--- /dev/null
+From a87efc225684584ee40cc5ac4050c11359e98c56 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Jan 2023 23:14:55 +0100
+Subject: accel: fix CONFIG_DRM dependencies
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 9f20c9f4b1e17e83e9ccc247cfdc0b61041bff3d ]
+
+At the moment, accel drivers can be built-in even with CONFIG_DRM=m,
+but this causes a link failure:
+
+x86_64-linux-ld: drivers/accel/ivpu/ivpu_drv.o: in function `ivpu_dev_init':
+ivpu_drv.c:(.text+0x1535): undefined reference to `drmm_kmalloc'
+x86_64-linux-ld: ivpu_drv.c:(.text+0x1562): undefined reference to `drmm_kmalloc'
+x86_64-linux-ld: drivers/accel/ivpu/ivpu_drv.o: in function `ivpu_remove':
+ivpu_drv.c:(.text+0x1faa): undefined reference to `drm_dev_unregister'
+x86_64-linux-ld: drivers/accel/ivpu/ivpu_drv.o: in function `ivpu_probe':
+ivpu_drv.c:(.text+0x1fef): undefined reference to `__devm_drm_dev_alloc'
+
+The problem is that DRM_ACCEL is a 'bool' symbol, so driver that
+only depend on DRM_ACCEL but not also on DRM do not see the restriction
+to =m configs.
+
+To ensure that each accel driver has an implied dependency on CONFIG_DRM,
+enclose the entire Kconfig file in an if/endif check.
+
+Fixes: 8bf4889762a8 ("drivers/accel: define kconfig and register a new major")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Stanislaw Gruszka <stanislaw.gruszka@linux.intel.com>
+Reviewed-by: Jeffrey Hugo <quic_jhugo@quicinc.com>
+Reviewed-by: Oded Gabbay <ogabbay@kernel.org>
+Signed-off-by: Jacek Lawrynowicz <jacek.lawrynowicz@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230127221504.2522909-1-arnd@kernel.org
+(cherry picked from commit 3524c96a121952f214271622bb372661ced86101)
+Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/accel/Kconfig | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/accel/Kconfig b/drivers/accel/Kconfig
+index c9ce849b2984a..c8177ae415b8b 100644
+--- a/drivers/accel/Kconfig
++++ b/drivers/accel/Kconfig
+@@ -6,9 +6,10 @@
+ # as, but not limited to, Machine-Learning and Deep-Learning acceleration
+ # devices
+ #
++if DRM
++
+ menuconfig DRM_ACCEL
+ bool "Compute Acceleration Framework"
+- depends on DRM
+ help
+ Framework for device drivers of compute acceleration devices, such
+ as, but not limited to, Machine-Learning and Deep-Learning
+@@ -22,3 +23,5 @@ menuconfig DRM_ACCEL
+ major number than GPUs, and will be exposed to user-space using
+ different device files, called accel/accel* (in /dev, sysfs
+ and debugfs).
++
++endif
+--
+2.39.2
+
--- /dev/null
+From f60aa151eda06e28ec65cbb866982afccbca10ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 14 Jan 2023 09:50:50 +0100
+Subject: ACPI: battery: Fix missing NUL-termination with large strings
+
+From: Armin Wolf <W_Armin@gmx.de>
+
+[ Upstream commit f2ac14b5f197e4a2dec51e5ceaa56682ff1592bc ]
+
+When encountering a string bigger than the destination buffer (32 bytes),
+the string is not properly NUL-terminated, causing buffer overreads later.
+
+This for example happens on the Inspiron 3505, where the battery
+model name is larger than 32 bytes, which leads to sysfs showing
+the model name together with the serial number string (which is
+NUL-terminated and thus prevents worse).
+
+Fix this by using strscpy() which ensures that the result is
+always NUL-terminated.
+
+Fixes: 106449e870b3 ("ACPI: Battery: Allow extract string from integer")
+Signed-off-by: Armin Wolf <W_Armin@gmx.de>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/battery.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
+index f4badcdde76e6..fb64bd217d826 100644
+--- a/drivers/acpi/battery.c
++++ b/drivers/acpi/battery.c
+@@ -440,7 +440,7 @@ static int extract_package(struct acpi_battery *battery,
+
+ if (element->type == ACPI_TYPE_STRING ||
+ element->type == ACPI_TYPE_BUFFER)
+- strncpy(ptr, element->string.pointer, 32);
++ strscpy(ptr, element->string.pointer, 32);
+ else if (element->type == ACPI_TYPE_INTEGER) {
+ strncpy(ptr, (u8 *)&element->integer.value,
+ sizeof(u64));
+--
+2.39.2
+
--- /dev/null
+From 5bc0e9c11c91b166644730edba517cc05844e1ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Jan 2023 13:45:58 +0000
+Subject: ACPI: Don't build ACPICA with '-Os'
+
+From: Mark Rutland <mark.rutland@arm.com>
+
+[ Upstream commit 8f9e0a52810dd83406c768972d022c37e7a18f1f ]
+
+The ACPICA code has been built with '-Os' since the beginning of git
+history, though there's no explanatory comment as to why.
+
+This is unfortunate as GCC drops the alignment specificed by
+'-falign-functions=N' when '-Os' is used, as reported in GCC bug 88345:
+
+ https://gcc.gnu.org/bugzilla/show_bug.cgi?id=88345
+
+This prevents CONFIG_FUNCTION_ALIGNMENT and
+CONFIG_DEBUG_FORCE_FUNCTION_ALIGN_64B from having their expected effect
+on the ACPICA code. This is doubly unfortunate as in subsequent patches
+arm64 will depend upon CONFIG_FUNCTION_ALIGNMENT for its ftrace
+implementation.
+
+Drop the '-Os' flag when building the ACPICA code. With this removed,
+the code builds cleanly and works correctly in testing so far.
+
+I've tested this by selecting CONFIG_DEBUG_FORCE_FUNCTION_ALIGN_64B=y,
+building and booting a kernel using ACPI, and looking for misaligned
+text symbols:
+
+* arm64:
+
+ Before, v6.2-rc3:
+ # uname -rm
+ 6.2.0-rc3 aarch64
+ # grep ' [Tt] ' /proc/kallsyms | grep -iv '[048c]0 [Tt] ' | wc -l
+ 5009
+
+ Before, v6.2-rc3 + fixed __cold:
+ # uname -rm
+ 6.2.0-rc3-00001-g2a2bedf8bfa9 aarch64
+ # grep ' [Tt] ' /proc/kallsyms | grep -iv '[048c]0 [Tt] ' | wc -l
+ 919
+
+ After:
+ # uname -rm
+ 6.2.0-rc3-00002-g267bddc38572 aarch64
+ # grep ' [Tt] ' /proc/kallsyms | grep -iv '[048c]0 [Tt] ' | wc -l
+ 323
+ # grep ' [Tt] ' /proc/kallsyms | grep -iv '[048c]0 [Tt] ' | grep acpi | wc -l
+ 0
+
+* x86_64:
+
+ Before, v6.2-rc3:
+ # uname -rm
+ 6.2.0-rc3 x86_64
+ # grep ' [Tt] ' /proc/kallsyms | grep -iv '[048c]0 [Tt] ' | wc -l
+ 11537
+
+ Before, v6.2-rc3 + fixed __cold:
+ # uname -rm
+ 6.2.0-rc3-00001-g2a2bedf8bfa9 x86_64
+ # grep ' [Tt] ' /proc/kallsyms | grep -iv '[048c]0 [Tt] ' | wc -l
+ 2805
+
+ After:
+ # uname -rm
+ 6.2.0-rc3-00002-g267bddc38572 x86_64
+ # grep ' [Tt] ' /proc/kallsyms | grep -iv '[048c]0 [Tt] ' | wc -l
+ 1357
+ # grep ' [Tt] ' /proc/kallsyms | grep -iv '[048c]0 [Tt] ' | grep acpi | wc -l
+ 0
+
+With the patch applied, the remaining unaligned text labels are a
+combination of static call trampolines and labels in assembly, which can
+be dealt with in subsequent patches.
+
+Signed-off-by: Mark Rutland <mark.rutland@arm.com>
+Acked-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Cc: Florent Revest <revest@chromium.org>
+Cc: Len Brown <lenb@kernel.org>
+Cc: Masami Hiramatsu <mhiramat@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Robert Moore <robert.moore@intel.com>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Cc: Will Deacon <will@kernel.org>
+Cc: linux-acpi@vger.kernel.org
+Link: https://lore.kernel.org/r/20230123134603.1064407-4-mark.rutland@arm.com
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpica/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/acpi/acpica/Makefile b/drivers/acpi/acpica/Makefile
+index 9e0d95d76fff7..30f3fc13c29d1 100644
+--- a/drivers/acpi/acpica/Makefile
++++ b/drivers/acpi/acpica/Makefile
+@@ -3,7 +3,7 @@
+ # Makefile for ACPICA Core interpreter
+ #
+
+-ccflags-y := -Os -D_LINUX -DBUILDING_ACPICA
++ccflags-y := -D_LINUX -DBUILDING_ACPICA
+ ccflags-$(CONFIG_ACPI_DEBUG) += -DACPI_DEBUG_OUTPUT
+
+ # use acpi.o to put all files here into acpi.o modparam namespace
+--
+2.39.2
+
--- /dev/null
+From 08d3810c4eb5838faa3029e4dbeacdfc96281ac8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 11 Feb 2023 15:13:33 -0500
+Subject: ACPI: resource: Add IRQ overrides for MAINGEAR Vector Pro 2 models
+
+From: Adam Niederer <adam.niederer@gmail.com>
+
+[ Upstream commit cb18703c179713056bd7e3bdfc2260ab4e8658f0 ]
+
+Fix a regression introduced by commit 9946e39fe8d0 ("ACPI: resource: skip
+IRQ override on AMD Zen platforms") on MAINGEAR Vector Pro 2 systems, which
+causes the built-in keyboard to not work. This restores the functionality
+by adding an IRQ override.
+
+No other IRQs were being overridden before, so this should be all that is
+needed for these systems. I have personally tested this on the 15" model
+(MG-VCP2-15A3070T), and I have confirmation that the issue is present on
+the 17" model (MG-VCP2-17A3070T).
+
+Fixes: 9946e39fe8d0 ("ACPI: resource: skip IRQ override on AMD Zen platforms")
+Signed-off-by: Adam Niederer <adam.niederer@gmail.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/resource.c | 19 +++++++++++++++++++
+ 1 file changed, 19 insertions(+)
+
+diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c
+index 192d1784e409b..1d9d3364bc2b5 100644
+--- a/drivers/acpi/resource.c
++++ b/drivers/acpi/resource.c
+@@ -478,6 +478,24 @@ static const struct dmi_system_id schenker_gm_rg[] = {
+ { }
+ };
+
++static const struct dmi_system_id maingear_laptop[] = {
++ {
++ .ident = "MAINGEAR Vector Pro 2 15",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Micro Electronics Inc"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "MG-VCP2-15A3070T"),
++ }
++ },
++ {
++ .ident = "MAINGEAR Vector Pro 2 17",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Micro Electronics Inc"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "MG-VCP2-17A3070T"),
++ },
++ },
++ { }
++};
++
+ struct irq_override_cmp {
+ const struct dmi_system_id *system;
+ unsigned char irq;
+@@ -493,6 +511,7 @@ static const struct irq_override_cmp override_table[] = {
+ { lenovo_laptop, 6, ACPI_LEVEL_SENSITIVE, ACPI_ACTIVE_LOW, 0, true },
+ { lenovo_laptop, 10, ACPI_LEVEL_SENSITIVE, ACPI_ACTIVE_LOW, 0, true },
+ { schenker_gm_rg, 1, ACPI_EDGE_SENSITIVE, ACPI_ACTIVE_LOW, 1, true },
++ { maingear_laptop, 1, ACPI_EDGE_SENSITIVE, ACPI_ACTIVE_LOW, 1, true },
+ };
+
+ static bool acpi_dev_irq_override(u32 gsi, u8 triggering, u8 polarity,
+--
+2.39.2
+
--- /dev/null
+From 762a08784701d1f6707a47b02f9ebdd10fb8ccfa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Feb 2023 19:16:53 +0100
+Subject: ACPI: resource: Do IRQ override on all TongFang GMxRGxx
+
+From: Werner Sembach <wse@tuxedocomputers.com>
+
+[ Upstream commit 17bb7046e7ce038a73ee97eaa804e0300c5199e2 ]
+
+Apply commit 7592b79ba4a9 ("ACPI: resource: do IRQ override on XMG Core 15")
+override for all vendors using this mainboard.
