--- /dev/null
+From 1c1d54a893ef858457dfd61d6d8271a978c2f1a7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Jun 2023 02:13:32 +0200
+Subject: Add MODULE_FIRMWARE() for FIRMWARE_TG357766.
+
+From: Tobias Heider <me@tobhe.de>
+
+[ Upstream commit 046f753da6143ee16452966915087ec8b0de3c70 ]
+
+Fixes a bug where on the M1 mac mini initramfs-tools fails to
+include the necessary firmware into the initrd.
+
+Fixes: c4dab50697ff ("tg3: Download 57766 EEE service patch firmware")
+Signed-off-by: Tobias Heider <me@tobhe.de>
+Reviewed-by: Michael Chan <michael.chan@broadcom.com>
+Link: https://lore.kernel.org/r/ZJt7LKzjdz8+dClx@tobhe.de
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/tg3.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
+index af9ea5e4371b3..9609041016776 100644
+--- a/drivers/net/ethernet/broadcom/tg3.c
++++ b/drivers/net/ethernet/broadcom/tg3.c
+@@ -224,6 +224,7 @@ MODULE_AUTHOR("David S. Miller (davem@redhat.com) and Jeff Garzik (jgarzik@pobox
+ MODULE_DESCRIPTION("Broadcom Tigon3 ethernet driver");
+ MODULE_LICENSE("GPL");
+ MODULE_FIRMWARE(FIRMWARE_TG3);
++MODULE_FIRMWARE(FIRMWARE_TG357766);
+ MODULE_FIRMWARE(FIRMWARE_TG3TSO);
+ MODULE_FIRMWARE(FIRMWARE_TG3TSO5);
+
+--
+2.39.2
+
--- /dev/null
+From be71acb51401334077fe8b975fd5f358fc08ea51 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Jul 2023 20:22:15 +0100
+Subject: afs: Fix accidental truncation when storing data
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit 03275585cabd0240944f19f33d7584a1b099a3a8 ]
+
+When an AFS FS.StoreData RPC call is made, amongst other things it is
+given the resultant file size to be. On the server, this is processed
+by truncating the file to new size and then writing the data.
+
+Now, kafs has a lock (vnode->io_lock) that serves to serialise
+operations against a specific vnode (ie. inode), but the parameters for
+the op are set before the lock is taken. This allows two writebacks
+(say sync and kswapd) to race - and if writes are ongoing the writeback
+for a later write could occur before the writeback for an earlier one if
+the latter gets interrupted.
+
+Note that afs_writepages() cannot take i_mutex and only takes a shared
+lock on vnode->validate_lock.
+
+Also note that the server does the truncation and the write inside a
+lock, so there's no problem at that end.
+
+Fix this by moving the calculation for the proposed new i_size inside
+the vnode->io_lock. Also reset the iterator (which we might have read
+from) and update the mtime setting there.
+
+Fixes: bd80d8a80e12 ("afs: Use ITER_XARRAY for writing")
+Reported-by: Marc Dionne <marc.dionne@auristor.com>
+Signed-off-by: David Howells <dhowells@redhat.com>
+Reviewed-by: Jeffrey Altman <jaltman@auristor.com>
+Reviewed-by: Marc Dionne <marc.dionne@auristor.com>
+cc: linux-afs@lists.infradead.org
+cc: linux-fsdevel@vger.kernel.org
+Link: https://lore.kernel.org/r/3526895.1687960024@warthog.procyon.org.uk/
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/afs/write.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/fs/afs/write.c b/fs/afs/write.c
+index 08fd456dde67c..3ecc212b62099 100644
+--- a/fs/afs/write.c
++++ b/fs/afs/write.c
+@@ -381,17 +381,19 @@ static int afs_store_data(struct afs_vnode *vnode, struct iov_iter *iter, loff_t
+ afs_op_set_vnode(op, 0, vnode);
+ op->file[0].dv_delta = 1;
+ op->file[0].modification = true;
+- op->store.write_iter = iter;
+ op->store.pos = pos;
+ op->store.size = size;
+- op->store.i_size = max(pos + size, vnode->netfs.remote_i_size);
+ op->store.laundering = laundering;
+- op->mtime = vnode->netfs.inode.i_mtime;
+ op->flags |= AFS_OPERATION_UNINTR;
+ op->ops = &afs_store_data_operation;
+
+ try_next_key:
+ afs_begin_vnode_operation(op);
++
++ op->store.write_iter = iter;
++ op->store.i_size = max(pos + size, vnode->netfs.remote_i_size);
++ op->mtime = vnode->netfs.inode.i_mtime;
++
+ afs_wait_for_operation(op);
+
+ switch (op->error) {
+--
+2.39.2
+
--- /dev/null
+From b06d7de1b7d6463536ca4a4a152f958d6b2c3be3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Apr 2023 19:05:49 +0000
+Subject: apparmor: fix missing error check for rhashtable_insert_fast
+
+From: Danila Chernetsov <listdansp@mail.ru>
+
+[ Upstream commit 000518bc5aef25d3f703592a0296d578c98b1517 ]
+
+ rhashtable_insert_fast() could return err value when memory allocation is
+ failed. but unpack_profile() do not check values and this always returns
+ success value. This patch just adds error check code.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: e025be0f26d5 ("apparmor: support querying extended trusted helper extra data")
+
+Signed-off-by: Danila Chernetsov <listdansp@mail.ru>
+Signed-off-by: John Johansen <john.johansen@canonical.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/apparmor/policy_unpack.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c
+index 9d26bbb901338..9c3fec2c7cf6b 100644
+--- a/security/apparmor/policy_unpack.c
++++ b/security/apparmor/policy_unpack.c
+@@ -917,8 +917,13 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name)
+ goto fail;
+ }
+
+- rhashtable_insert_fast(profile->data, &data->head,
+- profile->data->p);
++ if (rhashtable_insert_fast(profile->data, &data->head,
++ profile->data->p)) {
++ kfree_sensitive(data->key);
++ kfree_sensitive(data);
++ info = "failed to insert data to table";
++ goto fail;
++ }
+ }
+
+ if (!unpack_nameX(e, AA_STRUCTEND, NULL)) {
+--
+2.39.2
+
--- /dev/null
+From 527c91479bffb990d54c25cab35fdc3629d3f774 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Feb 2023 10:18:04 +0800
+Subject: blk-cgroup: don't update io stat for root cgroup
+
+From: Ming Lei <ming.lei@redhat.com>
+
+[ Upstream commit 0416f3be58c6b1ea066cd52e354b857693feb01e ]
+
+We source root cgroup stats from the system-wide stats, see blkcg_print_stat
+and blkcg_rstat_flush, so don't update io state for root cgroup.
+
+Fixes blkg leak issue introduced in commit 3b8cc6298724 ("blk-cgroup: Optimize blkcg_rstat_flush()")
+which starts to grab blkg's reference when adding iostat_cpu into percpu
+blkcg list, but this state won't be consumed by blkcg_rstat_flush() where
+the blkg reference is dropped.
+
+Tested-by: Bart van Assche <bvanassche@acm.org>
+Reported-by: Bart van Assche <bvanassche@acm.org>
+Fixes: 3b8cc6298724 ("blk-cgroup: Optimize blkcg_rstat_flush()")
+Cc: Tejun Heo <tj@kernel.org>
+Cc: Waiman Long <longman@redhat.com>
+Signed-off-by: Ming Lei <ming.lei@redhat.com>
+Link: https://lore.kernel.org/r/20230202021804.278582-1-ming.lei@redhat.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Stable-dep-of: ad7c3b41e86b ("blk-throttle: Fix io statistics for cgroup v1")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-cgroup.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
+index 2c7be256ff879..5ee0ae8ddbf6f 100644
+--- a/block/blk-cgroup.c
++++ b/block/blk-cgroup.c
+@@ -2008,6 +2008,10 @@ void blk_cgroup_bio_start(struct bio *bio)
+ struct blkg_iostat_set *bis;
+ unsigned long flags;
+
++ /* Root-level stats are sourced from system-wide IO stats */
++ if (!cgroup_parent(blkcg->css.cgroup))
++ return;
++
+ cpu = get_cpu();
+ bis = per_cpu_ptr(bio->bi_blkg->iostat_cpu, cpu);
+ flags = u64_stats_update_begin_irqsave(&bis->sync);
+--
+2.39.2
+
--- /dev/null
+From a7c7dbac32b9fc615ba132dbac34a467192964dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Nov 2022 20:59:01 -0400
+Subject: blk-cgroup: Optimize blkcg_rstat_flush()
+
+From: Waiman Long <longman@redhat.com>
+
+[ Upstream commit 3b8cc6298724021da845f2f9fd7dd4b6829a6817 ]
+
+For a system with many CPUs and block devices, the time to do
+blkcg_rstat_flush() from cgroup_rstat_flush() can be rather long. It
+can be especially problematic as interrupt is disabled during the flush.
+It was reported that it might take seconds to complete in some extreme
+cases leading to hard lockup messages.
+
+As it is likely that not all the percpu blkg_iostat_set's has been
+updated since the last flush, those stale blkg_iostat_set's don't need
+to be flushed in this case. This patch optimizes blkcg_rstat_flush()
+by keeping a lockless list of recently updated blkg_iostat_set's in a
+newly added percpu blkcg->lhead pointer.
+
+The blkg_iostat_set is added to a lockless list on the update side
+in blk_cgroup_bio_start(). It is removed from the lockless list when
+flushed in blkcg_rstat_flush(). Due to racing, it is possible that
+blk_iostat_set's in the lockless list may have no new IO stats to be
+flushed, but that is OK.
+
+To protect against destruction of blkg, a percpu reference is gotten
+when putting into the lockless list and put back when removed.
+
+When booting up an instrumented test kernel with this patch on a
+2-socket 96-thread system with cgroup v2, out of the 2051 calls to
+cgroup_rstat_flush() after bootup, 1788 of the calls were exited
+immediately because of empty lockless list. After an all-cpu kernel
+build, the ratio became 6295424/6340513. That was more than 99%.
+
+Signed-off-by: Waiman Long <longman@redhat.com>
+Acked-by: Tejun Heo <tj@kernel.org>
+Link: https://lore.kernel.org/r/20221105005902.407297-3-longman@redhat.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Stable-dep-of: ad7c3b41e86b ("blk-throttle: Fix io statistics for cgroup v1")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-cgroup.c | 76 ++++++++++++++++++++++++++++++++++++++++++----
+ block/blk-cgroup.h | 10 ++++++
+ 2 files changed, 80 insertions(+), 6 deletions(-)
+
+diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
+index 60f366f98fa2b..2c7be256ff879 100644
+--- a/block/blk-cgroup.c
++++ b/block/blk-cgroup.c
+@@ -60,6 +60,37 @@ static struct workqueue_struct *blkcg_punt_bio_wq;
+
+ #define BLKG_DESTROY_BATCH_SIZE 64
+
++/*
++ * Lockless lists for tracking IO stats update
++ *
++ * New IO stats are stored in the percpu iostat_cpu within blkcg_gq (blkg).
++ * There are multiple blkg's (one for each block device) attached to each
++ * blkcg. The rstat code keeps track of which cpu has IO stats updated,
++ * but it doesn't know which blkg has the updated stats. If there are many
++ * block devices in a system, the cost of iterating all the blkg's to flush
++ * out the IO stats can be high. To reduce such overhead, a set of percpu
++ * lockless lists (lhead) per blkcg are used to track the set of recently
++ * updated iostat_cpu's since the last flush. An iostat_cpu will be put
++ * onto the lockless list on the update side [blk_cgroup_bio_start()] if
++ * not there yet and then removed when being flushed [blkcg_rstat_flush()].
++ * References to blkg are gotten and then put back in the process to
++ * protect against blkg removal.
++ *
++ * Return: 0 if successful or -ENOMEM if allocation fails.
++ */
++static int init_blkcg_llists(struct blkcg *blkcg)
++{
++ int cpu;
++
++ blkcg->lhead = alloc_percpu_gfp(struct llist_head, GFP_KERNEL);
++ if (!blkcg->lhead)
++ return -ENOMEM;
++
++ for_each_possible_cpu(cpu)
++ init_llist_head(per_cpu_ptr(blkcg->lhead, cpu));
++ return 0;
++}
++
+ /**
+ * blkcg_css - find the current css
+ *
+@@ -237,8 +268,10 @@ static struct blkcg_gq *blkg_alloc(struct blkcg *blkcg, struct gendisk *disk,
+ blkg->blkcg = blkcg;
+
+ u64_stats_init(&blkg->iostat.sync);
+- for_each_possible_cpu(cpu)
++ for_each_possible_cpu(cpu) {
+ u64_stats_init(&per_cpu_ptr(blkg->iostat_cpu, cpu)->sync);
++ per_cpu_ptr(blkg->iostat_cpu, cpu)->blkg = blkg;
++ }
+
+ for (i = 0; i < BLKCG_MAX_POLS; i++) {
+ struct blkcg_policy *pol = blkcg_policy[i];
+@@ -831,7 +864,9 @@ static void blkcg_iostat_update(struct blkcg_gq *blkg, struct blkg_iostat *cur,
+ static void blkcg_rstat_flush(struct cgroup_subsys_state *css, int cpu)
+ {
+ struct blkcg *blkcg = css_to_blkcg(css);
+- struct blkcg_gq *blkg;
++ struct llist_head *lhead = per_cpu_ptr(blkcg->lhead, cpu);
++ struct llist_node *lnode;
++ struct blkg_iostat_set *bisc, *next_bisc;
+
+ /* Root-level stats are sourced from system-wide IO stats */
+ if (!cgroup_parent(css->cgroup))
+@@ -839,12 +874,21 @@ static void blkcg_rstat_flush(struct cgroup_subsys_state *css, int cpu)
+
+ rcu_read_lock();
+
+- hlist_for_each_entry_rcu(blkg, &blkcg->blkg_list, blkcg_node) {
++ lnode = llist_del_all(lhead);
++ if (!lnode)
++ goto out;
++
++ /*
++ * Iterate only the iostat_cpu's queued in the lockless list.
++ */
++ llist_for_each_entry_safe(bisc, next_bisc, lnode, lnode) {
++ struct blkcg_gq *blkg = bisc->blkg;
+ struct blkcg_gq *parent = blkg->parent;
+- struct blkg_iostat_set *bisc = per_cpu_ptr(blkg->iostat_cpu, cpu);
+ struct blkg_iostat cur;
+ unsigned int seq;
+
++ WRITE_ONCE(bisc->lqueued, false);
++
+ /* fetch the current per-cpu values */
+ do {
+ seq = u64_stats_fetch_begin(&bisc->sync);
+@@ -857,8 +901,10 @@ static void blkcg_rstat_flush(struct cgroup_subsys_state *css, int cpu)
+ if (parent && parent->parent)
+ blkcg_iostat_update(parent, &blkg->iostat.cur,
+ &blkg->iostat.last);
++ percpu_ref_put(&blkg->refcnt);
+ }
+
++out:
+ rcu_read_unlock();
+ }
+
+@@ -1136,6 +1182,7 @@ static void blkcg_css_free(struct cgroup_subsys_state *css)
+
+ mutex_unlock(&blkcg_pol_mutex);
+
++ free_percpu(blkcg->lhead);
+ kfree(blkcg);
+ }
+
+@@ -1158,6 +1205,9 @@ blkcg_css_alloc(struct cgroup_subsys_state *parent_css)
+ }
+ }
+
++ if (init_blkcg_llists(blkcg))
++ goto free_blkcg;
++
+ for (i = 0; i < BLKCG_MAX_POLS ; i++) {
+ struct blkcg_policy *pol = blkcg_policy[i];
+ struct blkcg_policy_data *cpd;
+@@ -1199,7 +1249,8 @@ blkcg_css_alloc(struct cgroup_subsys_state *parent_css)
+ for (i--; i >= 0; i--)
+ if (blkcg->cpd[i])
+ blkcg_policy[i]->cpd_free_fn(blkcg->cpd[i]);
+-
++ free_percpu(blkcg->lhead);
++free_blkcg:
+ if (blkcg != &blkcg_root)
+ kfree(blkcg);
+ unlock:
+@@ -1952,6 +2003,7 @@ static int blk_cgroup_io_type(struct bio *bio)
+
+ void blk_cgroup_bio_start(struct bio *bio)
+ {
++ struct blkcg *blkcg = bio->bi_blkg->blkcg;
+ int rwd = blk_cgroup_io_type(bio), cpu;
+ struct blkg_iostat_set *bis;
+ unsigned long flags;
+@@ -1970,9 +2022,21 @@ void blk_cgroup_bio_start(struct bio *bio)
+ }
+ bis->cur.ios[rwd]++;
+
++ /*
++ * If the iostat_cpu isn't in a lockless list, put it into the
++ * list to indicate that a stat update is pending.
++ */
++ if (!READ_ONCE(bis->lqueued)) {
++ struct llist_head *lhead = this_cpu_ptr(blkcg->lhead);
++
++ llist_add(&bis->lnode, lhead);
++ WRITE_ONCE(bis->lqueued, true);
++ percpu_ref_get(&bis->blkg->refcnt);
++ }
++
+ u64_stats_update_end_irqrestore(&bis->sync, flags);
+ if (cgroup_subsys_on_dfl(io_cgrp_subsys))
+- cgroup_rstat_updated(bio->bi_blkg->blkcg->css.cgroup, cpu);
++ cgroup_rstat_updated(blkcg->css.cgroup, cpu);
+ put_cpu();
+ }
+
+diff --git a/block/blk-cgroup.h b/block/blk-cgroup.h
+index aa2b286bc825f..1e94e404eaa80 100644
+--- a/block/blk-cgroup.h
++++ b/block/blk-cgroup.h
+@@ -18,6 +18,7 @@
+ #include <linux/cgroup.h>
+ #include <linux/kthread.h>
+ #include <linux/blk-mq.h>
++#include <linux/llist.h>
+
+ struct blkcg_gq;
+ struct blkg_policy_data;
+@@ -43,6 +44,9 @@ struct blkg_iostat {
+
+ struct blkg_iostat_set {
+ struct u64_stats_sync sync;
++ struct blkcg_gq *blkg;
++ struct llist_node lnode;
++ int lqueued; /* queued in llist */
+ struct blkg_iostat cur;
+ struct blkg_iostat last;
+ };
+@@ -97,6 +101,12 @@ struct blkcg {
+ struct blkcg_policy_data *cpd[BLKCG_MAX_POLS];
+
+ struct list_head all_blkcgs_node;
++
++ /*
++ * List of updated percpu blkg_iostat_set's since the last flush.
++ */
++ struct llist_head __percpu *lhead;
++
+ #ifdef CONFIG_BLK_CGROUP_FC_APPID
+ char fc_app_id[FC_APPID_LEN];
+ #endif
+--
+2.39.2
+
--- /dev/null
+From a664cdf1cba90269e240aeb587e2c528a51090cd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 May 2023 01:06:31 +0800
+Subject: blk-throttle: Fix io statistics for cgroup v1
+
+From: Jinke Han <hanjinke.666@bytedance.com>
+
+[ Upstream commit ad7c3b41e86b59943a903d23c7b037d820e6270c ]
+
+After commit f382fb0bcef4 ("block: remove legacy IO schedulers"),
+blkio.throttle.io_serviced and blkio.throttle.io_service_bytes become
+the only stable io stats interface of cgroup v1, and these statistics
+are done in the blk-throttle code. But the current code only counts the
+bios that are actually throttled. When the user does not add the throttle
+limit, the io stats for cgroup v1 has nothing. I fix it according to the
+statistical method of v2, and made it count all ios accurately.
+
+Fixes: a7b36ee6ba29 ("block: move blk-throtl fast path inline")
+Tested-by: Andrea Righi <andrea.righi@canonical.com>
+Signed-off-by: Jinke Han <hanjinke.666@bytedance.com>
+Acked-by: Muchun Song <songmuchun@bytedance.com>
+Acked-by: Tejun Heo <tj@kernel.org>
+Link: https://lore.kernel.org/r/20230507170631.89607-1-hanjinke.666@bytedance.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-cgroup.c | 6 ++++--
+ block/blk-throttle.c | 6 ------
+ block/blk-throttle.h | 9 +++++++++
+ 3 files changed, 13 insertions(+), 8 deletions(-)
+
+diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
+index 5ee0ae8ddbf6f..e812e48d5bb8a 100644
+--- a/block/blk-cgroup.c
++++ b/block/blk-cgroup.c
+@@ -2008,6 +2008,9 @@ void blk_cgroup_bio_start(struct bio *bio)
+ struct blkg_iostat_set *bis;
+ unsigned long flags;
+
++ if (!cgroup_subsys_on_dfl(io_cgrp_subsys))
++ return;
++
+ /* Root-level stats are sourced from system-wide IO stats */
+ if (!cgroup_parent(blkcg->css.cgroup))
+ return;
+@@ -2039,8 +2042,7 @@ void blk_cgroup_bio_start(struct bio *bio)
+ }
+
+ u64_stats_update_end_irqrestore(&bis->sync, flags);
+- if (cgroup_subsys_on_dfl(io_cgrp_subsys))
+- cgroup_rstat_updated(blkcg->css.cgroup, cpu);
++ cgroup_rstat_updated(blkcg->css.cgroup, cpu);
+ put_cpu();
+ }
+
+diff --git a/block/blk-throttle.c b/block/blk-throttle.c
+index f1bc600c4ded6..d88147d1358fc 100644
+--- a/block/blk-throttle.c
++++ b/block/blk-throttle.c
+@@ -2167,12 +2167,6 @@ bool __blk_throtl_bio(struct bio *bio)
+
+ rcu_read_lock();
+
+- if (!cgroup_subsys_on_dfl(io_cgrp_subsys)) {
+- blkg_rwstat_add(&tg->stat_bytes, bio->bi_opf,
+- bio->bi_iter.bi_size);
+- blkg_rwstat_add(&tg->stat_ios, bio->bi_opf, 1);
+- }
+-
+ spin_lock_irq(&q->queue_lock);
+
+ throtl_update_latency_buckets(td);
+diff --git a/block/blk-throttle.h b/block/blk-throttle.h
+index ef4b7a4de987d..d1ccbfe9f7978 100644
+--- a/block/blk-throttle.h
++++ b/block/blk-throttle.h
+@@ -185,6 +185,15 @@ static inline bool blk_should_throtl(struct bio *bio)
+ struct throtl_grp *tg = blkg_to_tg(bio->bi_blkg);
+ int rw = bio_data_dir(bio);
+
++ if (!cgroup_subsys_on_dfl(io_cgrp_subsys)) {
++ if (!bio_flagged(bio, BIO_CGROUP_ACCT)) {
++ bio_set_flag(bio, BIO_CGROUP_ACCT);
++ blkg_rwstat_add(&tg->stat_bytes, bio->bi_opf,
++ bio->bi_iter.bi_size);
++ }
++ blkg_rwstat_add(&tg->stat_ios, bio->bi_opf, 1);
++ }
++
+ /* iops limit is always counted */
+ if (tg->has_rules_iops[rw])
+ return true;
+--
+2.39.2
+
--- /dev/null
+From 96d7b761c0c6087cd05f68ca1a58db608849169f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 May 2023 11:04:23 +0200
+Subject: Bluetooth: fix invalid-bdaddr quirk for non-persistent setup
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+[ Upstream commit 0cb7365850bacb8c2a9975cae672d65714d8daa1 ]
+
+Devices that lack persistent storage for the device address can indicate
+this by setting the HCI_QUIRK_INVALID_BDADDR which causes the controller
+to be marked as unconfigured until user space has set a valid address.
+
+Once configured, the device address must be set on every setup for
+controllers with HCI_QUIRK_NON_PERSISTENT_SETUP to avoid marking the
+controller as unconfigured and requiring the address to be set again.
+
+Fixes: 740011cfe948 ("Bluetooth: Add new quirk for non-persistent setup settings")
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/hci_sync.c | 28 +++++++++++-----------------
+ 1 file changed, 11 insertions(+), 17 deletions(-)
+
+diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
+index 1805ddee0cd02..37131a36700a1 100644
+--- a/net/bluetooth/hci_sync.c
++++ b/net/bluetooth/hci_sync.c
+@@ -4567,23 +4567,17 @@ static int hci_dev_setup_sync(struct hci_dev *hdev)
+ invalid_bdaddr = test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks);
+
+ if (!ret) {
+- if (test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) {
+- if (!bacmp(&hdev->public_addr, BDADDR_ANY))
+- hci_dev_get_bd_addr_from_property(hdev);
+-
+- if (bacmp(&hdev->public_addr, BDADDR_ANY) &&
+- hdev->set_bdaddr) {
+- ret = hdev->set_bdaddr(hdev,
+- &hdev->public_addr);
+-
+- /* If setting of the BD_ADDR from the device
+- * property succeeds, then treat the address
+- * as valid even if the invalid BD_ADDR
+- * quirk indicates otherwise.
+- */
+- if (!ret)
+- invalid_bdaddr = false;
+- }
++ if (test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks) &&
++ !bacmp(&hdev->public_addr, BDADDR_ANY))
++ hci_dev_get_bd_addr_from_property(hdev);
++
++ if ((invalid_bdaddr ||
++ test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
++ bacmp(&hdev->public_addr, BDADDR_ANY) &&
++ hdev->set_bdaddr) {
++ ret = hdev->set_bdaddr(hdev, &hdev->public_addr);
++ if (!ret)
++ invalid_bdaddr = false;
+ }
+ }
+
+--
+2.39.2
+
--- /dev/null
+From b5ef8fa54bf7cc8962c4f9a9d0b340eb77f1e7fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 May 2023 11:04:24 +0200
+Subject: Bluetooth: fix use-bdaddr-property quirk
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+[ Upstream commit 6945795bc81ab7be22750ecfb365056688f2fada ]
+
+Devices that lack persistent storage for the device address can indicate
+this by setting the HCI_QUIRK_INVALID_BDADDR which causes the controller
+to be marked as unconfigured until user space has set a valid address.
+
+The related HCI_QUIRK_USE_BDADDR_PROPERTY was later added to similarly
+indicate that the device lacks a valid address but that one may be
+specified in the devicetree.
+
+As is clear from commit 7a0e5b15ca45 ("Bluetooth: Add quirk for reading
+BD_ADDR from fwnode property") that added and documented this quirk and
+commits like de79a9df1692 ("Bluetooth: btqcomsmd: use
+HCI_QUIRK_USE_BDADDR_PROPERTY"), the device address of controllers with
+this flag should be treated as invalid until user space has had a chance
+to configure the controller in case the devicetree property is missing.
+
+As it does not make sense to allow controllers with invalid addresses,
+restore the original semantics, which also makes sure that the
+implementation is consistent (e.g. get_missing_options() indicates that
+the address must be set) and matches the documentation (including
+comments in the code, such as, "In case any of them is set, the
+controller has to start up as unconfigured.").
+
+Fixes: e668eb1e1578 ("Bluetooth: hci_core: Don't stop BT if the BD address missing in dts")
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/hci_sync.c | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
+index 37131a36700a1..9f9299b44f0bf 100644
+--- a/net/bluetooth/hci_sync.c
++++ b/net/bluetooth/hci_sync.c
+@@ -4564,16 +4564,14 @@ static int hci_dev_setup_sync(struct hci_dev *hdev)
+ * BD_ADDR invalid before creating the HCI device or in
+ * its setup callback.
+ */
+- invalid_bdaddr = test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks);
+-
++ invalid_bdaddr = test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
++ test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks);
+ if (!ret) {
+ if (test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks) &&
+ !bacmp(&hdev->public_addr, BDADDR_ANY))
+ hci_dev_get_bd_addr_from_property(hdev);
+
+- if ((invalid_bdaddr ||
+- test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
+- bacmp(&hdev->public_addr, BDADDR_ANY) &&
++ if (invalid_bdaddr && bacmp(&hdev->public_addr, BDADDR_ANY) &&
+ hdev->set_bdaddr) {
+ ret = hdev->set_bdaddr(hdev, &hdev->public_addr);
+ if (!ret)
+--
+2.39.2
+
--- /dev/null
+From cd1f79e8e3d6e096366179826040f03e90cfa838 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Jun 2023 10:19:12 +0200
+Subject: Bluetooth: hci_bcm: do not mark valid bd_addr as invalid
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+[ Upstream commit 56b7f325db139c9255b1eb1d1e741576d5f8fa34 ]
+
+A recent commit restored the original (and still documented) semantics
+for the HCI_QUIRK_USE_BDADDR_PROPERTY quirk so that the device address
+is considered invalid unless an address is provided by firmware.
+
+This specifically means that this flag must only be set for devices with
+invalid addresses, but the Broadcom driver has so far been setting this
+flag unconditionally.
+
+Fortunately the driver already checks for invalid addresses during setup
+and sets the HCI_QUIRK_INVALID_BDADDR flag. Use this flag to indicate
+when the address can be overridden by firmware (long term, this should
+probably just always be allowed).
+
+Fixes: 6945795bc81a ("Bluetooth: fix use-bdaddr-property quirk")
+Reported-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Link: https://lore.kernel.org/lkml/ecef83c8-497f-4011-607b-a63c24764867@samsung.com
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/hci_bcm.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/bluetooth/hci_bcm.c b/drivers/bluetooth/hci_bcm.c
+index 2b6c0e1922cb3..207611132b8ef 100644
+--- a/drivers/bluetooth/hci_bcm.c
++++ b/drivers/bluetooth/hci_bcm.c
+@@ -641,7 +641,8 @@ static int bcm_setup(struct hci_uart *hu)
+ * Allow the bootloader to set a valid address through the
+ * device tree.
+ */
+- set_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hu->hdev->quirks);
++ if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hu->hdev->quirks))
++ set_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hu->hdev->quirks);
+
+ if (!bcm_request_irq(bcm))
+ err = bcm_setup_sleep(hu);
+--
+2.39.2
+
--- /dev/null
+From 14414fdf4989f9af2ae01d133e5927449c169e1f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Jun 2023 09:34:43 +0300
+Subject: Bluetooth: ISO: use hci_sync for setting CIG parameters
+
+From: Pauli Virtanen <pav@iki.fi>
+
+[ Upstream commit 6b9545dc9f8ff01d8bc1229103960d9cd265343f ]
+
+When reconfiguring CIG after disconnection of the last CIS, LE Remove
+CIG shall be sent before LE Set CIG Parameters. Otherwise, it fails
+because CIG is in the inactive state and not configurable (Core v5.3
+Vol 6 Part B Sec. 4.5.14.3). This ordering is currently wrong under
+suitable timing conditions, because LE Remove CIG is sent via the
+hci_sync queue and may be delayed, but Set CIG Parameters is via
+hci_send_cmd.
+
+Make the ordering well-defined by sending also Set CIG Parameters via
+hci_sync.
+
+Fixes: 26afbd826ee3 ("Bluetooth: Add initial implementation of CIS connections")
+Signed-off-by: Pauli Virtanen <pav@iki.fi>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/hci_conn.c | 47 +++++++++++++++++++++++++++++++++-------
+ 1 file changed, 39 insertions(+), 8 deletions(-)
+
+diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
+index ab9f00252dc2a..fef09d2121384 100644
+--- a/net/bluetooth/hci_conn.c
++++ b/net/bluetooth/hci_conn.c
+@@ -770,6 +770,11 @@ static void le_conn_timeout(struct work_struct *work)
+ hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
+ }
+
++struct iso_cig_params {
++ struct hci_cp_le_set_cig_params cp;
++ struct hci_cis_params cis[0x1f];
++};
++
+ struct iso_list_data {
+ union {
+ u8 cig;
+@@ -781,10 +786,7 @@ struct iso_list_data {
+ u16 sync_handle;
+ };
+ int count;
+- struct {
+- struct hci_cp_le_set_cig_params cp;
+- struct hci_cis_params cis[0x11];
+- } pdu;
++ struct iso_cig_params pdu;
+ };
+
+ static void bis_list(struct hci_conn *conn, void *data)
+@@ -1705,10 +1707,33 @@ static int hci_le_create_big(struct hci_conn *conn, struct bt_iso_qos *qos)
+ return hci_send_cmd(hdev, HCI_OP_LE_CREATE_BIG, sizeof(cp), &cp);
+ }
+
++static void set_cig_params_complete(struct hci_dev *hdev, void *data, int err)
++{
++ struct iso_cig_params *pdu = data;
++
++ bt_dev_dbg(hdev, "");
++
++ if (err)
++ bt_dev_err(hdev, "Unable to set CIG parameters: %d", err);
++
++ kfree(pdu);
++}
++
++static int set_cig_params_sync(struct hci_dev *hdev, void *data)
++{
++ struct iso_cig_params *pdu = data;
++ u32 plen;
++
++ plen = sizeof(pdu->cp) + pdu->cp.num_cis * sizeof(pdu->cis[0]);
++ return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_CIG_PARAMS, plen, pdu,
++ HCI_CMD_TIMEOUT);
++}
++
+ static bool hci_le_set_cig_params(struct hci_conn *conn, struct bt_iso_qos *qos)
+ {
+ struct hci_dev *hdev = conn->hdev;
+ struct iso_list_data data;
++ struct iso_cig_params *pdu;
+
+ memset(&data, 0, sizeof(data));
+
+@@ -1779,12 +1804,18 @@ static bool hci_le_set_cig_params(struct hci_conn *conn, struct bt_iso_qos *qos)
+ if (qos->cis == BT_ISO_QOS_CIS_UNSET || !data.pdu.cp.num_cis)
+ return false;
+
+- if (hci_send_cmd(hdev, HCI_OP_LE_SET_CIG_PARAMS,
+- sizeof(data.pdu.cp) +
+- (data.pdu.cp.num_cis * sizeof(*data.pdu.cis)),
+- &data.pdu) < 0)
++ pdu = kzalloc(sizeof(*pdu), GFP_KERNEL);
++ if (!pdu)
+ return false;
+
++ memcpy(pdu, &data.pdu, sizeof(*pdu));
++
++ if (hci_cmd_sync_queue(hdev, set_cig_params_sync, pdu,
++ set_cig_params_complete) < 0) {
++ kfree(pdu);
++ return false;
++ }
++
+ return true;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 78a5b7b9a2a323d2d77f855b44d6dd33dca55b28 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Jan 2023 20:37:01 +0200
+Subject: Bluetooth: MGMT: add CIS feature bits to controller information
+
+From: Pauli Virtanen <pav@iki.fi>
+
+[ Upstream commit 2394186a2cefb9a45a029281a55749804dd8c556 ]
+
+Userspace needs to know whether the adapter has feature support for
+Connected Isochronous Stream - Central/Peripheral, so it can set up
+LE Audio features accordingly.
+
+Expose these feature bits as settings in MGMT controller info.
+
+Signed-off-by: Pauli Virtanen <pav@iki.fi>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Stable-dep-of: 73f55453ea52 ("Bluetooth: MGMT: Fix marking SCAN_RSP as not connectable")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/bluetooth/mgmt.h | 2 ++
+ net/bluetooth/mgmt.c | 12 ++++++++++++
+ 2 files changed, 14 insertions(+)
+
+diff --git a/include/net/bluetooth/mgmt.h b/include/net/bluetooth/mgmt.h
+index 743f6f59dff81..e18a927669c0a 100644
+--- a/include/net/bluetooth/mgmt.h
++++ b/include/net/bluetooth/mgmt.h
+@@ -109,6 +109,8 @@ struct mgmt_rp_read_index_list {
+ #define MGMT_SETTING_STATIC_ADDRESS 0x00008000
+ #define MGMT_SETTING_PHY_CONFIGURATION 0x00010000
+ #define MGMT_SETTING_WIDEBAND_SPEECH 0x00020000
++#define MGMT_SETTING_CIS_CENTRAL 0x00040000
++#define MGMT_SETTING_CIS_PERIPHERAL 0x00080000
+
+ #define MGMT_OP_READ_INFO 0x0004
+ #define MGMT_READ_INFO_SIZE 0
+diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
+index fc4ba0884da96..815f2abe918ef 100644
+--- a/net/bluetooth/mgmt.c
++++ b/net/bluetooth/mgmt.c
+@@ -859,6 +859,12 @@ static u32 get_supported_settings(struct hci_dev *hdev)
+ hdev->set_bdaddr)
+ settings |= MGMT_SETTING_CONFIGURATION;
+
++ if (cis_central_capable(hdev))
++ settings |= MGMT_SETTING_CIS_CENTRAL;
++
++ if (cis_peripheral_capable(hdev))
++ settings |= MGMT_SETTING_CIS_PERIPHERAL;
++
+ settings |= MGMT_SETTING_PHY_CONFIGURATION;
+
+ return settings;
+@@ -932,6 +938,12 @@ static u32 get_current_settings(struct hci_dev *hdev)
+ if (hci_dev_test_flag(hdev, HCI_WIDEBAND_SPEECH_ENABLED))
+ settings |= MGMT_SETTING_WIDEBAND_SPEECH;
+
++ if (cis_central_capable(hdev))
++ settings |= MGMT_SETTING_CIS_CENTRAL;
++
++ if (cis_peripheral_capable(hdev))
++ settings |= MGMT_SETTING_CIS_PERIPHERAL;
++
+ return settings;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From e5a97ce5b2a6dcbb52d4104a841ecca0053b01b5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Jun 2023 12:33:47 -0700
+Subject: Bluetooth: MGMT: Fix marking SCAN_RSP as not connectable
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+[ Upstream commit 73f55453ea5236a586a7f1b3d5e2ee051d655351 ]
+
+When receiving a scan response there is no way to know if the remote
+device is connectable or not, so when it cannot be merged don't
+make any assumption and instead just mark it with a new flag defined as
+MGMT_DEV_FOUND_SCAN_RSP so userspace can tell it is a standalone
+SCAN_RSP.
+
+Link: https://lore.kernel.org/linux-bluetooth/CABBYNZ+CYMsDSPTxBn09Js3BcdC-x7vZFfyLJ3ppZGGwJKmUTw@mail.gmail.com/
+Fixes: c70a7e4cc8d2 ("Bluetooth: Add support for Not Connectable flag for Device Found events")
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/bluetooth/mgmt.h | 1 +
+ net/bluetooth/hci_event.c | 15 +++++----------
+ 2 files changed, 6 insertions(+), 10 deletions(-)
+
+diff --git a/include/net/bluetooth/mgmt.h b/include/net/bluetooth/mgmt.h
+index a5801649f6196..5e68b3dd44222 100644
+--- a/include/net/bluetooth/mgmt.h
++++ b/include/net/bluetooth/mgmt.h
+@@ -979,6 +979,7 @@ struct mgmt_ev_auth_failed {
+ #define MGMT_DEV_FOUND_NOT_CONNECTABLE BIT(2)
+ #define MGMT_DEV_FOUND_INITIATED_CONN BIT(3)
+ #define MGMT_DEV_FOUND_NAME_REQUEST_FAILED BIT(4)
++#define MGMT_DEV_FOUND_SCAN_RSP BIT(5)
+
+ #define MGMT_EV_DEVICE_FOUND 0x0012
+ struct mgmt_ev_device_found {
+diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
+index 21416ccc30ab2..b272cc1f36481 100644
+--- a/net/bluetooth/hci_event.c
++++ b/net/bluetooth/hci_event.c
+@@ -6307,23 +6307,18 @@ static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr,
+ return;
+ }
+
+- /* When receiving non-connectable or scannable undirected
+- * advertising reports, this means that the remote device is
+- * not connectable and then clearly indicate this in the
+- * device found event.
+- *
+- * When receiving a scan response, then there is no way to
++ /* When receiving a scan response, then there is no way to
+ * know if the remote device is connectable or not. However
+ * since scan responses are merged with a previously seen
+ * advertising report, the flags field from that report
+ * will be used.
+ *
+- * In the really unlikely case that a controller get confused
+- * and just sends a scan response event, then it is marked as
+- * not connectable as well.
++ * In the unlikely case that a controller just sends a scan
++ * response event that doesn't match the pending report, then
++ * it is marked as a standalone SCAN_RSP.
+ */
+ if (type == LE_ADV_SCAN_RSP)
+- flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
++ flags = MGMT_DEV_FOUND_SCAN_RSP;
+
+ /* If there's nothing pending either store the data from this
+ * event or send an immediate device found event if the data
+--
+2.39.2
+
--- /dev/null
+From b6ed3a726e918e40715ffad3cca946081188586b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Feb 2023 14:28:55 -0800
+Subject: Bluetooth: MGMT: Use BIT macro when defining bitfields
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+[ Upstream commit a80d2c545ded86d0350b9a870735565d8b749786 ]
+
+This makes use of BIT macro when defining bitfields which makes it
+clearer what bit it is toggling.
+
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Stable-dep-of: 73f55453ea52 ("Bluetooth: MGMT: Fix marking SCAN_RSP as not connectable")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/bluetooth/mgmt.h | 80 ++++++++++++++++++------------------
+ 1 file changed, 40 insertions(+), 40 deletions(-)
+
+diff --git a/include/net/bluetooth/mgmt.h b/include/net/bluetooth/mgmt.h
+index e18a927669c0a..a5801649f6196 100644
+--- a/include/net/bluetooth/mgmt.h
++++ b/include/net/bluetooth/mgmt.h
+@@ -91,26 +91,26 @@ struct mgmt_rp_read_index_list {
+ #define MGMT_MAX_NAME_LENGTH (HCI_MAX_NAME_LENGTH + 1)
+ #define MGMT_MAX_SHORT_NAME_LENGTH (HCI_MAX_SHORT_NAME_LENGTH + 1)
+
+-#define MGMT_SETTING_POWERED 0x00000001
+-#define MGMT_SETTING_CONNECTABLE 0x00000002
+-#define MGMT_SETTING_FAST_CONNECTABLE 0x00000004
+-#define MGMT_SETTING_DISCOVERABLE 0x00000008
+-#define MGMT_SETTING_BONDABLE 0x00000010
+-#define MGMT_SETTING_LINK_SECURITY 0x00000020
+-#define MGMT_SETTING_SSP 0x00000040
+-#define MGMT_SETTING_BREDR 0x00000080
+-#define MGMT_SETTING_HS 0x00000100
+-#define MGMT_SETTING_LE 0x00000200
+-#define MGMT_SETTING_ADVERTISING 0x00000400
+-#define MGMT_SETTING_SECURE_CONN 0x00000800
+-#define MGMT_SETTING_DEBUG_KEYS 0x00001000
+-#define MGMT_SETTING_PRIVACY 0x00002000
+-#define MGMT_SETTING_CONFIGURATION 0x00004000
+-#define MGMT_SETTING_STATIC_ADDRESS 0x00008000
+-#define MGMT_SETTING_PHY_CONFIGURATION 0x00010000
+-#define MGMT_SETTING_WIDEBAND_SPEECH 0x00020000
+-#define MGMT_SETTING_CIS_CENTRAL 0x00040000
+-#define MGMT_SETTING_CIS_PERIPHERAL 0x00080000
++#define MGMT_SETTING_POWERED BIT(0)
++#define MGMT_SETTING_CONNECTABLE BIT(1)
++#define MGMT_SETTING_FAST_CONNECTABLE BIT(2)
++#define MGMT_SETTING_DISCOVERABLE BIT(3)
++#define MGMT_SETTING_BONDABLE BIT(4)
++#define MGMT_SETTING_LINK_SECURITY BIT(5)
++#define MGMT_SETTING_SSP BIT(6)
++#define MGMT_SETTING_BREDR BIT(7)
++#define MGMT_SETTING_HS BIT(8)
++#define MGMT_SETTING_LE BIT(9)
++#define MGMT_SETTING_ADVERTISING BIT(10)
++#define MGMT_SETTING_SECURE_CONN BIT(11)
++#define MGMT_SETTING_DEBUG_KEYS BIT(12)
++#define MGMT_SETTING_PRIVACY BIT(13)
++#define MGMT_SETTING_CONFIGURATION BIT(14)
++#define MGMT_SETTING_STATIC_ADDRESS BIT(15)
++#define MGMT_SETTING_PHY_CONFIGURATION BIT(16)
++#define MGMT_SETTING_WIDEBAND_SPEECH BIT(17)
++#define MGMT_SETTING_CIS_CENTRAL BIT(18)
++#define MGMT_SETTING_CIS_PERIPHERAL BIT(19)
+
+ #define MGMT_OP_READ_INFO 0x0004
+ #define MGMT_READ_INFO_SIZE 0
+@@ -635,21 +635,21 @@ struct mgmt_rp_get_phy_configuration {
+ } __packed;
+ #define MGMT_GET_PHY_CONFIGURATION_SIZE 0
+
+-#define MGMT_PHY_BR_1M_1SLOT 0x00000001
+-#define MGMT_PHY_BR_1M_3SLOT 0x00000002
+-#define MGMT_PHY_BR_1M_5SLOT 0x00000004
+-#define MGMT_PHY_EDR_2M_1SLOT 0x00000008
+-#define MGMT_PHY_EDR_2M_3SLOT 0x00000010
+-#define MGMT_PHY_EDR_2M_5SLOT 0x00000020
+-#define MGMT_PHY_EDR_3M_1SLOT 0x00000040
+-#define MGMT_PHY_EDR_3M_3SLOT 0x00000080
+-#define MGMT_PHY_EDR_3M_5SLOT 0x00000100
+-#define MGMT_PHY_LE_1M_TX 0x00000200
+-#define MGMT_PHY_LE_1M_RX 0x00000400
+-#define MGMT_PHY_LE_2M_TX 0x00000800
+-#define MGMT_PHY_LE_2M_RX 0x00001000
+-#define MGMT_PHY_LE_CODED_TX 0x00002000
+-#define MGMT_PHY_LE_CODED_RX 0x00004000
++#define MGMT_PHY_BR_1M_1SLOT BIT(0)
++#define MGMT_PHY_BR_1M_3SLOT BIT(1)
++#define MGMT_PHY_BR_1M_5SLOT BIT(2)
++#define MGMT_PHY_EDR_2M_1SLOT BIT(3)
++#define MGMT_PHY_EDR_2M_3SLOT BIT(4)
++#define MGMT_PHY_EDR_2M_5SLOT BIT(5)
++#define MGMT_PHY_EDR_3M_1SLOT BIT(6)
++#define MGMT_PHY_EDR_3M_3SLOT BIT(7)
++#define MGMT_PHY_EDR_3M_5SLOT BIT(8)
++#define MGMT_PHY_LE_1M_TX BIT(9)
++#define MGMT_PHY_LE_1M_RX BIT(10)
++#define MGMT_PHY_LE_2M_TX BIT(11)
++#define MGMT_PHY_LE_2M_RX BIT(12)
++#define MGMT_PHY_LE_CODED_TX BIT(13)
++#define MGMT_PHY_LE_CODED_RX BIT(14)
+
+ #define MGMT_PHY_BREDR_MASK (MGMT_PHY_BR_1M_1SLOT | MGMT_PHY_BR_1M_3SLOT | \
+ MGMT_PHY_BR_1M_5SLOT | MGMT_PHY_EDR_2M_1SLOT | \
+@@ -974,11 +974,11 @@ struct mgmt_ev_auth_failed {
+ __u8 status;
+ } __packed;
+
+-#define MGMT_DEV_FOUND_CONFIRM_NAME 0x01
+-#define MGMT_DEV_FOUND_LEGACY_PAIRING 0x02
+-#define MGMT_DEV_FOUND_NOT_CONNECTABLE 0x04
+-#define MGMT_DEV_FOUND_INITIATED_CONN 0x08
+-#define MGMT_DEV_FOUND_NAME_REQUEST_FAILED 0x10
++#define MGMT_DEV_FOUND_CONFIRM_NAME BIT(0)
++#define MGMT_DEV_FOUND_LEGACY_PAIRING BIT(1)
++#define MGMT_DEV_FOUND_NOT_CONNECTABLE BIT(2)
++#define MGMT_DEV_FOUND_INITIATED_CONN BIT(3)
++#define MGMT_DEV_FOUND_NAME_REQUEST_FAILED BIT(4)
+
+ #define MGMT_EV_DEVICE_FOUND 0x0012
+ struct mgmt_ev_device_found {
+--
+2.39.2
+
--- /dev/null
+From d81e84be3d99f41869ab77db2b1c224fe972bb36 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 1 Jul 2023 17:14:47 +0000
+Subject: bpf, btf: Warn but return no error for NULL btf from
+ __register_btf_kfunc_id_set()
+
+From: SeongJae Park <sj@kernel.org>
+
+[ Upstream commit 3de4d22cc9ac7c9f38e10edcf54f9a8891a9c2aa ]
+
+__register_btf_kfunc_id_set() assumes .BTF to be part of the module's .ko
+file if CONFIG_DEBUG_INFO_BTF is enabled. If that's not the case, the
+function prints an error message and return an error. As a result, such
+modules cannot be loaded.
+
+However, the section could be stripped out during a build process. It would
+be better to let the modules loaded, because their basic functionalities
+have no problem [0], though the BTF functionalities will not be supported.
+Make the function to lower the level of the message from error to warn, and
+return no error.
+
+ [0] https://lore.kernel.org/bpf/20220219082037.ow2kbq5brktf4f2u@apollo.legion
+
+Fixes: c446fdacb10d ("bpf: fix register_btf_kfunc_id_set for !CONFIG_DEBUG_INFO_BTF")
+Reported-by: Alexander Egorenkov <Alexander.Egorenkov@ibm.com>
+Suggested-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
+Signed-off-by: SeongJae Park <sj@kernel.org>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Jiri Olsa <jolsa@kernel.org>
+Link: https://lore.kernel.org/bpf/87y228q66f.fsf@oc8242746057.ibm.com
+Link: https://lore.kernel.org/bpf/20220219082037.ow2kbq5brktf4f2u@apollo.legion
+Link: https://lore.kernel.org/bpf/20230701171447.56464-1-sj@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/btf.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
+index 8220caa488c54..fb78bb26786fc 100644
+--- a/kernel/bpf/btf.c
++++ b/kernel/bpf/btf.c
+@@ -7469,10 +7469,8 @@ int register_btf_kfunc_id_set(enum bpf_prog_type prog_type,
+ pr_err("missing vmlinux BTF, cannot register kfuncs\n");
+ return -ENOENT;
+ }
+- if (kset->owner && IS_ENABLED(CONFIG_DEBUG_INFO_BTF_MODULES)) {
+- pr_err("missing module BTF, cannot register kfuncs\n");
+- return -ENOENT;
+- }
++ if (kset->owner && IS_ENABLED(CONFIG_DEBUG_INFO_BTF_MODULES))
++ pr_warn("missing module BTF, cannot register kfuncs\n");
+ return 0;
+ }
+ if (IS_ERR(btf))
+--
+2.39.2
+
--- /dev/null
+From 9e6090352b3fbfbd14b522b6bfb376cf1a87698a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Jun 2023 19:07:18 +0300
+Subject: bus: fsl-mc: don't assume child devices are all fsl-mc devices
+
+From: Laurentiu Tudor <laurentiu.tudor@nxp.com>
+
+[ Upstream commit 303c9c63abb9390e906052863f82bb4e9824e5c0 ]
+
+Changes in VFIO caused a pseudo-device to be created as child of
+fsl-mc devices causing a crash [1] when trying to bind a fsl-mc
+device to VFIO. Fix this by checking the device type when enumerating
+fsl-mc child devices.
+
+[1]
+Modules linked in:
+Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP
+CPU: 6 PID: 1289 Comm: sh Not tainted 6.2.0-rc5-00047-g7c46948a6e9c #2
+Hardware name: NXP Layerscape LX2160ARDB (DT)
+pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+pc : mc_send_command+0x24/0x1f0
+lr : dprc_get_obj_region+0xfc/0x1c0
+sp : ffff80000a88b900
+x29: ffff80000a88b900 x28: ffff48a9429e1400 x27: 00000000000002b2
+x26: ffff48a9429e1718 x25: 0000000000000000 x24: 0000000000000000
+x23: ffffd59331ba3918 x22: ffffd59331ba3000 x21: 0000000000000000
+x20: ffff80000a88b9b8 x19: 0000000000000000 x18: 0000000000000001
+x17: 7270642f636d2d6c x16: 73662e3030303030 x15: ffffffffffffffff
+x14: ffffd59330f1d668 x13: ffff48a8727dc389 x12: ffff48a8727dc386
+x11: 0000000000000002 x10: 00008ceaf02f35d4 x9 : 0000000000000012
+x8 : 0000000000000000 x7 : 0000000000000006 x6 : ffff80000a88bab0
+x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff80000a88b9e8
+x2 : ffff80000a88b9e8 x1 : 0000000000000000 x0 : ffff48a945142b80
+Call trace:
+ mc_send_command+0x24/0x1f0
+ dprc_get_obj_region+0xfc/0x1c0
+ fsl_mc_device_add+0x340/0x590
+ fsl_mc_obj_device_add+0xd0/0xf8
+ dprc_scan_objects+0x1c4/0x340
+ dprc_scan_container+0x38/0x60
+ vfio_fsl_mc_probe+0x9c/0xf8
+ fsl_mc_driver_probe+0x24/0x70
+ really_probe+0xbc/0x2a8
+ __driver_probe_device+0x78/0xe0
+ device_driver_attach+0x30/0x68
+ bind_store+0xa8/0x130
+ drv_attr_store+0x24/0x38
+ sysfs_kf_write+0x44/0x60
+ kernfs_fop_write_iter+0x128/0x1b8
+ vfs_write+0x334/0x448
+ ksys_write+0x68/0xf0
+ __arm64_sys_write+0x1c/0x28
+ invoke_syscall+0x44/0x108
+ el0_svc_common.constprop.1+0x94/0xf8
+ do_el0_svc+0x38/0xb0
+ el0_svc+0x20/0x50
+ el0t_64_sync_handler+0x98/0xc0
+ el0t_64_sync+0x174/0x178
+Code: aa0103f4 a9025bf5 d5384100 b9400801 (79401260)
+---[ end trace 0000000000000000 ]---
+
+Fixes: 3c28a76124b2 ("vfio: Add struct device to vfio_device")
+Signed-off-by: Laurentiu Tudor <laurentiu.tudor@nxp.com>
+Tested-by: Ioana Ciornei <ioana.ciornei@nxp.com>
+Reviewed-by: Ioana Ciornei <ioana.ciornei@nxp.com>
+Message-ID: <20230613160718.29500-1-laurentiu.tudor@nxp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bus/fsl-mc/dprc-driver.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/bus/fsl-mc/dprc-driver.c b/drivers/bus/fsl-mc/dprc-driver.c
+index 5e70f9775a0e3..d1e2d2987dd38 100644
+--- a/drivers/bus/fsl-mc/dprc-driver.c
++++ b/drivers/bus/fsl-mc/dprc-driver.c
+@@ -46,6 +46,9 @@ static int __fsl_mc_device_remove_if_not_in_mc(struct device *dev, void *data)
+ struct fsl_mc_child_objs *objs;
+ struct fsl_mc_device *mc_dev;
+
++ if (!dev_is_fsl_mc(dev))
++ return 0;
++
+ mc_dev = to_fsl_mc_device(dev);
+ objs = data;
+
+@@ -65,6 +68,9 @@ static int __fsl_mc_device_remove_if_not_in_mc(struct device *dev, void *data)
+
+ static int __fsl_mc_device_remove(struct device *dev, void *data)
+ {
++ if (!dev_is_fsl_mc(dev))
++ return 0;
++
+ fsl_mc_device_remove(to_fsl_mc_device(dev));
+ return 0;
+ }
+--
+2.39.2
+
--- /dev/null
+From 4e03e3603d14d23b08acabcaacb27701161fcfab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 May 2023 19:59:32 +0530
+Subject: clk: qcom: camcc-sc7180: Add parent dependency to all camera GDSCs
+
+From: Taniya Das <quic_tdas@quicinc.com>
+
+[ Upstream commit 3e4d179532423f299554cd0dedabdd9d2fdd238d ]
+
+Camera titan top GDSC is a parent supply to all other camera GDSCs. Titan
+top GDSC is required to be enabled before enabling any other camera GDSCs
+and it should be disabled only after all other camera GDSCs are disabled.
+Ensure this behavior by marking titan top GDSC as parent of all other
+camera GDSCs.
+
+Fixes: 15d09e830bbc ("clk: qcom: camcc: Add camera clock controller driver for SC7180")
+Signed-off-by: Taniya Das <quic_tdas@quicinc.com>
+Acked-by: Stephen Boyd <sboyd@kernel.org>
+Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230501142932.13049-1-quic_tdas@quicinc.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/camcc-sc7180.c | 19 ++++++++++++-------
+ 1 file changed, 12 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/clk/qcom/camcc-sc7180.c b/drivers/clk/qcom/camcc-sc7180.c
+index e2b4804695f37..8a4ba7a19ed12 100644
+--- a/drivers/clk/qcom/camcc-sc7180.c
++++ b/drivers/clk/qcom/camcc-sc7180.c
+@@ -1480,12 +1480,21 @@ static struct clk_branch cam_cc_sys_tmr_clk = {
+ },
+ };
+
++static struct gdsc titan_top_gdsc = {
++ .gdscr = 0xb134,
++ .pd = {
++ .name = "titan_top_gdsc",
++ },
++ .pwrsts = PWRSTS_OFF_ON,
++};
++
+ static struct gdsc bps_gdsc = {
+ .gdscr = 0x6004,
+ .pd = {
+ .name = "bps_gdsc",
+ },
+ .pwrsts = PWRSTS_OFF_ON,
++ .parent = &titan_top_gdsc.pd,
+ .flags = HW_CTRL,
+ };
+
+@@ -1495,6 +1504,7 @@ static struct gdsc ife_0_gdsc = {
+ .name = "ife_0_gdsc",
+ },
+ .pwrsts = PWRSTS_OFF_ON,
++ .parent = &titan_top_gdsc.pd,
+ };
+
+ static struct gdsc ife_1_gdsc = {
+@@ -1503,6 +1513,7 @@ static struct gdsc ife_1_gdsc = {
+ .name = "ife_1_gdsc",
+ },
+ .pwrsts = PWRSTS_OFF_ON,
++ .parent = &titan_top_gdsc.pd,
+ };
+
+ static struct gdsc ipe_0_gdsc = {
+@@ -1512,15 +1523,9 @@ static struct gdsc ipe_0_gdsc = {
+ },
+ .pwrsts = PWRSTS_OFF_ON,
+ .flags = HW_CTRL,
++ .parent = &titan_top_gdsc.pd,
+ };
+
+-static struct gdsc titan_top_gdsc = {
+- .gdscr = 0xb134,
+- .pd = {
+- .name = "titan_top_gdsc",
+- },
+- .pwrsts = PWRSTS_OFF_ON,
+-};
+
+ static struct clk_hw *cam_cc_sc7180_hws[] = {
+ [CAM_CC_PLL2_OUT_EARLY] = &cam_cc_pll2_out_early.hw,
+--
+2.39.2
+
--- /dev/null
+From 4da8f32a2876ebfb31b9b92c7305aca9a353ffd8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Apr 2023 13:06:35 +0200
+Subject: clk: qcom: dispcc-qcm2290: Fix BI_TCXO_AO handling
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit 92dfee0fc889b5b00ffb6b1de87ce64c483bcb7b ]
+
+BI_TCXO_AO (.fw_name = "bi_tcxo_ao") was previously made to reuse the
+same parent enum entry as BI_TCXO (.fw_name = "bi_tcxo") in parent_map_2.
+
+Resolve it by introducing its own entry in the parent enum and
+correctly assigning it in disp_cc_parent_map_2[].
+
+Fixes: cc517ea3333f ("clk: qcom: Add display clock controller driver for QCM2290")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230412-topic-qcm_dispcc-v2-1-bce7dd512fe4@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/dispcc-qcm2290.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/qcom/dispcc-qcm2290.c b/drivers/clk/qcom/dispcc-qcm2290.c
+index 24755dc841f9d..4a4993470852b 100644
+--- a/drivers/clk/qcom/dispcc-qcm2290.c
++++ b/drivers/clk/qcom/dispcc-qcm2290.c
+@@ -23,6 +23,7 @@
+
+ enum {
+ P_BI_TCXO,
++ P_BI_TCXO_AO,
+ P_DISP_CC_PLL0_OUT_MAIN,
+ P_DSI0_PHY_PLL_OUT_BYTECLK,
+ P_DSI0_PHY_PLL_OUT_DSICLK,
+@@ -81,7 +82,7 @@ static const struct clk_parent_data disp_cc_parent_data_1[] = {
+ };
+
+ static const struct parent_map disp_cc_parent_map_2[] = {
+- { P_BI_TCXO, 0 },
++ { P_BI_TCXO_AO, 0 },
+ { P_GPLL0_OUT_MAIN, 4 },
+ };
+
+@@ -150,7 +151,7 @@ static struct clk_regmap_div disp_cc_mdss_byte0_div_clk_src = {
+ };
+
+ static const struct freq_tbl ftbl_disp_cc_mdss_ahb_clk_src[] = {
+- F(19200000, P_BI_TCXO, 1, 0, 0),
++ F(19200000, P_BI_TCXO_AO, 1, 0, 0),
+ F(37500000, P_GPLL0_OUT_MAIN, 8, 0, 0),
+ F(75000000, P_GPLL0_OUT_MAIN, 4, 0, 0),
+ { }
+--
+2.39.2
+
--- /dev/null
+From f0ab3f917f58eade5f247b76d51bd1c46be0d5d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Apr 2023 13:06:36 +0200
+Subject: clk: qcom: dispcc-qcm2290: Fix GPLL0_OUT_DIV handling
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit 63d56adf04b5795e54440dc5b7afddecb2966863 ]
+
+GPLL0_OUT_DIV (.fw_name = "gcc_disp_gpll0_div_clk_src") was previously
+made to reuse the same parent enum entry as GPLL0_OUT_MAIN
+(.fw_name = "gcc_disp_gpll0_clk_src") in parent_map_2.
+
+Resolve it by introducing its own entry in the parent enum and
+correctly assigning it in disp_cc_parent_map_2[].
+
+Fixes: cc517ea3333f ("clk: qcom: Add display clock controller driver for QCM2290")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230412-topic-qcm_dispcc-v2-2-bce7dd512fe4@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/dispcc-qcm2290.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/clk/qcom/dispcc-qcm2290.c b/drivers/clk/qcom/dispcc-qcm2290.c
+index 4a4993470852b..5cec98c4e8372 100644
+--- a/drivers/clk/qcom/dispcc-qcm2290.c
++++ b/drivers/clk/qcom/dispcc-qcm2290.c
+@@ -27,6 +27,7 @@ enum {
+ P_DISP_CC_PLL0_OUT_MAIN,
+ P_DSI0_PHY_PLL_OUT_BYTECLK,
+ P_DSI0_PHY_PLL_OUT_DSICLK,
++ P_GPLL0_OUT_DIV,
+ P_GPLL0_OUT_MAIN,
+ P_SLEEP_CLK,
+ };
+@@ -83,7 +84,7 @@ static const struct clk_parent_data disp_cc_parent_data_1[] = {
+
+ static const struct parent_map disp_cc_parent_map_2[] = {
+ { P_BI_TCXO_AO, 0 },
+- { P_GPLL0_OUT_MAIN, 4 },
++ { P_GPLL0_OUT_DIV, 4 },
+ };
+
+ static const struct clk_parent_data disp_cc_parent_data_2[] = {
+@@ -152,8 +153,8 @@ static struct clk_regmap_div disp_cc_mdss_byte0_div_clk_src = {
+
+ static const struct freq_tbl ftbl_disp_cc_mdss_ahb_clk_src[] = {
+ F(19200000, P_BI_TCXO_AO, 1, 0, 0),
+- F(37500000, P_GPLL0_OUT_MAIN, 8, 0, 0),
+- F(75000000, P_GPLL0_OUT_MAIN, 4, 0, 0),
++ F(37500000, P_GPLL0_OUT_DIV, 8, 0, 0),
++ F(75000000, P_GPLL0_OUT_DIV, 4, 0, 0),
+ { }
+ };
+
+--
+2.39.2
+
--- /dev/null
+From 5b57b2f33c26ac3ed253c1ae4662c77248a9f08f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Apr 2023 12:11:49 +0300
+Subject: clk: qcom: gcc-ipq6018: Use floor ops for sdcc clocks
+
+From: Mantas Pucka <mantas@8devices.com>
+
+[ Upstream commit 56e5ae0116aef87273cf1812d608645b076e4f02 ]
+
+SDCC clocks must be rounded down to avoid overclocking the controller.
+
+Fixes: d9db07f088af ("clk: qcom: Add ipq6018 Global Clock Controller support")
+Signed-off-by: Mantas Pucka <mantas@8devices.com>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/1682413909-24927-1-git-send-email-mantas@8devices.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/gcc-ipq6018.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/qcom/gcc-ipq6018.c b/drivers/clk/qcom/gcc-ipq6018.c
+index 3f9c2f61a5d93..5c5d1b04ea7af 100644
+--- a/drivers/clk/qcom/gcc-ipq6018.c
++++ b/drivers/clk/qcom/gcc-ipq6018.c
+@@ -1654,7 +1654,7 @@ static struct clk_rcg2 sdcc1_apps_clk_src = {
+ .name = "sdcc1_apps_clk_src",
+ .parent_data = gcc_xo_gpll0_gpll2_gpll0_out_main_div2,
+ .num_parents = 4,
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_floor_ops,
+ },
+ };
+
+--
+2.39.2
+
--- /dev/null
+From 14cf730f73e061d8bf9d90d9234a6c9b407fbe64 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Apr 2023 19:48:07 +0200
+Subject: clk: qcom: gcc-qcm2290: Mark RCGs shared where applicable
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit 7bf654a0d95e75b415f454e10627309d650762d0 ]
+
+The vast majority of shared RCGs were not marked as such. Fix it.
