part of the optimization works correct, that clear-tail
+trick makes corresponding tests reasonably fail:
+
+test_bitmap: bitmap_to_arr64(nbits == 1): tail is not safely cleared: 0xa5a5a5a500000001 (must be 0x0000000000000001)
+
+Fix it by removing bitmap_{from,to}_arr64() optimization for 32-bit LE
+arches.
+
+Reported-by: Guenter Roeck <linux@roeck-us.net>
+Link: https://lore.kernel.org/lkml/20230225184702.GA3587246@roeck-us.net/
+Fixes: 0a97953fd221 ("lib: add bitmap_{from,to}_arr64")
+Signed-off-by: Yury Norov <yury.norov@gmail.com>
+Tested-by: Guenter Roeck <linux@roeck-us.net>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Reviewed-by: Alexander Lobakin <aleksander.lobakin@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/bitmap.h | 8 +++-----
+ lib/bitmap.c | 2 +-
+ 2 files changed, 4 insertions(+), 6 deletions(-)
+
+diff --git a/include/linux/bitmap.h b/include/linux/bitmap.h
+index 7d6d73b781472..03644237e1efb 100644
+--- a/include/linux/bitmap.h
++++ b/include/linux/bitmap.h
+@@ -302,12 +302,10 @@ void bitmap_to_arr32(u32 *buf, const unsigned long *bitmap,
+ #endif
+
+ /*
+- * On 64-bit systems bitmaps are represented as u64 arrays internally. On LE32
+- * machines the order of hi and lo parts of numbers match the bitmap structure.
+- * In both cases conversion is not needed when copying data from/to arrays of
+- * u64.
++ * On 64-bit systems bitmaps are represented as u64 arrays internally. So,
++ * the conversion is not needed when copying data from/to arrays of u64.
+ */
+-#if (BITS_PER_LONG == 32) && defined(__BIG_ENDIAN)
++#if BITS_PER_LONG == 32
+ void bitmap_from_arr64(unsigned long *bitmap, const u64 *buf, unsigned int nbits);
+ void bitmap_to_arr64(u64 *buf, const unsigned long *bitmap, unsigned int nbits);
+ #else
+diff --git a/lib/bitmap.c b/lib/bitmap.c
+index 1c81413c51f86..ddb31015e38ae 100644
+--- a/lib/bitmap.c
++++ b/lib/bitmap.c
+@@ -1495,7 +1495,7 @@ void bitmap_to_arr32(u32 *buf, const unsigned long *bitmap, unsigned int nbits)
+ EXPORT_SYMBOL(bitmap_to_arr32);
+ #endif
+
+-#if (BITS_PER_LONG == 32) && defined(__BIG_ENDIAN)
++#if BITS_PER_LONG == 32
+ /**
+ * bitmap_from_arr64 - copy the contents of u64 array of bits to bitmap
+ * @bitmap: array of unsigned longs, the destination bitmap
+--
+2.39.2
+
--- /dev/null
+From d66587f44f14f6c601c193997d362c637c6d9f2e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Jul 2023 16:54:04 +0200
+Subject: lib: dhry: fix sleeping allocations inside non-preemptable section
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 8ba388c06bc8056935ec1814b2689bfb42f3b89a ]
+
+The Smatch static checker reports the following warnings:
+
+ lib/dhry_run.c:38 dhry_benchmark() warn: sleeping in atomic context
+ lib/dhry_run.c:43 dhry_benchmark() warn: sleeping in atomic context
+
+Indeed, dhry() does sleeping allocations inside the non-preemptable
+section delimited by get_cpu()/put_cpu().
+
+Fix this by using atomic allocations instead.
+Add error handling, as atomic these allocations may fail.
+
+Link: https://lkml.kernel.org/r/bac6d517818a7cd8efe217c1ad649fffab9cc371.1688568764.git.geert+renesas@glider.be
+Fixes: 13684e966d46283e ("lib: dhry: fix unstable smp_processor_id(_) usage")
+Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
+Closes: https://lore.kernel.org/r/0469eb3a-02eb-4b41-b189-de20b931fa56@moroto.mountain
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/dhry_1.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/lib/dhry_1.c b/lib/dhry_1.c
+index 83247106824cc..08edbbb19f573 100644
+--- a/lib/dhry_1.c
++++ b/lib/dhry_1.c
+@@ -139,8 +139,15 @@ int dhry(int n)
+
+ /* Initializations */
+
+- Next_Ptr_Glob = (Rec_Pointer)kzalloc(sizeof(Rec_Type), GFP_KERNEL);
+- Ptr_Glob = (Rec_Pointer)kzalloc(sizeof(Rec_Type), GFP_KERNEL);
++ Next_Ptr_Glob = (Rec_Pointer)kzalloc(sizeof(Rec_Type), GFP_ATOMIC);
++ if (!Next_Ptr_Glob)
++ return -ENOMEM;
++
++ Ptr_Glob = (Rec_Pointer)kzalloc(sizeof(Rec_Type), GFP_ATOMIC);
++ if (!Ptr_Glob) {
++ kfree(Next_Ptr_Glob);
++ return -ENOMEM;
++ }
+
+ Ptr_Glob->Ptr_Comp = Next_Ptr_Glob;
+ Ptr_Glob->Discr = Ident_1;
+--
+2.39.2
+
--- /dev/null
+From c7782f250eccbddfea642634beb2d19e0d62e270 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 May 2023 00:29:44 +0800
+Subject: lkdtm: replace ll_rw_block with submit_bh
+
+From: Yue Zhao <findns94@gmail.com>
+
+[ Upstream commit b290df06811852d4cc36f4b8a2a30c2063197a74 ]
+
+Function ll_rw_block was removed in commit 79f597842069 ("fs/buffer:
+remove ll_rw_block() helper"). There is no unified function to sumbit
+read or write buffer in block layer for now. Consider similar sematics,
+we can choose submit_bh() to replace ll_rw_block() as predefined crash
+point. In submit_bh(), it also takes read or write flag as the first
+argument and invoke submit_bio() to submit I/O request to block layer.
+
+Fixes: 79f597842069 ("fs/buffer: remove ll_rw_block() helper")
+Signed-off-by: Yue Zhao <findns94@gmail.com>
+Acked-by: Kees Cook <keescook@chromium.org>
+Link: https://lore.kernel.org/r/20230503162944.3969-1-findns94@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/fault-injection/provoke-crashes.rst | 2 +-
+ drivers/misc/lkdtm/core.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/Documentation/fault-injection/provoke-crashes.rst b/Documentation/fault-injection/provoke-crashes.rst
+index 3abe842256139..1f087e502ca6d 100644
+--- a/Documentation/fault-injection/provoke-crashes.rst
++++ b/Documentation/fault-injection/provoke-crashes.rst
+@@ -29,7 +29,7 @@ recur_count
+ cpoint_name
+ Where in the kernel to trigger the action. It can be
+ one of INT_HARDWARE_ENTRY, INT_HW_IRQ_EN, INT_TASKLET_ENTRY,
+- FS_DEVRW, MEM_SWAPOUT, TIMERADD, SCSI_QUEUE_RQ, or DIRECT.
++ FS_SUBMIT_BH, MEM_SWAPOUT, TIMERADD, SCSI_QUEUE_RQ, or DIRECT.
+
+ cpoint_type
+ Indicates the action to be taken on hitting the crash point.
+diff --git a/drivers/misc/lkdtm/core.c b/drivers/misc/lkdtm/core.c
+index b4712ff196b4e..0772e4a4757e9 100644
+--- a/drivers/misc/lkdtm/core.c
++++ b/drivers/misc/lkdtm/core.c
+@@ -79,7 +79,7 @@ static struct crashpoint crashpoints[] = {
+ CRASHPOINT("INT_HARDWARE_ENTRY", "do_IRQ"),
+ CRASHPOINT("INT_HW_IRQ_EN", "handle_irq_event"),
+ CRASHPOINT("INT_TASKLET_ENTRY", "tasklet_action"),
+- CRASHPOINT("FS_DEVRW", "ll_rw_block"),
++ CRASHPOINT("FS_SUBMIT_BH", "submit_bh"),
+ CRASHPOINT("MEM_SWAPOUT", "shrink_inactive_list"),
+ CRASHPOINT("TIMERADD", "hrtimer_start"),
+ CRASHPOINT("SCSI_QUEUE_RQ", "scsi_queue_rq"),
+--
+2.39.2
+
--- /dev/null
+From a3e8a2ec2e2c76a9377d0b98c2f61e65d0d71310 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jun 2023 20:00:22 -0500
+Subject: mailbox: ti-msgmgr: Fill non-message tx data fields with 0x0
+
+From: Nishanth Menon <nm@ti.com>
+
+[ Upstream commit 1b712f18c461bd75f018033a15cf381e712806b5 ]
+
+Sec proxy/message manager data buffer is 60 bytes with the last of the
+registers indicating transmission completion. This however poses a bit
+of a challenge.
+
+The backing memory for sec_proxy / message manager is regular memory,
+and all sec proxy does is to trigger a burst of all 60 bytes of data
+over to the target thread backing ring accelerator. It doesn't do a
+memory scrub when it moves data out in the burst. When we transmit
+multiple messages, remnants of previous message is also transmitted
+which results in some random data being set in TISCI fields of
+messages that have been expanded forward.
+
+The entire concept of backward compatibility hinges on the fact that
+the unused message fields remain 0x0 allowing for 0x0 value to be
+specially considered when backward compatibility of message extension
+is done.
+
+So, instead of just writing the completion register, we continue
+to fill the message buffer up with 0x0 (note: for partial message
+involving completion, we already do this).
+
+This allows us to scale and introduce ABI changes back also work with
+other boot stages that may have left data in the internal memory.
+
+While at this, be consistent and explicit with the data_reg pointer
+increment.
+
+Fixes: aace66b170ce ("mailbox: Introduce TI message manager driver")
+Signed-off-by: Nishanth Menon <nm@ti.com>
+Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mailbox/ti-msgmgr.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/mailbox/ti-msgmgr.c b/drivers/mailbox/ti-msgmgr.c
+index ddac423ac1a91..03048cbda525e 100644
+--- a/drivers/mailbox/ti-msgmgr.c
++++ b/drivers/mailbox/ti-msgmgr.c
+@@ -430,14 +430,20 @@ static int ti_msgmgr_send_data(struct mbox_chan *chan, void *data)
+ /* Ensure all unused data is 0 */
+ data_trail &= 0xFFFFFFFF >> (8 * (sizeof(u32) - trail_bytes));
+ writel(data_trail, data_reg);
+- data_reg++;
++ data_reg += sizeof(u32);
+ }
++
+ /*
+ * 'data_reg' indicates next register to write. If we did not already
+ * write on tx complete reg(last reg), we must do so for transmit
++ * In addition, we also need to make sure all intermediate data
++ * registers(if any required), are reset to 0 for TISCI backward
++ * compatibility to be maintained.
+ */
+- if (data_reg <= qinst->queue_buff_end)
+- writel(0, qinst->queue_buff_end);
++ while (data_reg <= qinst->queue_buff_end) {
++ writel(0, data_reg);
++ data_reg += sizeof(u32);
++ }
+
+ /* If we are in polled mode, wait for a response before proceeding */
+ if (ti_msgmgr_chan_has_polled_queue_rx(message->chan_rx))
+--
+2.39.2
+
--- /dev/null
+From 75d6713a879b1ca713ab30b4a0d3da59e8e445fc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Jun 2023 17:43:20 +0800
+Subject: md/raid10: fix the condition to call bio_end_io_acct()
+
+From: Li Nan <linan122@huawei.com>
+
+[ Upstream commit 125bfc7cd750e68c99f1d446e2c22abea08c237f ]
+
+/sys/block/[device]/queue/iostats is used to control whether to count io
+stat. Write 0 to it will clear queue_flags QUEUE_FLAG_IO_STAT which means
+iostats is disabled. If we disable iostats and later endable it, the io
+issued during this period will be counted incorrectly, inflight will be
+decreased to -1.
+
+ //T1 set iostats
+ echo 0 > /sys/block/md0/queue/iostats
+ clear QUEUE_FLAG_IO_STAT
+
+ //T2 issue io
+ if (QUEUE_FLAG_IO_STAT) -> false
+ bio_start_io_acct
+ inflight++
+
+ echo 1 > /sys/block/md0/queue/iostats
+ set QUEUE_FLAG_IO_STAT
+
+ //T3 io end
+ if (QUEUE_FLAG_IO_STAT) -> true
+ bio_end_io_acct
+ inflight-- -> -1
+
+Also, if iostats is enabled while issuing io but disabled while io end,
+inflight will never be decreased.
+
+Fix it by checking start_time when io end. If start_time is not 0, call
+bio_end_io_acct().
+
+Fixes: 528bc2cf2fcc ("md/raid10: enable io accounting")
+Signed-off-by: Li Nan <linan122@huawei.com>
+Signed-off-by: Song Liu <song@kernel.org>
+Link: https://lore.kernel.org/r/20230609094320.2397604-1-linan666@huaweicloud.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/raid10.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
+index 9d11a52367d17..9d23963496194 100644
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -325,7 +325,7 @@ static void raid_end_bio_io(struct r10bio *r10_bio)
+ if (!test_bit(R10BIO_Uptodate, &r10_bio->state))
+ bio->bi_status = BLK_STS_IOERR;
+
+- if (blk_queue_io_stat(bio->bi_bdev->bd_disk->queue))
++ if (r10_bio->start_time)
+ bio_end_io_acct(bio, r10_bio->start_time);
+ bio_endio(bio);
+ /*
+--
+2.39.2
+
--- /dev/null
+From ca106f1e0389286520b4aa4bec9e43da7142f09b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Apr 2023 09:55:43 +0800
+Subject: media: amphion: drop repeated codec data for vc1g format
+
+From: Ming Qian <ming.qian@nxp.com>
+
+[ Upstream commit e1d2ccc2cdd6333584aa3d5386dc667d0837c48f ]
+
+For format V4L2_PIX_FMT_VC1_ANNEX_G,
+the separate codec data is required only once.
+The repeated codec data may introduce some decoding error.
+so drop the repeated codec data.
+
+It's amphion vpu's limitation
+
+Fixes: e670f5d672ef ("media: amphion: only insert the first sequence startcode for vc1l format")
+Signed-off-by: Ming Qian <ming.qian@nxp.com>
+Tested-by: xiahong.bao <xiahong.bao@nxp.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/amphion/vpu_malone.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/media/platform/amphion/vpu_malone.c b/drivers/media/platform/amphion/vpu_malone.c
+index e96994437429f..c1d6606ad7e57 100644
+--- a/drivers/media/platform/amphion/vpu_malone.c
++++ b/drivers/media/platform/amphion/vpu_malone.c
+@@ -1313,6 +1313,15 @@ static int vpu_malone_insert_scode_pic(struct malone_scode_t *scode, u32 codec_i
+ return sizeof(hdr);
+ }
+
++static int vpu_malone_insert_scode_vc1_g_seq(struct malone_scode_t *scode)
++{
++ if (!scode->inst->total_input_count)
++ return 0;
++ if (vpu_vb_is_codecconfig(to_vb2_v4l2_buffer(scode->vb)))
++ scode->need_data = 0;
++ return 0;
++}
++
+ static int vpu_malone_insert_scode_vc1_g_pic(struct malone_scode_t *scode)
+ {
+ struct vb2_v4l2_buffer *vbuf;
+@@ -1460,6 +1469,7 @@ static const struct malone_scode_handler scode_handlers[] = {
+ },
+ {
+ .pixelformat = V4L2_PIX_FMT_VC1_ANNEX_G,
++ .insert_scode_seq = vpu_malone_insert_scode_vc1_g_seq,
+ .insert_scode_pic = vpu_malone_insert_scode_vc1_g_pic,
+ },
+ {
+--
+2.39.2
+
--- /dev/null
+From 36529d36ab4d3330f6e5d12715ff22146ba99566 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Apr 2023 09:55:42 +0800
+Subject: media: amphion: drop repeated codec data for vc1l format
+
+From: Ming Qian <ming.qian@nxp.com>
+
+[ Upstream commit 668ee1a3a1870381225002c246972419b98e4253 ]
+
+For format V4L2_PIX_FMT_VC1_ANNEX_L,
+the codec data is replaced with startcode,
+and then driver drop it, otherwise it may led to decoding error.
+
+It's amphion vpu's limitation
+
+Driver has dropped the first codec data,
+but need to drop the repeated codec data too.
+
+Fixes: e670f5d672ef ("media: amphion: only insert the first sequence startcode for vc1l format")
+Signed-off-by: Ming Qian <ming.qian@nxp.com>
+Tested-by: xiahong.bao <xiahong.bao@nxp.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/amphion/vpu_malone.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/media/platform/amphion/vpu_malone.c b/drivers/media/platform/amphion/vpu_malone.c
+index ef44bff9fbaf6..e96994437429f 100644
+--- a/drivers/media/platform/amphion/vpu_malone.c
++++ b/drivers/media/platform/amphion/vpu_malone.c
+@@ -1344,6 +1344,8 @@ static int vpu_malone_insert_scode_vc1_l_seq(struct malone_scode_t *scode)
+ int size = 0;
+ u8 rcv_seqhdr[MALONE_VC1_RCV_SEQ_HEADER_LEN];
+
++ if (vpu_vb_is_codecconfig(to_vb2_v4l2_buffer(scode->vb)))
++ scode->need_data = 0;
+ if (scode->inst->total_input_count)
+ return 0;
+ scode->need_data = 0;
+--
+2.39.2
+
--- /dev/null
+From bb18fbefa49e0d47aab24af07c3f744dffc876ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 May 2023 16:47:35 +0800
+Subject: media: amphion: initiate a drain of the capture queue in dynamic
+ resolution change
+
+From: Ming Qian <ming.qian@nxp.com>
+
+[ Upstream commit 076b6289b2c12d76fab248659896682830fa7766 ]
+
+The last buffer from before the change must be marked
+with the V4L2_BUF_FLAG_LAST flag,
+similarly to the Drain sequence above.
+
+initiate a drain of the capture queue in dynamic resolution change
+
+Fixes: 6de8d628df6e ("media: amphion: add v4l2 m2m vpu decoder stateful driver")
+Signed-off-by: Ming Qian <ming.qian@nxp.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/amphion/vdec.c | 7 ++++---
+ drivers/media/platform/amphion/venc.c | 4 ++--
+ drivers/media/platform/amphion/vpu_v4l2.c | 5 +++--
+ drivers/media/platform/amphion/vpu_v4l2.h | 2 +-
+ 4 files changed, 10 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/media/platform/amphion/vdec.c b/drivers/media/platform/amphion/vdec.c
+index 3fa1a74a2e204..6515f3cdb7a74 100644
+--- a/drivers/media/platform/amphion/vdec.c
++++ b/drivers/media/platform/amphion/vdec.c
+@@ -279,6 +279,7 @@ static void vdec_handle_resolution_change(struct vpu_inst *inst)
+
+ vdec->source_change--;
+ vpu_notify_source_change(inst);
++ vpu_set_last_buffer_dequeued(inst, false);
+ }
+
+ static int vdec_update_state(struct vpu_inst *inst, enum vpu_codec_state state, u32 force)
+@@ -314,7 +315,7 @@ static void vdec_set_last_buffer_dequeued(struct vpu_inst *inst)
+ return;
+
+ if (vdec->eos_received) {
+- if (!vpu_set_last_buffer_dequeued(inst)) {
++ if (!vpu_set_last_buffer_dequeued(inst, true)) {
+ vdec->eos_received--;
+ vdec_update_state(inst, VPU_CODEC_STATE_DRAIN, 0);
+ }
+@@ -569,7 +570,7 @@ static int vdec_drain(struct vpu_inst *inst)
+ return 0;
+
+ if (!vdec->params.frame_count) {
+- vpu_set_last_buffer_dequeued(inst);
++ vpu_set_last_buffer_dequeued(inst, true);
+ return 0;
+ }
+
+@@ -608,7 +609,7 @@ static int vdec_cmd_stop(struct vpu_inst *inst)
+ vpu_trace(inst->dev, "[%d]\n", inst->id);
+
+ if (inst->state == VPU_CODEC_STATE_DEINIT) {
+- vpu_set_last_buffer_dequeued(inst);
++ vpu_set_last_buffer_dequeued(inst, true);
+ } else {
+ vdec->drain = 1;
+ vdec_drain(inst);
+diff --git a/drivers/media/platform/amphion/venc.c b/drivers/media/platform/amphion/venc.c
+index e6e8fe45fc7c3..58480e2755ec4 100644
+--- a/drivers/media/platform/amphion/venc.c
++++ b/drivers/media/platform/amphion/venc.c
+@@ -458,7 +458,7 @@ static int venc_encoder_cmd(struct file *file, void *fh, struct v4l2_encoder_cmd
+ vpu_inst_lock(inst);
+ if (cmd->cmd == V4L2_ENC_CMD_STOP) {
+ if (inst->state == VPU_CODEC_STATE_DEINIT)
+- vpu_set_last_buffer_dequeued(inst);
++ vpu_set_last_buffer_dequeued(inst, true);
+ else
+ venc_request_eos(inst);
+ }
+@@ -878,7 +878,7 @@ static void venc_set_last_buffer_dequeued(struct vpu_inst *inst)
+ struct venc_t *venc = inst->priv;
+
+ if (venc->stopped && list_empty(&venc->frames))
+- vpu_set_last_buffer_dequeued(inst);
++ vpu_set_last_buffer_dequeued(inst, true);
+ }
+
+ static void venc_stop_done(struct vpu_inst *inst)
+diff --git a/drivers/media/platform/amphion/vpu_v4l2.c b/drivers/media/platform/amphion/vpu_v4l2.c
+index 6773b885597ce..810e93d2c954a 100644
+--- a/drivers/media/platform/amphion/vpu_v4l2.c
++++ b/drivers/media/platform/amphion/vpu_v4l2.c
+@@ -100,7 +100,7 @@ int vpu_notify_source_change(struct vpu_inst *inst)
+ return 0;
+ }
+
+-int vpu_set_last_buffer_dequeued(struct vpu_inst *inst)
++int vpu_set_last_buffer_dequeued(struct vpu_inst *inst, bool eos)
+ {
+ struct vb2_queue *q;
+
+@@ -116,7 +116,8 @@ int vpu_set_last_buffer_dequeued(struct vpu_inst *inst)
+ vpu_trace(inst->dev, "last buffer dequeued\n");
+ q->last_buffer_dequeued = true;
+ wake_up(&q->done_wq);
+- vpu_notify_eos(inst);
++ if (eos)
++ vpu_notify_eos(inst);
+ return 0;
+ }
+
+diff --git a/drivers/media/platform/amphion/vpu_v4l2.h b/drivers/media/platform/amphion/vpu_v4l2.h
+index ef5de6b66e474..60f43056a7a28 100644
+--- a/drivers/media/platform/amphion/vpu_v4l2.h
++++ b/drivers/media/platform/amphion/vpu_v4l2.h
+@@ -27,7 +27,7 @@ struct vb2_v4l2_buffer *vpu_find_buf_by_idx(struct vpu_inst *inst, u32 type, u32
+ void vpu_v4l2_set_error(struct vpu_inst *inst);
+ int vpu_notify_eos(struct vpu_inst *inst);
+ int vpu_notify_source_change(struct vpu_inst *inst);
+-int vpu_set_last_buffer_dequeued(struct vpu_inst *inst);
++int vpu_set_last_buffer_dequeued(struct vpu_inst *inst, bool eos);
+ void vpu_vb2_buffers_return(struct vpu_inst *inst, unsigned int type, enum vb2_buffer_state state);
+ int vpu_get_num_buffers(struct vpu_inst *inst, u32 type);
+ bool vpu_is_source_empty(struct vpu_inst *inst);
+--
+2.39.2
+
--- /dev/null
+From b222ff15bc9cc3fed15a79517624f773f71cb9d2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 May 2023 15:15:07 +0100
+Subject: media: atomisp: gc0310: Fix double free in gc0310_remove()
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 2746a966f9f05fdb0727f4e1e8f2d51ec79e071d ]
+
+gc0310_remove() must not call kfree(dev) since the gc0310_device struct
+is devm managed so explicitly freeing it causes a double free.
+
+While at it add a missing mutex_destroy() call for the input_lock.
+
+Link: https://lore.kernel.org/r/20230518153214.194976-6-hdegoede@redhat.com
+
+Fixes: 340b4dd6c183 ("media: atomisp: gc0310: Use devm_kzalloc() for data struct")
+Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/atomisp/i2c/atomisp-gc0310.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/staging/media/atomisp/i2c/atomisp-gc0310.c b/drivers/staging/media/atomisp/i2c/atomisp-gc0310.c
+index 273155308fe36..eb6db1571dc0d 100644
+--- a/drivers/staging/media/atomisp/i2c/atomisp-gc0310.c
++++ b/drivers/staging/media/atomisp/i2c/atomisp-gc0310.c
+@@ -377,8 +377,8 @@ static void gc0310_remove(struct i2c_client *client)
+ v4l2_device_unregister_subdev(sd);
+ media_entity_cleanup(&dev->sd.entity);
+ v4l2_ctrl_handler_free(&dev->ctrls.handler);
++ mutex_destroy(&dev->input_lock);
+ pm_runtime_disable(&client->dev);
+- kfree(dev);
+ }
+
+ static int gc0310_probe(struct i2c_client *client)
+--
+2.39.2
+
--- /dev/null
+From 0de3fcfb57cdceee0e7eb1f817637a5fa74dc223 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 May 2023 12:53:23 +0100
+Subject: media: atomisp: gmin_platform: fix out_len in
+ gmin_get_config_dsm_var()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit 1657f2934daf89e8d9fa4b2697008909eb22c73e ]
+
+Ideally, strlen(cur->string.pointer) and strlen(out) would be the same.
+But this code is using strscpy() to avoid a potential buffer overflow.
+So in the same way we should take the strlen() of the smaller string to
+avoid a buffer overflow in the caller, gmin_get_var_int().
+
+Link: https://lore.kernel.org/r/26124bcd-8132-4483-9d67-225c87d424e8@kili.mountain
+
+Fixes: 387041cda44e ("media: atomisp: improve sensor detection code to use _DSM table")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c b/drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c
+index c718a74ea70a3..88d4499233b98 100644
+--- a/drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c
++++ b/drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c
+@@ -1357,7 +1357,7 @@ static int gmin_get_config_dsm_var(struct device *dev,
+ dev_info(dev, "found _DSM entry for '%s': %s\n", var,
+ cur->string.pointer);
+ strscpy(out, cur->string.pointer, *out_len);
+- *out_len = strlen(cur->string.pointer);
++ *out_len = strlen(out);
+
+ ACPI_FREE(obj);
+ return 0;
+--
+2.39.2
+
--- /dev/null
+From 603463f6ef2aec61121ebe143d96de41745361c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 4 Jun 2023 17:14:03 +0100
+Subject: media: atomisp: ov2680: Stop using half pixelclock for binned modes
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 7d45a432251a30ed0252655177e708229b163291 ]
+
+Stop using half pixelclock for binned modes this fixes:
+1. The exposure being twice as high for binned mods (due to the half clk)
+2. The framerate being 15 fps instead of 30 fps
+
+The original code with fixed per mode register lists did use half pixel
+clk, but this should be combined with using half for the VTS value too.
+
+Using half VTS fixes the framerate issue, but this has the undesired
+side-effect of change the exposure ctrl range (half the range, double
+the amount of exposure per step).
+
+Link: https://lore.kernel.org/r/20230604161406.69369-3-hdegoede@redhat.com
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/atomisp/i2c/atomisp-ov2680.c | 8 +-------
+ drivers/staging/media/atomisp/i2c/ov2680.h | 1 +
+ 2 files changed, 2 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/staging/media/atomisp/i2c/atomisp-ov2680.c b/drivers/staging/media/atomisp/i2c/atomisp-ov2680.c
+index c079368019e87..3a6bc3e56b10e 100644
+--- a/drivers/staging/media/atomisp/i2c/atomisp-ov2680.c
++++ b/drivers/staging/media/atomisp/i2c/atomisp-ov2680.c
+@@ -239,27 +239,21 @@ static void ov2680_calc_mode(struct ov2680_device *sensor, int width, int height
+ static int ov2680_set_mode(struct ov2680_device *sensor)
+ {
+ struct i2c_client *client = sensor->client;
+- u8 pll_div, unknown, inc, fmt1, fmt2;
++ u8 unknown, inc, fmt1, fmt2;
+ int ret;
+
+ if (sensor->mode.binning) {
+- pll_div = 1;
+ unknown = 0x23;
+ inc = 0x31;
+ fmt1 = 0xc2;
+ fmt2 = 0x01;
+ } else {
+- pll_div = 0;
+ unknown = 0x21;
+ inc = 0x11;
+ fmt1 = 0xc0;
+ fmt2 = 0x00;
+ }
+
+- ret = ov_write_reg8(client, 0x3086, pll_div);
+- if (ret)
+- return ret;
+-
+ ret = ov_write_reg8(client, 0x370a, unknown);
+ if (ret)
+ return ret;
+diff --git a/drivers/staging/media/atomisp/i2c/ov2680.h b/drivers/staging/media/atomisp/i2c/ov2680.h
+index baf49eb0659e3..eed18d6943370 100644
+--- a/drivers/staging/media/atomisp/i2c/ov2680.h
++++ b/drivers/staging/media/atomisp/i2c/ov2680.h
+@@ -172,6 +172,7 @@ static struct ov2680_reg const ov2680_global_setting[] = {
+ {0x3082, 0x45},
+ {0x3084, 0x09},
+ {0x3085, 0x04},
++ {0x3086, 0x00},
+ {0x3503, 0x03},
+ {0x350b, 0x36},
+ {0x3600, 0xb4},
+--
+2.39.2
+
--- /dev/null
+From ecfef0e6e3ee602bdd579054471581996bfab452 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Jun 2023 04:54:35 +0200
+Subject: media: cec: i2c: ch7322: also select REGMAP
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 29f96ac23648b2259f42d40703c47dd18fd172ca ]
+
+Selecting only REGMAP_I2C can leave REGMAP unset, causing build errors,
+so also select REGMAP to prevent the build errors.
+
+../drivers/media/cec/i2c/ch7322.c:158:21: error: variable 'ch7322_regmap' has initializer but incomplete type
+ 158 | static const struct regmap_config ch7322_regmap = {
+../drivers/media/cec/i2c/ch7322.c:159:10: error: 'const struct regmap_config' has no member named 'reg_bits'
+ 159 | .reg_bits = 8,
+../drivers/media/cec/i2c/ch7322.c:159:21: warning: excess elements in struct initializer
+ 159 | .reg_bits = 8,
+../drivers/media/cec/i2c/ch7322.c:160:10: error: 'const struct regmap_config' has no member named 'val_bits'
+ 160 | .val_bits = 8,
+../drivers/media/cec/i2c/ch7322.c:160:21: warning: excess elements in struct initializer
+ 160 | .val_bits = 8,
+../drivers/media/cec/i2c/ch7322.c:161:10: error: 'const struct regmap_config' has no member named 'max_register'
+ 161 | .max_register = 0x7f,
+../drivers/media/cec/i2c/ch7322.c:161:25: warning: excess elements in struct initializer
+ 161 | .max_register = 0x7f,
+../drivers/media/cec/i2c/ch7322.c:162:10: error: 'const struct regmap_config' has no member named 'disable_locking'
+ 162 | .disable_locking = true,
+../drivers/media/cec/i2c/ch7322.c:162:28: warning: excess elements in struct initializer
+ 162 | .disable_locking = true,
+../drivers/media/cec/i2c/ch7322.c: In function 'ch7322_probe':
+../drivers/media/cec/i2c/ch7322.c:468:26: error: implicit declaration of function 'devm_regmap_init_i2c' [-Werror=implicit-function-declaration]
+ 468 | ch7322->regmap = devm_regmap_init_i2c(client, &ch7322_regmap);
+../drivers/media/cec/i2c/ch7322.c:468:24: warning: assignment to 'struct regmap *' from 'int' makes pointer from integer without a cast [-Wint-conversion]
+ 468 | ch7322->regmap = devm_regmap_init_i2c(client, &ch7322_regmap);
+../drivers/media/cec/i2c/ch7322.c: At top level:
+../drivers/media/cec/i2c/ch7322.c:158:35: error: storage size of 'ch7322_regmap' isn't known
+ 158 | static const struct regmap_config ch7322_regmap = {
+
+Link: https://lore.kernel.org/linux-media/20230608025435.29249-1-rdunlap@infradead.org
+Fixes: 21b9a47e0ec7 ("media: cec: i2c: ch7322: Add ch7322 CEC controller driver")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Cc: Jeff Chase <jnchase@google.com>
+Cc: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Cc: Joe Tessler <jrt@google.com>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Cc: Mark Brown <broonie@kernel.org>
+Cc: Masahiro Yamada <masahiroy@kernel.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/cec/i2c/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/media/cec/i2c/Kconfig b/drivers/media/cec/i2c/Kconfig
+index 70432a1d69186..d912d143fb312 100644
+--- a/drivers/media/cec/i2c/Kconfig
++++ b/drivers/media/cec/i2c/Kconfig
+@@ -5,6 +5,7 @@
+ config CEC_CH7322
+ tristate "Chrontel CH7322 CEC controller"
+ depends on I2C
++ select REGMAP
+ select REGMAP_I2C
+ select CEC_CORE
+ help
+--
+2.39.2
+
--- /dev/null
+From 7f315906f2734741e941c6f6703a9d4708d41b82 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Apr 2023 15:25:46 +0200
+Subject: media: common: saa7146: Avoid a leak in vmalloc_to_sg()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit b2aa8ac6f97e26d788948fb60dcc5625c9633f4e ]
+
+Commit in Fixes turned a BUG() into a "normal" memory allocation failure.
+While at it, it introduced a memory leak.
+So fix it.
+
+Also update the comment on top of the function to reflect what has been
+change by the commit in Fixes.
+
+Fixes: 40e986c99624 ("media: common: saa7146: replace BUG_ON by WARN_ON")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/common/saa7146/saa7146_core.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/media/common/saa7146/saa7146_core.c b/drivers/media/common/saa7146/saa7146_core.c
+index bcb957883044c..27c53eed8fe39 100644
+--- a/drivers/media/common/saa7146/saa7146_core.c
++++ b/drivers/media/common/saa7146/saa7146_core.c
+@@ -133,8 +133,8 @@ int saa7146_wait_for_debi_done(struct saa7146_dev *dev, int nobusyloop)
+ ****************************************************************************/
+
+ /* this is videobuf_vmalloc_to_sg() from videobuf-dma-sg.c
+- make sure virt has been allocated with vmalloc_32(), otherwise the BUG()
+- may be triggered on highmem machines */
++ make sure virt has been allocated with vmalloc_32(), otherwise return NULL
++ on highmem machines */
+ static struct scatterlist* vmalloc_to_sg(unsigned char *virt, int nr_pages)
+ {
+ struct scatterlist *sglist;
+@@ -150,7 +150,7 @@ static struct scatterlist* vmalloc_to_sg(unsigned char *virt, int nr_pages)
+ if (NULL == pg)
+ goto err;
+ if (WARN_ON(PageHighMem(pg)))
+- return NULL;
++ goto err;
+ sg_set_page(&sglist[i], pg, PAGE_SIZE, 0);
+ }
+ return sglist;
+--
+2.39.2
+
--- /dev/null
+From cca6eefeb42b229a179cf84f85f93fb7185158f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Apr 2023 11:47:47 +0200
+Subject: media: hi846: fix usage of pm_runtime_get_if_in_use()
+
+From: Martin Kepplinger <martin.kepplinger@puri.sm>
+
+[ Upstream commit 04fc06f6dc1592ed5d675311ac50d8fba5db62ab ]
+
+pm_runtime_get_if_in_use() does not only return nonzero values when
+the device is in use, it can return a negative errno too.
+
+And especially during resuming from system suspend, when runtime pm
+is not yet up again, -EAGAIN is being returned, so the subsequent
+pm_runtime_put() call results in a refcount underflow.
+
+Fix system-resume by handling -EAGAIN of pm_runtime_get_if_in_use().
+
+Signed-off-by: Martin Kepplinger <martin.kepplinger@puri.sm>
+Fixes: e8c0882685f9 ("media: i2c: add driver for the SK Hynix Hi-846 8M pixel camera")
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/hi846.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/i2c/hi846.c b/drivers/media/i2c/hi846.c
+index 306dc35e925fd..f8709cdf28b39 100644
+--- a/drivers/media/i2c/hi846.c
++++ b/drivers/media/i2c/hi846.c
+@@ -1353,7 +1353,8 @@ static int hi846_set_ctrl(struct v4l2_ctrl *ctrl)
+ exposure_max);
+ }
+
+- if (!pm_runtime_get_if_in_use(&client->dev))
++ ret = pm_runtime_get_if_in_use(&client->dev);
++ if (!ret || ret == -EAGAIN)
+ return 0;
+
+ switch (ctrl->id) {
+--
+2.39.2
+
--- /dev/null
+From e5e549bbe242b6dc658466b4ba5ec6cd4b68044c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 May 2023 11:35:46 +0100
+Subject: media: i2c: Correct format propagation for st-mipid02
+
+From: Daniel Scally <dan.scally@ideasonboard.com>
+
+[ Upstream commit 306c3190b30d4d6a098888b9d7d4cefaa0ddcb91 ]
+
+Format propagation in the st-mipid02 driver is incorrect in that when
+setting format for V4L2_SUBDEV_FORMAT_TRY on the source pad, the
+_active_ rather than _try_ format from the sink pad is propagated.
+This causes problems with format negotiation - update the function to
+propagate the correct format.
+
+Fixes: 642bb5e88fed ("media: st-mipid02: MIPID02 CSI-2 to PARALLEL bridge driver")
+Signed-off-by: Daniel Scally <dan.scally@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/st-mipid02.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/i2c/st-mipid02.c b/drivers/media/i2c/st-mipid02.c
+index 31b89aff0e86a..f20f87562bf11 100644
+--- a/drivers/media/i2c/st-mipid02.c
++++ b/drivers/media/i2c/st-mipid02.c
+@@ -736,8 +736,13 @@ static void mipid02_set_fmt_source(struct v4l2_subdev *sd,
+ {
+ struct mipid02_dev *bridge = to_mipid02_dev(sd);
+
+- /* source pad mirror active sink pad */
+- format->format = bridge->fmt;
++ /* source pad mirror sink pad */
++ if (format->which == V4L2_SUBDEV_FORMAT_ACTIVE)
++ format->format = bridge->fmt;
++ else
++ format->format = *v4l2_subdev_get_try_format(sd, sd_state,
++ MIPID02_SINK_0);
++
+ /* but code may need to be converted */
+ format->format.code = serial_to_parallel_code(format->format.code);
+
+--
+2.39.2
+
--- /dev/null
+From a676c29a1bba2b6ff122fb6d372803eeea5c0c3e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Feb 2023 16:59:51 +0300
+Subject: media: i2c: imx296: fix error checking in imx296_read_temperature()
+
+From: Dan Carpenter <error27@gmail.com>
+
+[ Upstream commit 1b3565dbc6aa124f34674e3dcf6966f663817e05 ]
+
+The "& IMX296_TMDOUT_MASK" means that "tmdout" can't be negative so the
+error checking will not work.
+
+Fixes: cb33db2b6ccf ("media: i2c: IMX296 camera sensor driver")
+Signed-off-by: Dan Carpenter <error27@gmail.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/imx296.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/i2c/imx296.c b/drivers/media/i2c/imx296.c
+index 4f22c0515ef8d..c3d6d52fc7727 100644
+--- a/drivers/media/i2c/imx296.c
++++ b/drivers/media/i2c/imx296.c
+@@ -922,10 +922,12 @@ static int imx296_read_temperature(struct imx296 *sensor, int *temp)
+ if (ret < 0)
+ return ret;
+
+- tmdout = imx296_read(sensor, IMX296_TMDOUT) & IMX296_TMDOUT_MASK;
++ tmdout = imx296_read(sensor, IMX296_TMDOUT);
+ if (tmdout < 0)
+ return tmdout;
+
++ tmdout &= IMX296_TMDOUT_MASK;
++
+ /* T(°C) = 246.312 - 0.304 * TMDOUT */;
+ *temp = 246312 - 304 * tmdout;
+
+--
+2.39.2
+
--- /dev/null
+From 38efb255732055b943916ac5b3f6453c56584b85 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 May 2023 02:40:07 +0100
+Subject: media: mediatek: vcodec: using decoder status instead of core work
+ count
+
+From: Yunfei Dong <yunfei.dong@mediatek.com>
+
+[ Upstream commit 2864e304faec04c2674328aad0e820a9cd84cdec ]
+
+Adding the definition of decoder status to separate different decoder
+period for core hardware.
+
+core_work_cnt is the number of core work queued to work queue, the control
+is very complex, leading to some unreasonable test result.
+
+Using parameter status to indicate whether queue core work to work queue.
+
+Fixes: 2e0ef56d81cb ("media: mediatek: vcodec: making sure queue_work successfully")
+Signed-off-by: Yunfei Dong <yunfei.dong@mediatek.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../platform/mediatek/vcodec/vdec_msg_queue.c | 33 ++++++++-----------
+ .../platform/mediatek/vcodec/vdec_msg_queue.h | 16 +++++++--
+ 2 files changed, 28 insertions(+), 21 deletions(-)
+
+diff --git a/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c b/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c
+index f3073d1e7f420..03f8d7cd8eddc 100644
+--- a/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c
++++ b/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c
+@@ -71,7 +71,6 @@ static void vdec_msg_queue_dec(struct vdec_msg_queue *msg_queue, int hardware_in
+ int vdec_msg_queue_qbuf(struct vdec_msg_queue_ctx *msg_ctx, struct vdec_lat_buf *buf)
+ {
+ struct list_head *head;
+- int status;
+
+ head = vdec_get_buf_list(msg_ctx->hardware_index, buf);
+ if (!head) {
+@@ -87,12 +86,9 @@ int vdec_msg_queue_qbuf(struct vdec_msg_queue_ctx *msg_ctx, struct vdec_lat_buf
+ if (msg_ctx->hardware_index != MTK_VDEC_CORE) {
+ wake_up_all(&msg_ctx->ready_to_use);
+ } else {
+- if (buf->ctx->msg_queue.core_work_cnt <
+- atomic_read(&buf->ctx->msg_queue.core_list_cnt)) {
+- status = queue_work(buf->ctx->dev->core_workqueue,
+- &buf->ctx->msg_queue.core_work);
+- if (status)
+- buf->ctx->msg_queue.core_work_cnt++;
++ if (!(buf->ctx->msg_queue.status & CONTEXT_LIST_QUEUED)) {
++ queue_work(buf->ctx->dev->core_workqueue, &buf->ctx->msg_queue.core_work);
++ buf->ctx->msg_queue.status |= CONTEXT_LIST_QUEUED;
+ }
+ }
+
+@@ -261,7 +257,10 @@ static void vdec_msg_queue_core_work(struct work_struct *work)
+ container_of(msg_queue, struct mtk_vcodec_ctx, msg_queue);
+ struct mtk_vcodec_dev *dev = ctx->dev;
+ struct vdec_lat_buf *lat_buf;
+- int status;
++
++ spin_lock(&ctx->dev->msg_queue_core_ctx.ready_lock);
++ ctx->msg_queue.status &= ~CONTEXT_LIST_QUEUED;
++ spin_unlock(&ctx->dev->msg_queue_core_ctx.ready_lock);
+
+ lat_buf = vdec_msg_queue_dqbuf(&dev->msg_queue_core_ctx);
+ if (!lat_buf)
+@@ -278,17 +277,13 @@ static void vdec_msg_queue_core_work(struct work_struct *work)
+ vdec_msg_queue_qbuf(&ctx->msg_queue.lat_ctx, lat_buf);
+
+ wake_up_all(&ctx->msg_queue.core_dec_done);
+- spin_lock(&dev->msg_queue_core_ctx.ready_lock);
+- lat_buf->ctx->msg_queue.core_work_cnt--;
+-
+- if (lat_buf->ctx->msg_queue.core_work_cnt <
+- atomic_read(&lat_buf->ctx->msg_queue.core_list_cnt)) {
+- status = queue_work(lat_buf->ctx->dev->core_workqueue,
+- &lat_buf->ctx->msg_queue.core_work);
+- if (status)
+- lat_buf->ctx->msg_queue.core_work_cnt++;
++ if (!(ctx->msg_queue.status & CONTEXT_LIST_QUEUED) &&
++ atomic_read(&msg_queue->core_list_cnt)) {
++ spin_lock(&ctx->dev->msg_queue_core_ctx.ready_lock);
++ ctx->msg_queue.status |= CONTEXT_LIST_QUEUED;
++ spin_unlock(&ctx->dev->msg_queue_core_ctx.ready_lock);
++ queue_work(ctx->dev->core_workqueue, &msg_queue->core_work);
+ }
+- spin_unlock(&dev->msg_queue_core_ctx.ready_lock);
+ }
+
+ int vdec_msg_queue_init(struct vdec_msg_queue *msg_queue,
+@@ -303,13 +298,13 @@ int vdec_msg_queue_init(struct vdec_msg_queue *msg_queue,
+ return 0;
+
+ msg_queue->ctx = ctx;
+- msg_queue->core_work_cnt = 0;
+ vdec_msg_queue_init_ctx(&msg_queue->lat_ctx, MTK_VDEC_LAT0);
+ INIT_WORK(&msg_queue->core_work, vdec_msg_queue_core_work);
+
+ atomic_set(&msg_queue->lat_list_cnt, 0);
+ atomic_set(&msg_queue->core_list_cnt, 0);
+ init_waitqueue_head(&msg_queue->core_dec_done);
++ msg_queue->status = CONTEXT_LIST_EMPTY;
+
+ msg_queue->wdma_addr.size =
+ vde_msg_queue_get_trans_size(ctx->picinfo.buf_w,
+diff --git a/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.h b/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.h
+index a5d44bc97c16b..8f82d14847726 100644
+--- a/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.h
++++ b/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.h
+@@ -21,6 +21,18 @@ struct mtk_vcodec_ctx;
+ struct mtk_vcodec_dev;
+ typedef int (*core_decode_cb_t)(struct vdec_lat_buf *lat_buf);
+
++/**
++ * enum core_ctx_status - Context decode status for core hardwre.