+
+Signed-off-by: Werner Sembach <wse@tuxedocomputers.com>
+Fixes: 9946e39fe8d0 ("ACPI: resource: skip IRQ override on AMD Zen platforms")
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/resource.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c
+index 1d9d3364bc2b5..a222bda7e15b0 100644
+--- a/drivers/acpi/resource.c
++++ b/drivers/acpi/resource.c
+@@ -467,11 +467,10 @@ static const struct dmi_system_id lenovo_laptop[] = {
+ { }
+ };
+
+-static const struct dmi_system_id schenker_gm_rg[] = {
++static const struct dmi_system_id tongfang_gm_rg[] = {
+ {
+- .ident = "XMG CORE 15 (M22)",
++ .ident = "TongFang GMxRGxx/XMG CORE 15 (M22)/TUXEDO Stellaris 15 Gen4 AMD",
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "SchenkerTechnologiesGmbH"),
+ DMI_MATCH(DMI_BOARD_NAME, "GMxRGxx"),
+ },
+ },
+@@ -510,7 +509,7 @@ static const struct irq_override_cmp override_table[] = {
+ { asus_laptop, 1, ACPI_LEVEL_SENSITIVE, ACPI_ACTIVE_LOW, 0, false },
+ { lenovo_laptop, 6, ACPI_LEVEL_SENSITIVE, ACPI_ACTIVE_LOW, 0, true },
+ { lenovo_laptop, 10, ACPI_LEVEL_SENSITIVE, ACPI_ACTIVE_LOW, 0, true },
+- { schenker_gm_rg, 1, ACPI_EDGE_SENSITIVE, ACPI_ACTIVE_LOW, 1, true },
++ { tongfang_gm_rg, 1, ACPI_EDGE_SENSITIVE, ACPI_ACTIVE_LOW, 1, true },
+ { maingear_laptop, 1, ACPI_EDGE_SENSITIVE, ACPI_ACTIVE_LOW, 1, true },
+ };
+
+--
+2.39.2
+
--- /dev/null
+From 1021d67fec6420a4ea46025d3ec800086355757e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Feb 2023 13:44:49 +0100
+Subject: ACPI: video: Fix Lenovo Ideapad Z570 DMI match
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 2d11eae42d52a131f06061015e49dc0f085c5bfc ]
+
+Multiple Ideapad Z570 variants need acpi_backlight=native to force native
+use on these pre Windows 8 machines since acpi_video backlight control
+does not work here.
+
+The original DMI quirk matches on a product_name of "102434U" but other
+variants may have different product_name-s such as e.g. "1024D9U".
+
+Move to checking product_version instead as is more or less standard for
+Lenovo DMI quirks for similar reasons.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/video_detect.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/acpi/video_detect.c b/drivers/acpi/video_detect.c
+index a8c02608dde45..710ac640267dd 100644
+--- a/drivers/acpi/video_detect.c
++++ b/drivers/acpi/video_detect.c
+@@ -434,7 +434,7 @@ static const struct dmi_system_id video_detect_dmi_table[] = {
+ /* Lenovo Ideapad Z570 */
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "102434U"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "Ideapad Z570"),
+ },
+ },
+ {
+--
+2.39.2
+
--- /dev/null
+From d7f189e34bc0329033f13e31fc75b06c7aae10d2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Dec 2022 09:51:20 -0600
+Subject: ACPICA: Drop port I/O validation for some regions
+
+From: Mario Limonciello <mario.limonciello@amd.com>
+
+[ Upstream commit e1d9148582ab2c3dada5c5cf8ca7531ca269fee5 ]
+
+Microsoft introduced support in Windows XP for blocking port I/O
+to various regions. For Windows compatibility ACPICA has adopted
+the same protections and will disallow writes to those
+(presumably) the same regions.
+
+On some systems the AML included with the firmware will issue 4 byte
+long writes to 0x80. These writes aren't making it over because of this
+blockage. The first 4 byte write attempt is rejected, and then
+subsequently 1 byte at a time each offset is tried. The first at 0x80
+works, but then the next 3 bytes are rejected.
+
+This manifests in bizarre failures for devices that expected the AML to
+write all 4 bytes. Trying the same AML on Windows 10 or 11 doesn't hit
+this failure and all 4 bytes are written.
+
+Either some of these regions were wrong or some point after Windows XP
+some of these regions blocks have been lifted.
+
+In the last 15 years there doesn't seem to be any reports popping up of
+this error in the Windows event viewer anymore. There is no documentation
+at Microsoft's developer site indicating that Windows ACPI interpreter
+blocks these regions. Between the lack of documentation and the fact that
+the writes actually do work in Windows 10 and 11, it's quite likely
+Windows doesn't actually enforce this anymore.
+
+So to help the issue, only enforce Windows XP specific entries if the
+latest _OSI supported is Windows XP. Continue to enforce the
+ALWAYS_ILLEGAL entries.
+
+Link: https://github.com/acpica/acpica/pull/817
+Fixes: 7f0719039085 ("ACPICA: New: I/O port protection")
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpica/hwvalid.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/acpi/acpica/hwvalid.c b/drivers/acpi/acpica/hwvalid.c
+index 915b26448d2c9..0d392e7b0747b 100644
+--- a/drivers/acpi/acpica/hwvalid.c
++++ b/drivers/acpi/acpica/hwvalid.c
+@@ -23,8 +23,8 @@ acpi_hw_validate_io_request(acpi_io_address address, u32 bit_width);
+ *
+ * The table is used to implement the Microsoft port access rules that
+ * first appeared in Windows XP. Some ports are always illegal, and some
+- * ports are only illegal if the BIOS calls _OSI with a win_XP string or
+- * later (meaning that the BIOS itelf is post-XP.)
++ * ports are only illegal if the BIOS calls _OSI with nothing newer than
++ * the specific _OSI strings.
+ *
+ * This provides ACPICA with the desired port protections and
+ * Microsoft compatibility.
+@@ -145,7 +145,8 @@ acpi_hw_validate_io_request(acpi_io_address address, u32 bit_width)
+
+ /* Port illegality may depend on the _OSI calls made by the BIOS */
+
+- if (acpi_gbl_osi_data >= port_info->osi_dependency) {
++ if (port_info->osi_dependency == ACPI_ALWAYS_ILLEGAL ||
++ acpi_gbl_osi_data == port_info->osi_dependency) {
+ ACPI_DEBUG_PRINT((ACPI_DB_VALUES,
+ "Denied AML access to port 0x%8.8X%8.8X/%X (%s 0x%.4X-0x%.4X)\n",
+ ACPI_FORMAT_UINT64(address),
+--
+2.39.2
+
--- /dev/null
+From 19bd3a367fa6b9553422094c7dbddc5717ad6cfa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 7 Jan 2023 02:53:08 +0300
+Subject: ACPICA: nsrepair: handle cases without a return value correctly
+
+From: Daniil Tatianin <d-tatianin@yandex-team.ru>
+
+[ Upstream commit ca843a4c79486e99a19b859ef0b9887854afe146 ]
+
+Previously acpi_ns_simple_repair() would crash if expected_btypes
+contained any combination of ACPI_RTYPE_NONE with a different type,
+e.g | ACPI_RTYPE_INTEGER because of slightly incorrect logic in the
+!return_object branch, which wouldn't return AE_AML_NO_RETURN_VALUE
+for such cases.
+
+Found by Linux Verification Center (linuxtesting.org) with the SVACE
+static analysis tool.
+
+Link: https://github.com/acpica/acpica/pull/811
+Fixes: 61db45ca2163 ("ACPICA: Restore code that repairs NULL package elements in return values.")
+Signed-off-by: Daniil Tatianin <d-tatianin@yandex-team.ru>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpica/nsrepair.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/acpi/acpica/nsrepair.c b/drivers/acpi/acpica/nsrepair.c
+index 367fcd201f96e..ec512e06a48ed 100644
+--- a/drivers/acpi/acpica/nsrepair.c
++++ b/drivers/acpi/acpica/nsrepair.c
+@@ -181,8 +181,9 @@ acpi_ns_simple_repair(struct acpi_evaluate_info *info,
+ * Try to fix if there was no return object. Warning if failed to fix.
+ */
+ if (!return_object) {
+- if (expected_btypes && (!(expected_btypes & ACPI_RTYPE_NONE))) {
+- if (package_index != ACPI_NOT_PACKAGE_ELEMENT) {
++ if (expected_btypes) {
++ if (!(expected_btypes & ACPI_RTYPE_NONE) &&
++ package_index != ACPI_NOT_PACKAGE_ELEMENT) {
+ ACPI_WARN_PREDEFINED((AE_INFO,
+ info->full_pathname,
+ ACPI_WARN_ALWAYS,
+@@ -196,14 +197,15 @@ acpi_ns_simple_repair(struct acpi_evaluate_info *info,
+ if (ACPI_SUCCESS(status)) {
+ return (AE_OK); /* Repair was successful */
+ }
+- } else {
++ }
++
++ if (expected_btypes != ACPI_RTYPE_NONE) {
+ ACPI_WARN_PREDEFINED((AE_INFO,
+ info->full_pathname,
+ ACPI_WARN_ALWAYS,
+ "Missing expected return value"));
++ return (AE_AML_NO_RETURN_VALUE);
+ }
+-
+- return (AE_AML_NO_RETURN_VALUE);
+ }
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 989cf5b4484dd18068f2ac2de2a405c05ad02053 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Jan 2023 00:14:02 -0500
+Subject: alpha/boot/tools/objstrip: fix the check for ELF header
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+[ Upstream commit 1878787797cbb019eeefe6f905514dcd557302b6 ]
+
+Just memcmp() with ELFMAG - that's the normal way to do it in userland
+code, which that thing is. Besides, that has the benefit of actually
+building - str_has_prefix() is *NOT* present in <string.h>.
+
+Fixes: 5f14596e55de "alpha: Replace strncmp with str_has_prefix"
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/alpha/boot/tools/objstrip.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/alpha/boot/tools/objstrip.c b/arch/alpha/boot/tools/objstrip.c
+index 08b430d25a315..7cf92d172dce9 100644
+--- a/arch/alpha/boot/tools/objstrip.c
++++ b/arch/alpha/boot/tools/objstrip.c
+@@ -148,7 +148,7 @@ main (int argc, char *argv[])
+ #ifdef __ELF__
+ elf = (struct elfhdr *) buf;
+
+- if (elf->e_ident[0] == 0x7f && str_has_prefix((char *)elf->e_ident + 1, "ELF")) {
++ if (memcmp(&elf->e_ident[EI_MAG0], ELFMAG, SELFMAG) == 0) {
+ if (elf->e_type != ET_EXEC) {
+ fprintf(stderr, "%s: %s is not an ELF executable\n",
+ prog_name, inname);
+--
+2.39.2
+
--- /dev/null
+From d0907f6229cb8945af2868c9570034b73a4b2054 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Jan 2023 14:15:23 +0300
+Subject: ALSA: hda/ca0132: minor fix for allocation size
+
+From: Alexey V. Vissarionov <gremlin@altlinux.org>
+
+[ Upstream commit 3ee0fe7fa39b14d1cea455b7041f2df933bd97d2 ]
+
+Although the "dma_chan" pointer occupies more or equal space compared
+to "*dma_chan", the allocation size should use the size of variable
+itself.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: 01ef7dbffb41 ("ALSA: hda - Update CA0132 codec to load DSP firmware binary")
+Signed-off-by: Alexey V. Vissarionov <gremlin@altlinux.org>
+Link: https://lore.kernel.org/r/20230117111522.GA15213@altlinux.org
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_ca0132.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/pci/hda/patch_ca0132.c b/sound/pci/hda/patch_ca0132.c
+index 0a292bf271f2e..acde4cd58785e 100644
+--- a/sound/pci/hda/patch_ca0132.c
++++ b/sound/pci/hda/patch_ca0132.c
+@@ -2455,7 +2455,7 @@ static int dspio_set_uint_param(struct hda_codec *codec, int mod_id,
+ static int dspio_alloc_dma_chan(struct hda_codec *codec, unsigned int *dma_chan)
+ {
+ int status = 0;
+- unsigned int size = sizeof(dma_chan);
++ unsigned int size = sizeof(*dma_chan);
+
+ codec_dbg(codec, " dspio_alloc_dma_chan() -- begin\n");
+ status = dspio_scp(codec, MASTERCONTROL, 0x20,
+--
+2.39.2
+
--- /dev/null
+From 8e41c5a3c13be4bbfc62973ac57d60de8892c4b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Feb 2023 10:20:13 +0100
+Subject: ALSA: hda: Fix the control element identification for multiple codecs
+
+From: Jaroslav Kysela <perex@perex.cz>
+
+[ Upstream commit d045bceff5a904bd79d71dede9f927c00ce4906f ]
+
+Some motherboards have multiple HDA codecs connected to the serial bus.
+The current code may create multiple mixer controls with the almost
+identical identification.
+
+The current code use id.device field from the control element structure
+to store the codec address to avoid such clashes for multiple codecs.
+Unfortunately, the user space do not handle this correctly. For mixer
+controls, only name and index are used for the identifiers.
+
+This patch fixes this problem to compose the index using the codec
+address as an offset in case, when the control already exists. It is
+really unlikely that one codec will create 10 similar controls.
+
+This patch adds new kernel module parameter 'ctl_dev_id' to allow
+select the old behaviour, too. The CONFIG_SND_HDA_CTL_DEV_ID Kconfig
+option sets the default value.