+
+Fixes: 496d1a13d405 ("clk: qcom: Add Global Clock Controller driver for QCM2290")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Acked-by: Shawn Guo <shawn.guo@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230403174807.345185-1-konrad.dybcio@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/gcc-qcm2290.c | 62 +++++++++++++++++-----------------
+ 1 file changed, 31 insertions(+), 31 deletions(-)
+
+diff --git a/drivers/clk/qcom/gcc-qcm2290.c b/drivers/clk/qcom/gcc-qcm2290.c
+index 096deff2ba257..48995e50c6bd7 100644
+--- a/drivers/clk/qcom/gcc-qcm2290.c
++++ b/drivers/clk/qcom/gcc-qcm2290.c
+@@ -650,7 +650,7 @@ static struct clk_rcg2 gcc_usb30_prim_mock_utmi_clk_src = {
+ .name = "gcc_usb30_prim_mock_utmi_clk_src",
+ .parent_data = gcc_parents_0,
+ .num_parents = ARRAY_SIZE(gcc_parents_0),
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -686,7 +686,7 @@ static struct clk_rcg2 gcc_camss_axi_clk_src = {
+ .name = "gcc_camss_axi_clk_src",
+ .parent_data = gcc_parents_4,
+ .num_parents = ARRAY_SIZE(gcc_parents_4),
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -706,7 +706,7 @@ static struct clk_rcg2 gcc_camss_cci_clk_src = {
+ .name = "gcc_camss_cci_clk_src",
+ .parent_data = gcc_parents_9,
+ .num_parents = ARRAY_SIZE(gcc_parents_9),
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -728,7 +728,7 @@ static struct clk_rcg2 gcc_camss_csi0phytimer_clk_src = {
+ .name = "gcc_camss_csi0phytimer_clk_src",
+ .parent_data = gcc_parents_5,
+ .num_parents = ARRAY_SIZE(gcc_parents_5),
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -742,7 +742,7 @@ static struct clk_rcg2 gcc_camss_csi1phytimer_clk_src = {
+ .name = "gcc_camss_csi1phytimer_clk_src",
+ .parent_data = gcc_parents_5,
+ .num_parents = ARRAY_SIZE(gcc_parents_5),
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -764,7 +764,7 @@ static struct clk_rcg2 gcc_camss_mclk0_clk_src = {
+ .parent_data = gcc_parents_3,
+ .num_parents = ARRAY_SIZE(gcc_parents_3),
+ .flags = CLK_OPS_PARENT_ENABLE,
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -779,7 +779,7 @@ static struct clk_rcg2 gcc_camss_mclk1_clk_src = {
+ .parent_data = gcc_parents_3,
+ .num_parents = ARRAY_SIZE(gcc_parents_3),
+ .flags = CLK_OPS_PARENT_ENABLE,
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -794,7 +794,7 @@ static struct clk_rcg2 gcc_camss_mclk2_clk_src = {
+ .parent_data = gcc_parents_3,
+ .num_parents = ARRAY_SIZE(gcc_parents_3),
+ .flags = CLK_OPS_PARENT_ENABLE,
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -809,7 +809,7 @@ static struct clk_rcg2 gcc_camss_mclk3_clk_src = {
+ .parent_data = gcc_parents_3,
+ .num_parents = ARRAY_SIZE(gcc_parents_3),
+ .flags = CLK_OPS_PARENT_ENABLE,
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -830,7 +830,7 @@ static struct clk_rcg2 gcc_camss_ope_ahb_clk_src = {
+ .name = "gcc_camss_ope_ahb_clk_src",
+ .parent_data = gcc_parents_6,
+ .num_parents = ARRAY_SIZE(gcc_parents_6),
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -854,7 +854,7 @@ static struct clk_rcg2 gcc_camss_ope_clk_src = {
+ .parent_data = gcc_parents_6,
+ .num_parents = ARRAY_SIZE(gcc_parents_6),
+ .flags = CLK_SET_RATE_PARENT,
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -888,7 +888,7 @@ static struct clk_rcg2 gcc_camss_tfe_0_clk_src = {
+ .name = "gcc_camss_tfe_0_clk_src",
+ .parent_data = gcc_parents_7,
+ .num_parents = ARRAY_SIZE(gcc_parents_7),
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -912,7 +912,7 @@ static struct clk_rcg2 gcc_camss_tfe_0_csid_clk_src = {
+ .name = "gcc_camss_tfe_0_csid_clk_src",
+ .parent_data = gcc_parents_8,
+ .num_parents = ARRAY_SIZE(gcc_parents_8),
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -926,7 +926,7 @@ static struct clk_rcg2 gcc_camss_tfe_1_clk_src = {
+ .name = "gcc_camss_tfe_1_clk_src",
+ .parent_data = gcc_parents_7,
+ .num_parents = ARRAY_SIZE(gcc_parents_7),
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -940,7 +940,7 @@ static struct clk_rcg2 gcc_camss_tfe_1_csid_clk_src = {
+ .name = "gcc_camss_tfe_1_csid_clk_src",
+ .parent_data = gcc_parents_8,
+ .num_parents = ARRAY_SIZE(gcc_parents_8),
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -963,7 +963,7 @@ static struct clk_rcg2 gcc_camss_tfe_cphy_rx_clk_src = {
+ .parent_data = gcc_parents_10,
+ .num_parents = ARRAY_SIZE(gcc_parents_10),
+ .flags = CLK_OPS_PARENT_ENABLE,
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -984,7 +984,7 @@ static struct clk_rcg2 gcc_camss_top_ahb_clk_src = {
+ .name = "gcc_camss_top_ahb_clk_src",
+ .parent_data = gcc_parents_4,
+ .num_parents = ARRAY_SIZE(gcc_parents_4),
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -1006,7 +1006,7 @@ static struct clk_rcg2 gcc_gp1_clk_src = {
+ .name = "gcc_gp1_clk_src",
+ .parent_data = gcc_parents_2,
+ .num_parents = ARRAY_SIZE(gcc_parents_2),
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -1020,7 +1020,7 @@ static struct clk_rcg2 gcc_gp2_clk_src = {
+ .name = "gcc_gp2_clk_src",
+ .parent_data = gcc_parents_2,
+ .num_parents = ARRAY_SIZE(gcc_parents_2),
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -1034,7 +1034,7 @@ static struct clk_rcg2 gcc_gp3_clk_src = {
+ .name = "gcc_gp3_clk_src",
+ .parent_data = gcc_parents_2,
+ .num_parents = ARRAY_SIZE(gcc_parents_2),
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -1054,7 +1054,7 @@ static struct clk_rcg2 gcc_pdm2_clk_src = {
+ .name = "gcc_pdm2_clk_src",
+ .parent_data = gcc_parents_0,
+ .num_parents = ARRAY_SIZE(gcc_parents_0),
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -1082,7 +1082,7 @@ static struct clk_init_data gcc_qupv3_wrap0_s0_clk_src_init = {
+ .name = "gcc_qupv3_wrap0_s0_clk_src",
+ .parent_data = gcc_parents_1,
+ .num_parents = ARRAY_SIZE(gcc_parents_1),
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ };
+
+ static struct clk_rcg2 gcc_qupv3_wrap0_s0_clk_src = {
+@@ -1098,7 +1098,7 @@ static struct clk_init_data gcc_qupv3_wrap0_s1_clk_src_init = {
+ .name = "gcc_qupv3_wrap0_s1_clk_src",
+ .parent_data = gcc_parents_1,
+ .num_parents = ARRAY_SIZE(gcc_parents_1),
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ };
+
+ static struct clk_rcg2 gcc_qupv3_wrap0_s1_clk_src = {
+@@ -1114,7 +1114,7 @@ static struct clk_init_data gcc_qupv3_wrap0_s2_clk_src_init = {
+ .name = "gcc_qupv3_wrap0_s2_clk_src",
+ .parent_data = gcc_parents_1,
+ .num_parents = ARRAY_SIZE(gcc_parents_1),
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ };
+
+ static struct clk_rcg2 gcc_qupv3_wrap0_s2_clk_src = {
+@@ -1130,7 +1130,7 @@ static struct clk_init_data gcc_qupv3_wrap0_s3_clk_src_init = {
+ .name = "gcc_qupv3_wrap0_s3_clk_src",
+ .parent_data = gcc_parents_1,
+ .num_parents = ARRAY_SIZE(gcc_parents_1),
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ };
+
+ static struct clk_rcg2 gcc_qupv3_wrap0_s3_clk_src = {
+@@ -1146,7 +1146,7 @@ static struct clk_init_data gcc_qupv3_wrap0_s4_clk_src_init = {
+ .name = "gcc_qupv3_wrap0_s4_clk_src",
+ .parent_data = gcc_parents_1,
+ .num_parents = ARRAY_SIZE(gcc_parents_1),
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ };
+
+ static struct clk_rcg2 gcc_qupv3_wrap0_s4_clk_src = {
+@@ -1162,7 +1162,7 @@ static struct clk_init_data gcc_qupv3_wrap0_s5_clk_src_init = {
+ .name = "gcc_qupv3_wrap0_s5_clk_src",
+ .parent_data = gcc_parents_1,
+ .num_parents = ARRAY_SIZE(gcc_parents_1),
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ };
+
+ static struct clk_rcg2 gcc_qupv3_wrap0_s5_clk_src = {
+@@ -1219,7 +1219,7 @@ static struct clk_rcg2 gcc_sdcc1_ice_core_clk_src = {
+ .name = "gcc_sdcc1_ice_core_clk_src",
+ .parent_data = gcc_parents_0,
+ .num_parents = ARRAY_SIZE(gcc_parents_0),
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -1266,7 +1266,7 @@ static struct clk_rcg2 gcc_usb30_prim_master_clk_src = {
+ .name = "gcc_usb30_prim_master_clk_src",
+ .parent_data = gcc_parents_0,
+ .num_parents = ARRAY_SIZE(gcc_parents_0),
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -1280,7 +1280,7 @@ static struct clk_rcg2 gcc_usb3_prim_phy_aux_clk_src = {
+ .name = "gcc_usb3_prim_phy_aux_clk_src",
+ .parent_data = gcc_parents_13,
+ .num_parents = ARRAY_SIZE(gcc_parents_13),
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -1303,7 +1303,7 @@ static struct clk_rcg2 gcc_video_venus_clk_src = {
+ .parent_data = gcc_parents_14,
+ .num_parents = ARRAY_SIZE(gcc_parents_14),
+ .flags = CLK_SET_RATE_PARENT,
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+--
+2.39.2
+
--- /dev/null
+From 843ec451583b377b34400d97665377fb51461359 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 May 2023 21:08:55 +0200
+Subject: clk: qcom: ipq6018: fix networking resets
+
+From: Robert Marko <robimarko@gmail.com>
+
+[ Upstream commit 349b5bed539b491b7894a5186a895751fd8ba6c7 ]
+
+Networking resets in IPQ6018 all use bitmask as they require multiple
+bits to be set and cleared instead of a single bit.
+
+So, current networking resets have the same register and bit 0 set which
+is clearly incorrect.
+
+Fixes: d9db07f088af ("clk: qcom: Add ipq6018 Global Clock Controller support")
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230526190855.2941291-2-robimarko@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/gcc-ipq6018.c | 32 ++++++++++++++++----------------
+ 1 file changed, 16 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/clk/qcom/gcc-ipq6018.c b/drivers/clk/qcom/gcc-ipq6018.c
+index 5c5d1b04ea7af..cde62a11f5736 100644
+--- a/drivers/clk/qcom/gcc-ipq6018.c
++++ b/drivers/clk/qcom/gcc-ipq6018.c
+@@ -4517,24 +4517,24 @@ static const struct qcom_reset_map gcc_ipq6018_resets[] = {
+ [GCC_PCIE0_AHB_ARES] = { 0x75040, 5 },
+ [GCC_PCIE0_AXI_MASTER_STICKY_ARES] = { 0x75040, 6 },
+ [GCC_PCIE0_AXI_SLAVE_STICKY_ARES] = { 0x75040, 7 },
+- [GCC_PPE_FULL_RESET] = { 0x68014, 0 },
+- [GCC_UNIPHY0_SOFT_RESET] = { 0x56004, 0 },
++ [GCC_PPE_FULL_RESET] = { .reg = 0x68014, .bitmask = 0xf0000 },
++ [GCC_UNIPHY0_SOFT_RESET] = { .reg = 0x56004, .bitmask = 0x3ff2 },
+ [GCC_UNIPHY0_XPCS_RESET] = { 0x56004, 2 },
+- [GCC_UNIPHY1_SOFT_RESET] = { 0x56104, 0 },
++ [GCC_UNIPHY1_SOFT_RESET] = { .reg = 0x56104, .bitmask = 0x32 },
+ [GCC_UNIPHY1_XPCS_RESET] = { 0x56104, 2 },
+- [GCC_EDMA_HW_RESET] = { 0x68014, 0 },
+- [GCC_NSSPORT1_RESET] = { 0x68014, 0 },
+- [GCC_NSSPORT2_RESET] = { 0x68014, 0 },
+- [GCC_NSSPORT3_RESET] = { 0x68014, 0 },
+- [GCC_NSSPORT4_RESET] = { 0x68014, 0 },
+- [GCC_NSSPORT5_RESET] = { 0x68014, 0 },
+- [GCC_UNIPHY0_PORT1_ARES] = { 0x56004, 0 },
+- [GCC_UNIPHY0_PORT2_ARES] = { 0x56004, 0 },
+- [GCC_UNIPHY0_PORT3_ARES] = { 0x56004, 0 },
+- [GCC_UNIPHY0_PORT4_ARES] = { 0x56004, 0 },
+- [GCC_UNIPHY0_PORT5_ARES] = { 0x56004, 0 },
+- [GCC_UNIPHY0_PORT_4_5_RESET] = { 0x56004, 0 },
+- [GCC_UNIPHY0_PORT_4_RESET] = { 0x56004, 0 },
++ [GCC_EDMA_HW_RESET] = { .reg = 0x68014, .bitmask = 0x300000 },
++ [GCC_NSSPORT1_RESET] = { .reg = 0x68014, .bitmask = 0x1000003 },
++ [GCC_NSSPORT2_RESET] = { .reg = 0x68014, .bitmask = 0x200000c },
++ [GCC_NSSPORT3_RESET] = { .reg = 0x68014, .bitmask = 0x4000030 },
++ [GCC_NSSPORT4_RESET] = { .reg = 0x68014, .bitmask = 0x8000300 },
++ [GCC_NSSPORT5_RESET] = { .reg = 0x68014, .bitmask = 0x10000c00 },
++ [GCC_UNIPHY0_PORT1_ARES] = { .reg = 0x56004, .bitmask = 0x30 },
++ [GCC_UNIPHY0_PORT2_ARES] = { .reg = 0x56004, .bitmask = 0xc0 },
++ [GCC_UNIPHY0_PORT3_ARES] = { .reg = 0x56004, .bitmask = 0x300 },
++ [GCC_UNIPHY0_PORT4_ARES] = { .reg = 0x56004, .bitmask = 0xc00 },
++ [GCC_UNIPHY0_PORT5_ARES] = { .reg = 0x56004, .bitmask = 0x3000 },
++ [GCC_UNIPHY0_PORT_4_5_RESET] = { .reg = 0x56004, .bitmask = 0x3c02 },
++ [GCC_UNIPHY0_PORT_4_RESET] = { .reg = 0x56004, .bitmask = 0xc02 },
+ [GCC_LPASS_BCR] = {0x1F000, 0},
+ [GCC_UBI32_TBU_BCR] = {0x65000, 0},
+ [GCC_LPASS_TBU_BCR] = {0x6C000, 0},
+--
+2.39.2
+
--- /dev/null
+From 4b4bfa748b1d7d78eae6ddd4be884402da305065 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 May 2023 20:53:35 +0300
+Subject: clk: qcom: mmcc-msm8974: fix MDSS_GDSC power flags
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit 4e13c7a55cf752887f2b8d8008711dbbc64ea796 ]
+
+Using PWRSTS_RET on msm8974's MDSS_GDSC causes display to stop working.
+The gdsc doesn't fully come out of retention mode. Change it's pwrsts
+flags to PWRSTS_OFF_ON.
+
+Fixes: d399723950c4 ("clk: qcom: gdsc: Fix the handling of PWRSTS_RET support")
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Reviewed-by: Rajendra Nayak <quic_rjendra@quicinc.com>
+Tested-by: Luca Weiss <luca@z3ntu.xyz>
+Link: https://lore.kernel.org/r/20230507175335.2321503-2-dmitry.baryshkov@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/mmcc-msm8974.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/qcom/mmcc-msm8974.c b/drivers/clk/qcom/mmcc-msm8974.c
+index d2fec5d5b22e2..82f6bad144a9a 100644
+--- a/drivers/clk/qcom/mmcc-msm8974.c
++++ b/drivers/clk/qcom/mmcc-msm8974.c
+@@ -2384,7 +2384,7 @@ static struct gdsc mdss_gdsc = {
+ .pd = {
+ .name = "mdss",
+ },
+- .pwrsts = PWRSTS_RET_ON,
++ .pwrsts = PWRSTS_OFF_ON,
+ };
+
+ static struct gdsc camss_jpeg_gdsc = {
+--
+2.39.2
+
--- /dev/null
+From acdbb1acc7382b5c65a72241ea2a90dcfedd1480 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 4 Dec 2022 14:45:04 +0200
+Subject: clk: qcom: mmcc-msm8974: move clock parent tables down
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit 28c6c02527757a4b3c63b30d77f7e7d5c112c085 ]
+
+Move clock parent tables down, after the PLL declarataions, so that we
+can use pll hw clock fields in the next commit.
+
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@somainline.org>
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20221204124508.1415713-8-dmitry.baryshkov@linaro.org
+Stable-dep-of: 853c064b5749 ("clk: qcom: mmcc-msm8974: remove oxili_ocmemgx_clk")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/mmcc-msm8974.c | 170 ++++++++++++++++----------------
+ 1 file changed, 85 insertions(+), 85 deletions(-)
+
+diff --git a/drivers/clk/qcom/mmcc-msm8974.c b/drivers/clk/qcom/mmcc-msm8974.c
+index 9008df2305df5..57f1a351c8f67 100644
+--- a/drivers/clk/qcom/mmcc-msm8974.c
++++ b/drivers/clk/qcom/mmcc-msm8974.c
+@@ -42,6 +42,91 @@ enum {
+ P_DSI1PLL_BYTE,
+ };
+
++static struct clk_pll mmpll0 = {
++ .l_reg = 0x0004,
++ .m_reg = 0x0008,
++ .n_reg = 0x000c,
++ .config_reg = 0x0014,
++ .mode_reg = 0x0000,
++ .status_reg = 0x001c,
++ .status_bit = 17,
++ .clkr.hw.init = &(struct clk_init_data){
++ .name = "mmpll0",
++ .parent_names = (const char *[]){ "xo" },
++ .num_parents = 1,
++ .ops = &clk_pll_ops,
++ },
++};
++
++static struct clk_regmap mmpll0_vote = {
++ .enable_reg = 0x0100,
++ .enable_mask = BIT(0),
++ .hw.init = &(struct clk_init_data){
++ .name = "mmpll0_vote",
++ .parent_names = (const char *[]){ "mmpll0" },
++ .num_parents = 1,
++ .ops = &clk_pll_vote_ops,
++ },
++};
++
++static struct clk_pll mmpll1 = {
++ .l_reg = 0x0044,
++ .m_reg = 0x0048,
++ .n_reg = 0x004c,
++ .config_reg = 0x0050,
++ .mode_reg = 0x0040,
++ .status_reg = 0x005c,
++ .status_bit = 17,
++ .clkr.hw.init = &(struct clk_init_data){
++ .name = "mmpll1",
++ .parent_names = (const char *[]){ "xo" },
++ .num_parents = 1,
++ .ops = &clk_pll_ops,
++ },
++};
++
++static struct clk_regmap mmpll1_vote = {
++ .enable_reg = 0x0100,
++ .enable_mask = BIT(1),
++ .hw.init = &(struct clk_init_data){
++ .name = "mmpll1_vote",
++ .parent_names = (const char *[]){ "mmpll1" },
++ .num_parents = 1,
++ .ops = &clk_pll_vote_ops,
++ },
++};
++
++static struct clk_pll mmpll2 = {
++ .l_reg = 0x4104,
++ .m_reg = 0x4108,
++ .n_reg = 0x410c,
++ .config_reg = 0x4110,
++ .mode_reg = 0x4100,
++ .status_reg = 0x411c,
++ .clkr.hw.init = &(struct clk_init_data){
++ .name = "mmpll2",
++ .parent_names = (const char *[]){ "xo" },
++ .num_parents = 1,
++ .ops = &clk_pll_ops,
++ },
++};
++
++static struct clk_pll mmpll3 = {
++ .l_reg = 0x0084,
++ .m_reg = 0x0088,
++ .n_reg = 0x008c,
++ .config_reg = 0x0090,
++ .mode_reg = 0x0080,
++ .status_reg = 0x009c,
++ .status_bit = 17,
++ .clkr.hw.init = &(struct clk_init_data){
++ .name = "mmpll3",
++ .parent_names = (const char *[]){ "xo" },
++ .num_parents = 1,
++ .ops = &clk_pll_ops,
++ },
++};
++
+ static const struct parent_map mmcc_xo_mmpll0_mmpll1_gpll0_map[] = {
+ { P_XO, 0 },
+ { P_MMPLL0, 1 },
+@@ -160,91 +245,6 @@ static const char * const mmcc_xo_dsibyte_hdmi_edp_gpll0[] = {
+ "dsi1pllbyte",
+ };
+
+-static struct clk_pll mmpll0 = {
+- .l_reg = 0x0004,
+- .m_reg = 0x0008,
+- .n_reg = 0x000c,
+- .config_reg = 0x0014,
+- .mode_reg = 0x0000,
+- .status_reg = 0x001c,
+- .status_bit = 17,
+- .clkr.hw.init = &(struct clk_init_data){
+- .name = "mmpll0",
+- .parent_names = (const char *[]){ "xo" },
+- .num_parents = 1,
+- .ops = &clk_pll_ops,
+- },
+-};
+-
+-static struct clk_regmap mmpll0_vote = {
+- .enable_reg = 0x0100,
+- .enable_mask = BIT(0),
+- .hw.init = &(struct clk_init_data){
+- .name = "mmpll0_vote",
+- .parent_names = (const char *[]){ "mmpll0" },
+- .num_parents = 1,
+- .ops = &clk_pll_vote_ops,
+- },
+-};
+-
+-static struct clk_pll mmpll1 = {
+- .l_reg = 0x0044,
+- .m_reg = 0x0048,
+- .n_reg = 0x004c,
+- .config_reg = 0x0050,
+- .mode_reg = 0x0040,
+- .status_reg = 0x005c,
+- .status_bit = 17,
+- .clkr.hw.init = &(struct clk_init_data){
+- .name = "mmpll1",
+- .parent_names = (const char *[]){ "xo" },
+- .num_parents = 1,
+- .ops = &clk_pll_ops,
+- },
+-};
+-
+-static struct clk_regmap mmpll1_vote = {
+- .enable_reg = 0x0100,
+- .enable_mask = BIT(1),
+- .hw.init = &(struct clk_init_data){
+- .name = "mmpll1_vote",
+- .parent_names = (const char *[]){ "mmpll1" },
+- .num_parents = 1,
+- .ops = &clk_pll_vote_ops,
+- },
+-};
+-
+-static struct clk_pll mmpll2 = {
+- .l_reg = 0x4104,
+- .m_reg = 0x4108,
+- .n_reg = 0x410c,
+- .config_reg = 0x4110,
+- .mode_reg = 0x4100,
+- .status_reg = 0x411c,
+- .clkr.hw.init = &(struct clk_init_data){
+- .name = "mmpll2",
+- .parent_names = (const char *[]){ "xo" },
+- .num_parents = 1,
+- .ops = &clk_pll_ops,
+- },
+-};
+-
+-static struct clk_pll mmpll3 = {
+- .l_reg = 0x0084,
+- .m_reg = 0x0088,
+- .n_reg = 0x008c,
+- .config_reg = 0x0090,
+- .mode_reg = 0x0080,
+- .status_reg = 0x009c,
+- .status_bit = 17,
+- .clkr.hw.init = &(struct clk_init_data){
+- .name = "mmpll3",
+- .parent_names = (const char *[]){ "xo" },
+- .num_parents = 1,
+- .ops = &clk_pll_ops,
+- },
+-};
+-
+ static struct clk_rcg2 mmss_ahb_clk_src = {
+ .cmd_rcgr = 0x5000,
+ .hid_width = 5,
+--
+2.39.2
+
--- /dev/null
+From 50ff6ced61a43846c26ee164d0cca2c1854431d8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 May 2023 18:33:19 +0300
+Subject: clk: qcom: mmcc-msm8974: remove oxili_ocmemgx_clk
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit 853c064b57491d739bfd0cc35ff75c5ea9c5e8f5 ]
+
+After the internal discussions, it looks like this clock is managed by
+RPM itself. Linux kernel should not touch it on its own, as this causes
+disagreement with RPM. Shutting down this clock causes the OCMEM<->GPU
+interface to stop working, resulting in GPU hangchecks/timeouts.
+
+Fixes: d8b212014e69 ("clk: qcom: Add support for MSM8974's multimedia clock controller (MMCC)")
+Suggested-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Tested-by: Luca Weiss <luca@z3ntu.xyz>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230508153319.2371645-1-dmitry.baryshkov@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/mmcc-msm8974.c | 19 -------------------
+ 1 file changed, 19 deletions(-)
+
+diff --git a/drivers/clk/qcom/mmcc-msm8974.c b/drivers/clk/qcom/mmcc-msm8974.c
+index 4273fce9a4a4c..b90a9f362f5f7 100644
+--- a/drivers/clk/qcom/mmcc-msm8974.c
++++ b/drivers/clk/qcom/mmcc-msm8974.c
+@@ -2204,23 +2204,6 @@ static struct clk_branch ocmemcx_ocmemnoc_clk = {
+ },
+ };
+
+-static struct clk_branch oxili_ocmemgx_clk = {
+- .halt_reg = 0x402c,
+- .clkr = {
+- .enable_reg = 0x402c,
+- .enable_mask = BIT(0),
+- .hw.init = &(struct clk_init_data){
+- .name = "oxili_ocmemgx_clk",
+- .parent_data = (const struct clk_parent_data[]){
+- { .fw_name = "gfx3d_clk_src", .name = "gfx3d_clk_src" },
+- },
+- .num_parents = 1,
+- .flags = CLK_SET_RATE_PARENT,
+- .ops = &clk_branch2_ops,
+- },
+- },
+-};
+-
+ static struct clk_branch ocmemnoc_clk = {
+ .halt_reg = 0x50b4,
+ .clkr = {
+@@ -2512,7 +2495,6 @@ static struct clk_regmap *mmcc_msm8226_clocks[] = {
+ [MMSS_MMSSNOC_AXI_CLK] = &mmss_mmssnoc_axi_clk.clkr,
+ [MMSS_S0_AXI_CLK] = &mmss_s0_axi_clk.clkr,
+ [OCMEMCX_AHB_CLK] = &ocmemcx_ahb_clk.clkr,
+- [OXILI_OCMEMGX_CLK] = &oxili_ocmemgx_clk.clkr,
+ [OXILI_GFX3D_CLK] = &oxili_gfx3d_clk.clkr,
+ [OXILICX_AHB_CLK] = &oxilicx_ahb_clk.clkr,
+ [OXILICX_AXI_CLK] = &oxilicx_axi_clk.clkr,
+@@ -2670,7 +2652,6 @@ static struct clk_regmap *mmcc_msm8974_clocks[] = {
+ [MMSS_S0_AXI_CLK] = &mmss_s0_axi_clk.clkr,
+ [OCMEMCX_AHB_CLK] = &ocmemcx_ahb_clk.clkr,
+ [OCMEMCX_OCMEMNOC_CLK] = &ocmemcx_ocmemnoc_clk.clkr,
+- [OXILI_OCMEMGX_CLK] = &oxili_ocmemgx_clk.clkr,
+ [OCMEMNOC_CLK] = &ocmemnoc_clk.clkr,
+ [OXILI_GFX3D_CLK] = &oxili_gfx3d_clk.clkr,
+ [OXILICX_AHB_CLK] = &oxilicx_ahb_clk.clkr,
+--
+2.39.2
+
--- /dev/null
+From 5c16010e3212a0536cae7c625df9e7dd51b959ab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 4 Dec 2022 14:45:03 +0200
+Subject: clk: qcom: mmcc-msm8974: use ARRAY_SIZE instead of specifying
+ num_parents
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit 4e74e921ea0c576682ffd7981af1d4a73ceaca11 ]
+
+Use ARRAY_SIZE() instead of manually specifying num_parents. This makes
+adding/removing entries to/from parent_data easy and errorproof.
+
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@somainline.org>
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20221204124508.1415713-7-dmitry.baryshkov@linaro.org
+Stable-dep-of: 853c064b5749 ("clk: qcom: mmcc-msm8974: remove oxili_ocmemgx_clk")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/mmcc-msm8974.c | 74 ++++++++++++++++-----------------
+ 1 file changed, 37 insertions(+), 37 deletions(-)
+
+diff --git a/drivers/clk/qcom/mmcc-msm8974.c b/drivers/clk/qcom/mmcc-msm8974.c
+index f74662925a582..9008df2305df5 100644
+--- a/drivers/clk/qcom/mmcc-msm8974.c
++++ b/drivers/clk/qcom/mmcc-msm8974.c
+@@ -252,7 +252,7 @@ static struct clk_rcg2 mmss_ahb_clk_src = {
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "mmss_ahb_clk_src",
+ .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0,
+- .num_parents = 4,
++ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0),
+ .ops = &clk_rcg2_ops,
+ },
+ };
+@@ -289,7 +289,7 @@ static struct clk_rcg2 mmss_axi_clk_src = {
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "mmss_axi_clk_src",
+ .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0,
+- .num_parents = 4,
++ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0),
+ .ops = &clk_rcg2_ops,
+ },
+ };
+@@ -313,7 +313,7 @@ static struct clk_rcg2 ocmemnoc_clk_src = {
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "ocmemnoc_clk_src",
+ .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0,
+- .num_parents = 4,
++ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0),
+ .ops = &clk_rcg2_ops,
+ },
+ };
+@@ -332,7 +332,7 @@ static struct clk_rcg2 csi0_clk_src = {
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "csi0_clk_src",
+ .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0,
+- .num_parents = 4,
++ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0),
+ .ops = &clk_rcg2_ops,
+ },
+ };
+@@ -345,7 +345,7 @@ static struct clk_rcg2 csi1_clk_src = {
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "csi1_clk_src",
+ .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0,
+- .num_parents = 4,
++ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0),
+ .ops = &clk_rcg2_ops,
+ },
+ };
+@@ -358,7 +358,7 @@ static struct clk_rcg2 csi2_clk_src = {
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "csi2_clk_src",
+ .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0,
+- .num_parents = 4,
++ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0),
+ .ops = &clk_rcg2_ops,
+ },
+ };
+@@ -371,7 +371,7 @@ static struct clk_rcg2 csi3_clk_src = {
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "csi3_clk_src",
+ .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0,
+- .num_parents = 4,
++ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0),
+ .ops = &clk_rcg2_ops,
+ },
+ };
+@@ -418,7 +418,7 @@ static struct clk_rcg2 vfe0_clk_src = {
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "vfe0_clk_src",
+ .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0,
+- .num_parents = 4,
++ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0),
+ .ops = &clk_rcg2_ops,
+ },
+ };
+@@ -431,7 +431,7 @@ static struct clk_rcg2 vfe1_clk_src = {
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "vfe1_clk_src",
+ .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0,
+- .num_parents = 4,
++ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0),
+ .ops = &clk_rcg2_ops,
+ },
+ };
+@@ -472,7 +472,7 @@ static struct clk_rcg2 mdp_clk_src = {
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "mdp_clk_src",
+ .parent_names = mmcc_xo_mmpll0_dsi_hdmi_gpll0,
+- .num_parents = 6,
++ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_dsi_hdmi_gpll0),
+ .ops = &clk_rcg2_ops,
+ },
+ };
+@@ -495,7 +495,7 @@ static struct clk_rcg2 jpeg0_clk_src = {
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "jpeg0_clk_src",
+ .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0,
+- .num_parents = 4,
++ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0),
+ .ops = &clk_rcg2_ops,
+ },
+ };
+@@ -508,7 +508,7 @@ static struct clk_rcg2 jpeg1_clk_src = {
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "jpeg1_clk_src",
+ .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0,
+- .num_parents = 4,
++ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0),
+ .ops = &clk_rcg2_ops,
+ },
+ };
+@@ -521,7 +521,7 @@ static struct clk_rcg2 jpeg2_clk_src = {
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "jpeg2_clk_src",
+ .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0,
+- .num_parents = 4,
++ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0),
+ .ops = &clk_rcg2_ops,
+ },
+ };
+@@ -534,7 +534,7 @@ static struct clk_rcg2 pclk0_clk_src = {
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "pclk0_clk_src",
+ .parent_names = mmcc_xo_dsi_hdmi_edp_gpll0,
+- .num_parents = 6,
++ .num_parents = ARRAY_SIZE(mmcc_xo_dsi_hdmi_edp_gpll0),
+ .ops = &clk_pixel_ops,
+ .flags = CLK_SET_RATE_PARENT,
+ },
+@@ -548,7 +548,7 @@ static struct clk_rcg2 pclk1_clk_src = {
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "pclk1_clk_src",
+ .parent_names = mmcc_xo_dsi_hdmi_edp_gpll0,
+- .num_parents = 6,
++ .num_parents = ARRAY_SIZE(mmcc_xo_dsi_hdmi_edp_gpll0),
+ .ops = &clk_pixel_ops,
+ .flags = CLK_SET_RATE_PARENT,
+ },
+@@ -581,7 +581,7 @@ static struct clk_rcg2 vcodec0_clk_src = {
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "vcodec0_clk_src",
+ .parent_names = mmcc_xo_mmpll0_1_3_gpll0,
+- .num_parents = 5,
++ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_1_3_gpll0),
+ .ops = &clk_rcg2_ops,
+ },
+ };
+@@ -599,7 +599,7 @@ static struct clk_rcg2 cci_clk_src = {
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "cci_clk_src",
+ .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0,
+- .num_parents = 4,
++ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0),
+ .ops = &clk_rcg2_ops,
+ },
+ };
+@@ -623,7 +623,7 @@ static struct clk_rcg2 camss_gp0_clk_src = {
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "camss_gp0_clk_src",
+ .parent_names = mmcc_xo_mmpll0_1_gpll1_0,
+- .num_parents = 5,
++ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_1_gpll1_0),
+ .ops = &clk_rcg2_ops,
+ },
+ };
+@@ -637,7 +637,7 @@ static struct clk_rcg2 camss_gp1_clk_src = {
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "camss_gp1_clk_src",
+ .parent_names = mmcc_xo_mmpll0_1_gpll1_0,
+- .num_parents = 5,
++ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_1_gpll1_0),
+ .ops = &clk_rcg2_ops,
+ },
+ };
+@@ -672,7 +672,7 @@ static struct clk_rcg2 mclk0_clk_src = {
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "mclk0_clk_src",
+ .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0,
+- .num_parents = 4,
++ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0),
+ .ops = &clk_rcg2_ops,
+ },
+ };
+@@ -685,7 +685,7 @@ static struct clk_rcg2 mclk1_clk_src = {
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "mclk1_clk_src",
+ .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0,
+- .num_parents = 4,
++ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0),
+ .ops = &clk_rcg2_ops,
+ },
+ };
+@@ -698,7 +698,7 @@ static struct clk_rcg2 mclk2_clk_src = {
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "mclk2_clk_src",
+ .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0,
+- .num_parents = 4,
++ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0),
+ .ops = &clk_rcg2_ops,
+ },
+ };
+@@ -711,7 +711,7 @@ static struct clk_rcg2 mclk3_clk_src = {
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "mclk3_clk_src",
+ .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0,
+- .num_parents = 4,
++ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0),
+ .ops = &clk_rcg2_ops,
+ },
+ };
+@@ -730,7 +730,7 @@ static struct clk_rcg2 csi0phytimer_clk_src = {
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "csi0phytimer_clk_src",
+ .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0,
+- .num_parents = 4,
++ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0),
+ .ops = &clk_rcg2_ops,
+ },
+ };
+@@ -743,7 +743,7 @@ static struct clk_rcg2 csi1phytimer_clk_src = {
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "csi1phytimer_clk_src",
+ .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0,
+- .num_parents = 4,
++ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0),
+ .ops = &clk_rcg2_ops,
+ },
+ };
+@@ -756,7 +756,7 @@ static struct clk_rcg2 csi2phytimer_clk_src = {
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "csi2phytimer_clk_src",
+ .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0,
+- .num_parents = 4,
++ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0),
+ .ops = &clk_rcg2_ops,
+ },
+ };
+@@ -787,7 +787,7 @@ static struct clk_rcg2 cpp_clk_src = {
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "cpp_clk_src",
+ .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0,
+- .num_parents = 4,
++ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0),
+ .ops = &clk_rcg2_ops,
+ },
+ };
+@@ -805,7 +805,7 @@ static struct clk_rcg2 byte0_clk_src = {
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "byte0_clk_src",
+ .parent_names = mmcc_xo_dsibyte_hdmi_edp_gpll0,
+- .num_parents = 6,
++ .num_parents = ARRAY_SIZE(mmcc_xo_dsibyte_hdmi_edp_gpll0),
+ .ops = &clk_byte2_ops,
+ .flags = CLK_SET_RATE_PARENT,
+ },
+@@ -819,7 +819,7 @@ static struct clk_rcg2 byte1_clk_src = {
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "byte1_clk_src",
+ .parent_names = mmcc_xo_dsibyte_hdmi_edp_gpll0,
+- .num_parents = 6,
++ .num_parents = ARRAY_SIZE(mmcc_xo_dsibyte_hdmi_edp_gpll0),
+ .ops = &clk_byte2_ops,
+ .flags = CLK_SET_RATE_PARENT,
+ },
+@@ -838,7 +838,7 @@ static struct clk_rcg2 edpaux_clk_src = {
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "edpaux_clk_src",
+ .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0,
+- .num_parents = 4,
++ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0),
+ .ops = &clk_rcg2_ops,
+ },
+ };
+@@ -857,7 +857,7 @@ static struct clk_rcg2 edplink_clk_src = {
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "edplink_clk_src",
+ .parent_names = mmcc_xo_dsi_hdmi_edp_gpll0,
+- .num_parents = 6,
++ .num_parents = ARRAY_SIZE(mmcc_xo_dsi_hdmi_edp_gpll0),
+ .ops = &clk_rcg2_ops,
+ .flags = CLK_SET_RATE_PARENT,
+ },
+@@ -877,7 +877,7 @@ static struct clk_rcg2 edppixel_clk_src = {
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "edppixel_clk_src",
+ .parent_names = mmcc_xo_dsi_hdmi_edp,
+- .num_parents = 6,
++ .num_parents = ARRAY_SIZE(mmcc_xo_dsi_hdmi_edp),
+ .ops = &clk_edp_pixel_ops,
+ },
+ };
+@@ -895,7 +895,7 @@ static struct clk_rcg2 esc0_clk_src = {
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "esc0_clk_src",
+ .parent_names = mmcc_xo_dsibyte_hdmi_edp_gpll0,
+- .num_parents = 6,
++ .num_parents = ARRAY_SIZE(mmcc_xo_dsibyte_hdmi_edp_gpll0),
+ .ops = &clk_rcg2_ops,
+ },
+ };
+@@ -908,7 +908,7 @@ static struct clk_rcg2 esc1_clk_src = {
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "esc1_clk_src",
+ .parent_names = mmcc_xo_dsibyte_hdmi_edp_gpll0,
+- .num_parents = 6,
++ .num_parents = ARRAY_SIZE(mmcc_xo_dsibyte_hdmi_edp_gpll0),
+ .ops = &clk_rcg2_ops,
+ },
+ };
+@@ -926,7 +926,7 @@ static struct clk_rcg2 extpclk_clk_src = {
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "extpclk_clk_src",
+ .parent_names = mmcc_xo_dsi_hdmi_edp_gpll0,
+- .num_parents = 6,
++ .num_parents = ARRAY_SIZE(mmcc_xo_dsi_hdmi_edp_gpll0),
+ .ops = &clk_byte_ops,
+ .flags = CLK_SET_RATE_PARENT,
+ },
+@@ -945,7 +945,7 @@ static struct clk_rcg2 hdmi_clk_src = {
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "hdmi_clk_src",
+ .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0,
+- .num_parents = 4,
++ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0),
+ .ops = &clk_rcg2_ops,
+ },
+ };
+@@ -963,7 +963,7 @@ static struct clk_rcg2 vsync_clk_src = {
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "vsync_clk_src",
+ .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0,
+- .num_parents = 4,
++ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0),
+ .ops = &clk_rcg2_ops,
+ },
+ };
+--
+2.39.2
+
--- /dev/null
+From 7823e3c9258a23e9e6129d4f5b0689aee6e96ae0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 May 2023 20:53:34 +0300
+Subject: clk: qcom: mmcc-msm8974: use clk_rcg2_shared_ops for mdp_clk_src
+ clock
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit 8fd492e77ff71f68f7311c22f7bc960182465cd7 ]
+
+The mdp_clk_src clock should not be turned off. Instead it should be
+'parked' to the XO, as most of other mdp_clk_src clocks. Fix that by
+using the clk_rcg2_shared_ops.
+
+Fixes: d8b212014e69 ("clk: qcom: Add support for MSM8974's multimedia clock controller (MMCC)")
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Tested-by: Luca Weiss <luca@z3ntu.xyz>
+Acked-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230507175335.2321503-1-dmitry.baryshkov@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/mmcc-msm8974.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/qcom/mmcc-msm8974.c b/drivers/clk/qcom/mmcc-msm8974.c
+index b90a9f362f5f7..d2fec5d5b22e2 100644
+--- a/drivers/clk/qcom/mmcc-msm8974.c
++++ b/drivers/clk/qcom/mmcc-msm8974.c
+@@ -485,7 +485,7 @@ static struct clk_rcg2 mdp_clk_src = {
+ .name = "mdp_clk_src",
+ .parent_data = mmcc_xo_mmpll0_dsi_hdmi_gpll0,
+ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_dsi_hdmi_gpll0),
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+--
+2.39.2
+
--- /dev/null
+From b406fa7418a18c782f5d928908d8dd593cd191be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 4 Dec 2022 14:45:05 +0200
+Subject: clk: qcom: mmcc-msm8974: use parent_hws/_data instead of parent_names
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit a174d29a59ec9462d3e72fd00a9fd05054c4ab20 ]
+
+Convert the clock driver to specify parent data rather than parent
+names, to actually bind using 'clock-names' specified in the DTS rather
+than global clock names. Use parent_hws where possible to refer parent
+clocks directly, skipping the lookup.
+
+Note, the system names for xo clocks were changed from "xo" to
+"xo_board" to follow the example of other platforms. This switches the
+clocks to use DT-provided "xo_board" clock instead of manually
+registered "xo" clock and allows us to drop qcom_cc_register_board_clk()
+call from the driver at some point.
+
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20221204124508.1415713-9-dmitry.baryshkov@linaro.org
+Stable-dep-of: 853c064b5749 ("clk: qcom: mmcc-msm8974: remove oxili_ocmemgx_clk")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/mmcc-msm8974.c | 516 ++++++++++++++++----------------
+ 1 file changed, 264 insertions(+), 252 deletions(-)
+
+diff --git a/drivers/clk/qcom/mmcc-msm8974.c b/drivers/clk/qcom/mmcc-msm8974.c
+index 57f1a351c8f67..4273fce9a4a4c 100644
+--- a/drivers/clk/qcom/mmcc-msm8974.c
++++ b/drivers/clk/qcom/mmcc-msm8974.c
+@@ -52,7 +52,9 @@ static struct clk_pll mmpll0 = {
+ .status_bit = 17,
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "mmpll0",
+- .parent_names = (const char *[]){ "xo" },
++ .parent_data = (const struct clk_parent_data[]){
++ { .fw_name = "xo", .name = "xo_board" },
++ },
+ .num_parents = 1,
+ .ops = &clk_pll_ops,
+ },
+@@ -63,7 +65,9 @@ static struct clk_regmap mmpll0_vote = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "mmpll0_vote",
+- .parent_names = (const char *[]){ "mmpll0" },
++ .parent_hws = (const struct clk_hw*[]){
++ &mmpll0.clkr.hw
++ },
+ .num_parents = 1,
+ .ops = &clk_pll_vote_ops,
+ },
+@@ -79,7 +83,9 @@ static struct clk_pll mmpll1 = {
+ .status_bit = 17,
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "mmpll1",
+- .parent_names = (const char *[]){ "xo" },
++ .parent_data = (const struct clk_parent_data[]){
++ { .fw_name = "xo", .name = "xo_board" },
++ },
+ .num_parents = 1,
+ .ops = &clk_pll_ops,
+ },
+@@ -90,7 +96,9 @@ static struct clk_regmap mmpll1_vote = {
+ .enable_mask = BIT(1),
+ .hw.init = &(struct clk_init_data){
+ .name = "mmpll1_vote",
+- .parent_names = (const char *[]){ "mmpll1" },
++ .parent_hws = (const struct clk_hw*[]){
++ &mmpll1.clkr.hw
++ },
+ .num_parents = 1,
+ .ops = &clk_pll_vote_ops,
+ },
+@@ -105,7 +113,9 @@ static struct clk_pll mmpll2 = {
+ .status_reg = 0x411c,
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "mmpll2",
+- .parent_names = (const char *[]){ "xo" },
++ .parent_data = (const struct clk_parent_data[]){
++ { .fw_name = "xo", .name = "xo_board" },
++ },
+ .num_parents = 1,
+ .ops = &clk_pll_ops,
+ },
+@@ -121,7 +131,9 @@ static struct clk_pll mmpll3 = {
+ .status_bit = 17,
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "mmpll3",
+- .parent_names = (const char *[]){ "xo" },
++ .parent_data = (const struct clk_parent_data[]){
++ { .fw_name = "xo", .name = "xo_board" },
++ },
+ .num_parents = 1,
+ .ops = &clk_pll_ops,
+ },
+@@ -134,11 +146,11 @@ static const struct parent_map mmcc_xo_mmpll0_mmpll1_gpll0_map[] = {
+ { P_GPLL0, 5 }
+ };
+
+-static const char * const mmcc_xo_mmpll0_mmpll1_gpll0[] = {
+- "xo",
+- "mmpll0_vote",
+- "mmpll1_vote",
+- "mmss_gpll0_vote",
++static const struct clk_parent_data mmcc_xo_mmpll0_mmpll1_gpll0[] = {
++ { .fw_name = "xo", .name = "xo_board" },
++ { .hw = &mmpll0_vote.hw },
++ { .hw = &mmpll1_vote.hw },
++ { .fw_name = "mmss_gpll0_vote", .name = "mmss_gpll0_vote" },
+ };
+
+ static const struct parent_map mmcc_xo_mmpll0_dsi_hdmi_gpll0_map[] = {
+@@ -150,13 +162,13 @@ static const struct parent_map mmcc_xo_mmpll0_dsi_hdmi_gpll0_map[] = {
+ { P_DSI1PLL, 3 }
+ };
+
+-static const char * const mmcc_xo_mmpll0_dsi_hdmi_gpll0[] = {
+- "xo",
+- "mmpll0_vote",
+- "hdmipll",
+- "mmss_gpll0_vote",
+- "dsi0pll",
+- "dsi1pll",
++static const struct clk_parent_data mmcc_xo_mmpll0_dsi_hdmi_gpll0[] = {
++ { .fw_name = "xo", .name = "xo_board" },
++ { .hw = &mmpll0_vote.hw },
++ { .fw_name = "hdmipll", .name = "hdmipll" },
++ { .fw_name = "mmss_gpll0_vote", .name = "mmss_gpll0_vote" },
++ { .fw_name = "dsi0pll", .name = "dsi0pll" },
++ { .fw_name = "dsi1pll", .name = "dsi1pll" },
+ };
+
+ static const struct parent_map mmcc_xo_mmpll0_1_3_gpll0_map[] = {
+@@ -167,12 +179,12 @@ static const struct parent_map mmcc_xo_mmpll0_1_3_gpll0_map[] = {
+ { P_MMPLL3, 3 }
+ };
+
+-static const char * const mmcc_xo_mmpll0_1_3_gpll0[] = {
+- "xo",
+- "mmpll0_vote",
+- "mmpll1_vote",
+- "mmss_gpll0_vote",
+- "mmpll3",
++static const struct clk_parent_data mmcc_xo_mmpll0_1_3_gpll0[] = {
++ { .fw_name = "xo", .name = "xo_board" },
++ { .hw = &mmpll0_vote.hw },
++ { .hw = &mmpll1_vote.hw },
++ { .fw_name = "mmss_gpll0_vote", .name = "mmss_gpll0_vote" },
++ { .hw = &mmpll3.clkr.hw },
+ };
+
+ static const struct parent_map mmcc_xo_mmpll0_1_gpll1_0_map[] = {
+@@ -183,12 +195,12 @@ static const struct parent_map mmcc_xo_mmpll0_1_gpll1_0_map[] = {
+ { P_GPLL1, 4 }
+ };
+
+-static const char * const mmcc_xo_mmpll0_1_gpll1_0[] = {
+- "xo",
+- "mmpll0_vote",
+- "mmpll1_vote",
+- "mmss_gpll0_vote",
+- "gpll1_vote",
++static const struct clk_parent_data mmcc_xo_mmpll0_1_gpll1_0[] = {
++ { .fw_name = "xo", .name = "xo_board" },
++ { .hw = &mmpll0_vote.hw },
++ { .hw = &mmpll1_vote.hw },
++ { .fw_name = "mmss_gpll0_vote", .name = "mmss_gpll0_vote" },
++ { .fw_name = "gpll1_vote", .name = "gpll1_vote" },
+ };
+
+ static const struct parent_map mmcc_xo_dsi_hdmi_edp_map[] = {
+@@ -200,13 +212,13 @@ static const struct parent_map mmcc_xo_dsi_hdmi_edp_map[] = {
+ { P_DSI1PLL, 2 }
+ };
+
+-static const char * const mmcc_xo_dsi_hdmi_edp[] = {
+- "xo",
+- "edp_link_clk",
+- "hdmipll",
+- "edp_vco_div",
+- "dsi0pll",
+- "dsi1pll",
++static const struct clk_parent_data mmcc_xo_dsi_hdmi_edp[] = {
++ { .fw_name = "xo", .name = "xo_board" },
++ { .fw_name = "edp_link_clk", .name = "edp_link_clk" },
++ { .fw_name = "hdmipll", .name = "hdmipll" },
++ { .fw_name = "edp_vco_div", .name = "edp_vco_div" },
++ { .fw_name = "dsi0pll", .name = "dsi0pll" },
++ { .fw_name = "dsi1pll", .name = "dsi1pll" },
+ };
+
+ static const struct parent_map mmcc_xo_dsi_hdmi_edp_gpll0_map[] = {
+@@ -218,13 +230,13 @@ static const struct parent_map mmcc_xo_dsi_hdmi_edp_gpll0_map[] = {
+ { P_DSI1PLL, 2 }
+ };
+
+-static const char * const mmcc_xo_dsi_hdmi_edp_gpll0[] = {
+- "xo",
+- "edp_link_clk",
+- "hdmipll",
+- "gpll0_vote",
+- "dsi0pll",
+- "dsi1pll",
++static const struct clk_parent_data mmcc_xo_dsi_hdmi_edp_gpll0[] = {
++ { .fw_name = "xo", .name = "xo_board" },
++ { .fw_name = "edp_link_clk", .name = "edp_link_clk" },
++ { .fw_name = "hdmipll", .name = "hdmipll" },
++ { .fw_name = "gpll0_vote", .name = "gpll0_vote" },
++ { .fw_name = "dsi0pll", .name = "dsi0pll" },
++ { .fw_name = "dsi1pll", .name = "dsi1pll" },
+ };
+
+ static const struct parent_map mmcc_xo_dsibyte_hdmi_edp_gpll0_map[] = {
+@@ -236,13 +248,13 @@ static const struct parent_map mmcc_xo_dsibyte_hdmi_edp_gpll0_map[] = {
+ { P_DSI1PLL_BYTE, 2 }
+ };
+
+-static const char * const mmcc_xo_dsibyte_hdmi_edp_gpll0[] = {
+- "xo",
+- "edp_link_clk",
+- "hdmipll",
+- "gpll0_vote",
+- "dsi0pllbyte",
+- "dsi1pllbyte",
++static const struct clk_parent_data mmcc_xo_dsibyte_hdmi_edp_gpll0[] = {
++ { .fw_name = "xo", .name = "xo_board" },
++ { .fw_name = "edp_link_clk", .name = "edp_link_clk" },
++ { .fw_name = "hdmipll", .name = "hdmipll" },
++ { .fw_name = "gpll0_vote", .name = "gpll0_vote" },
++ { .fw_name = "dsi0pllbyte", .name = "dsi0pllbyte" },
++ { .fw_name = "dsi1pllbyte", .name = "dsi1pllbyte" },
+ };
+
+ static struct clk_rcg2 mmss_ahb_clk_src = {
+@@ -251,7 +263,7 @@ static struct clk_rcg2 mmss_ahb_clk_src = {
+ .parent_map = mmcc_xo_mmpll0_mmpll1_gpll0_map,
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "mmss_ahb_clk_src",
+- .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0,
++ .parent_data = mmcc_xo_mmpll0_mmpll1_gpll0,
+ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0),
+ .ops = &clk_rcg2_ops,
+ },
+@@ -288,7 +300,7 @@ static struct clk_rcg2 mmss_axi_clk_src = {
+ .freq_tbl = ftbl_mmss_axi_clk,
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "mmss_axi_clk_src",
+- .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0,
++ .parent_data = mmcc_xo_mmpll0_mmpll1_gpll0,
+ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0),
+ .ops = &clk_rcg2_ops,
+ },
+@@ -312,7 +324,7 @@ static struct clk_rcg2 ocmemnoc_clk_src = {
+ .freq_tbl = ftbl_ocmemnoc_clk,
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "ocmemnoc_clk_src",
+- .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0,
++ .parent_data = mmcc_xo_mmpll0_mmpll1_gpll0,
+ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0),
+ .ops = &clk_rcg2_ops,
+ },
+@@ -331,7 +343,7 @@ static struct clk_rcg2 csi0_clk_src = {
+ .freq_tbl = ftbl_camss_csi0_3_clk,
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "csi0_clk_src",
+- .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0,
++ .parent_data = mmcc_xo_mmpll0_mmpll1_gpll0,
+ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0),
+ .ops = &clk_rcg2_ops,
+ },
+@@ -344,7 +356,7 @@ static struct clk_rcg2 csi1_clk_src = {
+ .freq_tbl = ftbl_camss_csi0_3_clk,
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "csi1_clk_src",
+- .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0,
++ .parent_data = mmcc_xo_mmpll0_mmpll1_gpll0,
+ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0),
+ .ops = &clk_rcg2_ops,
+ },
+@@ -357,7 +369,7 @@ static struct clk_rcg2 csi2_clk_src = {
+ .freq_tbl = ftbl_camss_csi0_3_clk,
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "csi2_clk_src",
+- .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0,
++ .parent_data = mmcc_xo_mmpll0_mmpll1_gpll0,
+ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0),
+ .ops = &clk_rcg2_ops,
+ },
+@@ -370,7 +382,7 @@ static struct clk_rcg2 csi3_clk_src = {
+ .freq_tbl = ftbl_camss_csi0_3_clk,
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "csi3_clk_src",
+- .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0,
++ .parent_data = mmcc_xo_mmpll0_mmpll1_gpll0,
+ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0),
+ .ops = &clk_rcg2_ops,
+ },
+@@ -417,7 +429,7 @@ static struct clk_rcg2 vfe0_clk_src = {
+ .freq_tbl = ftbl_camss_vfe_vfe0_1_clk,
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "vfe0_clk_src",
+- .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0,
++ .parent_data = mmcc_xo_mmpll0_mmpll1_gpll0,
+ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0),
+ .ops = &clk_rcg2_ops,
+ },
+@@ -430,7 +442,7 @@ static struct clk_rcg2 vfe1_clk_src = {
+ .freq_tbl = ftbl_camss_vfe_vfe0_1_clk,
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "vfe1_clk_src",
+- .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0,
++ .parent_data = mmcc_xo_mmpll0_mmpll1_gpll0,
+ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0),
+ .ops = &clk_rcg2_ops,
+ },
+@@ -471,7 +483,7 @@ static struct clk_rcg2 mdp_clk_src = {
+ .freq_tbl = ftbl_mdss_mdp_clk,
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "mdp_clk_src",
+- .parent_names = mmcc_xo_mmpll0_dsi_hdmi_gpll0,
++ .parent_data = mmcc_xo_mmpll0_dsi_hdmi_gpll0,
+ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_dsi_hdmi_gpll0),
+ .ops = &clk_rcg2_ops,
+ },
+@@ -494,7 +506,7 @@ static struct clk_rcg2 jpeg0_clk_src = {
+ .freq_tbl = ftbl_camss_jpeg_jpeg0_2_clk,
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "jpeg0_clk_src",
+- .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0,
++ .parent_data = mmcc_xo_mmpll0_mmpll1_gpll0,
+ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0),
+ .ops = &clk_rcg2_ops,
+ },
+@@ -507,7 +519,7 @@ static struct clk_rcg2 jpeg1_clk_src = {
+ .freq_tbl = ftbl_camss_jpeg_jpeg0_2_clk,
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "jpeg1_clk_src",
+- .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0,
++ .parent_data = mmcc_xo_mmpll0_mmpll1_gpll0,
+ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0),
+ .ops = &clk_rcg2_ops,
+ },
+@@ -520,7 +532,7 @@ static struct clk_rcg2 jpeg2_clk_src = {
+ .freq_tbl = ftbl_camss_jpeg_jpeg0_2_clk,
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "jpeg2_clk_src",
+- .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0,
++ .parent_data = mmcc_xo_mmpll0_mmpll1_gpll0,
+ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0),
+ .ops = &clk_rcg2_ops,
+ },
+@@ -533,7 +545,7 @@ static struct clk_rcg2 pclk0_clk_src = {
+ .parent_map = mmcc_xo_dsi_hdmi_edp_gpll0_map,
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "pclk0_clk_src",
+- .parent_names = mmcc_xo_dsi_hdmi_edp_gpll0,
++ .parent_data = mmcc_xo_dsi_hdmi_edp_gpll0,
+ .num_parents = ARRAY_SIZE(mmcc_xo_dsi_hdmi_edp_gpll0),
+ .ops = &clk_pixel_ops,
+ .flags = CLK_SET_RATE_PARENT,
+@@ -547,7 +559,7 @@ static struct clk_rcg2 pclk1_clk_src = {
+ .parent_map = mmcc_xo_dsi_hdmi_edp_gpll0_map,
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "pclk1_clk_src",
+- .parent_names = mmcc_xo_dsi_hdmi_edp_gpll0,
++ .parent_data = mmcc_xo_dsi_hdmi_edp_gpll0,
+ .num_parents = ARRAY_SIZE(mmcc_xo_dsi_hdmi_edp_gpll0),
+ .ops = &clk_pixel_ops,
+ .flags = CLK_SET_RATE_PARENT,
+@@ -580,7 +592,7 @@ static struct clk_rcg2 vcodec0_clk_src = {
+ .freq_tbl = ftbl_venus0_vcodec0_clk,
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "vcodec0_clk_src",
+- .parent_names = mmcc_xo_mmpll0_1_3_gpll0,
++ .parent_data = mmcc_xo_mmpll0_1_3_gpll0,
+ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_1_3_gpll0),
+ .ops = &clk_rcg2_ops,
+ },
+@@ -598,7 +610,7 @@ static struct clk_rcg2 cci_clk_src = {
+ .freq_tbl = ftbl_camss_cci_cci_clk,
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "cci_clk_src",
+- .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0,
++ .parent_data = mmcc_xo_mmpll0_mmpll1_gpll0,
+ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0),
+ .ops = &clk_rcg2_ops,
+ },
+@@ -622,7 +634,7 @@ static struct clk_rcg2 camss_gp0_clk_src = {
+ .freq_tbl = ftbl_camss_gp0_1_clk,
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "camss_gp0_clk_src",
+- .parent_names = mmcc_xo_mmpll0_1_gpll1_0,
++ .parent_data = mmcc_xo_mmpll0_1_gpll1_0,
+ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_1_gpll1_0),
+ .ops = &clk_rcg2_ops,
+ },
+@@ -636,7 +648,7 @@ static struct clk_rcg2 camss_gp1_clk_src = {
+ .freq_tbl = ftbl_camss_gp0_1_clk,
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "camss_gp1_clk_src",
+- .parent_names = mmcc_xo_mmpll0_1_gpll1_0,
++ .parent_data = mmcc_xo_mmpll0_1_gpll1_0,
+ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_1_gpll1_0),
+ .ops = &clk_rcg2_ops,
+ },
+@@ -671,7 +683,7 @@ static struct clk_rcg2 mclk0_clk_src = {
+ .freq_tbl = ftbl_camss_mclk0_3_clk,
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "mclk0_clk_src",
+- .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0,
++ .parent_data = mmcc_xo_mmpll0_mmpll1_gpll0,
+ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0),
+ .ops = &clk_rcg2_ops,
+ },
+@@ -684,7 +696,7 @@ static struct clk_rcg2 mclk1_clk_src = {
+ .freq_tbl = ftbl_camss_mclk0_3_clk,
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "mclk1_clk_src",
+- .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0,
++ .parent_data = mmcc_xo_mmpll0_mmpll1_gpll0,
+ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0),
+ .ops = &clk_rcg2_ops,
+ },
+@@ -697,7 +709,7 @@ static struct clk_rcg2 mclk2_clk_src = {
+ .freq_tbl = ftbl_camss_mclk0_3_clk,
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "mclk2_clk_src",
+- .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0,
++ .parent_data = mmcc_xo_mmpll0_mmpll1_gpll0,
+ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0),
+ .ops = &clk_rcg2_ops,
+ },
+@@ -710,7 +722,7 @@ static struct clk_rcg2 mclk3_clk_src = {
+ .freq_tbl = ftbl_camss_mclk0_3_clk,
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "mclk3_clk_src",
+- .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0,
++ .parent_data = mmcc_xo_mmpll0_mmpll1_gpll0,
+ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0),
+ .ops = &clk_rcg2_ops,
+ },
+@@ -729,7 +741,7 @@ static struct clk_rcg2 csi0phytimer_clk_src = {
+ .freq_tbl = ftbl_camss_phy0_2_csi0_2phytimer_clk,
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "csi0phytimer_clk_src",
+- .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0,
++ .parent_data = mmcc_xo_mmpll0_mmpll1_gpll0,
+ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0),
+ .ops = &clk_rcg2_ops,
+ },
+@@ -742,7 +754,7 @@ static struct clk_rcg2 csi1phytimer_clk_src = {
+ .freq_tbl = ftbl_camss_phy0_2_csi0_2phytimer_clk,
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "csi1phytimer_clk_src",
+- .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0,
++ .parent_data = mmcc_xo_mmpll0_mmpll1_gpll0,
+ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0),
+ .ops = &clk_rcg2_ops,
+ },
+@@ -755,7 +767,7 @@ static struct clk_rcg2 csi2phytimer_clk_src = {
+ .freq_tbl = ftbl_camss_phy0_2_csi0_2phytimer_clk,
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "csi2phytimer_clk_src",
+- .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0,
++ .parent_data = mmcc_xo_mmpll0_mmpll1_gpll0,
+ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0),
+ .ops = &clk_rcg2_ops,
+ },
+@@ -786,7 +798,7 @@ static struct clk_rcg2 cpp_clk_src = {
+ .freq_tbl = ftbl_camss_vfe_cpp_clk,
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "cpp_clk_src",
+- .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0,
++ .parent_data = mmcc_xo_mmpll0_mmpll1_gpll0,
+ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0),
+ .ops = &clk_rcg2_ops,
+ },
+@@ -804,7 +816,7 @@ static struct clk_rcg2 byte0_clk_src = {
+ .freq_tbl = byte_freq_tbl,
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "byte0_clk_src",
+- .parent_names = mmcc_xo_dsibyte_hdmi_edp_gpll0,
++ .parent_data = mmcc_xo_dsibyte_hdmi_edp_gpll0,
+ .num_parents = ARRAY_SIZE(mmcc_xo_dsibyte_hdmi_edp_gpll0),
+ .ops = &clk_byte2_ops,
+ .flags = CLK_SET_RATE_PARENT,
+@@ -818,7 +830,7 @@ static struct clk_rcg2 byte1_clk_src = {
+ .freq_tbl = byte_freq_tbl,
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "byte1_clk_src",
+- .parent_names = mmcc_xo_dsibyte_hdmi_edp_gpll0,
++ .parent_data = mmcc_xo_dsibyte_hdmi_edp_gpll0,
+ .num_parents = ARRAY_SIZE(mmcc_xo_dsibyte_hdmi_edp_gpll0),
+ .ops = &clk_byte2_ops,
+ .flags = CLK_SET_RATE_PARENT,
+@@ -837,7 +849,7 @@ static struct clk_rcg2 edpaux_clk_src = {
+ .freq_tbl = ftbl_mdss_edpaux_clk,
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "edpaux_clk_src",
+- .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0,
++ .parent_data = mmcc_xo_mmpll0_mmpll1_gpll0,
+ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0),
+ .ops = &clk_rcg2_ops,
+ },
+@@ -856,7 +868,7 @@ static struct clk_rcg2 edplink_clk_src = {
+ .freq_tbl = ftbl_mdss_edplink_clk,
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "edplink_clk_src",
+- .parent_names = mmcc_xo_dsi_hdmi_edp_gpll0,
++ .parent_data = mmcc_xo_dsi_hdmi_edp_gpll0,
+ .num_parents = ARRAY_SIZE(mmcc_xo_dsi_hdmi_edp_gpll0),
+ .ops = &clk_rcg2_ops,
+ .flags = CLK_SET_RATE_PARENT,
+@@ -876,7 +888,7 @@ static struct clk_rcg2 edppixel_clk_src = {
+ .freq_tbl = edp_pixel_freq_tbl,
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "edppixel_clk_src",
+- .parent_names = mmcc_xo_dsi_hdmi_edp,
++ .parent_data = mmcc_xo_dsi_hdmi_edp,
+ .num_parents = ARRAY_SIZE(mmcc_xo_dsi_hdmi_edp),
+ .ops = &clk_edp_pixel_ops,
+ },
+@@ -894,7 +906,7 @@ static struct clk_rcg2 esc0_clk_src = {
+ .freq_tbl = ftbl_mdss_esc0_1_clk,
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "esc0_clk_src",
+- .parent_names = mmcc_xo_dsibyte_hdmi_edp_gpll0,
++ .parent_data = mmcc_xo_dsibyte_hdmi_edp_gpll0,
+ .num_parents = ARRAY_SIZE(mmcc_xo_dsibyte_hdmi_edp_gpll0),
+ .ops = &clk_rcg2_ops,
+ },
+@@ -907,7 +919,7 @@ static struct clk_rcg2 esc1_clk_src = {
+ .freq_tbl = ftbl_mdss_esc0_1_clk,
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "esc1_clk_src",
+- .parent_names = mmcc_xo_dsibyte_hdmi_edp_gpll0,
++ .parent_data = mmcc_xo_dsibyte_hdmi_edp_gpll0,
+ .num_parents = ARRAY_SIZE(mmcc_xo_dsibyte_hdmi_edp_gpll0),
+ .ops = &clk_rcg2_ops,
+ },
+@@ -925,7 +937,7 @@ static struct clk_rcg2 extpclk_clk_src = {
+ .freq_tbl = extpclk_freq_tbl,
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "extpclk_clk_src",
+- .parent_names = mmcc_xo_dsi_hdmi_edp_gpll0,
++ .parent_data = mmcc_xo_dsi_hdmi_edp_gpll0,
+ .num_parents = ARRAY_SIZE(mmcc_xo_dsi_hdmi_edp_gpll0),
+ .ops = &clk_byte_ops,
+ .flags = CLK_SET_RATE_PARENT,
+@@ -944,7 +956,7 @@ static struct clk_rcg2 hdmi_clk_src = {
+ .freq_tbl = ftbl_mdss_hdmi_clk,
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "hdmi_clk_src",
+- .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0,
++ .parent_data = mmcc_xo_mmpll0_mmpll1_gpll0,
+ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0),
+ .ops = &clk_rcg2_ops,
+ },
+@@ -962,7 +974,7 @@ static struct clk_rcg2 vsync_clk_src = {
+ .freq_tbl = ftbl_mdss_vsync_clk,
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "vsync_clk_src",
+- .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0,
++ .parent_data = mmcc_xo_mmpll0_mmpll1_gpll0,
+ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0),
+ .ops = &clk_rcg2_ops,
+ },
+@@ -975,8 +987,8 @@ static struct clk_branch camss_cci_cci_ahb_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "camss_cci_cci_ahb_clk",
+- .parent_names = (const char *[]){
+- "mmss_ahb_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &mmss_ahb_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .ops = &clk_branch2_ops,
+@@ -991,8 +1003,8 @@ static struct clk_branch camss_cci_cci_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "camss_cci_cci_clk",
+- .parent_names = (const char *[]){
+- "cci_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &cci_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .flags = CLK_SET_RATE_PARENT,
+@@ -1008,8 +1020,8 @@ static struct clk_branch camss_csi0_ahb_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "camss_csi0_ahb_clk",
+- .parent_names = (const char *[]){
+- "mmss_ahb_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &mmss_ahb_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .ops = &clk_branch2_ops,
+@@ -1024,8 +1036,8 @@ static struct clk_branch camss_csi0_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "camss_csi0_clk",
+- .parent_names = (const char *[]){
+- "csi0_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &csi0_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .flags = CLK_SET_RATE_PARENT,
+@@ -1041,8 +1053,8 @@ static struct clk_branch camss_csi0phy_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "camss_csi0phy_clk",
+- .parent_names = (const char *[]){
+- "csi0_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &csi0_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .flags = CLK_SET_RATE_PARENT,
+@@ -1058,8 +1070,8 @@ static struct clk_branch camss_csi0pix_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "camss_csi0pix_clk",
+- .parent_names = (const char *[]){
+- "csi0_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &csi0_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .flags = CLK_SET_RATE_PARENT,
+@@ -1075,8 +1087,8 @@ static struct clk_branch camss_csi0rdi_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "camss_csi0rdi_clk",
+- .parent_names = (const char *[]){
+- "csi0_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &csi0_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .flags = CLK_SET_RATE_PARENT,
+@@ -1092,8 +1104,8 @@ static struct clk_branch camss_csi1_ahb_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "camss_csi1_ahb_clk",
+- .parent_names = (const char *[]){
+- "mmss_ahb_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &mmss_ahb_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .ops = &clk_branch2_ops,
+@@ -1108,8 +1120,8 @@ static struct clk_branch camss_csi1_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "camss_csi1_clk",
+- .parent_names = (const char *[]){
+- "csi1_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &csi1_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .flags = CLK_SET_RATE_PARENT,
+@@ -1125,8 +1137,8 @@ static struct clk_branch camss_csi1phy_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "camss_csi1phy_clk",
+- .parent_names = (const char *[]){
+- "csi1_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &csi1_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .flags = CLK_SET_RATE_PARENT,
+@@ -1142,8 +1154,8 @@ static struct clk_branch camss_csi1pix_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "camss_csi1pix_clk",
+- .parent_names = (const char *[]){
+- "csi1_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &csi1_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .flags = CLK_SET_RATE_PARENT,
+@@ -1159,8 +1171,8 @@ static struct clk_branch camss_csi1rdi_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "camss_csi1rdi_clk",
+- .parent_names = (const char *[]){
+- "csi1_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &csi1_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .flags = CLK_SET_RATE_PARENT,
+@@ -1176,8 +1188,8 @@ static struct clk_branch camss_csi2_ahb_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "camss_csi2_ahb_clk",