++ * @CONTEXT_LIST_EMPTY: No buffer queued on core hardware(must always be 0)
++ * @CONTEXT_LIST_QUEUED: Buffer queued to core work list
++ * @CONTEXT_LIST_DEC_DONE: context decode done
++ */
++enum core_ctx_status {
++ CONTEXT_LIST_EMPTY = 0,
++ CONTEXT_LIST_QUEUED,
++ CONTEXT_LIST_DEC_DONE,
++};
++
+ /**
+ * struct vdec_msg_queue_ctx - represents a queue for buffers ready to be processed
+ * @ready_to_use: ready used queue used to signalize when get a job queue
+@@ -77,7 +89,7 @@ struct vdec_lat_buf {
+ * @lat_list_cnt: used to record each instance lat list count
+ * @core_list_cnt: used to record each instance core list count
+ * @core_dec_done: core work queue decode done event
+- * @core_work_cnt: the number of core work in work queue
++ * @status: current context decode status for core hardware
+ */
+ struct vdec_msg_queue {
+ struct vdec_lat_buf lat_buf[NUM_BUFFER_COUNT];
+@@ -93,7 +105,7 @@ struct vdec_msg_queue {
+ atomic_t lat_list_cnt;
+ atomic_t core_list_cnt;
+ wait_queue_head_t core_dec_done;
+- int core_work_cnt;
++ int status;
+ };
+
+ /**
+--
+2.39.2
+
--- /dev/null
+From 667e6a4ffcc5c36f43f19cbde503c1116159e4bf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Apr 2023 12:18:24 +0200
+Subject: media: renesas: fdp1: Identify R-Car Gen2 versions
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 59a95979638664a905cd46845e7cac1b3ff942f7 ]
+
+On R-Car M2-W:
+
+ rcar_fdp1 fe940000.fdp1: FDP1 Unidentifiable (0x02010101)
+ rcar_fdp1 fe944000.fdp1: FDP1 Unidentifiable (0x02010101)
+
+Although the IP Internal Data Register on R-Car Gen2 is documented to
+contain all zeros, the actual register contents seem to match the FDP1
+version ID of R-Car H3 ES1.*, which has just been removed.
+Fortunately this version is not used for any other purposes yet.
+
+Fix this by re-adding the ID, now using an R-Car Gen2-specific name.
+
+Fixes: af4273b43f2b ("media: renesas: fdp1: remove R-Car H3 ES1.* handling")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Reviewed-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/renesas/rcar_fdp1.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/media/platform/renesas/rcar_fdp1.c b/drivers/media/platform/renesas/rcar_fdp1.c
+index f43e458590b8c..ab39cd2201c85 100644
+--- a/drivers/media/platform/renesas/rcar_fdp1.c
++++ b/drivers/media/platform/renesas/rcar_fdp1.c
+@@ -254,6 +254,8 @@ MODULE_PARM_DESC(debug, "activate debug info");
+
+ /* Internal Data (HW Version) */
+ #define FD1_IP_INTDATA 0x0800
++/* R-Car Gen2 HW manual says zero, but actual value matches R-Car H3 ES1.x */
++#define FD1_IP_GEN2 0x02010101
+ #define FD1_IP_M3W 0x02010202
+ #define FD1_IP_H3 0x02010203
+ #define FD1_IP_M3N 0x02010204
+@@ -2360,6 +2362,9 @@ static int fdp1_probe(struct platform_device *pdev)
+
+ hw_version = fdp1_read(fdp1, FD1_IP_INTDATA);
+ switch (hw_version) {
++ case FD1_IP_GEN2:
++ dprintk(fdp1, "FDP1 Version R-Car Gen2\n");
++ break;
+ case FD1_IP_M3W:
+ dprintk(fdp1, "FDP1 Version R-Car M3-W\n");
+ break;
+--
+2.39.2
+
--- /dev/null
+From f2de585287ec030ed0e8779ad8ddf0b2522f4667 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jun 2023 17:23:09 +0200
+Subject: media: tc358746: select CONFIG_GENERIC_PHY
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 582d4ad468cbc6ef2db4689ff3bd5868d95402c9 ]
+
+The tc358746 driver selects CONFIG_GENERIC_PHY_MIPI_DPHY and links to
+that, but this fails when CONFIG_GENERIC_PHY is disabled, because Kbuild
+then never enters the drivers/phy directory for building object files:
+
+ERROR: modpost: "phy_mipi_dphy_get_default_config_for_hsclk" [drivers/media/i2c/tc358746.ko] undefined!
+
+Add an explicit 'select GENERIC_PHY' here to ensure that the directory
+is entered, and add another dependency on that symbol so make it
+more obvious what is going on if another driver has the same problem,
+as this will produce a Kconfig warning.
+
+Link: https://lore.kernel.org/linux-media/20230623152318.2276816-1-arnd@kernel.org
+Fixes: 80a21da360516 ("media: tc358746: add Toshiba TC358746 Parallel to CSI-2 bridge driver")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Marco Felsch <m.felsch@pengutronix.de>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/Kconfig | 1 +
+ drivers/phy/Kconfig | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/drivers/media/i2c/Kconfig b/drivers/media/i2c/Kconfig
+index 256d55bb2b1da..76d1ee3cc1bab 100644
+--- a/drivers/media/i2c/Kconfig
++++ b/drivers/media/i2c/Kconfig
+@@ -1292,6 +1292,7 @@ config VIDEO_TC358746
+ select VIDEO_V4L2_SUBDEV_API
+ select MEDIA_CONTROLLER
+ select V4L2_FWNODE
++ select GENERIC_PHY
+ select GENERIC_PHY_MIPI_DPHY
+ select REGMAP_I2C
+ help
+diff --git a/drivers/phy/Kconfig b/drivers/phy/Kconfig
+index f46e3148d286d..8dba9596408f2 100644
+--- a/drivers/phy/Kconfig
++++ b/drivers/phy/Kconfig
+@@ -18,6 +18,7 @@ config GENERIC_PHY
+
+ config GENERIC_PHY_MIPI_DPHY
+ bool
++ depends on GENERIC_PHY
+ help
+ Generic MIPI D-PHY support.
+
+--
+2.39.2
+
--- /dev/null
+From a46a350e84854c68ad12f76584226e7c1bb84f4e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Mar 2023 10:04:49 -0700
+Subject: media: usb: Check az6007_read() return value
+
+From: Daniil Dulov <d.dulov@aladdin.ru>
+
+[ Upstream commit fdaca63186f59fc664b346c45b76576624b48e57 ]
+
+If az6007_read() returns error, there is no sence to continue.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: 3af2f4f15a61 ("[media] az6007: Change the az6007 read/write routine parameter")
+Signed-off-by: Daniil Dulov <d.dulov@aladdin.ru>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/dvb-usb-v2/az6007.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/usb/dvb-usb-v2/az6007.c b/drivers/media/usb/dvb-usb-v2/az6007.c
+index 62ee09f28a0bc..7524c90f5da61 100644
+--- a/drivers/media/usb/dvb-usb-v2/az6007.c
++++ b/drivers/media/usb/dvb-usb-v2/az6007.c
+@@ -202,7 +202,8 @@ static int az6007_rc_query(struct dvb_usb_device *d)
+ unsigned code;
+ enum rc_proto proto;
+
+- az6007_read(d, AZ6007_READ_IR, 0, 0, st->data, 10);
++ if (az6007_read(d, AZ6007_READ_IR, 0, 0, st->data, 10) < 0)
++ return -EIO;
+
+ if (st->data[1] == 0x44)
+ return 0;
+--
+2.39.2
+
--- /dev/null
+From 4421ee976d62cb4f78d765f61f981e8771dcfc32 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 May 2023 07:59:32 +0800
+Subject: media: usb: siano: Fix warning due to null work_func_t function
+ pointer
+
+From: Duoming Zhou <duoming@zju.edu.cn>
+
+[ Upstream commit 6f489a966fbeb0da63d45c2c66a8957eab604bf6 ]
+
+The previous commit ebad8e731c1c ("media: usb: siano: Fix use after
+free bugs caused by do_submit_urb") adds cancel_work_sync() in
+smsusb_stop_streaming(). But smsusb_stop_streaming() may be called,
+even if the work_struct surb->wq has not been initialized. As a result,
+the warning will occur. One of the processes that could lead to warning
+is shown below:
+
+smsusb_probe()
+ smsusb_init_device()
+ if (!dev->in_ep || !dev->out_ep || align < 0) {
+ smsusb_term_device(intf);
+ smsusb_stop_streaming()
+ cancel_work_sync(&dev->surbs[i].wq);
+ __cancel_work_timer()
+ __flush_work()
+ if (WARN_ON(!work->func)) // work->func is null
+
+The log reported by syzbot is shown below:
+
+WARNING: CPU: 0 PID: 897 at kernel/workqueue.c:3066 __flush_work+0x798/0xa80 kernel/workqueue.c:3063
+Modules linked in:
+CPU: 0 PID: 897 Comm: kworker/0:2 Not tainted 6.2.0-rc1-syzkaller #0
+RIP: 0010:__flush_work+0x798/0xa80 kernel/workqueue.c:3066
+...
+RSP: 0018:ffffc9000464ebf8 EFLAGS: 00010246
+RAX: 1ffff11002dbb420 RBX: 0000000000000021 RCX: 1ffffffff204fa4e
+RDX: dffffc0000000000 RSI: 0000000000000001 RDI: ffff888016dda0e8
+RBP: ffffc9000464ed98 R08: 0000000000000001 R09: ffffffff90253b2f
+R10: 0000000000000001 R11: 0000000000000000 R12: ffff888016dda0e8
+R13: ffff888016dda0e8 R14: ffff888016dda100 R15: 0000000000000001
+FS: 0000000000000000(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 00007ffd4331efe8 CR3: 000000000b48e000 CR4: 00000000003506f0
+DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+Call Trace:
+ <TASK>
+ __cancel_work_timer+0x315/0x460 kernel/workqueue.c:3160
+ smsusb_stop_streaming drivers/media/usb/siano/smsusb.c:182 [inline]
+ smsusb_term_device+0xda/0x2d0 drivers/media/usb/siano/smsusb.c:344
+ smsusb_init_device+0x400/0x9ce drivers/media/usb/siano/smsusb.c:419
+ smsusb_probe+0xbbd/0xc55 drivers/media/usb/siano/smsusb.c:567
+...
+
+This patch adds check before cancel_work_sync(). If surb->wq has not
+been initialized, the cancel_work_sync() will not be executed.
+
+Reported-by: syzbot+27b0b464864741b18b99@syzkaller.appspotmail.com
+Fixes: ebad8e731c1c ("media: usb: siano: Fix use after free bugs caused by do_submit_urb")
+Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/siano/smsusb.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/usb/siano/smsusb.c b/drivers/media/usb/siano/smsusb.c
+index 6f443c542c6da..640737d3b8aeb 100644
+--- a/drivers/media/usb/siano/smsusb.c
++++ b/drivers/media/usb/siano/smsusb.c
+@@ -179,7 +179,8 @@ static void smsusb_stop_streaming(struct smsusb_device_t *dev)
+
+ for (i = 0; i < MAX_URBS; i++) {
+ usb_kill_urb(&dev->surbs[i].urb);
+- cancel_work_sync(&dev->surbs[i].wq);
++ if (dev->surbs[i].wq.func)
++ cancel_work_sync(&dev->surbs[i].wq);
+
+ if (dev->surbs[i].cb) {
+ smscore_putbuffer(dev->coredev, dev->surbs[i].cb);
+--
+2.39.2
+
--- /dev/null
+From 4c2da866995863c6f08f579cf8ab98ac39a7bb35 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 12 Sep 2020 20:03:01 +0100
+Subject: media: venus: helpers: Fix ALIGN() of non power of two
+
+From: Rikard Falkeborn <rikard.falkeborn@gmail.com>
+
+[ Upstream commit 927e78ac8bc58155316cf6f46026e1912bbbbcfc ]
+
+ALIGN() expects its second argument to be a power of 2, otherwise
+incorrect results are produced for some inputs. The output can be
+both larger or smaller than what is expected.
+
+For example, ALIGN(304, 192) equals 320 instead of 384, and
+ALIGN(65, 192) equals 256 instead of 192.
+
+However, nestling two ALIGN() as is done in this case seem to only
+produce results equal to or bigger than the expected result if ALIGN()
+had handled non powers of two, and that in turn results in framesizes
+that are either the correct size or too large.
+
+Fortunately, since 192 * 4 / 3 equals 256, it turns out that one ALIGN()
+is sufficient.
+
+Fixes: ab1eda449c6e ("media: venus: vdec: handle 10bit bitstreams")
+Signed-off-by: Rikard Falkeborn <rikard.falkeborn@gmail.com>
+Signed-off-by: Stanimir Varbanov <stanimir.k.varbanov@gmail.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/qcom/venus/helpers.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/platform/qcom/venus/helpers.c b/drivers/media/platform/qcom/venus/helpers.c
+index a2ceab7f9ddbf..a68389b0aae0a 100644
+--- a/drivers/media/platform/qcom/venus/helpers.c
++++ b/drivers/media/platform/qcom/venus/helpers.c
+@@ -1036,8 +1036,8 @@ static u32 get_framesize_raw_yuv420_tp10_ubwc(u32 width, u32 height)
+ u32 extradata = SZ_16K;
+ u32 size;
+
+- y_stride = ALIGN(ALIGN(width, 192) * 4 / 3, 256);
+- uv_stride = ALIGN(ALIGN(width, 192) * 4 / 3, 256);
++ y_stride = ALIGN(width * 4 / 3, 256);
++ uv_stride = ALIGN(width * 4 / 3, 256);
+ y_sclines = ALIGN(height, 16);
+ uv_sclines = ALIGN((height + 1) >> 1, 16);
+
+--
+2.39.2
+
--- /dev/null
+From 7d385bdc0348136f9b95140c9746f0b63f724f5a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 May 2023 16:57:06 +0200
+Subject: media: videodev2.h: Fix p_s32 and p_s64 pointer types
+
+From: Daniel Lundberg Pedersen <dlp@qtec.com>
+
+[ Upstream commit 3f6375a2d1956739c6c8ffa3a862c9278d346940 ]
+
+Use the intended pointer types for p_s32 and p_64 in the union of the
+struct v4l2_ext_control.
+
+Fixes: e77eb66342c7 ("videodev2.h: add p_s32 and p_s64 pointers")
+Signed-off-by: Daniel Lundberg Pedersen <dlp@qtec.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/uapi/linux/videodev2.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/include/uapi/linux/videodev2.h b/include/uapi/linux/videodev2.h
+index aee75eb9e6863..9e7cf1d369456 100644
+--- a/include/uapi/linux/videodev2.h
++++ b/include/uapi/linux/videodev2.h
+@@ -1807,8 +1807,8 @@ struct v4l2_ext_control {
+ __u8 __user *p_u8;
+ __u16 __user *p_u16;
+ __u32 __user *p_u32;
+- __u32 __user *p_s32;
+- __u32 __user *p_s64;
++ __s32 __user *p_s32;
++ __s64 __user *p_s64;
+ struct v4l2_area __user *p_area;
+ struct v4l2_ctrl_h264_sps __user *p_h264_sps;
+ struct v4l2_ctrl_h264_pps *p_h264_pps;
+--
+2.39.2
+
--- /dev/null
+From 3ea3e5a76876706cd1dc57ee4201c63ac4b4d66c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 May 2023 15:36:49 +0200
+Subject: media: videodev2.h: Fix struct v4l2_input tuner index comment
+
+From: Marek Vasut <marex@denx.de>
+
+[ Upstream commit 26ae58f65e64fa7ba61d64bae752e59e08380c6a ]
+
+VIDIOC_ENUMINPUT documentation describes the tuner field of
+struct v4l2_input as index:
+
+Documentation/userspace-api/media/v4l/vidioc-enuminput.rst
+"
+* - __u32
+ - ``tuner``
+ - Capture devices can have zero or more tuners (RF demodulators).
+ When the ``type`` is set to ``V4L2_INPUT_TYPE_TUNER`` this is an
+ RF connector and this field identifies the tuner. It corresponds
+ to struct :c:type:`v4l2_tuner` field ``index``. For
+ details on tuners see :ref:`tuner`.
+"
+
+Drivers I could find also use the 'tuner' field as an index, e.g.:
+drivers/media/pci/bt8xx/bttv-driver.c bttv_enum_input()
+drivers/media/usb/go7007/go7007-v4l2.c vidioc_enum_input()
+
+However, the UAPI comment claims this field is 'enum v4l2_tuner_type':
+include/uapi/linux/videodev2.h
+
+This field being 'enum v4l2_tuner_type' is unlikely as it seems to be
+never used that way in drivers, and documentation confirms it. It seem
+this comment got in accidentally in the commit which this patch fixes.
+Fix the UAPI comment to stop confusion.
+
+This was pointed out by Dmitry while reviewing VIDIOC_ENUMINPUT
+support for strace.
+
+Fixes: 6016af82eafc ("[media] v4l2: use __u32 rather than enums in ioctl() structs")
+Signed-off-by: Marek Vasut <marex@denx.de>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/uapi/linux/videodev2.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/uapi/linux/videodev2.h b/include/uapi/linux/videodev2.h
+index 9e7cf1d369456..5d8bd754c69f1 100644
+--- a/include/uapi/linux/videodev2.h
++++ b/include/uapi/linux/videodev2.h
+@@ -1720,7 +1720,7 @@ struct v4l2_input {
+ __u8 name[32]; /* Label */
+ __u32 type; /* Type of input */
+ __u32 audioset; /* Associated audios (bitfield) */
+- __u32 tuner; /* enum v4l2_tuner_type */
++ __u32 tuner; /* Tuner index */
+ v4l2_std_id std;
+ __u32 status;
+ __u32 capabilities;
+--
+2.39.2
+
--- /dev/null
+From ef41a33d56b26587cd87e6dc107039348baeda52 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Jun 2023 09:48:18 +0800
+Subject: mfd: intel-lpss: Add missing check for platform_get_resource
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit d918e0d5824495a75d00b879118b098fcab36fdb ]
+
+Add the missing check for platform_get_resource and return error
+if it fails.
+
+Fixes: 4b45efe85263 ("mfd: Add support for Intel Sunrisepoint LPSS devices")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Signed-off-by: Lee Jones <lee@kernel.org>
+Link: https://lore.kernel.org/r/20230609014818.28475-1-jiasheng@iscas.ac.cn
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/intel-lpss-acpi.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/mfd/intel-lpss-acpi.c b/drivers/mfd/intel-lpss-acpi.c
+index a143c8dca2d93..212818aef93e2 100644
+--- a/drivers/mfd/intel-lpss-acpi.c
++++ b/drivers/mfd/intel-lpss-acpi.c
+@@ -183,6 +183,9 @@ static int intel_lpss_acpi_probe(struct platform_device *pdev)
+ return -ENOMEM;
+
+ info->mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++ if (!info->mem)
++ return -ENODEV;
++
+ info->irq = platform_get_irq(pdev, 0);
+
+ ret = intel_lpss_probe(&pdev->dev, info);
+--
+2.39.2
+
--- /dev/null
+From 57f2f93608352d23a9891b9cd73e6e23218d8d0b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 May 2023 22:57:10 +0200
+Subject: mfd: rt5033: Drop rt5033-battery sub-device
+
+From: Stephan Gerhold <stephan@gerhold.net>
+
+[ Upstream commit 43db1344e0f8c1eb687a1d6cd5b0de3009ab66cb ]
+
+The fuel gauge in the RT5033 PMIC (rt5033-battery) has its own I2C bus
+and interrupt lines. Therefore, it is not part of the MFD device
+and needs to be specified separately in the device tree.
+
+Fixes: 0b271258544b ("mfd: rt5033: Add Richtek RT5033 driver core.")
+Signed-off-by: Stephan Gerhold <stephan@gerhold.net>
+Signed-off-by: Jakob Hauser <jahau@rocketmail.com>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Lee Jones <lee@kernel.org>
+Link: https://lore.kernel.org/r/6a8a19bc67b5be3732882e8131ad2ffcb546ac03.1684182964.git.jahau@rocketmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/rt5033.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/drivers/mfd/rt5033.c b/drivers/mfd/rt5033.c
+index a5e520fe50a14..8029d444b7942 100644
+--- a/drivers/mfd/rt5033.c
++++ b/drivers/mfd/rt5033.c
+@@ -40,9 +40,6 @@ static const struct mfd_cell rt5033_devs[] = {
+ {
+ .name = "rt5033-charger",
+ .of_compatible = "richtek,rt5033-charger",
+- }, {
+- .name = "rt5033-battery",
+- .of_compatible = "richtek,rt5033-battery",
+ }, {
+ .name = "rt5033-led",
+ .of_compatible = "richtek,rt5033-led",
+--
+2.39.2
+
--- /dev/null
+From 8f8b632161d688ea1dcd8291e18d483c192a8450 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Jun 2023 11:28:03 +0200
+Subject: mfd: stmfx: Fix error path in stmfx_chip_init
+
+From: Amelie Delaunay <amelie.delaunay@foss.st.com>
+
+[ Upstream commit f592cf624531286f8b52e40dcfc157a5a7fb115c ]
+
+In error path, disable vdd regulator if it exists, but don't overload ret.
+Because if regulator_disable() is successful, stmfx_chip_init will exit
+successfully while chip init failed.
+
+Fixes: 06252ade9156 ("mfd: Add ST Multi-Function eXpander (STMFX) core driver")
+Signed-off-by: Amelie Delaunay <amelie.delaunay@foss.st.com>
+Link: https://lore.kernel.org/r/20230609092804.793100-1-amelie.delaunay@foss.st.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/stmfx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mfd/stmfx.c b/drivers/mfd/stmfx.c
+index e281971ba54ed..bfe89df276112 100644
+--- a/drivers/mfd/stmfx.c
++++ b/drivers/mfd/stmfx.c
+@@ -387,7 +387,7 @@ static int stmfx_chip_init(struct i2c_client *client)
+
+ err:
+ if (stmfx->vdd)
+- return regulator_disable(stmfx->vdd);
++ regulator_disable(stmfx->vdd);
+
+ return ret;
+ }
+--
+2.39.2
+
--- /dev/null
+From 91dc9c4b69c204aaf2bc54395b19a0f8d4b6be44 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Jun 2023 11:28:04 +0200
+Subject: mfd: stmfx: Nullify stmfx->vdd in case of error
+
+From: Amelie Delaunay <amelie.delaunay@foss.st.com>
+
+[ Upstream commit 7c81582c0bccb4757186176f0ee12834597066ad ]
+
+Nullify stmfx->vdd in case devm_regulator_get_optional() returns an error.
+And simplify code by returning an error only if return code is not -ENODEV,
+which means there is no vdd regulator and it is not an issue.
+
+Fixes: d75846ed08e6 ("mfd: stmfx: Fix dev_err_probe() call in stmfx_chip_init()")
+Signed-off-by: Amelie Delaunay <amelie.delaunay@foss.st.com>
+Link: https://lore.kernel.org/r/20230609092804.793100-2-amelie.delaunay@foss.st.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/stmfx.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/mfd/stmfx.c b/drivers/mfd/stmfx.c
+index bfe89df276112..76188212c66eb 100644
+--- a/drivers/mfd/stmfx.c
++++ b/drivers/mfd/stmfx.c
+@@ -330,9 +330,8 @@ static int stmfx_chip_init(struct i2c_client *client)
+ stmfx->vdd = devm_regulator_get_optional(&client->dev, "vdd");
+ ret = PTR_ERR_OR_ZERO(stmfx->vdd);
+ if (ret) {
+- if (ret == -ENODEV)
+- stmfx->vdd = NULL;
+- else
++ stmfx->vdd = NULL;
++ if (ret != -ENODEV)
+ return dev_err_probe(&client->dev, ret, "Failed to get VDD regulator\n");
+ }
+
+--
+2.39.2
+
--- /dev/null
+From bd5a1e7a9c5f6be939963febfadf1fca8c9a9ce7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 17 Jun 2023 12:43:16 +0200
+Subject: mfd: stmpe: Only disable the regulators if they are enabled
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 104d32bd81f620bb9f67fbf7d1159c414e89f05f ]
+
+In stmpe_probe(), if some regulator_enable() calls fail, probing continues
+and there is only a dev_warn().
+
+So, if stmpe_probe() is called the regulator may not be enabled. It is
+cleaner to test it before calling regulator_disable() in the remove
+function.
+
+Fixes: 9c9e321455fb ("mfd: stmpe: add optional regulators")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Link: https://lore.kernel.org/r/8de3aaf297931d655b9ad6aed548f4de8b85425a.1686998575.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/stmpe.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/mfd/stmpe.c b/drivers/mfd/stmpe.c
+index a92301dfc7126..9c3cf58457a7d 100644
+--- a/drivers/mfd/stmpe.c
++++ b/drivers/mfd/stmpe.c
+@@ -1485,9 +1485,9 @@ int stmpe_probe(struct stmpe_client_info *ci, enum stmpe_partnum partnum)
+
+ void stmpe_remove(struct stmpe *stmpe)
+ {
+- if (!IS_ERR(stmpe->vio))
++ if (!IS_ERR(stmpe->vio) && regulator_is_enabled(stmpe->vio))
+ regulator_disable(stmpe->vio);
+- if (!IS_ERR(stmpe->vcc))
++ if (!IS_ERR(stmpe->vcc) && regulator_is_enabled(stmpe->vcc))
+ regulator_disable(stmpe->vcc);
+
+ __stmpe_disable(stmpe, STMPE_BLOCK_ADC);
+--
+2.39.2
+
--- /dev/null
+From d8c5a2af4aae914e1879a21853f0fcbe63ca1a21 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 20 May 2023 09:10:54 +0200
+Subject: mfd: wcd934x: Fix an error handling path in wcd934x_slim_probe()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit f190b4891a3f9fac123a7afd378d4143a2723313 ]
+
+If devm_gpiod_get_optional() fails, some resources need to be released, as
+already done in the .remove() function.
+
+While at it, remove the unneeded error code from a dev_err_probe() call.
+It is already added in a human readable way by dev_err_probe() itself.
+
+Fixes: 6a0ee2a61a31 ("mfd: wcd934x: Replace legacy gpio interface for gpiod")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Link: https://lore.kernel.org/r/02d8447f6d1df52cc8357aae698152e9a9be67c6.1684565021.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/wcd934x.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/mfd/wcd934x.c b/drivers/mfd/wcd934x.c
+index 07e884087f2c7..281470d6b0b99 100644
+--- a/drivers/mfd/wcd934x.c
++++ b/drivers/mfd/wcd934x.c
+@@ -258,8 +258,9 @@ static int wcd934x_slim_probe(struct slim_device *sdev)
+ usleep_range(600, 650);
+ reset_gpio = devm_gpiod_get_optional(dev, "reset", GPIOD_OUT_LOW);
+ if (IS_ERR(reset_gpio)) {
+- return dev_err_probe(dev, PTR_ERR(reset_gpio),
+- "Failed to get reset gpio: err = %ld\n", PTR_ERR(reset_gpio));
++ ret = dev_err_probe(dev, PTR_ERR(reset_gpio),
++ "Failed to get reset gpio\n");
++ goto err_disable_regulators;
+ }
+ msleep(20);
+ gpiod_set_value(reset_gpio, 1);
+@@ -269,6 +270,10 @@ static int wcd934x_slim_probe(struct slim_device *sdev)
+ dev_set_drvdata(dev, ddata);
+
+ return 0;
++
++err_disable_regulators:
++ regulator_bulk_disable(WCD934X_MAX_SUPPLY, ddata->supplies);
++ return ret;
+ }
+
+ static void wcd934x_slim_remove(struct slim_device *sdev)
+--
+2.39.2
+
--- /dev/null
+From c5544b9db03572cd8105b8b23d704165fbd484de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Jun 2023 13:25:46 +0300
+Subject: misc: fastrpc: check return value of devm_kasprintf()
+
+From: Claudiu Beznea <claudiu.beznea@microchip.com>
+
+[ Upstream commit af2e19d82a116bc622eea84c9faadd5f7e20bec4 ]
+
+devm_kasprintf() returns a pointer to dynamically allocated memory.
+Pointer could be NULL in case allocation fails. Check pointer validity.
+Identified with coccinelle (kmerr.cocci script).
+
+Fixes: 3abe3ab3cdab ("misc: fastrpc: add secure domain support")
+Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Link: https://lore.kernel.org/r/20230615102546.581899-1-claudiu.beznea@microchip.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/fastrpc.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c
+index 30d4d0476248f..9051551d99373 100644
+--- a/drivers/misc/fastrpc.c
++++ b/drivers/misc/fastrpc.c
+@@ -2225,6 +2225,9 @@ static int fastrpc_device_register(struct device *dev, struct fastrpc_channel_ct
+ fdev->miscdev.fops = &fastrpc_fops;
+ fdev->miscdev.name = devm_kasprintf(dev, GFP_KERNEL, "fastrpc-%s%s",
+ domain, is_secured ? "-secure" : "");
++ if (!fdev->miscdev.name)
++ return -ENOMEM;
++
+ err = misc_register(&fdev->miscdev);
+ if (!err) {
+ if (is_secured)
+--
+2.39.2
+
--- /dev/null
+From 250ee84c4275bb563a0558438e41d7be71238c8c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Jun 2023 09:26:47 +0800
+Subject: mlxsw: minimal: fix potential memory leak in mlxsw_m_linecards_init
+
+From: Zhengchao Shao <shaozhengchao@huawei.com>
+
+[ Upstream commit 08fc75735fda3be97194bfbf3c899c87abb3d0fe ]
+
+The line cards array is not freed in the error path of
+mlxsw_m_linecards_init(), which can lead to a memory leak. Fix by
+freeing the array in the error path, thereby making the error path
+identical to mlxsw_m_linecards_fini().
+
+Fixes: 01328e23a476 ("mlxsw: minimal: Extend module to port mapping with slot index")
+Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com>
+Reviewed-by: Petr Machata <petrm@nvidia.com>
+Reviewed-by: Ido Schimmel <idosch@nvidia.com>
+Link: https://lore.kernel.org/r/20230630012647.1078002-1-shaozhengchao@huawei.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlxsw/minimal.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/minimal.c b/drivers/net/ethernet/mellanox/mlxsw/minimal.c
+index 6b56eadd736e5..6b98c3287b497 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/minimal.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/minimal.c
+@@ -417,6 +417,7 @@ static int mlxsw_m_linecards_init(struct mlxsw_m *mlxsw_m)
+ err_kmalloc_array:
+ for (i--; i >= 0; i--)
+ kfree(mlxsw_m->line_cards[i]);
++ kfree(mlxsw_m->line_cards);
+ err_kcalloc:
+ kfree(mlxsw_m->ports);
+ return err;
+--
+2.39.2
+
--- /dev/null
+From 79422008b833505c44a398796a4e50bbbb79a8d2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Jun 2023 19:41:18 +0300
+Subject: net: bridge: keep ports without IFF_UNICAST_FLT in BR_PROMISC mode
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit 6ca3c005d0604e8d2b439366e3923ea58db99641 ]
+
+According to the synchronization rules for .ndo_get_stats() as seen in
+Documentation/networking/netdevices.rst, acquiring a plain spin_lock()
+should not be illegal, but the bridge driver implementation makes it so.
+
+After running these commands, I am being faced with the following
+lockdep splat:
+
+$ ip link add link swp0 name macsec0 type macsec encrypt on && ip link set swp0 up
+$ ip link add dev br0 type bridge vlan_filtering 1 && ip link set br0 up
+$ ip link set macsec0 master br0 && ip link set macsec0 up
+
+ ========================================================
+ WARNING: possible irq lock inversion dependency detected
+ 6.4.0-04295-g31b577b4bd4a #603 Not tainted
+ --------------------------------------------------------
+ swapper/1/0 just changed the state of lock:
+ ffff6bd348724cd8 (&br->lock){+.-.}-{3:3}, at: br_forward_delay_timer_expired+0x34/0x198
+ but this lock took another, SOFTIRQ-unsafe lock in the past:
+ (&ocelot->stats_lock){+.+.}-{3:3}
+
+ and interrupts could create inverse lock ordering between them.
+
+ other info that might help us debug this:
+ Chain exists of:
+ &br->lock --> &br->hash_lock --> &ocelot->stats_lock
+
+ Possible interrupt unsafe locking scenario:
+
+ CPU0 CPU1
+ ---- ----
+ lock(&ocelot->stats_lock);
+ local_irq_disable();
+ lock(&br->lock);
+ lock(&br->hash_lock);
+ <Interrupt>
+ lock(&br->lock);
+
+ *** DEADLOCK ***
+
+(details about the 3 locks skipped)
+
+swp0 is instantiated by drivers/net/dsa/ocelot/felix.c, and this
+only matters to the extent that its .ndo_get_stats64() method calls
+spin_lock(&ocelot->stats_lock).
+
+Documentation/locking/lockdep-design.rst says:
+
+| A lock is irq-safe means it was ever used in an irq context, while a lock
+| is irq-unsafe means it was ever acquired with irq enabled.
+
+(...)
+
+| Furthermore, the following usage based lock dependencies are not allowed
+| between any two lock-classes::
+|
+| <hardirq-safe> -> <hardirq-unsafe>
+| <softirq-safe> -> <softirq-unsafe>
+
+Lockdep marks br->hash_lock as softirq-safe, because it is sometimes
+taken in softirq context (for example br_fdb_update() which runs in
+NET_RX softirq), and when it's not in softirq context it blocks softirqs
+by using spin_lock_bh().
+
+Lockdep marks ocelot->stats_lock as softirq-unsafe, because it never
+blocks softirqs from running, and it is never taken from softirq
+context. So it can always be interrupted by softirqs.
+
+There is a call path through which a function that holds br->hash_lock:
+fdb_add_hw_addr() will call a function that acquires ocelot->stats_lock:
+ocelot_port_get_stats64(). This can be seen below:
+
+ocelot_port_get_stats64+0x3c/0x1e0
+felix_get_stats64+0x20/0x38
+dsa_slave_get_stats64+0x3c/0x60
+dev_get_stats+0x74/0x2c8
+rtnl_fill_stats+0x4c/0x150
+rtnl_fill_ifinfo+0x5cc/0x7b8
+rtmsg_ifinfo_build_skb+0xe4/0x150
+rtmsg_ifinfo+0x5c/0xb0
+__dev_notify_flags+0x58/0x200
+__dev_set_promiscuity+0xa0/0x1f8
+dev_set_promiscuity+0x30/0x70
+macsec_dev_change_rx_flags+0x68/0x88
+__dev_set_promiscuity+0x1a8/0x1f8
+__dev_set_rx_mode+0x74/0xa8
+dev_uc_add+0x74/0xa0
+fdb_add_hw_addr+0x68/0xd8
+fdb_add_local+0xc4/0x110
+br_fdb_add_local+0x54/0x88
+br_add_if+0x338/0x4a0
+br_add_slave+0x20/0x38
+do_setlink+0x3a4/0xcb8
+rtnl_newlink+0x758/0x9d0
+rtnetlink_rcv_msg+0x2f0/0x550
+netlink_rcv_skb+0x128/0x148
+rtnetlink_rcv+0x24/0x38
+
+the plain English explanation for it is:
+
+The macsec0 bridge port is created without p->flags & BR_PROMISC,
+because it is what br_manage_promisc() decides for a VLAN filtering
+bridge with a single auto port.
+
+As part of the br_add_if() procedure, br_fdb_add_local() is called for
+the MAC address of the device, and this results in a call to
+dev_uc_add() for macsec0 while the softirq-safe br->hash_lock is taken.
+
+Because macsec0 does not have IFF_UNICAST_FLT, dev_uc_add() ends up
+calling __dev_set_promiscuity() for macsec0, which is propagated by its
+implementation, macsec_dev_change_rx_flags(), to the lower device: swp0.
+This triggers the call path:
+
+dev_set_promiscuity(swp0)
+-> rtmsg_ifinfo()
+ -> dev_get_stats()
+ -> ocelot_port_get_stats64()
+
+with a calling context that lockdep doesn't like (br->hash_lock held).
+
+Normally we don't see this, because even though many drivers that can be
+bridge ports don't support IFF_UNICAST_FLT, we need a driver that
+
+(a) doesn't support IFF_UNICAST_FLT, *and*
+(b) it forwards the IFF_PROMISC flag to another driver, and
+(c) *that* driver implements ndo_get_stats64() using a softirq-unsafe
+ spinlock.
+
+Condition (b) is necessary because the first __dev_set_rx_mode() calls
+__dev_set_promiscuity() with "bool notify=false", and thus, the
+rtmsg_ifinfo() code path won't be entered.
+
+The same criteria also hold true for DSA switches which don't report
+IFF_UNICAST_FLT. When the DSA master uses a spin_lock() in its
+ndo_get_stats64() method, the same lockdep splat can be seen.
+
+I think the deadlock possibility is real, even though I didn't reproduce
+it, and I'm thinking of the following situation to support that claim:
+
+fdb_add_hw_addr() runs on a CPU A, in a context with softirqs locally
+disabled and br->hash_lock held, and may end up attempting to acquire
+ocelot->stats_lock.
+
+In parallel, ocelot->stats_lock is currently held by a thread B (say,
+ocelot_check_stats_work()), which is interrupted while holding it by a
+softirq which attempts to lock br->hash_lock.
+
+Thread B cannot make progress because br->hash_lock is held by A. Whereas
+thread A cannot make progress because ocelot->stats_lock is held by B.
+
+When taking the issue at face value, the bridge can avoid that problem
+by simply making the ports promiscuous from a code path with a saner
+calling context (br->hash_lock not held). A bridge port without
+IFF_UNICAST_FLT is going to become promiscuous as soon as we call
+dev_uc_add() on it (which we do unconditionally), so why not be
+preemptive and make it promiscuous right from the beginning, so as to
+not be taken by surprise.
+
+With this, we've broken the links between code that holds br->hash_lock
+or br->lock and code that calls into the ndo_change_rx_flags() or
+ndo_get_stats64() ops of the bridge port.
+
+Fixes: 2796d0c648c9 ("bridge: Automatically manage port promiscuous mode.")
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Reviewed-by: Ido Schimmel <idosch@nvidia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bridge/br_if.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
+index 3f04b40f60568..2450690f98cfa 100644
+--- a/net/bridge/br_if.c
++++ b/net/bridge/br_if.c
+@@ -166,8 +166,9 @@ void br_manage_promisc(struct net_bridge *br)
+ * This lets us disable promiscuous mode and write
+ * this config to hw.
+ */
+- if (br->auto_cnt == 0 ||
+- (br->auto_cnt == 1 && br_auto_port(p)))
++ if ((p->dev->priv_flags & IFF_UNICAST_FLT) &&
++ (br->auto_cnt == 0 ||
++ (br->auto_cnt == 1 && br_auto_port(p))))
+ br_port_clear_promisc(p);
+ else
+ br_port_set_promisc(p);
+--
+2.39.2
+
--- /dev/null
+From f480e8b3437f17949221f0ded7bba5a9fd796339 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jun 2023 19:31:14 +0300
+Subject: net: dsa: felix: don't drop PTP frames with tag_8021q when RX
+ timestamping is disabled
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit 2edcfcbb3c5946609be1d8875473a240b170673b ]
+
+The driver implements a workaround for the fact that it doesn't have an
+IRQ source to tell it whether PTP frames are available through the
+extraction registers, for those frames to be processed and passed
+towards the network stack. That workaround is to configure the switch,
+through felix_hwtstamp_set() -> felix_update_trapping_destinations(),
+to create two copies of PTP packets: one sent over Ethernet to the DSA
+master, and one to be consumed through the aforementioned CPU extraction
+queue registers.
+
+The reason why we want PTP packets to be consumed through the CPU
+extraction registers in the first place is because we want to see their
+hardware RX timestamp. With tag_8021q, that is only visible that way,
+and it isn't visible with the copy of the packet that's transmitted over
+Ethernet.
+
+The problem with the workaround implementation is that it drops the
+packet received over Ethernet, in expectation of its copy being present
+in the CPU extraction registers. However, if felix_hwtstamp_set() hasn't
+run (aka PTP RX timestamping is disabled), the driver will drop the
+original PTP frame and there will be no copy of it in the CPU extraction
+registers. So, the network stack will simply not see any PTP frame.
+
+Look at the port's trapping configuration to see whether the driver has
+previously enabled the CPU extraction registers. If it hasn't, just
+don't RX timestamp the frame and let it be passed up the stack by DSA,
+which is perfectly fine.
+
+Fixes: 0a6f17c6ae21 ("net: dsa: tag_ocelot_8021q: add support for PTP timestamping")
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/ocelot/felix.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/drivers/net/dsa/ocelot/felix.c b/drivers/net/dsa/ocelot/felix.c
+index 80861ac090ae3..70c0e2b1936b3 100644
+--- a/drivers/net/dsa/ocelot/felix.c
++++ b/drivers/net/dsa/ocelot/felix.c
+@@ -1725,6 +1725,18 @@ static bool felix_rxtstamp(struct dsa_switch *ds, int port,
+ u32 tstamp_hi;
+ u64 tstamp;
+
++ switch (type & PTP_CLASS_PMASK) {
++ case PTP_CLASS_L2:
++ if (!(ocelot->ports[port]->trap_proto & OCELOT_PROTO_PTP_L2))
++ return false;
++ break;
++ case PTP_CLASS_IPV4:
++ case PTP_CLASS_IPV6:
++ if (!(ocelot->ports[port]->trap_proto & OCELOT_PROTO_PTP_L4))
++ return false;
++ break;
++ }
++
+ /* If the "no XTR IRQ" workaround is in use, tell DSA to defer this skb
+ * for RX timestamping. Then free it, and poll for its copy through
+ * MMIO in the CPU port module, and inject that into the stack from
+--
+2.39.2
+
--- /dev/null
+From 777973494b33a0ad17e1c99c171c4fc2b294ae56 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jun 2023 12:42:06 +0300
+Subject: net: dsa: sja1105: always enable the INCL_SRCPT option
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit b4638af8885af93cd70351081da1909c59342440 ]
+
+Link-local traffic on bridged SJA1105 ports is sometimes tagged by the
+hardware with source port information (when the port is under a VLAN
+aware bridge).
+
+The tag_8021q source port identification has become more loose
+("imprecise") and will report a plausible rather than exact bridge port,
+when under a bridge (be it VLAN-aware or VLAN-unaware). But link-local
+traffic always needs to know the precise source port.
+
+Modify the driver logic (and therefore: the tagging protocol itself) to
+always include the source port information with link-local packets,
+regardless of whether the port is standalone, under a VLAN-aware or
+VLAN-unaware bridge. This makes it possible for the tagging driver to
+give priority to that information over the tag_8021q VLAN header.
+
+The big drawback with INCL_SRCPT is that it makes it impossible to
+distinguish between an original MAC DA of 01:80:C2:XX:YY:ZZ and
+01:80:C2:AA:BB:ZZ, because the tagger just patches MAC DA bytes 3 and 4
+with zeroes. Only if PTP RX timestamping is enabled, the switch will
+generate a META follow-up frame containing the RX timestamp and the
+original bytes 3 and 4 of the MAC DA. Those will be used to patch up the
+original packet. Nonetheless, in the absence of PTP RX timestamping, we
+have to live with this limitation, since it is more important to have
+the more precise source port information for link-local traffic.
+
+Fixes: d7f9787a763f ("net: dsa: tag_8021q: add support for imprecise RX based on the VBID")
+Fixes: 91495f21fcec ("net: dsa: tag_8021q: replace the SVL bridging with VLAN-unaware IVL bridging")
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/sja1105/sja1105_main.c | 9 ++-------
+ 1 file changed, 2 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/dsa/sja1105/sja1105_main.c b/drivers/net/dsa/sja1105/sja1105_main.c
+index b70dcf32a26dc..8bd61f2ebb2ad 100644
+--- a/drivers/net/dsa/sja1105/sja1105_main.c
++++ b/drivers/net/dsa/sja1105/sja1105_main.c
+@@ -866,11 +866,11 @@ static int sja1105_init_general_params(struct sja1105_private *priv)
+ .hostprio = 7,
+ .mac_fltres1 = SJA1105_LINKLOCAL_FILTER_A,
+ .mac_flt1 = SJA1105_LINKLOCAL_FILTER_A_MASK,
+- .incl_srcpt1 = false,
++ .incl_srcpt1 = true,
+ .send_meta1 = false,
+ .mac_fltres0 = SJA1105_LINKLOCAL_FILTER_B,
+ .mac_flt0 = SJA1105_LINKLOCAL_FILTER_B_MASK,
+- .incl_srcpt0 = false,
++ .incl_srcpt0 = true,
+ .send_meta0 = false,
+ /* Default to an invalid value */
+ .mirr_port = priv->ds->num_ports,
+@@ -2407,11 +2407,6 @@ int sja1105_vlan_filtering(struct dsa_switch *ds, int port, bool enabled,
+ general_params->tpid = tpid;
+ /* EtherType used to identify outer tagged (S-tag) VLAN traffic */
+ general_params->tpid2 = tpid2;
+- /* When VLAN filtering is on, we need to at least be able to
+- * decode management traffic through the "backup plan".
+- */
+- general_params->incl_srcpt1 = enabled;
+- general_params->incl_srcpt0 = enabled;
+
+ for (port = 0; port < ds->num_ports; port++) {
+ if (dsa_is_unused_port(ds, port))
+--
+2.39.2
+
--- /dev/null
+From 64ee6ca1dd3284a0e17393dd8d682567e476c860 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Jul 2023 01:05:45 +0300
+Subject: net: dsa: sja1105: always enable the send_meta options
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit a372d66af48506d9f7aaae2a474cd18f14d98cb8 ]
+
+incl_srcpt has the limitation, mentioned in commit b4638af8885a ("net:
+dsa: sja1105: always enable the INCL_SRCPT option"), that frames with a
+MAC DA of 01:80:c2:xx:yy:zz will be received as 01:80:c2:00:00:zz unless
+PTP RX timestamping is enabled.