+
+BugLink: https://github.com/alsa-project/alsa-lib/issues/294
+BugLink: https://github.com/alsa-project/alsa-lib/issues/205
+Fixes: 54d174031576 ("[ALSA] hda-codec - Fix connection list parsing")
+Fixes: 1afe206ab699 ("ALSA: hda - Try to find an empty control index when it's occupied")
+Signed-off-by: Jaroslav Kysela <perex@perex.cz>
+Link: https://lore.kernel.org/r/20230202092013.4066998-1-perex@perex.cz
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/sound/hda_codec.h | 1 +
+ sound/pci/hda/Kconfig | 14 ++++++++++++++
+ sound/pci/hda/hda_codec.c | 13 ++++++++++---
+ sound/pci/hda/hda_controller.c | 1 +
+ sound/pci/hda/hda_controller.h | 1 +
+ sound/pci/hda/hda_intel.c | 5 +++++
+ 6 files changed, 32 insertions(+), 3 deletions(-)
+
+diff --git a/include/sound/hda_codec.h b/include/sound/hda_codec.h
+index eba23daf2c290..bbb7805e85d8e 100644
+--- a/include/sound/hda_codec.h
++++ b/include/sound/hda_codec.h
+@@ -259,6 +259,7 @@ struct hda_codec {
+ unsigned int relaxed_resume:1; /* don't resume forcibly for jack */
+ unsigned int forced_resume:1; /* forced resume for jack */
+ unsigned int no_stream_clean_at_suspend:1; /* do not clean streams at suspend */
++ unsigned int ctl_dev_id:1; /* old control element id build behaviour */
+
+ #ifdef CONFIG_PM
+ unsigned long power_on_acct;
+diff --git a/sound/pci/hda/Kconfig b/sound/pci/hda/Kconfig
+index 06d304db4183c..886255a03e8b4 100644
+--- a/sound/pci/hda/Kconfig
++++ b/sound/pci/hda/Kconfig
+@@ -302,6 +302,20 @@ config SND_HDA_INTEL_HDMI_SILENT_STREAM
+ This feature can impact power consumption as resources
+ are kept reserved both at transmitter and receiver.
+
++config SND_HDA_CTL_DEV_ID
++ bool "Use the device identifier field for controls"
++ depends on SND_HDA_INTEL
++ help
++ Say Y to use the device identifier field for (mixer)
++ controls (old behaviour until this option is available).
++
++ When enabled, the multiple HDA codecs may set the device
++ field in control (mixer) element identifiers. The use
++ of this field is not recommended and defined for mixer controls.
++
++ The old behaviour (Y) is obsolete and will be removed. Consider
++ to not enable this option.
++
+ endif
+
+ endmenu
+diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
+index 2e728aad67713..9f79c0ac2bda7 100644
+--- a/sound/pci/hda/hda_codec.c
++++ b/sound/pci/hda/hda_codec.c
+@@ -3389,7 +3389,12 @@ int snd_hda_add_new_ctls(struct hda_codec *codec,
+ kctl = snd_ctl_new1(knew, codec);
+ if (!kctl)
+ return -ENOMEM;
+- if (addr > 0)
++ /* Do not use the id.device field for MIXER elements.
++ * This field is for real device numbers (like PCM) but codecs
++ * are hidden components from the user space view (unrelated
++ * to the mixer element identification).
++ */
++ if (addr > 0 && codec->ctl_dev_id)
+ kctl->id.device = addr;
+ if (idx > 0)
+ kctl->id.index = idx;
+@@ -3400,9 +3405,11 @@ int snd_hda_add_new_ctls(struct hda_codec *codec,
+ * the codec addr; if it still fails (or it's the
+ * primary codec), then try another control index
+ */
+- if (!addr && codec->core.addr)
++ if (!addr && codec->core.addr) {
+ addr = codec->core.addr;
+- else if (!idx && !knew->index) {
++ if (!codec->ctl_dev_id)
++ idx += 10 * addr;
++ } else if (!idx && !knew->index) {
+ idx = find_empty_mixer_ctl_idx(codec,
+ knew->name, 0);
+ if (idx <= 0)
+diff --git a/sound/pci/hda/hda_controller.c b/sound/pci/hda/hda_controller.c
+index 0ff286b7b66be..083df287c1a48 100644
+--- a/sound/pci/hda/hda_controller.c
++++ b/sound/pci/hda/hda_controller.c
+@@ -1231,6 +1231,7 @@ int azx_probe_codecs(struct azx *chip, unsigned int max_slots)
+ continue;
+ codec->jackpoll_interval = chip->jackpoll_interval;
+ codec->beep_mode = chip->beep_mode;
++ codec->ctl_dev_id = chip->ctl_dev_id;
+ codecs++;
+ }
+ }
+diff --git a/sound/pci/hda/hda_controller.h b/sound/pci/hda/hda_controller.h
+index f5bf295eb8307..8556031bcd68e 100644
+--- a/sound/pci/hda/hda_controller.h
++++ b/sound/pci/hda/hda_controller.h
+@@ -124,6 +124,7 @@ struct azx {
+ /* HD codec */
+ int codec_probe_mask; /* copied from probe_mask option */
+ unsigned int beep_mode;
++ bool ctl_dev_id;
+
+ #ifdef CONFIG_SND_HDA_PATCH_LOADER
+ const struct firmware *fw;
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index 87002670c0c92..2dbc082076f69 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -119,6 +119,7 @@ static bool beep_mode[SNDRV_CARDS] = {[0 ... (SNDRV_CARDS-1)] =
+ CONFIG_SND_HDA_INPUT_BEEP_MODE};
+ #endif
+ static bool dmic_detect = 1;
++static bool ctl_dev_id = IS_ENABLED(CONFIG_SND_HDA_CTL_DEV_ID) ? 1 : 0;
+
+ module_param_array(index, int, NULL, 0444);
+ MODULE_PARM_DESC(index, "Index value for Intel HD audio interface.");
+@@ -157,6 +158,8 @@ module_param(dmic_detect, bool, 0444);
+ MODULE_PARM_DESC(dmic_detect, "Allow DSP driver selection (bypass this driver) "
+ "(0=off, 1=on) (default=1); "
+ "deprecated, use snd-intel-dspcfg.dsp_driver option instead");
++module_param(ctl_dev_id, bool, 0444);
++MODULE_PARM_DESC(ctl_dev_id, "Use control device identifier (based on codec address).");
+
+ #ifdef CONFIG_PM
+ static int param_set_xint(const char *val, const struct kernel_param *kp);
+@@ -2278,6 +2281,8 @@ static int azx_probe_continue(struct azx *chip)
+ chip->beep_mode = beep_mode[dev];
+ #endif
+
++ chip->ctl_dev_id = ctl_dev_id;
++
+ /* create codec instances */
+ if (bus->codec_mask) {
+ err = azx_probe_codecs(chip, azx_max_codecs[chip->driver_type]);
+--
+2.39.2
+
--- /dev/null
+From 7b7855d0931377bd7303ce7b5121562ea1d80344 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Feb 2023 21:34:51 +1100
+Subject: ALSA: hda/hdmi: Register with vga_switcheroo on Dual GPU Macbooks
+
+From: Orlando Chamberlain <orlandoch.dev@gmail.com>
+
+[ Upstream commit 5beb5627a2481aade9aa630b7ebb7f99442321b6 ]
+
+Commit 586bc4aab878 ("ALSA: hda/hdmi - fix vgaswitcheroo detection for
+AMD") caused only AMD gpu's with PX to have their audio component register
+with vga_switcheroo. This meant that Apple Macbooks with apple-gmux as the
+gpu switcher no longer had the audio client registering, so when the gpu is
+powered off by vga_switcheroo snd_hda_intel is unaware that it should have
+suspended the device:
+
+amdgpu: switched off
+snd_hda_intel 0000:03:00.1:
+ Unable to change power state from D3hot to D0, device inaccessible
+snd_hda_intel 0000:03:00.1: CORB reset timeout#2, CORBRP = 65535
+
+To resolve this, we use apple_gmux_detect() and register a
+vga_switcheroo audio client when apple-gmux is detected.
+
+Fixes: 586bc4aab878 ("ALSA: hda/hdmi - fix vgaswitcheroo detection for AMD")
+Link: https://lore.kernel.org/all/20230210044826.9834-9-orlandoch.dev@gmail.com/
+Signed-off-by: Orlando Chamberlain <orlandoch.dev@gmail.com>
+Link: https://lore.kernel.org/r/20230216103450.12925-1-orlandoch.dev@gmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/hda_intel.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index 2dbc082076f69..81c4a45254ff2 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -50,6 +50,7 @@
+ #include <sound/intel-dsp-config.h>
+ #include <linux/vgaarb.h>
+ #include <linux/vga_switcheroo.h>
++#include <linux/apple-gmux.h>
+ #include <linux/firmware.h>
+ #include <sound/hda_codec.h>
+ #include "hda_controller.h"
+@@ -1466,7 +1467,7 @@ static struct pci_dev *get_bound_vga(struct pci_dev *pci)
+ * vgaswitcheroo.
+ */
+ if (((p->class >> 16) == PCI_BASE_CLASS_DISPLAY) &&
+- atpx_present())
++ (atpx_present() || apple_gmux_detect(NULL, NULL)))
+ return p;
+ pci_dev_put(p);
+ }
+--
+2.39.2
+
--- /dev/null
+From d471857516ac578af6ea560383a7757dfd6b3158 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Nov 2022 19:40:35 +0800
+Subject: applicom: Fix PCI device refcount leak in applicom_init()
+
+From: Xiongfeng Wang <wangxiongfeng2@huawei.com>
+
+[ Upstream commit ce4273d89c52167d6fe20572136c58117eae0657 ]
+
+As comment of pci_get_class() says, it returns a pci_device with its
+refcount increased and decreased the refcount for the input parameter
+@from if it is not NULL.
+
+If we break the loop in applicom_init() with 'dev' not NULL, we need to
+call pci_dev_put() to decrease the refcount. Add the missing
+pci_dev_put() to avoid refcount leak.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Xiongfeng Wang <wangxiongfeng2@huawei.com>
+Link: https://lore.kernel.org/r/20221122114035.24194-1-wangxiongfeng2@huawei.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/applicom.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/char/applicom.c b/drivers/char/applicom.c
+index 36203d3fa6ea6..69314532f38cd 100644
+--- a/drivers/char/applicom.c
++++ b/drivers/char/applicom.c
+@@ -197,8 +197,10 @@ static int __init applicom_init(void)
+ if (!pci_match_id(applicom_pci_tbl, dev))
+ continue;
+
+- if (pci_enable_device(dev))
++ if (pci_enable_device(dev)) {
++ pci_dev_put(dev);
+ return -EIO;
++ }
+
+ RamIO = ioremap(pci_resource_start(dev, 0), LEN_RAM_IO);
+
+@@ -207,6 +209,7 @@ static int __init applicom_init(void)
+ "space at 0x%llx\n",
+ (unsigned long long)pci_resource_start(dev, 0));
+ pci_disable_device(dev);
++ pci_dev_put(dev);
+ return -EIO;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From b0a1b347d6bf0b973e860a24b5ff58b6ff1e631b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Jan 2023 21:58:41 +0100
+Subject: ARM: bcm2835_defconfig: Enable the framebuffer
+
+From: Stefan Wahren <stefan.wahren@i2se.com>
+
+[ Upstream commit afc8dd99840b7fb7190e769a893cda673bc3a907 ]
+
+Booting Linux on a Raspberry Pi based on bcm2835_defconfig there is
+no display activity.
+
+Enable CONFIG_FB which is nowadays required for CONFIG_FB_SIMPLE
+and CONFIG_FRAMEBUFFER_CONSOLE.
+
+Fixes: f611b1e7624c ("drm: Avoid circular dependencies for CONFIG_FB")
+Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
+Link: https://lore.kernel.org/r/20230113205842.17051-1-stefan.wahren@i2se.com
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/configs/bcm2835_defconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm/configs/bcm2835_defconfig b/arch/arm/configs/bcm2835_defconfig
+index a51babd178c26..be0c984a66947 100644
+--- a/arch/arm/configs/bcm2835_defconfig
++++ b/arch/arm/configs/bcm2835_defconfig
+@@ -107,6 +107,7 @@ CONFIG_MEDIA_CAMERA_SUPPORT=y
+ CONFIG_DRM=y
+ CONFIG_DRM_V3D=y
+ CONFIG_DRM_VC4=y
++CONFIG_FB=y
+ CONFIG_FB_SIMPLE=y
+ CONFIG_FRAMEBUFFER_CONSOLE=y
+ CONFIG_SOUND=y
+--
+2.39.2
+
--- /dev/null
+From 7a5db524250d01e84d7c8aaed57797d2453ebf6f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Jan 2023 16:53:54 +0100
+Subject: ARM: dts: exynos: correct wr-active property in Exynos3250 Rinato
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit d15d2a617499882971ddb773a583015bf36fa492 ]
+
+The property is wr-active:
+
+ exynos3250-rinato.dtb: fimd@11c00000: i80-if-timings: 'wr-act' does not match any of the regexes: 'pinctrl-[0-9]+'
+
+Fixes: b59b3afb94d4 ("ARM: dts: add fimd device support for exynos3250-rinato")
+Link: https://lore.kernel.org/r/20230120155404.323386-2-krzysztof.kozlowski@linaro.org
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/exynos3250-rinato.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/exynos3250-rinato.dts b/arch/arm/boot/dts/exynos3250-rinato.dts
+index 6d2c7bb191842..2eb682009815a 100644
+--- a/arch/arm/boot/dts/exynos3250-rinato.dts
++++ b/arch/arm/boot/dts/exynos3250-rinato.dts
+@@ -250,7 +250,7 @@ &fimd {
+ i80-if-timings {
+ cs-setup = <0>;
+ wr-setup = <0>;
+- wr-act = <1>;
++ wr-active = <1>;
+ wr-hold = <0>;
+ };
+ };
+--
+2.39.2
+
--- /dev/null
+From a9f4fea8c4a8fb1acffaac28e195487d91119938 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 21 Jan 2023 22:18:42 +0200
+Subject: ARM: dts: exynos: Use Exynos5420 compatible for the MIPI video phy
+
+From: Markuss Broks <markuss.broks@gmail.com>
+
+[ Upstream commit 5d5aa219a790d61cad2c38e1aa32058f16ad2f0b ]
+
+For some reason, the driver adding support for Exynos5420 MIPI phy
+back in 2016 wasn't used on Exynos5420, which caused a kernel panic.