+- .parent_names = (const char *[]){
+- "mmss_ahb_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &mmss_ahb_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .ops = &clk_branch2_ops,
+@@ -1192,8 +1204,8 @@ static struct clk_branch camss_csi2_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "camss_csi2_clk",
+- .parent_names = (const char *[]){
+- "csi2_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &csi2_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .flags = CLK_SET_RATE_PARENT,
+@@ -1209,8 +1221,8 @@ static struct clk_branch camss_csi2phy_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "camss_csi2phy_clk",
+- .parent_names = (const char *[]){
+- "csi2_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &csi2_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .flags = CLK_SET_RATE_PARENT,
+@@ -1226,8 +1238,8 @@ static struct clk_branch camss_csi2pix_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "camss_csi2pix_clk",
+- .parent_names = (const char *[]){
+- "csi2_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &csi2_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .flags = CLK_SET_RATE_PARENT,
+@@ -1243,8 +1255,8 @@ static struct clk_branch camss_csi2rdi_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "camss_csi2rdi_clk",
+- .parent_names = (const char *[]){
+- "csi2_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &csi2_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .flags = CLK_SET_RATE_PARENT,
+@@ -1260,8 +1272,8 @@ static struct clk_branch camss_csi3_ahb_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "camss_csi3_ahb_clk",
+- .parent_names = (const char *[]){
+- "mmss_ahb_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &mmss_ahb_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .ops = &clk_branch2_ops,
+@@ -1276,8 +1288,8 @@ static struct clk_branch camss_csi3_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "camss_csi3_clk",
+- .parent_names = (const char *[]){
+- "csi3_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &csi3_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .flags = CLK_SET_RATE_PARENT,
+@@ -1293,8 +1305,8 @@ static struct clk_branch camss_csi3phy_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "camss_csi3phy_clk",
+- .parent_names = (const char *[]){
+- "csi3_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &csi3_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .flags = CLK_SET_RATE_PARENT,
+@@ -1310,8 +1322,8 @@ static struct clk_branch camss_csi3pix_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "camss_csi3pix_clk",
+- .parent_names = (const char *[]){
+- "csi3_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &csi3_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .flags = CLK_SET_RATE_PARENT,
+@@ -1327,8 +1339,8 @@ static struct clk_branch camss_csi3rdi_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "camss_csi3rdi_clk",
+- .parent_names = (const char *[]){
+- "csi3_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &csi3_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .flags = CLK_SET_RATE_PARENT,
+@@ -1344,8 +1356,8 @@ static struct clk_branch camss_csi_vfe0_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "camss_csi_vfe0_clk",
+- .parent_names = (const char *[]){
+- "vfe0_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &vfe0_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .flags = CLK_SET_RATE_PARENT,
+@@ -1361,8 +1373,8 @@ static struct clk_branch camss_csi_vfe1_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "camss_csi_vfe1_clk",
+- .parent_names = (const char *[]){
+- "vfe1_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &vfe1_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .flags = CLK_SET_RATE_PARENT,
+@@ -1378,8 +1390,8 @@ static struct clk_branch camss_gp0_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "camss_gp0_clk",
+- .parent_names = (const char *[]){
+- "camss_gp0_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &camss_gp0_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .flags = CLK_SET_RATE_PARENT,
+@@ -1395,8 +1407,8 @@ static struct clk_branch camss_gp1_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "camss_gp1_clk",
+- .parent_names = (const char *[]){
+- "camss_gp1_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &camss_gp1_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .flags = CLK_SET_RATE_PARENT,
+@@ -1412,8 +1424,8 @@ static struct clk_branch camss_ispif_ahb_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "camss_ispif_ahb_clk",
+- .parent_names = (const char *[]){
+- "mmss_ahb_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &mmss_ahb_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .ops = &clk_branch2_ops,
+@@ -1428,8 +1440,8 @@ static struct clk_branch camss_jpeg_jpeg0_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "camss_jpeg_jpeg0_clk",
+- .parent_names = (const char *[]){
+- "jpeg0_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &jpeg0_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .flags = CLK_SET_RATE_PARENT,
+@@ -1445,8 +1457,8 @@ static struct clk_branch camss_jpeg_jpeg1_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "camss_jpeg_jpeg1_clk",
+- .parent_names = (const char *[]){
+- "jpeg1_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &jpeg1_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .flags = CLK_SET_RATE_PARENT,
+@@ -1462,8 +1474,8 @@ static struct clk_branch camss_jpeg_jpeg2_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "camss_jpeg_jpeg2_clk",
+- .parent_names = (const char *[]){
+- "jpeg2_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &jpeg2_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .flags = CLK_SET_RATE_PARENT,
+@@ -1479,8 +1491,8 @@ static struct clk_branch camss_jpeg_jpeg_ahb_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "camss_jpeg_jpeg_ahb_clk",
+- .parent_names = (const char *[]){
+- "mmss_ahb_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &mmss_ahb_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .ops = &clk_branch2_ops,
+@@ -1495,8 +1507,8 @@ static struct clk_branch camss_jpeg_jpeg_axi_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "camss_jpeg_jpeg_axi_clk",
+- .parent_names = (const char *[]){
+- "mmss_axi_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &mmss_axi_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .ops = &clk_branch2_ops,
+@@ -1511,8 +1523,8 @@ static struct clk_branch camss_jpeg_jpeg_ocmemnoc_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "camss_jpeg_jpeg_ocmemnoc_clk",
+- .parent_names = (const char *[]){
+- "ocmemnoc_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &ocmemnoc_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .flags = CLK_SET_RATE_PARENT,
+@@ -1528,8 +1540,8 @@ static struct clk_branch camss_mclk0_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "camss_mclk0_clk",
+- .parent_names = (const char *[]){
+- "mclk0_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &mclk0_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .flags = CLK_SET_RATE_PARENT,
+@@ -1545,8 +1557,8 @@ static struct clk_branch camss_mclk1_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "camss_mclk1_clk",
+- .parent_names = (const char *[]){
+- "mclk1_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &mclk1_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .flags = CLK_SET_RATE_PARENT,
+@@ -1562,8 +1574,8 @@ static struct clk_branch camss_mclk2_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "camss_mclk2_clk",
+- .parent_names = (const char *[]){
+- "mclk2_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &mclk2_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .flags = CLK_SET_RATE_PARENT,
+@@ -1579,8 +1591,8 @@ static struct clk_branch camss_mclk3_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "camss_mclk3_clk",
+- .parent_names = (const char *[]){
+- "mclk3_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &mclk3_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .flags = CLK_SET_RATE_PARENT,
+@@ -1596,8 +1608,8 @@ static struct clk_branch camss_micro_ahb_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "camss_micro_ahb_clk",
+- .parent_names = (const char *[]){
+- "mmss_ahb_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &mmss_ahb_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .ops = &clk_branch2_ops,
+@@ -1612,8 +1624,8 @@ static struct clk_branch camss_phy0_csi0phytimer_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "camss_phy0_csi0phytimer_clk",
+- .parent_names = (const char *[]){
+- "csi0phytimer_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &csi0phytimer_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .flags = CLK_SET_RATE_PARENT,
+@@ -1629,8 +1641,8 @@ static struct clk_branch camss_phy1_csi1phytimer_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "camss_phy1_csi1phytimer_clk",
+- .parent_names = (const char *[]){
+- "csi1phytimer_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &csi1phytimer_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .flags = CLK_SET_RATE_PARENT,
+@@ -1646,8 +1658,8 @@ static struct clk_branch camss_phy2_csi2phytimer_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "camss_phy2_csi2phytimer_clk",
+- .parent_names = (const char *[]){
+- "csi2phytimer_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &csi2phytimer_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .flags = CLK_SET_RATE_PARENT,
+@@ -1663,8 +1675,8 @@ static struct clk_branch camss_top_ahb_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "camss_top_ahb_clk",
+- .parent_names = (const char *[]){
+- "mmss_ahb_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &mmss_ahb_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .ops = &clk_branch2_ops,
+@@ -1679,8 +1691,8 @@ static struct clk_branch camss_vfe_cpp_ahb_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "camss_vfe_cpp_ahb_clk",
+- .parent_names = (const char *[]){
+- "mmss_ahb_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &mmss_ahb_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .ops = &clk_branch2_ops,
+@@ -1695,8 +1707,8 @@ static struct clk_branch camss_vfe_cpp_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "camss_vfe_cpp_clk",
+- .parent_names = (const char *[]){
+- "cpp_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &cpp_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .flags = CLK_SET_RATE_PARENT,
+@@ -1712,8 +1724,8 @@ static struct clk_branch camss_vfe_vfe0_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "camss_vfe_vfe0_clk",
+- .parent_names = (const char *[]){
+- "vfe0_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &vfe0_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .flags = CLK_SET_RATE_PARENT,
+@@ -1729,8 +1741,8 @@ static struct clk_branch camss_vfe_vfe1_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "camss_vfe_vfe1_clk",
+- .parent_names = (const char *[]){
+- "vfe1_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &vfe1_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .flags = CLK_SET_RATE_PARENT,
+@@ -1746,8 +1758,8 @@ static struct clk_branch camss_vfe_vfe_ahb_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "camss_vfe_vfe_ahb_clk",
+- .parent_names = (const char *[]){
+- "mmss_ahb_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &mmss_ahb_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .ops = &clk_branch2_ops,
+@@ -1762,8 +1774,8 @@ static struct clk_branch camss_vfe_vfe_axi_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "camss_vfe_vfe_axi_clk",
+- .parent_names = (const char *[]){
+- "mmss_axi_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &mmss_axi_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .ops = &clk_branch2_ops,
+@@ -1778,8 +1790,8 @@ static struct clk_branch camss_vfe_vfe_ocmemnoc_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "camss_vfe_vfe_ocmemnoc_clk",
+- .parent_names = (const char *[]){
+- "ocmemnoc_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &ocmemnoc_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .flags = CLK_SET_RATE_PARENT,
+@@ -1795,8 +1807,8 @@ static struct clk_branch mdss_ahb_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "mdss_ahb_clk",
+- .parent_names = (const char *[]){
+- "mmss_ahb_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &mmss_ahb_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .ops = &clk_branch2_ops,
+@@ -1811,8 +1823,8 @@ static struct clk_branch mdss_axi_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "mdss_axi_clk",
+- .parent_names = (const char *[]){
+- "mmss_axi_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &mmss_axi_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .flags = CLK_SET_RATE_PARENT,
+@@ -1828,8 +1840,8 @@ static struct clk_branch mdss_byte0_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "mdss_byte0_clk",
+- .parent_names = (const char *[]){
+- "byte0_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &byte0_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .flags = CLK_SET_RATE_PARENT,
+@@ -1845,8 +1857,8 @@ static struct clk_branch mdss_byte1_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "mdss_byte1_clk",
+- .parent_names = (const char *[]){
+- "byte1_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &byte1_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .flags = CLK_SET_RATE_PARENT,
+@@ -1862,8 +1874,8 @@ static struct clk_branch mdss_edpaux_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "mdss_edpaux_clk",
+- .parent_names = (const char *[]){
+- "edpaux_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &edpaux_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .flags = CLK_SET_RATE_PARENT,
+@@ -1879,8 +1891,8 @@ static struct clk_branch mdss_edplink_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "mdss_edplink_clk",
+- .parent_names = (const char *[]){
+- "edplink_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &edplink_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .flags = CLK_SET_RATE_PARENT,
+@@ -1896,8 +1908,8 @@ static struct clk_branch mdss_edppixel_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "mdss_edppixel_clk",
+- .parent_names = (const char *[]){
+- "edppixel_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &edppixel_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .flags = CLK_SET_RATE_PARENT,
+@@ -1913,8 +1925,8 @@ static struct clk_branch mdss_esc0_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "mdss_esc0_clk",
+- .parent_names = (const char *[]){
+- "esc0_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &esc0_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .flags = CLK_SET_RATE_PARENT,
+@@ -1930,8 +1942,8 @@ static struct clk_branch mdss_esc1_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "mdss_esc1_clk",
+- .parent_names = (const char *[]){
+- "esc1_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &esc1_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .flags = CLK_SET_RATE_PARENT,
+@@ -1947,8 +1959,8 @@ static struct clk_branch mdss_extpclk_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "mdss_extpclk_clk",
+- .parent_names = (const char *[]){
+- "extpclk_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &extpclk_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .flags = CLK_SET_RATE_PARENT,
+@@ -1964,8 +1976,8 @@ static struct clk_branch mdss_hdmi_ahb_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "mdss_hdmi_ahb_clk",
+- .parent_names = (const char *[]){
+- "mmss_ahb_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &mmss_ahb_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .ops = &clk_branch2_ops,
+@@ -1980,8 +1992,8 @@ static struct clk_branch mdss_hdmi_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "mdss_hdmi_clk",
+- .parent_names = (const char *[]){
+- "hdmi_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &hdmi_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .flags = CLK_SET_RATE_PARENT,
+@@ -1997,8 +2009,8 @@ static struct clk_branch mdss_mdp_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "mdss_mdp_clk",
+- .parent_names = (const char *[]){
+- "mdp_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &mdp_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .flags = CLK_SET_RATE_PARENT,
+@@ -2014,8 +2026,8 @@ static struct clk_branch mdss_mdp_lut_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "mdss_mdp_lut_clk",
+- .parent_names = (const char *[]){
+- "mdp_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &mdp_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .flags = CLK_SET_RATE_PARENT,
+@@ -2031,8 +2043,8 @@ static struct clk_branch mdss_pclk0_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "mdss_pclk0_clk",
+- .parent_names = (const char *[]){
+- "pclk0_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &pclk0_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .flags = CLK_SET_RATE_PARENT,
+@@ -2048,8 +2060,8 @@ static struct clk_branch mdss_pclk1_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "mdss_pclk1_clk",
+- .parent_names = (const char *[]){
+- "pclk1_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &pclk1_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .flags = CLK_SET_RATE_PARENT,
+@@ -2065,8 +2077,8 @@ static struct clk_branch mdss_vsync_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "mdss_vsync_clk",
+- .parent_names = (const char *[]){
+- "vsync_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &vsync_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .flags = CLK_SET_RATE_PARENT,
+@@ -2082,8 +2094,8 @@ static struct clk_branch mmss_misc_ahb_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "mmss_misc_ahb_clk",
+- .parent_names = (const char *[]){
+- "mmss_ahb_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &mmss_ahb_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .ops = &clk_branch2_ops,
+@@ -2098,8 +2110,8 @@ static struct clk_branch mmss_mmssnoc_ahb_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "mmss_mmssnoc_ahb_clk",
+- .parent_names = (const char *[]){
+- "mmss_ahb_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &mmss_ahb_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .ops = &clk_branch2_ops,
+@@ -2115,8 +2127,8 @@ static struct clk_branch mmss_mmssnoc_bto_ahb_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "mmss_mmssnoc_bto_ahb_clk",
+- .parent_names = (const char *[]){
+- "mmss_ahb_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &mmss_ahb_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .ops = &clk_branch2_ops,
+@@ -2132,8 +2144,8 @@ static struct clk_branch mmss_mmssnoc_axi_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "mmss_mmssnoc_axi_clk",
+- .parent_names = (const char *[]){
+- "mmss_axi_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &mmss_axi_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .flags = CLK_SET_RATE_PARENT | CLK_IGNORE_UNUSED,
+@@ -2149,8 +2161,8 @@ static struct clk_branch mmss_s0_axi_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "mmss_s0_axi_clk",
+- .parent_names = (const char *[]){
+- "mmss_axi_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &mmss_axi_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .ops = &clk_branch2_ops,
+@@ -2166,8 +2178,8 @@ static struct clk_branch ocmemcx_ahb_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "ocmemcx_ahb_clk",
+- .parent_names = (const char *[]){
+- "mmss_ahb_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &mmss_ahb_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .ops = &clk_branch2_ops,
+@@ -2182,8 +2194,8 @@ static struct clk_branch ocmemcx_ocmemnoc_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "ocmemcx_ocmemnoc_clk",
+- .parent_names = (const char *[]){
+- "ocmemnoc_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &ocmemnoc_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .flags = CLK_SET_RATE_PARENT,
+@@ -2199,8 +2211,8 @@ static struct clk_branch oxili_ocmemgx_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "oxili_ocmemgx_clk",
+- .parent_names = (const char *[]){
+- "gfx3d_clk_src",
++ .parent_data = (const struct clk_parent_data[]){
++ { .fw_name = "gfx3d_clk_src", .name = "gfx3d_clk_src" },
+ },
+ .num_parents = 1,
+ .flags = CLK_SET_RATE_PARENT,
+@@ -2216,8 +2228,8 @@ static struct clk_branch ocmemnoc_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "ocmemnoc_clk",
+- .parent_names = (const char *[]){
+- "ocmemnoc_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &ocmemnoc_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .flags = CLK_SET_RATE_PARENT,
+@@ -2233,8 +2245,8 @@ static struct clk_branch oxili_gfx3d_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "oxili_gfx3d_clk",
+- .parent_names = (const char *[]){
+- "gfx3d_clk_src",
++ .parent_data = (const struct clk_parent_data[]){
++ { .fw_name = "gfx3d_clk_src", .name = "gfx3d_clk_src" },
+ },
+ .num_parents = 1,
+ .flags = CLK_SET_RATE_PARENT,
+@@ -2250,8 +2262,8 @@ static struct clk_branch oxilicx_ahb_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "oxilicx_ahb_clk",
+- .parent_names = (const char *[]){
+- "mmss_ahb_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &mmss_ahb_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .ops = &clk_branch2_ops,
+@@ -2266,8 +2278,8 @@ static struct clk_branch oxilicx_axi_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "oxilicx_axi_clk",
+- .parent_names = (const char *[]){
+- "mmss_axi_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &mmss_axi_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .ops = &clk_branch2_ops,
+@@ -2282,8 +2294,8 @@ static struct clk_branch venus0_ahb_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "venus0_ahb_clk",
+- .parent_names = (const char *[]){
+- "mmss_ahb_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &mmss_ahb_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .ops = &clk_branch2_ops,
+@@ -2298,8 +2310,8 @@ static struct clk_branch venus0_axi_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "venus0_axi_clk",
+- .parent_names = (const char *[]){
+- "mmss_axi_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &mmss_axi_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .ops = &clk_branch2_ops,
+@@ -2314,8 +2326,8 @@ static struct clk_branch venus0_ocmemnoc_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "venus0_ocmemnoc_clk",
+- .parent_names = (const char *[]){
+- "ocmemnoc_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &ocmemnoc_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .flags = CLK_SET_RATE_PARENT,
+@@ -2331,8 +2343,8 @@ static struct clk_branch venus0_vcodec0_clk = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "venus0_vcodec0_clk",
+- .parent_names = (const char *[]){
+- "vcodec0_clk_src",
++ .parent_hws = (const struct clk_hw*[]){
++ &vcodec0_clk_src.clkr.hw
+ },
+ .num_parents = 1,
+ .flags = CLK_SET_RATE_PARENT,
+--
+2.39.2
+
--- /dev/null
+From 77dee81895f920cb18d770b39b2373caa7526c07 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Nov 2022 14:28:59 +0100
+Subject: clk: qcom: reset: support resetting multiple bits
+
+From: Robert Marko <robimarko@gmail.com>
+
+[ Upstream commit 4a5210893625f89723ea210d7c630b730abb37ad ]
+
+This patch adds the support for giving the complete bitmask
+in reset structure and reset operation will use this bitmask
+for all reset operations.
+
+Currently, reset structure only takes a single bit for each reset
+and then calculates the bitmask by using the BIT() macro.
+
+However, this is not sufficient anymore for newer SoC-s like IPQ8074,
+IPQ6018 and more, since their networking resets require multiple bits
+to be asserted in order to properly reset the HW block completely.
+
+So, in order to allow asserting multiple bits add "bitmask" field to
+qcom_reset_map, and then use that bitmask value if its populated in the
+driver, if its not populated, then we just default to existing behaviour
+and calculate the bitmask on the fly.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20221107132901.489240-1-robimarko@gmail.com
+Stable-dep-of: 349b5bed539b ("clk: qcom: ipq6018: fix networking resets")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/reset.c | 4 ++--
+ drivers/clk/qcom/reset.h | 1 +
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/qcom/reset.c b/drivers/clk/qcom/reset.c
+index 2a16adb572d2b..0e914ec7aeae1 100644
+--- a/drivers/clk/qcom/reset.c
++++ b/drivers/clk/qcom/reset.c
+@@ -30,7 +30,7 @@ qcom_reset_assert(struct reset_controller_dev *rcdev, unsigned long id)
+
+ rst = to_qcom_reset_controller(rcdev);
+ map = &rst->reset_map[id];
+- mask = BIT(map->bit);
++ mask = map->bitmask ? map->bitmask : BIT(map->bit);
+
+ return regmap_update_bits(rst->regmap, map->reg, mask, mask);
+ }
+@@ -44,7 +44,7 @@ qcom_reset_deassert(struct reset_controller_dev *rcdev, unsigned long id)
+
+ rst = to_qcom_reset_controller(rcdev);
+ map = &rst->reset_map[id];
+- mask = BIT(map->bit);
++ mask = map->bitmask ? map->bitmask : BIT(map->bit);
+
+ return regmap_update_bits(rst->regmap, map->reg, mask, 0);
+ }
+diff --git a/drivers/clk/qcom/reset.h b/drivers/clk/qcom/reset.h
+index b8c113582072b..9a47c838d9b1b 100644
+--- a/drivers/clk/qcom/reset.h
++++ b/drivers/clk/qcom/reset.h
+@@ -12,6 +12,7 @@ struct qcom_reset_map {
+ unsigned int reg;
+ u8 bit;
+ u8 udelay;
++ u32 bitmask;
+ };
+
+ struct regmap;
+--
+2.39.2
+
--- /dev/null
+From 83d12a7c912ef3ea830a9c16ee02a2daf746453f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Apr 2023 15:35:28 +0100
+Subject: coresight: Fix loss of connection info when a module is unloaded
+
+From: James Clark <james.clark@arm.com>
+
+[ Upstream commit c45b2835e7b205783bdfe08cc98fa86a7c5eeb74 ]
+
+child_fwnode should be a read only property based on the DT or ACPI. If
+it's cleared on the parent device when a child is unloaded, then when
+the child is loaded again the connection won't be remade.
+
+child_dev should be cleared instead which signifies that the connection
+should be remade when the child_fwnode registers a new coresight_device.
+
+Similarly the reference count shouldn't be decremented as long as the
+parent device exists. The correct place to drop the reference is in
+coresight_release_platform_data() which is already done.
+
+Reproducible on Juno with the following steps:
+
+ # load all coresight modules.
+ $ cd /sys/bus/coresight/devices/
+ $ echo 1 > tmc_etr0/enable_sink
+ $ echo 1 > etm0/enable_source
+ # Works fine ^
+
+ $ echo 0 > etm0/enable_source
+ $ rmmod coresight-funnel
+ $ modprobe coresight-funnel
+ $ echo 1 > etm0/enable_source
+ -bash: echo: write error: Invalid argument
+
+Fixes: 37ea1ffddffa ("coresight: Use fwnode handle instead of device names")
+Fixes: 2af89ebacf29 ("coresight: Clear the connection field properly")
+Tested-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Reviewed-by: Mike Leach <mike.leach@linaro.org>
+Signed-off-by: James Clark <james.clark@arm.com>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Link: https://lore.kernel.org/r/20230425143542.2305069-2-james.clark@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/coresight/coresight-core.c | 9 ++-------
+ 1 file changed, 2 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/hwtracing/coresight/coresight-core.c b/drivers/hwtracing/coresight/coresight-core.c
+index f3068175ca9d9..bcb08fadccf21 100644
+--- a/drivers/hwtracing/coresight/coresight-core.c
++++ b/drivers/hwtracing/coresight/coresight-core.c
+@@ -1446,13 +1446,8 @@ static int coresight_remove_match(struct device *dev, void *data)
+ if (csdev->dev.fwnode == conn->child_fwnode) {
+ iterator->orphan = true;
+ coresight_remove_links(iterator, conn);
+- /*
+- * Drop the reference to the handle for the remote
+- * device acquired in parsing the connections from
+- * platform data.
+- */
+- fwnode_handle_put(conn->child_fwnode);
+- conn->child_fwnode = NULL;
++
++ conn->child_dev = NULL;
+ /* No need to continue */
+ break;
+ }
+--
+2.39.2
+
--- /dev/null
+From cc5b7f331ce2fafb7cbfeca928532656235162df Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Jun 2023 15:18:12 +0100
+Subject: cpufreq: mediatek: correct voltages for MT7622 and MT7623
+
+From: Daniel Golle <daniel@makrotopia.org>
+
+[ Upstream commit f85534113f5ae90a52521cdb9e9977a43ee42626 ]
+
+The MT6380 regulator typically used together with MT7622 does not
+support the current maximum processor and SRAM voltage in the cpufreq
+driver (1360000uV).
+For MT7622 limit processor and SRAM supply voltages to 1350000uV to
+avoid having the tracking algorithm request unsupported voltages from
+the regulator.
+
+On MT7623 there is no separate SRAM supply and the maximum voltage used
+is 1300000uV. Create dedicated platform data for MT7623 to cover that
+case as well.
+
+Fixes: 0883426fd07e3 ("cpufreq: mediatek: Raise proc and sram max voltage for MT7622/7623")
+Suggested-by: Jia-wei Chang <Jia-wei.Chang@mediatek.com>
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/mediatek-cpufreq.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/cpufreq/mediatek-cpufreq.c b/drivers/cpufreq/mediatek-cpufreq.c
+index 9a39a7ccfae96..fef68cb2b38f7 100644
+--- a/drivers/cpufreq/mediatek-cpufreq.c
++++ b/drivers/cpufreq/mediatek-cpufreq.c
+@@ -696,9 +696,16 @@ static const struct mtk_cpufreq_platform_data mt2701_platform_data = {
+ static const struct mtk_cpufreq_platform_data mt7622_platform_data = {
+ .min_volt_shift = 100000,
+ .max_volt_shift = 200000,
+- .proc_max_volt = 1360000,
++ .proc_max_volt = 1350000,
+ .sram_min_volt = 0,
+- .sram_max_volt = 1360000,
++ .sram_max_volt = 1350000,
++ .ccifreq_supported = false,
++};
++
++static const struct mtk_cpufreq_platform_data mt7623_platform_data = {
++ .min_volt_shift = 100000,
++ .max_volt_shift = 200000,
++ .proc_max_volt = 1300000,
+ .ccifreq_supported = false,
+ };
+
+@@ -734,7 +741,7 @@ static const struct of_device_id mtk_cpufreq_machines[] __initconst = {
+ { .compatible = "mediatek,mt2701", .data = &mt2701_platform_data },
+ { .compatible = "mediatek,mt2712", .data = &mt2701_platform_data },
+ { .compatible = "mediatek,mt7622", .data = &mt7622_platform_data },
+- { .compatible = "mediatek,mt7623", .data = &mt7622_platform_data },
++ { .compatible = "mediatek,mt7623", .data = &mt7623_platform_data },
+ { .compatible = "mediatek,mt8167", .data = &mt8516_platform_data },
+ { .compatible = "mediatek,mt817x", .data = &mt2701_platform_data },
+ { .compatible = "mediatek,mt8173", .data = &mt2701_platform_data },
+--
+2.39.2
+
--- /dev/null
+From 8b3d63a7f43c48ce69521f3d32c0231f4e9c0ea2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Feb 2023 15:33:44 +0200
+Subject: device property: Clarify description of returned value in some
+ functions
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 295209ca7b5b3aa6375d6190311b2ae804dbcf65 ]
+
+Some of the functions do not provide Return: section on absence of which
+kernel-doc complains. Besides that several functions return the fwnode
+handle with incremented reference count. Add a respective note to make sure
+that the caller decrements it when it's not needed anymore.
+
+While at it, unify the style of the Return: sections.
+
+Reported-by: Daniel Kaehn <kaehndan@gmail.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Acked-by: Rafael J. Wysocki <rafael@kernel.org>
+Link: https://lore.kernel.org/r/20230217133344.79278-1-andriy.shevchenko@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Stable-dep-of: 39d422555e43 ("drivers: fwnode: fix fwnode_irq_get[_byname]()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/property.c | 124 +++++++++++++++++++++++++++++-----------
+ 1 file changed, 90 insertions(+), 34 deletions(-)
+
+diff --git a/drivers/base/property.c b/drivers/base/property.c
+index f2f7829ad36b9..868adeac2a843 100644
+--- a/drivers/base/property.c
++++ b/drivers/base/property.c
+@@ -30,6 +30,8 @@ EXPORT_SYMBOL_GPL(dev_fwnode);
+ * @propname: Name of the property
+ *
+ * Check if property @propname is present in the device firmware description.
++ *
++ * Return: true if property @propname is present. Otherwise, returns false.
+ */
+ bool device_property_present(struct device *dev, const char *propname)
+ {
+@@ -41,6 +43,8 @@ EXPORT_SYMBOL_GPL(device_property_present);
+ * fwnode_property_present - check if a property of a firmware node is present
+ * @fwnode: Firmware node whose property to check
+ * @propname: Name of the property
++ *
++ * Return: true if property @propname is present. Otherwise, returns false.
+ */
+ bool fwnode_property_present(const struct fwnode_handle *fwnode,
+ const char *propname)
+@@ -500,10 +504,10 @@ EXPORT_SYMBOL_GPL(fwnode_property_match_string);
+ * Obtain a reference based on a named property in an fwnode, with
+ * integer arguments.
+ *
+- * Caller is responsible to call fwnode_handle_put() on the returned
+- * args->fwnode pointer.
++ * The caller is responsible for calling fwnode_handle_put() on the returned
++ * @args->fwnode pointer.
+ *
+- * Returns: %0 on success
++ * Return: %0 on success
+ * %-ENOENT when the index is out of bounds, the index has an empty
+ * reference or the property was not found
+ * %-EINVAL on parse error
+@@ -539,8 +543,11 @@ EXPORT_SYMBOL_GPL(fwnode_property_get_reference_args);
+ *
+ * @index can be used when the named reference holds a table of references.
+ *
+- * Returns pointer to the reference fwnode, or ERR_PTR. Caller is responsible to
+- * call fwnode_handle_put() on the returned fwnode pointer.
++ * The caller is responsible for calling fwnode_handle_put() on the returned
++ * fwnode pointer.
++ *
++ * Return: a pointer to the reference fwnode, when found. Otherwise,
++ * returns an error pointer.
+ */
+ struct fwnode_handle *fwnode_find_reference(const struct fwnode_handle *fwnode,
+ const char *name,
+@@ -559,7 +566,7 @@ EXPORT_SYMBOL_GPL(fwnode_find_reference);
+ * fwnode_get_name - Return the name of a node
+ * @fwnode: The firmware node
+ *
+- * Returns a pointer to the node name.
++ * Return: a pointer to the node name, or %NULL.
+ */
+ const char *fwnode_get_name(const struct fwnode_handle *fwnode)
+ {
+@@ -571,7 +578,7 @@ EXPORT_SYMBOL_GPL(fwnode_get_name);
+ * fwnode_get_name_prefix - Return the prefix of node for printing purposes
+ * @fwnode: The firmware node
+ *
+- * Returns the prefix of a node, intended to be printed right before the node.
++ * Return: the prefix of a node, intended to be printed right before the node.
+ * The prefix works also as a separator between the nodes.
+ */
+ const char *fwnode_get_name_prefix(const struct fwnode_handle *fwnode)
+@@ -583,7 +590,10 @@ const char *fwnode_get_name_prefix(const struct fwnode_handle *fwnode)
+ * fwnode_get_parent - Return parent firwmare node
+ * @fwnode: Firmware whose parent is retrieved
+ *
+- * Return parent firmware node of the given node if possible or %NULL if no
++ * The caller is responsible for calling fwnode_handle_put() on the returned
++ * fwnode pointer.
++ *
++ * Return: parent firmware node of the given node if possible or %NULL if no
+ * parent was available.
+ */
+ struct fwnode_handle *fwnode_get_parent(const struct fwnode_handle *fwnode)
+@@ -600,8 +610,12 @@ EXPORT_SYMBOL_GPL(fwnode_get_parent);
+ * on the passed node, making it suitable for iterating through a
+ * node's parents.
+ *
+- * Returns a node pointer with refcount incremented, use
+- * fwnode_handle_put() on it when done.
++ * The caller is responsible for calling fwnode_handle_put() on the returned
++ * fwnode pointer. Note that this function also puts a reference to @fwnode
++ * unconditionally.
++ *
++ * Return: parent firmware node of the given node if possible or %NULL if no
++ * parent was available.
+ */
+ struct fwnode_handle *fwnode_get_next_parent(struct fwnode_handle *fwnode)
+ {
+@@ -621,8 +635,10 @@ EXPORT_SYMBOL_GPL(fwnode_get_next_parent);
+ * firmware node that has a corresponding struct device and returns that struct
+ * device.
+ *
+- * The caller of this function is expected to call put_device() on the returned
+- * device when they are done.
++ * The caller is responsible for calling put_device() on the returned device
++ * pointer.
++ *
++ * Return: a pointer to the device of the @fwnode's closest ancestor.
+ */
+ struct device *fwnode_get_next_parent_dev(struct fwnode_handle *fwnode)
+ {
+@@ -643,7 +659,7 @@ struct device *fwnode_get_next_parent_dev(struct fwnode_handle *fwnode)
+ * fwnode_count_parents - Return the number of parents a node has
+ * @fwnode: The node the parents of which are to be counted
+ *
+- * Returns the number of parents a node has.
++ * Return: the number of parents a node has.
+ */
+ unsigned int fwnode_count_parents(const struct fwnode_handle *fwnode)
+ {
+@@ -662,12 +678,12 @@ EXPORT_SYMBOL_GPL(fwnode_count_parents);
+ * @fwnode: The node the parent of which is requested
+ * @depth: Distance of the parent from the node
+ *
+- * Returns the nth parent of a node. If there is no parent at the requested
++ * The caller is responsible for calling fwnode_handle_put() on the returned
++ * fwnode pointer.
++ *
++ * Return: the nth parent of a node. If there is no parent at the requested
+ * @depth, %NULL is returned. If @depth is 0, the functionality is equivalent to
+ * fwnode_handle_get(). For @depth == 1, it is fwnode_get_parent() and so on.
+- *
+- * The caller is responsible for calling fwnode_handle_put() for the returned
+- * node.
+ */
+ struct fwnode_handle *fwnode_get_nth_parent(struct fwnode_handle *fwnode,
+ unsigned int depth)
+@@ -692,7 +708,7 @@ EXPORT_SYMBOL_GPL(fwnode_get_nth_parent);
+ *
+ * A node is considered an ancestor of itself too.
+ *
+- * Returns true if @ancestor is an ancestor of @child. Otherwise, returns false.
++ * Return: true if @ancestor is an ancestor of @child. Otherwise, returns false.
+ */
+ bool fwnode_is_ancestor_of(struct fwnode_handle *ancestor, struct fwnode_handle *child)
+ {
+@@ -717,6 +733,10 @@ bool fwnode_is_ancestor_of(struct fwnode_handle *ancestor, struct fwnode_handle
+ * fwnode_get_next_child_node - Return the next child node handle for a node
+ * @fwnode: Firmware node to find the next child node for.
+ * @child: Handle to one of the node's child nodes or a %NULL handle.
++ *
++ * The caller is responsible for calling fwnode_handle_put() on the returned
++ * fwnode pointer. Note that this function also puts a reference to @child
++ * unconditionally.
+ */
+ struct fwnode_handle *
+ fwnode_get_next_child_node(const struct fwnode_handle *fwnode,
+@@ -727,10 +747,13 @@ fwnode_get_next_child_node(const struct fwnode_handle *fwnode,
+ EXPORT_SYMBOL_GPL(fwnode_get_next_child_node);
+
+ /**
+- * fwnode_get_next_available_child_node - Return the next
+- * available child node handle for a node
++ * fwnode_get_next_available_child_node - Return the next available child node handle for a node
+ * @fwnode: Firmware node to find the next child node for.
+ * @child: Handle to one of the node's child nodes or a %NULL handle.
++ *
++ * The caller is responsible for calling fwnode_handle_put() on the returned
++ * fwnode pointer. Note that this function also puts a reference to @child
++ * unconditionally.
+ */
+ struct fwnode_handle *
+ fwnode_get_next_available_child_node(const struct fwnode_handle *fwnode,
+@@ -754,7 +777,11 @@ EXPORT_SYMBOL_GPL(fwnode_get_next_available_child_node);
+ /**
+ * device_get_next_child_node - Return the next child node handle for a device
+ * @dev: Device to find the next child node for.
+- * @child: Handle to one of the device's child nodes or a null handle.
++ * @child: Handle to one of the device's child nodes or a %NULL handle.
++ *
++ * The caller is responsible for calling fwnode_handle_put() on the returned
++ * fwnode pointer. Note that this function also puts a reference to @child
++ * unconditionally.
+ */
+ struct fwnode_handle *device_get_next_child_node(struct device *dev,
+ struct fwnode_handle *child)
+@@ -779,6 +806,9 @@ EXPORT_SYMBOL_GPL(device_get_next_child_node);
+ * fwnode_get_named_child_node - Return first matching named child node handle
+ * @fwnode: Firmware node to find the named child node for.
+ * @childname: String to match child node name against.
++ *
++ * The caller is responsible for calling fwnode_handle_put() on the returned
++ * fwnode pointer.
+ */
+ struct fwnode_handle *
+ fwnode_get_named_child_node(const struct fwnode_handle *fwnode,
+@@ -792,6 +822,9 @@ EXPORT_SYMBOL_GPL(fwnode_get_named_child_node);
+ * device_get_named_child_node - Return first matching named child node handle
+ * @dev: Device to find the named child node for.
+ * @childname: String to match child node name against.
++ *
++ * The caller is responsible for calling fwnode_handle_put() on the returned
++ * fwnode pointer.
+ */
+ struct fwnode_handle *device_get_named_child_node(struct device *dev,
+ const char *childname)
+@@ -804,7 +837,10 @@ EXPORT_SYMBOL_GPL(device_get_named_child_node);
+ * fwnode_handle_get - Obtain a reference to a device node
+ * @fwnode: Pointer to the device node to obtain the reference to.
+ *
+- * Returns the fwnode handle.
++ * The caller is responsible for calling fwnode_handle_put() on the returned
++ * fwnode pointer.
++ *
++ * Return: the fwnode handle.
+ */
+ struct fwnode_handle *fwnode_handle_get(struct fwnode_handle *fwnode)
+ {
+@@ -833,6 +869,8 @@ EXPORT_SYMBOL_GPL(fwnode_handle_put);
+ * fwnode_device_is_available - check if a device is available for use
+ * @fwnode: Pointer to the fwnode of the device.
+ *
++ * Return: true if device is available for use. Otherwise, returns false.
++ *
+ * For fwnode node types that don't implement the .device_is_available()
+ * operation, this function returns true.
+ */
+@@ -851,6 +889,8 @@ EXPORT_SYMBOL_GPL(fwnode_device_is_available);
+ /**
+ * device_get_child_node_count - return the number of child nodes for device
+ * @dev: Device to cound the child nodes for
++ *
++ * Return: the number of child nodes for a given device.
+ */
+ unsigned int device_get_child_node_count(struct device *dev)
+ {
+@@ -926,7 +966,7 @@ EXPORT_SYMBOL_GPL(device_get_phy_mode);
+ * @fwnode: Pointer to the firmware node
+ * @index: Index of the IO range
+ *
+- * Returns a pointer to the mapped memory.
++ * Return: a pointer to the mapped memory.
+ */
+ void __iomem *fwnode_iomap(struct fwnode_handle *fwnode, int index)
+ {
+@@ -939,8 +979,8 @@ EXPORT_SYMBOL(fwnode_iomap);
+ * @fwnode: Pointer to the firmware node
+ * @index: Zero-based index of the IRQ
+ *
+- * Returns Linux IRQ number on success. Other values are determined
+- * accordingly to acpi_/of_ irq_get() operation.
++ * Return: Linux IRQ number on success. Other values are determined
++ * according to acpi_irq_get() or of_irq_get() operation.
+ */
+ int fwnode_irq_get(const struct fwnode_handle *fwnode, unsigned int index)
+ {
+@@ -959,8 +999,7 @@ EXPORT_SYMBOL(fwnode_irq_get);
+ * number of the IRQ resource corresponding to the index of the matched
+ * string.
+ *
+- * Return:
+- * Linux IRQ number on success, or negative errno otherwise.
++ * Return: Linux IRQ number on success, or negative errno otherwise.
+ */
+ int fwnode_irq_get_byname(const struct fwnode_handle *fwnode, const char *name)
+ {
+@@ -982,7 +1021,11 @@ EXPORT_SYMBOL(fwnode_irq_get_byname);
+ * @fwnode: Pointer to the parent firmware node
+ * @prev: Previous endpoint node or %NULL to get the first
+ *
+- * Returns an endpoint firmware node pointer or %NULL if no more endpoints
++ * The caller is responsible for calling fwnode_handle_put() on the returned
++ * fwnode pointer. Note that this function also puts a reference to @prev
++ * unconditionally.
++ *
++ * Return: an endpoint firmware node pointer or %NULL if no more endpoints
+ * are available.
+ */
+ struct fwnode_handle *
+@@ -1022,6 +1065,9 @@ EXPORT_SYMBOL_GPL(fwnode_graph_get_next_endpoint);
+ * fwnode_graph_get_port_parent - Return the device fwnode of a port endpoint
+ * @endpoint: Endpoint firmware node of the port
+ *
++ * The caller is responsible for calling fwnode_handle_put() on the returned
++ * fwnode pointer.
++ *
+ * Return: the firmware node of the device the @endpoint belongs to.
+ */
+ struct fwnode_handle *
+@@ -1043,6 +1089,9 @@ EXPORT_SYMBOL_GPL(fwnode_graph_get_port_parent);
+ * @fwnode: Endpoint firmware node pointing to the remote endpoint
+ *
+ * Extracts firmware node of a remote device the @fwnode points to.
++ *
++ * The caller is responsible for calling fwnode_handle_put() on the returned
++ * fwnode pointer.
+ */
+ struct fwnode_handle *
+ fwnode_graph_get_remote_port_parent(const struct fwnode_handle *fwnode)
+@@ -1063,6 +1112,9 @@ EXPORT_SYMBOL_GPL(fwnode_graph_get_remote_port_parent);
+ * @fwnode: Endpoint firmware node pointing to the remote endpoint
+ *
+ * Extracts firmware node of a remote port the @fwnode points to.
++ *
++ * The caller is responsible for calling fwnode_handle_put() on the returned
++ * fwnode pointer.
+ */
+ struct fwnode_handle *
+ fwnode_graph_get_remote_port(const struct fwnode_handle *fwnode)
+@@ -1076,6 +1128,9 @@ EXPORT_SYMBOL_GPL(fwnode_graph_get_remote_port);
+ * @fwnode: Endpoint firmware node pointing to the remote endpoint
+ *
+ * Extracts firmware node of a remote endpoint the @fwnode points to.
++ *
++ * The caller is responsible for calling fwnode_handle_put() on the returned
++ * fwnode pointer.
+ */
+ struct fwnode_handle *
+ fwnode_graph_get_remote_endpoint(const struct fwnode_handle *fwnode)
+@@ -1103,8 +1158,11 @@ static bool fwnode_graph_remote_available(struct fwnode_handle *ep)
+ * @endpoint: identifier of the endpoint node under the port node
+ * @flags: fwnode lookup flags
+ *
+- * Return the fwnode handle of the local endpoint corresponding the port and
+- * endpoint IDs or NULL if not found.
++ * The caller is responsible for calling fwnode_handle_put() on the returned
++ * fwnode pointer.
++ *
++ * Return: the fwnode handle of the local endpoint corresponding the port and
++ * endpoint IDs or %NULL if not found.
+ *
+ * If FWNODE_GRAPH_ENDPOINT_NEXT is passed in @flags and the specified endpoint
+ * has not been found, look for the closest endpoint ID greater than the
+@@ -1112,9 +1170,6 @@ static bool fwnode_graph_remote_available(struct fwnode_handle *ep)
+ *
+ * Does not return endpoints that belong to disabled devices or endpoints that
+ * are unconnected, unless FWNODE_GRAPH_DEVICE_DISABLED is passed in @flags.
+- *
+- * The returned endpoint needs to be released by calling fwnode_handle_put() on
+- * it when it is not needed any more.
+ */
+ struct fwnode_handle *
+ fwnode_graph_get_endpoint_by_id(const struct fwnode_handle *fwnode,
+@@ -1320,7 +1375,8 @@ EXPORT_SYMBOL_GPL(fwnode_connection_find_match);
+ * @fwnode and other device nodes. @match will be used to convert the
+ * connection description to data the caller is expecting to be returned
+ * through the @matches array.
+- * If @matches is NULL @matches_len is ignored and the total number of resolved
++ *
++ * If @matches is %NULL @matches_len is ignored and the total number of resolved
+ * matches is returned.
+ *
+ * Return: Number of matches resolved, or negative errno.
+--
+2.39.2
+
--- /dev/null
+From 00e28d7b115250f43a2907f16a95848c9b2fd8c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Dec 2022 15:22:18 +0400
+Subject: device property: Fix documentation for fwnode_get_next_parent()
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit f18caf261398a7f2de4fa3f600deb87072fe7b8d ]
+
+Use fwnode_handle_put() on the node pointer to release the refcount.
+Change fwnode_handle_node() to fwnode_handle_put().
+
+Fixes: 233872585de1 ("device property: Add fwnode_get_next_parent()")
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Reviewed-by: Daniel Scally <djrscally@gmail.com>
+Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Link: https://lore.kernel.org/r/20221207112219.2652411-1-linmq006@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Stable-dep-of: 39d422555e43 ("drivers: fwnode: fix fwnode_irq_get[_byname]()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/property.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/base/property.c b/drivers/base/property.c
+index 7f338cb4fb7b8..f2f7829ad36b9 100644
+--- a/drivers/base/property.c
++++ b/drivers/base/property.c
+@@ -601,7 +601,7 @@ EXPORT_SYMBOL_GPL(fwnode_get_parent);
+ * node's parents.
+ *
+ * Returns a node pointer with refcount incremented, use
+- * fwnode_handle_node() on it when done.
++ * fwnode_handle_put() on it when done.
+ */
+ struct fwnode_handle *fwnode_get_next_parent(struct fwnode_handle *fwnode)
+ {
+--
+2.39.2
+
--- /dev/null
+From 99cd537e190bc9bd7daaa2f39d3a84b71af21800 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 May 2023 09:22:33 +0300
+Subject: drivers: fwnode: fix fwnode_irq_get[_byname]()
+
+From: Matti Vaittinen <mazziesaccount@gmail.com>
+
+[ Upstream commit 39d422555e43379516d4d13f5b7162a3dee6e646 ]
+
+The fwnode_irq_get() and the fwnode_irq_get_byname() return 0 upon
+device-tree IRQ mapping failure. This is contradicting the
+fwnode_irq_get_byname() function documentation and can potentially be a
+source of errors like:
+
+int probe(...) {
+ ...
+
+ irq = fwnode_irq_get_byname();
+ if (irq <= 0)
+ return irq;
+
+ ...
+}
+
+Here we do correctly check the return value from fwnode_irq_get_byname()
+but the driver probe will now return success. (There was already one
+such user in-tree).
+
+Change the fwnode_irq_get_byname() to work as documented and make also the
+fwnode_irq_get() follow same common convention returning a negative errno
+upon failure.
+
+Fixes: ca0acb511c21 ("device property: Add fwnode_irq_get_byname")
+Suggested-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Suggested-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Matti Vaittinen <mazziesaccount@gmail.com>
+Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+
+Message-ID: <3e64fe592dc99e27ef9a0b247fc49fa26b6b8a58.1685340157.git.mazziesaccount@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/property.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/base/property.c b/drivers/base/property.c
+index 868adeac2a843..b0c40d9734847 100644
+--- a/drivers/base/property.c
++++ b/drivers/base/property.c
+@@ -979,12 +979,18 @@ EXPORT_SYMBOL(fwnode_iomap);
+ * @fwnode: Pointer to the firmware node
+ * @index: Zero-based index of the IRQ
+ *
+- * Return: Linux IRQ number on success. Other values are determined
+- * according to acpi_irq_get() or of_irq_get() operation.
++ * Return: Linux IRQ number on success. Negative errno on failure.
+ */
+ int fwnode_irq_get(const struct fwnode_handle *fwnode, unsigned int index)
+ {
+- return fwnode_call_int_op(fwnode, irq_get, index);
++ int ret;
++
++ ret = fwnode_call_int_op(fwnode, irq_get, index);
++ /* We treat mapping errors as invalid case */
++ if (ret == 0)
++ return -EINVAL;
++
++ return ret;
+ }
+ EXPORT_SYMBOL(fwnode_irq_get);
+
+--
+2.39.2
+
--- /dev/null
+From 1f573a57e2fd690e6a4d38b72a7f403e9db64620 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jun 2023 22:18:39 -0500
+Subject: drm/amd: Don't try to enable secure display TA multiple times
+
+From: Mario Limonciello <mario.limonciello@amd.com>
+
+[ Upstream commit 5c6d52ff4b61e5267b25be714eb5a9ba2a338199 ]
+
+If the securedisplay TA failed to load the first time, it's unlikely
+to work again after a suspend/resume cycle or reset cycle and it appears
+to be causing problems in futher attempts.
+
+Fixes: e42dfa66d592 ("drm/amdgpu: Add secure display TA load for Renoir")
+Reported-by: Filip Hejsek <filip.hejsek@gmail.com>
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/2633
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+index a3cd816f98a14..0af9fb4098e8a 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+@@ -1959,6 +1959,8 @@ static int psp_securedisplay_initialize(struct psp_context *psp)
+ psp_securedisplay_parse_resp_status(psp, securedisplay_cmd->status);
+ dev_err(psp->adev->dev, "SECUREDISPLAY: query securedisplay TA failed. ret 0x%x\n",
+ securedisplay_cmd->securedisplay_out_message.query_ta.query_cmd_ret);
++ /* don't try again */
++ psp->securedisplay_context.context.bin_desc.size_bytes = 0;
+ }
+
+ return 0;
+--
+2.39.2
+
--- /dev/null
+From 202ee51e08d4cf8a1a209bae02e60eb3d9bd46ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jun 2023 13:18:13 +0200
+Subject: drm/amdgpu: fix number of fence calculations
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Christian König <christian.koenig@amd.com>
+
+[ Upstream commit 570b295248b00c3cf4cf59e397de5cb2361e10c2 ]
+
+Since adding gang submit we need to take the gang size into account
+while reserving fences.
+
+Signed-off-by: Christian König <christian.koenig@amd.com>
+Fixes: 4624459c84d7 ("drm/amdgpu: add gang submit frontend v6")
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+index 365e3fb6a9e5b..b60b6e6149bf7 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+@@ -129,9 +129,6 @@ static int amdgpu_cs_p1_user_fence(struct amdgpu_cs_parser *p,
+ bo = amdgpu_bo_ref(gem_to_amdgpu_bo(gobj));
+ p->uf_entry.priority = 0;
+ p->uf_entry.tv.bo = &bo->tbo;
+- /* One for TTM and two for the CS job */
+- p->uf_entry.tv.num_shared = 3;
+-
+ drm_gem_object_put(gobj);
+
+ size = amdgpu_bo_size(bo);
+@@ -883,15 +880,19 @@ static int amdgpu_cs_parser_bos(struct amdgpu_cs_parser *p,
+
+ mutex_lock(&p->bo_list->bo_list_mutex);
+
+- /* One for TTM and one for the CS job */
++ /* One for TTM and one for each CS job */
+ amdgpu_bo_list_for_each_entry(e, p->bo_list)
+- e->tv.num_shared = 2;
++ e->tv.num_shared = 1 + p->gang_size;
++ p->uf_entry.tv.num_shared = 1 + p->gang_size;
+
+ amdgpu_bo_list_get_list(p->bo_list, &p->validated);
+
+ INIT_LIST_HEAD(&duplicates);
+ amdgpu_vm_get_pd_bo(&fpriv->vm, &p->validated, &p->vm_pd);
+
++ /* Two for VM updates, one for TTM and one for each CS job */
++ p->vm_pd.tv.num_shared = 3 + p->gang_size;
++
+ if (p->uf_entry.tv.bo && !ttm_to_amdgpu_bo(p->uf_entry.tv.bo)->parent)
+ list_add(&p->uf_entry.tv.head, &p->validated);
+
+--
+2.39.2
+
--- /dev/null
+From cd39c8b610ed29150612e36364fdaac7380def97 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jun 2023 18:42:57 -0700
+Subject: drm/i915/guc/slpc: Apply min softlimit correctly
+
+From: Vinay Belgaumkar <vinay.belgaumkar@intel.com>
+
+[ Upstream commit 3e49de73fb89272dea01ba420c7ccbcf6b96aed7 ]
+
+The scenario being fixed here is depicted in the following sequence-
+
+modprobe i915
+echo 1 > /sys/class/drm/card0/gt/gt0/slpc_ignore_eff_freq
+echo 300 > /sys/class/drm/card0/gt_min_freq_mhz (RPn)
+cat /sys/class/drm/card0/gt_cur_freq_mhz --> cur == RPn as expected
+echo 1 > /sys/kernel/debug/dri/0/gt0/reset --> reset
+cat /sys/class/drm/card0/gt_min_freq_mhz --> cached freq is RPn
+cat /sys/class/drm/card0/gt_cur_freq_mhz --> it's not RPn, but RPe!!
+
+When SLPC reinitializes, it sets SLPC min freq to efficient frequency.
+Even if we disable efficient freq post that, we should restore the cached
+min freq (via H2G) for it to take effect.
+
+v2: Clarify commit message (Ashutosh)
+
+Fixes: 95ccf312a1e4 ("drm/i915/guc/slpc: Allow SLPC to use efficient frequency")
+Reviewed-by: Ashutosh Dixit <ashutosh.dixit@intel.com>
+Signed-off-by: Vinay Belgaumkar <vinay.belgaumkar@intel.com>
+Signed-off-by: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230621014257.1769564-1-vinay.belgaumkar@intel.com
+(cherry picked from commit da86b2b13f1d1ca26745b951ac94421f3137539a)
+Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/gt/uc/intel_guc_slpc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/i915/gt/uc/intel_guc_slpc.c b/drivers/gpu/drm/i915/gt/uc/intel_guc_slpc.c
+index fdd895f73f9f1..72ba1c758ca79 100644
+--- a/drivers/gpu/drm/i915/gt/uc/intel_guc_slpc.c
++++ b/drivers/gpu/drm/i915/gt/uc/intel_guc_slpc.c
+@@ -580,7 +580,7 @@ static int slpc_set_softlimits(struct intel_guc_slpc *slpc)
+ if (unlikely(ret))
+ return ret;
+ slpc_to_gt(slpc)->defaults.min_freq = slpc->min_freq_softlimit;
+- } else if (slpc->min_freq_softlimit != slpc->min_freq) {
++ } else {
+ return intel_guc_slpc_set_min_freq(slpc,
+ slpc->min_freq_softlimit);
+ }
+--
+2.39.2
+
--- /dev/null
+From e38104c8b3c6a71a8c4233629035bf4616b46135 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jun 2023 14:17:45 +0300
+Subject: drm/i915/psr: Use hw.adjusted mode when calculating io/fast wake
+ times
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jouni Högander <jouni.hogander@intel.com>
+
+[ Upstream commit 5311892a0ad1d301aafd53ca0154091b3eb407ea ]
+
+Encoder compute config is changing hw.adjusted mode. Uapi.adjusted mode
+doesn't get updated before psr compute config gets called. This causes io
+and fast wake line calculation using adjusted mode containing values before
+encoder adjustments. Fix this by using hw.adjusted mode instead of
+uapi.adjusted mode.
+
+Cc: Stanislav Lisovskiy <stanislav.lisovskiy@intel.com>
+
+Signed-off-by: Jouni Högander <jouni.hogander@intel.com>
+Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/8475
+Fixes: cb42e8ede5b4 ("drm/i915/psr: Use calculated io and fast wake lines")
+Reviewed-by: Mika Kahola <mika.kahola@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230620111745.2870706-1-jouni.hogander@intel.com
+(cherry picked from commit ef0af9db2a21257885116949f471fe5565b2f0ab)
+Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/display/intel_psr.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/display/intel_psr.c b/drivers/gpu/drm/i915/display/intel_psr.c
+index bf18423c7a005..e2d7c0a6802aa 100644
+--- a/drivers/gpu/drm/i915/display/intel_psr.c
++++ b/drivers/gpu/drm/i915/display/intel_psr.c
+@@ -857,9 +857,9 @@ static bool _compute_psr2_wake_times(struct intel_dp *intel_dp,
+ }
+
+ io_wake_lines = intel_usecs_to_scanlines(
+- &crtc_state->uapi.adjusted_mode, io_wake_time);
++ &crtc_state->hw.adjusted_mode, io_wake_time);
+ fast_wake_lines = intel_usecs_to_scanlines(
+- &crtc_state->uapi.adjusted_mode, fast_wake_time);
++ &crtc_state->hw.adjusted_mode, fast_wake_time);
+
+ if (io_wake_lines > max_wake_lines ||
+ fast_wake_lines > max_wake_lines)
+--
+2.39.2
+
--- /dev/null
+From cfcc0992266ac8da707d131bb9560e31cab271ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Apr 2023 12:41:06 +0200
+Subject: dt-bindings: power: reset: qcom-pon: Only allow reboot-mode
+ pre-pmk8350
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit d41dab4c031edaa460a484113394327aa52dc0bd ]
+
+As pointed out by Shazad [1], PMICs using a separate HLOS+PBS scheme
+(so PMK8350 and newer) are expected to pass reboot mode data through SDAM,
+as the reboot mode registers are absent in the HLOS reg space.
+
+Limit the reboot-mode.yaml inclusion to PMICs without a separate PBS
+region.
+
+[1] https://lore.kernel.org/linux-arm-msm/12f13183-c381-25f7-459e-62e0c2b19498@quicinc.com/
+
+Fixes: 03fccdc76dce ("dt-bindings: power: reset: qcom-pon: Add new compatible "qcom,pmk8350-pon"")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Acked-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/devicetree/bindings/power/reset/qcom,pon.yaml | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/Documentation/devicetree/bindings/power/reset/qcom,pon.yaml b/Documentation/devicetree/bindings/power/reset/qcom,pon.yaml
+index d96170eecbd22..0b1eca734d3b1 100644
+--- a/Documentation/devicetree/bindings/power/reset/qcom,pon.yaml
++++ b/Documentation/devicetree/bindings/power/reset/qcom,pon.yaml
+@@ -56,7 +56,6 @@ required:
+ unevaluatedProperties: false
+
+ allOf:
+- - $ref: reboot-mode.yaml#
+ - if:
+ properties:
+ compatible:
+@@ -66,6 +65,9 @@ allOf:
+ - qcom,pms405-pon
+ - qcom,pm8998-pon
+ then:
++ allOf:
++ - $ref: reboot-mode.yaml#
++
+ properties:
+ reg:
+ maxItems: 1
+--
+2.39.2
+
--- /dev/null
+From aefc608180ab29e3d722da0458ed446fc305b9cb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Mar 2023 16:39:53 +0200
+Subject: extcon: Fix kernel doc of property capability fields to avoid
+ warnings
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 73346b9965ebda2feb7fef8629e9b28baee820e3 ]
+
+Kernel documentation has to be synchronized with a code, otherwise
+the validator is not happy:
+
+ Function parameter or member 'usb_bits' not described in 'extcon_cable'
+ Function parameter or member 'chg_bits' not described in 'extcon_cable'
+ Function parameter or member 'jack_bits' not described in 'extcon_cable'
+ Function parameter or member 'disp_bits' not described in 'extcon_cable'
+
+Describe the fields added in the past.