+
+The incl_srcpt option was initially unconditionally enabled, then that
+changed with commit 42824463d38d ("net: dsa: sja1105: Limit use of
+incl_srcpt to bridge+vlan mode"), then again with b4638af8885a ("net:
+dsa: sja1105: always enable the INCL_SRCPT option"). Bottom line is that
+it now needs to be always enabled, otherwise the driver does not have a
+reliable source of information regarding source_port and switch_id for
+link-local traffic (tag_8021q VLANs may be imprecise since now they
+identify an entire bridging domain when ports are not standalone).
+
+If we accept that PTP RX timestamping (and therefore, meta frame
+generation) is always enabled in hardware, then that limitation could be
+avoided and packets with any MAC DA can be properly received, because
+meta frames do contain the original bytes from the MAC DA of their
+associated link-local packet.
+
+This change enables meta frame generation unconditionally, which also
+has the nice side effects of simplifying the switch control path
+(a switch reset is no longer required on hwtstamping settings change)
+and the tagger data path (it no longer needs to be informed whether to
+expect meta frames or not - it always does).
+
+Fixes: 227d07a07ef1 ("net: dsa: sja1105: Add support for traffic through standalone ports")
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/sja1105/sja1105.h | 2 +-
+ drivers/net/dsa/sja1105/sja1105_main.c | 5 ++-
+ drivers/net/dsa/sja1105/sja1105_ptp.c | 48 +++-----------------------
+ include/linux/dsa/sja1105.h | 4 ---
+ net/dsa/tag_sja1105.c | 45 ------------------------
+ 5 files changed, 7 insertions(+), 97 deletions(-)
+
+diff --git a/drivers/net/dsa/sja1105/sja1105.h b/drivers/net/dsa/sja1105/sja1105.h
+index fb1549a5fe321..dee35ba924ad2 100644
+--- a/drivers/net/dsa/sja1105/sja1105.h
++++ b/drivers/net/dsa/sja1105/sja1105.h
+@@ -252,6 +252,7 @@ struct sja1105_private {
+ unsigned long ucast_egress_floods;
+ unsigned long bcast_egress_floods;
+ unsigned long hwts_tx_en;
++ unsigned long hwts_rx_en;
+ const struct sja1105_info *info;
+ size_t max_xfer_len;
+ struct spi_device *spidev;
+@@ -289,7 +290,6 @@ struct sja1105_spi_message {
+ /* From sja1105_main.c */
+ enum sja1105_reset_reason {
+ SJA1105_VLAN_FILTERING = 0,
+- SJA1105_RX_HWTSTAMPING,
+ SJA1105_AGEING_TIME,
+ SJA1105_SCHEDULING,
+ SJA1105_BEST_EFFORT_POLICING,
+diff --git a/drivers/net/dsa/sja1105/sja1105_main.c b/drivers/net/dsa/sja1105/sja1105_main.c
+index 8bd61f2ebb2ad..947e8f7c09880 100644
+--- a/drivers/net/dsa/sja1105/sja1105_main.c
++++ b/drivers/net/dsa/sja1105/sja1105_main.c
+@@ -867,11 +867,11 @@ static int sja1105_init_general_params(struct sja1105_private *priv)
+ .mac_fltres1 = SJA1105_LINKLOCAL_FILTER_A,
+ .mac_flt1 = SJA1105_LINKLOCAL_FILTER_A_MASK,
+ .incl_srcpt1 = true,
+- .send_meta1 = false,
++ .send_meta1 = true,
+ .mac_fltres0 = SJA1105_LINKLOCAL_FILTER_B,
+ .mac_flt0 = SJA1105_LINKLOCAL_FILTER_B_MASK,
+ .incl_srcpt0 = true,
+- .send_meta0 = false,
++ .send_meta0 = true,
+ /* Default to an invalid value */
+ .mirr_port = priv->ds->num_ports,
+ /* No TTEthernet */
+@@ -2215,7 +2215,6 @@ static int sja1105_reload_cbs(struct sja1105_private *priv)
+
+ static const char * const sja1105_reset_reasons[] = {
+ [SJA1105_VLAN_FILTERING] = "VLAN filtering",
+- [SJA1105_RX_HWTSTAMPING] = "RX timestamping",
+ [SJA1105_AGEING_TIME] = "Ageing time",
+ [SJA1105_SCHEDULING] = "Time-aware scheduling",
+ [SJA1105_BEST_EFFORT_POLICING] = "Best-effort policing",
+diff --git a/drivers/net/dsa/sja1105/sja1105_ptp.c b/drivers/net/dsa/sja1105/sja1105_ptp.c
+index 30fb2cc40164b..a7d41e7813982 100644
+--- a/drivers/net/dsa/sja1105/sja1105_ptp.c
++++ b/drivers/net/dsa/sja1105/sja1105_ptp.c
+@@ -58,35 +58,10 @@ enum sja1105_ptp_clk_mode {
+ #define ptp_data_to_sja1105(d) \
+ container_of((d), struct sja1105_private, ptp_data)
+
+-/* Must be called only while the RX timestamping state of the tagger
+- * is turned off
+- */
+-static int sja1105_change_rxtstamping(struct sja1105_private *priv,
+- bool on)
+-{
+- struct sja1105_ptp_data *ptp_data = &priv->ptp_data;
+- struct sja1105_general_params_entry *general_params;
+- struct sja1105_table *table;
+-
+- table = &priv->static_config.tables[BLK_IDX_GENERAL_PARAMS];
+- general_params = table->entries;
+- general_params->send_meta1 = on;
+- general_params->send_meta0 = on;
+-
+- ptp_cancel_worker_sync(ptp_data->clock);
+- skb_queue_purge(&ptp_data->skb_txtstamp_queue);
+- skb_queue_purge(&ptp_data->skb_rxtstamp_queue);
+-
+- return sja1105_static_config_reload(priv, SJA1105_RX_HWTSTAMPING);
+-}
+-
+ int sja1105_hwtstamp_set(struct dsa_switch *ds, int port, struct ifreq *ifr)
+ {
+- struct sja1105_tagger_data *tagger_data = sja1105_tagger_data(ds);
+ struct sja1105_private *priv = ds->priv;
+ struct hwtstamp_config config;
+- bool rx_on;
+- int rc;
+
+ if (copy_from_user(&config, ifr->ifr_data, sizeof(config)))
+ return -EFAULT;
+@@ -104,26 +79,13 @@ int sja1105_hwtstamp_set(struct dsa_switch *ds, int port, struct ifreq *ifr)
+
+ switch (config.rx_filter) {
+ case HWTSTAMP_FILTER_NONE:
+- rx_on = false;
++ priv->hwts_rx_en &= ~BIT(port);
+ break;
+ default:
+- rx_on = true;
++ priv->hwts_rx_en |= BIT(port);
+ break;
+ }
+
+- if (rx_on != tagger_data->rxtstamp_get_state(ds)) {
+- tagger_data->rxtstamp_set_state(ds, false);
+-
+- rc = sja1105_change_rxtstamping(priv, rx_on);
+- if (rc < 0) {
+- dev_err(ds->dev,
+- "Failed to change RX timestamping: %d\n", rc);
+- return rc;
+- }
+- if (rx_on)
+- tagger_data->rxtstamp_set_state(ds, true);
+- }
+-
+ if (copy_to_user(ifr->ifr_data, &config, sizeof(config)))
+ return -EFAULT;
+ return 0;
+@@ -131,7 +93,6 @@ int sja1105_hwtstamp_set(struct dsa_switch *ds, int port, struct ifreq *ifr)
+
+ int sja1105_hwtstamp_get(struct dsa_switch *ds, int port, struct ifreq *ifr)
+ {
+- struct sja1105_tagger_data *tagger_data = sja1105_tagger_data(ds);
+ struct sja1105_private *priv = ds->priv;
+ struct hwtstamp_config config;
+
+@@ -140,7 +101,7 @@ int sja1105_hwtstamp_get(struct dsa_switch *ds, int port, struct ifreq *ifr)
+ config.tx_type = HWTSTAMP_TX_ON;
+ else
+ config.tx_type = HWTSTAMP_TX_OFF;
+- if (tagger_data->rxtstamp_get_state(ds))
++ if (priv->hwts_rx_en & BIT(port))
+ config.rx_filter = HWTSTAMP_FILTER_PTP_V2_L2_EVENT;
+ else
+ config.rx_filter = HWTSTAMP_FILTER_NONE;
+@@ -413,11 +374,10 @@ static long sja1105_rxtstamp_work(struct ptp_clock_info *ptp)
+
+ bool sja1105_rxtstamp(struct dsa_switch *ds, int port, struct sk_buff *skb)
+ {
+- struct sja1105_tagger_data *tagger_data = sja1105_tagger_data(ds);
+ struct sja1105_private *priv = ds->priv;
+ struct sja1105_ptp_data *ptp_data = &priv->ptp_data;
+
+- if (!tagger_data->rxtstamp_get_state(ds))
++ if (!(priv->hwts_rx_en & BIT(port)))
+ return false;
+
+ /* We need to read the full PTP clock to reconstruct the Rx
+diff --git a/include/linux/dsa/sja1105.h b/include/linux/dsa/sja1105.h
+index 159e43171cccf..c177322f793d6 100644
+--- a/include/linux/dsa/sja1105.h
++++ b/include/linux/dsa/sja1105.h
+@@ -48,13 +48,9 @@ struct sja1105_deferred_xmit_work {
+
+ /* Global tagger data */
+ struct sja1105_tagger_data {
+- /* Tagger to switch */
+ void (*xmit_work_fn)(struct kthread_work *work);
+ void (*meta_tstamp_handler)(struct dsa_switch *ds, int port, u8 ts_id,
+ enum sja1110_meta_tstamp dir, u64 tstamp);
+- /* Switch to tagger */
+- bool (*rxtstamp_get_state)(struct dsa_switch *ds);
+- void (*rxtstamp_set_state)(struct dsa_switch *ds, bool on);
+ };
+
+ struct sja1105_skb_cb {
+diff --git a/net/dsa/tag_sja1105.c b/net/dsa/tag_sja1105.c
+index ec48165673edb..ade3eeb2f3e6d 100644
+--- a/net/dsa/tag_sja1105.c
++++ b/net/dsa/tag_sja1105.c
+@@ -58,11 +58,8 @@
+ #define SJA1110_TX_TRAILER_LEN 4
+ #define SJA1110_MAX_PADDING_LEN 15
+
+-#define SJA1105_HWTS_RX_EN 0
+-
+ struct sja1105_tagger_private {
+ struct sja1105_tagger_data data; /* Must be first */
+- unsigned long state;
+ /* Protects concurrent access to the meta state machine
+ * from taggers running on multiple ports on SMP systems
+ */
+@@ -392,10 +389,6 @@ static struct sk_buff
+
+ priv = sja1105_tagger_private(ds);
+
+- if (!test_bit(SJA1105_HWTS_RX_EN, &priv->state))
+- /* Do normal processing. */
+- return skb;
+-
+ spin_lock(&priv->meta_lock);
+ /* Was this a link-local frame instead of the meta
+ * that we were expecting?
+@@ -431,12 +424,6 @@ static struct sk_buff
+
+ priv = sja1105_tagger_private(ds);
+
+- /* Drop the meta frame if we're not in the right state
+- * to process it.
+- */
+- if (!test_bit(SJA1105_HWTS_RX_EN, &priv->state))
+- return NULL;
+-
+ spin_lock(&priv->meta_lock);
+
+ stampable_skb = priv->stampable_skb;
+@@ -472,30 +459,6 @@ static struct sk_buff
+ return skb;
+ }
+
+-static bool sja1105_rxtstamp_get_state(struct dsa_switch *ds)
+-{
+- struct sja1105_tagger_private *priv = sja1105_tagger_private(ds);
+-
+- return test_bit(SJA1105_HWTS_RX_EN, &priv->state);
+-}
+-
+-static void sja1105_rxtstamp_set_state(struct dsa_switch *ds, bool on)
+-{
+- struct sja1105_tagger_private *priv = sja1105_tagger_private(ds);
+-
+- if (on)
+- set_bit(SJA1105_HWTS_RX_EN, &priv->state);
+- else
+- clear_bit(SJA1105_HWTS_RX_EN, &priv->state);
+-
+- /* Initialize the meta state machine to a known state */
+- if (!priv->stampable_skb)
+- return;
+-
+- kfree_skb(priv->stampable_skb);
+- priv->stampable_skb = NULL;
+-}
+-
+ static bool sja1105_skb_has_tag_8021q(const struct sk_buff *skb)
+ {
+ u16 tpid = ntohs(eth_hdr(skb)->h_proto);
+@@ -552,9 +515,6 @@ static struct sk_buff *sja1105_rcv(struct sk_buff *skb,
+ */
+ source_port = hdr->h_dest[3];
+ switch_id = hdr->h_dest[4];
+- /* Clear the DMAC bytes that were mangled by the switch */
+- hdr->h_dest[3] = 0;
+- hdr->h_dest[4] = 0;
+ } else if (is_meta) {
+ sja1105_meta_unpack(skb, &meta);
+ source_port = meta.source_port;
+@@ -785,7 +745,6 @@ static void sja1105_disconnect(struct dsa_switch *ds)
+
+ static int sja1105_connect(struct dsa_switch *ds)
+ {
+- struct sja1105_tagger_data *tagger_data;
+ struct sja1105_tagger_private *priv;
+ struct kthread_worker *xmit_worker;
+ int err;
+@@ -805,10 +764,6 @@ static int sja1105_connect(struct dsa_switch *ds)
+ }
+
+ priv->xmit_worker = xmit_worker;
+- /* Export functions for switch driver use */
+- tagger_data = &priv->data;
+- tagger_data->rxtstamp_get_state = sja1105_rxtstamp_get_state;
+- tagger_data->rxtstamp_set_state = sja1105_rxtstamp_set_state;
+ ds->tagger_data = priv;
+
+ return 0;
+--
+2.39.2
+
--- /dev/null
+From 588c69882a60013cae6453290e103167c3eeed57 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jun 2023 12:42:07 +0300
+Subject: net: dsa: tag_sja1105: always prefer source port information from
+ INCL_SRCPT
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit c1ae02d876898b1b8ca1e12c6f84d7b406263800 ]
+
+Currently the sja1105 tagging protocol prefers using the source port
+information from the VLAN header if that is available, falling back to
+the INCL_SRCPT option if it isn't. The VLAN header is available for all
+frames except for META frames initiated by the switch (containing RX
+timestamps), and thus, the "if (is_link_local)" branch is practically
+dead.
+
+The tag_8021q source port identification has become more loose
+("imprecise") and will report a plausible rather than exact bridge port,
+when under a bridge (be it VLAN-aware or VLAN-unaware). But link-local
+traffic always needs to know the precise source port. With incorrect
+source port reporting, for example PTP traffic over 2 bridged ports will
+all be seen on sockets opened on the first such port, which is incorrect.
+
+Now that the tagging protocol has been changed to make link-local frames
+always contain source port information, we can reverse the order of the
+checks so that we always give precedence to that information (which is
+always precise) in lieu of the tag_8021q VID which is only precise for a
+standalone port.
+
+Fixes: d7f9787a763f ("net: dsa: tag_8021q: add support for imprecise RX based on the VBID")
+Fixes: 91495f21fcec ("net: dsa: tag_8021q: replace the SVL bridging with VLAN-unaware IVL bridging")
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/dsa/tag_sja1105.c | 38 +++++++++++++++++++++++++++++---------
+ 1 file changed, 29 insertions(+), 9 deletions(-)
+
+diff --git a/net/dsa/tag_sja1105.c b/net/dsa/tag_sja1105.c
+index a5f3b73da417f..92a626a05e829 100644
+--- a/net/dsa/tag_sja1105.c
++++ b/net/dsa/tag_sja1105.c
+@@ -545,10 +545,7 @@ static struct sk_buff *sja1105_rcv(struct sk_buff *skb,
+ is_link_local = sja1105_is_link_local(skb);
+ is_meta = sja1105_is_meta_frame(skb);
+
+- if (sja1105_skb_has_tag_8021q(skb)) {
+- /* Normal traffic path. */
+- sja1105_vlan_rcv(skb, &source_port, &switch_id, &vbid, &vid);
+- } else if (is_link_local) {
++ if (is_link_local) {
+ /* Management traffic path. Switch embeds the switch ID and
+ * port ID into bytes of the destination MAC, courtesy of
+ * the incl_srcpt options.
+@@ -562,16 +559,39 @@ static struct sk_buff *sja1105_rcv(struct sk_buff *skb,
+ sja1105_meta_unpack(skb, &meta);
+ source_port = meta.source_port;
+ switch_id = meta.switch_id;
+- } else {
++ }
++
++ /* Normal data plane traffic and link-local frames are tagged with
++ * a tag_8021q VLAN which we have to strip
++ */
++ if (sja1105_skb_has_tag_8021q(skb)) {
++ int tmp_source_port = -1, tmp_switch_id = -1;
++
++ sja1105_vlan_rcv(skb, &tmp_source_port, &tmp_switch_id, &vbid,
++ &vid);
++ /* Preserve the source information from the INCL_SRCPT option,
++ * if available. This allows us to not overwrite a valid source
++ * port and switch ID with zeroes when receiving link-local
++ * frames from a VLAN-unaware bridged port (non-zero vbid) or a
++ * VLAN-aware bridged port (non-zero vid).
++ */
++ if (source_port == -1)
++ source_port = tmp_source_port;
++ if (switch_id == -1)
++ switch_id = tmp_switch_id;
++ } else if (source_port == -1 && switch_id == -1) {
++ /* Packets with no source information have no chance of
++ * getting accepted, drop them straight away.
++ */
+ return NULL;
+ }
+
+- if (vbid >= 1)
++ if (source_port != -1 && switch_id != -1)
++ skb->dev = dsa_master_find_slave(netdev, switch_id, source_port);
++ else if (vbid >= 1)
+ skb->dev = dsa_tag_8021q_find_port_by_vbid(netdev, vbid);
+- else if (source_port == -1 || switch_id == -1)
+- skb->dev = dsa_find_designated_bridge_port_by_vid(netdev, vid);
+ else
+- skb->dev = dsa_master_find_slave(netdev, switch_id, source_port);
++ skb->dev = dsa_find_designated_bridge_port_by_vid(netdev, vid);
+ if (!skb->dev) {
+ netdev_warn(netdev, "Couldn't decode source port\n");
+ return NULL;
+--
+2.39.2
+
--- /dev/null
+From 96c8a566f0f76c4c5807ca914901701e184c70d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Jul 2023 01:05:44 +0300
+Subject: net: dsa: tag_sja1105: fix MAC DA patching from meta frames
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit 1dcf6efd5f0c1f4496b3ef7ec5a7db104a53b38c ]
+
+The SJA1105 manual says that at offset 4 into the meta frame payload we
+have "MAC destination byte 2" and at offset 5 we have "MAC destination
+byte 1". These are counted from the LSB, so byte 1 is h_dest[ETH_HLEN-2]
+aka h_dest[4] and byte 2 is h_dest[ETH_HLEN-3] aka h_dest[3].
+
+The sja1105_meta_unpack() function decodes these the other way around,
+so a frame with MAC DA 01:80:c2:11:22:33 is received by the network
+stack as having 01:80:c2:22:11:33.
+
+Fixes: e53e18a6fe4d ("net: dsa: sja1105: Receive and decode meta frames")
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/dsa/tag_sja1105.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/dsa/tag_sja1105.c b/net/dsa/tag_sja1105.c
+index db0a6ac674708..ec48165673edb 100644
+--- a/net/dsa/tag_sja1105.c
++++ b/net/dsa/tag_sja1105.c
+@@ -118,8 +118,8 @@ static void sja1105_meta_unpack(const struct sk_buff *skb,
+ * a unified unpacking command for both device series.
+ */
+ packing(buf, &meta->tstamp, 31, 0, 4, UNPACK, 0);
+- packing(buf + 4, &meta->dmac_byte_4, 7, 0, 1, UNPACK, 0);
+- packing(buf + 5, &meta->dmac_byte_3, 7, 0, 1, UNPACK, 0);
++ packing(buf + 4, &meta->dmac_byte_3, 7, 0, 1, UNPACK, 0);
++ packing(buf + 5, &meta->dmac_byte_4, 7, 0, 1, UNPACK, 0);
+ packing(buf + 6, &meta->source_port, 7, 0, 1, UNPACK, 0);
+ packing(buf + 7, &meta->switch_id, 7, 0, 1, UNPACK, 0);
+ }
+--
+2.39.2
+
--- /dev/null
+From b0527ea4d94928e61465c238f3ab5c76c026bb79 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 1 Jul 2023 01:20:10 +0300
+Subject: net: dsa: tag_sja1105: fix source port decoding in vlan_filtering=0
+ bridge mode
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit a398b9ea0c3b791b7a0f4c6029a62cf628f97f22 ]
+
+There was a regression introduced by the blamed commit, where pinging to
+a VLAN-unaware bridge would fail with the repeated message "Couldn't
+decode source port" coming from the tagging protocol driver.
+
+When receiving packets with a bridge_vid as determined by
+dsa_tag_8021q_bridge_join(), dsa_8021q_rcv() will decode:
+- source_port = 0 (which isn't really valid, more like "don't know")
+- switch_id = 0 (which isn't really valid, more like "don't know")
+- vbid = value in range 1-7
+
+Since the blamed patch has reversed the order of the checks, we are now
+going to believe that source_port != -1 and switch_id != -1, so they're
+valid, but they aren't.
+
+The minimal solution to the problem is to only populate source_port and
+switch_id with what dsa_8021q_rcv() came up with, if the vbid is zero,
+i.e. the source port information is trustworthy.
+
+Fixes: c1ae02d87689 ("net: dsa: tag_sja1105: always prefer source port information from INCL_SRCPT")
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/dsa/tag_sja1105.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/net/dsa/tag_sja1105.c b/net/dsa/tag_sja1105.c
+index 92a626a05e829..db0a6ac674708 100644
+--- a/net/dsa/tag_sja1105.c
++++ b/net/dsa/tag_sja1105.c
+@@ -573,11 +573,14 @@ static struct sk_buff *sja1105_rcv(struct sk_buff *skb,
+ * if available. This allows us to not overwrite a valid source
+ * port and switch ID with zeroes when receiving link-local
+ * frames from a VLAN-unaware bridged port (non-zero vbid) or a
+- * VLAN-aware bridged port (non-zero vid).
++ * VLAN-aware bridged port (non-zero vid). Furthermore, the
++ * tag_8021q source port information is only of trust when the
++ * vbid is 0 (precise port). Otherwise, tmp_source_port and
++ * tmp_switch_id will be zeroes.
+ */
+- if (source_port == -1)
++ if (vbid == 0 && source_port == -1)
+ source_port = tmp_source_port;
+- if (switch_id == -1)
++ if (vbid == 0 && switch_id == -1)
+ switch_id = tmp_switch_id;
+ } else if (source_port == -1 && switch_id == -1) {
+ /* Packets with no source information have no chance of
+--
+2.39.2
+
--- /dev/null
+From 39f24189be667ad69f458a642cd89c23c2eee139 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Jun 2023 21:43:27 +0200
+Subject: net: dsa: vsc73xx: fix MTU configuration
+
+From: Pawel Dembicki <paweldembicki@gmail.com>
+
+[ Upstream commit 3cf62c8177adb0db9e15c8b898c44f997acf3ebf ]
+
+Switch in MAXLEN register stores the maximum size of a data frame.
+The MTU size is 18 bytes smaller than the frame size.
+
+The current settings are causing problems with packet forwarding.
+This patch fixes the MTU settings to proper values.
+
+Fixes: fb77ffc6ec86 ("net: dsa: vsc73xx: make the MTU configurable")
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Pawel Dembicki <paweldembicki@gmail.com>
+Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
+Link: https://lore.kernel.org/r/20230628194327.1765644-1-paweldembicki@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/vitesse-vsc73xx-core.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/dsa/vitesse-vsc73xx-core.c b/drivers/net/dsa/vitesse-vsc73xx-core.c
+index ae55167ce0a6f..ef1a4a7c47b23 100644
+--- a/drivers/net/dsa/vitesse-vsc73xx-core.c
++++ b/drivers/net/dsa/vitesse-vsc73xx-core.c
+@@ -1025,17 +1025,17 @@ static int vsc73xx_change_mtu(struct dsa_switch *ds, int port, int new_mtu)
+ struct vsc73xx *vsc = ds->priv;
+
+ return vsc73xx_write(vsc, VSC73XX_BLOCK_MAC, port,
+- VSC73XX_MAXLEN, new_mtu);
++ VSC73XX_MAXLEN, new_mtu + ETH_HLEN + ETH_FCS_LEN);
+ }
+
+ /* According to application not "VSC7398 Jumbo Frames" setting
+- * up the MTU to 9.6 KB does not affect the performance on standard
++ * up the frame size to 9.6 KB does not affect the performance on standard
+ * frames. It is clear from the application note that
+ * "9.6 kilobytes" == 9600 bytes.
+ */
+ static int vsc73xx_get_max_mtu(struct dsa_switch *ds, int port)
+ {
+- return 9600;
++ return 9600 - ETH_HLEN - ETH_FCS_LEN;
+ }
+
+ static const struct dsa_switch_ops vsc73xx_ds_ops = {
+--
+2.39.2
+
--- /dev/null
+From fd0041be14c6a0fe431d9431faa29adf65726d40 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 1 Jul 2023 02:48:24 +0000
+Subject: net: fix net_dev_start_xmit trace event vs skb_transport_offset()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit f88fcb1d7d961b4b402d675109726f94db87571c ]
+
+After blamed commit, we must be more careful about using
+skb_transport_offset(), as reminded us by syzbot:
+
+WARNING: CPU: 0 PID: 10 at include/linux/skbuff.h:2868 skb_transport_offset include/linux/skbuff.h:2977 [inline]
+WARNING: CPU: 0 PID: 10 at include/linux/skbuff.h:2868 perf_trace_net_dev_start_xmit+0x89a/0xce0 include/trace/events/net.h:14
+Modules linked in:
+CPU: 0 PID: 10 Comm: kworker/u4:1 Not tainted 6.1.30-syzkaller #0
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023
+Workqueue: bat_events batadv_iv_send_outstanding_bat_ogm_packet
+RIP: 0010:skb_transport_header include/linux/skbuff.h:2868 [inline]
+RIP: 0010:skb_transport_offset include/linux/skbuff.h:2977 [inline]
+RIP: 0010:perf_trace_net_dev_start_xmit+0x89a/0xce0 include/trace/events/net.h:14
+Code: 8b 04 25 28 00 00 00 48 3b 84 24 c0 00 00 00 0f 85 4e 04 00 00 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc e8 56 22 01 fd <0f> 0b e9 f6 fc ff ff 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 86 f9 ff
+RSP: 0018:ffffc900002bf700 EFLAGS: 00010293
+RAX: ffffffff8485d8ca RBX: 000000000000ffff RCX: ffff888100914280
+RDX: 0000000000000000 RSI: 000000000000ffff RDI: 000000000000ffff
+RBP: ffffc900002bf818 R08: ffffffff8485d5b6 R09: fffffbfff0f8fb5e
+R10: 0000000000000000 R11: dffffc0000000001 R12: 1ffff110217d8f67
+R13: ffff88810bec7b3a R14: dffffc0000000000 R15: dffffc0000000000
+FS: 0000000000000000(0000) GS:ffff8881f6a00000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 00007f96cf6d52f0 CR3: 000000012224c000 CR4: 0000000000350ef0
+Call Trace:
+<TASK>
+[<ffffffff84715e35>] trace_net_dev_start_xmit include/trace/events/net.h:14 [inline]
+[<ffffffff84715e35>] xmit_one net/core/dev.c:3643 [inline]
+[<ffffffff84715e35>] dev_hard_start_xmit+0x705/0x980 net/core/dev.c:3660
+[<ffffffff8471a232>] __dev_queue_xmit+0x16b2/0x3370 net/core/dev.c:4324
+[<ffffffff85416493>] dev_queue_xmit include/linux/netdevice.h:3030 [inline]
+[<ffffffff85416493>] batadv_send_skb_packet+0x3f3/0x680 net/batman-adv/send.c:108
+[<ffffffff85416744>] batadv_send_broadcast_skb+0x24/0x30 net/batman-adv/send.c:127
+[<ffffffff853bc52a>] batadv_iv_ogm_send_to_if net/batman-adv/bat_iv_ogm.c:393 [inline]
+[<ffffffff853bc52a>] batadv_iv_ogm_emit net/batman-adv/bat_iv_ogm.c:421 [inline]
+[<ffffffff853bc52a>] batadv_iv_send_outstanding_bat_ogm_packet+0x69a/0x840 net/batman-adv/bat_iv_ogm.c:1701
+[<ffffffff8151023c>] process_one_work+0x8ac/0x1170 kernel/workqueue.c:2289
+[<ffffffff81511938>] worker_thread+0xaa8/0x12d0 kernel/workqueue.c:2436
+
+Fixes: 66e4c8d95008 ("net: warn if transport header was not set")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reported-by: syzbot <syzkaller@googlegroups.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/trace/events/net.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/include/trace/events/net.h b/include/trace/events/net.h
+index da611a7aaf970..f667c76a3b022 100644
+--- a/include/trace/events/net.h
++++ b/include/trace/events/net.h
+@@ -51,7 +51,8 @@ TRACE_EVENT(net_dev_start_xmit,
+ __entry->network_offset = skb_network_offset(skb);
+ __entry->transport_offset_valid =
+ skb_transport_header_was_set(skb);
+- __entry->transport_offset = skb_transport_offset(skb);
++ __entry->transport_offset = skb_transport_header_was_set(skb) ?
++ skb_transport_offset(skb) : 0;
+ __entry->tx_flags = skb_shinfo(skb)->tx_flags;
+ __entry->gso_size = skb_shinfo(skb)->gso_size;
+ __entry->gso_segs = skb_shinfo(skb)->gso_segs;
+--
+2.39.2
+
--- /dev/null
+From 27b241d5b6bb12a6e12bd56bbd0ed19ce676122e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jun 2023 19:31:13 +0300
+Subject: net: mscc: ocelot: don't keep PTP configuration of all ports in
+ single structure
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit 45d0fcb5bc9558d0bf3d2fa7fabc5d8a88d35439 ]
+
+In a future change, the driver will need to determine whether PTP RX
+timestamping is enabled on a port (including whether traps were set up
+on that port in particular) and that is currently not possible.
+
+The driver supports different RX filters (L2, L4) and kinds of TX
+timestamping (one-step, two-step) on its ports, but it saves all
+configuration in a single struct hwtstamp_config that is global to the
+switch. So, the latest timestamping configuration on one port
+(including a request to disable timestamping) affects what gets reported
+for all ports, even though the configuration itself is still individual
+to each port.
+
+The port timestamping configurations are only coupled because of the
+common structure, so replace the hwtstamp_config with a mask of trapped
+protocols saved per port. We also have the ptp_cmd to distinguish
+between one-step and two-step PTP timestamping, so with those 2 bits of
+information we can fully reconstruct a descriptive struct
+hwtstamp_config for each port, during the SIOCGHWTSTAMP ioctl.
+
+Fixes: 4e3b0468e6d7 ("net: mscc: PTP Hardware Clock (PHC) support")
+Fixes: 96ca08c05838 ("net: mscc: ocelot: set up traps for PTP packets")
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mscc/ocelot.c | 1 -
+ drivers/net/ethernet/mscc/ocelot_ptp.c | 61 +++++++++++++++++---------
+ include/soc/mscc/ocelot.h | 10 +++--
+ 3 files changed, 48 insertions(+), 24 deletions(-)
+
+diff --git a/drivers/net/ethernet/mscc/ocelot.c b/drivers/net/ethernet/mscc/ocelot.c
+index 1f5f00b304418..2fa833d041baa 100644
+--- a/drivers/net/ethernet/mscc/ocelot.c
++++ b/drivers/net/ethernet/mscc/ocelot.c
+@@ -2925,7 +2925,6 @@ int ocelot_init(struct ocelot *ocelot)
+ }
+ }
+
+- mutex_init(&ocelot->ptp_lock);
+ mutex_init(&ocelot->mact_lock);
+ mutex_init(&ocelot->fwd_domain_lock);
+ mutex_init(&ocelot->tas_lock);
+diff --git a/drivers/net/ethernet/mscc/ocelot_ptp.c b/drivers/net/ethernet/mscc/ocelot_ptp.c
+index 673bfd70867a6..cb32234a5bf1b 100644
+--- a/drivers/net/ethernet/mscc/ocelot_ptp.c
++++ b/drivers/net/ethernet/mscc/ocelot_ptp.c
+@@ -439,8 +439,12 @@ static int ocelot_ipv6_ptp_trap_del(struct ocelot *ocelot, int port)
+ static int ocelot_setup_ptp_traps(struct ocelot *ocelot, int port,
+ bool l2, bool l4)
+ {
++ struct ocelot_port *ocelot_port = ocelot->ports[port];
+ int err;
+
++ ocelot_port->trap_proto &= ~(OCELOT_PROTO_PTP_L2 |
++ OCELOT_PROTO_PTP_L4);
++
+ if (l2)
+ err = ocelot_l2_ptp_trap_add(ocelot, port);
+ else
+@@ -464,6 +468,11 @@ static int ocelot_setup_ptp_traps(struct ocelot *ocelot, int port,
+ if (err)
+ return err;
+
++ if (l2)
++ ocelot_port->trap_proto |= OCELOT_PROTO_PTP_L2;
++ if (l4)
++ ocelot_port->trap_proto |= OCELOT_PROTO_PTP_L4;
++
+ return 0;
+
+ err_ipv6:
+@@ -474,10 +483,38 @@ static int ocelot_setup_ptp_traps(struct ocelot *ocelot, int port,
+ return err;
+ }
+
++static int ocelot_traps_to_ptp_rx_filter(unsigned int proto)
++{
++ if ((proto & OCELOT_PROTO_PTP_L2) && (proto & OCELOT_PROTO_PTP_L4))
++ return HWTSTAMP_FILTER_PTP_V2_EVENT;
++ else if (proto & OCELOT_PROTO_PTP_L2)
++ return HWTSTAMP_FILTER_PTP_V2_L2_EVENT;
++ else if (proto & OCELOT_PROTO_PTP_L4)
++ return HWTSTAMP_FILTER_PTP_V2_L4_EVENT;
++
++ return HWTSTAMP_FILTER_NONE;
++}
++
+ int ocelot_hwstamp_get(struct ocelot *ocelot, int port, struct ifreq *ifr)
+ {
+- return copy_to_user(ifr->ifr_data, &ocelot->hwtstamp_config,
+- sizeof(ocelot->hwtstamp_config)) ? -EFAULT : 0;
++ struct ocelot_port *ocelot_port = ocelot->ports[port];
++ struct hwtstamp_config cfg = {};
++
++ switch (ocelot_port->ptp_cmd) {
++ case IFH_REW_OP_TWO_STEP_PTP:
++ cfg.tx_type = HWTSTAMP_TX_ON;
++ break;
++ case IFH_REW_OP_ORIGIN_PTP:
++ cfg.tx_type = HWTSTAMP_TX_ONESTEP_SYNC;
++ break;
++ default:
++ cfg.tx_type = HWTSTAMP_TX_OFF;
++ break;
++ }
++
++ cfg.rx_filter = ocelot_traps_to_ptp_rx_filter(ocelot_port->trap_proto);
++
++ return copy_to_user(ifr->ifr_data, &cfg, sizeof(cfg)) ? -EFAULT : 0;
+ }
+ EXPORT_SYMBOL(ocelot_hwstamp_get);
+
+@@ -509,8 +546,6 @@ int ocelot_hwstamp_set(struct ocelot *ocelot, int port, struct ifreq *ifr)
+ return -ERANGE;
+ }
+
+- mutex_lock(&ocelot->ptp_lock);
+-
+ switch (cfg.rx_filter) {
+ case HWTSTAMP_FILTER_NONE:
+ break;
+@@ -531,28 +566,14 @@ int ocelot_hwstamp_set(struct ocelot *ocelot, int port, struct ifreq *ifr)
+ l4 = true;
+ break;
+ default:
+- mutex_unlock(&ocelot->ptp_lock);
+ return -ERANGE;
+ }
+
+ err = ocelot_setup_ptp_traps(ocelot, port, l2, l4);
+- if (err) {
+- mutex_unlock(&ocelot->ptp_lock);
++ if (err)
+ return err;
+- }
+-
+- if (l2 && l4)
+- cfg.rx_filter = HWTSTAMP_FILTER_PTP_V2_EVENT;
+- else if (l2)
+- cfg.rx_filter = HWTSTAMP_FILTER_PTP_V2_L2_EVENT;
+- else if (l4)
+- cfg.rx_filter = HWTSTAMP_FILTER_PTP_V2_L4_EVENT;
+- else
+- cfg.rx_filter = HWTSTAMP_FILTER_NONE;
+
+- /* Commit back the result & save it */
+- memcpy(&ocelot->hwtstamp_config, &cfg, sizeof(cfg));
+- mutex_unlock(&ocelot->ptp_lock);
++ cfg.rx_filter = ocelot_traps_to_ptp_rx_filter(ocelot_port->trap_proto);
+
+ return copy_to_user(ifr->ifr_data, &cfg, sizeof(cfg)) ? -EFAULT : 0;
+ }
+diff --git a/include/soc/mscc/ocelot.h b/include/soc/mscc/ocelot.h
+index cb8fbb2418795..22aae505c813b 100644
+--- a/include/soc/mscc/ocelot.h
++++ b/include/soc/mscc/ocelot.h
+@@ -730,6 +730,11 @@ enum macaccess_entry_type {
+ ENTRYTYPE_MACv6,
+ };
+
++enum ocelot_proto {
++ OCELOT_PROTO_PTP_L2 = BIT(0),
++ OCELOT_PROTO_PTP_L4 = BIT(1),
++};
++
+ #define OCELOT_QUIRK_PCS_PERFORMS_RATE_ADAPTATION BIT(0)
+ #define OCELOT_QUIRK_QSGMII_PORTS_MUST_BE_UP BIT(1)
+
+@@ -775,6 +780,8 @@ struct ocelot_port {
+ unsigned int ptp_skbs_in_flight;
+ struct sk_buff_head tx_skbs;
+
++ unsigned int trap_proto;
++
+ u16 mrp_ring_id;
+
+ u8 ptp_cmd;
+@@ -868,12 +875,9 @@ struct ocelot {
+ u8 mm_supported:1;
+ struct ptp_clock *ptp_clock;
+ struct ptp_clock_info ptp_info;
+- struct hwtstamp_config hwtstamp_config;
+ unsigned int ptp_skbs_in_flight;
+ /* Protects the 2-step TX timestamp ID logic */
+ spinlock_t ts_id_lock;
+- /* Protects the PTP interface state */
+- struct mutex ptp_lock;
+ /* Protects the PTP clock */
+ spinlock_t ptp_clock_lock;
+ struct ptp_pin_desc ptp_pins[OCELOT_PTP_PINS_NUM];
+--
+2.39.2
+
--- /dev/null
+From d8225dbddc010c37d6d26e87a68a47eaa703a8a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jun 2023 19:31:12 +0300
+Subject: net: mscc: ocelot: don't report that RX timestamping is enabled by
+ default
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit 4fd44b82b7aceaa35c2901c6546d2c4198e0799d ]
+
+PTP RX timestamping should be enabled when the user requests it, not by
+default. If it is enabled by default, it can be problematic when the
+ocelot driver is a DSA master, and it sidesteps what DSA tries to avoid
+through __dsa_master_hwtstamp_validate().
+
+Additionally, after the change which made ocelot trap PTP packets only
+to the CPU at ocelot_hwtstamp_set() time, it is no longer even true that
+RX timestamping is enabled by default, because until ocelot_hwtstamp_set()
+is called, the PTP traps are actually not set up. So the rx_filter field
+of ocelot->hwtstamp_config reflects an incorrect reality.
+
+Fixes: 96ca08c05838 ("net: mscc: ocelot: set up traps for PTP packets")
+Fixes: 4e3b0468e6d7 ("net: mscc: PTP Hardware Clock (PHC) support")
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mscc/ocelot_ptp.c | 5 -----
+ 1 file changed, 5 deletions(-)
+
+diff --git a/drivers/net/ethernet/mscc/ocelot_ptp.c b/drivers/net/ethernet/mscc/ocelot_ptp.c
+index 2180ae94c7447..673bfd70867a6 100644
+--- a/drivers/net/ethernet/mscc/ocelot_ptp.c
++++ b/drivers/net/ethernet/mscc/ocelot_ptp.c
+@@ -824,11 +824,6 @@ int ocelot_init_timestamp(struct ocelot *ocelot,
+
+ ocelot_write(ocelot, PTP_CFG_MISC_PTP_EN, PTP_CFG_MISC);
+
+- /* There is no device reconfiguration, PTP Rx stamping is always
+- * enabled.
+- */
+- ocelot->hwtstamp_config.rx_filter = HWTSTAMP_FILTER_PTP_V2_EVENT;
+-
+ return 0;
+ }
+ EXPORT_SYMBOL(ocelot_init_timestamp);
+--
+2.39.2
+
--- /dev/null
+From 729bf094b7aa56b2f2fbf39514d0999b1af165eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jun 2023 14:38:12 +0200
+Subject: net/sched: act_ipt: add sanity checks on skb before calling target
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit b2dc32dcba08bf55cec600caa76f4afd2e3614df ]
+
+Netfilter targets make assumptions on the skb state, for example
+iphdr is supposed to be in the linear area.
+
+This is normally done by IP stack, but in act_ipt case no
+such checks are made.
+
+Some targets can even assume that skb_dst will be valid.
+Make a minimum effort to check for this:
+
+- Don't call the targets eval function for non-ipv4 skbs.
+- Don't call the targets eval function for POSTROUTING
+ emulation when the skb has no dst set.
+
+v3: use skb_protocol helper (Davide Caratti)
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sched/act_ipt.c | 33 +++++++++++++++++++++++++++++++++
+ 1 file changed, 33 insertions(+)
+
+diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c
+index ea7f151e7dd29..a6b522b512dc3 100644
+--- a/net/sched/act_ipt.c
++++ b/net/sched/act_ipt.c
+@@ -230,6 +230,26 @@ static int tcf_xt_init(struct net *net, struct nlattr *nla,
+ a, &act_xt_ops, tp, flags);
+ }
+
++static bool tcf_ipt_act_check(struct sk_buff *skb)
++{
++ const struct iphdr *iph;
++ unsigned int nhoff, len;
++
++ if (!pskb_may_pull(skb, sizeof(struct iphdr)))
++ return false;
++
++ nhoff = skb_network_offset(skb);
++ iph = ip_hdr(skb);
++ if (iph->ihl < 5 || iph->version != 4)
++ return false;
++
++ len = skb_ip_totlen(skb);
++ if (skb->len < nhoff + len || len < (iph->ihl * 4u))
++ return false;
++
++ return pskb_may_pull(skb, iph->ihl * 4u);
++}
++
+ TC_INDIRECT_SCOPE int tcf_ipt_act(struct sk_buff *skb,
+ const struct tc_action *a,
+ struct tcf_result *res)
+@@ -244,9 +264,22 @@ TC_INDIRECT_SCOPE int tcf_ipt_act(struct sk_buff *skb,
+ .pf = NFPROTO_IPV4,
+ };
+
++ if (skb_protocol(skb, false) != htons(ETH_P_IP))
++ return TC_ACT_UNSPEC;
++
+ if (skb_unclone(skb, GFP_ATOMIC))
+ return TC_ACT_UNSPEC;
+
++ if (!tcf_ipt_act_check(skb))
++ return TC_ACT_UNSPEC;
++
++ if (state.hook == NF_INET_POST_ROUTING) {
++ if (!skb_dst(skb))
++ return TC_ACT_UNSPEC;
++
++ state.out = skb->dev;
++ }
++
+ spin_lock(&ipt->tcf_lock);
+
+ tcf_lastuse_update(&ipt->tcf_tm);
+--
+2.39.2
+
--- /dev/null
+From 420f98997693e6b6d433f2a717af450ee7b5ed45 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jun 2023 14:38:11 +0200
+Subject: net/sched: act_ipt: add sanity checks on table name and hook
+ locations
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit b4ee93380b3c891fea996af8d1d3ca0e36ad31f0 ]
+
+Looks like "tc" hard-codes "mangle" as the only supported table
+name, but on kernel side there are no checks.
+
+This is wrong. Not all xtables targets are safe to call from tc.
+E.g. "nat" targets assume skb has a conntrack object assigned to it.
+Normally those get called from netfilter nat core which consults the
+nat table to obtain the address mapping.
+
+"tc" userspace either sets PRE or POSTROUTING as hook number, but there
+is no validation of this on kernel side, so update netlink policy to
+reject bogus numbers. Some targets may assume skb_dst is set for
+input/forward hooks, so prevent those from being used.
+
+act_ipt uses the hook number in two places:
+1. the state hook number, this is fine as-is
+2. to set par.hook_mask
+
+The latter is a bit mask, so update the assignment to make
+xt_check_target() to the right thing.