+Add the proper compatible for it.
+
+Signed-off-by: Markuss Broks <markuss.broks@gmail.com>
+Link: https://lore.kernel.org/r/20230121201844.46872-2-markuss.broks@gmail.com
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/exynos5420.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/exynos5420.dtsi b/arch/arm/boot/dts/exynos5420.dtsi
+index 9f2523a873d9d..62263eb91b3cc 100644
+--- a/arch/arm/boot/dts/exynos5420.dtsi
++++ b/arch/arm/boot/dts/exynos5420.dtsi
+@@ -592,7 +592,7 @@ dp_phy: dp-video-phy {
+ };
+
+ mipi_phy: mipi-video-phy {
+- compatible = "samsung,s5pv210-mipi-video-phy";
++ compatible = "samsung,exynos5420-mipi-video-phy";
+ syscon = <&pmu_system_controller>;
+ #phy-cells = <1>;
+ };
+--
+2.39.2
+
--- /dev/null
+From 7875c61fa531cd03a81d872442f16b4f60d35da9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Dec 2022 11:04:33 +0800
+Subject: ARM: dts: imx7s: correct iomuxc gpr mux controller cells
+
+From: Peng Fan <peng.fan@nxp.com>
+
+[ Upstream commit 0e3e1946606a2919b1dda9967ab2e1c5af2fedd6 ]
+
+Per binding doc reg-mux.yaml, the #mux-control-cells should be 1
+
+Signed-off-by: Peng Fan <peng.fan@nxp.com>
+Reviewed-by: Marco Felsch <m.felsch@pengutronix.de>
+Fixes: 94a905a79f2c ("ARM: dts: imx7s: add multiplexer controls")
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx7s.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/imx7s.dtsi b/arch/arm/boot/dts/imx7s.dtsi
+index 0fc9e6b8b05dc..11b9321badc51 100644
+--- a/arch/arm/boot/dts/imx7s.dtsi
++++ b/arch/arm/boot/dts/imx7s.dtsi
+@@ -513,7 +513,7 @@ gpr: iomuxc-gpr@30340000 {
+
+ mux: mux-controller {
+ compatible = "mmio-mux";
+- #mux-control-cells = <0>;
++ #mux-control-cells = <1>;
+ mux-reg-masks = <0x14 0x00000010>;
+ };
+
+--
+2.39.2
+
--- /dev/null
+From d6fd45138cda93f5f5c02179d61129acd182958c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Jan 2023 13:49:51 +0100
+Subject: ARM: dts: stm32: Update part number NVMEM description on stm32mp131
+
+From: Patrick Delaunay <patrick.delaunay@foss.st.com>
+
+[ Upstream commit 366384e495511bea8583e44173629a3012d62db0 ]
+
+The STM32MP13x Device Part Number (also named RPN in reference manual)
+only uses the first 12 bits in OTP4, all the other bit are reserved and
+they can be different of zero; they must be masked in NVMEM result, so
+the number of bits must be defined in the nvmem cell description.
+
+Fixes: 1da8779c0029 ("ARM: dts: stm32: add STM32MP13 SoCs support")
+Signed-off-by: Patrick Delaunay <patrick.delaunay@foss.st.com>
+Signed-off-by: Alexandre Torgue <alexandre.torgue@foss.st.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/stm32mp131.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm/boot/dts/stm32mp131.dtsi b/arch/arm/boot/dts/stm32mp131.dtsi
+index accc3824f7e98..99d88096959eb 100644
+--- a/arch/arm/boot/dts/stm32mp131.dtsi
++++ b/arch/arm/boot/dts/stm32mp131.dtsi
+@@ -527,6 +527,7 @@ bsec: efuse@5c005000 {
+
+ part_number_otp: part_number_otp@4 {
+ reg = <0x4 0x2>;
++ bits = <0 12>;
+ };
+ ts_cal1: calib@5c {
+ reg = <0x5c 0x2>;
+--
+2.39.2
+
--- /dev/null
+From 06f53649d3e19b3f2f1524b99192d6da1bbe1ff1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 31 Dec 2022 16:58:54 -0600
+Subject: ARM: dts: sun8i: nanopi-duo2: Fix regulator GPIO reference
+
+From: Samuel Holland <samuel@sholland.org>
+
+[ Upstream commit 2177d4ae971f79b4a9a3c411f2fb8ae6113d1430 ]
+
+The property named in the schema is 'enable-gpios', not 'enable-gpio'.
+This makes no difference at runtime, because the regulator is marked as
+always-on, but it breaks validation.
+
+Fixes: 4701fc6e5dd9 ("ARM: dts: sun8i: add FriendlyARM NanoPi Duo2")
+Reviewed-by: Andre Przywara <andre.przywara@arm.com>
+Acked-by: Jernej Skrabec <jernej.skrabec@gmail.com>
+Signed-off-by: Samuel Holland <samuel@sholland.org>
+Link: https://lore.kernel.org/r/20221231225854.16320-2-samuel@sholland.org
+Signed-off-by: Jernej Skrabec <jernej.skrabec@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/sun8i-h3-nanopi-duo2.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/sun8i-h3-nanopi-duo2.dts b/arch/arm/boot/dts/sun8i-h3-nanopi-duo2.dts
+index 43641cb82398f..343b02b971555 100644
+--- a/arch/arm/boot/dts/sun8i-h3-nanopi-duo2.dts
++++ b/arch/arm/boot/dts/sun8i-h3-nanopi-duo2.dts
+@@ -57,7 +57,7 @@ reg_vdd_cpux: vdd-cpux-regulator {
+ regulator-ramp-delay = <50>; /* 4ms */
+
+ enable-active-high;
+- enable-gpio = <&r_pio 0 8 GPIO_ACTIVE_HIGH>; /* PL8 */
++ enable-gpios = <&r_pio 0 8 GPIO_ACTIVE_HIGH>; /* PL8 */
+ gpios = <&r_pio 0 6 GPIO_ACTIVE_HIGH>; /* PL6 */
+ gpios-states = <0x1>;
+ states = <1100000 0>, <1300000 1>;
+--
+2.39.2
+
--- /dev/null
+From db6dcdee6c7d874195eaad042f0192c5c6fa201b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Jan 2023 14:11:23 +0800
+Subject: ARM: imx: Call ida_simple_remove() for ida_simple_get
+
+From: Angus Chen <angus.chen@jaguarmicro.com>
+
+[ Upstream commit ebeb49f43c8952f12aa20f03f00d7009edc2d1c5 ]
+
+The function call ida_simple_get maybe fail,we should deal with it.
+And if ida_simple_get success ,it need to call ida_simple_remove also.
+BTW,devm_kasprintf can handle id is zero for consistency.
+
+Fixes: e76bdfd7403a ("ARM: imx: Added perf functionality to mmdc driver")
+Signed-off-by: Angus Chen <angus.chen@jaguarmicro.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-imx/mmdc.c | 24 ++++++++++++------------
+ 1 file changed, 12 insertions(+), 12 deletions(-)
+
+diff --git a/arch/arm/mach-imx/mmdc.c b/arch/arm/mach-imx/mmdc.c
+index af12668d0bf51..b9efe9da06e0b 100644
+--- a/arch/arm/mach-imx/mmdc.c
++++ b/arch/arm/mach-imx/mmdc.c
+@@ -99,6 +99,7 @@ struct mmdc_pmu {
+ cpumask_t cpu;
+ struct hrtimer hrtimer;
+ unsigned int active_events;
++ int id;
+ struct device *dev;
+ struct perf_event *mmdc_events[MMDC_NUM_COUNTERS];
+ struct hlist_node node;
+@@ -433,8 +434,6 @@ static enum hrtimer_restart mmdc_pmu_timer_handler(struct hrtimer *hrtimer)
+ static int mmdc_pmu_init(struct mmdc_pmu *pmu_mmdc,
+ void __iomem *mmdc_base, struct device *dev)
+ {
+- int mmdc_num;
+-
+ *pmu_mmdc = (struct mmdc_pmu) {
+ .pmu = (struct pmu) {
+ .task_ctx_nr = perf_invalid_context,
+@@ -452,15 +451,16 @@ static int mmdc_pmu_init(struct mmdc_pmu *pmu_mmdc,
+ .active_events = 0,
+ };
+
+- mmdc_num = ida_simple_get(&mmdc_ida, 0, 0, GFP_KERNEL);
++ pmu_mmdc->id = ida_simple_get(&mmdc_ida, 0, 0, GFP_KERNEL);
+
+- return mmdc_num;
++ return pmu_mmdc->id;
+ }
+
+ static int imx_mmdc_remove(struct platform_device *pdev)
+ {
+ struct mmdc_pmu *pmu_mmdc = platform_get_drvdata(pdev);
+
++ ida_simple_remove(&mmdc_ida, pmu_mmdc->id);
+ cpuhp_state_remove_instance_nocalls(cpuhp_mmdc_state, &pmu_mmdc->node);
+ perf_pmu_unregister(&pmu_mmdc->pmu);
+ iounmap(pmu_mmdc->mmdc_base);
+@@ -474,7 +474,6 @@ static int imx_mmdc_perf_init(struct platform_device *pdev, void __iomem *mmdc_b
+ {
+ struct mmdc_pmu *pmu_mmdc;
+ char *name;
+- int mmdc_num;
+ int ret;
+ const struct of_device_id *of_id =
+ of_match_device(imx_mmdc_dt_ids, &pdev->dev);
+@@ -497,14 +496,14 @@ static int imx_mmdc_perf_init(struct platform_device *pdev, void __iomem *mmdc_b
+ cpuhp_mmdc_state = ret;
+ }
+
+- mmdc_num = mmdc_pmu_init(pmu_mmdc, mmdc_base, &pdev->dev);
+- pmu_mmdc->mmdc_ipg_clk = mmdc_ipg_clk;
+- if (mmdc_num == 0)
+- name = "mmdc";
+- else
+- name = devm_kasprintf(&pdev->dev,
+- GFP_KERNEL, "mmdc%d", mmdc_num);
++ ret = mmdc_pmu_init(pmu_mmdc, mmdc_base, &pdev->dev);
++ if (ret < 0)
++ goto pmu_free;
+
++ name = devm_kasprintf(&pdev->dev,
++ GFP_KERNEL, "mmdc%d", ret);
++
++ pmu_mmdc->mmdc_ipg_clk = mmdc_ipg_clk;
+ pmu_mmdc->devtype_data = (struct fsl_mmdc_devtype_data *)of_id->data;
+
+ hrtimer_init(&pmu_mmdc->hrtimer, CLOCK_MONOTONIC,
+@@ -525,6 +524,7 @@ static int imx_mmdc_perf_init(struct platform_device *pdev, void __iomem *mmdc_b
+
+ pmu_register_err:
+ pr_warn("MMDC Perf PMU failed (%d), disabled\n", ret);
++ ida_simple_remove(&mmdc_ida, pmu_mmdc->id);
+ cpuhp_state_remove_instance_nocalls(cpuhp_mmdc_state, &pmu_mmdc->node);
+ hrtimer_cancel(&pmu_mmdc->hrtimer);
+ pmu_free:
+--
+2.39.2
+
--- /dev/null
+From e17fc6632466933ab58d60d6fab3f728b7ff53e9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Jan 2023 11:57:54 +0200
+Subject: ARM: OMAP1: call platform_device_put() in error case in
+ omap1_dm_timer_init()
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit 0414a100d6ab32721efa70ab55524540fdfe0ede ]
+
+If platform_device_add() is not called or failed, it should call
+platform_device_put() in error case.
+
+Fixes: 97933d6ced60 ("ARM: OMAP1: dmtimer: conversion to platform devices")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Message-Id: <20220701094602.2365099-1-yangyingliang@huawei.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-omap1/timer.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/mach-omap1/timer.c b/arch/arm/mach-omap1/timer.c
+index f5cd4bbf7566d..81a912c1145a9 100644
+--- a/arch/arm/mach-omap1/timer.c
++++ b/arch/arm/mach-omap1/timer.c
+@@ -158,7 +158,7 @@ static int __init omap1_dm_timer_init(void)
+ kfree(pdata);
+
+ err_free_pdev:
+- platform_device_unregister(pdev);
++ platform_device_put(pdev);
+
+ return ret;
+ }
+--
+2.39.2
+
--- /dev/null
+From f6ba30950fb38232feadbcf4e287c2e30867ae31 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Nov 2022 22:19:17 +0800
+Subject: ARM: OMAP2+: Fix memory leak in realtime_counter_init()
+
+From: Chen Hui <judy.chenhui@huawei.com>
+
+[ Upstream commit ed8167cbf65c2b6ff6faeb0f96ded4d6d581e1ac ]
+
+The "sys_clk" resource is malloced by clk_get(),
+it is not released when the function return.