+
+Fixes: ceaa98f442cf ("extcon: Add the support for the capability of each property")
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/extcon/extcon.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/extcon/extcon.c b/drivers/extcon/extcon.c
+index 01fd920685c2c..7141dd0d407d8 100644
+--- a/drivers/extcon/extcon.c
++++ b/drivers/extcon/extcon.c
+@@ -210,6 +210,10 @@ static const struct __extcon_info {
+ * @chg_propval: the array of charger connector properties
+ * @jack_propval: the array of jack connector properties
+ * @disp_propval: the array of display connector properties
++ * @usb_bits: the bit array of the USB connector property capabilities
++ * @chg_bits: the bit array of the charger connector property capabilities
++ * @jack_bits: the bit array of the jack connector property capabilities
++ * @disp_bits: the bit array of the display connector property capabilities
+ */
+ struct extcon_cable {
+ struct extcon_dev *edev;
+--
+2.39.2
+
--- /dev/null
+From de0f1ab292a4a300977d550ff73752b008ed3b1d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Mar 2023 16:39:52 +0200
+Subject: extcon: Fix kernel doc of property fields to avoid warnings
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 7e77e0b7a9f4cdf91cb0950749b40c840ea63efc ]
+
+Kernel documentation has to be synchronized with a code, otherwise
+the validator is not happy:
+
+ Function parameter or member 'usb_propval' not described in 'extcon_cable'
+ Function parameter or member 'chg_propval' not described in 'extcon_cable'
+ Function parameter or member 'jack_propval' not described in 'extcon_cable'
+ Function parameter or member 'disp_propval' not described in 'extcon_cable'
+
+Describe the fields added in the past.
+
+Fixes: 067c1652e7a7 ("extcon: Add the support for extcon property according to extcon type")
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/extcon/extcon.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/extcon/extcon.c b/drivers/extcon/extcon.c
+index e1c71359b6051..01fd920685c2c 100644
+--- a/drivers/extcon/extcon.c
++++ b/drivers/extcon/extcon.c
+@@ -206,6 +206,10 @@ static const struct __extcon_info {
+ * @attr_name: "name" sysfs entry
+ * @attr_state: "state" sysfs entry
+ * @attrs: the array pointing to attr_name and attr_state for attr_g
++ * @usb_propval: the array of USB connector properties
++ * @chg_propval: the array of charger connector properties
++ * @jack_propval: the array of jack connector properties
++ * @disp_propval: the array of display connector properties
+ */
+ struct extcon_cable {
+ struct extcon_dev *edev;
+--
+2.39.2
+
--- /dev/null
+From 9b946fdbf7cdb4ff9ee08c7db7927cbc5db65a98 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Jun 2023 14:19:01 +0800
+Subject: f2fs: check return value of freeze_super()
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit 8bec7dd1b3f7d7769d433d67bde404de948a2d95 ]
+
+freeze_super() can fail, it needs to check its return value and do
+error handling in f2fs_resize_fs().
+
+Fixes: 04f0b2eaa3b3 ("f2fs: ioctl for removing a range from F2FS")
+Fixes: b4b10061ef98 ("f2fs: refactor resize_fs to avoid meta updates in progress")
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/gc.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c
+index 3de887d07c060..aa4d513daa8f8 100644
+--- a/fs/f2fs/gc.c
++++ b/fs/f2fs/gc.c
+@@ -2186,7 +2186,9 @@ int f2fs_resize_fs(struct file *filp, __u64 block_count)
+ if (err)
+ return err;
+
+- freeze_super(sbi->sb);
++ err = freeze_super(sbi->sb);
++ if (err)
++ return err;
+
+ if (f2fs_readonly(sbi->sb)) {
+ thaw_super(sbi->sb);
+--
+2.39.2
+
--- /dev/null
+From 88a00c360eaf69e8c81073b09dcb5ca52aba261b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Apr 2023 00:47:11 +0800
+Subject: f2fs: do not allow to defragment files have FI_COMPRESS_RELEASED
+
+From: Yangtao Li <frank.li@vivo.com>
+
+[ Upstream commit 7cd2e5f75b86a1befa99834f3ed1d735eeff69e6 ]
+
+If a file has FI_COMPRESS_RELEASED, all writes for it should not be
+allowed.
+
+Fixes: 5fdb322ff2c2 ("f2fs: add F2FS_IOC_DECOMPRESS_FILE and F2FS_IOC_COMPRESS_FILE")
+Signed-off-by: Qi Han <hanqi@vivo.com>
+Signed-off-by: Yangtao Li <frank.li@vivo.com>
+Reviewed-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/file.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index dbad2db68f1bc..370c40858b42f 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -2588,6 +2588,11 @@ static int f2fs_defragment_range(struct f2fs_sb_info *sbi,
+
+ inode_lock(inode);
+
++ if (is_inode_flag_set(inode, FI_COMPRESS_RELEASED)) {
++ err = -EINVAL;
++ goto unlock_out;
++ }
++
+ /* if in-place-update policy is enabled, don't waste time here */
+ set_inode_flag(inode, FI_OPU_WRITE);
+ if (f2fs_should_update_inplace(inode, NULL)) {
+@@ -2712,6 +2717,7 @@ static int f2fs_defragment_range(struct f2fs_sb_info *sbi,
+ clear_inode_flag(inode, FI_SKIP_WRITES);
+ out:
+ clear_inode_flag(inode, FI_OPU_WRITE);
++unlock_out:
+ inode_unlock(inode);
+ if (!err)
+ range->len = (u64)total << PAGE_SHIFT;
+--
+2.39.2
+
--- /dev/null
+From 9aadadd22512620a51ae34210180259ed712c18c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Jun 2023 09:41:02 +0800
+Subject: f2fs: fix error path handling in truncate_dnode()
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit 0135c482fa97e2fd8245cb462784112a00ed1211 ]
+
+If truncate_node() fails in truncate_dnode(), it missed to call
+f2fs_put_page(), fix it.
+
+Fixes: 7735730d39d7 ("f2fs: fix to propagate error from __get_meta_page()")
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/node.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c
+index 07419c3e42a52..a010b4bc36d2c 100644
+--- a/fs/f2fs/node.c
++++ b/fs/f2fs/node.c
+@@ -941,8 +941,10 @@ static int truncate_dnode(struct dnode_of_data *dn)
+ dn->ofs_in_node = 0;
+ f2fs_truncate_data_blocks(dn);
+ err = truncate_node(dn);
+- if (err)
++ if (err) {
++ f2fs_put_page(page, 1);
+ return err;
++ }
+
+ return 1;
+ }
+--
+2.39.2
+
--- /dev/null
+From 4c345f909fdf1363d3da790a1341096fac3f3ac1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 14 May 2023 16:07:23 +0800
+Subject: f2fs: fix potential deadlock due to unpaired node_write lock use
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit f082c6b205a06953f26c40bdc7621cc5a58ceb7c ]
+
+If S_NOQUOTA is cleared from inode during data page writeback of quota
+file, it may miss to unlock node_write lock, result in potential
+deadlock, fix to use the lock in paired.
+
+Kworker Thread
+- writepage
+ if (IS_NOQUOTA())
+ f2fs_down_read(&sbi->node_write);
+ - vfs_cleanup_quota_inode
+ - inode->i_flags &= ~S_NOQUOTA;
+ if (IS_NOQUOTA())
+ f2fs_up_read(&sbi->node_write);
+
+Fixes: 79963d967b49 ("f2fs: shrink node_write lock coverage")
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/compress.c | 7 ++++---
+ fs/f2fs/data.c | 7 ++++---
+ 2 files changed, 8 insertions(+), 6 deletions(-)
+
+diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c
+index b160863eca141..e50d5848c1001 100644
+--- a/fs/f2fs/compress.c
++++ b/fs/f2fs/compress.c
+@@ -1235,6 +1235,7 @@ static int f2fs_write_compressed_pages(struct compress_ctx *cc,
+ unsigned int last_index = cc->cluster_size - 1;
+ loff_t psize;
+ int i, err;
++ bool quota_inode = IS_NOQUOTA(inode);
+
+ /* we should bypass data pages to proceed the kworkder jobs */
+ if (unlikely(f2fs_cp_error(sbi))) {
+@@ -1242,7 +1243,7 @@ static int f2fs_write_compressed_pages(struct compress_ctx *cc,
+ goto out_free;
+ }
+
+- if (IS_NOQUOTA(inode)) {
++ if (quota_inode) {
+ /*
+ * We need to wait for node_write to avoid block allocation during
+ * checkpoint. This can only happen to quota writes which can cause
+@@ -1364,7 +1365,7 @@ static int f2fs_write_compressed_pages(struct compress_ctx *cc,
+ set_inode_flag(inode, FI_FIRST_BLOCK_WRITTEN);
+
+ f2fs_put_dnode(&dn);
+- if (IS_NOQUOTA(inode))
++ if (quota_inode)
+ f2fs_up_read(&sbi->node_write);
+ else
+ f2fs_unlock_op(sbi);
+@@ -1390,7 +1391,7 @@ static int f2fs_write_compressed_pages(struct compress_ctx *cc,
+ out_put_dnode:
+ f2fs_put_dnode(&dn);
+ out_unlock_op:
+- if (IS_NOQUOTA(inode))
++ if (quota_inode)
+ f2fs_up_read(&sbi->node_write);
+ else
+ f2fs_unlock_op(sbi);
+diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
+index 36db9aab47790..c230824ab5e6e 100644
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -2759,6 +2759,7 @@ int f2fs_write_single_data_page(struct page *page, int *submitted,
+ loff_t psize = (loff_t)(page->index + 1) << PAGE_SHIFT;
+ unsigned offset = 0;
+ bool need_balance_fs = false;
++ bool quota_inode = IS_NOQUOTA(inode);
+ int err = 0;
+ struct f2fs_io_info fio = {
+ .sbi = sbi,
+@@ -2816,19 +2817,19 @@ int f2fs_write_single_data_page(struct page *page, int *submitted,
+ goto out;
+
+ /* Dentry/quota blocks are controlled by checkpoint */
+- if (S_ISDIR(inode->i_mode) || IS_NOQUOTA(inode)) {
++ if (S_ISDIR(inode->i_mode) || quota_inode) {
+ /*
+ * We need to wait for node_write to avoid block allocation during
+ * checkpoint. This can only happen to quota writes which can cause
+ * the below discard race condition.
+ */
+- if (IS_NOQUOTA(inode))
++ if (quota_inode)
+ f2fs_down_read(&sbi->node_write);
+
+ fio.need_lock = LOCK_DONE;
+ err = f2fs_do_write_data_page(&fio);
+
+- if (IS_NOQUOTA(inode))
++ if (quota_inode)
+ f2fs_up_read(&sbi->node_write);
+
+ goto done;
+--
+2.39.2
+
--- /dev/null
+From 187167ba3fca48210bf32c20943f6be8ab0747a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 May 2023 14:17:25 +0800
+Subject: f2fs: fix to avoid NULL pointer dereference f2fs_write_end_io()
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit d8189834d4348ae608083e1f1f53792cfcc2a9bc ]
+
+butt3rflyh4ck reports a bug as below:
+
+When a thread always calls F2FS_IOC_RESIZE_FS to resize fs, if resize fs is
+failed, f2fs kernel thread would invoke callback function to update f2fs io
+info, it would call f2fs_write_end_io and may trigger null-ptr-deref in
+NODE_MAPPING.
+
+general protection fault, probably for non-canonical address
+KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]
+RIP: 0010:NODE_MAPPING fs/f2fs/f2fs.h:1972 [inline]
+RIP: 0010:f2fs_write_end_io+0x727/0x1050 fs/f2fs/data.c:370
+ <TASK>
+ bio_endio+0x5af/0x6c0 block/bio.c:1608
+ req_bio_endio block/blk-mq.c:761 [inline]
+ blk_update_request+0x5cc/0x1690 block/blk-mq.c:906
+ blk_mq_end_request+0x59/0x4c0 block/blk-mq.c:1023
+ lo_complete_rq+0x1c6/0x280 drivers/block/loop.c:370
+ blk_complete_reqs+0xad/0xe0 block/blk-mq.c:1101
+ __do_softirq+0x1d4/0x8ef kernel/softirq.c:571
+ run_ksoftirqd kernel/softirq.c:939 [inline]
+ run_ksoftirqd+0x31/0x60 kernel/softirq.c:931
+ smpboot_thread_fn+0x659/0x9e0 kernel/smpboot.c:164
+ kthread+0x33e/0x440 kernel/kthread.c:379
+ ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
+
+The root cause is below race case can cause leaving dirty metadata
+in f2fs after filesystem is remount as ro:
+
+Thread A Thread B
+- f2fs_ioc_resize_fs
+ - f2fs_readonly --- return false
+ - f2fs_resize_fs
+ - f2fs_remount
+ - write_checkpoint
+ - set f2fs as ro
+ - free_segment_range
+ - update meta_inode's data
+
+Then, if f2fs_put_super() fails to write_checkpoint due to readonly
+status, and meta_inode's dirty data will be writebacked after node_inode
+is put, finally, f2fs_write_end_io will access NULL pointer on
+sbi->node_inode.
+
+Thread A IRQ context
+- f2fs_put_super
+ - write_checkpoint fails
+ - iput(node_inode)
+ - node_inode = NULL
+ - iput(meta_inode)
+ - write_inode_now
+ - f2fs_write_meta_page
+ - f2fs_write_end_io
+ - NODE_MAPPING(sbi)
+ : access NULL pointer on node_inode
+
+Fixes: b4b10061ef98 ("f2fs: refactor resize_fs to avoid meta updates in progress")
+Reported-by: butt3rflyh4ck <butterflyhuangxx@gmail.com>
+Closes: https://lore.kernel.org/r/1684480657-2375-1-git-send-email-yangtiezhu@loongson.cn
+Tested-by: butt3rflyh4ck <butterflyhuangxx@gmail.com>
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/f2fs.h | 2 +-
+ fs/f2fs/file.c | 2 +-
+ fs/f2fs/gc.c | 21 ++++++++++++++++++---
+ 3 files changed, 20 insertions(+), 5 deletions(-)
+
+diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
+index 8d7dc76e6f935..4d1e48c676fab 100644
+--- a/fs/f2fs/f2fs.h
++++ b/fs/f2fs/f2fs.h
+@@ -3817,7 +3817,7 @@ void f2fs_stop_gc_thread(struct f2fs_sb_info *sbi);
+ block_t f2fs_start_bidx_of_node(unsigned int node_ofs, struct inode *inode);
+ int f2fs_gc(struct f2fs_sb_info *sbi, struct f2fs_gc_control *gc_control);
+ void f2fs_build_gc_manager(struct f2fs_sb_info *sbi);
+-int f2fs_resize_fs(struct f2fs_sb_info *sbi, __u64 block_count);
++int f2fs_resize_fs(struct file *filp, __u64 block_count);
+ int __init f2fs_create_garbage_collection_cache(void);
+ void f2fs_destroy_garbage_collection_cache(void);
+
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index 370c40858b42f..7b94f047cbf79 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -3279,7 +3279,7 @@ static int f2fs_ioc_resize_fs(struct file *filp, unsigned long arg)
+ sizeof(block_count)))
+ return -EFAULT;
+
+- return f2fs_resize_fs(sbi, block_count);
++ return f2fs_resize_fs(filp, block_count);
+ }
+
+ static int f2fs_ioc_enable_verity(struct file *filp, unsigned long arg)
+diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c
+index 7e497f5b349ce..3de887d07c060 100644
+--- a/fs/f2fs/gc.c
++++ b/fs/f2fs/gc.c
+@@ -2110,8 +2110,9 @@ static void update_fs_metadata(struct f2fs_sb_info *sbi, int secs)
+ }
+ }
+
+-int f2fs_resize_fs(struct f2fs_sb_info *sbi, __u64 block_count)
++int f2fs_resize_fs(struct file *filp, __u64 block_count)
+ {
++ struct f2fs_sb_info *sbi = F2FS_I_SB(file_inode(filp));
+ __u64 old_block_count, shrunk_blocks;
+ struct cp_control cpc = { CP_RESIZE, 0, 0, 0 };
+ unsigned int secs;
+@@ -2149,12 +2150,18 @@ int f2fs_resize_fs(struct f2fs_sb_info *sbi, __u64 block_count)
+ return -EINVAL;
+ }
+
++ err = mnt_want_write_file(filp);
++ if (err)
++ return err;
++
+ shrunk_blocks = old_block_count - block_count;
+ secs = div_u64(shrunk_blocks, BLKS_PER_SEC(sbi));
+
+ /* stop other GC */
+- if (!f2fs_down_write_trylock(&sbi->gc_lock))
+- return -EAGAIN;
++ if (!f2fs_down_write_trylock(&sbi->gc_lock)) {
++ err = -EAGAIN;
++ goto out_drop_write;
++ }
+
+ /* stop CP to protect MAIN_SEC in free_segment_range */
+ f2fs_lock_op(sbi);
+@@ -2174,10 +2181,18 @@ int f2fs_resize_fs(struct f2fs_sb_info *sbi, __u64 block_count)
+ out_unlock:
+ f2fs_unlock_op(sbi);
+ f2fs_up_write(&sbi->gc_lock);
++out_drop_write:
++ mnt_drop_write_file(filp);
+ if (err)
+ return err;
+
+ freeze_super(sbi->sb);
++
++ if (f2fs_readonly(sbi->sb)) {
++ thaw_super(sbi->sb);
++ return -EROFS;
++ }
++
+ f2fs_down_write(&sbi->gc_lock);
+ f2fs_down_write(&sbi->cp_global_sem);
+
+--
+2.39.2
+
--- /dev/null
+From a001136e4aa6e16a8177b57185e78aefc6ae797f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Jun 2023 07:20:44 +0300
+Subject: fanotify: disallow mount/sb marks on kernel internal pseudo fs
+
+From: Amir Goldstein <amir73il@gmail.com>
+
+[ Upstream commit 69562eb0bd3e6bb8e522a7b254334e0fb30dff0c ]
+
+Hopefully, nobody is trying to abuse mount/sb marks for watching all
+anonymous pipes/inodes.
+
+I cannot think of a good reason to allow this - it looks like an
+oversight that dated back to the original fanotify API.
+
+Link: https://lore.kernel.org/linux-fsdevel/20230628101132.kvchg544mczxv2pm@quack3/
+Fixes: 0ff21db9fcc3 ("fanotify: hooks the fanotify_mark syscall to the vfsmount code")
+Signed-off-by: Amir Goldstein <amir73il@gmail.com>
+Reviewed-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Message-Id: <20230629042044.25723-1-amir73il@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/notify/fanotify/fanotify_user.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanotify_user.c
+index 4546da4a54f95..9df5db0f10ff2 100644
+--- a/fs/notify/fanotify/fanotify_user.c
++++ b/fs/notify/fanotify/fanotify_user.c
+@@ -1574,6 +1574,20 @@ static int fanotify_events_supported(struct fsnotify_group *group,
+ path->mnt->mnt_sb->s_type->fs_flags & FS_DISALLOW_NOTIFY_PERM)
+ return -EINVAL;
+
++ /*
++ * mount and sb marks are not allowed on kernel internal pseudo fs,
++ * like pipe_mnt, because that would subscribe to events on all the
++ * anonynous pipes in the system.
++ *
++ * SB_NOUSER covers all of the internal pseudo fs whose objects are not
++ * exposed to user's mount namespace, but there are other SB_KERNMOUNT
++ * fs, like nsfs, debugfs, for which the value of allowing sb and mount
++ * mark is questionable. For now we leave them alone.
++ */
++ if (mark_type != FAN_MARK_INODE &&
++ path->mnt->mnt_sb->s_flags & SB_NOUSER)
++ return -EINVAL;
++
+ /*
+ * We shouldn't have allowed setting dirent events and the directory
+ * flags FAN_ONDIR and FAN_EVENT_ON_CHILD in mask of non-dir inode,
+--
+2.39.2
+
--- /dev/null
+From 7c4e1b7b2443c10f55da810ca1dd5dbd1b5327a0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jun 2023 12:26:23 -0500
+Subject: gfs2: Fix duplicate should_fault_in_pages() call
+
+From: Bob Peterson <rpeterso@redhat.com>
+
+[ Upstream commit c8ed1b35931245087968fd95b2ec3dfc50f77769 ]
+
+In gfs2_file_buffered_write(), we currently jump from the second call of
+function should_fault_in_pages() to above the first call, so
+should_fault_in_pages() is getting called twice in a row, causing it to
+accidentally fall back to single-page writes rather than trying the more
+efficient multi-page writes first.
+
+Fix that by moving the retry label to the correct place, behind the
+first call to should_fault_in_pages().
+
+Fixes: e1fa9ea85ce8 ("gfs2: Stop using glock holder auto-demotion for now")
+Signed-off-by: Bob Peterson <rpeterso@redhat.com>
+Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/gfs2/file.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/gfs2/file.c b/fs/gfs2/file.c
+index bc6cd5f4b1077..c367f1678d5dc 100644
+--- a/fs/gfs2/file.c
++++ b/fs/gfs2/file.c
+@@ -1029,8 +1029,8 @@ static ssize_t gfs2_file_buffered_write(struct kiocb *iocb,
+ }
+
+ gfs2_holder_init(ip->i_gl, LM_ST_EXCLUSIVE, 0, gh);
+-retry:
+ if (should_fault_in_pages(from, iocb, &prev_count, &window_size)) {
++retry:
+ window_size -= fault_in_iov_iter_readable(from, window_size);
+ if (!window_size) {
+ ret = -EFAULT;
+--
+2.39.2
+
--- /dev/null
+From 7a422ad15e1c75f6fbd44c17e14c6fd5f2de1358 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Jun 2023 17:28:04 +0800
+Subject: hwtracing: hisi_ptt: Fix potential sleep in atomic context
+
+From: Yicong Yang <yangyicong@hisilicon.com>
+
+[ Upstream commit 6c50384ef8b94a527445e3694ae6549e1f15d859 ]
+
+We're using pci_irq_vector() to obtain the interrupt number and then
+bind it to the CPU start perf under the protection of spinlock in
+pmu::start(). pci_irq_vector() might sleep since [1] because it will
+call msi_domain_get_virq() to get the MSI interrupt number and it
+needs to acquire dev->msi.data->mutex. Getting a mutex will sleep on
+contention. So use pci_irq_vector() in an atomic context is problematic.
+
+This patch cached the interrupt number in the probe() and uses the
+cached data instead to avoid potential sleep.
+
+[1] commit 82ff8e6b78fc ("PCI/MSI: Use msi_get_virq() in pci_get_vector()")
+
+Fixes: ff0de066b463 ("hwtracing: hisi_ptt: Add trace function support for HiSilicon PCIe Tune and Trace device")
+Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Yicong Yang <yangyicong@hisilicon.com>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Link: https://lore.kernel.org/r/20230621092804.15120-6-yangyicong@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/ptt/hisi_ptt.c | 12 +++++-------
+ drivers/hwtracing/ptt/hisi_ptt.h | 2 ++
+ 2 files changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/hwtracing/ptt/hisi_ptt.c b/drivers/hwtracing/ptt/hisi_ptt.c
+index 30f1525639b57..4140efd664097 100644
+--- a/drivers/hwtracing/ptt/hisi_ptt.c
++++ b/drivers/hwtracing/ptt/hisi_ptt.c
+@@ -341,13 +341,13 @@ static int hisi_ptt_register_irq(struct hisi_ptt *hisi_ptt)
+ if (ret < 0)
+ return ret;
+
+- ret = devm_request_threaded_irq(&pdev->dev,
+- pci_irq_vector(pdev, HISI_PTT_TRACE_DMA_IRQ),
++ hisi_ptt->trace_irq = pci_irq_vector(pdev, HISI_PTT_TRACE_DMA_IRQ);
++ ret = devm_request_threaded_irq(&pdev->dev, hisi_ptt->trace_irq,
+ NULL, hisi_ptt_isr, 0,
+ DRV_NAME, hisi_ptt);
+ if (ret) {
+ pci_err(pdev, "failed to request irq %d, ret = %d\n",
+- pci_irq_vector(pdev, HISI_PTT_TRACE_DMA_IRQ), ret);
++ hisi_ptt->trace_irq, ret);
+ return ret;
+ }
+
+@@ -757,8 +757,7 @@ static void hisi_ptt_pmu_start(struct perf_event *event, int flags)
+ * core in event_function_local(). If CPU passed is offline we'll fail
+ * here, just log it since we can do nothing here.
+ */
+- ret = irq_set_affinity(pci_irq_vector(hisi_ptt->pdev, HISI_PTT_TRACE_DMA_IRQ),
+- cpumask_of(cpu));
++ ret = irq_set_affinity(hisi_ptt->trace_irq, cpumask_of(cpu));
+ if (ret)
+ dev_warn(dev, "failed to set the affinity of trace interrupt\n");
+
+@@ -1018,8 +1017,7 @@ static int hisi_ptt_cpu_teardown(unsigned int cpu, struct hlist_node *node)
+ * Also make sure the interrupt bind to the migrated CPU as well. Warn
+ * the user on failure here.
+ */
+- if (irq_set_affinity(pci_irq_vector(hisi_ptt->pdev, HISI_PTT_TRACE_DMA_IRQ),
+- cpumask_of(target)))
++ if (irq_set_affinity(hisi_ptt->trace_irq, cpumask_of(target)))
+ dev_warn(dev, "failed to set the affinity of trace interrupt\n");
+
+ hisi_ptt->trace_ctrl.on_cpu = target;
+diff --git a/drivers/hwtracing/ptt/hisi_ptt.h b/drivers/hwtracing/ptt/hisi_ptt.h
+index 5beb1648c93ab..948a4c4231527 100644
+--- a/drivers/hwtracing/ptt/hisi_ptt.h
++++ b/drivers/hwtracing/ptt/hisi_ptt.h
+@@ -166,6 +166,7 @@ struct hisi_ptt_pmu_buf {
+ * @pdev: pci_dev of this PTT device
+ * @tune_lock: lock to serialize the tune process
+ * @pmu_lock: lock to serialize the perf process
++ * @trace_irq: interrupt number used by trace
+ * @upper_bdf: the upper BDF range of the PCI devices managed by this PTT device
+ * @lower_bdf: the lower BDF range of the PCI devices managed by this PTT device
+ * @port_filters: the filter list of root ports
+@@ -180,6 +181,7 @@ struct hisi_ptt {
+ struct pci_dev *pdev;
+ struct mutex tune_lock;
+ spinlock_t pmu_lock;
++ int trace_irq;
+ u32 upper_bdf;
+ u32 lower_bdf;
+
+--
+2.39.2
+
--- /dev/null
+From daaebf1cd5b22603252040066a66720cd9065ca7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Jun 2023 12:25:58 -0600
+Subject: i2c: xiic: Don't try to handle more interrupt events after error
+
+From: Robert Hancock <robert.hancock@calian.com>
+
+[ Upstream commit cb6e45c9a0ad9e0f8664fd06db0227d185dc76ab ]
+
+In xiic_process, it is possible that error events such as arbitration
+lost or TX error can be raised in conjunction with other interrupt flags
+such as TX FIFO empty or bus not busy. Error events result in the
+controller being reset and the error returned to the calling request,
+but the function could potentially try to keep handling the other
+events, such as by writing more messages into the TX FIFO. Since the
+transaction has already failed, this is not helpful and will just cause
+issues.
+
+This problem has been present ever since:
+
+commit 7f9906bd7f72 ("i2c: xiic: Service all interrupts in isr")
+
+which allowed non-error events to be handled after errors, but became
+more obvious after:
+
+commit 743e227a8959 ("i2c: xiic: Defer xiic_wakeup() and
+__xiic_start_xfer() in xiic_process()")
+
+which reworked the code to add a WARN_ON which triggers if both the
+xfer_more and wakeup_req flags were set, since this combination is
+not supposed to happen, but was occurring in this scenario.
+
+Skip further interrupt handling after error flags are detected to avoid
+this problem.
+
+Fixes: 7f9906bd7f72 ("i2c: xiic: Service all interrupts in isr")
+Signed-off-by: Robert Hancock <robert.hancock@calian.com>
+Acked-by: Andi Shyti <andi.shyti@kernel.org>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-xiic.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/i2c/busses/i2c-xiic.c b/drivers/i2c/busses/i2c-xiic.c
+index effae4d467291..b41a6709e47f2 100644
+--- a/drivers/i2c/busses/i2c-xiic.c
++++ b/drivers/i2c/busses/i2c-xiic.c
+@@ -431,6 +431,8 @@ static irqreturn_t xiic_process(int irq, void *dev_id)
+ wakeup_req = 1;
+ wakeup_code = STATE_ERROR;
+ }
++ /* don't try to handle other events */
++ goto out;
+ }
+ if (pend & XIIC_INTR_RX_FULL_MASK) {
+ /* Receive register/FIFO is full */
+--
+2.39.2
+
--- /dev/null
+From 8016b09c94d40e2fbfdc06be477af29a1a29b313 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 May 2023 11:30:29 +0800
+Subject: i3c: master: svc: fix cpu schedule in spin lock
+
+From: Clark Wang <xiaoning.wang@nxp.com>
+
+[ Upstream commit 33beadb3b1ab74e69db2c49d9663f3a93a273943 ]
+
+pm_runtime_resume_and_get() may call sleep(). It cannot be used in
+svc_i3c_master_start_xfer_locked(), because it is in a spin lock.
+
+Move the pm runtime operations to svc_i3c_master_enqueue_xfer().
+
+Signed-off-by: Clark Wang <xiaoning.wang@nxp.com>
+Fixes: 05be23ef78f7 ("i3c: master: svc: add runtime pm support")
+Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/r/20230517033030.3068085-2-xiaoning.wang@nxp.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i3c/master/svc-i3c-master.c | 19 ++++++++++---------
+ 1 file changed, 10 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/i3c/master/svc-i3c-master.c b/drivers/i3c/master/svc-i3c-master.c
+index d6e9ed74cdcf4..d47360f8a1f36 100644
+--- a/drivers/i3c/master/svc-i3c-master.c
++++ b/drivers/i3c/master/svc-i3c-master.c
+@@ -1090,12 +1090,6 @@ static void svc_i3c_master_start_xfer_locked(struct svc_i3c_master *master)
+ if (!xfer)
+ return;
+
+- ret = pm_runtime_resume_and_get(master->dev);
+- if (ret < 0) {
+- dev_err(master->dev, "<%s> Cannot get runtime PM.\n", __func__);
+- return;
+- }
+-
+ svc_i3c_master_clear_merrwarn(master);
+ svc_i3c_master_flush_fifo(master);
+
+@@ -1110,9 +1104,6 @@ static void svc_i3c_master_start_xfer_locked(struct svc_i3c_master *master)
+ break;
+ }
+
+- pm_runtime_mark_last_busy(master->dev);
+- pm_runtime_put_autosuspend(master->dev);
+-
+ xfer->ret = ret;
+ complete(&xfer->comp);
+
+@@ -1133,6 +1124,13 @@ static void svc_i3c_master_enqueue_xfer(struct svc_i3c_master *master,
+ struct svc_i3c_xfer *xfer)
+ {
+ unsigned long flags;
++ int ret;
++
++ ret = pm_runtime_resume_and_get(master->dev);
++ if (ret < 0) {
++ dev_err(master->dev, "<%s> Cannot get runtime PM.\n", __func__);
++ return;
++ }
+
+ init_completion(&xfer->comp);
+ spin_lock_irqsave(&master->xferqueue.lock, flags);
+@@ -1143,6 +1141,9 @@ static void svc_i3c_master_enqueue_xfer(struct svc_i3c_master *master,
+ svc_i3c_master_start_xfer_locked(master);
+ }
+ spin_unlock_irqrestore(&master->xferqueue.lock, flags);
++
++ pm_runtime_mark_last_busy(master->dev);
++ pm_runtime_put_autosuspend(master->dev);
+ }
+
+ static bool
+--
+2.39.2
+
--- /dev/null
+From 2b3074663c8680396665d370fd6f725ea356c6d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Jun 2023 13:22:44 -0500
+Subject: ibmvnic: Do not reset dql stats on NON_FATAL err
+
+From: Nick Child <nnac123@linux.ibm.com>
+
+[ Upstream commit 48538ccb825b05544ec308a509e2cc9c013402db ]
+
+All ibmvnic resets, make a call to netdev_tx_reset_queue() when
+re-opening the device. netdev_tx_reset_queue() resets the num_queued
+and num_completed byte counters. These stats are used in Byte Queue
+Limit (BQL) algorithms. The difference between these two stats tracks
+the number of bytes currently sitting on the physical NIC. ibmvnic
+increases the number of queued bytes though calls to
+netdev_tx_sent_queue() in the drivers xmit function. When, VIOS reports
+that it is done transmitting bytes, the ibmvnic device increases the
+number of completed bytes through calls to netdev_tx_completed_queue().
+It is important to note that the driver batches its transmit calls and
+num_queued is increased every time that an skb is added to the next
+batch, not necessarily when the batch is sent to VIOS for transmission.
+
+Unlike other reset types, a NON FATAL reset will not flush the sub crq
+tx buffers. Therefore, it is possible for the batched skb array to be
+partially full. So if there is call to netdev_tx_reset_queue() when
+re-opening the device, the value of num_queued (0) would not account
+for the skb's that are currently batched. Eventually, when the batch
+is sent to VIOS, the call to netdev_tx_completed_queue() would increase
+num_completed to a value greater than the num_queued. This causes a
+BUG_ON crash:
+
+ibmvnic 30000002: Firmware reports error, cause: adapter problem.
+Starting recovery...
+ibmvnic 30000002: tx error 600
+ibmvnic 30000002: tx error 600
+ibmvnic 30000002: tx error 600
+ibmvnic 30000002: tx error 600
+------------[ cut here ]------------
+kernel BUG at lib/dynamic_queue_limits.c:27!
+Oops: Exception in kernel mode, sig: 5
+[....]
+NIP dql_completed+0x28/0x1c0
+LR ibmvnic_complete_tx.isra.0+0x23c/0x420 [ibmvnic]
+Call Trace:
+ibmvnic_complete_tx.isra.0+0x3f8/0x420 [ibmvnic] (unreliable)
+ibmvnic_interrupt_tx+0x40/0x70 [ibmvnic]
+__handle_irq_event_percpu+0x98/0x270
+---[ end trace ]---
+
+Therefore, do not reset the dql stats when performing a NON_FATAL reset.
+
+Fixes: 0d973388185d ("ibmvnic: Introduce xmit_more support using batched subCRQ hcalls")
+Signed-off-by: Nick Child <nnac123@linux.ibm.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/ibm/ibmvnic.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
+index 9282381a438fe..bc97f24b08270 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -1625,7 +1625,14 @@ static int __ibmvnic_open(struct net_device *netdev)
+ if (prev_state == VNIC_CLOSED)
+ enable_irq(adapter->tx_scrq[i]->irq);
+ enable_scrq_irq(adapter, adapter->tx_scrq[i]);
+- netdev_tx_reset_queue(netdev_get_tx_queue(netdev, i));
++ /* netdev_tx_reset_queue will reset dql stats. During NON_FATAL
++ * resets, don't reset the stats because there could be batched
++ * skb's waiting to be sent. If we reset dql stats, we risk
++ * num_completed being greater than num_queued. This will cause
++ * a BUG_ON in dql_completed().
++ */
++ if (adapter->reset_reason != VNIC_RESET_NON_FATAL)
++ netdev_tx_reset_queue(netdev_get_tx_queue(netdev, i));
+ }
+
+ rc = set_link_state(adapter, IBMVNIC_LOGICAL_LNK_UP);
+--
+2.39.2
+
--- /dev/null
+From 235b28f6bc30b918dc14aa40f3dd654f67083879 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 May 2023 10:40:17 +0800
+Subject: kernfs: fix missing kernfs_idr_lock to remove an ID from the IDR
+
+From: Muchun Song <songmuchun@bytedance.com>
+
+[ Upstream commit 30480b988f88c279752f3202a26b6fee5f586aef ]
+
+The root->ino_idr is supposed to be protected by kernfs_idr_lock, fix
+it.
+
+Fixes: 488dee96bb62 ("kernfs: allow creating kernfs objects with arbitrary uid/gid")
+Signed-off-by: Muchun Song <songmuchun@bytedance.com>
+Acked-by: Tejun Heo <tj@kernel.org>
+Link: https://lore.kernel.org/r/20230523024017.24851-1-songmuchun@bytedance.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/kernfs/dir.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/kernfs/dir.c b/fs/kernfs/dir.c
+index f33b3baad07cb..44842e6cf0a9b 100644
+--- a/fs/kernfs/dir.c
++++ b/fs/kernfs/dir.c
+@@ -652,7 +652,9 @@ static struct kernfs_node *__kernfs_new_node(struct kernfs_root *root,
+ return kn;
+
+ err_out3:
++ spin_lock(&kernfs_idr_lock);
+ idr_remove(&root->ino_idr, (u32)kernfs_ino(kn));
++ spin_unlock(&kernfs_idr_lock);
+ err_out2:
+ kmem_cache_free(kernfs_node_cache, kn);
+ err_out1:
+--
+2.39.2
+
--- /dev/null
+From d80a680169cd962fcde27848889e4d87bef276e9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 May 2023 10:42:34 +0200
+Subject: KVM: s390/diag: fix racy access of physical cpu number in diag 9c
+ handler
+
+From: Christian Borntraeger <borntraeger@linux.ibm.com>
+
+[ Upstream commit 0bc380beb78aa352eadbc21d934dd9606fcee808 ]
+
+We do check for target CPU == -1, but this might change at the time we
+are going to use it. Hold the physical target CPU in a local variable to
+avoid out-of-bound accesses to the cpu arrays.
+
+Cc: Pierre Morel <pmorel@linux.ibm.com>
+Fixes: 87e28a15c42c ("KVM: s390: diag9c (directed yield) forwarding")
+Reported-by: Marc Hartmayer <mhartmay@linux.ibm.com>
+Reviewed-by: Nico Boehr <nrb@linux.ibm.com>
+Reviewed-by: Pierre Morel <pmorel@linux.ibm.com>
+Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
+Signed-off-by: Janosch Frank <frankja@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/kvm/diag.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/arch/s390/kvm/diag.c b/arch/s390/kvm/diag.c
+index 807fa9da1e721..3c65b8258ae67 100644
+--- a/arch/s390/kvm/diag.c
++++ b/arch/s390/kvm/diag.c
+@@ -166,6 +166,7 @@ static int diag9c_forwarding_overrun(void)
+ static int __diag_time_slice_end_directed(struct kvm_vcpu *vcpu)
+ {
+ struct kvm_vcpu *tcpu;
++ int tcpu_cpu;
+ int tid;
+
+ tid = vcpu->run->s.regs.gprs[(vcpu->arch.sie_block->ipa & 0xf0) >> 4];
+@@ -181,14 +182,15 @@ static int __diag_time_slice_end_directed(struct kvm_vcpu *vcpu)
+ goto no_yield;
+
+ /* target guest VCPU already running */
+- if (READ_ONCE(tcpu->cpu) >= 0) {
++ tcpu_cpu = READ_ONCE(tcpu->cpu);
++ if (tcpu_cpu >= 0) {
+ if (!diag9c_forwarding_hz || diag9c_forwarding_overrun())
+ goto no_yield;
+
+ /* target host CPU already running */
+- if (!vcpu_is_preempted(tcpu->cpu))
++ if (!vcpu_is_preempted(tcpu_cpu))
+ goto no_yield;
+- smp_yield_cpu(tcpu->cpu);
++ smp_yield_cpu(tcpu_cpu);
+ VCPU_EVENT(vcpu, 5,
+ "diag time slice end directed to %d: yield forwarded",
+ tid);
+--
+2.39.2
+
--- /dev/null
+From 60dcf7497f6f6494ae759e6eb60e85905642dcc6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Mar 2023 15:54:23 +0100
+Subject: KVM: s390: fix KVM_S390_GET_CMMA_BITS for GFNs in memslot holes
+
+From: Nico Boehr <nrb@linux.ibm.com>
+
+[ Upstream commit 285cff4c0454340a4dc53f46e67f2cb1c293bd74 ]
+
+The KVM_S390_GET_CMMA_BITS ioctl may return incorrect values when userspace
+specifies a start_gfn outside of memslots.
+
+This can occur when a VM has multiple memslots with a hole in between:
+
++-----+----------+--------+--------+
+| ... | Slot N-1 | <hole> | Slot N |
++-----+----------+--------+--------+
+ ^ ^ ^ ^
+ | | | |
+GFN A A+B | |
+ A+B+C |
+ A+B+C+D
+
+When userspace specifies a GFN in [A+B, A+B+C), it would expect to get the
+CMMA values of the first dirty page in Slot N. However, userspace may get a
+start_gfn of A+B+C+D with a count of 0, hence completely skipping over any
+dirty pages in slot N.
+
+The error is in kvm_s390_next_dirty_cmma(), which assumes
+gfn_to_memslot_approx() will return the memslot _below_ the specified GFN
+when the specified GFN lies outside a memslot. In reality it may return
+either the memslot below or above the specified GFN.
+
+When a memslot above the specified GFN is returned this happens:
+
+- ofs is calculated, but since the memslot's base_gfn is larger than the
+ specified cur_gfn, ofs will underflow to a huge number.
+- ofs is passed to find_next_bit(). Since ofs will exceed the memslot's
+ number of pages, the number of pages in the memslot is returned,
+ completely skipping over all bits in the memslot userspace would be
+ interested in.
+
+Fix this by resetting ofs to zero when a memslot _above_ cur_gfn is
+returned (cur_gfn < ms->base_gfn).
+
+Signed-off-by: Nico Boehr <nrb@linux.ibm.com>
+Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
+Fixes: afdad61615cc ("KVM: s390: Fix storage attributes migration with memory slots")
+Message-Id: <20230324145424.293889-2-nrb@linux.ibm.com>
+Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
+Signed-off-by: Janosch Frank <frankja@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/kvm/kvm-s390.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
+index 26f89ec3062ba..3775363471f0c 100644
+--- a/arch/s390/kvm/kvm-s390.c
++++ b/arch/s390/kvm/kvm-s390.c
+@@ -2147,6 +2147,10 @@ static unsigned long kvm_s390_next_dirty_cmma(struct kvm_memslots *slots,
+ ms = container_of(mnode, struct kvm_memory_slot, gfn_node[slots->node_idx]);
+ ofs = 0;
+ }
++
++ if (cur_gfn < ms->base_gfn)
++ ofs = 0;
++
+ ofs = find_next_bit(kvm_second_dirty_bitmap(ms), ms->npages, ofs);
+ while (ofs >= ms->npages && (mnode = rb_next(mnode))) {
+ ms = container_of(mnode, struct kvm_memory_slot, gfn_node[slots->node_idx]);
+--
+2.39.2
+
--- /dev/null
+From 0477b30ccaea8cde3d49435ed02288d99ba51486 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 May 2023 17:42:58 +0200
+Subject: KVM: s390: vsie: fix the length of APCB bitmap
+
+From: Pierre Morel <pmorel@linux.ibm.com>
+
+[ Upstream commit 246be7d2720ea9a795b576067ecc5e5c7a1e7848 ]
+
+bit_and() uses the count of bits as the woking length.
+Fix the previous implementation and effectively use
+the right bitmap size.
+
+Fixes: 19fd83a64718 ("KVM: s390: vsie: allow CRYCB FORMAT-1")
+Fixes: 56019f9aca22 ("KVM: s390: vsie: Allow CRYCB FORMAT-2")
+
+Signed-off-by: Pierre Morel <pmorel@linux.ibm.com>
+Reviewed-by: Janosch Frank <frankja@linux.ibm.com>
+Link: https://lore.kernel.org/kvm/20230511094719.9691-1-pmorel@linux.ibm.com/
+Signed-off-by: Janosch Frank <frankja@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/kvm/vsie.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/arch/s390/kvm/vsie.c b/arch/s390/kvm/vsie.c
+index ace2541ababd3..740f8b56e63f9 100644
+--- a/arch/s390/kvm/vsie.c
++++ b/arch/s390/kvm/vsie.c
+@@ -169,7 +169,8 @@ static int setup_apcb00(struct kvm_vcpu *vcpu, unsigned long *apcb_s,
+ sizeof(struct kvm_s390_apcb0)))
+ return -EFAULT;
+
+- bitmap_and(apcb_s, apcb_s, apcb_h, sizeof(struct kvm_s390_apcb0));
++ bitmap_and(apcb_s, apcb_s, apcb_h,
++ BITS_PER_BYTE * sizeof(struct kvm_s390_apcb0));
+
+ return 0;
+ }
+@@ -191,7 +192,8 @@ static int setup_apcb11(struct kvm_vcpu *vcpu, unsigned long *apcb_s,
+ sizeof(struct kvm_s390_apcb1)))
+ return -EFAULT;
+
+- bitmap_and(apcb_s, apcb_s, apcb_h, sizeof(struct kvm_s390_apcb1));
++ bitmap_and(apcb_s, apcb_s, apcb_h,
++ BITS_PER_BYTE * sizeof(struct kvm_s390_apcb1));
+
+ return 0;
+ }
+--
+2.39.2
+
--- /dev/null
+From a3f503cf32e32dad1d57f4eb767f741d655560f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Feb 2023 11:24:36 -0800
+Subject: lib/bitmap: drop optimization of bitmap_{from,to}_arr64
+
+From: Yury Norov <yury.norov@gmail.com>
+
+[ Upstream commit c1d2ba10f594046831d14b03f194e8d05e78abad ]
+
+bitmap_{from,to}_arr64() optimization is overly optimistic on 32-bit LE
+architectures when it's wired to bitmap_copy_clear_tail().
+
+bitmap_copy_clear_tail() takes care of unused bits in the bitmap up to
+the next word boundary. But on 32-bit machines when copying bits from
+bitmap to array of 64-bit words, it's expected that the unused part of
+a recipient array must be cleared up to 64-bit boundary, so the last 4
+bytes may stay untouched when nbits % 64 <= 32.
+
+While the copying part of the optimization works correct, that clear-tail
+trick makes corresponding tests reasonably fail:
+
+test_bitmap: bitmap_to_arr64(nbits == 1): tail is not safely cleared: 0xa5a5a5a500000001 (must be 0x0000000000000001)
+
+Fix it by removing bitmap_{from,to}_arr64() optimization for 32-bit LE
+arches.
+
+Reported-by: Guenter Roeck <linux@roeck-us.net>
+Link: https://lore.kernel.org/lkml/20230225184702.GA3587246@roeck-us.net/
+Fixes: 0a97953fd221 ("lib: add bitmap_{from,to}_arr64")
+Signed-off-by: Yury Norov <yury.norov@gmail.com>
+Tested-by: Guenter Roeck <linux@roeck-us.net>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Reviewed-by: Alexander Lobakin <aleksander.lobakin@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/bitmap.h | 8 +++-----
+ lib/bitmap.c | 2 +-
+ 2 files changed, 4 insertions(+), 6 deletions(-)
+
+diff --git a/include/linux/bitmap.h b/include/linux/bitmap.h
+index 7d6d73b781472..03644237e1efb 100644
+--- a/include/linux/bitmap.h
++++ b/include/linux/bitmap.h
+@@ -302,12 +302,10 @@ void bitmap_to_arr32(u32 *buf, const unsigned long *bitmap,
+ #endif
+
+ /*
+- * On 64-bit systems bitmaps are represented as u64 arrays internally. On LE32
+- * machines the order of hi and lo parts of numbers match the bitmap structure.
+- * In both cases conversion is not needed when copying data from/to arrays of
+- * u64.
++ * On 64-bit systems bitmaps are represented as u64 arrays internally. So,
++ * the conversion is not needed when copying data from/to arrays of u64.
+ */
+-#if (BITS_PER_LONG == 32) && defined(__BIG_ENDIAN)
++#if BITS_PER_LONG == 32
+ void bitmap_from_arr64(unsigned long *bitmap, const u64 *buf, unsigned int nbits);
+ void bitmap_to_arr64(u64 *buf, const unsigned long *bitmap, unsigned int nbits);
+ #else
+diff --git a/lib/bitmap.c b/lib/bitmap.c
+index 1c81413c51f86..ddb31015e38ae 100644
+--- a/lib/bitmap.c
++++ b/lib/bitmap.c
+@@ -1495,7 +1495,7 @@ void bitmap_to_arr32(u32 *buf, const unsigned long *bitmap, unsigned int nbits)
+ EXPORT_SYMBOL(bitmap_to_arr32);
+ #endif
+
+-#if (BITS_PER_LONG == 32) && defined(__BIG_ENDIAN)
++#if BITS_PER_LONG == 32
+ /**
+ * bitmap_from_arr64 - copy the contents of u64 array of bits to bitmap
+ * @bitmap: array of unsigned longs, the destination bitmap
+--
+2.39.2
+
--- /dev/null
+From 41be7a82c7ab428b5fe32d0bb07f07036353db3c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 May 2023 00:29:44 +0800
+Subject: lkdtm: replace ll_rw_block with submit_bh
+
+From: Yue Zhao <findns94@gmail.com>
+
+[ Upstream commit b290df06811852d4cc36f4b8a2a30c2063197a74 ]
+
+Function ll_rw_block was removed in commit 79f597842069 ("fs/buffer:
+remove ll_rw_block() helper"). There is no unified function to sumbit
+read or write buffer in block layer for now. Consider similar sematics,
+we can choose submit_bh() to replace ll_rw_block() as predefined crash
+point. In submit_bh(), it also takes read or write flag as the first
+argument and invoke submit_bio() to submit I/O request to block layer.
+
+Fixes: 79f597842069 ("fs/buffer: remove ll_rw_block() helper")
+Signed-off-by: Yue Zhao <findns94@gmail.com>
+Acked-by: Kees Cook <keescook@chromium.org>
+Link: https://lore.kernel.org/r/20230503162944.3969-1-findns94@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/fault-injection/provoke-crashes.rst | 2 +-
+ drivers/misc/lkdtm/core.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/Documentation/fault-injection/provoke-crashes.rst b/Documentation/fault-injection/provoke-crashes.rst
+index 3abe842256139..1f087e502ca6d 100644
+--- a/Documentation/fault-injection/provoke-crashes.rst
++++ b/Documentation/fault-injection/provoke-crashes.rst
+@@ -29,7 +29,7 @@ recur_count
+ cpoint_name
+ Where in the kernel to trigger the action. It can be
+ one of INT_HARDWARE_ENTRY, INT_HW_IRQ_EN, INT_TASKLET_ENTRY,
+- FS_DEVRW, MEM_SWAPOUT, TIMERADD, SCSI_QUEUE_RQ, or DIRECT.
++ FS_SUBMIT_BH, MEM_SWAPOUT, TIMERADD, SCSI_QUEUE_RQ, or DIRECT.
+
+ cpoint_type
+ Indicates the action to be taken on hitting the crash point.
+diff --git a/drivers/misc/lkdtm/core.c b/drivers/misc/lkdtm/core.c
+index b4712ff196b4e..0772e4a4757e9 100644
+--- a/drivers/misc/lkdtm/core.c
++++ b/drivers/misc/lkdtm/core.c
+@@ -79,7 +79,7 @@ static struct crashpoint crashpoints[] = {
+ CRASHPOINT("INT_HARDWARE_ENTRY", "do_IRQ"),
+ CRASHPOINT("INT_HW_IRQ_EN", "handle_irq_event"),
+ CRASHPOINT("INT_TASKLET_ENTRY", "tasklet_action"),
+- CRASHPOINT("FS_DEVRW", "ll_rw_block"),
++ CRASHPOINT("FS_SUBMIT_BH", "submit_bh"),
+ CRASHPOINT("MEM_SWAPOUT", "shrink_inactive_list"),
+ CRASHPOINT("TIMERADD", "hrtimer_start"),
+ CRASHPOINT("SCSI_QUEUE_RQ", "scsi_queue_rq"),
+--
+2.39.2
+
--- /dev/null
+From 63b8243f66a354bf369b893fa920ac617b40d7c2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jun 2023 20:00:22 -0500
+Subject: mailbox: ti-msgmgr: Fill non-message tx data fields with 0x0
+
+From: Nishanth Menon <nm@ti.com>
+
+[ Upstream commit 1b712f18c461bd75f018033a15cf381e712806b5 ]
+
+Sec proxy/message manager data buffer is 60 bytes with the last of the
+registers indicating transmission completion. This however poses a bit
+of a challenge.
+
+The backing memory for sec_proxy / message manager is regular memory,
+and all sec proxy does is to trigger a burst of all 60 bytes of data
+over to the target thread backing ring accelerator. It doesn't do a
+memory scrub when it moves data out in the burst. When we transmit
+multiple messages, remnants of previous message is also transmitted
+which results in some random data being set in TISCI fields of
+messages that have been expanded forward.
+
+The entire concept of backward compatibility hinges on the fact that
+the unused message fields remain 0x0 allowing for 0x0 value to be
+specially considered when backward compatibility of message extension
+is done.
+
+So, instead of just writing the completion register, we continue
+to fill the message buffer up with 0x0 (note: for partial message
+involving completion, we already do this).
+
+This allows us to scale and introduce ABI changes back also work with
+other boot stages that may have left data in the internal memory.
+
+While at this, be consistent and explicit with the data_reg pointer
+increment.
+
+Fixes: aace66b170ce ("mailbox: Introduce TI message manager driver")
+Signed-off-by: Nishanth Menon <nm@ti.com>
+Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mailbox/ti-msgmgr.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/mailbox/ti-msgmgr.c b/drivers/mailbox/ti-msgmgr.c
+index ddac423ac1a91..03048cbda525e 100644
+--- a/drivers/mailbox/ti-msgmgr.c
++++ b/drivers/mailbox/ti-msgmgr.c
+@@ -430,14 +430,20 @@ static int ti_msgmgr_send_data(struct mbox_chan *chan, void *data)
+ /* Ensure all unused data is 0 */
+ data_trail &= 0xFFFFFFFF >> (8 * (sizeof(u32) - trail_bytes));
+ writel(data_trail, data_reg);
+- data_reg++;
++ data_reg += sizeof(u32);
+ }
++
+ /*
+ * 'data_reg' indicates next register to write. If we did not already
+ * write on tx complete reg(last reg), we must do so for transmit
++ * In addition, we also need to make sure all intermediate data
++ * registers(if any required), are reset to 0 for TISCI backward
++ * compatibility to be maintained.
+ */
+- if (data_reg <= qinst->queue_buff_end)
+- writel(0, qinst->queue_buff_end);
++ while (data_reg <= qinst->queue_buff_end) {
++ writel(0, data_reg);
++ data_reg += sizeof(u32);
++ }
+
+ /* If we are in polled mode, wait for a response before proceeding */
+ if (ti_msgmgr_chan_has_polled_queue_rx(message->chan_rx))
+--
+2.39.2
+
--- /dev/null
+From 1609e9ee3a51c95c22380f34f86d0ba7af0e7612 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Jun 2023 17:43:20 +0800
+Subject: md/raid10: fix the condition to call bio_end_io_acct()
+
+From: Li Nan <linan122@huawei.com>
+
+[ Upstream commit 125bfc7cd750e68c99f1d446e2c22abea08c237f ]
+
+/sys/block/[device]/queue/iostats is used to control whether to count io
+stat. Write 0 to it will clear queue_flags QUEUE_FLAG_IO_STAT which means
+iostats is disabled. If we disable iostats and later endable it, the io
+issued during this period will be counted incorrectly, inflight will be
+decreased to -1.
+
+ //T1 set iostats
+ echo 0 > /sys/block/md0/queue/iostats
+ clear QUEUE_FLAG_IO_STAT
+
+ //T2 issue io
+ if (QUEUE_FLAG_IO_STAT) -> false
+ bio_start_io_acct
+ inflight++
+
+ echo 1 > /sys/block/md0/queue/iostats
+ set QUEUE_FLAG_IO_STAT
+
+ //T3 io end
+ if (QUEUE_FLAG_IO_STAT) -> true
+ bio_end_io_acct
+ inflight-- -> -1
+
+Also, if iostats is enabled while issuing io but disabled while io end,
+inflight will never be decreased.
+
+Fix it by checking start_time when io end. If start_time is not 0, call
+bio_end_io_acct().
+
+Fixes: 528bc2cf2fcc ("md/raid10: enable io accounting")
+Signed-off-by: Li Nan <linan122@huawei.com>
+Signed-off-by: Song Liu <song@kernel.org>
+Link: https://lore.kernel.org/r/20230609094320.2397604-1-linan666@huaweicloud.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/raid10.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
+index ea6228ff3bb5e..d2098fcd6a270 100644
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -325,7 +325,7 @@ static void raid_end_bio_io(struct r10bio *r10_bio)
+ if (!test_bit(R10BIO_Uptodate, &r10_bio->state))
+ bio->bi_status = BLK_STS_IOERR;
+
+- if (blk_queue_io_stat(bio->bi_bdev->bd_disk->queue))
++ if (r10_bio->start_time)
+ bio_end_io_acct(bio, r10_bio->start_time);
+ bio_endio(bio);
+ /*
+--
+2.39.2
+
--- /dev/null
+From 7dbcc48120a128dda97cbc5c8a990389093bee78 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Apr 2023 09:55:43 +0800
+Subject: media: amphion: drop repeated codec data for vc1g format
+
+From: Ming Qian <ming.qian@nxp.com>
+
+[ Upstream commit e1d2ccc2cdd6333584aa3d5386dc667d0837c48f ]
+
+For format V4L2_PIX_FMT_VC1_ANNEX_G,
+the separate codec data is required only once.
+The repeated codec data may introduce some decoding error.
+so drop the repeated codec data.
+
+It's amphion vpu's limitation
+
+Fixes: e670f5d672ef ("media: amphion: only insert the first sequence startcode for vc1l format")
+Signed-off-by: Ming Qian <ming.qian@nxp.com>
+Tested-by: xiahong.bao <xiahong.bao@nxp.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/amphion/vpu_malone.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/media/platform/amphion/vpu_malone.c b/drivers/media/platform/amphion/vpu_malone.c
+index 36e563d29621f..c2f4fb12c3b64 100644
+--- a/drivers/media/platform/amphion/vpu_malone.c
++++ b/drivers/media/platform/amphion/vpu_malone.c
+@@ -1286,6 +1286,15 @@ static int vpu_malone_insert_scode_pic(struct malone_scode_t *scode, u32 codec_i
+ return sizeof(hdr);
+ }
+
++static int vpu_malone_insert_scode_vc1_g_seq(struct malone_scode_t *scode)
++{
++ if (!scode->inst->total_input_count)
++ return 0;
++ if (vpu_vb_is_codecconfig(to_vb2_v4l2_buffer(scode->vb)))
++ scode->need_data = 0;
++ return 0;
++}
++
+ static int vpu_malone_insert_scode_vc1_g_pic(struct malone_scode_t *scode)
+ {
+ struct vb2_v4l2_buffer *vbuf;
+@@ -1423,6 +1432,7 @@ static const struct malone_scode_handler scode_handlers[] = {
+ },
+ {
+ .pixelformat = V4L2_PIX_FMT_VC1_ANNEX_G,
++ .insert_scode_seq = vpu_malone_insert_scode_vc1_g_seq,
+ .insert_scode_pic = vpu_malone_insert_scode_vc1_g_pic,
+ },
+ {
+--
+2.39.2
+
--- /dev/null
+From b94cf7d36d9f5addb8a8e5ce7dc6d1b01d361db6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Apr 2023 09:55:42 +0800
+Subject: media: amphion: drop repeated codec data for vc1l format
+
+From: Ming Qian <ming.qian@nxp.com>
+
+[ Upstream commit 668ee1a3a1870381225002c246972419b98e4253 ]
+
+For format V4L2_PIX_FMT_VC1_ANNEX_L,
+the codec data is replaced with startcode,
+and then driver drop it, otherwise it may led to decoding error.
+
+It's amphion vpu's limitation
+
+Driver has dropped the first codec data,
+but need to drop the repeated codec data too.
+
+Fixes: e670f5d672ef ("media: amphion: only insert the first sequence startcode for vc1l format")
+Signed-off-by: Ming Qian <ming.qian@nxp.com>
+Tested-by: xiahong.bao <xiahong.bao@nxp.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/amphion/vpu_malone.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/media/platform/amphion/vpu_malone.c b/drivers/media/platform/amphion/vpu_malone.c
+index ae094cdc9bfc8..36e563d29621f 100644
+--- a/drivers/media/platform/amphion/vpu_malone.c
++++ b/drivers/media/platform/amphion/vpu_malone.c
+@@ -1317,6 +1317,8 @@ static int vpu_malone_insert_scode_vc1_l_seq(struct malone_scode_t *scode)
+ int size = 0;
+ u8 rcv_seqhdr[MALONE_VC1_RCV_SEQ_HEADER_LEN];
+
++ if (vpu_vb_is_codecconfig(to_vb2_v4l2_buffer(scode->vb)))
++ scode->need_data = 0;
+ if (scode->inst->total_input_count)
+ return 0;
+ scode->need_data = 0;
+--
+2.39.2
+
--- /dev/null
+From 77ad17ba26d290212171e55484e49939a152762b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 May 2023 16:47:35 +0800
+Subject: media: amphion: initiate a drain of the capture queue in dynamic
+ resolution change
+
+From: Ming Qian <ming.qian@nxp.com>
+
+[ Upstream commit 076b6289b2c12d76fab248659896682830fa7766 ]
+
+The last buffer from before the change must be marked
+with the V4L2_BUF_FLAG_LAST flag,
+similarly to the Drain sequence above.
+
+initiate a drain of the capture queue in dynamic resolution change
+
+Fixes: 6de8d628df6e ("media: amphion: add v4l2 m2m vpu decoder stateful driver")
+Signed-off-by: Ming Qian <ming.qian@nxp.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/amphion/vdec.c | 7 ++++---
+ drivers/media/platform/amphion/venc.c | 4 ++--
+ drivers/media/platform/amphion/vpu_v4l2.c | 5 +++--
+ drivers/media/platform/amphion/vpu_v4l2.h | 2 +-
+ 4 files changed, 10 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/media/platform/amphion/vdec.c b/drivers/media/platform/amphion/vdec.c
+index 4918547793dc1..c08b5a2bfc1df 100644
+--- a/drivers/media/platform/amphion/vdec.c
++++ b/drivers/media/platform/amphion/vdec.c
+@@ -229,6 +229,7 @@ static void vdec_handle_resolution_change(struct vpu_inst *inst)
+
+ vdec->source_change--;
+ vpu_notify_source_change(inst);
++ vpu_set_last_buffer_dequeued(inst, false);
+ }
+
+ static int vdec_update_state(struct vpu_inst *inst, enum vpu_codec_state state, u32 force)
+@@ -264,7 +265,7 @@ static void vdec_set_last_buffer_dequeued(struct vpu_inst *inst)
+ return;
+
+ if (vdec->eos_received) {
+- if (!vpu_set_last_buffer_dequeued(inst)) {
++ if (!vpu_set_last_buffer_dequeued(inst, true)) {
+ vdec->eos_received--;
+ vdec_update_state(inst, VPU_CODEC_STATE_DRAIN, 0);
+ }
+@@ -517,7 +518,7 @@ static int vdec_drain(struct vpu_inst *inst)
+ return 0;
+
+ if (!vdec->params.frame_count) {
+- vpu_set_last_buffer_dequeued(inst);
++ vpu_set_last_buffer_dequeued(inst, true);
+ return 0;
+ }
+
+@@ -556,7 +557,7 @@ static int vdec_cmd_stop(struct vpu_inst *inst)
+ vpu_trace(inst->dev, "[%d]\n", inst->id);
+
+ if (inst->state == VPU_CODEC_STATE_DEINIT) {
+- vpu_set_last_buffer_dequeued(inst);
++ vpu_set_last_buffer_dequeued(inst, true);
+ } else {
+ vdec->drain = 1;
+ vdec_drain(inst);
+diff --git a/drivers/media/platform/amphion/venc.c b/drivers/media/platform/amphion/venc.c
+index 37212f087fdd9..e8cb22da938e6 100644
+--- a/drivers/media/platform/amphion/venc.c
++++ b/drivers/media/platform/amphion/venc.c
+@@ -468,7 +468,7 @@ static int venc_encoder_cmd(struct file *file, void *fh, struct v4l2_encoder_cmd
+ vpu_inst_lock(inst);
+ if (cmd->cmd == V4L2_ENC_CMD_STOP) {
+ if (inst->state == VPU_CODEC_STATE_DEINIT)
+- vpu_set_last_buffer_dequeued(inst);
++ vpu_set_last_buffer_dequeued(inst, true);
+ else
+ venc_request_eos(inst);
+ }
+@@ -888,7 +888,7 @@ static void venc_set_last_buffer_dequeued(struct vpu_inst *inst)
+ struct venc_t *venc = inst->priv;
+
+ if (venc->stopped && list_empty(&venc->frames))
+- vpu_set_last_buffer_dequeued(inst);
++ vpu_set_last_buffer_dequeued(inst, true);
+ }
+
+ static void venc_stop_done(struct vpu_inst *inst)
+diff --git a/drivers/media/platform/amphion/vpu_v4l2.c b/drivers/media/platform/amphion/vpu_v4l2.c
+index 590d1084e5a5d..a74953191c221 100644
+--- a/drivers/media/platform/amphion/vpu_v4l2.c
++++ b/drivers/media/platform/amphion/vpu_v4l2.c
+@@ -100,7 +100,7 @@ int vpu_notify_source_change(struct vpu_inst *inst)
+ return 0;
+ }
+
+-int vpu_set_last_buffer_dequeued(struct vpu_inst *inst)
++int vpu_set_last_buffer_dequeued(struct vpu_inst *inst, bool eos)
+ {
+ struct vb2_queue *q;
+
+@@ -116,7 +116,8 @@ int vpu_set_last_buffer_dequeued(struct vpu_inst *inst)
+ vpu_trace(inst->dev, "last buffer dequeued\n");
+ q->last_buffer_dequeued = true;
+ wake_up(&q->done_wq);
+- vpu_notify_eos(inst);
++ if (eos)
++ vpu_notify_eos(inst);
+ return 0;
+ }
+
+diff --git a/drivers/media/platform/amphion/vpu_v4l2.h b/drivers/media/platform/amphion/vpu_v4l2.h
+index 795ca33a6a507..000af24a06ba0 100644
+--- a/drivers/media/platform/amphion/vpu_v4l2.h
++++ b/drivers/media/platform/amphion/vpu_v4l2.h
+@@ -26,7 +26,7 @@ struct vb2_v4l2_buffer *vpu_find_buf_by_idx(struct vpu_inst *inst, u32 type, u32
+ void vpu_v4l2_set_error(struct vpu_inst *inst);
+ int vpu_notify_eos(struct vpu_inst *inst);
+ int vpu_notify_source_change(struct vpu_inst *inst);
+-int vpu_set_last_buffer_dequeued(struct vpu_inst *inst);
++int vpu_set_last_buffer_dequeued(struct vpu_inst *inst, bool eos);
+ void vpu_vb2_buffers_return(struct vpu_inst *inst, unsigned int type, enum vb2_buffer_state state);
+ int vpu_get_num_buffers(struct vpu_inst *inst, u32 type);
+ bool vpu_is_source_empty(struct vpu_inst *inst);
+--
+2.39.2
+
--- /dev/null
+From 0769827bf12d2e03edfc1b67435c386a10040093 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 May 2023 12:53:23 +0100
+Subject: media: atomisp: gmin_platform: fix out_len in
+ gmin_get_config_dsm_var()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit 1657f2934daf89e8d9fa4b2697008909eb22c73e ]
+
+Ideally, strlen(cur->string.pointer) and strlen(out) would be the same.
