From e002c9e3ff9dfb5bccd601cd7674ba3908c71ba1 Mon Sep 17 00:00:00 2001
From: Sasha Levin <sashal@kernel.org>
Date: Sat, 20 Jan 2024 19:19:15 -0500
Subject: [PATCH] Fixes for 6.1

Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 ...-fix-information-leak-in-sec_attest_.patch |  39 ++
 ...r-extended-error-log-status-when-ras.patch |  48 +++
 ...it-avoid-u32-multiplication-overflow.patch |  40 ++
 ...x-the-fractional-clock-divider-flags.patch |  40 ++
 ...-for-error-while-searching-for-backl.patch |  54 +++
 ...add-clamp-in-scarlett2_mixer_ctl_put.patch |  39 ++
 ...dd-missing-error-check-to-scarlett2_.patch |  44 ++
 ...sing-error-check-to-scarlett2_.patch-19676 |  42 ++
 ...add-missing-error-checks-to-_ctl_get.patch | 356 ++++++++++++++++
 ...llow-passing-any-output-to-line_out_.patch |  83 ++++
 ...nci-always-select-config_cpu_arm926t.patch |  39 ++
 ...q8064-correct-xoadc-register-address.patch |  40 ++
 ...ts-qcom-sdx65-correct-spmi-node-name.patch |  39 ++
 ...n-t-mix-scmi-and-non-scmi-board-comp.patch |  86 ++++
 ...con-hikey970-pmic-fix-regulator-cell.patch |  37 ++
 ...s-imx8mm-reduce-gpu-to-nominal-speed.patch |  51 +++
 ...ek-mt8183-correct-mdp3-dma-related-n.patch |  62 +++
 ...pq6018-fix-clock-rates-for-gcc_usb0_.patch |  41 ++
 ...-dts-qcom-ipq6018-fix-up-indentation.patch | 121 ++++++
 ...pq6018-improve-pcie-phy-pcs-reg-tabl.patch |  43 ++
 ...pq6018-pad-addresses-to-8-hex-digits.patch | 114 ++++++
 ...4-dts-qcom-ipq6018-use-lowercase-hex.patch |  64 +++
 ...rb5165-rb5-correct-led-panic-indicat.patch |  42 ++
 ...c7180-make-watchdog-bark-interrupt-e.patch |  58 +++
 ...rm64-dts-qcom-sc7280-fix-up-gpu-sids.patch |  44 ++
 ...c7280-fix-usb_2-wakeup-interrupt-typ.patch |  43 ++
 ...c7280-make-watchdog-bark-interrupt-e.patch |  40 ++
 ...c7280-mark-adreno-smmu-as-dma-cohere.patch |  37 ++
 ...c7280-mark-sdhci-hosts-as-cache-cohe.patch |  44 ++
 ...m-sc7280-mark-some-nodes-as-reserved.patch | 126 ++++++
 ...c8280xp-make-watchdog-bark-interrupt.patch |  41 ++
 ...dm845-db845c-correct-led-panic-indic.patch |  41 ++
 ...dm845-make-watchdog-bark-interrupt-e.patch |  40 ++
 ...m6350-make-watchdog-bark-interrupt-e.patch |  40 ++
 ...com-sm8150-hdk-fix-ss-usb-regulators.patch |  70 ++++
 ...m8150-make-watchdog-bark-interrupt-e.patch |  40 ++
 ...m8250-make-watchdog-bark-interrupt-e.patch |  40 ++
 ...m64-dts-qcom-sm8350-fix-dma0-address.patch |  42 ++
 ...s-white-hawk-cpu-fix-missing-serial-.patch |  39 ++
 ...am62a-main-fix-gpio-pin-count-in-dt-.patch |  47 +++
 ...3-am65-main-fix-dss-irq-trigger-type.patch |  47 +++
 ...ix-gpio-name-and-drop-legacy-include.patch |  64 +++
 ...ix-gpio-name-and-drop-legacy-include.patch |  65 +++
 ...t5682_max98357a-fix-board-id-mismatc.patch |  67 +++
 ...-double-ef20-entry-from-dmi_platform.patch |  53 +++
 ...of-minors-and-first_minor-in-device_.patch |  45 ++
 ...ck-make-blk_def_max_sectors-unsigned.patch |  75 ++++
 ...oc_noio-to-false-on-device_add_disk-.patch |  39 ++
 ...r-fix-reference-leak-of-pnfs_device_.patch |  37 ++
 ...-btmtkuart-fix-recv_buf-return-value.patch |  68 ++++
 ...gus-check-for-re-auth-no-supported-w.patch |  88 ++++
 ...d-crosstask-check-to-__bpf_get_stack.patch | 121 ++++++
 ...need_defer-parameters-to-.map_fd_put.patch | 174 ++++++++
 ...tats-for-bpf_map-elements-insertions.patch |  77 ++++
 ...the-free-of-inner-map-when-necessary.patch | 141 +++++++
 ...e-precision-of-r0-on-callback-return.patch |  46 +++
 ...r-attempt-to-corrupt-spilled-pointer.patch |  42 ++
 ...tion-of-indirect-var-off-stack-acces.patch |  83 ++++
 ...-check-prefixlen-before-walking-trie.patch |  43 ++
 ...proto-update-hook-to-avoid-dup-calls.patch |  81 ++++
 ...mory-leak-in-netlbl_calipso_add_pass.patch | 138 +++++++
 ...ix-clk_hw_register_fixed_rate_with_a.patch |  43 ++
 ...sm8150-update-the-gpu_cc_pll1-config.patch |  40 ++
 ...-sm8150-add-missing-pll-config-prope.patch |  37 ++
 ...occ-sm8150-update-the-videocc-resets.patch |  41 ++
 ...-rzg2l-check-reset-monitor-registers.patch | 138 +++++++
 ...2l-cpg-reuse-code-in-rzg2l_cpg_reset.patch |  82 ++++
 ...n-error-code-problem-in-si5341_outpu.patch |  41 ++
 ...cess-the-result-of-devm_of_clk_add_h.patch |  43 ++
 ...roperty_present-for-testing-dt-prope.patch | 105 +++++
 ...sallow-multiple-in-flight-aio-reques.patch |  85 ++++
 ...-fix-memleak-in-ccp_init_dm_workarea.patch |  45 ++
 ...-hpre-save-capability-registers-in-p.patch | 211 ++++++++++
 ...con-qm-add-a-function-to-set-qm-algs.patch | 385 ++++++++++++++++++
 ...-qm-save-capability-registers-in-qm-.patch | 257 ++++++++++++
 ...-sec2-save-capability-registers-in-p.patch | 152 +++++++
 ...-zip-add-zip-comp-high-perf-mode-con.patch | 125 ++++++
 ...-zip-save-capability-registers-in-pr.patch | 159 ++++++++
 ...urn-crypto_aead_setkey-to-transfer-t.patch |  38 ++
 ...add-error-handling-for-dma_map_sg-ca.patch |  72 ++++
 ...oid-skcipher-fallback-code-duplicati.patch | 148 +++++++
 ...-not-resize-req-src-when-doing-hash-.patch |  99 +++++
 .../crypto-sahara-fix-ahash-reqsize.patch     |  37 ++
 ...to-sahara-fix-ahash-selftest-failure.patch |  41 ++
 ...ypto-sahara-fix-cbc-selftest-failure.patch |  94 +++++
 ...x-error-handling-in-sahara_hw_descri.patch |  54 +++
 ...x-processing-hash-requests-with-req-.patch |  56 +++
 ...x-processing-requests-with-cryptlen-.patch |  72 ++++
 ...x-wait_for_completion_timeout-error-.patch |  70 ++++
 ...hara-handle-zero-length-aes-requests.patch |  36 ++
 ...prove-error-handling-in-sahara_sha_p.patch |  51 +++
 ...to-sahara-remove-flags_new_key-logic.patch | 105 +++++
 ...to-scomp-fix-req-dst-buffer-overflow.patch |  57 +++
 ...rtio-handle-dataq-logic-with-tasklet.patch |  99 +++++
 ...it-for-tasklet-to-complete-on-device.patch |  43 ++
 ...jump_label_transform_static-override.patch |  45 ++
 ...r-dev-dma_mem-to-null-after-freeing-.patch |  44 ++
 ...ve-config_sysfs_deprecated-and-confi.patch | 278 +++++++++++++
 ...ix-a-use-after-free-in-kv_parse_powe.patch |  48 +++
 ...lk-zynqmp-calculate-closest-mux-rate.patch |  61 +++
 ...nqmp-update-divider-round-rate-logic.patch | 121 ++++++
 ...-double-free-in-amdgpu_parse_extende.patch | 198 +++++++++
 ...-pm-fix-a-double-free-in-si_dpm_init.patch |  45 ++
 ...fix-a-memleak-in-smu7_hwmgr_backend_.patch |  53 +++
 ...fs-fix-error-code-when-smc-register-.patch |  48 +++
 ...rm-list-is-non-empty-before-utilizin.patch |  81 ++++
 ...mhdp8546-fix-use-of-uninitialized-va.patch |  38 ++
 ...fix-typo-in-post_disable-description.patch |  36 ++
 ...58767-fix-return-value-on-error-case.patch |  39 ++
 ...s015-drop-buggy-__exit-annotation-fo.patch |  52 +++
 ...e-errors-from-drm_modeset_register_a.patch |  54 +++
 ...add-phy_mtk_dp-module-as-pre-depende.patch |  48 +++
 ...-underrun-in-vdo1-when-switches-off-.patch |  41 ++
 ...urn-error-if-mdp-rdma-failed-to-enab.patch |  41 ++
 ...-enable-and-frame_count-parameters-f.patch | 246 +++++++++++
 ...m-msm-dpu-set-input_sel-bit-for-intf.patch | 100 +++++
 ...pm_runtime_resume_and_get-to-prevent.patch |  43 ++
 ...m-mdp4-flush-vblank-event-on-disable.patch |  53 +++
 ...e-fix-warning-directly-dereferencing.patch |  58 +++
 ...kd35t133-hold-panel-in-reset-for-unp.patch |  42 ++
 ...rm-panel-st7701-fix-avcl-calculation.patch |  46 +++
 ...ore-core_mask-for-poweroff-and-disab.patch |  84 ++++
 ...lly-power-off-gpu-cores-in-panfrost_.patch | 127 ++++++
 ...eck-return-value-of-radeon_ring_lock.patch |  42 ++
 ...-the-alloc_workqueue-return-value-in.patch |  46 +++
 ...ix-a-memleak-in-sumo_parse_power_tab.patch |  41 ++
 ...fix-integer-overflow-issues-in-r100_.patch |  52 +++
 ...cs-fix-possible-int-overflows-in-r60.patch |  51 +++
 ...ty_dpm-fix-a-memleak-in-trinity_pars.patch |  41 ++
 ...-check-for-k2g-in-in-dispc_softreset.patch |  57 +++
 queue-6.1/drm-tidss-fix-dss-reset.patch       | 106 +++++
 ...-move-reset-to-the-end-of-dispc_init.patch |  55 +++
 ...turn-error-value-from-from-softreset.patch |  66 +++
 .../drm-tilcdc-fix-irq-free-on-unload.patch   |  40 ++
 ...k-update-the-videocc-resets-for-sm81.patch |  40 ++
 ...a-mediatek-mdp3-correct-rdma-and-wro.patch | 125 ++++++
 ...x-possible-out-of-bounds-string-acce.patch |  91 +++++
 ...o-when-remounting-if-setvariable-is-.patch | 108 +++++
 .../efivarfs-free-s_fs_info-on-unmount.patch  |  40 ++
 ...ry-leak-on-short-lived-bounced-pages.patch |  50 +++
 .../f2fs-fix-to-avoid-dirent-corruption.patch |  60 +++
 ...k-compress-file-in-f2fs_move_file_ra.patch |  40 ++
 ...k-return-value-of-f2fs_recover_xattr.patch |  70 ++++
 ...te-iostat-correctly-in-f2fs_filemap_.patch |  36 ++
 ...-on-block-writeback-for-post_read-ca.patch |  69 ++++
 .../fbdev-imxfb-fix-left-margin-setting.patch | 121 ++++++
 ...m-populate-platform-devices-from-sm-.patch |  51 +++
 ...fix-an-off-by-one-in-ti_sci_debugfs_.patch |  55 +++
 ...equest-originates-from-old-mount-api.patch |  61 +++
 ...null-pointer-dereference-in-gfs2_rgr.patch |  40 ++
 ...n-fix-two-memleaks-in-radeon_vm_init.patch |  48 +++
 ...b-iser-prevent-invalidating-wrong-mr.patch | 133 ++++++
 ...exthdr_fragment-handling-in-ip6_tnl_.patch | 173 ++++++++
 ...-ip_pktinfo-on-cache-report-igmp-msg.patch |  72 ++++
 .../keys-encrypted-add-check-for-strsep.patch |  37 ++
 ...ixer-test-fix-the-number-of-paramete.patch |  58 +++
 ...ixer-test-fix-the-print-format-speci.patch |  64 +++
 ...date-the-zero-field-of-packet-header.patch |  48 +++
 ...x-unchecked-dereference-in-debugfs_p.patch |  50 +++
 ....c-add-header-file-to-fix-build-erro.patch |  44 ++
 ...-flush-io-with-array-reconfiguration.patch |  96 +++++
 ...x-fix-a-memleak-in-cx231xx_init_isoc.patch |  51 +++
 ...s-media-rkisp1-fix-the-port-descript.patch |  54 +++
 ...nds-m88ds3103-fix-a-memory-leak-in-a.patch |  54 +++
 ...p-refcount-on-error-path-in-dvb_devi.patch |  35 ++
 ...pi-csis-fix-clock-handling-in-remove.patch |  46 +++
 ...emove-cancel-worker-in-mtk_jpeg_remo.patch |  43 ++
 ...pegdec-export-jpeg-decoder-functions.patch |  71 ++++
 ...x-use-after-free-on-context-disconne.patch |  46 +++
 ...-rkisp1-fix-media-device-memory-leak.patch |  57 +++
 ...k-the-try_-decoder_cmd-stateless-ioc.patch |  42 ++
 ...n-hook-the-try_-decoder_cmd-stateles.patch |  56 +++
 ...ble-the-gige-port-in-mlxbf_gige_open.patch |  68 ++++
 ...bf_gige-fix-intermittent-no-ip-issue.patch |  92 +++++
 ...-sdhci_am654-fix-ti-soc-dependencies.patch |  48 +++
 ...c-sdhci_omap-fix-ti-soc-dependencies.patch |  48 +++
 ...ull-pointer-dereference-caused-by-ft.patch |  85 ++++
 ...ement-ifc_timeout_msecs-for-nand-con.patch |  49 +++
 ...-netlink-major-minor-version-numbers.patch | 202 +++++++++
 ...-fix-skb-leak-and-crash-on-ooo-frags.patch | 149 +++++++
 ...les-mark-newset-as-dead-on-transacti.patch |  50 +++
 ...ure-we-handle-the-error-nfs4err_retu.patch |  53 +++
 ...ap-max_hw_sectors-to-blk_def_max_sec.patch |  59 +++
 .../of-add-of_property_present-helper.patch   |  61 +++
 ...ee-in-of_parse_phandle_with_args_map.patch | 231 +++++++++++
 ...of_count_phandle_with_args-expected-.patch |  38 ++
 ...el-vsec-enhance-and-export-intel_vse.patch | 109 +++++
 ...-intel-vsec-fix-xa_alloc-memory-leak.patch | 105 +++++
 ...-x86-intel-vsec-support-private-data.patch |  45 ++
 ...el-vsec-use-mutex-for-ida_alloc-and-.patch |  69 ++++
 ...s-block-driver-s-calculation-of-layo.patch |  92 +++++
 ...powerpc-44x-select-i2c-for-currituck.patch |  43 ++
 ...avres.o-to-always-y-instead-of-extra.patch |  50 +++
 ...add-a-null-pointer-check-in-update_e.patch |  55 +++
 ...add-a-null-pointer-check-in-opal_eve.patch |  37 ++
 ...add-a-null-pointer-check-in-opal_pow.patch |  41 ++
 ...add-a-null-pointer-check-to-scom_deb.patch |  41 ++
 ...memhp-fix-access-beyond-end-of-drmem.patch | 101 +++++
 ...-checks-for-binutils-older-than-2.25.patch |  96 +++++
 ...fix-possible-overflow-in-persistent_.patch |  46 +++
 ...2-fix-enable-count-for-clk-in-.probe.patch |  80 ++++
 ...eight32-in-stm32_pwm_detect_channels.patch |  66 +++
 ...gmap_clear_bits-and-regmap_set_bits-.patch | 150 +++++++
 ...sks-provide-rcu_trace_implies_rcu_gp.patch |  67 +++
 ...ppropriate-err-code-for-unsupported-.patch |  52 +++
 ...-hns-fix-memory-leak-in-free_mr_init.patch |  40 ++
 ...ce-uninitialized-symbol-smatch-warni.patch |  82 ++++
 ...rm-annotate-dma-fence-critical-secti.patch | 191 +++++++++
 ...-annotate-dma-fence-critical-section.patch | 176 ++++++++
 ...-fnic-return-error-if-vmalloc-failed.patch |  44 ++
 ...rrect-the-number-of-global-debugfs-r.patch |  42 ++
 ...place-with-standard-error-code-retur.patch |  63 +++
 ...llback-some-operations-if-flr-failed.patch |  55 +++
 queue-6.1/sctp-fix-busy-polling.patch         |  54 +++
 ...support-msg_errqueue-flag-in-recvmsg.patch |  59 +++
 ...-bpf-fix-erroneous-bitmask-operation.patch |  52 +++
 ...lax-time_tai-test-for-equal-timestam.patch |  53 +++
 ...x-grep-checking-for-fib_nexthop_mult.patch |  68 ++++
 ...specify-the-interface-when-do-arping.patch |  48 +++
 ...c-fix-error-handling-in-fpu-vmx-pree.patch |  88 ++++
 ...r-priority-for-bind-with-af_unspec-o.patch |  55 +++
 queue-6.1/series                              | 249 +++++++++++
 ...x-dis_cap_alloc-and-retain_on_pc-con.patch |  69 ++++
 ...siof-enforce-fixed-dtdl-for-r-car-h3.patch |  80 ++++
 ...qspi-fix-driver-kconfig-dependencies.patch |  42 ++
 ...xprt_switch_find_current_entry-logic.patch |  35 ++
 ...-logic-which-reduces-credit-update-m.patch |  69 ++++
 ...35_wdt-fix-wdioc_settimeout-handling.patch |  57 +++
 ...t-only-claim-unknown-nmi-if-from-ilo.patch |  51 +++
 ...-drop-runtime-pm-reference-count-whe.patch |  72 ++++
 ...atchdog-set-cdev-owner-before-adding.patch |  61 +++
 ...fi-ath11k-defer-on-rproc_get-failure.patch |  57 +++
 ...ifi-mvm-send-tx-path-flush-in-rfkill.patch |  42 ++
 ...-set-siso-mimo-chains-to-1-in-fw-smp.patch |  49 +++
 .../wifi-libertas-stop-selecting-wext.patch   |  37 ++
 ...-fix-country-count-limitation-for-cl.patch |  60 +++
 ...s-fix-workqueue-problem-causes-sta-a.patch | 180 ++++++++
 ...k-for-allocation-failure-in-plfxlc_u.patch |  41 ++
 ...wifi-rtlwifi-add-calculate_bit_shift.patch |  43 ++
 ...8188ee-phy-using-calculate_bit_shift.patch |  77 ++++
 ...i-rtl8192c-using-calculate_bit_shift.patch |  74 ++++
 ...-rtl8192ce-using-calculate_bit_shift.patch |  68 ++++
 ...-rtl8192cu-using-calculate_bit_shift.patch |  55 +++
 ...-rtl8192de-using-calculate_bit_shift.patch |  78 ++++
 ...-rtl8192ee-using-calculate_bit_shift.patch |  86 ++++
 ...-rtl8192se-using-calculate_bit_shift.patch |  78 ++++
 ...8821ae-phy-fix-an-undefined-bitwise-.patch |  59 +++
 ...8-fix-rx-filter-in-fif_allmulti-flag.patch |  42 ++
 ...ib-fix-overflow-when-counting-digits.patch |  66 +++
 ...6-mce-inject-clear-test-status-value.patch |  57 +++
 250 files changed, 18135 insertions(+)
 create mode 100644 queue-6.1/accel-habanalabs-fix-information-leak-in-sec_attest_.patch
 create mode 100644 queue-6.1/acpi-extlog-clear-extended-error-log-status-when-ras.patch
 create mode 100644 queue-6.1/acpi-lpit-avoid-u32-multiplication-overflow.patch
 create mode 100644 queue-6.1/acpi-lpss-fix-the-fractional-clock-divider-flags.patch
 create mode 100644 queue-6.1/acpi-video-check-for-error-while-searching-for-backl.patch
 create mode 100644 queue-6.1/alsa-scarlett2-add-clamp-in-scarlett2_mixer_ctl_put.patch
 create mode 100644 queue-6.1/alsa-scarlett2-add-missing-error-check-to-scarlett2_.patch
 create mode 100644 queue-6.1/alsa-scarlett2-add-missing-error-check-to-scarlett2_.patch-19676
 create mode 100644 queue-6.1/alsa-scarlett2-add-missing-error-checks-to-_ctl_get.patch
 create mode 100644 queue-6.1/alsa-scarlett2-allow-passing-any-output-to-line_out_.patch
 create mode 100644 queue-6.1/arm-davinci-always-select-config_cpu_arm926t.patch
 create mode 100644 queue-6.1/arm-dts-qcom-apq8064-correct-xoadc-register-address.patch
 create mode 100644 queue-6.1/arm-dts-qcom-sdx65-correct-spmi-node-name.patch
 create mode 100644 queue-6.1/arm-dts-stm32-don-t-mix-scmi-and-non-scmi-board-comp.patch
 create mode 100644 queue-6.1/arm64-dts-hisilicon-hikey970-pmic-fix-regulator-cell.patch
 create mode 100644 queue-6.1/arm64-dts-imx8mm-reduce-gpu-to-nominal-speed.patch
 create mode 100644 queue-6.1/arm64-dts-mediatek-mt8183-correct-mdp3-dma-related-n.patch
 create mode 100644 queue-6.1/arm64-dts-qcom-ipq6018-fix-clock-rates-for-gcc_usb0_.patch
 create mode 100644 queue-6.1/arm64-dts-qcom-ipq6018-fix-up-indentation.patch
 create mode 100644 queue-6.1/arm64-dts-qcom-ipq6018-improve-pcie-phy-pcs-reg-tabl.patch
 create mode 100644 queue-6.1/arm64-dts-qcom-ipq6018-pad-addresses-to-8-hex-digits.patch
 create mode 100644 queue-6.1/arm64-dts-qcom-ipq6018-use-lowercase-hex.patch
 create mode 100644 queue-6.1/arm64-dts-qcom-qrb5165-rb5-correct-led-panic-indicat.patch
 create mode 100644 queue-6.1/arm64-dts-qcom-sc7180-make-watchdog-bark-interrupt-e.patch
 create mode 100644 queue-6.1/arm64-dts-qcom-sc7280-fix-up-gpu-sids.patch
 create mode 100644 queue-6.1/arm64-dts-qcom-sc7280-fix-usb_2-wakeup-interrupt-typ.patch
 create mode 100644 queue-6.1/arm64-dts-qcom-sc7280-make-watchdog-bark-interrupt-e.patch
 create mode 100644 queue-6.1/arm64-dts-qcom-sc7280-mark-adreno-smmu-as-dma-cohere.patch
 create mode 100644 queue-6.1/arm64-dts-qcom-sc7280-mark-sdhci-hosts-as-cache-cohe.patch
 create mode 100644 queue-6.1/arm64-dts-qcom-sc7280-mark-some-nodes-as-reserved.patch
 create mode 100644 queue-6.1/arm64-dts-qcom-sc8280xp-make-watchdog-bark-interrupt.patch
 create mode 100644 queue-6.1/arm64-dts-qcom-sdm845-db845c-correct-led-panic-indic.patch
 create mode 100644 queue-6.1/arm64-dts-qcom-sdm845-make-watchdog-bark-interrupt-e.patch
 create mode 100644 queue-6.1/arm64-dts-qcom-sm6350-make-watchdog-bark-interrupt-e.patch
 create mode 100644 queue-6.1/arm64-dts-qcom-sm8150-hdk-fix-ss-usb-regulators.patch
 create mode 100644 queue-6.1/arm64-dts-qcom-sm8150-make-watchdog-bark-interrupt-e.patch
 create mode 100644 queue-6.1/arm64-dts-qcom-sm8250-make-watchdog-bark-interrupt-e.patch
 create mode 100644 queue-6.1/arm64-dts-qcom-sm8350-fix-dma0-address.patch
 create mode 100644 queue-6.1/arm64-dts-renesas-white-hawk-cpu-fix-missing-serial-.patch
 create mode 100644 queue-6.1/arm64-dts-ti-k3-am62a-main-fix-gpio-pin-count-in-dt-.patch
 create mode 100644 queue-6.1/arm64-dts-ti-k3-am65-main-fix-dss-irq-trigger-type.patch
 create mode 100644 queue-6.1/asoc-cs35l33-fix-gpio-name-and-drop-legacy-include.patch
 create mode 100644 queue-6.1/asoc-cs35l34-fix-gpio-name-and-drop-legacy-include.patch
 create mode 100644 queue-6.1/asoc-intel-glk_rt5682_max98357a-fix-board-id-mismatc.patch
 create mode 100644 queue-6.1/asoc-rt5645-drop-double-ef20-entry-from-dmi_platform.patch
 create mode 100644 queue-6.1/block-add-check-of-minors-and-first_minor-in-device_.patch
 create mode 100644 queue-6.1/block-make-blk_def_max_sectors-unsigned.patch
 create mode 100644 queue-6.1/block-set-memalloc_noio-to-false-on-device_add_disk-.patch
 create mode 100644 queue-6.1/blocklayoutdriver-fix-reference-leak-of-pnfs_device_.patch
 create mode 100644 queue-6.1/bluetooth-btmtkuart-fix-recv_buf-return-value.patch
 create mode 100644 queue-6.1/bluetooth-fix-bogus-check-for-re-auth-no-supported-w.patch
 create mode 100644 queue-6.1/bpf-add-crosstask-check-to-__bpf_get_stack.patch
 create mode 100644 queue-6.1/bpf-add-map-and-need_defer-parameters-to-.map_fd_put.patch
 create mode 100644 queue-6.1/bpf-add-percpu-stats-for-bpf_map-elements-insertions.patch
 create mode 100644 queue-6.1/bpf-defer-the-free-of-inner-map-when-necessary.patch
 create mode 100644 queue-6.1/bpf-enforce-precision-of-r0-on-callback-return.patch
 create mode 100644 queue-6.1/bpf-fix-check-for-attempt-to-corrupt-spilled-pointer.patch
 create mode 100644 queue-6.1/bpf-fix-verification-of-indirect-var-off-stack-acces.patch
 create mode 100644 queue-6.1/bpf-lpm-fix-check-prefixlen-before-walking-trie.patch
 create mode 100644 queue-6.1/bpf-sockmap-fix-proto-update-hook-to-avoid-dup-calls.patch
 create mode 100644 queue-6.1/calipso-fix-memory-leak-in-netlbl_calipso_add_pass.patch
 create mode 100644 queue-6.1/clk-fixed-rate-fix-clk_hw_register_fixed_rate_with_a.patch
 create mode 100644 queue-6.1/clk-qcom-gpucc-sm8150-update-the-gpu_cc_pll1-config.patch
 create mode 100644 queue-6.1/clk-qcom-videocc-sm8150-add-missing-pll-config-prope.patch
 create mode 100644 queue-6.1/clk-qcom-videocc-sm8150-update-the-videocc-resets.patch
 create mode 100644 queue-6.1/clk-renesas-rzg2l-check-reset-monitor-registers.patch
 create mode 100644 queue-6.1/clk-renesas-rzg2l-cpg-reuse-code-in-rzg2l_cpg_reset.patch
 create mode 100644 queue-6.1/clk-si5341-fix-an-error-code-problem-in-si5341_outpu.patch
 create mode 100644 queue-6.1/cpufreq-scmi-process-the-result-of-devm_of_clk_add_h.patch
 create mode 100644 queue-6.1/cpufreq-use-of_property_present-for-testing-dt-prope.patch
 create mode 100644 queue-6.1/crypto-af_alg-disallow-multiple-in-flight-aio-reques.patch
 create mode 100644 queue-6.1/crypto-ccp-fix-memleak-in-ccp_init_dm_workarea.patch
 create mode 100644 queue-6.1/crypto-hisilicon-hpre-save-capability-registers-in-p.patch
 create mode 100644 queue-6.1/crypto-hisilicon-qm-add-a-function-to-set-qm-algs.patch
 create mode 100644 queue-6.1/crypto-hisilicon-qm-save-capability-registers-in-qm-.patch
 create mode 100644 queue-6.1/crypto-hisilicon-sec2-save-capability-registers-in-p.patch
 create mode 100644 queue-6.1/crypto-hisilicon-zip-add-zip-comp-high-perf-mode-con.patch
 create mode 100644 queue-6.1/crypto-hisilicon-zip-save-capability-registers-in-pr.patch
 create mode 100644 queue-6.1/crypto-sa2ul-return-crypto_aead_setkey-to-transfer-t.patch
 create mode 100644 queue-6.1/crypto-safexcel-add-error-handling-for-dma_map_sg-ca.patch
 create mode 100644 queue-6.1/crypto-sahara-avoid-skcipher-fallback-code-duplicati.patch
 create mode 100644 queue-6.1/crypto-sahara-do-not-resize-req-src-when-doing-hash-.patch
 create mode 100644 queue-6.1/crypto-sahara-fix-ahash-reqsize.patch
 create mode 100644 queue-6.1/crypto-sahara-fix-ahash-selftest-failure.patch
 create mode 100644 queue-6.1/crypto-sahara-fix-cbc-selftest-failure.patch
 create mode 100644 queue-6.1/crypto-sahara-fix-error-handling-in-sahara_hw_descri.patch
 create mode 100644 queue-6.1/crypto-sahara-fix-processing-hash-requests-with-req-.patch
 create mode 100644 queue-6.1/crypto-sahara-fix-processing-requests-with-cryptlen-.patch
 create mode 100644 queue-6.1/crypto-sahara-fix-wait_for_completion_timeout-error-.patch
 create mode 100644 queue-6.1/crypto-sahara-handle-zero-length-aes-requests.patch
 create mode 100644 queue-6.1/crypto-sahara-improve-error-handling-in-sahara_sha_p.patch
 create mode 100644 queue-6.1/crypto-sahara-remove-flags_new_key-logic.patch
 create mode 100644 queue-6.1/crypto-scomp-fix-req-dst-buffer-overflow.patch
 create mode 100644 queue-6.1/crypto-virtio-handle-dataq-logic-with-tasklet.patch
 create mode 100644 queue-6.1/crypto-virtio-wait-for-tasklet-to-complete-on-device.patch
 create mode 100644 queue-6.1/csky-fix-arch_jump_label_transform_static-override.patch
 create mode 100644 queue-6.1/dma-mapping-clear-dev-dma_mem-to-null-after-freeing-.patch
 create mode 100644 queue-6.1/driver-core-remove-config_sysfs_deprecated-and-confi.patch
 create mode 100644 queue-6.1/drivers-amd-pm-fix-a-use-after-free-in-kv_parse_powe.patch
 create mode 100644 queue-6.1/drivers-clk-zynqmp-calculate-closest-mux-rate.patch
 create mode 100644 queue-6.1/drivers-clk-zynqmp-update-divider-round-rate-logic.patch
 create mode 100644 queue-6.1/drm-amd-pm-fix-a-double-free-in-amdgpu_parse_extende.patch
 create mode 100644 queue-6.1/drm-amd-pm-fix-a-double-free-in-si_dpm_init.patch
 create mode 100644 queue-6.1/drm-amd-pm-smu7-fix-a-memleak-in-smu7_hwmgr_backend_.patch
 create mode 100644 queue-6.1/drm-amdgpu-debugfs-fix-error-code-when-smc-register-.patch
 create mode 100644 queue-6.1/drm-amdkfd-confirm-list-is-non-empty-before-utilizin.patch
 create mode 100644 queue-6.1/drm-bridge-cdns-mhdp8546-fix-use-of-uninitialized-va.patch
 create mode 100644 queue-6.1/drm-bridge-fix-typo-in-post_disable-description.patch
 create mode 100644 queue-6.1/drm-bridge-tc358767-fix-return-value-on-error-case.patch
 create mode 100644 queue-6.1/drm-bridge-tpd12s015-drop-buggy-__exit-annotation-fo.patch
 create mode 100644 queue-6.1/drm-drv-propagate-errors-from-drm_modeset_register_a.patch
 create mode 100644 queue-6.1/drm-mediatek-dp-add-phy_mtk_dp-module-as-pre-depende.patch
 create mode 100644 queue-6.1/drm-mediatek-fix-underrun-in-vdo1-when-switches-off-.patch
 create mode 100644 queue-6.1/drm-mediatek-return-error-if-mdp-rdma-failed-to-enab.patch
 create mode 100644 queue-6.1/drm-msm-dpu-drop-enable-and-frame_count-parameters-f.patch
 create mode 100644 queue-6.1/drm-msm-dpu-set-input_sel-bit-for-intf.patch
 create mode 100644 queue-6.1/drm-msm-dsi-use-pm_runtime_resume_and_get-to-prevent.patch
 create mode 100644 queue-6.1/drm-msm-mdp4-flush-vblank-event-on-disable.patch
 create mode 100644 queue-6.1/drm-nouveau-fence-fix-warning-directly-dereferencing.patch
 create mode 100644 queue-6.1/drm-panel-elida-kd35t133-hold-panel-in-reset-for-unp.patch
 create mode 100644 queue-6.1/drm-panel-st7701-fix-avcl-calculation.patch
 create mode 100644 queue-6.1/drm-panfrost-ignore-core_mask-for-poweroff-and-disab.patch
 create mode 100644 queue-6.1/drm-panfrost-really-power-off-gpu-cores-in-panfrost_.patch
 create mode 100644 queue-6.1/drm-radeon-check-return-value-of-radeon_ring_lock.patch
 create mode 100644 queue-6.1/drm-radeon-check-the-alloc_workqueue-return-value-in.patch
 create mode 100644 queue-6.1/drm-radeon-dpm-fix-a-memleak-in-sumo_parse_power_tab.patch
 create mode 100644 queue-6.1/drm-radeon-r100-fix-integer-overflow-issues-in-r100_.patch
 create mode 100644 queue-6.1/drm-radeon-r600_cs-fix-possible-int-overflows-in-r60.patch
 create mode 100644 queue-6.1/drm-radeon-trinity_dpm-fix-a-memleak-in-trinity_pars.patch
 create mode 100644 queue-6.1/drm-tidss-check-for-k2g-in-in-dispc_softreset.patch
 create mode 100644 queue-6.1/drm-tidss-fix-dss-reset.patch
 create mode 100644 queue-6.1/drm-tidss-move-reset-to-the-end-of-dispc_init.patch
 create mode 100644 queue-6.1/drm-tidss-return-error-value-from-from-softreset.patch
 create mode 100644 queue-6.1/drm-tilcdc-fix-irq-free-on-unload.patch
 create mode 100644 queue-6.1/dt-bindings-clock-update-the-videocc-resets-for-sm81.patch
 create mode 100644 queue-6.1/dt-bindings-media-mediatek-mdp3-correct-rdma-and-wro.patch
 create mode 100644 queue-6.1/edac-thunderx-fix-possible-out-of-bounds-string-acce.patch
 create mode 100644 queue-6.1/efivarfs-force-ro-when-remounting-if-setvariable-is-.patch
 create mode 100644 queue-6.1/efivarfs-free-s_fs_info-on-unmount.patch
 create mode 100644 queue-6.1/erofs-fix-memory-leak-on-short-lived-bounced-pages.patch
 create mode 100644 queue-6.1/f2fs-fix-to-avoid-dirent-corruption.patch
 create mode 100644 queue-6.1/f2fs-fix-to-check-compress-file-in-f2fs_move_file_ra.patch
 create mode 100644 queue-6.1/f2fs-fix-to-check-return-value-of-f2fs_recover_xattr.patch
 create mode 100644 queue-6.1/f2fs-fix-to-update-iostat-correctly-in-f2fs_filemap_.patch
 create mode 100644 queue-6.1/f2fs-fix-to-wait-on-block-writeback-for-post_read-ca.patch
 create mode 100644 queue-6.1/fbdev-imxfb-fix-left-margin-setting.patch
 create mode 100644 queue-6.1/firmware-meson_sm-populate-platform-devices-from-sm-.patch
 create mode 100644 queue-6.1/firmware-ti_sci-fix-an-off-by-one-in-ti_sci_debugfs_.patch
 create mode 100644 queue-6.1/fs-indicate-request-originates-from-old-mount-api.patch
 create mode 100644 queue-6.1/gfs2-fix-kernel-null-pointer-dereference-in-gfs2_rgr.patch
 create mode 100644 queue-6.1/gpu-drm-radeon-fix-two-memleaks-in-radeon_vm_init.patch
 create mode 100644 queue-6.1/ib-iser-prevent-invalidating-wrong-mr.patch
 create mode 100644 queue-6.1/ip6_tunnel-fix-nexthdr_fragment-handling-in-ip6_tnl_.patch
 create mode 100644 queue-6.1/ipmr-support-ip_pktinfo-on-cache-report-igmp-msg.patch
 create mode 100644 queue-6.1/keys-encrypted-add-check-for-strsep.patch
 create mode 100644 queue-6.1/kselftest-alsa-mixer-test-fix-the-number-of-paramete.patch
 create mode 100644 queue-6.1/kselftest-alsa-mixer-test-fix-the-print-format-speci.patch
 create mode 100644 queue-6.1/ksmbd-validate-the-zero-field-of-packet-header.patch
 create mode 100644 queue-6.1/kunit-debugfs-fix-unchecked-dereference-in-debugfs_p.patch
 create mode 100644 queue-6.1/loongarch-signal.c-add-header-file-to-fix-build-erro.patch
 create mode 100644 queue-6.1/md-synchronize-flush-io-with-array-reconfiguration.patch
 create mode 100644 queue-6.1/media-cx231xx-fix-a-memleak-in-cx231xx_init_isoc.patch
 create mode 100644 queue-6.1/media-dt-bindings-media-rkisp1-fix-the-port-descript.patch
 create mode 100644 queue-6.1/media-dvb-frontends-m88ds3103-fix-a-memory-leak-in-a.patch
 create mode 100644 queue-6.1/media-dvbdev-drop-refcount-on-error-path-in-dvb_devi.patch
 create mode 100644 queue-6.1/media-imx-mipi-csis-fix-clock-handling-in-remove.patch
 create mode 100644 queue-6.1/media-mtk-jpeg-remove-cancel-worker-in-mtk_jpeg_remo.patch
 create mode 100644 queue-6.1/media-mtk-jpegdec-export-jpeg-decoder-functions.patch
 create mode 100644 queue-6.1/media-pvrusb2-fix-use-after-free-on-context-disconne.patch
 create mode 100644 queue-6.1/media-rkisp1-fix-media-device-memory-leak.patch
 create mode 100644 queue-6.1/media-rkvdec-hook-the-try_-decoder_cmd-stateless-ioc.patch
 create mode 100644 queue-6.1/media-verisilicon-hook-the-try_-decoder_cmd-stateles.patch
 create mode 100644 queue-6.1/mlxbf_gige-enable-the-gige-port-in-mlxbf_gige_open.patch
 create mode 100644 queue-6.1/mlxbf_gige-fix-intermittent-no-ip-issue.patch
 create mode 100644 queue-6.1/mmc-sdhci_am654-fix-ti-soc-dependencies.patch
 create mode 100644 queue-6.1/mmc-sdhci_omap-fix-ti-soc-dependencies.patch
 create mode 100644 queue-6.1/mtd-fix-gluebi-null-pointer-dereference-caused-by-ft.patch
 create mode 100644 queue-6.1/mtd-rawnand-increment-ifc_timeout_msecs-for-nand-con.patch
 create mode 100644 queue-6.1/net-ncsi-fix-netlink-major-minor-version-numbers.patch
 create mode 100644 queue-6.1/net-sched-act_ct-fix-skb-leak-and-crash-on-ooo-frags.patch
 create mode 100644 queue-6.1/netfilter-nf_tables-mark-newset-as-dead-on-transacti.patch
 create mode 100644 queue-6.1/nfsv4.1-pnfs-ensure-we-handle-the-error-nfs4err_retu.patch
 create mode 100644 queue-6.1/null_blk-don-t-cap-max_hw_sectors-to-blk_def_max_sec.patch
 create mode 100644 queue-6.1/of-add-of_property_present-helper.patch
 create mode 100644 queue-6.1/of-fix-double-free-in-of_parse_phandle_with_args_map.patch
 create mode 100644 queue-6.1/of-unittest-fix-of_count_phandle_with_args-expected-.patch
 create mode 100644 queue-6.1/platform-x86-intel-vsec-enhance-and-export-intel_vse.patch
 create mode 100644 queue-6.1/platform-x86-intel-vsec-fix-xa_alloc-memory-leak.patch
 create mode 100644 queue-6.1/platform-x86-intel-vsec-support-private-data.patch
 create mode 100644 queue-6.1/platform-x86-intel-vsec-use-mutex-for-ida_alloc-and-.patch
 create mode 100644 queue-6.1/pnfs-fix-the-pnfs-block-driver-s-calculation-of-layo.patch
 create mode 100644 queue-6.1/powerpc-44x-select-i2c-for-currituck.patch
 create mode 100644 queue-6.1/powerpc-add-crtsavres.o-to-always-y-instead-of-extra.patch
 create mode 100644 queue-6.1/powerpc-imc-pmu-add-a-null-pointer-check-in-update_e.patch
 create mode 100644 queue-6.1/powerpc-powernv-add-a-null-pointer-check-in-opal_eve.patch
 create mode 100644 queue-6.1/powerpc-powernv-add-a-null-pointer-check-in-opal_pow.patch
 create mode 100644 queue-6.1/powerpc-powernv-add-a-null-pointer-check-to-scom_deb.patch
 create mode 100644 queue-6.1/powerpc-pseries-memhp-fix-access-beyond-end-of-drmem.patch
 create mode 100644 queue-6.1/powerpc-remove-checks-for-binutils-older-than-2.25.patch
 create mode 100644 queue-6.1/pstore-ram_core-fix-possible-overflow-in-persistent_.patch
 create mode 100644 queue-6.1/pwm-stm32-fix-enable-count-for-clk-in-.probe.patch
 create mode 100644 queue-6.1/pwm-stm32-use-hweight32-in-stm32_pwm_detect_channels.patch
 create mode 100644 queue-6.1/pwm-stm32-use-regmap_clear_bits-and-regmap_set_bits-.patch
 create mode 100644 queue-6.1/rcu-tasks-provide-rcu_trace_implies_rcu_gp.patch
 create mode 100644 queue-6.1/rdma-hns-fix-inappropriate-err-code-for-unsupported-.patch
 create mode 100644 queue-6.1/rdma-hns-fix-memory-leak-in-free_mr_init.patch
 create mode 100644 queue-6.1/rdma-usnic-silence-uninitialized-symbol-smatch-warni.patch
 create mode 100644 queue-6.1/revert-drm-omapdrm-annotate-dma-fence-critical-secti.patch
 create mode 100644 queue-6.1/revert-drm-tidss-annotate-dma-fence-critical-section.patch
 create mode 100644 queue-6.1/scsi-fnic-return-error-if-vmalloc-failed.patch
 create mode 100644 queue-6.1/scsi-hisi_sas-correct-the-number-of-global-debugfs-r.patch
 create mode 100644 queue-6.1/scsi-hisi_sas-replace-with-standard-error-code-retur.patch
 create mode 100644 queue-6.1/scsi-hisi_sas-rollback-some-operations-if-flr-failed.patch
 create mode 100644 queue-6.1/sctp-fix-busy-polling.patch
 create mode 100644 queue-6.1/sctp-support-msg_errqueue-flag-in-recvmsg.patch
 create mode 100644 queue-6.1/selftests-bpf-fix-erroneous-bitmask-operation.patch
 create mode 100644 queue-6.1/selftests-bpf-relax-time_tai-test-for-equal-timestam.patch
 create mode 100644 queue-6.1/selftests-net-fix-grep-checking-for-fib_nexthop_mult.patch
 create mode 100644 queue-6.1/selftests-net-specify-the-interface-when-do-arping.patch
 create mode 100644 queue-6.1/selftests-powerpc-fix-error-handling-in-fpu-vmx-pree.patch
 create mode 100644 queue-6.1/selinux-fix-error-priority-for-bind-with-af_unspec-o.patch
 create mode 100644 queue-6.1/series
 create mode 100644 queue-6.1/soc-qcom-llcc-fix-dis_cap_alloc-and-retain_on_pc-con.patch
 create mode 100644 queue-6.1/spi-sh-msiof-enforce-fixed-dtdl-for-r-car-h3.patch
 create mode 100644 queue-6.1/spi-spi-zynqmp-gqspi-fix-driver-kconfig-dependencies.patch
 create mode 100644 queue-6.1/sunrpc-fix-_xprt_switch_find_current_entry-logic.patch
 create mode 100644 queue-6.1/virtio-vsock-fix-logic-which-reduces-credit-update-m.patch
 create mode 100644 queue-6.1/watchdog-bcm2835_wdt-fix-wdioc_settimeout-handling.patch
 create mode 100644 queue-6.1/watchdog-hpwdt-only-claim-unknown-nmi-if-from-ilo.patch
 create mode 100644 queue-6.1/watchdog-rti_wdt-drop-runtime-pm-reference-count-whe.patch
 create mode 100644 queue-6.1/watchdog-set-cdev-owner-before-adding.patch
 create mode 100644 queue-6.1/wifi-ath11k-defer-on-rproc_get-failure.patch
 create mode 100644 queue-6.1/wifi-iwlwifi-mvm-send-tx-path-flush-in-rfkill.patch
 create mode 100644 queue-6.1/wifi-iwlwifi-mvm-set-siso-mimo-chains-to-1-in-fw-smp.patch
 create mode 100644 queue-6.1/wifi-libertas-stop-selecting-wext.patch
 create mode 100644 queue-6.1/wifi-mt76-mt7921-fix-country-count-limitation-for-cl.patch
 create mode 100644 queue-6.1/wifi-mt76-mt7921s-fix-workqueue-problem-causes-sta-a.patch
 create mode 100644 queue-6.1/wifi-plfxlc-check-for-allocation-failure-in-plfxlc_u.patch
 create mode 100644 queue-6.1/wifi-rtlwifi-add-calculate_bit_shift.patch
 create mode 100644 queue-6.1/wifi-rtlwifi-rtl8188ee-phy-using-calculate_bit_shift.patch
 create mode 100644 queue-6.1/wifi-rtlwifi-rtl8192c-using-calculate_bit_shift.patch
 create mode 100644 queue-6.1/wifi-rtlwifi-rtl8192ce-using-calculate_bit_shift.patch
 create mode 100644 queue-6.1/wifi-rtlwifi-rtl8192cu-using-calculate_bit_shift.patch
 create mode 100644 queue-6.1/wifi-rtlwifi-rtl8192de-using-calculate_bit_shift.patch
 create mode 100644 queue-6.1/wifi-rtlwifi-rtl8192ee-using-calculate_bit_shift.patch
 create mode 100644 queue-6.1/wifi-rtlwifi-rtl8192se-using-calculate_bit_shift.patch
 create mode 100644 queue-6.1/wifi-rtlwifi-rtl8821ae-phy-fix-an-undefined-bitwise-.patch
 create mode 100644 queue-6.1/wifi-rtw88-fix-rx-filter-in-fif_allmulti-flag.patch
 create mode 100644 queue-6.1/x86-lib-fix-overflow-when-counting-digits.patch
 create mode 100644 queue-6.1/x86-mce-inject-clear-test-status-value.patch

diff --git a/queue-6.1/accel-habanalabs-fix-information-leak-in-sec_attest_.patch b/queue-6.1/accel-habanalabs-fix-information-leak-in-sec_attest_.patch
new file mode 100644
index 00000000000..de7393fbe34
--- /dev/null
+++ b/queue-6.1/accel-habanalabs-fix-information-leak-in-sec_attest_.patch
@@ -0,0 +1,39 @@
+From c66f32c1eb34e487cf50713954e6957684ad14db Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Dec 2023 21:00:59 +0800
+Subject: accel/habanalabs: fix information leak in sec_attest_info()
+
+From: Xingyuan Mo <hdthky0@gmail.com>
+
+[ Upstream commit a9f07790a4b2250f0140e9a61c7f842fd9b618c7 ]
+
+This function may copy the pad0 field of struct hl_info_sec_attest to user
+mode which has not been initialized, resulting in leakage of kernel heap
+data to user mode. To prevent this, use kzalloc() to allocate and zero out
+the buffer, which can also eliminate other uninitialized holes, if any.
+
+Fixes: 0c88760f8f5e ("habanalabs/gaudi2: add secured attestation info uapi")
+Signed-off-by: Xingyuan Mo <hdthky0@gmail.com>
+Reviewed-by: Oded Gabbay <ogabbay@kernel.org>
+Signed-off-by: Oded Gabbay <ogabbay@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/habanalabs/common/habanalabs_ioctl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/misc/habanalabs/common/habanalabs_ioctl.c b/drivers/misc/habanalabs/common/habanalabs_ioctl.c
+index 43afe40966e5..1ea1ae34b7a7 100644
+--- a/drivers/misc/habanalabs/common/habanalabs_ioctl.c
++++ b/drivers/misc/habanalabs/common/habanalabs_ioctl.c
+@@ -677,7 +677,7 @@ static int sec_attest_info(struct hl_fpriv *hpriv, struct hl_info_args *args)
+ 	if (!sec_attest_info)
+ 		return -ENOMEM;
+ 
+-	info = kmalloc(sizeof(*info), GFP_KERNEL);
++	info = kzalloc(sizeof(*info), GFP_KERNEL);
+ 	if (!info) {
+ 		rc = -ENOMEM;
+ 		goto free_sec_attest_info;
+-- 
+2.43.0
+
diff --git a/queue-6.1/acpi-extlog-clear-extended-error-log-status-when-ras.patch b/queue-6.1/acpi-extlog-clear-extended-error-log-status-when-ras.patch
new file mode 100644
index 00000000000..2a802c1a9fb
--- /dev/null
+++ b/queue-6.1/acpi-extlog-clear-extended-error-log-status-when-ras.patch
@@ -0,0 +1,48 @@
+From f8f83becf9a7de35400db88a6b12b16a66d6bb36 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Dec 2023 13:22:39 -0800
+Subject: ACPI: extlog: Clear Extended Error Log status when RAS_CEC handled
+ the error
+
+From: Tony Luck <tony.luck@intel.com>
+
+[ Upstream commit 38c872a9e96f72f2947affc0526cc05659367d3d ]
+
+When both CONFIG_RAS_CEC and CONFIG_ACPI_EXTLOG are enabled, Linux does
+not clear the status word of the BIOS supplied error record for corrected
+errors. This may prevent logging of subsequent uncorrected errors.
+
+Fix by clearing the status.
+
+Fixes: 23ba710a0864 ("x86/mce: Fix all mce notifiers to update the mce->kflags bitmask")
+Reported-by: Erwin Tsaur <erwin.tsaur@intel.com>
+Signed-off-by: Tony Luck <tony.luck@intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpi_extlog.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/acpi/acpi_extlog.c b/drivers/acpi/acpi_extlog.c
+index e648158368a7..088db2356998 100644
+--- a/drivers/acpi/acpi_extlog.c
++++ b/drivers/acpi/acpi_extlog.c
+@@ -145,9 +145,14 @@ static int extlog_print(struct notifier_block *nb, unsigned long val,
+ 	static u32 err_seq;
+ 
+ 	estatus = extlog_elog_entry_check(cpu, bank);
+-	if (estatus == NULL || (mce->kflags & MCE_HANDLED_CEC))
++	if (!estatus)
+ 		return NOTIFY_DONE;
+ 
++	if (mce->kflags & MCE_HANDLED_CEC) {
++		estatus->block_status = 0;
++		return NOTIFY_DONE;
++	}
++
+ 	memcpy(elog_buf, (void *)estatus, ELOG_ENTRY_LEN);
+ 	/* clear record status to enable BIOS to update it again */
+ 	estatus->block_status = 0;
+-- 
+2.43.0
+
diff --git a/queue-6.1/acpi-lpit-avoid-u32-multiplication-overflow.patch b/queue-6.1/acpi-lpit-avoid-u32-multiplication-overflow.patch
new file mode 100644
index 00000000000..eae4c93bd2b
--- /dev/null
+++ b/queue-6.1/acpi-lpit-avoid-u32-multiplication-overflow.patch
@@ -0,0 +1,40 @@
+From bde0e973b6481f25907d34033be2f0b975eb8794 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Nov 2023 21:08:59 +0300
+Subject: ACPI: LPIT: Avoid u32 multiplication overflow
+
+From: Nikita Kiryushin <kiryushin@ancud.ru>
+
+[ Upstream commit 56d2eeda87995245300836ee4dbd13b002311782 ]
+
+In lpit_update_residency() there is a possibility of overflow
+in multiplication, if tsc_khz is large enough (> UINT_MAX/1000).
+
+Change multiplication to mul_u32_u32().
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: eeb2d80d502a ("ACPI / LPIT: Add Low Power Idle Table (LPIT) support")
+Signed-off-by: Nikita Kiryushin <kiryushin@ancud.ru>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpi_lpit.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/acpi/acpi_lpit.c b/drivers/acpi/acpi_lpit.c
+index 50540d4d4948..2c015ecf7185 100644
+--- a/drivers/acpi/acpi_lpit.c
++++ b/drivers/acpi/acpi_lpit.c
+@@ -98,7 +98,7 @@ static void lpit_update_residency(struct lpit_residency_info *info,
+ 				 struct acpi_lpit_native *lpit_native)
+ {
+ 	info->frequency = lpit_native->counter_frequency ?
+-				lpit_native->counter_frequency : tsc_khz * 1000;
++				lpit_native->counter_frequency : mul_u32_u32(tsc_khz, 1000U);
+ 	if (!info->frequency)
+ 		info->frequency = 1;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/acpi-lpss-fix-the-fractional-clock-divider-flags.patch b/queue-6.1/acpi-lpss-fix-the-fractional-clock-divider-flags.patch
new file mode 100644
index 00000000000..fe91c47e6f7
--- /dev/null
+++ b/queue-6.1/acpi-lpss-fix-the-fractional-clock-divider-flags.patch
@@ -0,0 +1,40 @@
+From 49e1257b2dddb3b6d28324fcf6dfede98e2bd297 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Dec 2023 13:14:29 +0200
+Subject: ACPI: LPSS: Fix the fractional clock divider flags
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 3ebccf1d1ca74bbb78e6f8c38d1d172e468d91f8 ]
+
+The conversion to CLK_FRAC_DIVIDER_POWER_OF_TWO_PS uses wrong flags
+in the parameters and hence miscalculates the values in the clock
+divider. Fix this by applying the flag to the proper parameter.
+
+Fixes: 82f53f9ee577 ("clk: fractional-divider: Introduce POWER_OF_TWO_PS flag")
+Reported-by: Alex Vinarskis <alex.vinarskis@gmail.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpi_lpss.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c
+index f08ffa75f4a7..8b44743945c8 100644
+--- a/drivers/acpi/acpi_lpss.c
++++ b/drivers/acpi/acpi_lpss.c
+@@ -450,8 +450,9 @@ static int register_device_clock(struct acpi_device *adev,
+ 		if (!clk_name)
+ 			return -ENOMEM;
+ 		clk = clk_register_fractional_divider(NULL, clk_name, parent,
++						      0, prv_base, 1, 15, 16, 15,
+ 						      CLK_FRAC_DIVIDER_POWER_OF_TWO_PS,
+-						      prv_base, 1, 15, 16, 15, 0, NULL);
++						      NULL);
+ 		parent = clk_name;
+ 
+ 		clk_name = kasprintf(GFP_KERNEL, "%s-update", devname);
+-- 
+2.43.0
+
diff --git a/queue-6.1/acpi-video-check-for-error-while-searching-for-backl.patch b/queue-6.1/acpi-video-check-for-error-while-searching-for-backl.patch
new file mode 100644
index 00000000000..7a81d050654
--- /dev/null
+++ b/queue-6.1/acpi-video-check-for-error-while-searching-for-backl.patch
@@ -0,0 +1,54 @@
+From 203673a86a0389221cbea7dfffe45d9d867c1475 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Nov 2023 16:49:25 +0300
+Subject: ACPI: video: check for error while searching for backlight device
+ parent
+
+From: Nikita Kiryushin <kiryushin@ancud.ru>
+
+[ Upstream commit ccd45faf4973746c4f30ea41eec864e5cf191099 ]
+
+If acpi_get_parent() called in acpi_video_dev_register_backlight()
+fails, for example, because acpi_ut_acquire_mutex() fails inside
+acpi_get_parent), this can lead to incorrect (uninitialized)
+acpi_parent handle being passed to acpi_get_pci_dev() for detecting
+the parent pci device.
+
+Check acpi_get_parent() result and set parent device only in case of success.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: 9661e92c10a9 ("acpi: tie ACPI backlight devices to PCI devices if possible")
+Signed-off-by: Nikita Kiryushin <kiryushin@ancud.ru>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpi_video.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/acpi/acpi_video.c b/drivers/acpi/acpi_video.c
+index ed318485eb19..f7852fb75ab3 100644
+--- a/drivers/acpi/acpi_video.c
++++ b/drivers/acpi/acpi_video.c
+@@ -1726,12 +1726,12 @@ static void acpi_video_dev_register_backlight(struct acpi_video_device *device)
+ 		return;
+ 	count++;
+ 
+-	acpi_get_parent(device->dev->handle, &acpi_parent);
+-
+-	pdev = acpi_get_pci_dev(acpi_parent);
+-	if (pdev) {
+-		parent = &pdev->dev;
+-		pci_dev_put(pdev);
++	if (ACPI_SUCCESS(acpi_get_parent(device->dev->handle, &acpi_parent))) {
++		pdev = acpi_get_pci_dev(acpi_parent);
++		if (pdev) {
++			parent = &pdev->dev;
++			pci_dev_put(pdev);
++		}
+ 	}
+ 
+ 	memset(&props, 0, sizeof(struct backlight_properties));
+-- 
+2.43.0
+
diff --git a/queue-6.1/alsa-scarlett2-add-clamp-in-scarlett2_mixer_ctl_put.patch b/queue-6.1/alsa-scarlett2-add-clamp-in-scarlett2_mixer_ctl_put.patch
new file mode 100644
index 00000000000..7c95f247e0f
--- /dev/null
+++ b/queue-6.1/alsa-scarlett2-add-clamp-in-scarlett2_mixer_ctl_put.patch
@@ -0,0 +1,39 @@
+From 38182237da551d54642f340665cc917571180d29 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Dec 2023 04:07:52 +1030
+Subject: ALSA: scarlett2: Add clamp() in scarlett2_mixer_ctl_put()
+
+From: Geoffrey D. Bennett <g@b4.vu>
+
+[ Upstream commit 04f8f053252b86c7583895c962d66747ecdc61b7 ]
+
+Ensure the value passed to scarlett2_mixer_ctl_put() is between 0 and
+SCARLETT2_MIXER_MAX_VALUE so we don't attempt to access outside
+scarlett2_mixer_values[].
+
+Signed-off-by: Geoffrey D. Bennett <g@b4.vu>
+Fixes: 9e4d5c1be21f ("ALSA: usb-audio: Scarlett Gen 2 mixer interface")
+Link: https://lore.kernel.org/r/3b19fb3da641b587749b85fe1daa1b4e696c0c1b.1703001053.git.g@b4.vu
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/mixer_scarlett_gen2.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/sound/usb/mixer_scarlett_gen2.c b/sound/usb/mixer_scarlett_gen2.c
+index eedac43eee7d..1bcb05c73e0a 100644
+--- a/sound/usb/mixer_scarlett_gen2.c
++++ b/sound/usb/mixer_scarlett_gen2.c
+@@ -3361,7 +3361,8 @@ static int scarlett2_mixer_ctl_put(struct snd_kcontrol *kctl,
+ 	mutex_lock(&private->data_mutex);
+ 
+ 	oval = private->mix[index];
+-	val = ucontrol->value.integer.value[0];
++	val = clamp(ucontrol->value.integer.value[0],
++		    0L, (long)SCARLETT2_MIXER_MAX_VALUE);
+ 	num_mixer_in = port_count[SCARLETT2_PORT_TYPE_MIX][SCARLETT2_PORT_OUT];
+ 	mix_num = index / num_mixer_in;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/alsa-scarlett2-add-missing-error-check-to-scarlett2_.patch b/queue-6.1/alsa-scarlett2-add-missing-error-check-to-scarlett2_.patch
new file mode 100644
index 00000000000..9a5883d4a7c
--- /dev/null
+++ b/queue-6.1/alsa-scarlett2-add-missing-error-check-to-scarlett2_.patch
@@ -0,0 +1,44 @@
+From d65271161757590e7f5a69cc907f2c30ad594144 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Dec 2023 04:07:00 +1030
+Subject: ALSA: scarlett2: Add missing error check to scarlett2_config_save()
+
+From: Geoffrey D. Bennett <g@b4.vu>
+
+[ Upstream commit 5f6ff6931a1c0065a55448108940371e1ac8075f ]
+
+scarlett2_config_save() was ignoring the return value from
+scarlett2_usb(). As this function is not called from user-space we
+can't return the error, so call usb_audio_err() instead.
+
+Signed-off-by: Geoffrey D. Bennett <g@b4.vu>
+Fixes: 9e4d5c1be21f ("ALSA: usb-audio: Scarlett Gen 2 mixer interface")
+Link: https://lore.kernel.org/r/bf0a15332d852d7825fa6da87d2a0d9c0b702053.1703001053.git.g@b4.vu
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/mixer_scarlett_gen2.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/sound/usb/mixer_scarlett_gen2.c b/sound/usb/mixer_scarlett_gen2.c
+index 9d11bb08667e..3da0d3167ebf 100644
+--- a/sound/usb/mixer_scarlett_gen2.c
++++ b/sound/usb/mixer_scarlett_gen2.c
+@@ -1337,9 +1337,11 @@ static void scarlett2_config_save(struct usb_mixer_interface *mixer)
+ {
+ 	__le32 req = cpu_to_le32(SCARLETT2_USB_CONFIG_SAVE);
+ 
+-	scarlett2_usb(mixer, SCARLETT2_USB_DATA_CMD,
+-		      &req, sizeof(u32),
+-		      NULL, 0);
++	int err = scarlett2_usb(mixer, SCARLETT2_USB_DATA_CMD,
++				&req, sizeof(u32),
++				NULL, 0);
++	if (err < 0)
++		usb_audio_err(mixer->chip, "config save failed: %d\n", err);
+ }
+ 
+ /* Delayed work to save config */
+-- 
+2.43.0
+
diff --git a/queue-6.1/alsa-scarlett2-add-missing-error-check-to-scarlett2_.patch-19676 b/queue-6.1/alsa-scarlett2-add-missing-error-check-to-scarlett2_.patch-19676
new file mode 100644
index 00000000000..e548e01f485
--- /dev/null
+++ b/queue-6.1/alsa-scarlett2-add-missing-error-check-to-scarlett2_.patch-19676
@@ -0,0 +1,42 @@
+From 8c9c83bf9cbbc4014870bedf3ecb2238f461bf45 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Dec 2023 04:07:21 +1030
+Subject: ALSA: scarlett2: Add missing error check to
+ scarlett2_usb_set_config()
+
+From: Geoffrey D. Bennett <g@b4.vu>
+
+[ Upstream commit ca459dfa7d4ed9098fcf13e410963be6ae9b6bf3 ]
+
+scarlett2_usb_set_config() calls scarlett2_usb_get() but was not
+checking the result. Return the error if it fails rather than
+continuing with an invalid value.
+
+Signed-off-by: Geoffrey D. Bennett <g@b4.vu>
+Fixes: 9e15fae6c51a ("ALSA: usb-audio: scarlett2: Allow bit-level access to config")
+Link: https://lore.kernel.org/r/def110c5c31dbdf0a7414d258838a0a31c0fab67.1703001053.git.g@b4.vu
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/mixer_scarlett_gen2.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/sound/usb/mixer_scarlett_gen2.c b/sound/usb/mixer_scarlett_gen2.c
+index 3da0d3167ebf..94704581865b 100644
+--- a/sound/usb/mixer_scarlett_gen2.c
++++ b/sound/usb/mixer_scarlett_gen2.c
+@@ -1390,7 +1390,10 @@ static int scarlett2_usb_set_config(
+ 		size = 1;
+ 		offset = config_item->offset;
+ 
+-		scarlett2_usb_get(mixer, offset, &tmp, 1);
++		err = scarlett2_usb_get(mixer, offset, &tmp, 1);
++		if (err < 0)
++			return err;
++
+ 		if (value)
+ 			tmp |= (1 << index);
+ 		else
+-- 
+2.43.0
+
diff --git a/queue-6.1/alsa-scarlett2-add-missing-error-checks-to-_ctl_get.patch b/queue-6.1/alsa-scarlett2-add-missing-error-checks-to-_ctl_get.patch
new file mode 100644
index 00000000000..86a35ab6979
--- /dev/null
+++ b/queue-6.1/alsa-scarlett2-add-missing-error-checks-to-_ctl_get.patch
@@ -0,0 +1,356 @@
+From 70910fa5e8280ba21a3d8fcdf1d27206b1197a0d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Dec 2023 04:07:37 +1030
+Subject: ALSA: scarlett2: Add missing error checks to *_ctl_get()
+
+From: Geoffrey D. Bennett <g@b4.vu>
+
+[ Upstream commit 50603a67daef161c78c814580d57f7f0be57167e ]
+
+The *_ctl_get() functions which call scarlett2_update_*() were not
+checking the return value. Fix to check the return value and pass to
+the caller.
+
+Signed-off-by: Geoffrey D. Bennett <g@b4.vu>
+Fixes: 9e4d5c1be21f ("ALSA: usb-audio: Scarlett Gen 2 mixer interface")
+Link: https://lore.kernel.org/r/32a5fdc83b05fa74e0fcdd672fbf71d75c5f0a6d.1703001053.git.g@b4.vu
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/mixer_scarlett_gen2.c | 182 +++++++++++++++++++++++---------
+ 1 file changed, 130 insertions(+), 52 deletions(-)
+
+diff --git a/sound/usb/mixer_scarlett_gen2.c b/sound/usb/mixer_scarlett_gen2.c
+index f8a2ba479b7c..eedac43eee7d 100644
+--- a/sound/usb/mixer_scarlett_gen2.c
++++ b/sound/usb/mixer_scarlett_gen2.c
+@@ -1798,14 +1798,20 @@ static int scarlett2_sync_ctl_get(struct snd_kcontrol *kctl,
+ 	struct usb_mixer_elem_info *elem = kctl->private_data;
+ 	struct usb_mixer_interface *mixer = elem->head.mixer;
+ 	struct scarlett2_data *private = mixer->private_data;
++	int err = 0;
+ 
+ 	mutex_lock(&private->data_mutex);
+-	if (private->sync_updated)
+-		scarlett2_update_sync(mixer);
++
++	if (private->sync_updated) {
++		err = scarlett2_update_sync(mixer);
++		if (err < 0)
++			goto unlock;
++	}
+ 	ucontrol->value.enumerated.item[0] = private->sync;
+-	mutex_unlock(&private->data_mutex);
+ 
+-	return 0;
++unlock:
++	mutex_unlock(&private->data_mutex);
++	return err;
+ }
+ 
+ static const struct snd_kcontrol_new scarlett2_sync_ctl = {
+@@ -1888,14 +1894,20 @@ static int scarlett2_master_volume_ctl_get(struct snd_kcontrol *kctl,
+ 	struct usb_mixer_elem_info *elem = kctl->private_data;
+ 	struct usb_mixer_interface *mixer = elem->head.mixer;
+ 	struct scarlett2_data *private = mixer->private_data;
++	int err = 0;
+ 
+ 	mutex_lock(&private->data_mutex);
+-	if (private->vol_updated)
+-		scarlett2_update_volumes(mixer);
+-	mutex_unlock(&private->data_mutex);
+ 
++	if (private->vol_updated) {
++		err = scarlett2_update_volumes(mixer);
++		if (err < 0)
++			goto unlock;
++	}
+ 	ucontrol->value.integer.value[0] = private->master_vol;
+-	return 0;
++
++unlock:
++	mutex_unlock(&private->data_mutex);
++	return err;
+ }
+ 
+ static int line_out_remap(struct scarlett2_data *private, int index)
+@@ -1921,14 +1933,20 @@ static int scarlett2_volume_ctl_get(struct snd_kcontrol *kctl,
+ 	struct usb_mixer_interface *mixer = elem->head.mixer;
+ 	struct scarlett2_data *private = mixer->private_data;
+ 	int index = line_out_remap(private, elem->control);
++	int err = 0;
+ 
+ 	mutex_lock(&private->data_mutex);
+-	if (private->vol_updated)
+-		scarlett2_update_volumes(mixer);
+-	mutex_unlock(&private->data_mutex);
+ 
++	if (private->vol_updated) {
++		err = scarlett2_update_volumes(mixer);
++		if (err < 0)
++			goto unlock;
++	}
+ 	ucontrol->value.integer.value[0] = private->vol[index];
+-	return 0;
++
++unlock:
++	mutex_unlock(&private->data_mutex);
++	return err;
+ }
+ 
+ static int scarlett2_volume_ctl_put(struct snd_kcontrol *kctl,
+@@ -1995,14 +2013,20 @@ static int scarlett2_mute_ctl_get(struct snd_kcontrol *kctl,
+ 	struct usb_mixer_interface *mixer = elem->head.mixer;
+ 	struct scarlett2_data *private = mixer->private_data;
+ 	int index = line_out_remap(private, elem->control);
++	int err = 0;
+ 
+ 	mutex_lock(&private->data_mutex);
+-	if (private->vol_updated)
+-		scarlett2_update_volumes(mixer);
+-	mutex_unlock(&private->data_mutex);
+ 
++	if (private->vol_updated) {
++		err = scarlett2_update_volumes(mixer);
++		if (err < 0)
++			goto unlock;
++	}
+ 	ucontrol->value.integer.value[0] = private->mute_switch[index];
+-	return 0;
++
++unlock:
++	mutex_unlock(&private->data_mutex);
++	return err;
+ }
+ 
+ static int scarlett2_mute_ctl_put(struct snd_kcontrol *kctl,
+@@ -2248,14 +2272,20 @@ static int scarlett2_level_enum_ctl_get(struct snd_kcontrol *kctl,
+ 	const struct scarlett2_device_info *info = private->info;
+ 
+ 	int index = elem->control + info->level_input_first;
++	int err = 0;
+ 
+ 	mutex_lock(&private->data_mutex);
+-	if (private->input_other_updated)
+-		scarlett2_update_input_other(mixer);
++
++	if (private->input_other_updated) {
++		err = scarlett2_update_input_other(mixer);
++		if (err < 0)
++			goto unlock;
++	}
+ 	ucontrol->value.enumerated.item[0] = private->level_switch[index];
+-	mutex_unlock(&private->data_mutex);
+ 
+-	return 0;
++unlock:
++	mutex_unlock(&private->data_mutex);
++	return err;
+ }
+ 
+ static int scarlett2_level_enum_ctl_put(struct snd_kcontrol *kctl,
+@@ -2306,15 +2336,21 @@ static int scarlett2_pad_ctl_get(struct snd_kcontrol *kctl,
+ 	struct usb_mixer_elem_info *elem = kctl->private_data;
+ 	struct usb_mixer_interface *mixer = elem->head.mixer;
+ 	struct scarlett2_data *private = mixer->private_data;
++	int err = 0;
+ 
+ 	mutex_lock(&private->data_mutex);
+-	if (private->input_other_updated)
+-		scarlett2_update_input_other(mixer);
++
++	if (private->input_other_updated) {
++		err = scarlett2_update_input_other(mixer);
++		if (err < 0)
++			goto unlock;
++	}
+ 	ucontrol->value.integer.value[0] =
+ 		private->pad_switch[elem->control];
+-	mutex_unlock(&private->data_mutex);
+ 
+-	return 0;
++unlock:
++	mutex_unlock(&private->data_mutex);
++	return err;
+ }
+ 
+ static int scarlett2_pad_ctl_put(struct snd_kcontrol *kctl,
+@@ -2364,14 +2400,20 @@ static int scarlett2_air_ctl_get(struct snd_kcontrol *kctl,
+ 	struct usb_mixer_elem_info *elem = kctl->private_data;
+ 	struct usb_mixer_interface *mixer = elem->head.mixer;
+ 	struct scarlett2_data *private = mixer->private_data;
++	int err = 0;
+ 
+ 	mutex_lock(&private->data_mutex);
+-	if (private->input_other_updated)
+-		scarlett2_update_input_other(mixer);
++
++	if (private->input_other_updated) {
++		err = scarlett2_update_input_other(mixer);
++		if (err < 0)
++			goto unlock;
++	}
+ 	ucontrol->value.integer.value[0] = private->air_switch[elem->control];
+-	mutex_unlock(&private->data_mutex);
+ 
+-	return 0;
++unlock:
++	mutex_unlock(&private->data_mutex);
++	return err;
+ }
+ 
+ static int scarlett2_air_ctl_put(struct snd_kcontrol *kctl,
+@@ -2421,15 +2463,21 @@ static int scarlett2_phantom_ctl_get(struct snd_kcontrol *kctl,
+ 	struct usb_mixer_elem_info *elem = kctl->private_data;
+ 	struct usb_mixer_interface *mixer = elem->head.mixer;
+ 	struct scarlett2_data *private = mixer->private_data;
++	int err = 0;
+ 
+ 	mutex_lock(&private->data_mutex);
+-	if (private->input_other_updated)
+-		scarlett2_update_input_other(mixer);
++
++	if (private->input_other_updated) {
++		err = scarlett2_update_input_other(mixer);
++		if (err < 0)
++			goto unlock;
++	}
+ 	ucontrol->value.integer.value[0] =
+ 		private->phantom_switch[elem->control];
+-	mutex_unlock(&private->data_mutex);
+ 
+-	return 0;
++unlock:
++	mutex_unlock(&private->data_mutex);
++	return err;
+ }
+ 
+ static int scarlett2_phantom_ctl_put(struct snd_kcontrol *kctl,
+@@ -2601,14 +2649,20 @@ static int scarlett2_direct_monitor_ctl_get(
+ 	struct usb_mixer_elem_info *elem = kctl->private_data;
+ 	struct usb_mixer_interface *mixer = elem->head.mixer;
+ 	struct scarlett2_data *private = elem->head.mixer->private_data;
++	int err = 0;
+ 
+ 	mutex_lock(&private->data_mutex);
+-	if (private->monitor_other_updated)
+-		scarlett2_update_monitor_other(mixer);
++
++	if (private->monitor_other_updated) {
++		err = scarlett2_update_monitor_other(mixer);
++		if (err < 0)
++			goto unlock;
++	}
+ 	ucontrol->value.enumerated.item[0] = private->direct_monitor_switch;
+-	mutex_unlock(&private->data_mutex);
+ 
+-	return 0;
++unlock:
++	mutex_unlock(&private->data_mutex);
++	return err;
+ }
+ 
+ static int scarlett2_direct_monitor_ctl_put(
+@@ -2708,14 +2762,20 @@ static int scarlett2_speaker_switch_enum_ctl_get(
+ 	struct usb_mixer_elem_info *elem = kctl->private_data;
+ 	struct usb_mixer_interface *mixer = elem->head.mixer;
+ 	struct scarlett2_data *private = mixer->private_data;
++	int err = 0;
+ 
+ 	mutex_lock(&private->data_mutex);
+-	if (private->monitor_other_updated)
+-		scarlett2_update_monitor_other(mixer);
++
++	if (private->monitor_other_updated) {
++		err = scarlett2_update_monitor_other(mixer);
++		if (err < 0)
++			goto unlock;
++	}
+ 	ucontrol->value.enumerated.item[0] = private->speaker_switching_switch;
+-	mutex_unlock(&private->data_mutex);
+ 
+-	return 0;
++unlock:
++	mutex_unlock(&private->data_mutex);
++	return err;
+ }
+ 
+ /* when speaker switching gets enabled, switch the main/alt speakers
+@@ -2863,14 +2923,20 @@ static int scarlett2_talkback_enum_ctl_get(
+ 	struct usb_mixer_elem_info *elem = kctl->private_data;
+ 	struct usb_mixer_interface *mixer = elem->head.mixer;
+ 	struct scarlett2_data *private = mixer->private_data;
++	int err = 0;
+ 
+ 	mutex_lock(&private->data_mutex);
+-	if (private->monitor_other_updated)
+-		scarlett2_update_monitor_other(mixer);
++
++	if (private->monitor_other_updated) {
++		err = scarlett2_update_monitor_other(mixer);
++		if (err < 0)
++			goto unlock;
++	}
+ 	ucontrol->value.enumerated.item[0] = private->talkback_switch;
+-	mutex_unlock(&private->data_mutex);
+ 
+-	return 0;
++unlock:
++	mutex_unlock(&private->data_mutex);
++	return err;
+ }
+ 
+ static int scarlett2_talkback_enum_ctl_put(
+@@ -3018,14 +3084,20 @@ static int scarlett2_dim_mute_ctl_get(struct snd_kcontrol *kctl,
+ 	struct usb_mixer_elem_info *elem = kctl->private_data;
+ 	struct usb_mixer_interface *mixer = elem->head.mixer;
+ 	struct scarlett2_data *private = mixer->private_data;
++	int err = 0;
+ 
+ 	mutex_lock(&private->data_mutex);
+-	if (private->vol_updated)
+-		scarlett2_update_volumes(mixer);
+-	mutex_unlock(&private->data_mutex);
+ 
++	if (private->vol_updated) {
++		err = scarlett2_update_volumes(mixer);
++		if (err < 0)
++			goto unlock;
++	}
+ 	ucontrol->value.integer.value[0] = private->dim_mute[elem->control];
+-	return 0;
++
++unlock:
++	mutex_unlock(&private->data_mutex);
++	return err;
+ }
+ 
+ static int scarlett2_dim_mute_ctl_put(struct snd_kcontrol *kctl,
+@@ -3396,14 +3468,20 @@ static int scarlett2_mux_src_enum_ctl_get(struct snd_kcontrol *kctl,
+ 	struct usb_mixer_interface *mixer = elem->head.mixer;
+ 	struct scarlett2_data *private = mixer->private_data;
+ 	int index = line_out_remap(private, elem->control);
++	int err = 0;
+ 
+ 	mutex_lock(&private->data_mutex);
+-	if (private->mux_updated)
+-		scarlett2_usb_get_mux(mixer);
++
++	if (private->mux_updated) {
++		err = scarlett2_usb_get_mux(mixer);
++		if (err < 0)
++			goto unlock;
++	}
+ 	ucontrol->value.enumerated.item[0] = private->mux[index];
+-	mutex_unlock(&private->data_mutex);
+ 
+-	return 0;
++unlock:
++	mutex_unlock(&private->data_mutex);
++	return err;
+ }
+ 
+ static int scarlett2_mux_src_enum_ctl_put(struct snd_kcontrol *kctl,
+-- 
+2.43.0
+
diff --git a/queue-6.1/alsa-scarlett2-allow-passing-any-output-to-line_out_.patch b/queue-6.1/alsa-scarlett2-allow-passing-any-output-to-line_out_.patch
new file mode 100644
index 00000000000..817e9daf78e
--- /dev/null
+++ b/queue-6.1/alsa-scarlett2-allow-passing-any-output-to-line_out_.patch
@@ -0,0 +1,83 @@
+From 454e0b637e40f747c3d3739570d8e661c3613faa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Oct 2023 04:36:16 +1030
+Subject: ALSA: scarlett2: Allow passing any output to line_out_remap()
+
+From: Geoffrey D. Bennett <g@b4.vu>
+
+[ Upstream commit 2190b9aea4eb92ccf3176e35c17c959e40f1a81b ]
+
+Line outputs 3 & 4 on the Gen 3 18i8 are internally the analogue 7 and
+8 outputs, and this renumbering is hidden from the user by
+line_out_remap(). By allowing higher values (representing non-analogue
+outputs) to be passed to line_out_remap(), repeated code from
+scarlett2_mux_src_enum_ctl_get() and scarlett2_mux_src_enum_ctl_put()
+can be removed.
+
+Signed-off-by: Geoffrey D. Bennett <g@b4.vu>
+Link: https://lore.kernel.org/r/3b70267931f5994628ab27306c73cddd17b93c8f.1698342632.git.g@b4.vu
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Stable-dep-of: 50603a67daef ("ALSA: scarlett2: Add missing error checks to *_ctl_get()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/mixer_scarlett_gen2.c | 25 +++++++++----------------
+ 1 file changed, 9 insertions(+), 16 deletions(-)
+
+diff --git a/sound/usb/mixer_scarlett_gen2.c b/sound/usb/mixer_scarlett_gen2.c
+index 94704581865b..f8a2ba479b7c 100644
+--- a/sound/usb/mixer_scarlett_gen2.c
++++ b/sound/usb/mixer_scarlett_gen2.c
+@@ -1901,9 +1901,16 @@ static int scarlett2_master_volume_ctl_get(struct snd_kcontrol *kctl,
+ static int line_out_remap(struct scarlett2_data *private, int index)
+ {
+ 	const struct scarlett2_device_info *info = private->info;
++	const int (*port_count)[SCARLETT2_PORT_DIRNS] = info->port_count;
++	int line_out_count =
++		port_count[SCARLETT2_PORT_TYPE_ANALOGUE][SCARLETT2_PORT_OUT];
+ 
+ 	if (!info->line_out_remap_enable)
+ 		return index;
++
++	if (index >= line_out_count)
++		return index;
++
+ 	return info->line_out_remap[index];
+ }
+ 
+@@ -3388,14 +3395,7 @@ static int scarlett2_mux_src_enum_ctl_get(struct snd_kcontrol *kctl,
+ 	struct usb_mixer_elem_info *elem = kctl->private_data;
+ 	struct usb_mixer_interface *mixer = elem->head.mixer;
+ 	struct scarlett2_data *private = mixer->private_data;
+-	const struct scarlett2_device_info *info = private->info;
+-	const int (*port_count)[SCARLETT2_PORT_DIRNS] = info->port_count;
+-	int line_out_count =
+-		port_count[SCARLETT2_PORT_TYPE_ANALOGUE][SCARLETT2_PORT_OUT];
+-	int index = elem->control;
+-
+-	if (index < line_out_count)
+-		index = line_out_remap(private, index);
++	int index = line_out_remap(private, elem->control);
+ 
+ 	mutex_lock(&private->data_mutex);
+ 	if (private->mux_updated)
+@@ -3412,16 +3412,9 @@ static int scarlett2_mux_src_enum_ctl_put(struct snd_kcontrol *kctl,
+ 	struct usb_mixer_elem_info *elem = kctl->private_data;
+ 	struct usb_mixer_interface *mixer = elem->head.mixer;
+ 	struct scarlett2_data *private = mixer->private_data;
+-	const struct scarlett2_device_info *info = private->info;
+-	const int (*port_count)[SCARLETT2_PORT_DIRNS] = info->port_count;
+-	int line_out_count =
+-		port_count[SCARLETT2_PORT_TYPE_ANALOGUE][SCARLETT2_PORT_OUT];
+-	int index = elem->control;
++	int index = line_out_remap(private, elem->control);
+ 	int oval, val, err = 0;
+ 
+-	if (index < line_out_count)
+-		index = line_out_remap(private, index);
+-
+ 	mutex_lock(&private->data_mutex);
+ 
+ 	oval = private->mux[index];
+-- 
+2.43.0
+
diff --git a/queue-6.1/arm-davinci-always-select-config_cpu_arm926t.patch b/queue-6.1/arm-davinci-always-select-config_cpu_arm926t.patch
new file mode 100644
index 00000000000..c7bc7231e84
--- /dev/null
+++ b/queue-6.1/arm-davinci-always-select-config_cpu_arm926t.patch
@@ -0,0 +1,39 @@
+From a6416d234589c6129d26de7fa77b5924d84a36e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Jan 2024 12:00:36 +0100
+Subject: ARM: davinci: always select CONFIG_CPU_ARM926T
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 40974ee421b4d1fc74ac733d86899ce1b83d8f65 ]
+
+The select was lost by accident during the multiplatform conversion.
+Any davinci-only
+
+arm-linux-gnueabi-ld: arch/arm/mach-davinci/sleep.o: in function `CACHE_FLUSH':
+(.text+0x168): undefined reference to `arm926_flush_kern_cache_all'
+
+Fixes: f962396ce292 ("ARM: davinci: support multiplatform build for ARM v5")
+Acked-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Link: https://lore.kernel.org/r/20240108110055.1531153-1-arnd@kernel.org
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-davinci/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm/mach-davinci/Kconfig b/arch/arm/mach-davinci/Kconfig
+index c8cbd9a30791..0b54ca56555b 100644
+--- a/arch/arm/mach-davinci/Kconfig
++++ b/arch/arm/mach-davinci/Kconfig
+@@ -4,6 +4,7 @@ menuconfig ARCH_DAVINCI
+ 	bool "TI DaVinci"
+ 	depends on ARCH_MULTI_V5
+ 	depends on CPU_LITTLE_ENDIAN
++	select CPU_ARM926T
+ 	select DAVINCI_TIMER
+ 	select ZONE_DMA
+ 	select PM_GENERIC_DOMAINS if PM
+-- 
+2.43.0
+
diff --git a/queue-6.1/arm-dts-qcom-apq8064-correct-xoadc-register-address.patch b/queue-6.1/arm-dts-qcom-apq8064-correct-xoadc-register-address.patch
new file mode 100644
index 00000000000..e9c819fb8bd
--- /dev/null
+++ b/queue-6.1/arm-dts-qcom-apq8064-correct-xoadc-register-address.patch
@@ -0,0 +1,40 @@
+From cc9320c0c411510781b0e6c3cdad144f22dbe740 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Sep 2023 14:02:35 +0300
+Subject: ARM: dts: qcom: apq8064: correct XOADC register address
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit 554557542e709e190eff8a598f0cde02647d533a ]
+
+The XOADC is present at the address 0x197 rather than just 197. It
+doesn't change a lot (since the driver hardcodes all register
+addresses), but the DT should present correct address anyway.
+
+Fixes: c4b70883ee33 ("ARM: dts: add XOADC and IIO HWMON to APQ8064")
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/20230928110309.1212221-3-dmitry.baryshkov@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/qcom-apq8064.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/qcom-apq8064.dtsi b/arch/arm/boot/dts/qcom-apq8064.dtsi
+index 4b57e9f5bc64..2b3927a829b7 100644
+--- a/arch/arm/boot/dts/qcom-apq8064.dtsi
++++ b/arch/arm/boot/dts/qcom-apq8064.dtsi
+@@ -750,7 +750,7 @@ pwrkey@1c {
+ 
+ 				xoadc: xoadc@197 {
+ 					compatible = "qcom,pm8921-adc";
+-					reg = <197>;
++					reg = <0x197>;
+ 					interrupts-extended = <&pmicintc 78 IRQ_TYPE_EDGE_RISING>;
+ 					#address-cells = <2>;
+ 					#size-cells = <0>;
+-- 
+2.43.0
+
diff --git a/queue-6.1/arm-dts-qcom-sdx65-correct-spmi-node-name.patch b/queue-6.1/arm-dts-qcom-sdx65-correct-spmi-node-name.patch
new file mode 100644
index 00000000000..82a9434c882
--- /dev/null
+++ b/queue-6.1/arm-dts-qcom-sdx65-correct-spmi-node-name.patch
@@ -0,0 +1,39 @@
+From 451729b04862a8501d9cbff3687ed1b5f98b1006 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 24 Sep 2023 20:31:03 +0200
+Subject: ARM: dts: qcom: sdx65: correct SPMI node name
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit a900ad783f507cb396e402827052e70c0c565ae9 ]
+
+Node names should not have vendor prefixes:
+
+  qcom-sdx65-mtp.dtb: qcom,spmi@c440000: $nodename:0: 'qcom,spmi@c440000' does not match '^spmi@.*
+
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/20230924183103.49487-3-krzysztof.kozlowski@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/qcom-sdx65.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/qcom-sdx65.dtsi b/arch/arm/boot/dts/qcom-sdx65.dtsi
+index ecb9171e4da5..ebb78b489e63 100644
+--- a/arch/arm/boot/dts/qcom-sdx65.dtsi
++++ b/arch/arm/boot/dts/qcom-sdx65.dtsi
+@@ -401,7 +401,7 @@ restart@c264000 {
+ 			reg = <0x0c264000 0x1000>;
+ 		};
+ 
+-		spmi_bus: qcom,spmi@c440000 {
++		spmi_bus: spmi@c440000 {
+ 			compatible = "qcom,spmi-pmic-arb";
+ 			reg = <0xc440000 0xd00>,
+ 				<0xc600000 0x2000000>,
+-- 
+2.43.0
+
diff --git a/queue-6.1/arm-dts-stm32-don-t-mix-scmi-and-non-scmi-board-comp.patch b/queue-6.1/arm-dts-stm32-don-t-mix-scmi-and-non-scmi-board-comp.patch
new file mode 100644
index 00000000000..9302c7b1406
--- /dev/null
+++ b/queue-6.1/arm-dts-stm32-don-t-mix-scmi-and-non-scmi-board-comp.patch
@@ -0,0 +1,86 @@
+From 49a0e1c9f5f75c70908b65a30b2e9834c120a5a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Nov 2023 19:52:34 +0100
+Subject: ARM: dts: stm32: don't mix SCMI and non-SCMI board compatibles
+
+From: Ahmad Fatoum <a.fatoum@pengutronix.de>
+
+[ Upstream commit bfc3c6743de0ecb169026c36cbdbc0d12d22a528 ]
+
+The binding erroneously decreed that the SCMI variants of the ST
+evaluation kits are compatible with the non-SCMI variants.
+
+This is not correct, as a kernel or bootloader compatible with the non-SCMI
+variant is not necessarily able to function, when direct access
+to resources is replaced by having to talk SCMI to the secure monitor.
+
+The binding has been adjusted to reflect thus, so synchronize the device
+trees now.
+
+Fixes: 5b7e58313a77 ("ARM: dts: stm32: Add SCMI version of STM32 boards (DK1/DK2/ED1/EV1)")
+Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
+Signed-off-by: Alexandre Torgue <alexandre.torgue@foss.st.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/stm32mp157a-dk1-scmi.dts | 2 +-
+ arch/arm/boot/dts/stm32mp157c-dk2-scmi.dts | 2 +-
+ arch/arm/boot/dts/stm32mp157c-ed1-scmi.dts | 2 +-
+ arch/arm/boot/dts/stm32mp157c-ev1-scmi.dts | 3 +--
+ 4 files changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/arch/arm/boot/dts/stm32mp157a-dk1-scmi.dts b/arch/arm/boot/dts/stm32mp157a-dk1-scmi.dts
+index e539cc80bef8..942a6ca38d97 100644
+--- a/arch/arm/boot/dts/stm32mp157a-dk1-scmi.dts
++++ b/arch/arm/boot/dts/stm32mp157a-dk1-scmi.dts
+@@ -11,7 +11,7 @@
+ 
+ / {
+ 	model = "STMicroelectronics STM32MP157A-DK1 SCMI Discovery Board";
+-	compatible = "st,stm32mp157a-dk1-scmi", "st,stm32mp157a-dk1", "st,stm32mp157";
++	compatible = "st,stm32mp157a-dk1-scmi", "st,stm32mp157";
+ 
+ 	reserved-memory {
+ 		optee@de000000 {
+diff --git a/arch/arm/boot/dts/stm32mp157c-dk2-scmi.dts b/arch/arm/boot/dts/stm32mp157c-dk2-scmi.dts
+index 97e4f94b0a24..99c4ff1f5c21 100644
+--- a/arch/arm/boot/dts/stm32mp157c-dk2-scmi.dts
++++ b/arch/arm/boot/dts/stm32mp157c-dk2-scmi.dts
+@@ -11,7 +11,7 @@
+ 
+ / {
+ 	model = "STMicroelectronics STM32MP157C-DK2 SCMI Discovery Board";
+-	compatible = "st,stm32mp157c-dk2-scmi", "st,stm32mp157c-dk2", "st,stm32mp157";
++	compatible = "st,stm32mp157c-dk2-scmi", "st,stm32mp157";
+ 
+ 	reserved-memory {
+ 		optee@de000000 {
+diff --git a/arch/arm/boot/dts/stm32mp157c-ed1-scmi.dts b/arch/arm/boot/dts/stm32mp157c-ed1-scmi.dts
+index 9cf0a44d2f47..21010458b36f 100644
+--- a/arch/arm/boot/dts/stm32mp157c-ed1-scmi.dts
++++ b/arch/arm/boot/dts/stm32mp157c-ed1-scmi.dts
+@@ -11,7 +11,7 @@
+ 
+ / {
+ 	model = "STMicroelectronics STM32MP157C-ED1 SCMI eval daughter";
+-	compatible = "st,stm32mp157c-ed1-scmi", "st,stm32mp157c-ed1", "st,stm32mp157";
++	compatible = "st,stm32mp157c-ed1-scmi", "st,stm32mp157";
+ 
+ 	reserved-memory {
+ 		optee@fe000000 {
+diff --git a/arch/arm/boot/dts/stm32mp157c-ev1-scmi.dts b/arch/arm/boot/dts/stm32mp157c-ev1-scmi.dts
+index 3b9dd6f4ccc9..d37637149919 100644
+--- a/arch/arm/boot/dts/stm32mp157c-ev1-scmi.dts
++++ b/arch/arm/boot/dts/stm32mp157c-ev1-scmi.dts
+@@ -11,8 +11,7 @@
+ 
+ / {
+ 	model = "STMicroelectronics STM32MP157C-EV1 SCMI eval daughter on eval mother";
+-	compatible = "st,stm32mp157c-ev1-scmi", "st,stm32mp157c-ev1", "st,stm32mp157c-ed1",
+-		     "st,stm32mp157";
++	compatible = "st,stm32mp157c-ev1-scmi", "st,stm32mp157c-ed1", "st,stm32mp157";
+ 
+ 	reserved-memory {
+ 		optee@fe000000 {
+-- 
+2.43.0
+
diff --git a/queue-6.1/arm64-dts-hisilicon-hikey970-pmic-fix-regulator-cell.patch b/queue-6.1/arm64-dts-hisilicon-hikey970-pmic-fix-regulator-cell.patch
new file mode 100644
index 00000000000..957eb20c531
--- /dev/null
+++ b/queue-6.1/arm64-dts-hisilicon-hikey970-pmic-fix-regulator-cell.patch
@@ -0,0 +1,37 @@
+From c27a09ce33a1e1e84b06dca41ab0eb28a79b510a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Nov 2023 18:56:34 +0100
+Subject: arm64: dts: hisilicon: hikey970-pmic: fix regulator cells properties
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+[ Upstream commit 44ab3ee76a5a977864ba0bb6c352dcf6206804e0 ]
+
+The Hi6421 PMIC regulator child nodes do not have unit addresses so drop
+the incorrect '#address-cells' and '#size-cells' properties.
+
+Fixes: 6219b20e1ecd ("arm64: dts: hisilicon: Add support for Hikey 970 PMIC")
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Signed-off-by: Wei Xu <xuwei5@hisilicon.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/hisilicon/hikey970-pmic.dtsi | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/hisilicon/hikey970-pmic.dtsi b/arch/arm64/boot/dts/hisilicon/hikey970-pmic.dtsi
+index 970047f2dabd..c06e011a6c3f 100644
+--- a/arch/arm64/boot/dts/hisilicon/hikey970-pmic.dtsi
++++ b/arch/arm64/boot/dts/hisilicon/hikey970-pmic.dtsi
+@@ -25,9 +25,6 @@ pmic: pmic@0 {
+ 			gpios = <&gpio28 0 0>;
+ 
+ 			regulators {
+-				#address-cells = <1>;
+-				#size-cells = <0>;
+-
+ 				ldo3: ldo3 { /* HDMI */
+ 					regulator-name = "ldo3";
+ 					regulator-min-microvolt = <1500000>;
+-- 
+2.43.0
+
diff --git a/queue-6.1/arm64-dts-imx8mm-reduce-gpu-to-nominal-speed.patch b/queue-6.1/arm64-dts-imx8mm-reduce-gpu-to-nominal-speed.patch
new file mode 100644
index 00000000000..4d69ba805a8
--- /dev/null
+++ b/queue-6.1/arm64-dts-imx8mm-reduce-gpu-to-nominal-speed.patch
@@ -0,0 +1,51 @@
+From 94d020b553a87fd895f1cd130f47a421a9c0da95 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Nov 2023 14:02:16 -0600
+Subject: arm64: dts: imx8mm: Reduce GPU to nominal speed
+
+From: Adam Ford <aford173@gmail.com>
+
+[ Upstream commit 1f794d3eed5345413c2b0cf1bcccc92d77681220 ]
+
+When the GPU nodes were added, the GPU_PLL_OUT was configured
+for 1000MHz, but this requires the SoC to run in overdrive mode
+which requires an elevated voltage operating point.
+
+Since this may run some boards out of spec, the default clock
+should be set to 800MHz for nominal operating mode. Boards
+that run at the higher voltage can update their clocks
+accordingly.
+
+Fixes: 4523be8e46be ("arm64: dts: imx8mm: Add GPU nodes for 2D and 3D core")
+Signed-off-by: Adam Ford <aford173@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/imx8mm.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8mm.dtsi b/arch/arm64/boot/dts/freescale/imx8mm.dtsi
+index d583db18f74c..7a410d73600b 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mm.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx8mm.dtsi
+@@ -1303,7 +1303,7 @@ gpu_3d: gpu@38000000 {
+ 			assigned-clocks = <&clk IMX8MM_CLK_GPU3D_CORE>,
+ 					  <&clk IMX8MM_GPU_PLL_OUT>;
+ 			assigned-clock-parents = <&clk IMX8MM_GPU_PLL_OUT>;
+-			assigned-clock-rates = <0>, <1000000000>;
++			assigned-clock-rates = <0>, <800000000>;
+ 			power-domains = <&pgc_gpu>;
+ 		};
+ 
+@@ -1318,7 +1318,7 @@ gpu_2d: gpu@38008000 {
+ 			assigned-clocks = <&clk IMX8MM_CLK_GPU2D_CORE>,
+ 					  <&clk IMX8MM_GPU_PLL_OUT>;
+ 			assigned-clock-parents = <&clk IMX8MM_GPU_PLL_OUT>;
+-			assigned-clock-rates = <0>, <1000000000>;
++			assigned-clock-rates = <0>, <800000000>;
+ 			power-domains = <&pgc_gpu>;
+ 		};
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/arm64-dts-mediatek-mt8183-correct-mdp3-dma-related-n.patch b/queue-6.1/arm64-dts-mediatek-mt8183-correct-mdp3-dma-related-n.patch
new file mode 100644
index 00000000000..da37321c9bb
--- /dev/null
+++ b/queue-6.1/arm64-dts-mediatek-mt8183-correct-mdp3-dma-related-n.patch
@@ -0,0 +1,62 @@
+From 96e0d12e09a0772e68ccb5d52db3f09f3c2b3889 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Oct 2023 17:48:38 +0800
+Subject: arm64: dts: mediatek: mt8183: correct MDP3 DMA-related nodes
+
+From: Moudy Ho <moudy.ho@mediatek.com>
+
+[ Upstream commit 188ffcd7fea79af3cac441268fc99f60e87f03b3 ]
+
+In order to generalize the node names, the DMA-related nodes
+corresponding to MT8183 MDP3 need to be corrected.
+
+Fixes: 60a2fb8d202a ("arm64: dts: mt8183: add MediaTek MDP3 nodes")
+Signed-off-by: Moudy Ho <moudy.ho@mediatek.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8183.dtsi | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8183.dtsi b/arch/arm64/boot/dts/mediatek/mt8183.dtsi
+index 10779a9947fe..d5d9b954c449 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8183.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8183.dtsi
+@@ -1586,7 +1586,7 @@ mmsys: syscon@14000000 {
+ 			mediatek,gce-client-reg = <&gce SUBSYS_1400XXXX 0 0x1000>;
+ 		};
+ 
+-		mdp3-rdma0@14001000 {
++		dma-controller0@14001000 {
+ 			compatible = "mediatek,mt8183-mdp3-rdma";
+ 			reg = <0 0x14001000 0 0x1000>;
+ 			mediatek,gce-client-reg = <&gce SUBSYS_1400XXXX 0x1000 0x1000>;
+@@ -1598,6 +1598,7 @@ mdp3-rdma0@14001000 {
+ 			iommus = <&iommu M4U_PORT_MDP_RDMA0>;
+ 			mboxes = <&gce 20 CMDQ_THR_PRIO_LOWEST 0>,
+ 				 <&gce 21 CMDQ_THR_PRIO_LOWEST 0>;
++			#dma-cells = <1>;
+ 		};
+ 
+ 		mdp3-rsz0@14003000 {
+@@ -1618,7 +1619,7 @@ mdp3-rsz1@14004000 {
+ 			clocks = <&mmsys CLK_MM_MDP_RSZ1>;
+ 		};
+ 
+-		mdp3-wrot0@14005000 {
++		dma-controller@14005000 {
+ 			compatible = "mediatek,mt8183-mdp3-wrot";
+ 			reg = <0 0x14005000 0 0x1000>;
+ 			mediatek,gce-client-reg = <&gce SUBSYS_1400XXXX 0x5000 0x1000>;
+@@ -1627,6 +1628,7 @@ mdp3-wrot0@14005000 {
+ 			power-domains = <&spm MT8183_POWER_DOMAIN_DISP>;
+ 			clocks = <&mmsys CLK_MM_MDP_WROT0>;
+ 			iommus = <&iommu M4U_PORT_MDP_WROT0>;
++			#dma-cells = <1>;
+ 		};
+ 
+ 		mdp3-wdma@14006000 {
+-- 
+2.43.0
+
diff --git a/queue-6.1/arm64-dts-qcom-ipq6018-fix-clock-rates-for-gcc_usb0_.patch b/queue-6.1/arm64-dts-qcom-ipq6018-fix-clock-rates-for-gcc_usb0_.patch
new file mode 100644
index 00000000000..bba10404571
--- /dev/null
+++ b/queue-6.1/arm64-dts-qcom-ipq6018-fix-clock-rates-for-gcc_usb0_.patch
@@ -0,0 +1,41 @@
+From 618d78e36d0bf5fa1332898bb7e02724de1576ef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Dec 2023 23:08:05 +0800
+Subject: arm64: dts: qcom: ipq6018: fix clock rates for GCC_USB0_MOCK_UTMI_CLK
+
+From: Chukun Pan <amadeus@jmu.edu.cn>
+
+[ Upstream commit 5c0dbe8b058436ad5daecb19c60869f832607ea3 ]
+
+The downstream QSDK kernel [1] and GCC_USB1_MOCK_UTMI_CLK are both 24MHz.
+Adjust GCC_USB0_MOCK_UTMI_CLK to 24MHz to avoid the following error:
+
+clk: couldn't set gcc_usb0_mock_utmi_clk clk rate to 20000000 (-22), current rate: 24000000
+
+1. https://git.codelinaro.org/clo/qsdk/oss/kernel/linux-ipq-5.4/-/commit/486c8485f59
+
+Fixes: 5726079cd486 ("arm64: dts: ipq6018: Use reference clock to set dwc3 period")
+Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
+Link: https://lore.kernel.org/r/20231218150805.1228160-1-amadeus@jmu.edu.cn
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/ipq6018.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/ipq6018.dtsi b/arch/arm64/boot/dts/qcom/ipq6018.dtsi
+index 43ff8f1f1475..d436fa64caad 100644
+--- a/arch/arm64/boot/dts/qcom/ipq6018.dtsi
++++ b/arch/arm64/boot/dts/qcom/ipq6018.dtsi
+@@ -745,7 +745,7 @@ usb3: usb@8af8800 {
+ 					  <&gcc GCC_USB0_MOCK_UTMI_CLK>;
+ 			assigned-clock-rates = <133330000>,
+ 					       <133330000>,
+-					       <20000000>;
++					       <24000000>;
+ 
+ 			resets = <&gcc GCC_USB0_BCR>;
+ 			status = "disabled";
+-- 
+2.43.0
+
diff --git a/queue-6.1/arm64-dts-qcom-ipq6018-fix-up-indentation.patch b/queue-6.1/arm64-dts-qcom-ipq6018-fix-up-indentation.patch
new file mode 100644
index 00000000000..2c6dfe0a2ba
--- /dev/null
+++ b/queue-6.1/arm64-dts-qcom-ipq6018-fix-up-indentation.patch
@@ -0,0 +1,121 @@
+From dc43f38d0dd8464fa59dc1f7b432762db5d4cfcf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Jan 2023 10:46:27 +0100
+Subject: arm64: dts: qcom: ipq6018: Fix up indentation
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit c2596b717e9d96ae57c45481acfbafe9d3d54e56 ]
+
+The dwc3 subnode was indented using spaces for some reason and other
+properties were not exactly properly indented. Fix it.
+
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230102094642.74254-3-konrad.dybcio@linaro.org
+Stable-dep-of: 5c0dbe8b0584 ("arm64: dts: qcom: ipq6018: fix clock rates for GCC_USB0_MOCK_UTMI_CLK")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/ipq6018.dtsi | 44 +++++++++++++--------------
+ 1 file changed, 22 insertions(+), 22 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/ipq6018.dtsi b/arch/arm64/boot/dts/qcom/ipq6018.dtsi
+index 43a948b64007..1533c61cb106 100644
+--- a/arch/arm64/boot/dts/qcom/ipq6018.dtsi
++++ b/arch/arm64/boot/dts/qcom/ipq6018.dtsi
+@@ -201,8 +201,8 @@ crypto: crypto@73a000 {
+ 			compatible = "qcom,crypto-v5.1";
+ 			reg = <0x0 0x0073a000 0x0 0x6000>;
+ 			clocks = <&gcc GCC_CRYPTO_AHB_CLK>,
+-				<&gcc GCC_CRYPTO_AXI_CLK>,
+-				<&gcc GCC_CRYPTO_CLK>;
++				 <&gcc GCC_CRYPTO_AXI_CLK>,
++				 <&gcc GCC_CRYPTO_CLK>;
+ 			clock-names = "iface", "bus", "core";
+ 			dmas = <&cryptobam 2>, <&cryptobam 3>;
+ 			dma-names = "rx", "tx";
+@@ -272,7 +272,7 @@ blsp1_uart3: serial@78b1000 {
+ 			reg = <0x0 0x078b1000 0x0 0x200>;
+ 			interrupts = <GIC_SPI 306 IRQ_TYPE_LEVEL_HIGH>;
+ 			clocks = <&gcc GCC_BLSP1_UART3_APPS_CLK>,
+-				<&gcc GCC_BLSP1_AHB_CLK>;
++				 <&gcc GCC_BLSP1_AHB_CLK>;
+ 			clock-names = "core", "iface";
+ 			status = "disabled";
+ 		};
+@@ -285,7 +285,7 @@ blsp1_spi1: spi@78b5000 {
+ 			interrupts = <GIC_SPI 95 IRQ_TYPE_LEVEL_HIGH>;
+ 			spi-max-frequency = <50000000>;
+ 			clocks = <&gcc GCC_BLSP1_QUP1_SPI_APPS_CLK>,
+-				<&gcc GCC_BLSP1_AHB_CLK>;
++				 <&gcc GCC_BLSP1_AHB_CLK>;
+ 			clock-names = "core", "iface";
+ 			dmas = <&blsp_dma 12>, <&blsp_dma 13>;
+ 			dma-names = "tx", "rx";
+@@ -300,7 +300,7 @@ blsp1_spi2: spi@78b6000 {
+ 			interrupts = <GIC_SPI 96 IRQ_TYPE_LEVEL_HIGH>;
+ 			spi-max-frequency = <50000000>;
+ 			clocks = <&gcc GCC_BLSP1_QUP2_SPI_APPS_CLK>,
+-				<&gcc GCC_BLSP1_AHB_CLK>;
++				 <&gcc GCC_BLSP1_AHB_CLK>;
+ 			clock-names = "core", "iface";
+ 			dmas = <&blsp_dma 14>, <&blsp_dma 15>;
+ 			dma-names = "tx", "rx";
+@@ -358,8 +358,8 @@ qpic_nand: nand@79b0000 {
+ 			clock-names = "core", "aon";
+ 
+ 			dmas = <&qpic_bam 0>,
+-				<&qpic_bam 1>,
+-				<&qpic_bam 2>;
++			       <&qpic_bam 1>,
++			       <&qpic_bam 2>;
+ 			dma-names = "tx", "rx", "cmd";
+ 			pinctrl-0 = <&qpic_pins>;
+ 			pinctrl-names = "default";
+@@ -372,10 +372,10 @@ intc: interrupt-controller@b000000 {
+ 			#size-cells = <2>;
+ 			interrupt-controller;
+ 			#interrupt-cells = <0x3>;
+-			reg =   <0x0 0x0b000000 0x0 0x1000>,  /*GICD*/
+-				<0x0 0x0b002000 0x0 0x1000>,  /*GICC*/
+-				<0x0 0x0b001000 0x0 0x1000>,  /*GICH*/
+-				<0x0 0x0b004000 0x0 0x1000>;  /*GICV*/
++			reg = <0x0 0x0b000000 0x0 0x1000>,  /*GICD*/
++			      <0x0 0x0b002000 0x0 0x1000>,  /*GICC*/
++			      <0x0 0x0b001000 0x0 0x1000>,  /*GICH*/
++			      <0x0 0x0b004000 0x0 0x1000>;  /*GICV*/
+ 			interrupts = <GIC_PPI 9 IRQ_TYPE_LEVEL_HIGH>;
+ 			ranges = <0 0 0 0xb00a000 0 0xffd>;
+ 
+@@ -669,17 +669,17 @@ usb2: usb@70f8800 {
+ 			status = "disabled";
+ 
+ 			dwc_1: usb@7000000 {
+-			       compatible = "snps,dwc3";
+-			       reg = <0x0 0x07000000 0x0 0xcd00>;
+-			       interrupts = <GIC_SPI 99 IRQ_TYPE_LEVEL_HIGH>;
+-			       phys = <&qusb_phy_1>;
+-			       phy-names = "usb2-phy";
+-			       tx-fifo-resize;
+-			       snps,is-utmi-l1-suspend;
+-			       snps,hird-threshold = /bits/ 8 <0x0>;
+-			       snps,dis_u2_susphy_quirk;
+-			       snps,dis_u3_susphy_quirk;
+-			       dr_mode = "host";
++				compatible = "snps,dwc3";
++				reg = <0x0 0x07000000 0x0 0xcd00>;
++				interrupts = <GIC_SPI 99 IRQ_TYPE_LEVEL_HIGH>;
++				phys = <&qusb_phy_1>;
++				phy-names = "usb2-phy";
++				tx-fifo-resize;
++				snps,is-utmi-l1-suspend;
++				snps,hird-threshold = /bits/ 8 <0x0>;
++				snps,dis_u2_susphy_quirk;
++				snps,dis_u3_susphy_quirk;
++				dr_mode = "host";
+ 			};
+ 		};
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/arm64-dts-qcom-ipq6018-improve-pcie-phy-pcs-reg-tabl.patch b/queue-6.1/arm64-dts-qcom-ipq6018-improve-pcie-phy-pcs-reg-tabl.patch
new file mode 100644
index 00000000000..6219665f2bc
--- /dev/null
+++ b/queue-6.1/arm64-dts-qcom-ipq6018-improve-pcie-phy-pcs-reg-tabl.patch
@@ -0,0 +1,43 @@
+From 3478643b96d58a8d739210cce5bea96b60a7cd15 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Nov 2022 22:21:25 +0100
+Subject: arm64: dts: qcom: ipq6018: improve pcie phy pcs reg table
+
+From: Christian Marangi <ansuelsmth@gmail.com>
+
+[ Upstream commit 08f399a818b0eff552b1f23c3171950a58aea78f ]
+
+This is not a fix on its own but more a cleanup. Phy qmp pcie driver
+currently have a workaround to handle pcs_misc not declared and add
+0x400 offset to the pcs reg if pcs_misc is not declared.
+
+Correctly declare pcs_misc reg and reduce PCS size to the common value
+of 0x1f0 as done for every other qmp based pcie phy device.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20221103212125.17156-2-ansuelsmth@gmail.com
+Stable-dep-of: 5c0dbe8b0584 ("arm64: dts: qcom: ipq6018: fix clock rates for GCC_USB0_MOCK_UTMI_CLK")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/ipq6018.dtsi | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/ipq6018.dtsi b/arch/arm64/boot/dts/qcom/ipq6018.dtsi
+index d436fa64caad..f3743ef7354f 100644
+--- a/arch/arm64/boot/dts/qcom/ipq6018.dtsi
++++ b/arch/arm64/boot/dts/qcom/ipq6018.dtsi
+@@ -406,7 +406,8 @@ pcie_phy: phy@84000 {
+ 			pcie_phy0: phy@84200 {
+ 				reg = <0x0 0x84200 0x0 0x16c>, /* Serdes Tx */
+ 				      <0x0 0x84400 0x0 0x200>, /* Serdes Rx */
+-				      <0x0 0x84800 0x0 0x4f4>; /* PCS: Lane0, COM, PCIE */
++				      <0x0 0x84800 0x0 0x1f0>, /* PCS: Lane0, COM, PCIE */
++				      <0x0 0x84c00 0x0 0xf4>; /* pcs_misc */
+ 				#phy-cells = <0>;
+ 
+ 				clocks = <&gcc GCC_PCIE0_PIPE_CLK>;
+-- 
+2.43.0
+
diff --git a/queue-6.1/arm64-dts-qcom-ipq6018-pad-addresses-to-8-hex-digits.patch b/queue-6.1/arm64-dts-qcom-ipq6018-pad-addresses-to-8-hex-digits.patch
new file mode 100644
index 00000000000..7fde936a68e
--- /dev/null
+++ b/queue-6.1/arm64-dts-qcom-ipq6018-pad-addresses-to-8-hex-digits.patch
@@ -0,0 +1,114 @@
+From f1e3e35bafdb162441baede2c551c7d5bbe40194 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Jan 2023 10:46:26 +0100
+Subject: arm64: dts: qcom: ipq6018: Pad addresses to 8 hex digits
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit 647380e41520c7dbd651ebf0d9fd7dfa4928f42d ]
+
+Some addresses were 7-hex-digits long, or less. Fix that.