+
+Fixes: fa6d79d27614 ("ARM: OMAP: Add initialisation for the real-time counter.")
+Signed-off-by: Chen Hui <judy.chenhui@huawei.com>
+Message-Id: <20221108141917.46796-1-judy.chenhui@huawei.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-omap2/timer.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm/mach-omap2/timer.c b/arch/arm/mach-omap2/timer.c
+index 620ba69c8f114..5677c4a08f376 100644
+--- a/arch/arm/mach-omap2/timer.c
++++ b/arch/arm/mach-omap2/timer.c
+@@ -76,6 +76,7 @@ static void __init realtime_counter_init(void)
+ }
+
+ rate = clk_get_rate(sys_clk);
++ clk_put(sys_clk);
+
+ if (soc_is_dra7xx()) {
+ /*
+--
+2.39.2
+
--- /dev/null
+From 7e11f6ea9b9eeba86693eeb1dbd698fc4db03b80 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Jun 2022 19:29:39 +0800
+Subject: ARM: OMAP2+: omap4-common: Fix refcount leak bug
+
+From: Liang He <windhl@126.com>
+
+[ Upstream commit 7c32919a378782c95c72bc028b5c30dfe8c11f82 ]
+
+In omap4_sram_init(), of_find_compatible_node() will return a node
+pointer with refcount incremented. We should use of_node_put() when
+it is not used anymore.
+
+Signed-off-by: Liang He <windhl@126.com>
+Message-Id: <20220628112939.160737-1-windhl@126.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-omap2/omap4-common.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm/mach-omap2/omap4-common.c b/arch/arm/mach-omap2/omap4-common.c
+index 6d1eb4eefefe5..d9ed2a5dcd5ef 100644
+--- a/arch/arm/mach-omap2/omap4-common.c
++++ b/arch/arm/mach-omap2/omap4-common.c
+@@ -140,6 +140,7 @@ static int __init omap4_sram_init(void)
+ __func__);
+ else
+ sram_sync = (void __iomem *)gen_pool_alloc(sram_pool, PAGE_SIZE);
++ of_node_put(np);
+
+ return 0;
+ }
+--
+2.39.2
+
--- /dev/null
+From 69d912dfacc7893f5f4408a4fad8bcc306a8fc2d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Jan 2023 10:02:12 +0100
+Subject: ARM: s3c: fix s3c64xx_set_timer_source prototype
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 5bf52f5e4d12b8109f348cab60cb7d51092c4270 ]
+
+The prototype does not match the definition, as gcc-13 points
+out:
+
+arch/arm/mach-s3c/s3c64xx.c:169:13: error: conflicting types for 's3c64xx_set_timer_source' due to enum/integer mismatch; have 'void(unsigned int, unsigned int)' [-Werror=enum-int-mismatch]
+ 169 | void __init s3c64xx_set_timer_source(unsigned int event, unsigned int source)
+ | ^~~~~~~~~~~~~~~~~~~~~~~~
+In file included from arch/arm/mach-s3c/s3c64xx.c:50:
+arch/arm/mach-s3c/s3c64xx.h:62:20: note: previous declaration of 's3c64xx_set_timer_source' with type 'void(enum s3c64xx_timer_mode, enum s3c64xx_timer_mode)'
+ 62 | extern void __init s3c64xx_set_timer_source(enum s3c64xx_timer_mode event,
+ | ^~~~~~~~~~~~~~~~~~~~~~~~
+
+Fixes: 4280506ac9bb ("ARM: SAMSUNG: Move all platforms to new clocksource driver")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/r/20230118090224.2162863-1-arnd@kernel.org
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-s3c/s3c64xx.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm/mach-s3c/s3c64xx.c b/arch/arm/mach-s3c/s3c64xx.c
+index 0a8116c108fe4..dce2b0e953088 100644
+--- a/arch/arm/mach-s3c/s3c64xx.c
++++ b/arch/arm/mach-s3c/s3c64xx.c
+@@ -173,7 +173,8 @@ static struct samsung_pwm_variant s3c64xx_pwm_variant = {
+ .tclk_mask = (1 << 7) | (1 << 6) | (1 << 5),
+ };
+
+-void __init s3c64xx_set_timer_source(unsigned int event, unsigned int source)
++void __init s3c64xx_set_timer_source(enum s3c64xx_timer_mode event,
++ enum s3c64xx_timer_mode source)
+ {
+ s3c64xx_pwm_variant.output_mask = BIT(SAMSUNG_PWM_NUM) - 1;
+ s3c64xx_pwm_variant.output_mask &= ~(BIT(event) | BIT(source));
+--
+2.39.2
+
--- /dev/null
+From f584e323291b5f0a827e22640e1f13a3a3ed4d19 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Nov 2022 22:05:44 +0800
+Subject: ARM: zynq: Fix refcount leak in zynq_early_slcr_init
+
+From: Qiheng Lin <linqiheng@huawei.com>
+
+[ Upstream commit 9eedb910a3be0005b88c696a8552c0d4c9937cd4 ]
+
+of_find_compatible_node() returns a node pointer with refcount incremented,
+we should use of_node_put() on error path.
+Add missing of_node_put() to avoid refcount leak.
+
+Fixes: 3329659df030 ("ARM: zynq: Simplify SLCR initialization")
+Signed-off-by: Qiheng Lin <linqiheng@huawei.com>
+Link: https://lore.kernel.org/r/20221129140544.41293-1-linqiheng@huawei.com
+Signed-off-by: Michal Simek <michal.simek@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-zynq/slcr.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm/mach-zynq/slcr.c b/arch/arm/mach-zynq/slcr.c
+index 37707614885a5..9765b3f4c2fc5 100644
+--- a/arch/arm/mach-zynq/slcr.c
++++ b/arch/arm/mach-zynq/slcr.c
+@@ -213,6 +213,7 @@ int __init zynq_early_slcr_init(void)
+ zynq_slcr_regmap = syscon_regmap_lookup_by_compatible("xlnx,zynq-slcr");
+ if (IS_ERR(zynq_slcr_regmap)) {
+ pr_err("%s: failed to find zynq-slcr\n", __func__);
++ of_node_put(np);
+ return -ENODEV;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 5910c4373468676c3b7ec2eccc57ff7264d5a3ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Dec 2022 12:55:54 +0000
+Subject: arm64/cpufeature: Fix field sign for DIT hwcap detection
+
+From: Mark Brown <broonie@kernel.org>
+
+[ Upstream commit 50daf5b7c4ec4efcaf49a4128930f872bec7dbc0 ]
+
+Since it was added our hwcap for DIT has specified that DIT is a signed
+field but this appears to be incorrect, the two values for the enumeration
+are:
+
+ 0b0000 NI
+ 0b0001 IMP
+
+which look like a normal unsigned enumeration and the in-kernel DIT usage
+added by 01ab991fc0ee ("arm64: Enable data independent timing (DIT) in the
+kernel") detects the feature with an unsigned enum. Fix the hwcap to specify
+the field as unsigned.
+
+Fixes: 7206dc93a58f ("arm64: Expose Arm v8.4 features")
+Reviewed-by: Mark Rutland <mark.rutland@arm.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Link: https://lore.kernel.org/r/20221207-arm64-sysreg-helpers-v3-1-0d71a7b174a8@kernel.org
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/kernel/cpufeature.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c
+index a77315b338e61..ee40dca9f28ef 100644
+--- a/arch/arm64/kernel/cpufeature.c
++++ b/arch/arm64/kernel/cpufeature.c
+@@ -2777,7 +2777,7 @@ static const struct arm64_cpu_capabilities arm64_elf_hwcaps[] = {
+ HWCAP_CAP(SYS_ID_AA64PFR0_EL1, ID_AA64PFR0_EL1_FP_SHIFT, 4, FTR_SIGNED, 1, CAP_HWCAP, KERNEL_HWCAP_FPHP),
+ HWCAP_CAP(SYS_ID_AA64PFR0_EL1, ID_AA64PFR0_EL1_AdvSIMD_SHIFT, 4, FTR_SIGNED, 0, CAP_HWCAP, KERNEL_HWCAP_ASIMD),
+ HWCAP_CAP(SYS_ID_AA64PFR0_EL1, ID_AA64PFR0_EL1_AdvSIMD_SHIFT, 4, FTR_SIGNED, 1, CAP_HWCAP, KERNEL_HWCAP_ASIMDHP),
+- HWCAP_CAP(SYS_ID_AA64PFR0_EL1, ID_AA64PFR0_EL1_DIT_SHIFT, 4, FTR_SIGNED, 1, CAP_HWCAP, KERNEL_HWCAP_DIT),
++ HWCAP_CAP(SYS_ID_AA64PFR0_EL1, ID_AA64PFR0_EL1_DIT_SHIFT, 4, FTR_UNSIGNED, 1, CAP_HWCAP, KERNEL_HWCAP_DIT),
+ HWCAP_CAP(SYS_ID_AA64ISAR1_EL1, ID_AA64ISAR1_EL1_DPB_SHIFT, 4, FTR_UNSIGNED, 1, CAP_HWCAP, KERNEL_HWCAP_DCPOP),
+ HWCAP_CAP(SYS_ID_AA64ISAR1_EL1, ID_AA64ISAR1_EL1_DPB_SHIFT, 4, FTR_UNSIGNED, 2, CAP_HWCAP, KERNEL_HWCAP_DCPODP),
+ HWCAP_CAP(SYS_ID_AA64ISAR1_EL1, ID_AA64ISAR1_EL1_JSCVT_SHIFT, 4, FTR_UNSIGNED, 1, CAP_HWCAP, KERNEL_HWCAP_JSCVT),
+--
+2.39.2
+
--- /dev/null
+From 849f0c30febbdd086e2fa61fe53d4652d1e2ecc2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Jan 2023 11:34:23 +0100
+Subject: arm64: dts: amlogic: meson-axg: fix SCPI clock dvfs node name
+
+From: Neil Armstrong <neil.armstrong@linaro.org>
+
+[ Upstream commit 5b7069d72f03c92a0ab919725017394ebce03a81 ]
+
+Fixes:
+scpi: clocks: 'clock-controller' does not match any of the regexes: '^clocks-[0-9a-f]+$', 'pinctrl-[0-9]+'
+
+Link: https://lore.kernel.org/r/20230124-b4-amlogic-bindings-fixups-v1-2-44351528957e@linaro.org
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/amlogic/meson-axg.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/amlogic/meson-axg.dtsi b/arch/arm64/boot/dts/amlogic/meson-axg.dtsi
+index 417523dc4cc03..c87df0b2dfdea 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-axg.dtsi
++++ b/arch/arm64/boot/dts/amlogic/meson-axg.dtsi
+@@ -153,7 +153,7 @@ scpi {
+ scpi_clocks: clocks {
+ compatible = "arm,scpi-clocks";
+
+- scpi_dvfs: clock-controller {
++ scpi_dvfs: clocks-0 {
+ compatible = "arm,scpi-dvfs-clocks";
+ #clock-cells = <1>;
+ clock-indices = <0>;
+--
+2.39.2
+
--- /dev/null
+From 719917ddb180597a57b221aed9053218132df3cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Jan 2023 11:34:25 +0100
+Subject: arm64: dts: amlogic: meson-axg-jethome-jethub-j1xx: fix supply name
+ of USB controller node
+
+From: Neil Armstrong <neil.armstrong@linaro.org>
+
+[ Upstream commit a69cb1042cea840bc7b60fea1c26a6b259e68bf2 ]
+
+Fixes:
+usb@ffe09080: 'phy-supply' does not match any of the regexes: '^usb@[0-9a-f]+$', 'pinctrl-[0-9]+'
+
+Link: https://lore.kernel.org/r/20230124-b4-amlogic-bindings-fixups-v1-4-44351528957e@linaro.org
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/amlogic/meson-axg-jethome-jethub-j1xx.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/amlogic/meson-axg-jethome-jethub-j1xx.dtsi b/arch/arm64/boot/dts/amlogic/meson-axg-jethome-jethub-j1xx.dtsi
+index 22fd43b5fd73c..1916c007cba58 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-axg-jethome-jethub-j1xx.dtsi
++++ b/arch/arm64/boot/dts/amlogic/meson-axg-jethome-jethub-j1xx.dtsi
+@@ -303,7 +303,7 @@ &uart_AO_B {
+
+ &usb {
+ status = "okay";
+- phy-supply = <&usb_pwr>;
++ vbus-supply = <&usb_pwr>;
+ };
+
+ &spicc1 {
+--
+2.39.2
+
--- /dev/null
+From 0cc73616f3252da4b3cf2fd4464cf882f4334af1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Jan 2023 11:34:29 +0100
+Subject: arm64: dts: amlogic: meson-axg-jethome-jethub-j1xx: fix invalid rtc
+ node name
+
+From: Neil Armstrong <neil.armstrong@linaro.org>
+
+[ Upstream commit 956f52025c5dd92c80c12e31c99c854086a6fc55 ]
+
+Fixes:
+pcf8563@51: $nodename:0: 'pcf8563@51' does not match '^rtc(@.*|-[0-9a-f])*$'
+
+Link: https://lore.kernel.org/r/20230124-b4-amlogic-bindings-fixups-v1-8-44351528957e@linaro.org
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/amlogic/meson-axg-jethome-jethub-j1xx.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/amlogic/meson-axg-jethome-jethub-j1xx.dtsi b/arch/arm64/boot/dts/amlogic/meson-axg-jethome-jethub-j1xx.dtsi
+index 1916c007cba58..e1605a9b0a13f 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-axg-jethome-jethub-j1xx.dtsi
++++ b/arch/arm64/boot/dts/amlogic/meson-axg-jethome-jethub-j1xx.dtsi
+@@ -217,7 +217,7 @@ &i2c1 {
+ pinctrl-names = "default";
+
+ /* RTC */
+- pcf8563: pcf8563@51 {
++ pcf8563: rtc@51 {
+ compatible = "nxp,pcf8563";
+ reg = <0x51>;
+ status = "okay";
+--
+2.39.2
+
--- /dev/null
+From b13401e9c59d737933b2805deb5f9f05335bdd61 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Jan 2023 11:34:35 +0100
+Subject: arm64: dts: amlogic: meson-g12b-odroid-go-ultra: fix rk818 pmic
+ properties
+
+From: Neil Armstrong <neil.armstrong@linaro.org>
+
+[ Upstream commit ce9999722656f2433af9029571bc2b99448dda74 ]
+
+Fixes:
+pmic@1c: '#clock-cells' is a required property
+pmic@1c: 'switch-supply' does not match any of the regexes: 'pinctrl-[0-9]+'
+
+The switch supply is described by vcc9-supply per bindings documentation.