+
+Followup patch adds required checks for the skb/packet headers before
+calling the targets evaluation function.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sched/act_ipt.c | 27 ++++++++++++++++++++-------
+ 1 file changed, 20 insertions(+), 7 deletions(-)
+
+diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c
+index 5d96ffebd40f0..ea7f151e7dd29 100644
+--- a/net/sched/act_ipt.c
++++ b/net/sched/act_ipt.c
+@@ -48,7 +48,7 @@ static int ipt_init_target(struct net *net, struct xt_entry_target *t,
+ par.entryinfo = &e;
+ par.target = target;
+ par.targinfo = t->data;
+- par.hook_mask = hook;
++ par.hook_mask = 1 << hook;
+ par.family = NFPROTO_IPV4;
+
+ ret = xt_check_target(&par, t->u.target_size - sizeof(*t), 0, false);
+@@ -85,7 +85,8 @@ static void tcf_ipt_release(struct tc_action *a)
+
+ static const struct nla_policy ipt_policy[TCA_IPT_MAX + 1] = {
+ [TCA_IPT_TABLE] = { .type = NLA_STRING, .len = IFNAMSIZ },
+- [TCA_IPT_HOOK] = { .type = NLA_U32 },
++ [TCA_IPT_HOOK] = NLA_POLICY_RANGE(NLA_U32, NF_INET_PRE_ROUTING,
++ NF_INET_NUMHOOKS),
+ [TCA_IPT_INDEX] = { .type = NLA_U32 },
+ [TCA_IPT_TARG] = { .len = sizeof(struct xt_entry_target) },
+ };
+@@ -158,15 +159,27 @@ static int __tcf_ipt_init(struct net *net, unsigned int id, struct nlattr *nla,
+ return -EEXIST;
+ }
+ }
++
++ err = -EINVAL;
+ hook = nla_get_u32(tb[TCA_IPT_HOOK]);
++ switch (hook) {
++ case NF_INET_PRE_ROUTING:
++ break;
++ case NF_INET_POST_ROUTING:
++ break;
++ default:
++ goto err1;
++ }
++
++ if (tb[TCA_IPT_TABLE]) {
++ /* mangle only for now */
++ if (nla_strcmp(tb[TCA_IPT_TABLE], "mangle"))
++ goto err1;
++ }
+
+- err = -ENOMEM;
+- tname = kmalloc(IFNAMSIZ, GFP_KERNEL);
++ tname = kstrdup("mangle", GFP_KERNEL);
+ if (unlikely(!tname))
+ goto err1;
+- if (tb[TCA_IPT_TABLE] == NULL ||
+- nla_strscpy(tname, tb[TCA_IPT_TABLE], IFNAMSIZ) >= IFNAMSIZ)
+- strcpy(tname, "mangle");
+
+ t = kmemdup(td, td->u.target_size, GFP_KERNEL);
+ if (unlikely(!t))
+--
+2.39.2
+
--- /dev/null
+From 98a58b19aed0dd13d79a0c5abff50ffdb962fea5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jun 2023 14:38:13 +0200
+Subject: net/sched: act_ipt: zero skb->cb before calling target
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit 93d75d475c5dc3404292976147d063ee4d808592 ]
+
+xtables relies on skb being owned by ip stack, i.e. with ipv4
+check in place skb->cb is supposed to be IPCB.
+
+I don't see an immediate problem (REJECT target cannot be used anymore
+now that PRE/POSTROUTING hook validation has been fixed), but better be
+safe than sorry.
+
+A much better patch would be to either mark act_ipt as
+"depends on BROKEN" or remove it altogether. I plan to do this
+for -next in the near future.
+
+This tc extension is broken in the sense that tc lacks an
+equivalent of NF_STOLEN verdict.
+
+With NF_STOLEN, target function takes complete ownership of skb, caller
+cannot dereference it anymore.
+
+ACT_STOLEN cannot be used for this: it has a different meaning, caller
+is allowed to dereference the skb.
+
+At this time NF_STOLEN won't be returned by any targets as far as I can
+see, but this may change in the future.
+
+It might be possible to work around this via list of allowed
+target extensions known to only return DROP or ACCEPT verdicts, but this
+is error prone/fragile.
+
+Existing selftest only validates xt_LOG and act_ipt is restricted
+to ipv4 so I don't think this action is used widely.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sched/act_ipt.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c
+index a6b522b512dc3..598d6e299152a 100644
+--- a/net/sched/act_ipt.c
++++ b/net/sched/act_ipt.c
+@@ -21,6 +21,7 @@
+ #include <linux/tc_act/tc_ipt.h>
+ #include <net/tc_act/tc_ipt.h>
+ #include <net/tc_wrapper.h>
++#include <net/ip.h>
+
+ #include <linux/netfilter_ipv4/ip_tables.h>
+
+@@ -254,6 +255,7 @@ TC_INDIRECT_SCOPE int tcf_ipt_act(struct sk_buff *skb,
+ const struct tc_action *a,
+ struct tcf_result *res)
+ {
++ char saved_cb[sizeof_field(struct sk_buff, cb)];
+ int ret = 0, result = 0;
+ struct tcf_ipt *ipt = to_ipt(a);
+ struct xt_action_param par;
+@@ -280,6 +282,8 @@ TC_INDIRECT_SCOPE int tcf_ipt_act(struct sk_buff *skb,
+ state.out = skb->dev;
+ }
+
++ memcpy(saved_cb, skb->cb, sizeof(saved_cb));
++
+ spin_lock(&ipt->tcf_lock);
+
+ tcf_lastuse_update(&ipt->tcf_tm);
+@@ -292,6 +296,9 @@ TC_INDIRECT_SCOPE int tcf_ipt_act(struct sk_buff *skb,
+ par.state = &state;
+ par.target = ipt->tcfi_t->u.kernel.target;
+ par.targinfo = ipt->tcfi_t->data;
++
++ memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));
++
+ ret = par.target->target(skb, &par);
+
+ switch (ret) {
+@@ -312,6 +319,9 @@ TC_INDIRECT_SCOPE int tcf_ipt_act(struct sk_buff *skb,
+ break;
+ }
+ spin_unlock(&ipt->tcf_lock);
++
++ memcpy(skb->cb, saved_cb, sizeof(skb->cb));
++
+ return result;
+
+ }
+--
+2.39.2
+
--- /dev/null
+From cf54be45d5b89997ef03f2b427af7b13387db40f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Jul 2023 19:08:42 +0800
+Subject: net/sched: act_pedit: Add size check for TCA_PEDIT_PARMS_EX
+
+From: Lin Ma <linma@zju.edu.cn>
+
+[ Upstream commit 30c45b5361d39b4b793780ffac5538090b9e2eb1 ]
+
+The attribute TCA_PEDIT_PARMS_EX is not be included in pedit_policy and
+one malicious user could fake a TCA_PEDIT_PARMS_EX whose length is
+smaller than the intended sizeof(struct tc_pedit). Hence, the
+dereference in tcf_pedit_init() could access dirty heap data.
+
+static int tcf_pedit_init(...)
+{
+ // ...
+ pattr = tb[TCA_PEDIT_PARMS]; // TCA_PEDIT_PARMS is included
+ if (!pattr)
+ pattr = tb[TCA_PEDIT_PARMS_EX]; // but this is not
+
+ // ...
+ parm = nla_data(pattr);
+
+ index = parm->index; // parm is able to be smaller than 4 bytes
+ // and this dereference gets dirty skb_buff
+ // data created in netlink_sendmsg
+}
+
+This commit adds TCA_PEDIT_PARMS_EX length in pedit_policy which avoid
+the above case, just like the TCA_PEDIT_PARMS.
+
+Fixes: 71d0ed7079df ("net/act_pedit: Support using offset relative to the conventional network headers")
+Signed-off-by: Lin Ma <linma@zju.edu.cn>
+Reviewed-by: Pedro Tammela <pctammela@mojatatu.com>
+Link: https://lore.kernel.org/r/20230703110842.590282-1-linma@zju.edu.cn
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sched/act_pedit.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c
+index c819b812a899c..399d4643a940e 100644
+--- a/net/sched/act_pedit.c
++++ b/net/sched/act_pedit.c
+@@ -29,6 +29,7 @@ static struct tc_action_ops act_pedit_ops;
+
+ static const struct nla_policy pedit_policy[TCA_PEDIT_MAX + 1] = {
+ [TCA_PEDIT_PARMS] = { .len = sizeof(struct tc_pedit) },
++ [TCA_PEDIT_PARMS_EX] = { .len = sizeof(struct tc_pedit) },
+ [TCA_PEDIT_KEYS_EX] = { .type = NLA_NESTED },
+ };
+
+--
+2.39.2
+
--- /dev/null
+From 8785b4d3457ed09c52e0a75b5bb037c6f8d277a3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Dec 2022 00:28:07 +0800
+Subject: ntfs: Fix panic about slab-out-of-bounds caused by ntfs_listxattr()
+
+From: Zeng Heng <zengheng4@huawei.com>
+
+[ Upstream commit 3c675ddffb17a8b1e32efad5c983254af18b12c2 ]
+
+Here is a BUG report from syzbot:
+
+BUG: KASAN: slab-out-of-bounds in ntfs_list_ea fs/ntfs3/xattr.c:191 [inline]
+BUG: KASAN: slab-out-of-bounds in ntfs_listxattr+0x401/0x570 fs/ntfs3/xattr.c:710
+Read of size 1 at addr ffff888021acaf3d by task syz-executor128/3632
+
+Call Trace:
+ ntfs_list_ea fs/ntfs3/xattr.c:191 [inline]
+ ntfs_listxattr+0x401/0x570 fs/ntfs3/xattr.c:710
+ vfs_listxattr fs/xattr.c:457 [inline]
+ listxattr+0x293/0x2d0 fs/xattr.c:804
+
+Fix the logic of ea_all iteration. When the ea->name_len is 0,
+return immediately, or Add2Ptr() would visit invalid memory
+in the next loop.
+
+Fixes: be71b5cba2e6 ("fs/ntfs3: Add attrib operations")
+Reported-by: syzbot+9fcea5ef6dc4dc72d334@syzkaller.appspotmail.com
+Signed-off-by: Zeng Heng <zengheng4@huawei.com>
+[almaz.alexandrovich@paragon-software.com: lines of the patch have changed]
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/xattr.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/fs/ntfs3/xattr.c b/fs/ntfs3/xattr.c
+index c3de60a4543fa..fd02fcf4d4091 100644
+--- a/fs/ntfs3/xattr.c
++++ b/fs/ntfs3/xattr.c
+@@ -214,6 +214,9 @@ static ssize_t ntfs_list_ea(struct ntfs_inode *ni, char *buffer,
+ ea = Add2Ptr(ea_all, off);
+ ea_size = unpacked_ea_size(ea);
+
++ if (!ea->name_len)
++ break;
++
+ if (buffer) {
+ if (ret + ea->name_len + 1 > bytes_per_buffer) {
+ err = -ERANGE;
+--
+2.39.2
+
--- /dev/null
+From 6120bcb86b35560bd2d05bf8e88f15d5c51d7fde Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 11 Jun 2023 15:03:06 +0100
+Subject: nvmem: imx-ocotp: Reverse MAC addresses on all i.MX derivates
+
+From: Alexander Stein <alexander.stein@ew.tq-group.com>
+
+[ Upstream commit 8a00fc606312c68b98add8fe8e6f7a013ce29e78 ]
+
+Not just i.MX8M, but all i.MX6/7 (and subtypes) need to reverse the
+MAC address read from fuses. Exceptions are i.MX6SLL and i.MX7ULP which
+do not support ethernet at all.
+
+Fixes: d0221a780cbc ("nvmem: imx-ocotp: add support for post processing")
+Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Tested-by: Richard Leitner <richard.leitner@skidata.com> # imx6q
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Message-ID: <20230611140330.154222-3-srinivas.kandagatla@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvmem/imx-ocotp.c | 8 +-------
+ 1 file changed, 1 insertion(+), 7 deletions(-)
+
+diff --git a/drivers/nvmem/imx-ocotp.c b/drivers/nvmem/imx-ocotp.c
+index ac0edb6398f1e..c1af271052276 100644
+--- a/drivers/nvmem/imx-ocotp.c
++++ b/drivers/nvmem/imx-ocotp.c
+@@ -97,7 +97,6 @@ struct ocotp_params {
+ unsigned int bank_address_words;
+ void (*set_timing)(struct ocotp_priv *priv);
+ struct ocotp_ctrl_reg ctrl;
+- bool reverse_mac_address;
+ };
+
+ static int imx_ocotp_wait_for_busy(struct ocotp_priv *priv, u32 flags)
+@@ -545,7 +544,6 @@ static const struct ocotp_params imx8mq_params = {
+ .bank_address_words = 0,
+ .set_timing = imx_ocotp_set_imx6_timing,
+ .ctrl = IMX_OCOTP_BM_CTRL_DEFAULT,
+- .reverse_mac_address = true,
+ };
+
+ static const struct ocotp_params imx8mm_params = {
+@@ -553,7 +551,6 @@ static const struct ocotp_params imx8mm_params = {
+ .bank_address_words = 0,
+ .set_timing = imx_ocotp_set_imx6_timing,
+ .ctrl = IMX_OCOTP_BM_CTRL_DEFAULT,
+- .reverse_mac_address = true,
+ };
+
+ static const struct ocotp_params imx8mn_params = {
+@@ -561,7 +558,6 @@ static const struct ocotp_params imx8mn_params = {
+ .bank_address_words = 0,
+ .set_timing = imx_ocotp_set_imx6_timing,
+ .ctrl = IMX_OCOTP_BM_CTRL_DEFAULT,
+- .reverse_mac_address = true,
+ };
+
+ static const struct ocotp_params imx8mp_params = {
+@@ -569,7 +565,6 @@ static const struct ocotp_params imx8mp_params = {
+ .bank_address_words = 0,
+ .set_timing = imx_ocotp_set_imx6_timing,
+ .ctrl = IMX_OCOTP_BM_CTRL_8MP,
+- .reverse_mac_address = true,
+ };
+
+ static const struct of_device_id imx_ocotp_dt_ids[] = {
+@@ -624,8 +619,7 @@ static int imx_ocotp_probe(struct platform_device *pdev)
+ imx_ocotp_nvmem_config.size = 4 * priv->params->nregs;
+ imx_ocotp_nvmem_config.dev = dev;
+ imx_ocotp_nvmem_config.priv = priv;
+- if (priv->params->reverse_mac_address)
+- imx_ocotp_nvmem_config.layout = &imx_ocotp_layout;
++ imx_ocotp_nvmem_config.layout = &imx_ocotp_layout;
+
+ priv->config = &imx_ocotp_nvmem_config;
+
+--
+2.39.2
+
--- /dev/null
+From 61a22f1a057534d1a8d625f9ba6a1dd8a5b53017 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 11 Jun 2023 15:03:09 +0100
+Subject: nvmem: rmem: Use NVMEM_DEVID_AUTO
+
+From: Phil Elwell <phil@raspberrypi.com>
+
+[ Upstream commit 09dd7b993eddb3b48634fd5ddf27aa799785a9ee ]
+
+It is reasonable to declare multiple nvmem blocks. Unless a unique 'id'
+is passed in for each block there may be name clashes.
+
+Avoid this by using the magic token NVMEM_DEVID_AUTO.
+
+Fixes: 5a3fa75a4d9c ("nvmem: Add driver to expose reserved memory as nvmem")
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+Signed-off-by: Ivan T. Ivanov <iivanov@suse.de>
+Reviewed-by: Stefan Wahren <stefan.wahren@i2se.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Message-ID: <20230611140330.154222-6-srinivas.kandagatla@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvmem/rmem.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/nvmem/rmem.c b/drivers/nvmem/rmem.c
+index 80cb187f14817..752d0bf4445ee 100644
+--- a/drivers/nvmem/rmem.c
++++ b/drivers/nvmem/rmem.c
+@@ -71,6 +71,7 @@ static int rmem_probe(struct platform_device *pdev)
+ config.dev = dev;
+ config.priv = priv;
+ config.name = "rmem";
++ config.id = NVMEM_DEVID_AUTO;
+ config.size = mem->size;
+ config.reg_read = rmem_read;
+
+--
+2.39.2
+
--- /dev/null
+From 9691d43fa41f72252a3e94dd1785b9e81d56c88b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 May 2023 16:52:36 +0800
+Subject: nvmem: sunplus-ocotp: release otp->clk before return
+
+From: Yi Yingao <m202271736@hust.edu.cn>
+
+[ Upstream commit 095bb8ba45f28ed15296eb5b7662e03e57d5e34e ]
+
+Smatch reports:
+drivers/nvmem/sunplus-ocotp.c:205 sp_ocotp_probe()
+warn: 'otp->clk' from clk_prepare() not released on lines: 196.
+
+In the function sp_ocotp_probe(struct platform_device *pdev), otp->clk may
+not be released before return.
+
+To fix this issue, using function clk_unprepare() to release otp->clk.
+
+Fixes: 8747ec2e9762 ("nvmem: Add driver for OCOTP in Sunplus SP7021")
+Signed-off-by: Yi Yingao <m202271736@hust.edu.cn>
+Reviewed-by: Dongliang Mu <dzm91@hust.edu.cn>
+Message-ID: <20230509085237.5917-1-m202271736@hust.edu.cn>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvmem/sunplus-ocotp.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/nvmem/sunplus-ocotp.c b/drivers/nvmem/sunplus-ocotp.c
+index 52b928a7a6d58..f85350b17d672 100644
+--- a/drivers/nvmem/sunplus-ocotp.c
++++ b/drivers/nvmem/sunplus-ocotp.c
+@@ -192,9 +192,11 @@ static int sp_ocotp_probe(struct platform_device *pdev)
+ sp_ocotp_nvmem_config.dev = dev;
+
+ nvmem = devm_nvmem_register(dev, &sp_ocotp_nvmem_config);
+- if (IS_ERR(nvmem))
+- return dev_err_probe(&pdev->dev, PTR_ERR(nvmem),
++ if (IS_ERR(nvmem)) {
++ ret = dev_err_probe(&pdev->dev, PTR_ERR(nvmem),
+ "register nvmem device fail\n");
++ goto err;
++ }
+
+ platform_set_drvdata(pdev, nvmem);
+
+@@ -203,6 +205,9 @@ static int sp_ocotp_probe(struct platform_device *pdev)
+ (int)OTP_WORD_SIZE, (int)QAC628_OTP_SIZE);
+
+ return 0;
++err:
++ clk_unprepare(otp->clk);
++ return ret;
+ }
+
+ static const struct of_device_id sp_ocotp_dt_ids[] = {
+--
+2.39.2
+
--- /dev/null
+From ff852d3a7c3abbf8c2bd1607db3101d6aad4a8b7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Jul 2023 09:56:53 +0530
+Subject: octeontx-af: fix hardware timestamp configuration
+
+From: Hariprasad Kelam <hkelam@marvell.com>
+
+[ Upstream commit 14bb236b29922c4f57d8c05bfdbcb82677f917c9 ]
+
+MAC block on CN10K (RPM) supports hardware timestamp configuration. The
+previous patch which added timestamp configuration support has a bug.
+Though the netdev driver requests to disable timestamp configuration,
+the driver is always enabling it.
+
+This patch fixes the same.
+
+Fixes: d1489208681d ("octeontx2-af: cn10k: RPM hardware timestamp configuration")
+Signed-off-by: Hariprasad Kelam <hkelam@marvell.com>
+Signed-off-by: Sunil Goutham <sgoutham@marvell.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c
+index 4b8559ac0404f..095b2cc4a6999 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c
+@@ -763,7 +763,7 @@ static int rvu_cgx_ptp_rx_cfg(struct rvu *rvu, u16 pcifunc, bool enable)
+ cgxd = rvu_cgx_pdata(cgx_id, rvu);
+
+ mac_ops = get_mac_ops(cgxd);
+- mac_ops->mac_enadis_ptp_config(cgxd, lmac_id, true);
++ mac_ops->mac_enadis_ptp_config(cgxd, lmac_id, enable);
+ /* If PTP is enabled then inform NPC that packets to be
+ * parsed by this PF will have their data shifted by 8 bytes
+ * and if PTP is disabled then no shift is required
+--
+2.39.2
+
--- /dev/null
+From 6f30c568f863455f5246959022a050716b94da38 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Jun 2023 11:58:44 +0530
+Subject: octeontx2-af: Add validation before accessing cgx and lmac
+
+From: Hariprasad Kelam <hkelam@marvell.com>
+
+[ Upstream commit 79ebb53772c95d3a6ae51b3c65f9985fdd430df6 ]
+
+with the addition of new MAC blocks like CN10K RPM and CN10KB
+RPM_USX, LMACs are noncontiguous and CGX blocks are also
+noncontiguous. But during RVU driver initialization, the driver
+is assuming they are contiguous and trying to access
+cgx or lmac with their id which is resulting in kernel panic.
+
+This patch fixes the issue by adding proper checks.
+
+[ 23.219150] pc : cgx_lmac_read+0x38/0x70
+[ 23.219154] lr : rvu_program_channels+0x3f0/0x498
+[ 23.223852] sp : ffff000100d6fc80
+[ 23.227158] x29: ffff000100d6fc80 x28: ffff00010009f880 x27:
+000000000000005a
+[ 23.234288] x26: ffff000102586768 x25: 0000000000002500 x24:
+fffffffffff0f000
+
+Fixes: 91c6945ea1f9 ("octeontx2-af: cn10k: Add RPM MAC support")
+Signed-off-by: Hariprasad Kelam <hkelam@marvell.com>
+Signed-off-by: Sunil Goutham <sgoutham@marvell.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/octeontx2/af/cgx.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c
+index bd77152bb8d7c..f4bdca662d616 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c
+@@ -169,6 +169,9 @@ void cgx_lmac_write(int cgx_id, int lmac_id, u64 offset, u64 val)
+ {
+ struct cgx *cgx_dev = cgx_get_pdata(cgx_id);
+
++ /* Software must not access disabled LMAC registers */
++ if (!is_lmac_valid(cgx_dev, lmac_id))
++ return;
+ cgx_write(cgx_dev, lmac_id, offset, val);
+ }
+
+@@ -176,6 +179,10 @@ u64 cgx_lmac_read(int cgx_id, int lmac_id, u64 offset)
+ {
+ struct cgx *cgx_dev = cgx_get_pdata(cgx_id);
+
++ /* Software must not access disabled LMAC registers */
++ if (!is_lmac_valid(cgx_dev, lmac_id))
++ return 0;
++
+ return cgx_read(cgx_dev, lmac_id, offset);
+ }
+
+--
+2.39.2
+
--- /dev/null
+From a11892a35bb4a51ce4c508893fd2209b45ae8693 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Jun 2023 11:58:42 +0530
+Subject: octeontx2-af: cn10kb: fix interrupt csr addresses
+
+From: Hariprasad Kelam <hkelam@marvell.com>
+
+[ Upstream commit 4c5a331cacda995e995a7857f0e44e8937d98d2c ]
+
+The current design is that, for asynchronous events like link_up and
+link_down firmware raises the interrupt to kernel. The previous patch
+which added RPM_USX driver has a bug where it uses old csr addresses
+for configuring interrupts. Which is resulting in losing interrupts
+from source firmware.
+
+This patch fixes the issue by correcting csr addresses.
+
+Fixes: b9d0fedc6234 ("octeontx2-af: cn10kb: Add RPM_USX MAC support")
+Signed-off-by: Hariprasad Kelam <hkelam@marvell.com>
+Signed-off-by: Sunil Goutham <sgoutham@marvell.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/octeontx2/af/rpm.c | 2 +-
+ drivers/net/ethernet/marvell/octeontx2/af/rpm.h | 3 ++-
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rpm.c b/drivers/net/ethernet/marvell/octeontx2/af/rpm.c
+index de0d88dd10d65..a433f92c51eae 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rpm.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rpm.c
+@@ -47,7 +47,7 @@ static struct mac_ops rpm2_mac_ops = {
+ .int_set_reg = RPM2_CMRX_SW_INT_ENA_W1S,
+ .irq_offset = 1,
+ .int_ena_bit = BIT_ULL(0),
+- .lmac_fwi = RPM_LMAC_FWI,
++ .lmac_fwi = RPM2_LMAC_FWI,
+ .non_contiguous_serdes_lane = true,
+ .rx_stats_cnt = 43,
+ .tx_stats_cnt = 34,
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rpm.h b/drivers/net/ethernet/marvell/octeontx2/af/rpm.h
+index 22147b4c21370..be294eebab265 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rpm.h
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rpm.h
+@@ -94,7 +94,8 @@
+
+ /* CN10KB CSR Declaration */
+ #define RPM2_CMRX_SW_INT 0x1b0
+-#define RPM2_CMRX_SW_INT_ENA_W1S 0x1b8
++#define RPM2_CMRX_SW_INT_ENA_W1S 0x1c8
++#define RPM2_LMAC_FWI 0x12
+ #define RPM2_CMR_CHAN_MSK_OR 0x3120
+ #define RPM2_CMR_RX_OVR_BP_EN BIT_ULL(2)
+ #define RPM2_CMR_RX_OVR_BP_BP BIT_ULL(1)
+--
+2.39.2
+
--- /dev/null
+From 92a49ff16377d95343612e4800c1d6002060706c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Jun 2023 11:58:43 +0530
+Subject: octeontx2-af: Fix mapping for NIX block from CGX connection
+
+From: Hariprasad Kelam <hkelam@marvell.com>
+
+[ Upstream commit 2e7bc57b976bb016c6569a54d95c1b8d88f9450a ]
+
+Firmware configures NIX block mapping for all MAC blocks.
+The current implementation reads the configuration and
+creates the mapping between RVU PF and NIX blocks. But
+this configuration is only valid for silicons that support
+multiple blocks. For all other silicons, all MAC blocks
+map to NIX0.
+
+This patch corrects the mapping by adding a check for the same.
+
+Fixes: c5a73b632b90 ("octeontx2-af: Map NIX block from CGX connection")
+Signed-off-by: Hariprasad Kelam <hkelam@marvell.com>
+Signed-off-by: Sunil Goutham <sgoutham@marvell.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/octeontx2/af/rvu.h | 11 +++++++++++
+ drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c | 2 +-
+ 2 files changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu.h b/drivers/net/ethernet/marvell/octeontx2/af/rvu.h
+index d655bf04a483d..68ff3244a84a2 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu.h
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu.h
+@@ -23,6 +23,7 @@
+ #define PCI_DEVID_OCTEONTX2_LBK 0xA061
+
+ /* Subsystem Device ID */
++#define PCI_SUBSYS_DEVID_98XX 0xB100
+ #define PCI_SUBSYS_DEVID_96XX 0xB200
+ #define PCI_SUBSYS_DEVID_CN10K_A 0xB900
+ #define PCI_SUBSYS_DEVID_CNF10K_B 0xBC00
+@@ -669,6 +670,16 @@ static inline u16 rvu_nix_chan_cpt(struct rvu *rvu, u8 chan)
+ return rvu->hw->cpt_chan_base + chan;
+ }
+
++static inline bool is_rvu_supports_nix1(struct rvu *rvu)
++{
++ struct pci_dev *pdev = rvu->pdev;
++
++ if (pdev->subsystem_device == PCI_SUBSYS_DEVID_98XX)
++ return true;
++
++ return false;
++}
++
+ /* Function Prototypes
+ * RVU
+ */
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c
+index 83b342fa8d753..48611e6032284 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c
+@@ -114,7 +114,7 @@ static void rvu_map_cgx_nix_block(struct rvu *rvu, int pf,
+ p2x = cgx_lmac_get_p2x(cgx_id, lmac_id);
+ /* Firmware sets P2X_SELECT as either NIX0 or NIX1 */
+ pfvf->nix_blkaddr = BLKADDR_NIX0;
+- if (p2x == CMR_P2X_SEL_NIX1)
++ if (is_rvu_supports_nix1(rvu) && p2x == CMR_P2X_SEL_NIX1)
+ pfvf->nix_blkaddr = BLKADDR_NIX1;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From fd088009fbc452be49e88fb957011e9dda98923d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Jun 2023 11:58:45 +0530
+Subject: octeontx2-af: Reset MAC features in FLR
+
+From: Hariprasad Kelam <hkelam@marvell.com>
+
+[ Upstream commit 2e3e94c2f5dc98a8a0e93850407064bc5389c306 ]
+
+AF driver configures MAC features like internal loopback and PFC upon
+receiving the request from PF and its VF netdev. But these
+features are not getting reset in FLR. This patch fixes the issue by
+resetting the same.
+
+Fixes: 23999b30ae67 ("octeontx2-af: Enable or disable CGX internal loopback")
+Fixes: 1121f6b02e7a ("octeontx2-af: Priority flow control configuration support")
+Signed-off-by: Hariprasad Kelam <hkelam@marvell.com>
+Signed-off-by: Sunil Goutham <sgoutham@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/marvell/octeontx2/af/cgx.c | 26 ++++++++++++++--
+ .../net/ethernet/marvell/octeontx2/af/cgx.h | 2 ++
+ .../marvell/octeontx2/af/lmac_common.h | 3 ++
+ .../net/ethernet/marvell/octeontx2/af/rpm.c | 30 +++++++++++++++++--
+ .../net/ethernet/marvell/octeontx2/af/rpm.h | 2 ++
+ .../net/ethernet/marvell/octeontx2/af/rvu.c | 1 +
+ .../net/ethernet/marvell/octeontx2/af/rvu.h | 1 +
+ .../ethernet/marvell/octeontx2/af/rvu_cgx.c | 18 +++++++++++
+ 8 files changed, 77 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c
+index f4bdca662d616..592037f4e55b6 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c
+@@ -537,14 +537,15 @@ static u32 cgx_get_lmac_fifo_len(void *cgxd, int lmac_id)
+ int cgx_lmac_internal_loopback(void *cgxd, int lmac_id, bool enable)
+ {
+ struct cgx *cgx = cgxd;
+- u8 lmac_type;
++ struct lmac *lmac;
+ u64 cfg;
+
+ if (!is_lmac_valid(cgx, lmac_id))
+ return -ENODEV;
+
+- lmac_type = cgx->mac_ops->get_lmac_type(cgx, lmac_id);
+- if (lmac_type == LMAC_MODE_SGMII || lmac_type == LMAC_MODE_QSGMII) {
++ lmac = lmac_pdata(lmac_id, cgx);
++ if (lmac->lmac_type == LMAC_MODE_SGMII ||
++ lmac->lmac_type == LMAC_MODE_QSGMII) {
+ cfg = cgx_read(cgx, lmac_id, CGXX_GMP_PCS_MRX_CTL);
+ if (enable)
+ cfg |= CGXX_GMP_PCS_MRX_CTL_LBK;
+@@ -1563,6 +1564,23 @@ int cgx_lmac_linkup_start(void *cgxd)
+ return 0;
+ }
+
++int cgx_lmac_reset(void *cgxd, int lmac_id, u8 pf_req_flr)
++{
++ struct cgx *cgx = cgxd;
++ u64 cfg;
++
++ if (!is_lmac_valid(cgx, lmac_id))
++ return -ENODEV;
++
++ /* Resetting PFC related CSRs */
++ cfg = 0xff;
++ cgx_write(cgxd, lmac_id, CGXX_CMRX_RX_LOGL_XON, cfg);
++
++ if (pf_req_flr)
++ cgx_lmac_internal_loopback(cgxd, lmac_id, false);
++ return 0;
++}
++
+ static int cgx_configure_interrupt(struct cgx *cgx, struct lmac *lmac,
+ int cnt, bool req_free)
+ {
+@@ -1682,6 +1700,7 @@ static int cgx_lmac_init(struct cgx *cgx)
+ cgx->lmac_idmap[lmac->lmac_id] = lmac;
+ set_bit(lmac->lmac_id, &cgx->lmac_bmap);
+ cgx->mac_ops->mac_pause_frm_config(cgx, lmac->lmac_id, true);
++ lmac->lmac_type = cgx->mac_ops->get_lmac_type(cgx, lmac->lmac_id);
+ }
+
+ return cgx_lmac_verify_fwi_version(cgx);
+@@ -1778,6 +1797,7 @@ static struct mac_ops cgx_mac_ops = {
+ .mac_tx_enable = cgx_lmac_tx_enable,
+ .pfc_config = cgx_lmac_pfc_config,
+ .mac_get_pfc_frm_cfg = cgx_lmac_get_pfc_frm_cfg,
++ .mac_reset = cgx_lmac_reset,
+ };
+
+ static int cgx_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/cgx.h b/drivers/net/ethernet/marvell/octeontx2/af/cgx.h
+index 5a20d93004c71..5741141796880 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/cgx.h
++++ b/drivers/net/ethernet/marvell/octeontx2/af/cgx.h
+@@ -35,6 +35,7 @@
+ #define CGXX_CMRX_INT_ENA_W1S 0x058
+ #define CGXX_CMRX_RX_ID_MAP 0x060
+ #define CGXX_CMRX_RX_STAT0 0x070
++#define CGXX_CMRX_RX_LOGL_XON 0x100
+ #define CGXX_CMRX_RX_LMACS 0x128
+ #define CGXX_CMRX_RX_DMAC_CTL0 (0x1F8 + mac_ops->csr_offset)
+ #define CGX_DMAC_CTL0_CAM_ENABLE BIT_ULL(3)
+@@ -181,4 +182,5 @@ int cgx_lmac_get_pfc_frm_cfg(void *cgxd, int lmac_id, u8 *tx_pause,
+ u8 *rx_pause);
+ int verify_lmac_fc_cfg(void *cgxd, int lmac_id, u8 tx_pause, u8 rx_pause,
+ int pfvf_idx);
++int cgx_lmac_reset(void *cgxd, int lmac_id, u8 pf_req_flr);
+ #endif /* CGX_H */
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/lmac_common.h b/drivers/net/ethernet/marvell/octeontx2/af/lmac_common.h
+index 39aaf0e4467dc..0b4cba03f2e83 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/lmac_common.h
++++ b/drivers/net/ethernet/marvell/octeontx2/af/lmac_common.h
+@@ -24,6 +24,7 @@
+ * @cgx: parent cgx port
+ * @mcast_filters_count: Number of multicast filters installed
+ * @lmac_id: lmac port id
++ * @lmac_type: lmac type like SGMII/XAUI
+ * @cmd_pend: flag set before new command is started
+ * flag cleared after command response is received
+ * @name: lmac port name
+@@ -43,6 +44,7 @@ struct lmac {
+ struct cgx *cgx;
+ u8 mcast_filters_count;
+ u8 lmac_id;
++ u8 lmac_type;
+ bool cmd_pend;
+ char *name;
+ };
+@@ -125,6 +127,7 @@ struct mac_ops {
+
+ int (*mac_get_pfc_frm_cfg)(void *cgxd, int lmac_id,
+ u8 *tx_pause, u8 *rx_pause);
++ int (*mac_reset)(void *cgxd, int lmac_id, u8 pf_req_flr);
+
+ /* FEC stats */
+ int (*get_fec_stats)(void *cgxd, int lmac_id,
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rpm.c b/drivers/net/ethernet/marvell/octeontx2/af/rpm.c
+index a433f92c51eae..b4fcb20c3f4fd 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rpm.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rpm.c
+@@ -37,6 +37,7 @@ static struct mac_ops rpm_mac_ops = {
+ .mac_tx_enable = rpm_lmac_tx_enable,
+ .pfc_config = rpm_lmac_pfc_config,
+ .mac_get_pfc_frm_cfg = rpm_lmac_get_pfc_frm_cfg,
++ .mac_reset = rpm_lmac_reset,
+ };
+
+ static struct mac_ops rpm2_mac_ops = {
+@@ -68,6 +69,7 @@ static struct mac_ops rpm2_mac_ops = {
+ .mac_tx_enable = rpm_lmac_tx_enable,
+ .pfc_config = rpm_lmac_pfc_config,
+ .mac_get_pfc_frm_cfg = rpm_lmac_get_pfc_frm_cfg,
++ .mac_reset = rpm_lmac_reset,
+ };
+
+ bool is_dev_rpm2(void *rpmd)
+@@ -537,14 +539,15 @@ u32 rpm2_get_lmac_fifo_len(void *rpmd, int lmac_id)
+ int rpm_lmac_internal_loopback(void *rpmd, int lmac_id, bool enable)
+ {
+ rpm_t *rpm = rpmd;
+- u8 lmac_type;
++ struct lmac *lmac;
+ u64 cfg;
+
+ if (!is_lmac_valid(rpm, lmac_id))
+ return -ENODEV;
+- lmac_type = rpm->mac_ops->get_lmac_type(rpm, lmac_id);
+
+- if (lmac_type == LMAC_MODE_QSGMII || lmac_type == LMAC_MODE_SGMII) {
++ lmac = lmac_pdata(lmac_id, rpm);
++ if (lmac->lmac_type == LMAC_MODE_QSGMII ||
++ lmac->lmac_type == LMAC_MODE_SGMII) {
+ dev_err(&rpm->pdev->dev, "loopback not supported for LPC mode\n");
+ return 0;
+ }
+@@ -713,3 +716,24 @@ int rpm_get_fec_stats(void *rpmd, int lmac_id, struct cgx_fec_stats_rsp *rsp)
+
+ return 0;
+ }
++
++int rpm_lmac_reset(void *rpmd, int lmac_id, u8 pf_req_flr)
++{
++ u64 rx_logl_xon, cfg;
++ rpm_t *rpm = rpmd;
++
++ if (!is_lmac_valid(rpm, lmac_id))
++ return -ENODEV;
++
++ /* Resetting PFC related CSRs */
++ rx_logl_xon = is_dev_rpm2(rpm) ? RPM2_CMRX_RX_LOGL_XON :
++ RPMX_CMRX_RX_LOGL_XON;
++ cfg = 0xff;
++
++ rpm_write(rpm, lmac_id, rx_logl_xon, cfg);
++
++ if (pf_req_flr)
++ rpm_lmac_internal_loopback(rpm, lmac_id, false);
++
++ return 0;
++}
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rpm.h b/drivers/net/ethernet/marvell/octeontx2/af/rpm.h
+index be294eebab265..b79cfbc6f8770 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rpm.h
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rpm.h
+@@ -74,6 +74,7 @@
+ #define RPMX_MTI_MAC100X_CL01_PAUSE_QUANTA 0x80A8
+ #define RPMX_MTI_MAC100X_CL89_PAUSE_QUANTA 0x8108
+ #define RPM_DEFAULT_PAUSE_TIME 0x7FF
++#define RPMX_CMRX_RX_LOGL_XON 0x4100
+
+ #define RPMX_MTI_MAC100X_XIF_MODE 0x8100
+ #define RPMX_ONESTEP_ENABLE BIT_ULL(5)
+@@ -132,4 +133,5 @@ int rpm_lmac_get_pfc_frm_cfg(void *rpmd, int lmac_id, u8 *tx_pause,
+ int rpm2_get_nr_lmacs(void *rpmd);
+ bool is_dev_rpm2(void *rpmd);
+ int rpm_get_fec_stats(void *cgxd, int lmac_id, struct cgx_fec_stats_rsp *rsp);
++int rpm_lmac_reset(void *rpmd, int lmac_id, u8 pf_req_flr);
+ #endif /* RPM_H */
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu.c
+index 9f673bda9dbdd..b26b013216933 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu.c
+@@ -2629,6 +2629,7 @@ static void __rvu_flr_handler(struct rvu *rvu, u16 pcifunc)
+ * Since LF is detached use LF number as -1.
+ */
+ rvu_npc_free_mcam_entries(rvu, pcifunc, -1);
++ rvu_mac_reset(rvu, pcifunc);
+
+ mutex_unlock(&rvu->flr_lock);
+ }
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu.h b/drivers/net/ethernet/marvell/octeontx2/af/rvu.h
+index 68ff3244a84a2..be279cd1fd729 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu.h
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu.h
+@@ -875,6 +875,7 @@ int rvu_cgx_config_tx(void *cgxd, int lmac_id, bool enable);
+ int rvu_cgx_prio_flow_ctrl_cfg(struct rvu *rvu, u16 pcifunc, u8 tx_pause, u8 rx_pause,
+ u16 pfc_en);
+ int rvu_cgx_cfg_pause_frm(struct rvu *rvu, u16 pcifunc, u8 tx_pause, u8 rx_pause);
++void rvu_mac_reset(struct rvu *rvu, u16 pcifunc);
+ u32 rvu_cgx_get_lmac_fifolen(struct rvu *rvu, int cgx, int lmac);
+ int npc_get_nixlf_mcam_index(struct npc_mcam *mcam, u16 pcifunc, int nixlf,
+ int type);
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c
+index 48611e6032284..4b8559ac0404f 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c
+@@ -1250,3 +1250,21 @@ int rvu_mbox_handler_cgx_prio_flow_ctrl_cfg(struct rvu *rvu,
+ mac_ops->mac_get_pfc_frm_cfg(cgxd, lmac_id, &rsp->tx_pause, &rsp->rx_pause);
+ return err;
+ }
++
++void rvu_mac_reset(struct rvu *rvu, u16 pcifunc)
++{
++ int pf = rvu_get_pf(pcifunc);
++ struct mac_ops *mac_ops;
++ struct cgx *cgxd;
++ u8 cgx, lmac;
++
++ if (!is_pf_cgxmapped(rvu, pf))
++ return;
++
++ rvu_get_cgx_lmac_id(rvu->pf2cgxlmac_map[pf], &cgx, &lmac);
++ cgxd = rvu_cgx_pdata(cgx, rvu);
++ mac_ops = get_mac_ops(cgxd);
++
++ if (mac_ops->mac_reset(cgxd, lmac, !is_vf(pcifunc)))
++ dev_err(rvu->dev, "Failed to reset MAC\n");
++}
+--
+2.39.2
+
--- /dev/null
+From 660b359c2200b4d839765db2779af847dbc646ff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jun 2023 21:14:03 -0700
+Subject: perf bpf: Move the declaration of struct rq
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit 5c45b210479bffe068d38902fcdcb52c4c60a264 ]
+
+struct rq is defined in vmlinux.h when the vmlinux.h is generated,
+this causes a redefinition failure if it is declared in
+lock_contention.bpf.c. Move the definition to vmlinux.h for
+consistency with the generated version.
+
+Fixes: 760ebc45746b ("perf lock contention: Add empty 'struct rq' to satisfy libbpf 'runqueue' type verification")
+Signed-off-by: Ian Rogers <irogers@google.com>
+Acked-by: Andrii Nakryiko <andrii@kernel.org>
+Acked-by: Namhyung Kim <namhyung@kernel.org>
+Acked-by: Jiri Olsa <jolsa@kernel.org>
+Cc: James Clark <james.clark@arm.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Yang Jihong <yangjihong1@huawei.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Tiezhu Yang <yangtiezhu@loongson.cn>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: bpf@vger.kernel.org
+Link: https://lore.kernel.org/r/20230623041405.4039475-3-irogers@google.com
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/bpf_skel/lock_contention.bpf.c | 2 --
+ tools/perf/util/bpf_skel/vmlinux.h | 10 ++++++++++
+ 2 files changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/tools/perf/util/bpf_skel/lock_contention.bpf.c b/tools/perf/util/bpf_skel/lock_contention.bpf.c
+index 1d48226ae75d4..8d3cfbb3cc65b 100644
+--- a/tools/perf/util/bpf_skel/lock_contention.bpf.c
++++ b/tools/perf/util/bpf_skel/lock_contention.bpf.c
+@@ -416,8 +416,6 @@ int contention_end(u64 *ctx)
+ return 0;
+ }
+
+-struct rq {};
+-
+ extern struct rq runqueues __ksym;
+
+ struct rq___old {
+diff --git a/tools/perf/util/bpf_skel/vmlinux.h b/tools/perf/util/bpf_skel/vmlinux.h
+index c7ed51b0c1ef9..ab84a6e1da5ee 100644
+--- a/tools/perf/util/bpf_skel/vmlinux.h
++++ b/tools/perf/util/bpf_skel/vmlinux.h
+@@ -171,4 +171,14 @@ struct bpf_perf_event_data_kern {
+ struct perf_sample_data *data;
+ struct perf_event *event;
+ } __attribute__((preserve_access_index));
++
++/*
++ * If 'struct rq' isn't defined for lock_contention.bpf.c, for the sake of
++ * rq___old and rq___new, then the type for the 'runqueue' variable ends up
++ * being a forward declaration (BTF_KIND_FWD) while the kernel has it defined
++ * (BTF_KIND_STRUCT). The definition appears in vmlinux.h rather than
++ * lock_contention.bpf.c for consistency with a generated vmlinux.h.
++ */
++struct rq {};
++
+ #endif // __VMLINUX_H
+--
+2.39.2
+
--- /dev/null
+From f68b8703bd4cdd93659f5a7d78009ce1b543c331 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Jun 2023 11:39:58 +0200
+Subject: phy: qcom: qmp-combo: fix Display Port PHY configuration for SM8550
+
+From: Neil Armstrong <neil.armstrong@linaro.org>
+
+[ Upstream commit 6cd52a2a06774c6c454ffef084c3d9b17618ca23 ]
+
+The SM8550 PHY also uses a different offset for the CMN_STATUS reg,
+use the right one for the v6 Display Port configuration.
+
+Fixes: 49742e9edab3 ("phy: qcom-qmp-combo: Add support for SM8550")
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20230601-topic-sm8550-upstream-dp-phy-init-fix-v1-1-4e9da9f97991@linaro.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/qualcomm/phy-qcom-qmp-combo.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/phy/qualcomm/phy-qcom-qmp-combo.c b/drivers/phy/qualcomm/phy-qcom-qmp-combo.c
+index 87b17e5877ab8..1fdcc81661ed8 100644
+--- a/drivers/phy/qualcomm/phy-qcom-qmp-combo.c
++++ b/drivers/phy/qualcomm/phy-qcom-qmp-combo.c
+@@ -2142,6 +2142,7 @@ static void qmp_v4_configure_dp_tx(struct qmp_combo *qmp)
+ static int qmp_v456_configure_dp_phy(struct qmp_combo *qmp,
+ unsigned int com_resetm_ctrl_reg,
+ unsigned int com_c_ready_status_reg,
++ unsigned int com_cmn_status_reg,
+ unsigned int dp_phy_status_reg)
+ {
+ const struct phy_configure_opts_dp *dp_opts = &qmp->dp_opts;
+@@ -2198,14 +2199,14 @@ static int qmp_v456_configure_dp_phy(struct qmp_combo *qmp,
+ 10000))
+ return -ETIMEDOUT;
+
+- if (readl_poll_timeout(qmp->dp_serdes + QSERDES_V4_COM_CMN_STATUS,
++ if (readl_poll_timeout(qmp->dp_serdes + com_cmn_status_reg,
+ status,
+ ((status & BIT(0)) > 0),
+ 500,
+ 10000))
+ return -ETIMEDOUT;
+
+- if (readl_poll_timeout(qmp->dp_serdes + QSERDES_V4_COM_CMN_STATUS,
++ if (readl_poll_timeout(qmp->dp_serdes + com_cmn_status_reg,
+ status,
+ ((status & BIT(1)) > 0),
+ 500,
+@@ -2241,6 +2242,7 @@ static int qmp_v4_configure_dp_phy(struct qmp_combo *qmp)
+
+ ret = qmp_v456_configure_dp_phy(qmp, QSERDES_V4_COM_RESETSM_CNTRL,
+ QSERDES_V4_COM_C_READY_STATUS,
++ QSERDES_V4_COM_CMN_STATUS,
+ QSERDES_V4_DP_PHY_STATUS);
+ if (ret < 0)
+ return ret;
+@@ -2305,6 +2307,7 @@ static int qmp_v5_configure_dp_phy(struct qmp_combo *qmp)
+
+ ret = qmp_v456_configure_dp_phy(qmp, QSERDES_V4_COM_RESETSM_CNTRL,
+ QSERDES_V4_COM_C_READY_STATUS,
++ QSERDES_V4_COM_CMN_STATUS,
+ QSERDES_V4_DP_PHY_STATUS);
+ if (ret < 0)
+ return ret;
+@@ -2364,6 +2367,7 @@ static int qmp_v6_configure_dp_phy(struct qmp_combo *qmp)
+
+ ret = qmp_v456_configure_dp_phy(qmp, QSERDES_V6_COM_RESETSM_CNTRL,
+ QSERDES_V6_COM_C_READY_STATUS,
++ QSERDES_V6_COM_CMN_STATUS,
+ QSERDES_V6_DP_PHY_STATUS);
+ if (ret < 0)
+ return ret;
+--
+2.39.2
+
--- /dev/null
+From ae531944186f6b940ab632511aa4af0866c3e396 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 May 2023 10:39:50 +0300
+Subject: phy: tegra: xusb: check return value of devm_kzalloc()
+
+From: Claudiu Beznea <claudiu.beznea@microchip.com>
+
+[ Upstream commit 44faada0f38fc333d392af04c343b0e23f8f5d81 ]
+
+devm_kzalloc() returns a pointer to dynamically allocated memory.