+
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230102094642.74254-2-konrad.dybcio@linaro.org
+Stable-dep-of: 5c0dbe8b0584 ("arm64: dts: qcom: ipq6018: fix clock rates for GCC_USB0_MOCK_UTMI_CLK")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/ipq6018.dtsi | 24 ++++++++++++------------
+ 1 file changed, 12 insertions(+), 12 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/ipq6018.dtsi b/arch/arm64/boot/dts/qcom/ipq6018.dtsi
+index 55f685f51c71..43a948b64007 100644
+--- a/arch/arm64/boot/dts/qcom/ipq6018.dtsi
++++ b/arch/arm64/boot/dts/qcom/ipq6018.dtsi
+@@ -146,7 +146,7 @@ reserved-memory {
+ 		ranges;
+ 
+ 		rpm_msg_ram: memory@60000 {
+-			reg = <0x0 0x60000 0x0 0x6000>;
++			reg = <0x0 0x00060000 0x0 0x6000>;
+ 			no-map;
+ 		};
+ 
+@@ -181,7 +181,7 @@ soc: soc {
+ 
+ 		prng: qrng@e1000 {
+ 			compatible = "qcom,prng-ee";
+-			reg = <0x0 0xe3000 0x0 0x1000>;
++			reg = <0x0 0x000e3000 0x0 0x1000>;
+ 			clocks = <&gcc GCC_PRNG_AHB_CLK>;
+ 			clock-names = "core";
+ 		};
+@@ -388,7 +388,7 @@ v2m@0 {
+ 
+ 		pcie_phy: phy@84000 {
+ 			compatible = "qcom,ipq6018-qmp-pcie-phy";
+-			reg = <0x0 0x84000 0x0 0x1bc>; /* Serdes PLL */
++			reg = <0x0 0x00084000 0x0 0x1bc>; /* Serdes PLL */
+ 			status = "disabled";
+ 			#address-cells = <2>;
+ 			#size-cells = <2>;
+@@ -404,10 +404,10 @@ pcie_phy: phy@84000 {
+ 				      "common";
+ 
+ 			pcie_phy0: phy@84200 {
+-				reg = <0x0 0x84200 0x0 0x16c>, /* Serdes Tx */
+-				      <0x0 0x84400 0x0 0x200>, /* Serdes Rx */
+-				      <0x0 0x84800 0x0 0x1f0>, /* PCS: Lane0, COM, PCIE */
+-				      <0x0 0x84c00 0x0 0xf4>; /* pcs_misc */
++				reg = <0x0 0x00084200 0x0 0x16c>, /* Serdes Tx */
++				      <0x0 0x00084400 0x0 0x200>, /* Serdes Rx */
++				      <0x0 0x00084800 0x0 0x1f0>, /* PCS: Lane0, COM, PCIE */
++				      <0x0 0x00084c00 0x0 0xf4>; /* pcs_misc */
+ 				#phy-cells = <0>;
+ 
+ 				clocks = <&gcc GCC_PCIE0_PIPE_CLK>;
+@@ -629,7 +629,7 @@ mdio: mdio@90000 {
+ 			#address-cells = <1>;
+ 			#size-cells = <0>;
+ 			compatible = "qcom,ipq6018-mdio", "qcom,ipq4019-mdio";
+-			reg = <0x0 0x90000 0x0 0x64>;
++			reg = <0x0 0x00090000 0x0 0x64>;
+ 			clocks = <&gcc GCC_MDIO_AHB_CLK>;
+ 			clock-names = "gcc_mdio_ahb_clk";
+ 			status = "disabled";
+@@ -637,7 +637,7 @@ mdio: mdio@90000 {
+ 
+ 		qusb_phy_1: qusb@59000 {
+ 			compatible = "qcom,ipq6018-qusb2-phy";
+-			reg = <0x0 0x059000 0x0 0x180>;
++			reg = <0x0 0x00059000 0x0 0x180>;
+ 			#phy-cells = <0>;
+ 
+ 			clocks = <&gcc GCC_USB1_PHY_CFG_AHB_CLK>,
+@@ -670,7 +670,7 @@ usb2: usb@70f8800 {
+ 
+ 			dwc_1: usb@7000000 {
+ 			       compatible = "snps,dwc3";
+-			       reg = <0x0 0x7000000 0x0 0xcd00>;
++			       reg = <0x0 0x07000000 0x0 0xcd00>;
+ 			       interrupts = <GIC_SPI 99 IRQ_TYPE_LEVEL_HIGH>;
+ 			       phys = <&qusb_phy_1>;
+ 			       phy-names = "usb2-phy";
+@@ -685,7 +685,7 @@ dwc_1: usb@7000000 {
+ 
+ 		ssphy_0: ssphy@78000 {
+ 			compatible = "qcom,ipq6018-qmp-usb3-phy";
+-			reg = <0x0 0x78000 0x0 0x1c4>;
++			reg = <0x0 0x00078000 0x0 0x1c4>;
+ 			#address-cells = <2>;
+ 			#size-cells = <2>;
+ 			ranges;
+@@ -714,7 +714,7 @@ usb0_ssphy: phy@78200 {
+ 
+ 		qusb_phy_0: qusb@79000 {
+ 			compatible = "qcom,ipq6018-qusb2-phy";
+-			reg = <0x0 0x079000 0x0 0x180>;
++			reg = <0x0 0x00079000 0x0 0x180>;
+ 			#phy-cells = <0>;
+ 
+ 			clocks = <&gcc GCC_USB0_PHY_CFG_AHB_CLK>,
+-- 
+2.43.0
+
diff --git a/queue-6.1/arm64-dts-qcom-ipq6018-use-lowercase-hex.patch b/queue-6.1/arm64-dts-qcom-ipq6018-use-lowercase-hex.patch
new file mode 100644
index 00000000000..4f81824aca8
--- /dev/null
+++ b/queue-6.1/arm64-dts-qcom-ipq6018-use-lowercase-hex.patch
@@ -0,0 +1,64 @@
+From eb4cd68d402d05bcf38602b25bd1f5ee335c0f0c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Dec 2022 12:10:29 +0100
+Subject: arm64: dts: qcom: ipq6018: Use lowercase hex
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit 0431dba3733bf52dacf7382e7b0c1b4c0b59e88d ]
+
+Use lowercase hex, as that's the preferred and overwhermingly present
+style.
+
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20221212111037.98160-2-konrad.dybcio@linaro.org
+Stable-dep-of: 5c0dbe8b0584 ("arm64: dts: qcom: ipq6018: fix clock rates for GCC_USB0_MOCK_UTMI_CLK")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/ipq6018.dtsi | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/ipq6018.dtsi b/arch/arm64/boot/dts/qcom/ipq6018.dtsi
+index f3743ef7354f..55f685f51c71 100644
+--- a/arch/arm64/boot/dts/qcom/ipq6018.dtsi
++++ b/arch/arm64/boot/dts/qcom/ipq6018.dtsi
+@@ -685,7 +685,7 @@ dwc_1: usb@7000000 {
+ 
+ 		ssphy_0: ssphy@78000 {
+ 			compatible = "qcom,ipq6018-qmp-usb3-phy";
+-			reg = <0x0 0x78000 0x0 0x1C4>;
++			reg = <0x0 0x78000 0x0 0x1c4>;
+ 			#address-cells = <2>;
+ 			#size-cells = <2>;
+ 			ranges;
+@@ -702,7 +702,7 @@ ssphy_0: ssphy@78000 {
+ 			usb0_ssphy: phy@78200 {
+ 				reg = <0x0 0x00078200 0x0 0x130>, /* Tx */
+ 				      <0x0 0x00078400 0x0 0x200>, /* Rx */
+-				      <0x0 0x00078800 0x0 0x1F8>, /* PCS */
++				      <0x0 0x00078800 0x0 0x1f8>, /* PCS */
+ 				      <0x0 0x00078600 0x0 0x044>; /* PCS misc */
+ 				#phy-cells = <0>;
+ 				#clock-cells = <0>;
+@@ -727,7 +727,7 @@ qusb_phy_0: qusb@79000 {
+ 
+ 		usb3: usb@8af8800 {
+ 			compatible = "qcom,ipq6018-dwc3", "qcom,dwc3";
+-			reg = <0x0 0x8AF8800 0x0 0x400>;
++			reg = <0x0 0x8af8800 0x0 0x400>;
+ 			#address-cells = <2>;
+ 			#size-cells = <2>;
+ 			ranges;
+@@ -753,7 +753,7 @@ usb3: usb@8af8800 {
+ 
+ 			dwc_0: usb@8a00000 {
+ 				compatible = "snps,dwc3";
+-				reg = <0x0 0x8A00000 0x0 0xcd00>;
++				reg = <0x0 0x8a00000 0x0 0xcd00>;
+ 				interrupts = <GIC_SPI 140 IRQ_TYPE_LEVEL_HIGH>;
+ 				phys = <&qusb_phy_0>, <&usb0_ssphy>;
+ 				phy-names = "usb2-phy", "usb3-phy";
+-- 
+2.43.0
+
diff --git a/queue-6.1/arm64-dts-qcom-qrb5165-rb5-correct-led-panic-indicat.patch b/queue-6.1/arm64-dts-qcom-qrb5165-rb5-correct-led-panic-indicat.patch
new file mode 100644
index 00000000000..91f0b160fc2
--- /dev/null
+++ b/queue-6.1/arm64-dts-qcom-qrb5165-rb5-correct-led-panic-indicat.patch
@@ -0,0 +1,42 @@
+From 82a5b5bdf6d426ed661385f88e33292a97e21544 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 11 Nov 2023 10:46:23 +0100
+Subject: arm64: dts: qcom: qrb5165-rb5: correct LED panic indicator
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit dc6b5562acbac0285ab3b2dad23930b6434bdfc6 ]
+
+There is no "panic-indicator" default trigger but a property with that
+name:
+
+  qrb5165-rb5.dtb: leds: led-user4: Unevaluated properties are not allowed ('linux,default-trigger' was unexpected)
+
+Fixes: b5cbd84e499a ("arm64: dts: qcom: qrb5165-rb5: Add onboard LED support")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20231111094623.12476-1-krzysztof.kozlowski@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/qrb5165-rb5.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/qrb5165-rb5.dts b/arch/arm64/boot/dts/qcom/qrb5165-rb5.dts
+index 9731a7c63d53..1defbe0404e2 100644
+--- a/arch/arm64/boot/dts/qcom/qrb5165-rb5.dts
++++ b/arch/arm64/boot/dts/qcom/qrb5165-rb5.dts
+@@ -63,8 +63,8 @@ led-user4 {
+ 			function = LED_FUNCTION_INDICATOR;
+ 			color = <LED_COLOR_ID_GREEN>;
+ 			gpios = <&pm8150_gpios 10 GPIO_ACTIVE_HIGH>;
+-			linux,default-trigger = "panic-indicator";
+ 			default-state = "off";
++			panic-indicator;
+ 		};
+ 
+ 		led-wlan {
+-- 
+2.43.0
+
diff --git a/queue-6.1/arm64-dts-qcom-sc7180-make-watchdog-bark-interrupt-e.patch b/queue-6.1/arm64-dts-qcom-sc7180-make-watchdog-bark-interrupt-e.patch
new file mode 100644
index 00000000000..0cb98f98f7d
--- /dev/null
+++ b/queue-6.1/arm64-dts-qcom-sc7180-make-watchdog-bark-interrupt-e.patch
@@ -0,0 +1,58 @@
+From 9c22172ea02f6168af9b2b67ae7a322592cb31e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Nov 2023 14:43:28 -0800
+Subject: arm64: dts: qcom: sc7180: Make watchdog bark interrupt edge triggered
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit 7ac90b4cf107a3999b30844d7899e0331686b33b ]
+
+On sc7180 when the watchdog timer fires your logs get filled with:
+  watchdog0: pretimeout event
+  watchdog0: pretimeout event
+  watchdog0: pretimeout event
+  ...
+  watchdog0: pretimeout event
+
+If you're using console-ramoops to debug crashes the above gets quite
+annoying since it blows away any other log messages that might have
+been there.
+
+The issue is that the "bark" interrupt (AKA the "pretimeout"
+interrupt) remains high until the watchdog is pet. Since we've got
+things configured as "level" triggered we'll keep getting interrupted
+over and over.
+
+Let's switch to edge triggered. Now we'll get one interrupt when the
+"bark" interrupt goes off and won't get another one until the "bark"
+interrupt is cleared and asserts again.
+
+This matches how many older Qualcomm SoCs have things configured.
+
+Fixes: 28cc13e4060c ("arm64: dts: qcom: sc7180: Add watchdog bark interrupt")
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Link: https://lore.kernel.org/r/20231106144335.v2.1.Ic7577567baff921347d423b722de8b857602efb1@changeid
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sc7180.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sc7180.dtsi b/arch/arm64/boot/dts/qcom/sc7180.dtsi
+index 6f0ee4e13ef1..78e537f1d796 100644
+--- a/arch/arm64/boot/dts/qcom/sc7180.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc7180.dtsi
+@@ -3378,7 +3378,7 @@ watchdog@17c10000 {
+ 			compatible = "qcom,apss-wdt-sc7180", "qcom,kpss-wdt";
+ 			reg = <0 0x17c10000 0 0x1000>;
+ 			clocks = <&sleep_clk>;
+-			interrupts = <GIC_SPI 0 IRQ_TYPE_LEVEL_HIGH>;
++			interrupts = <GIC_SPI 0 IRQ_TYPE_EDGE_RISING>;
+ 		};
+ 
+ 		timer@17c20000{
+-- 
+2.43.0
+
diff --git a/queue-6.1/arm64-dts-qcom-sc7280-fix-up-gpu-sids.patch b/queue-6.1/arm64-dts-qcom-sc7280-fix-up-gpu-sids.patch
new file mode 100644
index 00000000000..b6a25b69d9d
--- /dev/null
+++ b/queue-6.1/arm64-dts-qcom-sc7280-fix-up-gpu-sids.patch
@@ -0,0 +1,44 @@
+From 12912dec0136297c1cb98a6853d7c42f8051f70c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Nov 2023 13:12:53 +0100
+Subject: arm64: dts: qcom: sc7280: Fix up GPU SIDs
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit 94085049fdad7a36fe14dd55e72e712fe55d6bca ]
+
+GPU_SMMU SID 1 is meant for Adreno LPAC (Low Priority Async Compute).
+On platforms that support it (in firmware), it is necessary to
+describe that link, or Adreno register access will hang the board.
+
+The current settings are functionally identical, *but* due to what is
+likely hardcoded security policies, the secure firmware rejects them,
+resulting in the board hanging. To avoid that, alter the settings such
+that SID 0 and 1 are described separately.
+
+Fixes: 96c471970b7b ("arm64: dts: qcom: sc7280: Add gpu support")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20230926-topic-a643-v2-2-06fa3d899c0a@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sc7280.dtsi | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sc7280.dtsi b/arch/arm64/boot/dts/qcom/sc7280.dtsi
+index b1016ccdf032..30e18ce54921 100644
+--- a/arch/arm64/boot/dts/qcom/sc7280.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc7280.dtsi
+@@ -2533,7 +2533,8 @@ gpu: gpu@3d00000 {
+ 				    "cx_mem",
+ 				    "cx_dbgc";
+ 			interrupts = <GIC_SPI 300 IRQ_TYPE_LEVEL_HIGH>;
+-			iommus = <&adreno_smmu 0 0x401>;
++			iommus = <&adreno_smmu 0 0x400>,
++				 <&adreno_smmu 1 0x400>;
+ 			operating-points-v2 = <&gpu_opp_table>;
+ 			qcom,gmu = <&gmu>;
+ 			interconnects = <&gem_noc MASTER_GFX3D 0 &mc_virt SLAVE_EBI1 0>;
+-- 
+2.43.0
+
diff --git a/queue-6.1/arm64-dts-qcom-sc7280-fix-usb_2-wakeup-interrupt-typ.patch b/queue-6.1/arm64-dts-qcom-sc7280-fix-usb_2-wakeup-interrupt-typ.patch
new file mode 100644
index 00000000000..c1e177a563d
--- /dev/null
+++ b/queue-6.1/arm64-dts-qcom-sc7280-fix-usb_2-wakeup-interrupt-typ.patch
@@ -0,0 +1,43 @@
+From a61ffba5c52bc252c34f23c8b1e0604eaacdfbbe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Nov 2023 17:43:25 +0100
+Subject: arm64: dts: qcom: sc7280: fix usb_2 wakeup interrupt types
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+[ Upstream commit 24f8aba9a7c77c7e9d814a5754798e8346c7dd28 ]
+
+The DP/DM wakeup interrupts are edge triggered and which edge to trigger
+on depends on use-case and whether a Low speed or Full/High speed device
+is connected.
+
+Note that only triggering on rising edges can be used to detect resume
+events but not disconnect events.
+
+Fixes: bb9efa59c665 ("arm64: dts: qcom: sc7280: Add USB related nodes")
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Link: https://lore.kernel.org/r/20231120164331.8116-6-johan+linaro@kernel.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sc7280.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sc7280.dtsi b/arch/arm64/boot/dts/qcom/sc7280.dtsi
+index fd1a451e1ba2..8a23250d5951 100644
+--- a/arch/arm64/boot/dts/qcom/sc7280.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc7280.dtsi
+@@ -3392,8 +3392,8 @@ usb_2: usb@8cf8800 {
+ 			assigned-clock-rates = <19200000>, <200000000>;
+ 
+ 			interrupts-extended = <&intc GIC_SPI 240 IRQ_TYPE_LEVEL_HIGH>,
+-					      <&pdc 12 IRQ_TYPE_EDGE_RISING>,
+-					      <&pdc 13 IRQ_TYPE_EDGE_RISING>;
++					      <&pdc 12 IRQ_TYPE_EDGE_BOTH>,
++					      <&pdc 13 IRQ_TYPE_EDGE_BOTH>;
+ 			interrupt-names = "hs_phy_irq",
+ 					  "dp_hs_phy_irq",
+ 					  "dm_hs_phy_irq";
+-- 
+2.43.0
+
diff --git a/queue-6.1/arm64-dts-qcom-sc7280-make-watchdog-bark-interrupt-e.patch b/queue-6.1/arm64-dts-qcom-sc7280-make-watchdog-bark-interrupt-e.patch
new file mode 100644
index 00000000000..1f2b3454c1d
--- /dev/null
+++ b/queue-6.1/arm64-dts-qcom-sc7280-make-watchdog-bark-interrupt-e.patch
@@ -0,0 +1,40 @@
+From 8089eb21d50ac55f902a5398b98beacc11f10344 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Nov 2023 14:43:29 -0800
+Subject: arm64: dts: qcom: sc7280: Make watchdog bark interrupt edge triggered
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit 6897fac411db7b43243f67d4fd4d3f95abf7f656 ]
+
+As described in the patch ("arm64: dts: qcom: sc7180: Make watchdog
+bark interrupt edge triggered"), the Qualcomm watchdog timer's bark
+interrupt should be configured as edge triggered. Make the change.
+
+Fixes: 0e51f883daa9 ("arm64: dts: qcom: sc7280: Add APSS watchdog node")
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Link: https://lore.kernel.org/r/20231106144335.v2.2.I11f77956d2492c88aca0ef5462123f225caf4fb4@changeid
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sc7280.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sc7280.dtsi b/arch/arm64/boot/dts/qcom/sc7280.dtsi
+index 4b8777eb96f1..b1016ccdf032 100644
+--- a/arch/arm64/boot/dts/qcom/sc7280.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc7280.dtsi
+@@ -5195,7 +5195,7 @@ watchdog: watchdog@17c10000 {
+ 			compatible = "qcom,apss-wdt-sc7280", "qcom,kpss-wdt";
+ 			reg = <0 0x17c10000 0 0x1000>;
+ 			clocks = <&sleep_clk>;
+-			interrupts = <GIC_SPI 0 IRQ_TYPE_LEVEL_HIGH>;
++			interrupts = <GIC_SPI 0 IRQ_TYPE_EDGE_RISING>;
+ 			status = "reserved"; /* Owned by Gunyah hyp */
+ 		};
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/arm64-dts-qcom-sc7280-mark-adreno-smmu-as-dma-cohere.patch b/queue-6.1/arm64-dts-qcom-sc7280-mark-adreno-smmu-as-dma-cohere.patch
new file mode 100644
index 00000000000..93a6ef5a302
--- /dev/null
+++ b/queue-6.1/arm64-dts-qcom-sc7280-mark-adreno-smmu-as-dma-cohere.patch
@@ -0,0 +1,37 @@
+From d344fef9c8b29825759f1b10655dd485b1748a55 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Nov 2023 13:12:54 +0100
+Subject: arm64: dts: qcom: sc7280: Mark Adreno SMMU as DMA coherent
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit 31edad478534186a2718be9206ce7b19f2735f6e ]
+
+The SMMUs on sc7280 are cache-coherent. APPS_SMMU is marked as such,
+mark the GPU one as well.
+
+Fixes: 96c471970b7b ("arm64: dts: qcom: sc7280: Add gpu support")
+Reviewed-by: Akhil P Oommen <quic_akhilpo@quicinc.com>
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20230926-topic-a643-v2-3-06fa3d899c0a@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sc7280.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/boot/dts/qcom/sc7280.dtsi b/arch/arm64/boot/dts/qcom/sc7280.dtsi
+index 30e18ce54921..fd1a451e1ba2 100644
+--- a/arch/arm64/boot/dts/qcom/sc7280.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc7280.dtsi
+@@ -2701,6 +2701,7 @@ adreno_smmu: iommu@3da0000 {
+ 					"gpu_cc_hub_aon_clk";
+ 
+ 			power-domains = <&gpucc GPU_CC_CX_GDSC>;
++			dma-coherent;
+ 		};
+ 
+ 		remoteproc_mpss: remoteproc@4080000 {
+-- 
+2.43.0
+
diff --git a/queue-6.1/arm64-dts-qcom-sc7280-mark-sdhci-hosts-as-cache-cohe.patch b/queue-6.1/arm64-dts-qcom-sc7280-mark-sdhci-hosts-as-cache-cohe.patch
new file mode 100644
index 00000000000..edcc3f92b2f
--- /dev/null
+++ b/queue-6.1/arm64-dts-qcom-sc7280-mark-sdhci-hosts-as-cache-cohe.patch
@@ -0,0 +1,44 @@
+From b77d4b80ef9bf4ab88642c0d53e1ca277f8e377b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Dec 2023 15:38:33 +0100
+Subject: arm64: dts: qcom: sc7280: Mark SDHCI hosts as cache-coherent
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit 827f5fc8d912203c1f971e47d61130b13c6820ba ]
+
+The SDHCI hosts on SC7280 are cache-coherent, just like on most fairly
+recent Qualcomm SoCs. Mark them as such.
+
+Fixes: 298c81a7d44f ("arm64: dts: qcom: sc7280: Add nodes for eMMC and SD card")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20231218-topic-7280_dmac_sdhci-v1-1-97af7efd64a1@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sc7280.dtsi | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/qcom/sc7280.dtsi b/arch/arm64/boot/dts/qcom/sc7280.dtsi
+index 8a23250d5951..7fc8c2045022 100644
+--- a/arch/arm64/boot/dts/qcom/sc7280.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc7280.dtsi
+@@ -888,6 +888,7 @@ sdhc_1: mmc@7c4000 {
+ 
+ 			bus-width = <8>;
+ 			supports-cqe;
++			dma-coherent;
+ 
+ 			qcom,dll-config = <0x0007642c>;
+ 			qcom,ddr-config = <0x80040868>;
+@@ -3271,6 +3272,7 @@ sdhc_2: mmc@8804000 {
+ 			operating-points-v2 = <&sdhc2_opp_table>;
+ 
+ 			bus-width = <4>;
++			dma-coherent;
+ 
+ 			qcom,dll-config = <0x0007642c>;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/arm64-dts-qcom-sc7280-mark-some-nodes-as-reserved.patch b/queue-6.1/arm64-dts-qcom-sc7280-mark-some-nodes-as-reserved.patch
new file mode 100644
index 00000000000..42a7ab93d02
--- /dev/null
+++ b/queue-6.1/arm64-dts-qcom-sc7280-mark-some-nodes-as-reserved.patch
@@ -0,0 +1,126 @@
+From 96f3e84906d586f99241ef673d42c28a5c380ba0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Sep 2023 14:45:55 +0200
+Subject: arm64: dts: qcom: sc7280: Mark some nodes as 'reserved'
+
+From: Luca Weiss <luca.weiss@fairphone.com>
+
+[ Upstream commit 6da24ba932082bae110feb917a64bb54637fa7c0 ]
+
+With the standard Qualcomm TrustZone setup, components such as lpasscc,
+pdc_reset and watchdog shouldn't be touched by Linux. Mark them with
+the status 'reserved' and reenable them in the chrome-common dtsi.
+
+Signed-off-by: Luca Weiss <luca.weiss@fairphone.com>
+Link: https://lore.kernel.org/r/20230919-fp5-initial-v2-1-14bb7cedadf5@fairphone.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Stable-dep-of: 6897fac411db ("arm64: dts: qcom: sc7280: Make watchdog bark interrupt edge triggered")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../boot/dts/qcom/sc7280-chrome-common.dtsi   | 24 +++++++++++++++++++
+ arch/arm64/boot/dts/qcom/sc7280.dtsi          |  8 ++++++-
+ 2 files changed, 31 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sc7280-chrome-common.dtsi b/arch/arm64/boot/dts/qcom/sc7280-chrome-common.dtsi
+index 25f31c81b2b7..efe6ea538ad2 100644
+--- a/arch/arm64/boot/dts/qcom/sc7280-chrome-common.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc7280-chrome-common.dtsi
+@@ -56,6 +56,26 @@ mba_mem: memory@9c700000 {
+ 	};
+ };
+ 
++&lpass_aon {
++	status = "okay";
++};
++
++&lpass_core {
++	status = "okay";
++};
++
++&lpass_hm {
++	status = "okay";
++};
++
++&lpasscc {
++	status = "okay";
++};
++
++&pdc_reset {
++	status = "okay";
++};
++
+ /* The PMIC PON code isn't compatible w/ how Chrome EC/BIOS handle things. */
+ &pmk8350_pon {
+ 	status = "disabled";
+@@ -93,6 +113,10 @@ &rmtfs_mem {
+ 	reg = <0x0 0x9c900000 0x0 0x800000>;
+ };
+ 
++&watchdog {
++	status = "okay";
++};
++
+ &wifi {
+ 	status = "okay";
+ 
+diff --git a/arch/arm64/boot/dts/qcom/sc7280.dtsi b/arch/arm64/boot/dts/qcom/sc7280.dtsi
+index aea356c63b9a..4b8777eb96f1 100644
+--- a/arch/arm64/boot/dts/qcom/sc7280.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc7280.dtsi
+@@ -2187,6 +2187,7 @@ lpasscc: lpasscc@3000000 {
+ 			clocks = <&gcc GCC_CFG_NOC_LPASS_CLK>;
+ 			clock-names = "iface";
+ 			#clock-cells = <1>;
++			status = "reserved"; /* Owned by ADSP firmware */
+ 		};
+ 
+ 		lpass_rx_macro: codec@3200000 {
+@@ -2339,6 +2340,7 @@ lpass_aon: clock-controller@3380000 {
+ 			clock-names = "bi_tcxo", "bi_tcxo_ao", "iface";
+ 			#clock-cells = <1>;
+ 			#power-domain-cells = <1>;
++			status = "reserved"; /* Owned by ADSP firmware */
+ 		};
+ 
+ 		lpass_core: clock-controller@3900000 {
+@@ -2349,6 +2351,7 @@ lpass_core: clock-controller@3900000 {
+ 			power-domains = <&lpass_hm LPASS_CORE_CC_LPASS_CORE_HM_GDSC>;
+ 			#clock-cells = <1>;
+ 			#power-domain-cells = <1>;
++			status = "reserved"; /* Owned by ADSP firmware */
+ 		};
+ 
+ 		lpass_cpu: audio@3987000 {
+@@ -2419,6 +2422,7 @@ lpass_hm: clock-controller@3c00000 {
+ 			clock-names = "bi_tcxo";
+ 			#clock-cells = <1>;
+ 			#power-domain-cells = <1>;
++			status = "reserved"; /* Owned by ADSP firmware */
+ 		};
+ 
+ 		lpass_ag_noc: interconnect@3c40000 {
+@@ -4195,6 +4199,7 @@ pdc_reset: reset-controller@b5e0000 {
+ 			compatible = "qcom,sc7280-pdc-global";
+ 			reg = <0 0x0b5e0000 0 0x20000>;
+ 			#reset-cells = <1>;
++			status = "reserved"; /* Owned by firmware */
+ 		};
+ 
+ 		tsens0: thermal-sensor@c263000 {
+@@ -5186,11 +5191,12 @@ gic-its@17a40000 {
+ 			};
+ 		};
+ 
+-		watchdog@17c10000 {
++		watchdog: watchdog@17c10000 {
+ 			compatible = "qcom,apss-wdt-sc7280", "qcom,kpss-wdt";
+ 			reg = <0 0x17c10000 0 0x1000>;
+ 			clocks = <&sleep_clk>;
+ 			interrupts = <GIC_SPI 0 IRQ_TYPE_LEVEL_HIGH>;
++			status = "reserved"; /* Owned by Gunyah hyp */
+ 		};
+ 
+ 		timer@17c20000 {
+-- 
+2.43.0
+
diff --git a/queue-6.1/arm64-dts-qcom-sc8280xp-make-watchdog-bark-interrupt.patch b/queue-6.1/arm64-dts-qcom-sc8280xp-make-watchdog-bark-interrupt.patch
new file mode 100644
index 00000000000..127af551bea
--- /dev/null
+++ b/queue-6.1/arm64-dts-qcom-sc8280xp-make-watchdog-bark-interrupt.patch
@@ -0,0 +1,41 @@
+From 24776ad88be557d81158cc6d344a7825e3c1a890 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Nov 2023 14:43:34 -0800
+Subject: arm64: dts: qcom: sc8280xp: Make watchdog bark interrupt edge
+ triggered
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit 6c4a9c7ea486da490400c84ba2768c90d228c283 ]
+
+As described in the patch ("arm64: dts: qcom: sc7180: Make watchdog
+bark interrupt edge triggered"), the Qualcomm watchdog timer's bark
+interrupt should be configured as edge triggered. Make the change.
+
+Fixes: 152d1faf1e2f ("arm64: dts: qcom: add SC8280XP platform")
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Link: https://lore.kernel.org/r/20231106144335.v2.7.I1c8ab71570f6906fd020decb80675f05fbe1fe74@changeid
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sc8280xp.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi
+index 405835ad28bc..7e3aaf5de3f5 100644
+--- a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi
+@@ -1653,7 +1653,7 @@ watchdog@17c10000 {
+ 			compatible = "qcom,apss-wdt-sc8280xp", "qcom,kpss-wdt";
+ 			reg = <0 0x17c10000 0 0x1000>;
+ 			clocks = <&sleep_clk>;
+-			interrupts = <GIC_SPI 0 IRQ_TYPE_LEVEL_HIGH>;
++			interrupts = <GIC_SPI 0 IRQ_TYPE_EDGE_RISING>;
+ 		};
+ 
+ 		timer@17c20000 {
+-- 
+2.43.0
+
diff --git a/queue-6.1/arm64-dts-qcom-sdm845-db845c-correct-led-panic-indic.patch b/queue-6.1/arm64-dts-qcom-sdm845-db845c-correct-led-panic-indic.patch
new file mode 100644
index 00000000000..7fcd29d8712
--- /dev/null
+++ b/queue-6.1/arm64-dts-qcom-sdm845-db845c-correct-led-panic-indic.patch
@@ -0,0 +1,41 @@
+From 829161c9027c57219571f8dd3e9a3bed37cbb661 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 11 Nov 2023 10:56:16 +0100
+Subject: arm64: dts: qcom: sdm845-db845c: correct LED panic indicator
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit 0c90c75e663246203a2b7f6dd9e08a110f4c3c43 ]
+
+There is no "panic-indicator" default trigger but a property with that
+name:
+
+  sdm845-db845c.dtb: leds: led-0: Unevaluated properties are not allowed ('linux,default-trigger' was unexpected)
+
+Fixes: 3f72e2d3e682 ("arm64: dts: qcom: Add Dragonboard 845c")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20231111095617.16496-1-krzysztof.kozlowski@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sdm845-db845c.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sdm845-db845c.dts b/arch/arm64/boot/dts/qcom/sdm845-db845c.dts
+index 8c9ccf5b4ea4..135ff4368c4a 100644
+--- a/arch/arm64/boot/dts/qcom/sdm845-db845c.dts
++++ b/arch/arm64/boot/dts/qcom/sdm845-db845c.dts
+@@ -66,8 +66,8 @@ led-0 {
+ 			function = LED_FUNCTION_INDICATOR;
+ 			color = <LED_COLOR_ID_GREEN>;
+ 			gpios = <&pm8998_gpio 13 GPIO_ACTIVE_HIGH>;
+-			linux,default-trigger = "panic-indicator";
+ 			default-state = "off";
++			panic-indicator;
+ 		};
+ 
+ 		led-1 {
+-- 
+2.43.0
+
diff --git a/queue-6.1/arm64-dts-qcom-sdm845-make-watchdog-bark-interrupt-e.patch b/queue-6.1/arm64-dts-qcom-sdm845-make-watchdog-bark-interrupt-e.patch
new file mode 100644
index 00000000000..6f7694ee079
--- /dev/null
+++ b/queue-6.1/arm64-dts-qcom-sdm845-make-watchdog-bark-interrupt-e.patch
@@ -0,0 +1,40 @@
+From 7c2f36ada63c455c7251486d24120121865b5cb9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Nov 2023 14:43:30 -0800
+Subject: arm64: dts: qcom: sdm845: Make watchdog bark interrupt edge triggered
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit 263b348499454f38d36b9442c3cf9279c571bb54 ]
+
+As described in the patch ("arm64: dts: qcom: sc7180: Make watchdog
+bark interrupt edge triggered"), the Qualcomm watchdog timer's bark
+interrupt should be configured as edge triggered. Make the change.
+
+Fixes: 36c436b03c58 ("arm64: dts: qcom: sdm845: Add watchdog bark interrupt")
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Link: https://lore.kernel.org/r/20231106144335.v2.3.I16675ebe5517c68453a1bd7f4334ff885f806c03@changeid
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sdm845.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sdm845.dtsi b/arch/arm64/boot/dts/qcom/sdm845.dtsi
+index 52c9f5639f8a..1e6841902900 100644
+--- a/arch/arm64/boot/dts/qcom/sdm845.dtsi
++++ b/arch/arm64/boot/dts/qcom/sdm845.dtsi
+@@ -5019,7 +5019,7 @@ watchdog@17980000 {
+ 			compatible = "qcom,apss-wdt-sdm845", "qcom,kpss-wdt";
+ 			reg = <0 0x17980000 0 0x1000>;
+ 			clocks = <&sleep_clk>;
+-			interrupts = <GIC_SPI 0 IRQ_TYPE_LEVEL_HIGH>;
++			interrupts = <GIC_SPI 0 IRQ_TYPE_EDGE_RISING>;
+ 		};
+ 
+ 		apss_shared: mailbox@17990000 {
+-- 
+2.43.0
+
diff --git a/queue-6.1/arm64-dts-qcom-sm6350-make-watchdog-bark-interrupt-e.patch b/queue-6.1/arm64-dts-qcom-sm6350-make-watchdog-bark-interrupt-e.patch
new file mode 100644
index 00000000000..7ac05e57703
--- /dev/null
+++ b/queue-6.1/arm64-dts-qcom-sm6350-make-watchdog-bark-interrupt-e.patch
@@ -0,0 +1,40 @@
+From 49f4725ace74ba4106cb7fee8772912183452520 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Nov 2023 14:43:35 -0800
+Subject: arm64: dts: qcom: sm6350: Make watchdog bark interrupt edge triggered
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit 5b84bb2b8d86595544fc8272364b0f1a34b68a4f ]
+
+As described in the patch ("arm64: dts: qcom: sc7180: Make watchdog
+bark interrupt edge triggered"), the Qualcomm watchdog timer's bark
+interrupt should be configured as edge triggered. Make the change.
+
+Fixes: 5f82b9cda61e ("arm64: dts: qcom: Add SM6350 device tree")
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Link: https://lore.kernel.org/r/20231106144335.v2.8.Ic1d4402e99c70354d501ccd98105e908a902f671@changeid
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm6350.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm6350.dtsi b/arch/arm64/boot/dts/qcom/sm6350.dtsi
+index cea7ca3f326f..9da373090593 100644
+--- a/arch/arm64/boot/dts/qcom/sm6350.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm6350.dtsi
+@@ -1462,7 +1462,7 @@ watchdog@17c10000 {
+ 			compatible = "qcom,apss-wdt-sm6350", "qcom,kpss-wdt";
+ 			reg = <0 0x17c10000 0 0x1000>;
+ 			clocks = <&sleep_clk>;
+-			interrupts = <GIC_SPI 0 IRQ_TYPE_LEVEL_HIGH>;
++			interrupts = <GIC_SPI 0 IRQ_TYPE_EDGE_RISING>;
+ 		};
+ 
+ 		timer@17c20000 {
+-- 
+2.43.0
+
diff --git a/queue-6.1/arm64-dts-qcom-sm8150-hdk-fix-ss-usb-regulators.patch b/queue-6.1/arm64-dts-qcom-sm8150-hdk-fix-ss-usb-regulators.patch
new file mode 100644
index 00000000000..c451e8c5ed5
--- /dev/null
+++ b/queue-6.1/arm64-dts-qcom-sm8150-hdk-fix-ss-usb-regulators.patch
@@ -0,0 +1,70 @@
+From 1522cd2db6104a1960cf538c5a4ca040edc5520f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Dec 2023 19:40:35 +0200
+Subject: arm64: dts: qcom: sm8150-hdk: fix SS USB regulators
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit a509adf05b2aac31b22781f5aa09e4768a5b6c39 ]
+
+The SM8150-HDK uses two different regulators to power up SuperSpeed USB
+PHYs. The L5A regulator is used for the second USB host, while the first
+(OTG) USB host uses different regulator, L18A. Fix the regulator for the
+usb_1 QMPPHY and (to remove possible confusion) drop the
+usb_ss_dp_core_1/_2 labels.
+
+Fixes: 0ab1b2d10afe ("arm64: dts: qcom: add sm8150 hdk dts")
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/20231215174152.315403-4-dmitry.baryshkov@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm8150-hdk.dts | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8150-hdk.dts b/arch/arm64/boot/dts/qcom/sm8150-hdk.dts
+index 3331ee957d64..368da4c7f41b 100644
+--- a/arch/arm64/boot/dts/qcom/sm8150-hdk.dts
++++ b/arch/arm64/boot/dts/qcom/sm8150-hdk.dts
+@@ -126,8 +126,6 @@ vdda_qrefs_0p875_5:
+ 		vdda_sp_sensor:
+ 		vdda_ufs_2ln_core_1:
+ 		vdda_ufs_2ln_core_2:
+-		vdda_usb_ss_dp_core_1:
+-		vdda_usb_ss_dp_core_2:
+ 		vdda_qlink_lv:
+ 		vdda_qlink_lv_ck:
+ 		vreg_l5a_0p875: ldo5 {
+@@ -209,6 +207,12 @@ vreg_l17a_3p0: ldo17 {
+ 			regulator-max-microvolt = <3008000>;
+ 			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+ 		};
++
++		vreg_l18a_0p8: ldo18 {
++			regulator-min-microvolt = <880000>;
++			regulator-max-microvolt = <880000>;
++			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
++		};
+ 	};
+ 
+ 	pm8150l-rpmh-regulators {
+@@ -439,13 +443,13 @@ &usb_2_hsphy {
+ &usb_1_qmpphy {
+ 	status = "okay";
+ 	vdda-phy-supply = <&vreg_l3c_1p2>;
+-	vdda-pll-supply = <&vdda_usb_ss_dp_core_1>;
++	vdda-pll-supply = <&vreg_l18a_0p8>;
+ };
+ 
+ &usb_2_qmpphy {
+ 	status = "okay";
+ 	vdda-phy-supply = <&vreg_l3c_1p2>;
+-	vdda-pll-supply = <&vdda_usb_ss_dp_core_1>;
++	vdda-pll-supply = <&vreg_l5a_0p875>;
+ };
+ 
+ &usb_1 {
+-- 
+2.43.0
+
diff --git a/queue-6.1/arm64-dts-qcom-sm8150-make-watchdog-bark-interrupt-e.patch b/queue-6.1/arm64-dts-qcom-sm8150-make-watchdog-bark-interrupt-e.patch
new file mode 100644
index 00000000000..774b3ccd933
--- /dev/null
+++ b/queue-6.1/arm64-dts-qcom-sm8150-make-watchdog-bark-interrupt-e.patch
@@ -0,0 +1,40 @@
+From 119d8dcdc038014921a4e02cba2e35fbba53b98e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Nov 2023 14:43:31 -0800
+Subject: arm64: dts: qcom: sm8150: Make watchdog bark interrupt edge triggered
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit 9204e9a4099212c850e1703c374ef4538080825b ]
+
+As described in the patch ("arm64: dts: qcom: sc7180: Make watchdog
+bark interrupt edge triggered"), the Qualcomm watchdog timer's bark
+interrupt should be configured as edge triggered. Make the change.
+
+Fixes: b094c8f8dd2a ("arm64: dts: qcom: sm8150: Add watchdog bark interrupt")
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Link: https://lore.kernel.org/r/20231106144335.v2.4.I23d0aa6c8f1fec5c26ad9b3c610df6f4c5392850@changeid
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm8150.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8150.dtsi b/arch/arm64/boot/dts/qcom/sm8150.dtsi
+index c586378fc6bc..c3c12b0cd416 100644
+--- a/arch/arm64/boot/dts/qcom/sm8150.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm8150.dtsi
+@@ -3940,7 +3940,7 @@ watchdog@17c10000 {
+ 			compatible = "qcom,apss-wdt-sm8150", "qcom,kpss-wdt";
+ 			reg = <0 0x17c10000 0 0x1000>;
+ 			clocks = <&sleep_clk>;
+-			interrupts = <GIC_SPI 0 IRQ_TYPE_LEVEL_HIGH>;
++			interrupts = <GIC_SPI 0 IRQ_TYPE_EDGE_RISING>;
+ 		};
+ 
+ 		timer@17c20000 {
+-- 
+2.43.0
+
diff --git a/queue-6.1/arm64-dts-qcom-sm8250-make-watchdog-bark-interrupt-e.patch b/queue-6.1/arm64-dts-qcom-sm8250-make-watchdog-bark-interrupt-e.patch
new file mode 100644
index 00000000000..a7d7860b917
--- /dev/null
+++ b/queue-6.1/arm64-dts-qcom-sm8250-make-watchdog-bark-interrupt-e.patch
@@ -0,0 +1,40 @@
+From 16c352018242c7e3b3feadcff91d9d527f721a00 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Nov 2023 14:43:32 -0800
+Subject: arm64: dts: qcom: sm8250: Make watchdog bark interrupt edge triggered
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit 735d80e2e8e5d073ae8b1fff8b1589ea284aa5af ]
+
+As described in the patch ("arm64: dts: qcom: sc7180: Make watchdog
+bark interrupt edge triggered"), the Qualcomm watchdog timer's bark
+interrupt should be configured as edge triggered. Make the change.
+
+Fixes: 46a4359f9156 ("arm64: dts: qcom: sm8250: Add watchdog bark interrupt")
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Link: https://lore.kernel.org/r/20231106144335.v2.5.I2910e7c10493d896841e9785c1817df9b9a58701@changeid
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm8250.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8250.dtsi b/arch/arm64/boot/dts/qcom/sm8250.dtsi
+index 4d9b30f0b284..3d02adbc0b62 100644
+--- a/arch/arm64/boot/dts/qcom/sm8250.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm8250.dtsi
+@@ -4879,7 +4879,7 @@ watchdog@17c10000 {
+ 			compatible = "qcom,apss-wdt-sm8250", "qcom,kpss-wdt";
+ 			reg = <0 0x17c10000 0 0x1000>;
+ 			clocks = <&sleep_clk>;
+-			interrupts = <GIC_SPI 0 IRQ_TYPE_LEVEL_HIGH>;
++			interrupts = <GIC_SPI 0 IRQ_TYPE_EDGE_RISING>;
+ 		};
+ 
+ 		timer@17c20000 {
+-- 
+2.43.0
+
diff --git a/queue-6.1/arm64-dts-qcom-sm8350-fix-dma0-address.patch b/queue-6.1/arm64-dts-qcom-sm8350-fix-dma0-address.patch
new file mode 100644
index 00000000000..c5ae8e92a6b
--- /dev/null
+++ b/queue-6.1/arm64-dts-qcom-sm8350-fix-dma0-address.patch
@@ -0,0 +1,42 @@
+From 443d186f9e02ac539d1a7b2343f2a792261fe2a0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 11 Nov 2023 23:07:40 +0100
+Subject: arm64: dts: qcom: sm8350: Fix DMA0 address
+
+From: Nia Espera <nespera@igalia.com>
+
+[ Upstream commit 01a9e9eb6cdbce175ddea3cbe1163daed6d54344 ]
+
+DMA0 node downstream is specified at 0x900000, so fix the typo. Without
+this, enabling any i2c node using DMA0 causes a hang.
+
+Fixes: bc08fbf49bc8 ("arm64: dts: qcom: sm8350: Define GPI DMA engines")
+Fixes: 41d6bca799b3 ("arm64: dts: qcom: sm8350: correct DMA controller unit address")
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Nia Espera <nespera@igalia.com>
+Link: https://lore.kernel.org/r/20231111-nia-sm8350-for-upstream-v4-2-3a638b02eea5@igalia.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm8350.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8350.dtsi b/arch/arm64/boot/dts/qcom/sm8350.dtsi
+index 793768a2c9e1..888bf4cd73c3 100644
+--- a/arch/arm64/boot/dts/qcom/sm8350.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm8350.dtsi
+@@ -903,9 +903,9 @@ spi19: spi@894000 {
+ 			};
+ 		};
+ 
+-		gpi_dma0: dma-controller@9800000 {
++		gpi_dma0: dma-controller@900000 {
+ 			compatible = "qcom,sm8350-gpi-dma", "qcom,sm6350-gpi-dma";
+-			reg = <0 0x09800000 0 0x60000>;
++			reg = <0 0x00900000 0 0x60000>;
+ 			interrupts = <GIC_SPI 244 IRQ_TYPE_LEVEL_HIGH>,
+ 				     <GIC_SPI 245 IRQ_TYPE_LEVEL_HIGH>,
+ 				     <GIC_SPI 246 IRQ_TYPE_LEVEL_HIGH>,
+-- 
+2.43.0
+
diff --git a/queue-6.1/arm64-dts-renesas-white-hawk-cpu-fix-missing-serial-.patch b/queue-6.1/arm64-dts-renesas-white-hawk-cpu-fix-missing-serial-.patch
new file mode 100644
index 00000000000..0c010dfa9a0
--- /dev/null
+++ b/queue-6.1/arm64-dts-renesas-white-hawk-cpu-fix-missing-serial-.patch
@@ -0,0 +1,39 @@
+From 3b83f757e40bc15919746e29adeb4493efac77a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Dec 2023 10:32:25 +0100
+Subject: arm64: dts: renesas: white-hawk-cpu: Fix missing serial console pin
+ control
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit fc67495680f60e88bb8ca43421c1dd628928d581 ]
+
+The pin control description for the serial console was added, but not
+enabled, due to missing pinctrl properties in the serial port device
+node.
+
+Fixes: 7a8d590de8132853 ("arm64: dts: renesas: white-hawk-cpu: Add serial port pin control")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/8a51516581cd71ecbfa174af9c7cebad1fc83c5b.1702459865.git.geert+renesas@glider.be
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/renesas/r8a779g0-white-hawk-cpu.dtsi | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/renesas/r8a779g0-white-hawk-cpu.dtsi b/arch/arm64/boot/dts/renesas/r8a779g0-white-hawk-cpu.dtsi
+index 895f0bd9f754..541b1e73b65e 100644
+--- a/arch/arm64/boot/dts/renesas/r8a779g0-white-hawk-cpu.dtsi
++++ b/arch/arm64/boot/dts/renesas/r8a779g0-white-hawk-cpu.dtsi
+@@ -125,6 +125,9 @@ &extalr_clk {
+ };
+ 
+ &hscif0 {
++	pinctrl-0 = <&hscif0_pins>;
++	pinctrl-names = "default";
++
+ 	status = "okay";
+ };
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/arm64-dts-ti-k3-am62a-main-fix-gpio-pin-count-in-dt-.patch b/queue-6.1/arm64-dts-ti-k3-am62a-main-fix-gpio-pin-count-in-dt-.patch
new file mode 100644
index 00000000000..05d68df25eb
--- /dev/null
+++ b/queue-6.1/arm64-dts-ti-k3-am62a-main-fix-gpio-pin-count-in-dt-.patch
@@ -0,0 +1,47 @@
+From 4c3d98ab5f16790e39b41462e259bd152cc50024 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Oct 2023 12:29:30 +0530
+Subject: arm64: dts: ti: k3-am62a-main: Fix GPIO pin count in DT nodes
+
+From: Nitin Yadav <n-yadav@ti.com>
+
+[ Upstream commit 7dc4af358cc382c5d20bd5b726e53ef0f526eb6d ]
+
+Fix number of gpio pins in main_gpio0 & main_gpio1 DT nodes according
+to AM62A7 datasheet[0].
+
+[0] https://www.ti.com/lit/gpn/am62a3 Section: 6.3.10 GPIO (Page No. 52-55)
+Fixes: 5fc6b1b62639 ("arm64: dts: ti: Introduce AM62A7 family of SoCs")
+Signed-off-by: Nitin Yadav <n-yadav@ti.com>
+Link: https://lore.kernel.org/r/20231027065930.1187405-1-n-yadav@ti.com
+Signed-off-by: Nishanth Menon <nm@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/ti/k3-am62a-main.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/ti/k3-am62a-main.dtsi b/arch/arm64/boot/dts/ti/k3-am62a-main.dtsi
+index bc4b50bcd177..9301ea388802 100644
+--- a/arch/arm64/boot/dts/ti/k3-am62a-main.dtsi
++++ b/arch/arm64/boot/dts/ti/k3-am62a-main.dtsi
+@@ -245,7 +245,7 @@ main_gpio0: gpio@600000 {
+ 			     <193>, <194>, <195>;
+ 		interrupt-controller;
+ 		#interrupt-cells = <2>;
+-		ti,ngpio = <87>;
++		ti,ngpio = <92>;
+ 		ti,davinci-gpio-unbanked = <0>;
+ 		power-domains = <&k3_pds 77 TI_SCI_PD_EXCLUSIVE>;
+ 		clocks = <&k3_clks 77 0>;
+@@ -263,7 +263,7 @@ main_gpio1: gpio@601000 {
+ 			     <183>, <184>, <185>;
+ 		interrupt-controller;
+ 		#interrupt-cells = <2>;
+-		ti,ngpio = <88>;
++		ti,ngpio = <52>;
+ 		ti,davinci-gpio-unbanked = <0>;
+ 		power-domains = <&k3_pds 78 TI_SCI_PD_EXCLUSIVE>;
+ 		clocks = <&k3_clks 78 0>;
+-- 
+2.43.0
+
diff --git a/queue-6.1/arm64-dts-ti-k3-am65-main-fix-dss-irq-trigger-type.patch b/queue-6.1/arm64-dts-ti-k3-am65-main-fix-dss-irq-trigger-type.patch
new file mode 100644
index 00000000000..5ae01fb9242
--- /dev/null
+++ b/queue-6.1/arm64-dts-ti-k3-am65-main-fix-dss-irq-trigger-type.patch
@@ -0,0 +1,47 @@
+From 7649dc91e7c74359954636a350228a300a96369e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Nov 2023 11:57:48 +0200
+Subject: arm64: dts: ti: k3-am65-main: Fix DSS irq trigger type
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+[ Upstream commit b57160859263c083c49482b0d083a586b1517f78 ]
+
+DSS irq trigger type is set to IRQ_TYPE_EDGE_RISING in the DT file, but
+the TRM says it is level triggered.
+
+For some reason triggering on rising edge results in double the amount
+of expected interrupts, e.g. for normal page flipping test the number of
+interrupts per second is 2 * fps. It is as if the IRQ triggers on both
+edges. There are no other side effects to this issue than slightly
+increased CPU & power consumption due to the extra interrupt.
+
+Switching to IRQ_TYPE_LEVEL_HIGH is correct and fixes the issue, so
+let's do that.
+
+Fixes: fc539b90eda2 ("arm64: dts: ti: am654: Add DSS node")
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Reviewed-by: Aradhya Bhatia <a-bhatia1@ti.com>
+Link: https://lore.kernel.org/r/20231106-am65-dss-clk-edge-v1-1-4a959fec0e1e@ideasonboard.com
+Signed-off-by: Nishanth Menon <nm@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/ti/k3-am65-main.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/ti/k3-am65-main.dtsi b/arch/arm64/boot/dts/ti/k3-am65-main.dtsi
+index ebb1c5ce7aec..83dd8993027a 100644
+--- a/arch/arm64/boot/dts/ti/k3-am65-main.dtsi
++++ b/arch/arm64/boot/dts/ti/k3-am65-main.dtsi
+@@ -856,7 +856,7 @@ dss: dss@4a00000 {
+ 		assigned-clocks = <&k3_clks 67 2>;
+ 		assigned-clock-parents = <&k3_clks 67 5>;
+ 
+-		interrupts = <GIC_SPI 166 IRQ_TYPE_EDGE_RISING>;
++		interrupts = <GIC_SPI 166 IRQ_TYPE_LEVEL_HIGH>;
+ 
+ 		dma-coherent;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/asoc-cs35l33-fix-gpio-name-and-drop-legacy-include.patch b/queue-6.1/asoc-cs35l33-fix-gpio-name-and-drop-legacy-include.patch
new file mode 100644
index 00000000000..cec9a142d86
--- /dev/null
+++ b/queue-6.1/asoc-cs35l33-fix-gpio-name-and-drop-legacy-include.patch
@@ -0,0 +1,64 @@
+From 73fc4bfdeb8096de779af53358fd45438ac28632 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Dec 2023 14:20:31 +0100
+Subject: ASoC: cs35l33: Fix GPIO name and drop legacy include
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+[ Upstream commit 50678d339d670a92658e5538ebee30447c88ccb3 ]
+
+This driver includes the legacy GPIO APIs <linux/gpio.h> and
+<linux/of_gpio.h> but does not use any symbols from any of
+them.
+
+Drop the includes.
+
+Further the driver is requesting "reset-gpios" rather than
+just "reset" from the GPIO framework. This is wrong because
+the gpiolib core will add "-gpios" before processing the
+request from e.g. device tree. Drop the suffix.
+
+The last problem means that the optional RESET GPIO has
+never been properly retrieved and used even if it existed,
+but nobody noticed.
+
+Fixes: 3333cb7187b9 ("ASoC: cs35l33: Initial commit of the cs35l33 CODEC driver.")
+Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Link: https://lore.kernel.org/r/20231201-descriptors-sound-cirrus-v2-2-ee9f9d4655eb@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/cs35l33.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/sound/soc/codecs/cs35l33.c b/sound/soc/codecs/cs35l33.c
+index 15e79168d256..c3b7046fd29b 100644
+--- a/sound/soc/codecs/cs35l33.c
++++ b/sound/soc/codecs/cs35l33.c
+@@ -22,13 +22,11 @@
+ #include <sound/soc-dapm.h>
+ #include <sound/initval.h>
+ #include <sound/tlv.h>
+-#include <linux/gpio.h>
+ #include <linux/gpio/consumer.h>
+ #include <sound/cs35l33.h>
+ #include <linux/pm_runtime.h>
+ #include <linux/regulator/consumer.h>
+ #include <linux/regulator/machine.h>
+-#include <linux/of_gpio.h>
+ #include <linux/of.h>
+ #include <linux/of_device.h>
+ #include <linux/of_irq.h>
+@@ -1167,7 +1165,7 @@ static int cs35l33_i2c_probe(struct i2c_client *i2c_client)
+ 
+ 	/* We could issue !RST or skip it based on AMP topology */
+ 	cs35l33->reset_gpio = devm_gpiod_get_optional(&i2c_client->dev,
+-			"reset-gpios", GPIOD_OUT_HIGH);
++			"reset", GPIOD_OUT_HIGH);
+ 	if (IS_ERR(cs35l33->reset_gpio)) {
+ 		dev_err(&i2c_client->dev, "%s ERROR: Can't get reset GPIO\n",
+ 			__func__);
+-- 
+2.43.0
+
diff --git a/queue-6.1/asoc-cs35l34-fix-gpio-name-and-drop-legacy-include.patch b/queue-6.1/asoc-cs35l34-fix-gpio-name-and-drop-legacy-include.patch
new file mode 100644
index 00000000000..1460bdfe355
--- /dev/null
+++ b/queue-6.1/asoc-cs35l34-fix-gpio-name-and-drop-legacy-include.patch
@@ -0,0 +1,65 @@
+From 8c0fad5a02cf4fb7b85f247fd6a0dfffbb6493c4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Dec 2023 14:20:32 +0100
+Subject: ASoC: cs35l34: Fix GPIO name and drop legacy include
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+[ Upstream commit a6122b0b4211d132934ef99e7b737910e6d54d2f ]
+
+This driver includes the legacy GPIO APIs <linux/gpio.h> and
+<linux/of_gpio.h> but does not use any symbols from any of
+them.
+
+Drop the includes.
+
+Further the driver is requesting "reset-gpios" rather than
+just "reset" from the GPIO framework. This is wrong because
+the gpiolib core will add "-gpios" before processing the
+request from e.g. device tree. Drop the suffix.
+
+The last problem means that the optional RESET GPIO has
+never been properly retrieved and used even if it existed,
+but nobody noticed.
+
+Fixes: c1124c09e103 ("ASoC: cs35l34: Initial commit of the cs35l34 CODEC driver.")
+Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Link: https://lore.kernel.org/r/20231201-descriptors-sound-cirrus-v2-3-ee9f9d4655eb@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/cs35l34.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/sound/soc/codecs/cs35l34.c b/sound/soc/codecs/cs35l34.c
+index b3f98023e6a7..57d125c03fad 100644
+--- a/sound/soc/codecs/cs35l34.c
++++ b/sound/soc/codecs/cs35l34.c
+@@ -20,14 +20,12 @@
+ #include <linux/regulator/machine.h>
+ #include <linux/pm_runtime.h>
+ #include <linux/of_device.h>
+-#include <linux/of_gpio.h>
+ #include <linux/of_irq.h>
+ #include <sound/core.h>
+ #include <sound/pcm.h>
+ #include <sound/pcm_params.h>
+ #include <sound/soc.h>
+ #include <sound/soc-dapm.h>
+-#include <linux/gpio.h>
+ #include <linux/gpio/consumer.h>
+ #include <sound/initval.h>
+ #include <sound/tlv.h>
+@@ -1061,7 +1059,7 @@ static int cs35l34_i2c_probe(struct i2c_client *i2c_client)
+ 		dev_err(&i2c_client->dev, "Failed to request IRQ: %d\n", ret);
+ 
+ 	cs35l34->reset_gpio = devm_gpiod_get_optional(&i2c_client->dev,
+-				"reset-gpios", GPIOD_OUT_LOW);
++				"reset", GPIOD_OUT_LOW);
+ 	if (IS_ERR(cs35l34->reset_gpio)) {
+ 		ret = PTR_ERR(cs35l34->reset_gpio);
+ 		goto err_regulator;
+-- 
+2.43.0
+
diff --git a/queue-6.1/asoc-intel-glk_rt5682_max98357a-fix-board-id-mismatc.patch b/queue-6.1/asoc-intel-glk_rt5682_max98357a-fix-board-id-mismatc.patch
new file mode 100644
index 00000000000..ce7b81c6dba
--- /dev/null
+++ b/queue-6.1/asoc-intel-glk_rt5682_max98357a-fix-board-id-mismatc.patch
@@ -0,0 +1,67 @@
+From 5b2f44dd121c2e56dc9e803f067a47404ee3df32 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Dec 2023 15:41:58 -0600
+Subject: ASoC: Intel: glk_rt5682_max98357a: fix board id mismatch
+
+From: Brent Lu <brent.lu@intel.com>
+
+[ Upstream commit 486ede0df82dd74472c6f5651e38ff48f7f766c1 ]
+
+The drv_name in enumeration table for ALC5682I-VS codec does not match
+the board id string in machine driver. Modify the entry of "10EC5682"
+to enumerate "RTL5682" as well and remove invalid entry.
+
+Fixes: 88b4d77d6035 ("ASoC: Intel: glk_rt5682_max98357a: support ALC5682I-VS codec")
+Reported-by: Curtis Malainey <cujomalainey@chromium.org>
+Reviewed-by: Curtis Malainey <cujomalainey@chromium.org>
+Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Signed-off-by: Brent Lu <brent.lu@intel.com>
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20231204214200.203100-4-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/common/soc-acpi-intel-glk-match.c | 14 ++++++--------
+ 1 file changed, 6 insertions(+), 8 deletions(-)
+
+diff --git a/sound/soc/intel/common/soc-acpi-intel-glk-match.c b/sound/soc/intel/common/soc-acpi-intel-glk-match.c
+index 387e73100884..8911c90bbaf6 100644
+--- a/sound/soc/intel/common/soc-acpi-intel-glk-match.c
++++ b/sound/soc/intel/common/soc-acpi-intel-glk-match.c
+@@ -19,6 +19,11 @@ static const struct snd_soc_acpi_codecs glk_codecs = {
+ 	.codecs = {"MX98357A"}
+ };
+ 
++static const struct snd_soc_acpi_codecs glk_rt5682_rt5682s_hp = {
++	.num_codecs = 2,
++	.codecs = {"10EC5682", "RTL5682"},
++};
++
+ struct snd_soc_acpi_mach snd_soc_acpi_intel_glk_machines[] = {
+ 	{
+ 		.id = "INT343A",
+@@ -35,20 +40,13 @@ struct snd_soc_acpi_mach snd_soc_acpi_intel_glk_machines[] = {
+ 		.sof_tplg_filename = "sof-glk-da7219.tplg",
+ 	},
+ 	{
+-		.id = "10EC5682",
++		.comp_ids = &glk_rt5682_rt5682s_hp,
+ 		.drv_name = "glk_rt5682_mx98357a",
+ 		.fw_filename = "intel/dsp_fw_glk.bin",
+ 		.machine_quirk = snd_soc_acpi_codec_list,
+ 		.quirk_data = &glk_codecs,
+ 		.sof_tplg_filename = "sof-glk-rt5682.tplg",
+ 	},
+-	{
+-		.id = "RTL5682",
+-		.drv_name = "glk_rt5682_max98357a",
+-		.machine_quirk = snd_soc_acpi_codec_list,
+-		.quirk_data = &glk_codecs,
+-		.sof_tplg_filename = "sof-glk-rt5682.tplg",
+-	},
+ 	{
+ 		.id = "10134242",
+ 		.drv_name = "glk_cs4242_mx98357a",
+-- 
+2.43.0
+
diff --git a/queue-6.1/asoc-rt5645-drop-double-ef20-entry-from-dmi_platform.patch b/queue-6.1/asoc-rt5645-drop-double-ef20-entry-from-dmi_platform.patch
new file mode 100644
index 00000000000..e37f5853270
--- /dev/null
+++ b/queue-6.1/asoc-rt5645-drop-double-ef20-entry-from-dmi_platform.patch
@@ -0,0 +1,53 @@
+From 5045b61976847f960345851e15dc6202834c1b36 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 26 Nov 2023 22:40:18 +0100
+Subject: ASoC: rt5645: Drop double EF20 entry from dmi_platform_data[]
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 51add1687f39292af626ac3c2046f49241713273 ]
+
+dmi_platform_data[] first contains a DMI entry matching:
+
+   DMI_MATCH(DMI_PRODUCT_NAME, "EF20"),
+
+and then contains an identical entry except for the match being:
+
+   DMI_MATCH(DMI_PRODUCT_NAME, "EF20EA"),
+
+Since these are partial (non exact) DMI matches the first match
+will also match any board with "EF20EA" in their DMI product-name,
+drop the second, redundant, entry.
+
+Fixes: a4dae468cfdd ("ASoC: rt5645: Add ACPI-defined GPIO for ECS EF20 series")
+Cc: Chris Chiu <chiu@endlessos.org>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://msgid.link/r/20231126214024.300505-2-hdegoede@redhat.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/rt5645.c | 8 --------
+ 1 file changed, 8 deletions(-)
+
+diff --git a/sound/soc/codecs/rt5645.c b/sound/soc/codecs/rt5645.c
+index 60518ee5a86e..fd3dca08460b 100644
+--- a/sound/soc/codecs/rt5645.c
++++ b/sound/soc/codecs/rt5645.c
+@@ -3827,14 +3827,6 @@ static const struct dmi_system_id dmi_platform_data[] = {
+ 		},
+ 		.driver_data = (void *)&ecs_ef20_platform_data,
+ 	},
+-	{
+-		.ident = "EF20EA",
+-		.callback = cht_rt5645_ef20_quirk_cb,
+-		.matches = {
+-			DMI_MATCH(DMI_PRODUCT_NAME, "EF20EA"),
+-		},
+-		.driver_data = (void *)&ecs_ef20_platform_data,
+-	},
+ 	{ }
+ };
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/block-add-check-of-minors-and-first_minor-in-device_.patch b/queue-6.1/block-add-check-of-minors-and-first_minor-in-device_.patch
new file mode 100644
index 00000000000..cb3dc18629d
--- /dev/null
+++ b/queue-6.1/block-add-check-of-minors-and-first_minor-in-device_.patch
@@ -0,0 +1,45 @@
+From 3a5fa9e452dfb74d36015bf8adf48d07baaf016b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Dec 2023 15:59:42 +0800
+Subject: block: add check of 'minors' and 'first_minor' in device_add_disk()
+
+From: Li Nan <linan122@huawei.com>
+
+[ Upstream commit 4c434392c4777881d01beada6701eff8c76b43fe ]
+
+'first_minor' represents the starting minor number of disks, and
+'minors' represents the number of partitions in the device. Neither
+of them can be greater than MINORMASK + 1.
+
+Commit e338924bd05d ("block: check minor range in device_add_disk()")
+only added the check of 'first_minor + minors'. However, their sum might
+be less than MINORMASK but their values are wrong. Complete the checks now.
+
+Fixes: e338924bd05d ("block: check minor range in device_add_disk()")
+Signed-off-by: Li Nan <linan122@huawei.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Link: https://lore.kernel.org/r/20231219075942.840255-1-linan666@huaweicloud.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/genhd.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/block/genhd.c b/block/genhd.c
+index 5b23f2c3d692..8e9d162cbdbd 100644
+--- a/block/genhd.c
++++ b/block/genhd.c
+@@ -444,7 +444,9 @@ int __must_check device_add_disk(struct device *parent, struct gendisk *disk,
+ 				DISK_MAX_PARTS);
+ 			disk->minors = DISK_MAX_PARTS;
+ 		}
+-		if (disk->first_minor + disk->minors > MINORMASK + 1)
++		if (disk->first_minor > MINORMASK ||
++		    disk->minors > MINORMASK + 1 ||
++		    disk->first_minor + disk->minors > MINORMASK + 1)
+ 			goto out_exit_elevator;
+ 	} else {
+ 		if (WARN_ON(disk->minors))
+-- 
+2.43.0
+
diff --git a/queue-6.1/block-make-blk_def_max_sectors-unsigned.patch b/queue-6.1/block-make-blk_def_max_sectors-unsigned.patch
new file mode 100644
index 00000000000..2448082e57a
--- /dev/null
+++ b/queue-6.1/block-make-blk_def_max_sectors-unsigned.patch
@@ -0,0 +1,75 @@
+From 6a8efbfdb9b4e671a47223f2be6f03a01133a243 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Jan 2023 12:51:45 -0800
+Subject: block: make BLK_DEF_MAX_SECTORS unsigned
+
+From: Keith Busch <kbusch@kernel.org>
+
+[ Upstream commit 0a26f327e46c203229e72c823dfec71a2b405ec5 ]
+
+This is used as an unsigned value, so define it that way to avoid
+having to cast it.
+
+Suggested-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
+Link: https://lore.kernel.org/r/20230105205146.3610282-2-kbusch@meta.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Stable-dep-of: 9a9525de8654 ("null_blk: don't cap max_hw_sectors to BLK_DEF_MAX_SECTORS")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-settings.c          | 2 +-
+ drivers/block/null_blk/main.c | 3 +--
+ include/linux/blkdev.h        | 3 ++-
+ 3 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/block/blk-settings.c b/block/blk-settings.c
+index 86ff375c00ce..bbca4ce77a2d 100644
+--- a/block/blk-settings.c
++++ b/block/blk-settings.c
+@@ -135,7 +135,7 @@ void blk_queue_max_hw_sectors(struct request_queue *q, unsigned int max_hw_secto
+ 	limits->max_hw_sectors = max_hw_sectors;
+ 
+ 	max_sectors = min_not_zero(max_hw_sectors, limits->max_dev_sectors);
+-	max_sectors = min_t(unsigned int, max_sectors, BLK_DEF_MAX_SECTORS);
++	max_sectors = min(max_sectors, BLK_DEF_MAX_SECTORS);
+ 	max_sectors = round_down(max_sectors,
+ 				 limits->logical_block_size >> SECTOR_SHIFT);
+ 	limits->max_sectors = max_sectors;
+diff --git a/drivers/block/null_blk/main.c b/drivers/block/null_blk/main.c
+index e9f38eba2f13..d921653b096b 100644
+--- a/drivers/block/null_blk/main.c
++++ b/drivers/block/null_blk/main.c
+@@ -2116,8 +2116,7 @@ static int null_add_dev(struct nullb_device *dev)
+ 	blk_queue_physical_block_size(nullb->q, dev->blocksize);
+ 	if (!dev->max_sectors)
+ 		dev->max_sectors = queue_max_hw_sectors(nullb->q);
+-	dev->max_sectors = min_t(unsigned int, dev->max_sectors,
+-				 BLK_DEF_MAX_SECTORS);
++	dev->max_sectors = min(dev->max_sectors, BLK_DEF_MAX_SECTORS);
+ 	blk_queue_max_hw_sectors(nullb->q, dev->max_sectors);
+ 
+ 	if (dev->virt_boundary)
+diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
+index 07a7eeef47d3..e255674a9ee7 100644
+--- a/include/linux/blkdev.h
++++ b/include/linux/blkdev.h
+@@ -1109,11 +1109,12 @@ static inline bool bdev_is_partition(struct block_device *bdev)
+ enum blk_default_limits {
+ 	BLK_MAX_SEGMENTS	= 128,
+ 	BLK_SAFE_MAX_SECTORS	= 255,
+-	BLK_DEF_MAX_SECTORS	= 2560,
+ 	BLK_MAX_SEGMENT_SIZE	= 65536,
+ 	BLK_SEG_BOUNDARY_MASK	= 0xFFFFFFFFUL,
+ };
+ 
++#define BLK_DEF_MAX_SECTORS 2560u
++
+ static inline unsigned long queue_segment_boundary(const struct request_queue *q)
+ {
+ 	return q->limits.seg_boundary_mask;
+-- 
+2.43.0
+
diff --git a/queue-6.1/block-set-memalloc_noio-to-false-on-device_add_disk-.patch b/queue-6.1/block-set-memalloc_noio-to-false-on-device_add_disk-.patch
new file mode 100644
index 00000000000..0b23fcd8f70
--- /dev/null
+++ b/queue-6.1/block-set-memalloc_noio-to-false-on-device_add_disk-.patch
@@ -0,0 +1,39 @@
+From 7670177e4eb17eee339578de1ed085278dc09538 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Dec 2023 15:53:56 +0800
+Subject: block: Set memalloc_noio to false on device_add_disk() error path
+
+From: Li Nan <linan122@huawei.com>
+
+[ Upstream commit 5fa3d1a00c2d4ba14f1300371ad39d5456e890d7 ]
+
+On the error path of device_add_disk(), device's memalloc_noio flag was
+set but not cleared. As the comment of pm_runtime_set_memalloc_noio(),
+"The function should be called between device_add() and device_del()".
+Clear this flag before device_del() now.
+
+Fixes: 25e823c8c37d ("block/genhd.c: apply pm_runtime_set_memalloc_noio on block devices")
+Signed-off-by: Li Nan <linan122@huawei.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Link: https://lore.kernel.org/r/20231211075356.1839282-1-linan666@huaweicloud.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/genhd.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/block/genhd.c b/block/genhd.c
+index 886e75213f6a..5b23f2c3d692 100644
+--- a/block/genhd.c
++++ b/block/genhd.c
+@@ -564,6 +564,7 @@ int __must_check device_add_disk(struct device *parent, struct gendisk *disk,
+ 	blk_integrity_del(disk);
+ out_del_block_link:
+ 	sysfs_remove_link(block_depr, dev_name(ddev));
++	pm_runtime_set_memalloc_noio(ddev, false);
+ out_device_del:
+ 	device_del(ddev);
+ out_free_ext_minor:
+-- 
+2.43.0
+
diff --git a/queue-6.1/blocklayoutdriver-fix-reference-leak-of-pnfs_device_.patch b/queue-6.1/blocklayoutdriver-fix-reference-leak-of-pnfs_device_.patch
new file mode 100644
index 00000000000..b781c8c3f77
--- /dev/null
+++ b/queue-6.1/blocklayoutdriver-fix-reference-leak-of-pnfs_device_.patch
@@ -0,0 +1,37 @@
+From d21f62e6aa9e83c4eb5bebb1bc60d0578787d83e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Dec 2023 10:05:01 -0500
+Subject: blocklayoutdriver: Fix reference leak of pnfs_device_node
+
+From: Benjamin Coddington <bcodding@redhat.com>
+
+[ Upstream commit 1530827b90025cdf80c9b0d07a166d045a0a7b81 ]
+
+The error path for blocklayout's device lookup is missing a reference drop
+for the case where a lookup finds the device, but the device is marked with
+NFS_DEVICEID_UNAVAILABLE.
+
+Fixes: b3dce6a2f060 ("pnfs/blocklayout: handle transient devices")
+Signed-off-by: Benjamin Coddington <bcodding@redhat.com>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/blocklayout/blocklayout.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/nfs/blocklayout/blocklayout.c b/fs/nfs/blocklayout/blocklayout.c
+index 943aeea1eb16..1d1d7abc3205 100644
+--- a/fs/nfs/blocklayout/blocklayout.c
++++ b/fs/nfs/blocklayout/blocklayout.c
+@@ -580,6 +580,8 @@ bl_find_get_deviceid(struct nfs_server *server,
+ 		nfs4_delete_deviceid(node->ld, node->nfs_client, id);
+ 		goto retry;
+ 	}
++
++	nfs4_put_deviceid_node(node);
+ 	return ERR_PTR(-ENODEV);
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/bluetooth-btmtkuart-fix-recv_buf-return-value.patch b/queue-6.1/bluetooth-btmtkuart-fix-recv_buf-return-value.patch
new file mode 100644
index 00000000000..52b67bfad38
--- /dev/null
+++ b/queue-6.1/bluetooth-btmtkuart-fix-recv_buf-return-value.patch
@@ -0,0 +1,68 @@
+From 76465184dd8bf1e12f26198441b8eed4e6ea445d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Dec 2023 17:40:19 +0100
+Subject: Bluetooth: btmtkuart: fix recv_buf() return value
+
+From: Francesco Dolcini <francesco.dolcini@toradex.com>
+
+[ Upstream commit 64057f051f20c2a2184b9db7f8037d928d68a4f4 ]
+
+Serdev recv_buf() callback is supposed to return the amount of bytes
+consumed, therefore an int in between 0 and count.
+
+Do not return negative number in case of issue, just print an error and
+return count. This fixes a WARN in ttyport_receive_buf().
+
+Link: https://lore.kernel.org/all/087be419-ec6b-47ad-851a-5e1e3ea5cfcc@kernel.org/
+Fixes: 7237c4c9ec92 ("Bluetooth: mediatek: Add protocol support for MediaTek serial devices")
+Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/btmtkuart.c | 11 +++--------
+ 1 file changed, 3 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/bluetooth/btmtkuart.c b/drivers/bluetooth/btmtkuart.c
+index c98691cdbbd5..04b72394dda5 100644
+--- a/drivers/bluetooth/btmtkuart.c
++++ b/drivers/bluetooth/btmtkuart.c
+@@ -337,7 +337,7 @@ mtk_stp_split(struct btmtkuart_dev *bdev, const unsigned char *data, int count,
+ 	return data;
+ }
+ 
+-static int btmtkuart_recv(struct hci_dev *hdev, const u8 *data, size_t count)
++static void btmtkuart_recv(struct hci_dev *hdev, const u8 *data, size_t count)
+ {
+ 	struct btmtkuart_dev *bdev = hci_get_drvdata(hdev);
+ 	const unsigned char *p_left = data, *p_h4;
+@@ -376,25 +376,20 @@ static int btmtkuart_recv(struct hci_dev *hdev, const u8 *data, size_t count)
+ 			bt_dev_err(bdev->hdev,
+ 				   "Frame reassembly failed (%d)", err);
+ 			bdev->rx_skb = NULL;
+-			return err;
++			return;
+ 		}
+ 
+ 		sz_left -= sz_h4;
+ 		p_left += sz_h4;
+ 	}
+-
+-	return 0;
+ }
+ 
+ static int btmtkuart_receive_buf(struct serdev_device *serdev, const u8 *data,
+ 				 size_t count)
+ {
+ 	struct btmtkuart_dev *bdev = serdev_device_get_drvdata(serdev);
+-	int err;
+ 
+-	err = btmtkuart_recv(bdev->hdev, data, count);
+-	if (err < 0)
+-		return err;
++	btmtkuart_recv(bdev->hdev, data, count);
+ 
+ 	bdev->hdev->stat.byte_rx += count;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/bluetooth-fix-bogus-check-for-re-auth-no-supported-w.patch b/queue-6.1/bluetooth-fix-bogus-check-for-re-auth-no-supported-w.patch
new file mode 100644
index 00000000000..8be4b789723
--- /dev/null
+++ b/queue-6.1/bluetooth-fix-bogus-check-for-re-auth-no-supported-w.patch
@@ -0,0 +1,88 @@
+From 74eff1a4e01b38bbf6589b12a88d5b22193f7163 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Nov 2023 14:58:03 +0100
+Subject: Bluetooth: Fix bogus check for re-auth no supported with non-ssp
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+[ Upstream commit d03376c185926098cb4d668d6458801eb785c0a5 ]
+
+This reverts 19f8def031bfa50c579149b200bfeeb919727b27
+"Bluetooth: Fix auth_complete_evt for legacy units" which seems to be
+working around a bug on a broken controller rather then any limitation
+imposed by the Bluetooth spec, in fact if there ws not possible to
+re-auth the command shall fail not succeed.
+
+Fixes: 19f8def031bf ("Bluetooth: Fix auth_complete_evt for legacy units")
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/bluetooth/hci_core.h |  1 -
+ net/bluetooth/hci_conn.c         |  8 +++-----
+ net/bluetooth/hci_event.c        | 11 ++---------
+ 3 files changed, 5 insertions(+), 15 deletions(-)
+
+diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
+index 5f8a534b6574..09c978f3d95d 100644
+--- a/include/net/bluetooth/hci_core.h
++++ b/include/net/bluetooth/hci_core.h
+@@ -942,7 +942,6 @@ void hci_inquiry_cache_flush(struct hci_dev *hdev);
+ /* ----- HCI Connections ----- */
+ enum {
+ 	HCI_CONN_AUTH_PEND,
+-	HCI_CONN_REAUTH_PEND,
+ 	HCI_CONN_ENCRYPT_PEND,
+ 	HCI_CONN_RSWITCH_PEND,
+ 	HCI_CONN_MODE_CHANGE_PEND,
+diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
+index 55e0ecd88543..12d36875358b 100644
+--- a/net/bluetooth/hci_conn.c
++++ b/net/bluetooth/hci_conn.c
+@@ -2314,12 +2314,10 @@ static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
+ 		hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED,
+ 			     sizeof(cp), &cp);
+ 
+-		/* If we're already encrypted set the REAUTH_PEND flag,
+-		 * otherwise set the ENCRYPT_PEND.
++		/* Set the ENCRYPT_PEND to trigger encryption after
++		 * authentication.
+ 		 */
+-		if (test_bit(HCI_CONN_ENCRYPT, &conn->flags))
+-			set_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
+-		else
++		if (!test_bit(HCI_CONN_ENCRYPT, &conn->flags))
+ 			set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
+ 	}
+ 
+diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
+index dcb13c64e8e7..56ecc5f97b91 100644
+--- a/net/bluetooth/hci_event.c
++++ b/net/bluetooth/hci_event.c
+@@ -3511,14 +3511,8 @@ static void hci_auth_complete_evt(struct hci_dev *hdev, void *data,
+ 
+ 	if (!ev->status) {
+ 		clear_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
+-
+-		if (!hci_conn_ssp_enabled(conn) &&
+-		    test_bit(HCI_CONN_REAUTH_PEND, &conn->flags)) {
+-			bt_dev_info(hdev, "re-auth of legacy device is not possible.");
+-		} else {
+-			set_bit(HCI_CONN_AUTH, &conn->flags);
+-			conn->sec_level = conn->pending_sec_level;
+-		}
++		set_bit(HCI_CONN_AUTH, &conn->flags);
++		conn->sec_level = conn->pending_sec_level;
+ 	} else {
+ 		if (ev->status == HCI_ERROR_PIN_OR_KEY_MISSING)
+ 			set_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
+@@ -3527,7 +3521,6 @@ static void hci_auth_complete_evt(struct hci_dev *hdev, void *data,
+ 	}
+ 
+ 	clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
+-	clear_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
+ 
+ 	if (conn->state == BT_CONFIG) {
+ 		if (!ev->status && hci_conn_ssp_enabled(conn)) {
+-- 
+2.43.0
+
diff --git a/queue-6.1/bpf-add-crosstask-check-to-__bpf_get_stack.patch b/queue-6.1/bpf-add-crosstask-check-to-__bpf_get_stack.patch
new file mode 100644
index 00000000000..9ebb81f81ed
--- /dev/null
+++ b/queue-6.1/bpf-add-crosstask-check-to-__bpf_get_stack.patch
@@ -0,0 +1,121 @@
+From e8568aac933a75135d583342a4c89eba758ac7f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Nov 2023 03:23:34 -0800
+Subject: bpf: Add crosstask check to __bpf_get_stack
+
+From: Jordan Rome <jordalgo@meta.com>
+
+[ Upstream commit b8e3a87a627b575896e448021e5c2f8a3bc19931 ]
+
+Currently get_perf_callchain only supports user stack walking for
+the current task. Passing the correct *crosstask* param will return
+0 frames if the task passed to __bpf_get_stack isn't the current
+one instead of a single incorrect frame/address. This change
+passes the correct *crosstask* param but also does a preemptive
+check in __bpf_get_stack if the task is current and returns
+-EOPNOTSUPP if it is not.
+
+This issue was found using bpf_get_task_stack inside a BPF
+iterator ("iter/task"), which iterates over all tasks.
+bpf_get_task_stack works fine for fetching kernel stacks
+but because get_perf_callchain relies on the caller to know
+if the requested *task* is the current one (via *crosstask*)
+it was failing in a confusing way.
+
+It might be possible to get user stacks for all tasks utilizing
+something like access_process_vm but that requires the bpf
+program calling bpf_get_task_stack to be sleepable and would
+therefore be a breaking change.
+
+Fixes: fa28dcb82a38 ("bpf: Introduce helper bpf_get_task_stack()")
+Signed-off-by: Jordan Rome <jordalgo@meta.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20231108112334.3433136-1-jordalgo@meta.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/uapi/linux/bpf.h       |  3 +++
+ kernel/bpf/stackmap.c          | 11 ++++++++++-
+ tools/include/uapi/linux/bpf.h |  3 +++
+ 3 files changed, 16 insertions(+), 1 deletion(-)
+
+diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
+index 92dbe89dafbf..201dc77ebbd7 100644
+--- a/include/uapi/linux/bpf.h
++++ b/include/uapi/linux/bpf.h
+@@ -4353,6 +4353,8 @@ union bpf_attr {
+  * long bpf_get_task_stack(struct task_struct *task, void *buf, u32 size, u64 flags)
+  *	Description
+  *		Return a user or a kernel stack in bpf program provided buffer.
++ *		Note: the user stack will only be populated if the *task* is
++ *		the current task; all other tasks will return -EOPNOTSUPP.
+  *		To achieve this, the helper needs *task*, which is a valid
+  *		pointer to **struct task_struct**. To store the stacktrace, the
+  *		bpf program provides *buf* with a nonnegative *size*.
+@@ -4364,6 +4366,7 @@ union bpf_attr {
+  *
+  *		**BPF_F_USER_STACK**
+  *			Collect a user space stack instead of a kernel stack.
++ *			The *task* must be the current task.
+  *		**BPF_F_USER_BUILD_ID**
+  *			Collect buildid+offset instead of ips for user stack,
+  *			only valid if **BPF_F_USER_STACK** is also specified.
+diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c
+index aecea7451b61..f86db3cf7212 100644
+--- a/kernel/bpf/stackmap.c
++++ b/kernel/bpf/stackmap.c
+@@ -391,6 +391,7 @@ static long __bpf_get_stack(struct pt_regs *regs, struct task_struct *task,
+ {
+ 	u32 trace_nr, copy_len, elem_size, num_elem, max_depth;
+ 	bool user_build_id = flags & BPF_F_USER_BUILD_ID;
++	bool crosstask = task && task != current;
+ 	u32 skip = flags & BPF_F_SKIP_FIELD_MASK;
+ 	bool user = flags & BPF_F_USER_STACK;
+ 	struct perf_callchain_entry *trace;
+@@ -413,6 +414,14 @@ static long __bpf_get_stack(struct pt_regs *regs, struct task_struct *task,
+ 	if (task && user && !user_mode(regs))
+ 		goto err_fault;
+ 
++	/* get_perf_callchain does not support crosstask user stack walking
++	 * but returns an empty stack instead of NULL.
++	 */
++	if (crosstask && user) {
++		err = -EOPNOTSUPP;
++		goto clear;
++	}
++
+ 	num_elem = size / elem_size;
+ 	max_depth = num_elem + skip;
+ 	if (sysctl_perf_event_max_stack < max_depth)
+@@ -424,7 +433,7 @@ static long __bpf_get_stack(struct pt_regs *regs, struct task_struct *task,
+ 		trace = get_callchain_entry_for_task(task, max_depth);
+ 	else
+ 		trace = get_perf_callchain(regs, 0, kernel, user, max_depth,
+-					   false, false);
++					   crosstask, false);
+ 	if (unlikely(!trace))
+ 		goto err_fault;
+ 
+diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
+index 92dbe89dafbf..201dc77ebbd7 100644
+--- a/tools/include/uapi/linux/bpf.h
++++ b/tools/include/uapi/linux/bpf.h
+@@ -4353,6 +4353,8 @@ union bpf_attr {
+  * long bpf_get_task_stack(struct task_struct *task, void *buf, u32 size, u64 flags)
+  *	Description
+  *		Return a user or a kernel stack in bpf program provided buffer.
++ *		Note: the user stack will only be populated if the *task* is
++ *		the current task; all other tasks will return -EOPNOTSUPP.
+  *		To achieve this, the helper needs *task*, which is a valid
+  *		pointer to **struct task_struct**. To store the stacktrace, the
+  *		bpf program provides *buf* with a nonnegative *size*.
+@@ -4364,6 +4366,7 @@ union bpf_attr {
+  *
+  *		**BPF_F_USER_STACK**
+  *			Collect a user space stack instead of a kernel stack.
++ *			The *task* must be the current task.
+  *		**BPF_F_USER_BUILD_ID**
+  *			Collect buildid+offset instead of ips for user stack,
+  *			only valid if **BPF_F_USER_STACK** is also specified.
+-- 
+2.43.0
+
diff --git a/queue-6.1/bpf-add-map-and-need_defer-parameters-to-.map_fd_put.patch b/queue-6.1/bpf-add-map-and-need_defer-parameters-to-.map_fd_put.patch
new file mode 100644
index 00000000000..a629d246dd8
--- /dev/null
+++ b/queue-6.1/bpf-add-map-and-need_defer-parameters-to-.map_fd_put.patch
@@ -0,0 +1,174 @@
+From d4583a4f366f28b22ae3c98878b4b7f7030185a8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Dec 2023 22:04:20 +0800
+Subject: bpf: Add map and need_defer parameters to .map_fd_put_ptr()
+
+From: Hou Tao <houtao1@huawei.com>
+
+[ Upstream commit 20c20bd11a0702ce4dc9300c3da58acf551d9725 ]
+
+map is the pointer of outer map, and need_defer needs some explanation.
+need_defer tells the implementation to defer the reference release of
+the passed element and ensure that the element is still alive before
+the bpf program, which may manipulate it, exits.
+
+The following three cases will invoke map_fd_put_ptr() and different
+need_defer values will be passed to these callers:
+
+1) release the reference of the old element in the map during map update
+   or map deletion. The release must be deferred, otherwise the bpf
+   program may incur use-after-free problem, so need_defer needs to be
+   true.
+2) release the reference of the to-be-added element in the error path of
+   map update. The to-be-added element is not visible to any bpf
+   program, so it is OK to pass false for need_defer parameter.
+3) release the references of all elements in the map during map release.
+   Any bpf program which has access to the map must have been exited and
+   released, so need_defer=false will be OK.
+
+These two parameters will be used by the following patches to fix the
+potential use-after-free problem for map-in-map.
+
+Signed-off-by: Hou Tao <houtao1@huawei.com>
+Link: https://lore.kernel.org/r/20231204140425.1480317-3-houtao@huaweicloud.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Stable-dep-of: 876673364161 ("bpf: Defer the free of inner map when necessary")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/bpf.h     |  6 +++++-
+ kernel/bpf/arraymap.c   | 12 +++++++-----
+ kernel/bpf/hashtab.c    |  6 +++---
+ kernel/bpf/map_in_map.c |  2 +-
+ kernel/bpf/map_in_map.h |  2 +-
+ 5 files changed, 17 insertions(+), 11 deletions(-)
+
+diff --git a/include/linux/bpf.h b/include/linux/bpf.h
+index 21b192ce018a..47420a973e58 100644
+--- a/include/linux/bpf.h
++++ b/include/linux/bpf.h
+@@ -102,7 +102,11 @@ struct bpf_map_ops {
+ 	/* funcs called by prog_array and perf_event_array map */
+ 	void *(*map_fd_get_ptr)(struct bpf_map *map, struct file *map_file,
+ 				int fd);
+-	void (*map_fd_put_ptr)(void *ptr);
++	/* If need_defer is true, the implementation should guarantee that
++	 * the to-be-put element is still alive before the bpf program, which
++	 * may manipulate it, exists.
++	 */
++	void (*map_fd_put_ptr)(struct bpf_map *map, void *ptr, bool need_defer);
+ 	int (*map_gen_lookup)(struct bpf_map *map, struct bpf_insn *insn_buf);
+ 	u32 (*map_fd_sys_lookup_elem)(void *ptr);
+ 	void (*map_seq_show_elem)(struct bpf_map *map, void *key,
+diff --git a/kernel/bpf/arraymap.c b/kernel/bpf/arraymap.c
+index 00f23febb9a7..c04e69f34e4d 100644
+--- a/kernel/bpf/arraymap.c
++++ b/kernel/bpf/arraymap.c
+@@ -852,7 +852,7 @@ int bpf_fd_array_map_update_elem(struct bpf_map *map, struct file *map_file,
+ 	}
+ 
+ 	if (old_ptr)
+-		map->ops->map_fd_put_ptr(old_ptr);
++		map->ops->map_fd_put_ptr(map, old_ptr, true);
+ 	return 0;
+ }
+ 
+@@ -875,7 +875,7 @@ static int fd_array_map_delete_elem(struct bpf_map *map, void *key)
+ 	}
+ 
+ 	if (old_ptr) {
+-		map->ops->map_fd_put_ptr(old_ptr);
++		map->ops->map_fd_put_ptr(map, old_ptr, true);
+ 		return 0;
+ 	} else {
+ 		return -ENOENT;
+@@ -898,8 +898,9 @@ static void *prog_fd_array_get_ptr(struct bpf_map *map,
+ 	return prog;
+ }
+ 
+-static void prog_fd_array_put_ptr(void *ptr)
++static void prog_fd_array_put_ptr(struct bpf_map *map, void *ptr, bool need_defer)
+ {
++	/* bpf_prog is freed after one RCU or tasks trace grace period */
+ 	bpf_prog_put(ptr);
+ }
+ 
+@@ -1185,8 +1186,9 @@ static void *perf_event_fd_array_get_ptr(struct bpf_map *map,
+ 	return ee;
+ }
+ 
+-static void perf_event_fd_array_put_ptr(void *ptr)
++static void perf_event_fd_array_put_ptr(struct bpf_map *map, void *ptr, bool need_defer)
+ {
++	/* bpf_perf_event is freed after one RCU grace period */
+ 	bpf_event_entry_free_rcu(ptr);
+ }
+ 
+@@ -1239,7 +1241,7 @@ static void *cgroup_fd_array_get_ptr(struct bpf_map *map,
+ 	return cgroup_get_from_fd(fd);
+ }
+ 
+-static void cgroup_fd_array_put_ptr(void *ptr)
++static void cgroup_fd_array_put_ptr(struct bpf_map *map, void *ptr, bool need_defer)
+ {
+ 	/* cgroup_put free cgrp after a rcu grace period */
+ 	cgroup_put(ptr);
+diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c
+index ce0051eee746..88c71de0a0a9 100644
+--- a/kernel/bpf/hashtab.c
++++ b/kernel/bpf/hashtab.c
+@@ -880,7 +880,7 @@ static void htab_put_fd_value(struct bpf_htab *htab, struct htab_elem *l)
+ 
+ 	if (map->ops->map_fd_put_ptr) {
+ 		ptr = fd_htab_map_get_ptr(map, l);
+-		map->ops->map_fd_put_ptr(ptr);
++		map->ops->map_fd_put_ptr(map, ptr, true);
+ 	}
+ }
+ 
+@@ -2424,7 +2424,7 @@ static void fd_htab_map_free(struct bpf_map *map)
+ 		hlist_nulls_for_each_entry_safe(l, n, head, hash_node) {
+ 			void *ptr = fd_htab_map_get_ptr(map, l);
+ 
+-			map->ops->map_fd_put_ptr(ptr);
++			map->ops->map_fd_put_ptr(map, ptr, false);
+ 		}
+ 	}
+ 
+@@ -2465,7 +2465,7 @@ int bpf_fd_htab_map_update_elem(struct bpf_map *map, struct file *map_file,
+ 
+ 	ret = htab_map_update_elem(map, key, &ptr, map_flags);
+ 	if (ret)
+-		map->ops->map_fd_put_ptr(ptr);
++		map->ops->map_fd_put_ptr(map, ptr, false);
+ 
+ 	return ret;
+ }
+diff --git a/kernel/bpf/map_in_map.c b/kernel/bpf/map_in_map.c
+index 8e87f69aae60..47ecc4818c93 100644
+--- a/kernel/bpf/map_in_map.c
++++ b/kernel/bpf/map_in_map.c
+@@ -115,7 +115,7 @@ void *bpf_map_fd_get_ptr(struct bpf_map *map,
+ 	return inner_map;
+ }
+ 
+-void bpf_map_fd_put_ptr(void *ptr)
++void bpf_map_fd_put_ptr(struct bpf_map *map, void *ptr, bool need_defer)
+ {
+ 	/* ptr->ops->map_free() has to go through one
+ 	 * rcu grace period by itself.
+diff --git a/kernel/bpf/map_in_map.h b/kernel/bpf/map_in_map.h
+index bcb7534afb3c..7d61602354de 100644
+--- a/kernel/bpf/map_in_map.h
++++ b/kernel/bpf/map_in_map.h
+@@ -13,7 +13,7 @@ struct bpf_map *bpf_map_meta_alloc(int inner_map_ufd);
+ void bpf_map_meta_free(struct bpf_map *map_meta);
+ void *bpf_map_fd_get_ptr(struct bpf_map *map, struct file *map_file,
+ 			 int ufd);
+-void bpf_map_fd_put_ptr(void *ptr);
++void bpf_map_fd_put_ptr(struct bpf_map *map, void *ptr, bool need_defer);
+ u32 bpf_map_fd_sys_lookup_elem(void *ptr);
+ 
+ #endif
+-- 
+2.43.0
+
diff --git a/queue-6.1/bpf-add-percpu-stats-for-bpf_map-elements-insertions.patch b/queue-6.1/bpf-add-percpu-stats-for-bpf_map-elements-insertions.patch
new file mode 100644
index 00000000000..5211de40793
--- /dev/null
+++ b/queue-6.1/bpf-add-percpu-stats-for-bpf_map-elements-insertions.patch
@@ -0,0 +1,77 @@
+From 4fcd45cc2334be78cdb680b7c4d08d1bc16a3b3e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Jul 2023 13:39:28 +0000
+Subject: bpf: add percpu stats for bpf_map elements insertions/deletions
+
+From: Anton Protopopov <aspsk@isovalent.com>
+
+[ Upstream commit 25954730461af01f66afa9e17036b051986b007e ]
+
+Add a generic percpu stats for bpf_map elements insertions/deletions in order
+to keep track of both, the current (approximate) number of elements in a map
+and per-cpu statistics on update/delete operations.
+
+To expose these stats a particular map implementation should initialize the
+counter and adjust it as needed using the 'bpf_map_*_elem_count' helpers
+provided by this commit.
+
+Signed-off-by: Anton Protopopov <aspsk@isovalent.com>
+Link: https://lore.kernel.org/r/20230706133932.45883-2-aspsk@isovalent.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Stable-dep-of: 876673364161 ("bpf: Defer the free of inner map when necessary")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/bpf.h | 30 ++++++++++++++++++++++++++++++
+ 1 file changed, 30 insertions(+)
+
+diff --git a/include/linux/bpf.h b/include/linux/bpf.h
+index ba22cf4f5fc0..21b192ce018a 100644
+--- a/include/linux/bpf.h
++++ b/include/linux/bpf.h
+@@ -249,6 +249,7 @@ struct bpf_map {
+ 	} owner;
+ 	bool bypass_spec_v1;
+ 	bool frozen; /* write-once; write-protected by freeze_mutex */
++	s64 __percpu *elem_count;
+ };
+ 
+ static inline bool map_value_has_spin_lock(const struct bpf_map *map)
+@@ -1791,6 +1792,35 @@ bpf_map_alloc_percpu(const struct bpf_map *map, size_t size, size_t align,
+ }
+ #endif
+ 
++static inline int
++bpf_map_init_elem_count(struct bpf_map *map)
++{
++	size_t size = sizeof(*map->elem_count), align = size;
++	gfp_t flags = GFP_USER | __GFP_NOWARN;
++
++	map->elem_count = bpf_map_alloc_percpu(map, size, align, flags);
++	if (!map->elem_count)
++		return -ENOMEM;
++
++	return 0;
++}
++
++static inline void
++bpf_map_free_elem_count(struct bpf_map *map)
++{
++	free_percpu(map->elem_count);
++}
++
++static inline void bpf_map_inc_elem_count(struct bpf_map *map)
++{
++	this_cpu_inc(*map->elem_count);
++}
++
++static inline void bpf_map_dec_elem_count(struct bpf_map *map)
++{
++	this_cpu_dec(*map->elem_count);
++}
++
+ extern int sysctl_unprivileged_bpf_disabled;
+ 
+ static inline bool bpf_allow_ptr_leaks(void)
+-- 
+2.43.0
+
diff --git a/queue-6.1/bpf-defer-the-free-of-inner-map-when-necessary.patch b/queue-6.1/bpf-defer-the-free-of-inner-map-when-necessary.patch
new file mode 100644
index 00000000000..99e0dd05a5d
--- /dev/null
+++ b/queue-6.1/bpf-defer-the-free-of-inner-map-when-necessary.patch
@@ -0,0 +1,141 @@
+From 78112dcfc9d0be828362408a7c0dde19dbbf93eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Dec 2023 22:04:22 +0800
+Subject: bpf: Defer the free of inner map when necessary
+
+From: Hou Tao <houtao1@huawei.com>
+
+[ Upstream commit 876673364161da50eed6b472d746ef88242b2368 ]
+
+When updating or deleting an inner map in map array or map htab, the map
+may still be accessed by non-sleepable program or sleepable program.
+However bpf_map_fd_put_ptr() decreases the ref-counter of the inner map
+directly through bpf_map_put(), if the ref-counter is the last one
+(which is true for most cases), the inner map will be freed by
+ops->map_free() in a kworker. But for now, most .map_free() callbacks
+don't use synchronize_rcu() or its variants to wait for the elapse of a
+RCU grace period, so after the invocation of ops->map_free completes,
+the bpf program which is accessing the inner map may incur
+use-after-free problem.
+
+Fix the free of inner map by invoking bpf_map_free_deferred() after both
+one RCU grace period and one tasks trace RCU grace period if the inner
+map has been removed from the outer map before. The deferment is
+accomplished by using call_rcu() or call_rcu_tasks_trace() when
+releasing the last ref-counter of bpf map. The newly-added rcu_head
+field in bpf_map shares the same storage space with work field to
+reduce the size of bpf_map.
+
+Fixes: bba1dc0b55ac ("bpf: Remove redundant synchronize_rcu.")
+Fixes: 638e4b825d52 ("bpf: Allows per-cpu maps and map-in-map in sleepable programs")
+Signed-off-by: Hou Tao <houtao1@huawei.com>
+Link: https://lore.kernel.org/r/20231204140425.1480317-5-houtao@huaweicloud.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/bpf.h     |  7 ++++++-
+ kernel/bpf/map_in_map.c | 11 ++++++++---
+ kernel/bpf/syscall.c    | 32 +++++++++++++++++++++++++++-----
+ 3 files changed, 41 insertions(+), 9 deletions(-)
+
+diff --git a/include/linux/bpf.h b/include/linux/bpf.h
+index 47420a973e58..c04a61ffac8a 100644
+--- a/include/linux/bpf.h
++++ b/include/linux/bpf.h
+@@ -237,7 +237,11 @@ struct bpf_map {
+ 	 */
+ 	atomic64_t refcnt ____cacheline_aligned;
+ 	atomic64_t usercnt;
+-	struct work_struct work;
++	/* rcu is used before freeing and work is only used during freeing */
++	union {
++		struct work_struct work;
++		struct rcu_head rcu;
++	};
+ 	struct mutex freeze_mutex;
+ 	atomic64_t writecnt;
+ 	/* 'Ownership' of program-containing map is claimed by the first program
+@@ -253,6 +257,7 @@ struct bpf_map {
+ 	} owner;
+ 	bool bypass_spec_v1;
+ 	bool frozen; /* write-once; write-protected by freeze_mutex */
++	bool free_after_mult_rcu_gp;
+ 	s64 __percpu *elem_count;
+ };
+ 
+diff --git a/kernel/bpf/map_in_map.c b/kernel/bpf/map_in_map.c
+index 47ecc4818c93..141f3332038c 100644
+--- a/kernel/bpf/map_in_map.c
++++ b/kernel/bpf/map_in_map.c
+@@ -117,10 +117,15 @@ void *bpf_map_fd_get_ptr(struct bpf_map *map,
+ 
+ void bpf_map_fd_put_ptr(struct bpf_map *map, void *ptr, bool need_defer)
+ {
+-	/* ptr->ops->map_free() has to go through one
+-	 * rcu grace period by itself.
++	struct bpf_map *inner_map = ptr;
++
++	/* The inner map may still be used by both non-sleepable and sleepable
++	 * bpf program, so free it after one RCU grace period and one tasks
++	 * trace RCU grace period.
+ 	 */
+-	bpf_map_put(ptr);
++	if (need_defer)
++		WRITE_ONCE(inner_map->free_after_mult_rcu_gp, true);
++	bpf_map_put(inner_map);
+ }
+ 
+ u32 bpf_map_fd_sys_lookup_elem(void *ptr)
+diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
+index 0c8b7733573e..f019c0821c70 100644
+--- a/kernel/bpf/syscall.c
++++ b/kernel/bpf/syscall.c
+@@ -628,6 +628,28 @@ static void bpf_map_put_uref(struct bpf_map *map)
+ 	}
+ }
+ 
++static void bpf_map_free_in_work(struct bpf_map *map)
++{
++	INIT_WORK(&map->work, bpf_map_free_deferred);
++	/* Avoid spawning kworkers, since they all might contend
++	 * for the same mutex like slab_mutex.
++	 */
++	queue_work(system_unbound_wq, &map->work);
++}
++
++static void bpf_map_free_rcu_gp(struct rcu_head *rcu)
++{
++	bpf_map_free_in_work(container_of(rcu, struct bpf_map, rcu));
++}
++
++static void bpf_map_free_mult_rcu_gp(struct rcu_head *rcu)
++{
++	if (rcu_trace_implies_rcu_gp())
++		bpf_map_free_rcu_gp(rcu);
++	else
++		call_rcu(rcu, bpf_map_free_rcu_gp);
++}
++
+ /* decrement map refcnt and schedule it for freeing via workqueue
+  * (unrelying map implementation ops->map_free() might sleep)
+  */
+@@ -637,11 +659,11 @@ static void __bpf_map_put(struct bpf_map *map, bool do_idr_lock)
+ 		/* bpf_map_free_id() must be called first */
+ 		bpf_map_free_id(map, do_idr_lock);
+ 		btf_put(map->btf);
+-		INIT_WORK(&map->work, bpf_map_free_deferred);
+-		/* Avoid spawning kworkers, since they all might contend
+-		 * for the same mutex like slab_mutex.
+-		 */
+-		queue_work(system_unbound_wq, &map->work);
++
++		if (READ_ONCE(map->free_after_mult_rcu_gp))
++			call_rcu_tasks_trace(&map->rcu, bpf_map_free_mult_rcu_gp);
++		else
++			bpf_map_free_in_work(map);
+ 	}
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/bpf-enforce-precision-of-r0-on-callback-return.patch b/queue-6.1/bpf-enforce-precision-of-r0-on-callback-return.patch
new file mode 100644
index 00000000000..031bba9c7f5
--- /dev/null
+++ b/queue-6.1/bpf-enforce-precision-of-r0-on-callback-return.patch
@@ -0,0 +1,46 @@
+From c38c4f1daffbeda1d194c3fa36fb17ca168930d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 Dec 2023 09:56:57 -0800
+Subject: bpf: enforce precision of R0 on callback return
+
+From: Andrii Nakryiko <andrii@kernel.org>
+
+[ Upstream commit 0acd03a5bd188b0c501d285d938439618bd855c4 ]
+
+Given verifier checks actual value, r0 has to be precise, so we need to
+propagate precision properly. r0 also has to be marked as read,
+otherwise subsequent state comparisons will ignore such register as
+unimportant and precision won't really help here.
+
+Fixes: 69c087ba6225 ("bpf: Add bpf_for_each_map_elem() helper")
+Acked-by: Eduard Zingerman <eddyz87@gmail.com>
+Acked-by: Shung-Hsi Yu <shung-hsi.yu@suse.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/r/20231202175705.885270-4-andrii@kernel.org
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/verifier.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index 142e10d49fd8..024a2393613f 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -7284,6 +7284,13 @@ static int prepare_func_exit(struct bpf_verifier_env *env, int *insn_idx)
+ 			verbose(env, "R0 not a scalar value\n");
+ 			return -EACCES;
+ 		}
++
++		/* we are going to rely on register's precise value */
++		err = mark_reg_read(env, r0, r0->parent, REG_LIVE_READ64);
++		err = err ?: mark_chain_precision(env, BPF_REG_0);
++		if (err)
++			return err;
++
+ 		if (!tnum_in(range, r0->var_off)) {
+ 			verbose_invalid_scalar(env, r0, &range, "callback return", "R0");
+ 			return -EINVAL;
+-- 
+2.43.0
+
diff --git a/queue-6.1/bpf-fix-check-for-attempt-to-corrupt-spilled-pointer.patch b/queue-6.1/bpf-fix-check-for-attempt-to-corrupt-spilled-pointer.patch
new file mode 100644
index 00000000000..e3e1988cfae
--- /dev/null
+++ b/queue-6.1/bpf-fix-check-for-attempt-to-corrupt-spilled-pointer.patch
@@ -0,0 +1,42 @@
+From a81b375ac84d04ebbad9f495443df3953a8131c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Dec 2023 10:42:41 -0800
+Subject: bpf: fix check for attempt to corrupt spilled pointer
+
+From: Andrii Nakryiko <andrii@kernel.org>
+
+[ Upstream commit ab125ed3ec1c10ccc36bc98c7a4256ad114a3dae ]
+
+When register is spilled onto a stack as a 1/2/4-byte register, we set
+slot_type[BPF_REG_SIZE - 1] (plus potentially few more below it,
+depending on actual spill size). So to check if some stack slot has
+spilled register we need to consult slot_type[7], not slot_type[0].
+
+To avoid the need to remember and double-check this in the future, just
+use is_spilled_reg() helper.
+
+Fixes: 27113c59b6d0 ("bpf: Check the other end of slot_type for STACK_SPILL")
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/r/20231205184248.1502704-4-andrii@kernel.org
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/verifier.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index 024a2393613f..adadf8546270 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -3284,7 +3284,7 @@ static int check_stack_write_fixed_off(struct bpf_verifier_env *env,
+ 	 * so it's aligned access and [off, off + size) are within stack limits
+ 	 */
+ 	if (!env->allow_ptr_leaks &&
+-	    state->stack[spi].slot_type[0] == STACK_SPILL &&
++	    is_spilled_reg(&state->stack[spi]) &&
+ 	    size != BPF_REG_SIZE) {
+ 		verbose(env, "attempt to corrupt spilled pointer on stack\n");
+ 		return -EACCES;
+-- 
+2.43.0
+
diff --git a/queue-6.1/bpf-fix-verification-of-indirect-var-off-stack-acces.patch b/queue-6.1/bpf-fix-verification-of-indirect-var-off-stack-acces.patch
new file mode 100644
index 00000000000..ed7fa767a3e
--- /dev/null
+++ b/queue-6.1/bpf-fix-verification-of-indirect-var-off-stack-acces.patch
@@ -0,0 +1,83 @@
+From 7b4ec453d802ce53d96da6be739a2a011d72b3c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Dec 2023 23:11:48 -0500
+Subject: bpf: Fix verification of indirect var-off stack access
+
+From: Andrei Matei <andreimatei1@gmail.com>
+
+[ Upstream commit a833a17aeac73b33f79433d7cee68d5cafd71e4f ]
+
+This patch fixes a bug around the verification of possibly-zero-sized
+stack accesses. When the access was done through a var-offset stack
+pointer, check_stack_access_within_bounds was incorrectly computing the
+maximum-offset of a zero-sized read to be the same as the register's min
+offset. Instead, we have to take in account the register's maximum
+possible value. The patch also simplifies how the max offset is checked;
+the check is now simpler than for min offset.
+
+The bug was allowing accesses to erroneously pass the
+check_stack_access_within_bounds() checks, only to later crash in
+check_stack_range_initialized() when all the possibly-affected stack
+slots are iterated (this time with a correct max offset).
+check_stack_range_initialized() is relying on
+check_stack_access_within_bounds() for its accesses to the
+stack-tracking vector to be within bounds; in the case of zero-sized
+accesses, we were essentially only verifying that the lowest possible
+slot was within bounds. We would crash when the max-offset of the stack
+pointer was >= 0 (which shouldn't pass verification, and hopefully is
+not something anyone's code attempts to do in practice).
+
+Thanks Hao for reporting!
+
+Fixes: 01f810ace9ed3 ("bpf: Allow variable-offset stack access")
+Reported-by: Hao Sun <sunhao.th@gmail.com>
+Signed-off-by: Andrei Matei <andreimatei1@gmail.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Acked-by: Eduard Zingerman <eddyz87@gmail.com>
+Acked-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20231207041150.229139-2-andreimatei1@gmail.com
+
+Closes: https://lore.kernel.org/bpf/CACkBjsZGEUaRCHsmaX=h-efVogsRfK1FPxmkgb0Os_frnHiNdw@mail.gmail.com/
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/verifier.c | 14 ++++----------
+ 1 file changed, 4 insertions(+), 10 deletions(-)
+
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index adadf8546270..95e7b638418e 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -4950,10 +4950,7 @@ static int check_stack_access_within_bounds(
+ 
+ 	if (tnum_is_const(reg->var_off)) {
+ 		min_off = reg->var_off.value + off;
+-		if (access_size > 0)
+-			max_off = min_off + access_size - 1;
+-		else
+-			max_off = min_off;
++		max_off = min_off + access_size;
+ 	} else {
+ 		if (reg->smax_value >= BPF_MAX_VAR_OFF ||
+ 		    reg->smin_value <= -BPF_MAX_VAR_OFF) {
+@@ -4962,15 +4959,12 @@ static int check_stack_access_within_bounds(
+ 			return -EACCES;
+ 		}
+ 		min_off = reg->smin_value + off;
+-		if (access_size > 0)
+-			max_off = reg->smax_value + off + access_size - 1;
+-		else
+-			max_off = min_off;
++		max_off = reg->smax_value + off + access_size;
+ 	}
+ 
+ 	err = check_stack_slot_within_bounds(min_off, state, type);
+-	if (!err)
+-		err = check_stack_slot_within_bounds(max_off, state, type);
++	if (!err && max_off > 0)
++		err = -EINVAL; /* out of stack access into non-negative offsets */
+ 
+ 	if (err) {
+ 		if (tnum_is_const(reg->var_off)) {
+-- 
+2.43.0
+
diff --git a/queue-6.1/bpf-lpm-fix-check-prefixlen-before-walking-trie.patch b/queue-6.1/bpf-lpm-fix-check-prefixlen-before-walking-trie.patch
new file mode 100644
index 00000000000..953482b6d04
--- /dev/null
+++ b/queue-6.1/bpf-lpm-fix-check-prefixlen-before-walking-trie.patch
@@ -0,0 +1,43 @@
+From 4eba773c556f57057e53b743e95447422ac36902 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 5 Nov 2023 09:58:01 +0100
+Subject: bpf, lpm: Fix check prefixlen before walking trie
+
+From: Florian Lehner <dev@der-flo.net>
+
+[ Upstream commit 9b75dbeb36fcd9fc7ed51d370310d0518a387769 ]
+
+When looking up an element in LPM trie, the condition 'matchlen ==
+trie->max_prefixlen' will never return true, if key->prefixlen is larger
+than trie->max_prefixlen. Consequently all elements in the LPM trie will
+be visited and no element is returned in the end.
+
+To resolve this, check key->prefixlen first before walking the LPM trie.
+
+Fixes: b95a5c4db09b ("bpf: add a longest prefix match trie map implementation")
+Signed-off-by: Florian Lehner <dev@der-flo.net>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20231105085801.3742-1-dev@der-flo.net
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/lpm_trie.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/kernel/bpf/lpm_trie.c b/kernel/bpf/lpm_trie.c
+index d833496e9e42..ce3a091d52e8 100644
+--- a/kernel/bpf/lpm_trie.c
++++ b/kernel/bpf/lpm_trie.c
+@@ -231,6 +231,9 @@ static void *trie_lookup_elem(struct bpf_map *map, void *_key)
+ 	struct lpm_trie_node *node, *found = NULL;
+ 	struct bpf_lpm_trie_key *key = _key;
+ 
++	if (key->prefixlen > trie->max_prefixlen)
++		return NULL;
++
+ 	/* Start walking the trie from the root node ... */
+ 
+ 	for (node = rcu_dereference_check(trie->root, rcu_read_lock_bh_held());
+-- 
+2.43.0
+
diff --git a/queue-6.1/bpf-sockmap-fix-proto-update-hook-to-avoid-dup-calls.patch b/queue-6.1/bpf-sockmap-fix-proto-update-hook-to-avoid-dup-calls.patch
new file mode 100644
index 00000000000..f8488b8a178
--- /dev/null
+++ b/queue-6.1/bpf-sockmap-fix-proto-update-hook-to-avoid-dup-calls.patch
@@ -0,0 +1,81 @@
+From d423d282ffc09799285ec83a7e5534851f16ea99 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Dec 2023 15:23:23 -0800
+Subject: bpf: sockmap, fix proto update hook to avoid dup calls
+
+From: John Fastabend <john.fastabend@gmail.com>
+
+[ Upstream commit 16b2f264983dc264c1560cc0170e760dec1bf54f ]
+
+When sockets are added to a sockmap or sockhash we allocate and init a
+psock. Then update the proto ops with sock_map_init_proto the flow is
+
+  sock_hash_update_common
+    sock_map_link
+      psock = sock_map_psock_get_checked() <-returns existing psock
+      sock_map_init_proto(sk, psock)       <- updates sk_proto
+
+If the socket is already in a map this results in the sock_map_init_proto
+being called multiple times on the same socket. We do this because when
+a socket is added to multiple maps this might result in a new set of BPF
+programs being attached to the socket requiring an updated ops struct.
+
+This creates a rule where it must be safe to call psock_update_sk_prot
+multiple times. When we added a fix for UAF through unix sockets in patch
+4dd9a38a753fc we broke this rule by adding a sock_hold in that path
+to ensure the sock is not released. The result is if a af_unix stream sock
+is placed in multiple maps it results in a memory leak because we call
+sock_hold multiple times with only a single sock_put on it.
+
+Fixes: 8866730aed51 ("bpf, sockmap: af_unix stream sockets need to hold ref for pair sock")
+Reported-by: Xingwei Lee <xrivendell7@gmail.com>
+Signed-off-by: John Fastabend <john.fastabend@gmail.com>
+Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
+Reviewed-by: Jakub Sitnicki <jakub@cloudflare.com>
+Link: https://lore.kernel.org/r/20231221232327.43678-2-john.fastabend@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/unix/unix_bpf.c | 21 ++++++++++++++++++---
+ 1 file changed, 18 insertions(+), 3 deletions(-)
+
+diff --git a/net/unix/unix_bpf.c b/net/unix/unix_bpf.c
+index 7ea7c3a0d0d0..bd84785bf8d6 100644
+--- a/net/unix/unix_bpf.c
++++ b/net/unix/unix_bpf.c
+@@ -161,15 +161,30 @@ int unix_stream_bpf_update_proto(struct sock *sk, struct sk_psock *psock, bool r
+ {
+ 	struct sock *sk_pair;
+ 
++	/* Restore does not decrement the sk_pair reference yet because we must
++	 * keep the a reference to the socket until after an RCU grace period
++	 * and any pending sends have completed.
++	 */
+ 	if (restore) {
+ 		sk->sk_write_space = psock->saved_write_space;
+ 		sock_replace_proto(sk, psock->sk_proto);
+ 		return 0;
+ 	}
+ 
+-	sk_pair = unix_peer(sk);
+-	sock_hold(sk_pair);
+-	psock->sk_pair = sk_pair;
++	/* psock_update_sk_prot can be called multiple times if psock is
++	 * added to multiple maps and/or slots in the same map. There is
++	 * also an edge case where replacing a psock with itself can trigger
++	 * an extra psock_update_sk_prot during the insert process. So it
++	 * must be safe to do multiple calls. Here we need to ensure we don't
++	 * increment the refcnt through sock_hold many times. There will only
++	 * be a single matching destroy operation.