+
+Link: https://lore.kernel.org/r/20230124-b4-amlogic-bindings-fixups-v1-14-44351528957e@linaro.org
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/amlogic/meson-g12b-odroid-go-ultra.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-go-ultra.dts b/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-go-ultra.dts
+index 1e40709610c52..c8e5a0a42b898 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-go-ultra.dts
++++ b/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-go-ultra.dts
+@@ -381,6 +381,7 @@ rk818: pmic@1c {
+ reg = <0x1c>;
+ interrupt-parent = <&gpio_intc>;
+ interrupts = <7 IRQ_TYPE_LEVEL_LOW>; /* GPIOAO_7 */
++ #clock-cells = <1>;
+
+ vcc1-supply = <&vdd_sys>;
+ vcc2-supply = <&vdd_sys>;
+@@ -391,7 +392,6 @@ rk818: pmic@1c {
+ vcc8-supply = <&vcc_2v3>;
+ vcc9-supply = <&vddao_3v3>;
+ boost-supply = <&vdd_sys>;
+- switch-supply = <&vdd_sys>;
+
+ regulators {
+ vddcpu_a: DCDC_REG1 {
+--
+2.39.2
+
--- /dev/null
+From 43baa6da717efb1672b456eed47e052d0103f100 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Jan 2023 11:34:24 +0100
+Subject: arm64: dts: amlogic: meson-gx: add missing SCPI sensors compatible
+
+From: Neil Armstrong <neil.armstrong@linaro.org>
+
+[ Upstream commit 2ff650051493d5bdb6dd09d4c2850bb37db6be31 ]
+
+Fixes:
+scpi: sensors:compatible: 'oneOf' conditional failed, one must be fixed:
+ ['amlogic,meson-gxbb-scpi-sensors'] is too short
+ 'arm,scpi-sensors' was expected
+
+Link: https://lore.kernel.org/r/20230124-b4-amlogic-bindings-fixups-v1-3-44351528957e@linaro.org
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/amlogic/meson-axg.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/amlogic/meson-axg.dtsi b/arch/arm64/boot/dts/amlogic/meson-axg.dtsi
+index c87df0b2dfdea..ff2b33313e637 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-axg.dtsi
++++ b/arch/arm64/boot/dts/amlogic/meson-axg.dtsi
+@@ -162,7 +162,7 @@ scpi_dvfs: clocks-0 {
+ };
+
+ scpi_sensors: sensors {
+- compatible = "amlogic,meson-gxbb-scpi-sensors";
++ compatible = "amlogic,meson-gxbb-scpi-sensors", "arm,scpi-sensors";
+ #thermal-sensor-cells = <1>;
+ };
+ };
+--
+2.39.2
+
--- /dev/null
+From 1a8f4415135c0884e1e04a07ec13e8d4dff393d2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Jan 2023 11:34:27 +0100
+Subject: arm64: dts: amlogic: meson-gx: add missing unit address to rng node
+ name
+
+From: Neil Armstrong <neil.armstrong@linaro.org>
+
+[ Upstream commit 61ff70708b98a85516eccb3755084ac97b42cf48 ]
+
+Fixes:
+bus@c8834000: rng: {...} should not be valid under {'type': 'object'}
+
+Link: https://lore.kernel.org/r/20230124-b4-amlogic-bindings-fixups-v1-6-44351528957e@linaro.org
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/amlogic/meson-gx.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gx.dtsi b/arch/arm64/boot/dts/amlogic/meson-gx.dtsi
+index 467d2eaf817b2..11f89bfecb56a 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gx.dtsi
++++ b/arch/arm64/boot/dts/amlogic/meson-gx.dtsi
+@@ -532,7 +532,7 @@ periphs: bus@c8834000 {
+ #size-cells = <2>;
+ ranges = <0x0 0x0 0x0 0xc8834000 0x0 0x2000>;
+
+- hwrng: rng {
++ hwrng: rng@0 {
+ compatible = "amlogic,meson-rng";
+ reg = <0x0 0x0 0x0 0x4>;
+ };
+--
+2.39.2
+
--- /dev/null
+From dfad626b4d1a7c146115c7d1f66a2febb0352aac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Jan 2023 11:34:22 +0100
+Subject: arm64: dts: amlogic: meson-gx: fix SCPI clock dvfs node name
+
+From: Neil Armstrong <neil.armstrong@linaro.org>
+
+[ Upstream commit 127f79212b07c5d9a6657a87e3eafdd889335814 ]
+
+Fixes:
+scpi: clocks: 'clock-controller' does not match any of the regexes: '^clocks-[0-9a-f]+$', 'pinctrl-[0-9]+'
+
+Link: https://lore.kernel.org/r/20230124-b4-amlogic-bindings-fixups-v1-1-44351528957e@linaro.org
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/amlogic/meson-gx.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gx.dtsi b/arch/arm64/boot/dts/amlogic/meson-gx.dtsi
+index 09a016fd828aa..467d2eaf817b2 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gx.dtsi
++++ b/arch/arm64/boot/dts/amlogic/meson-gx.dtsi
+@@ -250,7 +250,7 @@ scpi {
+ scpi_clocks: clocks {
+ compatible = "arm,scpi-clocks";
+
+- scpi_dvfs: clock-controller {
++ scpi_dvfs: clocks-0 {
+ compatible = "arm,scpi-dvfs-clocks";
+ #clock-cells = <1>;
+ clock-indices = <0>;
+--
+2.39.2
+
--- /dev/null
+From 0247b9b8a818c3035e7eaa9b27426c98a6cb8679 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Jan 2023 11:34:31 +0100
+Subject: arm64: dts: amlogic: meson-gx-libretech-pc: fix update button name
+
+From: Neil Armstrong <neil.armstrong@linaro.org>
+
+[ Upstream commit 6bb506ed36968207a8832f0143ebc127f0770eef ]
+
+Fixes:
+ adc-keys: 'update-button' does not match any of the regexes: '^button-', 'pinctrl-[0-9]+'
+
+Link: https://lore.kernel.org/r/20230124-b4-amlogic-bindings-fixups-v1-10-44351528957e@linaro.org
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/amlogic/meson-gx-libretech-pc.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gx-libretech-pc.dtsi b/arch/arm64/boot/dts/amlogic/meson-gx-libretech-pc.dtsi
+index bcdf55f48a831..4e84ab87cc7db 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gx-libretech-pc.dtsi
++++ b/arch/arm64/boot/dts/amlogic/meson-gx-libretech-pc.dtsi
+@@ -17,7 +17,7 @@ adc-keys {
+ io-channel-names = "buttons";
+ keyup-threshold-microvolt = <1800000>;
+
+- update-button {
++ button-update {
+ label = "update";
+ linux,code = <KEY_VENDOR>;
+ press-threshold-microvolt = <1300000>;
+--
+2.39.2
+
--- /dev/null
+From 12c2b8fa890f3316c4025cb8d144ca7952d1402f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Jan 2023 11:34:34 +0100
+Subject: arm64: dts: amlogic: meson-gxbb-kii-pro: fix led node name
+
+From: Neil Armstrong <neil.armstrong@linaro.org>
+
+[ Upstream commit afdef3b188c934f79ad4b0a7bd8c692742f9b5af ]
+
+Fixes:
+leds: status: {...} is not of type 'array'
+
+Link: https://lore.kernel.org/r/20230124-b4-amlogic-bindings-fixups-v1-13-44351528957e@linaro.org
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/amlogic/meson-gxbb-kii-pro.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-kii-pro.dts b/arch/arm64/boot/dts/amlogic/meson-gxbb-kii-pro.dts
+index 6d8cc00fedc7f..5f2d4317ecfbf 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-kii-pro.dts
++++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-kii-pro.dts
+@@ -16,7 +16,7 @@ / {
+
+ leds {
+ compatible = "gpio-leds";
+- status {
++ led {
+ gpios = <&gpio_ao GPIOAO_13 GPIO_ACTIVE_LOW>;
+ default-state = "off";
+ color = <LED_COLOR_ID_RED>;
+--
+2.39.2
+
--- /dev/null
+From c7b94fe43c9b4958a4ec746930ffbde1f0a8ddaf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Jan 2023 11:34:30 +0100
+Subject: arm64: dts: amlogic: meson-gxl: add missing unit address to
+ eth-phy-mux node name
+
+From: Neil Armstrong <neil.armstrong@linaro.org>
+
+[ Upstream commit d19189f70ba596798ea49166d2d1ef36a8df5289 ]
+
+Fixes:
+bus@c8834000: eth-phy-mux: {...} should not be valid under {'type': 'object'}
+
+Link: https://lore.kernel.org/r/20230124-b4-amlogic-bindings-fixups-v1-9-44351528957e@linaro.org
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/amlogic/meson-gxl.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi
+index 04e9d0f1bde0f..5905a6df09b04 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi
++++ b/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi
+@@ -773,7 +773,7 @@ mux {
+ };
+ };
+
+- eth-phy-mux {
++ eth-phy-mux@55c {
+ compatible = "mdio-mux-mmioreg", "mdio-mux";
+ #address-cells = <1>;
+ #size-cells = <0>;
+--
+2.39.2
+
--- /dev/null
+From 36ab1aca479f432d04b1462f94c648614dc5dd1b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Jan 2023 11:34:33 +0100
+Subject: arm64: dts: amlogic: meson-gxl-s905d-phicomm-n1: fix led node name
+
+From: Neil Armstrong <neil.armstrong@linaro.org>
+
+[ Upstream commit eee64d8fbbdaab72bbab3e462f3a7b742d20c8c2 ]
+
+Fixes:
+leds: status: {...} is not of type 'array'
+
+Link: https://lore.kernel.org/r/20230124-b4-amlogic-bindings-fixups-v1-12-44351528957e@linaro.org
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/amlogic/meson-gxl-s905d-phicomm-n1.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905d-phicomm-n1.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905d-phicomm-n1.dts
+index 9ef210f17b4aa..393d3cb33b9ee 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905d-phicomm-n1.dts
++++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905d-phicomm-n1.dts
+@@ -18,7 +18,7 @@ cvbs-connector {
+ leds {
+ compatible = "gpio-leds";
+
+- status {
++ led {
+ label = "n1:white:status";
+ gpios = <&gpio_ao GPIOAO_9 GPIO_ACTIVE_HIGH>;
+ default-state = "on";
+--
+2.39.2
+
--- /dev/null
+From f7a010e82ef745a21395ba1293bec1f04f0ed2e5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Jan 2023 11:34:26 +0100
+Subject: arm64: dts: amlogic: meson-gxl-s905d-sml5442tw: drop invalid
+ clock-names property
+
+From: Neil Armstrong <neil.armstrong@linaro.org>
+
+[ Upstream commit e3bd275ccbacf5eb18eaa311cea39f8bf8655feb ]
+
+Fixes:
+bluetooth: 'clock-names' does not match any of the regexes: 'pinctrl-[0-9]+'
+
+Link: https://lore.kernel.org/r/20230124-b4-amlogic-bindings-fixups-v1-5-44351528957e@linaro.org
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/amlogic/meson-gxl-s905d-sml5442tw.dts | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905d-sml5442tw.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905d-sml5442tw.dts
+index b331a013572f3..c490dbbf063bf 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905d-sml5442tw.dts
++++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905d-sml5442tw.dts
+@@ -79,6 +79,5 @@ bluetooth {
+ enable-gpios = <&gpio GPIOX_17 GPIO_ACTIVE_HIGH>;
+ max-speed = <2000000>;
+ clocks = <&wifi32k>;
+- clock-names = "lpo";
+ };
+ };
+--
+2.39.2
+
--- /dev/null
+From cd87b68b8dea7da946b64a255447f94835f28518 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Jan 2023 11:34:28 +0100
+Subject: arm64: dts: amlogic: meson-gxl-s905w-jethome-jethub-j80: fix invalid
+ rtc node name
+
+From: Neil Armstrong <neil.armstrong@linaro.org>
+
+[ Upstream commit 11172a97c092eaeb0a65c6434df0fc73f886a495 ]
+
+Fixes:
+pcf8563@51: $nodename:0: 'pcf8563@51' does not match '^rtc(@.*|-[0-9a-f])*$'
+
+Link: https://lore.kernel.org/r/20230124-b4-amlogic-bindings-fixups-v1-7-44351528957e@linaro.org
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../boot/dts/amlogic/meson-gxl-s905w-jethome-jethub-j80.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905w-jethome-jethub-j80.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905w-jethome-jethub-j80.dts
+index bb7412070cb26..a18d6d241a5ad 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905w-jethome-jethub-j80.dts
++++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905w-jethome-jethub-j80.dts
+@@ -239,7 +239,7 @@ &i2c_B {
+ pinctrl-names = "default";
+ pinctrl-0 = <&i2c_b_pins>;
+
+- pcf8563: pcf8563@51 {
++ pcf8563: rtc@51 {
+ compatible = "nxp,pcf8563";
+ reg = <0x51>;
+ status = "okay";
+--
+2.39.2
+
--- /dev/null
+From bd919f2dad13a363e83b956f9c0724bc13e20e34 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Jan 2023 11:34:32 +0100
+Subject: arm64: dts: amlogic: meson-sm1-bananapi-m5: fix adc keys node names
+
+From: Neil Armstrong <neil.armstrong@linaro.org>
+
+[ Upstream commit d519a73332b6c3d14e15f8fd20d7c6f29ed13d41 ]
+
+Fixes:
+adc_keys: 'key' does not match any of the regexes: '^button-', 'pinctrl-[0-9]+'
+
+Also fix the invalid "adc_keys" node name.