+But this code is using strscpy() to avoid a potential buffer overflow.
+So in the same way we should take the strlen() of the smaller string to
+avoid a buffer overflow in the caller, gmin_get_var_int().
+
+Link: https://lore.kernel.org/r/26124bcd-8132-4483-9d67-225c87d424e8@kili.mountain
+
+Fixes: 387041cda44e ("media: atomisp: improve sensor detection code to use _DSM table")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c b/drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c
+index 3d41fab661cf0..789b13db80b2f 100644
+--- a/drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c
++++ b/drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c
+@@ -1280,7 +1280,7 @@ static int gmin_get_config_dsm_var(struct device *dev,
+ dev_info(dev, "found _DSM entry for '%s': %s\n", var,
+ cur->string.pointer);
+ strscpy(out, cur->string.pointer, *out_len);
+- *out_len = strlen(cur->string.pointer);
++ *out_len = strlen(out);
+
+ ACPI_FREE(obj);
+ return 0;
+--
+2.39.2
+
--- /dev/null
+From e00c371d9f16157526ee68e71d227524d9b5f70b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Jun 2023 04:54:35 +0200
+Subject: media: cec: i2c: ch7322: also select REGMAP
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 29f96ac23648b2259f42d40703c47dd18fd172ca ]
+
+Selecting only REGMAP_I2C can leave REGMAP unset, causing build errors,
+so also select REGMAP to prevent the build errors.
+
+../drivers/media/cec/i2c/ch7322.c:158:21: error: variable 'ch7322_regmap' has initializer but incomplete type
+ 158 | static const struct regmap_config ch7322_regmap = {
+../drivers/media/cec/i2c/ch7322.c:159:10: error: 'const struct regmap_config' has no member named 'reg_bits'
+ 159 | .reg_bits = 8,
+../drivers/media/cec/i2c/ch7322.c:159:21: warning: excess elements in struct initializer
+ 159 | .reg_bits = 8,
+../drivers/media/cec/i2c/ch7322.c:160:10: error: 'const struct regmap_config' has no member named 'val_bits'
+ 160 | .val_bits = 8,
+../drivers/media/cec/i2c/ch7322.c:160:21: warning: excess elements in struct initializer
+ 160 | .val_bits = 8,
+../drivers/media/cec/i2c/ch7322.c:161:10: error: 'const struct regmap_config' has no member named 'max_register'
+ 161 | .max_register = 0x7f,
+../drivers/media/cec/i2c/ch7322.c:161:25: warning: excess elements in struct initializer
+ 161 | .max_register = 0x7f,
+../drivers/media/cec/i2c/ch7322.c:162:10: error: 'const struct regmap_config' has no member named 'disable_locking'
+ 162 | .disable_locking = true,
+../drivers/media/cec/i2c/ch7322.c:162:28: warning: excess elements in struct initializer
+ 162 | .disable_locking = true,
+../drivers/media/cec/i2c/ch7322.c: In function 'ch7322_probe':
+../drivers/media/cec/i2c/ch7322.c:468:26: error: implicit declaration of function 'devm_regmap_init_i2c' [-Werror=implicit-function-declaration]
+ 468 | ch7322->regmap = devm_regmap_init_i2c(client, &ch7322_regmap);
+../drivers/media/cec/i2c/ch7322.c:468:24: warning: assignment to 'struct regmap *' from 'int' makes pointer from integer without a cast [-Wint-conversion]
+ 468 | ch7322->regmap = devm_regmap_init_i2c(client, &ch7322_regmap);
+../drivers/media/cec/i2c/ch7322.c: At top level:
+../drivers/media/cec/i2c/ch7322.c:158:35: error: storage size of 'ch7322_regmap' isn't known
+ 158 | static const struct regmap_config ch7322_regmap = {
+
+Link: https://lore.kernel.org/linux-media/20230608025435.29249-1-rdunlap@infradead.org
+Fixes: 21b9a47e0ec7 ("media: cec: i2c: ch7322: Add ch7322 CEC controller driver")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Cc: Jeff Chase <jnchase@google.com>
+Cc: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Cc: Joe Tessler <jrt@google.com>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Cc: Mark Brown <broonie@kernel.org>
+Cc: Masahiro Yamada <masahiroy@kernel.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/cec/i2c/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/media/cec/i2c/Kconfig b/drivers/media/cec/i2c/Kconfig
+index 70432a1d69186..d912d143fb312 100644
+--- a/drivers/media/cec/i2c/Kconfig
++++ b/drivers/media/cec/i2c/Kconfig
+@@ -5,6 +5,7 @@
+ config CEC_CH7322
+ tristate "Chrontel CH7322 CEC controller"
+ depends on I2C
++ select REGMAP
+ select REGMAP_I2C
+ select CEC_CORE
+ help
+--
+2.39.2
+
--- /dev/null
+From af577e72146f15f70c495f360b1fd36cad4cedb5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Apr 2023 11:47:47 +0200
+Subject: media: hi846: fix usage of pm_runtime_get_if_in_use()
+
+From: Martin Kepplinger <martin.kepplinger@puri.sm>
+
+[ Upstream commit 04fc06f6dc1592ed5d675311ac50d8fba5db62ab ]
+
+pm_runtime_get_if_in_use() does not only return nonzero values when
+the device is in use, it can return a negative errno too.
+
+And especially during resuming from system suspend, when runtime pm
+is not yet up again, -EAGAIN is being returned, so the subsequent
+pm_runtime_put() call results in a refcount underflow.
+
+Fix system-resume by handling -EAGAIN of pm_runtime_get_if_in_use().
+
+Signed-off-by: Martin Kepplinger <martin.kepplinger@puri.sm>
+Fixes: e8c0882685f9 ("media: i2c: add driver for the SK Hynix Hi-846 8M pixel camera")
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/hi846.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/i2c/hi846.c b/drivers/media/i2c/hi846.c
+index 306dc35e925fd..f8709cdf28b39 100644
+--- a/drivers/media/i2c/hi846.c
++++ b/drivers/media/i2c/hi846.c
+@@ -1353,7 +1353,8 @@ static int hi846_set_ctrl(struct v4l2_ctrl *ctrl)
+ exposure_max);
+ }
+
+- if (!pm_runtime_get_if_in_use(&client->dev))
++ ret = pm_runtime_get_if_in_use(&client->dev);
++ if (!ret || ret == -EAGAIN)
+ return 0;
+
+ switch (ctrl->id) {
+--
+2.39.2
+
--- /dev/null
+From 7bacc9233f260cb9107521901364e0f3aae8d96b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 May 2023 11:35:46 +0100
+Subject: media: i2c: Correct format propagation for st-mipid02
+
+From: Daniel Scally <dan.scally@ideasonboard.com>
+
+[ Upstream commit 306c3190b30d4d6a098888b9d7d4cefaa0ddcb91 ]
+
+Format propagation in the st-mipid02 driver is incorrect in that when
+setting format for V4L2_SUBDEV_FORMAT_TRY on the source pad, the
+_active_ rather than _try_ format from the sink pad is propagated.
+This causes problems with format negotiation - update the function to
+propagate the correct format.
+
+Fixes: 642bb5e88fed ("media: st-mipid02: MIPID02 CSI-2 to PARALLEL bridge driver")
+Signed-off-by: Daniel Scally <dan.scally@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/st-mipid02.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/i2c/st-mipid02.c b/drivers/media/i2c/st-mipid02.c
+index 31b89aff0e86a..f20f87562bf11 100644
+--- a/drivers/media/i2c/st-mipid02.c
++++ b/drivers/media/i2c/st-mipid02.c
+@@ -736,8 +736,13 @@ static void mipid02_set_fmt_source(struct v4l2_subdev *sd,
+ {
+ struct mipid02_dev *bridge = to_mipid02_dev(sd);
+
+- /* source pad mirror active sink pad */
+- format->format = bridge->fmt;
++ /* source pad mirror sink pad */
++ if (format->which == V4L2_SUBDEV_FORMAT_ACTIVE)
++ format->format = bridge->fmt;
++ else
++ format->format = *v4l2_subdev_get_try_format(sd, sd_state,
++ MIPID02_SINK_0);
++
+ /* but code may need to be converted */
+ format->format.code = serial_to_parallel_code(format->format.code);
+
+--
+2.39.2
+
--- /dev/null
+From c91abf032421a6975c66ff353a4454c057a1a84b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 May 2023 02:40:07 +0100
+Subject: media: mediatek: vcodec: using decoder status instead of core work
+ count
+
+From: Yunfei Dong <yunfei.dong@mediatek.com>
+
+[ Upstream commit 2864e304faec04c2674328aad0e820a9cd84cdec ]
+
+Adding the definition of decoder status to separate different decoder
+period for core hardware.
+
+core_work_cnt is the number of core work queued to work queue, the control
+is very complex, leading to some unreasonable test result.
+
+Using parameter status to indicate whether queue core work to work queue.
+
+Fixes: 2e0ef56d81cb ("media: mediatek: vcodec: making sure queue_work successfully")
+Signed-off-by: Yunfei Dong <yunfei.dong@mediatek.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../platform/mediatek/vcodec/vdec_msg_queue.c | 33 ++++++++-----------
+ .../platform/mediatek/vcodec/vdec_msg_queue.h | 16 +++++++--
+ 2 files changed, 28 insertions(+), 21 deletions(-)
+
+diff --git a/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c b/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c
+index f3073d1e7f420..03f8d7cd8eddc 100644
+--- a/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c
++++ b/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c
+@@ -71,7 +71,6 @@ static void vdec_msg_queue_dec(struct vdec_msg_queue *msg_queue, int hardware_in
+ int vdec_msg_queue_qbuf(struct vdec_msg_queue_ctx *msg_ctx, struct vdec_lat_buf *buf)
+ {
+ struct list_head *head;
+- int status;
+
+ head = vdec_get_buf_list(msg_ctx->hardware_index, buf);
+ if (!head) {
+@@ -87,12 +86,9 @@ int vdec_msg_queue_qbuf(struct vdec_msg_queue_ctx *msg_ctx, struct vdec_lat_buf
+ if (msg_ctx->hardware_index != MTK_VDEC_CORE) {
+ wake_up_all(&msg_ctx->ready_to_use);
+ } else {
+- if (buf->ctx->msg_queue.core_work_cnt <
+- atomic_read(&buf->ctx->msg_queue.core_list_cnt)) {
+- status = queue_work(buf->ctx->dev->core_workqueue,
+- &buf->ctx->msg_queue.core_work);
+- if (status)
+- buf->ctx->msg_queue.core_work_cnt++;
++ if (!(buf->ctx->msg_queue.status & CONTEXT_LIST_QUEUED)) {
++ queue_work(buf->ctx->dev->core_workqueue, &buf->ctx->msg_queue.core_work);
++ buf->ctx->msg_queue.status |= CONTEXT_LIST_QUEUED;
+ }
+ }
+
+@@ -261,7 +257,10 @@ static void vdec_msg_queue_core_work(struct work_struct *work)
+ container_of(msg_queue, struct mtk_vcodec_ctx, msg_queue);
+ struct mtk_vcodec_dev *dev = ctx->dev;
+ struct vdec_lat_buf *lat_buf;
+- int status;
++
++ spin_lock(&ctx->dev->msg_queue_core_ctx.ready_lock);
++ ctx->msg_queue.status &= ~CONTEXT_LIST_QUEUED;
++ spin_unlock(&ctx->dev->msg_queue_core_ctx.ready_lock);
+
+ lat_buf = vdec_msg_queue_dqbuf(&dev->msg_queue_core_ctx);
+ if (!lat_buf)
+@@ -278,17 +277,13 @@ static void vdec_msg_queue_core_work(struct work_struct *work)
+ vdec_msg_queue_qbuf(&ctx->msg_queue.lat_ctx, lat_buf);
+
+ wake_up_all(&ctx->msg_queue.core_dec_done);
+- spin_lock(&dev->msg_queue_core_ctx.ready_lock);
+- lat_buf->ctx->msg_queue.core_work_cnt--;
+-
+- if (lat_buf->ctx->msg_queue.core_work_cnt <
+- atomic_read(&lat_buf->ctx->msg_queue.core_list_cnt)) {
+- status = queue_work(lat_buf->ctx->dev->core_workqueue,
+- &lat_buf->ctx->msg_queue.core_work);
+- if (status)
+- lat_buf->ctx->msg_queue.core_work_cnt++;
++ if (!(ctx->msg_queue.status & CONTEXT_LIST_QUEUED) &&
++ atomic_read(&msg_queue->core_list_cnt)) {
++ spin_lock(&ctx->dev->msg_queue_core_ctx.ready_lock);
++ ctx->msg_queue.status |= CONTEXT_LIST_QUEUED;
++ spin_unlock(&ctx->dev->msg_queue_core_ctx.ready_lock);
++ queue_work(ctx->dev->core_workqueue, &msg_queue->core_work);
+ }
+- spin_unlock(&dev->msg_queue_core_ctx.ready_lock);
+ }
+
+ int vdec_msg_queue_init(struct vdec_msg_queue *msg_queue,
+@@ -303,13 +298,13 @@ int vdec_msg_queue_init(struct vdec_msg_queue *msg_queue,
+ return 0;
+
+ msg_queue->ctx = ctx;
+- msg_queue->core_work_cnt = 0;
+ vdec_msg_queue_init_ctx(&msg_queue->lat_ctx, MTK_VDEC_LAT0);
+ INIT_WORK(&msg_queue->core_work, vdec_msg_queue_core_work);
+
+ atomic_set(&msg_queue->lat_list_cnt, 0);
+ atomic_set(&msg_queue->core_list_cnt, 0);
+ init_waitqueue_head(&msg_queue->core_dec_done);
++ msg_queue->status = CONTEXT_LIST_EMPTY;
+
+ msg_queue->wdma_addr.size =
+ vde_msg_queue_get_trans_size(ctx->picinfo.buf_w,
+diff --git a/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.h b/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.h
+index a5d44bc97c16b..8f82d14847726 100644
+--- a/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.h
++++ b/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.h
+@@ -21,6 +21,18 @@ struct mtk_vcodec_ctx;
+ struct mtk_vcodec_dev;
+ typedef int (*core_decode_cb_t)(struct vdec_lat_buf *lat_buf);
+
++/**
++ * enum core_ctx_status - Context decode status for core hardwre.
++ * @CONTEXT_LIST_EMPTY: No buffer queued on core hardware(must always be 0)
++ * @CONTEXT_LIST_QUEUED: Buffer queued to core work list
++ * @CONTEXT_LIST_DEC_DONE: context decode done
++ */
++enum core_ctx_status {
++ CONTEXT_LIST_EMPTY = 0,
++ CONTEXT_LIST_QUEUED,
++ CONTEXT_LIST_DEC_DONE,
++};
++
+ /**
+ * struct vdec_msg_queue_ctx - represents a queue for buffers ready to be processed
+ * @ready_to_use: ready used queue used to signalize when get a job queue
+@@ -77,7 +89,7 @@ struct vdec_lat_buf {
+ * @lat_list_cnt: used to record each instance lat list count
+ * @core_list_cnt: used to record each instance core list count
+ * @core_dec_done: core work queue decode done event
+- * @core_work_cnt: the number of core work in work queue
++ * @status: current context decode status for core hardware
+ */
+ struct vdec_msg_queue {
+ struct vdec_lat_buf lat_buf[NUM_BUFFER_COUNT];
+@@ -93,7 +105,7 @@ struct vdec_msg_queue {
+ atomic_t lat_list_cnt;
+ atomic_t core_list_cnt;
+ wait_queue_head_t core_dec_done;
+- int core_work_cnt;
++ int status;
+ };
+
+ /**
+--
+2.39.2
+
--- /dev/null
+From 811d2a179fa06565d8dd32fadfb8302bf1b2f08f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Mar 2023 10:04:49 -0700
+Subject: media: usb: Check az6007_read() return value
+
+From: Daniil Dulov <d.dulov@aladdin.ru>
+
+[ Upstream commit fdaca63186f59fc664b346c45b76576624b48e57 ]
+
+If az6007_read() returns error, there is no sence to continue.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: 3af2f4f15a61 ("[media] az6007: Change the az6007 read/write routine parameter")
+Signed-off-by: Daniil Dulov <d.dulov@aladdin.ru>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/dvb-usb-v2/az6007.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/usb/dvb-usb-v2/az6007.c b/drivers/media/usb/dvb-usb-v2/az6007.c
+index 62ee09f28a0bc..7524c90f5da61 100644
+--- a/drivers/media/usb/dvb-usb-v2/az6007.c
++++ b/drivers/media/usb/dvb-usb-v2/az6007.c
+@@ -202,7 +202,8 @@ static int az6007_rc_query(struct dvb_usb_device *d)
+ unsigned code;
+ enum rc_proto proto;
+
+- az6007_read(d, AZ6007_READ_IR, 0, 0, st->data, 10);
++ if (az6007_read(d, AZ6007_READ_IR, 0, 0, st->data, 10) < 0)
++ return -EIO;
+
+ if (st->data[1] == 0x44)
+ return 0;
+--
+2.39.2
+
--- /dev/null
+From 6974707c5463ef6a0a706292dc84c400256910ab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 May 2023 07:59:32 +0800
+Subject: media: usb: siano: Fix warning due to null work_func_t function
+ pointer
+
+From: Duoming Zhou <duoming@zju.edu.cn>
+
+[ Upstream commit 6f489a966fbeb0da63d45c2c66a8957eab604bf6 ]
+
+The previous commit ebad8e731c1c ("media: usb: siano: Fix use after
+free bugs caused by do_submit_urb") adds cancel_work_sync() in
+smsusb_stop_streaming(). But smsusb_stop_streaming() may be called,
+even if the work_struct surb->wq has not been initialized. As a result,
+the warning will occur. One of the processes that could lead to warning
+is shown below:
+
+smsusb_probe()
+ smsusb_init_device()
+ if (!dev->in_ep || !dev->out_ep || align < 0) {
+ smsusb_term_device(intf);
+ smsusb_stop_streaming()
+ cancel_work_sync(&dev->surbs[i].wq);
+ __cancel_work_timer()
+ __flush_work()
+ if (WARN_ON(!work->func)) // work->func is null
+
+The log reported by syzbot is shown below:
+
+WARNING: CPU: 0 PID: 897 at kernel/workqueue.c:3066 __flush_work+0x798/0xa80 kernel/workqueue.c:3063
+Modules linked in:
+CPU: 0 PID: 897 Comm: kworker/0:2 Not tainted 6.2.0-rc1-syzkaller #0
+RIP: 0010:__flush_work+0x798/0xa80 kernel/workqueue.c:3066
+...
+RSP: 0018:ffffc9000464ebf8 EFLAGS: 00010246
+RAX: 1ffff11002dbb420 RBX: 0000000000000021 RCX: 1ffffffff204fa4e
+RDX: dffffc0000000000 RSI: 0000000000000001 RDI: ffff888016dda0e8
+RBP: ffffc9000464ed98 R08: 0000000000000001 R09: ffffffff90253b2f
+R10: 0000000000000001 R11: 0000000000000000 R12: ffff888016dda0e8
+R13: ffff888016dda0e8 R14: ffff888016dda100 R15: 0000000000000001
+FS: 0000000000000000(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 00007ffd4331efe8 CR3: 000000000b48e000 CR4: 00000000003506f0
+DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+Call Trace:
+ <TASK>
+ __cancel_work_timer+0x315/0x460 kernel/workqueue.c:3160
+ smsusb_stop_streaming drivers/media/usb/siano/smsusb.c:182 [inline]
+ smsusb_term_device+0xda/0x2d0 drivers/media/usb/siano/smsusb.c:344
+ smsusb_init_device+0x400/0x9ce drivers/media/usb/siano/smsusb.c:419
+ smsusb_probe+0xbbd/0xc55 drivers/media/usb/siano/smsusb.c:567
+...
+
+This patch adds check before cancel_work_sync(). If surb->wq has not
+been initialized, the cancel_work_sync() will not be executed.
+
+Reported-by: syzbot+27b0b464864741b18b99@syzkaller.appspotmail.com
+Fixes: ebad8e731c1c ("media: usb: siano: Fix use after free bugs caused by do_submit_urb")
+Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/siano/smsusb.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/usb/siano/smsusb.c b/drivers/media/usb/siano/smsusb.c
+index 6f443c542c6da..640737d3b8aeb 100644
+--- a/drivers/media/usb/siano/smsusb.c
++++ b/drivers/media/usb/siano/smsusb.c
+@@ -179,7 +179,8 @@ static void smsusb_stop_streaming(struct smsusb_device_t *dev)
+
+ for (i = 0; i < MAX_URBS; i++) {
+ usb_kill_urb(&dev->surbs[i].urb);
+- cancel_work_sync(&dev->surbs[i].wq);
++ if (dev->surbs[i].wq.func)
++ cancel_work_sync(&dev->surbs[i].wq);
+
+ if (dev->surbs[i].cb) {
+ smscore_putbuffer(dev->coredev, dev->surbs[i].cb);
+--
+2.39.2
+
--- /dev/null
+From 5ce054188097929e550a1104ed6b23f2128713b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 12 Sep 2020 20:03:01 +0100
+Subject: media: venus: helpers: Fix ALIGN() of non power of two
+
+From: Rikard Falkeborn <rikard.falkeborn@gmail.com>
+
+[ Upstream commit 927e78ac8bc58155316cf6f46026e1912bbbbcfc ]
+
+ALIGN() expects its second argument to be a power of 2, otherwise
+incorrect results are produced for some inputs. The output can be
+both larger or smaller than what is expected.
+
+For example, ALIGN(304, 192) equals 320 instead of 384, and
+ALIGN(65, 192) equals 256 instead of 192.
+
+However, nestling two ALIGN() as is done in this case seem to only
+produce results equal to or bigger than the expected result if ALIGN()
+had handled non powers of two, and that in turn results in framesizes
+that are either the correct size or too large.
+
+Fortunately, since 192 * 4 / 3 equals 256, it turns out that one ALIGN()
+is sufficient.
+
+Fixes: ab1eda449c6e ("media: venus: vdec: handle 10bit bitstreams")
+Signed-off-by: Rikard Falkeborn <rikard.falkeborn@gmail.com>
+Signed-off-by: Stanimir Varbanov <stanimir.k.varbanov@gmail.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/qcom/venus/helpers.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/platform/qcom/venus/helpers.c b/drivers/media/platform/qcom/venus/helpers.c
+index ab6a29ffc81e2..ca6555bdc92fa 100644
+--- a/drivers/media/platform/qcom/venus/helpers.c
++++ b/drivers/media/platform/qcom/venus/helpers.c
+@@ -1036,8 +1036,8 @@ static u32 get_framesize_raw_yuv420_tp10_ubwc(u32 width, u32 height)
+ u32 extradata = SZ_16K;
+ u32 size;
+
+- y_stride = ALIGN(ALIGN(width, 192) * 4 / 3, 256);
+- uv_stride = ALIGN(ALIGN(width, 192) * 4 / 3, 256);
++ y_stride = ALIGN(width * 4 / 3, 256);
++ uv_stride = ALIGN(width * 4 / 3, 256);
+ y_sclines = ALIGN(height, 16);
+ uv_sclines = ALIGN((height + 1) >> 1, 16);
+
+--
+2.39.2
+
--- /dev/null
+From c625ea132d30a84941724b0da8fed8ab4ff9e664 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 May 2023 15:36:49 +0200
+Subject: media: videodev2.h: Fix struct v4l2_input tuner index comment
+
+From: Marek Vasut <marex@denx.de>
+
+[ Upstream commit 26ae58f65e64fa7ba61d64bae752e59e08380c6a ]
+
+VIDIOC_ENUMINPUT documentation describes the tuner field of
+struct v4l2_input as index:
+
+Documentation/userspace-api/media/v4l/vidioc-enuminput.rst
+"
+* - __u32
+ - ``tuner``
+ - Capture devices can have zero or more tuners (RF demodulators).
+ When the ``type`` is set to ``V4L2_INPUT_TYPE_TUNER`` this is an
+ RF connector and this field identifies the tuner. It corresponds
+ to struct :c:type:`v4l2_tuner` field ``index``. For
+ details on tuners see :ref:`tuner`.
+"
+
+Drivers I could find also use the 'tuner' field as an index, e.g.:
+drivers/media/pci/bt8xx/bttv-driver.c bttv_enum_input()
+drivers/media/usb/go7007/go7007-v4l2.c vidioc_enum_input()
+
+However, the UAPI comment claims this field is 'enum v4l2_tuner_type':
+include/uapi/linux/videodev2.h
+
+This field being 'enum v4l2_tuner_type' is unlikely as it seems to be
+never used that way in drivers, and documentation confirms it. It seem
+this comment got in accidentally in the commit which this patch fixes.
+Fix the UAPI comment to stop confusion.
+
+This was pointed out by Dmitry while reviewing VIDIOC_ENUMINPUT
+support for strace.
+
+Fixes: 6016af82eafc ("[media] v4l2: use __u32 rather than enums in ioctl() structs")
+Signed-off-by: Marek Vasut <marex@denx.de>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/uapi/linux/videodev2.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/uapi/linux/videodev2.h b/include/uapi/linux/videodev2.h
+index 29da1f4b4578e..45fa03882ef18 100644
+--- a/include/uapi/linux/videodev2.h
++++ b/include/uapi/linux/videodev2.h
+@@ -1693,7 +1693,7 @@ struct v4l2_input {
+ __u8 name[32]; /* Label */
+ __u32 type; /* Type of input */
+ __u32 audioset; /* Associated audios (bitfield) */
+- __u32 tuner; /* enum v4l2_tuner_type */
++ __u32 tuner; /* Tuner index */
+ v4l2_std_id std;
+ __u32 status;
+ __u32 capabilities;
+--
+2.39.2
+
--- /dev/null
+From 705f42bb0bad2d24ebebe9a87eba246e3f4d097c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Jun 2023 09:48:18 +0800
+Subject: mfd: intel-lpss: Add missing check for platform_get_resource
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit d918e0d5824495a75d00b879118b098fcab36fdb ]
+
+Add the missing check for platform_get_resource and return error
+if it fails.
+
+Fixes: 4b45efe85263 ("mfd: Add support for Intel Sunrisepoint LPSS devices")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Signed-off-by: Lee Jones <lee@kernel.org>
+Link: https://lore.kernel.org/r/20230609014818.28475-1-jiasheng@iscas.ac.cn
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/intel-lpss-acpi.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/mfd/intel-lpss-acpi.c b/drivers/mfd/intel-lpss-acpi.c
+index a143c8dca2d93..212818aef93e2 100644
+--- a/drivers/mfd/intel-lpss-acpi.c
++++ b/drivers/mfd/intel-lpss-acpi.c
+@@ -183,6 +183,9 @@ static int intel_lpss_acpi_probe(struct platform_device *pdev)
+ return -ENOMEM;
+
+ info->mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++ if (!info->mem)
++ return -ENODEV;
++
+ info->irq = platform_get_irq(pdev, 0);
+
+ ret = intel_lpss_probe(&pdev->dev, info);
+--
+2.39.2
+
--- /dev/null
+From 2d0eb680efa6fbc9e00ebcb2199fd9a5b1bcf654 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 May 2023 22:57:10 +0200
+Subject: mfd: rt5033: Drop rt5033-battery sub-device
+
+From: Stephan Gerhold <stephan@gerhold.net>
+
+[ Upstream commit 43db1344e0f8c1eb687a1d6cd5b0de3009ab66cb ]
+
+The fuel gauge in the RT5033 PMIC (rt5033-battery) has its own I2C bus
+and interrupt lines. Therefore, it is not part of the MFD device
+and needs to be specified separately in the device tree.
+
+Fixes: 0b271258544b ("mfd: rt5033: Add Richtek RT5033 driver core.")
+Signed-off-by: Stephan Gerhold <stephan@gerhold.net>
+Signed-off-by: Jakob Hauser <jahau@rocketmail.com>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Lee Jones <lee@kernel.org>
+Link: https://lore.kernel.org/r/6a8a19bc67b5be3732882e8131ad2ffcb546ac03.1684182964.git.jahau@rocketmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/rt5033.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/drivers/mfd/rt5033.c b/drivers/mfd/rt5033.c
+index f1236a9acf304..df095e91e2666 100644
+--- a/drivers/mfd/rt5033.c
++++ b/drivers/mfd/rt5033.c
+@@ -41,9 +41,6 @@ static const struct mfd_cell rt5033_devs[] = {
+ {
+ .name = "rt5033-charger",
+ .of_compatible = "richtek,rt5033-charger",
+- }, {
+- .name = "rt5033-battery",
+- .of_compatible = "richtek,rt5033-battery",
+ }, {
+ .name = "rt5033-led",
+ .of_compatible = "richtek,rt5033-led",
+--
+2.39.2
+
--- /dev/null
+From 8469c140c3ad64584d7932310e819a44f381cc8b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Jun 2023 11:28:03 +0200
+Subject: mfd: stmfx: Fix error path in stmfx_chip_init
+
+From: Amelie Delaunay <amelie.delaunay@foss.st.com>
+
+[ Upstream commit f592cf624531286f8b52e40dcfc157a5a7fb115c ]
+
+In error path, disable vdd regulator if it exists, but don't overload ret.
+Because if regulator_disable() is successful, stmfx_chip_init will exit
+successfully while chip init failed.
+
+Fixes: 06252ade9156 ("mfd: Add ST Multi-Function eXpander (STMFX) core driver")
+Signed-off-by: Amelie Delaunay <amelie.delaunay@foss.st.com>
+Link: https://lore.kernel.org/r/20230609092804.793100-1-amelie.delaunay@foss.st.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/stmfx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mfd/stmfx.c b/drivers/mfd/stmfx.c
+index 5dd7d96884596..61a8aad564a4e 100644
+--- a/drivers/mfd/stmfx.c
++++ b/drivers/mfd/stmfx.c
+@@ -387,7 +387,7 @@ static int stmfx_chip_init(struct i2c_client *client)
+
+ err:
+ if (stmfx->vdd)
+- return regulator_disable(stmfx->vdd);
++ regulator_disable(stmfx->vdd);
+
+ return ret;
+ }
+--
+2.39.2
+
--- /dev/null
+From 0cacb5dc39c5f84d901869628aaa2c86e43337a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Jun 2023 11:28:04 +0200
+Subject: mfd: stmfx: Nullify stmfx->vdd in case of error
+
+From: Amelie Delaunay <amelie.delaunay@foss.st.com>
+
+[ Upstream commit 7c81582c0bccb4757186176f0ee12834597066ad ]
+
+Nullify stmfx->vdd in case devm_regulator_get_optional() returns an error.
+And simplify code by returning an error only if return code is not -ENODEV,
+which means there is no vdd regulator and it is not an issue.
+
+Fixes: d75846ed08e6 ("mfd: stmfx: Fix dev_err_probe() call in stmfx_chip_init()")
+Signed-off-by: Amelie Delaunay <amelie.delaunay@foss.st.com>
+Link: https://lore.kernel.org/r/20230609092804.793100-2-amelie.delaunay@foss.st.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/stmfx.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/mfd/stmfx.c b/drivers/mfd/stmfx.c
+index 61a8aad564a4e..b1ecd85ad2a8a 100644
+--- a/drivers/mfd/stmfx.c
++++ b/drivers/mfd/stmfx.c
+@@ -330,9 +330,8 @@ static int stmfx_chip_init(struct i2c_client *client)
+ stmfx->vdd = devm_regulator_get_optional(&client->dev, "vdd");
+ ret = PTR_ERR_OR_ZERO(stmfx->vdd);
+ if (ret) {
+- if (ret == -ENODEV)
+- stmfx->vdd = NULL;
+- else
++ stmfx->vdd = NULL;
++ if (ret != -ENODEV)
+ return dev_err_probe(&client->dev, ret, "Failed to get VDD regulator\n");
+ }
+
+--
+2.39.2
+
--- /dev/null
+From ffe7e651447359f734b9d258cc6c16fe2e8651c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 17 Jun 2023 12:43:16 +0200
+Subject: mfd: stmpe: Only disable the regulators if they are enabled
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 104d32bd81f620bb9f67fbf7d1159c414e89f05f ]
+
+In stmpe_probe(), if some regulator_enable() calls fail, probing continues
+and there is only a dev_warn().
+
+So, if stmpe_probe() is called the regulator may not be enabled. It is
+cleaner to test it before calling regulator_disable() in the remove
+function.
+
+Fixes: 9c9e321455fb ("mfd: stmpe: add optional regulators")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Link: https://lore.kernel.org/r/8de3aaf297931d655b9ad6aed548f4de8b85425a.1686998575.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/stmpe.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/mfd/stmpe.c b/drivers/mfd/stmpe.c
+index 0c4f74197d3e0..aef29221d7c12 100644
+--- a/drivers/mfd/stmpe.c
++++ b/drivers/mfd/stmpe.c
+@@ -1485,9 +1485,9 @@ int stmpe_probe(struct stmpe_client_info *ci, enum stmpe_partnum partnum)
+
+ void stmpe_remove(struct stmpe *stmpe)
+ {
+- if (!IS_ERR(stmpe->vio))
++ if (!IS_ERR(stmpe->vio) && regulator_is_enabled(stmpe->vio))
+ regulator_disable(stmpe->vio);
+- if (!IS_ERR(stmpe->vcc))
++ if (!IS_ERR(stmpe->vcc) && regulator_is_enabled(stmpe->vcc))
+ regulator_disable(stmpe->vcc);
+
+ __stmpe_disable(stmpe, STMPE_BLOCK_ADC);
+--
+2.39.2
+
--- /dev/null
+From 7cfbbcaae53ee4cda32d447a3e18ede6cea50ec6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 20 May 2023 09:10:54 +0200
+Subject: mfd: wcd934x: Fix an error handling path in wcd934x_slim_probe()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit f190b4891a3f9fac123a7afd378d4143a2723313 ]
+
+If devm_gpiod_get_optional() fails, some resources need to be released, as
+already done in the .remove() function.
+
+While at it, remove the unneeded error code from a dev_err_probe() call.
+It is already added in a human readable way by dev_err_probe() itself.
+
+Fixes: 6a0ee2a61a31 ("mfd: wcd934x: Replace legacy gpio interface for gpiod")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Link: https://lore.kernel.org/r/02d8447f6d1df52cc8357aae698152e9a9be67c6.1684565021.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/wcd934x.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/mfd/wcd934x.c b/drivers/mfd/wcd934x.c
+index 68e2fa2fda99c..32ed2bd863758 100644
+--- a/drivers/mfd/wcd934x.c
++++ b/drivers/mfd/wcd934x.c
+@@ -253,8 +253,9 @@ static int wcd934x_slim_probe(struct slim_device *sdev)
+ usleep_range(600, 650);
+ reset_gpio = devm_gpiod_get_optional(dev, "reset", GPIOD_OUT_LOW);
+ if (IS_ERR(reset_gpio)) {
+- return dev_err_probe(dev, PTR_ERR(reset_gpio),
+- "Failed to get reset gpio: err = %ld\n", PTR_ERR(reset_gpio));
++ ret = dev_err_probe(dev, PTR_ERR(reset_gpio),
++ "Failed to get reset gpio\n");
++ goto err_disable_regulators;
+ }
+ msleep(20);
+ gpiod_set_value(reset_gpio, 1);
+@@ -264,6 +265,10 @@ static int wcd934x_slim_probe(struct slim_device *sdev)
+ dev_set_drvdata(dev, ddata);
+
+ return 0;
++
++err_disable_regulators:
++ regulator_bulk_disable(WCD934X_MAX_SUPPLY, ddata->supplies);
++ return ret;
+ }
+
+ static void wcd934x_slim_remove(struct slim_device *sdev)
+--
+2.39.2
+
--- /dev/null
+From 978040058f7f3afca9014652a9e82e866d9b9dcf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Jun 2023 13:25:46 +0300
+Subject: misc: fastrpc: check return value of devm_kasprintf()
+
+From: Claudiu Beznea <claudiu.beznea@microchip.com>
+
+[ Upstream commit af2e19d82a116bc622eea84c9faadd5f7e20bec4 ]
+
+devm_kasprintf() returns a pointer to dynamically allocated memory.
+Pointer could be NULL in case allocation fails. Check pointer validity.
+Identified with coccinelle (kmerr.cocci script).
+
+Fixes: 3abe3ab3cdab ("misc: fastrpc: add secure domain support")
+Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Link: https://lore.kernel.org/r/20230615102546.581899-1-claudiu.beznea@microchip.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/fastrpc.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c
+index 8b1e8661c3d73..e5cabb9012135 100644
+--- a/drivers/misc/fastrpc.c
++++ b/drivers/misc/fastrpc.c
+@@ -2030,6 +2030,9 @@ static int fastrpc_device_register(struct device *dev, struct fastrpc_channel_ct
+ fdev->miscdev.fops = &fastrpc_fops;
+ fdev->miscdev.name = devm_kasprintf(dev, GFP_KERNEL, "fastrpc-%s%s",
+ domain, is_secured ? "-secure" : "");
++ if (!fdev->miscdev.name)
++ return -ENOMEM;
++
+ err = misc_register(&fdev->miscdev);
+ if (!err) {
+ if (is_secured)
+--
+2.39.2
+
--- /dev/null
+From 306e5a516d905a13efedf937d35cc54f1dad884c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Jun 2023 09:26:47 +0800
+Subject: mlxsw: minimal: fix potential memory leak in mlxsw_m_linecards_init
+
+From: Zhengchao Shao <shaozhengchao@huawei.com>
+
+[ Upstream commit 08fc75735fda3be97194bfbf3c899c87abb3d0fe ]
+
+The line cards array is not freed in the error path of
+mlxsw_m_linecards_init(), which can lead to a memory leak. Fix by
+freeing the array in the error path, thereby making the error path
+identical to mlxsw_m_linecards_fini().
+
+Fixes: 01328e23a476 ("mlxsw: minimal: Extend module to port mapping with slot index")
+Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com>
+Reviewed-by: Petr Machata <petrm@nvidia.com>
+Reviewed-by: Ido Schimmel <idosch@nvidia.com>
+Link: https://lore.kernel.org/r/20230630012647.1078002-1-shaozhengchao@huawei.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlxsw/minimal.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/minimal.c b/drivers/net/ethernet/mellanox/mlxsw/minimal.c
+index 55b3c42bb0071..15116d9305f8e 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/minimal.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/minimal.c
+@@ -430,6 +430,7 @@ static int mlxsw_m_linecards_init(struct mlxsw_m *mlxsw_m)
+ err_kmalloc_array:
+ for (i--; i >= 0; i--)
+ kfree(mlxsw_m->line_cards[i]);
++ kfree(mlxsw_m->line_cards);
+ err_kcalloc:
+ kfree(mlxsw_m->ports);
+ return err;
+--
+2.39.2
+
--- /dev/null
+From 908fc3452bd6b93af1ffe28a9e1db4e1d418dc0c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 28 Jan 2023 10:58:30 -0500
+Subject: net: add a couple of helpers for iph tot_len
+
+From: Xin Long <lucien.xin@gmail.com>
+
+[ Upstream commit 058a8f7f73aae1cc22b53fcefec031b9e391b54d ]
+
+This patch adds three APIs to replace the iph->tot_len setting
+and getting in all places where IPv4 BIG TCP packets may reach,
+they will be used in the following patches.
+
+Note that iph_totlen() will be used when iph is not in linear
+data of the skb.
+
+Signed-off-by: Xin Long <lucien.xin@gmail.com>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Stable-dep-of: b2dc32dcba08 ("net/sched: act_ipt: add sanity checks on skb before calling target")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/ip.h | 21 +++++++++++++++++++++
+ include/net/route.h | 3 ---
+ 2 files changed, 21 insertions(+), 3 deletions(-)
+
+diff --git a/include/linux/ip.h b/include/linux/ip.h
+index 3d9c6750af627..d11c25f5030a0 100644
+--- a/include/linux/ip.h
++++ b/include/linux/ip.h
+@@ -35,4 +35,25 @@ static inline unsigned int ip_transport_len(const struct sk_buff *skb)
+ {
+ return ntohs(ip_hdr(skb)->tot_len) - skb_network_header_len(skb);
+ }
++
++static inline unsigned int iph_totlen(const struct sk_buff *skb, const struct iphdr *iph)
++{
++ u32 len = ntohs(iph->tot_len);
++
++ return (len || !skb_is_gso(skb) || !skb_is_gso_tcp(skb)) ?
++ len : skb->len - skb_network_offset(skb);
++}
++
++static inline unsigned int skb_ip_totlen(const struct sk_buff *skb)
++{
++ return iph_totlen(skb, ip_hdr(skb));
++}
++
++/* IPv4 datagram length is stored into 16bit field (tot_len) */
++#define IP_MAX_MTU 0xFFFFU
++
++static inline void iph_set_totlen(struct iphdr *iph, unsigned int len)
++{
++ iph->tot_len = len <= IP_MAX_MTU ? htons(len) : 0;
++}
+ #endif /* _LINUX_IP_H */
+diff --git a/include/net/route.h b/include/net/route.h
+index 6e92dd5bcd613..fe00b0a2e4759 100644
+--- a/include/net/route.h
++++ b/include/net/route.h
+@@ -35,9 +35,6 @@
+ #include <linux/cache.h>
+ #include <linux/security.h>
+
+-/* IPv4 datagram length is stored into 16bit field (tot_len) */
+-#define IP_MAX_MTU 0xFFFFU
+-
+ #define RTO_ONLINK 0x01
+
+ #define RT_CONN_FLAGS(sk) (RT_TOS(inet_sk(sk)->tos) | sock_flag(sk, SOCK_LOCALROUTE))
+--
+2.39.2
+
--- /dev/null
+From 6d3954e12c1b9bb98860ea0660f32b6c3b2a101d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Jun 2023 19:41:18 +0300
+Subject: net: bridge: keep ports without IFF_UNICAST_FLT in BR_PROMISC mode
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit 6ca3c005d0604e8d2b439366e3923ea58db99641 ]
+
+According to the synchronization rules for .ndo_get_stats() as seen in
+Documentation/networking/netdevices.rst, acquiring a plain spin_lock()
+should not be illegal, but the bridge driver implementation makes it so.
+
+After running these commands, I am being faced with the following
+lockdep splat:
+
+$ ip link add link swp0 name macsec0 type macsec encrypt on && ip link set swp0 up
+$ ip link add dev br0 type bridge vlan_filtering 1 && ip link set br0 up
+$ ip link set macsec0 master br0 && ip link set macsec0 up
+
+ ========================================================
+ WARNING: possible irq lock inversion dependency detected
+ 6.4.0-04295-g31b577b4bd4a #603 Not tainted
+ --------------------------------------------------------
+ swapper/1/0 just changed the state of lock:
+ ffff6bd348724cd8 (&br->lock){+.-.}-{3:3}, at: br_forward_delay_timer_expired+0x34/0x198
+ but this lock took another, SOFTIRQ-unsafe lock in the past:
+ (&ocelot->stats_lock){+.+.}-{3:3}
+
+ and interrupts could create inverse lock ordering between them.
+
+ other info that might help us debug this:
+ Chain exists of:
+ &br->lock --> &br->hash_lock --> &ocelot->stats_lock
+
+ Possible interrupt unsafe locking scenario:
+
+ CPU0 CPU1
+ ---- ----
+ lock(&ocelot->stats_lock);
+ local_irq_disable();
+ lock(&br->lock);
+ lock(&br->hash_lock);
+ <Interrupt>
+ lock(&br->lock);
+
+ *** DEADLOCK ***
+
+(details about the 3 locks skipped)
+
+swp0 is instantiated by drivers/net/dsa/ocelot/felix.c, and this
+only matters to the extent that its .ndo_get_stats64() method calls
+spin_lock(&ocelot->stats_lock).
+
+Documentation/locking/lockdep-design.rst says:
+
+| A lock is irq-safe means it was ever used in an irq context, while a lock
+| is irq-unsafe means it was ever acquired with irq enabled.
+
+(...)
+
+| Furthermore, the following usage based lock dependencies are not allowed
+| between any two lock-classes::
+|
+| <hardirq-safe> -> <hardirq-unsafe>
+| <softirq-safe> -> <softirq-unsafe>
+
+Lockdep marks br->hash_lock as softirq-safe, because it is sometimes
+taken in softirq context (for example br_fdb_update() which runs in
+NET_RX softirq), and when it's not in softirq context it blocks softirqs
+by using spin_lock_bh().
+
+Lockdep marks ocelot->stats_lock as softirq-unsafe, because it never
+blocks softirqs from running, and it is never taken from softirq
+context. So it can always be interrupted by softirqs.
+
+There is a call path through which a function that holds br->hash_lock:
+fdb_add_hw_addr() will call a function that acquires ocelot->stats_lock:
+ocelot_port_get_stats64(). This can be seen below:
+
+ocelot_port_get_stats64+0x3c/0x1e0
+felix_get_stats64+0x20/0x38
+dsa_slave_get_stats64+0x3c/0x60
+dev_get_stats+0x74/0x2c8
+rtnl_fill_stats+0x4c/0x150
+rtnl_fill_ifinfo+0x5cc/0x7b8
+rtmsg_ifinfo_build_skb+0xe4/0x150
+rtmsg_ifinfo+0x5c/0xb0
+__dev_notify_flags+0x58/0x200
+__dev_set_promiscuity+0xa0/0x1f8
+dev_set_promiscuity+0x30/0x70
+macsec_dev_change_rx_flags+0x68/0x88
+__dev_set_promiscuity+0x1a8/0x1f8
+__dev_set_rx_mode+0x74/0xa8
+dev_uc_add+0x74/0xa0
+fdb_add_hw_addr+0x68/0xd8
+fdb_add_local+0xc4/0x110
+br_fdb_add_local+0x54/0x88
+br_add_if+0x338/0x4a0
+br_add_slave+0x20/0x38
+do_setlink+0x3a4/0xcb8
+rtnl_newlink+0x758/0x9d0
+rtnetlink_rcv_msg+0x2f0/0x550
+netlink_rcv_skb+0x128/0x148
+rtnetlink_rcv+0x24/0x38
+
+the plain English explanation for it is:
+
+The macsec0 bridge port is created without p->flags & BR_PROMISC,
+because it is what br_manage_promisc() decides for a VLAN filtering
+bridge with a single auto port.
+
+As part of the br_add_if() procedure, br_fdb_add_local() is called for
+the MAC address of the device, and this results in a call to
+dev_uc_add() for macsec0 while the softirq-safe br->hash_lock is taken.
+
+Because macsec0 does not have IFF_UNICAST_FLT, dev_uc_add() ends up
+calling __dev_set_promiscuity() for macsec0, which is propagated by its
+implementation, macsec_dev_change_rx_flags(), to the lower device: swp0.
+This triggers the call path:
+
+dev_set_promiscuity(swp0)
+-> rtmsg_ifinfo()
+ -> dev_get_stats()
+ -> ocelot_port_get_stats64()
+
+with a calling context that lockdep doesn't like (br->hash_lock held).
+
+Normally we don't see this, because even though many drivers that can be
+bridge ports don't support IFF_UNICAST_FLT, we need a driver that
+
+(a) doesn't support IFF_UNICAST_FLT, *and*
+(b) it forwards the IFF_PROMISC flag to another driver, and
+(c) *that* driver implements ndo_get_stats64() using a softirq-unsafe
+ spinlock.
+
+Condition (b) is necessary because the first __dev_set_rx_mode() calls
+__dev_set_promiscuity() with "bool notify=false", and thus, the
+rtmsg_ifinfo() code path won't be entered.
+
+The same criteria also hold true for DSA switches which don't report
+IFF_UNICAST_FLT. When the DSA master uses a spin_lock() in its
+ndo_get_stats64() method, the same lockdep splat can be seen.
+
+I think the deadlock possibility is real, even though I didn't reproduce
+it, and I'm thinking of the following situation to support that claim:
+
+fdb_add_hw_addr() runs on a CPU A, in a context with softirqs locally
+disabled and br->hash_lock held, and may end up attempting to acquire
+ocelot->stats_lock.
+
+In parallel, ocelot->stats_lock is currently held by a thread B (say,
+ocelot_check_stats_work()), which is interrupted while holding it by a
+softirq which attempts to lock br->hash_lock.
+
+Thread B cannot make progress because br->hash_lock is held by A. Whereas
+thread A cannot make progress because ocelot->stats_lock is held by B.
+
+When taking the issue at face value, the bridge can avoid that problem
+by simply making the ports promiscuous from a code path with a saner
+calling context (br->hash_lock not held). A bridge port without
+IFF_UNICAST_FLT is going to become promiscuous as soon as we call
+dev_uc_add() on it (which we do unconditionally), so why not be
+preemptive and make it promiscuous right from the beginning, so as to
+not be taken by surprise.
+
+With this, we've broken the links between code that holds br->hash_lock
+or br->lock and code that calls into the ndo_change_rx_flags() or
+ndo_get_stats64() ops of the bridge port.
+
+Fixes: 2796d0c648c9 ("bridge: Automatically manage port promiscuous mode.")
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Reviewed-by: Ido Schimmel <idosch@nvidia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bridge/br_if.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
+index 228fd5b20f109..0989074f316ef 100644
+--- a/net/bridge/br_if.c
++++ b/net/bridge/br_if.c
+@@ -166,8 +166,9 @@ void br_manage_promisc(struct net_bridge *br)
+ * This lets us disable promiscuous mode and write
+ * this config to hw.
+ */
+- if (br->auto_cnt == 0 ||
+- (br->auto_cnt == 1 && br_auto_port(p)))
++ if ((p->dev->priv_flags & IFF_UNICAST_FLT) &&
++ (br->auto_cnt == 0 ||
++ (br->auto_cnt == 1 && br_auto_port(p))))
+ br_port_clear_promisc(p);
+ else
+ br_port_set_promisc(p);
+--
+2.39.2
+
--- /dev/null
+From b640761babc2557583a919e7b0f0a5ce54621e5f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jun 2023 19:31:14 +0300
+Subject: net: dsa: felix: don't drop PTP frames with tag_8021q when RX
+ timestamping is disabled
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit 2edcfcbb3c5946609be1d8875473a240b170673b ]
+
+The driver implements a workaround for the fact that it doesn't have an
+IRQ source to tell it whether PTP frames are available through the
+extraction registers, for those frames to be processed and passed
+towards the network stack. That workaround is to configure the switch,
+through felix_hwtstamp_set() -> felix_update_trapping_destinations(),
+to create two copies of PTP packets: one sent over Ethernet to the DSA
+master, and one to be consumed through the aforementioned CPU extraction
+queue registers.
+
+The reason why we want PTP packets to be consumed through the CPU
+extraction registers in the first place is because we want to see their
+hardware RX timestamp. With tag_8021q, that is only visible that way,
+and it isn't visible with the copy of the packet that's transmitted over
+Ethernet.
+
+The problem with the workaround implementation is that it drops the
+packet received over Ethernet, in expectation of its copy being present
+in the CPU extraction registers. However, if felix_hwtstamp_set() hasn't
+run (aka PTP RX timestamping is disabled), the driver will drop the
+original PTP frame and there will be no copy of it in the CPU extraction
+registers. So, the network stack will simply not see any PTP frame.
+
+Look at the port's trapping configuration to see whether the driver has
+previously enabled the CPU extraction registers. If it hasn't, just
+don't RX timestamp the frame and let it be passed up the stack by DSA,
+which is perfectly fine.
+
+Fixes: 0a6f17c6ae21 ("net: dsa: tag_ocelot_8021q: add support for PTP timestamping")
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/ocelot/felix.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/drivers/net/dsa/ocelot/felix.c b/drivers/net/dsa/ocelot/felix.c
+index dd3a18cc89dd2..4faabc4364aa7 100644
+--- a/drivers/net/dsa/ocelot/felix.c
++++ b/drivers/net/dsa/ocelot/felix.c
+@@ -1705,6 +1705,18 @@ static bool felix_rxtstamp(struct dsa_switch *ds, int port,
+ u32 tstamp_hi;
+ u64 tstamp;
+
++ switch (type & PTP_CLASS_PMASK) {
++ case PTP_CLASS_L2:
++ if (!(ocelot->ports[port]->trap_proto & OCELOT_PROTO_PTP_L2))
++ return false;
++ break;
++ case PTP_CLASS_IPV4:
++ case PTP_CLASS_IPV6:
++ if (!(ocelot->ports[port]->trap_proto & OCELOT_PROTO_PTP_L4))
++ return false;
++ break;
++ }
++
+ /* If the "no XTR IRQ" workaround is in use, tell DSA to defer this skb
+ * for RX timestamping. Then free it, and poll for its copy through
+ * MMIO in the CPU port module, and inject that into the stack from
+--
+2.39.2
+
--- /dev/null
+From 2e9ad3c5c55d896502f2645040c62dcfed0e30c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jun 2023 12:42:06 +0300
+Subject: net: dsa: sja1105: always enable the INCL_SRCPT option
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit b4638af8885af93cd70351081da1909c59342440 ]
+
+Link-local traffic on bridged SJA1105 ports is sometimes tagged by the
+hardware with source port information (when the port is under a VLAN
+aware bridge).
+
+The tag_8021q source port identification has become more loose
+("imprecise") and will report a plausible rather than exact bridge port,
+when under a bridge (be it VLAN-aware or VLAN-unaware). But link-local
+traffic always needs to know the precise source port.
+
+Modify the driver logic (and therefore: the tagging protocol itself) to
+always include the source port information with link-local packets,
+regardless of whether the port is standalone, under a VLAN-aware or
+VLAN-unaware bridge. This makes it possible for the tagging driver to
+give priority to that information over the tag_8021q VLAN header.
+
+The big drawback with INCL_SRCPT is that it makes it impossible to
+distinguish between an original MAC DA of 01:80:C2:XX:YY:ZZ and
+01:80:C2:AA:BB:ZZ, because the tagger just patches MAC DA bytes 3 and 4
+with zeroes. Only if PTP RX timestamping is enabled, the switch will
+generate a META follow-up frame containing the RX timestamp and the
+original bytes 3 and 4 of the MAC DA. Those will be used to patch up the
+original packet. Nonetheless, in the absence of PTP RX timestamping, we
+have to live with this limitation, since it is more important to have
+the more precise source port information for link-local traffic.
+
+Fixes: d7f9787a763f ("net: dsa: tag_8021q: add support for imprecise RX based on the VBID")
+Fixes: 91495f21fcec ("net: dsa: tag_8021q: replace the SVL bridging with VLAN-unaware IVL bridging")
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/sja1105/sja1105_main.c | 9 ++-------
+ 1 file changed, 2 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/dsa/sja1105/sja1105_main.c b/drivers/net/dsa/sja1105/sja1105_main.c
+index b70dcf32a26dc..8bd61f2ebb2ad 100644
+--- a/drivers/net/dsa/sja1105/sja1105_main.c
++++ b/drivers/net/dsa/sja1105/sja1105_main.c
+@@ -866,11 +866,11 @@ static int sja1105_init_general_params(struct sja1105_private *priv)
+ .hostprio = 7,
+ .mac_fltres1 = SJA1105_LINKLOCAL_FILTER_A,
+ .mac_flt1 = SJA1105_LINKLOCAL_FILTER_A_MASK,
+- .incl_srcpt1 = false,
++ .incl_srcpt1 = true,
+ .send_meta1 = false,
+ .mac_fltres0 = SJA1105_LINKLOCAL_FILTER_B,
+ .mac_flt0 = SJA1105_LINKLOCAL_FILTER_B_MASK,
+- .incl_srcpt0 = false,
++ .incl_srcpt0 = true,
+ .send_meta0 = false,
+ /* Default to an invalid value */
+ .mirr_port = priv->ds->num_ports,
+@@ -2407,11 +2407,6 @@ int sja1105_vlan_filtering(struct dsa_switch *ds, int port, bool enabled,
+ general_params->tpid = tpid;
+ /* EtherType used to identify outer tagged (S-tag) VLAN traffic */
+ general_params->tpid2 = tpid2;
+- /* When VLAN filtering is on, we need to at least be able to
+- * decode management traffic through the "backup plan".
+- */
+- general_params->incl_srcpt1 = enabled;
+- general_params->incl_srcpt0 = enabled;
+
+ for (port = 0; port < ds->num_ports; port++) {
+ if (dsa_is_unused_port(ds, port))
+--
+2.39.2
+
--- /dev/null
+From 48e1417bf8b6cb026e9cc1d86a6230e71f9fb2cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Jul 2023 01:05:45 +0300
+Subject: net: dsa: sja1105: always enable the send_meta options
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit a372d66af48506d9f7aaae2a474cd18f14d98cb8 ]
+
+incl_srcpt has the limitation, mentioned in commit b4638af8885a ("net:
+dsa: sja1105: always enable the INCL_SRCPT option"), that frames with a
+MAC DA of 01:80:c2:xx:yy:zz will be received as 01:80:c2:00:00:zz unless
+PTP RX timestamping is enabled.
+
+The incl_srcpt option was initially unconditionally enabled, then that
+changed with commit 42824463d38d ("net: dsa: sja1105: Limit use of
+incl_srcpt to bridge+vlan mode"), then again with b4638af8885a ("net:
+dsa: sja1105: always enable the INCL_SRCPT option"). Bottom line is that
+it now needs to be always enabled, otherwise the driver does not have a
+reliable source of information regarding source_port and switch_id for
+link-local traffic (tag_8021q VLANs may be imprecise since now they
+identify an entire bridging domain when ports are not standalone).
+
+If we accept that PTP RX timestamping (and therefore, meta frame
+generation) is always enabled in hardware, then that limitation could be
+avoided and packets with any MAC DA can be properly received, because
+meta frames do contain the original bytes from the MAC DA of their
+associated link-local packet.
+
+This change enables meta frame generation unconditionally, which also
+has the nice side effects of simplifying the switch control path
+(a switch reset is no longer required on hwtstamping settings change)
+and the tagger data path (it no longer needs to be informed whether to
+expect meta frames or not - it always does).
+
+Fixes: 227d07a07ef1 ("net: dsa: sja1105: Add support for traffic through standalone ports")
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/sja1105/sja1105.h | 2 +-
+ drivers/net/dsa/sja1105/sja1105_main.c | 5 ++-
+ drivers/net/dsa/sja1105/sja1105_ptp.c | 48 +++-----------------------
+ include/linux/dsa/sja1105.h | 4 ---
+ net/dsa/tag_sja1105.c | 45 ------------------------
+ 5 files changed, 7 insertions(+), 97 deletions(-)
+
+diff --git a/drivers/net/dsa/sja1105/sja1105.h b/drivers/net/dsa/sja1105/sja1105.h
+index 9ba2ec2b966d9..fb3cd4c78faa8 100644
+--- a/drivers/net/dsa/sja1105/sja1105.h
++++ b/drivers/net/dsa/sja1105/sja1105.h
+@@ -250,6 +250,7 @@ struct sja1105_private {
+ unsigned long ucast_egress_floods;
+ unsigned long bcast_egress_floods;
+ unsigned long hwts_tx_en;
++ unsigned long hwts_rx_en;
+ const struct sja1105_info *info;
+ size_t max_xfer_len;
+ struct spi_device *spidev;
+@@ -287,7 +288,6 @@ struct sja1105_spi_message {
+ /* From sja1105_main.c */
+ enum sja1105_reset_reason {
+ SJA1105_VLAN_FILTERING = 0,
+- SJA1105_RX_HWTSTAMPING,
+ SJA1105_AGEING_TIME,
+ SJA1105_SCHEDULING,
+ SJA1105_BEST_EFFORT_POLICING,
+diff --git a/drivers/net/dsa/sja1105/sja1105_main.c b/drivers/net/dsa/sja1105/sja1105_main.c
+index 8bd61f2ebb2ad..947e8f7c09880 100644
+--- a/drivers/net/dsa/sja1105/sja1105_main.c
++++ b/drivers/net/dsa/sja1105/sja1105_main.c
+@@ -867,11 +867,11 @@ static int sja1105_init_general_params(struct sja1105_private *priv)
+ .mac_fltres1 = SJA1105_LINKLOCAL_FILTER_A,
+ .mac_flt1 = SJA1105_LINKLOCAL_FILTER_A_MASK,
+ .incl_srcpt1 = true,
+- .send_meta1 = false,
++ .send_meta1 = true,
+ .mac_fltres0 = SJA1105_LINKLOCAL_FILTER_B,
+ .mac_flt0 = SJA1105_LINKLOCAL_FILTER_B_MASK,
+ .incl_srcpt0 = true,
+- .send_meta0 = false,
++ .send_meta0 = true,
+ /* Default to an invalid value */
+ .mirr_port = priv->ds->num_ports,
+ /* No TTEthernet */
+@@ -2215,7 +2215,6 @@ static int sja1105_reload_cbs(struct sja1105_private *priv)
+
+ static const char * const sja1105_reset_reasons[] = {
+ [SJA1105_VLAN_FILTERING] = "VLAN filtering",
+- [SJA1105_RX_HWTSTAMPING] = "RX timestamping",
+ [SJA1105_AGEING_TIME] = "Ageing time",
+ [SJA1105_SCHEDULING] = "Time-aware scheduling",
+ [SJA1105_BEST_EFFORT_POLICING] = "Best-effort policing",
+diff --git a/drivers/net/dsa/sja1105/sja1105_ptp.c b/drivers/net/dsa/sja1105/sja1105_ptp.c
+index 30fb2cc40164b..a7d41e7813982 100644
+--- a/drivers/net/dsa/sja1105/sja1105_ptp.c
++++ b/drivers/net/dsa/sja1105/sja1105_ptp.c
+@@ -58,35 +58,10 @@ enum sja1105_ptp_clk_mode {
+ #define ptp_data_to_sja1105(d) \
+ container_of((d), struct sja1105_private, ptp_data)
+
+-/* Must be called only while the RX timestamping state of the tagger
+- * is turned off
+- */
+-static int sja1105_change_rxtstamping(struct sja1105_private *priv,
+- bool on)
+-{
+- struct sja1105_ptp_data *ptp_data = &priv->ptp_data;
+- struct sja1105_general_params_entry *general_params;
+- struct sja1105_table *table;
+-
+- table = &priv->static_config.tables[BLK_IDX_GENERAL_PARAMS];
+- general_params = table->entries;
+- general_params->send_meta1 = on;
+- general_params->send_meta0 = on;
+-
+- ptp_cancel_worker_sync(ptp_data->clock);
+- skb_queue_purge(&ptp_data->skb_txtstamp_queue);
+- skb_queue_purge(&ptp_data->skb_rxtstamp_queue);
+-
+- return sja1105_static_config_reload(priv, SJA1105_RX_HWTSTAMPING);
+-}
+-
+ int sja1105_hwtstamp_set(struct dsa_switch *ds, int port, struct ifreq *ifr)
+ {
+- struct sja1105_tagger_data *tagger_data = sja1105_tagger_data(ds);
+ struct sja1105_private *priv = ds->priv;
+ struct hwtstamp_config config;
+- bool rx_on;
+- int rc;
+
+ if (copy_from_user(&config, ifr->ifr_data, sizeof(config)))
+ return -EFAULT;
+@@ -104,26 +79,13 @@ int sja1105_hwtstamp_set(struct dsa_switch *ds, int port, struct ifreq *ifr)
+
+ switch (config.rx_filter) {
+ case HWTSTAMP_FILTER_NONE:
+- rx_on = false;
++ priv->hwts_rx_en &= ~BIT(port);
+ break;
+ default:
+- rx_on = true;
++ priv->hwts_rx_en |= BIT(port);
+ break;
+ }
+
+- if (rx_on != tagger_data->rxtstamp_get_state(ds)) {
+- tagger_data->rxtstamp_set_state(ds, false);
+-
+- rc = sja1105_change_rxtstamping(priv, rx_on);
+- if (rc < 0) {
+- dev_err(ds->dev,
+- "Failed to change RX timestamping: %d\n", rc);
+- return rc;
+- }
+- if (rx_on)
+- tagger_data->rxtstamp_set_state(ds, true);
+- }
+-
+ if (copy_to_user(ifr->ifr_data, &config, sizeof(config)))
+ return -EFAULT;
+ return 0;
+@@ -131,7 +93,6 @@ int sja1105_hwtstamp_set(struct dsa_switch *ds, int port, struct ifreq *ifr)
+
+ int sja1105_hwtstamp_get(struct dsa_switch *ds, int port, struct ifreq *ifr)
+ {
+- struct sja1105_tagger_data *tagger_data = sja1105_tagger_data(ds);
+ struct sja1105_private *priv = ds->priv;
+ struct hwtstamp_config config;
+
+@@ -140,7 +101,7 @@ int sja1105_hwtstamp_get(struct dsa_switch *ds, int port, struct ifreq *ifr)
+ config.tx_type = HWTSTAMP_TX_ON;
+ else
+ config.tx_type = HWTSTAMP_TX_OFF;
+- if (tagger_data->rxtstamp_get_state(ds))
++ if (priv->hwts_rx_en & BIT(port))
+ config.rx_filter = HWTSTAMP_FILTER_PTP_V2_L2_EVENT;
+ else
+ config.rx_filter = HWTSTAMP_FILTER_NONE;
+@@ -413,11 +374,10 @@ static long sja1105_rxtstamp_work(struct ptp_clock_info *ptp)
+
+ bool sja1105_rxtstamp(struct dsa_switch *ds, int port, struct sk_buff *skb)
+ {
+- struct sja1105_tagger_data *tagger_data = sja1105_tagger_data(ds);
+ struct sja1105_private *priv = ds->priv;
+ struct sja1105_ptp_data *ptp_data = &priv->ptp_data;
+
+- if (!tagger_data->rxtstamp_get_state(ds))
++ if (!(priv->hwts_rx_en & BIT(port)))
+ return false;
+
+ /* We need to read the full PTP clock to reconstruct the Rx
+diff --git a/include/linux/dsa/sja1105.h b/include/linux/dsa/sja1105.h
+index 159e43171cccf..c177322f793d6 100644
+--- a/include/linux/dsa/sja1105.h
++++ b/include/linux/dsa/sja1105.h
+@@ -48,13 +48,9 @@ struct sja1105_deferred_xmit_work {
+
+ /* Global tagger data */
+ struct sja1105_tagger_data {
+- /* Tagger to switch */
+ void (*xmit_work_fn)(struct kthread_work *work);
+ void (*meta_tstamp_handler)(struct dsa_switch *ds, int port, u8 ts_id,
+ enum sja1110_meta_tstamp dir, u64 tstamp);
+- /* Switch to tagger */
+- bool (*rxtstamp_get_state)(struct dsa_switch *ds);
+- void (*rxtstamp_set_state)(struct dsa_switch *ds, bool on);
+ };
+
+ struct sja1105_skb_cb {
+diff --git a/net/dsa/tag_sja1105.c b/net/dsa/tag_sja1105.c
+index d3f27cd5fe244..143348962a216 100644
+--- a/net/dsa/tag_sja1105.c
++++ b/net/dsa/tag_sja1105.c
+@@ -53,11 +53,8 @@
+ #define SJA1110_TX_TRAILER_LEN 4
+ #define SJA1110_MAX_PADDING_LEN 15
+
+-#define SJA1105_HWTS_RX_EN 0
+-
+ struct sja1105_tagger_private {
+ struct sja1105_tagger_data data; /* Must be first */
+- unsigned long state;
+ /* Protects concurrent access to the meta state machine
+ * from taggers running on multiple ports on SMP systems
+ */
+@@ -387,10 +384,6 @@ static struct sk_buff
+
+ priv = sja1105_tagger_private(ds);
+
+- if (!test_bit(SJA1105_HWTS_RX_EN, &priv->state))
+- /* Do normal processing. */
+- return skb;
+-
+ spin_lock(&priv->meta_lock);
+ /* Was this a link-local frame instead of the meta
+ * that we were expecting?