++	 */
++	if (!psock->sk_pair) {
++		sk_pair = unix_peer(sk);
++		sock_hold(sk_pair);
++		psock->sk_pair = sk_pair;
++	}
++
+ 	unix_stream_bpf_check_needs_rebuild(psock->sk_proto);
+ 	sock_replace_proto(sk, &unix_stream_bpf_prot);
+ 	return 0;
+-- 
+2.43.0
+
diff --git a/queue-6.1/calipso-fix-memory-leak-in-netlbl_calipso_add_pass.patch b/queue-6.1/calipso-fix-memory-leak-in-netlbl_calipso_add_pass.patch
new file mode 100644
index 00000000000..54ee8a50858
--- /dev/null
+++ b/queue-6.1/calipso-fix-memory-leak-in-netlbl_calipso_add_pass.patch
@@ -0,0 +1,138 @@
+From c87cc1c3bbe522c9a873857c7366c6dc0c66267f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Nov 2023 09:25:54 +0000
+Subject: calipso: fix memory leak in netlbl_calipso_add_pass()
+
+From: Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru>
+
+[ Upstream commit ec4e9d630a64df500641892f4e259e8149594a99 ]
+
+If IPv6 support is disabled at boot (ipv6.disable=1),
+the calipso_init() -> netlbl_calipso_ops_register() function isn't called,
+and the netlbl_calipso_ops_get() function always returns NULL.
+In this case, the netlbl_calipso_add_pass() function allocates memory
+for the doi_def variable but doesn't free it with the calipso_doi_free().
+
+BUG: memory leak
+unreferenced object 0xffff888011d68180 (size 64):
+  comm "syz-executor.1", pid 10746, jiffies 4295410986 (age 17.928s)
+  hex dump (first 32 bytes):
+    00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00  ................
+    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
+  backtrace:
+    [<...>] kmalloc include/linux/slab.h:552 [inline]
+    [<...>] netlbl_calipso_add_pass net/netlabel/netlabel_calipso.c:76 [inline]
+    [<...>] netlbl_calipso_add+0x22e/0x4f0 net/netlabel/netlabel_calipso.c:111
+    [<...>] genl_family_rcv_msg_doit+0x22f/0x330 net/netlink/genetlink.c:739
+    [<...>] genl_family_rcv_msg net/netlink/genetlink.c:783 [inline]
+    [<...>] genl_rcv_msg+0x341/0x5a0 net/netlink/genetlink.c:800
+    [<...>] netlink_rcv_skb+0x14d/0x440 net/netlink/af_netlink.c:2515
+    [<...>] genl_rcv+0x29/0x40 net/netlink/genetlink.c:811
+    [<...>] netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline]
+    [<...>] netlink_unicast+0x54b/0x800 net/netlink/af_netlink.c:1339
+    [<...>] netlink_sendmsg+0x90a/0xdf0 net/netlink/af_netlink.c:1934
+    [<...>] sock_sendmsg_nosec net/socket.c:651 [inline]
+    [<...>] sock_sendmsg+0x157/0x190 net/socket.c:671
+    [<...>] ____sys_sendmsg+0x712/0x870 net/socket.c:2342
+    [<...>] ___sys_sendmsg+0xf8/0x170 net/socket.c:2396
+    [<...>] __sys_sendmsg+0xea/0x1b0 net/socket.c:2429
+    [<...>] do_syscall_64+0x30/0x40 arch/x86/entry/common.c:46
+    [<...>] entry_SYSCALL_64_after_hwframe+0x61/0xc6
+
+Found by InfoTeCS on behalf of Linux Verification Center
+(linuxtesting.org) with Syzkaller
+
+Fixes: cb72d38211ea ("netlabel: Initial support for the CALIPSO netlink protocol.")
+Signed-off-by: Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru>
+[PM: merged via the LSM tree at Jakub Kicinski request]
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netlabel/netlabel_calipso.c | 49 +++++++++++++++++----------------
+ 1 file changed, 26 insertions(+), 23 deletions(-)
+
+diff --git a/net/netlabel/netlabel_calipso.c b/net/netlabel/netlabel_calipso.c
+index f1d5b8465217..a07c2216d28b 100644
+--- a/net/netlabel/netlabel_calipso.c
++++ b/net/netlabel/netlabel_calipso.c
+@@ -54,6 +54,28 @@ static const struct nla_policy calipso_genl_policy[NLBL_CALIPSO_A_MAX + 1] = {
+ 	[NLBL_CALIPSO_A_MTYPE] = { .type = NLA_U32 },
+ };
+ 
++static const struct netlbl_calipso_ops *calipso_ops;
++
++/**
++ * netlbl_calipso_ops_register - Register the CALIPSO operations
++ * @ops: ops to register
++ *
++ * Description:
++ * Register the CALIPSO packet engine operations.
++ *
++ */
++const struct netlbl_calipso_ops *
++netlbl_calipso_ops_register(const struct netlbl_calipso_ops *ops)
++{
++	return xchg(&calipso_ops, ops);
++}
++EXPORT_SYMBOL(netlbl_calipso_ops_register);
++
++static const struct netlbl_calipso_ops *netlbl_calipso_ops_get(void)
++{
++	return READ_ONCE(calipso_ops);
++}
++
+ /* NetLabel Command Handlers
+  */
+ /**
+@@ -96,15 +118,18 @@ static int netlbl_calipso_add_pass(struct genl_info *info,
+  *
+  */
+ static int netlbl_calipso_add(struct sk_buff *skb, struct genl_info *info)
+-
+ {
+ 	int ret_val = -EINVAL;
+ 	struct netlbl_audit audit_info;
++	const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get();
+ 
+ 	if (!info->attrs[NLBL_CALIPSO_A_DOI] ||
+ 	    !info->attrs[NLBL_CALIPSO_A_MTYPE])
+ 		return -EINVAL;
+ 
++	if (!ops)
++		return -EOPNOTSUPP;
++
+ 	netlbl_netlink_auditinfo(&audit_info);
+ 	switch (nla_get_u32(info->attrs[NLBL_CALIPSO_A_MTYPE])) {
+ 	case CALIPSO_MAP_PASS:
+@@ -363,28 +388,6 @@ int __init netlbl_calipso_genl_init(void)
+ 	return genl_register_family(&netlbl_calipso_gnl_family);
+ }
+ 
+-static const struct netlbl_calipso_ops *calipso_ops;
+-
+-/**
+- * netlbl_calipso_ops_register - Register the CALIPSO operations
+- * @ops: ops to register
+- *
+- * Description:
+- * Register the CALIPSO packet engine operations.
+- *
+- */
+-const struct netlbl_calipso_ops *
+-netlbl_calipso_ops_register(const struct netlbl_calipso_ops *ops)
+-{
+-	return xchg(&calipso_ops, ops);
+-}
+-EXPORT_SYMBOL(netlbl_calipso_ops_register);
+-
+-static const struct netlbl_calipso_ops *netlbl_calipso_ops_get(void)
+-{
+-	return READ_ONCE(calipso_ops);
+-}
+-
+ /**
+  * calipso_doi_add - Add a new DOI to the CALIPSO protocol engine
+  * @doi_def: the DOI structure
+-- 
+2.43.0
+
diff --git a/queue-6.1/clk-fixed-rate-fix-clk_hw_register_fixed_rate_with_a.patch b/queue-6.1/clk-fixed-rate-fix-clk_hw_register_fixed_rate_with_a.patch
new file mode 100644
index 00000000000..4464164770f
--- /dev/null
+++ b/queue-6.1/clk-fixed-rate-fix-clk_hw_register_fixed_rate_with_a.patch
@@ -0,0 +1,43 @@
+From d14f813cf6afa89c86991e33238ee23d64a4b348 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Dec 2023 18:14:16 +0100
+Subject: clk: fixed-rate: fix
+ clk_hw_register_fixed_rate_with_accuracy_parent_hw
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Théo Lebrun <theo.lebrun@bootlin.com>
+
+[ Upstream commit ee0cf5e07f44a10fce8f1bfa9db226c0b5ecf880 ]
+
+Add missing comma and remove extraneous NULL argument. The macro is
+currently used by no one which explains why the typo slipped by.
+
+Fixes: 2d34f09e79c9 ("clk: fixed-rate: Add support for specifying parents via DT/pointers")
+Signed-off-by: Théo Lebrun <theo.lebrun@bootlin.com>
+Link: https://lore.kernel.org/r/20231218-mbly-clk-v1-1-44ce54108f06@bootlin.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/clk-provider.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/include/linux/clk-provider.h b/include/linux/clk-provider.h
+index 15e336281d1f..94fcfefb52f3 100644
+--- a/include/linux/clk-provider.h
++++ b/include/linux/clk-provider.h
+@@ -446,8 +446,8 @@ struct clk *clk_register_fixed_rate(struct device *dev, const char *name,
+  */
+ #define clk_hw_register_fixed_rate_with_accuracy_parent_hw(dev, name,	      \
+ 		parent_hw, flags, fixed_rate, fixed_accuracy)		      \
+-	__clk_hw_register_fixed_rate((dev), NULL, (name), NULL, (parent_hw)   \
+-				     NULL, NULL, (flags), (fixed_rate),	      \
++	__clk_hw_register_fixed_rate((dev), NULL, (name), NULL, (parent_hw),  \
++				     NULL, (flags), (fixed_rate),	      \
+ 				     (fixed_accuracy), 0, false)
+ /**
+  * clk_hw_register_fixed_rate_with_accuracy_parent_data - register fixed-rate
+-- 
+2.43.0
+
diff --git a/queue-6.1/clk-qcom-gpucc-sm8150-update-the-gpu_cc_pll1-config.patch b/queue-6.1/clk-qcom-gpucc-sm8150-update-the-gpu_cc_pll1-config.patch
new file mode 100644
index 00000000000..ad63930d5cc
--- /dev/null
+++ b/queue-6.1/clk-qcom-gpucc-sm8150-update-the-gpu_cc_pll1-config.patch
@@ -0,0 +1,40 @@
+From da963c21e23e542dcf82b0b35731b336e8e68d8c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Nov 2023 09:58:14 +0530
+Subject: clk: qcom: gpucc-sm8150: Update the gpu_cc_pll1 config
+
+From: Satya Priya Kakitapalli <quic_skakitap@quicinc.com>
+
+[ Upstream commit 6ebd9a4f8b8d2b35cf965a04849c4ba763722f13 ]
+
+Update the test_ctl_hi_val and test_ctl_hi1_val of gpu_cc_pll1
+as per latest HW recommendation.
+
+Fixes: 0cef71f2ccc8 ("clk: qcom: Add graphics clock controller driver for SM8150")
+Signed-off-by: Satya Priya Kakitapalli <quic_skakitap@quicinc.com>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20231122042814.4158076-1-quic_skakitap@quicinc.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/gpucc-sm8150.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/qcom/gpucc-sm8150.c b/drivers/clk/qcom/gpucc-sm8150.c
+index 8422fd047493..c89a5b59ddb7 100644
+--- a/drivers/clk/qcom/gpucc-sm8150.c
++++ b/drivers/clk/qcom/gpucc-sm8150.c
+@@ -37,8 +37,8 @@ static struct alpha_pll_config gpu_cc_pll1_config = {
+ 	.config_ctl_hi_val = 0x00002267,
+ 	.config_ctl_hi1_val = 0x00000024,
+ 	.test_ctl_val = 0x00000000,
+-	.test_ctl_hi_val = 0x00000002,
+-	.test_ctl_hi1_val = 0x00000000,
++	.test_ctl_hi_val = 0x00000000,
++	.test_ctl_hi1_val = 0x00000020,
+ 	.user_ctl_val = 0x00000000,
+ 	.user_ctl_hi_val = 0x00000805,
+ 	.user_ctl_hi1_val = 0x000000d0,
+-- 
+2.43.0
+
diff --git a/queue-6.1/clk-qcom-videocc-sm8150-add-missing-pll-config-prope.patch b/queue-6.1/clk-qcom-videocc-sm8150-add-missing-pll-config-prope.patch
new file mode 100644
index 00000000000..d208522142a
--- /dev/null
+++ b/queue-6.1/clk-qcom-videocc-sm8150-add-missing-pll-config-prope.patch
@@ -0,0 +1,37 @@
+From f29aa2ed3e7b6ab49e643cf59fdc1c65e5712ea7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Dec 2023 15:20:26 +0530
+Subject: clk: qcom: videocc-sm8150: Add missing PLL config property
+
+From: Satya Priya Kakitapalli <quic_skakitap@quicinc.com>
+
+[ Upstream commit 71f130c9193f613d497f7245365ed05ffdb0a401 ]
+
+When the driver was ported upstream, PLL test_ctl_hi1 register value
+was omitted. Add it to ensure the PLLs are fully configured.
+
+Fixes: 5658e8cf1a8a ("clk: qcom: add video clock controller driver for SM8150")
+Signed-off-by: Satya Priya Kakitapalli <quic_skakitap@quicinc.com>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20231201-videocc-8150-v3-3-56bec3a5e443@quicinc.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/videocc-sm8150.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clk/qcom/videocc-sm8150.c b/drivers/clk/qcom/videocc-sm8150.c
+index 6a5f89f53da8..52a9a453a143 100644
+--- a/drivers/clk/qcom/videocc-sm8150.c
++++ b/drivers/clk/qcom/videocc-sm8150.c
+@@ -33,6 +33,7 @@ static struct alpha_pll_config video_pll0_config = {
+ 	.config_ctl_val = 0x20485699,
+ 	.config_ctl_hi_val = 0x00002267,
+ 	.config_ctl_hi1_val = 0x00000024,
++	.test_ctl_hi1_val = 0x00000020,
+ 	.user_ctl_val = 0x00000000,
+ 	.user_ctl_hi_val = 0x00000805,
+ 	.user_ctl_hi1_val = 0x000000D0,
+-- 
+2.43.0
+
diff --git a/queue-6.1/clk-qcom-videocc-sm8150-update-the-videocc-resets.patch b/queue-6.1/clk-qcom-videocc-sm8150-update-the-videocc-resets.patch
new file mode 100644
index 00000000000..4b56c318889
--- /dev/null
+++ b/queue-6.1/clk-qcom-videocc-sm8150-update-the-videocc-resets.patch
@@ -0,0 +1,41 @@
+From 9d488117b4b71ca5f4921d03c45ff7884cfbacfb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Dec 2023 15:20:25 +0530
+Subject: clk: qcom: videocc-sm8150: Update the videocc resets
+
+From: Satya Priya Kakitapalli <quic_skakitap@quicinc.com>
+
+[ Upstream commit 1fd9a939db24d2f66e48f8bca3e3654add3fa205 ]
+
+Add all the available resets for the video clock controller
+on sm8150.
+
+Fixes: 5658e8cf1a8a ("clk: qcom: add video clock controller driver for SM8150")
+Signed-off-by: Satya Priya Kakitapalli <quic_skakitap@quicinc.com>
+Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20231201-videocc-8150-v3-2-56bec3a5e443@quicinc.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/videocc-sm8150.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/clk/qcom/videocc-sm8150.c b/drivers/clk/qcom/videocc-sm8150.c
+index 1afdbe4a249d..6a5f89f53da8 100644
+--- a/drivers/clk/qcom/videocc-sm8150.c
++++ b/drivers/clk/qcom/videocc-sm8150.c
+@@ -214,6 +214,10 @@ static const struct regmap_config video_cc_sm8150_regmap_config = {
+ 
+ static const struct qcom_reset_map video_cc_sm8150_resets[] = {
+ 	[VIDEO_CC_MVSC_CORE_CLK_BCR] = { 0x850, 2 },
++	[VIDEO_CC_INTERFACE_BCR] = { 0x8f0 },
++	[VIDEO_CC_MVS0_BCR] = { 0x870 },
++	[VIDEO_CC_MVS1_BCR] = { 0x8b0 },
++	[VIDEO_CC_MVSC_BCR] = { 0x810 },
+ };
+ 
+ static const struct qcom_cc_desc video_cc_sm8150_desc = {
+-- 
+2.43.0
+
diff --git a/queue-6.1/clk-renesas-rzg2l-check-reset-monitor-registers.patch b/queue-6.1/clk-renesas-rzg2l-check-reset-monitor-registers.patch
new file mode 100644
index 00000000000..902fbf8d81b
--- /dev/null
+++ b/queue-6.1/clk-renesas-rzg2l-check-reset-monitor-registers.patch
@@ -0,0 +1,138 @@
+From 53c139cf001b44013dfd4c6fa66a5bb062417600 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Dec 2023 09:06:50 +0200
+Subject: clk: renesas: rzg2l: Check reset monitor registers
+
+From: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
+
+[ Upstream commit da235d2fac212d0add570e755feb1167a830bc99 ]
+
+The hardware manual of both RZ/G2L and RZ/G3S specifies that the reset
+monitor registers need to be interrogated when the reset signals are
+toggled (chapters "Procedures for Supplying and Stopping Reset Signals"
+and "Procedure for Activating Modules").  Without this, there is a
+chance that different modules (e.g. Ethernet) are not ready after their
+reset signal is toggled, leading to failures (on probe or resume from
+deep sleep states).
+
+The same indications are available for RZ/V2M for TYPE-B reset controls.
+
+Fixes: ef3c613ccd68 ("clk: renesas: Add CPG core wrapper for RZ/G2L SoC")
+Fixes: 8090bea32484 ("clk: renesas: rzg2l: Add support for RZ/V2M reset monitor reg")
+Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/20231207070700.4156557-2-claudiu.beznea.uj@bp.renesas.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/renesas/rzg2l-cpg.c | 59 ++++++++++++++++++++++++---------
+ 1 file changed, 44 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/clk/renesas/rzg2l-cpg.c b/drivers/clk/renesas/rzg2l-cpg.c
+index 93720f319409..473feb36a38f 100644
+--- a/drivers/clk/renesas/rzg2l-cpg.c
++++ b/drivers/clk/renesas/rzg2l-cpg.c
+@@ -1121,12 +1121,27 @@ static int rzg2l_cpg_assert(struct reset_controller_dev *rcdev,
+ 	struct rzg2l_cpg_priv *priv = rcdev_to_priv(rcdev);
+ 	const struct rzg2l_cpg_info *info = priv->info;
+ 	unsigned int reg = info->resets[id].off;
+-	u32 value = BIT(info->resets[id].bit) << 16;
++	u32 mask = BIT(info->resets[id].bit);
++	s8 monbit = info->resets[id].monbit;
++	u32 value = mask << 16;
+ 
+ 	dev_dbg(rcdev->dev, "assert id:%ld offset:0x%x\n", id, CLK_RST_R(reg));
+ 
+ 	writel(value, priv->base + CLK_RST_R(reg));
+-	return 0;
++
++	if (info->has_clk_mon_regs) {
++		reg = CLK_MRST_R(reg);
++	} else if (monbit >= 0) {
++		reg = CPG_RST_MON;
++		mask = BIT(monbit);
++	} else {
++		/* Wait for at least one cycle of the RCLK clock (@ ca. 32 kHz) */
++		udelay(35);
++		return 0;
++	}
++
++	return readl_poll_timeout_atomic(priv->base + reg, value,
++					 value & mask, 10, 200);
+ }
+ 
+ static int rzg2l_cpg_deassert(struct reset_controller_dev *rcdev,
+@@ -1135,14 +1150,28 @@ static int rzg2l_cpg_deassert(struct reset_controller_dev *rcdev,
+ 	struct rzg2l_cpg_priv *priv = rcdev_to_priv(rcdev);
+ 	const struct rzg2l_cpg_info *info = priv->info;
+ 	unsigned int reg = info->resets[id].off;
+-	u32 dis = BIT(info->resets[id].bit);
+-	u32 value = (dis << 16) | dis;
++	u32 mask = BIT(info->resets[id].bit);
++	s8 monbit = info->resets[id].monbit;
++	u32 value = (mask << 16) | mask;
+ 
+ 	dev_dbg(rcdev->dev, "deassert id:%ld offset:0x%x\n", id,
+ 		CLK_RST_R(reg));
+ 
+ 	writel(value, priv->base + CLK_RST_R(reg));
+-	return 0;
++
++	if (info->has_clk_mon_regs) {
++		reg = CLK_MRST_R(reg);
++	} else if (monbit >= 0) {
++		reg = CPG_RST_MON;
++		mask = BIT(monbit);
++	} else {
++		/* Wait for at least one cycle of the RCLK clock (@ ca. 32 kHz) */
++		udelay(35);
++		return 0;
++	}
++
++	return readl_poll_timeout_atomic(priv->base + reg, value,
++					 !(value & mask), 10, 200);
+ }
+ 
+ static int rzg2l_cpg_reset(struct reset_controller_dev *rcdev,
+@@ -1154,9 +1183,6 @@ static int rzg2l_cpg_reset(struct reset_controller_dev *rcdev,
+ 	if (ret)
+ 		return ret;
+ 
+-	/* Wait for at least one cycle of the RCLK clock (@ ca. 32 kHz) */
+-	udelay(35);
+-
+ 	return rzg2l_cpg_deassert(rcdev, id);
+ }
+ 
+@@ -1165,18 +1191,21 @@ static int rzg2l_cpg_status(struct reset_controller_dev *rcdev,
+ {
+ 	struct rzg2l_cpg_priv *priv = rcdev_to_priv(rcdev);
+ 	const struct rzg2l_cpg_info *info = priv->info;
+-	unsigned int reg = info->resets[id].off;
+-	u32 bitmask = BIT(info->resets[id].bit);
+ 	s8 monbit = info->resets[id].monbit;
++	unsigned int reg;
++	u32 bitmask;
+ 
+ 	if (info->has_clk_mon_regs) {
+-		return !!(readl(priv->base + CLK_MRST_R(reg)) & bitmask);
++		reg = CLK_MRST_R(info->resets[id].off);
++		bitmask = BIT(info->resets[id].bit);
+ 	} else if (monbit >= 0) {
+-		u32 monbitmask = BIT(monbit);
+-
+-		return !!(readl(priv->base + CPG_RST_MON) & monbitmask);
++		reg = CPG_RST_MON;
++		bitmask = BIT(monbit);
++	} else {
++		return -ENOTSUPP;
+ 	}
+-	return -ENOTSUPP;
++
++	return !!(readl(priv->base + reg) & bitmask);
+ }
+ 
+ static const struct reset_control_ops rzg2l_cpg_reset_ops = {
+-- 
+2.43.0
+
diff --git a/queue-6.1/clk-renesas-rzg2l-cpg-reuse-code-in-rzg2l_cpg_reset.patch b/queue-6.1/clk-renesas-rzg2l-cpg-reuse-code-in-rzg2l_cpg_reset.patch
new file mode 100644
index 00000000000..a19a4af6fb6
--- /dev/null
+++ b/queue-6.1/clk-renesas-rzg2l-cpg-reuse-code-in-rzg2l_cpg_reset.patch
@@ -0,0 +1,82 @@
+From 128806e9c7840373cb3ef94f4910f4c5e44ba855 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Nov 2023 09:00:11 +0200
+Subject: clk: renesas: rzg2l-cpg: Reuse code in rzg2l_cpg_reset()
+
+From: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
+
+[ Upstream commit 5f9e29b9159a41fcf6733c3b59fa46a90ce3ae20 ]
+
+Code in rzg2l_cpg_reset() is equivalent with the combined code of
+rzg2l_cpg_assert() and rzg2l_cpg_deassert(). There is no need to have
+different versions thus re-use rzg2l_cpg_assert() and rzg2l_cpg_deassert().
+
+Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/20231120070024.4079344-2-claudiu.beznea.uj@bp.renesas.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Stable-dep-of: da235d2fac21 ("clk: renesas: rzg2l: Check reset monitor registers")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/renesas/rzg2l-cpg.c | 38 +++++++++++++--------------------
+ 1 file changed, 15 insertions(+), 23 deletions(-)
+
+diff --git a/drivers/clk/renesas/rzg2l-cpg.c b/drivers/clk/renesas/rzg2l-cpg.c
+index 84767cfc1e73..93720f319409 100644
+--- a/drivers/clk/renesas/rzg2l-cpg.c
++++ b/drivers/clk/renesas/rzg2l-cpg.c
+@@ -1115,29 +1115,6 @@ rzg2l_cpg_register_mod_clk(const struct rzg2l_mod_clk *mod,
+ 
+ #define rcdev_to_priv(x)	container_of(x, struct rzg2l_cpg_priv, rcdev)
+ 
+-static int rzg2l_cpg_reset(struct reset_controller_dev *rcdev,
+-			   unsigned long id)
+-{
+-	struct rzg2l_cpg_priv *priv = rcdev_to_priv(rcdev);
+-	const struct rzg2l_cpg_info *info = priv->info;
+-	unsigned int reg = info->resets[id].off;
+-	u32 dis = BIT(info->resets[id].bit);
+-	u32 we = dis << 16;
+-
+-	dev_dbg(rcdev->dev, "reset id:%ld offset:0x%x\n", id, CLK_RST_R(reg));
+-
+-	/* Reset module */
+-	writel(we, priv->base + CLK_RST_R(reg));
+-
+-	/* Wait for at least one cycle of the RCLK clock (@ ca. 32 kHz) */
+-	udelay(35);
+-
+-	/* Release module from reset state */
+-	writel(we | dis, priv->base + CLK_RST_R(reg));
+-
+-	return 0;
+-}
+-
+ static int rzg2l_cpg_assert(struct reset_controller_dev *rcdev,
+ 			    unsigned long id)
+ {
+@@ -1168,6 +1145,21 @@ static int rzg2l_cpg_deassert(struct reset_controller_dev *rcdev,
+ 	return 0;
+ }
+ 
++static int rzg2l_cpg_reset(struct reset_controller_dev *rcdev,
++			   unsigned long id)
++{
++	int ret;
++
++	ret = rzg2l_cpg_assert(rcdev, id);
++	if (ret)
++		return ret;
++
++	/* Wait for at least one cycle of the RCLK clock (@ ca. 32 kHz) */
++	udelay(35);
++
++	return rzg2l_cpg_deassert(rcdev, id);
++}
++
+ static int rzg2l_cpg_status(struct reset_controller_dev *rcdev,
+ 			    unsigned long id)
+ {
+-- 
+2.43.0
+
diff --git a/queue-6.1/clk-si5341-fix-an-error-code-problem-in-si5341_outpu.patch b/queue-6.1/clk-si5341-fix-an-error-code-problem-in-si5341_outpu.patch
new file mode 100644
index 00000000000..9ccf0b4aa11
--- /dev/null
+++ b/queue-6.1/clk-si5341-fix-an-error-code-problem-in-si5341_outpu.patch
@@ -0,0 +1,41 @@
+From d5ca16eca71c777344d41c31423b98502baaac31 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Nov 2023 11:16:36 +0800
+Subject: clk: si5341: fix an error code problem in si5341_output_clk_set_rate
+
+From: Su Hui <suhui@nfschina.com>
+
+[ Upstream commit 5607068ae5ab02c3ac9cabc6859d36e98004c341 ]
+
+regmap_bulk_write() return zero or negative error code, return the value
+of regmap_bulk_write() rather than '0'.
+
+Fixes: 3044a860fd09 ("clk: Add Si5341/Si5340 driver")
+Acked-by: Mike Looijmans <mike.looijmans@topic.nl>
+Signed-off-by: Su Hui <suhui@nfschina.com>
+Link: https://lore.kernel.org/r/20231101031633.996124-1-suhui@nfschina.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/clk-si5341.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/clk/clk-si5341.c b/drivers/clk/clk-si5341.c
+index c7d8cbd22bac..5acb35236c58 100644
+--- a/drivers/clk/clk-si5341.c
++++ b/drivers/clk/clk-si5341.c
+@@ -892,10 +892,8 @@ static int si5341_output_clk_set_rate(struct clk_hw *hw, unsigned long rate,
+ 	r[0] = r_div ? (r_div & 0xff) : 1;
+ 	r[1] = (r_div >> 8) & 0xff;
+ 	r[2] = (r_div >> 16) & 0xff;
+-	err = regmap_bulk_write(output->data->regmap,
++	return regmap_bulk_write(output->data->regmap,
+ 			SI5341_OUT_R_REG(output), r, 3);
+-
+-	return 0;
+ }
+ 
+ static int si5341_output_reparent(struct clk_si5341_output *output, u8 index)
+-- 
+2.43.0
+
diff --git a/queue-6.1/cpufreq-scmi-process-the-result-of-devm_of_clk_add_h.patch b/queue-6.1/cpufreq-scmi-process-the-result-of-devm_of_clk_add_h.patch
new file mode 100644
index 00000000000..6e1c8d4808c
--- /dev/null
+++ b/queue-6.1/cpufreq-scmi-process-the-result-of-devm_of_clk_add_h.patch
@@ -0,0 +1,43 @@
+From 0a7532f3228846792a6bcc43662b7dda4e255a87 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Dec 2023 18:12:20 +0300
+Subject: cpufreq: scmi: process the result of devm_of_clk_add_hw_provider()
+
+From: Alexandra Diupina <adiupina@astralinux.ru>
+
+[ Upstream commit c4a5118a3ae1eadc687d84eef9431f9e13eb015c ]
+
+devm_of_clk_add_hw_provider() may return an errno, so
+add a return value check
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: 8410e7f3b31e ("cpufreq: scmi: Fix OPP addition failure with a dummy clock provider")
+Signed-off-by: Alexandra Diupina <adiupina@astralinux.ru>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/scmi-cpufreq.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/cpufreq/scmi-cpufreq.c b/drivers/cpufreq/scmi-cpufreq.c
+index f34e6382a4c5..028df8a5f537 100644
+--- a/drivers/cpufreq/scmi-cpufreq.c
++++ b/drivers/cpufreq/scmi-cpufreq.c
+@@ -310,8 +310,11 @@ static int scmi_cpufreq_probe(struct scmi_device *sdev)
+ 
+ #ifdef CONFIG_COMMON_CLK
+ 	/* dummy clock provider as needed by OPP if clocks property is used */
+-	if (of_property_present(dev->of_node, "#clock-cells"))
+-		devm_of_clk_add_hw_provider(dev, of_clk_hw_simple_get, NULL);
++	if (of_property_present(dev->of_node, "#clock-cells")) {
++		ret = devm_of_clk_add_hw_provider(dev, of_clk_hw_simple_get, NULL);
++		if (ret)
++			return dev_err_probe(dev, ret, "%s: registering clock provider failed\n", __func__);
++	}
+ #endif
+ 
+ 	ret = cpufreq_register_driver(&scmi_cpufreq_driver);
+-- 
+2.43.0
+
diff --git a/queue-6.1/cpufreq-use-of_property_present-for-testing-dt-prope.patch b/queue-6.1/cpufreq-use-of_property_present-for-testing-dt-prope.patch
new file mode 100644
index 00000000000..581e1441c03
--- /dev/null
+++ b/queue-6.1/cpufreq-use-of_property_present-for-testing-dt-prope.patch
@@ -0,0 +1,105 @@
+From b612fe14f18e4fb961abdb1a86d21faf37733c81 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Mar 2023 08:47:02 -0600
+Subject: cpufreq: Use of_property_present() for testing DT property presence
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit b8f3a396a7ee43e6079176cc0fb8de2b95a23681 ]
+
+It is preferred to use typed property access functions (i.e.
+of_property_read_<type> functions) rather than low-level
+of_get_property/of_find_property functions for reading properties. As
+part of this, convert of_get_property/of_find_property calls to the
+recently added of_property_present() helper when we just want to test
+for presence of a property and nothing more.
+
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Stable-dep-of: c4a5118a3ae1 ("cpufreq: scmi: process the result of devm_of_clk_add_hw_provider()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/cpufreq-dt-platdev.c | 2 +-
+ drivers/cpufreq/imx-cpufreq-dt.c     | 2 +-
+ drivers/cpufreq/imx6q-cpufreq.c      | 4 ++--
+ drivers/cpufreq/scmi-cpufreq.c       | 2 +-
+ drivers/cpufreq/tegra20-cpufreq.c    | 2 +-
+ 5 files changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/cpufreq/cpufreq-dt-platdev.c b/drivers/cpufreq/cpufreq-dt-platdev.c
+index 69a8742c0a7a..8514bb62dd10 100644
+--- a/drivers/cpufreq/cpufreq-dt-platdev.c
++++ b/drivers/cpufreq/cpufreq-dt-platdev.c
+@@ -176,7 +176,7 @@ static bool __init cpu0_node_has_opp_v2_prop(void)
+ 	struct device_node *np = of_cpu_device_node_get(0);
+ 	bool ret = false;
+ 
+-	if (of_get_property(np, "operating-points-v2", NULL))
++	if (of_property_present(np, "operating-points-v2"))
+ 		ret = true;
+ 
+ 	of_node_put(np);
+diff --git a/drivers/cpufreq/imx-cpufreq-dt.c b/drivers/cpufreq/imx-cpufreq-dt.c
+index 76e553af2071..535867a7dfdd 100644
+--- a/drivers/cpufreq/imx-cpufreq-dt.c
++++ b/drivers/cpufreq/imx-cpufreq-dt.c
+@@ -89,7 +89,7 @@ static int imx_cpufreq_dt_probe(struct platform_device *pdev)
+ 
+ 	cpu_dev = get_cpu_device(0);
+ 
+-	if (!of_find_property(cpu_dev->of_node, "cpu-supply", NULL))
++	if (!of_property_present(cpu_dev->of_node, "cpu-supply"))
+ 		return -ENODEV;
+ 
+ 	if (of_machine_is_compatible("fsl,imx7ulp")) {
+diff --git a/drivers/cpufreq/imx6q-cpufreq.c b/drivers/cpufreq/imx6q-cpufreq.c
+index 925fc17eaacb..39b0362a3b9a 100644
+--- a/drivers/cpufreq/imx6q-cpufreq.c
++++ b/drivers/cpufreq/imx6q-cpufreq.c
+@@ -230,7 +230,7 @@ static int imx6q_opp_check_speed_grading(struct device *dev)
+ 	u32 val;
+ 	int ret;
+ 
+-	if (of_find_property(dev->of_node, "nvmem-cells", NULL)) {
++	if (of_property_present(dev->of_node, "nvmem-cells")) {
+ 		ret = nvmem_cell_read_u32(dev, "speed_grade", &val);
+ 		if (ret)
+ 			return ret;
+@@ -285,7 +285,7 @@ static int imx6ul_opp_check_speed_grading(struct device *dev)
+ 	u32 val;
+ 	int ret = 0;
+ 
+-	if (of_find_property(dev->of_node, "nvmem-cells", NULL)) {
++	if (of_property_present(dev->of_node, "nvmem-cells")) {
+ 		ret = nvmem_cell_read_u32(dev, "speed_grade", &val);
+ 		if (ret)
+ 			return ret;
+diff --git a/drivers/cpufreq/scmi-cpufreq.c b/drivers/cpufreq/scmi-cpufreq.c
+index 513a071845c2..f34e6382a4c5 100644
+--- a/drivers/cpufreq/scmi-cpufreq.c
++++ b/drivers/cpufreq/scmi-cpufreq.c
+@@ -310,7 +310,7 @@ static int scmi_cpufreq_probe(struct scmi_device *sdev)
+ 
+ #ifdef CONFIG_COMMON_CLK
+ 	/* dummy clock provider as needed by OPP if clocks property is used */
+-	if (of_find_property(dev->of_node, "#clock-cells", NULL))
++	if (of_property_present(dev->of_node, "#clock-cells"))
+ 		devm_of_clk_add_hw_provider(dev, of_clk_hw_simple_get, NULL);
+ #endif
+ 
+diff --git a/drivers/cpufreq/tegra20-cpufreq.c b/drivers/cpufreq/tegra20-cpufreq.c
+index ab7ac7df9e62..dfd2de4f8e07 100644
+--- a/drivers/cpufreq/tegra20-cpufreq.c
++++ b/drivers/cpufreq/tegra20-cpufreq.c
+@@ -25,7 +25,7 @@ static bool cpu0_node_has_opp_v2_prop(void)
+ 	struct device_node *np = of_cpu_device_node_get(0);
+ 	bool ret = false;
+ 
+-	if (of_get_property(np, "operating-points-v2", NULL))
++	if (of_property_present(np, "operating-points-v2"))
+ 		ret = true;
+ 
+ 	of_node_put(np);
+-- 
+2.43.0
+
diff --git a/queue-6.1/crypto-af_alg-disallow-multiple-in-flight-aio-reques.patch b/queue-6.1/crypto-af_alg-disallow-multiple-in-flight-aio-reques.patch
new file mode 100644
index 00000000000..89cd845b922
--- /dev/null
+++ b/queue-6.1/crypto-af_alg-disallow-multiple-in-flight-aio-reques.patch
@@ -0,0 +1,85 @@
+From fe3e76db21257a7490eb1d88a074da61be7c34f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Nov 2023 16:25:49 +0800
+Subject: crypto: af_alg - Disallow multiple in-flight AIO requests
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+[ Upstream commit 67b164a871af1d736f131fd6fe78a610909f06f3 ]
+
+Having multiple in-flight AIO requests results in unpredictable
+output because they all share the same IV.  Fix this by only allowing
+one request at a time.
+
+Fixes: 83094e5e9e49 ("crypto: af_alg - add async support to algif_aead")
+Fixes: a596999b7ddf ("crypto: algif - change algif_skcipher to be asynchronous")
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/af_alg.c         | 14 +++++++++++++-
+ include/crypto/if_alg.h |  3 +++
+ 2 files changed, 16 insertions(+), 1 deletion(-)
+
+diff --git a/crypto/af_alg.c b/crypto/af_alg.c
+index e893c0f6c879..fef69d2a6b18 100644
+--- a/crypto/af_alg.c
++++ b/crypto/af_alg.c
+@@ -1045,9 +1045,13 @@ EXPORT_SYMBOL_GPL(af_alg_sendpage);
+ void af_alg_free_resources(struct af_alg_async_req *areq)
+ {
+ 	struct sock *sk = areq->sk;
++	struct af_alg_ctx *ctx;
+ 
+ 	af_alg_free_areq_sgls(areq);
+ 	sock_kfree_s(sk, areq, areq->areqlen);
++
++	ctx = alg_sk(sk)->private;
++	ctx->inflight = false;
+ }
+ EXPORT_SYMBOL_GPL(af_alg_free_resources);
+ 
+@@ -1117,11 +1121,19 @@ EXPORT_SYMBOL_GPL(af_alg_poll);
+ struct af_alg_async_req *af_alg_alloc_areq(struct sock *sk,
+ 					   unsigned int areqlen)
+ {
+-	struct af_alg_async_req *areq = sock_kmalloc(sk, areqlen, GFP_KERNEL);
++	struct af_alg_ctx *ctx = alg_sk(sk)->private;
++	struct af_alg_async_req *areq;
++
++	/* Only one AIO request can be in flight. */
++	if (ctx->inflight)
++		return ERR_PTR(-EBUSY);
+ 
++	areq = sock_kmalloc(sk, areqlen, GFP_KERNEL);
+ 	if (unlikely(!areq))
+ 		return ERR_PTR(-ENOMEM);
+ 
++	ctx->inflight = true;
++
+ 	areq->areqlen = areqlen;
+ 	areq->sk = sk;
+ 	areq->last_rsgl = NULL;
+diff --git a/include/crypto/if_alg.h b/include/crypto/if_alg.h
+index a5db86670bdf..a406e281ae57 100644
+--- a/include/crypto/if_alg.h
++++ b/include/crypto/if_alg.h
+@@ -138,6 +138,7 @@ struct af_alg_async_req {
+  *			recvmsg is invoked.
+  * @init:		True if metadata has been sent.
+  * @len:		Length of memory allocated for this data structure.
++ * @inflight:		Non-zero when AIO requests are in flight.
+  */
+ struct af_alg_ctx {
+ 	struct list_head tsgl_list;
+@@ -156,6 +157,8 @@ struct af_alg_ctx {
+ 	bool init;
+ 
+ 	unsigned int len;
++
++	unsigned int inflight;
+ };
+ 
+ int af_alg_register_type(const struct af_alg_type *type);
+-- 
+2.43.0
+
diff --git a/queue-6.1/crypto-ccp-fix-memleak-in-ccp_init_dm_workarea.patch b/queue-6.1/crypto-ccp-fix-memleak-in-ccp_init_dm_workarea.patch
new file mode 100644
index 00000000000..d966a4b1323
--- /dev/null
+++ b/queue-6.1/crypto-ccp-fix-memleak-in-ccp_init_dm_workarea.patch
@@ -0,0 +1,45 @@
+From fcc6519c5411fc494328b2991889605198b7f73d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Nov 2023 11:47:10 +0800
+Subject: crypto: ccp - fix memleak in ccp_init_dm_workarea
+
+From: Dinghao Liu <dinghao.liu@zju.edu.cn>
+
+[ Upstream commit a1c95dd5bc1d6a5d7a75a376c2107421b7d6240d ]
+
+When dma_map_single() fails, wa->address is supposed to be freed
+by the callers of ccp_init_dm_workarea() through ccp_dm_free().
+However, many of the call spots don't expect to have to call
+ccp_dm_free() on failure of ccp_init_dm_workarea(), which may
+lead to a memleak. Let's free wa->address in ccp_init_dm_workarea()
+when dma_map_single() fails.
+
+Fixes: 63b945091a07 ("crypto: ccp - CCP device driver and interface support")
+Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
+Acked-by: Tom Lendacky <thomas.lendacky@amd.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/ccp/ccp-ops.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/crypto/ccp/ccp-ops.c b/drivers/crypto/ccp/ccp-ops.c
+index aa4e1a500691..cb8e99936abb 100644
+--- a/drivers/crypto/ccp/ccp-ops.c
++++ b/drivers/crypto/ccp/ccp-ops.c
+@@ -179,8 +179,11 @@ static int ccp_init_dm_workarea(struct ccp_dm_workarea *wa,
+ 
+ 		wa->dma.address = dma_map_single(wa->dev, wa->address, len,
+ 						 dir);
+-		if (dma_mapping_error(wa->dev, wa->dma.address))
++		if (dma_mapping_error(wa->dev, wa->dma.address)) {
++			kfree(wa->address);
++			wa->address = NULL;
+ 			return -ENOMEM;
++		}
+ 
+ 		wa->dma.length = len;
+ 	}
+-- 
+2.43.0
+
diff --git a/queue-6.1/crypto-hisilicon-hpre-save-capability-registers-in-p.patch b/queue-6.1/crypto-hisilicon-hpre-save-capability-registers-in-p.patch
new file mode 100644
index 00000000000..b6cfd055a6d
--- /dev/null
+++ b/queue-6.1/crypto-hisilicon-hpre-save-capability-registers-in-p.patch
@@ -0,0 +1,211 @@
+From ebac5ff448b99a539f1cf96be295c6c9037ed571 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 Dec 2023 17:17:20 +0800
+Subject: crypto: hisilicon/hpre - save capability registers in probe process
+
+From: Zhiqi Song <songzhiqi1@huawei.com>
+
+[ Upstream commit cf8b5156bbc8c9376f699e8d35e9464b739e33ff ]
+
+Pre-store the valid value of hpre alg support related capability
+register in hpre_qm_init(), which will be called by hpre_probe().
+It can reduce the number of capability register queries and avoid
+obtaining incorrect values in abnormal scenarios, such as reset
+failed and the memory space disabled.
+
+Fixes: f214d59a0603 ("crypto: hisilicon/hpre - support hpre capability")
+Signed-off-by: Zhiqi Song <songzhiqi1@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/hisilicon/hpre/hpre_main.c | 82 ++++++++++++++++++-----
+ 1 file changed, 64 insertions(+), 18 deletions(-)
+
+diff --git a/drivers/crypto/hisilicon/hpre/hpre_main.c b/drivers/crypto/hisilicon/hpre/hpre_main.c
+index cf02c9cde85a..269df4ec148b 100644
+--- a/drivers/crypto/hisilicon/hpre/hpre_main.c
++++ b/drivers/crypto/hisilicon/hpre/hpre_main.c
+@@ -226,6 +226,20 @@ static const struct hisi_qm_cap_info hpre_basic_info[] = {
+ 	{HPRE_CORE10_ALG_BITMAP_CAP, 0x3170, 0, GENMASK(31, 0), 0x0, 0x10, 0x10}
+ };
+ 
++enum hpre_pre_store_cap_idx {
++	HPRE_CLUSTER_NUM_CAP_IDX = 0x0,
++	HPRE_CORE_ENABLE_BITMAP_CAP_IDX,
++	HPRE_DRV_ALG_BITMAP_CAP_IDX,
++	HPRE_DEV_ALG_BITMAP_CAP_IDX,
++};
++
++static const u32 hpre_pre_store_caps[] = {
++	HPRE_CLUSTER_NUM_CAP,
++	HPRE_CORE_ENABLE_BITMAP_CAP,
++	HPRE_DRV_ALG_BITMAP_CAP,
++	HPRE_DEV_ALG_BITMAP_CAP,
++};
++
+ static const struct hpre_hw_error hpre_hw_errors[] = {
+ 	{
+ 		.int_msk = BIT(0),
+@@ -345,7 +359,7 @@ bool hpre_check_alg_support(struct hisi_qm *qm, u32 alg)
+ {
+ 	u32 cap_val;
+ 
+-	cap_val = hisi_qm_get_hw_info(qm, hpre_basic_info, HPRE_DRV_ALG_BITMAP_CAP, qm->cap_ver);
++	cap_val = qm->cap_tables.dev_cap_table[HPRE_DRV_ALG_BITMAP_CAP_IDX].cap_val;
+ 	if (alg & cap_val)
+ 		return true;
+ 
+@@ -421,16 +435,6 @@ static u32 vfs_num;
+ module_param_cb(vfs_num, &vfs_num_ops, &vfs_num, 0444);
+ MODULE_PARM_DESC(vfs_num, "Number of VFs to enable(1-63), 0(default)");
+ 
+-static inline int hpre_cluster_num(struct hisi_qm *qm)
+-{
+-	return hisi_qm_get_hw_info(qm, hpre_basic_info, HPRE_CLUSTER_NUM_CAP, qm->cap_ver);
+-}
+-
+-static inline int hpre_cluster_core_mask(struct hisi_qm *qm)
+-{
+-	return hisi_qm_get_hw_info(qm, hpre_basic_info, HPRE_CORE_ENABLE_BITMAP_CAP, qm->cap_ver);
+-}
+-
+ struct hisi_qp *hpre_create_qp(u8 type)
+ {
+ 	int node = cpu_to_node(smp_processor_id());
+@@ -497,13 +501,15 @@ static int hpre_cfg_by_dsm(struct hisi_qm *qm)
+ 
+ static int hpre_set_cluster(struct hisi_qm *qm)
+ {
+-	u32 cluster_core_mask = hpre_cluster_core_mask(qm);
+-	u8 clusters_num = hpre_cluster_num(qm);
+ 	struct device *dev = &qm->pdev->dev;
+ 	unsigned long offset;
++	u32 cluster_core_mask;
++	u8 clusters_num;
+ 	u32 val = 0;
+ 	int ret, i;
+ 
++	cluster_core_mask = qm->cap_tables.dev_cap_table[HPRE_CORE_ENABLE_BITMAP_CAP_IDX].cap_val;
++	clusters_num = qm->cap_tables.dev_cap_table[HPRE_CLUSTER_NUM_CAP_IDX].cap_val;
+ 	for (i = 0; i < clusters_num; i++) {
+ 		offset = i * HPRE_CLSTR_ADDR_INTRVL;
+ 
+@@ -698,11 +704,12 @@ static int hpre_set_user_domain_and_cache(struct hisi_qm *qm)
+ 
+ static void hpre_cnt_regs_clear(struct hisi_qm *qm)
+ {
+-	u8 clusters_num = hpre_cluster_num(qm);
+ 	unsigned long offset;
++	u8 clusters_num;
+ 	int i;
+ 
+ 	/* clear clusterX/cluster_ctrl */
++	clusters_num = qm->cap_tables.dev_cap_table[HPRE_CLUSTER_NUM_CAP_IDX].cap_val;
+ 	for (i = 0; i < clusters_num; i++) {
+ 		offset = HPRE_CLSTR_BASE + i * HPRE_CLSTR_ADDR_INTRVL;
+ 		writel(0x0, qm->io_base + offset + HPRE_CLUSTER_INQURY);
+@@ -989,13 +996,14 @@ static int hpre_pf_comm_regs_debugfs_init(struct hisi_qm *qm)
+ 
+ static int hpre_cluster_debugfs_init(struct hisi_qm *qm)
+ {
+-	u8 clusters_num = hpre_cluster_num(qm);
+ 	struct device *dev = &qm->pdev->dev;
+ 	char buf[HPRE_DBGFS_VAL_MAX_LEN];
+ 	struct debugfs_regset32 *regset;
+ 	struct dentry *tmp_d;
++	u8 clusters_num;
+ 	int i, ret;
+ 
++	clusters_num = qm->cap_tables.dev_cap_table[HPRE_CLUSTER_NUM_CAP_IDX].cap_val;
+ 	for (i = 0; i < clusters_num; i++) {
+ 		ret = snprintf(buf, HPRE_DBGFS_VAL_MAX_LEN, "cluster%d", i);
+ 		if (ret >= HPRE_DBGFS_VAL_MAX_LEN)
+@@ -1100,6 +1108,34 @@ static void hpre_debugfs_exit(struct hisi_qm *qm)
+ 	debugfs_remove_recursive(qm->debug.debug_root);
+ }
+ 
++static int hpre_pre_store_cap_reg(struct hisi_qm *qm)
++{
++	struct hisi_qm_cap_record *hpre_cap;
++	struct device *dev = &qm->pdev->dev;
++	size_t i, size;
++
++	size = ARRAY_SIZE(hpre_pre_store_caps);
++	hpre_cap = devm_kzalloc(dev, sizeof(*hpre_cap) * size, GFP_KERNEL);
++	if (!hpre_cap)
++		return -ENOMEM;
++
++	for (i = 0; i < size; i++) {
++		hpre_cap[i].type = hpre_pre_store_caps[i];
++		hpre_cap[i].cap_val = hisi_qm_get_hw_info(qm, hpre_basic_info,
++				      hpre_pre_store_caps[i], qm->cap_ver);
++	}
++
++	if (hpre_cap[HPRE_CLUSTER_NUM_CAP_IDX].cap_val > HPRE_CLUSTERS_NUM_MAX) {
++		dev_err(dev, "Device cluster num %u is out of range for driver supports %d!\n",
++			hpre_cap[HPRE_CLUSTER_NUM_CAP_IDX].cap_val, HPRE_CLUSTERS_NUM_MAX);
++		return -EINVAL;
++	}
++
++	qm->cap_tables.dev_cap_table = hpre_cap;
++
++	return 0;
++}
++
+ static int hpre_qm_init(struct hisi_qm *qm, struct pci_dev *pdev)
+ {
+ 	u64 alg_msk;
+@@ -1133,7 +1169,15 @@ static int hpre_qm_init(struct hisi_qm *qm, struct pci_dev *pdev)
+ 		return ret;
+ 	}
+ 
+-	alg_msk = hisi_qm_get_hw_info(qm, hpre_basic_info, HPRE_DEV_ALG_BITMAP_CAP, qm->cap_ver);
++	/* Fetch and save the value of capability registers */
++	ret = hpre_pre_store_cap_reg(qm);
++	if (ret) {
++		pci_err(pdev, "Failed to pre-store capability registers!\n");
++		hisi_qm_uninit(qm);
++		return ret;
++	}
++
++	alg_msk = qm->cap_tables.dev_cap_table[HPRE_DEV_ALG_BITMAP_CAP_IDX].cap_val;
+ 	ret = hisi_qm_set_algs(qm, alg_msk, hpre_dev_algs, ARRAY_SIZE(hpre_dev_algs));
+ 	if (ret) {
+ 		pci_err(pdev, "Failed to set hpre algs!\n");
+@@ -1147,11 +1191,12 @@ static int hpre_show_last_regs_init(struct hisi_qm *qm)
+ {
+ 	int cluster_dfx_regs_num =  ARRAY_SIZE(hpre_cluster_dfx_regs);
+ 	int com_dfx_regs_num = ARRAY_SIZE(hpre_com_dfx_regs);
+-	u8 clusters_num = hpre_cluster_num(qm);
+ 	struct qm_debug *debug = &qm->debug;
+ 	void __iomem *io_base;
++	u8 clusters_num;
+ 	int i, j, idx;
+ 
++	clusters_num = qm->cap_tables.dev_cap_table[HPRE_CLUSTER_NUM_CAP_IDX].cap_val;
+ 	debug->last_words = kcalloc(cluster_dfx_regs_num * clusters_num +
+ 			com_dfx_regs_num, sizeof(unsigned int), GFP_KERNEL);
+ 	if (!debug->last_words)
+@@ -1188,10 +1233,10 @@ static void hpre_show_last_dfx_regs(struct hisi_qm *qm)
+ {
+ 	int cluster_dfx_regs_num =  ARRAY_SIZE(hpre_cluster_dfx_regs);
+ 	int com_dfx_regs_num = ARRAY_SIZE(hpre_com_dfx_regs);
+-	u8 clusters_num = hpre_cluster_num(qm);
+ 	struct qm_debug *debug = &qm->debug;
+ 	struct pci_dev *pdev = qm->pdev;
+ 	void __iomem *io_base;
++	u8 clusters_num;
+ 	int i, j, idx;
+ 	u32 val;
+ 
+@@ -1206,6 +1251,7 @@ static void hpre_show_last_dfx_regs(struct hisi_qm *qm)
+ 			  hpre_com_dfx_regs[i].name, debug->last_words[i], val);
+ 	}
+ 
++	clusters_num = qm->cap_tables.dev_cap_table[HPRE_CLUSTER_NUM_CAP_IDX].cap_val;
+ 	for (i = 0; i < clusters_num; i++) {
+ 		io_base = qm->io_base + hpre_cluster_offsets[i];
+ 		for (j = 0; j <  cluster_dfx_regs_num; j++) {
+-- 
+2.43.0
+
diff --git a/queue-6.1/crypto-hisilicon-qm-add-a-function-to-set-qm-algs.patch b/queue-6.1/crypto-hisilicon-qm-add-a-function-to-set-qm-algs.patch
new file mode 100644
index 00000000000..175f5d1936e
--- /dev/null
+++ b/queue-6.1/crypto-hisilicon-qm-add-a-function-to-set-qm-algs.patch
@@ -0,0 +1,385 @@
+From bc1332dd8cf25152825087606f8825ef90b9fb59 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 Dec 2023 17:17:18 +0800
+Subject: crypto: hisilicon/qm - add a function to set qm algs
+
+From: Wenkai Lin <linwenkai6@hisilicon.com>
+
+[ Upstream commit f76f0d7f20672611974d3cc705996751fc403734 ]
+
+Extract a public function to set qm algs and remove
+the similar code for setting qm algs in each module.
+
+Signed-off-by: Wenkai Lin <linwenkai6@hisilicon.com>
+Signed-off-by: Hao Fang <fanghao11@huawei.com>
+Signed-off-by: Zhiqi Song <songzhiqi1@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Stable-dep-of: cf8b5156bbc8 ("crypto: hisilicon/hpre - save capability registers in probe process")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/hisilicon/hpre/hpre_main.c | 42 ++-----------------
+ drivers/crypto/hisilicon/qm.c             | 36 +++++++++++++++++
+ drivers/crypto/hisilicon/sec2/sec_main.c  | 47 ++++------------------
+ drivers/crypto/hisilicon/zip/zip_main.c   | 49 ++++-------------------
+ include/linux/hisi_acc_qm.h               |  8 +++-
+ 5 files changed, 62 insertions(+), 120 deletions(-)
+
+diff --git a/drivers/crypto/hisilicon/hpre/hpre_main.c b/drivers/crypto/hisilicon/hpre/hpre_main.c
+index ff8a5f20a5df..cf02c9cde85a 100644
+--- a/drivers/crypto/hisilicon/hpre/hpre_main.c
++++ b/drivers/crypto/hisilicon/hpre/hpre_main.c
+@@ -118,8 +118,6 @@
+ #define HPRE_DFX_COMMON2_LEN		0xE
+ #define HPRE_DFX_CORE_LEN		0x43
+ 
+-#define HPRE_DEV_ALG_MAX_LEN	256
+-
+ static const char hpre_name[] = "hisi_hpre";
+ static struct dentry *hpre_debugfs_root;
+ static const struct pci_device_id hpre_dev_ids[] = {
+@@ -135,12 +133,7 @@ struct hpre_hw_error {
+ 	const char *msg;
+ };
+ 
+-struct hpre_dev_alg {
+-	u32 alg_msk;
+-	const char *alg;
+-};
+-
+-static const struct hpre_dev_alg hpre_dev_algs[] = {
++static const struct qm_dev_alg hpre_dev_algs[] = {
+ 	{
+ 		.alg_msk = BIT(0),
+ 		.alg = "rsa\n"
+@@ -359,35 +352,6 @@ bool hpre_check_alg_support(struct hisi_qm *qm, u32 alg)
+ 	return false;
+ }
+ 
+-static int hpre_set_qm_algs(struct hisi_qm *qm)
+-{
+-	struct device *dev = &qm->pdev->dev;
+-	char *algs, *ptr;
+-	u32 alg_msk;
+-	int i;
+-
+-	if (!qm->use_sva)
+-		return 0;
+-
+-	algs = devm_kzalloc(dev, HPRE_DEV_ALG_MAX_LEN * sizeof(char), GFP_KERNEL);
+-	if (!algs)
+-		return -ENOMEM;
+-
+-	alg_msk = hisi_qm_get_hw_info(qm, hpre_basic_info, HPRE_DEV_ALG_BITMAP_CAP, qm->cap_ver);
+-
+-	for (i = 0; i < ARRAY_SIZE(hpre_dev_algs); i++)
+-		if (alg_msk & hpre_dev_algs[i].alg_msk)
+-			strcat(algs, hpre_dev_algs[i].alg);
+-
+-	ptr = strrchr(algs, '\n');
+-	if (ptr)
+-		*ptr = '\0';
+-
+-	qm->uacce->algs = algs;
+-
+-	return 0;
+-}
+-
+ static int hpre_diff_regs_show(struct seq_file *s, void *unused)
+ {
+ 	struct hisi_qm *qm = s->private;
+@@ -1138,6 +1102,7 @@ static void hpre_debugfs_exit(struct hisi_qm *qm)
+ 
+ static int hpre_qm_init(struct hisi_qm *qm, struct pci_dev *pdev)
+ {
++	u64 alg_msk;
+ 	int ret;
+ 
+ 	if (pdev->revision == QM_HW_V1) {
+@@ -1168,7 +1133,8 @@ static int hpre_qm_init(struct hisi_qm *qm, struct pci_dev *pdev)
+ 		return ret;
+ 	}
+ 
+-	ret = hpre_set_qm_algs(qm);
++	alg_msk = hisi_qm_get_hw_info(qm, hpre_basic_info, HPRE_DEV_ALG_BITMAP_CAP, qm->cap_ver);
++	ret = hisi_qm_set_algs(qm, alg_msk, hpre_dev_algs, ARRAY_SIZE(hpre_dev_algs));
+ 	if (ret) {
+ 		pci_err(pdev, "Failed to set hpre algs!\n");
+ 		hisi_qm_uninit(qm);
+diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c
+index d4c6a601c5f2..5539be1bfb40 100644
+--- a/drivers/crypto/hisilicon/qm.c
++++ b/drivers/crypto/hisilicon/qm.c
+@@ -237,6 +237,8 @@
+ #define QM_QOS_MAX_CIR_S		11
+ #define QM_AUTOSUSPEND_DELAY		3000
+ 
++#define QM_DEV_ALG_MAX_LEN		256
++
+ #define QM_MK_CQC_DW3_V1(hop_num, pg_sz, buf_sz, cqe_sz) \
+ 	(((hop_num) << QM_CQ_HOP_NUM_SHIFT)	| \
+ 	((pg_sz) << QM_CQ_PAGE_SIZE_SHIFT)	| \
+@@ -795,6 +797,40 @@ static void qm_get_xqc_depth(struct hisi_qm *qm, u16 *low_bits,
+ 	*high_bits = (depth >> QM_XQ_DEPTH_SHIFT) & QM_XQ_DEPTH_MASK;
+ }
+ 
++int hisi_qm_set_algs(struct hisi_qm *qm, u64 alg_msk, const struct qm_dev_alg *dev_algs,
++		     u32 dev_algs_size)
++{
++	struct device *dev = &qm->pdev->dev;
++	char *algs, *ptr;
++	int i;
++
++	if (!qm->uacce)
++		return 0;
++
++	if (dev_algs_size >= QM_DEV_ALG_MAX_LEN) {
++		dev_err(dev, "algs size %u is equal or larger than %d.\n",
++			dev_algs_size, QM_DEV_ALG_MAX_LEN);
++		return -EINVAL;
++	}
++
++	algs = devm_kzalloc(dev, QM_DEV_ALG_MAX_LEN * sizeof(char), GFP_KERNEL);
++	if (!algs)
++		return -ENOMEM;
++
++	for (i = 0; i < dev_algs_size; i++)
++		if (alg_msk & dev_algs[i].alg_msk)
++			strcat(algs, dev_algs[i].alg);
++
++	ptr = strrchr(algs, '\n');
++	if (ptr) {
++		*ptr = '\0';
++		qm->uacce->algs = algs;
++	}
++
++	return 0;
++}
++EXPORT_SYMBOL_GPL(hisi_qm_set_algs);
++
+ static u32 qm_get_irq_num(struct hisi_qm *qm)
+ {
+ 	if (qm->fun_type == QM_HW_PF)
+diff --git a/drivers/crypto/hisilicon/sec2/sec_main.c b/drivers/crypto/hisilicon/sec2/sec_main.c
+index e384988bda91..3605f610699c 100644
+--- a/drivers/crypto/hisilicon/sec2/sec_main.c
++++ b/drivers/crypto/hisilicon/sec2/sec_main.c
+@@ -121,7 +121,6 @@
+ 					GENMASK_ULL(42, 25))
+ #define SEC_AEAD_BITMAP			(GENMASK_ULL(7, 6) | GENMASK_ULL(18, 17) | \
+ 					GENMASK_ULL(45, 43))
+-#define SEC_DEV_ALG_MAX_LEN		256
+ 
+ struct sec_hw_error {
+ 	u32 int_msk;
+@@ -133,11 +132,6 @@ struct sec_dfx_item {
+ 	u32 offset;
+ };
+ 
+-struct sec_dev_alg {
+-	u64 alg_msk;
+-	const char *algs;
+-};
+-
+ static const char sec_name[] = "hisi_sec2";
+ static struct dentry *sec_debugfs_root;
+ 
+@@ -174,15 +168,15 @@ static const struct hisi_qm_cap_info sec_basic_info[] = {
+ 	{SEC_CORE4_ALG_BITMAP_HIGH, 0x3170, 0, GENMASK(31, 0), 0x3FFF, 0x3FFF, 0x3FFF},
+ };
+ 
+-static const struct sec_dev_alg sec_dev_algs[] = { {
++static const struct qm_dev_alg sec_dev_algs[] = { {
+ 		.alg_msk = SEC_CIPHER_BITMAP,
+-		.algs = "cipher\n",
++		.alg = "cipher\n",
+ 	}, {
+ 		.alg_msk = SEC_DIGEST_BITMAP,
+-		.algs = "digest\n",
++		.alg = "digest\n",
+ 	}, {
+ 		.alg_msk = SEC_AEAD_BITMAP,
+-		.algs = "aead\n",
++		.alg = "aead\n",
+ 	},
+ };
+ 
+@@ -1079,37 +1073,9 @@ static int sec_pf_probe_init(struct sec_dev *sec)
+ 	return ret;
+ }
+ 
+-static int sec_set_qm_algs(struct hisi_qm *qm)
+-{
+-	struct device *dev = &qm->pdev->dev;
+-	char *algs, *ptr;
+-	u64 alg_mask;
+-	int i;
+-
+-	if (!qm->use_sva)
+-		return 0;
+-
+-	algs = devm_kzalloc(dev, SEC_DEV_ALG_MAX_LEN * sizeof(char), GFP_KERNEL);
+-	if (!algs)
+-		return -ENOMEM;
+-
+-	alg_mask = sec_get_alg_bitmap(qm, SEC_DEV_ALG_BITMAP_HIGH, SEC_DEV_ALG_BITMAP_LOW);
+-
+-	for (i = 0; i < ARRAY_SIZE(sec_dev_algs); i++)
+-		if (alg_mask & sec_dev_algs[i].alg_msk)
+-			strcat(algs, sec_dev_algs[i].algs);
+-
+-	ptr = strrchr(algs, '\n');
+-	if (ptr)
+-		*ptr = '\0';
+-
+-	qm->uacce->algs = algs;
+-
+-	return 0;
+-}
+-
+ static int sec_qm_init(struct hisi_qm *qm, struct pci_dev *pdev)
+ {
++	u64 alg_msk;
+ 	int ret;
+ 
+ 	qm->pdev = pdev;
+@@ -1144,7 +1110,8 @@ static int sec_qm_init(struct hisi_qm *qm, struct pci_dev *pdev)
+ 		return ret;
+ 	}
+ 
+-	ret = sec_set_qm_algs(qm);
++	alg_msk = sec_get_alg_bitmap(qm, SEC_DEV_ALG_BITMAP_HIGH, SEC_DEV_ALG_BITMAP_LOW);
++	ret = hisi_qm_set_algs(qm, alg_msk, sec_dev_algs, ARRAY_SIZE(sec_dev_algs));
+ 	if (ret) {
+ 		pci_err(qm->pdev, "Failed to set sec algs!\n");
+ 		hisi_qm_uninit(qm);
+diff --git a/drivers/crypto/hisilicon/zip/zip_main.c b/drivers/crypto/hisilicon/zip/zip_main.c
+index 2c5e805ffdc3..a7a2091b6560 100644
+--- a/drivers/crypto/hisilicon/zip/zip_main.c
++++ b/drivers/crypto/hisilicon/zip/zip_main.c
+@@ -74,7 +74,6 @@
+ #define HZIP_AXI_SHUTDOWN_ENABLE	BIT(14)
+ #define HZIP_WR_PORT			BIT(11)
+ 
+-#define HZIP_DEV_ALG_MAX_LEN		256
+ #define HZIP_ALG_ZLIB_BIT		GENMASK(1, 0)
+ #define HZIP_ALG_GZIP_BIT		GENMASK(3, 2)
+ #define HZIP_ALG_DEFLATE_BIT		GENMASK(5, 4)
+@@ -128,23 +127,18 @@ struct zip_dfx_item {
+ 	u32 offset;
+ };
+ 
+-struct zip_dev_alg {
+-	u32 alg_msk;
+-	const char *algs;
+-};
+-
+-static const struct zip_dev_alg zip_dev_algs[] = { {
++static const struct qm_dev_alg zip_dev_algs[] = { {
+ 		.alg_msk = HZIP_ALG_ZLIB_BIT,
+-		.algs = "zlib\n",
++		.alg = "zlib\n",
+ 	}, {
+ 		.alg_msk = HZIP_ALG_GZIP_BIT,
+-		.algs = "gzip\n",
++		.alg = "gzip\n",
+ 	}, {
+ 		.alg_msk = HZIP_ALG_DEFLATE_BIT,
+-		.algs = "deflate\n",
++		.alg = "deflate\n",
+ 	}, {
+ 		.alg_msk = HZIP_ALG_LZ77_BIT,
+-		.algs = "lz77_zstd\n",
++		.alg = "lz77_zstd\n",
+ 	},
+ };
+ 
+@@ -478,35 +472,6 @@ static int hisi_zip_set_high_perf(struct hisi_qm *qm)
+ 	return ret;
+ }
+ 
+-static int hisi_zip_set_qm_algs(struct hisi_qm *qm)
+-{
+-	struct device *dev = &qm->pdev->dev;
+-	char *algs, *ptr;
+-	u32 alg_mask;
+-	int i;
+-
+-	if (!qm->use_sva)
+-		return 0;
+-
+-	algs = devm_kzalloc(dev, HZIP_DEV_ALG_MAX_LEN * sizeof(char), GFP_KERNEL);
+-	if (!algs)
+-		return -ENOMEM;
+-
+-	alg_mask = hisi_qm_get_hw_info(qm, zip_basic_cap_info, ZIP_DEV_ALG_BITMAP, qm->cap_ver);
+-
+-	for (i = 0; i < ARRAY_SIZE(zip_dev_algs); i++)
+-		if (alg_mask & zip_dev_algs[i].alg_msk)
+-			strcat(algs, zip_dev_algs[i].algs);
+-
+-	ptr = strrchr(algs, '\n');
+-	if (ptr)
+-		*ptr = '\0';
+-
+-	qm->uacce->algs = algs;
+-
+-	return 0;
+-}
+-
+ static void hisi_zip_open_sva_prefetch(struct hisi_qm *qm)
+ {
+ 	u32 val;
+@@ -1193,6 +1158,7 @@ static int hisi_zip_pf_probe_init(struct hisi_zip *hisi_zip)
+ 
+ static int hisi_zip_qm_init(struct hisi_qm *qm, struct pci_dev *pdev)
+ {
++	u64 alg_msk;
+ 	int ret;
+ 
+ 	qm->pdev = pdev;
+@@ -1228,7 +1194,8 @@ static int hisi_zip_qm_init(struct hisi_qm *qm, struct pci_dev *pdev)
+ 		return ret;
+ 	}
+ 
+-	ret = hisi_zip_set_qm_algs(qm);
++	alg_msk = hisi_qm_get_hw_info(qm, zip_basic_cap_info, ZIP_DEV_ALG_BITMAP, qm->cap_ver);
++	ret = hisi_qm_set_algs(qm, alg_msk, zip_dev_algs, ARRAY_SIZE(zip_dev_algs));
+ 	if (ret) {
+ 		pci_err(qm->pdev, "Failed to set zip algs!\n");
+ 		hisi_qm_uninit(qm);
+diff --git a/include/linux/hisi_acc_qm.h b/include/linux/hisi_acc_qm.h
+index 241b0dc3183e..b566ae420449 100644
+--- a/include/linux/hisi_acc_qm.h
++++ b/include/linux/hisi_acc_qm.h
+@@ -161,6 +161,11 @@ enum qm_cap_bits {
+ 	QM_SUPPORT_RPM,
+ };
+ 
++struct qm_dev_alg {
++	u64 alg_msk;
++	const char *alg;
++};
++
+ struct dfx_diff_registers {
+ 	u32 *regs;
+ 	u32 reg_offset;
+@@ -347,7 +352,6 @@ struct hisi_qm {
+ 	struct work_struct rst_work;
+ 	struct work_struct cmd_process;
+ 
+-	const char *algs;
+ 	bool use_sva;
+ 	bool is_frozen;
+ 
+@@ -533,6 +537,8 @@ void hisi_qm_regs_dump(struct seq_file *s, struct debugfs_regset32 *regset);
+ u32 hisi_qm_get_hw_info(struct hisi_qm *qm,
+ 			const struct hisi_qm_cap_info *info_table,
+ 			u32 index, bool is_read);
++int hisi_qm_set_algs(struct hisi_qm *qm, u64 alg_msk, const struct qm_dev_alg *dev_algs,
++		     u32 dev_algs_size);
+ 
+ /* Used by VFIO ACC live migration driver */
+ struct pci_driver *hisi_sec_get_pf_driver(void);
+-- 
+2.43.0
+
diff --git a/queue-6.1/crypto-hisilicon-qm-save-capability-registers-in-qm-.patch b/queue-6.1/crypto-hisilicon-qm-save-capability-registers-in-qm-.patch
new file mode 100644
index 00000000000..2fe91c31536
--- /dev/null
+++ b/queue-6.1/crypto-hisilicon-qm-save-capability-registers-in-qm-.patch
@@ -0,0 +1,257 @@
+From bbddf2e188c35ec55a6957bb005e2615fbc053e6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 Dec 2023 17:17:19 +0800
+Subject: crypto: hisilicon/qm - save capability registers in qm init process
+
+From: Zhiqi Song <songzhiqi1@huawei.com>
+
+[ Upstream commit cabe13d0bd2efb8dd50ed2310f57b33e1a69a0d4 ]
+
+In previous capability register implementation, qm irq related values
+were read from capability registers dynamically when needed. But in
+abnormal scenario, e.g. the core is timeout and the device needs to
+soft reset and reset failed after disabling the MSE, the device can
+not be removed normally, causing the following call trace:
+
+	| Call trace:
+        |  pci_irq_vector+0xfc/0x140
+        |  hisi_qm_uninit+0x278/0x3b0 [hisi_qm]
+        |  hpre_remove+0x16c/0x1c0 [hisi_hpre]
+        |  pci_device_remove+0x6c/0x264
+        |  device_release_driver_internal+0x1ec/0x3e0
+        |  device_release_driver+0x3c/0x60
+        |  pci_stop_bus_device+0xfc/0x22c
+        |  pci_stop_and_remove_bus_device+0x38/0x70
+        |  pci_iov_remove_virtfn+0x108/0x1c0
+        |  sriov_disable+0x7c/0x1e4
+        |  pci_disable_sriov+0x4c/0x6c
+        |  hisi_qm_sriov_disable+0x90/0x160 [hisi_qm]
+        |  hpre_remove+0x1a8/0x1c0 [hisi_hpre]
+        |  pci_device_remove+0x6c/0x264
+        |  device_release_driver_internal+0x1ec/0x3e0
+        |  driver_detach+0x168/0x2d0
+        |  bus_remove_driver+0xc0/0x230
+        |  driver_unregister+0x58/0xdc
+        |  pci_unregister_driver+0x40/0x220
+        |  hpre_exit+0x34/0x64 [hisi_hpre]
+        |  __arm64_sys_delete_module+0x374/0x620
+        [...]
+
+        | Call trace:
+        |  free_msi_irqs+0x25c/0x300
+        |  pci_disable_msi+0x19c/0x264
+        |  pci_free_irq_vectors+0x4c/0x70
+        |  hisi_qm_pci_uninit+0x44/0x90 [hisi_qm]
+        |  hisi_qm_uninit+0x28c/0x3b0 [hisi_qm]
+        |  hpre_remove+0x16c/0x1c0 [hisi_hpre]
+        |  pci_device_remove+0x6c/0x264
+        [...]
+
+The reason for this call trace is that when the MSE is disabled, the value
+of capability registers in the BAR space become invalid. This will make the
+subsequent unregister process get the wrong irq vector through capability
+registers and get the wrong irq number by pci_irq_vector().
+
+So add a capability table structure to pre-store the valid value of the irq
+information capability register in qm init process, avoid obtaining invalid
+capability register value after the MSE is disabled.
+
+Fixes: 3536cc55cada ("crypto: hisilicon/qm - support get device irq information from hardware registers")
+Signed-off-by: Zhiqi Song <songzhiqi1@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/hisilicon/qm.c | 62 +++++++++++++++++++++++++++++------
+ include/linux/hisi_acc_qm.h   | 12 +++++++
+ 2 files changed, 64 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c
+index f9acf7ecc41b..d4c6a601c5f2 100644
+--- a/drivers/crypto/hisilicon/qm.c
++++ b/drivers/crypto/hisilicon/qm.c
+@@ -315,6 +315,13 @@ enum qm_basic_type {
+ 	QM_VF_IRQ_NUM_CAP,
+ };
+ 
++enum qm_pre_store_cap_idx {
++	QM_EQ_IRQ_TYPE_CAP_IDX = 0x0,
++	QM_AEQ_IRQ_TYPE_CAP_IDX,
++	QM_ABN_IRQ_TYPE_CAP_IDX,
++	QM_PF2VF_IRQ_TYPE_CAP_IDX,
++};
++
+ static const struct hisi_qm_cap_info qm_cap_info_comm[] = {
+ 	{QM_SUPPORT_DB_ISOLATION, 0x30,   0, BIT(0),  0x0, 0x0, 0x0},
+ 	{QM_SUPPORT_FUNC_QOS,     0x3100, 0, BIT(8),  0x0, 0x0, 0x1},
+@@ -344,6 +351,13 @@ static const struct hisi_qm_cap_info qm_basic_info[] = {
+ 	{QM_VF_IRQ_NUM_CAP,     0x311c,   0,  GENMASK(15, 0), 0x1,       0x2,       0x3},
+ };
+ 
++static const u32 qm_pre_store_caps[] = {
++	QM_EQ_IRQ_TYPE_CAP,
++	QM_AEQ_IRQ_TYPE_CAP,
++	QM_ABN_IRQ_TYPE_CAP,
++	QM_PF2VF_IRQ_TYPE_CAP,
++};
++
+ struct qm_mailbox {
+ 	__le16 w0;
+ 	__le16 queue_num;
+@@ -4804,7 +4818,7 @@ static void qm_unregister_abnormal_irq(struct hisi_qm *qm)
+ 	if (qm->fun_type == QM_HW_VF)
+ 		return;
+ 
+-	val = hisi_qm_get_hw_info(qm, qm_basic_info, QM_ABN_IRQ_TYPE_CAP, qm->cap_ver);
++	val = qm->cap_tables.qm_cap_table[QM_ABN_IRQ_TYPE_CAP_IDX].cap_val;
+ 	if (!((val >> QM_IRQ_TYPE_SHIFT) & QM_ABN_IRQ_TYPE_MASK))
+ 		return;
+ 
+@@ -4821,7 +4835,7 @@ static int qm_register_abnormal_irq(struct hisi_qm *qm)
+ 	if (qm->fun_type == QM_HW_VF)
+ 		return 0;
+ 
+-	val = hisi_qm_get_hw_info(qm, qm_basic_info, QM_ABN_IRQ_TYPE_CAP, qm->cap_ver);
++	val = qm->cap_tables.qm_cap_table[QM_ABN_IRQ_TYPE_CAP_IDX].cap_val;
+ 	if (!((val >> QM_IRQ_TYPE_SHIFT) & QM_ABN_IRQ_TYPE_MASK))
+ 		return 0;
+ 
+@@ -4838,7 +4852,7 @@ static void qm_unregister_mb_cmd_irq(struct hisi_qm *qm)
+ 	struct pci_dev *pdev = qm->pdev;
+ 	u32 irq_vector, val;
+ 
+-	val = hisi_qm_get_hw_info(qm, qm_basic_info, QM_PF2VF_IRQ_TYPE_CAP, qm->cap_ver);
++	val = qm->cap_tables.qm_cap_table[QM_PF2VF_IRQ_TYPE_CAP_IDX].cap_val;
+ 	if (!((val >> QM_IRQ_TYPE_SHIFT) & QM_IRQ_TYPE_MASK))
+ 		return;
+ 
+@@ -4852,7 +4866,7 @@ static int qm_register_mb_cmd_irq(struct hisi_qm *qm)
+ 	u32 irq_vector, val;
+ 	int ret;
+ 
+-	val = hisi_qm_get_hw_info(qm, qm_basic_info, QM_PF2VF_IRQ_TYPE_CAP, qm->cap_ver);
++	val = qm->cap_tables.qm_cap_table[QM_PF2VF_IRQ_TYPE_CAP_IDX].cap_val;
+ 	if (!((val >> QM_IRQ_TYPE_SHIFT) & QM_IRQ_TYPE_MASK))
+ 		return 0;
+ 
+@@ -4869,7 +4883,7 @@ static void qm_unregister_aeq_irq(struct hisi_qm *qm)
+ 	struct pci_dev *pdev = qm->pdev;
+ 	u32 irq_vector, val;
+ 
+-	val = hisi_qm_get_hw_info(qm, qm_basic_info, QM_AEQ_IRQ_TYPE_CAP, qm->cap_ver);
++	val = qm->cap_tables.qm_cap_table[QM_AEQ_IRQ_TYPE_CAP_IDX].cap_val;
+ 	if (!((val >> QM_IRQ_TYPE_SHIFT) & QM_IRQ_TYPE_MASK))
+ 		return;
+ 
+@@ -4883,7 +4897,7 @@ static int qm_register_aeq_irq(struct hisi_qm *qm)
+ 	u32 irq_vector, val;
+ 	int ret;
+ 
+-	val = hisi_qm_get_hw_info(qm, qm_basic_info, QM_AEQ_IRQ_TYPE_CAP, qm->cap_ver);
++	val = qm->cap_tables.qm_cap_table[QM_AEQ_IRQ_TYPE_CAP_IDX].cap_val;
+ 	if (!((val >> QM_IRQ_TYPE_SHIFT) & QM_IRQ_TYPE_MASK))
+ 		return 0;
+ 
+@@ -4901,7 +4915,7 @@ static void qm_unregister_eq_irq(struct hisi_qm *qm)
+ 	struct pci_dev *pdev = qm->pdev;
+ 	u32 irq_vector, val;
+ 
+-	val = hisi_qm_get_hw_info(qm, qm_basic_info, QM_EQ_IRQ_TYPE_CAP, qm->cap_ver);
++	val = qm->cap_tables.qm_cap_table[QM_EQ_IRQ_TYPE_CAP_IDX].cap_val;
+ 	if (!((val >> QM_IRQ_TYPE_SHIFT) & QM_IRQ_TYPE_MASK))
+ 		return;
+ 
+@@ -4915,7 +4929,7 @@ static int qm_register_eq_irq(struct hisi_qm *qm)
+ 	u32 irq_vector, val;
+ 	int ret;
+ 
+-	val = hisi_qm_get_hw_info(qm, qm_basic_info, QM_EQ_IRQ_TYPE_CAP, qm->cap_ver);
++	val = qm->cap_tables.qm_cap_table[QM_EQ_IRQ_TYPE_CAP_IDX].cap_val;
+ 	if (!((val >> QM_IRQ_TYPE_SHIFT) & QM_IRQ_TYPE_MASK))
+ 		return 0;
+ 
+@@ -5003,7 +5017,29 @@ static int qm_get_qp_num(struct hisi_qm *qm)
+ 	return 0;
+ }
+ 
+-static void qm_get_hw_caps(struct hisi_qm *qm)
++static int qm_pre_store_irq_type_caps(struct hisi_qm *qm)
++{
++	struct hisi_qm_cap_record *qm_cap;
++	struct pci_dev *pdev = qm->pdev;
++	size_t i, size;
++
++	size = ARRAY_SIZE(qm_pre_store_caps);
++	qm_cap = devm_kzalloc(&pdev->dev, sizeof(*qm_cap) * size, GFP_KERNEL);
++	if (!qm_cap)
++		return -ENOMEM;
++
++	for (i = 0; i < size; i++) {
++		qm_cap[i].type = qm_pre_store_caps[i];
++		qm_cap[i].cap_val = hisi_qm_get_hw_info(qm, qm_basic_info,
++							qm_pre_store_caps[i], qm->cap_ver);
++	}
++
++	qm->cap_tables.qm_cap_table = qm_cap;
++
++	return 0;
++}
++
++static int qm_get_hw_caps(struct hisi_qm *qm)
+ {
+ 	const struct hisi_qm_cap_info *cap_info = qm->fun_type == QM_HW_PF ?
+ 						  qm_cap_info_pf : qm_cap_info_vf;
+@@ -5034,6 +5070,9 @@ static void qm_get_hw_caps(struct hisi_qm *qm)
+ 		if (val)
+ 			set_bit(cap_info[i].type, &qm->caps);
+ 	}
++
++	/* Fetch and save the value of irq type related capability registers */
++	return qm_pre_store_irq_type_caps(qm);
+ }
+ 
+ static int qm_get_pci_res(struct hisi_qm *qm)
+@@ -5055,7 +5094,10 @@ static int qm_get_pci_res(struct hisi_qm *qm)
+ 		goto err_request_mem_regions;
+ 	}
+ 
+-	qm_get_hw_caps(qm);
++	ret = qm_get_hw_caps(qm);
++	if (ret)
++		goto err_ioremap;
++
+ 	if (test_bit(QM_SUPPORT_DB_ISOLATION, &qm->caps)) {
+ 		qm->db_interval = QM_QP_DB_INTERVAL;
+ 		qm->db_phys_base = pci_resource_start(pdev, PCI_BAR_4);
+diff --git a/include/linux/hisi_acc_qm.h b/include/linux/hisi_acc_qm.h
+index 41203ce27d64..241b0dc3183e 100644
+--- a/include/linux/hisi_acc_qm.h
++++ b/include/linux/hisi_acc_qm.h
+@@ -266,6 +266,16 @@ struct hisi_qm_cap_info {
+ 	u32 v3_val;
+ };
+ 
++struct hisi_qm_cap_record {
++	u32 type;
++	u32 cap_val;
++};
++
++struct hisi_qm_cap_tables {
++	struct hisi_qm_cap_record *qm_cap_table;
++	struct hisi_qm_cap_record *dev_cap_table;
++};
++
+ struct hisi_qm_list {
+ 	struct mutex lock;
+ 	struct list_head list;
+@@ -348,6 +358,8 @@ struct hisi_qm {
+ 	struct qm_shaper_factor *factor;
+ 	u32 mb_qos;
+ 	u32 type_rate;
++
++	struct hisi_qm_cap_tables cap_tables;
+ };
+ 
+ struct hisi_qp_status {
+-- 
+2.43.0
+
diff --git a/queue-6.1/crypto-hisilicon-sec2-save-capability-registers-in-p.patch b/queue-6.1/crypto-hisilicon-sec2-save-capability-registers-in-p.patch
new file mode 100644
index 00000000000..a2c58d5f951
--- /dev/null
+++ b/queue-6.1/crypto-hisilicon-sec2-save-capability-registers-in-p.patch
@@ -0,0 +1,152 @@
+From 3292574633802cdcd54bd2685f13a410d7dae05b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 Dec 2023 17:17:21 +0800
+Subject: crypto: hisilicon/sec2 - save capability registers in probe process
+
+From: Zhiqi Song <songzhiqi1@huawei.com>
+
+[ Upstream commit f1115b0096c3163592e04e74f5a7548c25bda957 ]
+
+Pre-store the valid value of the sec alg support related capability
+register in sec_qm_init(), which will be called by probe process.
+It can reduce the number of capability register queries and avoid
+obtaining incorrect values in abnormal scenarios, such as reset
+failed and the memory space disabled.
+
+Fixes: 921715b6b782 ("crypto: hisilicon/sec - get algorithm bitmap from registers")
+Signed-off-by: Zhiqi Song <songzhiqi1@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/hisilicon/sec2/sec.h        |  7 ++++
+ drivers/crypto/hisilicon/sec2/sec_crypto.c | 13 +++++--
+ drivers/crypto/hisilicon/sec2/sec_main.c   | 43 ++++++++++++++++++++--
+ 3 files changed, 57 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/crypto/hisilicon/sec2/sec.h b/drivers/crypto/hisilicon/sec2/sec.h
+index 3e57fc04b377..410c83712e28 100644
+--- a/drivers/crypto/hisilicon/sec2/sec.h
++++ b/drivers/crypto/hisilicon/sec2/sec.h
+@@ -220,6 +220,13 @@ enum sec_cap_type {
+ 	SEC_CORE4_ALG_BITMAP_HIGH,
+ };
+ 
++enum sec_cap_reg_record_idx {
++	SEC_DRV_ALG_BITMAP_LOW_IDX = 0x0,
++	SEC_DRV_ALG_BITMAP_HIGH_IDX,
++	SEC_DEV_ALG_BITMAP_LOW_IDX,
++	SEC_DEV_ALG_BITMAP_HIGH_IDX,
++};
++
+ void sec_destroy_qps(struct hisi_qp **qps, int qp_num);
+ struct hisi_qp **sec_create_qps(void);
+ int sec_register_to_crypto(struct hisi_qm *qm);
+diff --git a/drivers/crypto/hisilicon/sec2/sec_crypto.c b/drivers/crypto/hisilicon/sec2/sec_crypto.c
+index 84ae8ddd1a13..cae7c414bdaf 100644
+--- a/drivers/crypto/hisilicon/sec2/sec_crypto.c
++++ b/drivers/crypto/hisilicon/sec2/sec_crypto.c
+@@ -2546,8 +2546,12 @@ static int sec_register_aead(u64 alg_mask)
+ 
+ int sec_register_to_crypto(struct hisi_qm *qm)
+ {
+-	u64 alg_mask = sec_get_alg_bitmap(qm, SEC_DRV_ALG_BITMAP_HIGH, SEC_DRV_ALG_BITMAP_LOW);
+-	int ret;
++	u64 alg_mask;
++	int ret = 0;
++
++	alg_mask = sec_get_alg_bitmap(qm, SEC_DRV_ALG_BITMAP_HIGH_IDX,
++				      SEC_DRV_ALG_BITMAP_LOW_IDX);
++
+ 
+ 	ret = sec_register_skcipher(alg_mask);
+ 	if (ret)
+@@ -2562,7 +2566,10 @@ int sec_register_to_crypto(struct hisi_qm *qm)
+ 
+ void sec_unregister_from_crypto(struct hisi_qm *qm)
+ {
+-	u64 alg_mask = sec_get_alg_bitmap(qm, SEC_DRV_ALG_BITMAP_HIGH, SEC_DRV_ALG_BITMAP_LOW);
++	u64 alg_mask;
++
++	alg_mask = sec_get_alg_bitmap(qm, SEC_DRV_ALG_BITMAP_HIGH_IDX,
++				      SEC_DRV_ALG_BITMAP_LOW_IDX);
+ 
+ 	sec_unregister_aead(alg_mask, ARRAY_SIZE(sec_aeads));
+ 	sec_unregister_skcipher(alg_mask, ARRAY_SIZE(sec_skciphers));
+diff --git a/drivers/crypto/hisilicon/sec2/sec_main.c b/drivers/crypto/hisilicon/sec2/sec_main.c
+index 3605f610699c..4bab5000a13e 100644
+--- a/drivers/crypto/hisilicon/sec2/sec_main.c
++++ b/drivers/crypto/hisilicon/sec2/sec_main.c
+@@ -168,6 +168,13 @@ static const struct hisi_qm_cap_info sec_basic_info[] = {
+ 	{SEC_CORE4_ALG_BITMAP_HIGH, 0x3170, 0, GENMASK(31, 0), 0x3FFF, 0x3FFF, 0x3FFF},
+ };
+ 
++static const u32 sec_pre_store_caps[] = {
++	SEC_DRV_ALG_BITMAP_LOW,
++	SEC_DRV_ALG_BITMAP_HIGH,
++	SEC_DEV_ALG_BITMAP_LOW,
++	SEC_DEV_ALG_BITMAP_HIGH,
++};
++
+ static const struct qm_dev_alg sec_dev_algs[] = { {
+ 		.alg_msk = SEC_CIPHER_BITMAP,
+ 		.alg = "cipher\n",
+@@ -389,8 +396,8 @@ u64 sec_get_alg_bitmap(struct hisi_qm *qm, u32 high, u32 low)
+ {
+ 	u32 cap_val_h, cap_val_l;
+ 
+-	cap_val_h = hisi_qm_get_hw_info(qm, sec_basic_info, high, qm->cap_ver);
+-	cap_val_l = hisi_qm_get_hw_info(qm, sec_basic_info, low, qm->cap_ver);
++	cap_val_h = qm->cap_tables.dev_cap_table[high].cap_val;
++	cap_val_l = qm->cap_tables.dev_cap_table[low].cap_val;
+ 
+ 	return ((u64)cap_val_h << SEC_ALG_BITMAP_SHIFT) | (u64)cap_val_l;
+ }
+@@ -1073,6 +1080,28 @@ static int sec_pf_probe_init(struct sec_dev *sec)
+ 	return ret;
+ }
+ 
++static int sec_pre_store_cap_reg(struct hisi_qm *qm)
++{
++	struct hisi_qm_cap_record *sec_cap;
++	struct pci_dev *pdev = qm->pdev;
++	size_t i, size;
++
++	size = ARRAY_SIZE(sec_pre_store_caps);
++	sec_cap = devm_kzalloc(&pdev->dev, sizeof(*sec_cap) * size, GFP_KERNEL);
++	if (!sec_cap)
++		return -ENOMEM;
++
++	for (i = 0; i < size; i++) {
++		sec_cap[i].type = sec_pre_store_caps[i];
++		sec_cap[i].cap_val = hisi_qm_get_hw_info(qm, sec_basic_info,
++				     sec_pre_store_caps[i], qm->cap_ver);
++	}
++
++	qm->cap_tables.dev_cap_table = sec_cap;
++
++	return 0;
++}
++
+ static int sec_qm_init(struct hisi_qm *qm, struct pci_dev *pdev)
+ {
+ 	u64 alg_msk;
+@@ -1110,7 +1139,15 @@ static int sec_qm_init(struct hisi_qm *qm, struct pci_dev *pdev)
+ 		return ret;
+ 	}
+ 
+-	alg_msk = sec_get_alg_bitmap(qm, SEC_DEV_ALG_BITMAP_HIGH, SEC_DEV_ALG_BITMAP_LOW);
++	/* Fetch and save the value of capability registers */
++	ret = sec_pre_store_cap_reg(qm);
++	if (ret) {
++		pci_err(qm->pdev, "Failed to pre-store capability registers!\n");
++		hisi_qm_uninit(qm);
++		return ret;
++	}
++
++	alg_msk = sec_get_alg_bitmap(qm, SEC_DEV_ALG_BITMAP_HIGH_IDX, SEC_DEV_ALG_BITMAP_LOW_IDX);
+ 	ret = hisi_qm_set_algs(qm, alg_msk, sec_dev_algs, ARRAY_SIZE(sec_dev_algs));
+ 	if (ret) {
+ 		pci_err(qm->pdev, "Failed to set sec algs!\n");
+-- 
+2.43.0
+
diff --git a/queue-6.1/crypto-hisilicon-zip-add-zip-comp-high-perf-mode-con.patch b/queue-6.1/crypto-hisilicon-zip-add-zip-comp-high-perf-mode-con.patch
new file mode 100644
index 00000000000..de845eb0b06
--- /dev/null
+++ b/queue-6.1/crypto-hisilicon-zip-add-zip-comp-high-perf-mode-con.patch
@@ -0,0 +1,125 @@
+From 6f5d234af3ab3c205e51641aefd2e429ece3f511 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Nov 2023 13:49:24 +0800
+Subject: crypto: hisilicon/zip - add zip comp high perf mode configuration
+
+From: Chenghai Huang <huangchenghai2@huawei.com>
+
+[ Upstream commit a9864bae1806499ebf3757a9e71dddde5b9c48c6 ]
+
+To meet specific application scenarios, the function of switching between
+the high performance mode and the high compression mode is added.
+
+Use the perf_mode=0/1 configuration to set the compression high perf mode,
+0(default, high compression mode), 1(high performance mode). These two
+modes only apply to the compression direction and are compatible with
+software algorithm in both directions.
+
+Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Stable-dep-of: cf8b5156bbc8 ("crypto: hisilicon/hpre - save capability registers in probe process")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/hisilicon/zip/zip_main.c | 65 +++++++++++++++++++++++++
+ 1 file changed, 65 insertions(+)
+
+diff --git a/drivers/crypto/hisilicon/zip/zip_main.c b/drivers/crypto/hisilicon/zip/zip_main.c
+index 190b4fecfc74..2c5e805ffdc3 100644
+--- a/drivers/crypto/hisilicon/zip/zip_main.c
++++ b/drivers/crypto/hisilicon/zip/zip_main.c
+@@ -107,6 +107,14 @@
+ #define HZIP_CLOCK_GATED_EN		(HZIP_CORE_GATED_EN | \
+ 					 HZIP_CORE_GATED_OOO_EN)
+ 
++/* zip comp high performance */
++#define HZIP_HIGH_PERF_OFFSET		0x301208
++
++enum {
++	HZIP_HIGH_COMP_RATE,
++	HZIP_HIGH_COMP_PERF,
++};
++
+ static const char hisi_zip_name[] = "hisi_zip";
+ static struct dentry *hzip_debugfs_root;
+ 
+@@ -352,6 +360,37 @@ static int hzip_diff_regs_show(struct seq_file *s, void *unused)
+ 	return 0;
+ }
+ DEFINE_SHOW_ATTRIBUTE(hzip_diff_regs);
++
++static int perf_mode_set(const char *val, const struct kernel_param *kp)
++{
++	int ret;
++	u32 n;
++
++	if (!val)
++		return -EINVAL;
++
++	ret = kstrtou32(val, 10, &n);
++	if (ret != 0 || (n != HZIP_HIGH_COMP_PERF &&
++			 n != HZIP_HIGH_COMP_RATE))
++		return -EINVAL;
++
++	return param_set_int(val, kp);
++}
++
++static const struct kernel_param_ops zip_com_perf_ops = {
++	.set = perf_mode_set,
++	.get = param_get_int,
++};
++
++/*
++ * perf_mode = 0 means enable high compression rate mode,
++ * perf_mode = 1 means enable high compression performance mode.
++ * These two modes only apply to the compression direction.
++ */
++static u32 perf_mode = HZIP_HIGH_COMP_RATE;
++module_param_cb(perf_mode, &zip_com_perf_ops, &perf_mode, 0444);
++MODULE_PARM_DESC(perf_mode, "ZIP high perf mode 0(default), 1(enable)");
++
+ static const struct kernel_param_ops zip_uacce_mode_ops = {
+ 	.set = uacce_mode_set,
+ 	.get = param_get_int,
+@@ -417,6 +456,28 @@ bool hisi_zip_alg_support(struct hisi_qm *qm, u32 alg)
+ 	return false;
+ }
+ 
++static int hisi_zip_set_high_perf(struct hisi_qm *qm)
++{
++	u32 val;
++	int ret;
++
++	val = readl_relaxed(qm->io_base + HZIP_HIGH_PERF_OFFSET);
++	if (perf_mode == HZIP_HIGH_COMP_PERF)
++		val |= HZIP_HIGH_COMP_PERF;
++	else
++		val &= ~HZIP_HIGH_COMP_PERF;
++
++	/* Set perf mode */
++	writel(val, qm->io_base + HZIP_HIGH_PERF_OFFSET);
++	ret = readl_relaxed_poll_timeout(qm->io_base + HZIP_HIGH_PERF_OFFSET,
++					 val, val == perf_mode, HZIP_DELAY_1_US,
++					 HZIP_POLL_TIMEOUT_US);
++	if (ret)
++		pci_err(qm->pdev, "failed to set perf mode\n");
++
++	return ret;
++}
++
+ static int hisi_zip_set_qm_algs(struct hisi_qm *qm)
+ {
+ 	struct device *dev = &qm->pdev->dev;
+@@ -1115,6 +1176,10 @@ static int hisi_zip_pf_probe_init(struct hisi_zip *hisi_zip)
+ 	if (ret)
+ 		return ret;
+ 
++	ret = hisi_zip_set_high_perf(qm);
++	if (ret)
++		return ret;
++
+ 	hisi_zip_open_sva_prefetch(qm);
+ 	hisi_qm_dev_err_init(qm);
+ 	hisi_zip_debug_regs_clear(qm);
+-- 
+2.43.0
+
diff --git a/queue-6.1/crypto-hisilicon-zip-save-capability-registers-in-pr.patch b/queue-6.1/crypto-hisilicon-zip-save-capability-registers-in-pr.patch
new file mode 100644
index 00000000000..52bacbc5873
--- /dev/null
+++ b/queue-6.1/crypto-hisilicon-zip-save-capability-registers-in-pr.patch
@@ -0,0 +1,159 @@
+From ac6d7cc33a7cdad5f8e262c7cd91f3ffa4092932 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 Dec 2023 17:17:22 +0800
+Subject: crypto: hisilicon/zip - save capability registers in probe process
+
+From: Zhiqi Song <songzhiqi1@huawei.com>
+
+[ Upstream commit 2ff0ad847951d61c2d8b309e1ccefb26c57dcc7b ]
+
+Pre-store the valid value of the zip alg support related capability
+register in hisi_zip_qm_init(), which will be called by hisi_zip_probe().
+It can reduce the number of capability register queries and avoid
+obtaining incorrect values in abnormal scenarios, such as reset failed
+and the memory space disabled.
+
+Fixes: db700974b69d ("crypto: hisilicon/zip - support zip capability")
+Signed-off-by: Zhiqi Song <songzhiqi1@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/hisilicon/zip/zip_main.c | 73 ++++++++++++++++++++-----
+ 1 file changed, 60 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/crypto/hisilicon/zip/zip_main.c b/drivers/crypto/hisilicon/zip/zip_main.c
+index a7a2091b6560..9e3f5bca27de 100644
+--- a/drivers/crypto/hisilicon/zip/zip_main.c
++++ b/drivers/crypto/hisilicon/zip/zip_main.c
+@@ -249,6 +249,26 @@ static struct hisi_qm_cap_info zip_basic_cap_info[] = {
+ 	{ZIP_CAP_MAX, 0x317c, 0, GENMASK(0, 0), 0x0, 0x0, 0x0}
+ };
+ 
++enum zip_pre_store_cap_idx {
++	ZIP_CORE_NUM_CAP_IDX = 0x0,
++	ZIP_CLUSTER_COMP_NUM_CAP_IDX,
++	ZIP_CLUSTER_DECOMP_NUM_CAP_IDX,
++	ZIP_DECOMP_ENABLE_BITMAP_IDX,
++	ZIP_COMP_ENABLE_BITMAP_IDX,
++	ZIP_DRV_ALG_BITMAP_IDX,
++	ZIP_DEV_ALG_BITMAP_IDX,
++};
++
++static const u32 zip_pre_store_caps[] = {
++	ZIP_CORE_NUM_CAP,
++	ZIP_CLUSTER_COMP_NUM_CAP,
++	ZIP_CLUSTER_DECOMP_NUM_CAP,
++	ZIP_DECOMP_ENABLE_BITMAP,
++	ZIP_COMP_ENABLE_BITMAP,
++	ZIP_DRV_ALG_BITMAP,
++	ZIP_DEV_ALG_BITMAP,
++};
++
+ enum {
+ 	HZIP_COMP_CORE0,
+ 	HZIP_COMP_CORE1,
+@@ -443,7 +463,7 @@ bool hisi_zip_alg_support(struct hisi_qm *qm, u32 alg)
+ {
+ 	u32 cap_val;
+ 
+-	cap_val = hisi_qm_get_hw_info(qm, zip_basic_cap_info, ZIP_DRV_ALG_BITMAP, qm->cap_ver);
++	cap_val = qm->cap_tables.dev_cap_table[ZIP_DRV_ALG_BITMAP_IDX].cap_val;
+ 	if ((alg & cap_val) == alg)
+ 		return true;
+ 
+@@ -568,10 +588,8 @@ static int hisi_zip_set_user_domain_and_cache(struct hisi_qm *qm)
+ 	}
+ 
+ 	/* let's open all compression/decompression cores */
+-	dcomp_bm = hisi_qm_get_hw_info(qm, zip_basic_cap_info,
+-				       ZIP_DECOMP_ENABLE_BITMAP, qm->cap_ver);
+-	comp_bm = hisi_qm_get_hw_info(qm, zip_basic_cap_info,
+-				      ZIP_COMP_ENABLE_BITMAP, qm->cap_ver);
++	dcomp_bm = qm->cap_tables.dev_cap_table[ZIP_DECOMP_ENABLE_BITMAP_IDX].cap_val;
++	comp_bm = qm->cap_tables.dev_cap_table[ZIP_COMP_ENABLE_BITMAP_IDX].cap_val;
+ 	writel(HZIP_DECOMP_CHECK_ENABLE | dcomp_bm | comp_bm, base + HZIP_CLOCK_GATE_CTRL);
+ 
+ 	/* enable sqc,cqc writeback */
+@@ -798,9 +816,8 @@ static int hisi_zip_core_debug_init(struct hisi_qm *qm)
+ 	char buf[HZIP_BUF_SIZE];
+ 	int i;
+ 
+-	zip_core_num = hisi_qm_get_hw_info(qm, zip_basic_cap_info, ZIP_CORE_NUM_CAP, qm->cap_ver);
+-	zip_comp_core_num = hisi_qm_get_hw_info(qm, zip_basic_cap_info, ZIP_CLUSTER_COMP_NUM_CAP,
+-						qm->cap_ver);
++	zip_core_num = qm->cap_tables.dev_cap_table[ZIP_CORE_NUM_CAP_IDX].cap_val;
++	zip_comp_core_num = qm->cap_tables.dev_cap_table[ZIP_CLUSTER_COMP_NUM_CAP_IDX].cap_val;
+ 
+ 	for (i = 0; i < zip_core_num; i++) {
+ 		if (i < zip_comp_core_num)
+@@ -942,7 +959,7 @@ static int hisi_zip_show_last_regs_init(struct hisi_qm *qm)
+ 	u32 zip_core_num;
+ 	int i, j, idx;
+ 
+-	zip_core_num = hisi_qm_get_hw_info(qm, zip_basic_cap_info, ZIP_CORE_NUM_CAP, qm->cap_ver);
++	zip_core_num = qm->cap_tables.dev_cap_table[ZIP_CORE_NUM_CAP_IDX].cap_val;
+ 
+ 	debug->last_words = kcalloc(core_dfx_regs_num * zip_core_num + com_dfx_regs_num,
+ 				    sizeof(unsigned int), GFP_KERNEL);
+@@ -998,9 +1015,9 @@ static void hisi_zip_show_last_dfx_regs(struct hisi_qm *qm)
+ 				 hzip_com_dfx_regs[i].name, debug->last_words[i], val);
+ 	}
+ 
+-	zip_core_num = hisi_qm_get_hw_info(qm, zip_basic_cap_info, ZIP_CORE_NUM_CAP, qm->cap_ver);
+-	zip_comp_core_num = hisi_qm_get_hw_info(qm, zip_basic_cap_info, ZIP_CLUSTER_COMP_NUM_CAP,
+-						qm->cap_ver);
++	zip_core_num = qm->cap_tables.dev_cap_table[ZIP_CORE_NUM_CAP_IDX].cap_val;
++	zip_comp_core_num = qm->cap_tables.dev_cap_table[ZIP_CLUSTER_COMP_NUM_CAP_IDX].cap_val;
++
+ 	for (i = 0; i < zip_core_num; i++) {
+ 		if (i < zip_comp_core_num)
+ 			scnprintf(buf, sizeof(buf), "Comp_core-%d", i);
+@@ -1156,6 +1173,28 @@ static int hisi_zip_pf_probe_init(struct hisi_zip *hisi_zip)
+ 	return ret;
+ }
+ 
++static int zip_pre_store_cap_reg(struct hisi_qm *qm)
++{
++	struct hisi_qm_cap_record *zip_cap;
++	struct pci_dev *pdev = qm->pdev;
++	size_t i, size;
++
++	size = ARRAY_SIZE(zip_pre_store_caps);
++	zip_cap = devm_kzalloc(&pdev->dev, sizeof(*zip_cap) * size, GFP_KERNEL);
++	if (!zip_cap)
++		return -ENOMEM;
++
++	for (i = 0; i < size; i++) {
++		zip_cap[i].type = zip_pre_store_caps[i];
++		zip_cap[i].cap_val = hisi_qm_get_hw_info(qm, zip_basic_cap_info,
++				     zip_pre_store_caps[i], qm->cap_ver);
++	}
++
++	qm->cap_tables.dev_cap_table = zip_cap;
++
++	return 0;
++}
++
+ static int hisi_zip_qm_init(struct hisi_qm *qm, struct pci_dev *pdev)
+ {
+ 	u64 alg_msk;
+@@ -1194,7 +1233,15 @@ static int hisi_zip_qm_init(struct hisi_qm *qm, struct pci_dev *pdev)
+ 		return ret;
+ 	}
+ 
+-	alg_msk = hisi_qm_get_hw_info(qm, zip_basic_cap_info, ZIP_DEV_ALG_BITMAP, qm->cap_ver);
++	/* Fetch and save the value of capability registers */
++	ret = zip_pre_store_cap_reg(qm);
++	if (ret) {
++		pci_err(qm->pdev, "Failed to pre-store capability registers!\n");
++		hisi_qm_uninit(qm);
++		return ret;
++	}
++
++	alg_msk = qm->cap_tables.dev_cap_table[ZIP_DEV_ALG_BITMAP_IDX].cap_val;
+ 	ret = hisi_qm_set_algs(qm, alg_msk, zip_dev_algs, ARRAY_SIZE(zip_dev_algs));
+ 	if (ret) {
+ 		pci_err(qm->pdev, "Failed to set zip algs!\n");
+-- 
+2.43.0
+
diff --git a/queue-6.1/crypto-sa2ul-return-crypto_aead_setkey-to-transfer-t.patch b/queue-6.1/crypto-sa2ul-return-crypto_aead_setkey-to-transfer-t.patch
new file mode 100644
index 00000000000..3bbf5c6252c
--- /dev/null
+++ b/queue-6.1/crypto-sa2ul-return-crypto_aead_setkey-to-transfer-t.patch
@@ -0,0 +1,38 @@
+From a433192fa9646fe90c67c975050e4d17154fe564 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Nov 2023 02:03:01 +0000
+Subject: crypto: sa2ul - Return crypto_aead_setkey to transfer the error
+
+From: Chen Ni <nichen@iscas.ac.cn>
+
+[ Upstream commit ce852f1308ac738e61c5b2502517deea593a1554 ]
+
+Return crypto_aead_setkey() in order to transfer the error if
+it fails.
+
+Fixes: d2c8ac187fc9 ("crypto: sa2ul - Add AEAD algorithm support")
+Signed-off-by: Chen Ni <nichen@iscas.ac.cn>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/sa2ul.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/crypto/sa2ul.c b/drivers/crypto/sa2ul.c
+index f4bc06c24ad8..e7efebf8127f 100644
+--- a/drivers/crypto/sa2ul.c
++++ b/drivers/crypto/sa2ul.c
+@@ -1868,9 +1868,8 @@ static int sa_aead_setkey(struct crypto_aead *authenc,
+ 	crypto_aead_set_flags(ctx->fallback.aead,
+ 			      crypto_aead_get_flags(authenc) &
+ 			      CRYPTO_TFM_REQ_MASK);
+-	crypto_aead_setkey(ctx->fallback.aead, key, keylen);
+ 
+-	return 0;
++	return crypto_aead_setkey(ctx->fallback.aead, key, keylen);
+ }
+ 
+ static int sa_aead_setauthsize(struct crypto_aead *tfm, unsigned int authsize)
+-- 
+2.43.0
+
diff --git a/queue-6.1/crypto-safexcel-add-error-handling-for-dma_map_sg-ca.patch b/queue-6.1/crypto-safexcel-add-error-handling-for-dma_map_sg-ca.patch
new file mode 100644
index 00000000000..dbc966c4d68
--- /dev/null
+++ b/queue-6.1/crypto-safexcel-add-error-handling-for-dma_map_sg-ca.patch
@@ -0,0 +1,72 @@
+From d07ff8790f876e16759ee211a11e32c63dc815b2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Dec 2023 04:49:29 -0800
+Subject: crypto: safexcel - Add error handling for dma_map_sg() calls
+
+From: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
+
+[ Upstream commit 87e02063d07708cac5bfe9fd3a6a242898758ac8 ]
+
+Macro dma_map_sg() may return 0 on error. This patch enables
+checks in case of the macro failure and ensures unmapping of
+previously mapped buffers with dma_unmap_sg().
+
+Found by Linux Verification Center (linuxtesting.org) with static
+analysis tool SVACE.
+
+Fixes: 49186a7d9e46 ("crypto: inside_secure - Avoid dma map if size is zero")
+Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
+Reviewed-by: Antoine Tenart <atenart@kernel.org>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../crypto/inside-secure/safexcel_cipher.c    | 19 +++++++++++--------
+ 1 file changed, 11 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/crypto/inside-secure/safexcel_cipher.c b/drivers/crypto/inside-secure/safexcel_cipher.c
+index 32a37e3850c5..f59e32115268 100644
+--- a/drivers/crypto/inside-secure/safexcel_cipher.c
++++ b/drivers/crypto/inside-secure/safexcel_cipher.c
+@@ -742,9 +742,9 @@ static int safexcel_send_req(struct crypto_async_request *base, int ring,
+ 				max(totlen_src, totlen_dst));
+ 			return -EINVAL;
+ 		}
+-		if (sreq->nr_src > 0)
+-			dma_map_sg(priv->dev, src, sreq->nr_src,
+-				   DMA_BIDIRECTIONAL);
++		if (sreq->nr_src > 0 &&
++		    !dma_map_sg(priv->dev, src, sreq->nr_src, DMA_BIDIRECTIONAL))
++			return -EIO;
+ 	} else {
+ 		if (unlikely(totlen_src && (sreq->nr_src <= 0))) {
+ 			dev_err(priv->dev, "Source buffer not large enough (need %d bytes)!",
+@@ -752,8 +752,9 @@ static int safexcel_send_req(struct crypto_async_request *base, int ring,
+ 			return -EINVAL;
+ 		}
+ 
+-		if (sreq->nr_src > 0)
+-			dma_map_sg(priv->dev, src, sreq->nr_src, DMA_TO_DEVICE);
++		if (sreq->nr_src > 0 &&
++		    !dma_map_sg(priv->dev, src, sreq->nr_src, DMA_TO_DEVICE))
++			return -EIO;
+ 
+ 		if (unlikely(totlen_dst && (sreq->nr_dst <= 0))) {
+ 			dev_err(priv->dev, "Dest buffer not large enough (need %d bytes)!",
+@@ -762,9 +763,11 @@ static int safexcel_send_req(struct crypto_async_request *base, int ring,
+ 			goto unmap;
+ 		}
+ 
+-		if (sreq->nr_dst > 0)
+-			dma_map_sg(priv->dev, dst, sreq->nr_dst,
+-				   DMA_FROM_DEVICE);
++		if (sreq->nr_dst > 0 &&
++		    !dma_map_sg(priv->dev, dst, sreq->nr_dst, DMA_FROM_DEVICE)) {
++			ret = -EIO;
++			goto unmap;
++		}
+ 	}
+ 
+ 	memcpy(ctx->base.ctxr->data, ctx->key, ctx->key_len);
+-- 
+2.43.0
+
diff --git a/queue-6.1/crypto-sahara-avoid-skcipher-fallback-code-duplicati.patch b/queue-6.1/crypto-sahara-avoid-skcipher-fallback-code-duplicati.patch
new file mode 100644
index 00000000000..b884811137a
--- /dev/null
+++ b/queue-6.1/crypto-sahara-avoid-skcipher-fallback-code-duplicati.patch
@@ -0,0 +1,148 @@
+From dc0aee8cb69b5f50382a6b09ba0aa1ee7062429e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Dec 2023 19:06:25 +0200
+Subject: crypto: sahara - avoid skcipher fallback code duplication
+
+From: Ovidiu Panait <ovidiu.panait@windriver.com>
+
+[ Upstream commit 01d70a4bbff20ea05cadb4c208841985a7cc6596 ]
+
+Factor out duplicated skcipher fallback handling code to a helper function
+sahara_aes_fallback(). Also, keep a single check if fallback is required in
+sahara_aes_crypt().