+
+Link: https://lore.kernel.org/r/20230124-b4-amlogic-bindings-fixups-v1-11-44351528957e@linaro.org
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/amlogic/meson-sm1-bananapi-m5.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/amlogic/meson-sm1-bananapi-m5.dts b/arch/arm64/boot/dts/amlogic/meson-sm1-bananapi-m5.dts
+index cadba194b149b..6d0db667581fa 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-sm1-bananapi-m5.dts
++++ b/arch/arm64/boot/dts/amlogic/meson-sm1-bananapi-m5.dts
+@@ -17,13 +17,13 @@ / {
+ compatible = "bananapi,bpi-m5", "amlogic,sm1";
+ model = "Banana Pi BPI-M5";
+
+- adc_keys {
++ adc-keys {
+ compatible = "adc-keys";
+ io-channels = <&saradc 2>;
+ io-channel-names = "buttons";
+ keyup-threshold-microvolt = <1800000>;
+
+- key {
++ button-sw3 {
+ label = "SW3";
+ linux,code = <BTN_3>;
+ press-threshold-microvolt = <1700000>;
+--
+2.39.2
+
--- /dev/null
+From 03495072bc63b4a2dfab38626684c4a8f0d029e5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Jan 2023 12:39:08 +0100
+Subject: arm64: dts: amlogic: meson-sm1-odroid-hc4: fix active fan thermal
+ trip
+
+From: Neil Armstrong <neil.armstrong@linaro.org>
+
+[ Upstream commit 1d2f14117aa7773efff50f832b85fc7779e586e0 ]
+
+Add an active trip tied to the on-board fan cooling device, which is better
+than describing it along the passive cooling maps.
+
+Fixes: 33b14f663df8 ("arm64: dts: meson: add initial device-tree for ODROID-HC4")
+Reported-by: Ricardo Pardini <ricardo@pardini.net>
+Link: https://lore.kernel.org/r/20230124-topic-odroid-hc4-upstream-fix-fan-trip-v1-1-b0c6aa355d93@linaro.org
+Tested-by: Ricardo Pardini <ricardo@pardini.net>
+[narmstrong: added Ricardo's tested-by from off-list chat]
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/amlogic/meson-sm1-odroid-hc4.dts | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/amlogic/meson-sm1-odroid-hc4.dts b/arch/arm64/boot/dts/amlogic/meson-sm1-odroid-hc4.dts
+index a1f0c38ccadda..74088e7280fee 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-sm1-odroid-hc4.dts
++++ b/arch/arm64/boot/dts/amlogic/meson-sm1-odroid-hc4.dts
+@@ -76,9 +76,17 @@ sound {
+ };
+
+ &cpu_thermal {
++ trips {
++ cpu_active: cpu-active {
++ temperature = <60000>; /* millicelsius */
++ hysteresis = <2000>; /* millicelsius */
++ type = "active";
++ };
++ };
++
+ cooling-maps {
+ map {
+- trip = <&cpu_passive>;
++ trip = <&cpu_active>;
+ cooling-device = <&fan0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>;
+ };
+ };
+--
+2.39.2
+
--- /dev/null
+From 9b3f502d8fbae449b115880486dd56fc55de14fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Dec 2022 17:23:50 +0100
+Subject: arm64: dts: imx8m: Align SoC unique ID node unit address
+
+From: Marek Vasut <marex@denx.de>
+
+[ Upstream commit ee0d68f219be8618f53d3f8808952e20525e3f30 ]
+
+Align the SoC unique ID DT node unit address with its reg property.
+
+Reviewed-by: Peng Fan <peng.fan@nxp.com>
+Fixes: cbff23797fa1 ("arm64: dts: imx8m: add NVMEM provider and consumer to read soc unique ID")
+Signed-off-by: Marek Vasut <marex@denx.de>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/imx8mm.dtsi | 2 +-
+ arch/arm64/boot/dts/freescale/imx8mn.dtsi | 2 +-
+ arch/arm64/boot/dts/freescale/imx8mp.dtsi | 2 +-
+ arch/arm64/boot/dts/freescale/imx8mq.dtsi | 2 +-
+ 4 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8mm.dtsi b/arch/arm64/boot/dts/freescale/imx8mm.dtsi
+index 4ee89fdcf59bd..b45852e8087a9 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mm.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx8mm.dtsi
+@@ -563,7 +563,7 @@ ocotp: efuse@30350000 {
+ #address-cells = <1>;
+ #size-cells = <1>;
+
+- imx8mm_uid: unique-id@410 {
++ imx8mm_uid: unique-id@4 {
+ reg = <0x4 0x8>;
+ };
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8mn.dtsi b/arch/arm64/boot/dts/freescale/imx8mn.dtsi
+index b7d91df71cc26..7601a031f85a0 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mn.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx8mn.dtsi
+@@ -564,7 +564,7 @@ ocotp: efuse@30350000 {
+ #address-cells = <1>;
+ #size-cells = <1>;
+
+- imx8mn_uid: unique-id@410 {
++ imx8mn_uid: unique-id@4 {
+ reg = <0x4 0x8>;
+ };
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8mp.dtsi b/arch/arm64/boot/dts/freescale/imx8mp.dtsi
+index 03034b439c1f7..bafe0a572f7e9 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mp.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx8mp.dtsi
+@@ -425,7 +425,7 @@ ocotp: efuse@30350000 {
+ #address-cells = <1>;
+ #size-cells = <1>;
+
+- imx8mp_uid: unique-id@420 {
++ imx8mp_uid: unique-id@8 {
+ reg = <0x8 0x8>;
+ };
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8mq.dtsi b/arch/arm64/boot/dts/freescale/imx8mq.dtsi
+index 7ce99c084e545..6eb5a98bb1bd4 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mq.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx8mq.dtsi
+@@ -593,7 +593,7 @@ ocotp: efuse@30350000 {
+ #address-cells = <1>;
+ #size-cells = <1>;
+
+- imx8mq_uid: soc-uid@410 {
++ imx8mq_uid: soc-uid@4 {
+ reg = <0x4 0x8>;
+ };
+
+--
+2.39.2
+
--- /dev/null
+From 5715d02b175df4aa3917e89d1e72b2943d79006f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Nov 2022 12:20:27 +0100
+Subject: arm64: dts: mediatek: mt7622: Add missing pwm-cells to pwm node
+
+From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+
+[ Upstream commit 22925af785fa3470efdf566339616d801119d348 ]
+
+Specify #pwm-cells on pwm@11006000 to make it actually usable.
+
+Fixes: ae457b7679c4 ("arm64: dts: mt7622: add SoC and peripheral related device nodes")
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20221128112028.58021-2-angelogioacchino.delregno@collabora.com
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt7622.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt7622.dtsi b/arch/arm64/boot/dts/mediatek/mt7622.dtsi
+index 146e18b5b1f46..7bb316922a3a9 100644
+--- a/arch/arm64/boot/dts/mediatek/mt7622.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt7622.dtsi
+@@ -435,6 +435,7 @@ uart3: serial@11005000 {
+ pwm: pwm@11006000 {
+ compatible = "mediatek,mt7622-pwm";
+ reg = <0 0x11006000 0 0x1000>;
++ #pwm-cells = <2>;
+ interrupts = <GIC_SPI 77 IRQ_TYPE_LEVEL_LOW>;
+ clocks = <&topckgen CLK_TOP_PWM_SEL>,
+ <&pericfg CLK_PERI_PWM_PD>,
+--
+2.39.2
+
--- /dev/null
+From 1ad6fa6160e5b349654ced3fe022a3407084b76c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Nov 2022 11:32:05 +0800
+Subject: arm64: dts: mediatek: mt7986: Fix watchdog compatible
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Allen-KH Cheng <allen-kh.cheng@mediatek.com>
+
+[ Upstream commit 70d24df30d06e5c822ba94751166ef55d0e28a89 ]
+
+MT7986's watchdog embeds a reset controller and needs only the
+mediatek,mt7986-wdt compatible string as the MT6589 one is there
+for watchdogs that don't have any reset controller capability.
+
+Fixes: 50137c150f5f ("arm64: dts: mediatek: add basic mt7986 support")
+Signed-off-by: Allen-KH Cheng <allen-kh.cheng@mediatek.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Reviewed-by: NÃcolas F. R. A. Prado <nfraprado@collabora.com>
+Link: https://lore.kernel.org/r/20221108033209.22751-4-allen-kh.cheng@mediatek.com
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt7986a.dtsi | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt7986a.dtsi b/arch/arm64/boot/dts/mediatek/mt7986a.dtsi
+index 0e9406fc63e2d..0ed5e067928b5 100644
+--- a/arch/arm64/boot/dts/mediatek/mt7986a.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt7986a.dtsi
+@@ -167,8 +167,7 @@ topckgen: topckgen@1001b000 {
+ };
+
+ watchdog: watchdog@1001c000 {
+- compatible = "mediatek,mt7986-wdt",
+- "mediatek,mt6589-wdt";
++ compatible = "mediatek,mt7986-wdt";
+ reg = <0 0x1001c000 0 0x1000>;
+ interrupts = <GIC_SPI 110 IRQ_TYPE_LEVEL_HIGH>;
+ #reset-cells = <1>;
+--
+2.39.2
+
--- /dev/null
+From 3997fbec93e4acec4ce95ee2ed08ad7249679f0e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Dec 2022 16:42:26 +0800
+Subject: arm64: dts: mediatek: mt8183: Fix systimer 13 MHz clock description
+
+From: Chen-Yu Tsai <wenst@chromium.org>
+
+[ Upstream commit ce8a06b5bac75ccce99c0cf91b96b767d64f28a7 ]
+
+The systimer block derives its 13 MHz clock by dividing the main 26 MHz
+oscillator clock by 2 internally, not through the TOPCKGEN clock
+controller.
+
+On the MT8183 this divider is set either by power-on-reset or by the
+bootloader. The bootloader may then make the divider unconfigurable to,
+but can be read out by, the operating system.
+
+Making the systimer block take the 26 MHz clock directly requires
+changing the implementations. As an ABI compatible fix, change the
+input clock of the systimer block a fixed factor divide-by-2 clock
+that takes the 26 MHz oscillator as its input.
+
+Fixes: 5bc8e2875ffb ("arm64: dts: mt8183: add systimer0 device node")
+Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20221201084229.3464449-2-wenst@chromium.org
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8183.dtsi | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8183.dtsi b/arch/arm64/boot/dts/mediatek/mt8183.dtsi
+index 402136bfd5350..268a1f28af8ce 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8183.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8183.dtsi
+@@ -585,6 +585,15 @@ psci {
+ method = "smc";
+ };
+
++ clk13m: fixed-factor-clock-13m {
++ compatible = "fixed-factor-clock";
++ #clock-cells = <0>;
++ clocks = <&clk26m>;
++ clock-div = <2>;
++ clock-mult = <1>;
++ clock-output-names = "clk13m";
++ };
++
+ clk26m: oscillator {
+ compatible = "fixed-clock";
+ #clock-cells = <0>;
+@@ -968,8 +977,7 @@ systimer: timer@10017000 {
+ "mediatek,mt6765-timer";
+ reg = <0 0x10017000 0 0x1000>;
+ interrupts = <GIC_SPI 200 IRQ_TYPE_LEVEL_HIGH>;
+- clocks = <&topckgen CLK_TOP_CLK13M>;
+- clock-names = "clk13m";
++ clocks = <&clk13m>;
+ };
+
+ iommu: iommu@10205000 {
+--
+2.39.2
+
--- /dev/null
+From 046d87e40901de15b21aa6aa9a2d2c4422c077e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Dec 2022 16:42:29 +0800
+Subject: arm64: dts: mediatek: mt8186: Fix systimer 13 MHz clock description
+
+From: Chen-Yu Tsai <wenst@chromium.org>
+
+[ Upstream commit b391efba57ff085233d5ead5e01817bf4b71d999 ]
+
+The systimer block derives its 13 MHz clock by dividing the main 26 MHz
+oscillator clock by 2 internally. The 13 MHz clock is not a separate
+oscillator.