+@@ -426,12 +419,6 @@ static struct sk_buff
+
+ priv = sja1105_tagger_private(ds);
+
+- /* Drop the meta frame if we're not in the right state
+- * to process it.
+- */
+- if (!test_bit(SJA1105_HWTS_RX_EN, &priv->state))
+- return NULL;
+-
+ spin_lock(&priv->meta_lock);
+
+ stampable_skb = priv->stampable_skb;
+@@ -467,30 +454,6 @@ static struct sk_buff
+ return skb;
+ }
+
+-static bool sja1105_rxtstamp_get_state(struct dsa_switch *ds)
+-{
+- struct sja1105_tagger_private *priv = sja1105_tagger_private(ds);
+-
+- return test_bit(SJA1105_HWTS_RX_EN, &priv->state);
+-}
+-
+-static void sja1105_rxtstamp_set_state(struct dsa_switch *ds, bool on)
+-{
+- struct sja1105_tagger_private *priv = sja1105_tagger_private(ds);
+-
+- if (on)
+- set_bit(SJA1105_HWTS_RX_EN, &priv->state);
+- else
+- clear_bit(SJA1105_HWTS_RX_EN, &priv->state);
+-
+- /* Initialize the meta state machine to a known state */
+- if (!priv->stampable_skb)
+- return;
+-
+- kfree_skb(priv->stampable_skb);
+- priv->stampable_skb = NULL;
+-}
+-
+ static bool sja1105_skb_has_tag_8021q(const struct sk_buff *skb)
+ {
+ u16 tpid = ntohs(eth_hdr(skb)->h_proto);
+@@ -547,9 +510,6 @@ static struct sk_buff *sja1105_rcv(struct sk_buff *skb,
+ */
+ source_port = hdr->h_dest[3];
+ switch_id = hdr->h_dest[4];
+- /* Clear the DMAC bytes that were mangled by the switch */
+- hdr->h_dest[3] = 0;
+- hdr->h_dest[4] = 0;
+ } else if (is_meta) {
+ sja1105_meta_unpack(skb, &meta);
+ source_port = meta.source_port;
+@@ -780,7 +740,6 @@ static void sja1105_disconnect(struct dsa_switch *ds)
+
+ static int sja1105_connect(struct dsa_switch *ds)
+ {
+- struct sja1105_tagger_data *tagger_data;
+ struct sja1105_tagger_private *priv;
+ struct kthread_worker *xmit_worker;
+ int err;
+@@ -800,10 +759,6 @@ static int sja1105_connect(struct dsa_switch *ds)
+ }
+
+ priv->xmit_worker = xmit_worker;
+- /* Export functions for switch driver use */
+- tagger_data = &priv->data;
+- tagger_data->rxtstamp_get_state = sja1105_rxtstamp_get_state;
+- tagger_data->rxtstamp_set_state = sja1105_rxtstamp_set_state;
+ ds->tagger_data = priv;
+
+ return 0;
+--
+2.39.2
+
--- /dev/null
+From 0eca48440313cb507ecd93886107a5be3da9bdef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jun 2023 12:42:07 +0300
+Subject: net: dsa: tag_sja1105: always prefer source port information from
+ INCL_SRCPT
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit c1ae02d876898b1b8ca1e12c6f84d7b406263800 ]
+
+Currently the sja1105 tagging protocol prefers using the source port
+information from the VLAN header if that is available, falling back to
+the INCL_SRCPT option if it isn't. The VLAN header is available for all
+frames except for META frames initiated by the switch (containing RX
+timestamps), and thus, the "if (is_link_local)" branch is practically
+dead.
+
+The tag_8021q source port identification has become more loose
+("imprecise") and will report a plausible rather than exact bridge port,
+when under a bridge (be it VLAN-aware or VLAN-unaware). But link-local
+traffic always needs to know the precise source port. With incorrect
+source port reporting, for example PTP traffic over 2 bridged ports will
+all be seen on sockets opened on the first such port, which is incorrect.
+
+Now that the tagging protocol has been changed to make link-local frames
+always contain source port information, we can reverse the order of the
+checks so that we always give precedence to that information (which is
+always precise) in lieu of the tag_8021q VID which is only precise for a
+standalone port.
+
+Fixes: d7f9787a763f ("net: dsa: tag_8021q: add support for imprecise RX based on the VBID")
+Fixes: 91495f21fcec ("net: dsa: tag_8021q: replace the SVL bridging with VLAN-unaware IVL bridging")
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/dsa/tag_sja1105.c | 38 +++++++++++++++++++++++++++++---------
+ 1 file changed, 29 insertions(+), 9 deletions(-)
+
+diff --git a/net/dsa/tag_sja1105.c b/net/dsa/tag_sja1105.c
+index 1a85125bda6da..731dc3a111ef3 100644
+--- a/net/dsa/tag_sja1105.c
++++ b/net/dsa/tag_sja1105.c
+@@ -540,10 +540,7 @@ static struct sk_buff *sja1105_rcv(struct sk_buff *skb,
+ is_link_local = sja1105_is_link_local(skb);
+ is_meta = sja1105_is_meta_frame(skb);
+
+- if (sja1105_skb_has_tag_8021q(skb)) {
+- /* Normal traffic path. */
+- sja1105_vlan_rcv(skb, &source_port, &switch_id, &vbid, &vid);
+- } else if (is_link_local) {
++ if (is_link_local) {
+ /* Management traffic path. Switch embeds the switch ID and
+ * port ID into bytes of the destination MAC, courtesy of
+ * the incl_srcpt options.
+@@ -557,16 +554,39 @@ static struct sk_buff *sja1105_rcv(struct sk_buff *skb,
+ sja1105_meta_unpack(skb, &meta);
+ source_port = meta.source_port;
+ switch_id = meta.switch_id;
+- } else {
++ }
++
++ /* Normal data plane traffic and link-local frames are tagged with
++ * a tag_8021q VLAN which we have to strip
++ */
++ if (sja1105_skb_has_tag_8021q(skb)) {
++ int tmp_source_port = -1, tmp_switch_id = -1;
++
++ sja1105_vlan_rcv(skb, &tmp_source_port, &tmp_switch_id, &vbid,
++ &vid);
++ /* Preserve the source information from the INCL_SRCPT option,
++ * if available. This allows us to not overwrite a valid source
++ * port and switch ID with zeroes when receiving link-local
++ * frames from a VLAN-unaware bridged port (non-zero vbid) or a
++ * VLAN-aware bridged port (non-zero vid).
++ */
++ if (source_port == -1)
++ source_port = tmp_source_port;
++ if (switch_id == -1)
++ switch_id = tmp_switch_id;
++ } else if (source_port == -1 && switch_id == -1) {
++ /* Packets with no source information have no chance of
++ * getting accepted, drop them straight away.
++ */
+ return NULL;
+ }
+
+- if (vbid >= 1)
++ if (source_port != -1 && switch_id != -1)
++ skb->dev = dsa_master_find_slave(netdev, switch_id, source_port);
++ else if (vbid >= 1)
+ skb->dev = dsa_tag_8021q_find_port_by_vbid(netdev, vbid);
+- else if (source_port == -1 || switch_id == -1)
+- skb->dev = dsa_find_designated_bridge_port_by_vid(netdev, vid);
+ else
+- skb->dev = dsa_master_find_slave(netdev, switch_id, source_port);
++ skb->dev = dsa_find_designated_bridge_port_by_vid(netdev, vid);
+ if (!skb->dev) {
+ netdev_warn(netdev, "Couldn't decode source port\n");
+ return NULL;
+--
+2.39.2
+
--- /dev/null
+From b63408892bc0486d8e45e36c62623ea1a928cc67 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Jul 2023 01:05:44 +0300
+Subject: net: dsa: tag_sja1105: fix MAC DA patching from meta frames
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit 1dcf6efd5f0c1f4496b3ef7ec5a7db104a53b38c ]
+
+The SJA1105 manual says that at offset 4 into the meta frame payload we
+have "MAC destination byte 2" and at offset 5 we have "MAC destination
+byte 1". These are counted from the LSB, so byte 1 is h_dest[ETH_HLEN-2]
+aka h_dest[4] and byte 2 is h_dest[ETH_HLEN-3] aka h_dest[3].
+
+The sja1105_meta_unpack() function decodes these the other way around,
+so a frame with MAC DA 01:80:c2:11:22:33 is received by the network
+stack as having 01:80:c2:22:11:33.
+
+Fixes: e53e18a6fe4d ("net: dsa: sja1105: Receive and decode meta frames")
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/dsa/tag_sja1105.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/dsa/tag_sja1105.c b/net/dsa/tag_sja1105.c
+index 6e3699d859dbd..d3f27cd5fe244 100644
+--- a/net/dsa/tag_sja1105.c
++++ b/net/dsa/tag_sja1105.c
+@@ -113,8 +113,8 @@ static void sja1105_meta_unpack(const struct sk_buff *skb,
+ * a unified unpacking command for both device series.
+ */
+ packing(buf, &meta->tstamp, 31, 0, 4, UNPACK, 0);
+- packing(buf + 4, &meta->dmac_byte_4, 7, 0, 1, UNPACK, 0);
+- packing(buf + 5, &meta->dmac_byte_3, 7, 0, 1, UNPACK, 0);
++ packing(buf + 4, &meta->dmac_byte_3, 7, 0, 1, UNPACK, 0);
++ packing(buf + 5, &meta->dmac_byte_4, 7, 0, 1, UNPACK, 0);
+ packing(buf + 6, &meta->source_port, 7, 0, 1, UNPACK, 0);
+ packing(buf + 7, &meta->switch_id, 7, 0, 1, UNPACK, 0);
+ }
+--
+2.39.2
+
--- /dev/null
+From 772350116f40ff69008c98f1916f4264775a4251 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 1 Jul 2023 01:20:10 +0300
+Subject: net: dsa: tag_sja1105: fix source port decoding in vlan_filtering=0
+ bridge mode
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit a398b9ea0c3b791b7a0f4c6029a62cf628f97f22 ]
+
+There was a regression introduced by the blamed commit, where pinging to
+a VLAN-unaware bridge would fail with the repeated message "Couldn't
+decode source port" coming from the tagging protocol driver.
+
+When receiving packets with a bridge_vid as determined by
+dsa_tag_8021q_bridge_join(), dsa_8021q_rcv() will decode:
+- source_port = 0 (which isn't really valid, more like "don't know")
+- switch_id = 0 (which isn't really valid, more like "don't know")
+- vbid = value in range 1-7
+
+Since the blamed patch has reversed the order of the checks, we are now
+going to believe that source_port != -1 and switch_id != -1, so they're
+valid, but they aren't.
+
+The minimal solution to the problem is to only populate source_port and
+switch_id with what dsa_8021q_rcv() came up with, if the vbid is zero,
+i.e. the source port information is trustworthy.
+
+Fixes: c1ae02d87689 ("net: dsa: tag_sja1105: always prefer source port information from INCL_SRCPT")
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/dsa/tag_sja1105.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/net/dsa/tag_sja1105.c b/net/dsa/tag_sja1105.c
+index 731dc3a111ef3..6e3699d859dbd 100644
+--- a/net/dsa/tag_sja1105.c
++++ b/net/dsa/tag_sja1105.c
+@@ -568,11 +568,14 @@ static struct sk_buff *sja1105_rcv(struct sk_buff *skb,
+ * if available. This allows us to not overwrite a valid source
+ * port and switch ID with zeroes when receiving link-local
+ * frames from a VLAN-unaware bridged port (non-zero vbid) or a
+- * VLAN-aware bridged port (non-zero vid).
++ * VLAN-aware bridged port (non-zero vid). Furthermore, the
++ * tag_8021q source port information is only of trust when the
++ * vbid is 0 (precise port). Otherwise, tmp_source_port and
++ * tmp_switch_id will be zeroes.
+ */
+- if (source_port == -1)
++ if (vbid == 0 && source_port == -1)
+ source_port = tmp_source_port;
+- if (switch_id == -1)
++ if (vbid == 0 && switch_id == -1)
+ switch_id = tmp_switch_id;
+ } else if (source_port == -1 && switch_id == -1) {
+ /* Packets with no source information have no chance of
+--
+2.39.2
+
--- /dev/null
+From 015508a3707a7985b30de421f0eeac18aa1953d5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Jun 2023 21:43:27 +0200
+Subject: net: dsa: vsc73xx: fix MTU configuration
+
+From: Pawel Dembicki <paweldembicki@gmail.com>
+
+[ Upstream commit 3cf62c8177adb0db9e15c8b898c44f997acf3ebf ]
+
+Switch in MAXLEN register stores the maximum size of a data frame.
+The MTU size is 18 bytes smaller than the frame size.
+
+The current settings are causing problems with packet forwarding.
+This patch fixes the MTU settings to proper values.
+
+Fixes: fb77ffc6ec86 ("net: dsa: vsc73xx: make the MTU configurable")
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Pawel Dembicki <paweldembicki@gmail.com>
+Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
+Link: https://lore.kernel.org/r/20230628194327.1765644-1-paweldembicki@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/vitesse-vsc73xx-core.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/dsa/vitesse-vsc73xx-core.c b/drivers/net/dsa/vitesse-vsc73xx-core.c
+index ae55167ce0a6f..ef1a4a7c47b23 100644
+--- a/drivers/net/dsa/vitesse-vsc73xx-core.c
++++ b/drivers/net/dsa/vitesse-vsc73xx-core.c
+@@ -1025,17 +1025,17 @@ static int vsc73xx_change_mtu(struct dsa_switch *ds, int port, int new_mtu)
+ struct vsc73xx *vsc = ds->priv;
+
+ return vsc73xx_write(vsc, VSC73XX_BLOCK_MAC, port,
+- VSC73XX_MAXLEN, new_mtu);
++ VSC73XX_MAXLEN, new_mtu + ETH_HLEN + ETH_FCS_LEN);
+ }
+
+ /* According to application not "VSC7398 Jumbo Frames" setting
+- * up the MTU to 9.6 KB does not affect the performance on standard
++ * up the frame size to 9.6 KB does not affect the performance on standard
+ * frames. It is clear from the application note that
+ * "9.6 kilobytes" == 9600 bytes.
+ */
+ static int vsc73xx_get_max_mtu(struct dsa_switch *ds, int port)
+ {
+- return 9600;
++ return 9600 - ETH_HLEN - ETH_FCS_LEN;
+ }
+
+ static const struct dsa_switch_ops vsc73xx_ds_ops = {
+--
+2.39.2
+
--- /dev/null
+From 3b057e8013a18bfac648f7e2d146f5308df04f4a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 1 Jul 2023 02:48:24 +0000
+Subject: net: fix net_dev_start_xmit trace event vs skb_transport_offset()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit f88fcb1d7d961b4b402d675109726f94db87571c ]
+
+After blamed commit, we must be more careful about using
+skb_transport_offset(), as reminded us by syzbot:
+
+WARNING: CPU: 0 PID: 10 at include/linux/skbuff.h:2868 skb_transport_offset include/linux/skbuff.h:2977 [inline]
+WARNING: CPU: 0 PID: 10 at include/linux/skbuff.h:2868 perf_trace_net_dev_start_xmit+0x89a/0xce0 include/trace/events/net.h:14
+Modules linked in:
+CPU: 0 PID: 10 Comm: kworker/u4:1 Not tainted 6.1.30-syzkaller #0
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023
+Workqueue: bat_events batadv_iv_send_outstanding_bat_ogm_packet
+RIP: 0010:skb_transport_header include/linux/skbuff.h:2868 [inline]
+RIP: 0010:skb_transport_offset include/linux/skbuff.h:2977 [inline]
+RIP: 0010:perf_trace_net_dev_start_xmit+0x89a/0xce0 include/trace/events/net.h:14
+Code: 8b 04 25 28 00 00 00 48 3b 84 24 c0 00 00 00 0f 85 4e 04 00 00 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc e8 56 22 01 fd <0f> 0b e9 f6 fc ff ff 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 86 f9 ff
+RSP: 0018:ffffc900002bf700 EFLAGS: 00010293
+RAX: ffffffff8485d8ca RBX: 000000000000ffff RCX: ffff888100914280
+RDX: 0000000000000000 RSI: 000000000000ffff RDI: 000000000000ffff
+RBP: ffffc900002bf818 R08: ffffffff8485d5b6 R09: fffffbfff0f8fb5e
+R10: 0000000000000000 R11: dffffc0000000001 R12: 1ffff110217d8f67
+R13: ffff88810bec7b3a R14: dffffc0000000000 R15: dffffc0000000000
+FS: 0000000000000000(0000) GS:ffff8881f6a00000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 00007f96cf6d52f0 CR3: 000000012224c000 CR4: 0000000000350ef0
+Call Trace:
+<TASK>
+[<ffffffff84715e35>] trace_net_dev_start_xmit include/trace/events/net.h:14 [inline]
+[<ffffffff84715e35>] xmit_one net/core/dev.c:3643 [inline]
+[<ffffffff84715e35>] dev_hard_start_xmit+0x705/0x980 net/core/dev.c:3660
+[<ffffffff8471a232>] __dev_queue_xmit+0x16b2/0x3370 net/core/dev.c:4324
+[<ffffffff85416493>] dev_queue_xmit include/linux/netdevice.h:3030 [inline]
+[<ffffffff85416493>] batadv_send_skb_packet+0x3f3/0x680 net/batman-adv/send.c:108
+[<ffffffff85416744>] batadv_send_broadcast_skb+0x24/0x30 net/batman-adv/send.c:127
+[<ffffffff853bc52a>] batadv_iv_ogm_send_to_if net/batman-adv/bat_iv_ogm.c:393 [inline]
+[<ffffffff853bc52a>] batadv_iv_ogm_emit net/batman-adv/bat_iv_ogm.c:421 [inline]
+[<ffffffff853bc52a>] batadv_iv_send_outstanding_bat_ogm_packet+0x69a/0x840 net/batman-adv/bat_iv_ogm.c:1701
+[<ffffffff8151023c>] process_one_work+0x8ac/0x1170 kernel/workqueue.c:2289
+[<ffffffff81511938>] worker_thread+0xaa8/0x12d0 kernel/workqueue.c:2436
+
+Fixes: 66e4c8d95008 ("net: warn if transport header was not set")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reported-by: syzbot <syzkaller@googlegroups.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/trace/events/net.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/include/trace/events/net.h b/include/trace/events/net.h
+index da611a7aaf970..f667c76a3b022 100644
+--- a/include/trace/events/net.h
++++ b/include/trace/events/net.h
+@@ -51,7 +51,8 @@ TRACE_EVENT(net_dev_start_xmit,
+ __entry->network_offset = skb_network_offset(skb);
+ __entry->transport_offset_valid =
+ skb_transport_header_was_set(skb);
+- __entry->transport_offset = skb_transport_offset(skb);
++ __entry->transport_offset = skb_transport_header_was_set(skb) ?
++ skb_transport_offset(skb) : 0;
+ __entry->tx_flags = skb_shinfo(skb)->tx_flags;
+ __entry->gso_size = skb_shinfo(skb)->gso_size;
+ __entry->gso_segs = skb_shinfo(skb)->gso_segs;
+--
+2.39.2
+
--- /dev/null
+From 4bb2360eb911e6cc36e0eef26cfb5235c88097ff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jun 2023 19:31:13 +0300
+Subject: net: mscc: ocelot: don't keep PTP configuration of all ports in
+ single structure
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit 45d0fcb5bc9558d0bf3d2fa7fabc5d8a88d35439 ]
+
+In a future change, the driver will need to determine whether PTP RX
+timestamping is enabled on a port (including whether traps were set up
+on that port in particular) and that is currently not possible.
+
+The driver supports different RX filters (L2, L4) and kinds of TX
+timestamping (one-step, two-step) on its ports, but it saves all
+configuration in a single struct hwtstamp_config that is global to the
+switch. So, the latest timestamping configuration on one port
+(including a request to disable timestamping) affects what gets reported
+for all ports, even though the configuration itself is still individual
+to each port.
+
+The port timestamping configurations are only coupled because of the
+common structure, so replace the hwtstamp_config with a mask of trapped
+protocols saved per port. We also have the ptp_cmd to distinguish
+between one-step and two-step PTP timestamping, so with those 2 bits of
+information we can fully reconstruct a descriptive struct
+hwtstamp_config for each port, during the SIOCGHWTSTAMP ioctl.
+
+Fixes: 4e3b0468e6d7 ("net: mscc: PTP Hardware Clock (PHC) support")
+Fixes: 96ca08c05838 ("net: mscc: ocelot: set up traps for PTP packets")
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mscc/ocelot.c | 1 -
+ drivers/net/ethernet/mscc/ocelot_ptp.c | 61 +++++++++++++++++---------
+ include/soc/mscc/ocelot.h | 10 +++--
+ 3 files changed, 48 insertions(+), 24 deletions(-)
+
+diff --git a/drivers/net/ethernet/mscc/ocelot.c b/drivers/net/ethernet/mscc/ocelot.c
+index 13b14110a0603..01b6e13f4692f 100644
+--- a/drivers/net/ethernet/mscc/ocelot.c
++++ b/drivers/net/ethernet/mscc/ocelot.c
+@@ -2728,7 +2728,6 @@ int ocelot_init(struct ocelot *ocelot)
+ }
+ }
+
+- mutex_init(&ocelot->ptp_lock);
+ mutex_init(&ocelot->mact_lock);
+ mutex_init(&ocelot->fwd_domain_lock);
+ mutex_init(&ocelot->tas_lock);
+diff --git a/drivers/net/ethernet/mscc/ocelot_ptp.c b/drivers/net/ethernet/mscc/ocelot_ptp.c
+index 673bfd70867a6..cb32234a5bf1b 100644
+--- a/drivers/net/ethernet/mscc/ocelot_ptp.c
++++ b/drivers/net/ethernet/mscc/ocelot_ptp.c
+@@ -439,8 +439,12 @@ static int ocelot_ipv6_ptp_trap_del(struct ocelot *ocelot, int port)
+ static int ocelot_setup_ptp_traps(struct ocelot *ocelot, int port,
+ bool l2, bool l4)
+ {
++ struct ocelot_port *ocelot_port = ocelot->ports[port];
+ int err;
+
++ ocelot_port->trap_proto &= ~(OCELOT_PROTO_PTP_L2 |
++ OCELOT_PROTO_PTP_L4);
++
+ if (l2)
+ err = ocelot_l2_ptp_trap_add(ocelot, port);
+ else
+@@ -464,6 +468,11 @@ static int ocelot_setup_ptp_traps(struct ocelot *ocelot, int port,
+ if (err)
+ return err;
+
++ if (l2)
++ ocelot_port->trap_proto |= OCELOT_PROTO_PTP_L2;
++ if (l4)
++ ocelot_port->trap_proto |= OCELOT_PROTO_PTP_L4;
++
+ return 0;
+
+ err_ipv6:
+@@ -474,10 +483,38 @@ static int ocelot_setup_ptp_traps(struct ocelot *ocelot, int port,
+ return err;
+ }
+
++static int ocelot_traps_to_ptp_rx_filter(unsigned int proto)
++{
++ if ((proto & OCELOT_PROTO_PTP_L2) && (proto & OCELOT_PROTO_PTP_L4))
++ return HWTSTAMP_FILTER_PTP_V2_EVENT;
++ else if (proto & OCELOT_PROTO_PTP_L2)
++ return HWTSTAMP_FILTER_PTP_V2_L2_EVENT;
++ else if (proto & OCELOT_PROTO_PTP_L4)
++ return HWTSTAMP_FILTER_PTP_V2_L4_EVENT;
++
++ return HWTSTAMP_FILTER_NONE;
++}
++
+ int ocelot_hwstamp_get(struct ocelot *ocelot, int port, struct ifreq *ifr)
+ {
+- return copy_to_user(ifr->ifr_data, &ocelot->hwtstamp_config,
+- sizeof(ocelot->hwtstamp_config)) ? -EFAULT : 0;
++ struct ocelot_port *ocelot_port = ocelot->ports[port];
++ struct hwtstamp_config cfg = {};
++
++ switch (ocelot_port->ptp_cmd) {
++ case IFH_REW_OP_TWO_STEP_PTP:
++ cfg.tx_type = HWTSTAMP_TX_ON;
++ break;
++ case IFH_REW_OP_ORIGIN_PTP:
++ cfg.tx_type = HWTSTAMP_TX_ONESTEP_SYNC;
++ break;
++ default:
++ cfg.tx_type = HWTSTAMP_TX_OFF;
++ break;
++ }
++
++ cfg.rx_filter = ocelot_traps_to_ptp_rx_filter(ocelot_port->trap_proto);
++
++ return copy_to_user(ifr->ifr_data, &cfg, sizeof(cfg)) ? -EFAULT : 0;
+ }
+ EXPORT_SYMBOL(ocelot_hwstamp_get);
+
+@@ -509,8 +546,6 @@ int ocelot_hwstamp_set(struct ocelot *ocelot, int port, struct ifreq *ifr)
+ return -ERANGE;
+ }
+
+- mutex_lock(&ocelot->ptp_lock);
+-
+ switch (cfg.rx_filter) {
+ case HWTSTAMP_FILTER_NONE:
+ break;
+@@ -531,28 +566,14 @@ int ocelot_hwstamp_set(struct ocelot *ocelot, int port, struct ifreq *ifr)
+ l4 = true;
+ break;
+ default:
+- mutex_unlock(&ocelot->ptp_lock);
+ return -ERANGE;
+ }
+
+ err = ocelot_setup_ptp_traps(ocelot, port, l2, l4);
+- if (err) {
+- mutex_unlock(&ocelot->ptp_lock);
++ if (err)
+ return err;
+- }
+-
+- if (l2 && l4)
+- cfg.rx_filter = HWTSTAMP_FILTER_PTP_V2_EVENT;
+- else if (l2)
+- cfg.rx_filter = HWTSTAMP_FILTER_PTP_V2_L2_EVENT;
+- else if (l4)
+- cfg.rx_filter = HWTSTAMP_FILTER_PTP_V2_L4_EVENT;
+- else
+- cfg.rx_filter = HWTSTAMP_FILTER_NONE;
+
+- /* Commit back the result & save it */
+- memcpy(&ocelot->hwtstamp_config, &cfg, sizeof(cfg));
+- mutex_unlock(&ocelot->ptp_lock);
++ cfg.rx_filter = ocelot_traps_to_ptp_rx_filter(ocelot_port->trap_proto);
+
+ return copy_to_user(ifr->ifr_data, &cfg, sizeof(cfg)) ? -EFAULT : 0;
+ }
+diff --git a/include/soc/mscc/ocelot.h b/include/soc/mscc/ocelot.h
+index 967ba30ea6363..195ca8f0b6f9d 100644
+--- a/include/soc/mscc/ocelot.h
++++ b/include/soc/mscc/ocelot.h
+@@ -902,6 +902,11 @@ enum macaccess_entry_type {
+ ENTRYTYPE_MACv6,
+ };
+
++enum ocelot_proto {
++ OCELOT_PROTO_PTP_L2 = BIT(0),
++ OCELOT_PROTO_PTP_L4 = BIT(1),
++};
++
+ #define OCELOT_QUIRK_PCS_PERFORMS_RATE_ADAPTATION BIT(0)
+ #define OCELOT_QUIRK_QSGMII_PORTS_MUST_BE_UP BIT(1)
+
+@@ -939,6 +944,8 @@ struct ocelot_port {
+ unsigned int ptp_skbs_in_flight;
+ struct sk_buff_head tx_skbs;
+
++ unsigned int trap_proto;
++
+ u16 mrp_ring_id;
+
+ u8 ptp_cmd;
+@@ -1032,12 +1039,9 @@ struct ocelot {
+ u8 ptp:1;
+ struct ptp_clock *ptp_clock;
+ struct ptp_clock_info ptp_info;
+- struct hwtstamp_config hwtstamp_config;
+ unsigned int ptp_skbs_in_flight;
+ /* Protects the 2-step TX timestamp ID logic */
+ spinlock_t ts_id_lock;
+- /* Protects the PTP interface state */
+- struct mutex ptp_lock;
+ /* Protects the PTP clock */
+ spinlock_t ptp_clock_lock;
+ struct ptp_pin_desc ptp_pins[OCELOT_PTP_PINS_NUM];
+--
+2.39.2
+
--- /dev/null
+From b3ecf4d2141bc60058f50693161df9f854410fca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jun 2023 19:31:12 +0300
+Subject: net: mscc: ocelot: don't report that RX timestamping is enabled by
+ default
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit 4fd44b82b7aceaa35c2901c6546d2c4198e0799d ]
+
+PTP RX timestamping should be enabled when the user requests it, not by
+default. If it is enabled by default, it can be problematic when the
+ocelot driver is a DSA master, and it sidesteps what DSA tries to avoid
+through __dsa_master_hwtstamp_validate().
+
+Additionally, after the change which made ocelot trap PTP packets only
+to the CPU at ocelot_hwtstamp_set() time, it is no longer even true that
+RX timestamping is enabled by default, because until ocelot_hwtstamp_set()
+is called, the PTP traps are actually not set up. So the rx_filter field
+of ocelot->hwtstamp_config reflects an incorrect reality.
+
+Fixes: 96ca08c05838 ("net: mscc: ocelot: set up traps for PTP packets")
+Fixes: 4e3b0468e6d7 ("net: mscc: PTP Hardware Clock (PHC) support")
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mscc/ocelot_ptp.c | 5 -----
+ 1 file changed, 5 deletions(-)
+
+diff --git a/drivers/net/ethernet/mscc/ocelot_ptp.c b/drivers/net/ethernet/mscc/ocelot_ptp.c
+index 2180ae94c7447..673bfd70867a6 100644
+--- a/drivers/net/ethernet/mscc/ocelot_ptp.c
++++ b/drivers/net/ethernet/mscc/ocelot_ptp.c
+@@ -824,11 +824,6 @@ int ocelot_init_timestamp(struct ocelot *ocelot,
+
+ ocelot_write(ocelot, PTP_CFG_MISC_PTP_EN, PTP_CFG_MISC);
+
+- /* There is no device reconfiguration, PTP Rx stamping is always
+- * enabled.
+- */
+- ocelot->hwtstamp_config.rx_filter = HWTSTAMP_FILTER_PTP_V2_EVENT;
+-
+ return 0;
+ }
+ EXPORT_SYMBOL(ocelot_init_timestamp);
+--
+2.39.2
+
--- /dev/null
+From 037d0ff744d1d19dc1dfeec1e9c485089b25ebca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jun 2023 14:38:12 +0200
+Subject: net/sched: act_ipt: add sanity checks on skb before calling target
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit b2dc32dcba08bf55cec600caa76f4afd2e3614df ]
+
+Netfilter targets make assumptions on the skb state, for example
+iphdr is supposed to be in the linear area.
+
+This is normally done by IP stack, but in act_ipt case no
+such checks are made.
+
+Some targets can even assume that skb_dst will be valid.
+Make a minimum effort to check for this:
+
+- Don't call the targets eval function for non-ipv4 skbs.
+- Don't call the targets eval function for POSTROUTING
+ emulation when the skb has no dst set.
+
+v3: use skb_protocol helper (Davide Caratti)
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sched/act_ipt.c | 33 +++++++++++++++++++++++++++++++++
+ 1 file changed, 33 insertions(+)
+
+diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c
+index ea7f151e7dd29..a6b522b512dc3 100644
+--- a/net/sched/act_ipt.c
++++ b/net/sched/act_ipt.c
+@@ -230,6 +230,26 @@ static int tcf_xt_init(struct net *net, struct nlattr *nla,
+ a, &act_xt_ops, tp, flags);
+ }
+
++static bool tcf_ipt_act_check(struct sk_buff *skb)
++{
++ const struct iphdr *iph;
++ unsigned int nhoff, len;
++
++ if (!pskb_may_pull(skb, sizeof(struct iphdr)))
++ return false;
++
++ nhoff = skb_network_offset(skb);
++ iph = ip_hdr(skb);
++ if (iph->ihl < 5 || iph->version != 4)
++ return false;
++
++ len = skb_ip_totlen(skb);
++ if (skb->len < nhoff + len || len < (iph->ihl * 4u))
++ return false;
++
++ return pskb_may_pull(skb, iph->ihl * 4u);
++}
++
+ TC_INDIRECT_SCOPE int tcf_ipt_act(struct sk_buff *skb,
+ const struct tc_action *a,
+ struct tcf_result *res)
+@@ -244,9 +264,22 @@ TC_INDIRECT_SCOPE int tcf_ipt_act(struct sk_buff *skb,
+ .pf = NFPROTO_IPV4,
+ };
+
++ if (skb_protocol(skb, false) != htons(ETH_P_IP))
++ return TC_ACT_UNSPEC;
++
+ if (skb_unclone(skb, GFP_ATOMIC))
+ return TC_ACT_UNSPEC;
+
++ if (!tcf_ipt_act_check(skb))
++ return TC_ACT_UNSPEC;
++
++ if (state.hook == NF_INET_POST_ROUTING) {
++ if (!skb_dst(skb))
++ return TC_ACT_UNSPEC;
++
++ state.out = skb->dev;
++ }
++
+ spin_lock(&ipt->tcf_lock);
+
+ tcf_lastuse_update(&ipt->tcf_tm);
+--
+2.39.2
+
--- /dev/null
+From 3159a8447b221a33ca87a5a70f73627a3b83122d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jun 2023 14:38:11 +0200
+Subject: net/sched: act_ipt: add sanity checks on table name and hook
+ locations
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit b4ee93380b3c891fea996af8d1d3ca0e36ad31f0 ]
+
+Looks like "tc" hard-codes "mangle" as the only supported table
+name, but on kernel side there are no checks.
+
+This is wrong. Not all xtables targets are safe to call from tc.
+E.g. "nat" targets assume skb has a conntrack object assigned to it.
+Normally those get called from netfilter nat core which consults the
+nat table to obtain the address mapping.
+
+"tc" userspace either sets PRE or POSTROUTING as hook number, but there
+is no validation of this on kernel side, so update netlink policy to
+reject bogus numbers. Some targets may assume skb_dst is set for
+input/forward hooks, so prevent those from being used.
+
+act_ipt uses the hook number in two places:
+1. the state hook number, this is fine as-is
+2. to set par.hook_mask
+
+The latter is a bit mask, so update the assignment to make
+xt_check_target() to the right thing.
+
+Followup patch adds required checks for the skb/packet headers before
+calling the targets evaluation function.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sched/act_ipt.c | 27 ++++++++++++++++++++-------
+ 1 file changed, 20 insertions(+), 7 deletions(-)
+
+diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c
+index 1625e10374161..dc92975a9374f 100644
+--- a/net/sched/act_ipt.c
++++ b/net/sched/act_ipt.c
+@@ -47,7 +47,7 @@ static int ipt_init_target(struct net *net, struct xt_entry_target *t,
+ par.entryinfo = &e;
+ par.target = target;
+ par.targinfo = t->data;
+- par.hook_mask = hook;
++ par.hook_mask = 1 << hook;
+ par.family = NFPROTO_IPV4;
+
+ ret = xt_check_target(&par, t->u.target_size - sizeof(*t), 0, false);
+@@ -84,7 +84,8 @@ static void tcf_ipt_release(struct tc_action *a)
+
+ static const struct nla_policy ipt_policy[TCA_IPT_MAX + 1] = {
+ [TCA_IPT_TABLE] = { .type = NLA_STRING, .len = IFNAMSIZ },
+- [TCA_IPT_HOOK] = { .type = NLA_U32 },
++ [TCA_IPT_HOOK] = NLA_POLICY_RANGE(NLA_U32, NF_INET_PRE_ROUTING,
++ NF_INET_NUMHOOKS),
+ [TCA_IPT_INDEX] = { .type = NLA_U32 },
+ [TCA_IPT_TARG] = { .len = sizeof(struct xt_entry_target) },
+ };
+@@ -157,15 +158,27 @@ static int __tcf_ipt_init(struct net *net, unsigned int id, struct nlattr *nla,
+ return -EEXIST;
+ }
+ }
++
++ err = -EINVAL;
+ hook = nla_get_u32(tb[TCA_IPT_HOOK]);
++ switch (hook) {
++ case NF_INET_PRE_ROUTING:
++ break;
++ case NF_INET_POST_ROUTING:
++ break;
++ default:
++ goto err1;
++ }
++
++ if (tb[TCA_IPT_TABLE]) {
++ /* mangle only for now */
++ if (nla_strcmp(tb[TCA_IPT_TABLE], "mangle"))
++ goto err1;
++ }
+
+- err = -ENOMEM;
+- tname = kmalloc(IFNAMSIZ, GFP_KERNEL);
++ tname = kstrdup("mangle", GFP_KERNEL);
+ if (unlikely(!tname))
+ goto err1;
+- if (tb[TCA_IPT_TABLE] == NULL ||
+- nla_strscpy(tname, tb[TCA_IPT_TABLE], IFNAMSIZ) >= IFNAMSIZ)
+- strcpy(tname, "mangle");
+
+ t = kmemdup(td, td->u.target_size, GFP_KERNEL);
+ if (unlikely(!t))
+--
+2.39.2
+
--- /dev/null
+From e30f7714a276eaf155fe312add3e12f7fc38ef61 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jun 2023 14:38:13 +0200
+Subject: net/sched: act_ipt: zero skb->cb before calling target
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit 93d75d475c5dc3404292976147d063ee4d808592 ]
+
+xtables relies on skb being owned by ip stack, i.e. with ipv4
+check in place skb->cb is supposed to be IPCB.
+
+I don't see an immediate problem (REJECT target cannot be used anymore
+now that PRE/POSTROUTING hook validation has been fixed), but better be
+safe than sorry.
+
+A much better patch would be to either mark act_ipt as
+"depends on BROKEN" or remove it altogether. I plan to do this
+for -next in the near future.
+
+This tc extension is broken in the sense that tc lacks an
+equivalent of NF_STOLEN verdict.
+
+With NF_STOLEN, target function takes complete ownership of skb, caller
+cannot dereference it anymore.
+
+ACT_STOLEN cannot be used for this: it has a different meaning, caller
+is allowed to dereference the skb.
+
+At this time NF_STOLEN won't be returned by any targets as far as I can
+see, but this may change in the future.
+
+It might be possible to work around this via list of allowed
+target extensions known to only return DROP or ACCEPT verdicts, but this
+is error prone/fragile.
+
+Existing selftest only validates xt_LOG and act_ipt is restricted
+to ipv4 so I don't think this action is used widely.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sched/act_ipt.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c
+index a6b522b512dc3..598d6e299152a 100644
+--- a/net/sched/act_ipt.c
++++ b/net/sched/act_ipt.c
+@@ -21,6 +21,7 @@
+ #include <linux/tc_act/tc_ipt.h>
+ #include <net/tc_act/tc_ipt.h>
+ #include <net/tc_wrapper.h>
++#include <net/ip.h>
+
+ #include <linux/netfilter_ipv4/ip_tables.h>
+
+@@ -254,6 +255,7 @@ TC_INDIRECT_SCOPE int tcf_ipt_act(struct sk_buff *skb,
+ const struct tc_action *a,
+ struct tcf_result *res)
+ {
++ char saved_cb[sizeof_field(struct sk_buff, cb)];
+ int ret = 0, result = 0;
+ struct tcf_ipt *ipt = to_ipt(a);
+ struct xt_action_param par;
+@@ -280,6 +282,8 @@ TC_INDIRECT_SCOPE int tcf_ipt_act(struct sk_buff *skb,
+ state.out = skb->dev;
+ }
+
++ memcpy(saved_cb, skb->cb, sizeof(saved_cb));
++
+ spin_lock(&ipt->tcf_lock);
+
+ tcf_lastuse_update(&ipt->tcf_tm);
+@@ -292,6 +296,9 @@ TC_INDIRECT_SCOPE int tcf_ipt_act(struct sk_buff *skb,
+ par.state = &state;
+ par.target = ipt->tcfi_t->u.kernel.target;
+ par.targinfo = ipt->tcfi_t->data;
++
++ memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));
++
+ ret = par.target->target(skb, &par);
+
+ switch (ret) {
+@@ -312,6 +319,9 @@ TC_INDIRECT_SCOPE int tcf_ipt_act(struct sk_buff *skb,
+ break;
+ }
+ spin_unlock(&ipt->tcf_lock);
++
++ memcpy(skb->cb, saved_cb, sizeof(skb->cb));
++
+ return result;
+
+ }
+--
+2.39.2
+
--- /dev/null
+From 632f98db23d7b2f5dd49022f8211ee5b7d1086dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Jul 2023 19:08:42 +0800
+Subject: net/sched: act_pedit: Add size check for TCA_PEDIT_PARMS_EX
+
+From: Lin Ma <linma@zju.edu.cn>
+
+[ Upstream commit 30c45b5361d39b4b793780ffac5538090b9e2eb1 ]
+
+The attribute TCA_PEDIT_PARMS_EX is not be included in pedit_policy and
+one malicious user could fake a TCA_PEDIT_PARMS_EX whose length is
+smaller than the intended sizeof(struct tc_pedit). Hence, the
+dereference in tcf_pedit_init() could access dirty heap data.
+
+static int tcf_pedit_init(...)
+{
+ // ...
+ pattr = tb[TCA_PEDIT_PARMS]; // TCA_PEDIT_PARMS is included
+ if (!pattr)
+ pattr = tb[TCA_PEDIT_PARMS_EX]; // but this is not
+
+ // ...
+ parm = nla_data(pattr);
+
+ index = parm->index; // parm is able to be smaller than 4 bytes
+ // and this dereference gets dirty skb_buff
+ // data created in netlink_sendmsg
+}
+
+This commit adds TCA_PEDIT_PARMS_EX length in pedit_policy which avoid
+the above case, just like the TCA_PEDIT_PARMS.
+
+Fixes: 71d0ed7079df ("net/act_pedit: Support using offset relative to the conventional network headers")
+Signed-off-by: Lin Ma <linma@zju.edu.cn>
+Reviewed-by: Pedro Tammela <pctammela@mojatatu.com>
+Link: https://lore.kernel.org/r/20230703110842.590282-1-linma@zju.edu.cn
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sched/act_pedit.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c
+index 613a1d777d5a6..c2aed8b056a1d 100644
+--- a/net/sched/act_pedit.c
++++ b/net/sched/act_pedit.c
+@@ -29,6 +29,7 @@ static struct tc_action_ops act_pedit_ops;
+
+ static const struct nla_policy pedit_policy[TCA_PEDIT_MAX + 1] = {
+ [TCA_PEDIT_PARMS] = { .len = sizeof(struct tc_pedit) },
++ [TCA_PEDIT_PARMS_EX] = { .len = sizeof(struct tc_pedit) },
+ [TCA_PEDIT_KEYS_EX] = { .type = NLA_NESTED },
+ };
+
+--
+2.39.2
+
--- /dev/null
+From 122945ba62d821b786b51bd84aa4ca23619737fc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Dec 2022 10:55:12 -0300
+Subject: net/sched: avoid indirect act functions on retpoline kernels
+
+From: Pedro Tammela <pctammela@mojatatu.com>
+
+[ Upstream commit 871cf386dd16705b1e08942efd02c58801293d01 ]
+
+Expose the necessary tc act functions and wire up act_api to use
+direct calls in retpoline kernels.
+
+Signed-off-by: Pedro Tammela <pctammela@mojatatu.com>
+Reviewed-by: Jamal Hadi Salim <jhs@mojatatu.com>
+Reviewed-by: Victor Nogueira <victor@mojatatu.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Stable-dep-of: b2dc32dcba08 ("net/sched: act_ipt: add sanity checks on skb before calling target")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sched/act_api.c | 3 ++-
+ net/sched/act_bpf.c | 6 ++++--
+ net/sched/act_connmark.c | 6 ++++--
+ net/sched/act_csum.c | 6 ++++--
+ net/sched/act_ct.c | 5 +++--
+ net/sched/act_ctinfo.c | 6 ++++--
+ net/sched/act_gact.c | 6 ++++--
+ net/sched/act_gate.c | 6 ++++--
+ net/sched/act_ife.c | 6 ++++--
+ net/sched/act_ipt.c | 6 ++++--
+ net/sched/act_mirred.c | 6 ++++--
+ net/sched/act_mpls.c | 6 ++++--
+ net/sched/act_nat.c | 7 ++++---
+ net/sched/act_pedit.c | 6 ++++--
+ net/sched/act_police.c | 6 ++++--
+ net/sched/act_sample.c | 6 ++++--
+ net/sched/act_simple.c | 6 ++++--
+ net/sched/act_skbedit.c | 6 ++++--
+ net/sched/act_skbmod.c | 6 ++++--
+ net/sched/act_tunnel_key.c | 6 ++++--
+ net/sched/act_vlan.c | 6 ++++--
+ 21 files changed, 81 insertions(+), 42 deletions(-)
+
+diff --git a/net/sched/act_api.c b/net/sched/act_api.c
+index b33f88e50aa90..60338a4ed0df3 100644
+--- a/net/sched/act_api.c
++++ b/net/sched/act_api.c
+@@ -23,6 +23,7 @@
+ #include <net/act_api.h>
+ #include <net/netlink.h>
+ #include <net/flow_offload.h>
++#include <net/tc_wrapper.h>
+
+ #ifdef CONFIG_INET
+ DEFINE_STATIC_KEY_FALSE(tcf_frag_xmit_count);
+@@ -1080,7 +1081,7 @@ int tcf_action_exec(struct sk_buff *skb, struct tc_action **actions,
+
+ repeat_ttl = 32;
+ repeat:
+- ret = a->ops->act(skb, a, res);
++ ret = tc_act(skb, a, res);
+ if (unlikely(ret == TC_ACT_REPEAT)) {
+ if (--repeat_ttl != 0)
+ goto repeat;
+diff --git a/net/sched/act_bpf.c b/net/sched/act_bpf.c
+index b79eee44e24eb..b0455fda7d0ba 100644
+--- a/net/sched/act_bpf.c
++++ b/net/sched/act_bpf.c
+@@ -18,6 +18,7 @@
+
+ #include <linux/tc_act/tc_bpf.h>
+ #include <net/tc_act/tc_bpf.h>
++#include <net/tc_wrapper.h>
+
+ #define ACT_BPF_NAME_LEN 256
+
+@@ -31,8 +32,9 @@ struct tcf_bpf_cfg {
+
+ static struct tc_action_ops act_bpf_ops;
+
+-static int tcf_bpf_act(struct sk_buff *skb, const struct tc_action *act,
+- struct tcf_result *res)
++TC_INDIRECT_SCOPE int tcf_bpf_act(struct sk_buff *skb,
++ const struct tc_action *act,
++ struct tcf_result *res)
+ {
+ bool at_ingress = skb_at_tc_ingress(skb);
+ struct tcf_bpf *prog = to_bpf(act);
+diff --git a/net/sched/act_connmark.c b/net/sched/act_connmark.c
+index d41002e4613ff..7e63ff7e3ed7a 100644
+--- a/net/sched/act_connmark.c
++++ b/net/sched/act_connmark.c
+@@ -20,6 +20,7 @@
+ #include <net/pkt_cls.h>
+ #include <uapi/linux/tc_act/tc_connmark.h>
+ #include <net/tc_act/tc_connmark.h>
++#include <net/tc_wrapper.h>
+
+ #include <net/netfilter/nf_conntrack.h>
+ #include <net/netfilter/nf_conntrack_core.h>
+@@ -27,8 +28,9 @@
+
+ static struct tc_action_ops act_connmark_ops;
+
+-static int tcf_connmark_act(struct sk_buff *skb, const struct tc_action *a,
+- struct tcf_result *res)
++TC_INDIRECT_SCOPE int tcf_connmark_act(struct sk_buff *skb,
++ const struct tc_action *a,
++ struct tcf_result *res)
+ {
+ const struct nf_conntrack_tuple_hash *thash;
+ struct nf_conntrack_tuple tuple;
+diff --git a/net/sched/act_csum.c b/net/sched/act_csum.c
+index 1366adf9b9091..95e9304024b7d 100644
+--- a/net/sched/act_csum.c
++++ b/net/sched/act_csum.c
+@@ -32,6 +32,7 @@
+
+ #include <linux/tc_act/tc_csum.h>
+ #include <net/tc_act/tc_csum.h>
++#include <net/tc_wrapper.h>
+
+ static const struct nla_policy csum_policy[TCA_CSUM_MAX + 1] = {
+ [TCA_CSUM_PARMS] = { .len = sizeof(struct tc_csum), },
+@@ -563,8 +564,9 @@ static int tcf_csum_ipv6(struct sk_buff *skb, u32 update_flags)
+ return 0;
+ }
+
+-static int tcf_csum_act(struct sk_buff *skb, const struct tc_action *a,
+- struct tcf_result *res)
++TC_INDIRECT_SCOPE int tcf_csum_act(struct sk_buff *skb,
++ const struct tc_action *a,
++ struct tcf_result *res)
+ {
+ struct tcf_csum *p = to_tcf_csum(a);
+ bool orig_vlan_tag_present = false;
+diff --git a/net/sched/act_ct.c b/net/sched/act_ct.c
+index 4c7f7861ea967..bb1911071d9de 100644
+--- a/net/sched/act_ct.c
++++ b/net/sched/act_ct.c
+@@ -24,6 +24,7 @@
+ #include <net/ipv6_frag.h>
+ #include <uapi/linux/tc_act/tc_ct.h>
+ #include <net/tc_act/tc_ct.h>
++#include <net/tc_wrapper.h>
+
+ #include <net/netfilter/nf_flow_table.h>
+ #include <net/netfilter/nf_conntrack.h>
+@@ -1019,8 +1020,8 @@ static int tcf_ct_act_nat(struct sk_buff *skb,
+ #endif
+ }
+
+-static int tcf_ct_act(struct sk_buff *skb, const struct tc_action *a,
+- struct tcf_result *res)
++TC_INDIRECT_SCOPE int tcf_ct_act(struct sk_buff *skb, const struct tc_action *a,
++ struct tcf_result *res)
+ {
+ struct net *net = dev_net(skb->dev);
+ bool cached, commit, clear, force;
+diff --git a/net/sched/act_ctinfo.c b/net/sched/act_ctinfo.c
+index 7275ad869f8ea..4d15b6a6169c4 100644
+--- a/net/sched/act_ctinfo.c
++++ b/net/sched/act_ctinfo.c
+@@ -18,6 +18,7 @@
+ #include <net/pkt_cls.h>
+ #include <uapi/linux/tc_act/tc_ctinfo.h>
+ #include <net/tc_act/tc_ctinfo.h>
++#include <net/tc_wrapper.h>
+
+ #include <net/netfilter/nf_conntrack.h>
+ #include <net/netfilter/nf_conntrack_core.h>
+@@ -75,8 +76,9 @@ static void tcf_ctinfo_cpmark_set(struct nf_conn *ct, struct tcf_ctinfo *ca,
+ skb->mark = READ_ONCE(ct->mark) & cp->cpmarkmask;
+ }
+
+-static int tcf_ctinfo_act(struct sk_buff *skb, const struct tc_action *a,
+- struct tcf_result *res)
++TC_INDIRECT_SCOPE int tcf_ctinfo_act(struct sk_buff *skb,
++ const struct tc_action *a,
++ struct tcf_result *res)
+ {
+ const struct nf_conntrack_tuple_hash *thash = NULL;
+ struct tcf_ctinfo *ca = to_ctinfo(a);
+diff --git a/net/sched/act_gact.c b/net/sched/act_gact.c
+index 62d682b96b885..54f1b13b2360b 100644
+--- a/net/sched/act_gact.c
++++ b/net/sched/act_gact.c
+@@ -18,6 +18,7 @@
+ #include <net/pkt_cls.h>
+ #include <linux/tc_act/tc_gact.h>
+ #include <net/tc_act/tc_gact.h>
++#include <net/tc_wrapper.h>
+
+ static struct tc_action_ops act_gact_ops;
+
+@@ -145,8 +146,9 @@ static int tcf_gact_init(struct net *net, struct nlattr *nla,
+ return err;
+ }
+
+-static int tcf_gact_act(struct sk_buff *skb, const struct tc_action *a,
+- struct tcf_result *res)
++TC_INDIRECT_SCOPE int tcf_gact_act(struct sk_buff *skb,
++ const struct tc_action *a,
++ struct tcf_result *res)
+ {
+ struct tcf_gact *gact = to_gact(a);
+ int action = READ_ONCE(gact->tcf_action);
+diff --git a/net/sched/act_gate.c b/net/sched/act_gate.c
+index 3049878e73153..9b8def0be41e9 100644
+--- a/net/sched/act_gate.c
++++ b/net/sched/act_gate.c
+@@ -14,6 +14,7 @@
+ #include <net/netlink.h>
+ #include <net/pkt_cls.h>
+ #include <net/tc_act/tc_gate.h>
++#include <net/tc_wrapper.h>
+
+ static struct tc_action_ops act_gate_ops;
+
+@@ -113,8 +114,9 @@ static enum hrtimer_restart gate_timer_func(struct hrtimer *timer)
+ return HRTIMER_RESTART;
+ }
+
+-static int tcf_gate_act(struct sk_buff *skb, const struct tc_action *a,
+- struct tcf_result *res)
++TC_INDIRECT_SCOPE int tcf_gate_act(struct sk_buff *skb,
++ const struct tc_action *a,
++ struct tcf_result *res)
+ {
+ struct tcf_gate *gact = to_gate(a);
+
+diff --git a/net/sched/act_ife.c b/net/sched/act_ife.c
+index 41d63b33461dc..bc7611b0744c4 100644
+--- a/net/sched/act_ife.c
++++ b/net/sched/act_ife.c
+@@ -29,6 +29,7 @@
+ #include <net/tc_act/tc_ife.h>
+ #include <linux/etherdevice.h>
+ #include <net/ife.h>
++#include <net/tc_wrapper.h>
+
+ static int max_metacnt = IFE_META_MAX + 1;
+ static struct tc_action_ops act_ife_ops;
+@@ -861,8 +862,9 @@ static int tcf_ife_encode(struct sk_buff *skb, const struct tc_action *a,
+ return action;
+ }
+
+-static int tcf_ife_act(struct sk_buff *skb, const struct tc_action *a,
+- struct tcf_result *res)
++TC_INDIRECT_SCOPE int tcf_ife_act(struct sk_buff *skb,
++ const struct tc_action *a,
++ struct tcf_result *res)
+ {
+ struct tcf_ife_info *ife = to_ife(a);
+ struct tcf_ife_params *p;
+diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c
+index dc92975a9374f..ea7f151e7dd29 100644
+--- a/net/sched/act_ipt.c
++++ b/net/sched/act_ipt.c
+@@ -20,6 +20,7 @@
+ #include <net/pkt_sched.h>
+ #include <linux/tc_act/tc_ipt.h>
+ #include <net/tc_act/tc_ipt.h>
++#include <net/tc_wrapper.h>
+
+ #include <linux/netfilter_ipv4/ip_tables.h>
+
+@@ -229,8 +230,9 @@ static int tcf_xt_init(struct net *net, struct nlattr *nla,
+ a, &act_xt_ops, tp, flags);
+ }
+
+-static int tcf_ipt_act(struct sk_buff *skb, const struct tc_action *a,
+- struct tcf_result *res)
++TC_INDIRECT_SCOPE int tcf_ipt_act(struct sk_buff *skb,
++ const struct tc_action *a,
++ struct tcf_result *res)
+ {
+ int ret = 0, result = 0;
+ struct tcf_ipt *ipt = to_ipt(a);
+diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c
+index 36395e5db3b40..a61482c5edbe7 100644
+--- a/net/sched/act_mirred.c
++++ b/net/sched/act_mirred.c
+@@ -24,6 +24,7 @@
+ #include <net/pkt_cls.h>
+ #include <linux/tc_act/tc_mirred.h>
+ #include <net/tc_act/tc_mirred.h>
++#include <net/tc_wrapper.h>
+
+ static LIST_HEAD(mirred_list);
+ static DEFINE_SPINLOCK(mirred_list_lock);
+@@ -224,8 +225,9 @@ static int tcf_mirred_forward(bool want_ingress, struct sk_buff *skb)
+ return err;
+ }
+
+-static int tcf_mirred_act(struct sk_buff *skb, const struct tc_action *a,
+- struct tcf_result *res)
++TC_INDIRECT_SCOPE int tcf_mirred_act(struct sk_buff *skb,
++ const struct tc_action *a,
++ struct tcf_result *res)
+ {
+ struct tcf_mirred *m = to_mirred(a);
+ struct sk_buff *skb2 = skb;
+diff --git a/net/sched/act_mpls.c b/net/sched/act_mpls.c
+index f24f997a7aaf9..809f7928a1be6 100644
+--- a/net/sched/act_mpls.c
++++ b/net/sched/act_mpls.c
+@@ -14,6 +14,7 @@
+ #include <net/pkt_sched.h>
+ #include <net/pkt_cls.h>
+ #include <net/tc_act/tc_mpls.h>
++#include <net/tc_wrapper.h>
+
+ static struct tc_action_ops act_mpls_ops;
+
+@@ -49,8 +50,9 @@ static __be32 tcf_mpls_get_lse(struct mpls_shim_hdr *lse,
+ return cpu_to_be32(new_lse);
+ }
+
+-static int tcf_mpls_act(struct sk_buff *skb, const struct tc_action *a,
+- struct tcf_result *res)
++TC_INDIRECT_SCOPE int tcf_mpls_act(struct sk_buff *skb,
++ const struct tc_action *a,
++ struct tcf_result *res)
+ {
+ struct tcf_mpls *m = to_mpls(a);
+ struct tcf_mpls_params *p;
+diff --git a/net/sched/act_nat.c b/net/sched/act_nat.c
+index 9265145f10404..74c74be330484 100644
+--- a/net/sched/act_nat.c
++++ b/net/sched/act_nat.c
+@@ -24,7 +24,7 @@
+ #include <net/tc_act/tc_nat.h>
+ #include <net/tcp.h>
+ #include <net/udp.h>
+-
++#include <net/tc_wrapper.h>
+
+ static struct tc_action_ops act_nat_ops;
+
+@@ -98,8 +98,9 @@ static int tcf_nat_init(struct net *net, struct nlattr *nla, struct nlattr *est,
+ return err;
+ }
+
+-static int tcf_nat_act(struct sk_buff *skb, const struct tc_action *a,
+- struct tcf_result *res)
++TC_INDIRECT_SCOPE int tcf_nat_act(struct sk_buff *skb,
++ const struct tc_action *a,
++ struct tcf_result *res)
+ {
+ struct tcf_nat *p = to_tcf_nat(a);
+ struct iphdr *iph;
+diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c
+index 180669aa9d097..613a1d777d5a6 100644
+--- a/net/sched/act_pedit.c
++++ b/net/sched/act_pedit.c
+@@ -23,6 +23,7 @@
+ #include <net/tc_act/tc_pedit.h>
+ #include <uapi/linux/tc_act/tc_pedit.h>
+ #include <net/pkt_cls.h>
++#include <net/tc_wrapper.h>
+
+ static struct tc_action_ops act_pedit_ops;
+
+@@ -369,8 +370,9 @@ static int pedit_skb_hdr_offset(struct sk_buff *skb,
+ return ret;
+ }
+
+-static int tcf_pedit_act(struct sk_buff *skb, const struct tc_action *a,
+- struct tcf_result *res)
++TC_INDIRECT_SCOPE int tcf_pedit_act(struct sk_buff *skb,
++ const struct tc_action *a,
++ struct tcf_result *res)
+ {
+ enum pedit_header_type htype = TCA_PEDIT_KEY_EX_HDR_TYPE_NETWORK;
+ enum pedit_cmd cmd = TCA_PEDIT_KEY_EX_CMD_SET;
+diff --git a/net/sched/act_police.c b/net/sched/act_police.c
+index 94be21378e7ca..2e9dce03d1ecc 100644
+--- a/net/sched/act_police.c
++++ b/net/sched/act_police.c
+@@ -19,6 +19,7 @@
+ #include <net/netlink.h>
+ #include <net/pkt_cls.h>
+ #include <net/tc_act/tc_police.h>
++#include <net/tc_wrapper.h>
+
+ /* Each policer is serialized by its individual spinlock */
+
+@@ -242,8 +243,9 @@ static bool tcf_police_mtu_check(struct sk_buff *skb, u32 limit)
+ return len <= limit;
+ }
+
+-static int tcf_police_act(struct sk_buff *skb, const struct tc_action *a,
+- struct tcf_result *res)
++TC_INDIRECT_SCOPE int tcf_police_act(struct sk_buff *skb,
++ const struct tc_action *a,
++ struct tcf_result *res)
+ {
+ struct tcf_police *police = to_police(a);
+ s64 now, toks, ppstoks = 0, ptoks = 0;
+diff --git a/net/sched/act_sample.c b/net/sched/act_sample.c
+index 09735a33e57e2..d5c745fbb1328 100644
+--- a/net/sched/act_sample.c
++++ b/net/sched/act_sample.c
+@@ -20,6 +20,7 @@
+ #include <net/tc_act/tc_sample.h>
+ #include <net/psample.h>
+ #include <net/pkt_cls.h>
++#include <net/tc_wrapper.h>
+
+ #include <linux/if_arp.h>
+
+@@ -160,8 +161,9 @@ static bool tcf_sample_dev_ok_push(struct net_device *dev)
+ }
+ }
+
+-static int tcf_sample_act(struct sk_buff *skb, const struct tc_action *a,
+- struct tcf_result *res)
++TC_INDIRECT_SCOPE int tcf_sample_act(struct sk_buff *skb,
++ const struct tc_action *a,
++ struct tcf_result *res)
+ {
+ struct tcf_sample *s = to_sample(a);
+ struct psample_group *psample_group;
+diff --git a/net/sched/act_simple.c b/net/sched/act_simple.c
+index 18d3761354611..4b84514534f39 100644
+--- a/net/sched/act_simple.c
++++ b/net/sched/act_simple.c
+@@ -14,6 +14,7 @@
+ #include <net/netlink.h>
+ #include <net/pkt_sched.h>
+ #include <net/pkt_cls.h>
++#include <net/tc_wrapper.h>
+
+ #include <linux/tc_act/tc_defact.h>
+ #include <net/tc_act/tc_defact.h>
+@@ -21,8 +22,9 @@
+ static struct tc_action_ops act_simp_ops;
+
+ #define SIMP_MAX_DATA 32
+-static int tcf_simp_act(struct sk_buff *skb, const struct tc_action *a,
+- struct tcf_result *res)
++TC_INDIRECT_SCOPE int tcf_simp_act(struct sk_buff *skb,
++ const struct tc_action *a,
++ struct tcf_result *res)
+ {
+ struct tcf_defact *d = to_defact(a);
+
+diff --git a/net/sched/act_skbedit.c b/net/sched/act_skbedit.c
+index 7f598784fd305..fd7d0d3eae3e7 100644
+--- a/net/sched/act_skbedit.c
++++ b/net/sched/act_skbedit.c
+@@ -16,6 +16,7 @@
+ #include <net/ipv6.h>
+ #include <net/dsfield.h>
+ #include <net/pkt_cls.h>
++#include <net/tc_wrapper.h>
+
+ #include <linux/tc_act/tc_skbedit.h>
+ #include <net/tc_act/tc_skbedit.h>
+@@ -36,8 +37,9 @@ static u16 tcf_skbedit_hash(struct tcf_skbedit_params *params,
+ return netdev_cap_txqueue(skb->dev, queue_mapping);
+ }
+
+-static int tcf_skbedit_act(struct sk_buff *skb, const struct tc_action *a,
+- struct tcf_result *res)
++TC_INDIRECT_SCOPE int tcf_skbedit_act(struct sk_buff *skb,
++ const struct tc_action *a,
++ struct tcf_result *res)
+ {
+ struct tcf_skbedit *d = to_skbedit(a);
+ struct tcf_skbedit_params *params;
+diff --git a/net/sched/act_skbmod.c b/net/sched/act_skbmod.c
+index d98758a639340..dffa990a9629f 100644
+--- a/net/sched/act_skbmod.c
++++ b/net/sched/act_skbmod.c
+@@ -15,14 +15,16 @@
+ #include <net/netlink.h>
+ #include <net/pkt_sched.h>
+ #include <net/pkt_cls.h>
++#include <net/tc_wrapper.h>
+
+ #include <linux/tc_act/tc_skbmod.h>
+ #include <net/tc_act/tc_skbmod.h>
+
+ static struct tc_action_ops act_skbmod_ops;
+
+-static int tcf_skbmod_act(struct sk_buff *skb, const struct tc_action *a,
+- struct tcf_result *res)
++TC_INDIRECT_SCOPE int tcf_skbmod_act(struct sk_buff *skb,
++ const struct tc_action *a,
++ struct tcf_result *res)
+ {
+ struct tcf_skbmod *d = to_skbmod(a);
+ int action, max_edit_len, err;
+diff --git a/net/sched/act_tunnel_key.c b/net/sched/act_tunnel_key.c
+index 2691a3d8e4511..2d12d26264153 100644
+--- a/net/sched/act_tunnel_key.c
++++ b/net/sched/act_tunnel_key.c
+@@ -16,14 +16,16 @@
+ #include <net/pkt_sched.h>
+ #include <net/dst.h>
+ #include <net/pkt_cls.h>
++#include <net/tc_wrapper.h>
+
+ #include <linux/tc_act/tc_tunnel_key.h>
+ #include <net/tc_act/tc_tunnel_key.h>
+
+ static struct tc_action_ops act_tunnel_key_ops;
+
+-static int tunnel_key_act(struct sk_buff *skb, const struct tc_action *a,
+- struct tcf_result *res)
++TC_INDIRECT_SCOPE int tunnel_key_act(struct sk_buff *skb,
++ const struct tc_action *a,
++ struct tcf_result *res)
+ {
+ struct tcf_tunnel_key *t = to_tunnel_key(a);
+ struct tcf_tunnel_key_params *params;
+diff --git a/net/sched/act_vlan.c b/net/sched/act_vlan.c
+index 7b24e898a3e6b..0251442f5f29d 100644
+--- a/net/sched/act_vlan.c
++++ b/net/sched/act_vlan.c
+@@ -12,14 +12,16 @@
+ #include <net/netlink.h>
+ #include <net/pkt_sched.h>
+ #include <net/pkt_cls.h>
++#include <net/tc_wrapper.h>
+
+ #include <linux/tc_act/tc_vlan.h>
+ #include <net/tc_act/tc_vlan.h>
+
+ static struct tc_action_ops act_vlan_ops;
+
+-static int tcf_vlan_act(struct sk_buff *skb, const struct tc_action *a,
+- struct tcf_result *res)
++TC_INDIRECT_SCOPE int tcf_vlan_act(struct sk_buff *skb,
++ const struct tc_action *a,
++ struct tcf_result *res)
+ {
+ struct tcf_vlan *v = to_vlan(a);
+ struct tcf_vlan_params *p;
+--
+2.39.2
+
--- /dev/null
+From 7a1e02f67ec85ddd57d9d3206d55bbb40dde64dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Dec 2022 00:28:07 +0800
+Subject: ntfs: Fix panic about slab-out-of-bounds caused by ntfs_listxattr()
+
+From: Zeng Heng <zengheng4@huawei.com>
+
+[ Upstream commit 3c675ddffb17a8b1e32efad5c983254af18b12c2 ]
+
+Here is a BUG report from syzbot:
+
+BUG: KASAN: slab-out-of-bounds in ntfs_list_ea fs/ntfs3/xattr.c:191 [inline]
+BUG: KASAN: slab-out-of-bounds in ntfs_listxattr+0x401/0x570 fs/ntfs3/xattr.c:710
+Read of size 1 at addr ffff888021acaf3d by task syz-executor128/3632
+
+Call Trace:
+ ntfs_list_ea fs/ntfs3/xattr.c:191 [inline]
+ ntfs_listxattr+0x401/0x570 fs/ntfs3/xattr.c:710
+ vfs_listxattr fs/xattr.c:457 [inline]
+ listxattr+0x293/0x2d0 fs/xattr.c:804
+
+Fix the logic of ea_all iteration. When the ea->name_len is 0,
+return immediately, or Add2Ptr() would visit invalid memory
+in the next loop.