+Pointer could be NULL in case allocation fails. Check pointer validity.
+Identified with coccinelle (kmerr.cocci script).
+
+Fixes: f67213cee2b3 ("phy: tegra: xusb: Add usb-role-switch support")
+Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Acked-by: Thierry Reding <treding@nvidia.com>
+Link: https://lore.kernel.org/r/20230531073950.145339-1-claudiu.beznea@microchip.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/tegra/xusb.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/phy/tegra/xusb.c b/drivers/phy/tegra/xusb.c
+index b5bad46a04a38..a296b87dced18 100644
+--- a/drivers/phy/tegra/xusb.c
++++ b/drivers/phy/tegra/xusb.c
+@@ -676,6 +676,9 @@ static int tegra_xusb_setup_usb_role_switch(struct tegra_xusb_port *port)
+ port->dev.driver = devm_kzalloc(&port->dev,
+ sizeof(struct device_driver),
+ GFP_KERNEL);
++ if (!port->dev.driver)
++ return -ENOMEM;
++
+ port->dev.driver->owner = THIS_MODULE;
+
+ port->usb_role_sw = usb_role_switch_register(&port->dev,
+--
+2.39.2
+
--- /dev/null
+From 977ab01a9bbfa5758cca00a75245812ce08ea8a7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Jun 2023 14:24:36 +0800
+Subject: power: supply: rt9467: Make charger-enable control as logic level
+
+From: ChiYuan Huang <cy_huang@richtek.com>
+
+[ Upstream commit 5d80a86a99d524b0d89ff3906c6200b9f57b66f8 ]
+
+The current coding make 'charger-enable-gpio' control as real hardware
+level. This conflicts with the default binding example. For driver
+behavior, no need to use real hardware level, just logic level is
+enough. This change can make this flexibility keep in dts gpio active
+level about this pin.
+
+Fixes: 6f7f70e3a8dd ("power: supply: rt9467: Add Richtek RT9467 charger driver")
+Signed-off-by: ChiYuan Huang <cy_huang@richtek.com>
+Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/rt9467-charger.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/power/supply/rt9467-charger.c b/drivers/power/supply/rt9467-charger.c
+index ea33693b69779..b0b9ff8667459 100644
+--- a/drivers/power/supply/rt9467-charger.c
++++ b/drivers/power/supply/rt9467-charger.c
+@@ -1192,7 +1192,7 @@ static int rt9467_charger_probe(struct i2c_client *i2c)
+ i2c_set_clientdata(i2c, data);
+
+ /* Default pull charge enable gpio to make 'CHG_EN' by SW control only */
+- ceb_gpio = devm_gpiod_get_optional(dev, "charge-enable", GPIOD_OUT_LOW);
++ ceb_gpio = devm_gpiod_get_optional(dev, "charge-enable", GPIOD_OUT_HIGH);
+ if (IS_ERR(ceb_gpio))
+ return dev_err_probe(dev, PTR_ERR(ceb_gpio),
+ "Failed to config charge enable gpio\n");
+--
+2.39.2
+
--- /dev/null
+From 431eee4c72d4a879c30adf6a1ed4068e098a051b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Jun 2023 22:47:12 -0700
+Subject: powerpc: allow PPC_EARLY_DEBUG_CPM only when SERIAL_CPM=y
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 39f49684036d24af800ff194c33c7b2653c591d7 ]
+
+In a randconfig with CONFIG_SERIAL_CPM=m and
+CONFIG_PPC_EARLY_DEBUG_CPM=y, there is a build error:
+ERROR: modpost: "udbg_putc" [drivers/tty/serial/cpm_uart/cpm_uart.ko] undefined!
+
+Prevent the build error by allowing PPC_EARLY_DEBUG_CPM only when
+SERIAL_CPM=y.
+
+Fixes: c374e00e17f1 ("[POWERPC] Add early debug console for CPM serial ports.")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Reviewed-by: Pali Rohár <pali@kernel.org>
+Reviewed-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20230701054714.30512-1-rdunlap@infradead.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/Kconfig.debug | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/Kconfig.debug b/arch/powerpc/Kconfig.debug
+index 6aaf8dc60610d..2a54fadbeaf51 100644
+--- a/arch/powerpc/Kconfig.debug
++++ b/arch/powerpc/Kconfig.debug
+@@ -240,7 +240,7 @@ config PPC_EARLY_DEBUG_40x
+
+ config PPC_EARLY_DEBUG_CPM
+ bool "Early serial debugging for Freescale CPM-based serial ports"
+- depends on SERIAL_CPM
++ depends on SERIAL_CPM=y
+ help
+ Select this to enable early debugging for Freescale chips
+ using a CPM-based serial port. This assumes that the bootwrapper
+--
+2.39.2
+
--- /dev/null
+From fc16269bdee2bd5f3250b16e1b2464d704034490 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 May 2023 19:28:18 +0200
+Subject: powerpc: dts: turris1x.dts: Fix PCIe MEM size for pci2 node
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pali Rohár <pali@kernel.org>
+
+[ Upstream commit abaa02fc944f2f9f2c2e1925ddaceaf35c48528c ]
+
+Freescale PCIe controllers on their PCIe Root Ports do not have any
+mappable PCI BAR allocate from PCIe MEM.
+
+Information about 1MB window on BAR0 of PCIe Root Port was misleading
+because Freescale PCIe controllers have at BAR0 position different register
+PEXCSRBAR, and kernel correctly skipts BAR0 for these Freescale PCIe Root
+Ports.
+
+So update comment about P2020 PCIe Root Port and decrease PCIe MEM size
+required for PCIe controller (pci2 node) on which is on-board xHCI
+controller.
+
+lspci confirms that on P2020 PCIe Root Port is no PCI BAR and /proc/iomem
+sees that only c0000000-c000ffff and c0010000-c0011fff ranges are used.
+
+Fixes: 54c15ec3b738 ("powerpc: dts: Add DTS file for CZ.NIC Turris 1.x routers")
+Signed-off-by: Pali Rohár <pali@kernel.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20230505172818.18416-1-pali@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/boot/dts/turris1x.dts | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/powerpc/boot/dts/turris1x.dts b/arch/powerpc/boot/dts/turris1x.dts
+index 6612160c19d59..dff1ea074d9d9 100644
+--- a/arch/powerpc/boot/dts/turris1x.dts
++++ b/arch/powerpc/boot/dts/turris1x.dts
+@@ -476,12 +476,12 @@ pci2: pcie@ffe08000 {
+ * channel 1 (but only USB 2.0 subset) to USB 2.0 pins on mPCIe
+ * slot 1 (CN5), channels 2 and 3 to connector P600.
+ *
+- * P2020 PCIe Root Port uses 1MB of PCIe MEM and xHCI controller
++ * P2020 PCIe Root Port does not use PCIe MEM and xHCI controller
+ * uses 64kB + 8kB of PCIe MEM. No PCIe IO is used or required.
+- * So allocate 2MB of PCIe MEM for this PCIe bus.
++ * So allocate 128kB of PCIe MEM for this PCIe bus.
+ */
+ reg = <0 0xffe08000 0 0x1000>;
+- ranges = <0x02000000 0x0 0xc0000000 0 0xc0000000 0x0 0x00200000>, /* MEM */
++ ranges = <0x02000000 0x0 0xc0000000 0 0xc0000000 0x0 0x00020000>, /* MEM */
+ <0x01000000 0x0 0x00000000 0 0xffc20000 0x0 0x00010000>; /* IO */
+
+ pcie@0 {
+--
+2.39.2
+
--- /dev/null
+From 5a163ebf01b5cd967fbb2b10b66bc76e30a38a70 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Jul 2023 19:14:46 +0200
+Subject: pptp: Fix fib lookup calls.
+
+From: Guillaume Nault <gnault@redhat.com>
+
+[ Upstream commit 84bef5b6037c15180ef88ac4216dc621d16df1a6 ]
+
+PPTP uses pppox sockets (struct pppox_sock). These sockets don't embed
+an inet_sock structure, so it's invalid to call inet_sk() on them.
+
+Therefore, the ip_route_output_ports() call in pptp_connect() has two
+problems:
+
+ * The tos variable is set with RT_CONN_FLAGS(sk), which calls
+ inet_sk() on the pppox socket.
+
+ * ip_route_output_ports() tries to retrieve routing flags using
+ inet_sk_flowi_flags(), which is also going to call inet_sk() on the
+ pppox socket.
+
+While PPTP doesn't use inet sockets, it's actually really layered on
+top of IP and therefore needs a proper way to do fib lookups. So let's
+define pptp_route_output() to get a struct rtable from a pptp socket.
+Let's also replace the ip_route_output_ports() call of pptp_xmit() for
+consistency.
+
+In practice, this means that:
+
+ * pptp_connect() sets ->flowi4_tos and ->flowi4_flags to zero instead
+ of using bits of unrelated struct pppox_sock fields.
+
+ * pptp_xmit() now respects ->sk_mark and ->sk_uid.
+
+ * pptp_xmit() now calls the security_sk_classify_flow() security
+ hook, thus allowing to set ->flowic_secid.
+
+ * pptp_xmit() now passes the pppox socket to xfrm_lookup_route().
+
+Found by code inspection.
+
+Fixes: 00959ade36ac ("PPTP: PPP over IPv4 (Point-to-Point Tunneling Protocol)")
+Signed-off-by: Guillaume Nault <gnault@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ppp/pptp.c | 31 ++++++++++++++++++++-----------
+ 1 file changed, 20 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/net/ppp/pptp.c b/drivers/net/ppp/pptp.c
+index 0fe78826c8fa4..32183f24e63ff 100644
+--- a/drivers/net/ppp/pptp.c
++++ b/drivers/net/ppp/pptp.c
+@@ -24,6 +24,7 @@
+ #include <linux/in.h>
+ #include <linux/ip.h>
+ #include <linux/rcupdate.h>
++#include <linux/security.h>
+ #include <linux/spinlock.h>
+
+ #include <net/sock.h>
+@@ -128,6 +129,23 @@ static void del_chan(struct pppox_sock *sock)
+ spin_unlock(&chan_lock);
+ }
+
++static struct rtable *pptp_route_output(struct pppox_sock *po,
++ struct flowi4 *fl4)
++{
++ struct sock *sk = &po->sk;
++ struct net *net;
++
++ net = sock_net(sk);
++ flowi4_init_output(fl4, sk->sk_bound_dev_if, sk->sk_mark, 0,
++ RT_SCOPE_UNIVERSE, IPPROTO_GRE, 0,
++ po->proto.pptp.dst_addr.sin_addr.s_addr,
++ po->proto.pptp.src_addr.sin_addr.s_addr,
++ 0, 0, sock_net_uid(net, sk));
++ security_sk_classify_flow(sk, flowi4_to_flowi_common(fl4));
++
++ return ip_route_output_flow(net, fl4, sk);
++}
++
+ static int pptp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
+ {
+ struct sock *sk = (struct sock *) chan->private;
+@@ -151,11 +169,7 @@ static int pptp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
+ if (sk_pppox(po)->sk_state & PPPOX_DEAD)
+ goto tx_error;
+
+- rt = ip_route_output_ports(net, &fl4, NULL,
+- opt->dst_addr.sin_addr.s_addr,
+- opt->src_addr.sin_addr.s_addr,
+- 0, 0, IPPROTO_GRE,
+- RT_TOS(0), sk->sk_bound_dev_if);
++ rt = pptp_route_output(po, &fl4);
+ if (IS_ERR(rt))
+ goto tx_error;
+
+@@ -438,12 +452,7 @@ static int pptp_connect(struct socket *sock, struct sockaddr *uservaddr,
+ po->chan.private = sk;
+ po->chan.ops = &pptp_chan_ops;
+
+- rt = ip_route_output_ports(sock_net(sk), &fl4, sk,
+- opt->dst_addr.sin_addr.s_addr,
+- opt->src_addr.sin_addr.s_addr,
+- 0, 0,
+- IPPROTO_GRE, RT_CONN_FLAGS(sk),
+- sk->sk_bound_dev_if);
++ rt = pptp_route_output(po, &fl4);
+ if (IS_ERR(rt)) {
+ error = -EHOSTUNREACH;
+ goto end;
+--
+2.39.2
+
--- /dev/null
+From 35497101a8715d8479d918db1bb9c37991cc0972 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 May 2023 14:07:42 +0300
+Subject: pwm: ab8500: Fix error code in probe()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit cdcffafc4d845cc0c6392cba168c7a942734cce7 ]
+
+This code accidentally return positive EINVAL instead of negative
+-EINVAL.
+
+Fixes: eb41f334589d ("pwm: ab8500: Fix register offset calculation to not depend on probe order")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Reviewed-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-ab8500.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pwm/pwm-ab8500.c b/drivers/pwm/pwm-ab8500.c
+index 507ff0d5f7bd8..583a7d69c7415 100644
+--- a/drivers/pwm/pwm-ab8500.c
++++ b/drivers/pwm/pwm-ab8500.c
+@@ -190,7 +190,7 @@ static int ab8500_pwm_probe(struct platform_device *pdev)
+ int err;
+
+ if (pdev->id < 1 || pdev->id > 31)
+- return dev_err_probe(&pdev->dev, EINVAL, "Invalid device id %d\n", pdev->id);
++ return dev_err_probe(&pdev->dev, -EINVAL, "Invalid device id %d\n", pdev->id);
+
+ /*
+ * Nothing to be done in probe, this is required to get the
+--
+2.39.2
+
--- /dev/null
+From 53fb2ee7b37048043dc2af4a0ea9cbe92ed90aaf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 May 2023 14:58:39 +0800
+Subject: pwm: imx-tpm: force 'real_period' to be zero in suspend
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Fancy Fang <chen.fang@nxp.com>
+
+[ Upstream commit 661dfb7f46298e53f6c3deaa772fa527aae86193 ]
+
+During suspend, all the tpm registers will lose values.
+So the 'real_period' value of struct 'imx_tpm_pwm_chip'
+should be forced to be zero to force the period update
+code can be executed after system resume back.
+
+Signed-off-by: Fancy Fang <chen.fang@nxp.com>
+Signed-off-by: Clark Wang <xiaoning.wang@nxp.com>
+Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Fixes: 738a1cfec2ed ("pwm: Add i.MX TPM PWM driver support")
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-imx-tpm.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/pwm/pwm-imx-tpm.c b/drivers/pwm/pwm-imx-tpm.c
+index 5e2b452ee5f2e..98ab65c896850 100644
+--- a/drivers/pwm/pwm-imx-tpm.c
++++ b/drivers/pwm/pwm-imx-tpm.c
+@@ -397,6 +397,13 @@ static int __maybe_unused pwm_imx_tpm_suspend(struct device *dev)
+ if (tpm->enable_count > 0)
+ return -EBUSY;
+
++ /*
++ * Force 'real_period' to be zero to force period update code
++ * can be executed after system resume back, since suspend causes
++ * the period related registers to become their reset values.
++ */
++ tpm->real_period = 0;
++
+ clk_disable_unprepare(tpm->clk);
+
+ return 0;
+--
+2.39.2
+
--- /dev/null
+From 7d1c29f7914ec7b12974cd4d73a2c032c7d5b301 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 May 2023 11:10:01 +0800
+Subject: pwm: mtk_disp: Fix the disable flow of disp_pwm
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Shuijing Li <shuijing.li@mediatek.com>
+
+[ Upstream commit bc13d60e4e1e945b34769a4a4c2b172e8552abe5 ]
+
+There is a flow error in the original mtk_disp_pwm_apply() function.
+If this function is called when the clock is disabled, there will be a
+chance to operate the disp_pwm register, resulting in disp_pwm exception.
+Fix this accordingly.
+
+Fixes: 888a623db5d0 ("pwm: mtk-disp: Implement atomic API .apply()")
+Signed-off-by: Shuijing Li <shuijing.li@mediatek.com>
+Reviewed-by: Matthias Brugger <matthias.bgg@gmail.com>
+Tested-by: Fei Shao <fshao@chromium.org>
+Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Reviewed-by: Alexandre Mergnat <amergnat@baylibre.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-mtk-disp.c | 13 +++++--------
+ 1 file changed, 5 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/pwm/pwm-mtk-disp.c b/drivers/pwm/pwm-mtk-disp.c
+index 79e321e96f56a..2401b67332417 100644
+--- a/drivers/pwm/pwm-mtk-disp.c
++++ b/drivers/pwm/pwm-mtk-disp.c
+@@ -79,14 +79,11 @@ static int mtk_disp_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,
+ if (state->polarity != PWM_POLARITY_NORMAL)
+ return -EINVAL;
+
+- if (!state->enabled) {
+- mtk_disp_pwm_update_bits(mdp, DISP_PWM_EN, mdp->data->enable_mask,
+- 0x0);
+-
+- if (mdp->enabled) {
+- clk_disable_unprepare(mdp->clk_mm);
+- clk_disable_unprepare(mdp->clk_main);
+- }
++ if (!state->enabled && mdp->enabled) {
++ mtk_disp_pwm_update_bits(mdp, DISP_PWM_EN,
++ mdp->data->enable_mask, 0x0);
++ clk_disable_unprepare(mdp->clk_mm);
++ clk_disable_unprepare(mdp->clk_main);
+
+ mdp->enabled = false;
+ return 0;
+--
+2.39.2
+
--- /dev/null
+From 23d0cf6768979bcfa8c550a8ff72e26fcc556236 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 May 2023 18:47:36 +0200
+Subject: pwm: sysfs: Do not apply state to already disabled PWMs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Marek Vasut <marex@denx.de>
+
+[ Upstream commit 38ba83598633373f47951384cfc389181c8d1bed ]
+
+If the PWM is exported but not enabled, do not call pwm_class_apply_state().
+First of all, in this case, period may still be unconfigured and this would
+make pwm_class_apply_state() return -EINVAL, and then suspend would fail.
+Second, it makes little sense to apply state onto PWM that is not enabled
+before suspend.
+
+Failing case:
+"
+$ echo 1 > /sys/class/pwm/pwmchip4/export
+$ echo mem > /sys/power/state
+...
+pwm pwmchip4: PM: dpm_run_callback(): pwm_class_suspend+0x1/0xa8 returns -22
+pwm pwmchip4: PM: failed to suspend: error -22
+PM: Some devices failed to suspend, or early wake event detected
+"
+
+Working case:
+"
+$ echo 1 > /sys/class/pwm/pwmchip4/export
+$ echo 100 > /sys/class/pwm/pwmchip4/pwm1/period
+$ echo 10 > /sys/class/pwm/pwmchip4/pwm1/duty_cycle
+$ echo mem > /sys/power/state
+...
+"
+
+Do not call pwm_class_apply_state() in case the PWM is disabled
+to fix this issue.
+
+Fixes: 7fd4edc57bbae ("pwm: sysfs: Add suspend/resume support")
+Signed-off-by: Marek Vasut <marex@denx.de>
+Fixes: ef2bf4997f7d ("pwm: Improve args checking in pwm_apply_state()")
+Reviewed-by: Brian Norris <briannorris@chromium.org>
+Reviewed-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/sysfs.c | 17 +++++++++++++++++
+ 1 file changed, 17 insertions(+)
+
+diff --git a/drivers/pwm/sysfs.c b/drivers/pwm/sysfs.c
+index 1a106ec329392..8d1254761e4dd 100644
+--- a/drivers/pwm/sysfs.c
++++ b/drivers/pwm/sysfs.c
+@@ -424,6 +424,13 @@ static int pwm_class_resume_npwm(struct device *parent, unsigned int npwm)
+ if (!export)
+ continue;
+
++ /* If pwmchip was not enabled before suspend, do nothing. */
++ if (!export->suspend.enabled) {
++ /* release lock taken in pwm_class_get_state */
++ mutex_unlock(&export->lock);
++ continue;
++ }
++
+ state.enabled = export->suspend.enabled;
+ ret = pwm_class_apply_state(export, pwm, &state);
+ if (ret < 0)
+@@ -448,7 +455,17 @@ static int pwm_class_suspend(struct device *parent)
+ if (!export)
+ continue;
+
++ /*
++ * If pwmchip was not enabled before suspend, save
++ * state for resume time and do nothing else.
++ */
+ export->suspend = state;
++ if (!state.enabled) {
++ /* release lock taken in pwm_class_get_state */
++ mutex_unlock(&export->lock);
++ continue;
++ }
++
+ state.enabled = false;
+ ret = pwm_class_apply_state(export, pwm, &state);
+ if (ret < 0) {
+--
+2.39.2
+
--- /dev/null
+From e66778240eec2164bfc761f608a096f190670635 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Jun 2023 11:30:35 +0200
+Subject: Revert "usb: common: usb-conn-gpio: Set last role to unknown before
+ initial detection"
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+[ Upstream commit df49f2a0ac4a34c0cb4b5c233fcfa0add644c43c ]
+
+This reverts commit edd60d24bd858cef165274e4cd6cab43bdc58d15.
+
+Heikki reports that this should not be a global flag just to work around
+one broken driver and should be fixed differently, so revert it.
+
+Reported-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Fixes: edd60d24bd85 ("usb: common: usb-conn-gpio: Set last role to unknown before initial detection")
+Link: https://lore.kernel.org/r/ZImE4L3YgABnCIsP@kuha.fi.intel.com
+Cc: Prashanth K <quic_prashk@quicinc.com>
+Cc: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/cdns3/core.c | 2 --
+ drivers/usb/common/usb-conn-gpio.c | 3 ---
+ drivers/usb/musb/jz4740.c | 2 --
+ drivers/usb/roles/intel-xhci-usb-role-switch.c | 2 --
+ include/linux/usb/role.h | 1 -
+ 5 files changed, 10 deletions(-)
+
+diff --git a/drivers/usb/cdns3/core.c b/drivers/usb/cdns3/core.c
+index 69d2921f2d3b5..dbcdf3b24b477 100644
+--- a/drivers/usb/cdns3/core.c
++++ b/drivers/usb/cdns3/core.c
+@@ -252,8 +252,6 @@ static enum usb_role cdns_hw_role_state_machine(struct cdns *cdns)
+ if (!vbus)
+ role = USB_ROLE_NONE;
+ break;
+- default:
+- break;
+ }
+
+ dev_dbg(cdns->dev, "role %d -> %d\n", cdns->role, role);
+diff --git a/drivers/usb/common/usb-conn-gpio.c b/drivers/usb/common/usb-conn-gpio.c
+index 30bdb81934bc8..e20874caba363 100644
+--- a/drivers/usb/common/usb-conn-gpio.c
++++ b/drivers/usb/common/usb-conn-gpio.c
+@@ -257,9 +257,6 @@ static int usb_conn_probe(struct platform_device *pdev)
+ platform_set_drvdata(pdev, info);
+ device_set_wakeup_capable(&pdev->dev, true);
+
+- /* Set last role to unknown before performing the initial detection */
+- info->last_role = USB_ROLE_UNKNOWN;
+-
+ /* Perform initial detection */
+ usb_conn_queue_dwork(info, 0);
+
+diff --git a/drivers/usb/musb/jz4740.c b/drivers/usb/musb/jz4740.c
+index 6d880c4cce36e..5aabdd7e2511d 100644
+--- a/drivers/usb/musb/jz4740.c
++++ b/drivers/usb/musb/jz4740.c
+@@ -95,8 +95,6 @@ static int jz4740_musb_role_switch_set(struct usb_role_switch *sw,
+ case USB_ROLE_HOST:
+ atomic_notifier_call_chain(&phy->notifier, USB_EVENT_ID, phy);
+ break;
+- default:
+- break;
+ }
+
+ return 0;
+diff --git a/drivers/usb/roles/intel-xhci-usb-role-switch.c b/drivers/usb/roles/intel-xhci-usb-role-switch.c
+index 4d6a3dd06e011..5c96e929acea0 100644
+--- a/drivers/usb/roles/intel-xhci-usb-role-switch.c
++++ b/drivers/usb/roles/intel-xhci-usb-role-switch.c
+@@ -97,8 +97,6 @@ static int intel_xhci_usb_set_role(struct usb_role_switch *sw,
+ val |= SW_VBUS_VALID;
+ drd_config = DRD_CONFIG_STATIC_DEVICE;
+ break;
+- default:
+- break;
+ }
+ val |= SW_IDPIN_EN;
+ if (data->enable_sw_switch) {
+diff --git a/include/linux/usb/role.h b/include/linux/usb/role.h
+index 65e790a28913e..b5deafd91f67b 100644
+--- a/include/linux/usb/role.h
++++ b/include/linux/usb/role.h
+@@ -11,7 +11,6 @@ enum usb_role {
+ USB_ROLE_NONE,
+ USB_ROLE_HOST,
+ USB_ROLE_DEVICE,
+- USB_ROLE_UNKNOWN,
+ };
+
+ typedef int (*usb_role_switch_set_t)(struct usb_role_switch *sw,
+--
+2.39.2
+
--- /dev/null
+From 80241db3373d54810e7bbacc7aea9394850312cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Jul 2023 19:31:26 +0100
+Subject: risc-v: Fix order of IPI enablement vs RCU startup
+
+From: Marc Zyngier <maz@kernel.org>
+
+[ Upstream commit 6259f3443c6a376aa077816ac92e9ddeb0817d09 ]
+
+Conor reports that risc-v tries to enable IPIs before telling the
+core code to enable RCU. With the introduction of the mapple tree
+as a backing store for the irq descriptors, this results in
+a very shouty boot sequence, as RCU is legitimately upset.
+
+Restore some sanity by moving the risc_ipi_enable() call after
+notify_cpu_starting(), which explicitly enables RCU on the calling
+CPU.
+
+Fixes: 832f15f42646 ("RISC-V: Treat IPIs as normal Linux IRQs")
+Reported-by: Conor Dooley <conor@kernel.org>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/r/20230703-dupe-frying-79ae2ccf94eb@spud
+Cc: Anup Patel <apatel@ventanamicro.com>
+Cc: Palmer Dabbelt <palmer@rivosinc.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Tested-by: Conor Dooley <conor.dooley@microchip.com>
+Link: https://lore.kernel.org/r/20230703183126.1567625-1-maz@kernel.org
+Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kernel/smpboot.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/arch/riscv/kernel/smpboot.c b/arch/riscv/kernel/smpboot.c
+index 445a4efee267d..6765f1ce79625 100644
+--- a/arch/riscv/kernel/smpboot.c
++++ b/arch/riscv/kernel/smpboot.c
+@@ -161,10 +161,11 @@ asmlinkage __visible void smp_callin(void)
+ mmgrab(mm);
+ current->active_mm = mm;
+
+- riscv_ipi_enable();
+-
+ store_cpu_topology(curr_cpuid);
+ notify_cpu_starting(curr_cpuid);
++
++ riscv_ipi_enable();
++
+ numa_add_cpu(curr_cpuid);
+ set_cpu_online(curr_cpuid, 1);
+ probe_vendor_features(curr_cpuid);
+--
+2.39.2
+
--- /dev/null
+From be5e13a01655d9dc0dfe33245847628631fec91c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Jun 2023 21:19:07 +0800
+Subject: riscv: move memblock_allow_resize() after linear mapping is ready
+
+From: Woody Zhang <woodylab@foxmail.com>
+
+[ Upstream commit 85fadc0d04119c2fe4a20287767ab904c6d21ba1 ]
+
+The initial memblock metadata is accessed from kernel image mapping. The
+regions arrays need to "reallocated" from memblock and accessed through
+linear mapping to cover more memblock regions. So the resizing should
+not be allowed until linear mapping is ready. Note that there are
+memblock allocations when building linear mapping.
+
+This patch is similar to 24cc61d8cb5a ("arm64: memblock: don't permit
+memblock resizing until linear mapping is up").
+
+In following log, many memblock regions are reserved before
+create_linear_mapping_page_table(). And then it triggered reallocation
+of memblock.reserved.regions and memcpy the old array in kernel image
+mapping to the new array in linear mapping which caused a page fault.
+
+[ 0.000000] memblock_reserve: [0x00000000bf01f000-0x00000000bf01ffff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6
+[ 0.000000] memblock_reserve: [0x00000000bf021000-0x00000000bf021fff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6
+[ 0.000000] memblock_reserve: [0x00000000bf023000-0x00000000bf023fff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6
+[ 0.000000] memblock_reserve: [0x00000000bf025000-0x00000000bf025fff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6
+[ 0.000000] memblock_reserve: [0x00000000bf027000-0x00000000bf027fff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6
+[ 0.000000] memblock_reserve: [0x00000000bf029000-0x00000000bf029fff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6
+[ 0.000000] memblock_reserve: [0x00000000bf02b000-0x00000000bf02bfff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6
+[ 0.000000] memblock_reserve: [0x00000000bf02d000-0x00000000bf02dfff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6
+[ 0.000000] memblock_reserve: [0x00000000bf02f000-0x00000000bf02ffff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6
+[ 0.000000] memblock_reserve: [0x00000000bf030000-0x00000000bf030fff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6
+[ 0.000000] OF: reserved mem: 0x0000000080000000..0x000000008007ffff (512 KiB) map non-reusable mmode_resv0@80000000
+[ 0.000000] memblock_reserve: [0x00000000bf000000-0x00000000bf001fed] paging_init+0x19a/0x5ae
+[ 0.000000] memblock_phys_alloc_range: 4096 bytes align=0x1000 from=0x0000000000000000 max_addr=0x0000000000000000 alloc_pmd_fixmap+0x14/0x1c
+[ 0.000000] memblock_reserve: [0x000000017ffff000-0x000000017fffffff] memblock_alloc_range_nid+0xb8/0x128
+[ 0.000000] memblock: reserved is doubled to 256 at [0x000000017fffd000-0x000000017fffe7ff]
+[ 0.000000] Unable to handle kernel paging request at virtual address ff600000ffffd000
+[ 0.000000] Oops [#1]
+[ 0.000000] Modules linked in:
+[ 0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 6.4.0-rc1-00011-g99a670b2069c #66
+[ 0.000000] Hardware name: riscv-virtio,qemu (DT)
+[ 0.000000] epc : __memcpy+0x60/0xf8
+[ 0.000000] ra : memblock_double_array+0x192/0x248
+[ 0.000000] epc : ffffffff8081d214 ra : ffffffff80a3dfc0 sp : ffffffff81403bd0
+[ 0.000000] gp : ffffffff814fbb38 tp : ffffffff8140dac0 t0 : 0000000001600000
+[ 0.000000] t1 : 0000000000000000 t2 : 000000008f001000 s0 : ffffffff81403c60
+[ 0.000000] s1 : ffffffff80c0bc98 a0 : ff600000ffffd000 a1 : ffffffff80c0bcd8
+[ 0.000000] a2 : 0000000000000c00 a3 : ffffffff80c0c8d8 a4 : 0000000080000000
+[ 0.000000] a5 : 0000000000080000 a6 : 0000000000000000 a7 : 0000000080200000
+[ 0.000000] s2 : ff600000ffffd000 s3 : 0000000000002000 s4 : 0000000000000c00
+[ 0.000000] s5 : ffffffff80c0bc60 s6 : ffffffff80c0bcc8 s7 : 0000000000000000
+[ 0.000000] s8 : ffffffff814fd0a8 s9 : 000000017fffe7ff s10: 0000000000000000
+[ 0.000000] s11: 0000000000001000 t3 : 0000000000001000 t4 : 0000000000000000
+[ 0.000000] t5 : 000000008f003000 t6 : ff600000ffffd000
+[ 0.000000] status: 0000000200000100 badaddr: ff600000ffffd000 cause: 000000000000000f
+[ 0.000000] [<ffffffff8081d214>] __memcpy+0x60/0xf8
+[ 0.000000] [<ffffffff80a3e1a2>] memblock_add_range.isra.14+0x12c/0x162
+[ 0.000000] [<ffffffff80a3e36a>] memblock_reserve+0x6e/0x8c
+[ 0.000000] [<ffffffff80a123fc>] memblock_alloc_range_nid+0xb8/0x128
+[ 0.000000] [<ffffffff80a1256a>] memblock_phys_alloc_range+0x5e/0x6a
+[ 0.000000] [<ffffffff80a04732>] alloc_pmd_fixmap+0x14/0x1c
+[ 0.000000] [<ffffffff80a0475a>] alloc_p4d_fixmap+0xc/0x14
+[ 0.000000] [<ffffffff80a04a36>] create_pgd_mapping+0x98/0x17c
+[ 0.000000] [<ffffffff80a04e9e>] create_linear_mapping_range.constprop.10+0xe4/0x112
+[ 0.000000] [<ffffffff80a05bb8>] paging_init+0x3ec/0x5ae
+[ 0.000000] [<ffffffff80a03354>] setup_arch+0xb2/0x576
+[ 0.000000] [<ffffffff80a00726>] start_kernel+0x72/0x57e
+[ 0.000000] Code: b303 0285 b383 0305 be03 0385 be83 0405 bf03 0485 (b023) 00ef
+[ 0.000000] ---[ end trace 0000000000000000 ]---
+[ 0.000000] Kernel panic - not syncing: Attempted to kill the idle task!
+[ 0.000000] ---[ end Kernel panic - not syncing: Attempted to kill the idle task! ]---
+
+Fixes: 671f9a3e2e24 ("RISC-V: Setup initial page tables in two stages")
+Signed-off-by: Woody Zhang <woodylab@foxmail.com>
+Tested-by: Song Shuai <songshuaishuai@tinylab.org>
+Link: https://lore.kernel.org/r/tencent_FBB94CE615C5CCE7701CD39C15CCE0EE9706@qq.com
+Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/mm/init.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/arch/riscv/mm/init.c b/arch/riscv/mm/init.c
+index 4fa420faa7808..1306149aad57a 100644
+--- a/arch/riscv/mm/init.c
++++ b/arch/riscv/mm/init.c
+@@ -267,7 +267,6 @@ static void __init setup_bootmem(void)
+ dma_contiguous_reserve(dma32_phys_limit);
+ if (IS_ENABLED(CONFIG_64BIT))
+ hugetlb_cma_reserve(PUD_SHIFT - PAGE_SHIFT);
+- memblock_allow_resize();
+ }
+
+ #ifdef CONFIG_MMU
+@@ -1370,6 +1369,9 @@ void __init paging_init(void)
+ {
+ setup_bootmem();
+ setup_vm_final();
++
++ /* Depend on that Linear Mapping is ready */
++ memblock_allow_resize();
+ }
+
+ void __init misc_mem_init(void)
+--
+2.39.2
+
--- /dev/null
+From 7c3ef88f9f6ef7b14dd0607be0623712fc4ad683 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Jun 2023 21:11:42 +0200
+Subject: rtc: st-lpc: Release some resources in st_rtc_probe() in case of
+ error
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 06c6e1b01d9261f03629cefd1f3553503291e6cf ]
+
+If an error occurs after clk_get(), the corresponding resources should be
+released.
+
+Use devm_clk_get() to fix it.
+
+Fixes: b5b2bdfc2893 ("rtc: st: Add new driver for ST's LPC RTC")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Link: https://lore.kernel.org/r/866af6adbc7454a7b4505eb6c28fbdc86ccff39e.1686251455.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-st-lpc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/rtc/rtc-st-lpc.c b/drivers/rtc/rtc-st-lpc.c
+index 0f8e4231098ef..d04d46f9cc65a 100644
+--- a/drivers/rtc/rtc-st-lpc.c
++++ b/drivers/rtc/rtc-st-lpc.c
+@@ -228,7 +228,7 @@ static int st_rtc_probe(struct platform_device *pdev)
+ enable_irq_wake(rtc->irq);
+ disable_irq(rtc->irq);
+
+- rtc->clk = clk_get(&pdev->dev, NULL);
++ rtc->clk = devm_clk_get(&pdev->dev, NULL);
+ if (IS_ERR(rtc->clk)) {
+ dev_err(&pdev->dev, "Unable to request clock\n");
+ return PTR_ERR(rtc->clk);
+--
+2.39.2
+
--- /dev/null
+From dd9ea04419dd9d3dedf0b5630efd45dd59231de1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Jun 2023 18:12:22 +0200
+Subject: rtla/hwnoise: Reduce runtime to 75%
+
+From: Daniel Bristot de Oliveira <bristot@kernel.org>
+
+[ Upstream commit 7bc4d3089a50050d4df0af63423a5d907c3bdb1a ]
+
+osnoise runs 100% of time by default. It makes sense because osnoise
+is preemptive. hwnoise checks preemption once a second, so it
+reduces system progress.
+
+Reduce runtime to 75% to avoid problems by default. I added a Fixes
+as it might avoid problems for first time users as it lands on distros.
+
+Link: https://lkml.kernel.org/r/af0b7113ffc00031b9af4bb40ef5889a27dadf8c.1686066600.git.bristot@kernel.org
+
+Cc: William White <chwhite@redhat.com>
+Cc: Jonathan Corbet <corbet@lwn.net>
+Tested-by: Juri Lelli <juri.lelli@redhat.com>
+Fixes: 1f428356c38d ("rtla: Add hwnoise tool")
+Signed-off-by: Daniel Bristot de Oliveira <bristot@kernel.org>
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/tracing/rtla/src/osnoise_top.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/tools/tracing/rtla/src/osnoise_top.c b/tools/tracing/rtla/src/osnoise_top.c
+index 562f2e4b18c57..3ece8c09ecd95 100644
+--- a/tools/tracing/rtla/src/osnoise_top.c
++++ b/tools/tracing/rtla/src/osnoise_top.c
+@@ -340,8 +340,14 @@ struct osnoise_top_params *osnoise_top_parse_args(int argc, char **argv)
+ if (!params)
+ exit(1);
+
+- if (strcmp(argv[0], "hwnoise") == 0)
++ if (strcmp(argv[0], "hwnoise") == 0) {
+ params->mode = MODE_HWNOISE;
++ /*
++ * Reduce CPU usage for 75% to avoid killing the system.
++ */
++ params->runtime = 750000;
++ params->period = 1000000;
++ }
+
+ while (1) {
+ static struct option long_options[] = {
+--
+2.39.2
+
--- /dev/null
+From 063fa6586b32df07713594c112c99b2c17f8c624 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Jul 2023 16:41:21 +0200
+Subject: s390/qeth: Fix vipa deletion
+
+From: Thorsten Winkler <twinkler@linux.ibm.com>
+
+[ Upstream commit 80de809bd35e2a8999edf9f5aaa2d8de18921f11 ]
+
+Change boolean parameter of function "qeth_l3_vipa_store" inside the
+"qeth_l3_dev_vipa_del4_store" function from "true" to "false" because
+"true" is used for adding a virtual ip address and "false" for deleting.
+
+Fixes: 2390166a6b45 ("s390/qeth: clean up L3 sysfs code")
+
+Reviewed-by: Alexandra Winter <wintera@linux.ibm.com>
+Reviewed-by: Wenjia Zhang <wenjia@linux.ibm.com>
+Signed-off-by: Thorsten Winkler <twinkler@linux.ibm.com>
+Signed-off-by: Alexandra Winter <wintera@linux.ibm.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/net/qeth_l3_sys.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/s390/net/qeth_l3_sys.c b/drivers/s390/net/qeth_l3_sys.c
+index 9f90a860ca2c9..a6b64228ead25 100644
+--- a/drivers/s390/net/qeth_l3_sys.c
++++ b/drivers/s390/net/qeth_l3_sys.c
+@@ -625,7 +625,7 @@ static QETH_DEVICE_ATTR(vipa_add4, add4, 0644,
+ static ssize_t qeth_l3_dev_vipa_del4_store(struct device *dev,
+ struct device_attribute *attr, const char *buf, size_t count)
+ {
+- return qeth_l3_vipa_store(dev, buf, true, count, QETH_PROT_IPV4);
++ return qeth_l3_vipa_store(dev, buf, false, count, QETH_PROT_IPV4);
+ }
+
+ static QETH_DEVICE_ATTR(vipa_del4, del4, 0200, NULL,
+--
+2.39.2
+
--- /dev/null
+From 37fbe7f54cc71ead2ee33480df258fa8a27ad486 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jun 2023 12:03:40 +0000
+Subject: sctp: fix potential deadlock on &net->sctp.addr_wq_lock
+
+From: Chengfeng Ye <dg573847474@gmail.com>
+
+[ Upstream commit 6feb37b3b06e9049e20dcf7e23998f92c9c5be9a ]
+
+As &net->sctp.addr_wq_lock is also acquired by the timer
+sctp_addr_wq_timeout_handler() in protocal.c, the same lock acquisition
+at sctp_auto_asconf_init() seems should disable irq since it is called
+from sctp_accept() under process context.
+
+Possible deadlock scenario:
+sctp_accept()
+ -> sctp_sock_migrate()
+ -> sctp_auto_asconf_init()
+ -> spin_lock(&net->sctp.addr_wq_lock)
+ <timer interrupt>
+ -> sctp_addr_wq_timeout_handler()
+ -> spin_lock_bh(&net->sctp.addr_wq_lock); (deadlock here)
+
+This flaw was found using an experimental static analysis tool we are
+developing for irq-related deadlock.
+
+The tentative patch fix the potential deadlock by spin_lock_bh().
+
+Signed-off-by: Chengfeng Ye <dg573847474@gmail.com>
+Fixes: 34e5b0118685 ("sctp: delay auto_asconf init until binding the first addr")
+Acked-by: Xin Long <lucien.xin@gmail.com>
+Link: https://lore.kernel.org/r/20230627120340.19432-1-dg573847474@gmail.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sctp/socket.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/sctp/socket.c b/net/sctp/socket.c
+index a68e1d541b128..ee15eff6364ee 100644
+--- a/net/sctp/socket.c
++++ b/net/sctp/socket.c
+@@ -364,9 +364,9 @@ static void sctp_auto_asconf_init(struct sctp_sock *sp)
+ struct net *net = sock_net(&sp->inet.sk);
+
+ if (net->sctp.default_auto_asconf) {
+- spin_lock(&net->sctp.addr_wq_lock);
++ spin_lock_bh(&net->sctp.addr_wq_lock);
+ list_add_tail(&sp->auto_asconf_list, &net->sctp.auto_asconf_splist);
+- spin_unlock(&net->sctp.addr_wq_lock);
++ spin_unlock_bh(&net->sctp.addr_wq_lock);
+ sp->do_auto_asconf = 1;
+ }
+ }
+--
+2.39.2
+
--- /dev/null
+From 6fe7b79bb3922576e745975552da1e45b2ec1983 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 May 2023 11:37:54 +0206
+Subject: serial: 8250: lock port for stop_rx() in omap8250_irq()
+
+From: John Ogness <john.ogness@linutronix.de>
+
+[ Upstream commit ca73a892c5bec4b08a2fa22b3015e98ed905abb7 ]
+
+The uarts_ops stop_rx() callback expects that the port->lock is
+taken and interrupts are disabled.
+
+Fixes: 1fe0e1fa3209 ("serial: 8250_omap: Handle optional overrun-throttle-ms property")
+Signed-off-by: John Ogness <john.ogness@linutronix.de>
+Reviewed-by: Tony Lindgren <tony@atomide.com>
+Link: https://lore.kernel.org/r/20230525093159.223817-4-john.ogness@linutronix.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/8250/8250_omap.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c
+index 05dc568bd3898..05704d8c56566 100644
+--- a/drivers/tty/serial/8250/8250_omap.c
++++ b/drivers/tty/serial/8250/8250_omap.c
+@@ -651,7 +651,9 @@ static irqreturn_t omap8250_irq(int irq, void *dev_id)
+
+ up->ier = port->serial_in(port, UART_IER);
+ if (up->ier & (UART_IER_RLSI | UART_IER_RDI)) {
++ spin_lock(&port->lock);
+ port->ops->stop_rx(port);
++ spin_unlock(&port->lock);
+ } else {
+ /* Keep restarting the timer until
+ * the input overrun subsides.
+--
+2.39.2
+
--- /dev/null
+From 46857fd9e163e0221fd1564da51babc00be227a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 May 2023 11:37:58 +0206
+Subject: serial: 8250: lock port for UART_IER access in omap8250_irq()
+
+From: John Ogness <john.ogness@linutronix.de>
+
+[ Upstream commit 25614735a647693c1260f253dc3ab32127697806 ]
+
+omap8250_irq() accesses UART_IER. This register is modified twice
+by each console write (serial8250_console_write()) under the port
+lock. omap8250_irq() must also take the port lock to guanentee
+synchronized access to UART_IER.