+
+Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Stable-dep-of: d1d6351e37aa ("crypto: sahara - handle zero-length aes requests")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/sahara.c | 85 ++++++++++++-----------------------------
+ 1 file changed, 25 insertions(+), 60 deletions(-)
+
+diff --git a/drivers/crypto/sahara.c b/drivers/crypto/sahara.c
+index 0b7a95dae9fe..89fd54bc0127 100644
+--- a/drivers/crypto/sahara.c
++++ b/drivers/crypto/sahara.c
+@@ -649,12 +649,37 @@ static int sahara_aes_setkey(struct crypto_skcipher *tfm, const u8 *key,
+ 	return crypto_skcipher_setkey(ctx->fallback, key, keylen);
+ }
+ 
++static int sahara_aes_fallback(struct skcipher_request *req, unsigned long mode)
++{
++	struct sahara_aes_reqctx *rctx = skcipher_request_ctx(req);
++	struct sahara_ctx *ctx = crypto_skcipher_ctx(
++		crypto_skcipher_reqtfm(req));
++
++	skcipher_request_set_tfm(&rctx->fallback_req, ctx->fallback);
++	skcipher_request_set_callback(&rctx->fallback_req,
++				      req->base.flags,
++				      req->base.complete,
++				      req->base.data);
++	skcipher_request_set_crypt(&rctx->fallback_req, req->src,
++				   req->dst, req->cryptlen, req->iv);
++
++	if (mode & FLAGS_ENCRYPT)
++		return crypto_skcipher_encrypt(&rctx->fallback_req);
++
++	return crypto_skcipher_decrypt(&rctx->fallback_req);
++}
++
+ static int sahara_aes_crypt(struct skcipher_request *req, unsigned long mode)
+ {
+ 	struct sahara_aes_reqctx *rctx = skcipher_request_ctx(req);
++	struct sahara_ctx *ctx = crypto_skcipher_ctx(
++		crypto_skcipher_reqtfm(req));
+ 	struct sahara_dev *dev = dev_ptr;
+ 	int err = 0;
+ 
++	if (unlikely(ctx->keylen != AES_KEYSIZE_128))
++		return sahara_aes_fallback(req, mode);
++
+ 	dev_dbg(dev->device, "nbytes: %d, enc: %d, cbc: %d\n",
+ 		req->cryptlen, !!(mode & FLAGS_ENCRYPT), !!(mode & FLAGS_CBC));
+ 
+@@ -677,81 +702,21 @@ static int sahara_aes_crypt(struct skcipher_request *req, unsigned long mode)
+ 
+ static int sahara_aes_ecb_encrypt(struct skcipher_request *req)
+ {
+-	struct sahara_aes_reqctx *rctx = skcipher_request_ctx(req);
+-	struct sahara_ctx *ctx = crypto_skcipher_ctx(
+-		crypto_skcipher_reqtfm(req));
+-
+-	if (unlikely(ctx->keylen != AES_KEYSIZE_128)) {
+-		skcipher_request_set_tfm(&rctx->fallback_req, ctx->fallback);
+-		skcipher_request_set_callback(&rctx->fallback_req,
+-					      req->base.flags,
+-					      req->base.complete,
+-					      req->base.data);
+-		skcipher_request_set_crypt(&rctx->fallback_req, req->src,
+-					   req->dst, req->cryptlen, req->iv);
+-		return crypto_skcipher_encrypt(&rctx->fallback_req);
+-	}
+-
+ 	return sahara_aes_crypt(req, FLAGS_ENCRYPT);
+ }
+ 
+ static int sahara_aes_ecb_decrypt(struct skcipher_request *req)
+ {
+-	struct sahara_aes_reqctx *rctx = skcipher_request_ctx(req);
+-	struct sahara_ctx *ctx = crypto_skcipher_ctx(
+-		crypto_skcipher_reqtfm(req));
+-
+-	if (unlikely(ctx->keylen != AES_KEYSIZE_128)) {
+-		skcipher_request_set_tfm(&rctx->fallback_req, ctx->fallback);
+-		skcipher_request_set_callback(&rctx->fallback_req,
+-					      req->base.flags,
+-					      req->base.complete,
+-					      req->base.data);
+-		skcipher_request_set_crypt(&rctx->fallback_req, req->src,
+-					   req->dst, req->cryptlen, req->iv);
+-		return crypto_skcipher_decrypt(&rctx->fallback_req);
+-	}
+-
+ 	return sahara_aes_crypt(req, 0);
+ }
+ 
+ static int sahara_aes_cbc_encrypt(struct skcipher_request *req)
+ {
+-	struct sahara_aes_reqctx *rctx = skcipher_request_ctx(req);
+-	struct sahara_ctx *ctx = crypto_skcipher_ctx(
+-		crypto_skcipher_reqtfm(req));
+-
+-	if (unlikely(ctx->keylen != AES_KEYSIZE_128)) {
+-		skcipher_request_set_tfm(&rctx->fallback_req, ctx->fallback);
+-		skcipher_request_set_callback(&rctx->fallback_req,
+-					      req->base.flags,
+-					      req->base.complete,
+-					      req->base.data);
+-		skcipher_request_set_crypt(&rctx->fallback_req, req->src,
+-					   req->dst, req->cryptlen, req->iv);
+-		return crypto_skcipher_encrypt(&rctx->fallback_req);
+-	}
+-
+ 	return sahara_aes_crypt(req, FLAGS_ENCRYPT | FLAGS_CBC);
+ }
+ 
+ static int sahara_aes_cbc_decrypt(struct skcipher_request *req)
+ {
+-	struct sahara_aes_reqctx *rctx = skcipher_request_ctx(req);
+-	struct sahara_ctx *ctx = crypto_skcipher_ctx(
+-		crypto_skcipher_reqtfm(req));
+-
+-	if (unlikely(ctx->keylen != AES_KEYSIZE_128)) {
+-		skcipher_request_set_tfm(&rctx->fallback_req, ctx->fallback);
+-		skcipher_request_set_callback(&rctx->fallback_req,
+-					      req->base.flags,
+-					      req->base.complete,
+-					      req->base.data);
+-		skcipher_request_set_crypt(&rctx->fallback_req, req->src,
+-					   req->dst, req->cryptlen, req->iv);
+-		return crypto_skcipher_decrypt(&rctx->fallback_req);
+-	}
+-
+ 	return sahara_aes_crypt(req, FLAGS_CBC);
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/crypto-sahara-do-not-resize-req-src-when-doing-hash-.patch b/queue-6.1/crypto-sahara-do-not-resize-req-src-when-doing-hash-.patch
new file mode 100644
index 00000000000..2ac2e1f9fb0
--- /dev/null
+++ b/queue-6.1/crypto-sahara-do-not-resize-req-src-when-doing-hash-.patch
@@ -0,0 +1,99 @@
+From bce2755fb6a4a5e8d2299cbbda3a898ffd05797b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 24 Dec 2023 10:21:36 +0200
+Subject: crypto: sahara - do not resize req->src when doing hash operations
+
+From: Ovidiu Panait <ovidiu.panait@windriver.com>
+
+[ Upstream commit a3c6f4f4d249cecaf2f34471aadbfb4f4ef57298 ]
+
+When testing sahara sha256 speed performance with tcrypt (mode=404) on
+imx53-qsrb board, multiple "Invalid numbers of src SG." errors are
+reported. This was traced to sahara_walk_and_recalc() resizing req->src
+and causing the subsequent dma_map_sg() call to fail.
+
+Now that the previous commit fixed sahara_sha_hw_links_create() to take
+into account the actual request size, rather than relying on sg->length
+values, the resize operation is no longer necessary.
+
+Therefore, remove sahara_walk_and_recalc() and simplify associated logic.
+
+Fixes: 5a2bb93f5992 ("crypto: sahara - add support for SHA1/256")
+Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/sahara.c | 38 ++------------------------------------
+ 1 file changed, 2 insertions(+), 36 deletions(-)
+
+diff --git a/drivers/crypto/sahara.c b/drivers/crypto/sahara.c
+index b167f92279ad..3b946f1313ed 100644
+--- a/drivers/crypto/sahara.c
++++ b/drivers/crypto/sahara.c
+@@ -887,24 +887,6 @@ static int sahara_sha_hw_context_descriptor_create(struct sahara_dev *dev,
+ 	return 0;
+ }
+ 
+-static int sahara_walk_and_recalc(struct scatterlist *sg, unsigned int nbytes)
+-{
+-	if (!sg || !sg->length)
+-		return nbytes;
+-
+-	while (nbytes && sg) {
+-		if (nbytes <= sg->length) {
+-			sg->length = nbytes;
+-			sg_mark_end(sg);
+-			break;
+-		}
+-		nbytes -= sg->length;
+-		sg = sg_next(sg);
+-	}
+-
+-	return nbytes;
+-}
+-
+ static int sahara_sha_prepare_request(struct ahash_request *req)
+ {
+ 	struct crypto_ahash *tfm = crypto_ahash_reqtfm(req);
+@@ -941,36 +923,20 @@ static int sahara_sha_prepare_request(struct ahash_request *req)
+ 					hash_later, 0);
+ 	}
+ 
+-	/* nbytes should now be multiple of blocksize */
+-	req->nbytes = req->nbytes - hash_later;
+-
+-	sahara_walk_and_recalc(req->src, req->nbytes);
+-
++	rctx->total = len - hash_later;
+ 	/* have data from previous operation and current */
+ 	if (rctx->buf_cnt && req->nbytes) {
+ 		sg_init_table(rctx->in_sg_chain, 2);
+ 		sg_set_buf(rctx->in_sg_chain, rctx->rembuf, rctx->buf_cnt);
+-
+ 		sg_chain(rctx->in_sg_chain, 2, req->src);
+-
+-		rctx->total = req->nbytes + rctx->buf_cnt;
+ 		rctx->in_sg = rctx->in_sg_chain;
+-
+-		req->src = rctx->in_sg_chain;
+ 	/* only data from previous operation */
+ 	} else if (rctx->buf_cnt) {
+-		if (req->src)
+-			rctx->in_sg = req->src;
+-		else
+-			rctx->in_sg = rctx->in_sg_chain;
+-		/* buf was copied into rembuf above */
++		rctx->in_sg = rctx->in_sg_chain;
+ 		sg_init_one(rctx->in_sg, rctx->rembuf, rctx->buf_cnt);
+-		rctx->total = rctx->buf_cnt;
+ 	/* no data from previous operation */
+ 	} else {
+ 		rctx->in_sg = req->src;
+-		rctx->total = req->nbytes;
+-		req->src = rctx->in_sg;
+ 	}
+ 
+ 	/* on next call, we only have the remaining data in the buffer */
+-- 
+2.43.0
+
diff --git a/queue-6.1/crypto-sahara-fix-ahash-reqsize.patch b/queue-6.1/crypto-sahara-fix-ahash-reqsize.patch
new file mode 100644
index 00000000000..0f474c9982e
--- /dev/null
+++ b/queue-6.1/crypto-sahara-fix-ahash-reqsize.patch
@@ -0,0 +1,37 @@
+From 077211a9bfd77abf7230a08f00ca8e17078f979e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 24 Dec 2023 10:21:32 +0200
+Subject: crypto: sahara - fix ahash reqsize
+
+From: Ovidiu Panait <ovidiu.panait@windriver.com>
+
+[ Upstream commit efcb50f41740ac55e6ccc4986c1a7740e21c62b4 ]
+
+Set the reqsize for sha algorithms to sizeof(struct sahara_sha_reqctx), the
+extra space is not needed.
+
+Fixes: 5a2bb93f5992 ("crypto: sahara - add support for SHA1/256")
+Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/sahara.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/crypto/sahara.c b/drivers/crypto/sahara.c
+index 4b32e96e197d..6e87b108df19 100644
+--- a/drivers/crypto/sahara.c
++++ b/drivers/crypto/sahara.c
+@@ -1163,8 +1163,7 @@ static int sahara_sha_import(struct ahash_request *req, const void *in)
+ static int sahara_sha_cra_init(struct crypto_tfm *tfm)
+ {
+ 	crypto_ahash_set_reqsize(__crypto_ahash_cast(tfm),
+-				 sizeof(struct sahara_sha_reqctx) +
+-				 SHA_BUFFER_LEN + SHA256_BLOCK_SIZE);
++				 sizeof(struct sahara_sha_reqctx));
+ 
+ 	return 0;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.1/crypto-sahara-fix-ahash-selftest-failure.patch b/queue-6.1/crypto-sahara-fix-ahash-selftest-failure.patch
new file mode 100644
index 00000000000..b6f17160061
--- /dev/null
+++ b/queue-6.1/crypto-sahara-fix-ahash-selftest-failure.patch
@@ -0,0 +1,41 @@
+From 475d73baa7d875fa63b9eaa4de05880953dce03d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Dec 2023 19:06:21 +0200
+Subject: crypto: sahara - fix ahash selftest failure
+
+From: Ovidiu Panait <ovidiu.panait@windriver.com>
+
+[ Upstream commit afffcf3db98b9495114b79d5381f8cc3f69476fb ]
+
+update() calls should not modify the result buffer, so add an additional
+check for "rctx->last" to make sure that only the final hash value is
+copied into the buffer.
+
+Fixes the following selftest failure:
+alg: ahash: sahara-sha256 update() used result buffer on test vector 3,
+cfg="init+update+final aligned buffer"
+
+Fixes: 5a2bb93f5992 ("crypto: sahara - add support for SHA1/256")
+Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/sahara.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/crypto/sahara.c b/drivers/crypto/sahara.c
+index aa9c45ff0f5a..5e0b26f36319 100644
+--- a/drivers/crypto/sahara.c
++++ b/drivers/crypto/sahara.c
+@@ -1048,7 +1048,7 @@ static int sahara_sha_process(struct ahash_request *req)
+ 
+ 	memcpy(rctx->context, dev->context_base, rctx->context_size);
+ 
+-	if (req->result)
++	if (req->result && rctx->last)
+ 		memcpy(req->result, rctx->context, rctx->digest_size);
+ 
+ 	return 0;
+-- 
+2.43.0
+
diff --git a/queue-6.1/crypto-sahara-fix-cbc-selftest-failure.patch b/queue-6.1/crypto-sahara-fix-cbc-selftest-failure.patch
new file mode 100644
index 00000000000..b1a41463253
--- /dev/null
+++ b/queue-6.1/crypto-sahara-fix-cbc-selftest-failure.patch
@@ -0,0 +1,94 @@
+From 36ba6de5590333fbba7c5b30bf1c467eb25df0cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Dec 2023 19:06:20 +0200
+Subject: crypto: sahara - fix cbc selftest failure
+
+From: Ovidiu Panait <ovidiu.panait@windriver.com>
+
+[ Upstream commit 9f10bc28c0fb676ae58aa3bfa358db8f5de124bb ]
+
+The kernel crypto API requires that all CBC implementations update the IV
+buffer to contain the last ciphertext block.
+
+This fixes the following cbc selftest error:
+alg: skcipher: sahara-cbc-aes encryption test failed (wrong output IV) on
+test vector 0, cfg="in-place (one sglist)"
+
+Fixes: 5de8875281e1 ("crypto: sahara - Add driver for SAHARA2 accelerator.")
+Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/sahara.c | 33 +++++++++++++++++++++++++++++++--
+ 1 file changed, 31 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/crypto/sahara.c b/drivers/crypto/sahara.c
+index 0e30d36b0a71..aa9c45ff0f5a 100644
+--- a/drivers/crypto/sahara.c
++++ b/drivers/crypto/sahara.c
+@@ -149,6 +149,7 @@ struct sahara_ctx {
+ 
+ struct sahara_aes_reqctx {
+ 	unsigned long mode;
++	u8 iv_out[AES_BLOCK_SIZE];
+ 	struct skcipher_request fallback_req;	// keep at the end
+ };
+ 
+@@ -542,8 +543,24 @@ static int sahara_hw_descriptor_create(struct sahara_dev *dev)
+ 	return -EINVAL;
+ }
+ 
++static void sahara_aes_cbc_update_iv(struct skcipher_request *req)
++{
++	struct crypto_skcipher *skcipher = crypto_skcipher_reqtfm(req);
++	struct sahara_aes_reqctx *rctx = skcipher_request_ctx(req);
++	unsigned int ivsize = crypto_skcipher_ivsize(skcipher);
++
++	/* Update IV buffer to contain the last ciphertext block */
++	if (rctx->mode & FLAGS_ENCRYPT) {
++		sg_pcopy_to_buffer(req->dst, sg_nents(req->dst), req->iv,
++				   ivsize, req->cryptlen - ivsize);
++	} else {
++		memcpy(req->iv, rctx->iv_out, ivsize);
++	}
++}
++
+ static int sahara_aes_process(struct skcipher_request *req)
+ {
++	struct crypto_skcipher *skcipher = crypto_skcipher_reqtfm(req);
+ 	struct sahara_dev *dev = dev_ptr;
+ 	struct sahara_ctx *ctx;
+ 	struct sahara_aes_reqctx *rctx;
+@@ -565,8 +582,17 @@ static int sahara_aes_process(struct skcipher_request *req)
+ 	rctx->mode &= FLAGS_MODE_MASK;
+ 	dev->flags = (dev->flags & ~FLAGS_MODE_MASK) | rctx->mode;
+ 
+-	if ((dev->flags & FLAGS_CBC) && req->iv)
+-		memcpy(dev->iv_base, req->iv, AES_KEYSIZE_128);
++	if ((dev->flags & FLAGS_CBC) && req->iv) {
++		unsigned int ivsize = crypto_skcipher_ivsize(skcipher);
++
++		memcpy(dev->iv_base, req->iv, ivsize);
++
++		if (!(dev->flags & FLAGS_ENCRYPT)) {
++			sg_pcopy_to_buffer(req->src, sg_nents(req->src),
++					   rctx->iv_out, ivsize,
++					   req->cryptlen - ivsize);
++		}
++	}
+ 
+ 	/* assign new context to device */
+ 	dev->ctx = ctx;
+@@ -589,6 +615,9 @@ static int sahara_aes_process(struct skcipher_request *req)
+ 	dma_unmap_sg(dev->device, dev->in_sg, dev->nb_in_sg,
+ 		DMA_TO_DEVICE);
+ 
++	if ((dev->flags & FLAGS_CBC) && req->iv)
++		sahara_aes_cbc_update_iv(req);
++
+ 	return 0;
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/crypto-sahara-fix-error-handling-in-sahara_hw_descri.patch b/queue-6.1/crypto-sahara-fix-error-handling-in-sahara_hw_descri.patch
new file mode 100644
index 00000000000..cf8dd0b94bd
--- /dev/null
+++ b/queue-6.1/crypto-sahara-fix-error-handling-in-sahara_hw_descri.patch
@@ -0,0 +1,54 @@
+From fb7419092234efa617d37da49f1d6286ce6b4688 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Dec 2023 19:06:23 +0200
+Subject: crypto: sahara - fix error handling in sahara_hw_descriptor_create()
+
+From: Ovidiu Panait <ovidiu.panait@windriver.com>
+
+[ Upstream commit ee6e6f0a7f5b39d50a5ef5fcc006f4f693db18a7 ]
+
+Do not call dma_unmap_sg() for scatterlists that were not mapped
+successfully.
+
+Fixes: 5de8875281e1 ("crypto: sahara - Add driver for SAHARA2 accelerator.")
+Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/sahara.c | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/crypto/sahara.c b/drivers/crypto/sahara.c
+index e25636904aca..0b7a95dae9fe 100644
+--- a/drivers/crypto/sahara.c
++++ b/drivers/crypto/sahara.c
+@@ -484,13 +484,14 @@ static int sahara_hw_descriptor_create(struct sahara_dev *dev)
+ 			 DMA_TO_DEVICE);
+ 	if (!ret) {
+ 		dev_err(dev->device, "couldn't map in sg\n");
+-		goto unmap_in;
++		return -EINVAL;
+ 	}
++
+ 	ret = dma_map_sg(dev->device, dev->out_sg, dev->nb_out_sg,
+ 			 DMA_FROM_DEVICE);
+ 	if (!ret) {
+ 		dev_err(dev->device, "couldn't map out sg\n");
+-		goto unmap_out;
++		goto unmap_in;
+ 	}
+ 
+ 	/* Create input links */
+@@ -538,9 +539,6 @@ static int sahara_hw_descriptor_create(struct sahara_dev *dev)
+ 
+ 	return 0;
+ 
+-unmap_out:
+-	dma_unmap_sg(dev->device, dev->out_sg, dev->nb_out_sg,
+-		DMA_FROM_DEVICE);
+ unmap_in:
+ 	dma_unmap_sg(dev->device, dev->in_sg, dev->nb_in_sg,
+ 		DMA_TO_DEVICE);
+-- 
+2.43.0
+
diff --git a/queue-6.1/crypto-sahara-fix-processing-hash-requests-with-req-.patch b/queue-6.1/crypto-sahara-fix-processing-hash-requests-with-req-.patch
new file mode 100644
index 00000000000..90d59a54843
--- /dev/null
+++ b/queue-6.1/crypto-sahara-fix-processing-hash-requests-with-req-.patch
@@ -0,0 +1,56 @@
+From e481f550d2826f36b26dd332c2fc75e7ef3fc567 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 24 Dec 2023 10:21:35 +0200
+Subject: crypto: sahara - fix processing hash requests with req->nbytes <
+ sg->length
+
+From: Ovidiu Panait <ovidiu.panait@windriver.com>
+
+[ Upstream commit 7bafa74d1ba35dcc173e1ce915e983d65905f77e ]
+
+It's not always the case that the entire sg entry needs to be processed.
+Currently, when nbytes is less than sg->length, "Descriptor length" errors
+are encountered.
+
+To fix this, take the actual request size into account when populating the
+hw links.
+
+Fixes: 5a2bb93f5992 ("crypto: sahara - add support for SHA1/256")
+Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/sahara.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/crypto/sahara.c b/drivers/crypto/sahara.c
+index 6e112e41a0c7..b167f92279ad 100644
+--- a/drivers/crypto/sahara.c
++++ b/drivers/crypto/sahara.c
+@@ -777,6 +777,7 @@ static int sahara_sha_hw_links_create(struct sahara_dev *dev,
+ 				       int start)
+ {
+ 	struct scatterlist *sg;
++	unsigned int len;
+ 	unsigned int i;
+ 	int ret;
+ 
+@@ -798,12 +799,14 @@ static int sahara_sha_hw_links_create(struct sahara_dev *dev,
+ 	if (!ret)
+ 		return -EFAULT;
+ 
++	len = rctx->total;
+ 	for (i = start; i < dev->nb_in_sg + start; i++) {
+-		dev->hw_link[i]->len = sg->length;
++		dev->hw_link[i]->len = min(len, sg->length);
+ 		dev->hw_link[i]->p = sg->dma_address;
+ 		if (i == (dev->nb_in_sg + start - 1)) {
+ 			dev->hw_link[i]->next = 0;
+ 		} else {
++			len -= min(len, sg->length);
+ 			dev->hw_link[i]->next = dev->hw_phys_link[i + 1];
+ 			sg = sg_next(sg);
+ 		}
+-- 
+2.43.0
+
diff --git a/queue-6.1/crypto-sahara-fix-processing-requests-with-cryptlen-.patch b/queue-6.1/crypto-sahara-fix-processing-requests-with-cryptlen-.patch
new file mode 100644
index 00000000000..91c1e2a34e3
--- /dev/null
+++ b/queue-6.1/crypto-sahara-fix-processing-requests-with-cryptlen-.patch
@@ -0,0 +1,72 @@
+From 65ec03228c2877d9d871926acb183f56868774dd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Dec 2023 19:06:22 +0200
+Subject: crypto: sahara - fix processing requests with cryptlen < sg->length
+
+From: Ovidiu Panait <ovidiu.panait@windriver.com>
+
+[ Upstream commit 5b8668ce3452827d27f8c34ff6ba080a8f983ed0 ]
+
+It's not always the case that the entire sg entry needs to be processed.
+Currently, when cryptlen is less than sg->legth, "Descriptor length" errors
+are encountered.
+
+The error was noticed when testing xts(sahara-ecb-aes) with arbitrary sized
+input data. To fix this, take the actual request size into account when
+populating the hw links.
+
+Fixes: 5de8875281e1 ("crypto: sahara - Add driver for SAHARA2 accelerator.")
+Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/sahara.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/crypto/sahara.c b/drivers/crypto/sahara.c
+index 5e0b26f36319..e25636904aca 100644
+--- a/drivers/crypto/sahara.c
++++ b/drivers/crypto/sahara.c
+@@ -445,6 +445,7 @@ static int sahara_hw_descriptor_create(struct sahara_dev *dev)
+ 	int ret;
+ 	int i, j;
+ 	int idx = 0;
++	u32 len;
+ 
+ 	memcpy(dev->key_base, ctx->key, ctx->keylen);
+ 
+@@ -495,12 +496,14 @@ static int sahara_hw_descriptor_create(struct sahara_dev *dev)
+ 	/* Create input links */
+ 	dev->hw_desc[idx]->p1 = dev->hw_phys_link[0];
+ 	sg = dev->in_sg;
++	len = dev->total;
+ 	for (i = 0; i < dev->nb_in_sg; i++) {
+-		dev->hw_link[i]->len = sg->length;
++		dev->hw_link[i]->len = min(len, sg->length);
+ 		dev->hw_link[i]->p = sg->dma_address;
+ 		if (i == (dev->nb_in_sg - 1)) {
+ 			dev->hw_link[i]->next = 0;
+ 		} else {
++			len -= min(len, sg->length);
+ 			dev->hw_link[i]->next = dev->hw_phys_link[i + 1];
+ 			sg = sg_next(sg);
+ 		}
+@@ -509,12 +512,14 @@ static int sahara_hw_descriptor_create(struct sahara_dev *dev)
+ 	/* Create output links */
+ 	dev->hw_desc[idx]->p2 = dev->hw_phys_link[i];
+ 	sg = dev->out_sg;
++	len = dev->total;
+ 	for (j = i; j < dev->nb_out_sg + i; j++) {
+-		dev->hw_link[j]->len = sg->length;
++		dev->hw_link[j]->len = min(len, sg->length);
+ 		dev->hw_link[j]->p = sg->dma_address;
+ 		if (j == (dev->nb_out_sg + i - 1)) {
+ 			dev->hw_link[j]->next = 0;
+ 		} else {
++			len -= min(len, sg->length);
+ 			dev->hw_link[j]->next = dev->hw_phys_link[j + 1];
+ 			sg = sg_next(sg);
+ 		}
+-- 
+2.43.0
+
diff --git a/queue-6.1/crypto-sahara-fix-wait_for_completion_timeout-error-.patch b/queue-6.1/crypto-sahara-fix-wait_for_completion_timeout-error-.patch
new file mode 100644
index 00000000000..b99de0ab0e9
--- /dev/null
+++ b/queue-6.1/crypto-sahara-fix-wait_for_completion_timeout-error-.patch
@@ -0,0 +1,70 @@
+From 5696c990f31feb1f6e73132014ad887f2bee4a8f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 24 Dec 2023 10:21:33 +0200
+Subject: crypto: sahara - fix wait_for_completion_timeout() error handling
+
+From: Ovidiu Panait <ovidiu.panait@windriver.com>
+
+[ Upstream commit 2dba8e1d1a7957dcbe7888846268538847b471d1 ]
+
+The sg lists are not unmapped in case of timeout errors. Fix this.
+
+Fixes: 5a2bb93f5992 ("crypto: sahara - add support for SHA1/256")
+Fixes: 5de8875281e1 ("crypto: sahara - Add driver for SAHARA2 accelerator.")
+Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/sahara.c | 18 ++++++++++--------
+ 1 file changed, 10 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/crypto/sahara.c b/drivers/crypto/sahara.c
+index 6e87b108df19..e2b1880ddeb0 100644
+--- a/drivers/crypto/sahara.c
++++ b/drivers/crypto/sahara.c
+@@ -608,16 +608,17 @@ static int sahara_aes_process(struct skcipher_request *req)
+ 
+ 	timeout = wait_for_completion_timeout(&dev->dma_completion,
+ 				msecs_to_jiffies(SAHARA_TIMEOUT_MS));
+-	if (!timeout) {
+-		dev_err(dev->device, "AES timeout\n");
+-		return -ETIMEDOUT;
+-	}
+ 
+ 	dma_unmap_sg(dev->device, dev->out_sg, dev->nb_out_sg,
+ 		DMA_FROM_DEVICE);
+ 	dma_unmap_sg(dev->device, dev->in_sg, dev->nb_in_sg,
+ 		DMA_TO_DEVICE);
+ 
++	if (!timeout) {
++		dev_err(dev->device, "AES timeout\n");
++		return -ETIMEDOUT;
++	}
++
+ 	if ((dev->flags & FLAGS_CBC) && req->iv)
+ 		sahara_aes_cbc_update_iv(req);
+ 
+@@ -1008,15 +1009,16 @@ static int sahara_sha_process(struct ahash_request *req)
+ 
+ 	timeout = wait_for_completion_timeout(&dev->dma_completion,
+ 				msecs_to_jiffies(SAHARA_TIMEOUT_MS));
+-	if (!timeout) {
+-		dev_err(dev->device, "SHA timeout\n");
+-		return -ETIMEDOUT;
+-	}
+ 
+ 	if (rctx->sg_in_idx)
+ 		dma_unmap_sg(dev->device, dev->in_sg, dev->nb_in_sg,
+ 			     DMA_TO_DEVICE);
+ 
++	if (!timeout) {
++		dev_err(dev->device, "SHA timeout\n");
++		return -ETIMEDOUT;
++	}
++
+ 	memcpy(rctx->context, dev->context_base, rctx->context_size);
+ 
+ 	if (req->result && rctx->last)
+-- 
+2.43.0
+
diff --git a/queue-6.1/crypto-sahara-handle-zero-length-aes-requests.patch b/queue-6.1/crypto-sahara-handle-zero-length-aes-requests.patch
new file mode 100644
index 00000000000..b8a45873c37
--- /dev/null
+++ b/queue-6.1/crypto-sahara-handle-zero-length-aes-requests.patch
@@ -0,0 +1,36 @@
+From fe7b484bf446888c7903c892d6cb7690a48cdda3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 24 Dec 2023 10:21:31 +0200
+Subject: crypto: sahara - handle zero-length aes requests
+
+From: Ovidiu Panait <ovidiu.panait@windriver.com>
+
+[ Upstream commit d1d6351e37aac14b32a291731d0855996c459d11 ]
+
+In case of a zero-length input, exit gracefully from sahara_aes_crypt().
+
+Fixes: 5de8875281e1 ("crypto: sahara - Add driver for SAHARA2 accelerator.")
+Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/sahara.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/crypto/sahara.c b/drivers/crypto/sahara.c
+index 89fd54bc0127..4b32e96e197d 100644
+--- a/drivers/crypto/sahara.c
++++ b/drivers/crypto/sahara.c
+@@ -677,6 +677,9 @@ static int sahara_aes_crypt(struct skcipher_request *req, unsigned long mode)
+ 	struct sahara_dev *dev = dev_ptr;
+ 	int err = 0;
+ 
++	if (!req->cryptlen)
++		return 0;
++
+ 	if (unlikely(ctx->keylen != AES_KEYSIZE_128))
+ 		return sahara_aes_fallback(req, mode);
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/crypto-sahara-improve-error-handling-in-sahara_sha_p.patch b/queue-6.1/crypto-sahara-improve-error-handling-in-sahara_sha_p.patch
new file mode 100644
index 00000000000..5e878b4bd17
--- /dev/null
+++ b/queue-6.1/crypto-sahara-improve-error-handling-in-sahara_sha_p.patch
@@ -0,0 +1,51 @@
+From 75288188aa1257c9dcaf4720faf471d2a5aea166 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 24 Dec 2023 10:21:34 +0200
+Subject: crypto: sahara - improve error handling in sahara_sha_process()
+
+From: Ovidiu Panait <ovidiu.panait@windriver.com>
+
+[ Upstream commit 5deff027fca49a1eb3b20359333cf2ae562a2343 ]
+
+sahara_sha_hw_data_descriptor_create() returns negative error codes on
+failure, so make sure the errors are correctly handled / propagated.
+
+Fixes: 5a2bb93f5992 ("crypto: sahara - add support for SHA1/256")
+Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/sahara.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/crypto/sahara.c b/drivers/crypto/sahara.c
+index e2b1880ddeb0..6e112e41a0c7 100644
+--- a/drivers/crypto/sahara.c
++++ b/drivers/crypto/sahara.c
+@@ -988,7 +988,10 @@ static int sahara_sha_process(struct ahash_request *req)
+ 		return ret;
+ 
+ 	if (rctx->first) {
+-		sahara_sha_hw_data_descriptor_create(dev, rctx, req, 0);
++		ret = sahara_sha_hw_data_descriptor_create(dev, rctx, req, 0);
++		if (ret)
++			return ret;
++
+ 		dev->hw_desc[0]->next = 0;
+ 		rctx->first = 0;
+ 	} else {
+@@ -996,7 +999,10 @@ static int sahara_sha_process(struct ahash_request *req)
+ 
+ 		sahara_sha_hw_context_descriptor_create(dev, rctx, req, 0);
+ 		dev->hw_desc[0]->next = dev->hw_phys_desc[1];
+-		sahara_sha_hw_data_descriptor_create(dev, rctx, req, 1);
++		ret = sahara_sha_hw_data_descriptor_create(dev, rctx, req, 1);
++		if (ret)
++			return ret;
++
+ 		dev->hw_desc[1]->next = 0;
+ 	}
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/crypto-sahara-remove-flags_new_key-logic.patch b/queue-6.1/crypto-sahara-remove-flags_new_key-logic.patch
new file mode 100644
index 00000000000..a17920c9f79
--- /dev/null
+++ b/queue-6.1/crypto-sahara-remove-flags_new_key-logic.patch
@@ -0,0 +1,105 @@
+From 354c834abc858a5cad05caa5ce7f9e5e4cd58b7b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Dec 2023 19:06:19 +0200
+Subject: crypto: sahara - remove FLAGS_NEW_KEY logic
+
+From: Ovidiu Panait <ovidiu.panait@windriver.com>
+
+[ Upstream commit 8fd183435728b139248a77978ea3732039341779 ]
+
+Remove the FLAGS_NEW_KEY logic as it has the following issues:
+- the wrong key may end up being used when there are multiple data streams:
+       t1            t2
+    setkey()
+    encrypt()
+                   setkey()
+                   encrypt()
+
+    encrypt() <--- key from t2 is used
+- switching between encryption and decryption with the same key is not
+  possible, as the hdr flags are only updated when a new setkey() is
+  performed
+
+With this change, the key is always sent along with the cryptdata when
+performing encryption/decryption operations.
+
+Fixes: 5de8875281e1 ("crypto: sahara - Add driver for SAHARA2 accelerator.")
+Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/sahara.c | 34 +++++++++++++---------------------
+ 1 file changed, 13 insertions(+), 21 deletions(-)
+
+diff --git a/drivers/crypto/sahara.c b/drivers/crypto/sahara.c
+index 7ab20fb95166..0e30d36b0a71 100644
+--- a/drivers/crypto/sahara.c
++++ b/drivers/crypto/sahara.c
+@@ -44,7 +44,6 @@
+ #define FLAGS_MODE_MASK		0x000f
+ #define FLAGS_ENCRYPT		BIT(0)
+ #define FLAGS_CBC		BIT(1)
+-#define FLAGS_NEW_KEY		BIT(3)
+ 
+ #define SAHARA_HDR_BASE			0x00800000
+ #define SAHARA_HDR_SKHA_ALG_AES	0
+@@ -142,8 +141,6 @@ struct sahara_hw_link {
+ };
+ 
+ struct sahara_ctx {
+-	unsigned long flags;
+-
+ 	/* AES-specific context */
+ 	int keylen;
+ 	u8 key[AES_KEYSIZE_128];
+@@ -448,26 +445,22 @@ static int sahara_hw_descriptor_create(struct sahara_dev *dev)
+ 	int i, j;
+ 	int idx = 0;
+ 
+-	/* Copy new key if necessary */
+-	if (ctx->flags & FLAGS_NEW_KEY) {
+-		memcpy(dev->key_base, ctx->key, ctx->keylen);
+-		ctx->flags &= ~FLAGS_NEW_KEY;
++	memcpy(dev->key_base, ctx->key, ctx->keylen);
+ 
+-		if (dev->flags & FLAGS_CBC) {
+-			dev->hw_desc[idx]->len1 = AES_BLOCK_SIZE;
+-			dev->hw_desc[idx]->p1 = dev->iv_phys_base;
+-		} else {
+-			dev->hw_desc[idx]->len1 = 0;
+-			dev->hw_desc[idx]->p1 = 0;
+-		}
+-		dev->hw_desc[idx]->len2 = ctx->keylen;
+-		dev->hw_desc[idx]->p2 = dev->key_phys_base;
+-		dev->hw_desc[idx]->next = dev->hw_phys_desc[1];
++	if (dev->flags & FLAGS_CBC) {
++		dev->hw_desc[idx]->len1 = AES_BLOCK_SIZE;
++		dev->hw_desc[idx]->p1 = dev->iv_phys_base;
++	} else {
++		dev->hw_desc[idx]->len1 = 0;
++		dev->hw_desc[idx]->p1 = 0;
++	}
++	dev->hw_desc[idx]->len2 = ctx->keylen;
++	dev->hw_desc[idx]->p2 = dev->key_phys_base;
++	dev->hw_desc[idx]->next = dev->hw_phys_desc[1];
++	dev->hw_desc[idx]->hdr = sahara_aes_key_hdr(dev);
+ 
+-		dev->hw_desc[idx]->hdr = sahara_aes_key_hdr(dev);
++	idx++;
+ 
+-		idx++;
+-	}
+ 
+ 	dev->nb_in_sg = sg_nents_for_len(dev->in_sg, dev->total);
+ 	if (dev->nb_in_sg < 0) {
+@@ -609,7 +602,6 @@ static int sahara_aes_setkey(struct crypto_skcipher *tfm, const u8 *key,
+ 	/* SAHARA only supports 128bit keys */
+ 	if (keylen == AES_KEYSIZE_128) {
+ 		memcpy(ctx->key, key, keylen);
+-		ctx->flags |= FLAGS_NEW_KEY;
+ 		return 0;
+ 	}
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/crypto-scomp-fix-req-dst-buffer-overflow.patch b/queue-6.1/crypto-scomp-fix-req-dst-buffer-overflow.patch
new file mode 100644
index 00000000000..0c698540ebe
--- /dev/null
+++ b/queue-6.1/crypto-scomp-fix-req-dst-buffer-overflow.patch
@@ -0,0 +1,57 @@
+From 0f2ce02526b73cdcde52cf13f5b2e9fbc77aa7f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Dec 2023 09:35:23 +0000
+Subject: crypto: scomp - fix req->dst buffer overflow
+
+From: Chengming Zhou <zhouchengming@bytedance.com>
+
+[ Upstream commit 744e1885922a9943458954cfea917b31064b4131 ]
+
+The req->dst buffer size should be checked before copying from the
+scomp_scratch->dst to avoid req->dst buffer overflow problem.
+
+Fixes: 1ab53a77b772 ("crypto: acomp - add driver-side scomp interface")
+Reported-by: syzbot+3eff5e51bf1db122a16e@syzkaller.appspotmail.com
+Closes: https://lore.kernel.org/all/0000000000000b05cd060d6b5511@google.com/
+Signed-off-by: Chengming Zhou <zhouchengming@bytedance.com>
+Reviewed-by: Barry Song <v-songbaohua@oppo.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/scompress.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/crypto/scompress.c b/crypto/scompress.c
+index 738f4f8f0f41..4d6366a44400 100644
+--- a/crypto/scompress.c
++++ b/crypto/scompress.c
+@@ -124,6 +124,7 @@ static int scomp_acomp_comp_decomp(struct acomp_req *req, int dir)
+ 	struct crypto_scomp *scomp = *tfm_ctx;
+ 	void **ctx = acomp_request_ctx(req);
+ 	struct scomp_scratch *scratch;
++	unsigned int dlen;
+ 	int ret;
+ 
+ 	if (!req->src || !req->slen || req->slen > SCOMP_SCRATCH_SIZE)
+@@ -135,6 +136,8 @@ static int scomp_acomp_comp_decomp(struct acomp_req *req, int dir)
+ 	if (!req->dlen || req->dlen > SCOMP_SCRATCH_SIZE)
+ 		req->dlen = SCOMP_SCRATCH_SIZE;
+ 
++	dlen = req->dlen;
++
+ 	scratch = raw_cpu_ptr(&scomp_scratch);
+ 	spin_lock(&scratch->lock);
+ 
+@@ -152,6 +155,9 @@ static int scomp_acomp_comp_decomp(struct acomp_req *req, int dir)
+ 				ret = -ENOMEM;
+ 				goto out;
+ 			}
++		} else if (req->dlen > dlen) {
++			ret = -ENOSPC;
++			goto out;
+ 		}
+ 		scatterwalk_map_and_copy(scratch->dst, req->dst, 0, req->dlen,
+ 					 1);
+-- 
+2.43.0
+
diff --git a/queue-6.1/crypto-virtio-handle-dataq-logic-with-tasklet.patch b/queue-6.1/crypto-virtio-handle-dataq-logic-with-tasklet.patch
new file mode 100644
index 00000000000..762db4b7444
--- /dev/null
+++ b/queue-6.1/crypto-virtio-handle-dataq-logic-with-tasklet.patch
@@ -0,0 +1,99 @@
+From 747ea701398a8c8156ca5ff2daf4fe815214095f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Nov 2023 11:49:45 +0000
+Subject: crypto: virtio - Handle dataq logic with tasklet
+
+From: Gonglei (Arei) <arei.gonglei@huawei.com>
+
+[ Upstream commit fed93fb62e05c38152b0fc1dc9609639e63eed76 ]
+
+Doing ipsec produces a spinlock recursion warning.
+This is due to crypto_finalize_request() being called in the upper half.
+Move virtual data queue processing of virtio-crypto driver to tasklet.
+
+Fixes: dbaf0624ffa57 ("crypto: add virtio-crypto driver")
+Reported-by: Halil Pasic <pasic@linux.ibm.com>
+Signed-off-by: wangyangxin <wangyangxin1@huawei.com>
+Signed-off-by: Gonglei <arei.gonglei@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/virtio/virtio_crypto_common.h |  2 ++
+ drivers/crypto/virtio/virtio_crypto_core.c   | 23 +++++++++++---------
+ 2 files changed, 15 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/crypto/virtio/virtio_crypto_common.h b/drivers/crypto/virtio/virtio_crypto_common.h
+index 154590e1f764..7059bbe5a2eb 100644
+--- a/drivers/crypto/virtio/virtio_crypto_common.h
++++ b/drivers/crypto/virtio/virtio_crypto_common.h
+@@ -10,6 +10,7 @@
+ #include <linux/virtio.h>
+ #include <linux/crypto.h>
+ #include <linux/spinlock.h>
++#include <linux/interrupt.h>
+ #include <crypto/aead.h>
+ #include <crypto/aes.h>
+ #include <crypto/engine.h>
+@@ -28,6 +29,7 @@ struct data_queue {
+ 	char name[32];
+ 
+ 	struct crypto_engine *engine;
++	struct tasklet_struct done_task;
+ };
+ 
+ struct virtio_crypto {
+diff --git a/drivers/crypto/virtio/virtio_crypto_core.c b/drivers/crypto/virtio/virtio_crypto_core.c
+index 3842915ea743..856daf05341c 100644
+--- a/drivers/crypto/virtio/virtio_crypto_core.c
++++ b/drivers/crypto/virtio/virtio_crypto_core.c
+@@ -72,27 +72,28 @@ int virtio_crypto_ctrl_vq_request(struct virtio_crypto *vcrypto, struct scatterl
+ 	return 0;
+ }
+ 
+-static void virtcrypto_dataq_callback(struct virtqueue *vq)
++static void virtcrypto_done_task(unsigned long data)
+ {
+-	struct virtio_crypto *vcrypto = vq->vdev->priv;
++	struct data_queue *data_vq = (struct data_queue *)data;
++	struct virtqueue *vq = data_vq->vq;
+ 	struct virtio_crypto_request *vc_req;
+-	unsigned long flags;
+ 	unsigned int len;
+-	unsigned int qid = vq->index;
+ 
+-	spin_lock_irqsave(&vcrypto->data_vq[qid].lock, flags);
+ 	do {
+ 		virtqueue_disable_cb(vq);
+ 		while ((vc_req = virtqueue_get_buf(vq, &len)) != NULL) {
+-			spin_unlock_irqrestore(
+-				&vcrypto->data_vq[qid].lock, flags);
+ 			if (vc_req->alg_cb)
+ 				vc_req->alg_cb(vc_req, len);
+-			spin_lock_irqsave(
+-				&vcrypto->data_vq[qid].lock, flags);
+ 		}
+ 	} while (!virtqueue_enable_cb(vq));
+-	spin_unlock_irqrestore(&vcrypto->data_vq[qid].lock, flags);
++}
++
++static void virtcrypto_dataq_callback(struct virtqueue *vq)
++{
++	struct virtio_crypto *vcrypto = vq->vdev->priv;
++	struct data_queue *dq = &vcrypto->data_vq[vq->index];
++
++	tasklet_schedule(&dq->done_task);
+ }
+ 
+ static int virtcrypto_find_vqs(struct virtio_crypto *vi)
+@@ -150,6 +151,8 @@ static int virtcrypto_find_vqs(struct virtio_crypto *vi)
+ 			ret = -ENOMEM;
+ 			goto err_engine;
+ 		}
++		tasklet_init(&vi->data_vq[i].done_task, virtcrypto_done_task,
++				(unsigned long)&vi->data_vq[i]);
+ 	}
+ 
+ 	kfree(names);
+-- 
+2.43.0
+
diff --git a/queue-6.1/crypto-virtio-wait-for-tasklet-to-complete-on-device.patch b/queue-6.1/crypto-virtio-wait-for-tasklet-to-complete-on-device.patch
new file mode 100644
index 00000000000..e130f9d2efc
--- /dev/null
+++ b/queue-6.1/crypto-virtio-wait-for-tasklet-to-complete-on-device.patch
@@ -0,0 +1,43 @@
+From 6d50aa1a3b484539ef73e34ee001a8723e8dccc5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Dec 2023 19:42:15 +0800
+Subject: crypto: virtio - Wait for tasklet to complete on device remove
+
+From: wangyangxin <wangyangxin1@huawei.com>
+
+[ Upstream commit 67cc511e8d436456cc98033e6d4ba83ebfc8e672 ]
+
+The scheduled tasklet needs to be executed on device remove.
+
+Fixes: fed93fb62e05 ("crypto: virtio - Handle dataq logic with tasklet")
+Signed-off-by: wangyangxin <wangyangxin1@huawei.com>
+Signed-off-by: Gonglei <arei.gonglei@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/virtio/virtio_crypto_core.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/crypto/virtio/virtio_crypto_core.c b/drivers/crypto/virtio/virtio_crypto_core.c
+index 856daf05341c..56dc0935c774 100644
+--- a/drivers/crypto/virtio/virtio_crypto_core.c
++++ b/drivers/crypto/virtio/virtio_crypto_core.c
+@@ -499,12 +499,15 @@ static void virtcrypto_free_unused_reqs(struct virtio_crypto *vcrypto)
+ static void virtcrypto_remove(struct virtio_device *vdev)
+ {
+ 	struct virtio_crypto *vcrypto = vdev->priv;
++	int i;
+ 
+ 	dev_info(&vdev->dev, "Start virtcrypto_remove.\n");
+ 
+ 	flush_work(&vcrypto->config_work);
+ 	if (virtcrypto_dev_started(vcrypto))
+ 		virtcrypto_dev_stop(vcrypto);
++	for (i = 0; i < vcrypto->max_data_queues; i++)
++		tasklet_kill(&vcrypto->data_vq[i].done_task);
+ 	virtio_reset_device(vdev);
+ 	virtcrypto_free_unused_reqs(vcrypto);
+ 	virtcrypto_clear_crypto_engines(vcrypto);
+-- 
+2.43.0
+
diff --git a/queue-6.1/csky-fix-arch_jump_label_transform_static-override.patch b/queue-6.1/csky-fix-arch_jump_label_transform_static-override.patch
new file mode 100644
index 00000000000..7d8816cf3c7
--- /dev/null
+++ b/queue-6.1/csky-fix-arch_jump_label_transform_static-override.patch
@@ -0,0 +1,45 @@
+From a5d83457e8f3f4e42250c61f0c5bdcf8462241e1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Nov 2023 22:02:59 +0100
+Subject: csky: fix arch_jump_label_transform_static override
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit ca8e45c8048a2c9503c74751d25414601f730580 ]
+
+The arch_jump_label_transform_static() function in csky was originally meant to
+override the generic __weak function, but that got changed to an #ifndef check.
+
+This showed up as a missing-prototype warning:
+arch/csky/kernel/jump_label.c:43:6: error: no previous prototype for 'arch_jump_label_transform_static' [-Werror=missing-prototypes]
+
+Change the method to use the new method of having a #define and a prototype
+for the global function.
+
+Fixes: 7e6b9db27de9 ("jump_label: make initial NOP patching the special case")
+Fixes: 4e8bb4ba5a55 ("csky: Add jump-label implementation")
+Reviewed-by: Guo Ren <guoren@kernel.org>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/csky/include/asm/jump_label.h | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/arch/csky/include/asm/jump_label.h b/arch/csky/include/asm/jump_label.h
+index d488ba6084bc..98a3f4b168bd 100644
+--- a/arch/csky/include/asm/jump_label.h
++++ b/arch/csky/include/asm/jump_label.h
+@@ -43,5 +43,10 @@ static __always_inline bool arch_static_branch_jump(struct static_key *key,
+ 	return true;
+ }
+ 
++enum jump_label_type;
++void arch_jump_label_transform_static(struct jump_entry *entry,
++				      enum jump_label_type type);
++#define arch_jump_label_transform_static arch_jump_label_transform_static
++
+ #endif  /* __ASSEMBLY__ */
+ #endif	/* __ASM_CSKY_JUMP_LABEL_H */
+-- 
+2.43.0
+
diff --git a/queue-6.1/dma-mapping-clear-dev-dma_mem-to-null-after-freeing-.patch b/queue-6.1/dma-mapping-clear-dev-dma_mem-to-null-after-freeing-.patch
new file mode 100644
index 00000000000..86194733050
--- /dev/null
+++ b/queue-6.1/dma-mapping-clear-dev-dma_mem-to-null-after-freeing-.patch
@@ -0,0 +1,44 @@
+From 7aa9411719c91fe8b72fe505d72e053e0579512a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Dec 2023 16:25:26 +0800
+Subject: dma-mapping: clear dev->dma_mem to NULL after freeing it
+
+From: Joakim Zhang <joakim.zhang@cixtech.com>
+
+[ Upstream commit b07bc2347672cc8c7293c64499f1488278c5ca3d ]
+
+Reproduced with below sequence:
+dma_declare_coherent_memory()->dma_release_coherent_memory()
+->dma_declare_coherent_memory()->"return -EBUSY" error
+
+It will return -EBUSY from the dma_assign_coherent_memory()
+in dma_declare_coherent_memory(), the reason is that dev->dma_mem
+pointer has not been set to NULL after it's freed.
+
+Fixes: cf65a0f6f6ff ("dma-mapping: move all DMA mapping code to kernel/dma")
+Signed-off-by: Joakim Zhang <joakim.zhang@cixtech.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/dma/coherent.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/kernel/dma/coherent.c b/kernel/dma/coherent.c
+index c21abc77c53e..ff5683a57f77 100644
+--- a/kernel/dma/coherent.c
++++ b/kernel/dma/coherent.c
+@@ -132,8 +132,10 @@ int dma_declare_coherent_memory(struct device *dev, phys_addr_t phys_addr,
+ 
+ void dma_release_coherent_memory(struct device *dev)
+ {
+-	if (dev)
++	if (dev) {
+ 		_dma_release_coherent_memory(dev->dma_mem);
++		dev->dma_mem = NULL;
++	}
+ }
+ 
+ static void *__dma_alloc_from_coherent(struct device *dev,
+-- 
+2.43.0
+
diff --git a/queue-6.1/driver-core-remove-config_sysfs_deprecated-and-confi.patch b/queue-6.1/driver-core-remove-config_sysfs_deprecated-and-confi.patch
new file mode 100644
index 00000000000..1f73bd1aafa
--- /dev/null
+++ b/queue-6.1/driver-core-remove-config_sysfs_deprecated-and-confi.patch
@@ -0,0 +1,278 @@
+From 59215e74fb040fb277b4635b3a4ad1189a0b5e6e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Feb 2023 08:33:26 +0100
+Subject: driver core: remove CONFIG_SYSFS_DEPRECATED and
+ CONFIG_SYSFS_DEPRECATED_V2
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+[ Upstream commit 721da5cee9d43901105f5b8bd33fcb9101b12fc3 ]
+
+CONFIG_SYSFS_DEPRECATED was added in commit 88a22c985e35
+("CONFIG_SYSFS_DEPRECATED") in 2006 to allow systems with older versions
+of some tools (i.e. Fedora 3's version of udev) to boot properly.  Four
+years later, in 2010, the option was attempted to be removed as most of
+userspace should have been fixed up properly by then, but some kernel
+developers clung to those old systems and refused to update, so we added
+CONFIG_SYSFS_DEPRECATED_V2 in commit e52eec13cd6b ("SYSFS: Allow boot
+time switching between deprecated and modern sysfs layout") to allow
+them to continue to boot properly, and we allowed a boot time parameter
+to be used to switch back to the old format if needed.
+
+Over time, the logic that was covered under these config options was
+slowly removed from individual driver subsystems successfully, removed,
+and the only thing that is now left in the kernel are some changes in
+the block layer's representation in sysfs where real directories are
+used instead of symlinks like normal.
+
+Because the original changes were done to userspace tools in 2006, and
+all distros that use those tools are long end-of-life, and older
+non-udev-based systems do not care about the block layer's sysfs
+representation, it is time to finally remove this old logic and the
+config entries from the kernel.
+
+Cc: Jonathan Corbet <corbet@lwn.net>
+Cc: "Rafael J. Wysocki" <rafael@kernel.org>
+Cc: linux-block@vger.kernel.org
+Cc: linux-doc@vger.kernel.org
+Acked-by: Jens Axboe <axboe@kernel.dk>
+Link: https://lore.kernel.org/r/20230223073326.2073220-1-gregkh@linuxfoundation.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Stable-dep-of: 5fa3d1a00c2d ("block: Set memalloc_noio to false on device_add_disk() error path")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../admin-guide/kernel-parameters.txt         |  9 -----
+ block/genhd.c                                 | 19 ++++------
+ drivers/base/class.c                          |  2 +-
+ drivers/base/core.c                           | 37 ------------------
+ include/linux/device.h                        |  6 ---
+ init/Kconfig                                  | 38 -------------------
+ 6 files changed, 8 insertions(+), 103 deletions(-)
+
+diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
+index 4ad60e127e04..d44a25ed43d7 100644
+--- a/Documentation/admin-guide/kernel-parameters.txt
++++ b/Documentation/admin-guide/kernel-parameters.txt
+@@ -6127,15 +6127,6 @@
+ 			later by a loaded module cannot be set this way.
+ 			Example: sysctl.vm.swappiness=40
+ 
+-	sysfs.deprecated=0|1 [KNL]
+-			Enable/disable old style sysfs layout for old udev
+-			on older distributions. When this option is enabled
+-			very new udev will not work anymore. When this option
+-			is disabled (or CONFIG_SYSFS_DEPRECATED not compiled)
+-			in older udev will not work anymore.
+-			Default depends on CONFIG_SYSFS_DEPRECATED_V2 set in
+-			the kernel configuration.
+-
+ 	sysrq_always_enabled
+ 			[KNL]
+ 			Ignore sysrq setting - this boot parameter will
+diff --git a/block/genhd.c b/block/genhd.c
+index afab646d12c8..886e75213f6a 100644
+--- a/block/genhd.c
++++ b/block/genhd.c
+@@ -473,12 +473,10 @@ int __must_check device_add_disk(struct device *parent, struct gendisk *disk,
+ 	if (ret)
+ 		goto out_device_del;
+ 
+-	if (!sysfs_deprecated) {
+-		ret = sysfs_create_link(block_depr, &ddev->kobj,
+-					kobject_name(&ddev->kobj));
+-		if (ret)
+-			goto out_device_del;
+-	}
++	ret = sysfs_create_link(block_depr, &ddev->kobj,
++				kobject_name(&ddev->kobj));
++	if (ret)
++		goto out_device_del;
+ 
+ 	/*
+ 	 * avoid probable deadlock caused by allocating memory with
+@@ -565,8 +563,7 @@ int __must_check device_add_disk(struct device *parent, struct gendisk *disk,
+ out_del_integrity:
+ 	blk_integrity_del(disk);
+ out_del_block_link:
+-	if (!sysfs_deprecated)
+-		sysfs_remove_link(block_depr, dev_name(ddev));
++	sysfs_remove_link(block_depr, dev_name(ddev));
+ out_device_del:
+ 	device_del(ddev);
+ out_free_ext_minor:
+@@ -663,8 +660,7 @@ void del_gendisk(struct gendisk *disk)
+ 
+ 	part_stat_set_all(disk->part0, 0);
+ 	disk->part0->bd_stamp = 0;
+-	if (!sysfs_deprecated)
+-		sysfs_remove_link(block_depr, dev_name(disk_to_dev(disk)));
++	sysfs_remove_link(block_depr, dev_name(disk_to_dev(disk)));
+ 	pm_runtime_set_memalloc_noio(disk_to_dev(disk), false);
+ 	device_del(disk_to_dev(disk));
+ 
+@@ -916,8 +912,7 @@ static int __init genhd_device_init(void)
+ 	register_blkdev(BLOCK_EXT_MAJOR, "blkext");
+ 
+ 	/* create top-level block dir */
+-	if (!sysfs_deprecated)
+-		block_depr = kobject_create_and_add("block", NULL);
++	block_depr = kobject_create_and_add("block", NULL);
+ 	return 0;
+ }
+ 
+diff --git a/drivers/base/class.c b/drivers/base/class.c
+index 8ceafb7d0203..254963a226ba 100644
+--- a/drivers/base/class.c
++++ b/drivers/base/class.c
+@@ -176,7 +176,7 @@ int __class_register(struct class *cls, struct lock_class_key *key)
+ 
+ #if defined(CONFIG_BLOCK)
+ 	/* let the block class directory show up in the root of sysfs */
+-	if (!sysfs_deprecated || cls != &block_class)
++	if (cls != &block_class)
+ 		cp->subsys.kobj.kset = class_kset;
+ #else
+ 	cp->subsys.kobj.kset = class_kset;
+diff --git a/drivers/base/core.c b/drivers/base/core.c
+index af90bfb0cc3d..578b21f08763 100644
+--- a/drivers/base/core.c
++++ b/drivers/base/core.c
+@@ -35,19 +35,6 @@
+ #include "physical_location.h"
+ #include "power/power.h"
+ 
+-#ifdef CONFIG_SYSFS_DEPRECATED
+-#ifdef CONFIG_SYSFS_DEPRECATED_V2
+-long sysfs_deprecated = 1;
+-#else
+-long sysfs_deprecated = 0;
+-#endif
+-static int __init sysfs_deprecated_setup(char *arg)
+-{
+-	return kstrtol(arg, 10, &sysfs_deprecated);
+-}
+-early_param("sysfs.deprecated", sysfs_deprecated_setup);
+-#endif
+-
+ /* Device links support. */
+ static LIST_HEAD(deferred_sync);
+ static unsigned int defer_sync_state_count = 1;
+@@ -3216,15 +3203,6 @@ static struct kobject *get_device_parent(struct device *dev,
+ 		struct kobject *parent_kobj;
+ 		struct kobject *k;
+ 
+-#ifdef CONFIG_BLOCK
+-		/* block disks show up in /sys/block */
+-		if (sysfs_deprecated && dev->class == &block_class) {
+-			if (parent && parent->class == &block_class)
+-				return &parent->kobj;
+-			return &block_class.p->subsys.kobj;
+-		}
+-#endif
+-
+ 		/*
+ 		 * If we have no parent, we live in "virtual".
+ 		 * Class-devices with a non class-device as parent, live
+@@ -3396,12 +3374,6 @@ static int device_add_class_symlinks(struct device *dev)
+ 			goto out_subsys;
+ 	}
+ 
+-#ifdef CONFIG_BLOCK
+-	/* /sys/block has directories and does not need symlinks */
+-	if (sysfs_deprecated && dev->class == &block_class)
+-		return 0;
+-#endif
+-
+ 	/* link in the class directory pointing to the device */
+ 	error = sysfs_create_link(&dev->class->p->subsys.kobj,
+ 				  &dev->kobj, dev_name(dev));
+@@ -3431,10 +3403,6 @@ static void device_remove_class_symlinks(struct device *dev)
+ 	if (dev->parent && device_is_not_partition(dev))
+ 		sysfs_remove_link(&dev->kobj, "device");
+ 	sysfs_remove_link(&dev->kobj, "subsystem");
+-#ifdef CONFIG_BLOCK
+-	if (sysfs_deprecated && dev->class == &block_class)
+-		return;
+-#endif
+ 	sysfs_delete_link(&dev->class->p->subsys.kobj, &dev->kobj, dev_name(dev));
+ }
+ 
+@@ -4742,11 +4710,6 @@ int device_change_owner(struct device *dev, kuid_t kuid, kgid_t kgid)
+ 	if (error)
+ 		goto out;
+ 
+-#ifdef CONFIG_BLOCK
+-	if (sysfs_deprecated && dev->class == &block_class)
+-		goto out;
+-#endif
+-
+ 	/*
+ 	 * Change the owner of the symlink located in the class directory of
+ 	 * the device class associated with @dev which points to the actual
+diff --git a/include/linux/device.h b/include/linux/device.h
+index 7cf24330d681..a46b3b4e3126 100644
+--- a/include/linux/device.h
++++ b/include/linux/device.h
+@@ -1102,10 +1102,4 @@ int dev_err_probe(const struct device *dev, int err, const char *fmt, ...);
+ #define MODULE_ALIAS_CHARDEV_MAJOR(major) \
+ 	MODULE_ALIAS("char-major-" __stringify(major) "-*")
+ 
+-#ifdef CONFIG_SYSFS_DEPRECATED
+-extern long sysfs_deprecated;
+-#else
+-#define sysfs_deprecated 0
+-#endif
+-
+ #endif /* _DEVICE_H_ */
+diff --git a/init/Kconfig b/init/Kconfig
+index 148704640252..8219099a0326 100644
+--- a/init/Kconfig
++++ b/init/Kconfig
+@@ -1292,44 +1292,6 @@ config SCHED_AUTOGROUP
+ 	  desktop applications.  Task group autogeneration is currently based
+ 	  upon task session.
+ 
+-config SYSFS_DEPRECATED
+-	bool "Enable deprecated sysfs features to support old userspace tools"
+-	depends on SYSFS
+-	default n
+-	help
+-	  This option adds code that switches the layout of the "block" class
+-	  devices, to not show up in /sys/class/block/, but only in
+-	  /sys/block/.
+-
+-	  This switch is only active when the sysfs.deprecated=1 boot option is
+-	  passed or the SYSFS_DEPRECATED_V2 option is set.
+-
+-	  This option allows new kernels to run on old distributions and tools,
+-	  which might get confused by /sys/class/block/. Since 2007/2008 all
+-	  major distributions and tools handle this just fine.
+-
+-	  Recent distributions and userspace tools after 2009/2010 depend on
+-	  the existence of /sys/class/block/, and will not work with this
+-	  option enabled.
+-
+-	  Only if you are using a new kernel on an old distribution, you might
+-	  need to say Y here.
+-
+-config SYSFS_DEPRECATED_V2
+-	bool "Enable deprecated sysfs features by default"
+-	default n
+-	depends on SYSFS
+-	depends on SYSFS_DEPRECATED
+-	help
+-	  Enable deprecated sysfs by default.
+-
+-	  See the CONFIG_SYSFS_DEPRECATED option for more details about this
+-	  option.
+-
+-	  Only if you are using a new kernel on an old distribution, you might
+-	  need to say Y here. Even then, odds are you would not need it
+-	  enabled, you can always pass the boot option if absolutely necessary.
+-
+ config RELAY
+ 	bool "Kernel->user space relay support (formerly relayfs)"
+ 	select IRQ_WORK
+-- 
+2.43.0
+
diff --git a/queue-6.1/drivers-amd-pm-fix-a-use-after-free-in-kv_parse_powe.patch b/queue-6.1/drivers-amd-pm-fix-a-use-after-free-in-kv_parse_powe.patch
new file mode 100644
index 00000000000..a8497568bfd
--- /dev/null
+++ b/queue-6.1/drivers-amd-pm-fix-a-use-after-free-in-kv_parse_powe.patch
@@ -0,0 +1,48 @@
+From beac9b1debc6aa9629e09bd01a203b1a16cd7239 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Dec 2023 00:24:58 +0800
+Subject: drivers/amd/pm: fix a use-after-free in kv_parse_power_table
+
+From: Zhipeng Lu <alexious@zju.edu.cn>
+
+[ Upstream commit 28dd788382c43b330480f57cd34cde0840896743 ]
+
+When ps allocated by kzalloc equals to NULL, kv_parse_power_table
+frees adev->pm.dpm.ps that allocated before. However, after the control
+flow goes through the following call chains:
+
+kv_parse_power_table
+  |-> kv_dpm_init
+        |-> kv_dpm_sw_init
+	      |-> kv_dpm_fini
+
+The adev->pm.dpm.ps is used in the for loop of kv_dpm_fini after its
+first free in kv_parse_power_table and causes a use-after-free bug.
+
+Fixes: a2e73f56fa62 ("drm/amdgpu: Add support for CIK parts")
+Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c
+index f5e08b60f66e..d17bfa111aa7 100644
+--- a/drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c
++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c
+@@ -2748,10 +2748,8 @@ static int kv_parse_power_table(struct amdgpu_device *adev)
+ 		non_clock_info = (struct _ATOM_PPLIB_NONCLOCK_INFO *)
+ 			&non_clock_info_array->nonClockInfo[non_clock_array_index];
+ 		ps = kzalloc(sizeof(struct kv_ps), GFP_KERNEL);
+-		if (ps == NULL) {
+-			kfree(adev->pm.dpm.ps);
++		if (ps == NULL)
+ 			return -ENOMEM;
+-		}
+ 		adev->pm.dpm.ps[i].ps_priv = ps;
+ 		k = 0;
+ 		idx = (u8 *)&power_state->v2.clockInfoIndex[0];
+-- 
+2.43.0
+
diff --git a/queue-6.1/drivers-clk-zynqmp-calculate-closest-mux-rate.patch b/queue-6.1/drivers-clk-zynqmp-calculate-closest-mux-rate.patch
new file mode 100644
index 00000000000..2b2fd5379fb
--- /dev/null
+++ b/queue-6.1/drivers-clk-zynqmp-calculate-closest-mux-rate.patch
@@ -0,0 +1,61 @@
+From 3c39565ca936cd8a9f92cd424f9dcf0e7b8e24af Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Nov 2023 03:29:15 -0800
+Subject: drivers: clk: zynqmp: calculate closest mux rate
+
+From: Jay Buddhabhatti <jay.buddhabhatti@amd.com>
+
+[ Upstream commit b782921ddd7f84f524723090377903f399fdbbcb ]
+
+Currently zynqmp clock driver is not calculating closest mux rate and
+because of that Linux is not setting proper frequency for CPU and
+not able to set given frequency for dynamic frequency scaling.
+
+E.g., In current logic initial acpu clock parent and frequency as below
+apll1                  0    0    0  2199999978    0     0  50000      Y
+    acpu0_mux          0    0    0  2199999978    0     0  50000      Y
+        acpu0_idiv1    0    0    0  2199999978    0     0  50000      Y
+            acpu0      0    0    0  2199999978    0     0  50000      Y
+
+After changing acpu frequency to 549999994 Hz using CPU freq scaling its
+selecting incorrect parent which is not closest frequency.
+rpll_to_xpd            0    0    0  1599999984    0     0  50000      Y
+    acpu0_mux          0    0    0  1599999984    0     0  50000      Y
+        acpu0_div1     0    0    0   533333328    0     0  50000      Y
+            acpu0      0    0    0   533333328    0     0  50000      Y
+
+Parent should remain same since 549999994 = 2199999978 / 4.
+
+So use __clk_mux_determine_rate_closest() generic function to calculate
+closest rate for mux clock. After this change its selecting correct
+parent and correct clock rate.
+apll1                  0    0    0  2199999978    0     0  50000      Y
+    acpu0_mux          0    0    0  2199999978    0     0  50000      Y
+        acpu0_div1     0    0    0   549999995    0     0  50000      Y
+            acpu0      0    0    0   549999995    0     0  50000      Y
+
+Fixes: 3fde0e16d016 ("drivers: clk: Add ZynqMP clock driver")
+Signed-off-by: Jay Buddhabhatti <jay.buddhabhatti@amd.com>
+Link: https://lore.kernel.org/r/20231129112916.23125-2-jay.buddhabhatti@amd.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/zynqmp/clk-mux-zynqmp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/zynqmp/clk-mux-zynqmp.c b/drivers/clk/zynqmp/clk-mux-zynqmp.c
+index 60359333f26d..9b5d3050b742 100644
+--- a/drivers/clk/zynqmp/clk-mux-zynqmp.c
++++ b/drivers/clk/zynqmp/clk-mux-zynqmp.c
+@@ -89,7 +89,7 @@ static int zynqmp_clk_mux_set_parent(struct clk_hw *hw, u8 index)
+ static const struct clk_ops zynqmp_clk_mux_ops = {
+ 	.get_parent = zynqmp_clk_mux_get_parent,
+ 	.set_parent = zynqmp_clk_mux_set_parent,
+-	.determine_rate = __clk_mux_determine_rate,
++	.determine_rate = __clk_mux_determine_rate_closest,
+ };
+ 
+ static const struct clk_ops zynqmp_clk_mux_ro_ops = {
+-- 
+2.43.0
+
diff --git a/queue-6.1/drivers-clk-zynqmp-update-divider-round-rate-logic.patch b/queue-6.1/drivers-clk-zynqmp-update-divider-round-rate-logic.patch
new file mode 100644
index 00000000000..2cb228e857f
--- /dev/null
+++ b/queue-6.1/drivers-clk-zynqmp-update-divider-round-rate-logic.patch
@@ -0,0 +1,121 @@
+From 22eb36784eade42dfb64ceae2d628e8bf0b19e1f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Nov 2023 03:29:16 -0800
+Subject: drivers: clk: zynqmp: update divider round rate logic
+
+From: Jay Buddhabhatti <jay.buddhabhatti@amd.com>
+
+[ Upstream commit 1fe15be1fb613534ecbac5f8c3f8744f757d237d ]
+
+Currently zynqmp divider round rate is considering single parent and
+calculating rate and parent rate accordingly. But if divider clock flag
+is set to SET_RATE_PARENT then its not trying to traverse through all
+parent rate and not selecting best parent rate from that. So use common
+divider_round_rate() which is traversing through all clock parents and
+its rate and calculating proper parent rate.
+
+Fixes: 3fde0e16d016 ("drivers: clk: Add ZynqMP clock driver")
+Signed-off-by: Jay Buddhabhatti <jay.buddhabhatti@amd.com>
+Link: https://lore.kernel.org/r/20231129112916.23125-3-jay.buddhabhatti@amd.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/zynqmp/divider.c | 66 +++---------------------------------
+ 1 file changed, 5 insertions(+), 61 deletions(-)
+
+diff --git a/drivers/clk/zynqmp/divider.c b/drivers/clk/zynqmp/divider.c
+index 33a3b2a22659..5a00487ae408 100644
+--- a/drivers/clk/zynqmp/divider.c
++++ b/drivers/clk/zynqmp/divider.c
+@@ -110,52 +110,6 @@ static unsigned long zynqmp_clk_divider_recalc_rate(struct clk_hw *hw,
+ 	return DIV_ROUND_UP_ULL(parent_rate, value);
+ }
+ 
+-static void zynqmp_get_divider2_val(struct clk_hw *hw,
+-				    unsigned long rate,
+-				    struct zynqmp_clk_divider *divider,
+-				    u32 *bestdiv)
+-{
+-	int div1;
+-	int div2;
+-	long error = LONG_MAX;
+-	unsigned long div1_prate;
+-	struct clk_hw *div1_parent_hw;
+-	struct zynqmp_clk_divider *pdivider;
+-	struct clk_hw *div2_parent_hw = clk_hw_get_parent(hw);
+-
+-	if (!div2_parent_hw)
+-		return;
+-
+-	pdivider = to_zynqmp_clk_divider(div2_parent_hw);
+-	if (!pdivider)
+-		return;
+-
+-	div1_parent_hw = clk_hw_get_parent(div2_parent_hw);
+-	if (!div1_parent_hw)
+-		return;
+-
+-	div1_prate = clk_hw_get_rate(div1_parent_hw);
+-	*bestdiv = 1;
+-	for (div1 = 1; div1 <= pdivider->max_div;) {
+-		for (div2 = 1; div2 <= divider->max_div;) {
+-			long new_error = ((div1_prate / div1) / div2) - rate;
+-
+-			if (abs(new_error) < abs(error)) {
+-				*bestdiv = div2;
+-				error = new_error;
+-			}
+-			if (divider->flags & CLK_DIVIDER_POWER_OF_TWO)
+-				div2 = div2 << 1;
+-			else
+-				div2++;
+-		}
+-		if (pdivider->flags & CLK_DIVIDER_POWER_OF_TWO)
+-			div1 = div1 << 1;
+-		else
+-			div1++;
+-	}
+-}
+-
+ /**
+  * zynqmp_clk_divider_round_rate() - Round rate of divider clock
+  * @hw:			handle between common and hardware-specific interfaces
+@@ -174,6 +128,7 @@ static long zynqmp_clk_divider_round_rate(struct clk_hw *hw,
+ 	u32 div_type = divider->div_type;
+ 	u32 bestdiv;
+ 	int ret;
++	u8 width;
+ 
+ 	/* if read only, just return current value */
+ 	if (divider->flags & CLK_DIVIDER_READ_ONLY) {
+@@ -193,23 +148,12 @@ static long zynqmp_clk_divider_round_rate(struct clk_hw *hw,
+ 		return DIV_ROUND_UP_ULL((u64)*prate, bestdiv);
+ 	}
+ 
+-	bestdiv = zynqmp_divider_get_val(*prate, rate, divider->flags);
+-
+-	/*
+-	 * In case of two divisors, compute best divider values and return
+-	 * divider2 value based on compute value. div1 will  be automatically
+-	 * set to optimum based on required total divider value.
+-	 */
+-	if (div_type == TYPE_DIV2 &&
+-	    (clk_hw_get_flags(hw) & CLK_SET_RATE_PARENT)) {
+-		zynqmp_get_divider2_val(hw, rate, divider, &bestdiv);
+-	}
++	width = fls(divider->max_div);
+ 
+-	if ((clk_hw_get_flags(hw) & CLK_SET_RATE_PARENT) && divider->is_frac)
+-		bestdiv = rate % *prate ? 1 : bestdiv;
++	rate = divider_round_rate(hw, rate, prate, NULL, width, divider->flags);
+ 
+-	bestdiv = min_t(u32, bestdiv, divider->max_div);
+-	*prate = rate * bestdiv;
++	if (divider->is_frac && (clk_hw_get_flags(hw) & CLK_SET_RATE_PARENT) && (rate % *prate))
++		*prate = rate;
+ 
+ 	return rate;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-amd-pm-fix-a-double-free-in-amdgpu_parse_extende.patch b/queue-6.1/drm-amd-pm-fix-a-double-free-in-amdgpu_parse_extende.patch
new file mode 100644
index 00000000000..7ed7e778dd6
--- /dev/null
+++ b/queue-6.1/drm-amd-pm-fix-a-double-free-in-amdgpu_parse_extende.patch
@@ -0,0 +1,198 @@
+From b16854e6c3631d3412cb7a3adbd9d284d416752f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Dec 2023 00:59:38 +0800
+Subject: drm/amd/pm: fix a double-free in amdgpu_parse_extended_power_table
+
+From: Zhipeng Lu <alexious@zju.edu.cn>
+
+[ Upstream commit a6582701178a47c4d0cb2188c965c59c0c0647c8 ]
+
+The amdgpu_free_extended_power_table is called in every error-handling
+paths of amdgpu_parse_extended_power_table. However, after the following
+call chain of returning:
+
+amdgpu_parse_extended_power_table
+  |-> kv_dpm_init / si_dpm_init
+      (the only two caller of amdgpu_parse_extended_power_table)
+        |-> kv_dpm_sw_init / si_dpm_sw_init
+            (the only caller of kv_dpm_init / si_dpm_init, accordingly)
+              |-> kv_dpm_fini / si_dpm_fini
+                  (goto dpm_failed in xx_dpm_sw_init)
+                    |-> amdgpu_free_extended_power_table
+
+As above, the amdgpu_free_extended_power_table is called twice in this
+returning chain and thus a double-free is triggered. Similarily, the
+last kfree in amdgpu_parse_extended_power_table also cause a double free
+with amdgpu_free_extended_power_table in kv_dpm_fini.
+
+Fixes: 84176663e70d ("drm/amd/pm: create a new holder for those APIs used only by legacy ASICs(si/kv)")
+Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c    | 52 +++++--------------
+ 1 file changed, 13 insertions(+), 39 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c
+index d3fe149d8476..291223ea7ba7 100644
+--- a/drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c
++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c
+@@ -272,10 +272,8 @@ int amdgpu_parse_extended_power_table(struct amdgpu_device *adev)
+ 				 le16_to_cpu(power_info->pplib4.usVddcDependencyOnSCLKOffset));
+ 			ret = amdgpu_parse_clk_voltage_dep_table(&adev->pm.dpm.dyn_state.vddc_dependency_on_sclk,
+ 								 dep_table);
+-			if (ret) {
+-				amdgpu_free_extended_power_table(adev);
++			if (ret)
+ 				return ret;
+-			}
+ 		}
+ 		if (power_info->pplib4.usVddciDependencyOnMCLKOffset) {
+ 			dep_table = (ATOM_PPLIB_Clock_Voltage_Dependency_Table *)
+@@ -283,10 +281,8 @@ int amdgpu_parse_extended_power_table(struct amdgpu_device *adev)
+ 				 le16_to_cpu(power_info->pplib4.usVddciDependencyOnMCLKOffset));
+ 			ret = amdgpu_parse_clk_voltage_dep_table(&adev->pm.dpm.dyn_state.vddci_dependency_on_mclk,
+ 								 dep_table);
+-			if (ret) {
+-				amdgpu_free_extended_power_table(adev);
++			if (ret)
+ 				return ret;
+-			}
+ 		}
+ 		if (power_info->pplib4.usVddcDependencyOnMCLKOffset) {
+ 			dep_table = (ATOM_PPLIB_Clock_Voltage_Dependency_Table *)
+@@ -294,10 +290,8 @@ int amdgpu_parse_extended_power_table(struct amdgpu_device *adev)
+ 				 le16_to_cpu(power_info->pplib4.usVddcDependencyOnMCLKOffset));
+ 			ret = amdgpu_parse_clk_voltage_dep_table(&adev->pm.dpm.dyn_state.vddc_dependency_on_mclk,
+ 								 dep_table);
+-			if (ret) {
+-				amdgpu_free_extended_power_table(adev);
++			if (ret)
+ 				return ret;
+-			}
+ 		}
+ 		if (power_info->pplib4.usMvddDependencyOnMCLKOffset) {
+ 			dep_table = (ATOM_PPLIB_Clock_Voltage_Dependency_Table *)
+@@ -305,10 +299,8 @@ int amdgpu_parse_extended_power_table(struct amdgpu_device *adev)
+ 				 le16_to_cpu(power_info->pplib4.usMvddDependencyOnMCLKOffset));
+ 			ret = amdgpu_parse_clk_voltage_dep_table(&adev->pm.dpm.dyn_state.mvdd_dependency_on_mclk,
+ 								 dep_table);
+-			if (ret) {
+-				amdgpu_free_extended_power_table(adev);
++			if (ret)
+ 				return ret;
+-			}
+ 		}
+ 		if (power_info->pplib4.usMaxClockVoltageOnDCOffset) {
+ 			ATOM_PPLIB_Clock_Voltage_Limit_Table *clk_v =
+@@ -339,10 +331,8 @@ int amdgpu_parse_extended_power_table(struct amdgpu_device *adev)
+ 				kcalloc(psl->ucNumEntries,
+ 					sizeof(struct amdgpu_phase_shedding_limits_entry),
+ 					GFP_KERNEL);
+-			if (!adev->pm.dpm.dyn_state.phase_shedding_limits_table.entries) {
+-				amdgpu_free_extended_power_table(adev);
++			if (!adev->pm.dpm.dyn_state.phase_shedding_limits_table.entries)
+ 				return -ENOMEM;
+-			}
+ 
+ 			entry = &psl->entries[0];
+ 			for (i = 0; i < psl->ucNumEntries; i++) {
+@@ -383,10 +373,8 @@ int amdgpu_parse_extended_power_table(struct amdgpu_device *adev)
+ 			ATOM_PPLIB_CAC_Leakage_Record *entry;
+ 			u32 size = cac_table->ucNumEntries * sizeof(struct amdgpu_cac_leakage_table);
+ 			adev->pm.dpm.dyn_state.cac_leakage_table.entries = kzalloc(size, GFP_KERNEL);
+-			if (!adev->pm.dpm.dyn_state.cac_leakage_table.entries) {
+-				amdgpu_free_extended_power_table(adev);
++			if (!adev->pm.dpm.dyn_state.cac_leakage_table.entries)
+ 				return -ENOMEM;
+-			}
+ 			entry = &cac_table->entries[0];
+ 			for (i = 0; i < cac_table->ucNumEntries; i++) {
+ 				if (adev->pm.dpm.platform_caps & ATOM_PP_PLATFORM_CAP_EVV) {
+@@ -438,10 +426,8 @@ int amdgpu_parse_extended_power_table(struct amdgpu_device *adev)
+ 				sizeof(struct amdgpu_vce_clock_voltage_dependency_entry);
+ 			adev->pm.dpm.dyn_state.vce_clock_voltage_dependency_table.entries =
+ 				kzalloc(size, GFP_KERNEL);
+-			if (!adev->pm.dpm.dyn_state.vce_clock_voltage_dependency_table.entries) {
+-				amdgpu_free_extended_power_table(adev);
++			if (!adev->pm.dpm.dyn_state.vce_clock_voltage_dependency_table.entries)
+ 				return -ENOMEM;
+-			}
+ 			adev->pm.dpm.dyn_state.vce_clock_voltage_dependency_table.count =
+ 				limits->numEntries;
+ 			entry = &limits->entries[0];
+@@ -493,10 +479,8 @@ int amdgpu_parse_extended_power_table(struct amdgpu_device *adev)
+ 				sizeof(struct amdgpu_uvd_clock_voltage_dependency_entry);
+ 			adev->pm.dpm.dyn_state.uvd_clock_voltage_dependency_table.entries =
+ 				kzalloc(size, GFP_KERNEL);
+-			if (!adev->pm.dpm.dyn_state.uvd_clock_voltage_dependency_table.entries) {
+-				amdgpu_free_extended_power_table(adev);
++			if (!adev->pm.dpm.dyn_state.uvd_clock_voltage_dependency_table.entries)
+ 				return -ENOMEM;
+-			}
+ 			adev->pm.dpm.dyn_state.uvd_clock_voltage_dependency_table.count =
+ 				limits->numEntries;
+ 			entry = &limits->entries[0];
+@@ -525,10 +509,8 @@ int amdgpu_parse_extended_power_table(struct amdgpu_device *adev)
+ 				sizeof(struct amdgpu_clock_voltage_dependency_entry);
+ 			adev->pm.dpm.dyn_state.samu_clock_voltage_dependency_table.entries =
+ 				kzalloc(size, GFP_KERNEL);
+-			if (!adev->pm.dpm.dyn_state.samu_clock_voltage_dependency_table.entries) {
+-				amdgpu_free_extended_power_table(adev);
++			if (!adev->pm.dpm.dyn_state.samu_clock_voltage_dependency_table.entries)
+ 				return -ENOMEM;
+-			}
+ 			adev->pm.dpm.dyn_state.samu_clock_voltage_dependency_table.count =
+ 				limits->numEntries;
+ 			entry = &limits->entries[0];
+@@ -548,10 +530,8 @@ int amdgpu_parse_extended_power_table(struct amdgpu_device *adev)
+ 				 le16_to_cpu(ext_hdr->usPPMTableOffset));
+ 			adev->pm.dpm.dyn_state.ppm_table =
+ 				kzalloc(sizeof(struct amdgpu_ppm_table), GFP_KERNEL);
+-			if (!adev->pm.dpm.dyn_state.ppm_table) {
+-				amdgpu_free_extended_power_table(adev);
++			if (!adev->pm.dpm.dyn_state.ppm_table)
+ 				return -ENOMEM;
+-			}
+ 			adev->pm.dpm.dyn_state.ppm_table->ppm_design = ppm->ucPpmDesign;
+ 			adev->pm.dpm.dyn_state.ppm_table->cpu_core_number =
+ 				le16_to_cpu(ppm->usCpuCoreNumber);
+@@ -583,10 +563,8 @@ int amdgpu_parse_extended_power_table(struct amdgpu_device *adev)
+ 				sizeof(struct amdgpu_clock_voltage_dependency_entry);
+ 			adev->pm.dpm.dyn_state.acp_clock_voltage_dependency_table.entries =
+ 				kzalloc(size, GFP_KERNEL);
+-			if (!adev->pm.dpm.dyn_state.acp_clock_voltage_dependency_table.entries) {
+-				amdgpu_free_extended_power_table(adev);
++			if (!adev->pm.dpm.dyn_state.acp_clock_voltage_dependency_table.entries)
+ 				return -ENOMEM;
+-			}
+ 			adev->pm.dpm.dyn_state.acp_clock_voltage_dependency_table.count =
+ 				limits->numEntries;
+ 			entry = &limits->entries[0];
+@@ -606,10 +584,8 @@ int amdgpu_parse_extended_power_table(struct amdgpu_device *adev)
+ 			ATOM_PowerTune_Table *pt;
+ 			adev->pm.dpm.dyn_state.cac_tdp_table =
+ 				kzalloc(sizeof(struct amdgpu_cac_tdp_table), GFP_KERNEL);
+-			if (!adev->pm.dpm.dyn_state.cac_tdp_table) {
+-				amdgpu_free_extended_power_table(adev);
++			if (!adev->pm.dpm.dyn_state.cac_tdp_table)
+ 				return -ENOMEM;
+-			}
+ 			if (rev > 0) {
+ 				ATOM_PPLIB_POWERTUNE_Table_V1 *ppt = (ATOM_PPLIB_POWERTUNE_Table_V1 *)
+ 					(mode_info->atom_context->bios + data_offset +
+@@ -645,10 +621,8 @@ int amdgpu_parse_extended_power_table(struct amdgpu_device *adev)
+ 			ret = amdgpu_parse_clk_voltage_dep_table(
+ 					&adev->pm.dpm.dyn_state.vddgfx_dependency_on_sclk,
+ 					dep_table);
+-			if (ret) {
+-				kfree(adev->pm.dpm.dyn_state.vddgfx_dependency_on_sclk.entries);
++			if (ret)
+ 				return ret;
+-			}
+ 		}
+ 	}
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-amd-pm-fix-a-double-free-in-si_dpm_init.patch b/queue-6.1/drm-amd-pm-fix-a-double-free-in-si_dpm_init.patch
new file mode 100644
index 00000000000..53c5e0cff97
--- /dev/null
+++ b/queue-6.1/drm-amd-pm-fix-a-double-free-in-si_dpm_init.patch
@@ -0,0 +1,45 @@
+From 98daddb0b369995391a70fb6136c87b7f59e930a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Dec 2023 23:24:11 +0800
+Subject: drm/amd/pm: fix a double-free in si_dpm_init
+
+From: Zhipeng Lu <alexious@zju.edu.cn>
+
+[ Upstream commit ac16667237a82e2597e329eb9bc520d1cf9dff30 ]
+
+When the allocation of
+adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries fails,
+amdgpu_free_extended_power_table is called to free some fields of adev.
+However, when the control flow returns to si_dpm_sw_init, it goes to
+label dpm_failed and calls si_dpm_fini, which calls
+amdgpu_free_extended_power_table again and free those fields again. Thus
+a double-free is triggered.
+
+Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)")
+Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+index c89cfef7cafa..dc0a6fba7050 100644
+--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+@@ -7379,10 +7379,9 @@ static int si_dpm_init(struct amdgpu_device *adev)
+ 		kcalloc(4,
+ 			sizeof(struct amdgpu_clock_voltage_dependency_entry),
+ 			GFP_KERNEL);
+-	if (!adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries) {
+-		amdgpu_free_extended_power_table(adev);
++	if (!adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries)
+ 		return -ENOMEM;
+-	}
++
+ 	adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.count = 4;
+ 	adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries[0].clk = 0;
+ 	adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries[0].v = 0;
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-amd-pm-smu7-fix-a-memleak-in-smu7_hwmgr_backend_.patch b/queue-6.1/drm-amd-pm-smu7-fix-a-memleak-in-smu7_hwmgr_backend_.patch
new file mode 100644
index 00000000000..931dc65f37b
--- /dev/null
+++ b/queue-6.1/drm-amd-pm-smu7-fix-a-memleak-in-smu7_hwmgr_backend_.patch
@@ -0,0 +1,53 @@
+From 3b0df803f427ec6985a815d22fe5cc0bf2b6a83e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 24 Dec 2023 16:22:47 +0800
+Subject: drm/amd/pm/smu7: fix a memleak in smu7_hwmgr_backend_init
+
+From: Zhipeng Lu <alexious@zju.edu.cn>
+
+[ Upstream commit 2f3be3ca779b11c332441b10e00443a2510f4d7b ]
+
+The hwmgr->backend, (i.e. data) allocated by kzalloc is not freed in
+the error-handling paths of smu7_get_evv_voltages and
+smu7_update_edc_leakage_table. However, it did be freed in the
+error-handling of phm_initializa_dynamic_state_adjustment_rule_settings,
+by smu7_hwmgr_backend_fini. So the lack of free in smu7_get_evv_voltages
+and smu7_update_edc_leakage_table is considered a memleak in this patch.
+
+Fixes: 599a7e9fe1b6 ("drm/amd/powerplay: implement smu7 hwmgr to manager asics with smu ip version 7.")
+Fixes: 8f0804c6b7d0 ("drm/amd/pm: add edc leakage controller setting")
+Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c
+index a31a62a1ce0b..5e9410117712 100644
+--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c
++++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c
+@@ -2987,6 +2987,8 @@ static int smu7_hwmgr_backend_init(struct pp_hwmgr *hwmgr)
+ 		result = smu7_get_evv_voltages(hwmgr);
+ 		if (result) {
+ 			pr_info("Get EVV Voltage Failed.  Abort Driver loading!\n");
++			kfree(hwmgr->backend);
++			hwmgr->backend = NULL;
+ 			return -EINVAL;
+ 		}
+ 	} else {
+@@ -3032,8 +3034,10 @@ static int smu7_hwmgr_backend_init(struct pp_hwmgr *hwmgr)
+ 	}
+ 
+ 	result = smu7_update_edc_leakage_table(hwmgr);
+-	if (result)
++	if (result) {
++		smu7_hwmgr_backend_fini(hwmgr);
+ 		return result;
++	}
+ 
+ 	return 0;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-amdgpu-debugfs-fix-error-code-when-smc-register-.patch b/queue-6.1/drm-amdgpu-debugfs-fix-error-code-when-smc-register-.patch
new file mode 100644
index 00000000000..59502642938
--- /dev/null
+++ b/queue-6.1/drm-amdgpu-debugfs-fix-error-code-when-smc-register-.patch
@@ -0,0 +1,48 @@
+From 6637415ab8ed69a50aef3247f215d85de25d32cd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Nov 2023 17:26:29 -0500
+Subject: drm/amdgpu/debugfs: fix error code when smc register accessors are
+ NULL
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+[ Upstream commit afe58346d5d3887b3e49ff623d2f2e471f232a8d ]
+
+Should be -EOPNOTSUPP.
+
+Fixes: 5104fdf50d32 ("drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL")
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
+index 8123feb1a116..06ab6066da61 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
+@@ -596,7 +596,7 @@ static ssize_t amdgpu_debugfs_regs_smc_read(struct file *f, char __user *buf,
+ 	int r;
+ 
+ 	if (!adev->smc_rreg)
+-		return -EPERM;
++		return -EOPNOTSUPP;
+ 
+ 	if (size & 0x3 || *pos & 0x3)
+ 		return -EINVAL;
+@@ -655,7 +655,7 @@ static ssize_t amdgpu_debugfs_regs_smc_write(struct file *f, const char __user *
+ 	int r;
+ 
+ 	if (!adev->smc_wreg)
+-		return -EPERM;
++		return -EOPNOTSUPP;
+ 
+ 	if (size & 0x3 || *pos & 0x3)
+ 		return -EINVAL;
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-amdkfd-confirm-list-is-non-empty-before-utilizin.patch b/queue-6.1/drm-amdkfd-confirm-list-is-non-empty-before-utilizin.patch
new file mode 100644
index 00000000000..3f5b6a67784
--- /dev/null
+++ b/queue-6.1/drm-amdkfd-confirm-list-is-non-empty-before-utilizin.patch
@@ -0,0 +1,81 @@
+From d1fa2b88398eea58286800cd42f1b85a56ff37dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Dec 2023 07:16:23 +0530
+Subject: drm/amdkfd: Confirm list is non-empty before utilizing
+ list_first_entry in kfd_topology.c
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
+
+[ Upstream commit 499839eca34ad62d43025ec0b46b80e77065f6d8 ]
+
+Before using list_first_entry, make sure to check that list is not
+empty, if list is empty return -ENODATA.
+
+Fixes the below:
+drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_topology.c:1347 kfd_create_indirect_link_prop() warn: can 'gpu_link' even be NULL?
+drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_topology.c:1428 kfd_add_peer_prop() warn: can 'iolink1' even be NULL?
+drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_topology.c:1433 kfd_add_peer_prop() warn: can 'iolink2' even be NULL?
+
+Fixes: 0f28cca87e9a ("drm/amdkfd: Extend KFD device topology to surface peer-to-peer links")
+Cc: Felix Kuehling <Felix.Kuehling@amd.com>
+Cc: Christian König <christian.koenig@amd.com>
+Cc: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
+Suggested-by: Felix Kuehling <Felix.Kuehling@amd.com>
+Suggested-by: Lijo Lazar <lijo.lazar@amd.com>
+Reviewed-by: Felix Kuehling <felix.kuehling@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_topology.c | 21 ++++++++++++---------
+ 1 file changed, 12 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
+index 713f893d2530..705d9e91b5aa 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
+@@ -1403,10 +1403,11 @@ static int kfd_create_indirect_link_prop(struct kfd_topology_device *kdev, int g
+ 		num_cpu++;
+ 	}
+ 
++	if (list_empty(&kdev->io_link_props))
++		return -ENODATA;
++
+ 	gpu_link = list_first_entry(&kdev->io_link_props,
+-					struct kfd_iolink_properties, list);
+-	if (!gpu_link)
+-		return -ENOMEM;
++				    struct kfd_iolink_properties, list);
+ 
+ 	for (i = 0; i < num_cpu; i++) {
+ 		/* CPU <--> GPU */
+@@ -1484,15 +1485,17 @@ static int kfd_add_peer_prop(struct kfd_topology_device *kdev,
+ 				peer->gpu->adev))
+ 		return ret;
+ 
++	if (list_empty(&kdev->io_link_props))
++		return -ENODATA;
++
+ 	iolink1 = list_first_entry(&kdev->io_link_props,
+-							struct kfd_iolink_properties, list);
+-	if (!iolink1)
+-		return -ENOMEM;
++				   struct kfd_iolink_properties, list);
++
++	if (list_empty(&peer->io_link_props))
++		return -ENODATA;
+ 
+ 	iolink2 = list_first_entry(&peer->io_link_props,
+-							struct kfd_iolink_properties, list);
+-	if (!iolink2)
+-		return -ENOMEM;
++				   struct kfd_iolink_properties, list);
+ 
+ 	props = kfd_alloc_struct(props);
+ 	if (!props)
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-bridge-cdns-mhdp8546-fix-use-of-uninitialized-va.patch b/queue-6.1/drm-bridge-cdns-mhdp8546-fix-use-of-uninitialized-va.patch
new file mode 100644
index 00000000000..5ce48f13f09
--- /dev/null
+++ b/queue-6.1/drm-bridge-cdns-mhdp8546-fix-use-of-uninitialized-va.patch
@@ -0,0 +1,38 @@
+From 294286ac3b6d814914a2c7efbe4ac33528371c93 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Nov 2023 15:14:05 +0200
+Subject: drm/bridge: cdns-mhdp8546: Fix use of uninitialized variable
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+[ Upstream commit 155d6fb61270dd297f128731cd155080deee8f3a ]
+
+'ret' could be uninitialized at the end of the function, although it's
+not clear if that can happen in practice.
+
+Fixes: 6a3608eae6d3 ("drm: bridge: cdns-mhdp8546: Enable HDCP")
+Acked-by: Maxime Ripard <mripard@kernel.org>
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20231103-uninit-fixes-v2-3-c22b2444f5f5@ideasonboard.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-hdcp.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-hdcp.c b/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-hdcp.c
+index 946212a95598..5e3b8edcf794 100644
+--- a/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-hdcp.c
++++ b/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-hdcp.c
+@@ -403,7 +403,8 @@ static int _cdns_mhdp_hdcp_disable(struct cdns_mhdp_device *mhdp)
+ 
+ static int _cdns_mhdp_hdcp_enable(struct cdns_mhdp_device *mhdp, u8 content_type)
+ {
+-	int ret, tries = 3;
++	int ret = -EINVAL;
++	int tries = 3;
+ 	u32 i;
+ 
+ 	for (i = 0; i < tries; i++) {
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-bridge-fix-typo-in-post_disable-description.patch b/queue-6.1/drm-bridge-fix-typo-in-post_disable-description.patch
new file mode 100644
index 00000000000..e31ad58168a
--- /dev/null
+++ b/queue-6.1/drm-bridge-fix-typo-in-post_disable-description.patch
@@ -0,0 +1,36 @@
+From 34ce5d893738f479609fa0c30f927a3e734176d5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Nov 2023 10:42:30 +0100
+Subject: drm/bridge: Fix typo in post_disable() description
+
+From: Dario Binacchi <dario.binacchi@amarulasolutions.com>
+
+[ Upstream commit 288b039db225676e0c520c981a1b5a2562d893a3 ]
+
+s/singals/signals/
+
+Fixes: 199e4e967af4 ("drm: Extract drm_bridge.h")
+Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
+Signed-off-by: Robert Foss <rfoss@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20231124094253.658064-1-dario.binacchi@amarulasolutions.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/drm/drm_bridge.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/drm/drm_bridge.h b/include/drm/drm_bridge.h
+index 6b656ea23b96..a76f4103d48b 100644
+--- a/include/drm/drm_bridge.h
++++ b/include/drm/drm_bridge.h
+@@ -191,7 +191,7 @@ struct drm_bridge_funcs {
+ 	 * or &drm_encoder_helper_funcs.dpms hook.
+ 	 *
+ 	 * The bridge must assume that the display pipe (i.e. clocks and timing
+-	 * singals) feeding it is no longer running when this callback is
++	 * signals) feeding it is no longer running when this callback is
+ 	 * called.
+ 	 *
+ 	 * The @post_disable callback is optional.
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-bridge-tc358767-fix-return-value-on-error-case.patch b/queue-6.1/drm-bridge-tc358767-fix-return-value-on-error-case.patch
new file mode 100644
index 00000000000..425d7006366
--- /dev/null
+++ b/queue-6.1/drm-bridge-tc358767-fix-return-value-on-error-case.patch
@@ -0,0 +1,39 @@
+From 74cddb357e3d05db5c6a6318d9bd1a41dd559ed4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Nov 2023 15:14:06 +0200
+Subject: drm/bridge: tc358767: Fix return value on error case
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+[ Upstream commit 32bd29b619638256c5b75fb021d6d9f12fc4a984 ]
+
+If the hpd_pin is invalid, the driver returns 'ret'. But 'ret' contains
+0, instead of an error value.
+
+Return -EINVAL instead.
+
+Fixes: f25ee5017e4f ("drm/bridge: tc358767: add IRQ and HPD support")
+Acked-by: Maxime Ripard <mripard@kernel.org>
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20231103-uninit-fixes-v2-4-c22b2444f5f5@ideasonboard.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/tc358767.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/bridge/tc358767.c b/drivers/gpu/drm/bridge/tc358767.c
+index 7ef78283e3d3..926ab5c3c31a 100644
+--- a/drivers/gpu/drm/bridge/tc358767.c
++++ b/drivers/gpu/drm/bridge/tc358767.c
+@@ -2097,7 +2097,7 @@ static int tc_probe(struct i2c_client *client, const struct i2c_device_id *id)
+ 	} else {
+ 		if (tc->hpd_pin < 0 || tc->hpd_pin > 1) {
+ 			dev_err(dev, "failed to parse HPD number\n");
+-			return ret;
++			return -EINVAL;
+ 		}
+ 	}
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-bridge-tpd12s015-drop-buggy-__exit-annotation-fo.patch b/queue-6.1/drm-bridge-tpd12s015-drop-buggy-__exit-annotation-fo.patch
new file mode 100644
index 00000000000..03a902b1e98
--- /dev/null
+++ b/queue-6.1/drm-bridge-tpd12s015-drop-buggy-__exit-annotation-fo.patch
@@ -0,0 +1,52 @@
+From dc2faa1f601141c7802a7df746315775c181a805 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Nov 2023 17:56:42 +0100
+Subject: drm/bridge: tpd12s015: Drop buggy __exit annotation for remove
+ function
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit ce3e112e7ae854249d8755906acc5f27e1542114 ]
+
+With tpd12s015_remove() marked with __exit this function is discarded
+when the driver is compiled as a built-in. The result is that when the
+driver unbinds there is no cleanup done which results in resource
+leakage or worse.
+
+Fixes: cff5e6f7e83f ("drm/bridge: Add driver for the TI TPD12S015 HDMI level shifter")
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
+Link: https://patchwork.freedesktop.org/patch/msgid/20231102165640.3307820-19-u.kleine-koenig@pengutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/ti-tpd12s015.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/ti-tpd12s015.c b/drivers/gpu/drm/bridge/ti-tpd12s015.c
+index e0e015243a60..b588fea12502 100644
+--- a/drivers/gpu/drm/bridge/ti-tpd12s015.c
++++ b/drivers/gpu/drm/bridge/ti-tpd12s015.c
+@@ -179,7 +179,7 @@ static int tpd12s015_probe(struct platform_device *pdev)
+ 	return 0;
+ }
+ 
+-static int __exit tpd12s015_remove(struct platform_device *pdev)
++static int tpd12s015_remove(struct platform_device *pdev)
+ {
+ 	struct tpd12s015_device *tpd = platform_get_drvdata(pdev);
+ 
+@@ -197,7 +197,7 @@ MODULE_DEVICE_TABLE(of, tpd12s015_of_match);
+ 
+ static struct platform_driver tpd12s015_driver = {
+ 	.probe	= tpd12s015_probe,
+-	.remove	= __exit_p(tpd12s015_remove),
++	.remove = tpd12s015_remove,
+ 	.driver	= {
+ 		.name	= "tpd12s015",
+ 		.of_match_table = tpd12s015_of_match,
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-drv-propagate-errors-from-drm_modeset_register_a.patch b/queue-6.1/drm-drv-propagate-errors-from-drm_modeset_register_a.patch
new file mode 100644
index 00000000000..368db96c754
--- /dev/null
+++ b/queue-6.1/drm-drv-propagate-errors-from-drm_modeset_register_a.patch
@@ -0,0 +1,54 @@
+From 3f05ba2a45d6e15d2062a5a5ff62bf801f841763 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 3 Dec 2023 01:55:52 +0300
+Subject: drm/drv: propagate errors from drm_modeset_register_all()
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit 5f8dec200923a76dc57187965fd59c1136f5d085 ]
+
+In case the drm_modeset_register_all() function fails, its error code
+will be ignored. Instead make the drm_dev_register() bail out in case of
+such an error.
+
+Fixes: 79190ea2658a ("drm: Add callbacks for late registering")
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Maxime Ripard <mripard@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20231202225552.1283638-1-dmitry.baryshkov@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_drv.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
+index 203bf8d6c34c..d41a5eaa3e89 100644
+--- a/drivers/gpu/drm/drm_drv.c
++++ b/drivers/gpu/drm/drm_drv.c
+@@ -895,8 +895,11 @@ int drm_dev_register(struct drm_device *dev, unsigned long flags)
+ 			goto err_minors;
+ 	}
+ 
+-	if (drm_core_check_feature(dev, DRIVER_MODESET))
+-		drm_modeset_register_all(dev);
++	if (drm_core_check_feature(dev, DRIVER_MODESET)) {
++		ret = drm_modeset_register_all(dev);
++		if (ret)
++			goto err_unload;
++	}
+ 
+ 	DRM_INFO("Initialized %s %d.%d.%d %s for %s on minor %d\n",
+ 		 driver->name, driver->major, driver->minor,
+@@ -906,6 +909,9 @@ int drm_dev_register(struct drm_device *dev, unsigned long flags)
+ 
+ 	goto out_unlock;
+ 
++err_unload:
++	if (dev->driver->unload)
++		dev->driver->unload(dev);
+ err_minors:
+ 	remove_compat_control_link(dev);
+ 	drm_minor_unregister(dev, DRM_MINOR_PRIMARY);
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-mediatek-dp-add-phy_mtk_dp-module-as-pre-depende.patch b/queue-6.1/drm-mediatek-dp-add-phy_mtk_dp-module-as-pre-depende.patch
new file mode 100644
index 00000000000..05476a650ea
--- /dev/null
+++ b/queue-6.1/drm-mediatek-dp-add-phy_mtk_dp-module-as-pre-depende.patch
@@ -0,0 +1,48 @@
+From de676391fc162429c3f06c98018dc4406f31aaf7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Nov 2023 09:29:27 -0500
+Subject: drm/mediatek: dp: Add phy_mtk_dp module as pre-dependency
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Nícolas F. R. A. Prado <nfraprado@collabora.com>
+
+[ Upstream commit c8048dd0b07df68724805254b9e994d99e9a7af4 ]
+
+The mtk_dp driver registers a phy device which is handled by the
+phy_mtk_dp driver and assumes that the phy probe will complete
+synchronously, proceeding to make use of functionality exposed by that
+driver right away. This assumption however is false when the phy driver
+is built as a module, causing the mtk_dp driver to fail probe in this
+case.
+
+Add the phy_mtk_dp module as a pre-dependency to the mtk_dp module to
+ensure the phy module has been loaded before the dp, so that the phy
+probe happens synchrounously and the mtk_dp driver can probe
+successfully even with the phy driver built as a module.
+
+Suggested-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Fixes: f70ac097a2cf ("drm/mediatek: Add MT8195 Embedded DisplayPort driver")
+Signed-off-by: Nícolas F. R. A. Prado <nfraprado@collabora.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Reviewed-by: Guillaume Ranquet <granquet@baylibre.com>
+Link: https://patchwork.kernel.org/project/dri-devel/patch/20231121142938.460846-1-nfraprado@collabora.com/
+Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/mediatek/mtk_dp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/mediatek/mtk_dp.c b/drivers/gpu/drm/mediatek/mtk_dp.c
+index 2c850b6d945b..519e23a2a017 100644
+--- a/drivers/gpu/drm/mediatek/mtk_dp.c
++++ b/drivers/gpu/drm/mediatek/mtk_dp.c
+@@ -2669,3 +2669,4 @@ MODULE_AUTHOR("Markus Schneider-Pargmann <msp@baylibre.com>");
+ MODULE_AUTHOR("Bo-Chen Chen <rex-bc.chen@mediatek.com>");
+ MODULE_DESCRIPTION("MediaTek DisplayPort Driver");
+ MODULE_LICENSE("GPL");
++MODULE_SOFTDEP("pre: phy_mtk_dp");
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-mediatek-fix-underrun-in-vdo1-when-switches-off-.patch b/queue-6.1/drm-mediatek-fix-underrun-in-vdo1-when-switches-off-.patch
new file mode 100644
index 00000000000..39d0450552c
--- /dev/null
+++ b/queue-6.1/drm-mediatek-fix-underrun-in-vdo1-when-switches-off-.patch
@@ -0,0 +1,41 @@
+From 65d79d15171c14f583c7850f84c237ce0ff621cd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Dec 2023 13:58:46 +0800
+Subject: drm/mediatek: Fix underrun in VDO1 when switches off the layer
+
+From: Hsiao Chien Sung <shawn.sung@mediatek.com>
+
+[ Upstream commit 73b5ab27ab2ee616f2709dc212c2b0007894a12e ]
+
+Do not reset Merge while using CMDQ because reset API doesn't
+wait for frame done event as CMDQ does and could lead to
+underrun when the layer is switching off.
+
+Fixes: aaf94f7c3ae6 ("drm/mediatek: Add display merge async reset control")
+
+Reviewed-by: CK Hu <ck.hu@mediatek.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Hsiao Chien Sung <shawn.sung@mediatek.com>
+Link: https://patchwork.kernel.org/project/dri-devel/patch/20231214055847.4936-23-shawn.sung@mediatek.com/
+Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/mediatek/mtk_disp_merge.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/mediatek/mtk_disp_merge.c b/drivers/gpu/drm/mediatek/mtk_disp_merge.c
+index 6428b6203ffe..211140e87568 100644
+--- a/drivers/gpu/drm/mediatek/mtk_disp_merge.c
++++ b/drivers/gpu/drm/mediatek/mtk_disp_merge.c
+@@ -104,7 +104,7 @@ void mtk_merge_stop_cmdq(struct device *dev, struct cmdq_pkt *cmdq_pkt)
+ 	mtk_ddp_write(cmdq_pkt, 0, &priv->cmdq_reg, priv->regs,
+ 		      DISP_REG_MERGE_CTRL);
+ 
+-	if (priv->async_clk)
++	if (!cmdq_pkt && priv->async_clk)
+ 		reset_control_reset(priv->reset_ctl);
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-mediatek-return-error-if-mdp-rdma-failed-to-enab.patch b/queue-6.1/drm-mediatek-return-error-if-mdp-rdma-failed-to-enab.patch
new file mode 100644
index 00000000000..5a8edd6e68d
--- /dev/null
+++ b/queue-6.1/drm-mediatek-return-error-if-mdp-rdma-failed-to-enab.patch
@@ -0,0 +1,41 @@
+From 21b2220381ea1e5e5fc9d1d27b66985233f6be7f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Dec 2023 13:58:44 +0800
+Subject: drm/mediatek: Return error if MDP RDMA failed to enable the clock
+
+From: Hsiao Chien Sung <shawn.sung@mediatek.com>
+
+[ Upstream commit 21b287146adf39304193e4c49198021e06a28ded ]
+
+Return the result of clk_prepare_enable() instead of
+always returns 0.
+
+Fixes: f8946e2b6bb2 ("drm/mediatek: Add display MDP RDMA support for MT8195")
+
+Reviewed-by: CK Hu <ck.hu@mediatek.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Hsiao Chien Sung <shawn.sung@mediatek.com>
+Link: https://patchwork.kernel.org/project/dri-devel/patch/20231214055847.4936-21-shawn.sung@mediatek.com/
+Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/mediatek/mtk_mdp_rdma.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/mediatek/mtk_mdp_rdma.c b/drivers/gpu/drm/mediatek/mtk_mdp_rdma.c
+index eecfa98ff52e..b288bb6eeecc 100644
+--- a/drivers/gpu/drm/mediatek/mtk_mdp_rdma.c
++++ b/drivers/gpu/drm/mediatek/mtk_mdp_rdma.c
+@@ -223,8 +223,7 @@ int mtk_mdp_rdma_clk_enable(struct device *dev)
+ {
+ 	struct mtk_mdp_rdma *rdma = dev_get_drvdata(dev);
+ 
+-	clk_prepare_enable(rdma->clk);
+-	return 0;
++	return clk_prepare_enable(rdma->clk);
+ }
+ 
+ void mtk_mdp_rdma_clk_disable(struct device *dev)
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-msm-dpu-drop-enable-and-frame_count-parameters-f.patch b/queue-6.1/drm-msm-dpu-drop-enable-and-frame_count-parameters-f.patch
new file mode 100644
index 00000000000..c34b4dcbe57
--- /dev/null
+++ b/queue-6.1/drm-msm-dpu-drop-enable-and-frame_count-parameters-f.patch
@@ -0,0 +1,246 @@
+From 3c7061016d2e637eb9c1b28f98a44d70d30af6e6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Dec 2023 13:30:18 -0800
+Subject: drm/msm/dpu: Drop enable and frame_count parameters from
+ dpu_hw_setup_misr()
+
+From: Jessica Zhang <quic_jesszhan@quicinc.com>
+
+[ Upstream commit 3313c23f3eab698bc6b904520ee608fc0f7b03d0 ]
+
+Drop the enable and frame_count parameters from dpu_hw_setup_misr() as they
+are always set to the same values.
+
+In addition, replace MISR_FRAME_COUNT_MASK with MISR_FRAME_COUNT as
+frame_count is always set to the same value.
+
+Fixes: 7b37523fb1d1 ("drm/msm/dpu: Move MISR methods to dpu_hw_util")
+Signed-off-by: Jessica Zhang <quic_jesszhan@quicinc.com>
+Reviewed-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Patchwork: https://patchwork.freedesktop.org/patch/572009/
+Link: https://lore.kernel.org/r/20231213-encoder-fixup-v4-2-6da6cd1bf118@quicinc.com
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c    |  4 ++--
+ drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c |  4 ++--
+ drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c |  6 +++---
+ drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.h |  4 ++--
+ drivers/gpu/drm/msm/disp/dpu1/dpu_hw_lm.c   |  6 +++---
+ drivers/gpu/drm/msm/disp/dpu1/dpu_hw_lm.h   |  3 ++-
+ drivers/gpu/drm/msm/disp/dpu1/dpu_hw_util.c | 19 +++++--------------
+ drivers/gpu/drm/msm/disp/dpu1/dpu_hw_util.h |  9 +++------
+ 8 files changed, 22 insertions(+), 33 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
+index 6c0ffe8e4adb..5a5821e59dc1 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0-only
+ /*
+- * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
++ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+  * Copyright (c) 2014-2021 The Linux Foundation. All rights reserved.
+  * Copyright (C) 2013 Red Hat
+  * Author: Rob Clark <robdclark@gmail.com>
+@@ -124,7 +124,7 @@ static void dpu_crtc_setup_lm_misr(struct dpu_crtc_state *crtc_state)
+ 			continue;
+ 
+ 		/* Calculate MISR over 1 frame */
+-		m->hw_lm->ops.setup_misr(m->hw_lm, true, 1);
++		m->hw_lm->ops.setup_misr(m->hw_lm);
+ 	}
+ }
+ 
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c
+index 547f9f2b9fcb..b0eb881f8af1 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c
+@@ -2,7 +2,7 @@
+ /*
+  * Copyright (C) 2013 Red Hat
+  * Copyright (c) 2014-2018, 2020-2021 The Linux Foundation. All rights reserved.
+- * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
++ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+  *
+  * Author: Rob Clark <robdclark@gmail.com>
+  */
+@@ -257,7 +257,7 @@ void dpu_encoder_setup_misr(const struct drm_encoder *drm_enc)
+ 		if (!phys->hw_intf || !phys->hw_intf->ops.setup_misr)
+ 			continue;
+ 
+-		phys->hw_intf->ops.setup_misr(phys->hw_intf, true, 1);
++		phys->hw_intf->ops.setup_misr(phys->hw_intf);
+ 	}
+ }
+ 
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c
+index 7e210ba0b104..384558d2f960 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0-only
+ /*
+- * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
++ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+  * Copyright (c) 2015-2018, The Linux Foundation. All rights reserved.
+  */
+ 
+@@ -322,9 +322,9 @@ static u32 dpu_hw_intf_get_line_count(struct dpu_hw_intf *intf)
+ 	return DPU_REG_READ(c, INTF_LINE_COUNT);
+ }
+ 
+-static void dpu_hw_intf_setup_misr(struct dpu_hw_intf *intf, bool enable, u32 frame_count)
++static void dpu_hw_intf_setup_misr(struct dpu_hw_intf *intf)
+ {
+-	dpu_hw_setup_misr(&intf->hw, INTF_MISR_CTRL, enable, frame_count, 0x1);
++	dpu_hw_setup_misr(&intf->hw, INTF_MISR_CTRL, 0x1);
+ }
+ 
+ static int dpu_hw_intf_collect_misr(struct dpu_hw_intf *intf, u32 *misr_value)
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.h b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.h
+index 643dd10bc030..e75339b96a1d 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.h
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.h
+@@ -1,6 +1,6 @@
+ /* SPDX-License-Identifier: GPL-2.0-only */
+ /*
+- * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
++ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+  * Copyright (c) 2015-2018, The Linux Foundation. All rights reserved.
+  */
+ 
+@@ -80,7 +80,7 @@ struct dpu_hw_intf_ops {
+ 	void (*bind_pingpong_blk)(struct dpu_hw_intf *intf,
+ 			bool enable,
+ 			const enum dpu_pingpong pp);
+-	void (*setup_misr)(struct dpu_hw_intf *intf, bool enable, u32 frame_count);
++	void (*setup_misr)(struct dpu_hw_intf *intf);
+ 	int (*collect_misr)(struct dpu_hw_intf *intf, u32 *misr_value);
+ };
+ 
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_lm.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_lm.c
+index 2dd9f9185cfc..cc04fb979fb5 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_lm.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_lm.c
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0-only
+ /*
+- * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
++ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+  * Copyright (c) 2015-2021, The Linux Foundation. All rights reserved.
+  */
+ 
+@@ -99,9 +99,9 @@ static void dpu_hw_lm_setup_border_color(struct dpu_hw_mixer *ctx,
+ 	}
+ }
+ 
+-static void dpu_hw_lm_setup_misr(struct dpu_hw_mixer *ctx, bool enable, u32 frame_count)
++static void dpu_hw_lm_setup_misr(struct dpu_hw_mixer *ctx)
+ {
+-	dpu_hw_setup_misr(&ctx->hw, LM_MISR_CTRL, enable, frame_count, 0x0);
++	dpu_hw_setup_misr(&ctx->hw, LM_MISR_CTRL, 0x0);
+ }
+ 
+ static int dpu_hw_lm_collect_misr(struct dpu_hw_mixer *ctx, u32 *misr_value)
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_lm.h b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_lm.h
+index 652ddfdedec3..0a050eb247b9 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_lm.h
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_lm.h
+@@ -1,5 +1,6 @@
+ /* SPDX-License-Identifier: GPL-2.0-only */
+ /*
++ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+  * Copyright (c) 2015-2021, The Linux Foundation. All rights reserved.
+  */
+ 
+@@ -57,7 +58,7 @@ struct dpu_hw_lm_ops {
+ 	/**
+ 	 * setup_misr: Enable/disable MISR
+ 	 */
+-	void (*setup_misr)(struct dpu_hw_mixer *ctx, bool enable, u32 frame_count);
++	void (*setup_misr)(struct dpu_hw_mixer *ctx);
+ 
+ 	/**
+ 	 * collect_misr: Read MISR signature
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_util.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_util.c
+index 119dc07d6ab5..1b7439ae686a 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_util.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_util.c
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0-only
+ /*
+- * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
++ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+  * Copyright (c) 2015-2018, The Linux Foundation. All rights reserved.
+  */
+ #define pr_fmt(fmt)	"[drm:%s:%d] " fmt, __func__, __LINE__
+@@ -454,9 +454,7 @@ u64 _dpu_hw_get_qos_lut(const struct dpu_qos_lut_tbl *tbl,
+  * note: Aside from encoders, input_sel should be set to 0x0 by default
+  */
+ void dpu_hw_setup_misr(struct dpu_hw_blk_reg_map *c,
+-		u32 misr_ctrl_offset,
+-		bool enable, u32 frame_count,
+-		u8 input_sel)
++		u32 misr_ctrl_offset, u8 input_sel)
+ {
+ 	u32 config = 0;
+ 
+@@ -465,16 +463,9 @@ void dpu_hw_setup_misr(struct dpu_hw_blk_reg_map *c,
+ 	/* Clear old MISR value (in case it's read before a new value is calculated)*/
+ 	wmb();
+ 
+-	if (enable) {
+-		config = (frame_count & MISR_FRAME_COUNT_MASK) |
+-			MISR_CTRL_ENABLE | MISR_CTRL_FREE_RUN_MASK |
+-			((input_sel & 0xF) << 24);
+-
+-		DPU_REG_WRITE(c, misr_ctrl_offset, config);
+-	} else {
+-		DPU_REG_WRITE(c, misr_ctrl_offset, 0);
+-	}
+-
++	config = MISR_FRAME_COUNT | MISR_CTRL_ENABLE | MISR_CTRL_FREE_RUN_MASK |
++		((input_sel & 0xF) << 24);
++	DPU_REG_WRITE(c, misr_ctrl_offset, config);
+ }
+ 
+ int dpu_hw_collect_misr(struct dpu_hw_blk_reg_map *c,
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_util.h b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_util.h
+index dffad0a83781..4ae2a434372c 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_util.h
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_util.h
+@@ -1,6 +1,6 @@
+ /* SPDX-License-Identifier: GPL-2.0-only */
+ /*
+- * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
++ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+  * Copyright (c) 2015-2021, The Linux Foundation. All rights reserved.