+
+Fixes: be71b5cba2e6 ("fs/ntfs3: Add attrib operations")
+Reported-by: syzbot+9fcea5ef6dc4dc72d334@syzkaller.appspotmail.com
+Signed-off-by: Zeng Heng <zengheng4@huawei.com>
+[almaz.alexandrovich@paragon-software.com: lines of the patch have changed]
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/xattr.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/fs/ntfs3/xattr.c b/fs/ntfs3/xattr.c
+index ea582b4fe1d9d..88866bcd1a218 100644
+--- a/fs/ntfs3/xattr.c
++++ b/fs/ntfs3/xattr.c
+@@ -178,6 +178,9 @@ static ssize_t ntfs_list_ea(struct ntfs_inode *ni, char *buffer,
+ for (ret = 0, off = 0; off < size; off += unpacked_ea_size(ea)) {
+ ea = Add2Ptr(ea_all, off);
+
++ if (!ea->name_len)
++ break;
++
+ if (buffer) {
+ if (ret + ea->name_len + 1 > bytes_per_buffer) {
+ err = -ERANGE;
+--
+2.39.2
+
--- /dev/null
+From 5df61ad20124f4e32fed2c123bbab95514565366 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 11 Jun 2023 15:03:09 +0100
+Subject: nvmem: rmem: Use NVMEM_DEVID_AUTO
+
+From: Phil Elwell <phil@raspberrypi.com>
+
+[ Upstream commit 09dd7b993eddb3b48634fd5ddf27aa799785a9ee ]
+
+It is reasonable to declare multiple nvmem blocks. Unless a unique 'id'
+is passed in for each block there may be name clashes.
+
+Avoid this by using the magic token NVMEM_DEVID_AUTO.
+
+Fixes: 5a3fa75a4d9c ("nvmem: Add driver to expose reserved memory as nvmem")
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+Signed-off-by: Ivan T. Ivanov <iivanov@suse.de>
+Reviewed-by: Stefan Wahren <stefan.wahren@i2se.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Message-ID: <20230611140330.154222-6-srinivas.kandagatla@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvmem/rmem.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/nvmem/rmem.c b/drivers/nvmem/rmem.c
+index 80cb187f14817..752d0bf4445ee 100644
+--- a/drivers/nvmem/rmem.c
++++ b/drivers/nvmem/rmem.c
+@@ -71,6 +71,7 @@ static int rmem_probe(struct platform_device *pdev)
+ config.dev = dev;
+ config.priv = priv;
+ config.name = "rmem";
++ config.id = NVMEM_DEVID_AUTO;
+ config.size = mem->size;
+ config.reg_read = rmem_read;
+
+--
+2.39.2
+
--- /dev/null
+From bcd8a9ceaa57cabfc640c77b70fdc65e18aa10c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 May 2023 16:52:36 +0800
+Subject: nvmem: sunplus-ocotp: release otp->clk before return
+
+From: Yi Yingao <m202271736@hust.edu.cn>
+
+[ Upstream commit 095bb8ba45f28ed15296eb5b7662e03e57d5e34e ]
+
+Smatch reports:
+drivers/nvmem/sunplus-ocotp.c:205 sp_ocotp_probe()
+warn: 'otp->clk' from clk_prepare() not released on lines: 196.
+
+In the function sp_ocotp_probe(struct platform_device *pdev), otp->clk may
+not be released before return.
+
+To fix this issue, using function clk_unprepare() to release otp->clk.
+
+Fixes: 8747ec2e9762 ("nvmem: Add driver for OCOTP in Sunplus SP7021")
+Signed-off-by: Yi Yingao <m202271736@hust.edu.cn>
+Reviewed-by: Dongliang Mu <dzm91@hust.edu.cn>
+Message-ID: <20230509085237.5917-1-m202271736@hust.edu.cn>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvmem/sunplus-ocotp.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/nvmem/sunplus-ocotp.c b/drivers/nvmem/sunplus-ocotp.c
+index 52b928a7a6d58..f85350b17d672 100644
+--- a/drivers/nvmem/sunplus-ocotp.c
++++ b/drivers/nvmem/sunplus-ocotp.c
+@@ -192,9 +192,11 @@ static int sp_ocotp_probe(struct platform_device *pdev)
+ sp_ocotp_nvmem_config.dev = dev;
+
+ nvmem = devm_nvmem_register(dev, &sp_ocotp_nvmem_config);
+- if (IS_ERR(nvmem))
+- return dev_err_probe(&pdev->dev, PTR_ERR(nvmem),
++ if (IS_ERR(nvmem)) {
++ ret = dev_err_probe(&pdev->dev, PTR_ERR(nvmem),
+ "register nvmem device fail\n");
++ goto err;
++ }
+
+ platform_set_drvdata(pdev, nvmem);
+
+@@ -203,6 +205,9 @@ static int sp_ocotp_probe(struct platform_device *pdev)
+ (int)OTP_WORD_SIZE, (int)QAC628_OTP_SIZE);
+
+ return 0;
++err:
++ clk_unprepare(otp->clk);
++ return ret;
+ }
+
+ static const struct of_device_id sp_ocotp_dt_ids[] = {
+--
+2.39.2
+
--- /dev/null
+From b3d7519ac93cadae6c77c064813dd23693ae2d4b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Jul 2023 09:56:53 +0530
+Subject: octeontx-af: fix hardware timestamp configuration
+
+From: Hariprasad Kelam <hkelam@marvell.com>
+
+[ Upstream commit 14bb236b29922c4f57d8c05bfdbcb82677f917c9 ]
+
+MAC block on CN10K (RPM) supports hardware timestamp configuration. The
+previous patch which added timestamp configuration support has a bug.
+Though the netdev driver requests to disable timestamp configuration,
+the driver is always enabling it.
+
+This patch fixes the same.
+
+Fixes: d1489208681d ("octeontx2-af: cn10k: RPM hardware timestamp configuration")
+Signed-off-by: Hariprasad Kelam <hkelam@marvell.com>
+Signed-off-by: Sunil Goutham <sgoutham@marvell.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c
+index e284a14ca1203..c60b9580ca969 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c
+@@ -751,7 +751,7 @@ static int rvu_cgx_ptp_rx_cfg(struct rvu *rvu, u16 pcifunc, bool enable)
+ cgxd = rvu_cgx_pdata(cgx_id, rvu);
+
+ mac_ops = get_mac_ops(cgxd);
+- mac_ops->mac_enadis_ptp_config(cgxd, lmac_id, true);
++ mac_ops->mac_enadis_ptp_config(cgxd, lmac_id, enable);
+ /* If PTP is enabled then inform NPC that packets to be
+ * parsed by this PF will have their data shifted by 8 bytes
+ * and if PTP is disabled then no shift is required
+--
+2.39.2
+
--- /dev/null
+From abfdc229d42676f45f9fd0b7246b4309d51b7ed2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Jun 2023 11:58:44 +0530
+Subject: octeontx2-af: Add validation before accessing cgx and lmac
+
+From: Hariprasad Kelam <hkelam@marvell.com>
+
+[ Upstream commit 79ebb53772c95d3a6ae51b3c65f9985fdd430df6 ]
+
+with the addition of new MAC blocks like CN10K RPM and CN10KB
+RPM_USX, LMACs are noncontiguous and CGX blocks are also
+noncontiguous. But during RVU driver initialization, the driver
+is assuming they are contiguous and trying to access
+cgx or lmac with their id which is resulting in kernel panic.
+
+This patch fixes the issue by adding proper checks.
+
+[ 23.219150] pc : cgx_lmac_read+0x38/0x70
+[ 23.219154] lr : rvu_program_channels+0x3f0/0x498
+[ 23.223852] sp : ffff000100d6fc80
+[ 23.227158] x29: ffff000100d6fc80 x28: ffff00010009f880 x27:
+000000000000005a
+[ 23.234288] x26: ffff000102586768 x25: 0000000000002500 x24:
+fffffffffff0f000
+
+Fixes: 91c6945ea1f9 ("octeontx2-af: cn10k: Add RPM MAC support")
+Signed-off-by: Hariprasad Kelam <hkelam@marvell.com>
+Signed-off-by: Sunil Goutham <sgoutham@marvell.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/octeontx2/af/cgx.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c
+index afdddfced7e69..65c0373d34d12 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c
+@@ -167,6 +167,9 @@ void cgx_lmac_write(int cgx_id, int lmac_id, u64 offset, u64 val)
+ {
+ struct cgx *cgx_dev = cgx_get_pdata(cgx_id);
+
++ /* Software must not access disabled LMAC registers */
++ if (!is_lmac_valid(cgx_dev, lmac_id))
++ return;
+ cgx_write(cgx_dev, lmac_id, offset, val);
+ }
+
+@@ -174,6 +177,10 @@ u64 cgx_lmac_read(int cgx_id, int lmac_id, u64 offset)
+ {
+ struct cgx *cgx_dev = cgx_get_pdata(cgx_id);
+
++ /* Software must not access disabled LMAC registers */
++ if (!is_lmac_valid(cgx_dev, lmac_id))
++ return 0;
++
+ return cgx_read(cgx_dev, lmac_id, offset);
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 71218faff1005cbe178cc8650550aa3cb942a360 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Jun 2023 11:58:43 +0530
+Subject: octeontx2-af: Fix mapping for NIX block from CGX connection
+
+From: Hariprasad Kelam <hkelam@marvell.com>
+
+[ Upstream commit 2e7bc57b976bb016c6569a54d95c1b8d88f9450a ]
+
+Firmware configures NIX block mapping for all MAC blocks.
+The current implementation reads the configuration and
+creates the mapping between RVU PF and NIX blocks. But
+this configuration is only valid for silicons that support
+multiple blocks. For all other silicons, all MAC blocks
+map to NIX0.
+
+This patch corrects the mapping by adding a check for the same.
+
+Fixes: c5a73b632b90 ("octeontx2-af: Map NIX block from CGX connection")
+Signed-off-by: Hariprasad Kelam <hkelam@marvell.com>
+Signed-off-by: Sunil Goutham <sgoutham@marvell.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/octeontx2/af/rvu.h | 11 +++++++++++
+ drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c | 2 +-
+ 2 files changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu.h b/drivers/net/ethernet/marvell/octeontx2/af/rvu.h
+index d493b533cf76e..a3346ea7876c5 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu.h
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu.h
+@@ -23,6 +23,7 @@
+ #define PCI_DEVID_OCTEONTX2_LBK 0xA061
+
+ /* Subsystem Device ID */
++#define PCI_SUBSYS_DEVID_98XX 0xB100
+ #define PCI_SUBSYS_DEVID_96XX 0xB200
+ #define PCI_SUBSYS_DEVID_CN10K_A 0xB900
+ #define PCI_SUBSYS_DEVID_CNF10K_B 0xBC00
+@@ -646,6 +647,16 @@ static inline u16 rvu_nix_chan_cpt(struct rvu *rvu, u8 chan)
+ return rvu->hw->cpt_chan_base + chan;
+ }
+
++static inline bool is_rvu_supports_nix1(struct rvu *rvu)
++{
++ struct pci_dev *pdev = rvu->pdev;
++
++ if (pdev->subsystem_device == PCI_SUBSYS_DEVID_98XX)
++ return true;
++
++ return false;
++}
++
+ /* Function Prototypes
+ * RVU
+ */
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c
+index 9eca38547b783..e284a14ca1203 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c
+@@ -112,7 +112,7 @@ static void rvu_map_cgx_nix_block(struct rvu *rvu, int pf,
+ p2x = cgx_lmac_get_p2x(cgx_id, lmac_id);
+ /* Firmware sets P2X_SELECT as either NIX0 or NIX1 */
+ pfvf->nix_blkaddr = BLKADDR_NIX0;
+- if (p2x == CMR_P2X_SEL_NIX1)
++ if (is_rvu_supports_nix1(rvu) && p2x == CMR_P2X_SEL_NIX1)
+ pfvf->nix_blkaddr = BLKADDR_NIX1;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 8637ddd8383dc9ffc1fee7d1f52cf61a6ce290b2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 May 2023 10:39:50 +0300
+Subject: phy: tegra: xusb: check return value of devm_kzalloc()
+
+From: Claudiu Beznea <claudiu.beznea@microchip.com>
+
+[ Upstream commit 44faada0f38fc333d392af04c343b0e23f8f5d81 ]
+
+devm_kzalloc() returns a pointer to dynamically allocated memory.
+Pointer could be NULL in case allocation fails. Check pointer validity.
+Identified with coccinelle (kmerr.cocci script).
+
+Fixes: f67213cee2b3 ("phy: tegra: xusb: Add usb-role-switch support")
+Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Acked-by: Thierry Reding <treding@nvidia.com>
+Link: https://lore.kernel.org/r/20230531073950.145339-1-claudiu.beznea@microchip.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/tegra/xusb.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/phy/tegra/xusb.c b/drivers/phy/tegra/xusb.c
+index c3fa22ee2d8d4..4d5b4071d47d5 100644
+--- a/drivers/phy/tegra/xusb.c
++++ b/drivers/phy/tegra/xusb.c
+@@ -670,6 +670,9 @@ static int tegra_xusb_setup_usb_role_switch(struct tegra_xusb_port *port)
+ port->dev.driver = devm_kzalloc(&port->dev,
+ sizeof(struct device_driver),
+ GFP_KERNEL);
++ if (!port->dev.driver)
++ return -ENOMEM;
++
+ port->dev.driver->owner = THIS_MODULE;
+
+ port->usb_role_sw = usb_role_switch_register(&port->dev,
+--
+2.39.2
+
--- /dev/null
+From 74ee2c2796a74efd4431b51eefb7be87ab2b0a23 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Jun 2023 22:47:12 -0700
+Subject: powerpc: allow PPC_EARLY_DEBUG_CPM only when SERIAL_CPM=y
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 39f49684036d24af800ff194c33c7b2653c591d7 ]
+
+In a randconfig with CONFIG_SERIAL_CPM=m and
+CONFIG_PPC_EARLY_DEBUG_CPM=y, there is a build error:
+ERROR: modpost: "udbg_putc" [drivers/tty/serial/cpm_uart/cpm_uart.ko] undefined!
+
+Prevent the build error by allowing PPC_EARLY_DEBUG_CPM only when
+SERIAL_CPM=y.
+
+Fixes: c374e00e17f1 ("[POWERPC] Add early debug console for CPM serial ports.")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Reviewed-by: Pali Rohár <pali@kernel.org>
+Reviewed-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20230701054714.30512-1-rdunlap@infradead.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/Kconfig.debug | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/Kconfig.debug b/arch/powerpc/Kconfig.debug
+index 6aaf8dc60610d..2a54fadbeaf51 100644
+--- a/arch/powerpc/Kconfig.debug
++++ b/arch/powerpc/Kconfig.debug
+@@ -240,7 +240,7 @@ config PPC_EARLY_DEBUG_40x
+
+ config PPC_EARLY_DEBUG_CPM
+ bool "Early serial debugging for Freescale CPM-based serial ports"
+- depends on SERIAL_CPM
++ depends on SERIAL_CPM=y
+ help
+ Select this to enable early debugging for Freescale chips
+ using a CPM-based serial port. This assumes that the bootwrapper
+--
+2.39.2
+
--- /dev/null
+From 5bef14c3b74185c168ce38b8ee33fb07b266292e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 May 2023 19:28:18 +0200
+Subject: powerpc: dts: turris1x.dts: Fix PCIe MEM size for pci2 node
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pali Rohár <pali@kernel.org>
+
+[ Upstream commit abaa02fc944f2f9f2c2e1925ddaceaf35c48528c ]
+
+Freescale PCIe controllers on their PCIe Root Ports do not have any
+mappable PCI BAR allocate from PCIe MEM.
+
+Information about 1MB window on BAR0 of PCIe Root Port was misleading
+because Freescale PCIe controllers have at BAR0 position different register
+PEXCSRBAR, and kernel correctly skipts BAR0 for these Freescale PCIe Root
+Ports.
+
+So update comment about P2020 PCIe Root Port and decrease PCIe MEM size
+required for PCIe controller (pci2 node) on which is on-board xHCI
+controller.
+
+lspci confirms that on P2020 PCIe Root Port is no PCI BAR and /proc/iomem
+sees that only c0000000-c000ffff and c0010000-c0011fff ranges are used.
+
+Fixes: 54c15ec3b738 ("powerpc: dts: Add DTS file for CZ.NIC Turris 1.x routers")
+Signed-off-by: Pali Rohár <pali@kernel.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20230505172818.18416-1-pali@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/boot/dts/turris1x.dts | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/powerpc/boot/dts/turris1x.dts b/arch/powerpc/boot/dts/turris1x.dts
+index e9cda34a140e0..9377055d5565c 100644
+--- a/arch/powerpc/boot/dts/turris1x.dts
++++ b/arch/powerpc/boot/dts/turris1x.dts
+@@ -453,12 +453,12 @@ pci2: pcie@ffe08000 {
+ * channel 1 (but only USB 2.0 subset) to USB 2.0 pins on mPCIe
+ * slot 1 (CN5), channels 2 and 3 to connector P600.
+ *
+- * P2020 PCIe Root Port uses 1MB of PCIe MEM and xHCI controller
++ * P2020 PCIe Root Port does not use PCIe MEM and xHCI controller
+ * uses 64kB + 8kB of PCIe MEM. No PCIe IO is used or required.
+- * So allocate 2MB of PCIe MEM for this PCIe bus.
++ * So allocate 128kB of PCIe MEM for this PCIe bus.
+ */
+ reg = <0 0xffe08000 0 0x1000>;
+- ranges = <0x02000000 0x0 0xc0000000 0 0xc0000000 0x0 0x00200000>, /* MEM */
++ ranges = <0x02000000 0x0 0xc0000000 0 0xc0000000 0x0 0x00020000>, /* MEM */
+ <0x01000000 0x0 0x00000000 0 0xffc20000 0x0 0x00010000>; /* IO */
+
+ pcie@0 {
+--
+2.39.2
+
--- /dev/null
+From f095a0fd51792f51bd2a6c289a852bbe8decda32 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Jul 2023 19:14:46 +0200
+Subject: pptp: Fix fib lookup calls.
+
+From: Guillaume Nault <gnault@redhat.com>
+
+[ Upstream commit 84bef5b6037c15180ef88ac4216dc621d16df1a6 ]
+
+PPTP uses pppox sockets (struct pppox_sock). These sockets don't embed
+an inet_sock structure, so it's invalid to call inet_sk() on them.
+
+Therefore, the ip_route_output_ports() call in pptp_connect() has two
+problems:
+
+ * The tos variable is set with RT_CONN_FLAGS(sk), which calls
+ inet_sk() on the pppox socket.
+
+ * ip_route_output_ports() tries to retrieve routing flags using
+ inet_sk_flowi_flags(), which is also going to call inet_sk() on the
+ pppox socket.
+
+While PPTP doesn't use inet sockets, it's actually really layered on
+top of IP and therefore needs a proper way to do fib lookups. So let's
+define pptp_route_output() to get a struct rtable from a pptp socket.
+Let's also replace the ip_route_output_ports() call of pptp_xmit() for
+consistency.
+
+In practice, this means that:
+
+ * pptp_connect() sets ->flowi4_tos and ->flowi4_flags to zero instead
+ of using bits of unrelated struct pppox_sock fields.
+
+ * pptp_xmit() now respects ->sk_mark and ->sk_uid.
+
+ * pptp_xmit() now calls the security_sk_classify_flow() security
+ hook, thus allowing to set ->flowic_secid.
+
+ * pptp_xmit() now passes the pppox socket to xfrm_lookup_route().
+
+Found by code inspection.
+
+Fixes: 00959ade36ac ("PPTP: PPP over IPv4 (Point-to-Point Tunneling Protocol)")
+Signed-off-by: Guillaume Nault <gnault@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ppp/pptp.c | 31 ++++++++++++++++++++-----------
+ 1 file changed, 20 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/net/ppp/pptp.c b/drivers/net/ppp/pptp.c
+index 0fe78826c8fa4..32183f24e63ff 100644
+--- a/drivers/net/ppp/pptp.c
++++ b/drivers/net/ppp/pptp.c
+@@ -24,6 +24,7 @@
+ #include <linux/in.h>
+ #include <linux/ip.h>
+ #include <linux/rcupdate.h>
++#include <linux/security.h>
+ #include <linux/spinlock.h>
+
+ #include <net/sock.h>
+@@ -128,6 +129,23 @@ static void del_chan(struct pppox_sock *sock)
+ spin_unlock(&chan_lock);
+ }
+
++static struct rtable *pptp_route_output(struct pppox_sock *po,
++ struct flowi4 *fl4)
++{
++ struct sock *sk = &po->sk;
++ struct net *net;
++
++ net = sock_net(sk);
++ flowi4_init_output(fl4, sk->sk_bound_dev_if, sk->sk_mark, 0,
++ RT_SCOPE_UNIVERSE, IPPROTO_GRE, 0,
++ po->proto.pptp.dst_addr.sin_addr.s_addr,
++ po->proto.pptp.src_addr.sin_addr.s_addr,
++ 0, 0, sock_net_uid(net, sk));
++ security_sk_classify_flow(sk, flowi4_to_flowi_common(fl4));
++
++ return ip_route_output_flow(net, fl4, sk);
++}
++
+ static int pptp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
+ {
+ struct sock *sk = (struct sock *) chan->private;
+@@ -151,11 +169,7 @@ static int pptp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
+ if (sk_pppox(po)->sk_state & PPPOX_DEAD)
+ goto tx_error;
+
+- rt = ip_route_output_ports(net, &fl4, NULL,
+- opt->dst_addr.sin_addr.s_addr,
+- opt->src_addr.sin_addr.s_addr,
+- 0, 0, IPPROTO_GRE,
+- RT_TOS(0), sk->sk_bound_dev_if);
++ rt = pptp_route_output(po, &fl4);
+ if (IS_ERR(rt))
+ goto tx_error;
+
+@@ -438,12 +452,7 @@ static int pptp_connect(struct socket *sock, struct sockaddr *uservaddr,
+ po->chan.private = sk;
+ po->chan.ops = &pptp_chan_ops;
+
+- rt = ip_route_output_ports(sock_net(sk), &fl4, sk,
+- opt->dst_addr.sin_addr.s_addr,
+- opt->src_addr.sin_addr.s_addr,
+- 0, 0,
+- IPPROTO_GRE, RT_CONN_FLAGS(sk),
+- sk->sk_bound_dev_if);
++ rt = pptp_route_output(po, &fl4);
+ if (IS_ERR(rt)) {
+ error = -EHOSTUNREACH;
+ goto end;
+--
+2.39.2
+
--- /dev/null
+From 1078d9eb66db0c14a5232f46411ae8644ffe465c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 May 2023 14:07:42 +0300
+Subject: pwm: ab8500: Fix error code in probe()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit cdcffafc4d845cc0c6392cba168c7a942734cce7 ]
+
+This code accidentally return positive EINVAL instead of negative
+-EINVAL.
+
+Fixes: eb41f334589d ("pwm: ab8500: Fix register offset calculation to not depend on probe order")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Reviewed-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-ab8500.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pwm/pwm-ab8500.c b/drivers/pwm/pwm-ab8500.c
+index ad37bc46f2721..5fa91f4cda7ac 100644
+--- a/drivers/pwm/pwm-ab8500.c
++++ b/drivers/pwm/pwm-ab8500.c
+@@ -96,7 +96,7 @@ static int ab8500_pwm_probe(struct platform_device *pdev)
+ int err;
+
+ if (pdev->id < 1 || pdev->id > 31)
+- return dev_err_probe(&pdev->dev, EINVAL, "Invalid device id %d\n", pdev->id);
++ return dev_err_probe(&pdev->dev, -EINVAL, "Invalid device id %d\n", pdev->id);
+
+ /*
+ * Nothing to be done in probe, this is required to get the
+--
+2.39.2
+
--- /dev/null
+From 328d054a1bd259b261084022a24aae00271301e6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 May 2023 14:58:39 +0800
+Subject: pwm: imx-tpm: force 'real_period' to be zero in suspend
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Fancy Fang <chen.fang@nxp.com>
+
+[ Upstream commit 661dfb7f46298e53f6c3deaa772fa527aae86193 ]
+
+During suspend, all the tpm registers will lose values.
+So the 'real_period' value of struct 'imx_tpm_pwm_chip'
+should be forced to be zero to force the period update
+code can be executed after system resume back.
+
+Signed-off-by: Fancy Fang <chen.fang@nxp.com>
+Signed-off-by: Clark Wang <xiaoning.wang@nxp.com>
+Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Fixes: 738a1cfec2ed ("pwm: Add i.MX TPM PWM driver support")
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-imx-tpm.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/pwm/pwm-imx-tpm.c b/drivers/pwm/pwm-imx-tpm.c
+index ed1aad96fff04..318dc0be974b4 100644
+--- a/drivers/pwm/pwm-imx-tpm.c
++++ b/drivers/pwm/pwm-imx-tpm.c
+@@ -399,6 +399,13 @@ static int __maybe_unused pwm_imx_tpm_suspend(struct device *dev)
+ if (tpm->enable_count > 0)
+ return -EBUSY;
+
++ /*
++ * Force 'real_period' to be zero to force period update code
++ * can be executed after system resume back, since suspend causes
++ * the period related registers to become their reset values.
++ */
++ tpm->real_period = 0;
++
+ clk_disable_unprepare(tpm->clk);
+
+ return 0;
+--
+2.39.2
+
--- /dev/null
+From 75afdbafac8c2f573a43527470a531cb4a254ba3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 May 2023 11:10:01 +0800
+Subject: pwm: mtk_disp: Fix the disable flow of disp_pwm
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Shuijing Li <shuijing.li@mediatek.com>
+
+[ Upstream commit bc13d60e4e1e945b34769a4a4c2b172e8552abe5 ]
+
+There is a flow error in the original mtk_disp_pwm_apply() function.
+If this function is called when the clock is disabled, there will be a
+chance to operate the disp_pwm register, resulting in disp_pwm exception.
+Fix this accordingly.
+
+Fixes: 888a623db5d0 ("pwm: mtk-disp: Implement atomic API .apply()")
+Signed-off-by: Shuijing Li <shuijing.li@mediatek.com>
+Reviewed-by: Matthias Brugger <matthias.bgg@gmail.com>
+Tested-by: Fei Shao <fshao@chromium.org>
+Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Reviewed-by: Alexandre Mergnat <amergnat@baylibre.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-mtk-disp.c | 13 +++++--------
+ 1 file changed, 5 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/pwm/pwm-mtk-disp.c b/drivers/pwm/pwm-mtk-disp.c
+index 3811578fcff05..db286284f3ee0 100644
+--- a/drivers/pwm/pwm-mtk-disp.c
++++ b/drivers/pwm/pwm-mtk-disp.c
+@@ -79,14 +79,11 @@ static int mtk_disp_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,
+ if (state->polarity != PWM_POLARITY_NORMAL)
+ return -EINVAL;
+
+- if (!state->enabled) {
+- mtk_disp_pwm_update_bits(mdp, DISP_PWM_EN, mdp->data->enable_mask,
+- 0x0);
+-
+- if (mdp->enabled) {
+- clk_disable_unprepare(mdp->clk_mm);
+- clk_disable_unprepare(mdp->clk_main);
+- }
++ if (!state->enabled && mdp->enabled) {
++ mtk_disp_pwm_update_bits(mdp, DISP_PWM_EN,
++ mdp->data->enable_mask, 0x0);
++ clk_disable_unprepare(mdp->clk_mm);
++ clk_disable_unprepare(mdp->clk_main);
+
+ mdp->enabled = false;
+ return 0;
+--
+2.39.2
+
--- /dev/null
+From 4d38c89ecc0294a87a19715ba2ef321fee1a762b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 May 2023 18:47:36 +0200
+Subject: pwm: sysfs: Do not apply state to already disabled PWMs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Marek Vasut <marex@denx.de>
+
+[ Upstream commit 38ba83598633373f47951384cfc389181c8d1bed ]
+
+If the PWM is exported but not enabled, do not call pwm_class_apply_state().
+First of all, in this case, period may still be unconfigured and this would
+make pwm_class_apply_state() return -EINVAL, and then suspend would fail.
+Second, it makes little sense to apply state onto PWM that is not enabled
+before suspend.
+
+Failing case:
+"
+$ echo 1 > /sys/class/pwm/pwmchip4/export
+$ echo mem > /sys/power/state
+...
+pwm pwmchip4: PM: dpm_run_callback(): pwm_class_suspend+0x1/0xa8 returns -22
+pwm pwmchip4: PM: failed to suspend: error -22
+PM: Some devices failed to suspend, or early wake event detected
+"
+
+Working case:
+"
+$ echo 1 > /sys/class/pwm/pwmchip4/export
+$ echo 100 > /sys/class/pwm/pwmchip4/pwm1/period
+$ echo 10 > /sys/class/pwm/pwmchip4/pwm1/duty_cycle
+$ echo mem > /sys/power/state
+...
+"
+
+Do not call pwm_class_apply_state() in case the PWM is disabled
+to fix this issue.
+
+Fixes: 7fd4edc57bbae ("pwm: sysfs: Add suspend/resume support")
+Signed-off-by: Marek Vasut <marex@denx.de>
+Fixes: ef2bf4997f7d ("pwm: Improve args checking in pwm_apply_state()")
+Reviewed-by: Brian Norris <briannorris@chromium.org>
+Reviewed-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/sysfs.c | 17 +++++++++++++++++
+ 1 file changed, 17 insertions(+)
+
+diff --git a/drivers/pwm/sysfs.c b/drivers/pwm/sysfs.c
+index e7db8e45001cf..ba125253857ea 100644
+--- a/drivers/pwm/sysfs.c
++++ b/drivers/pwm/sysfs.c
+@@ -424,6 +424,13 @@ static int pwm_class_resume_npwm(struct device *parent, unsigned int npwm)
+ if (!export)
+ continue;
+
++ /* If pwmchip was not enabled before suspend, do nothing. */
++ if (!export->suspend.enabled) {
++ /* release lock taken in pwm_class_get_state */
++ mutex_unlock(&export->lock);
++ continue;
++ }
++
+ state.enabled = export->suspend.enabled;
+ ret = pwm_class_apply_state(export, pwm, &state);
+ if (ret < 0)
+@@ -448,7 +455,17 @@ static int pwm_class_suspend(struct device *parent)
+ if (!export)
+ continue;
+
++ /*
++ * If pwmchip was not enabled before suspend, save
++ * state for resume time and do nothing else.
++ */
+ export->suspend = state;
++ if (!state.enabled) {
++ /* release lock taken in pwm_class_get_state */
++ mutex_unlock(&export->lock);
++ continue;
++ }
++
+ state.enabled = false;
+ ret = pwm_class_apply_state(export, pwm, &state);
+ if (ret < 0) {
+--
+2.39.2
+
--- /dev/null
+From 4fe86e1c7a9f0afc0fb3bbd915968081c2ab5e97 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Jun 2023 11:30:35 +0200
+Subject: Revert "usb: common: usb-conn-gpio: Set last role to unknown before
+ initial detection"
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+[ Upstream commit df49f2a0ac4a34c0cb4b5c233fcfa0add644c43c ]
+
+This reverts commit edd60d24bd858cef165274e4cd6cab43bdc58d15.
+
+Heikki reports that this should not be a global flag just to work around
+one broken driver and should be fixed differently, so revert it.
+
+Reported-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Fixes: edd60d24bd85 ("usb: common: usb-conn-gpio: Set last role to unknown before initial detection")
+Link: https://lore.kernel.org/r/ZImE4L3YgABnCIsP@kuha.fi.intel.com
+Cc: Prashanth K <quic_prashk@quicinc.com>
+Cc: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/cdns3/core.c | 2 --
+ drivers/usb/common/usb-conn-gpio.c | 3 ---
+ drivers/usb/musb/jz4740.c | 2 --
+ drivers/usb/roles/intel-xhci-usb-role-switch.c | 2 --
+ include/linux/usb/role.h | 1 -
+ 5 files changed, 10 deletions(-)
+
+diff --git a/drivers/usb/cdns3/core.c b/drivers/usb/cdns3/core.c
+index 69d2921f2d3b5..dbcdf3b24b477 100644
+--- a/drivers/usb/cdns3/core.c
++++ b/drivers/usb/cdns3/core.c
+@@ -252,8 +252,6 @@ static enum usb_role cdns_hw_role_state_machine(struct cdns *cdns)
+ if (!vbus)
+ role = USB_ROLE_NONE;
+ break;
+- default:
+- break;
+ }
+
+ dev_dbg(cdns->dev, "role %d -> %d\n", cdns->role, role);
+diff --git a/drivers/usb/common/usb-conn-gpio.c b/drivers/usb/common/usb-conn-gpio.c
+index 30bdb81934bc8..e20874caba363 100644
+--- a/drivers/usb/common/usb-conn-gpio.c
++++ b/drivers/usb/common/usb-conn-gpio.c
+@@ -257,9 +257,6 @@ static int usb_conn_probe(struct platform_device *pdev)
+ platform_set_drvdata(pdev, info);
+ device_set_wakeup_capable(&pdev->dev, true);
+
+- /* Set last role to unknown before performing the initial detection */
+- info->last_role = USB_ROLE_UNKNOWN;
+-
+ /* Perform initial detection */
+ usb_conn_queue_dwork(info, 0);
+
+diff --git a/drivers/usb/musb/jz4740.c b/drivers/usb/musb/jz4740.c
+index df4e9d397d986..d1e4e0deb7535 100644
+--- a/drivers/usb/musb/jz4740.c
++++ b/drivers/usb/musb/jz4740.c
+@@ -91,8 +91,6 @@ static int jz4740_musb_role_switch_set(struct usb_role_switch *sw,
+ case USB_ROLE_HOST:
+ atomic_notifier_call_chain(&phy->notifier, USB_EVENT_ID, phy);
+ break;
+- default:
+- break;
+ }
+
+ return 0;
+diff --git a/drivers/usb/roles/intel-xhci-usb-role-switch.c b/drivers/usb/roles/intel-xhci-usb-role-switch.c
+index 4d6a3dd06e011..5c96e929acea0 100644
+--- a/drivers/usb/roles/intel-xhci-usb-role-switch.c
++++ b/drivers/usb/roles/intel-xhci-usb-role-switch.c
+@@ -97,8 +97,6 @@ static int intel_xhci_usb_set_role(struct usb_role_switch *sw,
+ val |= SW_VBUS_VALID;
+ drd_config = DRD_CONFIG_STATIC_DEVICE;
+ break;
+- default:
+- break;
+ }
+ val |= SW_IDPIN_EN;
+ if (data->enable_sw_switch) {
+diff --git a/include/linux/usb/role.h b/include/linux/usb/role.h
+index 65e790a28913e..b5deafd91f67b 100644
+--- a/include/linux/usb/role.h
++++ b/include/linux/usb/role.h
+@@ -11,7 +11,6 @@ enum usb_role {
+ USB_ROLE_NONE,
+ USB_ROLE_HOST,
+ USB_ROLE_DEVICE,
+- USB_ROLE_UNKNOWN,
+ };
+
+ typedef int (*usb_role_switch_set_t)(struct usb_role_switch *sw,
+--
+2.39.2
+
--- /dev/null
+From ac49eae299f6f3f4c5fe156e8a051c18a811a4c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Jun 2023 21:19:07 +0800
+Subject: riscv: move memblock_allow_resize() after linear mapping is ready
+
+From: Woody Zhang <woodylab@foxmail.com>
+
+[ Upstream commit 85fadc0d04119c2fe4a20287767ab904c6d21ba1 ]
+
+The initial memblock metadata is accessed from kernel image mapping. The
+regions arrays need to "reallocated" from memblock and accessed through
+linear mapping to cover more memblock regions. So the resizing should
+not be allowed until linear mapping is ready. Note that there are
+memblock allocations when building linear mapping.
+
+This patch is similar to 24cc61d8cb5a ("arm64: memblock: don't permit
+memblock resizing until linear mapping is up").
+
+In following log, many memblock regions are reserved before
+create_linear_mapping_page_table(). And then it triggered reallocation
+of memblock.reserved.regions and memcpy the old array in kernel image
+mapping to the new array in linear mapping which caused a page fault.
+
+[ 0.000000] memblock_reserve: [0x00000000bf01f000-0x00000000bf01ffff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6
+[ 0.000000] memblock_reserve: [0x00000000bf021000-0x00000000bf021fff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6
+[ 0.000000] memblock_reserve: [0x00000000bf023000-0x00000000bf023fff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6
+[ 0.000000] memblock_reserve: [0x00000000bf025000-0x00000000bf025fff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6
+[ 0.000000] memblock_reserve: [0x00000000bf027000-0x00000000bf027fff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6
+[ 0.000000] memblock_reserve: [0x00000000bf029000-0x00000000bf029fff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6
+[ 0.000000] memblock_reserve: [0x00000000bf02b000-0x00000000bf02bfff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6
+[ 0.000000] memblock_reserve: [0x00000000bf02d000-0x00000000bf02dfff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6
+[ 0.000000] memblock_reserve: [0x00000000bf02f000-0x00000000bf02ffff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6
+[ 0.000000] memblock_reserve: [0x00000000bf030000-0x00000000bf030fff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6
+[ 0.000000] OF: reserved mem: 0x0000000080000000..0x000000008007ffff (512 KiB) map non-reusable mmode_resv0@80000000
+[ 0.000000] memblock_reserve: [0x00000000bf000000-0x00000000bf001fed] paging_init+0x19a/0x5ae
+[ 0.000000] memblock_phys_alloc_range: 4096 bytes align=0x1000 from=0x0000000000000000 max_addr=0x0000000000000000 alloc_pmd_fixmap+0x14/0x1c
+[ 0.000000] memblock_reserve: [0x000000017ffff000-0x000000017fffffff] memblock_alloc_range_nid+0xb8/0x128
+[ 0.000000] memblock: reserved is doubled to 256 at [0x000000017fffd000-0x000000017fffe7ff]
+[ 0.000000] Unable to handle kernel paging request at virtual address ff600000ffffd000
+[ 0.000000] Oops [#1]
+[ 0.000000] Modules linked in:
+[ 0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 6.4.0-rc1-00011-g99a670b2069c #66
+[ 0.000000] Hardware name: riscv-virtio,qemu (DT)
+[ 0.000000] epc : __memcpy+0x60/0xf8
+[ 0.000000] ra : memblock_double_array+0x192/0x248
+[ 0.000000] epc : ffffffff8081d214 ra : ffffffff80a3dfc0 sp : ffffffff81403bd0
+[ 0.000000] gp : ffffffff814fbb38 tp : ffffffff8140dac0 t0 : 0000000001600000
+[ 0.000000] t1 : 0000000000000000 t2 : 000000008f001000 s0 : ffffffff81403c60
+[ 0.000000] s1 : ffffffff80c0bc98 a0 : ff600000ffffd000 a1 : ffffffff80c0bcd8
+[ 0.000000] a2 : 0000000000000c00 a3 : ffffffff80c0c8d8 a4 : 0000000080000000
+[ 0.000000] a5 : 0000000000080000 a6 : 0000000000000000 a7 : 0000000080200000
+[ 0.000000] s2 : ff600000ffffd000 s3 : 0000000000002000 s4 : 0000000000000c00
+[ 0.000000] s5 : ffffffff80c0bc60 s6 : ffffffff80c0bcc8 s7 : 0000000000000000
+[ 0.000000] s8 : ffffffff814fd0a8 s9 : 000000017fffe7ff s10: 0000000000000000
+[ 0.000000] s11: 0000000000001000 t3 : 0000000000001000 t4 : 0000000000000000
+[ 0.000000] t5 : 000000008f003000 t6 : ff600000ffffd000
+[ 0.000000] status: 0000000200000100 badaddr: ff600000ffffd000 cause: 000000000000000f
+[ 0.000000] [<ffffffff8081d214>] __memcpy+0x60/0xf8
+[ 0.000000] [<ffffffff80a3e1a2>] memblock_add_range.isra.14+0x12c/0x162
+[ 0.000000] [<ffffffff80a3e36a>] memblock_reserve+0x6e/0x8c
+[ 0.000000] [<ffffffff80a123fc>] memblock_alloc_range_nid+0xb8/0x128
+[ 0.000000] [<ffffffff80a1256a>] memblock_phys_alloc_range+0x5e/0x6a
+[ 0.000000] [<ffffffff80a04732>] alloc_pmd_fixmap+0x14/0x1c
+[ 0.000000] [<ffffffff80a0475a>] alloc_p4d_fixmap+0xc/0x14
+[ 0.000000] [<ffffffff80a04a36>] create_pgd_mapping+0x98/0x17c
+[ 0.000000] [<ffffffff80a04e9e>] create_linear_mapping_range.constprop.10+0xe4/0x112
+[ 0.000000] [<ffffffff80a05bb8>] paging_init+0x3ec/0x5ae
+[ 0.000000] [<ffffffff80a03354>] setup_arch+0xb2/0x576
+[ 0.000000] [<ffffffff80a00726>] start_kernel+0x72/0x57e
+[ 0.000000] Code: b303 0285 b383 0305 be03 0385 be83 0405 bf03 0485 (b023) 00ef
+[ 0.000000] ---[ end trace 0000000000000000 ]---
+[ 0.000000] Kernel panic - not syncing: Attempted to kill the idle task!
+[ 0.000000] ---[ end Kernel panic - not syncing: Attempted to kill the idle task! ]---
+
+Fixes: 671f9a3e2e24 ("RISC-V: Setup initial page tables in two stages")
+Signed-off-by: Woody Zhang <woodylab@foxmail.com>
+Tested-by: Song Shuai <songshuaishuai@tinylab.org>
+Link: https://lore.kernel.org/r/tencent_FBB94CE615C5CCE7701CD39C15CCE0EE9706@qq.com
+Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/mm/init.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/arch/riscv/mm/init.c b/arch/riscv/mm/init.c
+index d8d97df801909..9390cdff39ffc 100644
+--- a/arch/riscv/mm/init.c
++++ b/arch/riscv/mm/init.c
+@@ -255,7 +255,6 @@ static void __init setup_bootmem(void)
+ dma_contiguous_reserve(dma32_phys_limit);
+ if (IS_ENABLED(CONFIG_64BIT))
+ hugetlb_cma_reserve(PUD_SHIFT - PAGE_SHIFT);
+- memblock_allow_resize();
+ }
+
+ #ifdef CONFIG_MMU
+@@ -1211,6 +1210,9 @@ void __init paging_init(void)
+ {
+ setup_bootmem();
+ setup_vm_final();
++
++ /* Depend on that Linear Mapping is ready */
++ memblock_allow_resize();
+ }
+
+ void __init misc_mem_init(void)
+--
+2.39.2
+
--- /dev/null
+From d1afa1a976c5d354e7e080834b31120e28d02cca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Jun 2023 21:11:42 +0200
+Subject: rtc: st-lpc: Release some resources in st_rtc_probe() in case of
+ error
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 06c6e1b01d9261f03629cefd1f3553503291e6cf ]
+
+If an error occurs after clk_get(), the corresponding resources should be
+released.
+
+Use devm_clk_get() to fix it.
+
+Fixes: b5b2bdfc2893 ("rtc: st: Add new driver for ST's LPC RTC")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Link: https://lore.kernel.org/r/866af6adbc7454a7b4505eb6c28fbdc86ccff39e.1686251455.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-st-lpc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/rtc/rtc-st-lpc.c b/drivers/rtc/rtc-st-lpc.c
+index 0f8e4231098ef..d04d46f9cc65a 100644
+--- a/drivers/rtc/rtc-st-lpc.c
++++ b/drivers/rtc/rtc-st-lpc.c
+@@ -228,7 +228,7 @@ static int st_rtc_probe(struct platform_device *pdev)
+ enable_irq_wake(rtc->irq);
+ disable_irq(rtc->irq);
+
+- rtc->clk = clk_get(&pdev->dev, NULL);
++ rtc->clk = devm_clk_get(&pdev->dev, NULL);
+ if (IS_ERR(rtc->clk)) {
+ dev_err(&pdev->dev, "Unable to request clock\n");
+ return PTR_ERR(rtc->clk);
+--
+2.39.2
+
--- /dev/null
+From 04a5c0bf8c3e5157b29f6d0baa8276f70f9c01f8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Jul 2023 16:41:21 +0200
+Subject: s390/qeth: Fix vipa deletion
+
+From: Thorsten Winkler <twinkler@linux.ibm.com>
+
+[ Upstream commit 80de809bd35e2a8999edf9f5aaa2d8de18921f11 ]
+
+Change boolean parameter of function "qeth_l3_vipa_store" inside the
+"qeth_l3_dev_vipa_del4_store" function from "true" to "false" because
+"true" is used for adding a virtual ip address and "false" for deleting.
+
+Fixes: 2390166a6b45 ("s390/qeth: clean up L3 sysfs code")
+
+Reviewed-by: Alexandra Winter <wintera@linux.ibm.com>
+Reviewed-by: Wenjia Zhang <wenjia@linux.ibm.com>
+Signed-off-by: Thorsten Winkler <twinkler@linux.ibm.com>
+Signed-off-by: Alexandra Winter <wintera@linux.ibm.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/net/qeth_l3_sys.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/s390/net/qeth_l3_sys.c b/drivers/s390/net/qeth_l3_sys.c
+index 1082380b21f85..dba9b307020cb 100644
+--- a/drivers/s390/net/qeth_l3_sys.c
++++ b/drivers/s390/net/qeth_l3_sys.c
+@@ -652,7 +652,7 @@ static QETH_DEVICE_ATTR(vipa_add4, add4, 0644,
+ static ssize_t qeth_l3_dev_vipa_del4_store(struct device *dev,
+ struct device_attribute *attr, const char *buf, size_t count)
+ {
+- return qeth_l3_vipa_store(dev, buf, true, count, QETH_PROT_IPV4);
++ return qeth_l3_vipa_store(dev, buf, false, count, QETH_PROT_IPV4);
+ }
+
+ static QETH_DEVICE_ATTR(vipa_del4, del4, 0200, NULL,
+--
+2.39.2
+
--- /dev/null
+From cdaa05df65d5f514e56f421f2f0c9d4fa68da74a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jun 2023 12:03:40 +0000
+Subject: sctp: fix potential deadlock on &net->sctp.addr_wq_lock
+
+From: Chengfeng Ye <dg573847474@gmail.com>
+
+[ Upstream commit 6feb37b3b06e9049e20dcf7e23998f92c9c5be9a ]
+
+As &net->sctp.addr_wq_lock is also acquired by the timer
+sctp_addr_wq_timeout_handler() in protocal.c, the same lock acquisition
+at sctp_auto_asconf_init() seems should disable irq since it is called
+from sctp_accept() under process context.
+
+Possible deadlock scenario:
+sctp_accept()
+ -> sctp_sock_migrate()
+ -> sctp_auto_asconf_init()
+ -> spin_lock(&net->sctp.addr_wq_lock)
+ <timer interrupt>
+ -> sctp_addr_wq_timeout_handler()
+ -> spin_lock_bh(&net->sctp.addr_wq_lock); (deadlock here)
+
+This flaw was found using an experimental static analysis tool we are
+developing for irq-related deadlock.
+
+The tentative patch fix the potential deadlock by spin_lock_bh().
+
+Signed-off-by: Chengfeng Ye <dg573847474@gmail.com>
+Fixes: 34e5b0118685 ("sctp: delay auto_asconf init until binding the first addr")
+Acked-by: Xin Long <lucien.xin@gmail.com>
+Link: https://lore.kernel.org/r/20230627120340.19432-1-dg573847474@gmail.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sctp/socket.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/sctp/socket.c b/net/sctp/socket.c
+index e1011311bc877..c806d272107ac 100644
+--- a/net/sctp/socket.c
++++ b/net/sctp/socket.c
+@@ -363,9 +363,9 @@ static void sctp_auto_asconf_init(struct sctp_sock *sp)
+ struct net *net = sock_net(&sp->inet.sk);
+
+ if (net->sctp.default_auto_asconf) {
+- spin_lock(&net->sctp.addr_wq_lock);
++ spin_lock_bh(&net->sctp.addr_wq_lock);
+ list_add_tail(&sp->auto_asconf_list, &net->sctp.auto_asconf_splist);
+- spin_unlock(&net->sctp.addr_wq_lock);
++ spin_unlock_bh(&net->sctp.addr_wq_lock);
+ sp->do_auto_asconf = 1;
+ }
+ }
+--
+2.39.2
+
--- /dev/null
+From 0930980fb3f5d15a403a3827e4eebb669fc577ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 May 2023 11:37:54 +0206
+Subject: serial: 8250: lock port for stop_rx() in omap8250_irq()
+
+From: John Ogness <john.ogness@linutronix.de>
+
+[ Upstream commit ca73a892c5bec4b08a2fa22b3015e98ed905abb7 ]
+
+The uarts_ops stop_rx() callback expects that the port->lock is
+taken and interrupts are disabled.
+
+Fixes: 1fe0e1fa3209 ("serial: 8250_omap: Handle optional overrun-throttle-ms property")
+Signed-off-by: John Ogness <john.ogness@linutronix.de>
+Reviewed-by: Tony Lindgren <tony@atomide.com>
+Link: https://lore.kernel.org/r/20230525093159.223817-4-john.ogness@linutronix.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/8250/8250_omap.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c
+index 79bdf933c67e6..7ecd2d379292b 100644
+--- a/drivers/tty/serial/8250/8250_omap.c
++++ b/drivers/tty/serial/8250/8250_omap.c
+@@ -641,7 +641,9 @@ static irqreturn_t omap8250_irq(int irq, void *dev_id)
+
+ up->ier = port->serial_in(port, UART_IER);
+ if (up->ier & (UART_IER_RLSI | UART_IER_RDI)) {
++ spin_lock(&port->lock);
+ port->ops->stop_rx(port);
++ spin_unlock(&port->lock);
+ } else {
+ /* Keep restarting the timer until
+ * the input overrun subsides.
+--
+2.39.2
+
--- /dev/null
+From b5cc2057c8b0cdb329c484aa336292bac67b9a5a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 May 2023 11:37:58 +0206
+Subject: serial: 8250: lock port for UART_IER access in omap8250_irq()
+
+From: John Ogness <john.ogness@linutronix.de>
+
+[ Upstream commit 25614735a647693c1260f253dc3ab32127697806 ]
+
+omap8250_irq() accesses UART_IER. This register is modified twice
+by each console write (serial8250_console_write()) under the port
+lock. omap8250_irq() must also take the port lock to guanentee
+synchronized access to UART_IER.
+
+Since the port lock is already being taken for the stop_rx() callback
+and since it is safe to call cancel_delayed_work() while holding the
+port lock, simply extend the port lock region to include UART_IER
+access.
+
+Fixes: 1fe0e1fa3209 ("serial: 8250_omap: Handle optional overrun-throttle-ms property")
+Signed-off-by: John Ogness <john.ogness@linutronix.de>
+Reviewed-by: Tony Lindgren <tony@atomide.com>
+Link: https://lore.kernel.org/r/20230525093159.223817-8-john.ogness@linutronix.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/8250/8250_omap.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c
+index 7ecd2d379292b..17a230281ebe0 100644
+--- a/drivers/tty/serial/8250/8250_omap.c
++++ b/drivers/tty/serial/8250/8250_omap.c
+@@ -639,17 +639,18 @@ static irqreturn_t omap8250_irq(int irq, void *dev_id)
+ if ((lsr & UART_LSR_OE) && up->overrun_backoff_time_ms > 0) {
+ unsigned long delay;
+
++ /* Synchronize UART_IER access against the console. */
++ spin_lock(&port->lock);
+ up->ier = port->serial_in(port, UART_IER);
+ if (up->ier & (UART_IER_RLSI | UART_IER_RDI)) {
+- spin_lock(&port->lock);
+ port->ops->stop_rx(port);
+- spin_unlock(&port->lock);
+ } else {
+ /* Keep restarting the timer until
+ * the input overrun subsides.
+ */
+ cancel_delayed_work(&up->overrun_backoff);
+ }
++ spin_unlock(&port->lock);
+
+ delay = msecs_to_jiffies(up->overrun_backoff_time_ms);
+ schedule_delayed_work(&up->overrun_backoff, delay);
+--
+2.39.2
+
--- /dev/null
+From 65fdc46af165a5c8603bc1968aeb45a5b8a167c0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 May 2023 11:20:11 +0300
+Subject: serial: 8250: omap: Fix freeing of resources on failed register
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit b9ab22c2bc8652324a803b3e2be69838920b4025 ]
+
+If serial8250_register_8250_port() fails, the SoC can hang as the
+deferred PMQoS work will still run as is not flushed and removed.
+
+Fixes: 61929cf0169d ("tty: serial: Add 8250-core based omap driver")
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Link: https://lore.kernel.org/r/20230508082014.23083-2-tony@atomide.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/8250/8250_omap.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c
+index 3f33014022f0e..79bdf933c67e6 100644
+--- a/drivers/tty/serial/8250/8250_omap.c
++++ b/drivers/tty/serial/8250/8250_omap.c
+@@ -1453,7 +1453,9 @@ static int omap8250_probe(struct platform_device *pdev)
+ err:
+ pm_runtime_dont_use_autosuspend(&pdev->dev);
+ pm_runtime_put_sync(&pdev->dev);
++ flush_work(&priv->qos_work);
+ pm_runtime_disable(&pdev->dev);
++ cpu_latency_qos_remove_request(&priv->pm_qos_request);
+ return ret;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 8cf68843192c4a6315bcc61df6ec7f225b36bca3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Jun 2023 07:59:19 +0300
+Subject: serial: 8250_omap: Use force_suspend and resume for system suspend
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit 20a41a62618df85f3a2981008edec5cadd785e0a ]
+
+We should not rely on autosuspend timeout for system suspend. Instead,
+let's use force_suspend and force_resume functions. Otherwise the serial
+port controller device may not be idled on suspend.
+
+As we are doing a register write on suspend to configure the serial port,
+we still need to runtime PM resume the port on suspend.
+
+While at it, let's switch to pm_runtime_resume_and_get() and check for
+errors returned. And let's add the missing line break before return to the
+suspend function while at it.
+
+Fixes: 09d8b2bdbc5c ("serial: 8250: omap: Provide ability to enable/disable UART as wakeup source")
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Tested-by: Dhruva Gole <d-gole@ti.com>
+Message-ID: <20230614045922.4798-1-tony@atomide.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/8250/8250_omap.c | 20 +++++++++++++++-----
+ 1 file changed, 15 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c
+index 17a230281ebe0..adc85e250822c 100644
+--- a/drivers/tty/serial/8250/8250_omap.c
++++ b/drivers/tty/serial/8250/8250_omap.c
+@@ -1505,25 +1505,35 @@ static int omap8250_suspend(struct device *dev)
+ {
+ struct omap8250_priv *priv = dev_get_drvdata(dev);
+ struct uart_8250_port *up = serial8250_get_port(priv->line);
++ int err;
+
+ serial8250_suspend_port(priv->line);
+
+- pm_runtime_get_sync(dev);
++ err = pm_runtime_resume_and_get(dev);
++ if (err)
++ return err;
+ if (!device_may_wakeup(dev))
+ priv->wer = 0;
+ serial_out(up, UART_OMAP_WER, priv->wer);
+- pm_runtime_mark_last_busy(dev);
+- pm_runtime_put_autosuspend(dev);
+-
++ err = pm_runtime_force_suspend(dev);
+ flush_work(&priv->qos_work);
+- return 0;
++
++ return err;
+ }
+
+ static int omap8250_resume(struct device *dev)
+ {
+ struct omap8250_priv *priv = dev_get_drvdata(dev);
++ int err;
+
++ err = pm_runtime_force_resume(dev);
++ if (err)
++ return err;
+ serial8250_resume_port(priv->line);
++ /* Paired with pm_runtime_resume_and_get() in omap8250_suspend() */
++ pm_runtime_mark_last_busy(dev);
++ pm_runtime_put_autosuspend(dev);
++
+ return 0;
+ }
+ #else
+--
+2.39.2
+
--- /dev/null
+From d6396ad2a147888585ac06f4f3233c7b50486755 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 May 2023 11:37:55 +0206
+Subject: serial: core: lock port for start_rx() in uart_resume_port()
+
+From: John Ogness <john.ogness@linutronix.de>
+
+[ Upstream commit 51e45fba14bf08b66bca764a083c7f2e2ff62f01 ]
+
+The only user of the start_rx() callback (qcom_geni) directly calls
+its own stop_rx() callback. Since stop_rx() requires that the
+port->lock is taken and interrupts are disabled, the start_rx()
+callback has the same requirement.
+
+Fixes: cfab87c2c271 ("serial: core: Introduce callback for start_rx and do stop_rx in suspend only if this callback implementation is present.")
+Signed-off-by: John Ogness <john.ogness@linutronix.de>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Link: https://lore.kernel.org/r/20230525093159.223817-5-john.ogness@linutronix.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/serial_core.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
+index b0a4677172062..2cc5c68c8689f 100644
+--- a/drivers/tty/serial/serial_core.c
++++ b/drivers/tty/serial/serial_core.c
+@@ -2431,8 +2431,11 @@ int uart_resume_port(struct uart_driver *drv, struct uart_port *uport)
+ if (console_suspend_enabled)
+ uart_change_pm(state, UART_PM_STATE_ON);
+ uport->ops->set_termios(uport, &termios, NULL);
+- if (!console_suspend_enabled && uport->ops->start_rx)
++ if (!console_suspend_enabled && uport->ops->start_rx) {
++ spin_lock_irq(&uport->lock);
+ uport->ops->start_rx(uport);
++ spin_unlock_irq(&uport->lock);
++ }
+ if (console_suspend_enabled)
+ console_start(uport->cons);
+ }
+--
+2.39.2
+
--- /dev/null
+From bf0bb91ad503785e9740396636a6d8b4cfc7f25b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 May 2023 11:37:53 +0206
+Subject: serial: core: lock port for stop_rx() in uart_suspend_port()
+
+From: John Ogness <john.ogness@linutronix.de>
+
+[ Upstream commit abcb0cf1f5b2d99b1d117a4dbce334120e358d6d ]
+
+The uarts_ops stop_rx() callback expects that the port->lock is
+taken and interrupts are disabled.
+
+Fixes: c9d2325cdb92 ("serial: core: Do stop_rx in suspend path for console if console_suspend is disabled")
+Signed-off-by: John Ogness <john.ogness@linutronix.de>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Link: https://lore.kernel.org/r/20230525093159.223817-3-john.ogness@linutronix.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/serial_core.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
+index 23a7ab0de4445..b0a4677172062 100644
+--- a/drivers/tty/serial/serial_core.c
++++ b/drivers/tty/serial/serial_core.c
+@@ -2334,8 +2334,11 @@ int uart_suspend_port(struct uart_driver *drv, struct uart_port *uport)
+ * able to Re-start_rx later.