+
+Since the port lock is already being taken for the stop_rx() callback
+and since it is safe to call cancel_delayed_work() while holding the
+port lock, simply extend the port lock region to include UART_IER
+access.
+
+Fixes: 1fe0e1fa3209 ("serial: 8250_omap: Handle optional overrun-throttle-ms property")
+Signed-off-by: John Ogness <john.ogness@linutronix.de>
+Reviewed-by: Tony Lindgren <tony@atomide.com>
+Link: https://lore.kernel.org/r/20230525093159.223817-8-john.ogness@linutronix.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/8250/8250_omap.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c
+index 05704d8c56566..0a90ddc0bdf66 100644
+--- a/drivers/tty/serial/8250/8250_omap.c
++++ b/drivers/tty/serial/8250/8250_omap.c
+@@ -649,17 +649,18 @@ static irqreturn_t omap8250_irq(int irq, void *dev_id)
+ if ((lsr & UART_LSR_OE) && up->overrun_backoff_time_ms > 0) {
+ unsigned long delay;
+
++ /* Synchronize UART_IER access against the console. */
++ spin_lock(&port->lock);
+ up->ier = port->serial_in(port, UART_IER);
+ if (up->ier & (UART_IER_RLSI | UART_IER_RDI)) {
+- spin_lock(&port->lock);
+ port->ops->stop_rx(port);
+- spin_unlock(&port->lock);
+ } else {
+ /* Keep restarting the timer until
+ * the input overrun subsides.
+ */
+ cancel_delayed_work(&up->overrun_backoff);
+ }
++ spin_unlock(&port->lock);
+
+ delay = msecs_to_jiffies(up->overrun_backoff_time_ms);
+ schedule_delayed_work(&up->overrun_backoff, delay);
+--
+2.39.2
+
--- /dev/null
+From 7ebf7ae08debb85c532c05127810a86646721ca3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 May 2023 11:20:11 +0300
+Subject: serial: 8250: omap: Fix freeing of resources on failed register
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit b9ab22c2bc8652324a803b3e2be69838920b4025 ]
+
+If serial8250_register_8250_port() fails, the SoC can hang as the
+deferred PMQoS work will still run as is not flushed and removed.
+
+Fixes: 61929cf0169d ("tty: serial: Add 8250-core based omap driver")
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Link: https://lore.kernel.org/r/20230508082014.23083-2-tony@atomide.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/8250/8250_omap.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c
+index 734f092ef839a..05dc568bd3898 100644
+--- a/drivers/tty/serial/8250/8250_omap.c
++++ b/drivers/tty/serial/8250/8250_omap.c
+@@ -1532,7 +1532,9 @@ static int omap8250_probe(struct platform_device *pdev)
+ err:
+ pm_runtime_dont_use_autosuspend(&pdev->dev);
+ pm_runtime_put_sync(&pdev->dev);
++ flush_work(&priv->qos_work);
+ pm_runtime_disable(&pdev->dev);
++ cpu_latency_qos_remove_request(&priv->pm_qos_request);
+ return ret;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 06e6f1ae22db9d1364acb4e7b65c6f4a6ecd7ab3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Jun 2023 07:59:19 +0300
+Subject: serial: 8250_omap: Use force_suspend and resume for system suspend
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit 20a41a62618df85f3a2981008edec5cadd785e0a ]
+
+We should not rely on autosuspend timeout for system suspend. Instead,
+let's use force_suspend and force_resume functions. Otherwise the serial
+port controller device may not be idled on suspend.
+
+As we are doing a register write on suspend to configure the serial port,
+we still need to runtime PM resume the port on suspend.
+
+While at it, let's switch to pm_runtime_resume_and_get() and check for
+errors returned. And let's add the missing line break before return to the
+suspend function while at it.
+
+Fixes: 09d8b2bdbc5c ("serial: 8250: omap: Provide ability to enable/disable UART as wakeup source")
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Tested-by: Dhruva Gole <d-gole@ti.com>
+Message-ID: <20230614045922.4798-1-tony@atomide.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/8250/8250_omap.c | 20 +++++++++++++++-----
+ 1 file changed, 15 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c
+index 0a90ddc0bdf66..b758e9b613c74 100644
+--- a/drivers/tty/serial/8250/8250_omap.c
++++ b/drivers/tty/serial/8250/8250_omap.c
+@@ -1584,25 +1584,35 @@ static int omap8250_suspend(struct device *dev)
+ {
+ struct omap8250_priv *priv = dev_get_drvdata(dev);
+ struct uart_8250_port *up = serial8250_get_port(priv->line);
++ int err;
+
+ serial8250_suspend_port(priv->line);
+
+- pm_runtime_get_sync(dev);
++ err = pm_runtime_resume_and_get(dev);
++ if (err)
++ return err;
+ if (!device_may_wakeup(dev))
+ priv->wer = 0;
+ serial_out(up, UART_OMAP_WER, priv->wer);
+- pm_runtime_mark_last_busy(dev);
+- pm_runtime_put_autosuspend(dev);
+-
++ err = pm_runtime_force_suspend(dev);
+ flush_work(&priv->qos_work);
+- return 0;
++
++ return err;
+ }
+
+ static int omap8250_resume(struct device *dev)
+ {
+ struct omap8250_priv *priv = dev_get_drvdata(dev);
++ int err;
+
++ err = pm_runtime_force_resume(dev);
++ if (err)
++ return err;
+ serial8250_resume_port(priv->line);
++ /* Paired with pm_runtime_resume_and_get() in omap8250_suspend() */
++ pm_runtime_mark_last_busy(dev);
++ pm_runtime_put_autosuspend(dev);
++
+ return 0;
+ }
+ #else
+--
+2.39.2
+
--- /dev/null
+From 6878c1c4d8c4c77f9c897bf5b2798d75906226b7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 May 2023 11:37:55 +0206
+Subject: serial: core: lock port for start_rx() in uart_resume_port()
+
+From: John Ogness <john.ogness@linutronix.de>
+
+[ Upstream commit 51e45fba14bf08b66bca764a083c7f2e2ff62f01 ]
+
+The only user of the start_rx() callback (qcom_geni) directly calls
+its own stop_rx() callback. Since stop_rx() requires that the
+port->lock is taken and interrupts are disabled, the start_rx()
+callback has the same requirement.
+
+Fixes: cfab87c2c271 ("serial: core: Introduce callback for start_rx and do stop_rx in suspend only if this callback implementation is present.")
+Signed-off-by: John Ogness <john.ogness@linutronix.de>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Link: https://lore.kernel.org/r/20230525093159.223817-5-john.ogness@linutronix.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/serial_core.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
+index a664778492c46..ea4a70055ad9f 100644
+--- a/drivers/tty/serial/serial_core.c
++++ b/drivers/tty/serial/serial_core.c
+@@ -2430,8 +2430,11 @@ int uart_resume_port(struct uart_driver *drv, struct uart_port *uport)
+ if (console_suspend_enabled)
+ uart_change_pm(state, UART_PM_STATE_ON);
+ uport->ops->set_termios(uport, &termios, NULL);
+- if (!console_suspend_enabled && uport->ops->start_rx)
++ if (!console_suspend_enabled && uport->ops->start_rx) {
++ spin_lock_irq(&uport->lock);
+ uport->ops->start_rx(uport);
++ spin_unlock_irq(&uport->lock);
++ }
+ if (console_suspend_enabled)
+ console_start(uport->cons);
+ }
+--
+2.39.2
+
--- /dev/null
+From ae9f07cff1a8d4e034673a77b8c3e3e5c5561739 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 May 2023 11:37:53 +0206
+Subject: serial: core: lock port for stop_rx() in uart_suspend_port()
+
+From: John Ogness <john.ogness@linutronix.de>
+
+[ Upstream commit abcb0cf1f5b2d99b1d117a4dbce334120e358d6d ]
+
+The uarts_ops stop_rx() callback expects that the port->lock is
+taken and interrupts are disabled.
+
+Fixes: c9d2325cdb92 ("serial: core: Do stop_rx in suspend path for console if console_suspend is disabled")
+Signed-off-by: John Ogness <john.ogness@linutronix.de>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Link: https://lore.kernel.org/r/20230525093159.223817-3-john.ogness@linutronix.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/serial_core.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
+index 54e82f476a2cc..a664778492c46 100644
+--- a/drivers/tty/serial/serial_core.c
++++ b/drivers/tty/serial/serial_core.c
+@@ -2333,8 +2333,11 @@ int uart_suspend_port(struct uart_driver *drv, struct uart_port *uport)
+ * able to Re-start_rx later.
+ */
+ if (!console_suspend_enabled && uart_console(uport)) {
+- if (uport->ops->start_rx)
++ if (uport->ops->start_rx) {
++ spin_lock_irq(&uport->lock);
+ uport->ops->stop_rx(uport);
++ spin_unlock_irq(&uport->lock);
++ }
+ goto unlock;
+ }
+
+--
+2.39.2
+
ksmbd-avoid-field-overflow-warning.patch
arm64-sme-use-str-p-to-clear-ffr-context-field-in-st.patch
x86-efi-make-efi_set_virtual_address_map-ibt-safe.patch
+w1-w1_therm-fix-locking-behavior-in-convert_t.patch
+w1-fix-loop-in-w1_fini.patch
+dt-bindings-power-reset-qcom-pon-only-allow-reboot-m.patch
+f2fs-do-not-allow-to-defragment-files-have-fi_compre.patch
+sh-j2-use-ioremap-to-translate-device-tree-address-i.patch
+cpufreq-tegra194-fix-an-error-handling-path-in-tegra.patch
+usb-extend-pci-resume-function-to-handle-pm-events.patch
+xhci-improve-the-xhci-system-resume-time.patch
+usb-dwc2-fix-some-error-handling-paths.patch
+serial-8250-omap-fix-freeing-of-resources-on-failed-.patch
+interconnect-qcom-rpm-rename-icc-provider-num_clocks.patch
+interconnect-qcom-rpm-don-t-use-clk_get_optional-for.patch
+clk-qcom-gcc-ipq5332-use-floor-ops-for-sdcc-clocks.patch
+clk-qcom-mmcc-msm8974-remove-oxili_ocmemgx_clk.patch
+clk-qcom-camcc-sc7180-add-parent-dependency-to-all-c.patch
+clk-qcom-gcc-ipq6018-use-floor-ops-for-sdcc-clocks.patch
+clk-qcom-gcc-qcm2290-mark-rcgs-shared-where-applicab.patch
+media-usb-check-az6007_read-return-value.patch
+media-amphion-drop-repeated-codec-data-for-vc1l-form.patch
+media-amphion-drop-repeated-codec-data-for-vc1g-form.patch
+media-common-saa7146-avoid-a-leak-in-vmalloc_to_sg.patch
+media-videodev2.h-fix-p_s32-and-p_s64-pointer-types.patch
+media-amphion-initiate-a-drain-of-the-capture-queue-.patch
+media-videodev2.h-fix-struct-v4l2_input-tuner-index-.patch
+media-usb-siano-fix-warning-due-to-null-work_func_t-.patch
+media-i2c-imx296-fix-error-checking-in-imx296_read_t.patch
+media-i2c-correct-format-propagation-for-st-mipid02.patch
+media-renesas-fdp1-identify-r-car-gen2-versions.patch
+media-hi846-fix-usage-of-pm_runtime_get_if_in_use.patch
+media-mediatek-vcodec-using-decoder-status-instead-o.patch
+clk-qcom-ipq6018-fix-networking-resets.patch
+clk-qcom-dispcc-qcm2290-fix-bi_tcxo_ao-handling.patch
+clk-qcom-dispcc-qcm2290-fix-gpll0_out_div-handling.patch
+clk-qcom-ipq5332-fix-the-src-parameter-in-ftbl_gcc_a.patch
+clk-qcom-ipq5332-fix-the-order-of-sleep_clk-and-xo-c.patch
+clk-qcom-mmcc-msm8974-use-clk_rcg2_shared_ops-for-md.patch
+staging-vchiq_arm-mark-vchiq_platform_init-static.patch
+soundwire-qcom-use-consistently-ctrl-as-state-variab.patch
+soundwire-qcom-fix-unbalanced-pm_runtime_put.patch
+soundwire-debugfs-fix-unbalanced-pm_runtime_put.patch
+usb-dwc3-qcom-fix-potential-memory-leak.patch
+usb-gadget-u_serial-add-null-pointer-check-in-gseria.patch
+extcon-fix-kernel-doc-of-property-fields-to-avoid-wa.patch
+extcon-fix-kernel-doc-of-property-capability-fields-.patch
+usb-phy-phy-tahvo-fix-memory-leak-in-tahvo_usb_probe.patch
+usb-hide-unused-usbfs_notify_suspend-resume-function.patch
+usb-misc-eud-fix-eud-sysfs-path-use-qcom_eud.patch
+serial-core-lock-port-for-stop_rx-in-uart_suspend_po.patch
+serial-8250-lock-port-for-stop_rx-in-omap8250_irq.patch
+serial-core-lock-port-for-start_rx-in-uart_resume_po.patch
+serial-8250-lock-port-for-uart_ier-access-in-omap825.patch
+kernfs-fix-missing-kernfs_idr_lock-to-remove-an-id-f.patch
+lkdtm-replace-ll_rw_block-with-submit_bh.patch
+i3c-master-svc-fix-cpu-schedule-in-spin-lock.patch
+coresight-fix-loss-of-connection-info-when-a-module-.patch
+coresight-etm4x-fix-missing-trctraceidr-file-in-sysf.patch
+power-supply-rt9467-make-charger-enable-control-as-l.patch
+mfd-rt5033-drop-rt5033-battery-sub-device.patch
+media-venus-helpers-fix-align-of-non-power-of-two.patch
+media-atomisp-gc0310-fix-double-free-in-gc0310_remov.patch
+media-atomisp-gmin_platform-fix-out_len-in-gmin_get_.patch
+media-atomisp-ov2680-stop-using-half-pixelclock-for-.patch
+sh-avoid-using-irq0-on-sh3-and-sh4.patch
+gfs2-fix-duplicate-should_fault_in_pages-call.patch
+f2fs-fix-potential-deadlock-due-to-unpaired-node_wri.patch
+f2fs-fix-to-avoid-null-pointer-dereference-f2fs_writ.patch
+f2fs-support-errors-remount-ro-continue-panic-mounto.patch
+f2fs-fix-the-wrong-condition-to-determine-atomic-con.patch
+f2fs-flush-error-flags-in-workqueue.patch
+kvm-s390-fix-kvm_s390_get_cmma_bits-for-gfns-in-mems.patch
+usb-dwc3-qcom-release-the-correct-resources-in-dwc3_.patch
+usb-dwc3-qcom-fix-an-error-handling-path-in-dwc3_qco.patch
+usb-common-usb-conn-gpio-set-last-role-to-unknown-be.patch
+usb-dwc3-meson-g12a-fix-an-error-handling-path-in-dw.patch
+rtla-hwnoise-reduce-runtime-to-75.patch
+mfd-wcd934x-fix-an-error-handling-path-in-wcd934x_sl.patch
+mfd-intel-lpss-add-missing-check-for-platform_get_re.patch
+revert-usb-common-usb-conn-gpio-set-last-role-to-unk.patch
+serial-8250_omap-use-force_suspend-and-resume-for-sy.patch
+drivers-fwnode-fix-fwnode_irq_get-_byname.patch
+cdx-fix-driver-managed-dma-support.patch
+nvmem-sunplus-ocotp-release-otp-clk-before-return.patch
+nvmem-imx-ocotp-reverse-mac-addresses-on-all-i.mx-de.patch
+test_firmware-return-enomem-instead-of-enospc-on-fai.patch
+nvmem-rmem-use-nvmem_devid_auto.patch
+bus-fsl-mc-don-t-assume-child-devices-are-all-fsl-mc.patch
+mfd-stmfx-fix-error-path-in-stmfx_chip_init.patch
+mfd-stmfx-nullify-stmfx-vdd-in-case-of-error.patch
+kvm-s390-vsie-fix-the-length-of-apcb-bitmap.patch
+kvm-s390-diag-fix-racy-access-of-physical-cpu-number.patch
+cpufreq-mediatek-correct-voltages-for-mt7622-and-mt7.patch
+misc-fastrpc-check-return-value-of-devm_kasprintf.patch
+clk-qcom-mmcc-msm8974-fix-mdss_gdsc-power-flags.patch
+hwtracing-hisi_ptt-fix-potential-sleep-in-atomic-con.patch
+phy-qcom-qmp-combo-fix-display-port-phy-configuratio.patch
+mfd-stmpe-only-disable-the-regulators-if-they-are-en.patch
+phy-tegra-xusb-check-return-value-of-devm_kzalloc.patch
+lib-bitmap-drop-optimization-of-bitmap_-from-to-_arr.patch
+pwm-imx-tpm-force-real_period-to-be-zero-in-suspend.patch
+pwm-sysfs-do-not-apply-state-to-already-disabled-pwm.patch
+pwm-ab8500-fix-error-code-in-probe.patch
+pwm-mtk_disp-fix-the-disable-flow-of-disp_pwm.patch
+md-raid10-fix-the-condition-to-call-bio_end_io_acct.patch
+perf-bpf-move-the-declaration-of-struct-rq.patch
+blk-throttle-fix-io-statistics-for-cgroup-v1.patch
+rtc-st-lpc-release-some-resources-in-st_rtc_probe-in.patch
+drm-i915-psr-use-hw.adjusted-mode-when-calculating-i.patch
+drm-i915-guc-slpc-apply-min-softlimit-correctly.patch
+f2fs-check-return-value-of-freeze_super.patch
+virtio-vdpa-fix-unchecked-call-to-null-set_vq_affini.patch
+tools-virtio-fix-build-break-for-aarch64.patch
+media-tc358746-select-config_generic_phy.patch
+media-cec-i2c-ch7322-also-select-regmap.patch
+sctp-fix-potential-deadlock-on-net-sctp.addr_wq_lock.patch
+net-sched-act_ipt-add-sanity-checks-on-table-name-an.patch
+net-sched-act_ipt-add-sanity-checks-on-skb-before-ca.patch
+net-sched-act_ipt-zero-skb-cb-before-calling-target.patch
+spi-spi-geni-qcom-enable-spi_controller_must_tx-for-.patch
+net-mscc-ocelot-don-t-report-that-rx-timestamping-is.patch
+net-mscc-ocelot-don-t-keep-ptp-configuration-of-all-.patch
+net-dsa-felix-don-t-drop-ptp-frames-with-tag_8021q-w.patch
+net-dsa-sja1105-always-enable-the-incl_srcpt-option.patch
+net-dsa-tag_sja1105-always-prefer-source-port-inform.patch
+add-module_firmware-for-firmware_tg357766.patch
+bluetooth-fix-invalid-bdaddr-quirk-for-non-persisten.patch
+bluetooth-fix-use-bdaddr-property-quirk.patch
+bluetooth-hci_bcm-do-not-mark-valid-bd_addr-as-inval.patch
+bluetooth-iso-use-hci_sync-for-setting-cig-parameter.patch
+bluetooth-mgmt-fix-marking-scan_rsp-as-not-connectab.patch
+sfc-support-for-devlink-port-requires-mae-access.patch
+ibmvnic-do-not-reset-dql-stats-on-non_fatal-err.patch
+net-dsa-vsc73xx-fix-mtu-configuration.patch
+mlxsw-minimal-fix-potential-memory-leak-in-mlxsw_m_l.patch
+spi-bcm-qspi-return-error-if-neither-hif_mspi-nor-ms.patch
+drm-amdgpu-fix-number-of-fence-calculations.patch
+drm-amd-don-t-try-to-enable-secure-display-ta-multip.patch
+mailbox-ti-msgmgr-fill-non-message-tx-data-fields-wi.patch
+f2fs-fix-error-path-handling-in-truncate_dnode.patch
+octeontx2-af-cn10kb-fix-interrupt-csr-addresses.patch
+octeontx2-af-fix-mapping-for-nix-block-from-cgx-conn.patch
+octeontx2-af-add-validation-before-accessing-cgx-and.patch
+octeontx2-af-reset-mac-features-in-flr.patch
+ntfs-fix-panic-about-slab-out-of-bounds-caused-by-nt.patch
+powerpc-allow-ppc_early_debug_cpm-only-when-serial_c.patch
+powerpc-dts-turris1x.dts-fix-pcie-mem-size-for-pci2-.patch
+net-bridge-keep-ports-without-iff_unicast_flt-in-br_.patch
+net-dsa-tag_sja1105-fix-source-port-decoding-in-vlan.patch
+net-fix-net_dev_start_xmit-trace-event-vs-skb_transp.patch
+tcp-annotate-data-races-in-__tcp_oow_rate_limited.patch
+vduse-fix-null-pointer-dereference.patch
+bpf-btf-warn-but-return-no-error-for-null-btf-from-_.patch
+xsk-honor-so_bindtodevice-on-bind.patch
+net-sched-act_pedit-add-size-check-for-tca_pedit_par.patch
+drm-i915-psr-fix-bdw-psr-aux-ch-data-register-offset.patch
+fanotify-disallow-mount-sb-marks-on-kernel-internal-.patch
+riscv-move-memblock_allow_resize-after-linear-mappin.patch
+pptp-fix-fib-lookup-calls.patch
+net-dsa-tag_sja1105-fix-mac-da-patching-from-meta-fr.patch
+net-dsa-sja1105-always-enable-the-send_meta-options.patch
+octeontx-af-fix-hardware-timestamp-configuration.patch
+afs-fix-accidental-truncation-when-storing-data.patch
+s390-qeth-fix-vipa-deletion.patch
+risc-v-fix-order-of-ipi-enablement-vs-rcu-startup.patch
+sh-dma-fix-dma-channel-offset-calculation.patch
+apparmor-fix-missing-error-check-for-rhashtable_inse.patch
+apparmor-add-missing-failure-check-in-compute_xmatch.patch
+apparmor-fix-policy_compat-permission-remap-with-ext.patch
+apparmor-fix-profile-verification-and-enable-it.patch
+i2c-xiic-don-t-try-to-handle-more-interrupt-events-a.patch
+writeback-account-the-number-of-pages-written-back.patch
+lib-dhry-fix-sleeping-allocations-inside-non-preempt.patch
--- /dev/null
+From 7ec233b6627ef165869c96bf8fc883f4f4ae7ec6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Jun 2023 13:32:20 +0100
+Subject: sfc: support for devlink port requires MAE access
+
+From: Martin Habets <habetsm.xilinx@gmail.com>
+
+[ Upstream commit 915057ae79692d47f9fb3504785855be49abaea4 ]
+
+On systems without MAE permission efx->mae is not initialised,
+and trying to lookup an mport results in a NULL pointer
+dereference.
+
+Fixes: 25414b2a64ae ("sfc: add devlink port support for ef100")
+Signed-off-by: Martin Habets <habetsm.xilinx@gmail.com>
+Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/sfc/efx_devlink.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/ethernet/sfc/efx_devlink.c b/drivers/net/ethernet/sfc/efx_devlink.c
+index ef9971cbb695d..0384b134e1242 100644
+--- a/drivers/net/ethernet/sfc/efx_devlink.c
++++ b/drivers/net/ethernet/sfc/efx_devlink.c
+@@ -622,6 +622,9 @@ static struct devlink_port *ef100_set_devlink_port(struct efx_nic *efx, u32 idx)
+ u32 id;
+ int rc;
+
++ if (!efx->mae)
++ return NULL;
++
+ if (efx_mae_lookup_mport(efx, idx, &id)) {
+ /* This should not happen. */
+ if (idx == MAE_MPORT_DESC_VF_IDX_NULL)
+--
+2.39.2
+
--- /dev/null
+From fce023e79d3dda8be9a814ef0e0b87e28a1eddd0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Jun 2023 23:22:17 +0300
+Subject: sh: Avoid using IRQ0 on SH3 and SH4
+
+From: Sergey Shtylyov <s.shtylyov@omp.ru>
+
+[ Upstream commit a8ac2961148e8c720dc760f2e06627cd5c55a154 ]
+
+IRQ0 is no longer returned by platform_get_irq() and its ilk -- they now
+return -EINVAL instead. However, the kernel code supporting SH3/4-based
+SoCs still maps the IRQ #s starting at 0 -- modify that code to start the
+IRQ #s from 16 instead.
+
+The patch should mostly affect the AP-SH4A-3A/AP-SH4AD-0A boards as they
+indeed are using IRQ0 for the SMSC911x compatible Ethernet chip.
+
+Fixes: ce753ad1549c ("platform: finally disallow IRQ0 in platform_get_irq() and its ilk")
+Signed-off-by: Sergey Shtylyov <s.shtylyov@omp.ru>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
+Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
+Link: https://lore.kernel.org/r/71105dbf-cdb0-72e1-f9eb-eeda8e321696@omp.ru
+Signed-off-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sh/include/mach-common/mach/highlander.h | 2 +-
+ arch/sh/include/mach-common/mach/r2d.h | 2 +-
+ arch/sh/include/mach-dreamcast/mach/sysasic.h | 2 +-
+ arch/sh/include/mach-se/mach/se7724.h | 2 +-
+ arch/sh/kernel/cpu/sh3/entry.S | 4 ++--
+ include/linux/sh_intc.h | 6 +++---
+ 6 files changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/arch/sh/include/mach-common/mach/highlander.h b/arch/sh/include/mach-common/mach/highlander.h
+index fb44c299d0337..b12c795584225 100644
+--- a/arch/sh/include/mach-common/mach/highlander.h
++++ b/arch/sh/include/mach-common/mach/highlander.h
+@@ -176,7 +176,7 @@
+ #define IVDR_CK_ON 4 /* iVDR Clock ON */
+ #endif
+
+-#define HL_FPGA_IRQ_BASE 200
++#define HL_FPGA_IRQ_BASE (200 + 16)
+ #define HL_NR_IRL 15
+
+ #define IRQ_AX88796 (HL_FPGA_IRQ_BASE + 0)
+diff --git a/arch/sh/include/mach-common/mach/r2d.h b/arch/sh/include/mach-common/mach/r2d.h
+index 0d7e483c7d3f5..69bc1907c5637 100644
+--- a/arch/sh/include/mach-common/mach/r2d.h
++++ b/arch/sh/include/mach-common/mach/r2d.h
+@@ -47,7 +47,7 @@
+
+ #define IRLCNTR1 (PA_BCR + 0) /* Interrupt Control Register1 */
+
+-#define R2D_FPGA_IRQ_BASE 100
++#define R2D_FPGA_IRQ_BASE (100 + 16)
+
+ #define IRQ_VOYAGER (R2D_FPGA_IRQ_BASE + 0)
+ #define IRQ_EXT (R2D_FPGA_IRQ_BASE + 1)
+diff --git a/arch/sh/include/mach-dreamcast/mach/sysasic.h b/arch/sh/include/mach-dreamcast/mach/sysasic.h
+index ed69ce7f20301..3b27be9a527ea 100644
+--- a/arch/sh/include/mach-dreamcast/mach/sysasic.h
++++ b/arch/sh/include/mach-dreamcast/mach/sysasic.h
+@@ -22,7 +22,7 @@
+ takes.
+ */
+
+-#define HW_EVENT_IRQ_BASE 48
++#define HW_EVENT_IRQ_BASE (48 + 16)
+
+ /* IRQ 13 */
+ #define HW_EVENT_VSYNC (HW_EVENT_IRQ_BASE + 5) /* VSync */
+diff --git a/arch/sh/include/mach-se/mach/se7724.h b/arch/sh/include/mach-se/mach/se7724.h
+index 1fe28820dfa95..ea6c46633b337 100644
+--- a/arch/sh/include/mach-se/mach/se7724.h
++++ b/arch/sh/include/mach-se/mach/se7724.h
+@@ -37,7 +37,7 @@
+ #define IRQ2_IRQ evt2irq(0x640)
+
+ /* Bits in IRQ012 registers */
+-#define SE7724_FPGA_IRQ_BASE 220
++#define SE7724_FPGA_IRQ_BASE (220 + 16)
+
+ /* IRQ0 */
+ #define IRQ0_BASE SE7724_FPGA_IRQ_BASE
+diff --git a/arch/sh/kernel/cpu/sh3/entry.S b/arch/sh/kernel/cpu/sh3/entry.S
+index e48b3dd996f58..b1f5b3c58a018 100644
+--- a/arch/sh/kernel/cpu/sh3/entry.S
++++ b/arch/sh/kernel/cpu/sh3/entry.S
+@@ -470,9 +470,9 @@ ENTRY(handle_interrupt)
+ mov r4, r0 ! save vector->jmp table offset for later
+
+ shlr2 r4 ! vector to IRQ# conversion
+- add #-0x10, r4
+
+- cmp/pz r4 ! is it a valid IRQ?
++ mov #0x10, r5
++ cmp/hs r5, r4 ! is it a valid IRQ?
+ bt 10f
+
+ /*
+diff --git a/include/linux/sh_intc.h b/include/linux/sh_intc.h
+index 37ad81058d6ae..27ae79191bdc3 100644
+--- a/include/linux/sh_intc.h
++++ b/include/linux/sh_intc.h
+@@ -13,9 +13,9 @@
+ /*
+ * Convert back and forth between INTEVT and IRQ values.
+ */
+-#ifdef CONFIG_CPU_HAS_INTEVT
+-#define evt2irq(evt) (((evt) >> 5) - 16)
+-#define irq2evt(irq) (((irq) + 16) << 5)
++#ifdef CONFIG_CPU_HAS_INTEVT /* Avoid IRQ0 (invalid for platform devices) */
++#define evt2irq(evt) ((evt) >> 5)
++#define irq2evt(irq) ((irq) << 5)
+ #else
+ #define evt2irq(evt) (evt)
+ #define irq2evt(irq) (irq)
+--
+2.39.2
+
--- /dev/null
+From e852fdc1f45541995e59b7b9f95730e3f127a1eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 27 May 2023 18:44:50 +0200
+Subject: sh: dma: Fix DMA channel offset calculation
+
+From: Artur Rojek <contact@artur-rojek.eu>
+
+[ Upstream commit e82e47584847129a20b8c9f4a1dcde09374fb0e0 ]
+
+Various SoCs of the SH3, SH4 and SH4A family, which use this driver,
+feature a differing number of DMA channels, which can be distributed
+between up to two DMAC modules. The existing implementation fails to
+correctly accommodate for all those variations, resulting in wrong
+channel offset calculations and leading to kernel panics.
+
+Rewrite dma_base_addr() in order to properly calculate channel offsets
+in a DMAC module. Fix dmaor_read_reg() and dmaor_write_reg(), so that
+the correct DMAC module base is selected for the DMAOR register.
+
+Fixes: 7f47c7189b3e8f19 ("sh: dma: More legacy cpu dma chainsawing.")
+Signed-off-by: Artur Rojek <contact@artur-rojek.eu>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
+Link: https://lore.kernel.org/r/20230527164452.64797-2-contact@artur-rojek.eu
+Signed-off-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sh/drivers/dma/dma-sh.c | 37 +++++++++++++++++++++++-------------
+ 1 file changed, 24 insertions(+), 13 deletions(-)
+
+diff --git a/arch/sh/drivers/dma/dma-sh.c b/arch/sh/drivers/dma/dma-sh.c
+index 96c626c2cd0a4..306fba1564e5e 100644
+--- a/arch/sh/drivers/dma/dma-sh.c
++++ b/arch/sh/drivers/dma/dma-sh.c
+@@ -18,6 +18,18 @@
+ #include <cpu/dma-register.h>
+ #include <cpu/dma.h>
+
++/*
++ * Some of the SoCs feature two DMAC modules. In such a case, the channels are
++ * distributed equally among them.
++ */
++#ifdef SH_DMAC_BASE1
++#define SH_DMAC_NR_MD_CH (CONFIG_NR_ONCHIP_DMA_CHANNELS / 2)
++#else
++#define SH_DMAC_NR_MD_CH CONFIG_NR_ONCHIP_DMA_CHANNELS
++#endif
++
++#define SH_DMAC_CH_SZ 0x10
++
+ /*
+ * Define the default configuration for dual address memory-memory transfer.
+ * The 0x400 value represents auto-request, external->external.
+@@ -29,7 +41,7 @@ static unsigned long dma_find_base(unsigned int chan)
+ unsigned long base = SH_DMAC_BASE0;
+
+ #ifdef SH_DMAC_BASE1
+- if (chan >= 6)
++ if (chan >= SH_DMAC_NR_MD_CH)
+ base = SH_DMAC_BASE1;
+ #endif
+
+@@ -40,13 +52,13 @@ static unsigned long dma_base_addr(unsigned int chan)
+ {
+ unsigned long base = dma_find_base(chan);
+
+- /* Normalize offset calculation */
+- if (chan >= 9)
+- chan -= 6;
+- if (chan >= 4)
+- base += 0x10;
++ chan = (chan % SH_DMAC_NR_MD_CH) * SH_DMAC_CH_SZ;
++
++ /* DMAOR is placed inside the channel register space. Step over it. */
++ if (chan >= DMAOR)
++ base += SH_DMAC_CH_SZ;
+
+- return base + (chan * 0x10);
++ return base + chan;
+ }
+
+ #ifdef CONFIG_SH_DMA_IRQ_MULTI
+@@ -250,12 +262,11 @@ static int sh_dmac_get_dma_residue(struct dma_channel *chan)
+ #define NR_DMAOR 1
+ #endif
+
+-/*
+- * DMAOR bases are broken out amongst channel groups. DMAOR0 manages
+- * channels 0 - 5, DMAOR1 6 - 11 (optional).
+- */
+-#define dmaor_read_reg(n) __raw_readw(dma_find_base((n)*6))
+-#define dmaor_write_reg(n, data) __raw_writew(data, dma_find_base(n)*6)
++#define dmaor_read_reg(n) __raw_readw(dma_find_base((n) * \
++ SH_DMAC_NR_MD_CH) + DMAOR)
++#define dmaor_write_reg(n, data) __raw_writew(data, \
++ dma_find_base((n) * \
++ SH_DMAC_NR_MD_CH) + DMAOR)
+
+ static inline int dmaor_reset(int no)
+ {
+--
+2.39.2
+
--- /dev/null
+From 90185d00dbbf2f2d832cff6274be3f9820ddd836 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 May 2023 14:57:41 +0200
+Subject: sh: j2: Use ioremap() to translate device tree address into kernel
+ memory
+
+From: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
+
+[ Upstream commit bc9d1f0cecd2407cfb2364a7d4be2f52d1d46a9d ]
+
+Addresses the following warning when building j2_defconfig:
+
+arch/sh/kernel/cpu/sh2/probe.c: In function 'scan_cache':
+arch/sh/kernel/cpu/sh2/probe.c:24:16: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast]
+ 24 | j2_ccr_base = (u32 __iomem *)of_flat_dt_translate_address(node);
+ |
+
+Fixes: 5a846abad07f ("sh: add support for J-Core J2 processor")
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Tested-by: Rob Landley <rob@landley.net>
+Signed-off-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
+Link: https://lore.kernel.org/r/20230503125746.331835-1-glaubitz@physik.fu-berlin.de
+Signed-off-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sh/kernel/cpu/sh2/probe.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/sh/kernel/cpu/sh2/probe.c b/arch/sh/kernel/cpu/sh2/probe.c
+index d342ea08843f6..70a07f4f2142f 100644
+--- a/arch/sh/kernel/cpu/sh2/probe.c
++++ b/arch/sh/kernel/cpu/sh2/probe.c
+@@ -21,7 +21,7 @@ static int __init scan_cache(unsigned long node, const char *uname,
+ if (!of_flat_dt_is_compatible(node, "jcore,cache"))
+ return 0;
+
+- j2_ccr_base = (u32 __iomem *)of_flat_dt_translate_address(node);
++ j2_ccr_base = ioremap(of_flat_dt_translate_address(node), 4);
+
+ return 1;
+ }
+--
+2.39.2
+
--- /dev/null
+From 492291e4edeb86cf5319912aadf3cfd404306014 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 May 2023 18:37:50 +0200
+Subject: soundwire: debugfs: fix unbalanced pm_runtime_put()
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit 217f5e0de397fafc94d25a8f7baf71920bea4a04 ]
+
+If pm_runtime_resume_and_get() failed with -EACCES, the driver continued
+execution and finally called pm_runtime_put_autosuspend(). Since
+pm_runtime_resume_and_get() drops the usage counter on every error, this
+lead to double decrement of that counter.
+
+Fixes: b275bf45ba1d ("soundwire: debugfs: Switch to sdw_read_no_pm")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20230517163750.997629-2-krzysztof.kozlowski@linaro.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soundwire/debugfs.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/soundwire/debugfs.c b/drivers/soundwire/debugfs.c
+index dea782e0edc4b..c3a1a359ee5c3 100644
+--- a/drivers/soundwire/debugfs.c
++++ b/drivers/soundwire/debugfs.c
+@@ -56,8 +56,9 @@ static int sdw_slave_reg_show(struct seq_file *s_file, void *data)
+ if (!buf)
+ return -ENOMEM;
+
+- ret = pm_runtime_resume_and_get(&slave->dev);
++ ret = pm_runtime_get_sync(&slave->dev);
+ if (ret < 0 && ret != -EACCES) {
++ pm_runtime_put_noidle(&slave->dev);
+ kfree(buf);
+ return ret;
+ }
+--
+2.39.2
+
--- /dev/null
+From d3fa8f7ed58b0fe96e2ef113aa9fcba0580b50a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 May 2023 18:37:49 +0200
+Subject: soundwire: qcom: fix unbalanced pm_runtime_put()
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit 9f9914b178a7935d2d94ee3e1bf55f2b42b18528 ]
+
+This reverts commit 57ed510b0547 ("soundwire: qcom: use
+pm_runtime_resume_and_get()") which introduced unbalanced
+pm_runtime_put(), when device did not have runtime PM enabled.
+
+If pm_runtime_resume_and_get() failed with -EACCES, the driver continued
+execution and finally called pm_runtime_put_autosuspend(). Since
+pm_runtime_resume_and_get() drops the usage counter on every error, this
+lead to double decrement of that counter visible in certain debugfs
+actions on unattached devices (still in reset state):
+
+ $ cat /sys/kernel/debug/soundwire/master-0-0/sdw:0:0217:f001:00:0/registers
+ qcom-soundwire 3210000.soundwire-controller: swrm_wait_for_wr_fifo_avail err write overflow
+ soundwire sdw-master-0: trf on Slave 1 failed:-5 read addr e36 count 1
+ soundwire sdw:0:0217:f001:00:0: Runtime PM usage count underflow!
+
+Fixes: 57ed510b0547 ("soundwire: qcom: use pm_runtime_resume_and_get()")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20230517163750.997629-1-krzysztof.kozlowski@linaro.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soundwire/qcom.c | 15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/soundwire/qcom.c b/drivers/soundwire/qcom.c
+index 7c75c6e3fab54..bd39e78788590 100644
+--- a/drivers/soundwire/qcom.c
++++ b/drivers/soundwire/qcom.c
+@@ -535,11 +535,12 @@ static irqreturn_t qcom_swrm_wake_irq_handler(int irq, void *dev_id)
+ struct qcom_swrm_ctrl *ctrl = dev_id;
+ int ret;
+
+- ret = pm_runtime_resume_and_get(ctrl->dev);
++ ret = pm_runtime_get_sync(ctrl->dev);
+ if (ret < 0 && ret != -EACCES) {
+ dev_err_ratelimited(ctrl->dev,
+- "pm_runtime_resume_and_get failed in %s, ret %d\n",
++ "pm_runtime_get_sync failed in %s, ret %d\n",
+ __func__, ret);
++ pm_runtime_put_noidle(ctrl->dev);
+ return ret;
+ }
+
+@@ -1090,11 +1091,12 @@ static int qcom_swrm_startup(struct snd_pcm_substream *substream,
+ struct snd_soc_dai *codec_dai;
+ int ret, i;
+
+- ret = pm_runtime_resume_and_get(ctrl->dev);
++ ret = pm_runtime_get_sync(ctrl->dev);
+ if (ret < 0 && ret != -EACCES) {
+ dev_err_ratelimited(ctrl->dev,
+- "pm_runtime_resume_and_get failed in %s, ret %d\n",
++ "pm_runtime_get_sync failed in %s, ret %d\n",
+ __func__, ret);
++ pm_runtime_put_noidle(ctrl->dev);
+ return ret;
+ }
+
+@@ -1295,11 +1297,12 @@ static int swrm_reg_show(struct seq_file *s_file, void *data)
+ struct qcom_swrm_ctrl *ctrl = s_file->private;
+ int reg, reg_val, ret;
+
+- ret = pm_runtime_resume_and_get(ctrl->dev);
++ ret = pm_runtime_get_sync(ctrl->dev);
+ if (ret < 0 && ret != -EACCES) {
+ dev_err_ratelimited(ctrl->dev,
+- "pm_runtime_resume_and_get failed in %s, ret %d\n",
++ "pm_runtime_get_sync failed in %s, ret %d\n",
+ __func__, ret);
++ pm_runtime_put_noidle(ctrl->dev);
+ return ret;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 163819f2fc605e8118df72da08c58303ed004e94 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Apr 2023 11:54:44 +0200
+Subject: soundwire: qcom: use consistently 'ctrl' as state variable name
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit 6f76e79153d588ebb00becbfc200ec3b983e353e ]
+
+The pointer to 'struct qcom_swrm_ctrl' was called sometimes 'swrm' and
+sometimes 'ctrl' variable. Choose one - 'ctrl' - so the code will be
+consistent and easier to read.
+
+No functional change.
+
+Reviewed-by: Srinivas Kandagagatla <srinivas.kandagatla@linaro.org>
+Tested-by: Srinivas Kandagagatla <srinivas.kandagatla@linaro.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Link: https://lore.kernel.org/r/20230418095447.577001-5-krzysztof.kozlowski@linaro.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Stable-dep-of: 9f9914b178a7 ("soundwire: qcom: fix unbalanced pm_runtime_put()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soundwire/qcom.c | 168 +++++++++++++++++++--------------------
+ 1 file changed, 84 insertions(+), 84 deletions(-)
+
+diff --git a/drivers/soundwire/qcom.c b/drivers/soundwire/qcom.c
+index 280455f047a36..7c75c6e3fab54 100644
+--- a/drivers/soundwire/qcom.c
++++ b/drivers/soundwire/qcom.c
+@@ -278,14 +278,14 @@ static u32 swrm_get_packed_reg_val(u8 *cmd_id, u8 cmd_data,
+ return val;
+ }
+
+-static int swrm_wait_for_rd_fifo_avail(struct qcom_swrm_ctrl *swrm)
++static int swrm_wait_for_rd_fifo_avail(struct qcom_swrm_ctrl *ctrl)
+ {
+ u32 fifo_outstanding_data, value;
+ int fifo_retry_count = SWR_OVERFLOW_RETRY_COUNT;
+
+ do {
+ /* Check for fifo underflow during read */
+- swrm->reg_read(swrm, SWRM_CMD_FIFO_STATUS, &value);
++ ctrl->reg_read(ctrl, SWRM_CMD_FIFO_STATUS, &value);
+ fifo_outstanding_data = FIELD_GET(SWRM_RD_CMD_FIFO_CNT_MASK, value);
+
+ /* Check if read data is available in read fifo */
+@@ -296,39 +296,39 @@ static int swrm_wait_for_rd_fifo_avail(struct qcom_swrm_ctrl *swrm)
+ } while (fifo_retry_count--);
+
+ if (fifo_outstanding_data == 0) {
+- dev_err_ratelimited(swrm->dev, "%s err read underflow\n", __func__);
++ dev_err_ratelimited(ctrl->dev, "%s err read underflow\n", __func__);
+ return -EIO;
+ }
+
+ return 0;
+ }
+
+-static int swrm_wait_for_wr_fifo_avail(struct qcom_swrm_ctrl *swrm)
++static int swrm_wait_for_wr_fifo_avail(struct qcom_swrm_ctrl *ctrl)
+ {
+ u32 fifo_outstanding_cmds, value;
+ int fifo_retry_count = SWR_OVERFLOW_RETRY_COUNT;
+
+ do {
+ /* Check for fifo overflow during write */
+- swrm->reg_read(swrm, SWRM_CMD_FIFO_STATUS, &value);
++ ctrl->reg_read(ctrl, SWRM_CMD_FIFO_STATUS, &value);
+ fifo_outstanding_cmds = FIELD_GET(SWRM_WR_CMD_FIFO_CNT_MASK, value);
+
+ /* Check for space in write fifo before writing */
+- if (fifo_outstanding_cmds < swrm->wr_fifo_depth)
++ if (fifo_outstanding_cmds < ctrl->wr_fifo_depth)
+ return 0;
+
+ usleep_range(500, 510);
+ } while (fifo_retry_count--);
+
+- if (fifo_outstanding_cmds == swrm->wr_fifo_depth) {
+- dev_err_ratelimited(swrm->dev, "%s err write overflow\n", __func__);
++ if (fifo_outstanding_cmds == ctrl->wr_fifo_depth) {
++ dev_err_ratelimited(ctrl->dev, "%s err write overflow\n", __func__);
+ return -EIO;
+ }
+
+ return 0;
+ }
+
+-static int qcom_swrm_cmd_fifo_wr_cmd(struct qcom_swrm_ctrl *swrm, u8 cmd_data,
++static int qcom_swrm_cmd_fifo_wr_cmd(struct qcom_swrm_ctrl *ctrl, u8 cmd_data,
+ u8 dev_addr, u16 reg_addr)
+ {
+
+@@ -341,20 +341,20 @@ static int qcom_swrm_cmd_fifo_wr_cmd(struct qcom_swrm_ctrl *swrm, u8 cmd_data,
+ val = swrm_get_packed_reg_val(&cmd_id, cmd_data,
+ dev_addr, reg_addr);
+ } else {
+- val = swrm_get_packed_reg_val(&swrm->wcmd_id, cmd_data,
++ val = swrm_get_packed_reg_val(&ctrl->wcmd_id, cmd_data,
+ dev_addr, reg_addr);
+ }
+
+- if (swrm_wait_for_wr_fifo_avail(swrm))
++ if (swrm_wait_for_wr_fifo_avail(ctrl))
+ return SDW_CMD_FAIL_OTHER;
+
+ if (cmd_id == SWR_BROADCAST_CMD_ID)
+- reinit_completion(&swrm->broadcast);
++ reinit_completion(&ctrl->broadcast);
+
+ /* Its assumed that write is okay as we do not get any status back */
+- swrm->reg_write(swrm, SWRM_CMD_FIFO_WR_CMD, val);
++ ctrl->reg_write(ctrl, SWRM_CMD_FIFO_WR_CMD, val);
+
+- if (swrm->version <= SWRM_VERSION_1_3_0)
++ if (ctrl->version <= SWRM_VERSION_1_3_0)
+ usleep_range(150, 155);
+
+ if (cmd_id == SWR_BROADCAST_CMD_ID) {
+@@ -362,7 +362,7 @@ static int qcom_swrm_cmd_fifo_wr_cmd(struct qcom_swrm_ctrl *swrm, u8 cmd_data,
+ * sleep for 10ms for MSM soundwire variant to allow broadcast
+ * command to complete.