+  */
+ 
+@@ -13,7 +13,7 @@
+ #include "dpu_hw_catalog.h"
+ 
+ #define REG_MASK(n)                     ((BIT(n)) - 1)
+-#define MISR_FRAME_COUNT_MASK           0xFF
++#define MISR_FRAME_COUNT                0x1
+ #define MISR_CTRL_ENABLE                BIT(8)
+ #define MISR_CTRL_STATUS                BIT(9)
+ #define MISR_CTRL_STATUS_CLEAR          BIT(10)
+@@ -350,10 +350,7 @@ u64 _dpu_hw_get_qos_lut(const struct dpu_qos_lut_tbl *tbl,
+ 		u32 total_fl);
+ 
+ void dpu_hw_setup_misr(struct dpu_hw_blk_reg_map *c,
+-		u32 misr_ctrl_offset,
+-		bool enable,
+-		u32 frame_count,
+-		u8 input_sel);
++		u32 misr_ctrl_offset, u8 input_sel);
+ 
+ int dpu_hw_collect_misr(struct dpu_hw_blk_reg_map *c,
+ 		u32 misr_ctrl_offset,
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-msm-dpu-set-input_sel-bit-for-intf.patch b/queue-6.1/drm-msm-dpu-set-input_sel-bit-for-intf.patch
new file mode 100644
index 00000000000..a64c32cfd90
--- /dev/null
+++ b/queue-6.1/drm-msm-dpu-set-input_sel-bit-for-intf.patch
@@ -0,0 +1,100 @@
+From 2f3a6a63046a1bfc11fb60d3e9efd3ef4046dcf2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Dec 2023 13:30:17 -0800
+Subject: drm/msm/dpu: Set input_sel bit for INTF
+
+From: Jessica Zhang <quic_jesszhan@quicinc.com>
+
+[ Upstream commit 980fffd0c69e5df0f67ee089d405899d532aeeab ]
+
+Set the input_sel bit for encoders as it was missed in the initial
+implementation.
+
+Reported-by: Rob Clark <robdclark@gmail.com>
+Closes: https://gitlab.freedesktop.org/drm/msm/-/issues/39
+Fixes: 91143873a05d ("drm/msm/dpu: Add MISR register support for interface")
+Signed-off-by: Jessica Zhang <quic_jesszhan@quicinc.com>
+Reviewed-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
+Patchwork: https://patchwork.freedesktop.org/patch/572007/
+Link: https://lore.kernel.org/r/20231213-encoder-fixup-v4-1-6da6cd1bf118@quicinc.com
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c | 2 +-
+ drivers/gpu/drm/msm/disp/dpu1/dpu_hw_lm.c   | 2 +-
+ drivers/gpu/drm/msm/disp/dpu1/dpu_hw_util.c | 9 +++++++--
+ drivers/gpu/drm/msm/disp/dpu1/dpu_hw_util.h | 3 ++-
+ 4 files changed, 11 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c
+index b9dddf576c02..7e210ba0b104 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c
+@@ -324,7 +324,7 @@ static u32 dpu_hw_intf_get_line_count(struct dpu_hw_intf *intf)
+ 
+ static void dpu_hw_intf_setup_misr(struct dpu_hw_intf *intf, bool enable, u32 frame_count)
+ {
+-	dpu_hw_setup_misr(&intf->hw, INTF_MISR_CTRL, enable, frame_count);
++	dpu_hw_setup_misr(&intf->hw, INTF_MISR_CTRL, enable, frame_count, 0x1);
+ }
+ 
+ static int dpu_hw_intf_collect_misr(struct dpu_hw_intf *intf, u32 *misr_value)
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_lm.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_lm.c
+index f5120ea91ede..2dd9f9185cfc 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_lm.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_lm.c
+@@ -101,7 +101,7 @@ static void dpu_hw_lm_setup_border_color(struct dpu_hw_mixer *ctx,
+ 
+ static void dpu_hw_lm_setup_misr(struct dpu_hw_mixer *ctx, bool enable, u32 frame_count)
+ {
+-	dpu_hw_setup_misr(&ctx->hw, LM_MISR_CTRL, enable, frame_count);
++	dpu_hw_setup_misr(&ctx->hw, LM_MISR_CTRL, enable, frame_count, 0x0);
+ }
+ 
+ static int dpu_hw_lm_collect_misr(struct dpu_hw_mixer *ctx, u32 *misr_value)
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_util.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_util.c
+index 8062228eada6..119dc07d6ab5 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_util.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_util.c
+@@ -450,9 +450,13 @@ u64 _dpu_hw_get_qos_lut(const struct dpu_qos_lut_tbl *tbl,
+ 	return 0;
+ }
+ 
++/*
++ * note: Aside from encoders, input_sel should be set to 0x0 by default
++ */
+ void dpu_hw_setup_misr(struct dpu_hw_blk_reg_map *c,
+ 		u32 misr_ctrl_offset,
+-		bool enable, u32 frame_count)
++		bool enable, u32 frame_count,
++		u8 input_sel)
+ {
+ 	u32 config = 0;
+ 
+@@ -463,7 +467,8 @@ void dpu_hw_setup_misr(struct dpu_hw_blk_reg_map *c,
+ 
+ 	if (enable) {
+ 		config = (frame_count & MISR_FRAME_COUNT_MASK) |
+-			MISR_CTRL_ENABLE | MISR_CTRL_FREE_RUN_MASK;
++			MISR_CTRL_ENABLE | MISR_CTRL_FREE_RUN_MASK |
++			((input_sel & 0xF) << 24);
+ 
+ 		DPU_REG_WRITE(c, misr_ctrl_offset, config);
+ 	} else {
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_util.h b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_util.h
+index 27f4c39e35ab..dffad0a83781 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_util.h
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_util.h
+@@ -352,7 +352,8 @@ u64 _dpu_hw_get_qos_lut(const struct dpu_qos_lut_tbl *tbl,
+ void dpu_hw_setup_misr(struct dpu_hw_blk_reg_map *c,
+ 		u32 misr_ctrl_offset,
+ 		bool enable,
+-		u32 frame_count);
++		u32 frame_count,
++		u8 input_sel);
+ 
+ int dpu_hw_collect_misr(struct dpu_hw_blk_reg_map *c,
+ 		u32 misr_ctrl_offset,
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-msm-dsi-use-pm_runtime_resume_and_get-to-prevent.patch b/queue-6.1/drm-msm-dsi-use-pm_runtime_resume_and_get-to-prevent.patch
new file mode 100644
index 00000000000..0210d5a6ab5
--- /dev/null
+++ b/queue-6.1/drm-msm-dsi-use-pm_runtime_resume_and_get-to-prevent.patch
@@ -0,0 +1,43 @@
+From 34b0007b25ec6b07de19466154bc8e5398a3986a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jun 2023 13:43:20 +0200
+Subject: drm/msm/dsi: Use pm_runtime_resume_and_get to prevent refcnt leaks
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit 3d07a411b4faaf2b498760ccf12888f8de529de0 ]
+
+This helper has been introduced to avoid programmer errors (missing
+_put calls leading to dangling refcnt) when using pm_runtime_get, use it.
+
+While at it, start checking the return value.
+
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Fixes: 5c8290284402 ("drm/msm/dsi: Split PHY drivers to separate files")
+Patchwork: https://patchwork.freedesktop.org/patch/543350/
+Link: https://lore.kernel.org/r/20230620-topic-dsiphy_rpm-v2-1-a11a751f34f0@linaro.org
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/dsi/phy/dsi_phy.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c b/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c
+index 7fc0975cb869..62bc3756f2e2 100644
+--- a/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c
++++ b/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c
+@@ -512,7 +512,9 @@ static int dsi_phy_enable_resource(struct msm_dsi_phy *phy)
+ 	struct device *dev = &phy->pdev->dev;
+ 	int ret;
+ 
+-	pm_runtime_get_sync(dev);
++	ret = pm_runtime_resume_and_get(dev);
++	if (ret)
++		return ret;
+ 
+ 	ret = clk_prepare_enable(phy->ahb_clk);
+ 	if (ret) {
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-msm-mdp4-flush-vblank-event-on-disable.patch b/queue-6.1/drm-msm-mdp4-flush-vblank-event-on-disable.patch
new file mode 100644
index 00000000000..321e5a9d205
--- /dev/null
+++ b/queue-6.1/drm-msm-mdp4-flush-vblank-event-on-disable.patch
@@ -0,0 +1,53 @@
+From 376cd830d73dbfc8c52fdc6e50175b483e6e3446 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Nov 2023 00:54:01 +0300
+Subject: drm/msm/mdp4: flush vblank event on disable
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit c6721b3c6423d8a348ae885a0f4c85e14f9bf85c ]
+
+Flush queued events when disabling the crtc. This avoids timeouts when
+we come back and wait for dependencies (like the previous frame's
+flip_done).
+
+Fixes: c8afe684c95c ("drm/msm: basic KMS driver for snapdragon")
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Reviewed-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
+Patchwork: https://patchwork.freedesktop.org/patch/569127/
+Link: https://lore.kernel.org/r/20231127215401.4064128-1-dmitry.baryshkov@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/disp/mdp4/mdp4_crtc.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/gpu/drm/msm/disp/mdp4/mdp4_crtc.c b/drivers/gpu/drm/msm/disp/mdp4/mdp4_crtc.c
+index 169f9de4a12a..3100957225a7 100644
+--- a/drivers/gpu/drm/msm/disp/mdp4/mdp4_crtc.c
++++ b/drivers/gpu/drm/msm/disp/mdp4/mdp4_crtc.c
+@@ -269,6 +269,7 @@ static void mdp4_crtc_atomic_disable(struct drm_crtc *crtc,
+ {
+ 	struct mdp4_crtc *mdp4_crtc = to_mdp4_crtc(crtc);
+ 	struct mdp4_kms *mdp4_kms = get_kms(crtc);
++	unsigned long flags;
+ 
+ 	DBG("%s", mdp4_crtc->name);
+ 
+@@ -281,6 +282,14 @@ static void mdp4_crtc_atomic_disable(struct drm_crtc *crtc,
+ 	mdp_irq_unregister(&mdp4_kms->base, &mdp4_crtc->err);
+ 	mdp4_disable(mdp4_kms);
+ 
++	if (crtc->state->event && !crtc->state->active) {
++		WARN_ON(mdp4_crtc->event);
++		spin_lock_irqsave(&mdp4_kms->dev->event_lock, flags);
++		drm_crtc_send_vblank_event(crtc, crtc->state->event);
++		crtc->state->event = NULL;
++		spin_unlock_irqrestore(&mdp4_kms->dev->event_lock, flags);
++	}
++
+ 	mdp4_crtc->enabled = false;
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-nouveau-fence-fix-warning-directly-dereferencing.patch b/queue-6.1/drm-nouveau-fence-fix-warning-directly-dereferencing.patch
new file mode 100644
index 00000000000..fa458aaa214
--- /dev/null
+++ b/queue-6.1/drm-nouveau-fence-fix-warning-directly-dereferencing.patch
@@ -0,0 +1,58 @@
+From ea650db1d4e8514c1ae1690e3e4d117952ac9698 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Nov 2023 00:43:03 +0530
+Subject: drm/nouveau/fence:: fix warning directly dereferencing a rcu pointer
+
+From: Abhinav Singh <singhabhinav9051571833@gmail.com>
+
+[ Upstream commit 5f35a624c1e30b5bae5023b3c256e94e0ad4f806 ]
+
+Fix a sparse warning with this message
+"warning:dereference of noderef expression". In this context it means we
+are dereferencing a __rcu tagged pointer directly.
+
+We should not be directly dereferencing a rcu pointer. To get a normal
+(non __rcu tagged pointer) from a __rcu tagged pointer we are using the
+function unrcu_pointer(...). The non __rcu tagged pointer then can be
+dereferenced just like a normal pointer.
+
+I tested with qemu with this command
+qemu-system-x86_64 \
+	-m 2G \
+	-smp 2 \
+	-kernel bzImage \
+	-append "console=ttyS0 root=/dev/sda earlyprintk=serial net.ifnames=0" \
+	-drive file=bullseye.img,format=raw \
+	-net user,host=10.0.2.10,hostfwd=tcp:127.0.0.1:10021-:22 \
+	-net nic,model=e1000 \
+	-enable-kvm \
+	-nographic \
+	-pidfile vm.pid \
+	2>&1 | tee vm.log
+with lockdep enabled.
+
+Fixes: 0ec5f02f0e2c ("drm/nouveau: prevent stale fence->channel pointers, and protect with rcu")
+Signed-off-by: Abhinav Singh <singhabhinav9051571833@gmail.com>
+Signed-off-by: Danilo Krummrich <dakr@redhat.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20231113191303.3277733-1-singhabhinav9051571833@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/nouveau/nv04_fence.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/nouveau/nv04_fence.c b/drivers/gpu/drm/nouveau/nv04_fence.c
+index 5b71a5a5cd85..cdbc75e3d1f6 100644
+--- a/drivers/gpu/drm/nouveau/nv04_fence.c
++++ b/drivers/gpu/drm/nouveau/nv04_fence.c
+@@ -39,7 +39,7 @@ struct nv04_fence_priv {
+ static int
+ nv04_fence_emit(struct nouveau_fence *fence)
+ {
+-	struct nvif_push *push = fence->channel->chan.push;
++	struct nvif_push *push = unrcu_pointer(fence->channel)->chan.push;
+ 	int ret = PUSH_WAIT(push, 2);
+ 	if (ret == 0) {
+ 		PUSH_NVSQ(push, NV_SW, 0x0150, fence->base.seqno);
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-panel-elida-kd35t133-hold-panel-in-reset-for-unp.patch b/queue-6.1/drm-panel-elida-kd35t133-hold-panel-in-reset-for-unp.patch
new file mode 100644
index 00000000000..562bf877adf
--- /dev/null
+++ b/queue-6.1/drm-panel-elida-kd35t133-hold-panel-in-reset-for-unp.patch
@@ -0,0 +1,42 @@
+From c26d90e0cbbb5bcb96ce7f82e04b43e3e23bb8a0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Nov 2023 13:44:02 -0600
+Subject: drm/panel-elida-kd35t133: hold panel in reset for unprepare
+
+From: Chris Morgan <macromorgan@hotmail.com>
+
+[ Upstream commit 03c5b2a5f6c39fe4e090346536cf1c14ee18b61e ]
+
+For devices like the Anbernic RG351M and RG351P the panel is wired to
+an always on regulator. When the device suspends and wakes up, there
+are some slight artifacts on the screen that go away over time. If
+instead we hold the panel in reset status after it is unprepared,
+this does not happen.
+
+Fixes: 5b6603360c12 ("drm/panel: add panel driver for Elida KD35T133 panels")
+Signed-off-by: Chris Morgan <macromorgan@hotmail.com>
+Reviewed-by: Jessica Zhang <quic_jesszhan@quicinc.com>
+Link: https://lore.kernel.org/r/20231117194405.1386265-3-macroalpha82@gmail.com
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20231117194405.1386265-3-macroalpha82@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panel/panel-elida-kd35t133.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/panel/panel-elida-kd35t133.c b/drivers/gpu/drm/panel/panel-elida-kd35t133.c
+index eee714cf3f49..3a7fc3ca6a6f 100644
+--- a/drivers/gpu/drm/panel/panel-elida-kd35t133.c
++++ b/drivers/gpu/drm/panel/panel-elida-kd35t133.c
+@@ -112,6 +112,8 @@ static int kd35t133_unprepare(struct drm_panel *panel)
+ 		return ret;
+ 	}
+ 
++	gpiod_set_value_cansleep(ctx->reset_gpio, 1);
++
+ 	regulator_disable(ctx->iovcc);
+ 	regulator_disable(ctx->vdd);
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-panel-st7701-fix-avcl-calculation.patch b/queue-6.1/drm-panel-st7701-fix-avcl-calculation.patch
new file mode 100644
index 00000000000..9681a6dc996
--- /dev/null
+++ b/queue-6.1/drm-panel-st7701-fix-avcl-calculation.patch
@@ -0,0 +1,46 @@
+From c665084149d2719deda5b726aef9c9c4fcd57d08 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Dec 2023 09:48:45 -0600
+Subject: drm/panel: st7701: Fix AVCL calculation
+
+From: Chris Morgan <macromorgan@hotmail.com>
+
+[ Upstream commit 799825aa87200ade1ba21db853d1c2ff720dcfe0 ]
+
+The AVCL register, according to the datasheet, comes in increments
+of -0.2v between -4.4v (represented by 0x0) to -5.0v (represented
+by 0x3). The current calculation is done by adding the defined
+AVCL value in mV to -4400 and then dividing by 200 to get the register
+value. Unfortunately if I subtract -4400 from -4400 I get -8800, which
+divided by 200 gives me -44. If I instead subtract -4400 from -4400
+I get 0, which divided by 200 gives me 0. Based on the datasheet this
+is the expected register value.
+
+Fixes: 83b7a8e7e88e ("drm/panel/panel-sitronix-st7701: Parametrize voltage and timing")
+
+Signed-off-by: Chris Morgan <macromorgan@hotmail.com>
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://lore.kernel.org/r/20231208154847.130615-2-macroalpha82@gmail.com
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20231208154847.130615-2-macroalpha82@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panel/panel-sitronix-st7701.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/panel/panel-sitronix-st7701.c b/drivers/gpu/drm/panel/panel-sitronix-st7701.c
+index 225b9884f61a..54b28992db5d 100644
+--- a/drivers/gpu/drm/panel/panel-sitronix-st7701.c
++++ b/drivers/gpu/drm/panel/panel-sitronix-st7701.c
+@@ -288,7 +288,7 @@ static void st7701_init_sequence(struct st7701 *st7701)
+ 		   FIELD_PREP(DSI_CMD2_BK1_PWRCTRL2_AVDD_MASK,
+ 			      DIV_ROUND_CLOSEST(desc->avdd_mv - 6200, 200)) |
+ 		   FIELD_PREP(DSI_CMD2_BK1_PWRCTRL2_AVCL_MASK,
+-			      DIV_ROUND_CLOSEST(-4400 + desc->avcl_mv, 200)));
++			      DIV_ROUND_CLOSEST(-4400 - desc->avcl_mv, 200)));
+ 
+ 	/* T2D = 0.2us * T2D[3:0] */
+ 	ST7701_DSI(st7701, DSI_CMD2_BK1_SPD1,
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-panfrost-ignore-core_mask-for-poweroff-and-disab.patch b/queue-6.1/drm-panfrost-ignore-core_mask-for-poweroff-and-disab.patch
new file mode 100644
index 00000000000..b3415465676
--- /dev/null
+++ b/queue-6.1/drm-panfrost-ignore-core_mask-for-poweroff-and-disab.patch
@@ -0,0 +1,84 @@
+From fd84ff8d45d779747bee37a71fae2786ecc90fe0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Dec 2023 12:42:13 +0100
+Subject: drm/panfrost: Ignore core_mask for poweroff and disable PWRTRANS irq
+
+From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+
+[ Upstream commit a4f5892914ca7709ea6d191f0edace93a5935966 ]
+
+Some SoCs may be equipped with a GPU containing two core groups
+and this is exactly the case of Samsung's Exynos 5422 featuring
+an ARM Mali-T628 MP6 GPU: the support for this GPU in Panfrost
+is partial, as this driver currently supports using only one
+core group and that's reflected on all parts of it, including
+the power on (and power off, previously to this patch) function.
+
+The issue with this is that even though executing the soft reset
+operation should power off all cores unconditionally, on at least
+one platform we're seeing a crash that seems to be happening due
+to an interrupt firing which may be because we are calling power
+transition only on the first core group, leaving the second one
+unchanged, or because ISR execution was pending before entering
+the panfrost_gpu_power_off() function and executed after powering
+off the GPU cores, or all of the above.
+
+Finally, solve this by:
+ - Avoid to enable the power transition interrupt on reset; and
+ - Ignoring the core_mask and ask the GPU to poweroff both core groups
+
+Fixes: 22aa1a209018 ("drm/panfrost: Really power off GPU cores in panfrost_gpu_power_off()")
+Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com>
+Reviewed-by: Steven Price <steven.price@arm.com>
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20231204114215.54575-2-angelogioacchino.delregno@collabora.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panfrost/panfrost_gpu.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/panfrost/panfrost_gpu.c b/drivers/gpu/drm/panfrost/panfrost_gpu.c
+index c08715f033c5..55d243048516 100644
+--- a/drivers/gpu/drm/panfrost/panfrost_gpu.c
++++ b/drivers/gpu/drm/panfrost/panfrost_gpu.c
+@@ -71,7 +71,12 @@ int panfrost_gpu_soft_reset(struct panfrost_device *pfdev)
+ 	}
+ 
+ 	gpu_write(pfdev, GPU_INT_CLEAR, GPU_IRQ_MASK_ALL);
+-	gpu_write(pfdev, GPU_INT_MASK, GPU_IRQ_MASK_ALL);
++
++	/* Only enable the interrupts we care about */
++	gpu_write(pfdev, GPU_INT_MASK,
++		  GPU_IRQ_MASK_ERROR |
++		  GPU_IRQ_PERFCNT_SAMPLE_COMPLETED |
++		  GPU_IRQ_CLEAN_CACHES_COMPLETED);
+ 
+ 	return 0;
+ }
+@@ -369,11 +374,10 @@ void panfrost_gpu_power_on(struct panfrost_device *pfdev)
+ 
+ void panfrost_gpu_power_off(struct panfrost_device *pfdev)
+ {
+-	u64 core_mask = panfrost_get_core_mask(pfdev);
+ 	int ret;
+ 	u32 val;
+ 
+-	gpu_write(pfdev, SHADER_PWROFF_LO, pfdev->features.shader_present & core_mask);
++	gpu_write(pfdev, SHADER_PWROFF_LO, pfdev->features.shader_present);
+ 	ret = readl_relaxed_poll_timeout(pfdev->iomem + SHADER_PWRTRANS_LO,
+ 					 val, !val, 1, 1000);
+ 	if (ret)
+@@ -385,7 +389,7 @@ void panfrost_gpu_power_off(struct panfrost_device *pfdev)
+ 	if (ret)
+ 		dev_err(pfdev->dev, "tiler power transition timeout");
+ 
+-	gpu_write(pfdev, L2_PWROFF_LO, pfdev->features.l2_present & core_mask);
++	gpu_write(pfdev, L2_PWROFF_LO, pfdev->features.l2_present);
+ 	ret = readl_poll_timeout(pfdev->iomem + L2_PWRTRANS_LO,
+ 				 val, !val, 0, 1000);
+ 	if (ret)
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-panfrost-really-power-off-gpu-cores-in-panfrost_.patch b/queue-6.1/drm-panfrost-really-power-off-gpu-cores-in-panfrost_.patch
new file mode 100644
index 00000000000..59138dcc48d
--- /dev/null
+++ b/queue-6.1/drm-panfrost-really-power-off-gpu-cores-in-panfrost_.patch
@@ -0,0 +1,127 @@
+From e43d52760aa6b2926a18f38f9135819cad5fa2f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Nov 2023 15:15:07 +0100
+Subject: drm/panfrost: Really power off GPU cores in panfrost_gpu_power_off()
+
+From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+
+[ Upstream commit 22aa1a209018dc2eca78745f7666db63637cd5dc ]
+
+The layout of the registers {TILER,SHADER,L2}_PWROFF_LO, used to request
+powering off cores, is the same as the {TILER,SHADER,L2}_PWRON_LO ones:
+this means that in order to request poweroff of cores, we are supposed
+to write a bitmask of cores that should be powered off!
+This means that the panfrost_gpu_power_off() function has always been
+doing nothing.
+
+Fix powering off the GPU by writing a bitmask of the cores to poweroff
+to the relevant PWROFF_LO registers and then check that the transition
+(from ON to OFF) has finished by polling the relevant PWRTRANS_LO
+registers.
+
+While at it, in order to avoid code duplication, move the core mask
+logic from panfrost_gpu_power_on() to a new panfrost_get_core_mask()
+function, used in both poweron and poweroff.
+
+Fixes: f3ba91228e8e ("drm/panfrost: Add initial panfrost driver")
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Reviewed-by: Steven Price <steven.price@arm.com>
+Signed-off-by: Steven Price <steven.price@arm.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20231102141507.73481-1-angelogioacchino.delregno@collabora.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panfrost/panfrost_gpu.c | 64 ++++++++++++++++++-------
+ 1 file changed, 46 insertions(+), 18 deletions(-)
+
+diff --git a/drivers/gpu/drm/panfrost/panfrost_gpu.c b/drivers/gpu/drm/panfrost/panfrost_gpu.c
+index 6452e4e900dd..c08715f033c5 100644
+--- a/drivers/gpu/drm/panfrost/panfrost_gpu.c
++++ b/drivers/gpu/drm/panfrost/panfrost_gpu.c
+@@ -313,28 +313,38 @@ static void panfrost_gpu_init_features(struct panfrost_device *pfdev)
+ 		 pfdev->features.shader_present, pfdev->features.l2_present);
+ }
+ 
++static u64 panfrost_get_core_mask(struct panfrost_device *pfdev)
++{
++	u64 core_mask;
++
++	if (pfdev->features.l2_present == 1)
++		return U64_MAX;
++
++	/*
++	 * Only support one core group now.
++	 * ~(l2_present - 1) unsets all bits in l2_present except
++	 * the bottom bit. (l2_present - 2) has all the bits in
++	 * the first core group set. AND them together to generate
++	 * a mask of cores in the first core group.
++	 */
++	core_mask = ~(pfdev->features.l2_present - 1) &
++		     (pfdev->features.l2_present - 2);
++	dev_info_once(pfdev->dev, "using only 1st core group (%lu cores from %lu)\n",
++		      hweight64(core_mask),
++		      hweight64(pfdev->features.shader_present));
++
++	return core_mask;
++}
++
+ void panfrost_gpu_power_on(struct panfrost_device *pfdev)
+ {
+ 	int ret;
+ 	u32 val;
+-	u64 core_mask = U64_MAX;
++	u64 core_mask;
+ 
+ 	panfrost_gpu_init_quirks(pfdev);
++	core_mask = panfrost_get_core_mask(pfdev);
+ 
+-	if (pfdev->features.l2_present != 1) {
+-		/*
+-		 * Only support one core group now.
+-		 * ~(l2_present - 1) unsets all bits in l2_present except
+-		 * the bottom bit. (l2_present - 2) has all the bits in
+-		 * the first core group set. AND them together to generate
+-		 * a mask of cores in the first core group.
+-		 */
+-		core_mask = ~(pfdev->features.l2_present - 1) &
+-			     (pfdev->features.l2_present - 2);
+-		dev_info_once(pfdev->dev, "using only 1st core group (%lu cores from %lu)\n",
+-			      hweight64(core_mask),
+-			      hweight64(pfdev->features.shader_present));
+-	}
+ 	gpu_write(pfdev, L2_PWRON_LO, pfdev->features.l2_present & core_mask);
+ 	ret = readl_relaxed_poll_timeout(pfdev->iomem + L2_READY_LO,
+ 		val, val == (pfdev->features.l2_present & core_mask),
+@@ -359,9 +369,27 @@ void panfrost_gpu_power_on(struct panfrost_device *pfdev)
+ 
+ void panfrost_gpu_power_off(struct panfrost_device *pfdev)
+ {
+-	gpu_write(pfdev, TILER_PWROFF_LO, 0);
+-	gpu_write(pfdev, SHADER_PWROFF_LO, 0);
+-	gpu_write(pfdev, L2_PWROFF_LO, 0);
++	u64 core_mask = panfrost_get_core_mask(pfdev);
++	int ret;
++	u32 val;
++
++	gpu_write(pfdev, SHADER_PWROFF_LO, pfdev->features.shader_present & core_mask);
++	ret = readl_relaxed_poll_timeout(pfdev->iomem + SHADER_PWRTRANS_LO,
++					 val, !val, 1, 1000);
++	if (ret)
++		dev_err(pfdev->dev, "shader power transition timeout");
++
++	gpu_write(pfdev, TILER_PWROFF_LO, pfdev->features.tiler_present);
++	ret = readl_relaxed_poll_timeout(pfdev->iomem + TILER_PWRTRANS_LO,
++					 val, !val, 1, 1000);
++	if (ret)
++		dev_err(pfdev->dev, "tiler power transition timeout");
++
++	gpu_write(pfdev, L2_PWROFF_LO, pfdev->features.l2_present & core_mask);
++	ret = readl_poll_timeout(pfdev->iomem + L2_PWRTRANS_LO,
++				 val, !val, 0, 1000);
++	if (ret)
++		dev_err(pfdev->dev, "l2 power transition timeout");
+ }
+ 
+ int panfrost_gpu_init(struct panfrost_device *pfdev)
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-radeon-check-return-value-of-radeon_ring_lock.patch b/queue-6.1/drm-radeon-check-return-value-of-radeon_ring_lock.patch
new file mode 100644
index 00000000000..db116989376
--- /dev/null
+++ b/queue-6.1/drm-radeon-check-return-value-of-radeon_ring_lock.patch
@@ -0,0 +1,42 @@
+From 8151a5cd114a20ab83387df476fcd98bbd212978 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Aug 2023 11:04:16 -0700
+Subject: drm/radeon: check return value of radeon_ring_lock()
+
+From: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
+
+[ Upstream commit 71225e1c930942cb1e042fc08c5cc0c4ef30e95e ]
+
+In the unlikely event of radeon_ring_lock() failing, its errno return
+value should be processed. This patch checks said return value and
+prints a debug message in case of an error.
+
+Found by Linux Verification Center (linuxtesting.org) with static
+analysis tool SVACE.
+
+Fixes: 48c0c902e2e6 ("drm/radeon/kms: add support for CP setup on SI")
+Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/radeon/si.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
+index a91012447b56..85e9cba49cec 100644
+--- a/drivers/gpu/drm/radeon/si.c
++++ b/drivers/gpu/drm/radeon/si.c
+@@ -3611,6 +3611,10 @@ static int si_cp_start(struct radeon_device *rdev)
+ 	for (i = RADEON_RING_TYPE_GFX_INDEX; i <= CAYMAN_RING_TYPE_CP2_INDEX; ++i) {
+ 		ring = &rdev->ring[i];
+ 		r = radeon_ring_lock(rdev, ring, 2);
++		if (r) {
++			DRM_ERROR("radeon: cp failed to lock ring (%d).\n", r);
++			return r;
++		}
+ 
+ 		/* clear the compute context state */
+ 		radeon_ring_write(ring, PACKET3_COMPUTE(PACKET3_CLEAR_STATE, 0));
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-radeon-check-the-alloc_workqueue-return-value-in.patch b/queue-6.1/drm-radeon-check-the-alloc_workqueue-return-value-in.patch
new file mode 100644
index 00000000000..ebcb2271993
--- /dev/null
+++ b/queue-6.1/drm-radeon-check-the-alloc_workqueue-return-value-in.patch
@@ -0,0 +1,46 @@
+From d5cbb1e84a7f08b36f2c9bf632684d260ec0da8b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Nov 2023 15:50:16 +0800
+Subject: drm/radeon: check the alloc_workqueue return value in
+ radeon_crtc_init()
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit 7a2464fac80d42f6f8819fed97a553e9c2f43310 ]
+
+check the alloc_workqueue return value in radeon_crtc_init()
+to avoid null-ptr-deref.
+
+Fixes: fa7f517cb26e ("drm/radeon: rework page flip handling v4")
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/radeon/radeon_display.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
+index ca5598ae8bfc..1814bb8e14f1 100644
+--- a/drivers/gpu/drm/radeon/radeon_display.c
++++ b/drivers/gpu/drm/radeon/radeon_display.c
+@@ -687,11 +687,16 @@ static void radeon_crtc_init(struct drm_device *dev, int index)
+ 	if (radeon_crtc == NULL)
+ 		return;
+ 
++	radeon_crtc->flip_queue = alloc_workqueue("radeon-crtc", WQ_HIGHPRI, 0);
++	if (!radeon_crtc->flip_queue) {
++		kfree(radeon_crtc);
++		return;
++	}
++
+ 	drm_crtc_init(dev, &radeon_crtc->base, &radeon_crtc_funcs);
+ 
+ 	drm_mode_crtc_set_gamma_size(&radeon_crtc->base, 256);
+ 	radeon_crtc->crtc_id = index;
+-	radeon_crtc->flip_queue = alloc_workqueue("radeon-crtc", WQ_HIGHPRI, 0);
+ 	rdev->mode_info.crtcs[index] = radeon_crtc;
+ 
+ 	if (rdev->family >= CHIP_BONAIRE) {
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-radeon-dpm-fix-a-memleak-in-sumo_parse_power_tab.patch b/queue-6.1/drm-radeon-dpm-fix-a-memleak-in-sumo_parse_power_tab.patch
new file mode 100644
index 00000000000..99bef02cd80
--- /dev/null
+++ b/queue-6.1/drm-radeon-dpm-fix-a-memleak-in-sumo_parse_power_tab.patch
@@ -0,0 +1,41 @@
+From 1cce30d04f7e1f7b000afc59def7cd3ed307894d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Dec 2023 16:57:56 +0800
+Subject: drm/radeon/dpm: fix a memleak in sumo_parse_power_table
+
+From: Zhipeng Lu <alexious@zju.edu.cn>
+
+[ Upstream commit 0737df9ed0997f5b8addd6e2b9699a8c6edba2e4 ]
+
+The rdev->pm.dpm.ps allocated by kcalloc should be freed in every
+following error-handling path. However, in the error-handling of
+rdev->pm.power_state[i].clock_info the rdev->pm.dpm.ps is not freed,
+resulting in a memleak in this function.
+
+Fixes: 80ea2c129c76 ("drm/radeon/kms: add dpm support for sumo asics (v2)")
+Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/radeon/sumo_dpm.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/radeon/sumo_dpm.c b/drivers/gpu/drm/radeon/sumo_dpm.c
+index f74f381af05f..d49c145db437 100644
+--- a/drivers/gpu/drm/radeon/sumo_dpm.c
++++ b/drivers/gpu/drm/radeon/sumo_dpm.c
+@@ -1493,8 +1493,10 @@ static int sumo_parse_power_table(struct radeon_device *rdev)
+ 		non_clock_array_index = power_state->v2.nonClockInfoIndex;
+ 		non_clock_info = (struct _ATOM_PPLIB_NONCLOCK_INFO *)
+ 			&non_clock_info_array->nonClockInfo[non_clock_array_index];
+-		if (!rdev->pm.power_state[i].clock_info)
++		if (!rdev->pm.power_state[i].clock_info) {
++			kfree(rdev->pm.dpm.ps);
+ 			return -EINVAL;
++		}
+ 		ps = kzalloc(sizeof(struct sumo_ps), GFP_KERNEL);
+ 		if (ps == NULL) {
+ 			kfree(rdev->pm.dpm.ps);
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-radeon-r100-fix-integer-overflow-issues-in-r100_.patch b/queue-6.1/drm-radeon-r100-fix-integer-overflow-issues-in-r100_.patch
new file mode 100644
index 00000000000..787ffcdb75b
--- /dev/null
+++ b/queue-6.1/drm-radeon-r100-fix-integer-overflow-issues-in-r100_.patch
@@ -0,0 +1,52 @@
+From 4187ca50829c07b24f826284d67a379e354ad88c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Nov 2023 07:22:12 -0800
+Subject: drm/radeon/r100: Fix integer overflow issues in r100_cs_track_check()
+
+From: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
+
+[ Upstream commit b5c5baa458faa5430c445acd9a17481274d77ccf ]
+
+It may be possible, albeit unlikely, to encounter integer overflow
+during the multiplication of several unsigned int variables, the
+result being assigned to a variable 'size' of wider type.
+
+Prevent this potential behaviour by converting one of the multiples
+to unsigned long.
+
+Found by Linux Verification Center (linuxtesting.org) with static
+analysis tool SVACE.
+
+Fixes: 0242f74d29df ("drm/radeon: clean up CS functions in r100.c")
+Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/radeon/r100.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
+index d4f09ecc3d22..f336b5b3b11f 100644
+--- a/drivers/gpu/drm/radeon/r100.c
++++ b/drivers/gpu/drm/radeon/r100.c
+@@ -2321,7 +2321,7 @@ int r100_cs_track_check(struct radeon_device *rdev, struct r100_cs_track *track)
+ 	switch (prim_walk) {
+ 	case 1:
+ 		for (i = 0; i < track->num_arrays; i++) {
+-			size = track->arrays[i].esize * track->max_indx * 4;
++			size = track->arrays[i].esize * track->max_indx * 4UL;
+ 			if (track->arrays[i].robj == NULL) {
+ 				DRM_ERROR("(PW %u) Vertex array %u no buffer "
+ 					  "bound\n", prim_walk, i);
+@@ -2340,7 +2340,7 @@ int r100_cs_track_check(struct radeon_device *rdev, struct r100_cs_track *track)
+ 		break;
+ 	case 2:
+ 		for (i = 0; i < track->num_arrays; i++) {
+-			size = track->arrays[i].esize * (nverts - 1) * 4;
++			size = track->arrays[i].esize * (nverts - 1) * 4UL;
+ 			if (track->arrays[i].robj == NULL) {
+ 				DRM_ERROR("(PW %u) Vertex array %u no buffer "
+ 					  "bound\n", prim_walk, i);
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-radeon-r600_cs-fix-possible-int-overflows-in-r60.patch b/queue-6.1/drm-radeon-r600_cs-fix-possible-int-overflows-in-r60.patch
new file mode 100644
index 00000000000..de1aada97c0
--- /dev/null
+++ b/queue-6.1/drm-radeon-r600_cs-fix-possible-int-overflows-in-r60.patch
@@ -0,0 +1,51 @@
+From c732ebedba9181eed30013b1091831f28a53fe8f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Nov 2023 07:22:30 -0800
+Subject: drm/radeon/r600_cs: Fix possible int overflows in r600_cs_check_reg()
+
+From: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
+
+[ Upstream commit 39c960bbf9d9ea862398759e75736cfb68c3446f ]
+
+While improbable, there may be a chance of hitting integer
+overflow when the result of radeon_get_ib_value() gets shifted
+left.
+
+Avoid it by casting one of the operands to larger data type (u64).
+
+Found by Linux Verification Center (linuxtesting.org) with static
+analysis tool SVACE.
+
+Fixes: 1729dd33d20b ("drm/radeon/kms: r600 CS parser fixes")
+Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/radeon/r600_cs.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/radeon/r600_cs.c b/drivers/gpu/drm/radeon/r600_cs.c
+index 638f861af80f..6cf54a747749 100644
+--- a/drivers/gpu/drm/radeon/r600_cs.c
++++ b/drivers/gpu/drm/radeon/r600_cs.c
+@@ -1275,7 +1275,7 @@ static int r600_cs_check_reg(struct radeon_cs_parser *p, u32 reg, u32 idx)
+ 			return -EINVAL;
+ 		}
+ 		tmp = (reg - CB_COLOR0_BASE) / 4;
+-		track->cb_color_bo_offset[tmp] = radeon_get_ib_value(p, idx) << 8;
++		track->cb_color_bo_offset[tmp] = (u64)radeon_get_ib_value(p, idx) << 8;
+ 		ib[idx] += (u32)((reloc->gpu_offset >> 8) & 0xffffffff);
+ 		track->cb_color_base_last[tmp] = ib[idx];
+ 		track->cb_color_bo[tmp] = reloc->robj;
+@@ -1302,7 +1302,7 @@ static int r600_cs_check_reg(struct radeon_cs_parser *p, u32 reg, u32 idx)
+ 					"0x%04X\n", reg);
+ 			return -EINVAL;
+ 		}
+-		track->htile_offset = radeon_get_ib_value(p, idx) << 8;
++		track->htile_offset = (u64)radeon_get_ib_value(p, idx) << 8;
+ 		ib[idx] += (u32)((reloc->gpu_offset >> 8) & 0xffffffff);
+ 		track->htile_bo = reloc->robj;
+ 		track->db_dirty = true;
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-radeon-trinity_dpm-fix-a-memleak-in-trinity_pars.patch b/queue-6.1/drm-radeon-trinity_dpm-fix-a-memleak-in-trinity_pars.patch
new file mode 100644
index 00000000000..d36cd4a2e80
--- /dev/null
+++ b/queue-6.1/drm-radeon-trinity_dpm-fix-a-memleak-in-trinity_pars.patch
@@ -0,0 +1,41 @@
+From b9ce290126ef51c8722a0e7a807d0df5d385e0ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Dec 2023 18:21:54 +0800
+Subject: drm/radeon/trinity_dpm: fix a memleak in trinity_parse_power_table
+
+From: Zhipeng Lu <alexious@zju.edu.cn>
+
+[ Upstream commit 28c28d7f77c06ac2c0b8f9c82bc04eba22912b3b ]
+
+The rdev->pm.dpm.ps allocated by kcalloc should be freed in every
+following error-handling path. However, in the error-handling of
+rdev->pm.power_state[i].clock_info the rdev->pm.dpm.ps is not freed,
+resulting in a memleak in this function.
+
+Fixes: d70229f70447 ("drm/radeon/kms: add dpm support for trinity asics")
+Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/radeon/trinity_dpm.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/radeon/trinity_dpm.c b/drivers/gpu/drm/radeon/trinity_dpm.c
+index 08ea1c864cb2..ef1cc7bad20a 100644
+--- a/drivers/gpu/drm/radeon/trinity_dpm.c
++++ b/drivers/gpu/drm/radeon/trinity_dpm.c
+@@ -1726,8 +1726,10 @@ static int trinity_parse_power_table(struct radeon_device *rdev)
+ 		non_clock_array_index = power_state->v2.nonClockInfoIndex;
+ 		non_clock_info = (struct _ATOM_PPLIB_NONCLOCK_INFO *)
+ 			&non_clock_info_array->nonClockInfo[non_clock_array_index];
+-		if (!rdev->pm.power_state[i].clock_info)
++		if (!rdev->pm.power_state[i].clock_info) {
++			kfree(rdev->pm.dpm.ps);
+ 			return -EINVAL;
++		}
+ 		ps = kzalloc(sizeof(struct sumo_ps), GFP_KERNEL);
+ 		if (ps == NULL) {
+ 			kfree(rdev->pm.dpm.ps);
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-tidss-check-for-k2g-in-in-dispc_softreset.patch b/queue-6.1/drm-tidss-check-for-k2g-in-in-dispc_softreset.patch
new file mode 100644
index 00000000000..2ca85c650b2
--- /dev/null
+++ b/queue-6.1/drm-tidss-check-for-k2g-in-in-dispc_softreset.patch
@@ -0,0 +1,57 @@
+From 97b187483c18e07b971e5f27de52e3a8073d7758 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Nov 2023 09:37:59 +0200
+Subject: drm/tidss: Check for K2G in in dispc_softreset()
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+[ Upstream commit 151825150cf9c2e9fb90763d35b9dff3783628ac ]
+
+K2G doesn't have softreset feature. Instead of having every caller of
+dispc_softreset() check for K2G, move the check into dispc_softreset(),
+and make dispc_softreset() return 0 in case of K2G.
+
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Reviewed-by: Aradhya Bhatia <a-bhatia1@ti.com>
+Link: https://lore.kernel.org/r/20231109-tidss-probe-v2-6-ac91b5ea35c0@ideasonboard.com
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Stable-dep-of: bc288a927815 ("drm/tidss: Fix dss reset")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/tidss/tidss_dispc.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/tidss/tidss_dispc.c b/drivers/gpu/drm/tidss/tidss_dispc.c
+index 591f0606f7f8..4bdd4c7b4991 100644
+--- a/drivers/gpu/drm/tidss/tidss_dispc.c
++++ b/drivers/gpu/drm/tidss/tidss_dispc.c
+@@ -2658,6 +2658,10 @@ static int dispc_softreset(struct dispc_device *dispc)
+ 	u32 val;
+ 	int ret = 0;
+ 
++	/* K2G display controller does not support soft reset */
++	if (dispc->feat->subrev == DISPC_K2G)
++		return 0;
++
+ 	/* Soft reset */
+ 	REG_FLD_MOD(dispc, DSS_SYSCONFIG, 1, 1, 1);
+ 	/* Wait for reset to complete */
+@@ -2778,12 +2782,9 @@ int dispc_init(struct tidss_device *tidss)
+ 	of_property_read_u32(dispc->dev->of_node, "max-memory-bandwidth",
+ 			     &dispc->memory_bandwidth_limit);
+ 
+-	/* K2G display controller does not support soft reset */
+-	if (feat->subrev != DISPC_K2G) {
+-		r = dispc_softreset(dispc);
+-		if (r)
+-			return r;
+-	}
++	r = dispc_softreset(dispc);
++	if (r)
++		return r;
+ 
+ 	tidss->dispc = dispc;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-tidss-fix-dss-reset.patch b/queue-6.1/drm-tidss-fix-dss-reset.patch
new file mode 100644
index 00000000000..a618c54c660
--- /dev/null
+++ b/queue-6.1/drm-tidss-fix-dss-reset.patch
@@ -0,0 +1,106 @@
+From 5a0495490066e05b9caa7dbd9c3d44c6df27ae3e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Nov 2023 09:38:01 +0200
+Subject: drm/tidss: Fix dss reset
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+[ Upstream commit bc288a927815efcf9d7f4a54d4d89c5df478c635 ]
+
+The probe function calls dispc_softreset() before runtime PM is enabled
+and without enabling any of the DSS clocks. This happens to work by
+luck, and we need to make sure the DSS HW is active and the fclk is
+enabled.
+
+To fix the above, add a new function, dispc_init_hw(), which does:
+
+- pm_runtime_set_active()
+- clk_prepare_enable(fclk)
+- dispc_softreset().
+
+This ensures that the reset can be successfully accomplished.
+
+Note that we use pm_runtime_set_active(), not the normal
+pm_runtime_get(). The reason for this is that at this point we haven't
+enabled the runtime PM yet and also we don't want the normal resume
+callback to be called: the dispc resume callback does some initial HW
+setup, and it expects that the HW was off (no video ports are
+streaming). If the bootloader has enabled the DSS and has set up a
+boot time splash-screen, the DSS would be enabled and streaming which
+might lead to issues with the normal resume callback.
+
+Fixes: c9b2d923befd ("drm/tidss: Soft Reset DISPC on startup")
+Reviewed-by: Aradhya Bhatia <a-bhatia1@ti.com>
+Link: https://lore.kernel.org/r/20231109-tidss-probe-v2-8-ac91b5ea35c0@ideasonboard.com
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/tidss/tidss_dispc.c | 45 ++++++++++++++++++++++++++++-
+ 1 file changed, 44 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/tidss/tidss_dispc.c b/drivers/gpu/drm/tidss/tidss_dispc.c
+index 4bdd4c7b4991..95b75236fe5e 100644
+--- a/drivers/gpu/drm/tidss/tidss_dispc.c
++++ b/drivers/gpu/drm/tidss/tidss_dispc.c
+@@ -2675,6 +2675,49 @@ static int dispc_softreset(struct dispc_device *dispc)
+ 	return 0;
+ }
+ 
++static int dispc_init_hw(struct dispc_device *dispc)
++{
++	struct device *dev = dispc->dev;
++	int ret;
++
++	ret = pm_runtime_set_active(dev);
++	if (ret) {
++		dev_err(dev, "Failed to set DSS PM to active\n");
++		return ret;
++	}
++
++	ret = clk_prepare_enable(dispc->fclk);
++	if (ret) {
++		dev_err(dev, "Failed to enable DSS fclk\n");
++		goto err_runtime_suspend;
++	}
++
++	ret = dispc_softreset(dispc);
++	if (ret)
++		goto err_clk_disable;
++
++	clk_disable_unprepare(dispc->fclk);
++	ret = pm_runtime_set_suspended(dev);
++	if (ret) {
++		dev_err(dev, "Failed to set DSS PM to suspended\n");
++		return ret;
++	}
++
++	return 0;
++
++err_clk_disable:
++	clk_disable_unprepare(dispc->fclk);
++
++err_runtime_suspend:
++	ret = pm_runtime_set_suspended(dev);
++	if (ret) {
++		dev_err(dev, "Failed to set DSS PM to suspended\n");
++		return ret;
++	}
++
++	return ret;
++}
++
+ int dispc_init(struct tidss_device *tidss)
+ {
+ 	struct device *dev = tidss->dev;
+@@ -2782,7 +2825,7 @@ int dispc_init(struct tidss_device *tidss)
+ 	of_property_read_u32(dispc->dev->of_node, "max-memory-bandwidth",
+ 			     &dispc->memory_bandwidth_limit);
+ 
+-	r = dispc_softreset(dispc);
++	r = dispc_init_hw(dispc);
+ 	if (r)
+ 		return r;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-tidss-move-reset-to-the-end-of-dispc_init.patch b/queue-6.1/drm-tidss-move-reset-to-the-end-of-dispc_init.patch
new file mode 100644
index 00000000000..47a56b94211
--- /dev/null
+++ b/queue-6.1/drm-tidss-move-reset-to-the-end-of-dispc_init.patch
@@ -0,0 +1,55 @@
+From b973165b2b3a8da5f3ee9c5569f37d27f44da06d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Nov 2023 09:37:57 +0200
+Subject: drm/tidss: Move reset to the end of dispc_init()
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+[ Upstream commit 36d1e0852680aa038e2428d450673390111b165c ]
+
+We do a DSS reset in the middle of the dispc_init(). While that happens
+to work now, we should really make sure that e..g the fclk, which is
+acquired only later in the function, is enabled when doing a reset. This
+will be handled in a later patch, but for now, let's move the
+dispc_softreset() call to the end of dispc_init(), which is a sensible
+place for it anyway.
+
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Reviewed-by: Aradhya Bhatia <a-bhatia1@ti.com>
+Link: https://lore.kernel.org/r/20231109-tidss-probe-v2-4-ac91b5ea35c0@ideasonboard.com
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Stable-dep-of: bc288a927815 ("drm/tidss: Fix dss reset")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/tidss/tidss_dispc.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/tidss/tidss_dispc.c b/drivers/gpu/drm/tidss/tidss_dispc.c
+index 16301bdfead1..9ce452288c9e 100644
+--- a/drivers/gpu/drm/tidss/tidss_dispc.c
++++ b/drivers/gpu/drm/tidss/tidss_dispc.c
+@@ -2726,10 +2726,6 @@ int dispc_init(struct tidss_device *tidss)
+ 			return r;
+ 	}
+ 
+-	/* K2G display controller does not support soft reset */
+-	if (feat->subrev != DISPC_K2G)
+-		dispc_softreset(dispc);
+-
+ 	for (i = 0; i < dispc->feat->num_vps; i++) {
+ 		u32 gamma_size = dispc->feat->vp_feat.color.gamma_size;
+ 		u32 *gamma_table;
+@@ -2778,6 +2774,10 @@ int dispc_init(struct tidss_device *tidss)
+ 	of_property_read_u32(dispc->dev->of_node, "max-memory-bandwidth",
+ 			     &dispc->memory_bandwidth_limit);
+ 
++	/* K2G display controller does not support soft reset */
++	if (feat->subrev != DISPC_K2G)
++		dispc_softreset(dispc);
++
+ 	tidss->dispc = dispc;
+ 
+ 	return 0;
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-tidss-return-error-value-from-from-softreset.patch b/queue-6.1/drm-tidss-return-error-value-from-from-softreset.patch
new file mode 100644
index 00000000000..a2320b77817
--- /dev/null
+++ b/queue-6.1/drm-tidss-return-error-value-from-from-softreset.patch
@@ -0,0 +1,66 @@
+From f21a62e7fddb649c7de9c3a8aa0c572408c0233a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Nov 2023 09:37:58 +0200
+Subject: drm/tidss: Return error value from from softreset
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+[ Upstream commit aceafbb5035c4bfc75a321863ed1e393d644d2d2 ]
+
+Return an error value from dispc_softreset() so that the caller can
+handle the errors.
+
+Reviewed-by: Aradhya Bhatia <a-bhatia1@ti.com>
+Link: https://lore.kernel.org/r/20231109-tidss-probe-v2-5-ac91b5ea35c0@ideasonboard.com
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Stable-dep-of: bc288a927815 ("drm/tidss: Fix dss reset")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/tidss/tidss_dispc.c | 17 ++++++++++++-----
+ 1 file changed, 12 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/tidss/tidss_dispc.c b/drivers/gpu/drm/tidss/tidss_dispc.c
+index 9ce452288c9e..591f0606f7f8 100644
+--- a/drivers/gpu/drm/tidss/tidss_dispc.c
++++ b/drivers/gpu/drm/tidss/tidss_dispc.c
+@@ -2653,7 +2653,7 @@ static void dispc_init_errata(struct dispc_device *dispc)
+ 	}
+ }
+ 
+-static void dispc_softreset(struct dispc_device *dispc)
++static int dispc_softreset(struct dispc_device *dispc)
+ {
+ 	u32 val;
+ 	int ret = 0;
+@@ -2663,8 +2663,12 @@ static void dispc_softreset(struct dispc_device *dispc)
+ 	/* Wait for reset to complete */
+ 	ret = readl_poll_timeout(dispc->base_common + DSS_SYSSTATUS,
+ 				 val, val & 1, 100, 5000);
+-	if (ret)
+-		dev_warn(dispc->dev, "failed to reset dispc\n");
++	if (ret) {
++		dev_err(dispc->dev, "failed to reset dispc\n");
++		return ret;
++	}
++
++	return 0;
+ }
+ 
+ int dispc_init(struct tidss_device *tidss)
+@@ -2775,8 +2779,11 @@ int dispc_init(struct tidss_device *tidss)
+ 			     &dispc->memory_bandwidth_limit);
+ 
+ 	/* K2G display controller does not support soft reset */
+-	if (feat->subrev != DISPC_K2G)
+-		dispc_softreset(dispc);
++	if (feat->subrev != DISPC_K2G) {
++		r = dispc_softreset(dispc);
++		if (r)
++			return r;
++	}
+ 
+ 	tidss->dispc = dispc;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-tilcdc-fix-irq-free-on-unload.patch b/queue-6.1/drm-tilcdc-fix-irq-free-on-unload.patch
new file mode 100644
index 00000000000..b6aea8550db
--- /dev/null
+++ b/queue-6.1/drm-tilcdc-fix-irq-free-on-unload.patch
@@ -0,0 +1,40 @@
+From 2c76bdb56cd6902796fd3b44f5db5f71868a2f27 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Sep 2023 10:12:50 +0300
+Subject: drm/tilcdc: Fix irq free on unload
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+[ Upstream commit 38360bf96d816e175bc602c4ee76953cd303b71d ]
+
+The driver only frees the reserved irq if priv->irq_enabled is set to
+true. However, the driver mistakenly sets priv->irq_enabled to false,
+instead of true, in tilcdc_irq_install(), and thus the driver never
+frees the irq, causing issues on loading the driver a second time.
+
+Fixes: b6366814fa77 ("drm/tilcdc: Convert to Linux IRQ interfaces")
+Cc: Thomas Zimmermann <tzimmermann@suse.de>
+Reviewed-by: Aradhya Bhatia <a-bhatia1@ti.com>
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230919-lcdc-v1-1-ba60da7421e1@ideasonboard.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/tilcdc/tilcdc_drv.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/tilcdc/tilcdc_drv.c b/drivers/gpu/drm/tilcdc/tilcdc_drv.c
+index f72755b8ea14..86d34b77b37d 100644
+--- a/drivers/gpu/drm/tilcdc/tilcdc_drv.c
++++ b/drivers/gpu/drm/tilcdc/tilcdc_drv.c
+@@ -138,7 +138,7 @@ static int tilcdc_irq_install(struct drm_device *dev, unsigned int irq)
+ 	if (ret)
+ 		return ret;
+ 
+-	priv->irq_enabled = false;
++	priv->irq_enabled = true;
+ 
+ 	return 0;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.1/dt-bindings-clock-update-the-videocc-resets-for-sm81.patch b/queue-6.1/dt-bindings-clock-update-the-videocc-resets-for-sm81.patch
new file mode 100644
index 00000000000..07a09868c73
--- /dev/null
+++ b/queue-6.1/dt-bindings-clock-update-the-videocc-resets-for-sm81.patch
@@ -0,0 +1,40 @@
+From 3ceb5711636fd8a9d902f6836bcd55570f019ac9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Dec 2023 15:20:24 +0530
+Subject: dt-bindings: clock: Update the videocc resets for sm8150
+
+From: Satya Priya Kakitapalli <quic_skakitap@quicinc.com>
+
+[ Upstream commit 3185f96968eedd117ec72ee7b87ead44b6d1bbbd ]
+
+Add all the available resets for the video clock controller
+on sm8150.
+
+Signed-off-by: Satya Priya Kakitapalli <quic_skakitap@quicinc.com>
+Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Link: https://lore.kernel.org/r/20231201-videocc-8150-v3-1-56bec3a5e443@quicinc.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Stable-dep-of: 1fd9a939db24 ("clk: qcom: videocc-sm8150: Update the videocc resets")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/dt-bindings/clock/qcom,videocc-sm8150.h | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/include/dt-bindings/clock/qcom,videocc-sm8150.h b/include/dt-bindings/clock/qcom,videocc-sm8150.h
+index e24ee840cfdb..c557b78dc572 100644
+--- a/include/dt-bindings/clock/qcom,videocc-sm8150.h
++++ b/include/dt-bindings/clock/qcom,videocc-sm8150.h
+@@ -16,6 +16,10 @@
+ 
+ /* VIDEO_CC Resets */
+ #define VIDEO_CC_MVSC_CORE_CLK_BCR	0
++#define VIDEO_CC_INTERFACE_BCR		1
++#define VIDEO_CC_MVS0_BCR		2
++#define VIDEO_CC_MVS1_BCR		3
++#define VIDEO_CC_MVSC_BCR		4
+ 
+ /* VIDEO_CC GDSCRs */
+ #define VENUS_GDSC			0
+-- 
+2.43.0
+
diff --git a/queue-6.1/dt-bindings-media-mediatek-mdp3-correct-rdma-and-wro.patch b/queue-6.1/dt-bindings-media-mediatek-mdp3-correct-rdma-and-wro.patch
new file mode 100644
index 00000000000..7a534b92fe4
--- /dev/null
+++ b/queue-6.1/dt-bindings-media-mediatek-mdp3-correct-rdma-and-wro.patch
@@ -0,0 +1,125 @@
+From c562b166a229bc3acebb7c21da10be8b58876e3b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Oct 2023 16:33:42 +0800
+Subject: dt-bindings: media: mediatek: mdp3: correct RDMA and WROT node with
+ generic names
+
+From: Moudy Ho <moudy.ho@mediatek.com>
+
+[ Upstream commit f5f185bf7c42f6ca885202fefc40fc871d08a722 ]
+
+The DMA-related nodes RDMA/WROT in MDP3 should be changed to generic names.
+In addition, fix improper space indent in example.
+
+Fixes: 4ad7b39623ab ("media: dt-binding: mediatek: add bindings for MediaTek MDP3 components")
+Signed-off-by: Moudy Ho <moudy.ho@mediatek.com>
+Acked-by: Rob Herring <robh@kernel.org>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../bindings/media/mediatek,mdp3-rdma.yaml    | 29 +++++++++++--------
+ .../bindings/media/mediatek,mdp3-wrot.yaml    | 23 +++++++++------
+ 2 files changed, 31 insertions(+), 21 deletions(-)
+
+diff --git a/Documentation/devicetree/bindings/media/mediatek,mdp3-rdma.yaml b/Documentation/devicetree/bindings/media/mediatek,mdp3-rdma.yaml
+index 9cfc0c7d23e0..46730687c662 100644
+--- a/Documentation/devicetree/bindings/media/mediatek,mdp3-rdma.yaml
++++ b/Documentation/devicetree/bindings/media/mediatek,mdp3-rdma.yaml
+@@ -61,6 +61,9 @@ properties:
+       - description: used for 1st data pipe from RDMA
+       - description: used for 2nd data pipe from RDMA
+ 
++  '#dma-cells':
++    const: 1
++
+ required:
+   - compatible
+   - reg
+@@ -70,6 +73,7 @@ required:
+   - clocks
+   - iommus
+   - mboxes
++  - '#dma-cells'
+ 
+ additionalProperties: false
+ 
+@@ -80,16 +84,17 @@ examples:
+     #include <dt-bindings/power/mt8183-power.h>
+     #include <dt-bindings/memory/mt8183-larb-port.h>
+ 
+-    mdp3_rdma0: mdp3-rdma0@14001000 {
+-      compatible = "mediatek,mt8183-mdp3-rdma";
+-      reg = <0x14001000 0x1000>;
+-      mediatek,gce-client-reg = <&gce SUBSYS_1400XXXX 0x1000 0x1000>;
+-      mediatek,gce-events = <CMDQ_EVENT_MDP_RDMA0_SOF>,
+-                            <CMDQ_EVENT_MDP_RDMA0_EOF>;
+-      power-domains = <&spm MT8183_POWER_DOMAIN_DISP>;
+-      clocks = <&mmsys CLK_MM_MDP_RDMA0>,
+-               <&mmsys CLK_MM_MDP_RSZ1>;
+-      iommus = <&iommu>;
+-      mboxes = <&gce 20 CMDQ_THR_PRIO_LOWEST>,
+-               <&gce 21 CMDQ_THR_PRIO_LOWEST>;
++    dma-controller@14001000 {
++        compatible = "mediatek,mt8183-mdp3-rdma";
++        reg = <0x14001000 0x1000>;
++        mediatek,gce-client-reg = <&gce SUBSYS_1400XXXX 0x1000 0x1000>;
++        mediatek,gce-events = <CMDQ_EVENT_MDP_RDMA0_SOF>,
++                              <CMDQ_EVENT_MDP_RDMA0_EOF>;
++        power-domains = <&spm MT8183_POWER_DOMAIN_DISP>;
++        clocks = <&mmsys CLK_MM_MDP_RDMA0>,
++                 <&mmsys CLK_MM_MDP_RSZ1>;
++        iommus = <&iommu>;
++        mboxes = <&gce 20 CMDQ_THR_PRIO_LOWEST>,
++                 <&gce 21 CMDQ_THR_PRIO_LOWEST>;
++        #dma-cells = <1>;
+     };
+diff --git a/Documentation/devicetree/bindings/media/mediatek,mdp3-wrot.yaml b/Documentation/devicetree/bindings/media/mediatek,mdp3-wrot.yaml
+index 0baa77198fa2..64ea98aa0592 100644
+--- a/Documentation/devicetree/bindings/media/mediatek,mdp3-wrot.yaml
++++ b/Documentation/devicetree/bindings/media/mediatek,mdp3-wrot.yaml
+@@ -50,6 +50,9 @@ properties:
+   iommus:
+     maxItems: 1
+ 
++  '#dma-cells':
++    const: 1
++
+ required:
+   - compatible
+   - reg
+@@ -58,6 +61,7 @@ required:
+   - power-domains
+   - clocks
+   - iommus
++  - '#dma-cells'
+ 
+ additionalProperties: false
+ 
+@@ -68,13 +72,14 @@ examples:
+     #include <dt-bindings/power/mt8183-power.h>
+     #include <dt-bindings/memory/mt8183-larb-port.h>
+ 
+-    mdp3_wrot0: mdp3-wrot0@14005000 {
+-      compatible = "mediatek,mt8183-mdp3-wrot";
+-      reg = <0x14005000 0x1000>;
+-      mediatek,gce-client-reg = <&gce SUBSYS_1400XXXX 0x5000 0x1000>;
+-      mediatek,gce-events = <CMDQ_EVENT_MDP_WROT0_SOF>,
+-                            <CMDQ_EVENT_MDP_WROT0_EOF>;
+-      power-domains = <&spm MT8183_POWER_DOMAIN_DISP>;
+-      clocks = <&mmsys CLK_MM_MDP_WROT0>;
+-      iommus = <&iommu>;
++    dma-controller@14005000 {
++        compatible = "mediatek,mt8183-mdp3-wrot";
++        reg = <0x14005000 0x1000>;
++        mediatek,gce-client-reg = <&gce SUBSYS_1400XXXX 0x5000 0x1000>;
++        mediatek,gce-events = <CMDQ_EVENT_MDP_WROT0_SOF>,
++                              <CMDQ_EVENT_MDP_WROT0_EOF>;
++        power-domains = <&spm MT8183_POWER_DOMAIN_DISP>;
++        clocks = <&mmsys CLK_MM_MDP_WROT0>;
++        iommus = <&iommu>;
++        #dma-cells = <1>;
+     };
+-- 
+2.43.0
+
diff --git a/queue-6.1/edac-thunderx-fix-possible-out-of-bounds-string-acce.patch b/queue-6.1/edac-thunderx-fix-possible-out-of-bounds-string-acce.patch
new file mode 100644
index 00000000000..47b3504d56c
--- /dev/null
+++ b/queue-6.1/edac-thunderx-fix-possible-out-of-bounds-string-acce.patch
@@ -0,0 +1,91 @@
+From ab32c506485eedf3bd21621a404303fb0c812d08 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Nov 2023 23:19:53 +0100
+Subject: EDAC/thunderx: Fix possible out-of-bounds string access
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 475c58e1a471e9b873e3e39958c64a2d278275c8 ]
+
+Enabling -Wstringop-overflow globally exposes a warning for a common bug
+in the usage of strncat():
+
+  drivers/edac/thunderx_edac.c: In function 'thunderx_ocx_com_threaded_isr':
+  drivers/edac/thunderx_edac.c:1136:17: error: 'strncat' specified bound 1024 equals destination size [-Werror=stringop-overflow=]
+   1136 |                 strncat(msg, other, OCX_MESSAGE_SIZE);
+        |                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+   ...
+   1145 |                                 strncat(msg, other, OCX_MESSAGE_SIZE);
+   ...
+   1150 |                                 strncat(msg, other, OCX_MESSAGE_SIZE);
+
+   ...
+
+Apparently the author of this driver expected strncat() to behave the
+way that strlcat() does, which uses the size of the destination buffer
+as its third argument rather than the length of the source buffer. The
+result is that there is no check on the size of the allocated buffer.
+
+Change it to strlcat().
+
+  [ bp: Trim compiler output, fixup commit message. ]
+
+Fixes: 41003396f932 ("EDAC, thunderx: Add Cavium ThunderX EDAC driver")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org>
+Link: https://lore.kernel.org/r/20231122222007.3199885-1-arnd@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/edac/thunderx_edac.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/edac/thunderx_edac.c b/drivers/edac/thunderx_edac.c
+index f13674081cb6..4dca21b39bf7 100644
+--- a/drivers/edac/thunderx_edac.c
++++ b/drivers/edac/thunderx_edac.c
+@@ -1133,7 +1133,7 @@ static irqreturn_t thunderx_ocx_com_threaded_isr(int irq, void *irq_id)
+ 		decode_register(other, OCX_OTHER_SIZE,
+ 				ocx_com_errors, ctx->reg_com_int);
+ 
+-		strncat(msg, other, OCX_MESSAGE_SIZE);
++		strlcat(msg, other, OCX_MESSAGE_SIZE);
+ 
+ 		for (lane = 0; lane < OCX_RX_LANES; lane++)
+ 			if (ctx->reg_com_int & BIT(lane)) {
+@@ -1142,12 +1142,12 @@ static irqreturn_t thunderx_ocx_com_threaded_isr(int irq, void *irq_id)
+ 					 lane, ctx->reg_lane_int[lane],
+ 					 lane, ctx->reg_lane_stat11[lane]);
+ 
+-				strncat(msg, other, OCX_MESSAGE_SIZE);
++				strlcat(msg, other, OCX_MESSAGE_SIZE);
+ 
+ 				decode_register(other, OCX_OTHER_SIZE,
+ 						ocx_lane_errors,
+ 						ctx->reg_lane_int[lane]);
+-				strncat(msg, other, OCX_MESSAGE_SIZE);
++				strlcat(msg, other, OCX_MESSAGE_SIZE);
+ 			}
+ 
+ 		if (ctx->reg_com_int & OCX_COM_INT_CE)
+@@ -1217,7 +1217,7 @@ static irqreturn_t thunderx_ocx_lnk_threaded_isr(int irq, void *irq_id)
+ 		decode_register(other, OCX_OTHER_SIZE,
+ 				ocx_com_link_errors, ctx->reg_com_link_int);
+ 
+-		strncat(msg, other, OCX_MESSAGE_SIZE);
++		strlcat(msg, other, OCX_MESSAGE_SIZE);
+ 
+ 		if (ctx->reg_com_link_int & OCX_COM_LINK_INT_UE)
+ 			edac_device_handle_ue(ocx->edac_dev, 0, 0, msg);
+@@ -1896,7 +1896,7 @@ static irqreturn_t thunderx_l2c_threaded_isr(int irq, void *irq_id)
+ 
+ 		decode_register(other, L2C_OTHER_SIZE, l2_errors, ctx->reg_int);
+ 
+-		strncat(msg, other, L2C_MESSAGE_SIZE);
++		strlcat(msg, other, L2C_MESSAGE_SIZE);
+ 
+ 		if (ctx->reg_int & mask_ue)
+ 			edac_device_handle_ue(l2c->edac_dev, 0, 0, msg);
+-- 
+2.43.0
+
diff --git a/queue-6.1/efivarfs-force-ro-when-remounting-if-setvariable-is-.patch b/queue-6.1/efivarfs-force-ro-when-remounting-if-setvariable-is-.patch
new file mode 100644
index 00000000000..18444d356bd
--- /dev/null
+++ b/queue-6.1/efivarfs-force-ro-when-remounting-if-setvariable-is-.patch
@@ -0,0 +1,108 @@
+From 43bb0d3a47d0a852d189793fe1142f4de4d6050b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Nov 2023 14:40:56 +0900
+Subject: efivarfs: force RO when remounting if SetVariable is not supported
+
+From: Ilias Apalodimas <ilias.apalodimas@linaro.org>
+
+[ Upstream commit 0e8d2444168dd519fea501599d150e62718ed2fe ]
+
+If SetVariable at runtime is not supported by the firmware we never assign
+a callback for that function. At the same time mount the efivarfs as
+RO so no one can call that.  However, we never check the permission flags
+when someone remounts the filesystem as RW. As a result this leads to a
+crash looking like this:
+
+$ mount -o remount,rw /sys/firmware/efi/efivars
+$ efi-updatevar -f PK.auth PK
+
+[  303.279166] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
+[  303.280482] Mem abort info:
+[  303.280854]   ESR = 0x0000000086000004
+[  303.281338]   EC = 0x21: IABT (current EL), IL = 32 bits
+[  303.282016]   SET = 0, FnV = 0
+[  303.282414]   EA = 0, S1PTW = 0
+[  303.282821]   FSC = 0x04: level 0 translation fault
+[  303.283771] user pgtable: 4k pages, 48-bit VAs, pgdp=000000004258c000
+[  303.284913] [0000000000000000] pgd=0000000000000000, p4d=0000000000000000
+[  303.286076] Internal error: Oops: 0000000086000004 [#1] PREEMPT SMP
+[  303.286936] Modules linked in: qrtr tpm_tis tpm_tis_core crct10dif_ce arm_smccc_trng rng_core drm fuse ip_tables x_tables ipv6
+[  303.288586] CPU: 1 PID: 755 Comm: efi-updatevar Not tainted 6.3.0-rc1-00108-gc7d0c4695c68 #1
+[  303.289748] Hardware name: Unknown Unknown Product/Unknown Product, BIOS 2023.04-00627-g88336918701d 04/01/2023
+[  303.291150] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+[  303.292123] pc : 0x0
+[  303.292443] lr : efivar_set_variable_locked+0x74/0xec
+[  303.293156] sp : ffff800008673c10
+[  303.293619] x29: ffff800008673c10 x28: ffff0000037e8000 x27: 0000000000000000
+[  303.294592] x26: 0000000000000800 x25: ffff000002467400 x24: 0000000000000027
+[  303.295572] x23: ffffd49ea9832000 x22: ffff0000020c9800 x21: ffff000002467000
+[  303.296566] x20: 0000000000000001 x19: 00000000000007fc x18: 0000000000000000
+[  303.297531] x17: 0000000000000000 x16: 0000000000000000 x15: 0000aaaac807ab54
+[  303.298495] x14: ed37489f673633c0 x13: 71c45c606de13f80 x12: 47464259e219acf4
+[  303.299453] x11: ffff000002af7b01 x10: 0000000000000003 x9 : 0000000000000002
+[  303.300431] x8 : 0000000000000010 x7 : ffffd49ea8973230 x6 : 0000000000a85201
+[  303.301412] x5 : 0000000000000000 x4 : ffff0000020c9800 x3 : 00000000000007fc
+[  303.302370] x2 : 0000000000000027 x1 : ffff000002467400 x0 : ffff000002467000
+[  303.303341] Call trace:
+[  303.303679]  0x0
+[  303.303938]  efivar_entry_set_get_size+0x98/0x16c
+[  303.304585]  efivarfs_file_write+0xd0/0x1a4
+[  303.305148]  vfs_write+0xc4/0x2e4
+[  303.305601]  ksys_write+0x70/0x104
+[  303.306073]  __arm64_sys_write+0x1c/0x28
+[  303.306622]  invoke_syscall+0x48/0x114
+[  303.307156]  el0_svc_common.constprop.0+0x44/0xec
+[  303.307803]  do_el0_svc+0x38/0x98
+[  303.308268]  el0_svc+0x2c/0x84
+[  303.308702]  el0t_64_sync_handler+0xf4/0x120
+[  303.309293]  el0t_64_sync+0x190/0x194
+[  303.309794] Code: ???????? ???????? ???????? ???????? (????????)
+[  303.310612] ---[ end trace 0000000000000000 ]---
+
+Fix this by adding a .reconfigure() function to the fs operations which
+we can use to check the requested flags and deny anything that's not RO
+if the firmware doesn't implement SetVariable at runtime.
+
+Fixes: f88814cc2578 ("efi/efivars: Expose RT service availability via efivars abstraction")
+Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/efivarfs/super.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/fs/efivarfs/super.c b/fs/efivarfs/super.c
+index 6780fc81cc11..f5966cd95918 100644
+--- a/fs/efivarfs/super.c
++++ b/fs/efivarfs/super.c
+@@ -13,6 +13,7 @@
+ #include <linux/ucs2_string.h>
+ #include <linux/slab.h>
+ #include <linux/magic.h>
++#include <linux/printk.h>
+ 
+ #include "internal.h"
+ 
+@@ -226,8 +227,19 @@ static int efivarfs_get_tree(struct fs_context *fc)
+ 	return get_tree_single(fc, efivarfs_fill_super);
+ }
+ 
++static int efivarfs_reconfigure(struct fs_context *fc)
++{
++	if (!efivar_supports_writes() && !(fc->sb_flags & SB_RDONLY)) {
++		pr_err("Firmware does not support SetVariableRT. Can not remount with rw\n");
++		return -EINVAL;
++	}
++
++	return 0;
++}
++
+ static const struct fs_context_operations efivarfs_context_ops = {
+ 	.get_tree	= efivarfs_get_tree,
++	.reconfigure	= efivarfs_reconfigure,
+ };
+ 
+ static int efivarfs_init_fs_context(struct fs_context *fc)
+-- 
+2.43.0
+
diff --git a/queue-6.1/efivarfs-free-s_fs_info-on-unmount.patch b/queue-6.1/efivarfs-free-s_fs_info-on-unmount.patch
new file mode 100644
index 00000000000..80463160a04
--- /dev/null
+++ b/queue-6.1/efivarfs-free-s_fs_info-on-unmount.patch
@@ -0,0 +1,40 @@
+From 7ef43c5114d1adfea92dc9c013b3c3bdba2d0555 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Dec 2023 17:39:28 +0100
+Subject: efivarfs: Free s_fs_info on unmount
+
+From: Ard Biesheuvel <ardb@kernel.org>
+
+[ Upstream commit 547713d502f7b4b8efccd409cff84d731a23853b ]
+
+Now that we allocate a s_fs_info struct on fs context creation, we
+should ensure that we free it again when the superblock goes away.
+
+Fixes: 5329aa5101f7 ("efivarfs: Add uid/gid mount options")
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/efivarfs/super.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/fs/efivarfs/super.c b/fs/efivarfs/super.c
+index f5966cd95918..77c7615bba5e 100644
+--- a/fs/efivarfs/super.c
++++ b/fs/efivarfs/super.c
+@@ -250,10 +250,13 @@ static int efivarfs_init_fs_context(struct fs_context *fc)
+ 
+ static void efivarfs_kill_sb(struct super_block *sb)
+ {
++	struct efivarfs_fs_info *sfi = sb->s_fs_info;
++
+ 	kill_litter_super(sb);
+ 
+ 	/* Remove all entries and destroy */
+ 	efivar_entry_iter(efivarfs_destroy, &efivarfs_list, NULL);
++	kfree(sfi);
+ }
+ 
+ static struct file_system_type efivarfs_type = {
+-- 
+2.43.0
+
diff --git a/queue-6.1/erofs-fix-memory-leak-on-short-lived-bounced-pages.patch b/queue-6.1/erofs-fix-memory-leak-on-short-lived-bounced-pages.patch
new file mode 100644
index 00000000000..b6a46c198bb
--- /dev/null
+++ b/queue-6.1/erofs-fix-memory-leak-on-short-lived-bounced-pages.patch
@@ -0,0 +1,50 @@
+From 1d93436916867fef5d1a0c4c2a56226b77dceda2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Nov 2023 02:04:31 +0800
+Subject: erofs: fix memory leak on short-lived bounced pages
+
+From: Gao Xiang <hsiangkao@linux.alibaba.com>
+
+[ Upstream commit 93d6fda7f926451a0fa1121b9558d75ca47e861e ]
+
+Both MicroLZMA and DEFLATE algorithms can use short-lived pages on
+demand for the overlapped inplace I/O decompression.
+
+However, those short-lived pages are actually added to
+`be->compressed_pages`.  Thus, it should be checked instead of
+`pcl->compressed_bvecs`.
+
+The LZ4 algorithm doesn't work like this, so it won't be impacted.
+
+Fixes: 67139e36d970 ("erofs: introduce `z_erofs_parse_in_bvecs'")
+Reviewed-by: Yue Hu <huyue2@coolpad.com>
+Reviewed-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
+Link: https://lore.kernel.org/r/20231128180431.4116991-1-hsiangkao@linux.alibaba.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/erofs/zdata.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/fs/erofs/zdata.c b/fs/erofs/zdata.c
+index 1b91ac5be961..cf9a2fa7f55d 100644
+--- a/fs/erofs/zdata.c
++++ b/fs/erofs/zdata.c
+@@ -1192,12 +1192,11 @@ static int z_erofs_decompress_pcluster(struct z_erofs_decompress_backend *be,
+ 		put_page(page);
+ 	} else {
+ 		for (i = 0; i < pclusterpages; ++i) {
+-			page = pcl->compressed_bvecs[i].page;
++			/* consider shortlived pages added when decompressing */
++			page = be->compressed_pages[i];
+ 
+ 			if (erofs_page_is_managed(sbi, page))
+ 				continue;
+-
+-			/* recycle all individual short-lived pages */
+ 			(void)z_erofs_put_shortlivedpage(be->pagepool, page);
+ 			WRITE_ONCE(pcl->compressed_bvecs[i].page, NULL);
+ 		}
+-- 
+2.43.0
+
diff --git a/queue-6.1/f2fs-fix-to-avoid-dirent-corruption.patch b/queue-6.1/f2fs-fix-to-avoid-dirent-corruption.patch
new file mode 100644
index 00000000000..c82cd4d2c26
--- /dev/null
+++ b/queue-6.1/f2fs-fix-to-avoid-dirent-corruption.patch
@@ -0,0 +1,60 @@
+From e441dee4496de1faf45f40dcb3bbaefa6ab7d38a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Nov 2023 17:25:16 +0800
+Subject: f2fs: fix to avoid dirent corruption
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit 53edb549565f55ccd0bdf43be3d66ce4c2d48b28 ]
+
+As Al reported in link[1]:
+
+f2fs_rename()
+...
+	if (old_dir != new_dir && !whiteout)
+		f2fs_set_link(old_inode, old_dir_entry,
+					old_dir_page, new_dir);
+	else
+		f2fs_put_page(old_dir_page, 0);
+
+You want correct inumber in the ".." link.  And cross-directory
+rename does move the source to new parent, even if you'd been asked
+to leave a whiteout in the old place.
+
+[1] https://lore.kernel.org/all/20231017055040.GN800259@ZenIV/
+
+With below testcase, it may cause dirent corruption, due to it missed
+to call f2fs_set_link() to update ".." link to new directory.
+- mkdir -p dir/foo
+- renameat2 -w dir/foo bar
+
+[ASSERT] (__chk_dots_dentries:1421)  --> Bad inode number[0x4] for '..', parent parent ino is [0x3]
+[FSCK] other corrupted bugs                           [Fail]
+
+Fixes: 7e01e7ad746b ("f2fs: support RENAME_WHITEOUT")
+Cc: Jan Kara <jack@suse.cz>
+Reported-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Chao Yu <chao@kernel.org>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/namei.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/f2fs/namei.c b/fs/f2fs/namei.c
+index bd020a992c2e..328cd20b16a5 100644
+--- a/fs/f2fs/namei.c
++++ b/fs/f2fs/namei.c
+@@ -1099,7 +1099,7 @@ static int f2fs_rename(struct user_namespace *mnt_userns, struct inode *old_dir,
+ 	}
+ 
+ 	if (old_dir_entry) {
+-		if (old_dir != new_dir && !whiteout)
++		if (old_dir != new_dir)
+ 			f2fs_set_link(old_inode, old_dir_entry,
+ 						old_dir_page, new_dir);
+ 		else
+-- 
+2.43.0
+
diff --git a/queue-6.1/f2fs-fix-to-check-compress-file-in-f2fs_move_file_ra.patch b/queue-6.1/f2fs-fix-to-check-compress-file-in-f2fs_move_file_ra.patch
new file mode 100644
index 00000000000..f01c579267a
--- /dev/null
+++ b/queue-6.1/f2fs-fix-to-check-compress-file-in-f2fs_move_file_ra.patch
@@ -0,0 +1,40 @@
+From da56614beb61c5a282280a9b1f052c6e4f4b9c1a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 10 Dec 2023 19:35:44 +0800
+Subject: f2fs: fix to check compress file in f2fs_move_file_range()
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit fb9b65340c818875ea86464faf3c744bdce0055c ]
+
+f2fs_move_file_range() doesn't support migrating compressed cluster
+data, let's add the missing check condition and return -EOPNOTSUPP
+for the case until we support it.
+
+Fixes: 4c8ff7095bef ("f2fs: support data compression")
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/file.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index 9b9fb3c57ec6..3f2c55b9aa8a 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -2821,6 +2821,11 @@ static int f2fs_move_file_range(struct file *file_in, loff_t pos_in,
+ 			goto out;
+ 	}
+ 
++	if (f2fs_compressed_file(src) || f2fs_compressed_file(dst)) {
++		ret = -EOPNOTSUPP;
++		goto out_unlock;
++	}
++
+ 	ret = -EINVAL;
+ 	if (pos_in + len > src->i_size || pos_in + len < pos_in)
+ 		goto out_unlock;
+-- 
+2.43.0
+
diff --git a/queue-6.1/f2fs-fix-to-check-return-value-of-f2fs_recover_xattr.patch b/queue-6.1/f2fs-fix-to-check-return-value-of-f2fs_recover_xattr.patch
new file mode 100644
index 00000000000..a0bdeb2af27
--- /dev/null
+++ b/queue-6.1/f2fs-fix-to-check-return-value-of-f2fs_recover_xattr.patch
@@ -0,0 +1,70 @@
+From 95729c4e74ea4317db1a9d3e3aa849940eaf3749 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Dec 2023 10:15:27 +0800
+Subject: f2fs: fix to check return value of f2fs_recover_xattr_data
+
+From: Zhiguo Niu <zhiguo.niu@unisoc.com>
+
+[ Upstream commit 86d7d57a3f096c8349b32a0cd5f6f314e4416a6d ]
+
+Should check return value of f2fs_recover_xattr_data in
+__f2fs_setxattr rather than doing invalid retry if error happen.
+
+Also just do set_page_dirty in f2fs_recover_xattr_data when
+page is changed really.
+
+Fixes: 50a472bbc79f ("f2fs: do not return EFSCORRUPTED, but try to run online repair")
+Signed-off-by: Zhiguo Niu <zhiguo.niu@unisoc.com>
+Reviewed-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/node.c  |  6 +++---
+ fs/f2fs/xattr.c | 11 +++++++----
+ 2 files changed, 10 insertions(+), 7 deletions(-)
+
+diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c
+index 6efccd7ccfe1..c6d0e0709632 100644
+--- a/fs/f2fs/node.c
++++ b/fs/f2fs/node.c
+@@ -2738,11 +2738,11 @@ int f2fs_recover_xattr_data(struct inode *inode, struct page *page)
+ 	f2fs_update_inode_page(inode);
+ 
+ 	/* 3: update and set xattr node page dirty */
+-	if (page)
++	if (page) {
+ 		memcpy(F2FS_NODE(xpage), F2FS_NODE(page),
+ 				VALID_XATTR_BLOCK_SIZE);
+-
+-	set_page_dirty(xpage);
++		set_page_dirty(xpage);
++	}
+ 	f2fs_put_page(xpage, 1);
+ 
+ 	return 0;
+diff --git a/fs/f2fs/xattr.c b/fs/f2fs/xattr.c
+index 8816e13ca7c9..0631b383e21f 100644
+--- a/fs/f2fs/xattr.c
++++ b/fs/f2fs/xattr.c
+@@ -660,11 +660,14 @@ static int __f2fs_setxattr(struct inode *inode, int index,
+ 	here = __find_xattr(base_addr, last_base_addr, NULL, index, len, name);
+ 	if (!here) {
+ 		if (!F2FS_I(inode)->i_xattr_nid) {
++			error = f2fs_recover_xattr_data(inode, NULL);
+ 			f2fs_notice(F2FS_I_SB(inode),
+-				"recover xattr in inode (%lu)", inode->i_ino);
+-			f2fs_recover_xattr_data(inode, NULL);
+-			kfree(base_addr);
+-			goto retry;
++				"recover xattr in inode (%lu), error(%d)",
++					inode->i_ino, error);
++			if (!error) {
++				kfree(base_addr);
++				goto retry;
++			}
+ 		}
+ 		f2fs_err(F2FS_I_SB(inode), "set inode (%lu) has corrupted xattr",
+ 								inode->i_ino);
+-- 
+2.43.0
+
diff --git a/queue-6.1/f2fs-fix-to-update-iostat-correctly-in-f2fs_filemap_.patch b/queue-6.1/f2fs-fix-to-update-iostat-correctly-in-f2fs_filemap_.patch
new file mode 100644
index 00000000000..f0db705d170
--- /dev/null
+++ b/queue-6.1/f2fs-fix-to-update-iostat-correctly-in-f2fs_filemap_.patch
@@ -0,0 +1,36 @@
+From ae2f297681dfb5cd9a9f407e443c624e9228364f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 10 Dec 2023 19:35:47 +0800
+Subject: f2fs: fix to update iostat correctly in f2fs_filemap_fault()
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit bb34cc6ca87ff78f9fb5913d7619dc1389554da6 ]
+
+In f2fs_filemap_fault(), it fixes to update iostat info only if
+VM_FAULT_LOCKED is tagged in return value of filemap_fault().
+
+Fixes: 8b83ac81f428 ("f2fs: support read iostat")
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/file.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index 3f2c55b9aa8a..fd22854dbeae 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -42,7 +42,7 @@ static vm_fault_t f2fs_filemap_fault(struct vm_fault *vmf)
+ 	vm_fault_t ret;
+ 
+ 	ret = filemap_fault(vmf);
+-	if (!ret)
++	if (ret & VM_FAULT_LOCKED)
+ 		f2fs_update_iostat(F2FS_I_SB(inode), inode,
+ 					APP_MAPPED_READ_IO, F2FS_BLKSIZE);
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/f2fs-fix-to-wait-on-block-writeback-for-post_read-ca.patch b/queue-6.1/f2fs-fix-to-wait-on-block-writeback-for-post_read-ca.patch
new file mode 100644
index 00000000000..1b81f6217de
--- /dev/null
+++ b/queue-6.1/f2fs-fix-to-wait-on-block-writeback-for-post_read-ca.patch
@@ -0,0 +1,69 @@
+From e963c3dfd980dd259b62617a5438cddcfc13db03 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 10 Dec 2023 19:35:43 +0800
+Subject: f2fs: fix to wait on block writeback for post_read case
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit 55fdc1c24a1d6229fe0ecf31335fb9a2eceaaa00 ]
+
+If inode is compressed, but not encrypted, it missed to call
+f2fs_wait_on_block_writeback() to wait for GCed page writeback
+in IPU write path.
+
+Thread A				GC-Thread
+					- f2fs_gc
+					 - do_garbage_collect
+					  - gc_data_segment
+					   - move_data_block
+					    - f2fs_submit_page_write
+					     migrate normal cluster's block via
+					     meta_inode's page cache
+- f2fs_write_single_data_page
+ - f2fs_do_write_data_page
+  - f2fs_inplace_write_data
+   - f2fs_submit_page_bio
+
+IRQ
+- f2fs_read_end_io
+					IRQ
+					old data overrides new data due to
+					out-of-order GC and common IO.
+					- f2fs_read_end_io
+
+Fixes: 4c8ff7095bef ("f2fs: support data compression")
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/data.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
+index 3666c1fd77a6..8b561af37974 100644
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -2490,9 +2490,6 @@ int f2fs_encrypt_one_page(struct f2fs_io_info *fio)
+ 
+ 	page = fio->compressed_page ? fio->compressed_page : fio->page;
+ 
+-	/* wait for GCed page writeback via META_MAPPING */
+-	f2fs_wait_on_block_writeback(inode, fio->old_blkaddr);
+-
+ 	if (fscrypt_inode_uses_inline_crypto(inode))
+ 		return 0;
+ 
+@@ -2681,6 +2678,10 @@ int f2fs_do_write_data_page(struct f2fs_io_info *fio)
+ 		goto out_writepage;
+ 	}
+ 
++	/* wait for GCed page writeback via META_MAPPING */
++	if (fio->post_read)
++		f2fs_wait_on_block_writeback(inode, fio->old_blkaddr);
++
+ 	/*
+ 	 * If current allocation needs SSR,
+ 	 * it had better in-place writes for updated data.
+-- 
+2.43.0
+
diff --git a/queue-6.1/fbdev-imxfb-fix-left-margin-setting.patch b/queue-6.1/fbdev-imxfb-fix-left-margin-setting.patch
new file mode 100644
index 00000000000..a1960db5d09
--- /dev/null
+++ b/queue-6.1/fbdev-imxfb-fix-left-margin-setting.patch
@@ -0,0 +1,121 @@
+From 0f4f621ac35a0c9239682e9a27ef712cfcfe3543 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 11 Nov 2023 11:41:50 +0100
+Subject: fbdev: imxfb: fix left margin setting
+
+From: Dario Binacchi <dario.binacchi@amarulasolutions.com>
+
+[ Upstream commit 5758844105f7dd9a0a04990cd92499a1a593dd36 ]
+
+The previous setting did not take into account the CSTN mode.
+For the H_WAIT_2 bitfield (bits 0-7) of the LCDC Horizontal Configuration
+Register (LCDCR), the IMX25RM manual states that:
+
+In TFT mode, it specifies the number of SCLK periods between the end of
+HSYNC and the beginning of OE signal, and the total delay time equals
+(H_WAIT_2 + 3) of SCLK periods.
+In CSTN mode, it specifies the number of SCLK periods between the end of
+HSYNC and the first display data in each line, and the total delay time
+equals (H_WAIT_2 + 2) of SCLK periods.
+
+The patch handles both cases.
+
+Fixes: 4e47382fbca9 ("fbdev: imxfb: warn about invalid left/right margin")
+Fixes: 7e8549bcee00 ("imxfb: Fix margin settings")
+Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/imxfb.c | 27 +++++++++++++++++++++++++--
+ 1 file changed, 25 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/video/fbdev/imxfb.c b/drivers/video/fbdev/imxfb.c
+index 36ada87b49a4..32b8374abeca 100644
+--- a/drivers/video/fbdev/imxfb.c
++++ b/drivers/video/fbdev/imxfb.c
+@@ -42,6 +42,7 @@
+ #include <video/videomode.h>
+ 
+ #define PCR_TFT		(1 << 31)
++#define PCR_COLOR	(1 << 30)
+ #define PCR_BPIX_8	(3 << 25)
+ #define PCR_BPIX_12	(4 << 25)
+ #define PCR_BPIX_16	(5 << 25)
+@@ -150,6 +151,12 @@ enum imxfb_type {
+ 	IMX21_FB,
+ };
+ 
++enum imxfb_panel_type {
++	PANEL_TYPE_MONOCHROME,
++	PANEL_TYPE_CSTN,
++	PANEL_TYPE_TFT,
++};
++
+ struct imxfb_info {
+ 	struct platform_device  *pdev;
+ 	void __iomem		*regs;
+@@ -157,6 +164,7 @@ struct imxfb_info {
+ 	struct clk		*clk_ahb;
+ 	struct clk		*clk_per;
+ 	enum imxfb_type		devtype;
++	enum imxfb_panel_type	panel_type;
+ 	bool			enabled;
+ 
+ 	/*
+@@ -444,6 +452,13 @@ static int imxfb_check_var(struct fb_var_screeninfo *var, struct fb_info *info)
+ 	if (!is_imx1_fb(fbi) && imxfb_mode->aus_mode)
+ 		fbi->lauscr = LAUSCR_AUS_MODE;
+ 
++	if (imxfb_mode->pcr & PCR_TFT)
++		fbi->panel_type = PANEL_TYPE_TFT;
++	else if (imxfb_mode->pcr & PCR_COLOR)
++		fbi->panel_type = PANEL_TYPE_CSTN;
++	else
++		fbi->panel_type = PANEL_TYPE_MONOCHROME;
++
+ 	/*
+ 	 * Copy the RGB parameters for this display
+ 	 * from the machine specific parameters.
+@@ -598,6 +613,7 @@ static int imxfb_activate_var(struct fb_var_screeninfo *var, struct fb_info *inf
+ {
+ 	struct imxfb_info *fbi = info->par;
+ 	u32 ymax_mask = is_imx1_fb(fbi) ? YMAX_MASK_IMX1 : YMAX_MASK_IMX21;
++	u8 left_margin_low;
+ 
+ 	pr_debug("var: xres=%d hslen=%d lm=%d rm=%d\n",
+ 		var->xres, var->hsync_len,
+@@ -606,6 +622,13 @@ static int imxfb_activate_var(struct fb_var_screeninfo *var, struct fb_info *inf
+ 		var->yres, var->vsync_len,
+ 		var->upper_margin, var->lower_margin);
+ 
++	if (fbi->panel_type == PANEL_TYPE_TFT)
++		left_margin_low = 3;
++	else if (fbi->panel_type == PANEL_TYPE_CSTN)
++		left_margin_low = 2;
++	else
++		left_margin_low = 0;
++
+ #if DEBUG_VAR
+ 	if (var->xres < 16        || var->xres > 1024)
+ 		printk(KERN_ERR "%s: invalid xres %d\n",
+@@ -613,7 +636,7 @@ static int imxfb_activate_var(struct fb_var_screeninfo *var, struct fb_info *inf
+ 	if (var->hsync_len < 1    || var->hsync_len > 64)
+ 		printk(KERN_ERR "%s: invalid hsync_len %d\n",
+ 			info->fix.id, var->hsync_len);
+-	if (var->left_margin < 3  || var->left_margin > 255)
++	if (var->left_margin < left_margin_low  || var->left_margin > 255)
+ 		printk(KERN_ERR "%s: invalid left_margin %d\n",
+ 			info->fix.id, var->left_margin);
+ 	if (var->right_margin < 1 || var->right_margin > 255)
+@@ -639,7 +662,7 @@ static int imxfb_activate_var(struct fb_var_screeninfo *var, struct fb_info *inf
+ 
+ 	writel(HCR_H_WIDTH(var->hsync_len - 1) |
+ 		HCR_H_WAIT_1(var->right_margin - 1) |
+-		HCR_H_WAIT_2(var->left_margin - 3),
++		HCR_H_WAIT_2(var->left_margin - left_margin_low),
+ 		fbi->regs + LCDC_HCR);
+ 
+ 	writel(VCR_V_WIDTH(var->vsync_len) |
+-- 
+2.43.0
+
diff --git a/queue-6.1/firmware-meson_sm-populate-platform-devices-from-sm-.patch b/queue-6.1/firmware-meson_sm-populate-platform-devices-from-sm-.patch
new file mode 100644
index 00000000000..d07c1ef77b6
--- /dev/null
+++ b/queue-6.1/firmware-meson_sm-populate-platform-devices-from-sm-.patch
@@ -0,0 +1,51 @@
+From dc26adfc6fcb7add8f38f7acd2e2354f64692fe3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Mar 2023 17:55:57 +0300
+Subject: firmware: meson_sm: populate platform devices from sm device tree
+ data
+
+From: Dmitry Rokosov <ddrokosov@sberdevices.ru>
+
+[ Upstream commit e45f243409db98d610248c843b25435e7fb0baf3 ]
+
+In some meson boards, secure monitor device has children, for example,
+power secure controller. By default, secure monitor isn't the bus in terms
+of device tree subsystem, so the of_platform initialization code doesn't
+populate its device tree data. As a result, secure monitor's children
+aren't probed at all.
+
+Run the 'of_platform_populate()' routine manually to resolve such issues.
+
+Signed-off-by: Dmitry Rokosov <ddrokosov@sberdevices.ru>
+Acked-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Link: https://lore.kernel.org/r/20230324145557.27797-1-ddrokosov@sberdevices.ru
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Stable-dep-of: d8385d7433f9 ("firmware: meson-sm: unmap out_base shmem in error path")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/meson/meson_sm.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/firmware/meson/meson_sm.c b/drivers/firmware/meson/meson_sm.c
+index d081a6312627..bf19dd66c213 100644
+--- a/drivers/firmware/meson/meson_sm.c
++++ b/drivers/firmware/meson/meson_sm.c
+@@ -313,11 +313,14 @@ static int __init meson_sm_probe(struct platform_device *pdev)
+ 
+ 	platform_set_drvdata(pdev, fw);
+ 
+-	pr_info("secure-monitor enabled\n");
++	if (devm_of_platform_populate(dev))
++		goto out_in_base;
+ 
+ 	if (sysfs_create_group(&pdev->dev.kobj, &meson_sm_sysfs_attr_group))
+ 		goto out_in_base;
+ 
++	pr_info("secure-monitor enabled\n");
++
+ 	return 0;
+ 
+ out_in_base:
+-- 
+2.43.0
+
diff --git a/queue-6.1/firmware-ti_sci-fix-an-off-by-one-in-ti_sci_debugfs_.patch b/queue-6.1/firmware-ti_sci-fix-an-off-by-one-in-ti_sci_debugfs_.patch
new file mode 100644
index 00000000000..e1c8de29f1b
--- /dev/null
+++ b/queue-6.1/firmware-ti_sci-fix-an-off-by-one-in-ti_sci_debugfs_.patch
@@ -0,0 +1,55 @@
+From d928c1506b0327d6b6852f1b70e727359cc6fa82 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Oct 2023 11:12:26 +0100
+Subject: firmware: ti_sci: Fix an off-by-one in ti_sci_debugfs_create()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 964946b88887089f447a9b6a28c39ee97dc76360 ]
+
+The ending NULL is not taken into account by strncat(), so switch to
+snprintf() to correctly build 'debug_name'.
+
+Using snprintf() also makes the code more readable.
+
+Fixes: aa276781a64a ("firmware: Add basic support for TI System Control Interface (TI-SCI) protocol")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org>
+Link: https://lore.kernel.org/r/7158db0a4d7b19855ddd542ec61b666973aad8dc.1698660720.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Nishanth Menon <nm@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/ti_sci.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/firmware/ti_sci.c b/drivers/firmware/ti_sci.c
+index 597d1a367d96..6231c98ba291 100644
+--- a/drivers/firmware/ti_sci.c
++++ b/drivers/firmware/ti_sci.c
+@@ -161,7 +161,7 @@ static int ti_sci_debugfs_create(struct platform_device *pdev,
+ {
+ 	struct device *dev = &pdev->dev;
+ 	struct resource *res;
+-	char debug_name[50] = "ti_sci_debug@";
++	char debug_name[50];
+ 
+ 	/* Debug region is optional */
+ 	res = platform_get_resource_byname(pdev, IORESOURCE_MEM,
+@@ -178,10 +178,10 @@ static int ti_sci_debugfs_create(struct platform_device *pdev,
+ 	/* Setup NULL termination */
+ 	info->debug_buffer[info->debug_region_size] = 0;
+ 
+-	info->d = debugfs_create_file(strncat(debug_name, dev_name(dev),
+-					      sizeof(debug_name) -
+-					      sizeof("ti_sci_debug@")),
+-				      0444, NULL, info, &ti_sci_debug_fops);
++	snprintf(debug_name, sizeof(debug_name), "ti_sci_debug@%s",
++		 dev_name(dev));
++	info->d = debugfs_create_file(debug_name, 0444, NULL, info,
++				      &ti_sci_debug_fops);
+ 	if (IS_ERR(info->d))
+ 		return PTR_ERR(info->d);
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/fs-indicate-request-originates-from-old-mount-api.patch b/queue-6.1/fs-indicate-request-originates-from-old-mount-api.patch
new file mode 100644
index 00000000000..26d5f061a2e
--- /dev/null
+++ b/queue-6.1/fs-indicate-request-originates-from-old-mount-api.patch
@@ -0,0 +1,61 @@
+From 0bfe742d069813411059ebc2d25fe121e8d0e98f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Nov 2023 12:17:37 -0500
+Subject: fs: indicate request originates from old mount API
+
+From: Christian Brauner <brauner@kernel.org>
+
+[ Upstream commit f67d922edb4e95a4a56d07d5d40a76dd4f23a85b ]
+
+We already communicate to filesystems when a remount request comes from
+the old mount API as some filesystems choose to implement different
+behavior in the new mount API than the old mount API to e.g., take the
+chance to fix significant API bugs. Allow the same for regular mount
+requests.
+
+Fixes: b330966f79fb ("fuse: reject options on reconfigure via fsconfig(2)")
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
+Reviewed-by: Anand Jain <anand.jain@oracle.com>
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Josef Bacik <josef@toxicpanda.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/namespace.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/fs/namespace.c b/fs/namespace.c
+index e04a9e9e3f14..29a8d90dd107 100644
+--- a/fs/namespace.c
++++ b/fs/namespace.c
+@@ -2693,7 +2693,12 @@ static int do_remount(struct path *path, int ms_flags, int sb_flags,
+ 	if (IS_ERR(fc))
+ 		return PTR_ERR(fc);
+ 
++	/*
++	 * Indicate to the filesystem that the remount request is coming
++	 * from the legacy mount system call.
++	 */
+ 	fc->oldapi = true;
++
+ 	err = parse_monolithic_mount_data(fc, data);
+ 	if (!err) {
+ 		down_write(&sb->s_umount);
+@@ -3027,6 +3032,12 @@ static int do_new_mount(struct path *path, const char *fstype, int sb_flags,
+ 	if (IS_ERR(fc))
+ 		return PTR_ERR(fc);
+ 
++	/*
++	 * Indicate to the filesystem that the mount request is coming
++	 * from the legacy mount system call.
++	 */
++	fc->oldapi = true;
++
+ 	if (subtype)
+ 		err = vfs_parse_fs_string(fc, "subtype",
+ 					  subtype, strlen(subtype));
+-- 
+2.43.0
+
diff --git a/queue-6.1/gfs2-fix-kernel-null-pointer-dereference-in-gfs2_rgr.patch b/queue-6.1/gfs2-fix-kernel-null-pointer-dereference-in-gfs2_rgr.patch
new file mode 100644
index 00000000000..b1b33a28548
--- /dev/null
+++ b/queue-6.1/gfs2-fix-kernel-null-pointer-dereference-in-gfs2_rgr.patch
@@ -0,0 +1,40 @@
+From 861c14dede58a6c08e06e934c463e21e8f6c7ed1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Nov 2023 21:21:29 +0500
+Subject: gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump
+
+From: Osama Muhammad <osmtendev@gmail.com>
+
+[ Upstream commit 8877243beafa7c6bfc42022cbfdf9e39b25bd4fa ]
+
+Syzkaller has reported a NULL pointer dereference when accessing
+rgd->rd_rgl in gfs2_rgrp_dump().  This can happen when creating
+rgd->rd_gl fails in read_rindex_entry().  Add a NULL pointer check in
+gfs2_rgrp_dump() to prevent that.
+
+Reported-and-tested-by: syzbot+da0fc229cc1ff4bb2e6d@syzkaller.appspotmail.com
+Link: https://syzkaller.appspot.com/bug?extid=da0fc229cc1ff4bb2e6d
+Fixes: 72244b6bc752 ("gfs2: improve debug information when lvb mismatches are found")
+Signed-off-by: Osama Muhammad <osmtendev@gmail.com>
+Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/gfs2/rgrp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
+index f602fb844951..dcaaa32efc4a 100644
+--- a/fs/gfs2/rgrp.c
++++ b/fs/gfs2/rgrp.c
+@@ -2306,7 +2306,7 @@ void gfs2_rgrp_dump(struct seq_file *seq, struct gfs2_rgrpd *rgd,
+ 		       (unsigned long long)rgd->rd_addr, rgd->rd_flags,
+ 		       rgd->rd_free, rgd->rd_free_clone, rgd->rd_dinodes,
+ 		       rgd->rd_requested, rgd->rd_reserved, rgd->rd_extfail_pt);
+-	if (rgd->rd_sbd->sd_args.ar_rgrplvb) {
++	if (rgd->rd_sbd->sd_args.ar_rgrplvb && rgd->rd_rgl) {
+ 		struct gfs2_rgrp_lvb *rgl = rgd->rd_rgl;
+ 
+ 		gfs2_print_dbg(seq, "%s  L: f:%02x b:%u i:%u\n", fs_id_buf,
+-- 
+2.43.0
+
diff --git a/queue-6.1/gpu-drm-radeon-fix-two-memleaks-in-radeon_vm_init.patch b/queue-6.1/gpu-drm-radeon-fix-two-memleaks-in-radeon_vm_init.patch
new file mode 100644
index 00000000000..5c03e2e6c06
--- /dev/null
+++ b/queue-6.1/gpu-drm-radeon-fix-two-memleaks-in-radeon_vm_init.patch
@@ -0,0 +1,48 @@
+From 31e4fcf346da82c1db81ef4c6e1efd67319c0139 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Dec 2023 00:58:42 +0800
+Subject: gpu/drm/radeon: fix two memleaks in radeon_vm_init
+
+From: Zhipeng Lu <alexious@zju.edu.cn>
+
+[ Upstream commit c2709b2d6a537ca0fa0f1da36fdaf07e48ef447d ]
+
+When radeon_bo_create and radeon_vm_clear_bo fail, the vm->page_tables
+allocated before need to be freed. However, neither radeon_vm_init
+itself nor its caller have done such deallocation.
+
+Fixes: 6d2f2944e95e ("drm/radeon: use normal BOs for the page tables v4")
+Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/radeon/radeon_vm.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/radeon/radeon_vm.c b/drivers/gpu/drm/radeon/radeon_vm.c
+index 987cabbf1318..c38b4d5d6a14 100644
+--- a/drivers/gpu/drm/radeon/radeon_vm.c
++++ b/drivers/gpu/drm/radeon/radeon_vm.c
+@@ -1204,13 +1204,17 @@ int radeon_vm_init(struct radeon_device *rdev, struct radeon_vm *vm)
+ 	r = radeon_bo_create(rdev, pd_size, align, true,
+ 			     RADEON_GEM_DOMAIN_VRAM, 0, NULL,
+ 			     NULL, &vm->page_directory);
+-	if (r)
++	if (r) {
++		kfree(vm->page_tables);
++		vm->page_tables = NULL;
+ 		return r;
+-
++	}
+ 	r = radeon_vm_clear_bo(rdev, vm->page_directory);
+ 	if (r) {
+ 		radeon_bo_unref(&vm->page_directory);
+ 		vm->page_directory = NULL;
++		kfree(vm->page_tables);
++		vm->page_tables = NULL;
+ 		return r;
+ 	}
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/ib-iser-prevent-invalidating-wrong-mr.patch b/queue-6.1/ib-iser-prevent-invalidating-wrong-mr.patch
new file mode 100644
index 00000000000..46a75db40c6
--- /dev/null
+++ b/queue-6.1/ib-iser-prevent-invalidating-wrong-mr.patch
@@ -0,0 +1,133 @@
+From 7e9a61eb72b12f18a30802641ddc6a01e03f4f7f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Dec 2023 09:23:11 +0200
+Subject: IB/iser: Prevent invalidating wrong MR
+
+From: Sergey Gorenko <sergeygo@nvidia.com>
+
+[ Upstream commit 2f1888281e67205bd80d3e8f54dbd519a9653f26 ]
+
+The iser_reg_resources structure has two pointers to MR but only one
+mr_valid field. The implementation assumes that we use only *sig_mr when
+pi_enable is true. Otherwise, we use only *mr. However, it is only
+sometimes correct. Read commands without protection information occur even
+when pi_enble is true. For example, the following SCSI commands have a
+Data-In buffer but never have protection information: READ CAPACITY (16),
+INQUIRY, MODE SENSE(6), MAINTENANCE IN. So, we use
+*sig_mr for some SCSI commands and *mr for the other SCSI commands.
+
+In most cases, it works fine because the remote invalidation is applied.
+However, there are two cases when the remote invalidation is not
+applicable.
+ 1. Small write commands when all data is sent as an immediate.
+ 2. The target does not support the remote invalidation feature.
+
+The lazy invalidation is used if the remote invalidation is impossible.
+Since, at the lazy invalidation, we always invalidate the MR we want to
+use, the wrong MR may be invalidated.
+
+To fix the issue, we need a field per MR that indicates the MR needs
+invalidation. Since the ib_mr structure already has such a field, let's
+use ib_mr.need_inval instead of iser_reg_resources.mr_valid.
+
+Fixes: b76a439982f8 ("IB/iser: Use IB_WR_REG_MR_INTEGRITY for PI handover")
+Link: https://lore.kernel.org/r/20231219072311.40989-1-sergeygo@nvidia.com
+Acked-by: Max Gurtovoy <mgurtovoy@nvidia.com>
+Signed-off-by: Sergey Gorenko <sergeygo@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/iser/iscsi_iser.h     | 2 --
+ drivers/infiniband/ulp/iser/iser_initiator.c | 5 ++++-
+ drivers/infiniband/ulp/iser/iser_memory.c    | 8 ++++----
+ drivers/infiniband/ulp/iser/iser_verbs.c     | 1 -
+ 4 files changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/infiniband/ulp/iser/iscsi_iser.h b/drivers/infiniband/ulp/iser/iscsi_iser.h
+index dee8c97ff056..d967d5532459 100644
+--- a/drivers/infiniband/ulp/iser/iscsi_iser.h
++++ b/drivers/infiniband/ulp/iser/iscsi_iser.h
+@@ -317,12 +317,10 @@ struct iser_device {
+  *
+  * @mr:         memory region
+  * @sig_mr:     signature memory region
+- * @mr_valid:   is mr valid indicator
+  */
+ struct iser_reg_resources {
+ 	struct ib_mr                     *mr;
+ 	struct ib_mr                     *sig_mr;
+-	u8				  mr_valid:1;
+ };
+ 
+ /**
+diff --git a/drivers/infiniband/ulp/iser/iser_initiator.c b/drivers/infiniband/ulp/iser/iser_initiator.c
+index 7b83f48f60c5..8ec470c519e8 100644
+--- a/drivers/infiniband/ulp/iser/iser_initiator.c
++++ b/drivers/infiniband/ulp/iser/iser_initiator.c
+@@ -580,7 +580,10 @@ static inline int iser_inv_desc(struct iser_fr_desc *desc, u32 rkey)
+ 		return -EINVAL;
+ 	}
+ 
+-	desc->rsc.mr_valid = 0;
++	if (desc->sig_protected)
++		desc->rsc.sig_mr->need_inval = false;
++	else
++		desc->rsc.mr->need_inval = false;
+ 
+ 	return 0;
+ }
+diff --git a/drivers/infiniband/ulp/iser/iser_memory.c b/drivers/infiniband/ulp/iser/iser_memory.c
+index 29ae2c6a250a..6efcb79c8efe 100644
+--- a/drivers/infiniband/ulp/iser/iser_memory.c
++++ b/drivers/infiniband/ulp/iser/iser_memory.c
+@@ -264,7 +264,7 @@ static int iser_reg_sig_mr(struct iscsi_iser_task *iser_task,
+ 
+ 	iser_set_prot_checks(iser_task->sc, &sig_attrs->check_mask);
+ 
+-	if (rsc->mr_valid)
++	if (rsc->sig_mr->need_inval)
+ 		iser_inv_rkey(&tx_desc->inv_wr, mr, cqe, &wr->wr);
+ 
+ 	ib_update_fast_reg_key(mr, ib_inc_rkey(mr->rkey));
+@@ -288,7 +288,7 @@ static int iser_reg_sig_mr(struct iscsi_iser_task *iser_task,
+ 	wr->access = IB_ACCESS_LOCAL_WRITE |
+ 		     IB_ACCESS_REMOTE_READ |
+ 		     IB_ACCESS_REMOTE_WRITE;
+-	rsc->mr_valid = 1;
++	rsc->sig_mr->need_inval = true;
+ 
+ 	sig_reg->sge.lkey = mr->lkey;
+ 	sig_reg->rkey = mr->rkey;
+@@ -313,7 +313,7 @@ static int iser_fast_reg_mr(struct iscsi_iser_task *iser_task,
+ 	struct ib_reg_wr *wr = &tx_desc->reg_wr;
+ 	int n;
+ 
+-	if (rsc->mr_valid)
++	if (rsc->mr->need_inval)
+ 		iser_inv_rkey(&tx_desc->inv_wr, mr, cqe, &wr->wr);
+ 
+ 	ib_update_fast_reg_key(mr, ib_inc_rkey(mr->rkey));
+@@ -336,7 +336,7 @@ static int iser_fast_reg_mr(struct iscsi_iser_task *iser_task,
+ 		     IB_ACCESS_REMOTE_WRITE |
+ 		     IB_ACCESS_REMOTE_READ;
+ 
+-	rsc->mr_valid = 1;
++	rsc->mr->need_inval = true;
+ 
+ 	reg->sge.lkey = mr->lkey;
+ 	reg->rkey = mr->rkey;
+diff --git a/drivers/infiniband/ulp/iser/iser_verbs.c b/drivers/infiniband/ulp/iser/iser_verbs.c
+index a00ca117303a..057e69164e6d 100644
+--- a/drivers/infiniband/ulp/iser/iser_verbs.c
++++ b/drivers/infiniband/ulp/iser/iser_verbs.c
+@@ -135,7 +135,6 @@ iser_create_fastreg_desc(struct iser_device *device,
+ 			goto err_alloc_mr_integrity;
+ 		}
+ 	}
+-	desc->rsc.mr_valid = 0;
+ 
+ 	return desc;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/ip6_tunnel-fix-nexthdr_fragment-handling-in-ip6_tnl_.patch b/queue-6.1/ip6_tunnel-fix-nexthdr_fragment-handling-in-ip6_tnl_.patch
new file mode 100644
index 00000000000..cf71ae50893
--- /dev/null
+++ b/queue-6.1/ip6_tunnel-fix-nexthdr_fragment-handling-in-ip6_tnl_.patch
@@ -0,0 +1,173 @@
+From 197036817b80cf74931407ac4f0643ccf1f64269 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Jan 2024 17:03:13 +0000
+Subject: ip6_tunnel: fix NEXTHDR_FRAGMENT handling in
+ ip6_tnl_parse_tlv_enc_lim()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit d375b98e0248980681e5e56b712026174d617198 ]
+
+syzbot pointed out [1] that NEXTHDR_FRAGMENT handling is broken.
+
+Reading frag_off can only be done if we pulled enough bytes
+to skb->head. Currently we might access garbage.