+ */
+ if (!console_suspend_enabled && uart_console(uport)) {
+- if (uport->ops->start_rx)
++ if (uport->ops->start_rx) {
++ spin_lock_irq(&uport->lock);
+ uport->ops->stop_rx(uport);
++ spin_unlock_irq(&uport->lock);
++ }
+ goto unlock;
+ }
+
+--
+2.39.2
+
block-increment-diskseq-on-all-media-change-events.patch
btrfs-fix-race-when-deleting-free-space-root-from-the-dirty-cow-roots-list.patch
sunrpc-fix-uaf-in-svc_tcp_listen_data_ready.patch
+w1-w1_therm-fix-locking-behavior-in-convert_t.patch
+w1-fix-loop-in-w1_fini.patch
+dt-bindings-power-reset-qcom-pon-only-allow-reboot-m.patch
+f2fs-do-not-allow-to-defragment-files-have-fi_compre.patch
+sh-j2-use-ioremap-to-translate-device-tree-address-i.patch
+usb-dwc2-platform-improve-error-reporting-for-proble.patch
+usb-dwc2-fix-some-error-handling-paths.patch
+serial-8250-omap-fix-freeing-of-resources-on-failed-.patch
+clk-qcom-mmcc-msm8974-use-array_size-instead-of-spec.patch
+clk-qcom-mmcc-msm8974-move-clock-parent-tables-down.patch
+clk-qcom-mmcc-msm8974-use-parent_hws-_data-instead-o.patch
+clk-qcom-mmcc-msm8974-remove-oxili_ocmemgx_clk.patch
+clk-qcom-camcc-sc7180-add-parent-dependency-to-all-c.patch
+clk-qcom-gcc-ipq6018-use-floor-ops-for-sdcc-clocks.patch
+clk-qcom-gcc-qcm2290-mark-rcgs-shared-where-applicab.patch
+media-usb-check-az6007_read-return-value.patch
+media-amphion-drop-repeated-codec-data-for-vc1l-form.patch
+media-amphion-drop-repeated-codec-data-for-vc1g-form.patch
+media-amphion-initiate-a-drain-of-the-capture-queue-.patch
+media-videodev2.h-fix-struct-v4l2_input-tuner-index-.patch
+media-usb-siano-fix-warning-due-to-null-work_func_t-.patch
+media-i2c-correct-format-propagation-for-st-mipid02.patch
+media-hi846-fix-usage-of-pm_runtime_get_if_in_use.patch
+media-mediatek-vcodec-using-decoder-status-instead-o.patch
+clk-qcom-reset-support-resetting-multiple-bits.patch
+clk-qcom-ipq6018-fix-networking-resets.patch
+clk-qcom-dispcc-qcm2290-fix-bi_tcxo_ao-handling.patch
+clk-qcom-dispcc-qcm2290-fix-gpll0_out_div-handling.patch
+clk-qcom-mmcc-msm8974-use-clk_rcg2_shared_ops-for-md.patch
+staging-vchiq_arm-mark-vchiq_platform_init-static.patch
+usb-dwc3-qcom-fix-potential-memory-leak.patch
+usb-gadget-u_serial-add-null-pointer-check-in-gseria.patch
+extcon-fix-kernel-doc-of-property-fields-to-avoid-wa.patch
+extcon-fix-kernel-doc-of-property-capability-fields-.patch
+usb-phy-phy-tahvo-fix-memory-leak-in-tahvo_usb_probe.patch
+usb-hide-unused-usbfs_notify_suspend-resume-function.patch
+usb-misc-eud-fix-eud-sysfs-path-use-qcom_eud.patch
+serial-core-lock-port-for-stop_rx-in-uart_suspend_po.patch
+serial-8250-lock-port-for-stop_rx-in-omap8250_irq.patch
+serial-core-lock-port-for-start_rx-in-uart_resume_po.patch
+serial-8250-lock-port-for-uart_ier-access-in-omap825.patch
+kernfs-fix-missing-kernfs_idr_lock-to-remove-an-id-f.patch
+lkdtm-replace-ll_rw_block-with-submit_bh.patch
+i3c-master-svc-fix-cpu-schedule-in-spin-lock.patch
+coresight-fix-loss-of-connection-info-when-a-module-.patch
+mfd-rt5033-drop-rt5033-battery-sub-device.patch
+media-venus-helpers-fix-align-of-non-power-of-two.patch
+media-atomisp-gmin_platform-fix-out_len-in-gmin_get_.patch
+sh-avoid-using-irq0-on-sh3-and-sh4.patch
+gfs2-fix-duplicate-should_fault_in_pages-call.patch
+f2fs-fix-potential-deadlock-due-to-unpaired-node_wri.patch
+f2fs-fix-to-avoid-null-pointer-dereference-f2fs_writ.patch
+kvm-s390-fix-kvm_s390_get_cmma_bits-for-gfns-in-mems.patch
+usb-dwc3-qcom-release-the-correct-resources-in-dwc3_.patch
+usb-dwc3-qcom-fix-an-error-handling-path-in-dwc3_qco.patch
+usb-common-usb-conn-gpio-set-last-role-to-unknown-be.patch
+usb-dwc3-meson-g12a-fix-an-error-handling-path-in-dw.patch
+mfd-wcd934x-fix-an-error-handling-path-in-wcd934x_sl.patch
+mfd-intel-lpss-add-missing-check-for-platform_get_re.patch
+revert-usb-common-usb-conn-gpio-set-last-role-to-unk.patch
+serial-8250_omap-use-force_suspend-and-resume-for-sy.patch
+device-property-fix-documentation-for-fwnode_get_nex.patch
+device-property-clarify-description-of-returned-valu.patch
+drivers-fwnode-fix-fwnode_irq_get-_byname.patch
+nvmem-sunplus-ocotp-release-otp-clk-before-return.patch
+nvmem-rmem-use-nvmem_devid_auto.patch
+bus-fsl-mc-don-t-assume-child-devices-are-all-fsl-mc.patch
+mfd-stmfx-fix-error-path-in-stmfx_chip_init.patch
+mfd-stmfx-nullify-stmfx-vdd-in-case-of-error.patch
+kvm-s390-vsie-fix-the-length-of-apcb-bitmap.patch
+kvm-s390-diag-fix-racy-access-of-physical-cpu-number.patch
+cpufreq-mediatek-correct-voltages-for-mt7622-and-mt7.patch
+misc-fastrpc-check-return-value-of-devm_kasprintf.patch
+clk-qcom-mmcc-msm8974-fix-mdss_gdsc-power-flags.patch
+hwtracing-hisi_ptt-fix-potential-sleep-in-atomic-con.patch
+mfd-stmpe-only-disable-the-regulators-if-they-are-en.patch
+phy-tegra-xusb-check-return-value-of-devm_kzalloc.patch
+lib-bitmap-drop-optimization-of-bitmap_-from-to-_arr.patch
+pwm-imx-tpm-force-real_period-to-be-zero-in-suspend.patch
+pwm-sysfs-do-not-apply-state-to-already-disabled-pwm.patch
+pwm-ab8500-fix-error-code-in-probe.patch
+pwm-mtk_disp-fix-the-disable-flow-of-disp_pwm.patch
+md-raid10-fix-the-condition-to-call-bio_end_io_acct.patch
+blk-cgroup-optimize-blkcg_rstat_flush.patch
+blk-cgroup-don-t-update-io-stat-for-root-cgroup.patch
+blk-throttle-fix-io-statistics-for-cgroup-v1.patch
+rtc-st-lpc-release-some-resources-in-st_rtc_probe-in.patch
+drm-i915-psr-use-hw.adjusted-mode-when-calculating-i.patch
+drm-i915-guc-slpc-apply-min-softlimit-correctly.patch
+f2fs-check-return-value-of-freeze_super.patch
+media-cec-i2c-ch7322-also-select-regmap.patch
+sctp-fix-potential-deadlock-on-net-sctp.addr_wq_lock.patch
+net-sched-act_ipt-add-sanity-checks-on-table-name-an.patch
+net-sched-avoid-indirect-act-functions-on-retpoline-.patch
+net-add-a-couple-of-helpers-for-iph-tot_len.patch
+net-sched-act_ipt-add-sanity-checks-on-skb-before-ca.patch
+net-sched-act_ipt-zero-skb-cb-before-calling-target.patch
+spi-spi-geni-qcom-enable-spi_controller_must_tx-for-.patch
+net-mscc-ocelot-don-t-report-that-rx-timestamping-is.patch
+net-mscc-ocelot-don-t-keep-ptp-configuration-of-all-.patch
+net-dsa-felix-don-t-drop-ptp-frames-with-tag_8021q-w.patch
+net-dsa-sja1105-always-enable-the-incl_srcpt-option.patch
+net-dsa-tag_sja1105-always-prefer-source-port-inform.patch
+add-module_firmware-for-firmware_tg357766.patch
+bluetooth-fix-invalid-bdaddr-quirk-for-non-persisten.patch
+bluetooth-fix-use-bdaddr-property-quirk.patch
+bluetooth-hci_bcm-do-not-mark-valid-bd_addr-as-inval.patch
+bluetooth-iso-use-hci_sync-for-setting-cig-parameter.patch
+bluetooth-mgmt-add-cis-feature-bits-to-controller-in.patch
+bluetooth-mgmt-use-bit-macro-when-defining-bitfields.patch
+bluetooth-mgmt-fix-marking-scan_rsp-as-not-connectab.patch
+ibmvnic-do-not-reset-dql-stats-on-non_fatal-err.patch
+net-dsa-vsc73xx-fix-mtu-configuration.patch
+mlxsw-minimal-fix-potential-memory-leak-in-mlxsw_m_l.patch
+spi-bcm-qspi-return-error-if-neither-hif_mspi-nor-ms.patch
+drm-amdgpu-fix-number-of-fence-calculations.patch
+drm-amd-don-t-try-to-enable-secure-display-ta-multip.patch
+mailbox-ti-msgmgr-fill-non-message-tx-data-fields-wi.patch
+f2fs-fix-error-path-handling-in-truncate_dnode.patch
+octeontx2-af-fix-mapping-for-nix-block-from-cgx-conn.patch
+octeontx2-af-add-validation-before-accessing-cgx-and.patch
+ntfs-fix-panic-about-slab-out-of-bounds-caused-by-nt.patch
+powerpc-allow-ppc_early_debug_cpm-only-when-serial_c.patch
+powerpc-dts-turris1x.dts-fix-pcie-mem-size-for-pci2-.patch
+net-bridge-keep-ports-without-iff_unicast_flt-in-br_.patch
+net-dsa-tag_sja1105-fix-source-port-decoding-in-vlan.patch
+net-fix-net_dev_start_xmit-trace-event-vs-skb_transp.patch
+tcp-annotate-data-races-in-__tcp_oow_rate_limited.patch
+bpf-btf-warn-but-return-no-error-for-null-btf-from-_.patch
+xsk-honor-so_bindtodevice-on-bind.patch
+net-sched-act_pedit-add-size-check-for-tca_pedit_par.patch
+fanotify-disallow-mount-sb-marks-on-kernel-internal-.patch
+riscv-move-memblock_allow_resize-after-linear-mappin.patch
+pptp-fix-fib-lookup-calls.patch
+net-dsa-tag_sja1105-fix-mac-da-patching-from-meta-fr.patch
+net-dsa-sja1105-always-enable-the-send_meta-options.patch
+octeontx-af-fix-hardware-timestamp-configuration.patch
+afs-fix-accidental-truncation-when-storing-data.patch
+s390-qeth-fix-vipa-deletion.patch
+sh-dma-fix-dma-channel-offset-calculation.patch
+apparmor-fix-missing-error-check-for-rhashtable_inse.patch
+i2c-xiic-don-t-try-to-handle-more-interrupt-events-a.patch
--- /dev/null
+From 942e6a9b8a7e10d690c9f0f52581b7e3f05e1722 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Jun 2023 23:22:17 +0300
+Subject: sh: Avoid using IRQ0 on SH3 and SH4
+
+From: Sergey Shtylyov <s.shtylyov@omp.ru>
+
+[ Upstream commit a8ac2961148e8c720dc760f2e06627cd5c55a154 ]
+
+IRQ0 is no longer returned by platform_get_irq() and its ilk -- they now
+return -EINVAL instead. However, the kernel code supporting SH3/4-based
+SoCs still maps the IRQ #s starting at 0 -- modify that code to start the
+IRQ #s from 16 instead.
+
+The patch should mostly affect the AP-SH4A-3A/AP-SH4AD-0A boards as they
+indeed are using IRQ0 for the SMSC911x compatible Ethernet chip.
+
+Fixes: ce753ad1549c ("platform: finally disallow IRQ0 in platform_get_irq() and its ilk")
+Signed-off-by: Sergey Shtylyov <s.shtylyov@omp.ru>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
+Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
+Link: https://lore.kernel.org/r/71105dbf-cdb0-72e1-f9eb-eeda8e321696@omp.ru
+Signed-off-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sh/include/mach-common/mach/highlander.h | 2 +-
+ arch/sh/include/mach-common/mach/r2d.h | 2 +-
+ arch/sh/include/mach-dreamcast/mach/sysasic.h | 2 +-
+ arch/sh/include/mach-se/mach/se7724.h | 2 +-
+ arch/sh/kernel/cpu/sh3/entry.S | 4 ++--
+ include/linux/sh_intc.h | 6 +++---
+ 6 files changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/arch/sh/include/mach-common/mach/highlander.h b/arch/sh/include/mach-common/mach/highlander.h
+index fb44c299d0337..b12c795584225 100644
+--- a/arch/sh/include/mach-common/mach/highlander.h
++++ b/arch/sh/include/mach-common/mach/highlander.h
+@@ -176,7 +176,7 @@
+ #define IVDR_CK_ON 4 /* iVDR Clock ON */
+ #endif
+
+-#define HL_FPGA_IRQ_BASE 200
++#define HL_FPGA_IRQ_BASE (200 + 16)
+ #define HL_NR_IRL 15
+
+ #define IRQ_AX88796 (HL_FPGA_IRQ_BASE + 0)
+diff --git a/arch/sh/include/mach-common/mach/r2d.h b/arch/sh/include/mach-common/mach/r2d.h
+index 0d7e483c7d3f5..69bc1907c5637 100644
+--- a/arch/sh/include/mach-common/mach/r2d.h
++++ b/arch/sh/include/mach-common/mach/r2d.h
+@@ -47,7 +47,7 @@
+
+ #define IRLCNTR1 (PA_BCR + 0) /* Interrupt Control Register1 */
+
+-#define R2D_FPGA_IRQ_BASE 100
++#define R2D_FPGA_IRQ_BASE (100 + 16)
+
+ #define IRQ_VOYAGER (R2D_FPGA_IRQ_BASE + 0)
+ #define IRQ_EXT (R2D_FPGA_IRQ_BASE + 1)
+diff --git a/arch/sh/include/mach-dreamcast/mach/sysasic.h b/arch/sh/include/mach-dreamcast/mach/sysasic.h
+index ed69ce7f20301..3b27be9a527ea 100644
+--- a/arch/sh/include/mach-dreamcast/mach/sysasic.h
++++ b/arch/sh/include/mach-dreamcast/mach/sysasic.h
+@@ -22,7 +22,7 @@
+ takes.
+ */
+
+-#define HW_EVENT_IRQ_BASE 48
++#define HW_EVENT_IRQ_BASE (48 + 16)
+
+ /* IRQ 13 */
+ #define HW_EVENT_VSYNC (HW_EVENT_IRQ_BASE + 5) /* VSync */
+diff --git a/arch/sh/include/mach-se/mach/se7724.h b/arch/sh/include/mach-se/mach/se7724.h
+index 1fe28820dfa95..ea6c46633b337 100644
+--- a/arch/sh/include/mach-se/mach/se7724.h
++++ b/arch/sh/include/mach-se/mach/se7724.h
+@@ -37,7 +37,7 @@
+ #define IRQ2_IRQ evt2irq(0x640)
+
+ /* Bits in IRQ012 registers */
+-#define SE7724_FPGA_IRQ_BASE 220
++#define SE7724_FPGA_IRQ_BASE (220 + 16)
+
+ /* IRQ0 */
+ #define IRQ0_BASE SE7724_FPGA_IRQ_BASE
+diff --git a/arch/sh/kernel/cpu/sh3/entry.S b/arch/sh/kernel/cpu/sh3/entry.S
+index e48b3dd996f58..b1f5b3c58a018 100644
+--- a/arch/sh/kernel/cpu/sh3/entry.S
++++ b/arch/sh/kernel/cpu/sh3/entry.S
+@@ -470,9 +470,9 @@ ENTRY(handle_interrupt)
+ mov r4, r0 ! save vector->jmp table offset for later
+
+ shlr2 r4 ! vector to IRQ# conversion
+- add #-0x10, r4
+
+- cmp/pz r4 ! is it a valid IRQ?
++ mov #0x10, r5
++ cmp/hs r5, r4 ! is it a valid IRQ?
+ bt 10f
+
+ /*
+diff --git a/include/linux/sh_intc.h b/include/linux/sh_intc.h
+index 37ad81058d6ae..27ae79191bdc3 100644
+--- a/include/linux/sh_intc.h
++++ b/include/linux/sh_intc.h
+@@ -13,9 +13,9 @@
+ /*
+ * Convert back and forth between INTEVT and IRQ values.
+ */
+-#ifdef CONFIG_CPU_HAS_INTEVT
+-#define evt2irq(evt) (((evt) >> 5) - 16)
+-#define irq2evt(irq) (((irq) + 16) << 5)
++#ifdef CONFIG_CPU_HAS_INTEVT /* Avoid IRQ0 (invalid for platform devices) */
++#define evt2irq(evt) ((evt) >> 5)
++#define irq2evt(irq) ((irq) << 5)
+ #else
+ #define evt2irq(evt) (evt)
+ #define irq2evt(irq) (irq)
+--
+2.39.2
+
--- /dev/null
+From d91d2339a31ce27a04eee7949a120c269d62ebb2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 27 May 2023 18:44:50 +0200
+Subject: sh: dma: Fix DMA channel offset calculation
+
+From: Artur Rojek <contact@artur-rojek.eu>
+
+[ Upstream commit e82e47584847129a20b8c9f4a1dcde09374fb0e0 ]
+
+Various SoCs of the SH3, SH4 and SH4A family, which use this driver,
+feature a differing number of DMA channels, which can be distributed
+between up to two DMAC modules. The existing implementation fails to
+correctly accommodate for all those variations, resulting in wrong
+channel offset calculations and leading to kernel panics.
+
+Rewrite dma_base_addr() in order to properly calculate channel offsets
+in a DMAC module. Fix dmaor_read_reg() and dmaor_write_reg(), so that
+the correct DMAC module base is selected for the DMAOR register.
+
+Fixes: 7f47c7189b3e8f19 ("sh: dma: More legacy cpu dma chainsawing.")
+Signed-off-by: Artur Rojek <contact@artur-rojek.eu>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
+Link: https://lore.kernel.org/r/20230527164452.64797-2-contact@artur-rojek.eu
+Signed-off-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sh/drivers/dma/dma-sh.c | 37 +++++++++++++++++++++++-------------
+ 1 file changed, 24 insertions(+), 13 deletions(-)
+
+diff --git a/arch/sh/drivers/dma/dma-sh.c b/arch/sh/drivers/dma/dma-sh.c
+index 96c626c2cd0a4..306fba1564e5e 100644
+--- a/arch/sh/drivers/dma/dma-sh.c
++++ b/arch/sh/drivers/dma/dma-sh.c
+@@ -18,6 +18,18 @@
+ #include <cpu/dma-register.h>
+ #include <cpu/dma.h>
+
++/*
++ * Some of the SoCs feature two DMAC modules. In such a case, the channels are
++ * distributed equally among them.
++ */
++#ifdef SH_DMAC_BASE1
++#define SH_DMAC_NR_MD_CH (CONFIG_NR_ONCHIP_DMA_CHANNELS / 2)
++#else
++#define SH_DMAC_NR_MD_CH CONFIG_NR_ONCHIP_DMA_CHANNELS
++#endif
++
++#define SH_DMAC_CH_SZ 0x10
++
+ /*
+ * Define the default configuration for dual address memory-memory transfer.
+ * The 0x400 value represents auto-request, external->external.
+@@ -29,7 +41,7 @@ static unsigned long dma_find_base(unsigned int chan)
+ unsigned long base = SH_DMAC_BASE0;
+
+ #ifdef SH_DMAC_BASE1
+- if (chan >= 6)
++ if (chan >= SH_DMAC_NR_MD_CH)
+ base = SH_DMAC_BASE1;
+ #endif
+
+@@ -40,13 +52,13 @@ static unsigned long dma_base_addr(unsigned int chan)
+ {
+ unsigned long base = dma_find_base(chan);
+
+- /* Normalize offset calculation */
+- if (chan >= 9)
+- chan -= 6;
+- if (chan >= 4)
+- base += 0x10;
++ chan = (chan % SH_DMAC_NR_MD_CH) * SH_DMAC_CH_SZ;
++
++ /* DMAOR is placed inside the channel register space. Step over it. */
++ if (chan >= DMAOR)
++ base += SH_DMAC_CH_SZ;
+
+- return base + (chan * 0x10);
++ return base + chan;
+ }
+
+ #ifdef CONFIG_SH_DMA_IRQ_MULTI
+@@ -250,12 +262,11 @@ static int sh_dmac_get_dma_residue(struct dma_channel *chan)
+ #define NR_DMAOR 1
+ #endif
+
+-/*
+- * DMAOR bases are broken out amongst channel groups. DMAOR0 manages
+- * channels 0 - 5, DMAOR1 6 - 11 (optional).
+- */
+-#define dmaor_read_reg(n) __raw_readw(dma_find_base((n)*6))
+-#define dmaor_write_reg(n, data) __raw_writew(data, dma_find_base(n)*6)
++#define dmaor_read_reg(n) __raw_readw(dma_find_base((n) * \
++ SH_DMAC_NR_MD_CH) + DMAOR)
++#define dmaor_write_reg(n, data) __raw_writew(data, \
++ dma_find_base((n) * \
++ SH_DMAC_NR_MD_CH) + DMAOR)
+
+ static inline int dmaor_reset(int no)
+ {
+--
+2.39.2
+
--- /dev/null
+From 082b97bba219dbc47b04cd000b457814318f117d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 May 2023 14:57:41 +0200
+Subject: sh: j2: Use ioremap() to translate device tree address into kernel
+ memory
+
+From: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
+
+[ Upstream commit bc9d1f0cecd2407cfb2364a7d4be2f52d1d46a9d ]
+
+Addresses the following warning when building j2_defconfig:
+
+arch/sh/kernel/cpu/sh2/probe.c: In function 'scan_cache':
+arch/sh/kernel/cpu/sh2/probe.c:24:16: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast]
+ 24 | j2_ccr_base = (u32 __iomem *)of_flat_dt_translate_address(node);
+ |
+
+Fixes: 5a846abad07f ("sh: add support for J-Core J2 processor")
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Tested-by: Rob Landley <rob@landley.net>
+Signed-off-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
+Link: https://lore.kernel.org/r/20230503125746.331835-1-glaubitz@physik.fu-berlin.de
+Signed-off-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sh/kernel/cpu/sh2/probe.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/sh/kernel/cpu/sh2/probe.c b/arch/sh/kernel/cpu/sh2/probe.c
+index d342ea08843f6..70a07f4f2142f 100644
+--- a/arch/sh/kernel/cpu/sh2/probe.c
++++ b/arch/sh/kernel/cpu/sh2/probe.c
+@@ -21,7 +21,7 @@ static int __init scan_cache(unsigned long node, const char *uname,
+ if (!of_flat_dt_is_compatible(node, "jcore,cache"))
+ return 0;
+
+- j2_ccr_base = (u32 __iomem *)of_flat_dt_translate_address(node);
++ j2_ccr_base = ioremap(of_flat_dt_translate_address(node), 4);
+
+ return 1;
+ }
+--
+2.39.2
+
--- /dev/null
+From cddcf5a54c8646d829b0b8b0c5b8d1df4aa7c9d1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Jun 2023 15:43:05 +0200
+Subject: spi: bcm-qspi: return error if neither hif_mspi nor mspi is available
+
+From: Jonas Gorski <jonas.gorski@gmail.com>
+
+[ Upstream commit 7c1f23ad34fcdace50275a6aa1e1969b41c6233f ]
+
+If neither a "hif_mspi" nor "mspi" resource is present, the driver will
+just early exit in probe but still return success. Apart from not doing
+anything meaningful, this would then also lead to a null pointer access
+on removal, as platform_get_drvdata() would return NULL, which it would
+then try to dereference when trying to unregister the spi master.
+
+Fix this by unconditionally calling devm_ioremap_resource(), as it can
+handle a NULL res and will then return a viable ERR_PTR() if we get one.
+
+The "return 0;" was previously a "goto qspi_resource_err;" where then
+ret was returned, but since ret was still initialized to 0 at this place
+this was a valid conversion in 63c5395bb7a9 ("spi: bcm-qspi: Fix
+use-after-free on unbind"). The issue was not introduced by this commit,
+only made more obvious.
+
+Fixes: fa236a7ef240 ("spi: bcm-qspi: Add Broadcom MSPI driver")
+Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
+Reviewed-by: Kamal Dasu <kamal.dasu@broadcom.com>
+Link: https://lore.kernel.org/r/20230629134306.95823-1-jonas.gorski@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-bcm-qspi.c | 10 +++-------
+ 1 file changed, 3 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/spi/spi-bcm-qspi.c b/drivers/spi/spi-bcm-qspi.c
+index cad2d55dcd3d2..137e7315a3cfd 100644
+--- a/drivers/spi/spi-bcm-qspi.c
++++ b/drivers/spi/spi-bcm-qspi.c
+@@ -1543,13 +1543,9 @@ int bcm_qspi_probe(struct platform_device *pdev,
+ res = platform_get_resource_byname(pdev, IORESOURCE_MEM,
+ "mspi");
+
+- if (res) {
+- qspi->base[MSPI] = devm_ioremap_resource(dev, res);
+- if (IS_ERR(qspi->base[MSPI]))
+- return PTR_ERR(qspi->base[MSPI]);
+- } else {
+- return 0;
+- }
++ qspi->base[MSPI] = devm_ioremap_resource(dev, res);
++ if (IS_ERR(qspi->base[MSPI]))
++ return PTR_ERR(qspi->base[MSPI]);
+
+ res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "bspi");
+ if (res) {
+--
+2.39.2
+
--- /dev/null
+From a34e8b4af656c1ef0f446df8f2022ee4607b0f17 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Jun 2023 12:58:47 +0300
+Subject: spi: spi-geni-qcom: enable SPI_CONTROLLER_MUST_TX for GPI DMA mode
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit d10005837be83906bbd2078c3b4f9dfcbd6c95b6 ]
+
+The GPI DMA mode requires for TX DMA to be prepared. Force SPI core to
+provide TX buffer even if the caller didn't provide one by setting the
+SPI_CONTROLLER_MUST_TX flag.
+
+Fixes: b59c122484ec ("spi: spi-geni-qcom: Add support for GPI dma")
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/20230629095847.3648597-1-dmitry.baryshkov@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-geni-qcom.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/spi/spi-geni-qcom.c b/drivers/spi/spi-geni-qcom.c
+index 689b94fc5570a..7b76dcd11e2bb 100644
+--- a/drivers/spi/spi-geni-qcom.c
++++ b/drivers/spi/spi-geni-qcom.c
+@@ -979,6 +979,12 @@ static int spi_geni_probe(struct platform_device *pdev)
+ if (mas->cur_xfer_mode == GENI_SE_FIFO)
+ spi->set_cs = spi_geni_set_cs;
+
++ /*
++ * TX is required per GSI spec, see setup_gsi_xfer().
++ */
++ if (mas->cur_xfer_mode == GENI_GPI_DMA)
++ spi->flags = SPI_CONTROLLER_MUST_TX;
++
+ ret = request_irq(mas->irq, geni_spi_isr, 0, dev_name(dev), spi);
+ if (ret)
+ goto spi_geni_release_dma;
+--
+2.39.2
+
--- /dev/null
+From 25fd438a0099692a9797a6c0b3d11db5c6a0931a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 May 2023 22:25:55 +0200
+Subject: staging: vchiq_arm: mark vchiq_platform_init() static
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit e152c58d7a48194d6b530d8e004d650fd01568b6 ]
+
+This function has no callers from other files, and the declaration
+was removed a while ago, causing a W=1 warning:
+
+drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:465:5: error: no previous prototype for 'vchiq_platform_init'
+
+Marking it static solves this problem but introduces a new warning
+since gcc determines that 'g_fragments_base' is never initialized
+in some kernel configurations:
+
+In file included from include/linux/string.h:254,
+ from include/linux/bitmap.h:11,
+ from include/linux/cpumask.h:12,
+ from include/linux/mm_types_task.h:14,
+ from include/linux/mm_types.h:5,
+ from include/linux/buildid.h:5,
+ from include/linux/module.h:14,
+ from drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:8:
+In function 'memcpy_to_page',
+ inlined from 'free_pagelist' at drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:433:4:
+include/linux/fortify-string.h:57:33: error: argument 2 null where non-null expected [-Werror=nonnull]
+include/linux/highmem.h:427:9: note: in expansion of macro 'memcpy'
+ 427 | memcpy(to + offset, from, len);
+ | ^~~~~~
+
+Add a NULL pointer check for this in addition to the static annotation
+to avoid both.
+
+Fixes: 89cc4218f640 ("staging: vchiq_arm: drop unnecessary declarations")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
+Reviewed-by: Umang Jain <umang.jain@ideasonboard.com>
+Link: https://lore.kernel.org/r/20230516202603.560554-1-arnd@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
+index dc33490ba7fbb..705c5e283c27b 100644
+--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
++++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
+@@ -415,7 +415,7 @@ free_pagelist(struct vchiq_instance *instance, struct vchiq_pagelist_info *pagel
+ pagelistinfo->scatterlist_mapped = 0;
+
+ /* Deal with any partial cache lines (fragments) */
+- if (pagelist->type >= PAGELIST_READ_WITH_FRAGMENTS) {
++ if (pagelist->type >= PAGELIST_READ_WITH_FRAGMENTS && g_fragments_base) {
+ char *fragments = g_fragments_base +
+ (pagelist->type - PAGELIST_READ_WITH_FRAGMENTS) *
+ g_fragments_size;
+@@ -462,7 +462,7 @@ free_pagelist(struct vchiq_instance *instance, struct vchiq_pagelist_info *pagel
+ cleanup_pagelistinfo(instance, pagelistinfo);
+ }
+
+-int vchiq_platform_init(struct platform_device *pdev, struct vchiq_state *state)
++static int vchiq_platform_init(struct platform_device *pdev, struct vchiq_state *state)
+ {
+ struct device *dev = &pdev->dev;
+ struct vchiq_drvdata *drvdata = platform_get_drvdata(pdev);
+--
+2.39.2
+
--- /dev/null
+From 38819409e4797edb36f4cc22d901d1da1da2b25f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Jun 2023 16:41:50 +0000
+Subject: tcp: annotate data races in __tcp_oow_rate_limited()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 998127cdb4699b9d470a9348ffe9f1154346be5f ]
+
+request sockets are lockless, __tcp_oow_rate_limited() could be called
+on the same object from different cpus. This is harmless.
+
+Add READ_ONCE()/WRITE_ONCE() annotations to avoid a KCSAN report.
+
+Fixes: 4ce7e93cb3fe ("tcp: rate limit ACK sent by SYN_RECV request sockets")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/tcp_input.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index 5dabb38b857ff..e2d3ea2e34561 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -3590,8 +3590,11 @@ static int tcp_ack_update_window(struct sock *sk, const struct sk_buff *skb, u32
+ static bool __tcp_oow_rate_limited(struct net *net, int mib_idx,
+ u32 *last_oow_ack_time)
+ {
+- if (*last_oow_ack_time) {
+- s32 elapsed = (s32)(tcp_jiffies32 - *last_oow_ack_time);
++ /* Paired with the WRITE_ONCE() in this function. */
++ u32 val = READ_ONCE(*last_oow_ack_time);
++
++ if (val) {
++ s32 elapsed = (s32)(tcp_jiffies32 - val);
+
+ if (0 <= elapsed &&
+ elapsed < READ_ONCE(net->ipv4.sysctl_tcp_invalid_ratelimit)) {
+@@ -3600,7 +3603,10 @@ static bool __tcp_oow_rate_limited(struct net *net, int mib_idx,
+ }
+ }
+
+- *last_oow_ack_time = tcp_jiffies32;
++ /* Paired with the prior READ_ONCE() and with itself,
++ * as we might be lockless.
++ */
++ WRITE_ONCE(*last_oow_ack_time, tcp_jiffies32);
+
+ return false; /* not rate-limited: go ahead, send dupack now! */
+ }
+--
+2.39.2
+
--- /dev/null
+From 1ebf4c3675857e8c0d4ad3ee483de95d9977f07f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 May 2023 20:11:14 +0530
+Subject: usb: common: usb-conn-gpio: Set last role to unknown before initial
+ detection
+
+From: Prashanth K <quic_prashk@quicinc.com>
+
+[ Upstream commit edd60d24bd858cef165274e4cd6cab43bdc58d15 ]
+
+Currently if we bootup a device without cable connected, then
+usb-conn-gpio won't call set_role() since last_role is same as
+current role. This happens because during probe last_role gets
+initialised to zero.
+
+To avoid this, added a new constant in enum usb_role, last_role
+is set to USB_ROLE_UNKNOWN before performing initial detection.
+
+While at it, also handle default case for the usb_role switch
+in cdns3, intel-xhci-usb-role-switch & musb/jz4740 to avoid
+build warnings.
+
+Fixes: 4602f3bff266 ("usb: common: add USB GPIO based connection detection driver")
+Signed-off-by: Prashanth K <quic_prashk@quicinc.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Message-ID: <1685544074-17337-1-git-send-email-quic_prashk@quicinc.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/cdns3/core.c | 2 ++
+ drivers/usb/common/usb-conn-gpio.c | 3 +++
+ drivers/usb/musb/jz4740.c | 2 ++
+ drivers/usb/roles/intel-xhci-usb-role-switch.c | 2 ++
+ include/linux/usb/role.h | 1 +
+ 5 files changed, 10 insertions(+)
+
+diff --git a/drivers/usb/cdns3/core.c b/drivers/usb/cdns3/core.c
+index dbcdf3b24b477..69d2921f2d3b5 100644
+--- a/drivers/usb/cdns3/core.c
++++ b/drivers/usb/cdns3/core.c
+@@ -252,6 +252,8 @@ static enum usb_role cdns_hw_role_state_machine(struct cdns *cdns)
+ if (!vbus)
+ role = USB_ROLE_NONE;
+ break;
++ default:
++ break;
+ }
+
+ dev_dbg(cdns->dev, "role %d -> %d\n", cdns->role, role);
+diff --git a/drivers/usb/common/usb-conn-gpio.c b/drivers/usb/common/usb-conn-gpio.c
+index e20874caba363..30bdb81934bc8 100644
+--- a/drivers/usb/common/usb-conn-gpio.c
++++ b/drivers/usb/common/usb-conn-gpio.c
+@@ -257,6 +257,9 @@ static int usb_conn_probe(struct platform_device *pdev)
+ platform_set_drvdata(pdev, info);
+ device_set_wakeup_capable(&pdev->dev, true);
+
++ /* Set last role to unknown before performing the initial detection */
++ info->last_role = USB_ROLE_UNKNOWN;
++
+ /* Perform initial detection */
+ usb_conn_queue_dwork(info, 0);
+
+diff --git a/drivers/usb/musb/jz4740.c b/drivers/usb/musb/jz4740.c
+index d1e4e0deb7535..df4e9d397d986 100644
+--- a/drivers/usb/musb/jz4740.c
++++ b/drivers/usb/musb/jz4740.c
+@@ -91,6 +91,8 @@ static int jz4740_musb_role_switch_set(struct usb_role_switch *sw,
+ case USB_ROLE_HOST:
+ atomic_notifier_call_chain(&phy->notifier, USB_EVENT_ID, phy);
+ break;
++ default:
++ break;
+ }
+
+ return 0;
+diff --git a/drivers/usb/roles/intel-xhci-usb-role-switch.c b/drivers/usb/roles/intel-xhci-usb-role-switch.c
+index 5c96e929acea0..4d6a3dd06e011 100644
+--- a/drivers/usb/roles/intel-xhci-usb-role-switch.c
++++ b/drivers/usb/roles/intel-xhci-usb-role-switch.c
+@@ -97,6 +97,8 @@ static int intel_xhci_usb_set_role(struct usb_role_switch *sw,
+ val |= SW_VBUS_VALID;
+ drd_config = DRD_CONFIG_STATIC_DEVICE;
+ break;
++ default:
++ break;
+ }
+ val |= SW_IDPIN_EN;
+ if (data->enable_sw_switch) {
+diff --git a/include/linux/usb/role.h b/include/linux/usb/role.h
+index b5deafd91f67b..65e790a28913e 100644
+--- a/include/linux/usb/role.h
++++ b/include/linux/usb/role.h
+@@ -11,6 +11,7 @@ enum usb_role {
+ USB_ROLE_NONE,
+ USB_ROLE_HOST,
+ USB_ROLE_DEVICE,
++ USB_ROLE_UNKNOWN,
+ };
+
+ typedef int (*usb_role_switch_set_t)(struct usb_role_switch *sw,
+--
+2.39.2
+
--- /dev/null
+From ecff4db2d131eaf3dc7c553ce1a0b45dbdd75fe5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 May 2023 19:15:08 +0200
+Subject: usb: dwc2: Fix some error handling paths
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit ada050c69108bc34be13ecc11f7fad0f20ebadc4 ]
+
+dwc2_driver_probe() calls dwc2_lowlevel_hw_init() which deassert some reset
+lines.
+Should an error happen in dwc2_lowlevel_hw_init() after calling
+reset_control_deassert() or in the probe after calling
+dwc2_lowlevel_hw_init(), the reset lines remain deasserted.
+
+Add some devm_add_action_or_reset() calls to re-assert the lines if needed.
+
+Update the remove function accordingly.
+
+This change is compile-tested only.
+
+Fixes: 83f8da562f8b ("usb: dwc2: Add reset control to dwc2")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Link: https://lore.kernel.org/r/c64537b5339342bd00f7c2152b8fc23792b9f95a.1683306479.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc2/platform.c | 16 +++++++++++++---
+ 1 file changed, 13 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/usb/dwc2/platform.c b/drivers/usb/dwc2/platform.c
+index d1589ba7d322d..58f53faab340f 100644
+--- a/drivers/usb/dwc2/platform.c
++++ b/drivers/usb/dwc2/platform.c
+@@ -175,6 +175,11 @@ int dwc2_lowlevel_hw_disable(struct dwc2_hsotg *hsotg)
+ return ret;
+ }
+
++static void dwc2_reset_control_assert(void *data)
++{
++ reset_control_assert(data);
++}
++
+ static int dwc2_lowlevel_hw_init(struct dwc2_hsotg *hsotg)
+ {
+ int i, ret;
+@@ -185,6 +190,10 @@ static int dwc2_lowlevel_hw_init(struct dwc2_hsotg *hsotg)
+ "error getting reset control\n");
+
+ reset_control_deassert(hsotg->reset);
++ ret = devm_add_action_or_reset(hsotg->dev, dwc2_reset_control_assert,
++ hsotg->reset);
++ if (ret)
++ return ret;
+
+ hsotg->reset_ecc = devm_reset_control_get_optional(hsotg->dev, "dwc2-ecc");
+ if (IS_ERR(hsotg->reset_ecc))
+@@ -192,6 +201,10 @@ static int dwc2_lowlevel_hw_init(struct dwc2_hsotg *hsotg)
+ "error getting reset control for ecc\n");
+
+ reset_control_deassert(hsotg->reset_ecc);
++ ret = devm_add_action_or_reset(hsotg->dev, dwc2_reset_control_assert,
++ hsotg->reset_ecc);
++ if (ret)
++ return ret;
+
+ /*
+ * Attempt to find a generic PHY, then look for an old style
+@@ -306,9 +319,6 @@ static int dwc2_driver_remove(struct platform_device *dev)
+ if (hsotg->ll_hw_enabled)
+ dwc2_lowlevel_hw_disable(hsotg);
+
+- reset_control_assert(hsotg->reset);
+- reset_control_assert(hsotg->reset_ecc);
+-
+ return 0;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From b436bd52a3e8dd51370e8220dc1aac03fe21e7ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Oct 2022 21:59:14 +0200
+Subject: usb: dwc2: platform: Improve error reporting for problems during
+ .remove()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit 55f223b8b408cbfd85fb1c5b74ab85ccab319a69 ]
+
+Returning an error value in a platform driver's remove callback results in
+a generic error message being emitted by the driver core, but otherwise it
+doesn't make a difference. The device goes away anyhow.
+
+For each case where ret is non-zero the driver already emits an error
+message, so suppress the generic error message by returning zero
+unconditionally. (Side note: The return value handling was unreliable
+anyhow as the value returned by dwc2_exit_hibernation() was overwritten
+anyhow if hsotg->in_ppd was non-zero.)
+
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Acked-by: Minas Harutyunyan <hminas@synopsys.com>
+Link: https://lore.kernel.org/r/20221017195914.1426297-1-u.kleine-koenig@pengutronix.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Stable-dep-of: ada050c69108 ("usb: dwc2: Fix some error handling paths")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc2/platform.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/dwc2/platform.c b/drivers/usb/dwc2/platform.c
+index 0c02ef7628fd5..d1589ba7d322d 100644
+--- a/drivers/usb/dwc2/platform.c
++++ b/drivers/usb/dwc2/platform.c
+@@ -309,7 +309,7 @@ static int dwc2_driver_remove(struct platform_device *dev)
+ reset_control_assert(hsotg->reset);
+ reset_control_assert(hsotg->reset_ecc);
+
+- return ret;
++ return 0;
+ }
+
+ /**
+--
+2.39.2
+
--- /dev/null
+From 00c0446807133abc8463ab85358afc915b137993 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Jun 2023 15:32:52 +0200
+Subject: usb: dwc3-meson-g12a: Fix an error handling path in
+ dwc3_meson_g12a_probe()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 01052b91c9808e3c3b068ae2721cb728ec9aa4c0 ]
+
+If dwc3_meson_g12a_otg_init() fails, resources allocated by the previous
+of_platform_populate() call should be released, as already done in the
+error handling path.
+
+Fixes: 1e355f21d3fb ("usb: dwc3: Add Amlogic A1 DWC3 glue")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Message-ID: <9d28466de1808ccc756b4cc25fc72c482d133d13.1686403934.git.christophe.jaillet@wanadoo.fr>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc3/dwc3-meson-g12a.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/dwc3/dwc3-meson-g12a.c b/drivers/usb/dwc3/dwc3-meson-g12a.c
+index b282ad0e69c6d..eaea944ebd2ce 100644
+--- a/drivers/usb/dwc3/dwc3-meson-g12a.c
++++ b/drivers/usb/dwc3/dwc3-meson-g12a.c
+@@ -805,7 +805,7 @@ static int dwc3_meson_g12a_probe(struct platform_device *pdev)
+
+ ret = dwc3_meson_g12a_otg_init(pdev, priv);
+ if (ret)
+- goto err_phys_power;
++ goto err_plat_depopulate;
+
+ pm_runtime_set_active(dev);
+ pm_runtime_enable(dev);
+@@ -813,6 +813,9 @@ static int dwc3_meson_g12a_probe(struct platform_device *pdev)
+
+ return 0;
+
++err_plat_depopulate:
++ of_platform_depopulate(dev);
++
+ err_phys_power:
+ for (i = 0 ; i < PHY_COUNT ; ++i)
+ phy_power_off(priv->phys[i]);
+--
+2.39.2
+
--- /dev/null
+From 1490e9660ce585944493526670adc5d3573cc524 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 4 Jun 2023 16:56:34 +0200
+Subject: usb: dwc3: qcom: Fix an error handling path in dwc3_qcom_probe()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 4a944da707123686d372ec01ea60056902fadf35 ]
+
+If dwc3_qcom_create_urs_usb_platdev() fails, some resources still need to
+be released, as already done in the other error handling path of the
+probe.
+
+Fixes: c25c210f590e ("usb: dwc3: qcom: add URS Host support for sdm845 ACPI boot")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Reviewed-by: Andrew Halaney <ahalaney@redhat.com>
+Message-ID: <b69fa8dd68d816e7d24c88d3eda776ceb28c5dc5.1685890571.git.christophe.jaillet@wanadoo.fr>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc3/dwc3-qcom.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/dwc3/dwc3-qcom.c b/drivers/usb/dwc3/dwc3-qcom.c
+index 9c01e963ae467..72c22851d7eef 100644
+--- a/drivers/usb/dwc3/dwc3-qcom.c
++++ b/drivers/usb/dwc3/dwc3-qcom.c
+@@ -865,9 +865,10 @@ static int dwc3_qcom_probe(struct platform_device *pdev)
+ if (IS_ERR_OR_NULL(qcom->urs_usb)) {
+ dev_err(dev, "failed to create URS USB platdev\n");
+ if (!qcom->urs_usb)
+- return -ENODEV;
++ ret = -ENODEV;
+ else
+- return PTR_ERR(qcom->urs_usb);
++ ret = PTR_ERR(qcom->urs_usb);
++ goto clk_disable;
+ }
+ }
+ }
+--
+2.39.2
+
--- /dev/null
+From 3b781c54791790583da39e9d335fe492c84b8a2f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 May 2023 20:25:18 +0300
+Subject: usb: dwc3: qcom: Fix potential memory leak
+
+From: Vladislav Efanov <VEfanov@ispras.ru>
+
+[ Upstream commit 097fb3ee710d4de83b8d4f5589e8ee13e0f0541e ]
+
+Function dwc3_qcom_probe() allocates memory for resource structure
+which is pointed by parent_res pointer. This memory is not
+freed. This leads to memory leak. Use stack memory to prevent
+memory leak.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: 2bc02355f8ba ("usb: dwc3: qcom: Add support for booting with ACPI")
+Signed-off-by: Vladislav Efanov <VEfanov@ispras.ru>
+Acked-by: Shawn Guo <shawn.guo@linaro.org>
+Link: https://lore.kernel.org/r/20230517172518.442591-1-VEfanov@ispras.ru
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc3/dwc3-qcom.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/usb/dwc3/dwc3-qcom.c b/drivers/usb/dwc3/dwc3-qcom.c
+index 79b22abf97276..482260182d656 100644
+--- a/drivers/usb/dwc3/dwc3-qcom.c
++++ b/drivers/usb/dwc3/dwc3-qcom.c
+@@ -800,6 +800,7 @@ static int dwc3_qcom_probe(struct platform_device *pdev)
+ struct device *dev = &pdev->dev;
+ struct dwc3_qcom *qcom;
+ struct resource *res, *parent_res = NULL;
++ struct resource local_res;
+ int ret, i;
+ bool ignore_pipe_clk;
+ bool wakeup_source;
+@@ -851,9 +852,8 @@ static int dwc3_qcom_probe(struct platform_device *pdev)
+ if (np) {
+ parent_res = res;
+ } else {
+- parent_res = kmemdup(res, sizeof(struct resource), GFP_KERNEL);
+- if (!parent_res)
+- return -ENOMEM;
++ memcpy(&local_res, res, sizeof(struct resource));
++ parent_res = &local_res;
+
+ parent_res->start = res->start +
+ qcom->acpi_pdata->qscratch_base_offset;
+--
+2.39.2
+
--- /dev/null
+From 0397d10a6a496cca2fc51cae5f90608d9709161a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 4 Jun 2023 17:04:37 +0200
+Subject: usb: dwc3: qcom: Release the correct resources in dwc3_qcom_remove()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 8fd95da2cfb5046c4bb5a3cdc9eb7963ba8b10dd ]
+
+In the probe, some resources are allocated with
+dwc3_qcom_of_register_core() or dwc3_qcom_acpi_register_core(). The
+corresponding resources are already coorectly freed in the error handling
+path of the probe, but not in the remove function.
+
+Fix it.
+
+Fixes: 2bc02355f8ba ("usb: dwc3: qcom: Add support for booting with ACPI")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Reviewed-by: Andrew Halaney <ahalaney@redhat.com>
+Message-ID: <c0215a84cdf18fb3514c81842783ec53cf149deb.1685891059.git.christophe.jaillet@wanadoo.fr>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc3/dwc3-qcom.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/dwc3/dwc3-qcom.c b/drivers/usb/dwc3/dwc3-qcom.c
+index 482260182d656..9c01e963ae467 100644
+--- a/drivers/usb/dwc3/dwc3-qcom.c
++++ b/drivers/usb/dwc3/dwc3-qcom.c
+@@ -950,11 +950,15 @@ static int dwc3_qcom_probe(struct platform_device *pdev)
+ static int dwc3_qcom_remove(struct platform_device *pdev)
+ {
+ struct dwc3_qcom *qcom = platform_get_drvdata(pdev);
++ struct device_node *np = pdev->dev.of_node;
+ struct device *dev = &pdev->dev;
+ int i;
+
+ device_remove_software_node(&qcom->dwc3->dev);
+- of_platform_depopulate(dev);
++ if (np)
++ of_platform_depopulate(&pdev->dev);
++ else
++ platform_device_put(pdev);
+
+ for (i = qcom->num_clocks - 1; i >= 0; i--) {
+ clk_disable_unprepare(qcom->clks[i]);
+--
+2.39.2
+
--- /dev/null
+From 374e658b001c865b0ff620edd3cc6ec8d1883972 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 May 2023 14:48:37 +0530
+Subject: usb: gadget: u_serial: Add null pointer check in gserial_suspend
+
+From: Prashanth K <quic_prashk@quicinc.com>
+
+[ Upstream commit 2f6ecb89fe8feb2b60a53325b0eeb9866d88909a ]
+
+Consider a case where gserial_disconnect has already cleared
+gser->ioport. And if gserial_suspend gets called afterwards,
+it will lead to accessing of gser->ioport and thus causing
+null pointer dereference.
+
+Avoid this by adding a null pointer check. Added a static
+spinlock to prevent gser->ioport from becoming null after
+the newly added null pointer check.
+
+Fixes: aba3a8d01d62 ("usb: gadget: u_serial: add suspend resume callbacks")
+Signed-off-by: Prashanth K <quic_prashk@quicinc.com>
+Link: https://lore.kernel.org/r/1683278317-11774-1-git-send-email-quic_prashk@quicinc.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/function/u_serial.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/gadget/function/u_serial.c b/drivers/usb/gadget/function/u_serial.c
+index db6fd0238d4b4..ea2c5b6cde8cd 100644
+--- a/drivers/usb/gadget/function/u_serial.c
++++ b/drivers/usb/gadget/function/u_serial.c
+@@ -1419,10 +1419,19 @@ EXPORT_SYMBOL_GPL(gserial_disconnect);
+
+ void gserial_suspend(struct gserial *gser)
+ {
+- struct gs_port *port = gser->ioport;
++ struct gs_port *port;
+ unsigned long flags;
+
+- spin_lock_irqsave(&port->port_lock, flags);
++ spin_lock_irqsave(&serial_port_lock, flags);
++ port = gser->ioport;
++
++ if (!port) {
++ spin_unlock_irqrestore(&serial_port_lock, flags);
++ return;
++ }
++
++ spin_lock(&port->port_lock);
++ spin_unlock(&serial_port_lock);
+ port->suspended = true;
+ spin_unlock_irqrestore(&port->port_lock, flags);
+ }
+--
+2.39.2
+
--- /dev/null
+From 37ff4f015e5ef61a1cc3cbe6e2f3f267ed993347 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 May 2023 22:17:42 +0200
+Subject: usb: hide unused usbfs_notify_suspend/resume functions
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 8e6bd945e6dde64fbc60ec3fe252164493a8d3a2 ]
+
+The declaration is in an #ifdef, which causes warnings when building
+with 'make W=1' and without CONFIG_PM:
+
+drivers/usb/core/devio.c:742:6: error: no previous prototype for 'usbfs_notify_suspend'
+drivers/usb/core/devio.c:747:6: error: no previous prototype for 'usbfs_notify_resume'
+
+Use the same #ifdef check around the function definitions to avoid
+the warnings and slightly shrink the USB core.
+
+Fixes: 7794f486ed0b ("usbfs: Add ioctls for runtime power management")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Link: https://lore.kernel.org/r/20230516202103.558301-1-arnd@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/core/devio.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
+index 984de3f5e8eb9..4184cd65a6aac 100644
+--- a/drivers/usb/core/devio.c
++++ b/drivers/usb/core/devio.c
+@@ -747,6 +747,7 @@ static int driver_resume(struct usb_interface *intf)
+ return 0;
+ }
+
++#ifdef CONFIG_PM
+ /* The following routines apply to the entire device, not interfaces */
+ void usbfs_notify_suspend(struct usb_device *udev)
+ {
+@@ -765,6 +766,7 @@ void usbfs_notify_resume(struct usb_device *udev)
+ }
+ mutex_unlock(&usbfs_mutex);
+ }
++#endif
+
+ struct usb_driver usbfs_driver = {
+ .name = "usbfs",
+--
+2.39.2
+
--- /dev/null
+From 3afcb093d430edc8f01664d4ebb6c09c9b9369c1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 May 2023 02:47:51 +0530
+Subject: usb: misc: eud: Fix eud sysfs path (use 'qcom_eud')
+
+From: Bhupesh Sharma <bhupesh.sharma@linaro.org>
+
+[ Upstream commit f16135918b5f8b510db014ecf0a069e34c02382e ]
+
+The eud sysfs enablement path is currently mentioned in the
+Documentation as:
+ /sys/bus/platform/drivers/eud/.../enable
+
+Instead it should be:
+ /sys/bus/platform/drivers/qcom_eud/.../enable
+
+Fix the same.
+
+Fixes: 9a1bf58ccd44 ("usb: misc: eud: Add driver support for Embedded USB Debugger(EUD)")
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Acked-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Signed-off-by: Bhupesh Sharma <bhupesh.sharma@linaro.org>
+Link: https://lore.kernel.org/r/20230517211756.2483552-2-bhupesh.sharma@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/ABI/testing/sysfs-driver-eud | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Documentation/ABI/testing/sysfs-driver-eud b/Documentation/ABI/testing/sysfs-driver-eud
+index 83f3872182a40..2bab0db2d2f0f 100644
+--- a/Documentation/ABI/testing/sysfs-driver-eud
++++ b/Documentation/ABI/testing/sysfs-driver-eud
+@@ -1,4 +1,4 @@
+-What: /sys/bus/platform/drivers/eud/.../enable
++What: /sys/bus/platform/drivers/qcom_eud/.../enable
+ Date: February 2022
+ Contact: Souradeep Chowdhury <quic_schowdhu@quicinc.com>
+ Description:
+--
+2.39.2
+
--- /dev/null
+From a2452eb81700444947486d9144f3c2fced95e69b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Apr 2023 22:08:31 +0800
+Subject: usb: phy: phy-tahvo: fix memory leak in tahvo_usb_probe()
+
+From: Li Yang <lidaxian@hust.edu.cn>
+
+[ Upstream commit 342161c11403ea00e9febc16baab1d883d589d04 ]
+
+Smatch reports:
+drivers/usb/phy/phy-tahvo.c: tahvo_usb_probe()
+warn: missing unwind goto?
+
+After geting irq, if ret < 0, it will return without error handling to
+free memory.
+Just add error handling to fix this problem.
+
+Fixes: 0d45a1373e66 ("usb: phy: tahvo: add IRQ check")
+Signed-off-by: Li Yang <lidaxian@hust.edu.cn>
+Reviewed-by: Dongliang Mu <dzm91@hust.edu.cn>
+Link: https://lore.kernel.org/r/20230420140832.9110-1-lidaxian@hust.edu.cn
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/phy/phy-tahvo.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/phy/phy-tahvo.c b/drivers/usb/phy/phy-tahvo.c
+index f2d2cc586c5b7..da63d7e4d2709 100644
+--- a/drivers/usb/phy/phy-tahvo.c
++++ b/drivers/usb/phy/phy-tahvo.c
+@@ -391,7 +391,7 @@ static int tahvo_usb_probe(struct platform_device *pdev)
+
+ tu->irq = ret = platform_get_irq(pdev, 0);
+ if (ret < 0)
+- return ret;
++ goto err_remove_phy;
+ ret = request_threaded_irq(tu->irq, NULL, tahvo_usb_vbus_interrupt,
+ IRQF_ONESHOT,
+ "tahvo-vbus", tu);
+--
+2.39.2
+
--- /dev/null
+From 27faf4b2fd52fc92cc81be6ee0bfd67889badf0a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 May 2021 17:17:45 +0300
+Subject: w1: fix loop in w1_fini()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 83f3fcf96fcc7e5405b37d9424c7ef26bfa203f8 ]
+
+The __w1_remove_master_device() function calls:
+
+ list_del(&dev->w1_master_entry);
+
+So presumably this can cause an endless loop.
+
+Fixes: 7785925dd8e0 ("[PATCH] w1: cleanups.")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/w1/w1.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/w1/w1.c b/drivers/w1/w1.c
+index 4a2ddf730a3ac..2eee26b7fc4a3 100644
+--- a/drivers/w1/w1.c
++++ b/drivers/w1/w1.c
+@@ -1263,10 +1263,10 @@ static int __init w1_init(void)
+
+ static void __exit w1_fini(void)
+ {
+- struct w1_master *dev;
++ struct w1_master *dev, *n;
+
+ /* Set netlink removal messages and some cleanup */
+- list_for_each_entry(dev, &w1_masters, w1_master_entry)
++ list_for_each_entry_safe(dev, n, &w1_masters, w1_master_entry)
+ __w1_remove_master_device(dev);
+
+ w1_fini_netlink();
+--
+2.39.2
+
--- /dev/null
+From 8dece5aba276fea7c4203ce98b78f4250ee7f4e8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Apr 2023 13:21:52 +0200
+Subject: w1: w1_therm: fix locking behavior in convert_t
+
+From: Stefan Wahren <stefan.wahren@i2se.com>
+
+[ Upstream commit dca5480ab7b77a889088ab7cac81934604510ac7 ]
+
+The commit 67b392f7b8ed ("w1_therm: optimizing temperature read timings")
+accidentially inverted the logic for lock handling of the bus mutex.
+
+Before:
+ pullup -> release lock before sleep
+ no pullup -> release lock after sleep
+
+After:
+ pullup -> release lock after sleep
+ no pullup -> release lock before sleep
+
+This cause spurious measurements of 85 degree (powerup value) on the
+Tarragon board with connected 1-w temperature sensor
+(w1_therm.w1_strong_pull=0).
+
+In the meantime a new feature for polling the conversion
+completion has been integrated in these branches with
+commit 021da53e65fd ("w1: w1_therm: Add sysfs entries to control
+conversion time and driver features"). But this feature isn't
+available for parasite power mode, so handle this separately.
+
+Link: https://lore.kernel.org/regressions/2023042645-attentive-amends-7b0b@gregkh/T/
+Fixes: 67b392f7b8ed ("w1_therm: optimizing temperature read timings")
+Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
+Link: https://lore.kernel.org/r/20230427112152.12313-1-stefan.wahren@i2se.com
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/w1/slaves/w1_therm.c | 31 ++++++++++++++-----------------
+ 1 file changed, 14 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/w1/slaves/w1_therm.c b/drivers/w1/slaves/w1_therm.c
+index 067692626cf07..99c58bd9d2df0 100644
+--- a/drivers/w1/slaves/w1_therm.c
++++ b/drivers/w1/slaves/w1_therm.c
+@@ -1159,29 +1159,26 @@ static int convert_t(struct w1_slave *sl, struct therm_info *info)
+
+ w1_write_8(dev_master, W1_CONVERT_TEMP);
+
+- if (strong_pullup) { /*some device need pullup */
++ if (SLAVE_FEATURES(sl) & W1_THERM_POLL_COMPLETION) {
++ ret = w1_poll_completion(dev_master, W1_POLL_CONVERT_TEMP);
++ if (ret) {
++ dev_dbg(&sl->dev, "%s: Timeout\n", __func__);
++ goto mt_unlock;
++ }
++ mutex_unlock(&dev_master->bus_mutex);
++ } else if (!strong_pullup) { /*no device need pullup */
+ sleep_rem = msleep_interruptible(t_conv);
+ if (sleep_rem != 0) {
+ ret = -EINTR;
+ goto mt_unlock;
+ }
+ mutex_unlock(&dev_master->bus_mutex);
+- } else { /*no device need pullup */
+- if (SLAVE_FEATURES(sl) & W1_THERM_POLL_COMPLETION) {
+- ret = w1_poll_completion(dev_master, W1_POLL_CONVERT_TEMP);
+- if (ret) {
+- dev_dbg(&sl->dev, "%s: Timeout\n", __func__);
+- goto mt_unlock;
+- }
+- mutex_unlock(&dev_master->bus_mutex);
+- } else {
+- /* Fixed delay */
+- mutex_unlock(&dev_master->bus_mutex);
+- sleep_rem = msleep_interruptible(t_conv);
+- if (sleep_rem != 0) {
+- ret = -EINTR;
+- goto dec_refcnt;
+- }
++ } else { /*some device need pullup */
++ mutex_unlock(&dev_master->bus_mutex);
++ sleep_rem = msleep_interruptible(t_conv);
++ if (sleep_rem != 0) {
++ ret = -EINTR;
++ goto dec_refcnt;
+ }
+ }
+ ret = read_scratchpad(sl, info);
+--
+2.39.2
+
--- /dev/null
+From ce5a1e02a3139e887cb4a454e46c175e800509fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Jul 2023 19:53:29 +0200
+Subject: xsk: Honor SO_BINDTODEVICE on bind
+
+From: Ilya Maximets <i.maximets@ovn.org>
+
+[ Upstream commit f7306acec9aae9893d15e745c8791124d42ab10a ]
+
+Initial creation of an AF_XDP socket requires CAP_NET_RAW capability. A
+privileged process might create the socket and pass it to a non-privileged
+process for later use. However, that process will be able to bind the socket
+to any network interface. Even though it will not be able to receive any
+traffic without modification of the BPF map, the situation is not ideal.
+
+Sockets already have a mechanism that can be used to restrict what interface
+they can be attached to. That is SO_BINDTODEVICE.
+
+To change the SO_BINDTODEVICE binding the process will need CAP_NET_RAW.
+
+Make xsk_bind() honor the SO_BINDTODEVICE in order to allow safer workflow
+when non-privileged process is using AF_XDP.
+
+The intended workflow is following:
+
+ 1. First process creates a bare socket with socket(AF_XDP, ...).
+ 2. First process loads the XSK program to the interface.
+ 3. First process adds the socket fd to a BPF map.
+ 4. First process ties socket fd to a particular interface using
+ SO_BINDTODEVICE.
+ 5. First process sends socket fd to a second process.
+ 6. Second process allocates UMEM.
+ 7. Second process binds socket to the interface with bind(...).
+ 8. Second process sends/receives the traffic.
+
+All the steps above are possible today if the first process is privileged
+and the second one has sufficient RLIMIT_MEMLOCK and no capabilities.
+However, the second process will be able to bind the socket to any interface
+it wants on step 7 and send traffic from it. With the proposed change, the
+second process will be able to bind the socket only to a specific interface
+chosen by the first process at step 4.
+
+Fixes: 965a99098443 ("xsk: add support for bind for Rx")
+Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Magnus Karlsson <magnus.karlsson@intel.com>
+Acked-by: John Fastabend <john.fastabend@gmail.com>
+Acked-by: Jason Wang <jasowang@redhat.com>
+Link: https://lore.kernel.org/bpf/20230703175329.3259672-1-i.maximets@ovn.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/networking/af_xdp.rst | 9 +++++++++
+ net/xdp/xsk.c | 5 +++++
+ 2 files changed, 14 insertions(+)
+
+diff --git a/Documentation/networking/af_xdp.rst b/Documentation/networking/af_xdp.rst
+index 60b217b436be6..5b77b9e5ac7e6 100644
+--- a/Documentation/networking/af_xdp.rst
++++ b/Documentation/networking/af_xdp.rst
+@@ -433,6 +433,15 @@ start N bytes into the buffer leaving the first N bytes for the
+ application to use. The final option is the flags field, but it will
+ be dealt with in separate sections for each UMEM flag.
+
++SO_BINDTODEVICE setsockopt
++--------------------------
++
++This is a generic SOL_SOCKET option that can be used to tie AF_XDP
++socket to a particular network interface. It is useful when a socket
++is created by a privileged process and passed to a non-privileged one.
++Once the option is set, kernel will refuse attempts to bind that socket
++to a different interface. Updating the value requires CAP_NET_RAW.
++
+ XDP_STATISTICS getsockopt
+ -------------------------
+
+diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c
+index 13f62d2402e71..371d269d22fa0 100644
+--- a/net/xdp/xsk.c
++++ b/net/xdp/xsk.c
+@@ -886,6 +886,7 @@ static int xsk_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
+ struct sock *sk = sock->sk;
+ struct xdp_sock *xs = xdp_sk(sk);
+ struct net_device *dev;
++ int bound_dev_if;
+ u32 flags, qid;
+ int err = 0;
+
+@@ -899,6 +900,10 @@ static int xsk_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
+ XDP_USE_NEED_WAKEUP))
+ return -EINVAL;
+
++ bound_dev_if = READ_ONCE(sk->sk_bound_dev_if);
++ if (bound_dev_if && bound_dev_if != sxdp->sxdp_ifindex)
++ return -EINVAL;
++
+ rtnl_lock();
+ mutex_lock(&xs->mutex);
+ if (xs->state != XSK_READY) {
+--
+2.39.2
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