+ */
+- ret = wait_for_completion_timeout(&swrm->broadcast,
++ ret = wait_for_completion_timeout(&ctrl->broadcast,
+ msecs_to_jiffies(TIMEOUT_MS));
+ if (!ret)
+ ret = SDW_CMD_IGNORED;
+@@ -375,41 +375,41 @@ static int qcom_swrm_cmd_fifo_wr_cmd(struct qcom_swrm_ctrl *swrm, u8 cmd_data,
+ return ret;
+ }
+
+-static int qcom_swrm_cmd_fifo_rd_cmd(struct qcom_swrm_ctrl *swrm,
++static int qcom_swrm_cmd_fifo_rd_cmd(struct qcom_swrm_ctrl *ctrl,
+ u8 dev_addr, u16 reg_addr,
+ u32 len, u8 *rval)
+ {
+ u32 cmd_data, cmd_id, val, retry_attempt = 0;
+
+- val = swrm_get_packed_reg_val(&swrm->rcmd_id, len, dev_addr, reg_addr);
++ val = swrm_get_packed_reg_val(&ctrl->rcmd_id, len, dev_addr, reg_addr);
+
+ /*
+ * Check for outstanding cmd wrt. write fifo depth to avoid
+ * overflow as read will also increase write fifo cnt.
+ */
+- swrm_wait_for_wr_fifo_avail(swrm);
++ swrm_wait_for_wr_fifo_avail(ctrl);
+
+ /* wait for FIFO RD to complete to avoid overflow */
+ usleep_range(100, 105);
+- swrm->reg_write(swrm, SWRM_CMD_FIFO_RD_CMD, val);
++ ctrl->reg_write(ctrl, SWRM_CMD_FIFO_RD_CMD, val);
+ /* wait for FIFO RD CMD complete to avoid overflow */
+ usleep_range(250, 255);
+
+- if (swrm_wait_for_rd_fifo_avail(swrm))
++ if (swrm_wait_for_rd_fifo_avail(ctrl))
+ return SDW_CMD_FAIL_OTHER;
+
+ do {
+- swrm->reg_read(swrm, SWRM_CMD_FIFO_RD_FIFO_ADDR, &cmd_data);
++ ctrl->reg_read(ctrl, SWRM_CMD_FIFO_RD_FIFO_ADDR, &cmd_data);
+ rval[0] = cmd_data & 0xFF;
+ cmd_id = FIELD_GET(SWRM_RD_FIFO_CMD_ID_MASK, cmd_data);
+
+- if (cmd_id != swrm->rcmd_id) {
++ if (cmd_id != ctrl->rcmd_id) {
+ if (retry_attempt < (MAX_FIFO_RD_RETRY - 1)) {
+ /* wait 500 us before retry on fifo read failure */
+ usleep_range(500, 505);
+- swrm->reg_write(swrm, SWRM_CMD_FIFO_CMD,
++ ctrl->reg_write(ctrl, SWRM_CMD_FIFO_CMD,
+ SWRM_CMD_FIFO_FLUSH);
+- swrm->reg_write(swrm, SWRM_CMD_FIFO_RD_CMD, val);
++ ctrl->reg_write(ctrl, SWRM_CMD_FIFO_RD_CMD, val);
+ }
+ retry_attempt++;
+ } else {
+@@ -418,9 +418,9 @@ static int qcom_swrm_cmd_fifo_rd_cmd(struct qcom_swrm_ctrl *swrm,
+
+ } while (retry_attempt < MAX_FIFO_RD_RETRY);
+
+- dev_err(swrm->dev, "failed to read fifo: reg: 0x%x, rcmd_id: 0x%x,\
++ dev_err(ctrl->dev, "failed to read fifo: reg: 0x%x, rcmd_id: 0x%x,\
+ dev_num: 0x%x, cmd_data: 0x%x\n",
+- reg_addr, swrm->rcmd_id, dev_addr, cmd_data);
++ reg_addr, ctrl->rcmd_id, dev_addr, cmd_data);
+
+ return SDW_CMD_IGNORED;
+ }
+@@ -532,39 +532,39 @@ static int qcom_swrm_enumerate(struct sdw_bus *bus)
+
+ static irqreturn_t qcom_swrm_wake_irq_handler(int irq, void *dev_id)
+ {
+- struct qcom_swrm_ctrl *swrm = dev_id;
++ struct qcom_swrm_ctrl *ctrl = dev_id;
+ int ret;
+
+- ret = pm_runtime_resume_and_get(swrm->dev);
++ ret = pm_runtime_resume_and_get(ctrl->dev);
+ if (ret < 0 && ret != -EACCES) {
+- dev_err_ratelimited(swrm->dev,
++ dev_err_ratelimited(ctrl->dev,
+ "pm_runtime_resume_and_get failed in %s, ret %d\n",
+ __func__, ret);
+ return ret;
+ }
+
+- if (swrm->wake_irq > 0) {
+- if (!irqd_irq_disabled(irq_get_irq_data(swrm->wake_irq)))
+- disable_irq_nosync(swrm->wake_irq);
++ if (ctrl->wake_irq > 0) {
++ if (!irqd_irq_disabled(irq_get_irq_data(ctrl->wake_irq)))
++ disable_irq_nosync(ctrl->wake_irq);
+ }
+
+- pm_runtime_mark_last_busy(swrm->dev);
+- pm_runtime_put_autosuspend(swrm->dev);
++ pm_runtime_mark_last_busy(ctrl->dev);
++ pm_runtime_put_autosuspend(ctrl->dev);
+
+ return IRQ_HANDLED;
+ }
+
+ static irqreturn_t qcom_swrm_irq_handler(int irq, void *dev_id)
+ {
+- struct qcom_swrm_ctrl *swrm = dev_id;
++ struct qcom_swrm_ctrl *ctrl = dev_id;
+ u32 value, intr_sts, intr_sts_masked, slave_status;
+ u32 i;
+ int devnum;
+ int ret = IRQ_HANDLED;
+- clk_prepare_enable(swrm->hclk);
++ clk_prepare_enable(ctrl->hclk);
+
+- swrm->reg_read(swrm, SWRM_INTERRUPT_STATUS, &intr_sts);
+- intr_sts_masked = intr_sts & swrm->intr_mask;
++ ctrl->reg_read(ctrl, SWRM_INTERRUPT_STATUS, &intr_sts);
++ intr_sts_masked = intr_sts & ctrl->intr_mask;
+
+ do {
+ for (i = 0; i < SWRM_INTERRUPT_MAX; i++) {
+@@ -574,80 +574,80 @@ static irqreturn_t qcom_swrm_irq_handler(int irq, void *dev_id)
+
+ switch (value) {
+ case SWRM_INTERRUPT_STATUS_SLAVE_PEND_IRQ:
+- devnum = qcom_swrm_get_alert_slave_dev_num(swrm);
++ devnum = qcom_swrm_get_alert_slave_dev_num(ctrl);
+ if (devnum < 0) {
+- dev_err_ratelimited(swrm->dev,
++ dev_err_ratelimited(ctrl->dev,
+ "no slave alert found.spurious interrupt\n");
+ } else {
+- sdw_handle_slave_status(&swrm->bus, swrm->status);
++ sdw_handle_slave_status(&ctrl->bus, ctrl->status);
+ }
+
+ break;
+ case SWRM_INTERRUPT_STATUS_NEW_SLAVE_ATTACHED:
+ case SWRM_INTERRUPT_STATUS_CHANGE_ENUM_SLAVE_STATUS:
+- dev_dbg_ratelimited(swrm->dev, "SWR new slave attached\n");
+- swrm->reg_read(swrm, SWRM_MCP_SLV_STATUS, &slave_status);
+- if (swrm->slave_status == slave_status) {
+- dev_dbg(swrm->dev, "Slave status not changed %x\n",
++ dev_dbg_ratelimited(ctrl->dev, "SWR new slave attached\n");
++ ctrl->reg_read(ctrl, SWRM_MCP_SLV_STATUS, &slave_status);
++ if (ctrl->slave_status == slave_status) {
++ dev_dbg(ctrl->dev, "Slave status not changed %x\n",
+ slave_status);
+ } else {
+- qcom_swrm_get_device_status(swrm);
+- qcom_swrm_enumerate(&swrm->bus);
+- sdw_handle_slave_status(&swrm->bus, swrm->status);
++ qcom_swrm_get_device_status(ctrl);
++ qcom_swrm_enumerate(&ctrl->bus);
++ sdw_handle_slave_status(&ctrl->bus, ctrl->status);
+ }
+ break;
+ case SWRM_INTERRUPT_STATUS_MASTER_CLASH_DET:
+- dev_err_ratelimited(swrm->dev,
++ dev_err_ratelimited(ctrl->dev,
+ "%s: SWR bus clsh detected\n",
+ __func__);
+- swrm->intr_mask &= ~SWRM_INTERRUPT_STATUS_MASTER_CLASH_DET;
+- swrm->reg_write(swrm, SWRM_INTERRUPT_CPU_EN, swrm->intr_mask);
++ ctrl->intr_mask &= ~SWRM_INTERRUPT_STATUS_MASTER_CLASH_DET;
++ ctrl->reg_write(ctrl, SWRM_INTERRUPT_CPU_EN, ctrl->intr_mask);
+ break;
+ case SWRM_INTERRUPT_STATUS_RD_FIFO_OVERFLOW:
+- swrm->reg_read(swrm, SWRM_CMD_FIFO_STATUS, &value);
+- dev_err_ratelimited(swrm->dev,
++ ctrl->reg_read(ctrl, SWRM_CMD_FIFO_STATUS, &value);
++ dev_err_ratelimited(ctrl->dev,
+ "%s: SWR read FIFO overflow fifo status 0x%x\n",
+ __func__, value);
+ break;
+ case SWRM_INTERRUPT_STATUS_RD_FIFO_UNDERFLOW:
+- swrm->reg_read(swrm, SWRM_CMD_FIFO_STATUS, &value);
+- dev_err_ratelimited(swrm->dev,
++ ctrl->reg_read(ctrl, SWRM_CMD_FIFO_STATUS, &value);
++ dev_err_ratelimited(ctrl->dev,
+ "%s: SWR read FIFO underflow fifo status 0x%x\n",
+ __func__, value);
+ break;
+ case SWRM_INTERRUPT_STATUS_WR_CMD_FIFO_OVERFLOW:
+- swrm->reg_read(swrm, SWRM_CMD_FIFO_STATUS, &value);
+- dev_err(swrm->dev,
++ ctrl->reg_read(ctrl, SWRM_CMD_FIFO_STATUS, &value);
++ dev_err(ctrl->dev,
+ "%s: SWR write FIFO overflow fifo status %x\n",
+ __func__, value);
+- swrm->reg_write(swrm, SWRM_CMD_FIFO_CMD, 0x1);
++ ctrl->reg_write(ctrl, SWRM_CMD_FIFO_CMD, 0x1);
+ break;
+ case SWRM_INTERRUPT_STATUS_CMD_ERROR:
+- swrm->reg_read(swrm, SWRM_CMD_FIFO_STATUS, &value);
+- dev_err_ratelimited(swrm->dev,
++ ctrl->reg_read(ctrl, SWRM_CMD_FIFO_STATUS, &value);
++ dev_err_ratelimited(ctrl->dev,
+ "%s: SWR CMD error, fifo status 0x%x, flushing fifo\n",
+ __func__, value);
+- swrm->reg_write(swrm, SWRM_CMD_FIFO_CMD, 0x1);
++ ctrl->reg_write(ctrl, SWRM_CMD_FIFO_CMD, 0x1);
+ break;
+ case SWRM_INTERRUPT_STATUS_DOUT_PORT_COLLISION:
+- dev_err_ratelimited(swrm->dev,
++ dev_err_ratelimited(ctrl->dev,
+ "%s: SWR Port collision detected\n",
+ __func__);
+- swrm->intr_mask &= ~SWRM_INTERRUPT_STATUS_DOUT_PORT_COLLISION;
+- swrm->reg_write(swrm,
+- SWRM_INTERRUPT_CPU_EN, swrm->intr_mask);
++ ctrl->intr_mask &= ~SWRM_INTERRUPT_STATUS_DOUT_PORT_COLLISION;
++ ctrl->reg_write(ctrl,
++ SWRM_INTERRUPT_CPU_EN, ctrl->intr_mask);
+ break;
+ case SWRM_INTERRUPT_STATUS_READ_EN_RD_VALID_MISMATCH:
+- dev_err_ratelimited(swrm->dev,
++ dev_err_ratelimited(ctrl->dev,
+ "%s: SWR read enable valid mismatch\n",
+ __func__);
+- swrm->intr_mask &=
++ ctrl->intr_mask &=
+ ~SWRM_INTERRUPT_STATUS_READ_EN_RD_VALID_MISMATCH;
+- swrm->reg_write(swrm,
+- SWRM_INTERRUPT_CPU_EN, swrm->intr_mask);
++ ctrl->reg_write(ctrl,
++ SWRM_INTERRUPT_CPU_EN, ctrl->intr_mask);
+ break;
+ case SWRM_INTERRUPT_STATUS_SPECIAL_CMD_ID_FINISHED:
+- complete(&swrm->broadcast);
++ complete(&ctrl->broadcast);
+ break;
+ case SWRM_INTERRUPT_STATUS_BUS_RESET_FINISHED_V2:
+ break;
+@@ -656,19 +656,19 @@ static irqreturn_t qcom_swrm_irq_handler(int irq, void *dev_id)
+ case SWRM_INTERRUPT_STATUS_EXT_CLK_STOP_WAKEUP:
+ break;
+ default:
+- dev_err_ratelimited(swrm->dev,
++ dev_err_ratelimited(ctrl->dev,
+ "%s: SWR unknown interrupt value: %d\n",
+ __func__, value);
+ ret = IRQ_NONE;
+ break;
+ }
+ }
+- swrm->reg_write(swrm, SWRM_INTERRUPT_CLEAR, intr_sts);
+- swrm->reg_read(swrm, SWRM_INTERRUPT_STATUS, &intr_sts);
+- intr_sts_masked = intr_sts & swrm->intr_mask;
++ ctrl->reg_write(ctrl, SWRM_INTERRUPT_CLEAR, intr_sts);
++ ctrl->reg_read(ctrl, SWRM_INTERRUPT_STATUS, &intr_sts);
++ intr_sts_masked = intr_sts & ctrl->intr_mask;
+ } while (intr_sts_masked);
+
+- clk_disable_unprepare(swrm->hclk);
++ clk_disable_unprepare(ctrl->hclk);
+ return ret;
+ }
+
+@@ -1292,23 +1292,23 @@ static int qcom_swrm_get_port_config(struct qcom_swrm_ctrl *ctrl)
+ #ifdef CONFIG_DEBUG_FS
+ static int swrm_reg_show(struct seq_file *s_file, void *data)
+ {
+- struct qcom_swrm_ctrl *swrm = s_file->private;
++ struct qcom_swrm_ctrl *ctrl = s_file->private;
+ int reg, reg_val, ret;
+
+- ret = pm_runtime_resume_and_get(swrm->dev);
++ ret = pm_runtime_resume_and_get(ctrl->dev);
+ if (ret < 0 && ret != -EACCES) {
+- dev_err_ratelimited(swrm->dev,
++ dev_err_ratelimited(ctrl->dev,
+ "pm_runtime_resume_and_get failed in %s, ret %d\n",
+ __func__, ret);
+ return ret;
+ }
+
+ for (reg = 0; reg <= SWR_MSTR_MAX_REG_ADDR; reg += 4) {
+- swrm->reg_read(swrm, reg, ®_val);
++ ctrl->reg_read(ctrl, reg, ®_val);
+ seq_printf(s_file, "0x%.3x: 0x%.2x\n", reg, reg_val);
+ }
+- pm_runtime_mark_last_busy(swrm->dev);
+- pm_runtime_put_autosuspend(swrm->dev);
++ pm_runtime_mark_last_busy(ctrl->dev);
++ pm_runtime_put_autosuspend(ctrl->dev);
+
+
+ return 0;
+@@ -1489,13 +1489,13 @@ static int qcom_swrm_remove(struct platform_device *pdev)
+ return 0;
+ }
+
+-static bool swrm_wait_for_frame_gen_enabled(struct qcom_swrm_ctrl *swrm)
++static bool swrm_wait_for_frame_gen_enabled(struct qcom_swrm_ctrl *ctrl)
+ {
+ int retry = SWRM_LINK_STATUS_RETRY_CNT;
+ int comp_sts;
+
+ do {
+- swrm->reg_read(swrm, SWRM_COMP_STATUS, &comp_sts);
++ ctrl->reg_read(ctrl, SWRM_COMP_STATUS, &comp_sts);
+
+ if (comp_sts & SWRM_FRM_GEN_ENABLED)
+ return true;
+@@ -1503,7 +1503,7 @@ static bool swrm_wait_for_frame_gen_enabled(struct qcom_swrm_ctrl *swrm)
+ usleep_range(500, 510);
+ } while (retry--);
+
+- dev_err(swrm->dev, "%s: link status not %s\n", __func__,
++ dev_err(ctrl->dev, "%s: link status not %s\n", __func__,
+ comp_sts & SWRM_FRM_GEN_ENABLED ? "connected" : "disconnected");
+
+ return false;
+--
+2.39.2
+
--- /dev/null
+From 6f4878e068180ee7e47d1146f3ba999571f50668 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Jun 2023 15:43:05 +0200
+Subject: spi: bcm-qspi: return error if neither hif_mspi nor mspi is available
+
+From: Jonas Gorski <jonas.gorski@gmail.com>
+
+[ Upstream commit 7c1f23ad34fcdace50275a6aa1e1969b41c6233f ]
+
+If neither a "hif_mspi" nor "mspi" resource is present, the driver will
+just early exit in probe but still return success. Apart from not doing
+anything meaningful, this would then also lead to a null pointer access
+on removal, as platform_get_drvdata() would return NULL, which it would
+then try to dereference when trying to unregister the spi master.
+
+Fix this by unconditionally calling devm_ioremap_resource(), as it can
+handle a NULL res and will then return a viable ERR_PTR() if we get one.
+
+The "return 0;" was previously a "goto qspi_resource_err;" where then
+ret was returned, but since ret was still initialized to 0 at this place
+this was a valid conversion in 63c5395bb7a9 ("spi: bcm-qspi: Fix
+use-after-free on unbind"). The issue was not introduced by this commit,
+only made more obvious.
+
+Fixes: fa236a7ef240 ("spi: bcm-qspi: Add Broadcom MSPI driver")
+Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
+Reviewed-by: Kamal Dasu <kamal.dasu@broadcom.com>
+Link: https://lore.kernel.org/r/20230629134306.95823-1-jonas.gorski@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-bcm-qspi.c | 10 +++-------
+ 1 file changed, 3 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/spi/spi-bcm-qspi.c b/drivers/spi/spi-bcm-qspi.c
+index 6b46a3b67c416..d91dfbe47aa50 100644
+--- a/drivers/spi/spi-bcm-qspi.c
++++ b/drivers/spi/spi-bcm-qspi.c
+@@ -1543,13 +1543,9 @@ int bcm_qspi_probe(struct platform_device *pdev,
+ res = platform_get_resource_byname(pdev, IORESOURCE_MEM,
+ "mspi");
+
+- if (res) {
+- qspi->base[MSPI] = devm_ioremap_resource(dev, res);
+- if (IS_ERR(qspi->base[MSPI]))
+- return PTR_ERR(qspi->base[MSPI]);
+- } else {
+- return 0;
+- }
++ qspi->base[MSPI] = devm_ioremap_resource(dev, res);
++ if (IS_ERR(qspi->base[MSPI]))
++ return PTR_ERR(qspi->base[MSPI]);
+
+ res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "bspi");
+ if (res) {
+--
+2.39.2
+
--- /dev/null
+From ed1d080b26ffc33136bded12bf8443c94eb1c590 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Jun 2023 12:58:47 +0300
+Subject: spi: spi-geni-qcom: enable SPI_CONTROLLER_MUST_TX for GPI DMA mode
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit d10005837be83906bbd2078c3b4f9dfcbd6c95b6 ]
+
+The GPI DMA mode requires for TX DMA to be prepared. Force SPI core to
+provide TX buffer even if the caller didn't provide one by setting the
+SPI_CONTROLLER_MUST_TX flag.
+
+Fixes: b59c122484ec ("spi: spi-geni-qcom: Add support for GPI dma")
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/20230629095847.3648597-1-dmitry.baryshkov@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-geni-qcom.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/spi/spi-geni-qcom.c b/drivers/spi/spi-geni-qcom.c
+index 26ce959d98dfa..1df9d4844a68d 100644
+--- a/drivers/spi/spi-geni-qcom.c
++++ b/drivers/spi/spi-geni-qcom.c
+@@ -1097,6 +1097,12 @@ static int spi_geni_probe(struct platform_device *pdev)
+ if (mas->cur_xfer_mode == GENI_SE_FIFO)
+ spi->set_cs = spi_geni_set_cs;
+
++ /*
++ * TX is required per GSI spec, see setup_gsi_xfer().
++ */
++ if (mas->cur_xfer_mode == GENI_GPI_DMA)
++ spi->flags = SPI_CONTROLLER_MUST_TX;
++
+ ret = request_irq(mas->irq, geni_spi_isr, 0, dev_name(dev), spi);
+ if (ret)
+ goto spi_geni_release_dma;
+--
+2.39.2
+
--- /dev/null
+From 999ecd0fba0c0e527294c9434416c9c87ac06f3b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 May 2023 22:25:55 +0200
+Subject: staging: vchiq_arm: mark vchiq_platform_init() static
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit e152c58d7a48194d6b530d8e004d650fd01568b6 ]
+
+This function has no callers from other files, and the declaration
+was removed a while ago, causing a W=1 warning:
+
+drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:465:5: error: no previous prototype for 'vchiq_platform_init'
+
+Marking it static solves this problem but introduces a new warning
+since gcc determines that 'g_fragments_base' is never initialized
+in some kernel configurations:
+
+In file included from include/linux/string.h:254,
+ from include/linux/bitmap.h:11,
+ from include/linux/cpumask.h:12,
+ from include/linux/mm_types_task.h:14,
+ from include/linux/mm_types.h:5,
+ from include/linux/buildid.h:5,
+ from include/linux/module.h:14,
+ from drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:8:
+In function 'memcpy_to_page',
+ inlined from 'free_pagelist' at drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:433:4:
+include/linux/fortify-string.h:57:33: error: argument 2 null where non-null expected [-Werror=nonnull]
+include/linux/highmem.h:427:9: note: in expansion of macro 'memcpy'
+ 427 | memcpy(to + offset, from, len);
+ | ^~~~~~
+
+Add a NULL pointer check for this in addition to the static annotation
+to avoid both.
+
+Fixes: 89cc4218f640 ("staging: vchiq_arm: drop unnecessary declarations")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
+Reviewed-by: Umang Jain <umang.jain@ideasonboard.com>
+Link: https://lore.kernel.org/r/20230516202603.560554-1-arnd@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
+index 90a3958d1f297..aa2313f3bcab8 100644
+--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
++++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
+@@ -415,7 +415,7 @@ free_pagelist(struct vchiq_instance *instance, struct vchiq_pagelist_info *pagel
+ pagelistinfo->scatterlist_mapped = 0;
+
+ /* Deal with any partial cache lines (fragments) */
+- if (pagelist->type >= PAGELIST_READ_WITH_FRAGMENTS) {
++ if (pagelist->type >= PAGELIST_READ_WITH_FRAGMENTS && g_fragments_base) {
+ char *fragments = g_fragments_base +
+ (pagelist->type - PAGELIST_READ_WITH_FRAGMENTS) *
+ g_fragments_size;
+@@ -462,7 +462,7 @@ free_pagelist(struct vchiq_instance *instance, struct vchiq_pagelist_info *pagel
+ cleanup_pagelistinfo(instance, pagelistinfo);
+ }
+
+-int vchiq_platform_init(struct platform_device *pdev, struct vchiq_state *state)
++static int vchiq_platform_init(struct platform_device *pdev, struct vchiq_state *state)
+ {
+ struct device *dev = &pdev->dev;
+ struct vchiq_drvdata *drvdata = platform_get_drvdata(pdev);
+--
+2.39.2
+
--- /dev/null
+From 876a4f0035d10e9ca90b89461192ed9a2a6c7588 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Jun 2023 16:41:50 +0000
+Subject: tcp: annotate data races in __tcp_oow_rate_limited()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 998127cdb4699b9d470a9348ffe9f1154346be5f ]
+
+request sockets are lockless, __tcp_oow_rate_limited() could be called
+on the same object from different cpus. This is harmless.
+
+Add READ_ONCE()/WRITE_ONCE() annotations to avoid a KCSAN report.
+
+Fixes: 4ce7e93cb3fe ("tcp: rate limit ACK sent by SYN_RECV request sockets")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/tcp_input.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index bf8b22218dd46..57f1e4883b761 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -3590,8 +3590,11 @@ static int tcp_ack_update_window(struct sock *sk, const struct sk_buff *skb, u32
+ static bool __tcp_oow_rate_limited(struct net *net, int mib_idx,
+ u32 *last_oow_ack_time)
+ {
+- if (*last_oow_ack_time) {
+- s32 elapsed = (s32)(tcp_jiffies32 - *last_oow_ack_time);
++ /* Paired with the WRITE_ONCE() in this function. */
++ u32 val = READ_ONCE(*last_oow_ack_time);
++
++ if (val) {
++ s32 elapsed = (s32)(tcp_jiffies32 - val);
+
+ if (0 <= elapsed &&
+ elapsed < READ_ONCE(net->ipv4.sysctl_tcp_invalid_ratelimit)) {
+@@ -3600,7 +3603,10 @@ static bool __tcp_oow_rate_limited(struct net *net, int mib_idx,
+ }
+ }
+
+- *last_oow_ack_time = tcp_jiffies32;
++ /* Paired with the prior READ_ONCE() and with itself,
++ * as we might be lockless.
++ */
++ WRITE_ONCE(*last_oow_ack_time, tcp_jiffies32);
+
+ return false; /* not rate-limited: go ahead, send dupack now! */
+ }
+--
+2.39.2
+
--- /dev/null
+From 5b43e8bb70637956654b94c6d841559cbc7c26c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Jun 2023 09:08:10 +0200
+Subject: test_firmware: return ENOMEM instead of ENOSPC on failed memory
+ allocation
+
+From: Mirsad Goran Todorovac <mirsad.todorovac@alu.unizg.hr>
+
+[ Upstream commit 7dae593cd226a0bca61201cf85ceb9335cf63682 ]
+
+In a couple of situations like
+
+ name = kstrndup(buf, count, GFP_KERNEL);
+ if (!name)
+ return -ENOSPC;
+
+the error is not actually "No space left on device", but "Out of memory".
+
+It is semantically correct to return -ENOMEM in all failed kstrndup()
+and kzalloc() cases in this driver, as it is not a problem with disk
+space, but with kernel memory allocator failing allocation.
+
+The semantically correct should be:
+
+ name = kstrndup(buf, count, GFP_KERNEL);
+ if (!name)
+ return -ENOMEM;
+
+Cc: Dan Carpenter <error27@gmail.com>
+Cc: Takashi Iwai <tiwai@suse.de>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: "Luis R. Rodriguez" <mcgrof@ruslug.rutgers.edu>
+Cc: Scott Branden <sbranden@broadcom.com>
+Cc: Hans de Goede <hdegoede@redhat.com>
+Cc: Brian Norris <briannorris@chromium.org>
+Fixes: c92316bf8e948 ("test_firmware: add batched firmware tests")
+Fixes: 0a8adf584759c ("test: add firmware_class loader test")
+Fixes: 548193cba2a7d ("test_firmware: add support for firmware_request_platform")
+Fixes: eb910947c82f9 ("test: firmware_class: add asynchronous request trigger")
+Fixes: 061132d2b9c95 ("test_firmware: add test custom fallback trigger")
+Fixes: 7feebfa487b92 ("test_firmware: add support for request_firmware_into_buf")
+Signed-off-by: Mirsad Goran Todorovac <mirsad.todorovac@alu.unizg.hr>
+Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org>
+Message-ID: <20230606070808.9300-1-mirsad.todorovac@alu.unizg.hr>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/test_firmware.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/lib/test_firmware.c b/lib/test_firmware.c
+index 1d7d480b8eeb3..add4699fc6cd4 100644
+--- a/lib/test_firmware.c
++++ b/lib/test_firmware.c
+@@ -214,7 +214,7 @@ static int __kstrncpy(char **dst, const char *name, size_t count, gfp_t gfp)
+ {
+ *dst = kstrndup(name, count, gfp);
+ if (!*dst)
+- return -ENOSPC;
++ return -ENOMEM;
+ return count;
+ }
+
+@@ -671,7 +671,7 @@ static ssize_t trigger_request_store(struct device *dev,
+
+ name = kstrndup(buf, count, GFP_KERNEL);
+ if (!name)
+- return -ENOSPC;
++ return -ENOMEM;
+
+ pr_info("loading '%s'\n", name);
+
+@@ -719,7 +719,7 @@ static ssize_t trigger_request_platform_store(struct device *dev,
+
+ name = kstrndup(buf, count, GFP_KERNEL);
+ if (!name)
+- return -ENOSPC;
++ return -ENOMEM;
+
+ pr_info("inserting test platform fw '%s'\n", name);
+ efi_embedded_fw.name = name;
+@@ -772,7 +772,7 @@ static ssize_t trigger_async_request_store(struct device *dev,
+
+ name = kstrndup(buf, count, GFP_KERNEL);
+ if (!name)
+- return -ENOSPC;
++ return -ENOMEM;
+
+ pr_info("loading '%s'\n", name);
+
+@@ -817,7 +817,7 @@ static ssize_t trigger_custom_fallback_store(struct device *dev,
+
+ name = kstrndup(buf, count, GFP_KERNEL);
+ if (!name)
+- return -ENOSPC;
++ return -ENOMEM;
+
+ pr_info("loading '%s' using custom fallback mechanism\n", name);
+
+@@ -868,7 +868,7 @@ static int test_fw_run_batch_request(void *data)
+
+ test_buf = kzalloc(TEST_FIRMWARE_BUF_SIZE, GFP_KERNEL);
+ if (!test_buf)
+- return -ENOSPC;
++ return -ENOMEM;
+
+ if (test_fw_config->partial)
+ req->rc = request_partial_firmware_into_buf
+--
+2.39.2
+
--- /dev/null
+From 9c8a81cd2105a8ba3bdabc9ce1b162e1ce194b13 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Mar 2023 12:00:24 +0800
+Subject: tools/virtio: fix build break for aarch64
+
+From: Peng Fan <peng.fan@nxp.com>
+
+[ Upstream commit 77b894f220cbd04301b3d941df8247106e67f8e4 ]
+
+"-mfunction-return=thunk -mindirect-branch-register" are only valid
+for x86. So introduce compiler operation check to avoid such issues
+
+Fixes: 0d0ed4006127 ("tools/virtio: enable to build with retpoline")
+Signed-off-by: Peng Fan <peng.fan@nxp.com>
+Message-Id: <20230323040024.3809108-1-peng.fan@oss.nxp.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/virtio/Makefile | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/tools/virtio/Makefile b/tools/virtio/Makefile
+index 7b7139d97d742..d128925980e05 100644
+--- a/tools/virtio/Makefile
++++ b/tools/virtio/Makefile
+@@ -4,7 +4,18 @@ test: virtio_test vringh_test
+ virtio_test: virtio_ring.o virtio_test.o
+ vringh_test: vringh_test.o vringh.o virtio_ring.o
+
+-CFLAGS += -g -O2 -Werror -Wno-maybe-uninitialized -Wall -I. -I../include/ -I ../../usr/include/ -Wno-pointer-sign -fno-strict-overflow -fno-strict-aliasing -fno-common -MMD -U_FORTIFY_SOURCE -include ../../include/linux/kconfig.h -mfunction-return=thunk -fcf-protection=none -mindirect-branch-register
++try-run = $(shell set -e; \
++ if ($(1)) >/dev/null 2>&1; \
++ then echo "$(2)"; \
++ else echo "$(3)"; \
++ fi)
++
++__cc-option = $(call try-run,\
++ $(1) -Werror $(2) -c -x c /dev/null -o /dev/null,$(2),)
++cc-option = $(call __cc-option, $(CC),$(1))
++
++CFLAGS += -g -O2 -Werror -Wno-maybe-uninitialized -Wall -I. -I../include/ -I ../../usr/include/ -Wno-pointer-sign -fno-strict-overflow -fno-strict-aliasing -fno-common -MMD -U_FORTIFY_SOURCE -include ../../include/linux/kconfig.h $(call cc-option,-mfunction-return=thunk) $(call cc-option,-fcf-protection=none) $(call cc-option,-mindirect-branch-register)
++
+ CFLAGS += -pthread
+ LDFLAGS += -pthread
+ vpath %.c ../../drivers/virtio ../../drivers/vhost
+--
+2.39.2
+
--- /dev/null
+From bcb0b16f0636a6b20c5cd836e804b326ec0a2ed6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 May 2023 20:11:14 +0530
+Subject: usb: common: usb-conn-gpio: Set last role to unknown before initial
+ detection
+
+From: Prashanth K <quic_prashk@quicinc.com>
+
+[ Upstream commit edd60d24bd858cef165274e4cd6cab43bdc58d15 ]
+
+Currently if we bootup a device without cable connected, then
+usb-conn-gpio won't call set_role() since last_role is same as
+current role. This happens because during probe last_role gets
+initialised to zero.
+
+To avoid this, added a new constant in enum usb_role, last_role
+is set to USB_ROLE_UNKNOWN before performing initial detection.
+
+While at it, also handle default case for the usb_role switch
+in cdns3, intel-xhci-usb-role-switch & musb/jz4740 to avoid
+build warnings.
+
+Fixes: 4602f3bff266 ("usb: common: add USB GPIO based connection detection driver")
+Signed-off-by: Prashanth K <quic_prashk@quicinc.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Message-ID: <1685544074-17337-1-git-send-email-quic_prashk@quicinc.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/cdns3/core.c | 2 ++
+ drivers/usb/common/usb-conn-gpio.c | 3 +++
+ drivers/usb/musb/jz4740.c | 2 ++
+ drivers/usb/roles/intel-xhci-usb-role-switch.c | 2 ++
+ include/linux/usb/role.h | 1 +
+ 5 files changed, 10 insertions(+)
+
+diff --git a/drivers/usb/cdns3/core.c b/drivers/usb/cdns3/core.c
+index dbcdf3b24b477..69d2921f2d3b5 100644
+--- a/drivers/usb/cdns3/core.c
++++ b/drivers/usb/cdns3/core.c
+@@ -252,6 +252,8 @@ static enum usb_role cdns_hw_role_state_machine(struct cdns *cdns)
+ if (!vbus)
+ role = USB_ROLE_NONE;
+ break;
++ default:
++ break;
+ }
+
+ dev_dbg(cdns->dev, "role %d -> %d\n", cdns->role, role);
+diff --git a/drivers/usb/common/usb-conn-gpio.c b/drivers/usb/common/usb-conn-gpio.c
+index e20874caba363..30bdb81934bc8 100644
+--- a/drivers/usb/common/usb-conn-gpio.c
++++ b/drivers/usb/common/usb-conn-gpio.c
+@@ -257,6 +257,9 @@ static int usb_conn_probe(struct platform_device *pdev)
+ platform_set_drvdata(pdev, info);
+ device_set_wakeup_capable(&pdev->dev, true);
+
++ /* Set last role to unknown before performing the initial detection */
++ info->last_role = USB_ROLE_UNKNOWN;
++
+ /* Perform initial detection */
+ usb_conn_queue_dwork(info, 0);
+
+diff --git a/drivers/usb/musb/jz4740.c b/drivers/usb/musb/jz4740.c
+index 5aabdd7e2511d..6d880c4cce36e 100644
+--- a/drivers/usb/musb/jz4740.c
++++ b/drivers/usb/musb/jz4740.c
+@@ -95,6 +95,8 @@ static int jz4740_musb_role_switch_set(struct usb_role_switch *sw,
+ case USB_ROLE_HOST:
+ atomic_notifier_call_chain(&phy->notifier, USB_EVENT_ID, phy);
+ break;
++ default:
++ break;
+ }
+
+ return 0;
+diff --git a/drivers/usb/roles/intel-xhci-usb-role-switch.c b/drivers/usb/roles/intel-xhci-usb-role-switch.c
+index 5c96e929acea0..4d6a3dd06e011 100644
+--- a/drivers/usb/roles/intel-xhci-usb-role-switch.c
++++ b/drivers/usb/roles/intel-xhci-usb-role-switch.c
+@@ -97,6 +97,8 @@ static int intel_xhci_usb_set_role(struct usb_role_switch *sw,
+ val |= SW_VBUS_VALID;
+ drd_config = DRD_CONFIG_STATIC_DEVICE;
+ break;
++ default:
++ break;
+ }
+ val |= SW_IDPIN_EN;
+ if (data->enable_sw_switch) {
+diff --git a/include/linux/usb/role.h b/include/linux/usb/role.h
+index b5deafd91f67b..65e790a28913e 100644
+--- a/include/linux/usb/role.h
++++ b/include/linux/usb/role.h
+@@ -11,6 +11,7 @@ enum usb_role {
+ USB_ROLE_NONE,
+ USB_ROLE_HOST,
+ USB_ROLE_DEVICE,
++ USB_ROLE_UNKNOWN,
+ };
+
+ typedef int (*usb_role_switch_set_t)(struct usb_role_switch *sw,
+--
+2.39.2
+
--- /dev/null
+From 93a73e221bca0f8d682378a48cb78512a5406d10 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 May 2023 19:15:08 +0200
+Subject: usb: dwc2: Fix some error handling paths
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit ada050c69108bc34be13ecc11f7fad0f20ebadc4 ]
+
+dwc2_driver_probe() calls dwc2_lowlevel_hw_init() which deassert some reset
+lines.
+Should an error happen in dwc2_lowlevel_hw_init() after calling
+reset_control_deassert() or in the probe after calling
+dwc2_lowlevel_hw_init(), the reset lines remain deasserted.
+
+Add some devm_add_action_or_reset() calls to re-assert the lines if needed.
+
+Update the remove function accordingly.
+
+This change is compile-tested only.
+
+Fixes: 83f8da562f8b ("usb: dwc2: Add reset control to dwc2")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Link: https://lore.kernel.org/r/c64537b5339342bd00f7c2152b8fc23792b9f95a.1683306479.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc2/platform.c | 16 +++++++++++++---
+ 1 file changed, 13 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/usb/dwc2/platform.c b/drivers/usb/dwc2/platform.c
+index 5aee284018c00..5cf025511cce6 100644
+--- a/drivers/usb/dwc2/platform.c
++++ b/drivers/usb/dwc2/platform.c
+@@ -203,6 +203,11 @@ int dwc2_lowlevel_hw_disable(struct dwc2_hsotg *hsotg)
+ return ret;
+ }
+
++static void dwc2_reset_control_assert(void *data)
++{
++ reset_control_assert(data);
++}
++
+ static int dwc2_lowlevel_hw_init(struct dwc2_hsotg *hsotg)
+ {
+ int i, ret;
+@@ -213,6 +218,10 @@ static int dwc2_lowlevel_hw_init(struct dwc2_hsotg *hsotg)
+ "error getting reset control\n");
+
+ reset_control_deassert(hsotg->reset);
++ ret = devm_add_action_or_reset(hsotg->dev, dwc2_reset_control_assert,
++ hsotg->reset);
++ if (ret)
++ return ret;
+
+ hsotg->reset_ecc = devm_reset_control_get_optional(hsotg->dev, "dwc2-ecc");
+ if (IS_ERR(hsotg->reset_ecc))
+@@ -220,6 +229,10 @@ static int dwc2_lowlevel_hw_init(struct dwc2_hsotg *hsotg)
+ "error getting reset control for ecc\n");
+
+ reset_control_deassert(hsotg->reset_ecc);
++ ret = devm_add_action_or_reset(hsotg->dev, dwc2_reset_control_assert,
++ hsotg->reset_ecc);
++ if (ret)
++ return ret;
+
+ /*
+ * Attempt to find a generic PHY, then look for an old style
+@@ -339,9 +352,6 @@ static int dwc2_driver_remove(struct platform_device *dev)
+ if (hsotg->ll_hw_enabled)
+ dwc2_lowlevel_hw_disable(hsotg);
+
+- reset_control_assert(hsotg->reset);
+- reset_control_assert(hsotg->reset_ecc);
+-
+ return 0;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 76e64e6f2a5fa54ac7fb9481c56ca6ddb7fd1ed4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Jun 2023 15:32:52 +0200
+Subject: usb: dwc3-meson-g12a: Fix an error handling path in
+ dwc3_meson_g12a_probe()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 01052b91c9808e3c3b068ae2721cb728ec9aa4c0 ]
+
+If dwc3_meson_g12a_otg_init() fails, resources allocated by the previous
+of_platform_populate() call should be released, as already done in the
+error handling path.
+
+Fixes: 1e355f21d3fb ("usb: dwc3: Add Amlogic A1 DWC3 glue")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Message-ID: <9d28466de1808ccc756b4cc25fc72c482d133d13.1686403934.git.christophe.jaillet@wanadoo.fr>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc3/dwc3-meson-g12a.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/dwc3/dwc3-meson-g12a.c b/drivers/usb/dwc3/dwc3-meson-g12a.c
+index b282ad0e69c6d..eaea944ebd2ce 100644
+--- a/drivers/usb/dwc3/dwc3-meson-g12a.c
++++ b/drivers/usb/dwc3/dwc3-meson-g12a.c
+@@ -805,7 +805,7 @@ static int dwc3_meson_g12a_probe(struct platform_device *pdev)
+
+ ret = dwc3_meson_g12a_otg_init(pdev, priv);
+ if (ret)
+- goto err_phys_power;
++ goto err_plat_depopulate;
+
+ pm_runtime_set_active(dev);
+ pm_runtime_enable(dev);
+@@ -813,6 +813,9 @@ static int dwc3_meson_g12a_probe(struct platform_device *pdev)
+
+ return 0;
+
++err_plat_depopulate:
++ of_platform_depopulate(dev);
++
+ err_phys_power:
+ for (i = 0 ; i < PHY_COUNT ; ++i)
+ phy_power_off(priv->phys[i]);
+--
+2.39.2
+
--- /dev/null
+From bcb76a1048a16c1ada04c3cc9fe901a7d3af9a74 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 4 Jun 2023 16:56:34 +0200
+Subject: usb: dwc3: qcom: Fix an error handling path in dwc3_qcom_probe()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 4a944da707123686d372ec01ea60056902fadf35 ]
+
+If dwc3_qcom_create_urs_usb_platdev() fails, some resources still need to
+be released, as already done in the other error handling path of the
+probe.
+
+Fixes: c25c210f590e ("usb: dwc3: qcom: add URS Host support for sdm845 ACPI boot")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Reviewed-by: Andrew Halaney <ahalaney@redhat.com>
+Message-ID: <b69fa8dd68d816e7d24c88d3eda776ceb28c5dc5.1685890571.git.christophe.jaillet@wanadoo.fr>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc3/dwc3-qcom.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/dwc3/dwc3-qcom.c b/drivers/usb/dwc3/dwc3-qcom.c
+index 9c01e963ae467..72c22851d7eef 100644
+--- a/drivers/usb/dwc3/dwc3-qcom.c
++++ b/drivers/usb/dwc3/dwc3-qcom.c
+@@ -865,9 +865,10 @@ static int dwc3_qcom_probe(struct platform_device *pdev)
+ if (IS_ERR_OR_NULL(qcom->urs_usb)) {
+ dev_err(dev, "failed to create URS USB platdev\n");
+ if (!qcom->urs_usb)
+- return -ENODEV;
++ ret = -ENODEV;
+ else
+- return PTR_ERR(qcom->urs_usb);
++ ret = PTR_ERR(qcom->urs_usb);
++ goto clk_disable;
+ }
+ }
+ }
+--
+2.39.2
+
--- /dev/null
+From 6e4aa24ff85ab7aab2b6871c8eb48d0ec875f8ff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 May 2023 20:25:18 +0300
+Subject: usb: dwc3: qcom: Fix potential memory leak
+
+From: Vladislav Efanov <VEfanov@ispras.ru>
+
+[ Upstream commit 097fb3ee710d4de83b8d4f5589e8ee13e0f0541e ]
+
+Function dwc3_qcom_probe() allocates memory for resource structure
+which is pointed by parent_res pointer. This memory is not
+freed. This leads to memory leak. Use stack memory to prevent
+memory leak.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: 2bc02355f8ba ("usb: dwc3: qcom: Add support for booting with ACPI")
+Signed-off-by: Vladislav Efanov <VEfanov@ispras.ru>
+Acked-by: Shawn Guo <shawn.guo@linaro.org>
+Link: https://lore.kernel.org/r/20230517172518.442591-1-VEfanov@ispras.ru
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc3/dwc3-qcom.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/usb/dwc3/dwc3-qcom.c b/drivers/usb/dwc3/dwc3-qcom.c
+index 79b22abf97276..482260182d656 100644
+--- a/drivers/usb/dwc3/dwc3-qcom.c
++++ b/drivers/usb/dwc3/dwc3-qcom.c
+@@ -800,6 +800,7 @@ static int dwc3_qcom_probe(struct platform_device *pdev)
+ struct device *dev = &pdev->dev;
+ struct dwc3_qcom *qcom;
+ struct resource *res, *parent_res = NULL;
++ struct resource local_res;
+ int ret, i;
+ bool ignore_pipe_clk;
+ bool wakeup_source;
+@@ -851,9 +852,8 @@ static int dwc3_qcom_probe(struct platform_device *pdev)
+ if (np) {
+ parent_res = res;
+ } else {
+- parent_res = kmemdup(res, sizeof(struct resource), GFP_KERNEL);
+- if (!parent_res)
+- return -ENOMEM;
++ memcpy(&local_res, res, sizeof(struct resource));
++ parent_res = &local_res;
+
+ parent_res->start = res->start +
+ qcom->acpi_pdata->qscratch_base_offset;
+--
+2.39.2
+
--- /dev/null
+From 05f62516175c584a75ab16a792f736b22df9d1d7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 4 Jun 2023 17:04:37 +0200
+Subject: usb: dwc3: qcom: Release the correct resources in dwc3_qcom_remove()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 8fd95da2cfb5046c4bb5a3cdc9eb7963ba8b10dd ]
+
+In the probe, some resources are allocated with
+dwc3_qcom_of_register_core() or dwc3_qcom_acpi_register_core(). The
+corresponding resources are already coorectly freed in the error handling
+path of the probe, but not in the remove function.