+
+[1]
+BUG: KMSAN: uninit-value in ip6_tnl_parse_tlv_enc_lim+0x94f/0xbb0
+ip6_tnl_parse_tlv_enc_lim+0x94f/0xbb0
+ipxip6_tnl_xmit net/ipv6/ip6_tunnel.c:1326 [inline]
+ip6_tnl_start_xmit+0xab2/0x1a70 net/ipv6/ip6_tunnel.c:1432
+__netdev_start_xmit include/linux/netdevice.h:4940 [inline]
+netdev_start_xmit include/linux/netdevice.h:4954 [inline]
+xmit_one net/core/dev.c:3548 [inline]
+dev_hard_start_xmit+0x247/0xa10 net/core/dev.c:3564
+__dev_queue_xmit+0x33b8/0x5130 net/core/dev.c:4349
+dev_queue_xmit include/linux/netdevice.h:3134 [inline]
+neigh_connected_output+0x569/0x660 net/core/neighbour.c:1592
+neigh_output include/net/neighbour.h:542 [inline]
+ip6_finish_output2+0x23a9/0x2b30 net/ipv6/ip6_output.c:137
+ip6_finish_output+0x855/0x12b0 net/ipv6/ip6_output.c:222
+NF_HOOK_COND include/linux/netfilter.h:303 [inline]
+ip6_output+0x323/0x610 net/ipv6/ip6_output.c:243
+dst_output include/net/dst.h:451 [inline]
+ip6_local_out+0xe9/0x140 net/ipv6/output_core.c:155
+ip6_send_skb net/ipv6/ip6_output.c:1952 [inline]
+ip6_push_pending_frames+0x1f9/0x560 net/ipv6/ip6_output.c:1972
+rawv6_push_pending_frames+0xbe8/0xdf0 net/ipv6/raw.c:582
+rawv6_sendmsg+0x2b66/0x2e70 net/ipv6/raw.c:920
+inet_sendmsg+0x105/0x190 net/ipv4/af_inet.c:847
+sock_sendmsg_nosec net/socket.c:730 [inline]
+__sock_sendmsg net/socket.c:745 [inline]
+____sys_sendmsg+0x9c2/0xd60 net/socket.c:2584
+___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638
+__sys_sendmsg net/socket.c:2667 [inline]
+__do_sys_sendmsg net/socket.c:2676 [inline]
+__se_sys_sendmsg net/socket.c:2674 [inline]
+__x64_sys_sendmsg+0x307/0x490 net/socket.c:2674
+do_syscall_x64 arch/x86/entry/common.c:52 [inline]
+do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83
+entry_SYSCALL_64_after_hwframe+0x63/0x6b
+
+Uninit was created at:
+slab_post_alloc_hook+0x129/0xa70 mm/slab.h:768
+slab_alloc_node mm/slub.c:3478 [inline]
+__kmem_cache_alloc_node+0x5c9/0x970 mm/slub.c:3517
+__do_kmalloc_node mm/slab_common.c:1006 [inline]
+__kmalloc_node_track_caller+0x118/0x3c0 mm/slab_common.c:1027
+kmalloc_reserve+0x249/0x4a0 net/core/skbuff.c:582
+pskb_expand_head+0x226/0x1a00 net/core/skbuff.c:2098
+__pskb_pull_tail+0x13b/0x2310 net/core/skbuff.c:2655
+pskb_may_pull_reason include/linux/skbuff.h:2673 [inline]
+pskb_may_pull include/linux/skbuff.h:2681 [inline]
+ip6_tnl_parse_tlv_enc_lim+0x901/0xbb0 net/ipv6/ip6_tunnel.c:408
+ipxip6_tnl_xmit net/ipv6/ip6_tunnel.c:1326 [inline]
+ip6_tnl_start_xmit+0xab2/0x1a70 net/ipv6/ip6_tunnel.c:1432
+__netdev_start_xmit include/linux/netdevice.h:4940 [inline]
+netdev_start_xmit include/linux/netdevice.h:4954 [inline]
+xmit_one net/core/dev.c:3548 [inline]
+dev_hard_start_xmit+0x247/0xa10 net/core/dev.c:3564
+__dev_queue_xmit+0x33b8/0x5130 net/core/dev.c:4349
+dev_queue_xmit include/linux/netdevice.h:3134 [inline]
+neigh_connected_output+0x569/0x660 net/core/neighbour.c:1592
+neigh_output include/net/neighbour.h:542 [inline]
+ip6_finish_output2+0x23a9/0x2b30 net/ipv6/ip6_output.c:137
+ip6_finish_output+0x855/0x12b0 net/ipv6/ip6_output.c:222
+NF_HOOK_COND include/linux/netfilter.h:303 [inline]
+ip6_output+0x323/0x610 net/ipv6/ip6_output.c:243
+dst_output include/net/dst.h:451 [inline]
+ip6_local_out+0xe9/0x140 net/ipv6/output_core.c:155
+ip6_send_skb net/ipv6/ip6_output.c:1952 [inline]
+ip6_push_pending_frames+0x1f9/0x560 net/ipv6/ip6_output.c:1972
+rawv6_push_pending_frames+0xbe8/0xdf0 net/ipv6/raw.c:582
+rawv6_sendmsg+0x2b66/0x2e70 net/ipv6/raw.c:920
+inet_sendmsg+0x105/0x190 net/ipv4/af_inet.c:847
+sock_sendmsg_nosec net/socket.c:730 [inline]
+__sock_sendmsg net/socket.c:745 [inline]
+____sys_sendmsg+0x9c2/0xd60 net/socket.c:2584
+___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638
+__sys_sendmsg net/socket.c:2667 [inline]
+__do_sys_sendmsg net/socket.c:2676 [inline]
+__se_sys_sendmsg net/socket.c:2674 [inline]
+__x64_sys_sendmsg+0x307/0x490 net/socket.c:2674
+do_syscall_x64 arch/x86/entry/common.c:52 [inline]
+do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83
+entry_SYSCALL_64_after_hwframe+0x63/0x6b
+
+CPU: 0 PID: 7345 Comm: syz-executor.3 Not tainted 6.7.0-rc8-syzkaller-00024-gac865f00af29 #0
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
+
+Fixes: fbfa743a9d2a ("ipv6: fix ip6_tnl_parse_tlv_enc_lim()")
+Reported-by: syzbot <syzkaller@googlegroups.com>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Willem de Bruijn <willemb@google.com>
+Reviewed-by: Willem de Bruijn <willemb@google.com>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/ip6_tunnel.c | 26 +++++++++++++-------------
+ 1 file changed, 13 insertions(+), 13 deletions(-)
+
+diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
+index afc922c88d17..9125e92d9917 100644
+--- a/net/ipv6/ip6_tunnel.c
++++ b/net/ipv6/ip6_tunnel.c
+@@ -399,7 +399,7 @@ __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw)
+ 	const struct ipv6hdr *ipv6h = (const struct ipv6hdr *)raw;
+ 	unsigned int nhoff = raw - skb->data;
+ 	unsigned int off = nhoff + sizeof(*ipv6h);
+-	u8 next, nexthdr = ipv6h->nexthdr;
++	u8 nexthdr = ipv6h->nexthdr;
+ 
+ 	while (ipv6_ext_hdr(nexthdr) && nexthdr != NEXTHDR_NONE) {
+ 		struct ipv6_opt_hdr *hdr;
+@@ -410,25 +410,25 @@ __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw)
+ 
+ 		hdr = (struct ipv6_opt_hdr *)(skb->data + off);
+ 		if (nexthdr == NEXTHDR_FRAGMENT) {
+-			struct frag_hdr *frag_hdr = (struct frag_hdr *) hdr;
+-			if (frag_hdr->frag_off)
+-				break;
+ 			optlen = 8;
+ 		} else if (nexthdr == NEXTHDR_AUTH) {
+ 			optlen = ipv6_authlen(hdr);
+ 		} else {
+ 			optlen = ipv6_optlen(hdr);
+ 		}
+-		/* cache hdr->nexthdr, since pskb_may_pull() might
+-		 * invalidate hdr
+-		 */
+-		next = hdr->nexthdr;
+-		if (nexthdr == NEXTHDR_DEST) {
+-			u16 i = 2;
+ 
+-			/* Remember : hdr is no longer valid at this point. */
+-			if (!pskb_may_pull(skb, off + optlen))
++		if (!pskb_may_pull(skb, off + optlen))
++			break;
++
++		hdr = (struct ipv6_opt_hdr *)(skb->data + off);
++		if (nexthdr == NEXTHDR_FRAGMENT) {
++			struct frag_hdr *frag_hdr = (struct frag_hdr *)hdr;
++
++			if (frag_hdr->frag_off)
+ 				break;
++		}
++		if (nexthdr == NEXTHDR_DEST) {
++			u16 i = 2;
+ 
+ 			while (1) {
+ 				struct ipv6_tlv_tnl_enc_lim *tel;
+@@ -449,7 +449,7 @@ __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw)
+ 					i++;
+ 			}
+ 		}
+-		nexthdr = next;
++		nexthdr = hdr->nexthdr;
+ 		off += optlen;
+ 	}
+ 	return 0;
+-- 
+2.43.0
+
diff --git a/queue-6.1/ipmr-support-ip_pktinfo-on-cache-report-igmp-msg.patch b/queue-6.1/ipmr-support-ip_pktinfo-on-cache-report-igmp-msg.patch
new file mode 100644
index 00000000000..6cd5d740cb5
--- /dev/null
+++ b/queue-6.1/ipmr-support-ip_pktinfo-on-cache-report-igmp-msg.patch
@@ -0,0 +1,72 @@
+From ededf05625b249283d7ba16cb0ba992264e64952 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Dec 2023 17:19:35 +0100
+Subject: ipmr: support IP_PKTINFO on cache report IGMP msg
+
+From: Leone Fernando <leone4fernando@gmail.com>
+
+[ Upstream commit bb7403655b3c3eb245d0ee330047cd3e20b3c4af ]
+
+In order to support IP_PKTINFO on those packets, we need to call
+ipv4_pktinfo_prepare.
+
+When sending mrouted/pimd daemons a cache report IGMP msg, it is
+unnecessary to set dst on the newly created skb.
+It used to be necessary on older versions until
+commit d826eb14ecef ("ipv4: PKTINFO doesnt need dst reference") which
+changed the way IP_PKTINFO struct is been retrieved.
+
+Changes from v1:
+1. Undo changes in ipv4_pktinfo_prepare function. use it directly
+   and copy the control block.
+
+Fixes: d826eb14ecef ("ipv4: PKTINFO doesnt need dst reference")
+Signed-off-by: Leone Fernando <leone4fernando@gmail.com>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/ipmr.c | 13 ++++++-------
+ 1 file changed, 6 insertions(+), 7 deletions(-)
+
+diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
+index e04544ac4b45..b807197475a5 100644
+--- a/net/ipv4/ipmr.c
++++ b/net/ipv4/ipmr.c
+@@ -1025,6 +1025,10 @@ static int ipmr_cache_report(const struct mr_table *mrt,
+ 	struct sk_buff *skb;
+ 	int ret;
+ 
++	mroute_sk = rcu_dereference(mrt->mroute_sk);
++	if (!mroute_sk)
++		return -EINVAL;
++
+ 	if (assert == IGMPMSG_WHOLEPKT || assert == IGMPMSG_WRVIFWHOLE)
+ 		skb = skb_realloc_headroom(pkt, sizeof(struct iphdr));
+ 	else
+@@ -1069,7 +1073,8 @@ static int ipmr_cache_report(const struct mr_table *mrt,
+ 		msg = (struct igmpmsg *)skb_network_header(skb);
+ 		msg->im_vif = vifi;
+ 		msg->im_vif_hi = vifi >> 8;
+-		skb_dst_set(skb, dst_clone(skb_dst(pkt)));
++		ipv4_pktinfo_prepare(mroute_sk, pkt);
++		memcpy(skb->cb, pkt->cb, sizeof(skb->cb));
+ 		/* Add our header */
+ 		igmp = skb_put(skb, sizeof(struct igmphdr));
+ 		igmp->type = assert;
+@@ -1079,12 +1084,6 @@ static int ipmr_cache_report(const struct mr_table *mrt,
+ 		skb->transport_header = skb->network_header;
+ 	}
+ 
+-	mroute_sk = rcu_dereference(mrt->mroute_sk);
+-	if (!mroute_sk) {
+-		kfree_skb(skb);
+-		return -EINVAL;
+-	}
+-
+ 	igmpmsg_netlink_event(mrt, skb);
+ 
+ 	/* Deliver to mrouted */
+-- 
+2.43.0
+
diff --git a/queue-6.1/keys-encrypted-add-check-for-strsep.patch b/queue-6.1/keys-encrypted-add-check-for-strsep.patch
new file mode 100644
index 00000000000..15742772601
--- /dev/null
+++ b/queue-6.1/keys-encrypted-add-check-for-strsep.patch
@@ -0,0 +1,37 @@
+From 1cf7474886454ac2cc88f561bce4e95c7da2a272 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Nov 2023 07:36:27 +0000
+Subject: KEYS: encrypted: Add check for strsep
+
+From: Chen Ni <nichen@iscas.ac.cn>
+
+[ Upstream commit b4af096b5df5dd131ab796c79cedc7069d8f4882 ]
+
+Add check for strsep() in order to transfer the error.
+
+Fixes: cd3bc044af48 ("KEYS: encrypted: Instantiate key with user-provided decrypted data")
+Signed-off-by: Chen Ni <nichen@iscas.ac.cn>
+Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/keys/encrypted-keys/encrypted.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/security/keys/encrypted-keys/encrypted.c b/security/keys/encrypted-keys/encrypted.c
+index 1e313982af02..fea7e0937150 100644
+--- a/security/keys/encrypted-keys/encrypted.c
++++ b/security/keys/encrypted-keys/encrypted.c
+@@ -237,6 +237,10 @@ static int datablob_parse(char *datablob, const char **format,
+ 			break;
+ 		}
+ 		*decrypted_data = strsep(&datablob, " \t");
++		if (!*decrypted_data) {
++			pr_info("encrypted_key: decrypted_data is missing\n");
++			break;
++		}
+ 		ret = 0;
+ 		break;
+ 	case Opt_load:
+-- 
+2.43.0
+
diff --git a/queue-6.1/kselftest-alsa-mixer-test-fix-the-number-of-paramete.patch b/queue-6.1/kselftest-alsa-mixer-test-fix-the-number-of-paramete.patch
new file mode 100644
index 00000000000..3b20d12a02f
--- /dev/null
+++ b/queue-6.1/kselftest-alsa-mixer-test-fix-the-number-of-paramete.patch
@@ -0,0 +1,58 @@
+From 362d5896a6c6b9dc71e488bbb18a468138ec5a17 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 Jan 2024 18:37:02 +0100
+Subject: kselftest/alsa - mixer-test: fix the number of parameters to
+ ksft_exit_fail_msg()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Mirsad Todorovac <mirsad.todorovac@alu.unizg.hr>
+
+[ Upstream commit 8c51c13dc63d46e754c44215eabc0890a8bd9bfb ]
+
+Minor fix in the number of arguments to error reporting function in the
+test program as reported by GCC 13.2.0 warning.
+
+mixer-test.c: In function ‘find_controls’:
+mixer-test.c:169:44: warning: too many arguments for format [-Wformat-extra-args]
+  169 |                         ksft_exit_fail_msg("snd_ctl_poll_descriptors() failed for %d\n",
+      |                                            ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+The number of arguments in call to ksft_exit_fail_msg() doesn't correspond
+to the format specifiers, so this is adjusted resembling the sibling calls
+to the error function.
+
+Fixes: b1446bda56456 ("kselftest: alsa: Check for event generation when we write to controls")
+Cc: Mark Brown <broonie@kernel.org>
+Cc: Jaroslav Kysela <perex@perex.cz>
+Cc: Takashi Iwai <tiwai@suse.com>
+Cc: Shuah Khan <shuah@kernel.org>
+Cc: linux-sound@vger.kernel.org
+Cc: linux-kselftest@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Mirsad Todorovac <mirsad.todorovac@alu.unizg.hr>
+Acked-by: Mark Brown <broonie@kernel.org>
+Link: https://lore.kernel.org/r/20240107173704.937824-2-mirsad.todorovac@alu.unizg.hr
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/alsa/mixer-test.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/alsa/mixer-test.c b/tools/testing/selftests/alsa/mixer-test.c
+index 37da902545a4..d59910658c8c 100644
+--- a/tools/testing/selftests/alsa/mixer-test.c
++++ b/tools/testing/selftests/alsa/mixer-test.c
+@@ -205,7 +205,7 @@ static void find_controls(void)
+ 		err = snd_ctl_poll_descriptors(card_data->handle,
+ 					       &card_data->pollfd, 1);
+ 		if (err != 1) {
+-			ksft_exit_fail_msg("snd_ctl_poll_descriptors() failed for %d\n",
++			ksft_exit_fail_msg("snd_ctl_poll_descriptors() failed for card %d: %d\n",
+ 				       card, err);
+ 		}
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/kselftest-alsa-mixer-test-fix-the-print-format-speci.patch b/queue-6.1/kselftest-alsa-mixer-test-fix-the-print-format-speci.patch
new file mode 100644
index 00000000000..8d52d9b7a69
--- /dev/null
+++ b/queue-6.1/kselftest-alsa-mixer-test-fix-the-print-format-speci.patch
@@ -0,0 +1,64 @@
+From d8bb425ff2e09ad9467ab470005a419dbec66e28 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 Jan 2024 18:37:04 +0100
+Subject: kselftest/alsa - mixer-test: Fix the print format specifier warning
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Mirsad Todorovac <mirsad.todorovac@alu.unizg.hr>
+
+[ Upstream commit 3f47c1ebe5ca9c5883e596c7888dec4bec0176d8 ]
+
+The GCC 13.2.0 compiler issued the following warning:
+
+mixer-test.c: In function ‘ctl_value_index_valid’:
+mixer-test.c:322:79: warning: format ‘%lld’ expects argument of type ‘long long int’, \
+			      but argument 5 has type ‘long int’ [-Wformat=]
+  322 |                         ksft_print_msg("%s.%d value %lld more than maximum %lld\n",
+      |                                                                            ~~~^
+      |                                                                               |
+      |                                                                               long long int
+      |                                                                            %ld
+  323 |                                        ctl->name, index, int64_val,
+  324 |                                        snd_ctl_elem_info_get_max(ctl->info));
+      |                                        ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+      |                                        |
+      |                                        long int
+
+Fixing the format specifier as advised by the compiler suggestion removes the
+warning.
+
+Fixes: 3f48b137d88e7 ("kselftest: alsa: Factor out check that values meet constraints")
+Cc: Mark Brown <broonie@kernel.org>
+Cc: Jaroslav Kysela <perex@perex.cz>
+Cc: Takashi Iwai <tiwai@suse.com>
+Cc: Shuah Khan <shuah@kernel.org>
+Cc: linux-sound@vger.kernel.org
+Cc: linux-kselftest@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Mirsad Todorovac <mirsad.todorovac@alu.unizg.hr>
+Acked-by: Mark Brown <broonie@kernel.org>
+Link: https://lore.kernel.org/r/20240107173704.937824-3-mirsad.todorovac@alu.unizg.hr
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/alsa/mixer-test.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/alsa/mixer-test.c b/tools/testing/selftests/alsa/mixer-test.c
+index d59910658c8c..9ad39db32d14 100644
+--- a/tools/testing/selftests/alsa/mixer-test.c
++++ b/tools/testing/selftests/alsa/mixer-test.c
+@@ -358,7 +358,7 @@ static bool ctl_value_index_valid(struct ctl_data *ctl,
+ 		}
+ 
+ 		if (int64_val > snd_ctl_elem_info_get_max64(ctl->info)) {
+-			ksft_print_msg("%s.%d value %lld more than maximum %lld\n",
++			ksft_print_msg("%s.%d value %lld more than maximum %ld\n",
+ 				       ctl->name, index, int64_val,
+ 				       snd_ctl_elem_info_get_max(ctl->info));
+ 			return false;
+-- 
+2.43.0
+
diff --git a/queue-6.1/ksmbd-validate-the-zero-field-of-packet-header.patch b/queue-6.1/ksmbd-validate-the-zero-field-of-packet-header.patch
new file mode 100644
index 00000000000..9754a84a8e2
--- /dev/null
+++ b/queue-6.1/ksmbd-validate-the-zero-field-of-packet-header.patch
@@ -0,0 +1,48 @@
+From 3a91a8646711fcd583fb0eecfe1de6e88053f9b0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Dec 2023 14:56:47 +0800
+Subject: ksmbd: validate the zero field of packet header
+
+From: Li Nan <linan122@huawei.com>
+
+[ Upstream commit 516b3eb8c8065f7465f87608d37a7ed08298c7a5 ]
+
+The SMB2 Protocol requires that "The first byte of the Direct TCP
+transport packet header MUST be zero (0x00)"[1]. Commit 1c1bcf2d3ea0
+("ksmbd: validate smb request protocol id") removed the validation of
+this 1-byte zero. Add the validation back now.
+
+[1]: [MS-SMB2] - v20230227, page 30.
+https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-SMB2/%5bMS-SMB2%5d-230227.pdf
+
+Fixes: 1c1bcf2d3ea0 ("ksmbd: validate smb request protocol id")
+Signed-off-by: Li Nan <linan122@huawei.com>
+Acked-by: Tom Talpey <tom@talpey.com>
+Acked-by: Namjae Jeon <linkinjeon@kernel.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/server/smb_common.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/fs/smb/server/smb_common.c b/fs/smb/server/smb_common.c
+index d160363c09eb..e90a1e8c1951 100644
+--- a/fs/smb/server/smb_common.c
++++ b/fs/smb/server/smb_common.c
+@@ -158,8 +158,12 @@ int ksmbd_verify_smb_message(struct ksmbd_work *work)
+  */
+ bool ksmbd_smb_request(struct ksmbd_conn *conn)
+ {
+-	__le32 *proto = (__le32 *)smb2_get_msg(conn->request_buf);
++	__le32 *proto;
+ 
++	if (conn->request_buf[0] != 0)
++		return false;
++
++	proto = (__le32 *)smb2_get_msg(conn->request_buf);
+ 	if (*proto == SMB2_COMPRESSION_TRANSFORM_ID) {
+ 		pr_err_ratelimited("smb2 compression not support yet");
+ 		return false;
+-- 
+2.43.0
+
diff --git a/queue-6.1/kunit-debugfs-fix-unchecked-dereference-in-debugfs_p.patch b/queue-6.1/kunit-debugfs-fix-unchecked-dereference-in-debugfs_p.patch
new file mode 100644
index 00000000000..60bfec43d7d
--- /dev/null
+++ b/queue-6.1/kunit-debugfs-fix-unchecked-dereference-in-debugfs_p.patch
@@ -0,0 +1,50 @@
+From 8ad5b5a78a64f03b0ab2b10e29501dd44996c793 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Oct 2023 10:47:58 +0000
+Subject: kunit: debugfs: Fix unchecked dereference in debugfs_print_results()
+
+From: Richard Fitzgerald <rf@opensource.cirrus.com>
+
+[ Upstream commit 34dfd5bb2e5507e69d9b6d6c90f546600c7a4977 ]
+
+Move the call to kunit_suite_has_succeeded() after the check that
+the kunit_suite pointer is valid.
+
+This was found by smatch:
+
+ lib/kunit/debugfs.c:66 debugfs_print_results() warn: variable
+ dereferenced before check 'suite' (see line 63)
+
+Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com>
+Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
+Fixes: 38289a26e1b8 ("kunit: fix debugfs code to use enum kunit_status, not bool")
+Reviewed-by: Rae Moar <rmoar@google.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/kunit/debugfs.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/lib/kunit/debugfs.c b/lib/kunit/debugfs.c
+index b08bb1fba106..de5e71458358 100644
+--- a/lib/kunit/debugfs.c
++++ b/lib/kunit/debugfs.c
+@@ -52,12 +52,14 @@ static void debugfs_print_result(struct seq_file *seq,
+ static int debugfs_print_results(struct seq_file *seq, void *v)
+ {
+ 	struct kunit_suite *suite = (struct kunit_suite *)seq->private;
+-	enum kunit_status success = kunit_suite_has_succeeded(suite);
++	enum kunit_status success;
+ 	struct kunit_case *test_case;
+ 
+ 	if (!suite)
+ 		return 0;
+ 
++	success = kunit_suite_has_succeeded(suite);
++
+ 	/* Print KTAP header so the debugfs log can be parsed as valid KTAP. */
+ 	seq_puts(seq, "KTAP version 1\n");
+ 	seq_puts(seq, "1..1\n");
+-- 
+2.43.0
+
diff --git a/queue-6.1/loongarch-signal.c-add-header-file-to-fix-build-erro.patch b/queue-6.1/loongarch-signal.c-add-header-file-to-fix-build-erro.patch
new file mode 100644
index 00000000000..97d0d9e9882
--- /dev/null
+++ b/queue-6.1/loongarch-signal.c-add-header-file-to-fix-build-erro.patch
@@ -0,0 +1,44 @@
+From 9251004617c7dbfcbcad67cef8e69bd63c12808d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Dec 2023 20:58:25 -0800
+Subject: LoongArch: signal.c: add header file to fix build error
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit c968b99f868dd82ebcafec9788ce18334da177b6 ]
+
+loongarch's signal.c uses rseq_signal_deliver() so it should
+pull in the appropriate header to prevent a build error:
+
+../arch/loongarch/kernel/signal.c: In function 'handle_signal':
+../arch/loongarch/kernel/signal.c:1034:9: error: implicit declaration of function 'rseq_signal_deliver' [-Werror=implicit-function-declaration]
+ 1034 |         rseq_signal_deliver(ksig, regs);
+      |         ^~~~~~~~~~~~~~~~~~~
+
+Fixes: b74baf4ad05b ("LoongArch: Add signal handling support")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Cc: Huacai Chen <chenhuacai@kernel.org>
+Cc: WANG Xuerui <kernel@xen0n.name>
+Cc: loongarch@lists.linux.dev
+Cc: Kent Overstreet <kent.overstreet@linux.dev>
+Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/loongarch/kernel/signal.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/loongarch/kernel/signal.c b/arch/loongarch/kernel/signal.c
+index 8f5b7986374b..d51f15a50d10 100644
+--- a/arch/loongarch/kernel/signal.c
++++ b/arch/loongarch/kernel/signal.c
+@@ -14,6 +14,7 @@
+ #include <linux/cache.h>
+ #include <linux/context_tracking.h>
+ #include <linux/irqflags.h>
++#include <linux/rseq.h>
+ #include <linux/sched.h>
+ #include <linux/mm.h>
+ #include <linux/personality.h>
+-- 
+2.43.0
+
diff --git a/queue-6.1/md-synchronize-flush-io-with-array-reconfiguration.patch b/queue-6.1/md-synchronize-flush-io-with-array-reconfiguration.patch
new file mode 100644
index 00000000000..357bdedebaa
--- /dev/null
+++ b/queue-6.1/md-synchronize-flush-io-with-array-reconfiguration.patch
@@ -0,0 +1,96 @@
+From de627507edbf1c0b390ae7accb0a7f9b7b4c165b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Nov 2023 10:02:34 +0800
+Subject: md: synchronize flush io with array reconfiguration
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit fa2bbff7b0b4e211fec5e5686ef96350690597b5 ]
+
+Currently rcu is used to protect iterating rdev from submit_flushes():
+
+submit_flushes			remove_and_add_spares
+				synchronize_rcu
+				pers->hot_remove_disk()
+ rcu_read_lock()
+ rdev_for_each_rcu
+  if (rdev->raid_disk >= 0)
+				rdev->radi_disk = -1;
+   atomic_inc(&rdev->nr_pending)
+   rcu_read_unlock()
+   bi = bio_alloc_bioset()
+   bi->bi_end_io = md_end_flush
+   bi->private = rdev
+   submit_bio
+   // issue io for removed rdev
+
+Fix this problem by grabbing 'acive_io' before iterating rdev, make sure
+that remove_and_add_spares() won't concurrent with submit_flushes().
+
+Fixes: a2826aa92e2e ("md: support barrier requests on all personalities.")
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Signed-off-by: Song Liu <song@kernel.org>
+Link: https://lore.kernel.org/r/20231129020234.1586910-1-yukuai1@huaweicloud.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/md.c | 22 ++++++++++++++++------
+ 1 file changed, 16 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index 0c2801d77090..6120f26a7969 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -528,6 +528,9 @@ static void md_end_flush(struct bio *bio)
+ 	rdev_dec_pending(rdev, mddev);
+ 
+ 	if (atomic_dec_and_test(&mddev->flush_pending)) {
++		/* The pair is percpu_ref_get() from md_flush_request() */
++		percpu_ref_put(&mddev->active_io);
++
+ 		/* The pre-request flush has finished */
+ 		queue_work(md_wq, &mddev->flush_work);
+ 	}
+@@ -547,12 +550,8 @@ static void submit_flushes(struct work_struct *ws)
+ 	rdev_for_each_rcu(rdev, mddev)
+ 		if (rdev->raid_disk >= 0 &&
+ 		    !test_bit(Faulty, &rdev->flags)) {
+-			/* Take two references, one is dropped
+-			 * when request finishes, one after
+-			 * we reclaim rcu_read_lock
+-			 */
+ 			struct bio *bi;
+-			atomic_inc(&rdev->nr_pending);
++
+ 			atomic_inc(&rdev->nr_pending);
+ 			rcu_read_unlock();
+ 			bi = bio_alloc_bioset(rdev->bdev, 0,
+@@ -563,7 +562,6 @@ static void submit_flushes(struct work_struct *ws)
+ 			atomic_inc(&mddev->flush_pending);
+ 			submit_bio(bi);
+ 			rcu_read_lock();
+-			rdev_dec_pending(rdev, mddev);
+ 		}
+ 	rcu_read_unlock();
+ 	if (atomic_dec_and_test(&mddev->flush_pending))
+@@ -616,6 +614,18 @@ bool md_flush_request(struct mddev *mddev, struct bio *bio)
+ 	/* new request after previous flush is completed */
+ 	if (ktime_after(req_start, mddev->prev_flush_start)) {
+ 		WARN_ON(mddev->flush_bio);
++		/*
++		 * Grab a reference to make sure mddev_suspend() will wait for
++		 * this flush to be done.
++		 *
++		 * md_flush_reqeust() is called under md_handle_request() and
++		 * 'active_io' is already grabbed, hence percpu_ref_is_zero()
++		 * won't pass, percpu_ref_tryget_live() can't be used because
++		 * percpu_ref_kill() can be called by mddev_suspend()
++		 * concurrently.
++		 */
++		WARN_ON(percpu_ref_is_zero(&mddev->active_io));
++		percpu_ref_get(&mddev->active_io);
+ 		mddev->flush_bio = bio;
+ 		bio = NULL;
+ 	}
+-- 
+2.43.0
+
diff --git a/queue-6.1/media-cx231xx-fix-a-memleak-in-cx231xx_init_isoc.patch b/queue-6.1/media-cx231xx-fix-a-memleak-in-cx231xx_init_isoc.patch
new file mode 100644
index 00000000000..60d8ac80dba
--- /dev/null
+++ b/queue-6.1/media-cx231xx-fix-a-memleak-in-cx231xx_init_isoc.patch
@@ -0,0 +1,51 @@
+From aaaf09e4fd5ee9786bfc3a65ba4609dbee25ca2a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Dec 2023 21:22:55 +0800
+Subject: media: cx231xx: fix a memleak in cx231xx_init_isoc
+
+From: Zhipeng Lu <alexious@zju.edu.cn>
+
+[ Upstream commit 5d3c8990e2bbf929cb211563dadd70708f42e4e6 ]
+
+The dma_q->p_left_data alloced by kzalloc should be freed in all the
+following error handling paths. However, it hasn't been freed in the
+allocation error paths of dev->video_mode.isoc_ctl.urb and
+dev->video_mode.isoc_ctl.transfer_buffer.
+
+On the other hand, the dma_q->p_left_data did be freed in the
+error-handling paths after that of dev->video_mode.isoc_ctl.urb and
+dev->video_mode.isoc_ctl.transfer_buffer, by calling
+cx231xx_uninit_isoc(dev). So the same free operation should be done in
+error-handling paths of those two allocation.
+
+Fixes: 64fbf4445526 ("[media] cx231xx: Added support for Carraera, Shelby, RDx_253S and VIDEO_GRABBER")
+Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/cx231xx/cx231xx-core.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/media/usb/cx231xx/cx231xx-core.c b/drivers/media/usb/cx231xx/cx231xx-core.c
+index 727e6268567f..f1feccc28bf0 100644
+--- a/drivers/media/usb/cx231xx/cx231xx-core.c
++++ b/drivers/media/usb/cx231xx/cx231xx-core.c
+@@ -1024,6 +1024,7 @@ int cx231xx_init_isoc(struct cx231xx *dev, int max_packets,
+ 	if (!dev->video_mode.isoc_ctl.urb) {
+ 		dev_err(dev->dev,
+ 			"cannot alloc memory for usb buffers\n");
++		kfree(dma_q->p_left_data);
+ 		return -ENOMEM;
+ 	}
+ 
+@@ -1033,6 +1034,7 @@ int cx231xx_init_isoc(struct cx231xx *dev, int max_packets,
+ 		dev_err(dev->dev,
+ 			"cannot allocate memory for usbtransfer\n");
+ 		kfree(dev->video_mode.isoc_ctl.urb);
++		kfree(dma_q->p_left_data);
+ 		return -ENOMEM;
+ 	}
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/media-dt-bindings-media-rkisp1-fix-the-port-descript.patch b/queue-6.1/media-dt-bindings-media-rkisp1-fix-the-port-descript.patch
new file mode 100644
index 00000000000..6f10fef63f5
--- /dev/null
+++ b/queue-6.1/media-dt-bindings-media-rkisp1-fix-the-port-descript.patch
@@ -0,0 +1,54 @@
+From 0fd51b5e42bf34a8946030cac16261431d00fde6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Nov 2023 17:44:07 +0100
+Subject: media: dt-bindings: media: rkisp1: Fix the port description for the
+ parallel interface
+
+From: Mehdi Djait <mehdi.djait@bootlin.com>
+
+[ Upstream commit 25bf28b25a2afa1864b7143259443160d9163ea0 ]
+
+The bus-type belongs to the endpoint's properties and should therefore
+be moved.
+
+Link: https://lore.kernel.org/r/20231115164407.99876-1-mehdi.djait@bootlin.com
+
+Fixes: 6a0eaa25bf36 ("media: dt-bindings: media: rkisp1: Add port for parallel interface")
+Signed-off-by: Mehdi Djait <mehdi.djait@bootlin.com>
+Acked-by: Conor Dooley <conor.dooley@microchip.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../devicetree/bindings/media/rockchip-isp1.yaml      | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/Documentation/devicetree/bindings/media/rockchip-isp1.yaml b/Documentation/devicetree/bindings/media/rockchip-isp1.yaml
+index b3661d7d4357..2a0ad332f5ce 100644
+--- a/Documentation/devicetree/bindings/media/rockchip-isp1.yaml
++++ b/Documentation/devicetree/bindings/media/rockchip-isp1.yaml
+@@ -90,15 +90,16 @@ properties:
+         description: connection point for input on the parallel interface
+ 
+         properties:
+-          bus-type:
+-            enum: [5, 6]
+-
+           endpoint:
+             $ref: video-interfaces.yaml#
+             unevaluatedProperties: false
+ 
+-        required:
+-          - bus-type
++            properties:
++              bus-type:
++                enum: [5, 6]
++
++            required:
++              - bus-type
+ 
+     anyOf:
+       - required:
+-- 
+2.43.0
+
diff --git a/queue-6.1/media-dvb-frontends-m88ds3103-fix-a-memory-leak-in-a.patch b/queue-6.1/media-dvb-frontends-m88ds3103-fix-a-memory-leak-in-a.patch
new file mode 100644
index 00000000000..7f1c53e734d
--- /dev/null
+++ b/queue-6.1/media-dvb-frontends-m88ds3103-fix-a-memory-leak-in-a.patch
@@ -0,0 +1,54 @@
+From 5fbf169d89c33b11bfc6f3c7545624a6a492e9c6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Oct 2023 08:20:26 +0100
+Subject: media: dvb-frontends: m88ds3103: Fix a memory leak in an error
+ handling path of m88ds3103_probe()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 5b2f885e2f6f482d05c23f04c8240f7b4fc5bdb5 ]
+
+If an error occurs after a successful i2c_mux_add_adapter(), then
+i2c_mux_del_adapters() should be called to free some resources, as
+already done in the remove function.
+
+Fixes: e6089feca460 ("media: m88ds3103: Add support for ds3103b demod")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/dvb-frontends/m88ds3103.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/dvb-frontends/m88ds3103.c b/drivers/media/dvb-frontends/m88ds3103.c
+index 9a0d43c7ba9e..ce99f7dfb5a5 100644
+--- a/drivers/media/dvb-frontends/m88ds3103.c
++++ b/drivers/media/dvb-frontends/m88ds3103.c
+@@ -1894,7 +1894,7 @@ static int m88ds3103_probe(struct i2c_client *client,
+ 		/* get frontend address */
+ 		ret = regmap_read(dev->regmap, 0x29, &utmp);
+ 		if (ret)
+-			goto err_kfree;
++			goto err_del_adapters;
+ 		dev->dt_addr = ((utmp & 0x80) == 0) ? 0x42 >> 1 : 0x40 >> 1;
+ 		dev_dbg(&client->dev, "dt addr is 0x%02x\n", dev->dt_addr);
+ 
+@@ -1902,11 +1902,14 @@ static int m88ds3103_probe(struct i2c_client *client,
+ 						      dev->dt_addr);
+ 		if (IS_ERR(dev->dt_client)) {
+ 			ret = PTR_ERR(dev->dt_client);
+-			goto err_kfree;
++			goto err_del_adapters;
+ 		}
+ 	}
+ 
+ 	return 0;
++
++err_del_adapters:
++	i2c_mux_del_adapters(dev->muxc);
+ err_kfree:
+ 	kfree(dev);
+ err:
+-- 
+2.43.0
+
diff --git a/queue-6.1/media-dvbdev-drop-refcount-on-error-path-in-dvb_devi.patch b/queue-6.1/media-dvbdev-drop-refcount-on-error-path-in-dvb_devi.patch
new file mode 100644
index 00000000000..def325dc089
--- /dev/null
+++ b/queue-6.1/media-dvbdev-drop-refcount-on-error-path-in-dvb_devi.patch
@@ -0,0 +1,35 @@
+From 8b8673ec3b6289577d58bef2c39b61fb169d1226 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Oct 2023 12:53:33 +0300
+Subject: media: dvbdev: drop refcount on error path in dvb_device_open()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit a2dd235df435a05d389240be748909ada91201d2 ]
+
+If call to file->f_op->open() fails, then call dvb_device_put(dvbdev).
+
+Fixes: 0fc044b2b5e2 ("media: dvbdev: adopts refcnt to avoid UAF")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/dvb-core/dvbdev.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/media/dvb-core/dvbdev.c b/drivers/media/dvb-core/dvbdev.c
+index 9f9a97652708..d352e028491a 100644
+--- a/drivers/media/dvb-core/dvbdev.c
++++ b/drivers/media/dvb-core/dvbdev.c
+@@ -104,6 +104,8 @@ static int dvb_device_open(struct inode *inode, struct file *file)
+ 			err = file->f_op->open(inode, file);
+ 		up_read(&minor_rwsem);
+ 		mutex_unlock(&dvbdev_mutex);
++		if (err)
++			dvb_device_put(dvbdev);
+ 		return err;
+ 	}
+ fail:
+-- 
+2.43.0
+
diff --git a/queue-6.1/media-imx-mipi-csis-fix-clock-handling-in-remove.patch b/queue-6.1/media-imx-mipi-csis-fix-clock-handling-in-remove.patch
new file mode 100644
index 00000000000..faca443778a
--- /dev/null
+++ b/queue-6.1/media-imx-mipi-csis-fix-clock-handling-in-remove.patch
@@ -0,0 +1,46 @@
+From 91a557d48a69ed91b7be227ca59dfc0e9d756239 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Nov 2023 16:21:34 +0100
+Subject: media: imx-mipi-csis: Fix clock handling in remove()
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+[ Upstream commit 5705b0e0eb550ff834125a46a4ef99b62093d83d ]
+
+The driver always calls mipi_csis_runtime_suspend() and
+mipi_csis_clk_disable() in remove(). This causes multiple WARNs from the
+kernel, as the clocks get disabled too many times.
+
+Fix the remove() to call mipi_csis_runtime_suspend() and
+mipi_csis_clk_disable() in a way that reverses what is done in probe().
+
+Link: https://lore.kernel.org/r/20231122-imx-csis-v2-1-e44b8dc4cb66@ideasonboard.com
+
+Fixes: 7807063b862b ("media: staging/imx7: add MIPI CSI-2 receiver subdev for i.MX7")
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/nxp/imx-mipi-csis.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/nxp/imx-mipi-csis.c b/drivers/media/platform/nxp/imx-mipi-csis.c
+index 905072871ed2..196f2bba419f 100644
+--- a/drivers/media/platform/nxp/imx-mipi-csis.c
++++ b/drivers/media/platform/nxp/imx-mipi-csis.c
+@@ -1553,8 +1553,10 @@ static int mipi_csis_remove(struct platform_device *pdev)
+ 	v4l2_async_nf_cleanup(&csis->notifier);
+ 	v4l2_async_unregister_subdev(&csis->sd);
+ 
++	if (!pm_runtime_enabled(&pdev->dev))
++		mipi_csis_runtime_suspend(&pdev->dev);
++
+ 	pm_runtime_disable(&pdev->dev);
+-	mipi_csis_runtime_suspend(&pdev->dev);
+ 	mipi_csis_clk_disable(csis);
+ 	media_entity_cleanup(&csis->sd.entity);
+ 	fwnode_handle_put(csis->sd.fwnode);
+-- 
+2.43.0
+
diff --git a/queue-6.1/media-mtk-jpeg-remove-cancel-worker-in-mtk_jpeg_remo.patch b/queue-6.1/media-mtk-jpeg-remove-cancel-worker-in-mtk_jpeg_remo.patch
new file mode 100644
index 00000000000..6be62ed8a84
--- /dev/null
+++ b/queue-6.1/media-mtk-jpeg-remove-cancel-worker-in-mtk_jpeg_remo.patch
@@ -0,0 +1,43 @@
+From 05b36afd7a84c1fdd0f6d1832bff546ccecfb9b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Nov 2023 15:48:09 +0100
+Subject: media: mtk-jpeg: Remove cancel worker in mtk_jpeg_remove to avoid the
+ crash of multi-core JPEG devices
+
+From: Zheng Wang <zyytlz.wz@163.com>
+
+[ Upstream commit d8212c5c87c143ca01b78f6bf61244af07e0058e ]
+
+This patch reverts commit c677d7ae8314
+("media: mtk-jpeg: Fix use after free bug due to uncanceled work").
+The job_timeout_work is initialized only for
+the single-core JPEG device so it will cause the crash for multi-core
+JPEG devices.
+
+Fix it by removing the cancel_delayed_work_sync function.
+
+Fixes: c677d7ae8314 ("media: mtk-jpeg: Fix use after free bug due to uncanceled work")
+Signed-off-by: Zheng Wang <zyytlz.wz@163.com>
+Signed-off-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
+index e9a4f8abd21c..3071b61946c3 100644
+--- a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
++++ b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
+@@ -1412,7 +1412,6 @@ static int mtk_jpeg_remove(struct platform_device *pdev)
+ {
+ 	struct mtk_jpeg_dev *jpeg = platform_get_drvdata(pdev);
+ 
+-	cancel_delayed_work_sync(&jpeg->job_timeout_work);
+ 	pm_runtime_disable(&pdev->dev);
+ 	video_unregister_device(jpeg->vdev);
+ 	v4l2_m2m_release(jpeg->m2m_dev);
+-- 
+2.43.0
+
diff --git a/queue-6.1/media-mtk-jpegdec-export-jpeg-decoder-functions.patch b/queue-6.1/media-mtk-jpegdec-export-jpeg-decoder-functions.patch
new file mode 100644
index 00000000000..086932402a3
--- /dev/null
+++ b/queue-6.1/media-mtk-jpegdec-export-jpeg-decoder-functions.patch
@@ -0,0 +1,71 @@
+From 3834f4aa9f7098028d69c2e9b15c12d42ab60d27 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Sep 2022 17:08:11 +0800
+Subject: media: mtk-jpegdec: export jpeg decoder functions
+
+From: kyrie wu <kyrie.wu@mediatek.com>
+
+[ Upstream commit 08d530a8da706f157e9dcb4d9b7b4f0eff908ab9 ]
+
+mtk jpeg decoder is built as a module, export some functions to make them
+visible by other modules.
+
+Signed-off-by: kyrie wu <kyrie.wu@mediatek.com>
+Signed-off-by: irui wang <irui.wang@mediatek.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Stable-dep-of: d8212c5c87c1 ("media: mtk-jpeg: Remove cancel worker in mtk_jpeg_remove to avoid the crash of multi-core JPEG devices")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/mediatek/jpeg/mtk_jpeg_dec_hw.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_dec_hw.c b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_dec_hw.c
+index afbbfd5d02bc..6d200e23754e 100644
+--- a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_dec_hw.c
++++ b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_dec_hw.c
+@@ -188,6 +188,7 @@ int mtk_jpeg_dec_fill_param(struct mtk_jpeg_dec_param *param)
+ 
+ 	return 0;
+ }
++EXPORT_SYMBOL_GPL(mtk_jpeg_dec_fill_param);
+ 
+ u32 mtk_jpeg_dec_get_int_status(void __iomem *base)
+ {
+@@ -199,6 +200,7 @@ u32 mtk_jpeg_dec_get_int_status(void __iomem *base)
+ 
+ 	return ret;
+ }
++EXPORT_SYMBOL_GPL(mtk_jpeg_dec_get_int_status);
+ 
+ u32 mtk_jpeg_dec_enum_result(u32 irq_result)
+ {
+@@ -215,11 +217,13 @@ u32 mtk_jpeg_dec_enum_result(u32 irq_result)
+ 
+ 	return MTK_JPEG_DEC_RESULT_ERROR_UNKNOWN;
+ }
++EXPORT_SYMBOL_GPL(mtk_jpeg_dec_enum_result);
+ 
+ void mtk_jpeg_dec_start(void __iomem *base)
+ {
+ 	writel(0, base + JPGDEC_REG_TRIG);
+ }
++EXPORT_SYMBOL_GPL(mtk_jpeg_dec_start);
+ 
+ static void mtk_jpeg_dec_soft_reset(void __iomem *base)
+ {
+@@ -239,6 +243,7 @@ void mtk_jpeg_dec_reset(void __iomem *base)
+ 	mtk_jpeg_dec_soft_reset(base);
+ 	mtk_jpeg_dec_hard_reset(base);
+ }
++EXPORT_SYMBOL_GPL(mtk_jpeg_dec_reset);
+ 
+ static void mtk_jpeg_dec_set_brz_factor(void __iomem *base, u8 yscale_w,
+ 					u8 yscale_h, u8 uvscale_w, u8 uvscale_h)
+@@ -407,3 +412,4 @@ void mtk_jpeg_dec_set_config(void __iomem *base,
+ 				   config->dma_last_mcu);
+ 	mtk_jpeg_dec_set_pause_mcu_idx(base, config->total_mcu);
+ }
++EXPORT_SYMBOL_GPL(mtk_jpeg_dec_set_config);
+-- 
+2.43.0
+
diff --git a/queue-6.1/media-pvrusb2-fix-use-after-free-on-context-disconne.patch b/queue-6.1/media-pvrusb2-fix-use-after-free-on-context-disconne.patch
new file mode 100644
index 00000000000..c574b27eae3
--- /dev/null
+++ b/queue-6.1/media-pvrusb2-fix-use-after-free-on-context-disconne.patch
@@ -0,0 +1,46 @@
+From 0f45ba33a4b75164377685bbd615b8f1abfbff59 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Oct 2023 01:09:12 +0200
+Subject: media: pvrusb2: fix use after free on context disconnection
+
+From: Ricardo B. Marliere <ricardo@marliere.net>
+
+[ Upstream commit ded85b0c0edd8f45fec88783d7555a5b982449c1 ]
+
+Upon module load, a kthread is created targeting the
+pvr2_context_thread_func function, which may call pvr2_context_destroy
+and thus call kfree() on the context object. However, that might happen
+before the usb hub_event handler is able to notify the driver. This
+patch adds a sanity check before the invalid read reported by syzbot,
+within the context disconnection call stack.
+
+Reported-and-tested-by: syzbot+621409285c4156a009b3@syzkaller.appspotmail.com
+Closes: https://lore.kernel.org/all/000000000000a02a4205fff8eb92@google.com/
+
+Fixes: e5be15c63804 ("V4L/DVB (7711): pvrusb2: Fix race on module unload")
+Signed-off-by: Ricardo B. Marliere <ricardo@marliere.net>
+Acked-by: Mike Isely <isely@pobox.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/pvrusb2/pvrusb2-context.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/usb/pvrusb2/pvrusb2-context.c b/drivers/media/usb/pvrusb2/pvrusb2-context.c
+index 14170a5d72b3..1764674de98b 100644
+--- a/drivers/media/usb/pvrusb2/pvrusb2-context.c
++++ b/drivers/media/usb/pvrusb2/pvrusb2-context.c
+@@ -268,7 +268,8 @@ void pvr2_context_disconnect(struct pvr2_context *mp)
+ {
+ 	pvr2_hdw_disconnect(mp->hdw);
+ 	mp->disconnect_flag = !0;
+-	pvr2_context_notify(mp);
++	if (!pvr2_context_shutok())
++		pvr2_context_notify(mp);
+ }
+ 
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/media-rkisp1-fix-media-device-memory-leak.patch b/queue-6.1/media-rkisp1-fix-media-device-memory-leak.patch
new file mode 100644
index 00000000000..198390deba4
--- /dev/null
+++ b/queue-6.1/media-rkisp1-fix-media-device-memory-leak.patch
@@ -0,0 +1,57 @@
+From 6282ba55a241597b3a6f26f69ab7d14b85ba6782 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Nov 2023 16:50:07 +0100
+Subject: media: rkisp1: Fix media device memory leak
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+[ Upstream commit 452f604a4683654f4d9472b3126d8da61d748443 ]
+
+Add missing calls to media_device_cleanup() to fix memory leak.
+
+Link: https://lore.kernel.org/r/20231122-rkisp-fixes-v2-1-78bfb63cdcf8@ideasonboard.com
+
+Fixes: d65dd85281fb ("media: staging: rkisp1: add Rockchip ISP1 base driver")
+Reviewed-by: Tommaso Merciai <tomm.merciai@gmail.com>
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c
+index f2475c6235ea..2b76339f9381 100644
+--- a/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c
++++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c
+@@ -582,7 +582,7 @@ static int rkisp1_probe(struct platform_device *pdev)
+ 
+ 	ret = v4l2_device_register(rkisp1->dev, &rkisp1->v4l2_dev);
+ 	if (ret)
+-		goto err_pm_runtime_disable;
++		goto err_media_dev_cleanup;
+ 
+ 	ret = media_device_register(&rkisp1->media_dev);
+ 	if (ret) {
+@@ -617,6 +617,8 @@ static int rkisp1_probe(struct platform_device *pdev)
+ 	media_device_unregister(&rkisp1->media_dev);
+ err_unreg_v4l2_dev:
+ 	v4l2_device_unregister(&rkisp1->v4l2_dev);
++err_media_dev_cleanup:
++	media_device_cleanup(&rkisp1->media_dev);
+ err_pm_runtime_disable:
+ 	pm_runtime_disable(&pdev->dev);
+ 	return ret;
+@@ -637,6 +639,8 @@ static int rkisp1_remove(struct platform_device *pdev)
+ 	media_device_unregister(&rkisp1->media_dev);
+ 	v4l2_device_unregister(&rkisp1->v4l2_dev);
+ 
++	media_device_cleanup(&rkisp1->media_dev);
++
+ 	pm_runtime_disable(&pdev->dev);
+ 
+ 	return 0;
+-- 
+2.43.0
+
diff --git a/queue-6.1/media-rkvdec-hook-the-try_-decoder_cmd-stateless-ioc.patch b/queue-6.1/media-rkvdec-hook-the-try_-decoder_cmd-stateless-ioc.patch
new file mode 100644
index 00000000000..d73e7722af7
--- /dev/null
+++ b/queue-6.1/media-rkvdec-hook-the-try_-decoder_cmd-stateless-ioc.patch
@@ -0,0 +1,42 @@
+From 16bf5ef93865e5a33802522ce05e4d892e24b86f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Nov 2023 21:16:40 +0100
+Subject: media: rkvdec: Hook the (TRY_)DECODER_CMD stateless ioctls
+
+From: Paul Kocialkowski <paul.kocialkowski@bootlin.com>
+
+[ Upstream commit 1fb7b5ab62113b29ce331464048d8c39e58fd08a ]
+
+The (TRY_)DECODER_CMD ioctls are used to support flushing when holding
+capture buffers is supported. This is the case of this driver but the
+ioctls were never hooked to the ioctl ops.
+
+Add them to correctly support flushing.
+
+Fixes: ed7bb87d3d03 ("media: rkvdec: Enable capture buffer holding for H264")
+Signed-off-by: Paul Kocialkowski <paul.kocialkowski@bootlin.com>
+Reviewed-by: Daniel Almeida <daniel.almeida@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/rkvdec/rkvdec.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/staging/media/rkvdec/rkvdec.c b/drivers/staging/media/rkvdec/rkvdec.c
+index a9bd1e71ea48..d16cf4115d03 100644
+--- a/drivers/staging/media/rkvdec/rkvdec.c
++++ b/drivers/staging/media/rkvdec/rkvdec.c
+@@ -461,6 +461,9 @@ static const struct v4l2_ioctl_ops rkvdec_ioctl_ops = {
+ 
+ 	.vidioc_streamon = v4l2_m2m_ioctl_streamon,
+ 	.vidioc_streamoff = v4l2_m2m_ioctl_streamoff,
++
++	.vidioc_decoder_cmd = v4l2_m2m_ioctl_stateless_decoder_cmd,
++	.vidioc_try_decoder_cmd = v4l2_m2m_ioctl_stateless_try_decoder_cmd,
+ };
+ 
+ static int rkvdec_queue_setup(struct vb2_queue *vq, unsigned int *num_buffers,
+-- 
+2.43.0
+
diff --git a/queue-6.1/media-verisilicon-hook-the-try_-decoder_cmd-stateles.patch b/queue-6.1/media-verisilicon-hook-the-try_-decoder_cmd-stateles.patch
new file mode 100644
index 00000000000..3ed1708ca5a
--- /dev/null
+++ b/queue-6.1/media-verisilicon-hook-the-try_-decoder_cmd-stateles.patch
@@ -0,0 +1,56 @@
+From 0a4ec878be4d88a8dd23b0bc2405b7565fb6ad91 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Nov 2023 21:16:39 +0100
+Subject: media: verisilicon: Hook the (TRY_)DECODER_CMD stateless ioctls
+
+From: Paul Kocialkowski <paul.kocialkowski@bootlin.com>
+
+[ Upstream commit 6c0d9e12b1d12bbd95484e4b99f63feeb423765f ]
+
+The (TRY_)DECODER_CMD ioctls are used to support flushing when holding
+capture buffers is supported. This is the case of this driver but the
+ioctls were never hooked to the ioctl ops.
+
+Add them to correctly support flushing.
+
+Fixes: 340ce50f75a6 ("media: hantro: Enable HOLD_CAPTURE_BUF for H.264")
+Signed-off-by: Paul Kocialkowski <paul.kocialkowski@bootlin.com>
+Reviewed-by: Daniel Almeida <daniel.almeida@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/verisilicon/hantro_drv.c  | 2 ++
+ drivers/media/platform/verisilicon/hantro_v4l2.c | 3 +++
+ 2 files changed, 5 insertions(+)
+
+diff --git a/drivers/media/platform/verisilicon/hantro_drv.c b/drivers/media/platform/verisilicon/hantro_drv.c
+index 08840ba313e7..69a2442f3122 100644
+--- a/drivers/media/platform/verisilicon/hantro_drv.c
++++ b/drivers/media/platform/verisilicon/hantro_drv.c
+@@ -813,6 +813,8 @@ static int hantro_add_func(struct hantro_dev *vpu, unsigned int funcid)
+ 
+ 	if (funcid == MEDIA_ENT_F_PROC_VIDEO_ENCODER) {
+ 		vpu->encoder = func;
++		v4l2_disable_ioctl(vfd, VIDIOC_TRY_DECODER_CMD);
++		v4l2_disable_ioctl(vfd, VIDIOC_DECODER_CMD);
+ 	} else {
+ 		vpu->decoder = func;
+ 		v4l2_disable_ioctl(vfd, VIDIOC_TRY_ENCODER_CMD);
+diff --git a/drivers/media/platform/verisilicon/hantro_v4l2.c b/drivers/media/platform/verisilicon/hantro_v4l2.c
+index 30e650edaea8..b2da48936e3f 100644
+--- a/drivers/media/platform/verisilicon/hantro_v4l2.c
++++ b/drivers/media/platform/verisilicon/hantro_v4l2.c
+@@ -759,6 +759,9 @@ const struct v4l2_ioctl_ops hantro_ioctl_ops = {
+ 	.vidioc_g_selection = vidioc_g_selection,
+ 	.vidioc_s_selection = vidioc_s_selection,
+ 
++	.vidioc_decoder_cmd = v4l2_m2m_ioctl_stateless_decoder_cmd,
++	.vidioc_try_decoder_cmd = v4l2_m2m_ioctl_stateless_try_decoder_cmd,
++
+ 	.vidioc_try_encoder_cmd = v4l2_m2m_ioctl_try_encoder_cmd,
+ 	.vidioc_encoder_cmd = vidioc_encoder_cmd,
+ };
+-- 
+2.43.0
+
diff --git a/queue-6.1/mlxbf_gige-enable-the-gige-port-in-mlxbf_gige_open.patch b/queue-6.1/mlxbf_gige-enable-the-gige-port-in-mlxbf_gige_open.patch
new file mode 100644
index 00000000000..7abae450d2c
--- /dev/null
+++ b/queue-6.1/mlxbf_gige-enable-the-gige-port-in-mlxbf_gige_open.patch
@@ -0,0 +1,68 @@
+From c8ee968da7e237b33fdfbc29b4130362f377f33c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Jan 2024 11:00:14 -0500
+Subject: mlxbf_gige: Enable the GigE port in mlxbf_gige_open
+
+From: Asmaa Mnebhi <asmaa@nvidia.com>
+
+[ Upstream commit a460f4a684511e007bbf1700758a41f05d9981e6 ]
+
+At the moment, the GigE port is enabled in the mlxbf_gige_probe
+function. If the mlxbf_gige_open is not executed, this could cause
+pause frames to increase in the case where there is high backgroud
+traffic. This results in clogging the port.
+So move enabling the OOB port to mlxbf_gige_open.
+
+Fixes: f92e1869d74e ("Add Mellanox BlueField Gigabit Ethernet driver")
+Reviewed-by: David Thompson <davthompson@nvidia.com>
+Signed-off-by: Asmaa Mnebhi <asmaa@nvidia.com>
+Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c   | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c
+index eafc0d3313fd..83c4659390fd 100644
+--- a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c
++++ b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c
+@@ -130,9 +130,15 @@ static int mlxbf_gige_open(struct net_device *netdev)
+ {
+ 	struct mlxbf_gige *priv = netdev_priv(netdev);
+ 	struct phy_device *phydev = netdev->phydev;
++	u64 control;
+ 	u64 int_en;
+ 	int err;
+ 
++	/* Perform general init of GigE block */
++	control = readq(priv->base + MLXBF_GIGE_CONTROL);
++	control |= MLXBF_GIGE_CONTROL_PORT_EN;
++	writeq(control, priv->base + MLXBF_GIGE_CONTROL);
++
+ 	err = mlxbf_gige_request_irqs(priv);
+ 	if (err)
+ 		return err;
+@@ -279,7 +285,6 @@ static int mlxbf_gige_probe(struct platform_device *pdev)
+ 	void __iomem *plu_base;
+ 	void __iomem *base;
+ 	int addr, phy_irq;
+-	u64 control;
+ 	int err;
+ 
+ 	base = devm_platform_ioremap_resource(pdev, MLXBF_GIGE_RES_MAC);
+@@ -294,11 +299,6 @@ static int mlxbf_gige_probe(struct platform_device *pdev)
+ 	if (IS_ERR(plu_base))
+ 		return PTR_ERR(plu_base);
+ 
+-	/* Perform general init of GigE block */
+-	control = readq(base + MLXBF_GIGE_CONTROL);
+-	control |= MLXBF_GIGE_CONTROL_PORT_EN;
+-	writeq(control, base + MLXBF_GIGE_CONTROL);
+-
+ 	netdev = devm_alloc_etherdev(&pdev->dev, sizeof(*priv));
+ 	if (!netdev)
+ 		return -ENOMEM;
+-- 
+2.43.0
+
diff --git a/queue-6.1/mlxbf_gige-fix-intermittent-no-ip-issue.patch b/queue-6.1/mlxbf_gige-fix-intermittent-no-ip-issue.patch
new file mode 100644
index 00000000000..26268389a17
--- /dev/null
+++ b/queue-6.1/mlxbf_gige-fix-intermittent-no-ip-issue.patch
@@ -0,0 +1,92 @@
+From 67eb344d3ec2c558af97090eb02bce1fa53e3b31 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Jan 2024 10:59:46 -0500
+Subject: mlxbf_gige: Fix intermittent no ip issue
+
+From: Asmaa Mnebhi <asmaa@nvidia.com>
+
+[ Upstream commit ef210ef85d5cb543ce34a57803ed856d0c8c08c2 ]
+
+Although the link is up, there is no ip assigned on setups with high background
+traffic. Nothing is transmitted nor received. The RX error count keeps on
+increasing. After several minutes, the RX error count stagnates and the
+GigE interface finally gets an ip.
+
+The issue is that mlxbf_gige_rx_init() is called before phy_start().
+As soon as the RX DMA is enabled in mlxbf_gige_rx_init(), the RX CI reaches the max
+of 128, and becomes equal to RX PI. RX CI doesn't decrease since the code hasn't
+ran phy_start yet.
+Bring the PHY up before starting the RX.
+
+Fixes: f92e1869d74e ("Add Mellanox BlueField Gigabit Ethernet driver")
+Reviewed-by: David Thompson <davthompson@nvidia.com>
+Signed-off-by: Asmaa Mnebhi <asmaa@nvidia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c | 14 +++++++-------
+ .../ethernet/mellanox/mlxbf_gige/mlxbf_gige_rx.c   |  6 +++---
+ 2 files changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c
+index 2292d63a279c..eafc0d3313fd 100644
+--- a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c
++++ b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c
+@@ -147,14 +147,14 @@ static int mlxbf_gige_open(struct net_device *netdev)
+ 	 */
+ 	priv->valid_polarity = 0;
+ 
+-	err = mlxbf_gige_rx_init(priv);
++	phy_start(phydev);
++
++	err = mlxbf_gige_tx_init(priv);
+ 	if (err)
+ 		goto free_irqs;
+-	err = mlxbf_gige_tx_init(priv);
++	err = mlxbf_gige_rx_init(priv);
+ 	if (err)
+-		goto rx_deinit;
+-
+-	phy_start(phydev);
++		goto tx_deinit;
+ 
+ 	netif_napi_add(netdev, &priv->napi, mlxbf_gige_poll);
+ 	napi_enable(&priv->napi);
+@@ -176,8 +176,8 @@ static int mlxbf_gige_open(struct net_device *netdev)
+ 
+ 	return 0;
+ 
+-rx_deinit:
+-	mlxbf_gige_rx_deinit(priv);
++tx_deinit:
++	mlxbf_gige_tx_deinit(priv);
+ 
+ free_irqs:
+ 	mlxbf_gige_free_irqs(priv);
+diff --git a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_rx.c b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_rx.c
+index 227d01cace3f..699984358493 100644
+--- a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_rx.c
++++ b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_rx.c
+@@ -142,6 +142,9 @@ int mlxbf_gige_rx_init(struct mlxbf_gige *priv)
+ 	writeq(MLXBF_GIGE_RX_MAC_FILTER_COUNT_PASS_EN,
+ 	       priv->base + MLXBF_GIGE_RX_MAC_FILTER_COUNT_PASS);
+ 
++	writeq(ilog2(priv->rx_q_entries),
++	       priv->base + MLXBF_GIGE_RX_WQE_SIZE_LOG2);
++
+ 	/* Clear MLXBF_GIGE_INT_MASK 'receive pkt' bit to
+ 	 * indicate readiness to receive interrupts
+ 	 */
+@@ -154,9 +157,6 @@ int mlxbf_gige_rx_init(struct mlxbf_gige *priv)
+ 	data |= MLXBF_GIGE_RX_DMA_EN;
+ 	writeq(data, priv->base + MLXBF_GIGE_RX_DMA);
+ 
+-	writeq(ilog2(priv->rx_q_entries),
+-	       priv->base + MLXBF_GIGE_RX_WQE_SIZE_LOG2);
+-
+ 	return 0;
+ 
+ free_wqe_and_skb:
+-- 
+2.43.0
+
diff --git a/queue-6.1/mmc-sdhci_am654-fix-ti-soc-dependencies.patch b/queue-6.1/mmc-sdhci_am654-fix-ti-soc-dependencies.patch
new file mode 100644
index 00000000000..7fff7e1f360
--- /dev/null
+++ b/queue-6.1/mmc-sdhci_am654-fix-ti-soc-dependencies.patch
@@ -0,0 +1,48 @@
+From cf4b4b5bb1a62fef47ac8cb14050ce604849d8eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Dec 2023 13:59:46 +0000
+Subject: mmc: sdhci_am654: Fix TI SoC dependencies
+
+From: Peter Robinson <pbrobinson@gmail.com>
+
+[ Upstream commit cb052da7f031b0d2309a4895ca236afb3b4bbf50 ]
+
+The sdhci_am654 is specific to recent TI SoCs, update the
+dependencies for those SoCs and compile testing. While we're
+at it update the text to reflect the wider range of
+supported TI SoCS the driver now supports.
+
+Fixes: 41fd4caeb00b ("mmc: sdhci_am654: Add Initial Support for AM654 SDHCI driver")
+Signed-off-by: Peter Robinson <pbrobinson@gmail.com>
+Link: https://lore.kernel.org/r/20231220135950.433588-1-pbrobinson@gmail.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/Kconfig | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/mmc/host/Kconfig b/drivers/mmc/host/Kconfig
+index 9b5a2cb110b3..5c960c1ee8f9 100644
+--- a/drivers/mmc/host/Kconfig
++++ b/drivers/mmc/host/Kconfig
+@@ -1076,14 +1076,15 @@ config MMC_SDHCI_OMAP
+ 
+ config MMC_SDHCI_AM654
+ 	tristate "Support for the SDHCI Controller in TI's AM654 SOCs"
++	depends on ARCH_K3 || COMPILE_TEST
+ 	depends on MMC_SDHCI_PLTFM && OF
+ 	select MMC_SDHCI_IO_ACCESSORS
+ 	select MMC_CQHCI
+ 	select REGMAP_MMIO
+ 	help
+ 	  This selects the Secure Digital Host Controller Interface (SDHCI)
+-	  support present in TI's AM654 SOCs. The controller supports
+-	  SD/MMC/SDIO devices.
++	  support present in TI's AM65x/AM64x/AM62x/J721E SOCs. The controller
++	  supports SD/MMC/SDIO devices.
+ 
+ 	  If you have a controller with this interface, say Y or M here.
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/mmc-sdhci_omap-fix-ti-soc-dependencies.patch b/queue-6.1/mmc-sdhci_omap-fix-ti-soc-dependencies.patch
new file mode 100644
index 00000000000..82e4f20476c
--- /dev/null
+++ b/queue-6.1/mmc-sdhci_omap-fix-ti-soc-dependencies.patch
@@ -0,0 +1,48 @@
+From c0ccf825dea7acb8bf31ab9491c3b7a6c39477ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Dec 2023 13:59:47 +0000
+Subject: mmc: sdhci_omap: Fix TI SoC dependencies
+
+From: Peter Robinson <pbrobinson@gmail.com>
+
+[ Upstream commit 09f164d393a6671e5ff8342ba6b3cb7fe3f20208 ]
+
+The sdhci_omap is specific to  older TI SoCs, update the
+dependencies for those SoCs and compile testing. While we're
+at it update the text to reflect the wider range of
+supported TI SoCS the driver now supports.
+
+Fixes: 7d326930d352 ("mmc: sdhci-omap: Add OMAP SDHCI driver")
+Signed-off-by: Peter Robinson <pbrobinson@gmail.com>
+Link: https://lore.kernel.org/r/20231220135950.433588-2-pbrobinson@gmail.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/Kconfig | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/mmc/host/Kconfig b/drivers/mmc/host/Kconfig
+index 5c960c1ee8f9..d84bdb69f56b 100644
+--- a/drivers/mmc/host/Kconfig
++++ b/drivers/mmc/host/Kconfig
+@@ -1061,14 +1061,15 @@ config MMC_SDHCI_XENON
+ 
+ config MMC_SDHCI_OMAP
+ 	tristate "TI SDHCI Controller Support"
++	depends on ARCH_OMAP2PLUS || ARCH_KEYSTONE || COMPILE_TEST
+ 	depends on MMC_SDHCI_PLTFM && OF
+ 	select THERMAL
+ 	imply TI_SOC_THERMAL
+ 	select MMC_SDHCI_EXTERNAL_DMA if DMA_ENGINE
+ 	help
+ 	  This selects the Secure Digital Host Controller Interface (SDHCI)
+-	  support present in TI's DRA7 SOCs. The controller supports
+-	  SD/MMC/SDIO devices.
++	  support present in TI's Keystone/OMAP2+/DRA7 SOCs. The controller
++	  supports SD/MMC/SDIO devices.
+ 
+ 	  If you have a controller with this interface, say Y or M here.
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/mtd-fix-gluebi-null-pointer-dereference-caused-by-ft.patch b/queue-6.1/mtd-fix-gluebi-null-pointer-dereference-caused-by-ft.patch
new file mode 100644
index 00000000000..4868a6baba4
--- /dev/null
+++ b/queue-6.1/mtd-fix-gluebi-null-pointer-dereference-caused-by-ft.patch
@@ -0,0 +1,85 @@
+From b850cbab540726324b572c39545e8c6bb75958c6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Dec 2023 10:46:19 +0800
+Subject: mtd: Fix gluebi NULL pointer dereference caused by ftl notifier
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: ZhaoLong Wang <wangzhaolong1@huawei.com>
+
+[ Upstream commit a43bdc376deab5fff1ceb93dca55bcab8dbdc1d6 ]
+
+If both ftl.ko and gluebi.ko are loaded, the notifier of ftl
+triggers NULL pointer dereference when trying to access
+‘gluebi->desc’ in gluebi_read().
+
+ubi_gluebi_init
+  ubi_register_volume_notifier
+    ubi_enumerate_volumes
+      ubi_notify_all
+        gluebi_notify    nb->notifier_call()
+          gluebi_create
+            mtd_device_register
+              mtd_device_parse_register
+                add_mtd_device
+                  blktrans_notify_add   not->add()
+                    ftl_add_mtd         tr->add_mtd()
+                      scan_header
+                        mtd_read
+                          mtd_read_oob
+                            mtd_read_oob_std
+                              gluebi_read   mtd->read()
+                                gluebi->desc - NULL
+
+Detailed reproduction information available at the Link [1],
+
+In the normal case, obtain gluebi->desc in the gluebi_get_device(),
+and access gluebi->desc in the gluebi_read(). However,
+gluebi_get_device() is not executed in advance in the
+ftl_add_mtd() process, which leads to NULL pointer dereference.
+
+The solution for the gluebi module is to run jffs2 on the UBI
+volume without considering working with ftl or mtdblock [2].
+Therefore, this problem can be avoided by preventing gluebi from
+creating the mtdblock device after creating mtd partition of the
+type MTD_UBIVOLUME.
+
+Fixes: 2ba3d76a1e29 ("UBI: make gluebi a separate module")
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=217992 [1]
+Link: https://lore.kernel.org/lkml/441107100.23734.1697904580252.JavaMail.zimbra@nod.at/ [2]
+Signed-off-by: ZhaoLong Wang <wangzhaolong1@huawei.com>
+Reviewed-by: Zhihao Cheng <chengzhihao1@huawei.com>
+Acked-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20231220024619.2138625-1-wangzhaolong1@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/mtd_blkdevs.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/mtd/mtd_blkdevs.c b/drivers/mtd/mtd_blkdevs.c
+index 60b222799871..8ee60605a6dc 100644
+--- a/drivers/mtd/mtd_blkdevs.c
++++ b/drivers/mtd/mtd_blkdevs.c
+@@ -463,7 +463,7 @@ static void blktrans_notify_add(struct mtd_info *mtd)
+ {
+ 	struct mtd_blktrans_ops *tr;
+ 
+-	if (mtd->type == MTD_ABSENT)
++	if (mtd->type == MTD_ABSENT || mtd->type == MTD_UBIVOLUME)
+ 		return;
+ 
+ 	list_for_each_entry(tr, &blktrans_majors, list)
+@@ -503,7 +503,7 @@ int register_mtd_blktrans(struct mtd_blktrans_ops *tr)
+ 	mutex_lock(&mtd_table_mutex);
+ 	list_add(&tr->list, &blktrans_majors);
+ 	mtd_for_each_device(mtd)
+-		if (mtd->type != MTD_ABSENT)
++		if (mtd->type != MTD_ABSENT && mtd->type != MTD_UBIVOLUME)
+ 			tr->add_mtd(tr, mtd);
+ 	mutex_unlock(&mtd_table_mutex);
+ 	return 0;
+-- 
+2.43.0
+
diff --git a/queue-6.1/mtd-rawnand-increment-ifc_timeout_msecs-for-nand-con.patch b/queue-6.1/mtd-rawnand-increment-ifc_timeout_msecs-for-nand-con.patch
new file mode 100644
index 00000000000..12197ce245e
--- /dev/null
+++ b/queue-6.1/mtd-rawnand-increment-ifc_timeout_msecs-for-nand-con.patch
@@ -0,0 +1,49 @@
+From f074842c3d2294099b1ae2dc6228ada849133b80 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 18 Nov 2023 18:31:51 +1000
+Subject: mtd: rawnand: Increment IFC_TIMEOUT_MSECS for nand controller
+ response
+
+From: Ronald Monthero <debug.penguin32@gmail.com>
+
+[ Upstream commit 923fb6238cb3ac529aa2bf13b3b1e53762186a8b ]
+
+Under heavy load it is likely that the controller is done
+with its own task but the thread unlocking the wait is not
+scheduled in time. Increasing IFC_TIMEOUT_MSECS allows the
+controller to respond within allowable timeslice of 1 sec.
+
+fsl,ifc-nand 7e800000.nand: Controller is not responding
+
+[<804b2047>] (nand_get_device) from [<804b5335>] (nand_write_oob+0x1b/0x4a)
+[<804b5335>] (nand_write_oob) from [<804a3585>] (mtd_write+0x41/0x5c)
+[<804a3585>] (mtd_write) from [<804c1d47>] (ubi_io_write+0x17f/0x22c)
+[<804c1d47>] (ubi_io_write) from [<804c047b>] (ubi_eba_write_leb+0x5b/0x1d0)
+
+Fixes: 82771882d960 ("NAND Machine support for Integrated Flash Controller")
+Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Ronald Monthero <debug.penguin32@gmail.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20231118083156.776887-1-debug.penguin32@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/nand/raw/fsl_ifc_nand.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mtd/nand/raw/fsl_ifc_nand.c b/drivers/mtd/nand/raw/fsl_ifc_nand.c
+index 02d500176838..bea1a7d3edd7 100644
+--- a/drivers/mtd/nand/raw/fsl_ifc_nand.c
++++ b/drivers/mtd/nand/raw/fsl_ifc_nand.c
+@@ -20,7 +20,7 @@
+ 
+ #define ERR_BYTE		0xFF /* Value returned for read
+ 					bytes when read failed	*/
+-#define IFC_TIMEOUT_MSECS	500  /* Maximum number of mSecs to wait
++#define IFC_TIMEOUT_MSECS	1000 /* Maximum timeout to wait
+ 					for IFC NAND Machine	*/
+ 
+ struct fsl_ifc_ctrl;
+-- 
+2.43.0
+
diff --git a/queue-6.1/net-ncsi-fix-netlink-major-minor-version-numbers.patch b/queue-6.1/net-ncsi-fix-netlink-major-minor-version-numbers.patch
new file mode 100644
index 00000000000..aff8d54cae3
--- /dev/null
+++ b/queue-6.1/net-ncsi-fix-netlink-major-minor-version-numbers.patch
@@ -0,0 +1,202 @@
+From 337a17ed08e7fc149f67ac9766213ada2fb06078 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Nov 2023 10:07:34 -0600
+Subject: net/ncsi: Fix netlink major/minor version numbers
+
+From: Peter Delevoryas <peter@pjd.dev>
+
+[ Upstream commit 3084b58bfd0b9e4b5e034f31f31b42977db35f12 ]
+
+The netlink interface for major and minor version numbers doesn't actually
+return the major and minor version numbers.
+
+It reports a u32 that contains the (major, minor, update, alpha1)
+components as the major version number, and then alpha2 as the minor
+version number.
+
+For whatever reason, the u32 byte order was reversed (ntohl): maybe it was
+assumed that the encoded value was a single big-endian u32, and alpha2 was
+the minor version.
+
+The correct way to get the supported NC-SI version from the network
+controller is to parse the Get Version ID response as described in 8.4.44
+of the NC-SI spec[1].
+
+    Get Version ID Response Packet Format
+
+              Bits
+            +--------+--------+--------+--------+
+     Bytes  | 31..24 | 23..16 | 15..8  | 7..0   |
+    +-------+--------+--------+--------+--------+
+    | 0..15 | NC-SI Header                      |
+    +-------+--------+--------+--------+--------+
+    | 16..19| Response code   | Reason code     |
+    +-------+--------+--------+--------+--------+
+    |20..23 | Major  | Minor  | Update | Alpha1 |
+    +-------+--------+--------+--------+--------+
+    |24..27 |         reserved         | Alpha2 |
+    +-------+--------+--------+--------+--------+
+    |            .... other stuff ....          |
+
+The major, minor, and update fields are all binary-coded decimal (BCD)
+encoded [2]. The spec provides examples below the Get Version ID response
+format in section 8.4.44.1, but for practical purposes, this is an example
+from a live network card:
+
+    root@bmc:~# ncsi-util 0x15
+    NC-SI Command Response:
+    cmd: GET_VERSION_ID(0x15)
+    Response: COMMAND_COMPLETED(0x0000)  Reason: NO_ERROR(0x0000)
+    Payload length = 40
+
+    20: 0xf1 0xf1 0xf0 0x00 <<<<<<<<< (major, minor, update, alpha1)
+    24: 0x00 0x00 0x00 0x00 <<<<<<<<< (_, _, _, alpha2)
+
+    28: 0x6d 0x6c 0x78 0x30
+    32: 0x2e 0x31 0x00 0x00
+    36: 0x00 0x00 0x00 0x00
+    40: 0x16 0x1d 0x07 0xd2
+    44: 0x10 0x1d 0x15 0xb3
+    48: 0x00 0x17 0x15 0xb3
+    52: 0x00 0x00 0x81 0x19
+
+This should be parsed as "1.1.0".
+
+"f" in the upper-nibble means to ignore it, contributing zero.
+
+If both nibbles are "f", I think the whole field is supposed to be ignored.
+Major and minor are "required", meaning they're not supposed to be "ff",
+but the update field is "optional" so I think it can be ff. I think the
+simplest thing to do is just set the major and minor to zero instead of
+juggling some conditional logic or something.
+
+bcd2bin() from "include/linux/bcd.h" seems to assume both nibbles are 0-9,
+so I've provided a custom BCD decoding function.
+
+Alpha1 and alpha2 are ISO/IEC 8859-1 encoded, which just means ASCII
+characters as far as I can tell, although the full encoding table for
+non-alphabetic characters is slightly different (I think).
+
+I imagine the alpha fields are just supposed to be alphabetic characters,
+but I haven't seen any network cards actually report a non-zero value for
+either.
+
+If people wrote software against this netlink behavior, and were parsing
+the major and minor versions themselves from the u32, then this would
+definitely break their code.
+
+[1] https://www.dmtf.org/sites/default/files/standards/documents/DSP0222_1.0.0.pdf
+[2] https://en.wikipedia.org/wiki/Binary-coded_decimal
+[2] https://en.wikipedia.org/wiki/ISO/IEC_8859-1
+
+Signed-off-by: Peter Delevoryas <peter@pjd.dev>
+Fixes: 138635cc27c9 ("net/ncsi: NCSI response packet handler")
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ncsi/internal.h     |  7 +++++--
+ net/ncsi/ncsi-netlink.c |  4 ++--
+ net/ncsi/ncsi-pkt.h     |  7 +++++--
+ net/ncsi/ncsi-rsp.c     | 26 ++++++++++++++++++++++++--
+ 4 files changed, 36 insertions(+), 8 deletions(-)
+
+diff --git a/net/ncsi/internal.h b/net/ncsi/internal.h
+index 03757e76bb6b..374412ed780b 100644
+--- a/net/ncsi/internal.h
++++ b/net/ncsi/internal.h
+@@ -105,8 +105,11 @@ enum {
+ 
+ 
+ struct ncsi_channel_version {
+-	u32 version;		/* Supported BCD encoded NCSI version */
+-	u32 alpha2;		/* Supported BCD encoded NCSI version */
++	u8   major;		/* NCSI version major */
++	u8   minor;		/* NCSI version minor */
++	u8   update;		/* NCSI version update */
++	char alpha1;		/* NCSI version alpha1 */
++	char alpha2;		/* NCSI version alpha2 */
+ 	u8  fw_name[12];	/* Firmware name string                */
+ 	u32 fw_version;		/* Firmware version                   */
+ 	u16 pci_ids[4];		/* PCI identification                 */
+diff --git a/net/ncsi/ncsi-netlink.c b/net/ncsi/ncsi-netlink.c
+index d27f4eccce6d..fe681680b5d9 100644
+--- a/net/ncsi/ncsi-netlink.c
++++ b/net/ncsi/ncsi-netlink.c
+@@ -71,8 +71,8 @@ static int ncsi_write_channel_info(struct sk_buff *skb,
+ 	if (nc == nc->package->preferred_channel)
+ 		nla_put_flag(skb, NCSI_CHANNEL_ATTR_FORCED);
+ 
+-	nla_put_u32(skb, NCSI_CHANNEL_ATTR_VERSION_MAJOR, nc->version.version);
+-	nla_put_u32(skb, NCSI_CHANNEL_ATTR_VERSION_MINOR, nc->version.alpha2);
++	nla_put_u32(skb, NCSI_CHANNEL_ATTR_VERSION_MAJOR, nc->version.major);
++	nla_put_u32(skb, NCSI_CHANNEL_ATTR_VERSION_MINOR, nc->version.minor);
+ 	nla_put_string(skb, NCSI_CHANNEL_ATTR_VERSION_STR, nc->version.fw_name);
+ 
+ 	vid_nest = nla_nest_start_noflag(skb, NCSI_CHANNEL_ATTR_VLAN_LIST);
+diff --git a/net/ncsi/ncsi-pkt.h b/net/ncsi/ncsi-pkt.h
+index ba66c7dc3a21..c9d1da34dc4d 100644
+--- a/net/ncsi/ncsi-pkt.h
++++ b/net/ncsi/ncsi-pkt.h
+@@ -197,9 +197,12 @@ struct ncsi_rsp_gls_pkt {
+ /* Get Version ID */
+ struct ncsi_rsp_gvi_pkt {
+ 	struct ncsi_rsp_pkt_hdr rsp;          /* Response header */
+-	__be32                  ncsi_version; /* NCSI version    */
++	unsigned char           major;        /* NCSI version major */
++	unsigned char           minor;        /* NCSI version minor */
++	unsigned char           update;       /* NCSI version update */
++	unsigned char           alpha1;       /* NCSI version alpha1 */
+ 	unsigned char           reserved[3];  /* Reserved        */
+-	unsigned char           alpha2;       /* NCSI version    */
++	unsigned char           alpha2;       /* NCSI version alpha2 */
+ 	unsigned char           fw_name[12];  /* f/w name string */
+ 	__be32                  fw_version;   /* f/w version     */
+ 	__be16                  pci_ids[4];   /* PCI IDs         */
+diff --git a/net/ncsi/ncsi-rsp.c b/net/ncsi/ncsi-rsp.c
+index 069c2659074b..480e80e3c283 100644
+--- a/net/ncsi/ncsi-rsp.c
++++ b/net/ncsi/ncsi-rsp.c
+@@ -19,6 +19,19 @@
+ #include "ncsi-pkt.h"
+ #include "ncsi-netlink.h"
+ 
++/* Nibbles within [0xA, 0xF] add zero "0" to the returned value.
++ * Optional fields (encoded as 0xFF) will default to zero.
++ */
++static u8 decode_bcd_u8(u8 x)
++{
++	int lo = x & 0xF;
++	int hi = x >> 4;
++
++	lo = lo < 0xA ? lo : 0;
++	hi = hi < 0xA ? hi : 0;
++	return lo + hi * 10;
++}
++
+ static int ncsi_validate_rsp_pkt(struct ncsi_request *nr,
+ 				 unsigned short payload)
+ {
+@@ -755,9 +768,18 @@ static int ncsi_rsp_handler_gvi(struct ncsi_request *nr)
+ 	if (!nc)
+ 		return -ENODEV;
+ 
+-	/* Update to channel's version info */
++	/* Update channel's version info
++	 *
++	 * Major, minor, and update fields are supposed to be
++	 * unsigned integers encoded as packed BCD.
++	 *
++	 * Alpha1 and alpha2 are ISO/IEC 8859-1 characters.
++	 */
+ 	ncv = &nc->version;
+-	ncv->version = ntohl(rsp->ncsi_version);
++	ncv->major = decode_bcd_u8(rsp->major);
++	ncv->minor = decode_bcd_u8(rsp->minor);
++	ncv->update = decode_bcd_u8(rsp->update);
++	ncv->alpha1 = rsp->alpha1;
+ 	ncv->alpha2 = rsp->alpha2;
+ 	memcpy(ncv->fw_name, rsp->fw_name, 12);
+ 	ncv->fw_version = ntohl(rsp->fw_version);
+-- 
+2.43.0
+
diff --git a/queue-6.1/net-sched-act_ct-fix-skb-leak-and-crash-on-ooo-frags.patch b/queue-6.1/net-sched-act_ct-fix-skb-leak-and-crash-on-ooo-frags.patch
new file mode 100644
index 00000000000..a1c398b7761
--- /dev/null
+++ b/queue-6.1/net-sched-act_ct-fix-skb-leak-and-crash-on-ooo-frags.patch
@@ -0,0 +1,149 @@
+From f0fcf59eeede266817ff97ad6796888974db2ec6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Dec 2023 16:14:57 +0800
+Subject: net/sched: act_ct: fix skb leak and crash on ooo frags
+
+From: Tao Liu <taoliu828@163.com>
+
+[ Upstream commit 3f14b377d01d8357eba032b4cabc8c1149b458b6 ]
+
+act_ct adds skb->users before defragmentation. If frags arrive in order,
+the last frag's reference is reset in:
+
+  inet_frag_reasm_prepare
+    skb_morph
+
+which is not straightforward.
+
+However when frags arrive out of order, nobody unref the last frag, and
+all frags are leaked. The situation is even worse, as initiating packet
+capture can lead to a crash[0] when skb has been cloned and shared at the
+same time.
+
+Fix the issue by removing skb_get() before defragmentation. act_ct
+returns TC_ACT_CONSUMED when defrag failed or in progress.
+
+[0]:
+[  843.804823] ------------[ cut here ]------------
+[  843.809659] kernel BUG at net/core/skbuff.c:2091!
+[  843.814516] invalid opcode: 0000 [#1] PREEMPT SMP
+[  843.819296] CPU: 7 PID: 0 Comm: swapper/7 Kdump: loaded Tainted: G S 6.7.0-rc3 #2
+[  843.824107] Hardware name: XFUSION 1288H V6/BC13MBSBD, BIOS 1.29 11/25/2022
+[  843.828953] RIP: 0010:pskb_expand_head+0x2ac/0x300
+[  843.833805] Code: 8b 70 28 48 85 f6 74 82 48 83 c6 08 bf 01 00 00 00 e8 38 bd ff ff 8b 83 c0 00 00 00 48 03 83 c8 00 00 00 e9 62 ff ff ff 0f 0b <0f> 0b e8 8d d0 ff ff e9 b3 fd ff ff 81 7c 24 14 40 01 00 00 4c 89
+[  843.843698] RSP: 0018:ffffc9000cce07c0 EFLAGS: 00010202
+[  843.848524] RAX: 0000000000000002 RBX: ffff88811a211d00 RCX: 0000000000000820
+[  843.853299] RDX: 0000000000000640 RSI: 0000000000000000 RDI: ffff88811a211d00
+[  843.857974] RBP: ffff888127d39518 R08: 00000000bee97314 R09: 0000000000000000
+[  843.862584] R10: 0000000000000000 R11: ffff8881109f0000 R12: 0000000000000880
+[  843.867147] R13: ffff888127d39580 R14: 0000000000000640 R15: ffff888170f7b900
+[  843.871680] FS:  0000000000000000(0000) GS:ffff889ffffc0000(0000) knlGS:0000000000000000
+[  843.876242] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[  843.880778] CR2: 00007fa42affcfb8 CR3: 000000011433a002 CR4: 0000000000770ef0
+[  843.885336] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[  843.889809] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+[  843.894229] PKRU: 55555554
+[  843.898539] Call Trace:
+[  843.902772]  <IRQ>
+[  843.906922]  ? __die_body+0x1e/0x60
+[  843.911032]  ? die+0x3c/0x60
+[  843.915037]  ? do_trap+0xe2/0x110
+[  843.918911]  ? pskb_expand_head+0x2ac/0x300
+[  843.922687]  ? do_error_trap+0x65/0x80
+[  843.926342]  ? pskb_expand_head+0x2ac/0x300
+[  843.929905]  ? exc_invalid_op+0x50/0x60
+[  843.933398]  ? pskb_expand_head+0x2ac/0x300
+[  843.936835]  ? asm_exc_invalid_op+0x1a/0x20
+[  843.940226]  ? pskb_expand_head+0x2ac/0x300
+[  843.943580]  inet_frag_reasm_prepare+0xd1/0x240
+[  843.946904]  ip_defrag+0x5d4/0x870
+[  843.950132]  nf_ct_handle_fragments+0xec/0x130 [nf_conntrack]
+[  843.953334]  tcf_ct_act+0x252/0xd90 [act_ct]
+[  843.956473]  ? tcf_mirred_act+0x516/0x5a0 [act_mirred]
+[  843.959657]  tcf_action_exec+0xa1/0x160
+[  843.962823]  fl_classify+0x1db/0x1f0 [cls_flower]
+[  843.966010]  ? skb_clone+0x53/0xc0
+[  843.969173]  tcf_classify+0x24d/0x420
+[  843.972333]  tc_run+0x8f/0xf0
+[  843.975465]  __netif_receive_skb_core+0x67a/0x1080
+[  843.978634]  ? dev_gro_receive+0x249/0x730
+[  843.981759]  __netif_receive_skb_list_core+0x12d/0x260
+[  843.984869]  netif_receive_skb_list_internal+0x1cb/0x2f0
+[  843.987957]  ? mlx5e_handle_rx_cqe_mpwrq_rep+0xfa/0x1a0 [mlx5_core]
+[  843.991170]  napi_complete_done+0x72/0x1a0
+[  843.994305]  mlx5e_napi_poll+0x28c/0x6d0 [mlx5_core]
+[  843.997501]  __napi_poll+0x25/0x1b0
+[  844.000627]  net_rx_action+0x256/0x330
+[  844.003705]  __do_softirq+0xb3/0x29b
+[  844.006718]  irq_exit_rcu+0x9e/0xc0
+[  844.009672]  common_interrupt+0x86/0xa0
+[  844.012537]  </IRQ>
+[  844.015285]  <TASK>
+[  844.017937]  asm_common_interrupt+0x26/0x40
+[  844.020591] RIP: 0010:acpi_safe_halt+0x1b/0x20
+[  844.023247] Code: ff 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 65 48 8b 04 25 00 18 03 00 48 8b 00 a8 08 75 0c 66 90 0f 00 2d 81 d0 44 00 fb f4 <fa> c3 0f 1f 00 89 fa ec 48 8b 05 ee 88 ed 00 a9 00 00 00 80 75 11
+[  844.028900] RSP: 0018:ffffc90000533e70 EFLAGS: 00000246
+[  844.031725] RAX: 0000000000004000 RBX: 0000000000000001 RCX: 0000000000000000
+[  844.034553] RDX: ffff889ffffc0000 RSI: ffffffff828b7f20 RDI: ffff88a090f45c64
+[  844.037368] RBP: ffff88a0901a2800 R08: ffff88a090f45c00 R09: 00000000000317c0
+[  844.040155] R10: 00ec812281150475 R11: ffff889fffff0e04 R12: ffffffff828b7fa0
+[  844.042962] R13: ffffffff828b7f20 R14: 0000000000000001 R15: 0000000000000000
+[  844.045819]  acpi_idle_enter+0x7b/0xc0
+[  844.048621]  cpuidle_enter_state+0x7f/0x430
+[  844.051451]  cpuidle_enter+0x2d/0x40
+[  844.054279]  do_idle+0x1d4/0x240
+[  844.057096]  cpu_startup_entry+0x2a/0x30
+[  844.059934]  start_secondary+0x104/0x130
+[  844.062787]  secondary_startup_64_no_verify+0x16b/0x16b
+[  844.065674]  </TASK>
+
+Fixes: b57dc7c13ea9 ("net/sched: Introduce action ct")
+Signed-off-by: Tao Liu <taoliu828@163.com>
+Link: https://lore.kernel.org/r/20231228081457.936732-1-taoliu828@163.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sched/act_ct.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/net/sched/act_ct.c b/net/sched/act_ct.c
+index d6d33f854050..84e15116f18c 100644
+--- a/net/sched/act_ct.c
++++ b/net/sched/act_ct.c
+@@ -863,7 +863,6 @@ static int tcf_ct_handle_fragments(struct net *net, struct sk_buff *skb,
+ 	if (err || !frag)
+ 		return err;
+ 
+-	skb_get(skb);
+ 	mru = tc_skb_cb(skb)->mru;
+ 
+ 	if (family == NFPROTO_IPV4) {
+@@ -1150,12 +1149,8 @@ static int tcf_ct_act(struct sk_buff *skb, const struct tc_action *a,
+ 	nh_ofs = skb_network_offset(skb);
+ 	skb_pull_rcsum(skb, nh_ofs);
+ 	err = tcf_ct_handle_fragments(net, skb, family, p->zone, &defrag);
+-	if (err == -EINPROGRESS) {
+-		retval = TC_ACT_STOLEN;
+-		goto out_clear;
+-	}
+ 	if (err)
+-		goto drop;
++		goto out_frag;
+ 
+ 	err = tcf_ct_skb_network_trim(skb, family);
+ 	if (err)
+@@ -1226,6 +1221,11 @@ static int tcf_ct_act(struct sk_buff *skb, const struct tc_action *a,
+ 		qdisc_skb_cb(skb)->pkt_len = skb->len;
+ 	return retval;
+ 
++out_frag:
++	if (err != -EINPROGRESS)
++		tcf_action_inc_drop_qstats(&c->common);
++	return TC_ACT_CONSUMED;
++
+ drop:
+ 	tcf_action_inc_drop_qstats(&c->common);
+ 	return TC_ACT_SHOT;
+-- 
+2.43.0
+
diff --git a/queue-6.1/netfilter-nf_tables-mark-newset-as-dead-on-transacti.patch b/queue-6.1/netfilter-nf_tables-mark-newset-as-dead-on-transacti.patch
new file mode 100644
index 00000000000..2f2280141e7
--- /dev/null
+++ b/queue-6.1/netfilter-nf_tables-mark-newset-as-dead-on-transacti.patch
@@ -0,0 +1,50 @@
+From a0f22a23a3767aee0186730120a3238587de10e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Nov 2023 11:00:37 +0100
+Subject: netfilter: nf_tables: mark newset as dead on transaction abort
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit 08e4c8c5919fd405a4d709b4ba43d836894a26eb ]
+
+If a transaction is aborted, we should mark the to-be-released NEWSET dead,
+just like commit path does for DEL and DESTROYSET commands.
+
+In both cases all remaining elements will be released via
+set->ops->destroy().
+
+The existing abort code does NOT post the actual release to the work queue.
+Also the entire __nf_tables_abort() function is wrapped in gc_seq
+begin/end pair.
+
+Therefore, async gc worker will never try to release the pending set
+elements, as gc sequence is always stale.
+
+It might be possible to speed up transaction aborts via work queue too,
+this would result in a race and a possible use-after-free.
+
+So fix this before it becomes an issue.
+
+Fixes: 5f68718b34a5 ("netfilter: nf_tables: GC transaction API to avoid race with control plane")
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_tables_api.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index 3d6ebb9877a4..db987388cb5d 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -9937,6 +9937,7 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action)
+ 				nft_trans_destroy(trans);
+ 				break;
+ 			}
++			nft_trans_set(trans)->dead = 1;
+ 			list_del_rcu(&nft_trans_set(trans)->list);
+ 			break;
+ 		case NFT_MSG_DELSET:
+-- 
+2.43.0
+
diff --git a/queue-6.1/nfsv4.1-pnfs-ensure-we-handle-the-error-nfs4err_retu.patch b/queue-6.1/nfsv4.1-pnfs-ensure-we-handle-the-error-nfs4err_retu.patch
new file mode 100644
index 00000000000..05f75e82210
--- /dev/null
+++ b/queue-6.1/nfsv4.1-pnfs-ensure-we-handle-the-error-nfs4err_retu.patch
@@ -0,0 +1,53 @@
+From a7fc21c0282abc3ba7ae749f915a8a0d9311fbd8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Nov 2023 13:55:29 -0500
+Subject: NFSv4.1/pnfs: Ensure we handle the error NFS4ERR_RETURNCONFLICT
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+[ Upstream commit 037e56a22ff37f9a9c2330b66cff55d3d1ff9b90 ]
+
+Once the client has processed the CB_LAYOUTRECALL, but has not yet
+successfully returned the layout, the server is supposed to switch to
+returning NFS4ERR_RETURNCONFLICT. This patch ensures that we handle
+that return value correctly.
+
+Fixes: 183d9e7b112a ("pnfs: rework LAYOUTGET retry handling")
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4proc.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 85a952143e9f..ec3f0103e1a7 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -170,6 +170,7 @@ static int nfs4_map_errors(int err)
+ 	case -NFS4ERR_RESOURCE:
+ 	case -NFS4ERR_LAYOUTTRYLATER:
+ 	case -NFS4ERR_RECALLCONFLICT:
++	case -NFS4ERR_RETURNCONFLICT:
+ 		return -EREMOTEIO;
+ 	case -NFS4ERR_WRONGSEC:
+ 	case -NFS4ERR_WRONG_CRED:
+@@ -558,6 +559,7 @@ static int nfs4_do_handle_exception(struct nfs_server *server,
+ 		case -NFS4ERR_GRACE:
+ 		case -NFS4ERR_LAYOUTTRYLATER:
+ 		case -NFS4ERR_RECALLCONFLICT:
++		case -NFS4ERR_RETURNCONFLICT:
+ 			exception->delay = 1;
+ 			return 0;
+ 
+@@ -9667,6 +9669,7 @@ nfs4_layoutget_handle_exception(struct rpc_task *task,
+ 		status = -EBUSY;
+ 		break;
+ 	case -NFS4ERR_RECALLCONFLICT:
++	case -NFS4ERR_RETURNCONFLICT:
+ 		status = -ERECALLCONFLICT;
+ 		break;
+ 	case -NFS4ERR_DELEG_REVOKED:
+-- 
+2.43.0
+
diff --git a/queue-6.1/null_blk-don-t-cap-max_hw_sectors-to-blk_def_max_sec.patch b/queue-6.1/null_blk-don-t-cap-max_hw_sectors-to-blk_def_max_sec.patch
new file mode 100644
index 00000000000..cf2b3109f5b
--- /dev/null
+++ b/queue-6.1/null_blk-don-t-cap-max_hw_sectors-to-blk_def_max_sec.patch
@@ -0,0 +1,59 @@
+From c64c568aca071af6fed3df9f591803cdc2db4c76 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Dec 2023 09:23:02 +0000
+Subject: null_blk: don't cap max_hw_sectors to BLK_DEF_MAX_SECTORS
+
+From: Christoph Hellwig <hch@lst.de>
+
+[ Upstream commit 9a9525de865410047fa962867b4fcd33943b206f ]
+
+null_blk has some rather odd capping of the max_hw_sectors value to
+BLK_DEF_MAX_SECTORS, which doesn't make sense - max_hw_sector is the
+hardware limit, and BLK_DEF_MAX_SECTORS despite the confusing name is the
+default cap for the max_sectors field used for normal file system I/O.
+
+Remove all the capping, and simply leave it to the block layer or
+user to take up or not all of that for file system I/O.
+
+Fixes: ea17fd354ca8 ("null_blk: Allow controlling max_hw_sectors limit")
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Link: https://lore.kernel.org/r/20231227092305.279567-2-hch@lst.de
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/null_blk/main.c | 12 ++----------
+ 1 file changed, 2 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/block/null_blk/main.c b/drivers/block/null_blk/main.c
+index d921653b096b..959952e8ede3 100644
+--- a/drivers/block/null_blk/main.c
++++ b/drivers/block/null_blk/main.c
+@@ -2114,10 +2114,8 @@ static int null_add_dev(struct nullb_device *dev)
+ 
+ 	blk_queue_logical_block_size(nullb->q, dev->blocksize);
+ 	blk_queue_physical_block_size(nullb->q, dev->blocksize);
+-	if (!dev->max_sectors)
+-		dev->max_sectors = queue_max_hw_sectors(nullb->q);
+-	dev->max_sectors = min(dev->max_sectors, BLK_DEF_MAX_SECTORS);
+-	blk_queue_max_hw_sectors(nullb->q, dev->max_sectors);
++	if (dev->max_sectors)
++		blk_queue_max_hw_sectors(nullb->q, dev->max_sectors);
+ 
+ 	if (dev->virt_boundary)
+ 		blk_queue_virt_boundary(nullb->q, PAGE_SIZE - 1);
+@@ -2217,12 +2215,6 @@ static int __init null_init(void)
+ 		g_bs = PAGE_SIZE;
+ 	}
+ 
+-	if (g_max_sectors > BLK_DEF_MAX_SECTORS) {
+-		pr_warn("invalid max sectors\n");
+-		pr_warn("defaults max sectors to %u\n", BLK_DEF_MAX_SECTORS);
+-		g_max_sectors = BLK_DEF_MAX_SECTORS;
+-	}
+-
+ 	if (g_home_node != NUMA_NO_NODE && g_home_node >= nr_online_nodes) {
+ 		pr_err("invalid home_node value\n");
+ 		g_home_node = NUMA_NO_NODE;
+-- 
+2.43.0
+
diff --git a/queue-6.1/of-add-of_property_present-helper.patch b/queue-6.1/of-add-of_property_present-helper.patch
new file mode 100644
index 00000000000..5e0d051d9aa
--- /dev/null
+++ b/queue-6.1/of-add-of_property_present-helper.patch
@@ -0,0 +1,61 @@
+From d7c09cfde2565181569706b48ecd0687d05eb78d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Feb 2023 15:35:01 -0600
+Subject: of: Add of_property_present() helper
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit 9cbad37ce8122de32a1529e394b468bc101c9e7f ]
+
+Add an of_property_present() function similar to
+fwnode_property_present(). of_property_read_bool() could be used
+directly, but it is cleaner to not use it on non-boolean properties.
+
+Reviewed-by: Frank Rowand <frowand.list@gmail.com>
+Tested-by: Frank Rowand <frowand.list@gmail.com>
+Link: https://lore.kernel.org/all/20230215215547.691573-1-robh@kernel.org/
+Signed-off-by: Rob Herring <robh@kernel.org>
+Stable-dep-of: c4a5118a3ae1 ("cpufreq: scmi: process the result of devm_of_clk_add_hw_provider()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/of.h | 17 ++++++++++++++++-
+ 1 file changed, 16 insertions(+), 1 deletion(-)
+
+diff --git a/include/linux/of.h b/include/linux/of.h
+index 6b79ef9a6541..1c5301e10442 100644
+--- a/include/linux/of.h
++++ b/include/linux/of.h
+@@ -1155,7 +1155,8 @@ static inline int of_property_read_string_index(const struct device_node *np,
+  * @np:		device node from which the property value is to be read.
+  * @propname:	name of the property to be searched.
+  *
+- * Search for a property in a device node.
++ * Search for a boolean property in a device node. Usage on non-boolean
++ * property types is deprecated.
+  *
+  * Return: true if the property exists false otherwise.
+  */
+@@ -1167,6 +1168,20 @@ static inline bool of_property_read_bool(const struct device_node *np,
+ 	return prop ? true : false;
+ }
+ 
++/**
++ * of_property_present - Test if a property is present in a node
++ * @np:		device node to search for the property.
++ * @propname:	name of the property to be searched.
++ *
++ * Test for a property present in a device node.
++ *
++ * Return: true if the property exists false otherwise.
++ */
++static inline bool of_property_present(const struct device_node *np, const char *propname)
++{
++	return of_property_read_bool(np, propname);
++}
++
+ /**
+  * of_property_read_u8_array - Find and read an array of u8 from a property.
+  *
+-- 
+2.43.0
+
diff --git a/queue-6.1/of-fix-double-free-in-of_parse_phandle_with_args_map.patch b/queue-6.1/of-fix-double-free-in-of_parse_phandle_with_args_map.patch
new file mode 100644
index 00000000000..0cce0981855
--- /dev/null
+++ b/queue-6.1/of-fix-double-free-in-of_parse_phandle_with_args_map.patch
@@ -0,0 +1,231 @@
+From 184bbc91674a8a2cfb21def2c5edd6c455e4f0aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Dec 2023 11:54:11 +0100
+Subject: of: Fix double free in of_parse_phandle_with_args_map
+
+From: Christian A. Ehrhardt <lk@c--e.de>
+
+[ Upstream commit 4dde83569832f9377362e50f7748463340c5db6b ]
+
+In of_parse_phandle_with_args_map() the inner loop that
+iterates through the map entries calls of_node_put(new)
+to free the reference acquired by the previous iteration
+of the inner loop. This assumes that the value of "new" is
+NULL on the first iteration of the inner loop.
+
+Make sure that this is true in all iterations of the outer
+loop by setting "new" to NULL after its value is assigned to "cur".
+
+Extend the unittest to detect the double free and add an additional
+test case that actually triggers this path.
+
+Fixes: bd6f2fd5a1 ("of: Support parsing phandle argument lists through a nexus node")
+Cc: Stephen Boyd <stephen.boyd@linaro.org>
+Signed-off-by: "Christian A. Ehrhardt" <lk@c--e.de>
+Link: https://lore.kernel.org/r/20231229105411.1603434-1-lk@c--e.de
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/of/base.c                           |  1 +
+ drivers/of/unittest-data/tests-phandle.dtsi | 10 ++-
+ drivers/of/unittest.c                       | 74 ++++++++++++---------
+ 3 files changed, 53 insertions(+), 32 deletions(-)
+
+diff --git a/drivers/of/base.c b/drivers/of/base.c
+index d5a5c35eba72..f849bbb9ef8c 100644
+--- a/drivers/of/base.c
++++ b/drivers/of/base.c
+@@ -1646,6 +1646,7 @@ int of_parse_phandle_with_args_map(const struct device_node *np,
+ 		out_args->np = new;
+ 		of_node_put(cur);
+ 		cur = new;
++		new = NULL;
+ 	}
+ put:
+ 	of_node_put(cur);
+diff --git a/drivers/of/unittest-data/tests-phandle.dtsi b/drivers/of/unittest-data/tests-phandle.dtsi
+index 6b33be4c4416..aa0d7027ffa6 100644
+--- a/drivers/of/unittest-data/tests-phandle.dtsi
++++ b/drivers/of/unittest-data/tests-phandle.dtsi
+@@ -38,6 +38,13 @@ provider4: provider4 {
+ 				phandle-map-pass-thru = <0x0 0xf0>;
+ 			};
+ 
++			provider5: provider5 {
++				#phandle-cells = <2>;
++				phandle-map = <2 7 &provider4 2 3>;
++				phandle-map-mask = <0xff 0xf>;
++				phandle-map-pass-thru = <0x0 0xf0>;
++			};
++
+ 			consumer-a {
+ 				phandle-list =	<&provider1 1>,
+ 						<&provider2 2 0>,
+@@ -64,7 +71,8 @@ consumer-b {
+ 						<&provider4 4 0x100>,
+ 						<&provider4 0 0x61>,
+ 						<&provider0>,
+-						<&provider4 19 0x20>;
++						<&provider4 19 0x20>,
++						<&provider5 2 7>;
+ 				phandle-list-bad-phandle = <12345678 0 0>;
+ 				phandle-list-bad-args = <&provider2 1 0>,
+ 							<&provider4 0>;
+diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c
+index edd2342598e4..b59cb9ba1979 100644
+--- a/drivers/of/unittest.c
++++ b/drivers/of/unittest.c
+@@ -448,6 +448,9 @@ static void __init of_unittest_parse_phandle_with_args(void)
+ 
+ 		unittest(passed, "index %i - data error on node %pOF rc=%i\n",
+ 			 i, args.np, rc);
++
++		if (rc == 0)
++			of_node_put(args.np);
+ 	}
+ 
+ 	/* Check for missing list property */
+@@ -537,8 +540,9 @@ static void __init of_unittest_parse_phandle_with_args(void)
+ 
+ static void __init of_unittest_parse_phandle_with_args_map(void)
+ {
+-	struct device_node *np, *p0, *p1, *p2, *p3;
++	struct device_node *np, *p[6] = {};
+ 	struct of_phandle_args args;
++	unsigned int prefs[6];
+ 	int i, rc;
+ 
+ 	np = of_find_node_by_path("/testcase-data/phandle-tests/consumer-b");
+@@ -547,34 +551,24 @@ static void __init of_unittest_parse_phandle_with_args_map(void)
+ 		return;
+ 	}
+ 
+-	p0 = of_find_node_by_path("/testcase-data/phandle-tests/provider0");
+-	if (!p0) {
+-		pr_err("missing testcase data\n");
+-		return;
+-	}
+-
+-	p1 = of_find_node_by_path("/testcase-data/phandle-tests/provider1");
+-	if (!p1) {
+-		pr_err("missing testcase data\n");
+-		return;
+-	}
+-
+-	p2 = of_find_node_by_path("/testcase-data/phandle-tests/provider2");
+-	if (!p2) {
+-		pr_err("missing testcase data\n");
+-		return;
+-	}
+-
+-	p3 = of_find_node_by_path("/testcase-data/phandle-tests/provider3");
+-	if (!p3) {
+-		pr_err("missing testcase data\n");
+-		return;
++	p[0] = of_find_node_by_path("/testcase-data/phandle-tests/provider0");
++	p[1] = of_find_node_by_path("/testcase-data/phandle-tests/provider1");
++	p[2] = of_find_node_by_path("/testcase-data/phandle-tests/provider2");
++	p[3] = of_find_node_by_path("/testcase-data/phandle-tests/provider3");
++	p[4] = of_find_node_by_path("/testcase-data/phandle-tests/provider4");
++	p[5] = of_find_node_by_path("/testcase-data/phandle-tests/provider5");
++	for (i = 0; i < ARRAY_SIZE(p); ++i) {
++		if (!p[i]) {
++			pr_err("missing testcase data\n");
++			return;
++		}
++		prefs[i] = kref_read(&p[i]->kobj.kref);
+ 	}
+ 
+ 	rc = of_count_phandle_with_args(np, "phandle-list", "#phandle-cells");
+-	unittest(rc == 7, "of_count_phandle_with_args() returned %i, expected 7\n", rc);
++	unittest(rc == 8, "of_count_phandle_with_args() returned %i, expected 7\n", rc);
+ 
+-	for (i = 0; i < 8; i++) {
++	for (i = 0; i < 9; i++) {
+ 		bool passed = true;
+ 
+ 		memset(&args, 0, sizeof(args));
+@@ -585,13 +579,13 @@ static void __init of_unittest_parse_phandle_with_args_map(void)
+ 		switch (i) {
+ 		case 0:
+ 			passed &= !rc;
+-			passed &= (args.np == p1);
++			passed &= (args.np == p[1]);
+ 			passed &= (args.args_count == 1);
+ 			passed &= (args.args[0] == 1);
+ 			break;
+ 		case 1:
+ 			passed &= !rc;
+-			passed &= (args.np == p3);
++			passed &= (args.np == p[3]);
+ 			passed &= (args.args_count == 3);
+ 			passed &= (args.args[0] == 2);
+ 			passed &= (args.args[1] == 5);
+@@ -602,28 +596,36 @@ static void __init of_unittest_parse_phandle_with_args_map(void)
+ 			break;
+ 		case 3:
+ 			passed &= !rc;
+-			passed &= (args.np == p0);
++			passed &= (args.np == p[0]);
+ 			passed &= (args.args_count == 0);
+ 			break;
+ 		case 4:
+ 			passed &= !rc;
+-			passed &= (args.np == p1);
++			passed &= (args.np == p[1]);
+ 			passed &= (args.args_count == 1);
+ 			passed &= (args.args[0] == 3);
+ 			break;
+ 		case 5:
+ 			passed &= !rc;
+-			passed &= (args.np == p0);
++			passed &= (args.np == p[0]);
+ 			passed &= (args.args_count == 0);
+ 			break;
+ 		case 6:
+ 			passed &= !rc;
+-			passed &= (args.np == p2);
++			passed &= (args.np == p[2]);
+ 			passed &= (args.args_count == 2);
+ 			passed &= (args.args[0] == 15);
+ 			passed &= (args.args[1] == 0x20);
+ 			break;
+ 		case 7:
++			passed &= !rc;
++			passed &= (args.np == p[3]);
++			passed &= (args.args_count == 3);
++			passed &= (args.args[0] == 2);
++			passed &= (args.args[1] == 5);
++			passed &= (args.args[2] == 3);
++			break;
++		case 8:
+ 			passed &= (rc == -ENOENT);
+ 			break;
+ 		default:
+@@ -632,6 +634,9 @@ static void __init of_unittest_parse_phandle_with_args_map(void)
+ 
+ 		unittest(passed, "index %i - data error on node %s rc=%i\n",
+ 			 i, args.np->full_name, rc);
++
++		if (rc == 0)
++			of_node_put(args.np);
+ 	}
+ 
+ 	/* Check for missing list property */
+@@ -678,6 +683,13 @@ static void __init of_unittest_parse_phandle_with_args_map(void)
+ 		   "OF: /testcase-data/phandle-tests/consumer-b: #phandle-cells = 2 found 1");
+ 
+ 	unittest(rc == -EINVAL, "expected:%i got:%i\n", -EINVAL, rc);
++
++	for (i = 0; i < ARRAY_SIZE(p); ++i) {
++		unittest(prefs[i] == kref_read(&p[i]->kobj.kref),
++			 "provider%d: expected:%d got:%d\n",
++			 i, prefs[i], kref_read(&p[i]->kobj.kref));
++		of_node_put(p[i]);
++	}
+ }
+ 
+ static void __init of_unittest_property_string(void)
+-- 
+2.43.0
+
diff --git a/queue-6.1/of-unittest-fix-of_count_phandle_with_args-expected-.patch b/queue-6.1/of-unittest-fix-of_count_phandle_with_args-expected-.patch
new file mode 100644
index 00000000000..5cfe47cc5c4
--- /dev/null
+++ b/queue-6.1/of-unittest-fix-of_count_phandle_with_args-expected-.patch
@@ -0,0 +1,38 @@
+From 894f4d5b4d6be95f60352ec5333b59a345268610 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Jan 2024 09:50:25 +0100
+Subject: of: unittest: Fix of_count_phandle_with_args() expected value message
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 716089b417cf98d01f0dc1b39f9c47e1d7b4c965 ]
+
+The expected result value for the call to of_count_phandle_with_args()
+was updated from 7 to 8, but the accompanying error message was
+forgotten.
+
+Fixes: 4dde83569832f937 ("of: Fix double free in of_parse_phandle_with_args_map")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/20240111085025.2073894-1-geert+renesas@glider.be
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/of/unittest.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c
+index b59cb9ba1979..e541a8960f1d 100644
+--- a/drivers/of/unittest.c
++++ b/drivers/of/unittest.c
+@@ -566,7 +566,7 @@ static void __init of_unittest_parse_phandle_with_args_map(void)
+ 	}
+ 
+ 	rc = of_count_phandle_with_args(np, "phandle-list", "#phandle-cells");
+-	unittest(rc == 8, "of_count_phandle_with_args() returned %i, expected 7\n", rc);
++	unittest(rc == 8, "of_count_phandle_with_args() returned %i, expected 8\n", rc);
+ 
+ 	for (i = 0; i < 9; i++) {
+ 		bool passed = true;
+-- 
+2.43.0
+
diff --git a/queue-6.1/platform-x86-intel-vsec-enhance-and-export-intel_vse.patch b/queue-6.1/platform-x86-intel-vsec-enhance-and-export-intel_vse.patch
new file mode 100644
index 00000000000..fe0ab29438b
--- /dev/null
+++ b/queue-6.1/platform-x86-intel-vsec-enhance-and-export-intel_vse.patch
@@ -0,0 +1,109 @@
+From db68ba8b629080b9b4ecbbb14e60719122c37779 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Feb 2023 17:07:33 -0800
+Subject: platform/x86/intel/vsec: Enhance and Export intel_vsec_add_aux()
+
+From: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+
+[ Upstream commit 251a41116aebdbb7ff00fbc635b1c1a0f08119e6 ]
+
+Remove static for intel_vsec_add_aux() and export this interface so that
+it can be used by other vsec related modules.
+
+This driver creates aux devices by parsing PCI-VSEC, which allows
+individual drivers to load on those devices. Those driver may further
+create more devices on aux bus by parsing the PCI MMIO region.
+
+For example, TPMI (Topology Aware Register and PM Capsule Interface)
+creates device nodes for power management features by parsing MMIO region.
+
+When TPMI driver creates devices, it can reuse existing function
+intel_vsec_add_aux() to create aux devices with TPMI device as the parent.
+
+Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Acked-by: David E. Box <david.e.box@linux.intel.com>
+Link: https://lore.kernel.org/r/20230202010738.2186174-3-srinivas.pandruvada@linux.intel.com
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Stable-dep-of: 8cbcc1dbf8a6 ("platform/x86/intel/vsec: Fix xa_alloc memory leak")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/intel/vsec.c | 16 +++++++++++-----
+ drivers/platform/x86/intel/vsec.h |  4 ++++
+ 2 files changed, 15 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/platform/x86/intel/vsec.c b/drivers/platform/x86/intel/vsec.c
+index 483bb6565166..4d73ad741892 100644
+--- a/drivers/platform/x86/intel/vsec.c
++++ b/drivers/platform/x86/intel/vsec.c
+@@ -133,8 +133,9 @@ static void intel_vsec_dev_release(struct device *dev)
+ 	kfree(intel_vsec_dev);
+ }
+ 
+-static int intel_vsec_add_aux(struct pci_dev *pdev, struct intel_vsec_device *intel_vsec_dev,
+-			      const char *name)
++int intel_vsec_add_aux(struct pci_dev *pdev, struct device *parent,
++		       struct intel_vsec_device *intel_vsec_dev,
++		       const char *name)
+ {
+ 	struct auxiliary_device *auxdev = &intel_vsec_dev->auxdev;
+ 	int ret, id;
+@@ -146,9 +147,12 @@ static int intel_vsec_add_aux(struct pci_dev *pdev, struct intel_vsec_device *in
+ 		return ret;
+ 	}
+ 
++	if (!parent)
++		parent = &pdev->dev;
++
+ 	auxdev->id = ret;
+ 	auxdev->name = name;
+-	auxdev->dev.parent = &pdev->dev;
++	auxdev->dev.parent = parent;
+ 	auxdev->dev.release = intel_vsec_dev_release;
+ 
+ 	ret = auxiliary_device_init(auxdev);
+@@ -165,7 +169,7 @@ static int intel_vsec_add_aux(struct pci_dev *pdev, struct intel_vsec_device *in
+ 		return ret;
+ 	}
+ 
+-	ret = devm_add_action_or_reset(&pdev->dev, intel_vsec_remove_aux,
++	ret = devm_add_action_or_reset(parent, intel_vsec_remove_aux,
+ 				       auxdev);
+ 	if (ret < 0)
+ 		return ret;
+@@ -178,6 +182,7 @@ static int intel_vsec_add_aux(struct pci_dev *pdev, struct intel_vsec_device *in
+ 
+ 	return 0;
+ }
++EXPORT_SYMBOL_NS_GPL(intel_vsec_add_aux, INTEL_VSEC);
+ 
+ static int intel_vsec_add_dev(struct pci_dev *pdev, struct intel_vsec_header *header,
+ 			      struct intel_vsec_platform_info *info)
+@@ -235,7 +240,8 @@ static int intel_vsec_add_dev(struct pci_dev *pdev, struct intel_vsec_header *he
+ 	else
+ 		intel_vsec_dev->ida = &intel_vsec_ida;
+ 
+-	return intel_vsec_add_aux(pdev, intel_vsec_dev, intel_vsec_name(header->id));
++	return intel_vsec_add_aux(pdev, NULL, intel_vsec_dev,
++				  intel_vsec_name(header->id));
+ }
+ 
+ static bool intel_vsec_walk_header(struct pci_dev *pdev,
+diff --git a/drivers/platform/x86/intel/vsec.h b/drivers/platform/x86/intel/vsec.h
+index 3deeb05cf394..d02c340fd458 100644
+--- a/drivers/platform/x86/intel/vsec.h
++++ b/drivers/platform/x86/intel/vsec.h
+@@ -40,6 +40,10 @@ struct intel_vsec_device {
+ 	int num_resources;
+ };
+ 
++int intel_vsec_add_aux(struct pci_dev *pdev, struct device *parent,
++		       struct intel_vsec_device *intel_vsec_dev,
++		       const char *name);
++
+ static inline struct intel_vsec_device *dev_to_ivdev(struct device *dev)
+ {
+ 	return container_of(dev, struct intel_vsec_device, auxdev.dev);
+-- 
+2.43.0
+
diff --git a/queue-6.1/platform-x86-intel-vsec-fix-xa_alloc-memory-leak.patch b/queue-6.1/platform-x86-intel-vsec-fix-xa_alloc-memory-leak.patch
new file mode 100644
index 00000000000..4b0e8dd0940
--- /dev/null
+++ b/queue-6.1/platform-x86-intel-vsec-fix-xa_alloc-memory-leak.patch
@@ -0,0 +1,105 @@
+From a31bbb6076efc012821e5c3ddb8ebed5863e075a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Nov 2023 14:21:13 -0800
+Subject: platform/x86/intel/vsec: Fix xa_alloc memory leak
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: David E. Box <david.e.box@linux.intel.com>
+
+[ Upstream commit 8cbcc1dbf8a62c730fadd60de761e0658547a589 ]
+
+Commit 936874b77dd0 ("platform/x86/intel/vsec: Add PCI error recovery
+support to Intel PMT") added an xarray to track the list of vsec devices to
+be recovered after a PCI error. But it did not provide cleanup for the list
+leading to a memory leak that was caught by kmemleak.  Do xa_alloc() before
+devm_add_action_or_reset() so that the list may be cleaned up with
+xa_erase() in the release function.
+
+Fixes: 936874b77dd0 ("platform/x86/intel/vsec: Add PCI error recovery support to Intel PMT")
+Signed-off-by: David E. Box <david.e.box@linux.intel.com>
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Link: https://lore.kernel.org/r/20231129222132.2331261-2-david.e.box@linux.intel.com
+[hdegoede@redhat.com: Add missing xa_erase() on error-exit
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/intel/vsec.c | 25 +++++++++++++++----------
+ drivers/platform/x86/intel/vsec.h |  1 +
+ 2 files changed, 16 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/platform/x86/intel/vsec.c b/drivers/platform/x86/intel/vsec.c
+index 7e2e7a37e07e..40477d1d41b5 100644
+--- a/drivers/platform/x86/intel/vsec.c
++++ b/drivers/platform/x86/intel/vsec.c
+@@ -130,6 +130,8 @@ static void intel_vsec_dev_release(struct device *dev)
+ {
+ 	struct intel_vsec_device *intel_vsec_dev = dev_to_ivdev(dev);
+ 
++	xa_erase(&auxdev_array, intel_vsec_dev->id);
++
+ 	mutex_lock(&vsec_ida_lock);
+ 	ida_free(intel_vsec_dev->ida, intel_vsec_dev->auxdev.id);
+ 	mutex_unlock(&vsec_ida_lock);
+@@ -145,19 +147,28 @@ int intel_vsec_add_aux(struct pci_dev *pdev, struct device *parent,
+ 	struct auxiliary_device *auxdev = &intel_vsec_dev->auxdev;
+ 	int ret, id;
+ 
+-	mutex_lock(&vsec_ida_lock);
+-	ret = ida_alloc(intel_vsec_dev->ida, GFP_KERNEL);
+-	mutex_unlock(&vsec_ida_lock);
++	ret = xa_alloc(&auxdev_array, &intel_vsec_dev->id, intel_vsec_dev,
++		       PMT_XA_LIMIT, GFP_KERNEL);
+ 	if (ret < 0) {
+ 		kfree(intel_vsec_dev->resource);
+ 		kfree(intel_vsec_dev);
+ 		return ret;
+ 	}
+ 
++	mutex_lock(&vsec_ida_lock);
++	id = ida_alloc(intel_vsec_dev->ida, GFP_KERNEL);
++	mutex_unlock(&vsec_ida_lock);
++	if (id < 0) {
++		xa_erase(&auxdev_array, intel_vsec_dev->id);
++		kfree(intel_vsec_dev->resource);
++		kfree(intel_vsec_dev);
++		return id;
++	}
++
+ 	if (!parent)
+ 		parent = &pdev->dev;
+ 
+-	auxdev->id = ret;
++	auxdev->id = id;
+ 	auxdev->name = name;
+ 	auxdev->dev.parent = parent;
+ 	auxdev->dev.release = intel_vsec_dev_release;
+@@ -183,12 +194,6 @@ int intel_vsec_add_aux(struct pci_dev *pdev, struct device *parent,
+ 	if (ret < 0)
+ 		return ret;
+ 
+-	/* Add auxdev to list */
+-	ret = xa_alloc(&auxdev_array, &id, intel_vsec_dev, PMT_XA_LIMIT,
+-		       GFP_KERNEL);
+-	if (ret)
+-		return ret;
+-
+ 	return 0;
+ }
+ EXPORT_SYMBOL_NS_GPL(intel_vsec_add_aux, INTEL_VSEC);
+diff --git a/drivers/platform/x86/intel/vsec.h b/drivers/platform/x86/intel/vsec.h
+index ae8fe92c5595..330672588868 100644
+--- a/drivers/platform/x86/intel/vsec.h
++++ b/drivers/platform/x86/intel/vsec.h
+@@ -38,6 +38,7 @@ struct intel_vsec_device {
+ 	struct ida *ida;
+ 	struct intel_vsec_platform_info *info;
+ 	int num_resources;
++	int id; /* xa */
+ 	void *priv_data;
+ 	size_t priv_data_size;
+ };
+-- 
+2.43.0
+
diff --git a/queue-6.1/platform-x86-intel-vsec-support-private-data.patch b/queue-6.1/platform-x86-intel-vsec-support-private-data.patch
new file mode 100644
index 00000000000..6877b3a2f3f
--- /dev/null
+++ b/queue-6.1/platform-x86-intel-vsec-support-private-data.patch
@@ -0,0 +1,45 @@
+From 1f7a258b626c0a8c0276a7874d575dae5b2e41bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Feb 2023 17:07:34 -0800
+Subject: platform/x86/intel/vsec: Support private data
+
+From: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+
+[ Upstream commit 4ec5d0231d2e4aebe41152d57c6b4f1e7ea14f08 ]
+
+Add fields to struct intel_vsec_device, so that core module (which
+creates aux bus devices) can pass private data to the client drivers.
+
+For example there is one vsec device instance per CPU package. On a
+multi package system, this private data can be used to pass the package
+ID. This package id can be used by client drivers to change power
+settings for a specific CPU package by targeting MMIO space of the
+correct PCI device.
+
+Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Acked-by: David E. Box <david.e.box@linux.intel.com>
+Link: https://lore.kernel.org/r/20230202010738.2186174-4-srinivas.pandruvada@linux.intel.com
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Stable-dep-of: 8cbcc1dbf8a6 ("platform/x86/intel/vsec: Fix xa_alloc memory leak")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/intel/vsec.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/platform/x86/intel/vsec.h b/drivers/platform/x86/intel/vsec.h
+index d02c340fd458..ae8fe92c5595 100644
+--- a/drivers/platform/x86/intel/vsec.h
++++ b/drivers/platform/x86/intel/vsec.h
+@@ -38,6 +38,8 @@ struct intel_vsec_device {
+ 	struct ida *ida;
+ 	struct intel_vsec_platform_info *info;
+ 	int num_resources;
++	void *priv_data;
++	size_t priv_data_size;
+ };
+ 
+ int intel_vsec_add_aux(struct pci_dev *pdev, struct device *parent,
+-- 
+2.43.0
+
diff --git a/queue-6.1/platform-x86-intel-vsec-use-mutex-for-ida_alloc-and-.patch b/queue-6.1/platform-x86-intel-vsec-use-mutex-for-ida_alloc-and-.patch
new file mode 100644
index 00000000000..3e1b83a010a
--- /dev/null
+++ b/queue-6.1/platform-x86-intel-vsec-use-mutex-for-ida_alloc-and-.patch
@@ -0,0 +1,69 @@
+From 52a371f1a5462ca16ef203cbaab80fab81fedca8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Feb 2023 04:58:21 -0800
+Subject: platform/x86/intel/vsec: Use mutex for ida_alloc() and ida_free()
+
+From: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+
+[ Upstream commit 9a90ea7d378486aa358330dafc7e8c3b27de4d84 ]
+
+ID alloc and free functions don't have in built protection for parallel
+invocation of ida_alloc() and ida_free(). With the current flow in the
+vsec driver, there is no such scenario. But add mutex protection for
+potential future changes.
+
+Suggested-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Link: https://lore.kernel.org/r/20230207125821.3837799-1-srinivas.pandruvada@linux.intel.com
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Stable-dep-of: 8cbcc1dbf8a6 ("platform/x86/intel/vsec: Fix xa_alloc memory leak")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/intel/vsec.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/platform/x86/intel/vsec.c b/drivers/platform/x86/intel/vsec.c
+index 4d73ad741892..7e2e7a37e07e 100644
+--- a/drivers/platform/x86/intel/vsec.c
++++ b/drivers/platform/x86/intel/vsec.c
+@@ -124,11 +124,16 @@ static void intel_vsec_remove_aux(void *data)
+ 	auxiliary_device_uninit(data);
+ }
+ 
++static DEFINE_MUTEX(vsec_ida_lock);
++
+ static void intel_vsec_dev_release(struct device *dev)
+ {
+ 	struct intel_vsec_device *intel_vsec_dev = dev_to_ivdev(dev);
+ 
++	mutex_lock(&vsec_ida_lock);
+ 	ida_free(intel_vsec_dev->ida, intel_vsec_dev->auxdev.id);
++	mutex_unlock(&vsec_ida_lock);
++
+ 	kfree(intel_vsec_dev->resource);
+ 	kfree(intel_vsec_dev);
+ }
+@@ -140,7 +145,9 @@ int intel_vsec_add_aux(struct pci_dev *pdev, struct device *parent,
+ 	struct auxiliary_device *auxdev = &intel_vsec_dev->auxdev;
+ 	int ret, id;
+ 
++	mutex_lock(&vsec_ida_lock);
+ 	ret = ida_alloc(intel_vsec_dev->ida, GFP_KERNEL);
++	mutex_unlock(&vsec_ida_lock);
+ 	if (ret < 0) {
+ 		kfree(intel_vsec_dev->resource);
+ 		kfree(intel_vsec_dev);
+@@ -157,7 +164,9 @@ int intel_vsec_add_aux(struct pci_dev *pdev, struct device *parent,
+ 
+ 	ret = auxiliary_device_init(auxdev);
+ 	if (ret < 0) {
++		mutex_lock(&vsec_ida_lock);
+ 		ida_free(intel_vsec_dev->ida, auxdev->id);
++		mutex_unlock(&vsec_ida_lock);
+ 		kfree(intel_vsec_dev->resource);
+ 		kfree(intel_vsec_dev);
+ 		return ret;
+-- 
+2.43.0
+
diff --git a/queue-6.1/pnfs-fix-the-pnfs-block-driver-s-calculation-of-layo.patch b/queue-6.1/pnfs-fix-the-pnfs-block-driver-s-calculation-of-layo.patch
new file mode 100644
index 00000000000..421040a0ed0
--- /dev/null
+++ b/queue-6.1/pnfs-fix-the-pnfs-block-driver-s-calculation-of-layo.patch
@@ -0,0 +1,92 @@
+From e3540443175815553db3405d9dc9a25928e4a5b1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Nov 2023 06:25:13 -0500
+Subject: pNFS: Fix the pnfs block driver's calculation of layoutget size
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+[ Upstream commit 8a6291bf3b0eae1bf26621e6419a91682f2d6227 ]
+
+Instead of relying on the value of the 'bytes_left' field, we should
+calculate the layout size based on the offset of the request that is
+being written out.
+
+Reported-by: Benjamin Coddington <bcodding@redhat.com>
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Fixes: 954998b60caa ("NFS: Fix error handling for O_DIRECT write scheduling")
+Reviewed-by: Benjamin Coddington <bcodding@redhat.com>
+Tested-by: Benjamin Coddington <bcodding@redhat.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/blocklayout/blocklayout.c | 5 ++---
+ fs/nfs/direct.c                  | 5 +++--
+ fs/nfs/internal.h                | 2 +-
+ fs/nfs/pnfs.c                    | 3 ++-
+ 4 files changed, 8 insertions(+), 7 deletions(-)
+
+diff --git a/fs/nfs/blocklayout/blocklayout.c b/fs/nfs/blocklayout/blocklayout.c
+index 1d1d7abc3205..6be13e0ec170 100644
+--- a/fs/nfs/blocklayout/blocklayout.c
++++ b/fs/nfs/blocklayout/blocklayout.c
+@@ -895,10 +895,9 @@ bl_pg_init_write(struct nfs_pageio_descriptor *pgio, struct nfs_page *req)
+ 	}
+ 
+ 	if (pgio->pg_dreq == NULL)
+-		wb_size = pnfs_num_cont_bytes(pgio->pg_inode,
+-					      req->wb_index);
++		wb_size = pnfs_num_cont_bytes(pgio->pg_inode, req->wb_index);
+ 	else
+-		wb_size = nfs_dreq_bytes_left(pgio->pg_dreq);
++		wb_size = nfs_dreq_bytes_left(pgio->pg_dreq, req_offset(req));
+ 
+ 	pnfs_generic_pg_init_write(pgio, req, wb_size);
+ 
+diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c
+index 3bb530d4bb5c..8fdb65e1b14a 100644
+--- a/fs/nfs/direct.c
++++ b/fs/nfs/direct.c
+@@ -195,9 +195,10 @@ static void nfs_direct_req_release(struct nfs_direct_req *dreq)
+ 	kref_put(&dreq->kref, nfs_direct_req_free);
+ }
+ 
+-ssize_t nfs_dreq_bytes_left(struct nfs_direct_req *dreq)
++ssize_t nfs_dreq_bytes_left(struct nfs_direct_req *dreq, loff_t offset)
+ {
+-	return dreq->bytes_left;
++	loff_t start = offset - dreq->io_start;
++	return dreq->max_count - start;
+ }
+ EXPORT_SYMBOL_GPL(nfs_dreq_bytes_left);
+ 
+diff --git a/fs/nfs/internal.h b/fs/nfs/internal.h
+index 4b07a0508f9d..35a8ae46b6c3 100644
+--- a/fs/nfs/internal.h
++++ b/fs/nfs/internal.h
+@@ -640,7 +640,7 @@ extern int nfs_sillyrename(struct inode *dir, struct dentry *dentry);
+ /* direct.c */
+ void nfs_init_cinfo_from_dreq(struct nfs_commit_info *cinfo,
+ 			      struct nfs_direct_req *dreq);
+-extern ssize_t nfs_dreq_bytes_left(struct nfs_direct_req *dreq);
++extern ssize_t nfs_dreq_bytes_left(struct nfs_direct_req *dreq, loff_t offset);
+ 
+ /* nfs4proc.c */
+ extern struct nfs_client *nfs4_init_client(struct nfs_client *clp,
+diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
+index 1ffb1068216b..4448ff829cbb 100644
+--- a/fs/nfs/pnfs.c
++++ b/fs/nfs/pnfs.c
+@@ -2729,7 +2729,8 @@ pnfs_generic_pg_init_read(struct nfs_pageio_descriptor *pgio, struct nfs_page *r
+ 		if (pgio->pg_dreq == NULL)
+ 			rd_size = i_size_read(pgio->pg_inode) - req_offset(req);
+ 		else
+-			rd_size = nfs_dreq_bytes_left(pgio->pg_dreq);
++			rd_size = nfs_dreq_bytes_left(pgio->pg_dreq,
++						      req_offset(req));
+ 
+ 		pgio->pg_lseg =
+ 			pnfs_update_layout(pgio->pg_inode, nfs_req_openctx(req),
+-- 
+2.43.0
+
diff --git a/queue-6.1/powerpc-44x-select-i2c-for-currituck.patch b/queue-6.1/powerpc-44x-select-i2c-for-currituck.patch
new file mode 100644
index 00000000000..1257a6ebd97
--- /dev/null
+++ b/queue-6.1/powerpc-44x-select-i2c-for-currituck.patch
@@ -0,0 +1,43 @@
+From 0d0f9285920def7fc6ce9dde62933d02761cbc3a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Nov 2023 21:51:59 -0800
+Subject: powerpc/44x: select I2C for CURRITUCK
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 4a74197b65e69c46fe6e53f7df2f4d6ce9ffe012 ]
+
+Fix build errors when CURRITUCK=y and I2C is not builtin (=m or is
+not set). Fixes these build errors:
+
+powerpc-linux-ld: arch/powerpc/platforms/44x/ppc476.o: in function `avr_halt_system':
+ppc476.c:(.text+0x58): undefined reference to `i2c_smbus_write_byte_data'
+powerpc-linux-ld: arch/powerpc/platforms/44x/ppc476.o: in function `ppc47x_device_probe':
+ppc476.c:(.init.text+0x18): undefined reference to `i2c_register_driver'
+
+Fixes: 2a2c74b2efcb ("IBM Akebono: Add the Akebono platform")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: lore.kernel.org/r/202312010820.cmdwF5X9-lkp@intel.com
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20231201055159.8371-1-rdunlap@infradead.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/44x/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/powerpc/platforms/44x/Kconfig b/arch/powerpc/platforms/44x/Kconfig
+index 25b80cd558f8..fc79f8466933 100644
+--- a/arch/powerpc/platforms/44x/Kconfig
++++ b/arch/powerpc/platforms/44x/Kconfig
+@@ -173,6 +173,7 @@ config ISS4xx
+ config CURRITUCK
+ 	bool "IBM Currituck (476fpe) Support"
+ 	depends on PPC_47x
++	select I2C
+ 	select SWIOTLB
+ 	select 476FPE
+ 	select FORCE_PCI
+-- 
+2.43.0
+
diff --git a/queue-6.1/powerpc-add-crtsavres.o-to-always-y-instead-of-extra.patch b/queue-6.1/powerpc-add-crtsavres.o-to-always-y-instead-of-extra.patch
new file mode 100644
index 00000000000..68abdf48a01
--- /dev/null
+++ b/queue-6.1/powerpc-add-crtsavres.o-to-always-y-instead-of-extra.patch
@@ -0,0 +1,50 @@
+From d477f063f2b8c4354324273de56b5f5f0557ed45 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Nov 2023 08:23:32 +0900
+Subject: powerpc: add crtsavres.o to always-y instead of extra-y
+
+From: Masahiro Yamada <masahiroy@kernel.org>
+
+[ Upstream commit 1b1e38002648819c04773647d5242990e2824264 ]
+
+crtsavres.o is linked to modules. However, as explained in commit
+d0e628cd817f ("kbuild: doc: clarify the difference between extra-y
+and always-y"), 'make modules' does not build extra-y.
+
+For example, the following command fails:
+
+  $ make ARCH=powerpc LLVM=1 KBUILD_MODPOST_WARN=1 mrproper ps3_defconfig modules
+    [snip]
+    LD [M]  arch/powerpc/platforms/cell/spufs/spufs.ko
+  ld.lld: error: cannot open arch/powerpc/lib/crtsavres.o: No such file or directory
+  make[3]: *** [scripts/Makefile.modfinal:56: arch/powerpc/platforms/cell/spufs/spufs.ko] Error 1
+  make[2]: *** [Makefile:1844: modules] Error 2
+  make[1]: *** [/home/masahiro/workspace/linux-kbuild/Makefile:350: __build_one_by_one] Error 2
+  make: *** [Makefile:234: __sub-make] Error 2
+
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Fixes: baa25b571a16 ("powerpc/64: Do not link crtsavres.o in vmlinux")
+Reviewed-by: Nicholas Piggin <npiggin@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20231120232332.4100288-1-masahiroy@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/lib/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/lib/Makefile b/arch/powerpc/lib/Makefile
+index b705c89f3e21..9b394bab17eb 100644
+--- a/arch/powerpc/lib/Makefile
++++ b/arch/powerpc/lib/Makefile
+@@ -43,7 +43,7 @@ obj-$(CONFIG_FUNCTION_ERROR_INJECTION)	+= error-inject.o
+ # so it is only needed for modules, and only for older linkers which
+ # do not support --save-restore-funcs
+ ifndef CONFIG_LD_IS_BFD
+-extra-$(CONFIG_PPC64)	+= crtsavres.o
++always-$(CONFIG_PPC64)	+= crtsavres.o
+ endif
+ 
+ obj-$(CONFIG_PPC_BOOK3S_64) += copyuser_power7.o copypage_power7.o \
+-- 
+2.43.0
+
diff --git a/queue-6.1/powerpc-imc-pmu-add-a-null-pointer-check-in-update_e.patch b/queue-6.1/powerpc-imc-pmu-add-a-null-pointer-check-in-update_e.patch
new file mode 100644
index 00000000000..cf5ea4f11f3
--- /dev/null
+++ b/queue-6.1/powerpc-imc-pmu-add-a-null-pointer-check-in-update_e.patch
@@ -0,0 +1,55 @@
+From 1dbbc2c188b11f75895707a29d4fad8349c93d40 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 26 Nov 2023 17:37:19 +0800
+Subject: powerpc/imc-pmu: Add a null pointer check in update_events_in_group()
+
+From: Kunwu Chan <chentao@kylinos.cn>
+
+[ Upstream commit 0a233867a39078ebb0f575e2948593bbff5826b3 ]
+
+kasprintf() returns a pointer to dynamically allocated memory
+which can be NULL upon failure.
+
+Fixes: 885dcd709ba9 ("powerpc/perf: Add nest IMC PMU support")
+Signed-off-by: Kunwu Chan <chentao@kylinos.cn>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20231126093719.1440305-1-chentao@kylinos.cn
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/perf/imc-pmu.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/arch/powerpc/perf/imc-pmu.c b/arch/powerpc/perf/imc-pmu.c
+index ada817c49b72..56d82f7f9734 100644
+--- a/arch/powerpc/perf/imc-pmu.c
++++ b/arch/powerpc/perf/imc-pmu.c
+@@ -299,6 +299,8 @@ static int update_events_in_group(struct device_node *node, struct imc_pmu *pmu)
+ 	attr_group->attrs = attrs;
+ 	do {
+ 		ev_val_str = kasprintf(GFP_KERNEL, "event=0x%x", pmu->events[i].value);
++		if (!ev_val_str)
++			continue;
+ 		dev_str = device_str_attr_create(pmu->events[i].name, ev_val_str);
+ 		if (!dev_str)
+ 			continue;
+@@ -306,6 +308,8 @@ static int update_events_in_group(struct device_node *node, struct imc_pmu *pmu)
+ 		attrs[j++] = dev_str;
+ 		if (pmu->events[i].scale) {
+ 			ev_scale_str = kasprintf(GFP_KERNEL, "%s.scale", pmu->events[i].name);
++			if (!ev_scale_str)
++				continue;
+ 			dev_str = device_str_attr_create(ev_scale_str, pmu->events[i].scale);
+ 			if (!dev_str)
+ 				continue;
+@@ -315,6 +319,8 @@ static int update_events_in_group(struct device_node *node, struct imc_pmu *pmu)
+ 
+ 		if (pmu->events[i].unit) {
+ 			ev_unit_str = kasprintf(GFP_KERNEL, "%s.unit", pmu->events[i].name);
++			if (!ev_unit_str)
++				continue;
+ 			dev_str = device_str_attr_create(ev_unit_str, pmu->events[i].unit);
+ 			if (!dev_str)
+ 				continue;
+-- 
+2.43.0
+
diff --git a/queue-6.1/powerpc-powernv-add-a-null-pointer-check-in-opal_eve.patch b/queue-6.1/powerpc-powernv-add-a-null-pointer-check-in-opal_eve.patch
new file mode 100644
index 00000000000..f7c3af0ec14
--- /dev/null
+++ b/queue-6.1/powerpc-powernv-add-a-null-pointer-check-in-opal_eve.patch
@@ -0,0 +1,37 @@
+From 08e9bbe44cb91e201923fe3dea0a318a509b7b0c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Nov 2023 11:07:55 +0800
+Subject: powerpc/powernv: Add a null pointer check in opal_event_init()
+
+From: Kunwu Chan <chentao@kylinos.cn>
+
+[ Upstream commit 8649829a1dd25199bbf557b2621cedb4bf9b3050 ]
+
+kasprintf() returns a pointer to dynamically allocated memory
+which can be NULL upon failure.
+
+Fixes: 2717a33d6074 ("powerpc/opal-irqchip: Use interrupt names if present")
+Signed-off-by: Kunwu Chan <chentao@kylinos.cn>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20231127030755.1546750-1-chentao@kylinos.cn
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/powernv/opal-irqchip.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/powerpc/platforms/powernv/opal-irqchip.c b/arch/powerpc/platforms/powernv/opal-irqchip.c
+index d55652b5f6fa..391f50535200 100644
+--- a/arch/powerpc/platforms/powernv/opal-irqchip.c
++++ b/arch/powerpc/platforms/powernv/opal-irqchip.c
+@@ -275,6 +275,8 @@ int __init opal_event_init(void)
+ 		else
+ 			name = kasprintf(GFP_KERNEL, "opal");
+ 
++		if (!name)
++			continue;
+ 		/* Install interrupt handler */
+ 		rc = request_irq(r->start, opal_interrupt, r->flags & IRQD_TRIGGER_MASK,
+ 				 name, NULL);
+-- 
+2.43.0
+
diff --git a/queue-6.1/powerpc-powernv-add-a-null-pointer-check-in-opal_pow.patch b/queue-6.1/powerpc-powernv-add-a-null-pointer-check-in-opal_pow.patch
new file mode 100644
index 00000000000..5ff75679588
--- /dev/null
+++ b/queue-6.1/powerpc-powernv-add-a-null-pointer-check-in-opal_pow.patch
@@ -0,0 +1,41 @@
+From 5947cde35aa1a256bd18381bba956e973373ba4b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 26 Nov 2023 17:57:39 +0800
+Subject: powerpc/powernv: Add a null pointer check in opal_powercap_init()
+
+From: Kunwu Chan <chentao@kylinos.cn>
+
+[ Upstream commit e123015c0ba859cf48aa7f89c5016cc6e98e018d ]
+
+kasprintf() returns a pointer to dynamically allocated memory
+which can be NULL upon failure.
+
+Fixes: b9ef7b4b867f ("powerpc: Convert to using %pOFn instead of device_node.name")
+Signed-off-by: Kunwu Chan <chentao@kylinos.cn>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20231126095739.1501990-1-chentao@kylinos.cn
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/powernv/opal-powercap.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/arch/powerpc/platforms/powernv/opal-powercap.c b/arch/powerpc/platforms/powernv/opal-powercap.c
+index 7bfe4cbeb35a..ea917266aa17 100644
+--- a/arch/powerpc/platforms/powernv/opal-powercap.c
++++ b/arch/powerpc/platforms/powernv/opal-powercap.c
+@@ -196,6 +196,12 @@ void __init opal_powercap_init(void)
+ 
+ 		j = 0;
+ 		pcaps[i].pg.name = kasprintf(GFP_KERNEL, "%pOFn", node);
++		if (!pcaps[i].pg.name) {
++			kfree(pcaps[i].pattrs);
++			kfree(pcaps[i].pg.attrs);
++			goto out_pcaps_pattrs;
++		}
++
+ 		if (has_min) {
+ 			powercap_add_attr(min, "powercap-min",
+ 					  &pcaps[i].pattrs[j]);
+-- 
+2.43.0
+
diff --git a/queue-6.1/powerpc-powernv-add-a-null-pointer-check-to-scom_deb.patch b/queue-6.1/powerpc-powernv-add-a-null-pointer-check-to-scom_deb.patch
new file mode 100644
index 00000000000..cf86149f8f6
--- /dev/null
+++ b/queue-6.1/powerpc-powernv-add-a-null-pointer-check-to-scom_deb.patch
@@ -0,0 +1,41 @@
+From 652ebf5b78372b4ec0d1d5353e5273818a36af59 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Dec 2023 16:59:37 +0800
+Subject: powerpc/powernv: Add a null pointer check to scom_debug_init_one()
+
+From: Kunwu Chan <chentao@kylinos.cn>
+
+[ Upstream commit 9a260f2dd827bbc82cc60eb4f4d8c22707d80742 ]
+
+kasprintf() returns a pointer to dynamically allocated memory
+which can be NULL upon failure.
+Add a null pointer check, and release 'ent' to avoid memory leaks.
+
+Fixes: bfd2f0d49aef ("powerpc/powernv: Get rid of old scom_controller abstraction")
+Signed-off-by: Kunwu Chan <chentao@kylinos.cn>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20231208085937.107210-1-chentao@kylinos.cn
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/powernv/opal-xscom.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/arch/powerpc/platforms/powernv/opal-xscom.c b/arch/powerpc/platforms/powernv/opal-xscom.c
+index 6b4eed2ef4fa..f67235d1ba2c 100644
+--- a/arch/powerpc/platforms/powernv/opal-xscom.c
++++ b/arch/powerpc/platforms/powernv/opal-xscom.c
+@@ -165,6 +165,11 @@ static int scom_debug_init_one(struct dentry *root, struct device_node *dn,
+ 	ent->chip = chip;
+ 	snprintf(ent->name, 16, "%08x", chip);
+ 	ent->path.data = (void *)kasprintf(GFP_KERNEL, "%pOF", dn);
++	if (!ent->path.data) {
++		kfree(ent);
++		return -ENOMEM;
++	}
++
+ 	ent->path.size = strlen((char *)ent->path.data);
+ 
+ 	dir = debugfs_create_dir(ent->name, root);
+-- 
+2.43.0
+
diff --git a/queue-6.1/powerpc-pseries-memhp-fix-access-beyond-end-of-drmem.patch b/queue-6.1/powerpc-pseries-memhp-fix-access-beyond-end-of-drmem.patch
new file mode 100644
index 00000000000..692e42e7f54
--- /dev/null
+++ b/queue-6.1/powerpc-pseries-memhp-fix-access-beyond-end-of-drmem.patch
@@ -0,0 +1,101 @@
+From 8e65433cec8c96cd1066ce1427343cda0625b191 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Nov 2023 11:01:53 -0600
+Subject: powerpc/pseries/memhp: Fix access beyond end of drmem array
+
+From: Nathan Lynch <nathanl@linux.ibm.com>
+
+[ Upstream commit bd68ffce69f6cf8ddd3a3c32549d1d2275e49fc5 ]
+
+dlpar_memory_remove_by_index() may access beyond the bounds of the
+drmem lmb array when the LMB lookup fails to match an entry with the
+given DRC index. When the search fails, the cursor is left pointing to
+&drmem_info->lmbs[drmem_info->n_lmbs], which is one element past the
+last valid entry in the array. The debug message at the end of the
+function then dereferences this pointer:
+
+        pr_debug("Failed to hot-remove memory at %llx\n",
+                 lmb->base_addr);
+
+This was found by inspection and confirmed with KASAN:
+
+  pseries-hotplug-mem: Attempting to hot-remove LMB, drc index 1234
+  ==================================================================
+  BUG: KASAN: slab-out-of-bounds in dlpar_memory+0x298/0x1658
+  Read of size 8 at addr c000000364e97fd0 by task bash/949
+
+  dump_stack_lvl+0xa4/0xfc (unreliable)
+  print_report+0x214/0x63c
+  kasan_report+0x140/0x2e0
+  __asan_load8+0xa8/0xe0
+  dlpar_memory+0x298/0x1658
+  handle_dlpar_errorlog+0x130/0x1d0
+  dlpar_store+0x18c/0x3e0
+  kobj_attr_store+0x68/0xa0
+  sysfs_kf_write+0xc4/0x110
+  kernfs_fop_write_iter+0x26c/0x390
+  vfs_write+0x2d4/0x4e0
+  ksys_write+0xac/0x1a0
+  system_call_exception+0x268/0x530
+  system_call_vectored_common+0x15c/0x2ec
+
+  Allocated by task 1:
+   kasan_save_stack+0x48/0x80
+   kasan_set_track+0x34/0x50
+   kasan_save_alloc_info+0x34/0x50
+   __kasan_kmalloc+0xd0/0x120
+   __kmalloc+0x8c/0x320
+   kmalloc_array.constprop.0+0x48/0x5c
+   drmem_init+0x2a0/0x41c
+   do_one_initcall+0xe0/0x5c0
+   kernel_init_freeable+0x4ec/0x5a0
+   kernel_init+0x30/0x1e0
+   ret_from_kernel_user_thread+0x14/0x1c
+
+  The buggy address belongs to the object at c000000364e80000
+   which belongs to the cache kmalloc-128k of size 131072
+  The buggy address is located 0 bytes to the right of
+   allocated 98256-byte region [c000000364e80000, c000000364e97fd0)
+
+  ==================================================================
+  pseries-hotplug-mem: Failed to hot-remove memory at 0
+
+Log failed lookups with a separate message and dereference the
+cursor only when it points to a valid entry.
+
+Signed-off-by: Nathan Lynch <nathanl@linux.ibm.com>
+Fixes: 51925fb3c5c9 ("powerpc/pseries: Implement memory hotplug remove in the kernel")
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20231114-pseries-memhp-fixes-v1-1-fb8f2bb7c557@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/pseries/hotplug-memory.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/arch/powerpc/platforms/pseries/hotplug-memory.c b/arch/powerpc/platforms/pseries/hotplug-memory.c
+index 2e3a317722a8..051a777ba1b2 100644
+--- a/arch/powerpc/platforms/pseries/hotplug-memory.c
++++ b/arch/powerpc/platforms/pseries/hotplug-memory.c
+@@ -500,14 +500,15 @@ static int dlpar_memory_remove_by_index(u32 drc_index)
+ 		}
+ 	}
+ 
+-	if (!lmb_found)
++	if (!lmb_found) {
++		pr_debug("Failed to look up LMB for drc index %x\n", drc_index);
+ 		rc = -EINVAL;
+-
+-	if (rc)
++	} else if (rc) {
+ 		pr_debug("Failed to hot-remove memory at %llx\n",
+ 			 lmb->base_addr);
+-	else
++	} else {
+ 		pr_debug("Memory at %llx was hot-removed\n", lmb->base_addr);
++	}
+ 
+ 	return rc;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.1/powerpc-remove-checks-for-binutils-older-than-2.25.patch b/queue-6.1/powerpc-remove-checks-for-binutils-older-than-2.25.patch
new file mode 100644
index 00000000000..b65e4448c74
--- /dev/null
+++ b/queue-6.1/powerpc-remove-checks-for-binutils-older-than-2.25.patch
@@ -0,0 +1,96 @@
+From 71cbe64487ced1c21d177e6e478d6f8e473f9b45 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Jan 2023 17:22:50 +0900
+Subject: powerpc: remove checks for binutils older than 2.25
+
+From: Masahiro Yamada <masahiroy@kernel.org>
+
+[ Upstream commit 54a11654de163994e32b24e3aa90ef81f4a3184d ]
+
+Commit e4412739472b ("Documentation: raise minimum supported version of
+binutils to 2.25") allows us to remove the checks for old binutils.
+
+There is no more user for ld-ifversion. Remove it as well.
+
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Reviewed-by: Nicholas Piggin <npiggin@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20230119082250.151485-1-masahiroy@kernel.org
+Stable-dep-of: 1b1e38002648 ("powerpc: add crtsavres.o to always-y instead of extra-y")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/Makefile     | 17 +----------------
+ arch/powerpc/lib/Makefile |  2 +-
+ scripts/Makefile.compiler |  4 ----
+ 3 files changed, 2 insertions(+), 21 deletions(-)
+
+diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile
+index 054844153b1f..487e4967b60d 100644
+--- a/arch/powerpc/Makefile
++++ b/arch/powerpc/Makefile
+@@ -42,18 +42,13 @@ machine-$(CONFIG_PPC64) += 64
+ machine-$(CONFIG_CPU_LITTLE_ENDIAN) += le
+ UTS_MACHINE := $(subst $(space),,$(machine-y))
+ 
+-# XXX This needs to be before we override LD below
+-ifdef CONFIG_PPC32
+-KBUILD_LDFLAGS_MODULE += arch/powerpc/lib/crtsavres.o
+-else
+-ifeq ($(call ld-ifversion, -ge, 22500, y),y)
++ifeq ($(CONFIG_PPC64)$(CONFIG_LD_IS_BFD),yy)
+ # Have the linker provide sfpr if possible.
+ # There is a corresponding test in arch/powerpc/lib/Makefile
+ KBUILD_LDFLAGS_MODULE += --save-restore-funcs
+ else
+ KBUILD_LDFLAGS_MODULE += arch/powerpc/lib/crtsavres.o
+ endif
+-endif
+ 
+ ifdef CONFIG_CPU_LITTLE_ENDIAN
+ KBUILD_CFLAGS	+= -mlittle-endian
+@@ -391,17 +386,7 @@ endif
+ endif
+ 
+ PHONY += checkbin
+-# Check toolchain versions:
+-# - gcc-4.6 is the minimum kernel-wide version so nothing required.
+ checkbin:
+-	@if test "x${CONFIG_LD_IS_LLD}" != "xy" -a \
+-		"x$(call ld-ifversion, -le, 22400, y)" = "xy" ; then \
+-		echo -n '*** binutils 2.24 miscompiles weak symbols ' ; \
+-		echo 'in some circumstances.' ; \
+-		echo    '*** binutils 2.23 do not define the TOC symbol ' ; \
+-		echo -n '*** Please use a different binutils version.' ; \
+-		false ; \
+-	fi
+ 	@if test "x${CONFIG_FTRACE_MCOUNT_USE_RECORDMCOUNT}" = "xy" -a \
+ 		"x${CONFIG_LD_IS_BFD}" = "xy" -a \
+ 		"${CONFIG_LD_VERSION}" = "23700" ; then \
+diff --git a/arch/powerpc/lib/Makefile b/arch/powerpc/lib/Makefile
+index 8560c912186d..b705c89f3e21 100644
+--- a/arch/powerpc/lib/Makefile
++++ b/arch/powerpc/lib/Makefile
+@@ -42,7 +42,7 @@ obj-$(CONFIG_FUNCTION_ERROR_INJECTION)	+= error-inject.o
+ # 64-bit linker creates .sfpr on demand for final link (vmlinux),
+ # so it is only needed for modules, and only for older linkers which
+ # do not support --save-restore-funcs
+-ifeq ($(call ld-ifversion, -lt, 22500, y),y)
++ifndef CONFIG_LD_IS_BFD
+ extra-$(CONFIG_PPC64)	+= crtsavres.o
+ endif
+ 
+diff --git a/scripts/Makefile.compiler b/scripts/Makefile.compiler
+index 158c57f2acfd..87589a7ba27f 100644
+--- a/scripts/Makefile.compiler
++++ b/scripts/Makefile.compiler
+@@ -72,7 +72,3 @@ clang-min-version = $(shell [ $(CONFIG_CLANG_VERSION)0 -ge $(1)0 ] && echo y)
+ # ld-option
+ # Usage: KBUILD_LDFLAGS += $(call ld-option, -X, -Y)
+ ld-option = $(call try-run, $(LD) $(KBUILD_LDFLAGS) $(1) -v,$(1),$(2),$(3))
+-
+-# ld-ifversion
+-# Usage:  $(call ld-ifversion, -ge, 22252, y)
+-ld-ifversion = $(shell [ $(CONFIG_LD_VERSION)0 $(1) $(2)0 ] && echo $(3) || echo $(4))
+-- 
+2.43.0
+
diff --git a/queue-6.1/pstore-ram_core-fix-possible-overflow-in-persistent_.patch b/queue-6.1/pstore-ram_core-fix-possible-overflow-in-persistent_.patch
new file mode 100644
index 00000000000..476712c8368
--- /dev/null
+++ b/queue-6.1/pstore-ram_core-fix-possible-overflow-in-persistent_.patch
@@ -0,0 +1,46 @@
+From 5f941b409ac70bc8cabbca95c87f9f265b28608d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 5 Nov 2023 23:29:36 +0300
+Subject: pstore: ram_core: fix possible overflow in persistent_ram_init_ecc()
+
+From: Sergey Shtylyov <s.shtylyov@omp.ru>
+
+[ Upstream commit 86222a8fc16ec517de8da2604d904c9df3a08e5d ]
+
+In persistent_ram_init_ecc(), on 64-bit arches DIV_ROUND_UP() will return
+64-bit value since persistent_ram_zone::buffer_size has type size_t which
+is derived from the 64-bit *unsigned long*, while the ecc_blocks variable
+this value gets assigned to has (always 32-bit) *int* type.  Even if that
+value fits into *int* type, an overflow is still possible when calculating
+the size_t typed ecc_total variable further below since there's no cast to
+any 64-bit type before multiplication.  Declaring the ecc_blocks variable
+as *size_t* should fix this mess...
+
+Found by Linux Verification Center (linuxtesting.org) with the SVACE static
+analysis tool.
+
+Fixes: 9cc05ad97c57 ("staging: android: persistent_ram: refactor ecc support")
+Signed-off-by: Sergey Shtylyov <s.shtylyov@omp.ru>
+Link: https://lore.kernel.org/r/20231105202936.25694-1-s.shtylyov@omp.ru
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/pstore/ram_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/pstore/ram_core.c b/fs/pstore/ram_core.c
+index 1e755d093d92..f479e0755a24 100644
+--- a/fs/pstore/ram_core.c
++++ b/fs/pstore/ram_core.c
+@@ -190,7 +190,7 @@ static int persistent_ram_init_ecc(struct persistent_ram_zone *prz,
+ {
+ 	int numerr;
+ 	struct persistent_ram_buffer *buffer = prz->buffer;
+-	int ecc_blocks;
++	size_t ecc_blocks;
+ 	size_t ecc_total;
+ 
+ 	if (!ecc_info || !ecc_info->ecc_size)
+-- 
+2.43.0
+
diff --git a/queue-6.1/pwm-stm32-fix-enable-count-for-clk-in-.probe.patch b/queue-6.1/pwm-stm32-fix-enable-count-for-clk-in-.probe.patch
new file mode 100644
index 00000000000..10520f66210
--- /dev/null
+++ b/queue-6.1/pwm-stm32-fix-enable-count-for-clk-in-.probe.patch
@@ -0,0 +1,80 @@
+From 1dc40b220fcb66157f2e2b59cf7876a7352c2d4c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Oct 2023 22:07:04 +0200
+Subject: pwm: stm32: Fix enable count for clk in .probe()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Philipp Zabel <p.zabel@pengutronix.de>
+
+[ Upstream commit 19f1016ea9600ed89bc24247c36ff5934ad94fbb ]
+
+Make the driver take over hardware state without disabling in .probe()
+and enable the clock for each enabled channel.
+
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+[ukleinek: split off from a patch that also implemented .get_state()]
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Fixes: 7edf7369205b ("pwm: Add driver for STM32 plaftorm")
+Reviewed-by: Fabrice Gasnier <fabrice.gasnier@foss.st.com>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-stm32.c | 18 ++++++++++++++----
+ 1 file changed, 14 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/pwm/pwm-stm32.c b/drivers/pwm/pwm-stm32.c
+index 9c260aac442d..bdcdb7f38312 100644
+--- a/drivers/pwm/pwm-stm32.c
++++ b/drivers/pwm/pwm-stm32.c
+@@ -575,17 +575,21 @@ static void stm32_pwm_detect_complementary(struct stm32_pwm *priv)
+ 	priv->have_complementary_output = (ccer != 0);
+ }
+ 
+-static unsigned int stm32_pwm_detect_channels(struct stm32_pwm *priv)
++static unsigned int stm32_pwm_detect_channels(struct stm32_pwm *priv,
++					      unsigned int *num_enabled)
+ {
+-	u32 ccer;
++	u32 ccer, ccer_backup;
+ 
+ 	/*
+ 	 * If channels enable bits don't exist writing 1 will have no
+ 	 * effect so we can detect and count them.
+ 	 */
++	regmap_read(priv->regmap, TIM_CCER, &ccer_backup);
+ 	regmap_set_bits(priv->regmap, TIM_CCER, TIM_CCER_CCXE);
+ 	regmap_read(priv->regmap, TIM_CCER, &ccer);
+-	regmap_clear_bits(priv->regmap, TIM_CCER, TIM_CCER_CCXE);
++	regmap_write(priv->regmap, TIM_CCER, ccer_backup);
++
++	*num_enabled = hweight32(ccer_backup & TIM_CCER_CCXE);
+ 
+ 	return hweight32(ccer & TIM_CCER_CCXE);
+ }
+@@ -596,6 +600,8 @@ static int stm32_pwm_probe(struct platform_device *pdev)
+ 	struct device_node *np = dev->of_node;
+ 	struct stm32_timers *ddata = dev_get_drvdata(pdev->dev.parent);
+ 	struct stm32_pwm *priv;
++	unsigned int num_enabled;
++	unsigned int i;
+ 	int ret;
+ 
+ 	priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
+@@ -618,7 +624,11 @@ static int stm32_pwm_probe(struct platform_device *pdev)
+ 
+ 	priv->chip.dev = dev;
+ 	priv->chip.ops = &stm32pwm_ops;
+-	priv->chip.npwm = stm32_pwm_detect_channels(priv);
++	priv->chip.npwm = stm32_pwm_detect_channels(priv, &num_enabled);
++
++	/* Initialize clock refcount to number of enabled PWM channels. */
++	for (i = 0; i < num_enabled; i++)
++		clk_enable(priv->clk);
+ 
+ 	ret = pwmchip_add(&priv->chip);
+ 	if (ret < 0)
+-- 
+2.43.0
+
diff --git a/queue-6.1/pwm-stm32-use-hweight32-in-stm32_pwm_detect_channels.patch b/queue-6.1/pwm-stm32-use-hweight32-in-stm32_pwm_detect_channels.patch
new file mode 100644
index 00000000000..6b65a7f519f
--- /dev/null
+++ b/queue-6.1/pwm-stm32-use-hweight32-in-stm32_pwm_detect_channels.patch
@@ -0,0 +1,66 @@
+From 6b9165461c2b3177a7b21645fc969955848f1d3e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Oct 2023 22:07:02 +0200
+Subject: pwm: stm32: Use hweight32 in stm32_pwm_detect_channels
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Philipp Zabel <p.zabel@pengutronix.de>
+
+[ Upstream commit 41fa8f57c0d269243fe3bde2bce71e82c884b9ad ]
+
+Use hweight32() to count the CCxE bits in stm32_pwm_detect_channels().
+Since the return value is assigned to chip.npwm, change it to unsigned
+int as well.
+
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Reviewed-by: Fabrice Gasnier <fabrice.gasnier@foss.st.com>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Stable-dep-of: 19f1016ea960 ("pwm: stm32: Fix enable count for clk in .probe()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-stm32.c | 17 ++---------------
+ 1 file changed, 2 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/pwm/pwm-stm32.c b/drivers/pwm/pwm-stm32.c
+index 21e4a34dfff3..9c260aac442d 100644
+--- a/drivers/pwm/pwm-stm32.c
++++ b/drivers/pwm/pwm-stm32.c
+@@ -575,10 +575,9 @@ static void stm32_pwm_detect_complementary(struct stm32_pwm *priv)
+ 	priv->have_complementary_output = (ccer != 0);
+ }
+ 
+-static int stm32_pwm_detect_channels(struct stm32_pwm *priv)
++static unsigned int stm32_pwm_detect_channels(struct stm32_pwm *priv)
+ {
+ 	u32 ccer;
+-	int npwm = 0;
+ 
+ 	/*
+ 	 * If channels enable bits don't exist writing 1 will have no
+@@ -588,19 +587,7 @@ static int stm32_pwm_detect_channels(struct stm32_pwm *priv)
+ 	regmap_read(priv->regmap, TIM_CCER, &ccer);
+ 	regmap_clear_bits(priv->regmap, TIM_CCER, TIM_CCER_CCXE);
+ 
+-	if (ccer & TIM_CCER_CC1E)
+-		npwm++;
+-
+-	if (ccer & TIM_CCER_CC2E)
+-		npwm++;
+-
+-	if (ccer & TIM_CCER_CC3E)
+-		npwm++;
+-
+-	if (ccer & TIM_CCER_CC4E)
+-		npwm++;
+-
+-	return npwm;
++	return hweight32(ccer & TIM_CCER_CCXE);
+ }
+ 
+ static int stm32_pwm_probe(struct platform_device *pdev)
+-- 
+2.43.0
+
diff --git a/queue-6.1/pwm-stm32-use-regmap_clear_bits-and-regmap_set_bits-.patch b/queue-6.1/pwm-stm32-use-regmap_clear_bits-and-regmap_set_bits-.patch
new file mode 100644
index 00000000000..9a83489fb38
--- /dev/null
+++ b/queue-6.1/pwm-stm32-use-regmap_clear_bits-and-regmap_set_bits-.patch
@@ -0,0 +1,150 @@
+From 3acdc410b5bc5a7cdbfffb244b95e79c087e18f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Dec 2022 19:35:18 +0100
+Subject: pwm: stm32: Use regmap_clear_bits and regmap_set_bits where
+ applicable
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit 632ae5d7eb348b3ef88552ec0999260b6f9d6ab1 ]
+
+Found using coccinelle and the following semantic patch:
+
+@@
+expression map, reg, bits;
+@@
+
+- regmap_update_bits(map, reg, bits, bits)
++ regmap_set_bits(map, reg, bits)
+
+@@
+expression map, reg, bits;
+@@
+
+- regmap_update_bits(map, reg, bits, 0)
++ regmap_clear_bits(map, reg, bits)
+
+Tested-by: Fabrice Gasnier <fabrice.gasnier@foss.st.com>
+Link: https://lore.kernel.org/r/20221115111347.3705732-6-u.kleine-koenig@pengutronix.de
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Stable-dep-of: 19f1016ea960 ("pwm: stm32: Fix enable count for clk in .probe()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-stm32.c | 34 ++++++++++++++++------------------
+ 1 file changed, 16 insertions(+), 18 deletions(-)
+
+diff --git a/drivers/pwm/pwm-stm32.c b/drivers/pwm/pwm-stm32.c
+index 794ca5b02968..21e4a34dfff3 100644
+--- a/drivers/pwm/pwm-stm32.c
++++ b/drivers/pwm/pwm-stm32.c
+@@ -115,14 +115,14 @@ static int stm32_pwm_raw_capture(struct stm32_pwm *priv, struct pwm_device *pwm,
+ 	int ret;
+ 
+ 	/* Ensure registers have been updated, enable counter and capture */
+-	regmap_update_bits(priv->regmap, TIM_EGR, TIM_EGR_UG, TIM_EGR_UG);
+-	regmap_update_bits(priv->regmap, TIM_CR1, TIM_CR1_CEN, TIM_CR1_CEN);
++	regmap_set_bits(priv->regmap, TIM_EGR, TIM_EGR_UG);
++	regmap_set_bits(priv->regmap, TIM_CR1, TIM_CR1_CEN);
+ 
+ 	/* Use cc1 or cc3 DMA resp for PWM input channels 1 & 2 or 3 & 4 */
+ 	dma_id = pwm->hwpwm < 2 ? STM32_TIMERS_DMA_CH1 : STM32_TIMERS_DMA_CH3;
+ 	ccen = pwm->hwpwm < 2 ? TIM_CCER_CC12E : TIM_CCER_CC34E;
+ 	ccr = pwm->hwpwm < 2 ? TIM_CCR1 : TIM_CCR3;
+-	regmap_update_bits(priv->regmap, TIM_CCER, ccen, ccen);
++	regmap_set_bits(priv->regmap, TIM_CCER, ccen);
+ 
+ 	/*
+ 	 * Timer DMA burst mode. Request 2 registers, 2 bursts, to get both
+@@ -160,8 +160,8 @@ static int stm32_pwm_raw_capture(struct stm32_pwm *priv, struct pwm_device *pwm,
+ 	}
+ 
+ stop:
+-	regmap_update_bits(priv->regmap, TIM_CCER, ccen, 0);
+-	regmap_update_bits(priv->regmap, TIM_CR1, TIM_CR1_CEN, 0);
++	regmap_clear_bits(priv->regmap, TIM_CCER, ccen);
++	regmap_clear_bits(priv->regmap, TIM_CR1, TIM_CR1_CEN);
+ 
+ 	return ret;
+ }
+@@ -359,7 +359,7 @@ static int stm32_pwm_config(struct stm32_pwm *priv, int ch,
+ 
+ 	regmap_write(priv->regmap, TIM_PSC, prescaler);
+ 	regmap_write(priv->regmap, TIM_ARR, prd - 1);
+-	regmap_update_bits(priv->regmap, TIM_CR1, TIM_CR1_ARPE, TIM_CR1_ARPE);
++	regmap_set_bits(priv->regmap, TIM_CR1, TIM_CR1_ARPE);
+ 
+ 	/* Calculate the duty cycles */
+ 	dty = prd * duty_ns;
+@@ -377,7 +377,7 @@ static int stm32_pwm_config(struct stm32_pwm *priv, int ch,
+ 	else
+ 		regmap_update_bits(priv->regmap, TIM_CCMR2, mask, ccmr);
+ 
+-	regmap_update_bits(priv->regmap, TIM_BDTR, TIM_BDTR_MOE, TIM_BDTR_MOE);
++	regmap_set_bits(priv->regmap, TIM_BDTR, TIM_BDTR_MOE);
+ 
+ 	return 0;
+ }
+@@ -411,13 +411,13 @@ static int stm32_pwm_enable(struct stm32_pwm *priv, int ch)
+ 	if (priv->have_complementary_output)
+ 		mask |= TIM_CCER_CC1NE << (ch * 4);
+ 
+-	regmap_update_bits(priv->regmap, TIM_CCER, mask, mask);
++	regmap_set_bits(priv->regmap, TIM_CCER, mask);
+ 
+ 	/* Make sure that registers are updated */
+-	regmap_update_bits(priv->regmap, TIM_EGR, TIM_EGR_UG, TIM_EGR_UG);
++	regmap_set_bits(priv->regmap, TIM_EGR, TIM_EGR_UG);
+ 
+ 	/* Enable controller */
+-	regmap_update_bits(priv->regmap, TIM_CR1, TIM_CR1_CEN, TIM_CR1_CEN);
++	regmap_set_bits(priv->regmap, TIM_CR1, TIM_CR1_CEN);
+ 
+ 	return 0;
+ }
+@@ -431,11 +431,11 @@ static void stm32_pwm_disable(struct stm32_pwm *priv, int ch)
+ 	if (priv->have_complementary_output)
+ 		mask |= TIM_CCER_CC1NE << (ch * 4);
+ 
+-	regmap_update_bits(priv->regmap, TIM_CCER, mask, 0);
++	regmap_clear_bits(priv->regmap, TIM_CCER, mask);
+ 
+ 	/* When all channels are disabled, we can disable the controller */
+ 	if (!active_channels(priv))
+-		regmap_update_bits(priv->regmap, TIM_CR1, TIM_CR1_CEN, 0);
++		regmap_clear_bits(priv->regmap, TIM_CR1, TIM_CR1_CEN);
+ 
+ 	clk_disable(priv->clk);
+ }
+@@ -568,10 +568,9 @@ static void stm32_pwm_detect_complementary(struct stm32_pwm *priv)
+ 	 * If complementary bit doesn't exist writing 1 will have no
+ 	 * effect so we can detect it.
+ 	 */
+-	regmap_update_bits(priv->regmap,
+-			   TIM_CCER, TIM_CCER_CC1NE, TIM_CCER_CC1NE);
++	regmap_set_bits(priv->regmap, TIM_CCER, TIM_CCER_CC1NE);
+ 	regmap_read(priv->regmap, TIM_CCER, &ccer);
+-	regmap_update_bits(priv->regmap, TIM_CCER, TIM_CCER_CC1NE, 0);
++	regmap_clear_bits(priv->regmap, TIM_CCER, TIM_CCER_CC1NE);
+ 
+ 	priv->have_complementary_output = (ccer != 0);
+ }
+@@ -585,10 +584,9 @@ static int stm32_pwm_detect_channels(struct stm32_pwm *priv)
+ 	 * If channels enable bits don't exist writing 1 will have no
+ 	 * effect so we can detect and count them.
+ 	 */
+-	regmap_update_bits(priv->regmap,
+-			   TIM_CCER, TIM_CCER_CCXE, TIM_CCER_CCXE);
++	regmap_set_bits(priv->regmap, TIM_CCER, TIM_CCER_CCXE);
+ 	regmap_read(priv->regmap, TIM_CCER, &ccer);
+-	regmap_update_bits(priv->regmap, TIM_CCER, TIM_CCER_CCXE, 0);
++	regmap_clear_bits(priv->regmap, TIM_CCER, TIM_CCER_CCXE);
+ 
+ 	if (ccer & TIM_CCER_CC1E)
+ 		npwm++;
+-- 
+2.43.0
+
diff --git a/queue-6.1/rcu-tasks-provide-rcu_trace_implies_rcu_gp.patch b/queue-6.1/rcu-tasks-provide-rcu_trace_implies_rcu_gp.patch
new file mode 100644
index 00000000000..9aba5cc7520
--- /dev/null
+++ b/queue-6.1/rcu-tasks-provide-rcu_trace_implies_rcu_gp.patch
@@ -0,0 +1,67 @@
+From fd1ee3524bbdf475d958a20360dca83b307fe1d1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Oct 2022 19:39:43 +0800
+Subject: rcu-tasks: Provide rcu_trace_implies_rcu_gp()
+
+From: Paul E. McKenney <paulmck@kernel.org>
+
+[ Upstream commit e6c86c513f440bec5f1046539c7e3c6c653842da ]
+
+As an accident of implementation, an RCU Tasks Trace grace period also
+acts as an RCU grace period.  However, this could change at any time.
+This commit therefore creates an rcu_trace_implies_rcu_gp() that currently
+returns true to codify this accident.  Code relying on this accident
+must call this function to verify that this accident is still happening.
+
+Reported-by: Hou Tao <houtao@huaweicloud.com>
+Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
+Cc: Alexei Starovoitov <ast@kernel.org>
+Cc: Martin KaFai Lau <martin.lau@linux.dev>
+Link: https://lore.kernel.org/r/20221014113946.965131-2-houtao@huaweicloud.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Stable-dep-of: 876673364161 ("bpf: Defer the free of inner map when necessary")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/rcupdate.h | 12 ++++++++++++
+ kernel/rcu/tasks.h       |  2 ++
+ 2 files changed, 14 insertions(+)
+
+diff --git a/include/linux/rcupdate.h b/include/linux/rcupdate.h
+index e9e61cd27ef6..46bd9a331fd5 100644
+--- a/include/linux/rcupdate.h
++++ b/include/linux/rcupdate.h
+@@ -242,6 +242,18 @@ static inline void exit_tasks_rcu_stop(void) { }
+ static inline void exit_tasks_rcu_finish(void) { }
+ #endif /* #else #ifdef CONFIG_TASKS_RCU_GENERIC */
+ 
++/**
++ * rcu_trace_implies_rcu_gp - does an RCU Tasks Trace grace period imply an RCU grace period?
++ *
++ * As an accident of implementation, an RCU Tasks Trace grace period also
++ * acts as an RCU grace period.  However, this could change at any time.
++ * Code relying on this accident must call this function to verify that
++ * this accident is still happening.
++ *
++ * You have been warned!
++ */
++static inline bool rcu_trace_implies_rcu_gp(void) { return true; }
++
+ /**
+  * cond_resched_tasks_rcu_qs - Report potential quiescent states to RCU
+  *
+diff --git a/kernel/rcu/tasks.h b/kernel/rcu/tasks.h
+index c1f18c63b9b1..b5d5b6cf093a 100644
+--- a/kernel/rcu/tasks.h
++++ b/kernel/rcu/tasks.h
+@@ -1570,6 +1570,8 @@ static void rcu_tasks_trace_postscan(struct list_head *hop)
+ {
+ 	// Wait for late-stage exiting tasks to finish exiting.
+ 	// These might have passed the call to exit_tasks_rcu_finish().
++
++	// If you remove the following line, update rcu_trace_implies_rcu_gp()!!!
+ 	synchronize_rcu();
+ 	// Any tasks that exit after this point will set
+ 	// TRC_NEED_QS_CHECKED in ->trc_reader_special.b.need_qs.
+-- 
+2.43.0
+
diff --git a/queue-6.1/rdma-hns-fix-inappropriate-err-code-for-unsupported-.patch b/queue-6.1/rdma-hns-fix-inappropriate-err-code-for-unsupported-.patch
new file mode 100644
index 00000000000..862931835a2
--- /dev/null
+++ b/queue-6.1/rdma-hns-fix-inappropriate-err-code-for-unsupported-.patch
@@ -0,0 +1,52 @@
+From ccc7f6faad6040bb7bcd86c316d99e2384542bcd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Nov 2023 20:34:47 +0800
+Subject: RDMA/hns: Fix inappropriate err code for unsupported operations
+
+From: Junxian Huang <huangjunxian6@hisilicon.com>
+
+[ Upstream commit f45b83ad39f8033e717b1eee57e81811113d5a84 ]
+
+EOPNOTSUPP is more situable than EINVAL for allocating XRCD while XRC
+is not supported and unsupported resizing SRQ.
+
+Fixes: 32548870d438 ("RDMA/hns: Add support for XRC on HIP09")
+Fixes: 221109e64316 ("RDMA/hns: Add interception for resizing SRQs")
+Signed-off-by: Junxian Huang <huangjunxian6@hisilicon.com>
+Link: https://lore.kernel.org/r/20231114123449.1106162-2-huangjunxian6@hisilicon.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 2 +-
+ drivers/infiniband/hw/hns/hns_roce_pd.c    | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+index c2ee80546d12..280a3458bb53 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+@@ -5791,7 +5791,7 @@ static int hns_roce_v2_modify_srq(struct ib_srq *ibsrq,
+ 
+ 	/* Resizing SRQs is not supported yet */
+ 	if (srq_attr_mask & IB_SRQ_MAX_WR)
+-		return -EINVAL;
++		return -EOPNOTSUPP;
+ 
+ 	if (srq_attr_mask & IB_SRQ_LIMIT) {
+ 		if (srq_attr->srq_limit > srq->wqe_cnt)
+diff --git a/drivers/infiniband/hw/hns/hns_roce_pd.c b/drivers/infiniband/hw/hns/hns_roce_pd.c
+index 783e71852c50..bd1fe89ca205 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_pd.c
++++ b/drivers/infiniband/hw/hns/hns_roce_pd.c
+@@ -150,7 +150,7 @@ int hns_roce_alloc_xrcd(struct ib_xrcd *ib_xrcd, struct ib_udata *udata)
+ 	int ret;
+ 
+ 	if (!(hr_dev->caps.flags & HNS_ROCE_CAP_FLAG_XRC))
+-		return -EINVAL;
++		return -EOPNOTSUPP;
+ 
+ 	ret = hns_roce_xrcd_alloc(hr_dev, &xrcd->xrcdn);
+ 	if (ret)
+-- 
+2.43.0
+
diff --git a/queue-6.1/rdma-hns-fix-memory-leak-in-free_mr_init.patch b/queue-6.1/rdma-hns-fix-memory-leak-in-free_mr_init.patch
new file mode 100644
index 00000000000..9ff29b516d6
--- /dev/null
+++ b/queue-6.1/rdma-hns-fix-memory-leak-in-free_mr_init.patch
@@ -0,0 +1,40 @@
+From b6dfce6c1917d51074993730bed4db6a9435ec36 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Dec 2023 19:42:31 +0800
+Subject: RDMA/hns: Fix memory leak in free_mr_init()
+
+From: Chengchang Tang <tangchengchang@huawei.com>
+
+[ Upstream commit 288f535951aa81ed674f5e5477ab11b9d9351b8c ]
+
+When a reserved QP fails to be created, the memory of the remaining
+created reserved QPs is leaked.
+
+Fixes: 70f92521584f ("RDMA/hns: Use the reserved loopback QPs to free MR before destroying MPT")
+Signed-off-by: Chengchang Tang <tangchengchang@huawei.com>
+Signed-off-by: Junxian Huang <huangjunxian6@hisilicon.com>
+Link: https://lore.kernel.org/r/20231207114231.2872104-6-huangjunxian6@hisilicon.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+index 280a3458bb53..58fbb1d3b7f4 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+@@ -2819,6 +2819,10 @@ static int free_mr_alloc_res(struct hns_roce_dev *hr_dev)
+ 	return 0;
+ 
+ create_failed_qp:
++	for (i--; i >= 0; i--) {
++		hns_roce_v2_destroy_qp(&free_mr->rsv_qp[i]->ibqp, NULL);
++		kfree(free_mr->rsv_qp[i]);
++	}
+ 	hns_roce_destroy_cq(cq, NULL);
+ 	kfree(cq);
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/rdma-usnic-silence-uninitialized-symbol-smatch-warni.patch b/queue-6.1/rdma-usnic-silence-uninitialized-symbol-smatch-warni.patch
new file mode 100644
index 00000000000..8cf6c3ab49c
--- /dev/null
+++ b/queue-6.1/rdma-usnic-silence-uninitialized-symbol-smatch-warni.patch
@@ -0,0 +1,82 @@
+From 75444a1385f6a1adb536f75c13b65e2a6c794785 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Nov 2023 11:28:02 +0200
+Subject: RDMA/usnic: Silence uninitialized symbol smatch warnings
+
+From: Leon Romanovsky <leonro@nvidia.com>
+
+[ Upstream commit b9a85e5eec126d6ae6c362f94b447c223e8fe6e4 ]
+
+The patch 1da177e4c3f4: "Linux-2.6.12-rc2" from Apr 16, 2005
+(linux-next), leads to the following Smatch static checker warning:
+
+        drivers/infiniband/hw/mthca/mthca_cmd.c:644 mthca_SYS_EN()
+        error: uninitialized symbol 'out'.
+
+drivers/infiniband/hw/mthca/mthca_cmd.c
+    636 int mthca_SYS_EN(struct mthca_dev *dev)
+    637 {
+    638         u64 out;
+    639         int ret;
+    640
+    641         ret = mthca_cmd_imm(dev, 0, &out, 0, 0, CMD_SYS_EN, CMD_TIME_CLASS_D);
+
+We pass out here and it gets used without being initialized.
+
+        err = mthca_cmd_post(dev, in_param,
+                             out_param ? *out_param : 0,
+                                         ^^^^^^^^^^
+                             in_modifier, op_modifier,
+                             op, context->token, 1);
+
+It's the same in mthca_cmd_wait() and mthca_cmd_poll().
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
+Closes: https://lore.kernel.org/all/533bc3df-8078-4397-b93d-d1f6cec9b636@moroto.mountain
+Link: https://lore.kernel.org/r/c559cb7113158c02d75401ac162652072ef1b5f0.1699867650.git.leon@kernel.org
+Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mthca/mthca_cmd.c  | 4 ++--
+ drivers/infiniband/hw/mthca/mthca_main.c | 2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/infiniband/hw/mthca/mthca_cmd.c b/drivers/infiniband/hw/mthca/mthca_cmd.c
+index f330ce895d88..8fe0cef7e2be 100644
+--- a/drivers/infiniband/hw/mthca/mthca_cmd.c
++++ b/drivers/infiniband/hw/mthca/mthca_cmd.c
+@@ -635,7 +635,7 @@ void mthca_free_mailbox(struct mthca_dev *dev, struct mthca_mailbox *mailbox)
+ 
+ int mthca_SYS_EN(struct mthca_dev *dev)
+ {
+-	u64 out;
++	u64 out = 0;
+ 	int ret;
+ 
+ 	ret = mthca_cmd_imm(dev, 0, &out, 0, 0, CMD_SYS_EN, CMD_TIME_CLASS_D);
+@@ -1955,7 +1955,7 @@ int mthca_WRITE_MGM(struct mthca_dev *dev, int index,
+ int mthca_MGID_HASH(struct mthca_dev *dev, struct mthca_mailbox *mailbox,
+ 		    u16 *hash)
+ {
+-	u64 imm;
++	u64 imm = 0;
+ 	int err;
+ 
+ 	err = mthca_cmd_imm(dev, mailbox->dma, &imm, 0, 0, CMD_MGID_HASH,
+diff --git a/drivers/infiniband/hw/mthca/mthca_main.c b/drivers/infiniband/hw/mthca/mthca_main.c
+index b54bc8865dae..1ab268b77096 100644
+--- a/drivers/infiniband/hw/mthca/mthca_main.c
++++ b/drivers/infiniband/hw/mthca/mthca_main.c
+@@ -382,7 +382,7 @@ static int mthca_init_icm(struct mthca_dev *mdev,
+ 			  struct mthca_init_hca_param *init_hca,
+ 			  u64 icm_size)
+ {
+-	u64 aux_pages;
++	u64 aux_pages = 0;
+ 	int err;
+ 
+ 	err = mthca_SET_ICM_SIZE(mdev, icm_size, &aux_pages);
+-- 
+2.43.0
+
diff --git a/queue-6.1/revert-drm-omapdrm-annotate-dma-fence-critical-secti.patch b/queue-6.1/revert-drm-omapdrm-annotate-dma-fence-critical-secti.patch
new file mode 100644
index 00000000000..03d7ab8c020
--- /dev/null
+++ b/queue-6.1/revert-drm-omapdrm-annotate-dma-fence-critical-secti.patch
@@ -0,0 +1,191 @@
+From 8e28914ee152e8d303d623d93415e33f7d2d3247 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Sep 2023 15:57:17 +0300
+Subject: Revert "drm/omapdrm: Annotate dma-fence critical section in commit
+ path"
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+[ Upstream commit 9d7c8c066916f231ca0ed4e4fce6c4b58ca3e451 ]
+
+This reverts commit 250aa22920cd5d956a5d3e9c6a43d671c2bae217.
+
+The DMA-fence annotations cause a lockdep warning (see below). As per
+https://patchwork.freedesktop.org/patch/462170/ it sounds like the
+annotations don't work correctly.
+
+======================================================
+WARNING: possible circular locking dependency detected
+6.5.0-rc2+ #2 Not tainted
+------------------------------------------------------
+kmstest/219 is trying to acquire lock:
+c4705838 (&hdmi->lock){+.+.}-{3:3}, at: hdmi5_bridge_mode_set+0x1c/0x50
+
+but task is already holding lock:
+c11e1128 (dma_fence_map){++++}-{0:0}, at: omap_atomic_commit_tail+0x14/0xbc
+
+which lock already depends on the new lock.
+
+the existing dependency chain (in reverse order) is:
+
+-> #2 (dma_fence_map){++++}-{0:0}:
+       __dma_fence_might_wait+0x48/0xb4
+       dma_resv_lockdep+0x1b8/0x2bc
+       do_one_initcall+0x68/0x3b0
+       kernel_init_freeable+0x260/0x34c
+       kernel_init+0x14/0x140
+       ret_from_fork+0x14/0x28
+
+-> #1 (fs_reclaim){+.+.}-{0:0}:
+       fs_reclaim_acquire+0x70/0xa8
+       __kmem_cache_alloc_node+0x3c/0x368
+       kmalloc_trace+0x28/0x58
+       _drm_do_get_edid+0x7c/0x35c
+       hdmi5_bridge_get_edid+0xc8/0x1ac
+       drm_bridge_connector_get_modes+0x64/0xc0
+       drm_helper_probe_single_connector_modes+0x170/0x528
+       drm_client_modeset_probe+0x208/0x1334
+       __drm_fb_helper_initial_config_and_unlock+0x30/0x548
+       omap_fbdev_client_hotplug+0x3c/0x6c
+       drm_client_register+0x58/0x94
+       pdev_probe+0x544/0x6b0
+       platform_probe+0x58/0xbc
+       really_probe+0xd8/0x3fc
+       __driver_probe_device+0x94/0x1f4
+       driver_probe_device+0x2c/0xc4
+       __device_attach_driver+0xa4/0x11c
+       bus_for_each_drv+0x84/0xdc
+       __device_attach+0xac/0x20c
+       bus_probe_device+0x8c/0x90
+       device_add+0x588/0x7e0
+       platform_device_add+0x110/0x24c
+       platform_device_register_full+0x108/0x15c
+       dss_bind+0x90/0xc0
+       try_to_bring_up_aggregate_device+0x1e0/0x2c8
+       __component_add+0xa4/0x174
+       hdmi5_probe+0x1c8/0x270
+       platform_probe+0x58/0xbc
+       really_probe+0xd8/0x3fc
+       __driver_probe_device+0x94/0x1f4
+       driver_probe_device+0x2c/0xc4
+       __device_attach_driver+0xa4/0x11c
+       bus_for_each_drv+0x84/0xdc
+       __device_attach+0xac/0x20c
+       bus_probe_device+0x8c/0x90
+       deferred_probe_work_func+0x8c/0xd8
+       process_one_work+0x2ac/0x6e4
+       worker_thread+0x30/0x4ec
+       kthread+0x100/0x124
+       ret_from_fork+0x14/0x28
+
+-> #0 (&hdmi->lock){+.+.}-{3:3}:
+       __lock_acquire+0x145c/0x29cc
+       lock_acquire.part.0+0xb4/0x258
+       __mutex_lock+0x90/0x950
+       mutex_lock_nested+0x1c/0x24
+       hdmi5_bridge_mode_set+0x1c/0x50
+       drm_bridge_chain_mode_set+0x48/0x5c
+       crtc_set_mode+0x188/0x1d0
+       omap_atomic_commit_tail+0x2c/0xbc
+       commit_tail+0x9c/0x188
+       drm_atomic_helper_commit+0x158/0x18c
+       drm_atomic_commit+0xa4/0xe8
+       drm_mode_atomic_ioctl+0x9a4/0xc38
+       drm_ioctl+0x210/0x4a8
+       sys_ioctl+0x138/0xf00
+       ret_fast_syscall+0x0/0x1c
+
+other info that might help us debug this:
+
+Chain exists of:
+  &hdmi->lock --> fs_reclaim --> dma_fence_map
+
+ Possible unsafe locking scenario:
+
+       CPU0                    CPU1
+       ----                    ----
+  rlock(dma_fence_map);
+                               lock(fs_reclaim);
+                               lock(dma_fence_map);
+  lock(&hdmi->lock);
+
+ *** DEADLOCK ***
+
+3 locks held by kmstest/219:
+ #0: f1011de4 (crtc_ww_class_acquire){+.+.}-{0:0}, at: drm_mode_atomic_ioctl+0xf0/0xc38
+ #1: c47059c8 (crtc_ww_class_mutex){+.+.}-{3:3}, at: modeset_lock+0xf8/0x230
+ #2: c11e1128 (dma_fence_map){++++}-{0:0}, at: omap_atomic_commit_tail+0x14/0xbc
+
+stack backtrace:
+CPU: 1 PID: 219 Comm: kmstest Not tainted 6.5.0-rc2+ #2
+Hardware name: Generic DRA74X (Flattened Device Tree)
+ unwind_backtrace from show_stack+0x10/0x14
+ show_stack from dump_stack_lvl+0x58/0x70
+ dump_stack_lvl from check_noncircular+0x164/0x198
+ check_noncircular from __lock_acquire+0x145c/0x29cc
+ __lock_acquire from lock_acquire.part.0+0xb4/0x258
+ lock_acquire.part.0 from __mutex_lock+0x90/0x950
+ __mutex_lock from mutex_lock_nested+0x1c/0x24
+ mutex_lock_nested from hdmi5_bridge_mode_set+0x1c/0x50
+ hdmi5_bridge_mode_set from drm_bridge_chain_mode_set+0x48/0x5c
+ drm_bridge_chain_mode_set from crtc_set_mode+0x188/0x1d0
+ crtc_set_mode from omap_atomic_commit_tail+0x2c/0xbc
+ omap_atomic_commit_tail from commit_tail+0x9c/0x188
+ commit_tail from drm_atomic_helper_commit+0x158/0x18c
+ drm_atomic_helper_commit from drm_atomic_commit+0xa4/0xe8
+ drm_atomic_commit from drm_mode_atomic_ioctl+0x9a4/0xc38
+ drm_mode_atomic_ioctl from drm_ioctl+0x210/0x4a8
+ drm_ioctl from sys_ioctl+0x138/0xf00
+ sys_ioctl from ret_fast_syscall+0x0/0x1c
+Exception stack(0xf1011fa8 to 0xf1011ff0)
+1fa0:                   00466d58 be9ab510 00000003 c03864bc be9ab510 be9ab4e0
+1fc0: 00466d58 be9ab510 c03864bc 00000036 00466ef0 00466fc0 00467020 00466f20
+1fe0: b6bc7ef4 be9ab4d0 b6bbbb00 b6cb2cc0
+
+Fixes: 250aa22920cd ("drm/omapdrm: Annotate dma-fence critical section in commit path")
+Reviewed-by: Aradhya Bhatia <a-bhatia1@ti.com>
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230920-dma-fence-annotation-revert-v1-2-7ebf6f7f5bf6@ideasonboard.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/omapdrm/omap_drv.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/omapdrm/omap_drv.c b/drivers/gpu/drm/omapdrm/omap_drv.c
+index eaf67b9e5f12..5b6d1668f405 100644
+--- a/drivers/gpu/drm/omapdrm/omap_drv.c
++++ b/drivers/gpu/drm/omapdrm/omap_drv.c
+@@ -68,7 +68,6 @@ static void omap_atomic_commit_tail(struct drm_atomic_state *old_state)
+ {
+ 	struct drm_device *dev = old_state->dev;
+ 	struct omap_drm_private *priv = dev->dev_private;
+-	bool fence_cookie = dma_fence_begin_signalling();
+ 
+ 	dispc_runtime_get(priv->dispc);
+ 
+@@ -91,6 +90,8 @@ static void omap_atomic_commit_tail(struct drm_atomic_state *old_state)
+ 		omap_atomic_wait_for_completion(dev, old_state);
+ 
+ 		drm_atomic_helper_commit_planes(dev, old_state, 0);
++
++		drm_atomic_helper_commit_hw_done(old_state);
+ 	} else {
+ 		/*
+ 		 * OMAP3 DSS seems to have issues with the work-around above,
+@@ -100,11 +101,9 @@ static void omap_atomic_commit_tail(struct drm_atomic_state *old_state)
+ 		drm_atomic_helper_commit_planes(dev, old_state, 0);
+ 
+ 		drm_atomic_helper_commit_modeset_enables(dev, old_state);
+-	}
+ 
+-	drm_atomic_helper_commit_hw_done(old_state);
+-
+-	dma_fence_end_signalling(fence_cookie);
++		drm_atomic_helper_commit_hw_done(old_state);
++	}
+ 
+ 	/*
+ 	 * Wait for completion of the page flips to ensure that old buffers
+-- 
+2.43.0
+
diff --git a/queue-6.1/revert-drm-tidss-annotate-dma-fence-critical-section.patch b/queue-6.1/revert-drm-tidss-annotate-dma-fence-critical-section.patch
new file mode 100644
index 00000000000..56f3c537881
--- /dev/null
+++ b/queue-6.1/revert-drm-tidss-annotate-dma-fence-critical-section.patch
@@ -0,0 +1,176 @@
+From 32cd9ae13f73845fd0303463416e3ba27fcff53a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Sep 2023 15:57:16 +0300
+Subject: Revert "drm/tidss: Annotate dma-fence critical section in commit
+ path"
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+[ Upstream commit ca34d816558c3e4c3f8fe037b5a6b16c944693de ]
+
+This reverts commit 4d56a4f08391857ba93465de489707b66adad114.
+
+The DMA-fence annotations cause a lockdep warning (see below). As per
+https://patchwork.freedesktop.org/patch/462170/ it sounds like the
+annotations don't work correctly.
+
+======================================================
+WARNING: possible circular locking dependency detected
+6.6.0-rc2+ #1 Not tainted
+------------------------------------------------------
+kmstest/733 is trying to acquire lock:
+ffff8000819377f0 (fs_reclaim){+.+.}-{0:0}, at: __kmem_cache_alloc_node+0x58/0x2d4
+
+but task is already holding lock:
+ffff800081a06aa0 (dma_fence_map){++++}-{0:0}, at: tidss_atomic_commit_tail+0x20/0xc0 [tidss]
+
+which lock already depends on the new lock.
+
+the existing dependency chain (in reverse order) is:
+
+-> #2 (dma_fence_map){++++}-{0:0}:
+       __dma_fence_might_wait+0x5c/0xd0
+       dma_resv_lockdep+0x1a4/0x32c
+       do_one_initcall+0x84/0x2fc
+       kernel_init_freeable+0x28c/0x4c4
+       kernel_init+0x24/0x1dc
+       ret_from_fork+0x10/0x20
+
+-> #1 (mmu_notifier_invalidate_range_start){+.+.}-{0:0}:
+       fs_reclaim_acquire+0x70/0xe4
+       __kmem_cache_alloc_node+0x58/0x2d4
+       kmalloc_trace+0x38/0x78
+       __kthread_create_worker+0x3c/0x150
+       kthread_create_worker+0x64/0x8c
+       workqueue_init+0x1e8/0x2f0
+       kernel_init_freeable+0x11c/0x4c4
+       kernel_init+0x24/0x1dc
+       ret_from_fork+0x10/0x20
+
+-> #0 (fs_reclaim){+.+.}-{0:0}:
+       __lock_acquire+0x1370/0x20d8
+       lock_acquire+0x1e8/0x308
+       fs_reclaim_acquire+0xd0/0xe4
+       __kmem_cache_alloc_node+0x58/0x2d4
+       __kmalloc_node_track_caller+0x58/0xf0
+       kmemdup+0x34/0x60
+       regmap_bulk_write+0x64/0x2c0
+       tc358768_bridge_pre_enable+0x8c/0x12d0 [tc358768]
+       drm_atomic_bridge_call_pre_enable+0x68/0x80 [drm]
+       drm_atomic_bridge_chain_pre_enable+0x50/0x158 [drm]
+       drm_atomic_helper_commit_modeset_enables+0x164/0x264 [drm_kms_helper]
+       tidss_atomic_commit_tail+0x58/0xc0 [tidss]
+       commit_tail+0xa0/0x188 [drm_kms_helper]
+       drm_atomic_helper_commit+0x1a8/0x1c0 [drm_kms_helper]
+       drm_atomic_commit+0xa8/0xe0 [drm]
+       drm_mode_atomic_ioctl+0x9ec/0xc80 [drm]
+       drm_ioctl_kernel+0xc4/0x170 [drm]
+       drm_ioctl+0x234/0x4b0 [drm]
+       drm_compat_ioctl+0x110/0x12c [drm]
+       __arm64_compat_sys_ioctl+0x128/0x150
+       invoke_syscall+0x48/0x110
+       el0_svc_common.constprop.0+0x40/0xe0
+       do_el0_svc_compat+0x1c/0x38
+       el0_svc_compat+0x48/0xb4
+       el0t_32_sync_handler+0xb0/0x138
+       el0t_32_sync+0x194/0x198
+
+other info that might help us debug this:
+
+Chain exists of:
+  fs_reclaim --> mmu_notifier_invalidate_range_start --> dma_fence_map
+
+ Possible unsafe locking scenario:
+
+       CPU0                    CPU1
+       ----                    ----
+  rlock(dma_fence_map);
+                               lock(mmu_notifier_invalidate_range_start);
+                               lock(dma_fence_map);
+  lock(fs_reclaim);
+
+ *** DEADLOCK ***
+
+3 locks held by kmstest/733:
+ #0: ffff800082e5bba0 (crtc_ww_class_acquire){+.+.}-{0:0}, at: drm_mode_atomic_ioctl+0x118/0xc80 [drm]
+ #1: ffff000004224c88 (crtc_ww_class_mutex){+.+.}-{3:3}, at: modeset_lock+0xdc/0x1a0 [drm]
+ #2: ffff800081a06aa0 (dma_fence_map){++++}-{0:0}, at: tidss_atomic_commit_tail+0x20/0xc0 [tidss]
+
+stack backtrace:
+CPU: 0 PID: 733 Comm: kmstest Not tainted 6.6.0-rc2+ #1
+Hardware name: Toradex Verdin AM62 on Verdin Development Board (DT)
+Call trace:
+ dump_backtrace+0x98/0x118
+ show_stack+0x18/0x24
+ dump_stack_lvl+0x60/0xac
+ dump_stack+0x18/0x24
+ print_circular_bug+0x288/0x368
+ check_noncircular+0x168/0x17c
+ __lock_acquire+0x1370/0x20d8
+ lock_acquire+0x1e8/0x308
+ fs_reclaim_acquire+0xd0/0xe4
+ __kmem_cache_alloc_node+0x58/0x2d4
+ __kmalloc_node_track_caller+0x58/0xf0
+ kmemdup+0x34/0x60
+ regmap_bulk_write+0x64/0x2c0
+ tc358768_bridge_pre_enable+0x8c/0x12d0 [tc358768]
+ drm_atomic_bridge_call_pre_enable+0x68/0x80 [drm]
+ drm_atomic_bridge_chain_pre_enable+0x50/0x158 [drm]
+ drm_atomic_helper_commit_modeset_enables+0x164/0x264 [drm_kms_helper]
+ tidss_atomic_commit_tail+0x58/0xc0 [tidss]
+ commit_tail+0xa0/0x188 [drm_kms_helper]
+ drm_atomic_helper_commit+0x1a8/0x1c0 [drm_kms_helper]
+ drm_atomic_commit+0xa8/0xe0 [drm]
+ drm_mode_atomic_ioctl+0x9ec/0xc80 [drm]
+ drm_ioctl_kernel+0xc4/0x170 [drm]
+ drm_ioctl+0x234/0x4b0 [drm]
+ drm_compat_ioctl+0x110/0x12c [drm]
+ __arm64_compat_sys_ioctl+0x128/0x150
+ invoke_syscall+0x48/0x110
+ el0_svc_common.constprop.0+0x40/0xe0
+ do_el0_svc_compat+0x1c/0x38
+ el0_svc_compat+0x48/0xb4
+ el0t_32_sync_handler+0xb0/0x138
+ el0t_32_sync+0x194/0x198
+
+Fixes: 4d56a4f08391 ("drm/tidss: Annotate dma-fence critical section in commit path")
+Reviewed-by: Aradhya Bhatia <a-bhatia1@ti.com>
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230920-dma-fence-annotation-revert-v1-1-7ebf6f7f5bf6@ideasonboard.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/tidss/tidss_kms.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/tidss/tidss_kms.c b/drivers/gpu/drm/tidss/tidss_kms.c
+index afb2879980c6..995bac488392 100644
+--- a/drivers/gpu/drm/tidss/tidss_kms.c
++++ b/drivers/gpu/drm/tidss/tidss_kms.c
+@@ -4,8 +4,6 @@
+  * Author: Tomi Valkeinen <tomi.valkeinen@ti.com>
+  */
+ 
+-#include <linux/dma-fence.h>
+-
+ #include <drm/drm_atomic.h>
+ #include <drm/drm_atomic_helper.h>
+ #include <drm/drm_bridge.h>
+@@ -27,7 +25,6 @@ static void tidss_atomic_commit_tail(struct drm_atomic_state *old_state)
+ {
+ 	struct drm_device *ddev = old_state->dev;
+ 	struct tidss_device *tidss = to_tidss(ddev);
+-	bool fence_cookie = dma_fence_begin_signalling();
+ 
+ 	dev_dbg(ddev->dev, "%s\n", __func__);
+ 
+@@ -38,7 +35,6 @@ static void tidss_atomic_commit_tail(struct drm_atomic_state *old_state)
+ 	drm_atomic_helper_commit_modeset_enables(ddev, old_state);
+ 
+ 	drm_atomic_helper_commit_hw_done(old_state);
+-	dma_fence_end_signalling(fence_cookie);
+ 	drm_atomic_helper_wait_for_flip_done(ddev, old_state);
+ 
+ 	drm_atomic_helper_cleanup_planes(ddev, old_state);
+-- 
+2.43.0
+
diff --git a/queue-6.1/scsi-fnic-return-error-if-vmalloc-failed.patch b/queue-6.1/scsi-fnic-return-error-if-vmalloc-failed.patch
new file mode 100644
index 00000000000..32549da26e3
--- /dev/null
+++ b/queue-6.1/scsi-fnic-return-error-if-vmalloc-failed.patch
@@ -0,0 +1,44 @@
+From 4e7ee4ced7241adad87c46e23b03a31200c80e71 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Nov 2023 14:10:08 +0300
+Subject: scsi: fnic: Return error if vmalloc() failed
+
+From: Artem Chernyshev <artem.chernyshev@red-soft.ru>
+
+[ Upstream commit f5f27a332a14f43463aa0075efa3a0c662c0f4a8 ]
+
+In fnic_init_module() exists redundant check for return value from
+fnic_debugfs_init(), because at moment it only can return zero. It make
+sense to process theoretical vmalloc() failure.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: 9730ddfb123d ("scsi: fnic: remove redundant assignment of variable rc")
+Signed-off-by: Artem Chernyshev <artem.chernyshev@red-soft.ru>
+Link: https://lore.kernel.org/r/20231128111008.2280507-1-artem.chernyshev@red-soft.ru
+Reviewed-by: Karan Tilak Kumar <kartilak@cisco.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/fnic/fnic_debugfs.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/fnic/fnic_debugfs.c b/drivers/scsi/fnic/fnic_debugfs.c
+index 6fedc3b7d1ab..eb895a65ea8f 100644
+--- a/drivers/scsi/fnic/fnic_debugfs.c
++++ b/drivers/scsi/fnic/fnic_debugfs.c
+@@ -52,9 +52,10 @@ int fnic_debugfs_init(void)
+ 		fc_trc_flag->fnic_trace = 2;
+ 		fc_trc_flag->fc_trace = 3;
+ 		fc_trc_flag->fc_clear = 4;
++		return 0;
+ 	}
+ 
+-	return 0;
++	return -ENOMEM;
+ }
+ 
+ /*
+-- 
+2.43.0
+
diff --git a/queue-6.1/scsi-hisi_sas-correct-the-number-of-global-debugfs-r.patch b/queue-6.1/scsi-hisi_sas-correct-the-number-of-global-debugfs-r.patch
new file mode 100644
index 00000000000..577aac225d9
--- /dev/null
+++ b/queue-6.1/scsi-hisi_sas-correct-the-number-of-global-debugfs-r.patch
@@ -0,0 +1,42 @@
+From 8d126a287fc48714d095af371e4ea06903a8ce90 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Dec 2023 11:45:16 +0800
+Subject: scsi: hisi_sas: Correct the number of global debugfs registers
+
+From: Yihang Li <liyihang9@huawei.com>
+
+[ Upstream commit 73e33f969ef05328766b23a99b2c07bfff765009 ]
+
+In function debugfs_debugfs_snapshot_global_reg_v3_hw() it uses
+debugfs_axi_reg.count (which is the number of axi debugfs registers) to
+acquire the number of global debugfs registers.
+
+Use debugfs_global_reg.count to acquire the number of global debugfs
+registers instead.
+
+Fixes: 623a4b6d5c2a ("scsi: hisi_sas: Move debugfs code to v3 hw driver")
+Signed-off-by: Yihang Li <liyihang9@huawei.com>
+Signed-off-by: Xiang Chen <chenxiang66@hisilicon.com>
+Link: https://lore.kernel.org/r/1702525516-51258-6-git-send-email-chenxiang66@hisilicon.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+index ee2065e83f9b..0c80ff9affa3 100644
+--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
++++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+@@ -3330,7 +3330,7 @@ static void debugfs_snapshot_global_reg_v3_hw(struct hisi_hba *hisi_hba)
+ 	u32 *databuf = hisi_hba->debugfs_regs[dump_index][DEBUGFS_GLOBAL].data;
+ 	int i;
+ 
+-	for (i = 0; i < debugfs_axi_reg.count; i++, databuf++)
++	for (i = 0; i < debugfs_global_reg.count; i++, databuf++)
+ 		*databuf = hisi_sas_read32(hisi_hba, 4 * i);
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/scsi-hisi_sas-replace-with-standard-error-code-retur.patch b/queue-6.1/scsi-hisi_sas-replace-with-standard-error-code-retur.patch
new file mode 100644
index 00000000000..36b5fcc80ee
--- /dev/null
+++ b/queue-6.1/scsi-hisi_sas-replace-with-standard-error-code-retur.patch
@@ -0,0 +1,63 @@
+From 2a7680d22b7321d911de30072c756f43160d0cd4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Dec 2023 11:45:13 +0800
+Subject: scsi: hisi_sas: Replace with standard error code return value
+
+From: Yihang Li <liyihang9@huawei.com>
+
+[ Upstream commit d34ee535705eb43885bc0f561c63046f697355ad ]
+
+In function hisi_sas_controller_prereset(), -ENOSYS (Function not
+implemented) should be returned if the driver does not support .soft_reset.
+Returns -EPERM (Operation not permitted) if HISI_SAS_RESETTING_BIT is
+already be set.
+
+In function _suspend_v3_hw(), returns -EPERM (Operation not permitted) if
+HISI_SAS_RESETTING_BIT is already be set.
+
+Fixes: 4522204ab218 ("scsi: hisi_sas: tidy host controller reset function a bit")
+Signed-off-by: Yihang Li <liyihang9@huawei.com>
+Signed-off-by: Xiang Chen <chenxiang66@hisilicon.com>
+Link: https://lore.kernel.org/r/1702525516-51258-3-git-send-email-chenxiang66@hisilicon.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/hisi_sas/hisi_sas_main.c  | 4 ++--
+ drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/scsi/hisi_sas/hisi_sas_main.c b/drivers/scsi/hisi_sas/hisi_sas_main.c
+index a8142e2b9643..450a8578157c 100644
+--- a/drivers/scsi/hisi_sas/hisi_sas_main.c
++++ b/drivers/scsi/hisi_sas/hisi_sas_main.c
+@@ -1502,12 +1502,12 @@ EXPORT_SYMBOL_GPL(hisi_sas_controller_reset_done);
+ static int hisi_sas_controller_prereset(struct hisi_hba *hisi_hba)
+ {
+ 	if (!hisi_hba->hw->soft_reset)
+-		return -1;
++		return -ENOENT;
+ 
+ 	down(&hisi_hba->sem);
+ 	if (test_and_set_bit(HISI_SAS_RESETTING_BIT, &hisi_hba->flags)) {
+ 		up(&hisi_hba->sem);
+-		return -1;
++		return -EPERM;
+ 	}
+ 
+ 	if (hisi_sas_debugfs_enable && hisi_hba->debugfs_itct[0].itct)
+diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+index c4305ec38ebf..4f816b2cfa49 100644
+--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
++++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+@@ -4981,7 +4981,7 @@ static int _suspend_v3_hw(struct device *device)
+ 	}
+ 
+ 	if (test_and_set_bit(HISI_SAS_RESETTING_BIT, &hisi_hba->flags))
+-		return -1;
++		return -EPERM;
+ 
+ 	dev_warn(dev, "entering suspend state\n");
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/scsi-hisi_sas-rollback-some-operations-if-flr-failed.patch b/queue-6.1/scsi-hisi_sas-rollback-some-operations-if-flr-failed.patch
new file mode 100644
index 00000000000..5c0772e2e69
--- /dev/null
+++ b/queue-6.1/scsi-hisi_sas-rollback-some-operations-if-flr-failed.patch
@@ -0,0 +1,55 @@
+From 67388dcd60ec23f5aafb840b775de20091b8d52a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Dec 2023 11:45:15 +0800
+Subject: scsi: hisi_sas: Rollback some operations if FLR failed
+
+From: Yihang Li <liyihang9@huawei.com>
+
+[ Upstream commit 7ea3e7763c50b20a8bd25cf524ea0c6463de69be ]
+
+We obtain the semaphore and set HISI_SAS_RESETTING_BIT in
+hisi_sas_reset_prepare_v3_hw(), block the scsi host and set
+HISI_SAS_REJECT_CMD_BIT in hisi_sas_controller_reset_prepare(), released
+them in hisi_sas_controller_reset_done(). However, if the HW reset failure
+in FLR results in early return, the semaphore and flag bits will not be
+release.
+
+Rollback some operations including clearing flags / releasing semaphore
+when FLR is failed.
+
+Fixes: e5ea48014adc ("scsi: hisi_sas: Implement handlers of PCIe FLR for v3 hw")
+Signed-off-by: Yihang Li <liyihang9@huawei.com>
+Signed-off-by: Xiang Chen <chenxiang66@hisilicon.com>
+Link: https://lore.kernel.org/r/1702525516-51258-5-git-send-email-chenxiang66@hisilicon.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+index 4f816b2cfa49..ee2065e83f9b 100644
+--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
++++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+@@ -4946,6 +4946,7 @@ static void hisi_sas_reset_done_v3_hw(struct pci_dev *pdev)
+ {
+ 	struct sas_ha_struct *sha = pci_get_drvdata(pdev);
+ 	struct hisi_hba *hisi_hba = sha->lldd_ha;
++	struct Scsi_Host *shost = hisi_hba->shost;
+ 	struct device *dev = hisi_hba->dev;
+ 	int rc;
+ 
+@@ -4954,6 +4955,10 @@ static void hisi_sas_reset_done_v3_hw(struct pci_dev *pdev)
+ 	rc = hw_init_v3_hw(hisi_hba);
+ 	if (rc) {
+ 		dev_err(dev, "FLR: hw init failed rc=%d\n", rc);
++		clear_bit(HISI_SAS_REJECT_CMD_BIT, &hisi_hba->flags);
++		scsi_unblock_requests(shost);
++		clear_bit(HISI_SAS_RESETTING_BIT, &hisi_hba->flags);
++		up(&hisi_hba->sem);
+ 		return;
+ 	}
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/sctp-fix-busy-polling.patch b/queue-6.1/sctp-fix-busy-polling.patch
new file mode 100644
index 00000000000..4c277caedc4
--- /dev/null
+++ b/queue-6.1/sctp-fix-busy-polling.patch
@@ -0,0 +1,54 @@
+From ccaad0a3df024559ef15d5059230fd67af6ccf2f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Dec 2023 17:00:17 +0000
+Subject: sctp: fix busy polling
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit a562c0a2d651e040681b0bfce9b4d229ac3b0b8c ]
+
+Busy polling while holding the socket lock makes litle sense,
+because incoming packets wont reach our receive queue.
+
+Fixes: 8465a5fcd1ce ("sctp: add support for busy polling to sctp protocol")
+Reported-by: Jacob Moroni <jmoroni@google.com>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
+Cc: Xin Long <lucien.xin@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sctp/socket.c | 10 ++++------
+ 1 file changed, 4 insertions(+), 6 deletions(-)
+
+diff --git a/net/sctp/socket.c b/net/sctp/socket.c
+index da56832179f0..237a6b04adf6 100644
+--- a/net/sctp/socket.c
++++ b/net/sctp/socket.c
+@@ -2101,6 +2101,10 @@ static int sctp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,
+ 	if (unlikely(flags & MSG_ERRQUEUE))
+ 		return inet_recv_error(sk, msg, len, addr_len);
+ 
++	if (sk_can_busy_loop(sk) &&
++	    skb_queue_empty_lockless(&sk->sk_receive_queue))
++		sk_busy_loop(sk, flags & MSG_DONTWAIT);
++
+ 	lock_sock(sk);
+ 
+ 	if (sctp_style(sk, TCP) && !sctp_sstate(sk, ESTABLISHED) &&
+@@ -9041,12 +9045,6 @@ struct sk_buff *sctp_skb_recv_datagram(struct sock *sk, int flags, int *err)
+ 		if (sk->sk_shutdown & RCV_SHUTDOWN)
+ 			break;
+ 
+-		if (sk_can_busy_loop(sk)) {
+-			sk_busy_loop(sk, flags & MSG_DONTWAIT);
+-
+-			if (!skb_queue_empty_lockless(&sk->sk_receive_queue))
+-				continue;
+-		}
+ 
+ 		/* User doesn't want to wait.  */
+ 		error = -EAGAIN;
+-- 
+2.43.0
+
diff --git a/queue-6.1/sctp-support-msg_errqueue-flag-in-recvmsg.patch b/queue-6.1/sctp-support-msg_errqueue-flag-in-recvmsg.patch
new file mode 100644
index 00000000000..979a5472196
--- /dev/null
+++ b/queue-6.1/sctp-support-msg_errqueue-flag-in-recvmsg.patch
@@ -0,0 +1,59 @@
+From 40e5baf01a104efbf56e51e070ef67681aad548b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Dec 2023 14:55:50 +0000
+Subject: sctp: support MSG_ERRQUEUE flag in recvmsg()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 4746b36b1abe11ca32987b2d21e1e770deab17cc ]
+
+For some reason sctp_poll() generates EPOLLERR if sk->sk_error_queue
+is not empty but recvmsg() can not drain the error queue yet.
+
+This is needed to better support timestamping.
+
+I had to export inet_recv_error(), since sctp
+can be compiled as a module.
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
+Cc: Willem de Bruijn <willemb@google.com>
+Acked-by: Xin Long <lucien.xin@gmail.com>
+Link: https://lore.kernel.org/r/20231212145550.3872051-1-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Stable-dep-of: a562c0a2d651 ("sctp: fix busy polling")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/af_inet.c | 1 +
+ net/sctp/socket.c  | 3 +++
+ 2 files changed, 4 insertions(+)
+
+diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
+index 347c3768df6e..c13b8ed63f87 100644
+--- a/net/ipv4/af_inet.c
++++ b/net/ipv4/af_inet.c
+@@ -1642,6 +1642,7 @@ int inet_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len)
+ #endif
+ 	return -EINVAL;
+ }
++EXPORT_SYMBOL(inet_recv_error);
+ 
+ int inet_gro_complete(struct sk_buff *skb, int nhoff)
+ {
+diff --git a/net/sctp/socket.c b/net/sctp/socket.c
+index e25dc1709131..da56832179f0 100644
+--- a/net/sctp/socket.c
++++ b/net/sctp/socket.c
+@@ -2098,6 +2098,9 @@ static int sctp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,
+ 	pr_debug("%s: sk:%p, msghdr:%p, len:%zd, flags:0x%x, addr_len:%p)\n",
+ 		 __func__, sk, msg, len, flags, addr_len);
+ 
++	if (unlikely(flags & MSG_ERRQUEUE))
++		return inet_recv_error(sk, msg, len, addr_len);
++
+ 	lock_sock(sk);
+ 
+ 	if (sctp_style(sk, TCP) && !sctp_sstate(sk, ESTABLISHED) &&
+-- 
+2.43.0
+
diff --git a/queue-6.1/selftests-bpf-fix-erroneous-bitmask-operation.patch b/queue-6.1/selftests-bpf-fix-erroneous-bitmask-operation.patch
new file mode 100644
index 00000000000..efe45b7aa90
--- /dev/null
+++ b/queue-6.1/selftests-bpf-fix-erroneous-bitmask-operation.patch
@@ -0,0 +1,52 @@
+From 352cfb661c785fd7b6f888d3c352c84814d27da5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Nov 2023 13:03:53 +0100
+Subject: selftests/bpf: Fix erroneous bitmask operation
+
+From: Jeroen van Ingen Schenau <jeroen.vaningenschenau@novoserve.com>
+
+[ Upstream commit b6a3451e0847d5d70fb5fa2b2a80ab9f80bf2c7b ]
+
+xdp_synproxy_kern.c is a BPF program that generates SYN cookies on
+allowed TCP ports and sends SYNACKs to clients, accelerating synproxy
+iptables module.
+
+Fix the bitmask operation when checking the status of an existing
+conntrack entry within tcp_lookup() function. Do not AND with the bit
+position number, but with the bitmask value to check whether the entry
+found has the IPS_CONFIRMED flag set.
+
+Fixes: fb5cd0ce70d4 ("selftests/bpf: Add selftests for raw syncookie helpers")
+Signed-off-by: Jeroen van Ingen Schenau <jeroen.vaningenschenau@novoserve.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Tested-by: Minh Le Hoang <minh.lehoang@novoserve.com>
+Link: https://lore.kernel.org/xdp-newbies/CAAi1gX7owA+Tcxq-titC-h-KPM7Ri-6ZhTNMhrnPq5gmYYwKow@mail.gmail.com/T/#u
+Link: https://lore.kernel.org/bpf/20231130120353.3084-1-jeroen.vaningenschenau@novoserve.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/progs/xdp_synproxy_kern.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/progs/xdp_synproxy_kern.c b/tools/testing/selftests/bpf/progs/xdp_synproxy_kern.c
+index 736686e903f6..26bfbc73d129 100644
+--- a/tools/testing/selftests/bpf/progs/xdp_synproxy_kern.c
++++ b/tools/testing/selftests/bpf/progs/xdp_synproxy_kern.c
+@@ -447,13 +447,13 @@ static __always_inline int tcp_lookup(void *ctx, struct header_pointers *hdr, bo
+ 		unsigned long status = ct->status;
+ 
+ 		bpf_ct_release(ct);
+-		if (status & IPS_CONFIRMED_BIT)
++		if (status & IPS_CONFIRMED)
+ 			return XDP_PASS;
+ 	} else if (ct_lookup_opts.error != -ENOENT) {
+ 		return XDP_ABORTED;
+ 	}
+ 
+-	/* error == -ENOENT || !(status & IPS_CONFIRMED_BIT) */
++	/* error == -ENOENT || !(status & IPS_CONFIRMED) */
+ 	return XDP_TX;
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/selftests-bpf-relax-time_tai-test-for-equal-timestam.patch b/queue-6.1/selftests-bpf-relax-time_tai-test-for-equal-timestam.patch
new file mode 100644
index 00000000000..3ab8f534005
--- /dev/null
+++ b/queue-6.1/selftests-bpf-relax-time_tai-test-for-equal-timestam.patch
@@ -0,0 +1,53 @@
+From 177b28910600c77ffe838b39dbc7733e2d47554f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Dec 2023 18:29:11 +0000
+Subject: selftests/bpf: Relax time_tai test for equal timestamps in
+ tai_forward
+
+From: YiFei Zhu <zhuyifei@google.com>
+
+[ Upstream commit e1ba7f64b192f083b4423644be03bb9e3dc8ae84 ]
+
+We're observing test flakiness on an arm64 platform which might not
+have timestamps as precise as x86. The test log looks like:
+
+  test_time_tai:PASS:tai_open 0 nsec
+  test_time_tai:PASS:test_run 0 nsec
+  test_time_tai:PASS:tai_ts1 0 nsec
+  test_time_tai:PASS:tai_ts2 0 nsec
+  test_time_tai:FAIL:tai_forward unexpected tai_forward: actual 1702348135471494160 <= expected 1702348135471494160
+  test_time_tai:PASS:tai_gettime 0 nsec
+  test_time_tai:PASS:tai_future_ts1 0 nsec
+  test_time_tai:PASS:tai_future_ts2 0 nsec
+  test_time_tai:PASS:tai_range_ts1 0 nsec
+  test_time_tai:PASS:tai_range_ts2 0 nsec
+  #199     time_tai:FAIL
+
+This patch changes ASSERT_GT to ASSERT_GE in the tai_forward assertion
+so that equal timestamps are permitted.
+
+Fixes: 64e15820b987 ("selftests/bpf: Add BPF-helper test for CLOCK_TAI access")
+Signed-off-by: YiFei Zhu <zhuyifei@google.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20231212182911.3784108-1-zhuyifei@google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/prog_tests/time_tai.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/bpf/prog_tests/time_tai.c b/tools/testing/selftests/bpf/prog_tests/time_tai.c
+index a31119823666..f45af1b0ef2c 100644
+--- a/tools/testing/selftests/bpf/prog_tests/time_tai.c
++++ b/tools/testing/selftests/bpf/prog_tests/time_tai.c
+@@ -56,7 +56,7 @@ void test_time_tai(void)
+ 	ASSERT_NEQ(ts2, 0, "tai_ts2");
+ 
+ 	/* TAI is moving forward only */
+-	ASSERT_GT(ts2, ts1, "tai_forward");
++	ASSERT_GE(ts2, ts1, "tai_forward");
+ 
+ 	/* Check for future */
+ 	ret = clock_gettime(CLOCK_TAI, &now_tai);
+-- 
+2.43.0
+
diff --git a/queue-6.1/selftests-net-fix-grep-checking-for-fib_nexthop_mult.patch b/queue-6.1/selftests-net-fix-grep-checking-for-fib_nexthop_mult.patch
new file mode 100644
index 00000000000..e54b9558502
--- /dev/null
+++ b/queue-6.1/selftests-net-fix-grep-checking-for-fib_nexthop_mult.patch
@@ -0,0 +1,68 @@
+From fdc75f02979a03e3e687bf0d0601761da9e05875 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Dec 2023 14:08:49 +0800
+Subject: selftests/net: fix grep checking for fib_nexthop_multiprefix
+
+From: Hangbin Liu <liuhangbin@gmail.com>
+
+[ Upstream commit a33e9da3470499e9ff476138f271fb52d6bfe767 ]
+
+When running fib_nexthop_multiprefix test I saw all IPv6 test failed.
+e.g.
+
+ ]# ./fib_nexthop_multiprefix.sh
+ TEST: IPv4: host 0 to host 1, mtu 1300                              [ OK ]
+ TEST: IPv6: host 0 to host 1, mtu 1300                              [FAIL]
+
+ With -v it shows
+
+ COMMAND: ip netns exec h0 /usr/sbin/ping6 -s 1350 -c5 -w5 2001:db8:101::1
+ PING 2001:db8:101::1(2001:db8:101::1) 1350 data bytes
+ From 2001:db8:100::64 icmp_seq=1 Packet too big: mtu=1300
+
+ --- 2001:db8:101::1 ping statistics ---
+ 1 packets transmitted, 0 received, +1 errors, 100% packet loss, time 0ms
+
+ Route get
+ 2001:db8:101::1 via 2001:db8:100::64 dev eth0 src 2001:db8:100::1 metric 1024 expires 599sec mtu 1300 pref medium
+ Searching for:
+     2001:db8:101::1 from :: via 2001:db8:100::64 dev eth0 src 2001:db8:100::1 .* mtu 1300
+
+The reason is when CONFIG_IPV6_SUBTREES is not enabled, rt6_fill_node() will
+not put RTA_SRC info. After fix:
+
+]# ./fib_nexthop_multiprefix.sh
+TEST: IPv4: host 0 to host 1, mtu 1300                              [ OK ]
+TEST: IPv6: host 0 to host 1, mtu 1300                              [ OK ]
+
+Fixes: 735ab2f65dce ("selftests: Add test with multiple prefixes using single nexthop")
+Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
+Link: https://lore.kernel.org/r/20231213060856.4030084-7-liuhangbin@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/fib_nexthop_multiprefix.sh | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/testing/selftests/net/fib_nexthop_multiprefix.sh b/tools/testing/selftests/net/fib_nexthop_multiprefix.sh
+index 51df5e305855..b52d59547fc5 100755
+--- a/tools/testing/selftests/net/fib_nexthop_multiprefix.sh
++++ b/tools/testing/selftests/net/fib_nexthop_multiprefix.sh
+@@ -209,12 +209,12 @@ validate_v6_exception()
+ 		echo "Route get"
+ 		ip -netns h0 -6 ro get ${dst}
+ 		echo "Searching for:"
+-		echo "    ${dst} from :: via ${r1} dev eth0 src ${h0} .* mtu ${mtu}"
++		echo "    ${dst}.* via ${r1} dev eth0 src ${h0} .* mtu ${mtu}"
+ 		echo
+ 	fi
+ 
+ 	ip -netns h0 -6 ro get ${dst} | \
+-	grep -q "${dst} from :: via ${r1} dev eth0 src ${h0} .* mtu ${mtu}"
++	grep -q "${dst}.* via ${r1} dev eth0 src ${h0} .* mtu ${mtu}"
+ 	rc=$?
+ 
+ 	log_test $rc 0 "IPv6: host 0 to host ${i}, mtu ${mtu}"
+-- 
+2.43.0
+
diff --git a/queue-6.1/selftests-net-specify-the-interface-when-do-arping.patch b/queue-6.1/selftests-net-specify-the-interface-when-do-arping.patch
new file mode 100644
index 00000000000..daf0fc5041e
--- /dev/null
+++ b/queue-6.1/selftests-net-specify-the-interface-when-do-arping.patch
@@ -0,0 +1,48 @@
+From 79d6c7073be43fc48a655631f77562d9ad285e4f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 Dec 2023 10:00:59 +0800
+Subject: selftests/net: specify the interface when do arping
+
+From: Hangbin Liu <liuhangbin@gmail.com>
+
+[ Upstream commit 7f770d28f2e5abfd442ad689ba1129dd66593529 ]
+
+When do arping, the interface need to be specified. Or we will
+get error: Interface "lo" is not ARPable. And the test failed.