+
+Fix it.
+
+Fixes: 2bc02355f8ba ("usb: dwc3: qcom: Add support for booting with ACPI")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Reviewed-by: Andrew Halaney <ahalaney@redhat.com>
+Message-ID: <c0215a84cdf18fb3514c81842783ec53cf149deb.1685891059.git.christophe.jaillet@wanadoo.fr>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc3/dwc3-qcom.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/dwc3/dwc3-qcom.c b/drivers/usb/dwc3/dwc3-qcom.c
+index 482260182d656..9c01e963ae467 100644
+--- a/drivers/usb/dwc3/dwc3-qcom.c
++++ b/drivers/usb/dwc3/dwc3-qcom.c
+@@ -950,11 +950,15 @@ static int dwc3_qcom_probe(struct platform_device *pdev)
+ static int dwc3_qcom_remove(struct platform_device *pdev)
+ {
+ struct dwc3_qcom *qcom = platform_get_drvdata(pdev);
++ struct device_node *np = pdev->dev.of_node;
+ struct device *dev = &pdev->dev;
+ int i;
+
+ device_remove_software_node(&qcom->dwc3->dev);
+- of_platform_depopulate(dev);
++ if (np)
++ of_platform_depopulate(&pdev->dev);
++ else
++ platform_device_put(pdev);
+
+ for (i = qcom->num_clocks - 1; i >= 0; i--) {
+ clk_disable_unprepare(qcom->clks[i]);
+--
+2.39.2
+
--- /dev/null
+From 878ea5d60ed9db19c5be557cc71aa7888d7ec0ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Apr 2023 19:30:55 +0530
+Subject: USB: Extend pci resume function to handle PM events
+
+From: Basavaraj Natikar <Basavaraj.Natikar@amd.com>
+
+[ Upstream commit 1f7d5520719dd1fed1a2947679f6cc26a55f1e6b ]
+
+Currently, the pci_resume method has only a flag indicating whether the
+system is resuming from hibernation. In order to handle all PM events like
+AUTO_RESUME (runtime resume from device in D3), RESUME (system resume from
+s2idle, S3 or S4 states) etc change the pci_resume method to handle all PM
+events.
+
+Signed-off-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Acked-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://lore.kernel.org/r/20230428140056.1318981-2-Basavaraj.Natikar@amd.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Stable-dep-of: 1c024241d018 ("xhci: Improve the XHCI system resume time")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/core/hcd-pci.c | 24 +++++++++++++-----------
+ drivers/usb/host/ehci-pci.c | 3 ++-
+ drivers/usb/host/ohci-pci.c | 8 +++++++-
+ drivers/usb/host/uhci-pci.c | 7 ++++---
+ drivers/usb/host/xhci-histb.c | 2 +-
+ drivers/usb/host/xhci-pci.c | 4 ++--
+ drivers/usb/host/xhci-plat.c | 4 ++--
+ drivers/usb/host/xhci-tegra.c | 2 +-
+ drivers/usb/host/xhci.c | 3 ++-
+ drivers/usb/host/xhci.h | 2 +-
+ include/linux/usb/hcd.h | 2 +-
+ 11 files changed, 36 insertions(+), 25 deletions(-)
+
+diff --git a/drivers/usb/core/hcd-pci.c b/drivers/usb/core/hcd-pci.c
+index ab2f3737764e4..990280688b254 100644
+--- a/drivers/usb/core/hcd-pci.c
++++ b/drivers/usb/core/hcd-pci.c
+@@ -415,12 +415,15 @@ static int check_root_hub_suspended(struct device *dev)
+ return 0;
+ }
+
+-static int suspend_common(struct device *dev, bool do_wakeup)
++static int suspend_common(struct device *dev, pm_message_t msg)
+ {
+ struct pci_dev *pci_dev = to_pci_dev(dev);
+ struct usb_hcd *hcd = pci_get_drvdata(pci_dev);
++ bool do_wakeup;
+ int retval;
+
++ do_wakeup = PMSG_IS_AUTO(msg) ? true : device_may_wakeup(dev);
++
+ /* Root hub suspend should have stopped all downstream traffic,
+ * and all bus master traffic. And done so for both the interface
+ * and the stub usb_device (which we check here). But maybe it
+@@ -447,7 +450,7 @@ static int suspend_common(struct device *dev, bool do_wakeup)
+ (retval == 0 && do_wakeup && hcd->shared_hcd &&
+ HCD_WAKEUP_PENDING(hcd->shared_hcd))) {
+ if (hcd->driver->pci_resume)
+- hcd->driver->pci_resume(hcd, false);
++ hcd->driver->pci_resume(hcd, msg);
+ retval = -EBUSY;
+ }
+ if (retval)
+@@ -470,7 +473,7 @@ static int suspend_common(struct device *dev, bool do_wakeup)
+ return retval;
+ }
+
+-static int resume_common(struct device *dev, int event)
++static int resume_common(struct device *dev, pm_message_t msg)
+ {
+ struct pci_dev *pci_dev = to_pci_dev(dev);
+ struct usb_hcd *hcd = pci_get_drvdata(pci_dev);
+@@ -498,12 +501,11 @@ static int resume_common(struct device *dev, int event)
+ * No locking is needed because PCI controller drivers do not
+ * get unbound during system resume.
+ */
+- if (pci_dev->class == CL_EHCI && event != PM_EVENT_AUTO_RESUME)
++ if (pci_dev->class == CL_EHCI && msg.event != PM_EVENT_AUTO_RESUME)
+ for_each_companion(pci_dev, hcd,
+ ehci_wait_for_companions);
+
+- retval = hcd->driver->pci_resume(hcd,
+- event == PM_EVENT_RESTORE);
++ retval = hcd->driver->pci_resume(hcd, msg);
+ if (retval) {
+ dev_err(dev, "PCI post-resume error %d!\n", retval);
+ usb_hc_died(hcd);
+@@ -516,7 +518,7 @@ static int resume_common(struct device *dev, int event)
+
+ static int hcd_pci_suspend(struct device *dev)
+ {
+- return suspend_common(dev, device_may_wakeup(dev));
++ return suspend_common(dev, PMSG_SUSPEND);
+ }
+
+ static int hcd_pci_suspend_noirq(struct device *dev)
+@@ -577,12 +579,12 @@ static int hcd_pci_resume_noirq(struct device *dev)
+
+ static int hcd_pci_resume(struct device *dev)
+ {
+- return resume_common(dev, PM_EVENT_RESUME);
++ return resume_common(dev, PMSG_RESUME);
+ }
+
+ static int hcd_pci_restore(struct device *dev)
+ {
+- return resume_common(dev, PM_EVENT_RESTORE);
++ return resume_common(dev, PMSG_RESTORE);
+ }
+
+ #else
+@@ -600,7 +602,7 @@ static int hcd_pci_runtime_suspend(struct device *dev)
+ {
+ int retval;
+
+- retval = suspend_common(dev, true);
++ retval = suspend_common(dev, PMSG_AUTO_SUSPEND);
+ if (retval == 0)
+ powermac_set_asic(to_pci_dev(dev), 0);
+ dev_dbg(dev, "hcd_pci_runtime_suspend: %d\n", retval);
+@@ -612,7 +614,7 @@ static int hcd_pci_runtime_resume(struct device *dev)
+ int retval;
+
+ powermac_set_asic(to_pci_dev(dev), 1);
+- retval = resume_common(dev, PM_EVENT_AUTO_RESUME);
++ retval = resume_common(dev, PMSG_AUTO_RESUME);
+ dev_dbg(dev, "hcd_pci_runtime_resume: %d\n", retval);
+ return retval;
+ }
+diff --git a/drivers/usb/host/ehci-pci.c b/drivers/usb/host/ehci-pci.c
+index 4b148fe5e43b2..889dc44262711 100644
+--- a/drivers/usb/host/ehci-pci.c
++++ b/drivers/usb/host/ehci-pci.c
+@@ -354,10 +354,11 @@ static int ehci_pci_setup(struct usb_hcd *hcd)
+ * Also they depend on separate root hub suspend/resume.
+ */
+
+-static int ehci_pci_resume(struct usb_hcd *hcd, bool hibernated)
++static int ehci_pci_resume(struct usb_hcd *hcd, pm_message_t msg)
+ {
+ struct ehci_hcd *ehci = hcd_to_ehci(hcd);
+ struct pci_dev *pdev = to_pci_dev(hcd->self.controller);
++ bool hibernated = (msg.event == PM_EVENT_RESTORE);
+
+ if (ehci_resume(hcd, hibernated) != 0)
+ (void) ehci_pci_reinit(ehci, pdev);
+diff --git a/drivers/usb/host/ohci-pci.c b/drivers/usb/host/ohci-pci.c
+index d7b4f40f9ff4e..900ea0d368e03 100644
+--- a/drivers/usb/host/ohci-pci.c
++++ b/drivers/usb/host/ohci-pci.c
+@@ -301,6 +301,12 @@ static struct pci_driver ohci_pci_driver = {
+ #endif
+ };
+
++#ifdef CONFIG_PM
++static int ohci_pci_resume(struct usb_hcd *hcd, pm_message_t msg)
++{
++ return ohci_resume(hcd, msg.event == PM_EVENT_RESTORE);
++}
++#endif
+ static int __init ohci_pci_init(void)
+ {
+ if (usb_disabled())
+@@ -311,7 +317,7 @@ static int __init ohci_pci_init(void)
+ #ifdef CONFIG_PM
+ /* Entries for the PCI suspend/resume callbacks are special */
+ ohci_pci_hc_driver.pci_suspend = ohci_suspend;
+- ohci_pci_hc_driver.pci_resume = ohci_resume;
++ ohci_pci_hc_driver.pci_resume = ohci_pci_resume;
+ #endif
+
+ return pci_register_driver(&ohci_pci_driver);
+diff --git a/drivers/usb/host/uhci-pci.c b/drivers/usb/host/uhci-pci.c
+index 7bd2fddde770a..5edf6a08cf82c 100644
+--- a/drivers/usb/host/uhci-pci.c
++++ b/drivers/usb/host/uhci-pci.c
+@@ -169,7 +169,7 @@ static void uhci_shutdown(struct pci_dev *pdev)
+
+ #ifdef CONFIG_PM
+
+-static int uhci_pci_resume(struct usb_hcd *hcd, bool hibernated);
++static int uhci_pci_resume(struct usb_hcd *hcd, pm_message_t state);
+
+ static int uhci_pci_suspend(struct usb_hcd *hcd, bool do_wakeup)
+ {
+@@ -204,14 +204,15 @@ static int uhci_pci_suspend(struct usb_hcd *hcd, bool do_wakeup)
+
+ /* Check for race with a wakeup request */
+ if (do_wakeup && HCD_WAKEUP_PENDING(hcd)) {
+- uhci_pci_resume(hcd, false);
++ uhci_pci_resume(hcd, PMSG_SUSPEND);
+ rc = -EBUSY;
+ }
+ return rc;
+ }
+
+-static int uhci_pci_resume(struct usb_hcd *hcd, bool hibernated)
++static int uhci_pci_resume(struct usb_hcd *hcd, pm_message_t msg)
+ {
++ bool hibernated = (msg.event == PM_EVENT_RESTORE);
+ struct uhci_hcd *uhci = hcd_to_uhci(hcd);
+
+ dev_dbg(uhci_dev(uhci), "%s\n", __func__);
+diff --git a/drivers/usb/host/xhci-histb.c b/drivers/usb/host/xhci-histb.c
+index 08369857686e7..91ce97821de51 100644
+--- a/drivers/usb/host/xhci-histb.c
++++ b/drivers/usb/host/xhci-histb.c
+@@ -367,7 +367,7 @@ static int __maybe_unused xhci_histb_resume(struct device *dev)
+ if (!device_may_wakeup(dev))
+ xhci_histb_host_enable(histb);
+
+- return xhci_resume(xhci, 0);
++ return xhci_resume(xhci, PMSG_RESUME);
+ }
+
+ static const struct dev_pm_ops xhci_histb_pm_ops = {
+diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
+index 79b3691f373f3..69a5cb7eba381 100644
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -832,7 +832,7 @@ static int xhci_pci_suspend(struct usb_hcd *hcd, bool do_wakeup)
+ return ret;
+ }
+
+-static int xhci_pci_resume(struct usb_hcd *hcd, bool hibernated)
++static int xhci_pci_resume(struct usb_hcd *hcd, pm_message_t msg)
+ {
+ struct xhci_hcd *xhci = hcd_to_xhci(hcd);
+ struct pci_dev *pdev = to_pci_dev(hcd->self.controller);
+@@ -867,7 +867,7 @@ static int xhci_pci_resume(struct usb_hcd *hcd, bool hibernated)
+ if (xhci->quirks & XHCI_PME_STUCK_QUIRK)
+ xhci_pme_quirk(hcd);
+
+- retval = xhci_resume(xhci, hibernated);
++ retval = xhci_resume(xhci, msg);
+ return retval;
+ }
+
+diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
+index b0c8e8efc43b6..f36633fa83624 100644
+--- a/drivers/usb/host/xhci-plat.c
++++ b/drivers/usb/host/xhci-plat.c
+@@ -478,7 +478,7 @@ static int __maybe_unused xhci_plat_resume(struct device *dev)
+ if (ret)
+ return ret;
+
+- ret = xhci_resume(xhci, 0);
++ ret = xhci_resume(xhci, PMSG_RESUME);
+ if (ret)
+ return ret;
+
+@@ -507,7 +507,7 @@ static int __maybe_unused xhci_plat_runtime_resume(struct device *dev)
+ struct usb_hcd *hcd = dev_get_drvdata(dev);
+ struct xhci_hcd *xhci = hcd_to_xhci(hcd);
+
+- return xhci_resume(xhci, 0);
++ return xhci_resume(xhci, PMSG_AUTO_RESUME);
+ }
+
+ const struct dev_pm_ops xhci_plat_pm_ops = {
+diff --git a/drivers/usb/host/xhci-tegra.c b/drivers/usb/host/xhci-tegra.c
+index c75d932441436..8a9c7deb7686e 100644
+--- a/drivers/usb/host/xhci-tegra.c
++++ b/drivers/usb/host/xhci-tegra.c
+@@ -2272,7 +2272,7 @@ static int tegra_xusb_exit_elpg(struct tegra_xusb *tegra, bool runtime)
+ if (wakeup)
+ tegra_xhci_disable_phy_sleepwalk(tegra);
+
+- err = xhci_resume(xhci, 0);
++ err = xhci_resume(xhci, runtime ? PMSG_AUTO_RESUME : PMSG_RESUME);
+ if (err < 0) {
+ dev_err(tegra->dev, "failed to resume XHCI: %d\n", err);
+ goto disable_phy;
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index 78790dc13c5f1..65d54c8a24928 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -960,8 +960,9 @@ EXPORT_SYMBOL_GPL(xhci_suspend);
+ * This is called when the machine transition from S3/S4 mode.
+ *
+ */
+-int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
++int xhci_resume(struct xhci_hcd *xhci, pm_message_t msg)
+ {
++ bool hibernated = (msg.event == PM_EVENT_RESTORE);
+ u32 command, temp = 0;
+ struct usb_hcd *hcd = xhci_to_hcd(xhci);
+ int retval = 0;
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
+index 6b690ec91ff3a..f845c15073ba4 100644
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -2140,7 +2140,7 @@ int xhci_disable_slot(struct xhci_hcd *xhci, u32 slot_id);
+ int xhci_ext_cap_init(struct xhci_hcd *xhci);
+
+ int xhci_suspend(struct xhci_hcd *xhci, bool do_wakeup);
+-int xhci_resume(struct xhci_hcd *xhci, bool hibernated);
++int xhci_resume(struct xhci_hcd *xhci, pm_message_t msg);
+
+ irqreturn_t xhci_irq(struct usb_hcd *hcd);
+ irqreturn_t xhci_msi_irq(int irq, void *hcd);
+diff --git a/include/linux/usb/hcd.h b/include/linux/usb/hcd.h
+index 0c7eff91adf4e..4e9623e8492b3 100644
+--- a/include/linux/usb/hcd.h
++++ b/include/linux/usb/hcd.h
+@@ -267,7 +267,7 @@ struct hc_driver {
+ int (*pci_suspend)(struct usb_hcd *hcd, bool do_wakeup);
+
+ /* called after entering D0 (etc), before resuming the hub */
+- int (*pci_resume)(struct usb_hcd *hcd, bool hibernated);
++ int (*pci_resume)(struct usb_hcd *hcd, pm_message_t state);
+
+ /* called just before hibernate final D3 state, allows host to poweroff parts */
+ int (*pci_poweroff_late)(struct usb_hcd *hcd, bool do_wakeup);
+--
+2.39.2
+
--- /dev/null
+From 705333452795018e2d679a40c7b792484bcb1dda Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 May 2023 14:48:37 +0530
+Subject: usb: gadget: u_serial: Add null pointer check in gserial_suspend
+
+From: Prashanth K <quic_prashk@quicinc.com>
+
+[ Upstream commit 2f6ecb89fe8feb2b60a53325b0eeb9866d88909a ]
+
+Consider a case where gserial_disconnect has already cleared
+gser->ioport. And if gserial_suspend gets called afterwards,
+it will lead to accessing of gser->ioport and thus causing
+null pointer dereference.
+
+Avoid this by adding a null pointer check. Added a static
+spinlock to prevent gser->ioport from becoming null after
+the newly added null pointer check.
+
+Fixes: aba3a8d01d62 ("usb: gadget: u_serial: add suspend resume callbacks")
+Signed-off-by: Prashanth K <quic_prashk@quicinc.com>
+Link: https://lore.kernel.org/r/1683278317-11774-1-git-send-email-quic_prashk@quicinc.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/function/u_serial.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/gadget/function/u_serial.c b/drivers/usb/gadget/function/u_serial.c
+index a0ca47fbff0fc..e5d522d54f6a3 100644
+--- a/drivers/usb/gadget/function/u_serial.c
++++ b/drivers/usb/gadget/function/u_serial.c
+@@ -1420,10 +1420,19 @@ EXPORT_SYMBOL_GPL(gserial_disconnect);
+
+ void gserial_suspend(struct gserial *gser)
+ {
+- struct gs_port *port = gser->ioport;
++ struct gs_port *port;
+ unsigned long flags;
+
+- spin_lock_irqsave(&port->port_lock, flags);
++ spin_lock_irqsave(&serial_port_lock, flags);
++ port = gser->ioport;
++
++ if (!port) {
++ spin_unlock_irqrestore(&serial_port_lock, flags);
++ return;
++ }
++
++ spin_lock(&port->port_lock);
++ spin_unlock(&serial_port_lock);
+ port->suspended = true;
+ spin_unlock_irqrestore(&port->port_lock, flags);
+ }
+--
+2.39.2
+
--- /dev/null
+From 186cb9314d793f656f2e93bfe62c67fd8ca1992d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 May 2023 22:17:42 +0200
+Subject: usb: hide unused usbfs_notify_suspend/resume functions
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 8e6bd945e6dde64fbc60ec3fe252164493a8d3a2 ]
+
+The declaration is in an #ifdef, which causes warnings when building
+with 'make W=1' and without CONFIG_PM:
+
+drivers/usb/core/devio.c:742:6: error: no previous prototype for 'usbfs_notify_suspend'
+drivers/usb/core/devio.c:747:6: error: no previous prototype for 'usbfs_notify_resume'
+
+Use the same #ifdef check around the function definitions to avoid
+the warnings and slightly shrink the USB core.
+
+Fixes: 7794f486ed0b ("usbfs: Add ioctls for runtime power management")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Link: https://lore.kernel.org/r/20230516202103.558301-1-arnd@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/core/devio.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
+index fcf68818e9992..cbad2af5fd882 100644
+--- a/drivers/usb/core/devio.c
++++ b/drivers/usb/core/devio.c
+@@ -746,6 +746,7 @@ static int driver_resume(struct usb_interface *intf)
+ return 0;
+ }
+
++#ifdef CONFIG_PM
+ /* The following routines apply to the entire device, not interfaces */
+ void usbfs_notify_suspend(struct usb_device *udev)
+ {
+@@ -764,6 +765,7 @@ void usbfs_notify_resume(struct usb_device *udev)
+ }
+ mutex_unlock(&usbfs_mutex);
+ }
++#endif
+
+ struct usb_driver usbfs_driver = {
+ .name = "usbfs",
+--
+2.39.2
+
--- /dev/null
+From e16e95bd1c9c03c05ec1948e1cfe5e2716ad49f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 May 2023 02:47:51 +0530
+Subject: usb: misc: eud: Fix eud sysfs path (use 'qcom_eud')
+
+From: Bhupesh Sharma <bhupesh.sharma@linaro.org>
+
+[ Upstream commit f16135918b5f8b510db014ecf0a069e34c02382e ]
+
+The eud sysfs enablement path is currently mentioned in the
+Documentation as:
+ /sys/bus/platform/drivers/eud/.../enable
+
+Instead it should be:
+ /sys/bus/platform/drivers/qcom_eud/.../enable
+
+Fix the same.
+
+Fixes: 9a1bf58ccd44 ("usb: misc: eud: Add driver support for Embedded USB Debugger(EUD)")
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Acked-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Signed-off-by: Bhupesh Sharma <bhupesh.sharma@linaro.org>
+Link: https://lore.kernel.org/r/20230517211756.2483552-2-bhupesh.sharma@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/ABI/testing/sysfs-driver-eud | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Documentation/ABI/testing/sysfs-driver-eud b/Documentation/ABI/testing/sysfs-driver-eud
+index 83f3872182a40..2bab0db2d2f0f 100644
+--- a/Documentation/ABI/testing/sysfs-driver-eud
++++ b/Documentation/ABI/testing/sysfs-driver-eud
+@@ -1,4 +1,4 @@
+-What: /sys/bus/platform/drivers/eud/.../enable
++What: /sys/bus/platform/drivers/qcom_eud/.../enable
+ Date: February 2022
+ Contact: Souradeep Chowdhury <quic_schowdhu@quicinc.com>
+ Description:
+--
+2.39.2
+
--- /dev/null
+From bfb98ec8a87fb0ae1232d899e2cfebd0f0780428 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Apr 2023 22:08:31 +0800
+Subject: usb: phy: phy-tahvo: fix memory leak in tahvo_usb_probe()
+
+From: Li Yang <lidaxian@hust.edu.cn>
+
+[ Upstream commit 342161c11403ea00e9febc16baab1d883d589d04 ]
+
+Smatch reports:
+drivers/usb/phy/phy-tahvo.c: tahvo_usb_probe()
+warn: missing unwind goto?
+
+After geting irq, if ret < 0, it will return without error handling to
+free memory.
+Just add error handling to fix this problem.
+
+Fixes: 0d45a1373e66 ("usb: phy: tahvo: add IRQ check")
+Signed-off-by: Li Yang <lidaxian@hust.edu.cn>
+Reviewed-by: Dongliang Mu <dzm91@hust.edu.cn>
+Link: https://lore.kernel.org/r/20230420140832.9110-1-lidaxian@hust.edu.cn
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/phy/phy-tahvo.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/phy/phy-tahvo.c b/drivers/usb/phy/phy-tahvo.c
+index 47562d49dfc1b..5cac31c6029b3 100644
+--- a/drivers/usb/phy/phy-tahvo.c
++++ b/drivers/usb/phy/phy-tahvo.c
+@@ -391,7 +391,7 @@ static int tahvo_usb_probe(struct platform_device *pdev)
+
+ tu->irq = ret = platform_get_irq(pdev, 0);
+ if (ret < 0)
+- return ret;
++ goto err_remove_phy;
+ ret = request_threaded_irq(tu->irq, NULL, tahvo_usb_vbus_interrupt,
+ IRQF_ONESHOT,
+ "tahvo-vbus", tu);
+--
+2.39.2
+
--- /dev/null
+From 2d7cf658d4076966bd0521a9972cb0db8552be4e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jun 2023 22:48:51 +0200
+Subject: vduse: fix NULL pointer dereference
+
+From: Maxime Coquelin <maxime.coquelin@redhat.com>
+
+[ Upstream commit f06cf1e1a503169280467d12d2ec89bf2c30ace7 ]
+
+vduse_vdpa_set_vq_affinity callback can be called
+with NULL value as cpu_mask when deleting the vduse
+device.
+
+This patch resets virtqueue's IRQ affinity mask value
+to set all CPUs instead of dereferencing NULL cpu_mask.
+
+[ 4760.952149] BUG: kernel NULL pointer dereference, address: 0000000000000000
+[ 4760.959110] #PF: supervisor read access in kernel mode
+[ 4760.964247] #PF: error_code(0x0000) - not-present page
+[ 4760.969385] PGD 0 P4D 0
+[ 4760.971927] Oops: 0000 [#1] PREEMPT SMP PTI
+[ 4760.976112] CPU: 13 PID: 2346 Comm: vdpa Not tainted 6.4.0-rc6+ #4
+[ 4760.982291] Hardware name: Dell Inc. PowerEdge R640/0W23H8, BIOS 2.8.1 06/26/2020
+[ 4760.989769] RIP: 0010:memcpy_orig+0xc5/0x130
+[ 4760.994049] Code: 16 f8 4c 89 07 4c 89 4f 08 4c 89 54 17 f0 4c 89 5c 17 f8 c3 cc cc cc cc 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 83 fa 08 72 1b <4c> 8b 06 4c 8b 4c 16 f8 4c 89 07 4c 89 4c 17 f8 c3 cc cc cc cc 66
+[ 4761.012793] RSP: 0018:ffffb1d565abb830 EFLAGS: 00010246
+[ 4761.018020] RAX: ffff9f4bf6b27898 RBX: ffff9f4be23969c0 RCX: ffff9f4bcadf6400
+[ 4761.025152] RDX: 0000000000000008 RSI: 0000000000000000 RDI: ffff9f4bf6b27898
+[ 4761.032286] RBP: 0000000000000000 R08: 0000000000000008 R09: 0000000000000000
+[ 4761.039416] R10: 0000000000000000 R11: 0000000000000600 R12: 0000000000000000
+[ 4761.046549] R13: 0000000000000000 R14: 0000000000000080 R15: ffffb1d565abbb10
+[ 4761.053680] FS: 00007f64c2ec2740(0000) GS:ffff9f635f980000(0000) knlGS:0000000000000000
+[ 4761.061765] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 4761.067513] CR2: 0000000000000000 CR3: 0000001875270006 CR4: 00000000007706e0
+[ 4761.074645] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[ 4761.081775] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+[ 4761.088909] PKRU: 55555554
+[ 4761.091620] Call Trace:
+[ 4761.094074] <TASK>
+[ 4761.096180] ? __die+0x1f/0x70
+[ 4761.099238] ? page_fault_oops+0x171/0x4f0
+[ 4761.103340] ? exc_page_fault+0x7b/0x180
+[ 4761.107265] ? asm_exc_page_fault+0x22/0x30
+[ 4761.111460] ? memcpy_orig+0xc5/0x130
+[ 4761.115126] vduse_vdpa_set_vq_affinity+0x3e/0x50 [vduse]
+[ 4761.120533] virtnet_clean_affinity.part.0+0x3d/0x90 [virtio_net]
+[ 4761.126635] remove_vq_common+0x1a4/0x250 [virtio_net]
+[ 4761.131781] virtnet_remove+0x5d/0x70 [virtio_net]
+[ 4761.136580] virtio_dev_remove+0x3a/0x90
+[ 4761.140509] device_release_driver_internal+0x19b/0x200
+[ 4761.145742] bus_remove_device+0xc2/0x130
+[ 4761.149755] device_del+0x158/0x3e0
+[ 4761.153245] ? kernfs_find_ns+0x35/0xc0
+[ 4761.157086] device_unregister+0x13/0x60
+[ 4761.161010] unregister_virtio_device+0x11/0x20
+[ 4761.165543] device_release_driver_internal+0x19b/0x200
+[ 4761.170770] bus_remove_device+0xc2/0x130
+[ 4761.174782] device_del+0x158/0x3e0
+[ 4761.178276] ? __pfx_vdpa_name_match+0x10/0x10 [vdpa]
+[ 4761.183336] device_unregister+0x13/0x60
+[ 4761.187260] vdpa_nl_cmd_dev_del_set_doit+0x63/0xe0 [vdpa]
+
+Fixes: 28f6288eb63d ("vduse: Support set_vq_affinity callback")
+Cc: xieyongji@bytedance.com
+Signed-off-by: Maxime Coquelin <maxime.coquelin@redhat.com>
+Message-Id: <20230622204851.318125-1-maxime.coquelin@redhat.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Acked-by: Jason Wang <jasowang@redhat.com>
+Reviewed-by: Xie Yongji <xieyongji@bytedance.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vdpa/vdpa_user/vduse_dev.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/vdpa/vdpa_user/vduse_dev.c b/drivers/vdpa/vdpa_user/vduse_dev.c
+index 5f5c21674fdce..0d84e6a9c3cca 100644
+--- a/drivers/vdpa/vdpa_user/vduse_dev.c
++++ b/drivers/vdpa/vdpa_user/vduse_dev.c
+@@ -726,7 +726,11 @@ static int vduse_vdpa_set_vq_affinity(struct vdpa_device *vdpa, u16 idx,
+ {
+ struct vduse_dev *dev = vdpa_to_vduse(vdpa);
+
+- cpumask_copy(&dev->vqs[idx]->irq_affinity, cpu_mask);
++ if (cpu_mask)
++ cpumask_copy(&dev->vqs[idx]->irq_affinity, cpu_mask);
++ else
++ cpumask_setall(&dev->vqs[idx]->irq_affinity);
++
+ return 0;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From a950f379add9efcf3507df24e7b5c08ff599c89a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 May 2023 16:50:52 +0300
+Subject: virtio-vdpa: Fix unchecked call to NULL set_vq_affinity
+
+From: Dragos Tatulea <dtatulea@nvidia.com>
+
+[ Upstream commit fe37efba475375caa2dbc71cb06f53f7086277ef ]
+
+The referenced patch calls set_vq_affinity without checking if the op is
+valid. This patch adds the check.
+
+Fixes: 3dad56823b53 ("virtio-vdpa: Support interrupt affinity spreading mechanism")
+Reviewed-by: Gal Pressman <gal@nvidia.com>
+Signed-off-by: Dragos Tatulea <dtatulea@nvidia.com>
+Message-Id: <20230504135053.2283816-1-dtatulea@nvidia.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Reviewed-by: Feng Liu <feliu@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/virtio/virtio_vdpa.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/virtio/virtio_vdpa.c b/drivers/virtio/virtio_vdpa.c
+index eb6aee8c06b2c..989e2d7184ce4 100644
+--- a/drivers/virtio/virtio_vdpa.c
++++ b/drivers/virtio/virtio_vdpa.c
+@@ -385,7 +385,9 @@ static int virtio_vdpa_find_vqs(struct virtio_device *vdev, unsigned int nvqs,
+ err = PTR_ERR(vqs[i]);
+ goto err_setup_vq;
+ }
+- ops->set_vq_affinity(vdpa, i, &masks[i]);
++
++ if (ops->set_vq_affinity)
++ ops->set_vq_affinity(vdpa, i, &masks[i]);
+ }
+
+ cb.callback = virtio_vdpa_config_cb;
+--
+2.39.2
+
--- /dev/null
+From 73e4f1a9a5f4310e13ac2167e74efa86d1ca7937 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 May 2021 17:17:45 +0300
+Subject: w1: fix loop in w1_fini()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 83f3fcf96fcc7e5405b37d9424c7ef26bfa203f8 ]
+
+The __w1_remove_master_device() function calls:
+
+ list_del(&dev->w1_master_entry);
+
+So presumably this can cause an endless loop.
+
+Fixes: 7785925dd8e0 ("[PATCH] w1: cleanups.")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/w1/w1.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/w1/w1.c b/drivers/w1/w1.c
+index 9d199fed96287..2c766bdc68cc5 100644
+--- a/drivers/w1/w1.c
++++ b/drivers/w1/w1.c
+@@ -1263,10 +1263,10 @@ static int __init w1_init(void)
+
+ static void __exit w1_fini(void)
+ {
+- struct w1_master *dev;
++ struct w1_master *dev, *n;
+
+ /* Set netlink removal messages and some cleanup */
+- list_for_each_entry(dev, &w1_masters, w1_master_entry)
++ list_for_each_entry_safe(dev, n, &w1_masters, w1_master_entry)
+ __w1_remove_master_device(dev);
+
+ w1_fini_netlink();
+--
+2.39.2
+
--- /dev/null
+From 350fc635494ec8305aa5652e1175b7953ab38fdf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Apr 2023 13:21:52 +0200
+Subject: w1: w1_therm: fix locking behavior in convert_t
+
+From: Stefan Wahren <stefan.wahren@i2se.com>
+
+[ Upstream commit dca5480ab7b77a889088ab7cac81934604510ac7 ]
+
+The commit 67b392f7b8ed ("w1_therm: optimizing temperature read timings")
+accidentially inverted the logic for lock handling of the bus mutex.
+
+Before:
+ pullup -> release lock before sleep
+ no pullup -> release lock after sleep
+
+After:
+ pullup -> release lock after sleep
+ no pullup -> release lock before sleep
+
+This cause spurious measurements of 85 degree (powerup value) on the
+Tarragon board with connected 1-w temperature sensor
+(w1_therm.w1_strong_pull=0).
+
+In the meantime a new feature for polling the conversion
+completion has been integrated in these branches with
+commit 021da53e65fd ("w1: w1_therm: Add sysfs entries to control
+conversion time and driver features"). But this feature isn't
+available for parasite power mode, so handle this separately.
+
+Link: https://lore.kernel.org/regressions/2023042645-attentive-amends-7b0b@gregkh/T/
+Fixes: 67b392f7b8ed ("w1_therm: optimizing temperature read timings")
+Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
+Link: https://lore.kernel.org/r/20230427112152.12313-1-stefan.wahren@i2se.com
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/w1/slaves/w1_therm.c | 31 ++++++++++++++-----------------
+ 1 file changed, 14 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/w1/slaves/w1_therm.c b/drivers/w1/slaves/w1_therm.c
+index 067692626cf07..99c58bd9d2df0 100644
+--- a/drivers/w1/slaves/w1_therm.c
++++ b/drivers/w1/slaves/w1_therm.c
+@@ -1159,29 +1159,26 @@ static int convert_t(struct w1_slave *sl, struct therm_info *info)
+
+ w1_write_8(dev_master, W1_CONVERT_TEMP);
+
+- if (strong_pullup) { /*some device need pullup */
++ if (SLAVE_FEATURES(sl) & W1_THERM_POLL_COMPLETION) {
++ ret = w1_poll_completion(dev_master, W1_POLL_CONVERT_TEMP);
++ if (ret) {
++ dev_dbg(&sl->dev, "%s: Timeout\n", __func__);
++ goto mt_unlock;
++ }
++ mutex_unlock(&dev_master->bus_mutex);
++ } else if (!strong_pullup) { /*no device need pullup */
+ sleep_rem = msleep_interruptible(t_conv);
+ if (sleep_rem != 0) {
+ ret = -EINTR;
+ goto mt_unlock;
+ }
+ mutex_unlock(&dev_master->bus_mutex);
+- } else { /*no device need pullup */
+- if (SLAVE_FEATURES(sl) & W1_THERM_POLL_COMPLETION) {
+- ret = w1_poll_completion(dev_master, W1_POLL_CONVERT_TEMP);
+- if (ret) {
+- dev_dbg(&sl->dev, "%s: Timeout\n", __func__);
+- goto mt_unlock;
+- }
+- mutex_unlock(&dev_master->bus_mutex);
+- } else {
+- /* Fixed delay */
+- mutex_unlock(&dev_master->bus_mutex);
+- sleep_rem = msleep_interruptible(t_conv);
+- if (sleep_rem != 0) {
+- ret = -EINTR;
+- goto dec_refcnt;
+- }
++ } else { /*some device need pullup */
++ mutex_unlock(&dev_master->bus_mutex);
++ sleep_rem = msleep_interruptible(t_conv);
++ if (sleep_rem != 0) {
++ ret = -EINTR;
++ goto dec_refcnt;
+ }
+ }
+ ret = read_scratchpad(sl, info);
+--
+2.39.2
+
--- /dev/null
+From 878deaa007290b73ff069bb3cd493ace626df12c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Jun 2023 19:55:48 +0100
+Subject: writeback: account the number of pages written back
+
+From: Matthew Wilcox (Oracle) <willy@infradead.org>
+
+[ Upstream commit 8344a3d44be3d18671e18c4ba23bb03dd21e14ad ]
+
+nr_to_write is a count of pages, so we need to decrease it by the number
+of pages in the folio we just wrote, not by 1. Most callers specify
+either LONG_MAX or 1, so are unaffected, but writeback_sb_inodes() might
+end up writing 512x as many pages as it asked for.
+
+Dave added:
+
+: XFS is the only filesystem this would affect, right? AFAIA, nothing
+: else enables large folios and uses writeback through
+: write_cache_pages() at this point...
+:
+: In which case, I'd be surprised if much difference, if any, gets
+: noticed by anyone.
+
+Link: https://lkml.kernel.org/r/20230628185548.981888-1-willy@infradead.org
+Fixes: 793917d997df ("mm/readahead: Add large folio readahead")
+Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Cc: Jan Kara <jack@suse.cz>
+Cc: Dave Chinner <david@fromorbit.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ mm/page-writeback.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/mm/page-writeback.c b/mm/page-writeback.c
+index db79439990073..6faa09f1783b3 100644
+--- a/mm/page-writeback.c
++++ b/mm/page-writeback.c
+@@ -2434,6 +2434,7 @@ int write_cache_pages(struct address_space *mapping,
+
+ for (i = 0; i < nr_folios; i++) {
+ struct folio *folio = fbatch.folios[i];
++ unsigned long nr;
+
+ done_index = folio->index;
+
+@@ -2471,6 +2472,7 @@ int write_cache_pages(struct address_space *mapping,
+
+ trace_wbc_writepage(wbc, inode_to_bdi(mapping->host));
+ error = writepage(folio, wbc, data);
++ nr = folio_nr_pages(folio);
+ if (unlikely(error)) {
+ /*
+ * Handle errors according to the type of
+@@ -2489,8 +2491,7 @@ int write_cache_pages(struct address_space *mapping,
+ error = 0;
+ } else if (wbc->sync_mode != WB_SYNC_ALL) {
+ ret = error;
+- done_index = folio->index +
+- folio_nr_pages(folio);
++ done_index = folio->index + nr;
+ done = 1;
+ break;
+ }
+@@ -2504,7 +2505,8 @@ int write_cache_pages(struct address_space *mapping,
+ * keep going until we have written all the pages
+ * we tagged for writeback prior to entering this loop.
+ */
+- if (--wbc->nr_to_write <= 0 &&
++ wbc->nr_to_write -= nr;
++ if (wbc->nr_to_write <= 0 &&
+ wbc->sync_mode == WB_SYNC_NONE) {
+ done = 1;
+ break;
+--
+2.39.2
+
--- /dev/null
+From 96546d6f2828d88301ccc5052221e4fb5cc21de4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Apr 2023 19:30:56 +0530
+Subject: xhci: Improve the XHCI system resume time
+
+From: Basavaraj Natikar <Basavaraj.Natikar@amd.com>
+
+[ Upstream commit 1c024241d018cf9fc17aa8d95c3fe77d671d7142 ]
+
+Avoid extra 120ms delay during system resume.
+
+The xHC controller may signal wake up to 120ms before showing which usb
+device caused the wake on the xHC port registers.
+
+The xhci driver therefore checks for port activity up to 120ms during
+resume, making sure that the hub driver can see the port change, and
+won't immediately runtime suspend back due to no port activity.
+
+This is however only needed for runtime resume as system resume will
+resume all child hubs and other child usb devices anyway.
+
+Fixes: 253f588c70f6 ("xhci: Improve detection of device initiated wake signal.")
+Signed-off-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com>
+Acked-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://lore.kernel.org/r/20230428140056.1318981-3-Basavaraj.Natikar@amd.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/xhci.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index 65d54c8a24928..b81313ffeb768 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -1117,7 +1117,7 @@ int xhci_resume(struct xhci_hcd *xhci, pm_message_t msg)
+ * the first wake signalling failed, give it that chance.
+ */
+ pending_portevent = xhci_pending_portevent(xhci);
+- if (!pending_portevent) {
++ if (!pending_portevent && msg.event == PM_EVENT_AUTO_RESUME) {
+ msleep(120);
+ pending_portevent = xhci_pending_portevent(xhci);
+ }
+--
+2.39.2
+
--- /dev/null
+From 4fd3910f2b9218996cc6dff025e440a526f3715d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Jul 2023 19:53:29 +0200
+Subject: xsk: Honor SO_BINDTODEVICE on bind
+
+From: Ilya Maximets <i.maximets@ovn.org>
+
+[ Upstream commit f7306acec9aae9893d15e745c8791124d42ab10a ]
+
+Initial creation of an AF_XDP socket requires CAP_NET_RAW capability. A
+privileged process might create the socket and pass it to a non-privileged
+process for later use. However, that process will be able to bind the socket
+to any network interface. Even though it will not be able to receive any
+traffic without modification of the BPF map, the situation is not ideal.
+
+Sockets already have a mechanism that can be used to restrict what interface
+they can be attached to. That is SO_BINDTODEVICE.
+
+To change the SO_BINDTODEVICE binding the process will need CAP_NET_RAW.
+
+Make xsk_bind() honor the SO_BINDTODEVICE in order to allow safer workflow
+when non-privileged process is using AF_XDP.
+
+The intended workflow is following:
+
+ 1. First process creates a bare socket with socket(AF_XDP, ...).
+ 2. First process loads the XSK program to the interface.
+ 3. First process adds the socket fd to a BPF map.
+ 4. First process ties socket fd to a particular interface using
+ SO_BINDTODEVICE.
+ 5. First process sends socket fd to a second process.
+ 6. Second process allocates UMEM.
+ 7. Second process binds socket to the interface with bind(...).
+ 8. Second process sends/receives the traffic.
+
+All the steps above are possible today if the first process is privileged
+and the second one has sufficient RLIMIT_MEMLOCK and no capabilities.
+However, the second process will be able to bind the socket to any interface
+it wants on step 7 and send traffic from it. With the proposed change, the
+second process will be able to bind the socket only to a specific interface
+chosen by the first process at step 4.
+
+Fixes: 965a99098443 ("xsk: add support for bind for Rx")
+Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Magnus Karlsson <magnus.karlsson@intel.com>
+Acked-by: John Fastabend <john.fastabend@gmail.com>
+Acked-by: Jason Wang <jasowang@redhat.com>
+Link: https://lore.kernel.org/bpf/20230703175329.3259672-1-i.maximets@ovn.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/networking/af_xdp.rst | 9 +++++++++
+ net/xdp/xsk.c | 5 +++++
+ 2 files changed, 14 insertions(+)
+
+diff --git a/Documentation/networking/af_xdp.rst b/Documentation/networking/af_xdp.rst
+index 247c6c4127e94..1cc35de336a41 100644
+--- a/Documentation/networking/af_xdp.rst
++++ b/Documentation/networking/af_xdp.rst
+@@ -433,6 +433,15 @@ start N bytes into the buffer leaving the first N bytes for the
+ application to use. The final option is the flags field, but it will
+ be dealt with in separate sections for each UMEM flag.
+
++SO_BINDTODEVICE setsockopt
++--------------------------
++
++This is a generic SOL_SOCKET option that can be used to tie AF_XDP
++socket to a particular network interface. It is useful when a socket
++is created by a privileged process and passed to a non-privileged one.
++Once the option is set, kernel will refuse attempts to bind that socket
++to a different interface. Updating the value requires CAP_NET_RAW.
++
+ XDP_STATISTICS getsockopt
+ -------------------------
+
+diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c
+index cc1e7f15fa731..32dd55b9ce8a8 100644
+--- a/net/xdp/xsk.c
++++ b/net/xdp/xsk.c
+@@ -886,6 +886,7 @@ static int xsk_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
+ struct sock *sk = sock->sk;
+ struct xdp_sock *xs = xdp_sk(sk);
+ struct net_device *dev;
++ int bound_dev_if;
+ u32 flags, qid;
+ int err = 0;
+
+@@ -899,6 +900,10 @@ static int xsk_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
+ XDP_USE_NEED_WAKEUP))
+ return -EINVAL;
+
++ bound_dev_if = READ_ONCE(sk->sk_bound_dev_if);
++ if (bound_dev_if && bound_dev_if != sxdp->sxdp_ifindex)
++ return -EINVAL;
++
+ rtnl_lock();
+ mutex_lock(&xs->mutex);
+ if (xs->state != XSK_READY) {
+--
+2.39.2
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