+]# ./arp_ndisc_untracked_subnets.sh
+    TEST: test_arp:  accept_arp=0                                       [ OK ]
+    TEST: test_arp:  accept_arp=1                                       [FAIL]
+    TEST: test_arp:  accept_arp=2  same_subnet=0                        [ OK ]
+    TEST: test_arp:  accept_arp=2  same_subnet=1                        [FAIL]
+
+After fix:
+]# ./arp_ndisc_untracked_subnets.sh
+    TEST: test_arp:  accept_arp=0                                       [ OK ]
+    TEST: test_arp:  accept_arp=1                                       [ OK ]
+    TEST: test_arp:  accept_arp=2  same_subnet=0                        [ OK ]
+    TEST: test_arp:  accept_arp=2  same_subnet=1                        [ OK ]
+
+Fixes: 0ea7b0a454ca ("selftests: net: arp_ndisc_untracked_subnets: test for arp_accept and accept_untracked_na")
+Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/arp_ndisc_untracked_subnets.sh | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/net/arp_ndisc_untracked_subnets.sh b/tools/testing/selftests/net/arp_ndisc_untracked_subnets.sh
+index c899b446acb6..327427ec10f5 100755
+--- a/tools/testing/selftests/net/arp_ndisc_untracked_subnets.sh
++++ b/tools/testing/selftests/net/arp_ndisc_untracked_subnets.sh
+@@ -150,7 +150,7 @@ arp_test_gratuitous() {
+ 	fi
+ 	# Supply arp_accept option to set up which sets it in sysctl
+ 	setup ${arp_accept}
+-	ip netns exec ${HOST_NS} arping -A -U ${HOST_ADDR} -c1 2>&1 >/dev/null
++	ip netns exec ${HOST_NS} arping -A -I ${HOST_INTF} -U ${HOST_ADDR} -c1 2>&1 >/dev/null
+ 
+ 	if verify_arp $1 $2; then
+ 		printf "    TEST: %-60s  [ OK ]\n" "${test_msg[*]}"
+-- 
+2.43.0
+
diff --git a/queue-6.1/selftests-powerpc-fix-error-handling-in-fpu-vmx-pree.patch b/queue-6.1/selftests-powerpc-fix-error-handling-in-fpu-vmx-pree.patch
new file mode 100644
index 00000000000..ce80d7f28b4
--- /dev/null
+++ b/queue-6.1/selftests-powerpc-fix-error-handling-in-fpu-vmx-pree.patch
@@ -0,0 +1,88 @@
+From 9a2b2718eb25f696ae826d9716bdd126fc6da267 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Nov 2023 00:27:44 +1100
+Subject: selftests/powerpc: Fix error handling in FPU/VMX preemption tests
+
+From: Michael Ellerman <mpe@ellerman.id.au>
+
+[ Upstream commit 9dbd5927408c4a0707de73ae9dd9306b184e8fee ]
+
+The FPU & VMX preemption tests do not check for errors returned by the
+low-level asm routines, preempt_fpu() / preempt_vsx() respectively.
+That means any register corruption detected by the asm routines does not
+result in a test failure.
+
+Fix it by returning the return value of the asm routines from the
+pthread child routines.
+
+Fixes: e5ab8be68e44 ("selftests/powerpc: Test preservation of FPU and VMX regs across preemption")
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20231128132748.1990179-1-mpe@ellerman.id.au
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/powerpc/math/fpu_preempt.c |  9 +++++----
+ tools/testing/selftests/powerpc/math/vmx_preempt.c | 10 ++++++----
+ 2 files changed, 11 insertions(+), 8 deletions(-)
+
+diff --git a/tools/testing/selftests/powerpc/math/fpu_preempt.c b/tools/testing/selftests/powerpc/math/fpu_preempt.c
+index 5235bdc8c0b1..3e5b5663d244 100644
+--- a/tools/testing/selftests/powerpc/math/fpu_preempt.c
++++ b/tools/testing/selftests/powerpc/math/fpu_preempt.c
+@@ -37,19 +37,20 @@ __thread double darray[] = {0.1, 0.2, 0.3, 0.4, 0.5, 0.6, 0.7, 0.8, 0.9, 1.0,
+ int threads_starting;
+ int running;
+ 
+-extern void preempt_fpu(double *darray, int *threads_starting, int *running);
++extern int preempt_fpu(double *darray, int *threads_starting, int *running);
+ 
+ void *preempt_fpu_c(void *p)
+ {
++	long rc;
+ 	int i;
++
+ 	srand(pthread_self());
+ 	for (i = 0; i < 21; i++)
+ 		darray[i] = rand();
+ 
+-	/* Test failed if it ever returns */
+-	preempt_fpu(darray, &threads_starting, &running);
++	rc = preempt_fpu(darray, &threads_starting, &running);
+ 
+-	return p;
++	return (void *)rc;
+ }
+ 
+ int test_preempt_fpu(void)
+diff --git a/tools/testing/selftests/powerpc/math/vmx_preempt.c b/tools/testing/selftests/powerpc/math/vmx_preempt.c
+index 6761d6ce30ec..6f7cf400c687 100644
+--- a/tools/testing/selftests/powerpc/math/vmx_preempt.c
++++ b/tools/testing/selftests/powerpc/math/vmx_preempt.c
+@@ -37,19 +37,21 @@ __thread vector int varray[] = {{1, 2, 3, 4}, {5, 6, 7, 8}, {9, 10,11,12},
+ int threads_starting;
+ int running;
+ 
+-extern void preempt_vmx(vector int *varray, int *threads_starting, int *running);
++extern int preempt_vmx(vector int *varray, int *threads_starting, int *running);
+ 
+ void *preempt_vmx_c(void *p)
+ {
+ 	int i, j;
++	long rc;
++
+ 	srand(pthread_self());
+ 	for (i = 0; i < 12; i++)
+ 		for (j = 0; j < 4; j++)
+ 			varray[i][j] = rand();
+ 
+-	/* Test fails if it ever returns */
+-	preempt_vmx(varray, &threads_starting, &running);
+-	return p;
++	rc = preempt_vmx(varray, &threads_starting, &running);
++
++	return (void *)rc;
+ }
+ 
+ int test_preempt_vmx(void)
+-- 
+2.43.0
+
diff --git a/queue-6.1/selinux-fix-error-priority-for-bind-with-af_unspec-o.patch b/queue-6.1/selinux-fix-error-priority-for-bind-with-af_unspec-o.patch
new file mode 100644
index 00000000000..7d2d91c2466
--- /dev/null
+++ b/queue-6.1/selinux-fix-error-priority-for-bind-with-af_unspec-o.patch
@@ -0,0 +1,55 @@
+From d42308bf1842f1e3cba98f574583c7d92d2df4bf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Jan 2024 17:34:15 +0100
+Subject: selinux: Fix error priority for bind with AF_UNSPEC on PF_INET6
+ socket
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Mickaël Salaün <mic@digikod.net>
+
+[ Upstream commit bbf5a1d0e5d0fb3bdf90205aa872636122692a50 ]
+
+The IPv6 network stack first checks the sockaddr length (-EINVAL error)
+before checking the family (-EAFNOSUPPORT error).
+
+This was discovered thanks to commit a549d055a22e ("selftests/landlock:
+Add network tests").
+
+Cc: Eric Paris <eparis@parisplace.org>
+Cc: Konstantin Meskhidze <konstantin.meskhidze@huawei.com>
+Cc: Paul Moore <paul@paul-moore.com>
+Cc: Stephen Smalley <stephen.smalley.work@gmail.com>
+Reported-by: Muhammad Usama Anjum <usama.anjum@collabora.com>
+Closes: https://lore.kernel.org/r/0584f91c-537c-4188-9e4f-04f192565667@collabora.com
+Fixes: 0f8db8cc73df ("selinux: add AF_UNSPEC and INADDR_ANY checks to selinux_socket_bind()")
+Signed-off-by: Mickaël Salaün <mic@digikod.net>
+Tested-by: Muhammad Usama Anjum <usama.anjum@collabora.com>
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/selinux/hooks.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
+index d88c399b0e86..d45e9fa74e62 100644
+--- a/security/selinux/hooks.c
++++ b/security/selinux/hooks.c
+@@ -4690,6 +4690,13 @@ static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, in
+ 				return -EINVAL;
+ 			addr4 = (struct sockaddr_in *)address;
+ 			if (family_sa == AF_UNSPEC) {
++				if (family == PF_INET6) {
++					/* Length check from inet6_bind_sk() */
++					if (addrlen < SIN6_LEN_RFC2133)
++						return -EINVAL;
++					/* Family check from __inet6_bind() */
++					goto err_af;
++				}
+ 				/* see __inet_bind(), we only want to allow
+ 				 * AF_UNSPEC if the address is INADDR_ANY
+ 				 */
+-- 
+2.43.0
+
diff --git a/queue-6.1/series b/queue-6.1/series
new file mode 100644
index 00000000000..36586198208
--- /dev/null
+++ b/queue-6.1/series
@@ -0,0 +1,249 @@
+x86-lib-fix-overflow-when-counting-digits.patch
+x86-mce-inject-clear-test-status-value.patch
+edac-thunderx-fix-possible-out-of-bounds-string-acce.patch
+powerpc-remove-checks-for-binutils-older-than-2.25.patch
+powerpc-add-crtsavres.o-to-always-y-instead-of-extra.patch
+powerpc-44x-select-i2c-for-currituck.patch
+powerpc-pseries-memhp-fix-access-beyond-end-of-drmem.patch
+selftests-powerpc-fix-error-handling-in-fpu-vmx-pree.patch
+powerpc-powernv-add-a-null-pointer-check-to-scom_deb.patch
+powerpc-powernv-add-a-null-pointer-check-in-opal_eve.patch
+powerpc-powernv-add-a-null-pointer-check-in-opal_pow.patch
+powerpc-imc-pmu-add-a-null-pointer-check-in-update_e.patch
+spi-spi-zynqmp-gqspi-fix-driver-kconfig-dependencies.patch
+mtd-rawnand-increment-ifc_timeout_msecs-for-nand-con.patch
+acpi-video-check-for-error-while-searching-for-backl.patch
+acpi-lpit-avoid-u32-multiplication-overflow.patch
+keys-encrypted-add-check-for-strsep.patch
+platform-x86-intel-vsec-enhance-and-export-intel_vse.patch
+platform-x86-intel-vsec-support-private-data.patch
+platform-x86-intel-vsec-use-mutex-for-ida_alloc-and-.patch
+platform-x86-intel-vsec-fix-xa_alloc-memory-leak.patch
+of-add-of_property_present-helper.patch
+cpufreq-use-of_property_present-for-testing-dt-prope.patch
+cpufreq-scmi-process-the-result-of-devm_of_clk_add_h.patch
+calipso-fix-memory-leak-in-netlbl_calipso_add_pass.patch
+efivarfs-force-ro-when-remounting-if-setvariable-is-.patch
+efivarfs-free-s_fs_info-on-unmount.patch
+spi-sh-msiof-enforce-fixed-dtdl-for-r-car-h3.patch
+acpi-lpss-fix-the-fractional-clock-divider-flags.patch
+acpi-extlog-clear-extended-error-log-status-when-ras.patch
+kunit-debugfs-fix-unchecked-dereference-in-debugfs_p.patch
+mtd-fix-gluebi-null-pointer-dereference-caused-by-ft.patch
+selinux-fix-error-priority-for-bind-with-af_unspec-o.patch
+crypto-virtio-handle-dataq-logic-with-tasklet.patch
+crypto-sa2ul-return-crypto_aead_setkey-to-transfer-t.patch
+crypto-ccp-fix-memleak-in-ccp_init_dm_workarea.patch
+crypto-af_alg-disallow-multiple-in-flight-aio-reques.patch
+crypto-safexcel-add-error-handling-for-dma_map_sg-ca.patch
+crypto-sahara-remove-flags_new_key-logic.patch
+crypto-sahara-fix-cbc-selftest-failure.patch
+crypto-sahara-fix-ahash-selftest-failure.patch
+crypto-sahara-fix-processing-requests-with-cryptlen-.patch
+crypto-sahara-fix-error-handling-in-sahara_hw_descri.patch
+crypto-hisilicon-qm-save-capability-registers-in-qm-.patch
+crypto-hisilicon-zip-add-zip-comp-high-perf-mode-con.patch
+crypto-hisilicon-qm-add-a-function-to-set-qm-algs.patch
+crypto-hisilicon-hpre-save-capability-registers-in-p.patch
+crypto-hisilicon-sec2-save-capability-registers-in-p.patch
+crypto-hisilicon-zip-save-capability-registers-in-pr.patch
+pstore-ram_core-fix-possible-overflow-in-persistent_.patch
+erofs-fix-memory-leak-on-short-lived-bounced-pages.patch
+fs-indicate-request-originates-from-old-mount-api.patch
+gfs2-fix-kernel-null-pointer-dereference-in-gfs2_rgr.patch
+crypto-virtio-wait-for-tasklet-to-complete-on-device.patch
+crypto-sahara-avoid-skcipher-fallback-code-duplicati.patch
+crypto-sahara-handle-zero-length-aes-requests.patch
+crypto-sahara-fix-ahash-reqsize.patch
+crypto-sahara-fix-wait_for_completion_timeout-error-.patch
+crypto-sahara-improve-error-handling-in-sahara_sha_p.patch
+crypto-sahara-fix-processing-hash-requests-with-req-.patch
+crypto-sahara-do-not-resize-req-src-when-doing-hash-.patch
+crypto-scomp-fix-req-dst-buffer-overflow.patch
+csky-fix-arch_jump_label_transform_static-override.patch
+loongarch-signal.c-add-header-file-to-fix-build-erro.patch
+blocklayoutdriver-fix-reference-leak-of-pnfs_device_.patch
+nfsv4.1-pnfs-ensure-we-handle-the-error-nfs4err_retu.patch
+sunrpc-fix-_xprt_switch_find_current_entry-logic.patch
+pnfs-fix-the-pnfs-block-driver-s-calculation-of-layo.patch
+wifi-plfxlc-check-for-allocation-failure-in-plfxlc_u.patch
+wifi-rtw88-fix-rx-filter-in-fif_allmulti-flag.patch
+bpf-lpm-fix-check-prefixlen-before-walking-trie.patch
+bpf-add-crosstask-check-to-__bpf_get_stack.patch
+wifi-ath11k-defer-on-rproc_get-failure.patch
+wifi-libertas-stop-selecting-wext.patch
+arm-dts-qcom-apq8064-correct-xoadc-register-address.patch
+net-ncsi-fix-netlink-major-minor-version-numbers.patch
+firmware-ti_sci-fix-an-off-by-one-in-ti_sci_debugfs_.patch
+firmware-meson_sm-populate-platform-devices-from-sm-.patch
+wifi-rtlwifi-rtl8821ae-phy-fix-an-undefined-bitwise-.patch
+arm64-dts-ti-k3-am62a-main-fix-gpio-pin-count-in-dt-.patch
+arm64-dts-ti-k3-am65-main-fix-dss-irq-trigger-type.patch
+selftests-bpf-fix-erroneous-bitmask-operation.patch
+md-synchronize-flush-io-with-array-reconfiguration.patch
+bpf-enforce-precision-of-r0-on-callback-return.patch
+arm-dts-qcom-sdx65-correct-spmi-node-name.patch
+arm64-dts-qcom-sc7180-make-watchdog-bark-interrupt-e.patch
+arm64-dts-qcom-sc7280-mark-some-nodes-as-reserved.patch
+arm64-dts-qcom-sc7280-make-watchdog-bark-interrupt-e.patch
+arm64-dts-qcom-sdm845-make-watchdog-bark-interrupt-e.patch
+arm64-dts-qcom-sm8150-make-watchdog-bark-interrupt-e.patch
+arm64-dts-qcom-sm8250-make-watchdog-bark-interrupt-e.patch
+arm64-dts-qcom-sc8280xp-make-watchdog-bark-interrupt.patch
+arm64-dts-qcom-sm6350-make-watchdog-bark-interrupt-e.patch
+rcu-tasks-provide-rcu_trace_implies_rcu_gp.patch
+bpf-add-percpu-stats-for-bpf_map-elements-insertions.patch
+bpf-add-map-and-need_defer-parameters-to-.map_fd_put.patch
+bpf-defer-the-free-of-inner-map-when-necessary.patch
+selftests-net-specify-the-interface-when-do-arping.patch
+bpf-fix-check-for-attempt-to-corrupt-spilled-pointer.patch
+scsi-fnic-return-error-if-vmalloc-failed.patch
+arm64-dts-qcom-qrb5165-rb5-correct-led-panic-indicat.patch
+arm64-dts-qcom-sdm845-db845c-correct-led-panic-indic.patch
+arm64-dts-qcom-sm8350-fix-dma0-address.patch
+arm64-dts-qcom-sc7280-fix-up-gpu-sids.patch
+arm64-dts-qcom-sc7280-mark-adreno-smmu-as-dma-cohere.patch
+arm64-dts-qcom-sc7280-fix-usb_2-wakeup-interrupt-typ.patch
+wifi-mt76-mt7921s-fix-workqueue-problem-causes-sta-a.patch
+bpf-fix-verification-of-indirect-var-off-stack-acces.patch
+arm64-dts-hisilicon-hikey970-pmic-fix-regulator-cell.patch
+dt-bindings-media-mediatek-mdp3-correct-rdma-and-wro.patch
+arm64-dts-mediatek-mt8183-correct-mdp3-dma-related-n.patch
+wifi-mt76-mt7921-fix-country-count-limitation-for-cl.patch
+selftests-bpf-relax-time_tai-test-for-equal-timestam.patch
+driver-core-remove-config_sysfs_deprecated-and-confi.patch
+block-set-memalloc_noio-to-false-on-device_add_disk-.patch
+arm64-dts-renesas-white-hawk-cpu-fix-missing-serial-.patch
+arm64-dts-imx8mm-reduce-gpu-to-nominal-speed.patch
+scsi-hisi_sas-replace-with-standard-error-code-retur.patch
+scsi-hisi_sas-rollback-some-operations-if-flr-failed.patch
+scsi-hisi_sas-correct-the-number-of-global-debugfs-r.patch
+arm-dts-stm32-don-t-mix-scmi-and-non-scmi-board-comp.patch
+selftests-net-fix-grep-checking-for-fib_nexthop_mult.patch
+ipmr-support-ip_pktinfo-on-cache-report-igmp-msg.patch
+virtio-vsock-fix-logic-which-reduces-credit-update-m.patch
+dma-mapping-clear-dev-dma_mem-to-null-after-freeing-.patch
+soc-qcom-llcc-fix-dis_cap_alloc-and-retain_on_pc-con.patch
+arm64-dts-qcom-sm8150-hdk-fix-ss-usb-regulators.patch
+block-add-check-of-minors-and-first_minor-in-device_.patch
+arm64-dts-qcom-sc7280-mark-sdhci-hosts-as-cache-cohe.patch
+arm64-dts-qcom-ipq6018-fix-clock-rates-for-gcc_usb0_.patch
+arm64-dts-qcom-ipq6018-improve-pcie-phy-pcs-reg-tabl.patch
+arm64-dts-qcom-ipq6018-use-lowercase-hex.patch
+arm64-dts-qcom-ipq6018-pad-addresses-to-8-hex-digits.patch
+arm64-dts-qcom-ipq6018-fix-up-indentation.patch
+wifi-rtlwifi-add-calculate_bit_shift.patch
+wifi-rtlwifi-rtl8188ee-phy-using-calculate_bit_shift.patch
+wifi-rtlwifi-rtl8192c-using-calculate_bit_shift.patch
+wifi-rtlwifi-rtl8192cu-using-calculate_bit_shift.patch
+wifi-rtlwifi-rtl8192ce-using-calculate_bit_shift.patch
+wifi-rtlwifi-rtl8192de-using-calculate_bit_shift.patch
+wifi-rtlwifi-rtl8192ee-using-calculate_bit_shift.patch
+wifi-rtlwifi-rtl8192se-using-calculate_bit_shift.patch
+wifi-iwlwifi-mvm-set-siso-mimo-chains-to-1-in-fw-smp.patch
+wifi-iwlwifi-mvm-send-tx-path-flush-in-rfkill.patch
+netfilter-nf_tables-mark-newset-as-dead-on-transacti.patch
+bluetooth-fix-bogus-check-for-re-auth-no-supported-w.patch
+bluetooth-btmtkuart-fix-recv_buf-return-value.patch
+block-make-blk_def_max_sectors-unsigned.patch
+null_blk-don-t-cap-max_hw_sectors-to-blk_def_max_sec.patch
+bpf-sockmap-fix-proto-update-hook-to-avoid-dup-calls.patch
+sctp-support-msg_errqueue-flag-in-recvmsg.patch
+sctp-fix-busy-polling.patch
+net-sched-act_ct-fix-skb-leak-and-crash-on-ooo-frags.patch
+mlxbf_gige-fix-intermittent-no-ip-issue.patch
+mlxbf_gige-enable-the-gige-port-in-mlxbf_gige_open.patch
+ip6_tunnel-fix-nexthdr_fragment-handling-in-ip6_tnl_.patch
+arm-davinci-always-select-config_cpu_arm926t.patch
+revert-drm-tidss-annotate-dma-fence-critical-section.patch
+revert-drm-omapdrm-annotate-dma-fence-critical-secti.patch
+drm-panfrost-really-power-off-gpu-cores-in-panfrost_.patch
+rdma-usnic-silence-uninitialized-symbol-smatch-warni.patch
+rdma-hns-fix-inappropriate-err-code-for-unsupported-.patch
+drm-panel-elida-kd35t133-hold-panel-in-reset-for-unp.patch
+drm-nouveau-fence-fix-warning-directly-dereferencing.patch
+drm-bridge-tpd12s015-drop-buggy-__exit-annotation-fo.patch
+drm-tilcdc-fix-irq-free-on-unload.patch
+media-pvrusb2-fix-use-after-free-on-context-disconne.patch
+media-mtk-jpegdec-export-jpeg-decoder-functions.patch
+media-mtk-jpeg-remove-cancel-worker-in-mtk_jpeg_remo.patch
+media-verisilicon-hook-the-try_-decoder_cmd-stateles.patch
+media-rkvdec-hook-the-try_-decoder_cmd-stateless-ioc.patch
+drm-bridge-fix-typo-in-post_disable-description.patch
+f2fs-fix-to-avoid-dirent-corruption.patch
+drm-radeon-r600_cs-fix-possible-int-overflows-in-r60.patch
+drm-radeon-r100-fix-integer-overflow-issues-in-r100_.patch
+drm-radeon-check-return-value-of-radeon_ring_lock.patch
+drm-tidss-move-reset-to-the-end-of-dispc_init.patch
+drm-tidss-return-error-value-from-from-softreset.patch
+drm-tidss-check-for-k2g-in-in-dispc_softreset.patch
+drm-tidss-fix-dss-reset.patch
+asoc-cs35l33-fix-gpio-name-and-drop-legacy-include.patch
+asoc-cs35l34-fix-gpio-name-and-drop-legacy-include.patch
+drm-msm-mdp4-flush-vblank-event-on-disable.patch
+drm-msm-dsi-use-pm_runtime_resume_and_get-to-prevent.patch
+drm-drv-propagate-errors-from-drm_modeset_register_a.patch
+asoc-intel-glk_rt5682_max98357a-fix-board-id-mismatc.patch
+drm-panfrost-ignore-core_mask-for-poweroff-and-disab.patch
+drm-radeon-check-the-alloc_workqueue-return-value-in.patch
+drm-radeon-dpm-fix-a-memleak-in-sumo_parse_power_tab.patch
+drm-radeon-trinity_dpm-fix-a-memleak-in-trinity_pars.patch
+drm-bridge-cdns-mhdp8546-fix-use-of-uninitialized-va.patch
+drm-bridge-tc358767-fix-return-value-on-error-case.patch
+media-cx231xx-fix-a-memleak-in-cx231xx_init_isoc.patch
+rdma-hns-fix-memory-leak-in-free_mr_init.patch
+clk-qcom-gpucc-sm8150-update-the-gpu_cc_pll1-config.patch
+media-imx-mipi-csis-fix-clock-handling-in-remove.patch
+media-dt-bindings-media-rkisp1-fix-the-port-descript.patch
+media-rkisp1-fix-media-device-memory-leak.patch
+drm-panel-st7701-fix-avcl-calculation.patch
+f2fs-fix-to-wait-on-block-writeback-for-post_read-ca.patch
+f2fs-fix-to-check-compress-file-in-f2fs_move_file_ra.patch
+f2fs-fix-to-update-iostat-correctly-in-f2fs_filemap_.patch
+media-dvbdev-drop-refcount-on-error-path-in-dvb_devi.patch
+media-dvb-frontends-m88ds3103-fix-a-memory-leak-in-a.patch
+clk-renesas-rzg2l-cpg-reuse-code-in-rzg2l_cpg_reset.patch
+clk-renesas-rzg2l-check-reset-monitor-registers.patch
+drm-msm-dpu-set-input_sel-bit-for-intf.patch
+drm-msm-dpu-drop-enable-and-frame_count-parameters-f.patch
+drm-mediatek-return-error-if-mdp-rdma-failed-to-enab.patch
+drm-mediatek-fix-underrun-in-vdo1-when-switches-off-.patch
+drm-amdgpu-debugfs-fix-error-code-when-smc-register-.patch
+drm-amd-pm-fix-a-double-free-in-si_dpm_init.patch
+drivers-amd-pm-fix-a-use-after-free-in-kv_parse_powe.patch
+gpu-drm-radeon-fix-two-memleaks-in-radeon_vm_init.patch
+drm-amd-pm-fix-a-double-free-in-amdgpu_parse_extende.patch
+f2fs-fix-to-check-return-value-of-f2fs_recover_xattr.patch
+dt-bindings-clock-update-the-videocc-resets-for-sm81.patch
+clk-qcom-videocc-sm8150-update-the-videocc-resets.patch
+clk-qcom-videocc-sm8150-add-missing-pll-config-prope.patch
+drivers-clk-zynqmp-calculate-closest-mux-rate.patch
+drivers-clk-zynqmp-update-divider-round-rate-logic.patch
+watchdog-set-cdev-owner-before-adding.patch
+watchdog-hpwdt-only-claim-unknown-nmi-if-from-ilo.patch
+watchdog-bcm2835_wdt-fix-wdioc_settimeout-handling.patch
+watchdog-rti_wdt-drop-runtime-pm-reference-count-whe.patch
+clk-si5341-fix-an-error-code-problem-in-si5341_outpu.patch
+drm-mediatek-dp-add-phy_mtk_dp-module-as-pre-depende.patch
+accel-habanalabs-fix-information-leak-in-sec_attest_.patch
+clk-fixed-rate-fix-clk_hw_register_fixed_rate_with_a.patch
+pwm-stm32-use-regmap_clear_bits-and-regmap_set_bits-.patch
+pwm-stm32-use-hweight32-in-stm32_pwm_detect_channels.patch
+pwm-stm32-fix-enable-count-for-clk-in-.probe.patch
+asoc-rt5645-drop-double-ef20-entry-from-dmi_platform.patch
+alsa-scarlett2-add-missing-error-check-to-scarlett2_.patch
+alsa-scarlett2-add-missing-error-check-to-scarlett2_.patch-19676
+alsa-scarlett2-allow-passing-any-output-to-line_out_.patch
+alsa-scarlett2-add-missing-error-checks-to-_ctl_get.patch
+alsa-scarlett2-add-clamp-in-scarlett2_mixer_ctl_put.patch
+mmc-sdhci_am654-fix-ti-soc-dependencies.patch
+mmc-sdhci_omap-fix-ti-soc-dependencies.patch
+ib-iser-prevent-invalidating-wrong-mr.patch
+drm-amdkfd-confirm-list-is-non-empty-before-utilizin.patch
+drm-amd-pm-smu7-fix-a-memleak-in-smu7_hwmgr_backend_.patch
+kselftest-alsa-mixer-test-fix-the-number-of-paramete.patch
+kselftest-alsa-mixer-test-fix-the-print-format-speci.patch
+ksmbd-validate-the-zero-field-of-packet-header.patch
+of-fix-double-free-in-of_parse_phandle_with_args_map.patch
+fbdev-imxfb-fix-left-margin-setting.patch
+of-unittest-fix-of_count_phandle_with_args-expected-.patch
diff --git a/queue-6.1/soc-qcom-llcc-fix-dis_cap_alloc-and-retain_on_pc-con.patch b/queue-6.1/soc-qcom-llcc-fix-dis_cap_alloc-and-retain_on_pc-con.patch
new file mode 100644
index 00000000000..4247cb74bc8
--- /dev/null
+++ b/queue-6.1/soc-qcom-llcc-fix-dis_cap_alloc-and-retain_on_pc-con.patch
@@ -0,0 +1,69 @@
+From aefbeb58d53d67eb0d679b3d6d35471ca9661dcd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Dec 2023 21:02:51 +0530
+Subject: soc: qcom: llcc: Fix dis_cap_alloc and retain_on_pc configuration
+
+From: Atul Dhudase <quic_adhudase@quicinc.com>
+
+[ Upstream commit eed6e57e9f3e2beac37563eb6a0129549daa330e ]
+
+Commit c14e64b46944 ("soc: qcom: llcc: Support chipsets that can
+ write to llcc") add the support for chipset where capacity based
+allocation and retention through power collapse can be programmed
+based on content of SCT table mentioned in the llcc driver where
+the target like sdm845 where the entire programming related to it
+is controlled in firmware. However, the commit introduces a bug
+where capacity/retention register get overwritten each time it
+gets programmed for each slice and that results in misconfiguration
+of the register based on SCT table and that is not expected
+behaviour instead it should be read modify write to retain the
+configuration of other slices.
+
+This issue is totally caught from code review and programming test
+and not through any power/perf numbers so, it is not known what
+impact this could make if we don't have this change however,
+this feature are for these targets and they should have been
+programmed accordingly as per their configuration mentioned in
+SCT table like others bits information.
+
+This change brings one difference where it keeps capacity/retention
+bits of the slices that are not mentioned in SCT table in unknown
+state where as earlier it was initialized to zero.
+
+Fixes: c14e64b46944 ("soc: qcom: llcc: Support chipsets that can write to llcc")
+Signed-off-by: Atul Dhudase <quic_adhudase@quicinc.com>
+Signed-off-by: Mukesh Ojha <quic_mojha@quicinc.com>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Link: https://lore.kernel.org/r/1701876771-10695-1-git-send-email-quic_mojha@quicinc.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/qcom/llcc-qcom.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/soc/qcom/llcc-qcom.c b/drivers/soc/qcom/llcc-qcom.c
+index bc400669ee02..16a05143d0d6 100644
+--- a/drivers/soc/qcom/llcc-qcom.c
++++ b/drivers/soc/qcom/llcc-qcom.c
+@@ -680,14 +680,14 @@ static int _qcom_llcc_cfg_program(const struct llcc_slice_config *config,
+ 		u32 disable_cap_alloc, retain_pc;
+ 
+ 		disable_cap_alloc = config->dis_cap_alloc << config->slice_id;
+-		ret = regmap_write(drv_data->bcast_regmap,
+-				LLCC_TRP_SCID_DIS_CAP_ALLOC, disable_cap_alloc);
++		ret = regmap_update_bits(drv_data->bcast_regmap, LLCC_TRP_SCID_DIS_CAP_ALLOC,
++					 BIT(config->slice_id), disable_cap_alloc);
+ 		if (ret)
+ 			return ret;
+ 
+ 		retain_pc = config->retain_on_pc << config->slice_id;
+-		ret = regmap_write(drv_data->bcast_regmap,
+-				LLCC_TRP_PCB_ACT, retain_pc);
++		ret = regmap_update_bits(drv_data->bcast_regmap, LLCC_TRP_PCB_ACT,
++					 BIT(config->slice_id), retain_pc);
+ 		if (ret)
+ 			return ret;
+ 	}
+-- 
+2.43.0
+
diff --git a/queue-6.1/spi-sh-msiof-enforce-fixed-dtdl-for-r-car-h3.patch b/queue-6.1/spi-sh-msiof-enforce-fixed-dtdl-for-r-car-h3.patch
new file mode 100644
index 00000000000..729c07ebd26
--- /dev/null
+++ b/queue-6.1/spi-sh-msiof-enforce-fixed-dtdl-for-r-car-h3.patch
@@ -0,0 +1,80 @@
+From b8ed113e01ecc7eff8be679ee4a4b30056d888ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Dec 2023 09:12:38 +0100
+Subject: spi: sh-msiof: Enforce fixed DTDL for R-Car H3
+
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+
+[ Upstream commit e5c7bcb499840551cfbe85c6df177ebc50432bf0 ]
+
+Documentation says only DTDL of 200 is allowed for this SoC.
+
+Fixes: 4286db8456f4 ("spi: sh-msiof: Add R-Car Gen 2 and 3 fallback bindings")
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Link: https://msgid.link/r/20231212081239.14254-1-wsa+renesas@sang-engineering.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-sh-msiof.c | 17 +++++++++++++++++
+ 1 file changed, 17 insertions(+)
+
+diff --git a/drivers/spi/spi-sh-msiof.c b/drivers/spi/spi-sh-msiof.c
+index 9bca3d076f05..51ceaa485724 100644
+--- a/drivers/spi/spi-sh-msiof.c
++++ b/drivers/spi/spi-sh-msiof.c
+@@ -30,12 +30,15 @@
+ 
+ #include <asm/unaligned.h>
+ 
++#define SH_MSIOF_FLAG_FIXED_DTDL_200	BIT(0)
++
+ struct sh_msiof_chipdata {
+ 	u32 bits_per_word_mask;
+ 	u16 tx_fifo_size;
+ 	u16 rx_fifo_size;
+ 	u16 ctlr_flags;
+ 	u16 min_div_pow;
++	u32 flags;
+ };
+ 
+ struct sh_msiof_spi_priv {
+@@ -1073,6 +1076,16 @@ static const struct sh_msiof_chipdata rcar_gen3_data = {
+ 	.min_div_pow = 1,
+ };
+ 
++static const struct sh_msiof_chipdata rcar_r8a7795_data = {
++	.bits_per_word_mask = SPI_BPW_MASK(8) | SPI_BPW_MASK(16) |
++			      SPI_BPW_MASK(24) | SPI_BPW_MASK(32),
++	.tx_fifo_size = 64,
++	.rx_fifo_size = 64,
++	.ctlr_flags = SPI_CONTROLLER_MUST_TX,
++	.min_div_pow = 1,
++	.flags = SH_MSIOF_FLAG_FIXED_DTDL_200,
++};
++
+ static const struct of_device_id sh_msiof_match[] = {
+ 	{ .compatible = "renesas,sh-mobile-msiof", .data = &sh_data },
+ 	{ .compatible = "renesas,msiof-r8a7743",   .data = &rcar_gen2_data },
+@@ -1083,6 +1096,7 @@ static const struct of_device_id sh_msiof_match[] = {
+ 	{ .compatible = "renesas,msiof-r8a7793",   .data = &rcar_gen2_data },
+ 	{ .compatible = "renesas,msiof-r8a7794",   .data = &rcar_gen2_data },
+ 	{ .compatible = "renesas,rcar-gen2-msiof", .data = &rcar_gen2_data },
++	{ .compatible = "renesas,msiof-r8a7795",   .data = &rcar_r8a7795_data },
+ 	{ .compatible = "renesas,msiof-r8a7796",   .data = &rcar_gen3_data },
+ 	{ .compatible = "renesas,rcar-gen3-msiof", .data = &rcar_gen3_data },
+ 	{ .compatible = "renesas,rcar-gen4-msiof", .data = &rcar_gen3_data },
+@@ -1280,6 +1294,9 @@ static int sh_msiof_spi_probe(struct platform_device *pdev)
+ 		return -ENXIO;
+ 	}
+ 
++	if (chipdata->flags & SH_MSIOF_FLAG_FIXED_DTDL_200)
++		info->dtdl = 200;
++
+ 	if (info->mode == MSIOF_SPI_SLAVE)
+ 		ctlr = spi_alloc_slave(&pdev->dev,
+ 				       sizeof(struct sh_msiof_spi_priv));
+-- 
+2.43.0
+
diff --git a/queue-6.1/spi-spi-zynqmp-gqspi-fix-driver-kconfig-dependencies.patch b/queue-6.1/spi-spi-zynqmp-gqspi-fix-driver-kconfig-dependencies.patch
new file mode 100644
index 00000000000..ae225265ab3
--- /dev/null
+++ b/queue-6.1/spi-spi-zynqmp-gqspi-fix-driver-kconfig-dependencies.patch
@@ -0,0 +1,42 @@
+From 738c378062a830bfa62a7d88bf073880bfc9df1d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Nov 2023 20:23:55 +0530
+Subject: spi: spi-zynqmp-gqspi: fix driver kconfig dependencies
+
+From: Amit Kumar Mahapatra <amit.kumar-mahapatra@amd.com>
+
+[ Upstream commit 424a8166764e462258fdccaaefbdeb07517c8b21 ]
+
+ZynqMP GQSPI driver no longer uses spi-master framework. It had been
+converted to use spi-mem framework. So remove driver dependency from
+spi-master and replace it with spi-mem.
+
+Fixes: 1c26372e5aa9 ("spi: spi-zynqmp-gqspi: Update driver to use spi-mem framework")
+Signed-off-by: Amit Kumar Mahapatra <amit.kumar-mahapatra@amd.com>
+Signed-off-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
+Link: https://lore.kernel.org/r/1699282435-884917-1-git-send-email-radhey.shyam.pandey@amd.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/Kconfig | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/spi/Kconfig b/drivers/spi/Kconfig
+index 946e2186d244..15ea11ebcbe0 100644
+--- a/drivers/spi/Kconfig
++++ b/drivers/spi/Kconfig
+@@ -1101,9 +1101,10 @@ config SPI_ZYNQ_QSPI
+ 
+ config SPI_ZYNQMP_GQSPI
+ 	tristate "Xilinx ZynqMP GQSPI controller"
+-	depends on (SPI_MASTER && HAS_DMA) || COMPILE_TEST
++	depends on (SPI_MEM && HAS_DMA) || COMPILE_TEST
+ 	help
+ 	  Enables Xilinx GQSPI controller driver for Zynq UltraScale+ MPSoC.
++	  This controller only supports SPI memory interface.
+ 
+ config SPI_AMD
+ 	tristate "AMD SPI controller"
+-- 
+2.43.0
+
diff --git a/queue-6.1/sunrpc-fix-_xprt_switch_find_current_entry-logic.patch b/queue-6.1/sunrpc-fix-_xprt_switch_find_current_entry-logic.patch
new file mode 100644
index 00000000000..2eb05751b5e
--- /dev/null
+++ b/queue-6.1/sunrpc-fix-_xprt_switch_find_current_entry-logic.patch
@@ -0,0 +1,35 @@
+From ff2d062cbcab7b9b4b64dc4fc26d57e9f7b0f708 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Dec 2023 14:42:03 -0500
+Subject: SUNRPC: fix _xprt_switch_find_current_entry logic
+
+From: Olga Kornievskaia <kolga@netapp.com>
+
+[ Upstream commit 98b4e5137504a5bd9346562b1310cdc13486603b ]
+
+Fix the logic for picking current transport entry.
+
+Fixes: 95d0d30c66b8 ("SUNRPC create an iterator to list only OFFLINE xprts")
+Signed-off-by: Olga Kornievskaia <kolga@netapp.com>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sunrpc/xprtmultipath.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/sunrpc/xprtmultipath.c b/net/sunrpc/xprtmultipath.c
+index 701250b305db..74ee2271251e 100644
+--- a/net/sunrpc/xprtmultipath.c
++++ b/net/sunrpc/xprtmultipath.c
+@@ -284,7 +284,7 @@ struct rpc_xprt *_xprt_switch_find_current_entry(struct list_head *head,
+ 		if (cur == pos)
+ 			found = true;
+ 		if (found && ((find_active && xprt_is_active(pos)) ||
+-			      (!find_active && xprt_is_active(pos))))
++			      (!find_active && !xprt_is_active(pos))))
+ 			return pos;
+ 	}
+ 	return NULL;
+-- 
+2.43.0
+
diff --git a/queue-6.1/virtio-vsock-fix-logic-which-reduces-credit-update-m.patch b/queue-6.1/virtio-vsock-fix-logic-which-reduces-credit-update-m.patch
new file mode 100644
index 00000000000..1edd6f800ea
--- /dev/null
+++ b/queue-6.1/virtio-vsock-fix-logic-which-reduces-credit-update-m.patch
@@ -0,0 +1,69 @@
+From 42a6801d0bd0ef311e5cb58b0d21e6c0ed1c2758 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Dec 2023 15:52:28 +0300
+Subject: virtio/vsock: fix logic which reduces credit update messages
+
+From: Arseniy Krasnov <avkrasnov@salutedevices.com>
+
+[ Upstream commit 93b80887668226180ea5f5349cc728ca6dc700ab ]
+
+Add one more condition for sending credit update during dequeue from
+stream socket: when number of bytes in the rx queue is smaller than
+SO_RCVLOWAT value of the socket. This is actual for non-default value
+of SO_RCVLOWAT (e.g. not 1) - idea is to "kick" peer to continue data
+transmission, because we need at least SO_RCVLOWAT bytes in our rx
+queue to wake up user for reading data (in corner case it is also
+possible to stuck both tx and rx sides, this is why 'Fixes' is used).
+
+Fixes: b89d882dc9fc ("vsock/virtio: reduce credit update messages")
+Signed-off-by: Arseniy Krasnov <avkrasnov@salutedevices.com>
+Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
+Acked-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/vmw_vsock/virtio_transport_common.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+diff --git a/net/vmw_vsock/virtio_transport_common.c b/net/vmw_vsock/virtio_transport_common.c
+index 2e25890ca52d..9983b833b55d 100644
+--- a/net/vmw_vsock/virtio_transport_common.c
++++ b/net/vmw_vsock/virtio_transport_common.c
+@@ -366,6 +366,8 @@ virtio_transport_stream_do_dequeue(struct vsock_sock *vsk,
+ 	struct virtio_vsock_sock *vvs = vsk->trans;
+ 	size_t bytes, total = 0;
+ 	struct sk_buff *skb;
++	u32 fwd_cnt_delta;
++	bool low_rx_bytes;
+ 	int err = -EFAULT;
+ 	u32 free_space;
+ 
+@@ -400,7 +402,10 @@ virtio_transport_stream_do_dequeue(struct vsock_sock *vsk,
+ 		}
+ 	}
+ 
+-	free_space = vvs->buf_alloc - (vvs->fwd_cnt - vvs->last_fwd_cnt);
++	fwd_cnt_delta = vvs->fwd_cnt - vvs->last_fwd_cnt;
++	free_space = vvs->buf_alloc - fwd_cnt_delta;
++	low_rx_bytes = (vvs->rx_bytes <
++			sock_rcvlowat(sk_vsock(vsk), 0, INT_MAX));
+ 
+ 	spin_unlock_bh(&vvs->rx_lock);
+ 
+@@ -410,9 +415,11 @@ virtio_transport_stream_do_dequeue(struct vsock_sock *vsk,
+ 	 * too high causes extra messages. Too low causes transmitter
+ 	 * stalls. As stalls are in theory more expensive than extra
+ 	 * messages, we set the limit to a high value. TODO: experiment
+-	 * with different values.
++	 * with different values. Also send credit update message when
++	 * number of bytes in rx queue is not enough to wake up reader.
+ 	 */
+-	if (free_space < VIRTIO_VSOCK_MAX_PKT_BUF_SIZE)
++	if (fwd_cnt_delta &&
++	    (free_space < VIRTIO_VSOCK_MAX_PKT_BUF_SIZE || low_rx_bytes))
+ 		virtio_transport_send_credit_update(vsk);
+ 
+ 	return total;
+-- 
+2.43.0
+
diff --git a/queue-6.1/watchdog-bcm2835_wdt-fix-wdioc_settimeout-handling.patch b/queue-6.1/watchdog-bcm2835_wdt-fix-wdioc_settimeout-handling.patch
new file mode 100644
index 00000000000..12604cb4ddc
--- /dev/null
+++ b/queue-6.1/watchdog-bcm2835_wdt-fix-wdioc_settimeout-handling.patch
@@ -0,0 +1,57 @@
+From 298d84b6e52aa928cc769eec338ce79fc55acd09 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 12 Nov 2023 18:32:51 +0100
+Subject: watchdog: bcm2835_wdt: Fix WDIOC_SETTIMEOUT handling
+
+From: Stefan Wahren <wahrenst@gmx.net>
+
+[ Upstream commit f33f5b1fd1be5f5106d16f831309648cb0f1c31d ]
+
+Users report about the unexpected behavior for setting timeouts above
+15 sec on Raspberry Pi. According to watchdog-api.rst the ioctl
+WDIOC_SETTIMEOUT shouldn't fail because of hardware limitations.
+But looking at the code shows that max_timeout based on the
+register value PM_WDOG_TIME_SET, which is the maximum.
+
+Since 664a39236e71 ("watchdog: Introduce hardware maximum heartbeat
+in watchdog core") the watchdog core is able to handle this problem.
+
+This fix has been tested with watchdog-test from selftests.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=217374
+Fixes: 664a39236e71 ("watchdog: Introduce hardware maximum heartbeat in watchdog core")
+Signed-off-by: Stefan Wahren <wahrenst@gmx.net>
+Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Link: https://lore.kernel.org/r/20231112173251.4827-1-wahrenst@gmx.net
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/bcm2835_wdt.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/watchdog/bcm2835_wdt.c b/drivers/watchdog/bcm2835_wdt.c
+index 94907176a0e4..55c0f7b0e8fb 100644
+--- a/drivers/watchdog/bcm2835_wdt.c
++++ b/drivers/watchdog/bcm2835_wdt.c
+@@ -42,6 +42,7 @@
+ 
+ #define SECS_TO_WDOG_TICKS(x) ((x) << 16)
+ #define WDOG_TICKS_TO_SECS(x) ((x) >> 16)
++#define WDOG_TICKS_TO_MSECS(x) ((x) * 1000 >> 16)
+ 
+ struct bcm2835_wdt {
+ 	void __iomem		*base;
+@@ -140,7 +141,7 @@ static struct watchdog_device bcm2835_wdt_wdd = {
+ 	.info =		&bcm2835_wdt_info,
+ 	.ops =		&bcm2835_wdt_ops,
+ 	.min_timeout =	1,
+-	.max_timeout =	WDOG_TICKS_TO_SECS(PM_WDOG_TIME_SET),
++	.max_hw_heartbeat_ms =	WDOG_TICKS_TO_MSECS(PM_WDOG_TIME_SET),
+ 	.timeout =	WDOG_TICKS_TO_SECS(PM_WDOG_TIME_SET),
+ };
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/watchdog-hpwdt-only-claim-unknown-nmi-if-from-ilo.patch b/queue-6.1/watchdog-hpwdt-only-claim-unknown-nmi-if-from-ilo.patch
new file mode 100644
index 00000000000..e5139f23d52
--- /dev/null
+++ b/queue-6.1/watchdog-hpwdt-only-claim-unknown-nmi-if-from-ilo.patch
@@ -0,0 +1,51 @@
+From 3e89dee2b1b3723736869c5c87dc230e125ccf05 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Dec 2023 14:53:38 -0700
+Subject: watchdog/hpwdt: Only claim UNKNOWN NMI if from iLO
+
+From: Jerry Hoemann <jerry.hoemann@hpe.com>
+
+[ Upstream commit dced0b3e51dd2af3730efe14dd86b5e3173f0a65 ]
+
+Avoid unnecessary crashes by claiming only NMIs that are due to
+ERROR signalling or generated by the hpwdt hardware device.
+
+The code does this, but only for iLO5.
+
+The intent was to preserve legacy, Gen9 and earlier, semantics of
+using hpwdt for error containtment as hardware/firmware would signal
+fatal IO errors as an NMI with the expectation of hpwdt crashing
+the system.  Howerver, these IO errors should be received by hpwdt
+as an NMI_IO_CHECK.  So the test is overly permissive and should
+not be limited to only ilo5.
+
+We need to enable this protection for future iLOs not matching the
+current PCI IDs.
+
+Fixes: 62290a5c194b ("watchdog: hpwdt: Claim NMIs generated by iLO5")
+Signed-off-by: Jerry Hoemann <jerry.hoemann@hpe.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Link: https://lore.kernel.org/r/20231213215340.495734-2-jerry.hoemann@hpe.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/hpwdt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/watchdog/hpwdt.c b/drivers/watchdog/hpwdt.c
+index f79f932bca14..79ed1626d8ea 100644
+--- a/drivers/watchdog/hpwdt.c
++++ b/drivers/watchdog/hpwdt.c
+@@ -178,7 +178,7 @@ static int hpwdt_pretimeout(unsigned int ulReason, struct pt_regs *regs)
+ 		"3. OA Forward Progress Log\n"
+ 		"4. iLO Event Log";
+ 
+-	if (ilo5 && ulReason == NMI_UNKNOWN && !mynmi)
++	if (ulReason == NMI_UNKNOWN && !mynmi)
+ 		return NMI_DONE;
+ 
+ 	if (ilo5 && !pretimeout && !mynmi)
+-- 
+2.43.0
+
diff --git a/queue-6.1/watchdog-rti_wdt-drop-runtime-pm-reference-count-whe.patch b/queue-6.1/watchdog-rti_wdt-drop-runtime-pm-reference-count-whe.patch
new file mode 100644
index 00000000000..c6c9679bf2f
--- /dev/null
+++ b/queue-6.1/watchdog-rti_wdt-drop-runtime-pm-reference-count-whe.patch
@@ -0,0 +1,72 @@
+From 762479cd26f46045ae75ad7b30f5076b17f7ffe8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Dec 2023 19:31:10 +0530
+Subject: watchdog: rti_wdt: Drop runtime pm reference count when watchdog is
+ unused
+
+From: Vignesh Raghavendra <vigneshr@ti.com>
+
+[ Upstream commit c1a6edf3b541e44e78f10bc6024df779715723f1 ]
+
+Call runtime_pm_put*() if watchdog is not already started during probe and re
+enable it in watchdog start as required.
+
+On K3 SoCs, watchdogs and their corresponding CPUs are under same
+power-domain, so if the reference count of unused watchdogs aren't
+dropped, it will lead to CPU hotplug failures as Device Management
+firmware won't allow to turn off the power-domain due to dangling
+reference count.
+
+Fixes: 2d63908bdbfb ("watchdog: Add K3 RTI watchdog support")
+Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
+Tested-by: Manorit Chawdhry <m-chawdhry@ti.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Link: https://lore.kernel.org/r/20231213140110.938129-1-vigneshr@ti.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/rti_wdt.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/watchdog/rti_wdt.c b/drivers/watchdog/rti_wdt.c
+index 6e9253761fc1..ea617c0f9747 100644
+--- a/drivers/watchdog/rti_wdt.c
++++ b/drivers/watchdog/rti_wdt.c
+@@ -70,6 +70,11 @@ static int rti_wdt_start(struct watchdog_device *wdd)
+ {
+ 	u32 timer_margin;
+ 	struct rti_wdt_device *wdt = watchdog_get_drvdata(wdd);
++	int ret;
++
++	ret = pm_runtime_resume_and_get(wdd->parent);
++	if (ret)
++		return ret;
+ 
+ 	/* set timeout period */
+ 	timer_margin = (u64)wdd->timeout * wdt->freq;
+@@ -295,6 +300,9 @@ static int rti_wdt_probe(struct platform_device *pdev)
+ 	if (last_ping)
+ 		watchdog_set_last_hw_keepalive(wdd, last_ping);
+ 
++	if (!watchdog_hw_running(wdd))
++		pm_runtime_put_sync(&pdev->dev);
++
+ 	return 0;
+ 
+ err_iomap:
+@@ -309,7 +317,10 @@ static int rti_wdt_remove(struct platform_device *pdev)
+ 	struct rti_wdt_device *wdt = platform_get_drvdata(pdev);
+ 
+ 	watchdog_unregister_device(&wdt->wdd);
+-	pm_runtime_put(&pdev->dev);
++
++	if (!pm_runtime_suspended(&pdev->dev))
++		pm_runtime_put(&pdev->dev);
++
+ 	pm_runtime_disable(&pdev->dev);
+ 
+ 	return 0;
+-- 
+2.43.0
+
diff --git a/queue-6.1/watchdog-set-cdev-owner-before-adding.patch b/queue-6.1/watchdog-set-cdev-owner-before-adding.patch
new file mode 100644
index 00000000000..369cb1a53b6
--- /dev/null
+++ b/queue-6.1/watchdog-set-cdev-owner-before-adding.patch
@@ -0,0 +1,61 @@
+From 1a3accf3add9739ece0099415d2e30f9b57e68cb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Dec 2023 11:05:22 -0800
+Subject: watchdog: set cdev owner before adding
+
+From: Curtis Klein <curtis.klein@hpe.com>
+
+[ Upstream commit 38d75297745f04206db9c29bdd75557f0344c7cc ]
+
+When the new watchdog character device is registered, it becomes
+available for opening. This creates a race where userspace may open the
+device before the character device's owner is set. This results in an
+imbalance in module_get calls as the cdev_get in cdev_open will not
+increment the reference count on the watchdog driver module.
+
+This causes problems when the watchdog character device is released as
+the module loader's reference will also be released. This makes it
+impossible to open the watchdog device later on as it now appears that
+the module is being unloaded. The open will fail with -ENXIO from
+chrdev_open.
+
+The legacy watchdog device will fail with -EBUSY from the try_module_get
+in watchdog_open because it's module owner is the watchdog core module
+so it can still be opened but it will fail to get a refcount on the
+underlying watchdog device driver.
+
+Fixes: 72139dfa2464 ("watchdog: Fix the race between the release of watchdog_core_data and cdev")
+Signed-off-by: Curtis Klein <curtis.klein@hpe.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Link: https://lore.kernel.org/r/20231205190522.55153-1-curtis.klein@hpe.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/watchdog_dev.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/watchdog/watchdog_dev.c b/drivers/watchdog/watchdog_dev.c
+index fdffa6859dde..81684d89dc98 100644
+--- a/drivers/watchdog/watchdog_dev.c
++++ b/drivers/watchdog/watchdog_dev.c
+@@ -1052,6 +1052,7 @@ static int watchdog_cdev_register(struct watchdog_device *wdd)
+ 
+ 	/* Fill in the data structures */
+ 	cdev_init(&wd_data->cdev, &watchdog_fops);
++	wd_data->cdev.owner = wdd->ops->owner;
+ 
+ 	/* Add the device */
+ 	err = cdev_device_add(&wd_data->cdev, &wd_data->dev);
+@@ -1066,8 +1067,6 @@ static int watchdog_cdev_register(struct watchdog_device *wdd)
+ 		return err;
+ 	}
+ 
+-	wd_data->cdev.owner = wdd->ops->owner;
+-
+ 	/* Record time of most recent heartbeat as 'just before now'. */
+ 	wd_data->last_hw_keepalive = ktime_sub(ktime_get(), 1);
+ 	watchdog_set_open_deadline(wd_data);
+-- 
+2.43.0
+
diff --git a/queue-6.1/wifi-ath11k-defer-on-rproc_get-failure.patch b/queue-6.1/wifi-ath11k-defer-on-rproc_get-failure.patch
new file mode 100644
index 00000000000..fe3599060de
--- /dev/null
+++ b/queue-6.1/wifi-ath11k-defer-on-rproc_get-failure.patch
@@ -0,0 +1,57 @@
+From 208a9a2888b26358de7ed6c1329d3237551e0efe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Oct 2023 08:57:18 +0200
+Subject: wifi: ath11k: Defer on rproc_get failure
+
+From: Luca Weiss <luca.weiss@fairphone.com>
+
+[ Upstream commit 2a3ec40b98b46c339adb57313d3b933ee5e7a8e8 ]
+
+If we already have gotten the rproc_handle (meaning the "qcom,rproc"
+property is defined in the devicetree), it's a valid state that the
+remoteproc module hasn't probed yet so we should defer probing instead
+of just failing to probe.
+
+This resolves a race condition when the ath11k driver probes and fails
+before the wpss remoteproc driver has probed, like the following:
+
+  [    6.232360] ath11k 17a10040.wifi: failed to get rproc
+  [    6.232366] ath11k 17a10040.wifi: failed to get rproc: -22
+  [    6.232478] ath11k: probe of 17a10040.wifi failed with error -22
+       ...
+  [    6.252415] remoteproc remoteproc2: 8a00000.remoteproc is available
+  [    6.252776] remoteproc remoteproc2: powering up 8a00000.remoteproc
+  [    6.252781] remoteproc remoteproc2: Booting fw image qcom/qcm6490/fairphone5/wpss.mdt, size 7188
+
+So, defer the probe if we hit that so we can retry later once the wpss
+remoteproc is available.
+
+Tested-on: WCN6750 hw1.0 AHB WLAN.MSL.1.0.1-01264-QCAMSLSWPLZ-1.37886.3
+
+Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices")
+Signed-off-by: Luca Weiss <luca.weiss@fairphone.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20231027-ath11k-rproc-defer-v1-1-f6b6a812cd18@fairphone.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath11k/ahb.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath11k/ahb.c b/drivers/net/wireless/ath/ath11k/ahb.c
+index 76f275ca53e9..70d468f01338 100644
+--- a/drivers/net/wireless/ath/ath11k/ahb.c
++++ b/drivers/net/wireless/ath/ath11k/ahb.c
+@@ -813,8 +813,8 @@ static int ath11k_core_get_rproc(struct ath11k_base *ab)
+ 
+ 	prproc = rproc_get_by_phandle(rproc_phandle);
+ 	if (!prproc) {
+-		ath11k_err(ab, "failed to get rproc\n");
+-		return -EINVAL;
++		ath11k_dbg(ab, ATH11K_DBG_AHB, "failed to get rproc, deferring\n");
++		return -EPROBE_DEFER;
+ 	}
+ 	ab_ahb->tgt_rproc = prproc;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/wifi-iwlwifi-mvm-send-tx-path-flush-in-rfkill.patch b/queue-6.1/wifi-iwlwifi-mvm-send-tx-path-flush-in-rfkill.patch
new file mode 100644
index 00000000000..3720692bd15
--- /dev/null
+++ b/queue-6.1/wifi-iwlwifi-mvm-send-tx-path-flush-in-rfkill.patch
@@ -0,0 +1,42 @@
+From ceb2e940edd65a1c1cba8d6aed57125155af0d45 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Dec 2023 21:58:52 +0200
+Subject: wifi: iwlwifi: mvm: send TX path flush in rfkill
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 2afc3dad39ea84a072d04ff40a417234326adc47 ]
+
+If we want to drop packets, that's surely a good thing to
+do when we want to enter rfkill. Send this command despite
+rfkill so we can successfully clean up everything, we need
+to handle it separately since it has CMD_WANT_SKB, so it's
+not going to automatically return success when in rfkill.
+
+Fixes: d4e3a341b87b ("iwlwifi: mvm: add support for new flush queue response")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Reviewed-by: Gregory Greenman <gregory.greenman@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://msgid.link/20231219215605.c528a6fa6cec.Ibe5e9560359ccc0fba60c35e01de285c376748a2@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/tx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+index caaf4d52e2c6..76219486b9c2 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+@@ -2200,7 +2200,7 @@ int iwl_mvm_flush_sta_tids(struct iwl_mvm *mvm, u32 sta_id, u16 tids)
+ 	WARN_ON(!iwl_mvm_has_new_tx_api(mvm));
+ 
+ 	if (iwl_fw_lookup_notif_ver(mvm->fw, LONG_GROUP, TXPATH_FLUSH, 0) > 0)
+-		cmd.flags |= CMD_WANT_SKB;
++		cmd.flags |= CMD_WANT_SKB | CMD_SEND_IN_RFKILL;
+ 
+ 	IWL_DEBUG_TX_QUEUES(mvm, "flush for sta id %d tid mask 0x%x\n",
+ 			    sta_id, tids);
+-- 
+2.43.0
+
diff --git a/queue-6.1/wifi-iwlwifi-mvm-set-siso-mimo-chains-to-1-in-fw-smp.patch b/queue-6.1/wifi-iwlwifi-mvm-set-siso-mimo-chains-to-1-in-fw-smp.patch
new file mode 100644
index 00000000000..257e5381bf5
--- /dev/null
+++ b/queue-6.1/wifi-iwlwifi-mvm-set-siso-mimo-chains-to-1-in-fw-smp.patch
@@ -0,0 +1,49 @@
+From 2a69e5fe2f87fe4b0651b2ede57c79bf38aa77cf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Dec 2023 21:58:49 +0200
+Subject: wifi: iwlwifi: mvm: set siso/mimo chains to 1 in FW SMPS request
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit b1a2e5c310e063560760806d2cc5d2233c596067 ]
+
+The firmware changed their mind, don't set the chains to zero,
+instead set them to 1 as we normally would for connections to
+APs that don't use MIMO.
+
+Fixes: 2a7ce54ccc23 ("iwlwifi: mvm: honour firmware SMPS requests")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Reviewed-by: Luciano Coelho <luciano.coelho@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://msgid.link/20231219215605.7f031f1a127f.Idc816e0f604b07d22a9d5352bc23c445512fad14@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/phy-ctxt.c | 11 -----------
+ 1 file changed, 11 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/phy-ctxt.c b/drivers/net/wireless/intel/iwlwifi/mvm/phy-ctxt.c
+index a3cefbc43e80..2c14188f34bb 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/phy-ctxt.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/phy-ctxt.c
+@@ -99,17 +99,6 @@ static void iwl_mvm_phy_ctxt_set_rxchain(struct iwl_mvm *mvm,
+ 		active_cnt = 2;
+ 	}
+ 
+-	/*
+-	 * If the firmware requested it, then we know that it supports
+-	 * getting zero for the values to indicate "use one, but pick
+-	 * which one yourself", which means it can dynamically pick one
+-	 * that e.g. has better RSSI.
+-	 */
+-	if (mvm->fw_static_smps_request && active_cnt == 1 && idle_cnt == 1) {
+-		idle_cnt = 0;
+-		active_cnt = 0;
+-	}
+-
+ 	*rxchain_info = cpu_to_le32(iwl_mvm_get_valid_rx_ant(mvm) <<
+ 					PHY_RX_CHAIN_VALID_POS);
+ 	*rxchain_info |= cpu_to_le32(idle_cnt << PHY_RX_CHAIN_CNT_POS);
+-- 
+2.43.0
+
diff --git a/queue-6.1/wifi-libertas-stop-selecting-wext.patch b/queue-6.1/wifi-libertas-stop-selecting-wext.patch
new file mode 100644
index 00000000000..68a412b9766
--- /dev/null
+++ b/queue-6.1/wifi-libertas-stop-selecting-wext.patch
@@ -0,0 +1,37 @@
+From d6d43a7f63a22ebde5731dc687c5748ff5af3a87 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Nov 2023 16:34:03 +0100
+Subject: wifi: libertas: stop selecting wext
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 8170b04c2c92eee52ea50b96db4c54662197e512 ]
+
+Libertas no longer references the iw_handler infrastructure or wext_spy,
+so neither of the 'select' statements are used any more.
+
+Fixes: e86dc1ca4676 ("Libertas: cfg80211 support")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20231108153409.1065286-1-arnd@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/marvell/libertas/Kconfig | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/net/wireless/marvell/libertas/Kconfig b/drivers/net/wireless/marvell/libertas/Kconfig
+index 6d62ab49aa8d..c7d02adb3eea 100644
+--- a/drivers/net/wireless/marvell/libertas/Kconfig
++++ b/drivers/net/wireless/marvell/libertas/Kconfig
+@@ -2,8 +2,6 @@
+ config LIBERTAS
+ 	tristate "Marvell 8xxx Libertas WLAN driver support"
+ 	depends on CFG80211
+-	select WIRELESS_EXT
+-	select WEXT_SPY
+ 	select LIB80211
+ 	select FW_LOADER
+ 	help
+-- 
+2.43.0
+
diff --git a/queue-6.1/wifi-mt76-mt7921-fix-country-count-limitation-for-cl.patch b/queue-6.1/wifi-mt76-mt7921-fix-country-count-limitation-for-cl.patch
new file mode 100644
index 00000000000..3b456b38e4d
--- /dev/null
+++ b/queue-6.1/wifi-mt76-mt7921-fix-country-count-limitation-for-cl.patch
@@ -0,0 +1,60 @@
+From a7dad6c0ef9b313552e2b69d3591aa8abccf9d7a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Nov 2023 11:06:44 +0800
+Subject: wifi: mt76: mt7921: fix country count limitation for CLC
+
+From: Ming Yen Hsieh <mingyen.hsieh@mediatek.com>
+
+[ Upstream commit fa6ad88e023ddfa6c5dcdb466d159e89f451e305 ]
+
+Due to the increase in the number of power tables for 6Ghz on CLC,
+the variable nr_country is no longer sufficient to represent the
+total quantity. Therefore, we have switched to calculating the
+length of clc buf to obtain the correct power table. Additionally,
+the version number has been incremented to 1.
+
+Fixes: 23bdc5d8cadf ("wifi: mt76: mt7921: introduce Country Location Control support")
+Signed-off-by: Ming Yen Hsieh <mingyen.hsieh@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
+index 10dda1693d7d..19640ff76bdc 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
+@@ -1036,21 +1036,26 @@ int __mt7921_mcu_set_clc(struct mt7921_dev *dev, u8 *alpha2,
+ 		u8 type[2];
+ 		u8 rsvd[64];
+ 	} __packed req = {
++		.ver = 1,
+ 		.idx = idx,
+ 		.env = env_cap,
+ 	};
+ 	int ret, valid_cnt = 0;
+-	u8 i, *pos;
++	u16 buf_len = 0;
++	u8 *pos;
+ 
+ 	if (!clc)
+ 		return 0;
+ 
++	buf_len = le16_to_cpu(clc->len) - sizeof(*clc);
+ 	pos = clc->data;
+-	for (i = 0; i < clc->nr_country; i++) {
++	while (buf_len > 16) {
+ 		struct mt7921_clc_rule *rule = (struct mt7921_clc_rule *)pos;
+ 		u16 len = le16_to_cpu(rule->len);
++		u16 offset = len + sizeof(*rule);
+ 
+-		pos += len + sizeof(*rule);
++		pos += offset;
++		buf_len -= offset;
+ 		if (rule->alpha2[0] != alpha2[0] ||
+ 		    rule->alpha2[1] != alpha2[1])
+ 			continue;
+-- 
+2.43.0
+
diff --git a/queue-6.1/wifi-mt76-mt7921s-fix-workqueue-problem-causes-sta-a.patch b/queue-6.1/wifi-mt76-mt7921s-fix-workqueue-problem-causes-sta-a.patch
new file mode 100644
index 00000000000..4ddebec0ba5
--- /dev/null
+++ b/queue-6.1/wifi-mt76-mt7921s-fix-workqueue-problem-causes-sta-a.patch
@@ -0,0 +1,180 @@
+From 2b22cb867e8b9b9ff32cd1721dde3213d2ac46c0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Nov 2023 20:54:49 +0800
+Subject: wifi: mt76: mt7921s: fix workqueue problem causes STA association
+ fail
+
+From: Wang Zhao <wang.zhao@mediatek.com>
+
+[ Upstream commit 92184eae1d5ad804884e2c6e289d885b9e3194d1 ]
+
+The ieee80211_queue_work function queues work into the mac80211
+local->workqueue, which is widely used for mac80211 internal
+work processes. In the mt76 driver, both the mt76-sido-status and
+mt76-sdio-net threads enqueue workers to the workqueue with this
+function. However, in some cases, when two workers are enqueued
+to the workqueue almost simultaneously, the second worker may not
+be scheduled immediately and may get stuck for a while.
+This can cause timing issues. To avoid these timing
+conflicts caused by worker scheduling, replace the worker
+with an independent thread.
+
+Fixes: 48fab5bbef40 ("mt76: mt7921: introduce mt7921s support")
+Signed-off-by: Wang Zhao <wang.zhao@mediatek.com>
+Signed-off-by: Deren Wu <deren.wu@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt76.h      |  3 +--
+ .../net/wireless/mediatek/mt76/mt7615/sdio.c   |  2 +-
+ .../net/wireless/mediatek/mt76/mt7921/sdio.c   |  4 +++-
+ .../wireless/mediatek/mt76/mt7921/sdio_mac.c   |  3 ++-
+ drivers/net/wireless/mediatek/mt76/sdio.c      | 18 +++++++++++-------
+ 5 files changed, 18 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt76.h b/drivers/net/wireless/mediatek/mt76/mt76.h
+index 9c753c6aabef..60c9f9c56a4f 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt76.h
++++ b/drivers/net/wireless/mediatek/mt76/mt76.h
+@@ -564,8 +564,7 @@ struct mt76_sdio {
+ 	struct mt76_worker txrx_worker;
+ 	struct mt76_worker status_worker;
+ 	struct mt76_worker net_worker;
+-
+-	struct work_struct stat_work;
++	struct mt76_worker stat_worker;
+ 
+ 	u8 *xmit_buf;
+ 	u32 xmit_buf_sz;
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/sdio.c b/drivers/net/wireless/mediatek/mt76/mt7615/sdio.c
+index 304212f5f8da..d742b22428f0 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7615/sdio.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7615/sdio.c
+@@ -205,8 +205,8 @@ static int mt7663s_suspend(struct device *dev)
+ 	mt76_worker_disable(&mdev->mt76.sdio.txrx_worker);
+ 	mt76_worker_disable(&mdev->mt76.sdio.status_worker);
+ 	mt76_worker_disable(&mdev->mt76.sdio.net_worker);
++	mt76_worker_disable(&mdev->mt76.sdio.stat_worker);
+ 
+-	cancel_work_sync(&mdev->mt76.sdio.stat_work);
+ 	clear_bit(MT76_READING_STATS, &mdev->mphy.state);
+ 
+ 	mt76_tx_status_check(&mdev->mt76, true);
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/sdio.c b/drivers/net/wireless/mediatek/mt76/mt7921/sdio.c
+index 3b25a06fd946..8898ba69b8e9 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7921/sdio.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7921/sdio.c
+@@ -222,7 +222,7 @@ static int mt7921s_suspend(struct device *__dev)
+ 	mt76_txq_schedule_all(&dev->mphy);
+ 	mt76_worker_disable(&mdev->tx_worker);
+ 	mt76_worker_disable(&mdev->sdio.status_worker);
+-	cancel_work_sync(&mdev->sdio.stat_work);
++	mt76_worker_disable(&mdev->sdio.stat_worker);
+ 	clear_bit(MT76_READING_STATS, &dev->mphy.state);
+ 	mt76_tx_status_check(mdev, true);
+ 
+@@ -254,6 +254,7 @@ static int mt7921s_suspend(struct device *__dev)
+ restore_worker:
+ 	mt76_worker_enable(&mdev->tx_worker);
+ 	mt76_worker_enable(&mdev->sdio.status_worker);
++	mt76_worker_enable(&mdev->sdio.stat_worker);
+ 
+ 	if (!pm->ds_enable)
+ 		mt76_connac_mcu_set_deep_sleep(mdev, false);
+@@ -286,6 +287,7 @@ static int mt7921s_resume(struct device *__dev)
+ 	mt76_worker_enable(&mdev->sdio.txrx_worker);
+ 	mt76_worker_enable(&mdev->sdio.status_worker);
+ 	mt76_worker_enable(&mdev->sdio.net_worker);
++	mt76_worker_enable(&mdev->sdio.stat_worker);
+ 
+ 	/* restore previous ds setting */
+ 	if (!pm->ds_enable)
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/sdio_mac.c b/drivers/net/wireless/mediatek/mt76/mt7921/sdio_mac.c
+index 1b3adb3d91e8..fd07b6623392 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7921/sdio_mac.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7921/sdio_mac.c
+@@ -107,7 +107,7 @@ int mt7921s_mac_reset(struct mt7921_dev *dev)
+ 	mt76_worker_disable(&dev->mt76.sdio.txrx_worker);
+ 	mt76_worker_disable(&dev->mt76.sdio.status_worker);
+ 	mt76_worker_disable(&dev->mt76.sdio.net_worker);
+-	cancel_work_sync(&dev->mt76.sdio.stat_work);
++	mt76_worker_disable(&dev->mt76.sdio.stat_worker);
+ 
+ 	mt7921s_disable_irq(&dev->mt76);
+ 	mt7921s_wfsys_reset(dev);
+@@ -115,6 +115,7 @@ int mt7921s_mac_reset(struct mt7921_dev *dev)
+ 	mt76_worker_enable(&dev->mt76.sdio.txrx_worker);
+ 	mt76_worker_enable(&dev->mt76.sdio.status_worker);
+ 	mt76_worker_enable(&dev->mt76.sdio.net_worker);
++	mt76_worker_enable(&dev->mt76.sdio.stat_worker);
+ 
+ 	dev->fw_assert = false;
+ 	clear_bit(MT76_MCU_RESET, &dev->mphy.state);
+diff --git a/drivers/net/wireless/mediatek/mt76/sdio.c b/drivers/net/wireless/mediatek/mt76/sdio.c
+index 176207f3177c..fc4fb9463564 100644
+--- a/drivers/net/wireless/mediatek/mt76/sdio.c
++++ b/drivers/net/wireless/mediatek/mt76/sdio.c
+@@ -481,21 +481,21 @@ static void mt76s_status_worker(struct mt76_worker *w)
+ 		if (dev->drv->tx_status_data && ndata_frames > 0 &&
+ 		    !test_and_set_bit(MT76_READING_STATS, &dev->phy.state) &&
+ 		    !test_bit(MT76_STATE_SUSPEND, &dev->phy.state))
+-			ieee80211_queue_work(dev->hw, &dev->sdio.stat_work);
++			mt76_worker_schedule(&sdio->stat_worker);
+ 	} while (nframes > 0);
+ 
+ 	if (resched)
+ 		mt76_worker_schedule(&dev->tx_worker);
+ }
+ 
+-static void mt76s_tx_status_data(struct work_struct *work)
++static void mt76s_tx_status_data(struct mt76_worker *worker)
+ {
+ 	struct mt76_sdio *sdio;
+ 	struct mt76_dev *dev;
+ 	u8 update = 1;
+ 	u16 count = 0;
+ 
+-	sdio = container_of(work, struct mt76_sdio, stat_work);
++	sdio = container_of(worker, struct mt76_sdio, stat_worker);
+ 	dev = container_of(sdio, struct mt76_dev, sdio);
+ 
+ 	while (true) {
+@@ -508,7 +508,7 @@ static void mt76s_tx_status_data(struct work_struct *work)
+ 	}
+ 
+ 	if (count && test_bit(MT76_STATE_RUNNING, &dev->phy.state))
+-		ieee80211_queue_work(dev->hw, &sdio->stat_work);
++		mt76_worker_schedule(&sdio->status_worker);
+ 	else
+ 		clear_bit(MT76_READING_STATS, &dev->phy.state);
+ }
+@@ -600,8 +600,8 @@ void mt76s_deinit(struct mt76_dev *dev)
+ 	mt76_worker_teardown(&sdio->txrx_worker);
+ 	mt76_worker_teardown(&sdio->status_worker);
+ 	mt76_worker_teardown(&sdio->net_worker);
++	mt76_worker_teardown(&sdio->stat_worker);
+ 
+-	cancel_work_sync(&sdio->stat_work);
+ 	clear_bit(MT76_READING_STATS, &dev->phy.state);
+ 
+ 	mt76_tx_status_check(dev, true);
+@@ -644,10 +644,14 @@ int mt76s_init(struct mt76_dev *dev, struct sdio_func *func,
+ 	if (err)
+ 		return err;
+ 
++	err = mt76_worker_setup(dev->hw, &sdio->stat_worker, mt76s_tx_status_data,
++				"sdio-sta");
++	if (err)
++		return err;
++
+ 	sched_set_fifo_low(sdio->status_worker.task);
+ 	sched_set_fifo_low(sdio->net_worker.task);
+-
+-	INIT_WORK(&sdio->stat_work, mt76s_tx_status_data);
++	sched_set_fifo_low(sdio->stat_worker.task);
+ 
+ 	dev->queue_ops = &sdio_queue_ops;
+ 	dev->bus = bus_ops;
+-- 
+2.43.0
+
diff --git a/queue-6.1/wifi-plfxlc-check-for-allocation-failure-in-plfxlc_u.patch b/queue-6.1/wifi-plfxlc-check-for-allocation-failure-in-plfxlc_u.patch
new file mode 100644
index 00000000000..b80f5ca4c1e
--- /dev/null
+++ b/queue-6.1/wifi-plfxlc-check-for-allocation-failure-in-plfxlc_u.patch
@@ -0,0 +1,41 @@
+From c6fa782f4d9bc4bae35ff2a6de64943251ce11cb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Oct 2023 12:03:23 +0300
+Subject: wifi: plfxlc: check for allocation failure in plfxlc_usb_wreq_async()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit 40018a8fa9aa63ca5b26e803502138158fb0ff96 ]
+
+Check for if the usb_alloc_urb() failed.
+
+Fixes: 68d57a07bfe5 ("wireless: add plfxlc driver for pureLiFi X, XL, XC devices")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/e8d4a19a-f251-4101-a89b-607345e938cb@moroto.mountain
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/purelifi/plfxlc/usb.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/purelifi/plfxlc/usb.c b/drivers/net/wireless/purelifi/plfxlc/usb.c
+index 76d0a778636a..311676c1ece0 100644
+--- a/drivers/net/wireless/purelifi/plfxlc/usb.c
++++ b/drivers/net/wireless/purelifi/plfxlc/usb.c
+@@ -493,9 +493,12 @@ int plfxlc_usb_wreq_async(struct plfxlc_usb *usb, const u8 *buffer,
+ 			  void *context)
+ {
+ 	struct usb_device *udev = interface_to_usbdev(usb->ez_usb);
+-	struct urb *urb = usb_alloc_urb(0, GFP_ATOMIC);
++	struct urb *urb;
+ 	int r;
+ 
++	urb = usb_alloc_urb(0, GFP_ATOMIC);
++	if (!urb)
++		return -ENOMEM;
+ 	usb_fill_bulk_urb(urb, udev, usb_sndbulkpipe(udev, EP_DATA_OUT),
+ 			  (void *)buffer, buffer_len, complete_fn, context);
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/wifi-rtlwifi-add-calculate_bit_shift.patch b/queue-6.1/wifi-rtlwifi-add-calculate_bit_shift.patch
new file mode 100644
index 00000000000..2a2e5382fe7
--- /dev/null
+++ b/queue-6.1/wifi-rtlwifi-add-calculate_bit_shift.patch
@@ -0,0 +1,43 @@
+From 56532d5ae905ea2b8f801fbae6bc7beeb68ed282 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Dec 2023 14:57:29 +0800
+Subject: wifi: rtlwifi: add calculate_bit_shift()
+
+From: Su Hui <suhui@nfschina.com>
+
+[ Upstream commit 52221dfddbbfb5b4e029bb2efe9bb7da33ec1e46 ]
+
+There are many same functions like _rtl88e_phy_calculate_bit_shift(),
+_rtl92c_phy_calculate_bit_shift() and so on. And these functions can
+cause undefined bitwise shift behavior. Add calculate_bit_shift() to
+replace them and fix undefined behavior in subsequent patches.
+
+Signed-off-by: Su Hui <suhui@nfschina.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://msgid.link/20231219065739.1895666-2-suhui@nfschina.com
+Stable-dep-of: 969bc926f04b ("wifi: rtlwifi: rtl8188ee: phy: using calculate_bit_shift()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtlwifi/wifi.h | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/wifi.h b/drivers/net/wireless/realtek/rtlwifi/wifi.h
+index 31f9e9e5c680..0bac788ccd6e 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/wifi.h
++++ b/drivers/net/wireless/realtek/rtlwifi/wifi.h
+@@ -3105,4 +3105,11 @@ static inline struct ieee80211_sta *rtl_find_sta(struct ieee80211_hw *hw,
+ 	return ieee80211_find_sta(mac->vif, mac_addr);
+ }
+ 
++static inline u32 calculate_bit_shift(u32 bitmask)
++{
++	if (WARN_ON_ONCE(!bitmask))
++		return 0;
++
++	return __ffs(bitmask);
++}
+ #endif
+-- 
+2.43.0
+
diff --git a/queue-6.1/wifi-rtlwifi-rtl8188ee-phy-using-calculate_bit_shift.patch b/queue-6.1/wifi-rtlwifi-rtl8188ee-phy-using-calculate_bit_shift.patch
new file mode 100644
index 00000000000..71eb84580f5
--- /dev/null
+++ b/queue-6.1/wifi-rtlwifi-rtl8188ee-phy-using-calculate_bit_shift.patch
@@ -0,0 +1,77 @@
+From c758c2f83140756282d301dab5d985215172d9f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Dec 2023 14:57:31 +0800
+Subject: wifi: rtlwifi: rtl8188ee: phy: using calculate_bit_shift()
+
+From: Su Hui <suhui@nfschina.com>
+
+[ Upstream commit 969bc926f04b438676768aeffffffb050e480b62 ]
+
+Using calculate_bit_shift() to replace _rtl88e_phy_calculate_bit_shift().
+And fix the undefined bitwise shift behavior problem.
+
+Fixes: f0eb856e0b6c ("rtlwifi: rtl8188ee: Add new driver")
+Signed-off-by: Su Hui <suhui@nfschina.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://msgid.link/20231219065739.1895666-4-suhui@nfschina.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/realtek/rtlwifi/rtl8188ee/phy.c   | 14 ++++----------
+ 1 file changed, 4 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/phy.c
+index 12d0b3a87af7..0fab3a0c7d49 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/phy.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/phy.c
+@@ -16,12 +16,6 @@ static u32 _rtl88e_phy_rf_serial_read(struct ieee80211_hw *hw,
+ static void _rtl88e_phy_rf_serial_write(struct ieee80211_hw *hw,
+ 					enum radio_path rfpath, u32 offset,
+ 					u32 data);
+-static u32 _rtl88e_phy_calculate_bit_shift(u32 bitmask)
+-{
+-	u32 i = ffs(bitmask);
+-
+-	return i ? i - 1 : 32;
+-}
+ static bool _rtl88e_phy_bb8188e_config_parafile(struct ieee80211_hw *hw);
+ static bool _rtl88e_phy_config_mac_with_headerfile(struct ieee80211_hw *hw);
+ static bool phy_config_bb_with_headerfile(struct ieee80211_hw *hw,
+@@ -51,7 +45,7 @@ u32 rtl88e_phy_query_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask)
+ 	rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE,
+ 		"regaddr(%#x), bitmask(%#x)\n", regaddr, bitmask);
+ 	originalvalue = rtl_read_dword(rtlpriv, regaddr);
+-	bitshift = _rtl88e_phy_calculate_bit_shift(bitmask);
++	bitshift = calculate_bit_shift(bitmask);
+ 	returnvalue = (originalvalue & bitmask) >> bitshift;
+ 
+ 	rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE,
+@@ -74,7 +68,7 @@ void rtl88e_phy_set_bb_reg(struct ieee80211_hw *hw,
+ 
+ 	if (bitmask != MASKDWORD) {
+ 		originalvalue = rtl_read_dword(rtlpriv, regaddr);
+-		bitshift = _rtl88e_phy_calculate_bit_shift(bitmask);
++		bitshift = calculate_bit_shift(bitmask);
+ 		data = ((originalvalue & (~bitmask)) | (data << bitshift));
+ 	}
+ 
+@@ -99,7 +93,7 @@ u32 rtl88e_phy_query_rf_reg(struct ieee80211_hw *hw,
+ 
+ 
+ 	original_value = _rtl88e_phy_rf_serial_read(hw, rfpath, regaddr);
+-	bitshift = _rtl88e_phy_calculate_bit_shift(bitmask);
++	bitshift = calculate_bit_shift(bitmask);
+ 	readback_value = (original_value & bitmask) >> bitshift;
+ 
+ 	spin_unlock(&rtlpriv->locks.rf_lock);
+@@ -127,7 +121,7 @@ void rtl88e_phy_set_rf_reg(struct ieee80211_hw *hw,
+ 			original_value = _rtl88e_phy_rf_serial_read(hw,
+ 								    rfpath,
+ 								    regaddr);
+-			bitshift = _rtl88e_phy_calculate_bit_shift(bitmask);
++			bitshift = calculate_bit_shift(bitmask);
+ 			data =
+ 			    ((original_value & (~bitmask)) |
+ 			     (data << bitshift));
+-- 
+2.43.0
+
diff --git a/queue-6.1/wifi-rtlwifi-rtl8192c-using-calculate_bit_shift.patch b/queue-6.1/wifi-rtlwifi-rtl8192c-using-calculate_bit_shift.patch
new file mode 100644
index 00000000000..4992bb7e136
--- /dev/null
+++ b/queue-6.1/wifi-rtlwifi-rtl8192c-using-calculate_bit_shift.patch
@@ -0,0 +1,74 @@
+From 4008a7779d17561bf9b7dd4b391033330d9c86f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Dec 2023 14:57:32 +0800
+Subject: wifi: rtlwifi: rtl8192c: using calculate_bit_shift()
+
+From: Su Hui <suhui@nfschina.com>
+
+[ Upstream commit 1dedc3a6699d827d345019e921b8d8f37f694333 ]
+
+Using calculate_bit_shift() to replace _rtl92c_phy_calculate_bit_shift().
+And fix the undefined bitwise shift behavior problem.
+
+Fixes: 4295cd254af3 ("rtlwifi: Move common parts of rtl8192ce/phy.c")
+Signed-off-by: Su Hui <suhui@nfschina.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://msgid.link/20231219065739.1895666-5-suhui@nfschina.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../wireless/realtek/rtlwifi/rtl8192c/phy_common.c   | 12 ++----------
+ .../wireless/realtek/rtlwifi/rtl8192c/phy_common.h   |  1 -
+ 2 files changed, 2 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192c/phy_common.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192c/phy_common.c
+index 3d29c8dbb255..144ee780e1b6 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192c/phy_common.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192c/phy_common.c
+@@ -17,7 +17,7 @@ u32 rtl92c_phy_query_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask)
+ 	rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE, "regaddr(%#x), bitmask(%#x)\n",
+ 		regaddr, bitmask);
+ 	originalvalue = rtl_read_dword(rtlpriv, regaddr);
+-	bitshift = _rtl92c_phy_calculate_bit_shift(bitmask);
++	bitshift = calculate_bit_shift(bitmask);
+ 	returnvalue = (originalvalue & bitmask) >> bitshift;
+ 
+ 	rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE,
+@@ -40,7 +40,7 @@ void rtl92c_phy_set_bb_reg(struct ieee80211_hw *hw,
+ 
+ 	if (bitmask != MASKDWORD) {
+ 		originalvalue = rtl_read_dword(rtlpriv, regaddr);
+-		bitshift = _rtl92c_phy_calculate_bit_shift(bitmask);
++		bitshift = calculate_bit_shift(bitmask);
+ 		data = ((originalvalue & (~bitmask)) | (data << bitshift));
+ 	}
+ 
+@@ -143,14 +143,6 @@ void _rtl92c_phy_rf_serial_write(struct ieee80211_hw *hw,
+ }
+ EXPORT_SYMBOL(_rtl92c_phy_rf_serial_write);
+ 
+-u32 _rtl92c_phy_calculate_bit_shift(u32 bitmask)
+-{
+-	u32 i = ffs(bitmask);
+-
+-	return i ? i - 1 : 32;
+-}
+-EXPORT_SYMBOL(_rtl92c_phy_calculate_bit_shift);
+-
+ static void _rtl92c_phy_bb_config_1t(struct ieee80211_hw *hw)
+ {
+ 	rtl_set_bbreg(hw, RFPGA0_TXINFO, 0x3, 0x2);
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192c/phy_common.h b/drivers/net/wireless/realtek/rtlwifi/rtl8192c/phy_common.h
+index 75afa6253ad0..e64d377dfe9e 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192c/phy_common.h
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192c/phy_common.h
+@@ -196,7 +196,6 @@ bool rtl92c_phy_set_rf_power_state(struct ieee80211_hw *hw,
+ void rtl92ce_phy_set_rf_on(struct ieee80211_hw *hw);
+ void rtl92c_phy_set_io(struct ieee80211_hw *hw);
+ void rtl92c_bb_block_on(struct ieee80211_hw *hw);
+-u32 _rtl92c_phy_calculate_bit_shift(u32 bitmask);
+ long _rtl92c_phy_txpwr_idx_to_dbm(struct ieee80211_hw *hw,
+ 				  enum wireless_mode wirelessmode,
+ 				  u8 txpwridx);
+-- 
+2.43.0
+
diff --git a/queue-6.1/wifi-rtlwifi-rtl8192ce-using-calculate_bit_shift.patch b/queue-6.1/wifi-rtlwifi-rtl8192ce-using-calculate_bit_shift.patch
new file mode 100644
index 00000000000..3ea00fd367c
--- /dev/null
+++ b/queue-6.1/wifi-rtlwifi-rtl8192ce-using-calculate_bit_shift.patch
@@ -0,0 +1,68 @@
+From 7cea474a72d2db5b33283a0660a7c16bcd736364 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Dec 2023 14:57:34 +0800
+Subject: wifi: rtlwifi: rtl8192ce: using calculate_bit_shift()
+
+From: Su Hui <suhui@nfschina.com>
+
+[ Upstream commit 3d03e8231031bcc65a48cd88ef9c71b6524ce70b ]
+
+Using calculate_bit_shift() to replace _rtl92c_phy_calculate_bit_shift().
+And fix the undefined bitwise shift behavior problem.
+
+Fixes: 0c8173385e54 ("rtl8192ce: Add new driver")
+Signed-off-by: Su Hui <suhui@nfschina.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://msgid.link/20231219065739.1895666-7-suhui@nfschina.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.c | 6 +++---
+ drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.h | 1 -
+ 2 files changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.c
+index da54e51badd3..fa70a7d5539f 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.c
+@@ -39,7 +39,7 @@ u32 rtl92c_phy_query_rf_reg(struct ieee80211_hw *hw,
+ 							       rfpath, regaddr);
+ 	}
+ 
+-	bitshift = _rtl92c_phy_calculate_bit_shift(bitmask);
++	bitshift = calculate_bit_shift(bitmask);
+ 	readback_value = (original_value & bitmask) >> bitshift;
+ 
+ 	spin_unlock(&rtlpriv->locks.rf_lock);
+@@ -110,7 +110,7 @@ void rtl92ce_phy_set_rf_reg(struct ieee80211_hw *hw,
+ 			original_value = _rtl92c_phy_rf_serial_read(hw,
+ 								    rfpath,
+ 								    regaddr);
+-			bitshift = _rtl92c_phy_calculate_bit_shift(bitmask);
++			bitshift = calculate_bit_shift(bitmask);
+ 			data =
+ 			    ((original_value & (~bitmask)) |
+ 			     (data << bitshift));
+@@ -122,7 +122,7 @@ void rtl92ce_phy_set_rf_reg(struct ieee80211_hw *hw,
+ 			original_value = _rtl92c_phy_fw_rf_serial_read(hw,
+ 								       rfpath,
+ 								       regaddr);
+-			bitshift = _rtl92c_phy_calculate_bit_shift(bitmask);
++			bitshift = calculate_bit_shift(bitmask);
+ 			data =
+ 			    ((original_value & (~bitmask)) |
+ 			     (data << bitshift));
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.h b/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.h
+index 7582a162bd11..c7a0d4c776f0 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.h
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.h
+@@ -94,7 +94,6 @@ u32 _rtl92c_phy_rf_serial_read(struct ieee80211_hw *hw, enum radio_path rfpath,
+ 			       u32 offset);
+ u32 _rtl92c_phy_fw_rf_serial_read(struct ieee80211_hw *hw,
+ 				  enum radio_path rfpath, u32 offset);
+-u32 _rtl92c_phy_calculate_bit_shift(u32 bitmask);
+ void _rtl92c_phy_rf_serial_write(struct ieee80211_hw *hw,
+ 				 enum radio_path rfpath, u32 offset, u32 data);
+ void _rtl92c_phy_fw_rf_serial_write(struct ieee80211_hw *hw,
+-- 
+2.43.0
+
diff --git a/queue-6.1/wifi-rtlwifi-rtl8192cu-using-calculate_bit_shift.patch b/queue-6.1/wifi-rtlwifi-rtl8192cu-using-calculate_bit_shift.patch
new file mode 100644
index 00000000000..70a16713756
--- /dev/null
+++ b/queue-6.1/wifi-rtlwifi-rtl8192cu-using-calculate_bit_shift.patch
@@ -0,0 +1,55 @@
+From 5c1b4ad0bc69c49c2f7fec1f36705a750d6d5695 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Dec 2023 14:57:33 +0800
+Subject: wifi: rtlwifi: rtl8192cu: using calculate_bit_shift()
+
+From: Su Hui <suhui@nfschina.com>
+
+[ Upstream commit f4088c8fcbabadad9dd17d17ae9ba24e9e3221ec ]
+
+Using calculate_bit_shift() to replace _rtl92c_phy_calculate_bit_shift().
+And fix an undefined bitwise shift behavior problem.
+
+Fixes: f0a39ae738d6 ("rtlwifi: rtl8192cu: Add routine phy")
+Signed-off-by: Su Hui <suhui@nfschina.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://msgid.link/20231219065739.1895666-6-suhui@nfschina.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtlwifi/rtl8192cu/phy.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/phy.c
+index a8d9fe269f31..0b8cb7e61fd8 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/phy.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/phy.c
+@@ -32,7 +32,7 @@ u32 rtl92cu_phy_query_rf_reg(struct ieee80211_hw *hw,
+ 		original_value = _rtl92c_phy_fw_rf_serial_read(hw,
+ 							       rfpath, regaddr);
+ 	}
+-	bitshift = _rtl92c_phy_calculate_bit_shift(bitmask);
++	bitshift = calculate_bit_shift(bitmask);
+ 	readback_value = (original_value & bitmask) >> bitshift;
+ 	rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE,
+ 		"regaddr(%#x), rfpath(%#x), bitmask(%#x), original_value(%#x)\n",
+@@ -56,7 +56,7 @@ void rtl92cu_phy_set_rf_reg(struct ieee80211_hw *hw,
+ 			original_value = _rtl92c_phy_rf_serial_read(hw,
+ 								    rfpath,
+ 								    regaddr);
+-			bitshift = _rtl92c_phy_calculate_bit_shift(bitmask);
++			bitshift = calculate_bit_shift(bitmask);
+ 			data =
+ 			    ((original_value & (~bitmask)) |
+ 			     (data << bitshift));
+@@ -67,7 +67,7 @@ void rtl92cu_phy_set_rf_reg(struct ieee80211_hw *hw,
+ 			original_value = _rtl92c_phy_fw_rf_serial_read(hw,
+ 								       rfpath,
+ 								       regaddr);
+-			bitshift = _rtl92c_phy_calculate_bit_shift(bitmask);
++			bitshift = calculate_bit_shift(bitmask);
+ 			data =
+ 			    ((original_value & (~bitmask)) |
+ 			     (data << bitshift));
+-- 
+2.43.0
+
diff --git a/queue-6.1/wifi-rtlwifi-rtl8192de-using-calculate_bit_shift.patch b/queue-6.1/wifi-rtlwifi-rtl8192de-using-calculate_bit_shift.patch
new file mode 100644
index 00000000000..2427d1b2dfa
--- /dev/null
+++ b/queue-6.1/wifi-rtlwifi-rtl8192de-using-calculate_bit_shift.patch
@@ -0,0 +1,78 @@
+From cf78e06327f0eae93059500f12520fd5ca9acc71 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Dec 2023 14:57:35 +0800
+Subject: wifi: rtlwifi: rtl8192de: using calculate_bit_shift()
+
+From: Su Hui <suhui@nfschina.com>
+
+[ Upstream commit b8b2baad2e652042cf8b6339939ac2f4e6f53de4 ]
+
+Using calculate_bit_shift() to replace _rtl92d_phy_calculate_bit_shift().
+And fix the undefined bitwise shift behavior problem.
+
+Fixes: 7274a8c22980 ("rtlwifi: rtl8192de: Merge phy routines")
+Signed-off-by: Su Hui <suhui@nfschina.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://msgid.link/20231219065739.1895666-8-suhui@nfschina.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/realtek/rtlwifi/rtl8192de/phy.c  | 15 ++++-----------
+ 1 file changed, 4 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c
+index d18c092b6142..d835a27429f0 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c
+@@ -169,13 +169,6 @@ static const u8 channel_all[59] = {
+ 	157, 159, 161, 163, 165
+ };
+ 
+-static u32 _rtl92d_phy_calculate_bit_shift(u32 bitmask)
+-{
+-	u32 i = ffs(bitmask);
+-
+-	return i ? i - 1 : 32;
+-}
+-
+ u32 rtl92d_phy_query_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask)
+ {
+ 	struct rtl_priv *rtlpriv = rtl_priv(hw);
+@@ -198,7 +191,7 @@ u32 rtl92d_phy_query_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask)
+ 	} else {
+ 		originalvalue = rtl_read_dword(rtlpriv, regaddr);
+ 	}
+-	bitshift = _rtl92d_phy_calculate_bit_shift(bitmask);
++	bitshift = calculate_bit_shift(bitmask);
+ 	returnvalue = (originalvalue & bitmask) >> bitshift;
+ 	rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE,
+ 		"BBR MASK=0x%x Addr[0x%x]=0x%x\n",
+@@ -230,7 +223,7 @@ void rtl92d_phy_set_bb_reg(struct ieee80211_hw *hw,
+ 					dbi_direct);
+ 		else
+ 			originalvalue = rtl_read_dword(rtlpriv, regaddr);
+-		bitshift = _rtl92d_phy_calculate_bit_shift(bitmask);
++		bitshift = calculate_bit_shift(bitmask);
+ 		data = ((originalvalue & (~bitmask)) | (data << bitshift));
+ 	}
+ 	if (rtlhal->during_mac1init_radioa || rtlhal->during_mac0init_radiob)
+@@ -317,7 +310,7 @@ u32 rtl92d_phy_query_rf_reg(struct ieee80211_hw *hw,
+ 		regaddr, rfpath, bitmask);
+ 	spin_lock(&rtlpriv->locks.rf_lock);
+ 	original_value = _rtl92d_phy_rf_serial_read(hw, rfpath, regaddr);
+-	bitshift = _rtl92d_phy_calculate_bit_shift(bitmask);
++	bitshift = calculate_bit_shift(bitmask);
+ 	readback_value = (original_value & bitmask) >> bitshift;
+ 	spin_unlock(&rtlpriv->locks.rf_lock);
+ 	rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE,
+@@ -343,7 +336,7 @@ void rtl92d_phy_set_rf_reg(struct ieee80211_hw *hw, enum radio_path rfpath,
+ 		if (bitmask != RFREG_OFFSET_MASK) {
+ 			original_value = _rtl92d_phy_rf_serial_read(hw,
+ 				rfpath, regaddr);
+-			bitshift = _rtl92d_phy_calculate_bit_shift(bitmask);
++			bitshift = calculate_bit_shift(bitmask);
+ 			data = ((original_value & (~bitmask)) |
+ 				(data << bitshift));
+ 		}
+-- 
+2.43.0
+
diff --git a/queue-6.1/wifi-rtlwifi-rtl8192ee-using-calculate_bit_shift.patch b/queue-6.1/wifi-rtlwifi-rtl8192ee-using-calculate_bit_shift.patch
new file mode 100644
index 00000000000..166e5f3297a
--- /dev/null
+++ b/queue-6.1/wifi-rtlwifi-rtl8192ee-using-calculate_bit_shift.patch
@@ -0,0 +1,86 @@
+From f7157625f5b6fbe134ed10aa50eb1d820ee43f7a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Dec 2023 14:57:36 +0800
+Subject: wifi: rtlwifi: rtl8192ee: using calculate_bit_shift()
+
+From: Su Hui <suhui@nfschina.com>
+
+[ Upstream commit 63526897fc0d086069bcab67c3a112caaec751cb ]
+
+Using calculate_bit_shift() to replace _rtl92ee_phy_calculate_bit_shift().
+And fix the undefined bitwise shift behavior problem.
+
+Fixes: b1a3bfc97cd9 ("rtlwifi: rtl8192ee: Move driver from staging to the regular tree")
+Signed-off-by: Su Hui <suhui@nfschina.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://msgid.link/20231219065739.1895666-9-suhui@nfschina.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/realtek/rtlwifi/rtl8192ee/phy.c | 16 ++++------------
+ 1 file changed, 4 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/phy.c
+index cc0bcaf13e96..73ef602bfb01 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/phy.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/phy.c
+@@ -16,7 +16,6 @@ static u32 _rtl92ee_phy_rf_serial_read(struct ieee80211_hw *hw,
+ static void _rtl92ee_phy_rf_serial_write(struct ieee80211_hw *hw,
+ 					 enum radio_path rfpath, u32 offset,
+ 					 u32 data);
+-static u32 _rtl92ee_phy_calculate_bit_shift(u32 bitmask);
+ static bool _rtl92ee_phy_bb8192ee_config_parafile(struct ieee80211_hw *hw);
+ static bool _rtl92ee_phy_config_mac_with_headerfile(struct ieee80211_hw *hw);
+ static bool phy_config_bb_with_hdr_file(struct ieee80211_hw *hw,
+@@ -46,7 +45,7 @@ u32 rtl92ee_phy_query_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask)
+ 	rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE,
+ 		"regaddr(%#x), bitmask(%#x)\n", regaddr, bitmask);
+ 	originalvalue = rtl_read_dword(rtlpriv, regaddr);
+-	bitshift = _rtl92ee_phy_calculate_bit_shift(bitmask);
++	bitshift = calculate_bit_shift(bitmask);
+ 	returnvalue = (originalvalue & bitmask) >> bitshift;
+ 
+ 	rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE,
+@@ -68,7 +67,7 @@ void rtl92ee_phy_set_bb_reg(struct ieee80211_hw *hw, u32 regaddr,
+ 
+ 	if (bitmask != MASKDWORD) {
+ 		originalvalue = rtl_read_dword(rtlpriv, regaddr);
+-		bitshift = _rtl92ee_phy_calculate_bit_shift(bitmask);
++		bitshift = calculate_bit_shift(bitmask);
+ 		data = ((originalvalue & (~bitmask)) | (data << bitshift));
+ 	}
+ 
+@@ -92,7 +91,7 @@ u32 rtl92ee_phy_query_rf_reg(struct ieee80211_hw *hw,
+ 	spin_lock(&rtlpriv->locks.rf_lock);
+ 
+ 	original_value = _rtl92ee_phy_rf_serial_read(hw , rfpath, regaddr);
+-	bitshift = _rtl92ee_phy_calculate_bit_shift(bitmask);
++	bitshift = calculate_bit_shift(bitmask);
+ 	readback_value = (original_value & bitmask) >> bitshift;
+ 
+ 	spin_unlock(&rtlpriv->locks.rf_lock);
+@@ -119,7 +118,7 @@ void rtl92ee_phy_set_rf_reg(struct ieee80211_hw *hw,
+ 
+ 	if (bitmask != RFREG_OFFSET_MASK) {
+ 		original_value = _rtl92ee_phy_rf_serial_read(hw, rfpath, addr);
+-		bitshift = _rtl92ee_phy_calculate_bit_shift(bitmask);
++		bitshift = calculate_bit_shift(bitmask);
+ 		data = (original_value & (~bitmask)) | (data << bitshift);
+ 	}
+ 
+@@ -201,13 +200,6 @@ static void _rtl92ee_phy_rf_serial_write(struct ieee80211_hw *hw,
+ 		pphyreg->rf3wire_offset, data_and_addr);
+ }
+ 
+-static u32 _rtl92ee_phy_calculate_bit_shift(u32 bitmask)
+-{
+-	u32 i = ffs(bitmask);
+-
+-	return i ? i - 1 : 32;
+-}
+-
+ bool rtl92ee_phy_mac_config(struct ieee80211_hw *hw)
+ {
+ 	return _rtl92ee_phy_config_mac_with_headerfile(hw);
+-- 
+2.43.0
+
diff --git a/queue-6.1/wifi-rtlwifi-rtl8192se-using-calculate_bit_shift.patch b/queue-6.1/wifi-rtlwifi-rtl8192se-using-calculate_bit_shift.patch
new file mode 100644
index 00000000000..4d49ef7112b
--- /dev/null
+++ b/queue-6.1/wifi-rtlwifi-rtl8192se-using-calculate_bit_shift.patch
@@ -0,0 +1,78 @@
+From 681af837b9e7e734c40627fde56f2cd00bd1aee7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Dec 2023 14:57:37 +0800
+Subject: wifi: rtlwifi: rtl8192se: using calculate_bit_shift()
+
+From: Su Hui <suhui@nfschina.com>
+
+[ Upstream commit ac32b9317063b101a8ff3d3e885f76f87a280419 ]
+
+Using calculate_bit_shift() to replace _rtl92s_phy_calculate_bit_shift().
+And fix the undefined bitwise shift behavior problem.
+
+Fixes: d15853163bea ("rtlwifi: rtl8192se: Merge phy routines")
+Signed-off-by: Su Hui <suhui@nfschina.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://msgid.link/20231219065739.1895666-10-suhui@nfschina.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/realtek/rtlwifi/rtl8192se/phy.c  | 15 ++++-----------
+ 1 file changed, 4 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192se/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192se/phy.c
+index aaa004d4d6d0..0e2b9698088b 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192se/phy.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192se/phy.c
+@@ -14,13 +14,6 @@
+ #include "hw.h"
+ #include "table.h"
+ 
+-static u32 _rtl92s_phy_calculate_bit_shift(u32 bitmask)
+-{
+-	u32 i = ffs(bitmask);
+-
+-	return i ? i - 1 : 32;
+-}
+-
+ u32 rtl92s_phy_query_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask)
+ {
+ 	struct rtl_priv *rtlpriv = rtl_priv(hw);
+@@ -30,7 +23,7 @@ u32 rtl92s_phy_query_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask)
+ 		regaddr, bitmask);
+ 
+ 	originalvalue = rtl_read_dword(rtlpriv, regaddr);
+-	bitshift = _rtl92s_phy_calculate_bit_shift(bitmask);
++	bitshift = calculate_bit_shift(bitmask);
+ 	returnvalue = (originalvalue & bitmask) >> bitshift;
+ 
+ 	rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE, "BBR MASK=0x%x Addr[0x%x]=0x%x\n",
+@@ -52,7 +45,7 @@ void rtl92s_phy_set_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask,
+ 
+ 	if (bitmask != MASKDWORD) {
+ 		originalvalue = rtl_read_dword(rtlpriv, regaddr);
+-		bitshift = _rtl92s_phy_calculate_bit_shift(bitmask);
++		bitshift = calculate_bit_shift(bitmask);
+ 		data = ((originalvalue & (~bitmask)) | (data << bitshift));
+ 	}
+ 
+@@ -160,7 +153,7 @@ u32 rtl92s_phy_query_rf_reg(struct ieee80211_hw *hw, enum radio_path rfpath,
+ 
+ 	original_value = _rtl92s_phy_rf_serial_read(hw, rfpath, regaddr);
+ 
+-	bitshift = _rtl92s_phy_calculate_bit_shift(bitmask);
++	bitshift = calculate_bit_shift(bitmask);
+ 	readback_value = (original_value & bitmask) >> bitshift;
+ 
+ 	spin_unlock(&rtlpriv->locks.rf_lock);
+@@ -191,7 +184,7 @@ void rtl92s_phy_set_rf_reg(struct ieee80211_hw *hw, enum radio_path rfpath,
+ 	if (bitmask != RFREG_OFFSET_MASK) {
+ 		original_value = _rtl92s_phy_rf_serial_read(hw, rfpath,
+ 							    regaddr);
+-		bitshift = _rtl92s_phy_calculate_bit_shift(bitmask);
++		bitshift = calculate_bit_shift(bitmask);
+ 		data = ((original_value & (~bitmask)) | (data << bitshift));
+ 	}
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/wifi-rtlwifi-rtl8821ae-phy-fix-an-undefined-bitwise-.patch b/queue-6.1/wifi-rtlwifi-rtl8821ae-phy-fix-an-undefined-bitwise-.patch
new file mode 100644
index 00000000000..48427193afb
--- /dev/null
+++ b/queue-6.1/wifi-rtlwifi-rtl8821ae-phy-fix-an-undefined-bitwise-.patch
@@ -0,0 +1,59 @@
+From bae99a120292a9289b581bb254842b1f49ff812d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Nov 2023 09:35:13 +0800
+Subject: wifi: rtlwifi: rtl8821ae: phy: fix an undefined bitwise shift
+ behavior
+
+From: Su Hui <suhui@nfschina.com>
+
+[ Upstream commit bc8263083af60e7e57c6120edbc1f75d6c909a35 ]
+
+Clang static checker warns:
+
+drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c:184:49:
+	The result of the left shift is undefined due to shifting by '32',
+	which is greater or equal to the width of type 'u32'.
+	[core.UndefinedBinaryOperatorResult]
+
+If the value of the right operand is negative or is greater than or
+equal to the width of the promoted left operand, the behavior is
+undefined.[1][2]
+
+For example, when using different gcc's compilation optimization options
+(-O0 or -O2), the result of '(u32)data << 32' is different. One is 0, the
+other is old value of data. Let _rtl8821ae_phy_calculate_bit_shift()'s
+return value less than 32 to fix this problem. Warn if bitmask is zero.
+
+[1] https://stackoverflow.com/questions/11270492/what-does-the-c-standard-say-about-bitshifting-more-bits-than-the-width-of-type
+[2] https://www.open-std.org/jtc1/sc22/wg14/www/docs/n1256.pdf
+
+Fixes: 21e4b0726dc6 ("rtlwifi: rtl8821ae: Move driver from staging to regular tree")
+Signed-off-by: Su Hui <suhui@nfschina.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20231127013511.26694-2-suhui@nfschina.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c
+index 5323ead30db0..fa1839d8ee55 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c
+@@ -29,9 +29,10 @@ static void _rtl8821ae_phy_rf_serial_write(struct ieee80211_hw *hw,
+ 					   u32 data);
+ static u32 _rtl8821ae_phy_calculate_bit_shift(u32 bitmask)
+ {
+-	u32 i = ffs(bitmask);
++	if (WARN_ON_ONCE(!bitmask))
++		return 0;
+ 
+-	return i ? i - 1 : 32;
++	return __ffs(bitmask);
+ }
+ static bool _rtl8821ae_phy_bb8821a_config_parafile(struct ieee80211_hw *hw);
+ /*static bool _rtl8812ae_phy_config_mac_with_headerfile(struct ieee80211_hw *hw);*/
+-- 
+2.43.0
+
diff --git a/queue-6.1/wifi-rtw88-fix-rx-filter-in-fif_allmulti-flag.patch b/queue-6.1/wifi-rtw88-fix-rx-filter-in-fif_allmulti-flag.patch
new file mode 100644
index 00000000000..c8b337d2bdb
--- /dev/null
+++ b/queue-6.1/wifi-rtw88-fix-rx-filter-in-fif_allmulti-flag.patch
@@ -0,0 +1,42 @@
+From 30b8b1c97b44643436adad00b523bd6fc68db40a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Nov 2023 10:08:51 +0800
+Subject: wifi: rtw88: fix RX filter in FIF_ALLMULTI flag
+
+From: Chih-Kang Chang <gary.chang@realtek.com>
+
+[ Upstream commit 53ee0b3b99edc6a47096bffef15695f5a895386f ]
+
+The broadcast packets will be filtered in the FIF_ALLMULTI flag in
+the original code, which causes beacon packets to be filtered out
+and disconnection. Therefore, we fix it.
+
+Fixes: e3037485c68e ("rtw88: new Realtek 802.11ac driver")
+Signed-off-by: Chih-Kang Chang <gary.chang@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20231103020851.102238-1-pkshih@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw88/mac80211.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw88/mac80211.c b/drivers/net/wireless/realtek/rtw88/mac80211.c
+index fabca307867a..0970d6bcba43 100644
+--- a/drivers/net/wireless/realtek/rtw88/mac80211.c
++++ b/drivers/net/wireless/realtek/rtw88/mac80211.c
+@@ -266,9 +266,9 @@ static void rtw_ops_configure_filter(struct ieee80211_hw *hw,
+ 
+ 	if (changed_flags & FIF_ALLMULTI) {
+ 		if (*new_flags & FIF_ALLMULTI)
+-			rtwdev->hal.rcr |= BIT_AM | BIT_AB;
++			rtwdev->hal.rcr |= BIT_AM;
+ 		else
+-			rtwdev->hal.rcr &= ~(BIT_AM | BIT_AB);
++			rtwdev->hal.rcr &= ~(BIT_AM);
+ 	}
+ 	if (changed_flags & FIF_FCSFAIL) {
+ 		if (*new_flags & FIF_FCSFAIL)
+-- 
+2.43.0
+
diff --git a/queue-6.1/x86-lib-fix-overflow-when-counting-digits.patch b/queue-6.1/x86-lib-fix-overflow-when-counting-digits.patch
new file mode 100644
index 00000000000..3721ffb36c4
--- /dev/null
+++ b/queue-6.1/x86-lib-fix-overflow-when-counting-digits.patch
@@ -0,0 +1,66 @@
+From adf39980df3f40395c8bd64854ecc46095da2612 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Nov 2023 17:49:01 +0000
+Subject: x86/lib: Fix overflow when counting digits
+
+From: Colin Ian King <colin.i.king@gmail.com>
+
+[ Upstream commit a24d61c609813963aacc9f6ec8343f4fcaac7243 ]
+
+tl;dr: The num_digits() function has a theoretical overflow issue.
+But it doesn't affect any actual in-tree users.  Fix it by using
+a larger type for one of the local variables.
+
+Long version:
+
+There is an overflow in variable m in function num_digits when val
+is >= 1410065408 which leads to the digit calculation loop to
+iterate more times than required. This results in either more
+digits being counted or in some cases (for example where val is
+1932683193) the value of m eventually overflows to zero and the
+while loop spins forever).
+
+Currently the function num_digits is currently only being used for
+small values of val in the SMP boot stage for digit counting on the
+number of cpus and NUMA nodes, so the overflow is never encountered.
+However it is useful to fix the overflow issue in case the function
+is used for other purposes in the future. (The issue was discovered
+while investigating the digit counting performance in various
+kernel helper functions rather than any real-world use-case).
+
+The simplest fix is to make m a long long, the overhead in
+multiplication speed for a long long is very minor for small values
+of val less than 10000 on modern processors. The alternative
+fix is to replace the multiplication with a constant division
+by 10 loop (this compiles down to an multiplication and shift)
+without needing to make m a long long, but this is slightly slower
+than the fix in this commit when measured on a range of x86
+processors).
+
+[ dhansen: subject and changelog tweaks ]
+
+Fixes: 646e29a1789a ("x86: Improve the printout of the SMP bootup CPU table")
+Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
+Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
+Link: https://lore.kernel.org/all/20231102174901.2590325-1-colin.i.king%40gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/lib/misc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/lib/misc.c b/arch/x86/lib/misc.c
+index a018ec4fba53..c97be9a1430a 100644
+--- a/arch/x86/lib/misc.c
++++ b/arch/x86/lib/misc.c
+@@ -6,7 +6,7 @@
+  */
+ int num_digits(int val)
+ {
+-	int m = 10;
++	long long m = 10;
+ 	int d = 1;
+ 
+ 	if (val < 0) {
+-- 
+2.43.0
+
diff --git a/queue-6.1/x86-mce-inject-clear-test-status-value.patch b/queue-6.1/x86-mce-inject-clear-test-status-value.patch
new file mode 100644
index 00000000000..11d15c86995
--- /dev/null
+++ b/queue-6.1/x86-mce-inject-clear-test-status-value.patch
@@ -0,0 +1,57 @@
+From c669f11bcad386a81ceb69fc5e1ad6cada0cc51b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 18 Nov 2023 13:32:29 -0600
+Subject: x86/mce/inject: Clear test status value
+
+From: Yazen Ghannam <yazen.ghannam@amd.com>
+
+[ Upstream commit 6175b407756b22e7fdc771181b7d832ebdedef5c ]
+
+AMD systems generally allow MCA "simulation" where MCA registers can be
+written with valid data and the full MCA handling flow can be tested by
+software.
+
+However, the platform on Scalable MCA systems, can prevent software from
+writing data to the MCA registers. There is no architectural way to
+determine this configuration. Therefore, the MCE injection module will
+check for this behavior by writing and reading back a test status value.
+This is done during module init, and the check can run on any CPU with
+any valid MCA bank.
+
+If MCA_STATUS writes are ignored by the platform, then there are no side
+effects on the hardware state.
+
+If the writes are not ignored, then the test status value will remain in
+the hardware MCA_STATUS register. It is likely that the value will not
+be overwritten by hardware or software, since the tested CPU and bank
+are arbitrary. Therefore, the user may see a spurious, synthetic MCA
+error reported whenever MCA is polled for this CPU.
+
+Clear the test value immediately after writing it. It is very unlikely
+that a valid MCA error is logged by hardware during the test. Errors
+that cause an #MC won't be affected.
+
+Fixes: 891e465a1bd8 ("x86/mce: Check whether writes to MCA_STATUS are getting ignored")
+Signed-off-by: Yazen Ghannam <yazen.ghannam@amd.com>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Link: https://lore.kernel.org/r/20231118193248.1296798-2-yazen.ghannam@amd.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/cpu/mce/inject.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/x86/kernel/cpu/mce/inject.c b/arch/x86/kernel/cpu/mce/inject.c
+index 12cf2e7ca33c..87c15ab89651 100644
+--- a/arch/x86/kernel/cpu/mce/inject.c
++++ b/arch/x86/kernel/cpu/mce/inject.c
+@@ -747,6 +747,7 @@ static void check_hw_inj_possible(void)
+ 
+ 		wrmsrl_safe(mca_msr_reg(bank, MCA_STATUS), status);
+ 		rdmsrl_safe(mca_msr_reg(bank, MCA_STATUS), &status);
++		wrmsrl_safe(mca_msr_reg(bank, MCA_STATUS), 0);
+ 
+ 		if (!status) {
+ 			hw_injection_possible = false;
+-- 
+2.43.0
+
-- 
2.47.3