+
+Fix this by making the 13 MHz clock a divide-by-2 fixed factor clock,
+taking its input from the main 26 MHz oscillator.
+
+Fixes: 2e78620b1350 ("arm64: dts: Add MediaTek MT8186 dts and evaluation board and Makefile")
+Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20221201084229.3464449-5-wenst@chromium.org
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8186.dtsi | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8186.dtsi b/arch/arm64/boot/dts/mediatek/mt8186.dtsi
+index c326aeb33a109..857b0c22422f4 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8186.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8186.dtsi
+@@ -214,10 +214,12 @@ l3_0: l3-cache {
+ };
+ };
+
+- clk13m: oscillator-13m {
+- compatible = "fixed-clock";
++ clk13m: fixed-factor-clock-13m {
++ compatible = "fixed-factor-clock";
+ #clock-cells = <0>;
+- clock-frequency = <13000000>;
++ clocks = <&clk26m>;
++ clock-div = <2>;
++ clock-mult = <1>;
+ clock-output-names = "clk13m";
+ };
+
+--
+2.39.2
+
--- /dev/null
+From 091dd9b2c8a48832386091187d5b1bea78fa0559 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Nov 2022 11:32:03 +0800
+Subject: arm64: dts: mediatek: mt8186: Fix watchdog compatible
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+
+[ Upstream commit e5e961628d696237ddc3d53d9d5ac11f43e0bf67 ]
+
+MT8186's watchdog embeds a reset controller and needs only the
+mediatek,mt8186-wdt compatible string as the MT6589 one is there
+for watchdogs that don't have any reset controller capability.
+
+Fixes: 2e78620b1350 ("arm64: dts: Add MediaTek MT8186 dts and evaluation board and Makefile")
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Co-developed-by: Allen-KH Cheng <allen-kh.cheng@mediatek.com>
+Signed-off-by: Allen-KH Cheng <allen-kh.cheng@mediatek.com>
+Reviewed-by: NÃcolas F. R. A. Prado <nfraprado@collabora.com>
+Link: https://lore.kernel.org/r/20221108033209.22751-2-allen-kh.cheng@mediatek.com
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8186.dtsi | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8186.dtsi b/arch/arm64/boot/dts/mediatek/mt8186.dtsi
+index 0d8d2799d86d1..a02bf4ab1504d 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8186.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8186.dtsi
+@@ -333,8 +333,7 @@ pio: pinctrl@10005000 {
+ };
+
+ watchdog: watchdog@10007000 {
+- compatible = "mediatek,mt8186-wdt",
+- "mediatek,mt6589-wdt";
++ compatible = "mediatek,mt8186-wdt";
+ mediatek,disable-extrst;
+ reg = <0 0x10007000 0 0x1000>;
+ #reset-cells = <1>;
+--
+2.39.2
+
--- /dev/null
+From 2ff45773f2cffd27f6907184175461a2eb794d27 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Dec 2022 16:42:27 +0800
+Subject: arm64: dts: mediatek: mt8192: Fix systimer 13 MHz clock description
+
+From: Chen-Yu Tsai <wenst@chromium.org>
+
+[ Upstream commit f19f68e56b0c6631984a9f5023035d4bd09612bb ]
+
+The systimer block derives its 13 MHz clock by dividing the main 26 MHz
+oscillator clock by 2 internally, not through the TOPCKGEN clock
+controller.
+
+On the MT8192 this divider is fixed to /2 and is not configurable.
+
+Making the systimer block take the 26 MHz clock directly requires
+changing the implementations. As an ABI compatible fix, change the
+input clock of the systimer block a fixed factor divide-by-2 clock
+that takes the 26 MHz oscillator as its input.
+
+Fixes: 48489980e27e ("arm64: dts: Add Mediatek SoC MT8192 and evaluation board dts and Makefile")
+Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20221201084229.3464449-3-wenst@chromium.org
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8192.dtsi | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8192.dtsi b/arch/arm64/boot/dts/mediatek/mt8192.dtsi
+index 424fc89cc6f7c..0d43a32734a37 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8192.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8192.dtsi
+@@ -29,6 +29,15 @@ aliases {
+ rdma4 = &rdma4;
+ };
+
++ clk13m: fixed-factor-clock-13m {
++ compatible = "fixed-factor-clock";
++ #clock-cells = <0>;
++ clocks = <&clk26m>;
++ clock-div = <2>;
++ clock-mult = <1>;
++ clock-output-names = "clk13m";
++ };
++
+ clk26m: oscillator0 {
+ compatible = "fixed-clock";
+ #clock-cells = <0>;
+@@ -534,8 +543,7 @@ systimer: timer@10017000 {
+ "mediatek,mt6765-timer";
+ reg = <0 0x10017000 0 0x1000>;
+ interrupts = <GIC_SPI 233 IRQ_TYPE_LEVEL_HIGH 0>;
+- clocks = <&topckgen CLK_TOP_CSW_F26M_D2>;
+- clock-names = "clk13m";
++ clocks = <&clk13m>;
+ };
+
+ pwrap: pwrap@10026000 {
+--
+2.39.2
+
--- /dev/null
+From 36b0d739f78b48534bb8ab2fe5c11eb6f78d6908 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Dec 2022 18:12:02 +0800
+Subject: arm64: dts: mediatek: mt8192: Mark scp_adsp clock as broken
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Chen-Yu Tsai <wenst@chromium.org>
+
+[ Upstream commit 089cd717e6ef03cf9cf7865777d67775de41339b ]
+
+The scp_adsp clock controller is under the SCP_ADSP power domain. This
+power domain is currently not supported nor defined.
+
+Mark the clock controller as broken for now, to avoid the system from
+trying to access it, and causing the CPU or bus to stall.
+
+Fixes: 5d2b897bc6f5 ("arm64: dts: mediatek: Add mt8192 clock controllers")
+Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
+Reviewed-by: NÃcolas F. R. A. Prado <nfraprado@collabora.com>
+Tested-by: NÃcolas F. R. A. Prado <nfraprado@collabora.com>
+Link: https://lore.kernel.org/r/20221229101202.1655924-1-wenst@chromium.org
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8192.dtsi | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8192.dtsi b/arch/arm64/boot/dts/mediatek/mt8192.dtsi
+index 0d43a32734a37..46a1e457fab45 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8192.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8192.dtsi
+@@ -586,6 +586,8 @@ scp_adsp: clock-controller@10720000 {
+ compatible = "mediatek,mt8192-scp_adsp";
+ reg = <0 0x10720000 0 0x1000>;
+ #clock-cells = <1>;
++ /* power domain dependency not upstreamed */
++ status = "fail";
+ };
+
+ uart0: serial@11002000 {
+--
+2.39.2
+
--- /dev/null
+From 9dea6ab261fed592838467f1bad7d81b6748c2ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Dec 2022 14:11:17 +0100
+Subject: arm64: dts: mediatek: mt8195: Add power domain to U3PHY1 T-PHY
+
+From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+
+[ Upstream commit a9f6721a3c92764582ed12296292fda4a7f2dd25 ]
+
+Assign power domain to the U3PHY1 T-PHY in otder to keep this PHY
+alive after unused PD shutdown and to be able to completely cut
+and restore power to it, for example, to save some power during
+system suspend/sleep.
+
+Fixes: 2b515194bf0c ("arm64: dts: mt8195: Add power domains controller")
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20221214131117.108008-2-angelogioacchino.delregno@collabora.com
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8195.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8195.dtsi b/arch/arm64/boot/dts/mediatek/mt8195.dtsi
+index c10cfeb1214d5..d6856691fc385 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8195.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8195.dtsi
+@@ -1549,6 +1549,7 @@ u3phy1: t-phy@11e30000 {
+ #address-cells = <1>;
+ #size-cells = <1>;
+ ranges = <0 0 0x11e30000 0xe00>;
++ power-domains = <&spm MT8195_POWER_DOMAIN_SSUSB_PCIE_PHY>;
+ status = "disabled";
+
+ u2port1: usb-phy@0 {
+--
+2.39.2
+
--- /dev/null
+From 12b9193cc8eddfa6c5d100b0a949364a7915b169 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Dec 2022 16:42:28 +0800
+Subject: arm64: dts: mediatek: mt8195: Fix systimer 13 MHz clock description
+
+From: Chen-Yu Tsai <wenst@chromium.org>
+
+[ Upstream commit 0f1c806b65d136a5fe0b88adad5ff1cb451fc401 ]
+
+The systimer block derives its 13 MHz clock by dividing the main 26 MHz
+oscillator clock by 2 internally, not through the TOPCKGEN clock
+controller.
+
+On the MT8195 this divider is set either by power-on-reset or by the
+bootloader. The bootloader may then make the divider unconfigurable to,
+but can be read out by, the operating system.
+
+Making the systimer block take the 26 MHz clock directly requires
+changing the implementations. As an ABI compatible fix, change the
+input clock of the systimer block a fixed factor divide-by-2 clock
+that takes the 26 MHz oscillator as its input.
+
+Fixes: 37f2582883be ("arm64: dts: Add mediatek SoC mt8195 and evaluation board")
+Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20221201084229.3464449-4-wenst@chromium.org
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8195.dtsi | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8195.dtsi b/arch/arm64/boot/dts/mediatek/mt8195.dtsi
+index d6856691fc385..d8d846a57d97f 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8195.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8195.dtsi
+@@ -248,6 +248,15 @@ sound: mt8195-sound {
+ status = "disabled";
+ };
+
++ clk13m: fixed-factor-clock-13m {
++ compatible = "fixed-factor-clock";
++ #clock-cells = <0>;
++ clocks = <&clk26m>;
++ clock-div = <2>;
++ clock-mult = <1>;
++ clock-output-names = "clk13m";
++ };
++
+ clk26m: oscillator-26m {
+ compatible = "fixed-clock";
+ #clock-cells = <0>;
+@@ -705,7 +714,7 @@ systimer: timer@10017000 {
+ "mediatek,mt6765-timer";
+ reg = <0 0x10017000 0 0x1000>;
+ interrupts = <GIC_SPI 265 IRQ_TYPE_LEVEL_HIGH 0>;
+- clocks = <&topckgen CLK_TOP_CLK26M_D2>;
++ clocks = <&clk13m>;
+ };
+
+ pwrap: pwrap@10024000 {
+--
+2.39.2
+
--- /dev/null
+From 60bcc56a22e6569e35602f88667b832ebfb86955 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Nov 2022 11:32:04 +0800
+Subject: arm64: dts: mediatek: mt8195: Fix watchdog compatible
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+
+[ Upstream commit 02938f460cde0d360dde48056c4d1c0a4bd49230 ]
+
+MT8195's watchdog embeds a reset controller and needs only the
+mediatek,mt8195-wdt compatible string as the MT6589 one is there
+for watchdogs that don't have any reset controller capability.
+
+Fixes: 37f2582883be ("arm64: dts: Add mediatek SoC mt8195 and evaluation board")
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Co-developed-by: Allen-KH Cheng <allen-kh.cheng@mediatek.com>
+Signed-off-by: Allen-KH Cheng <allen-kh.cheng@mediatek.com>
+Reviewed-by: NÃcolas F. R. A. Prado <nfraprado@collabora.com>
+Link: https://lore.kernel.org/r/20221108033209.22751-3-allen-kh.cheng@mediatek.com
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8195.dtsi | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8195.dtsi b/arch/arm64/boot/dts/mediatek/mt8195.dtsi
+index f0bd5754d19d0..c5b8abc0c5854 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8195.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8195.dtsi
+@@ -694,8 +694,7 @@ power-domain@MT8195_POWER_DOMAIN_AUDIO {
+ };
+
+ watchdog: watchdog@10007000 {
+- compatible = "mediatek,mt8195-wdt",
+- "mediatek,mt6589-wdt";
++ compatible = "mediatek,mt8195-wdt";
+ mediatek,disable-extrst;
+ reg = <0 0x10007000 0 0x100>;
+ #reset-cells = <1>;
+--
+2.39.2
+
--- /dev/null
+From 85b7ca324d13cbac3c70c51354f93e6eb111b5c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Jan 2023 22:13:47 +0100
+Subject: arm64: dts: meson-axg: jethub-j1xx: Fix MAC address node names
+
+From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+
+[ Upstream commit 2f66eeb06e3e8b1cac9e9093be3baadbac2709eb ]
+
+Node names should use hyphens instead of underscores to not cause
+warnings.
+
+Fixes: 59ec069d5055 ("arm64: dts: meson-axg: add support for JetHub D1p (j110)")
+Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://lore.kernel.org/r/20230111211350.1461860-4-martin.blumenstingl@googlemail.com
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../boot/dts/amlogic/meson-axg-jethome-jethub-j1xx.dtsi | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/amlogic/meson-axg-jethome-jethub-j1xx.dtsi b/arch/arm64/boot/dts/amlogic/meson-axg-jethome-jethub-j1xx.dtsi
+index 5836b00309312..22fd43b5fd73c 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-axg-jethome-jethub-j1xx.dtsi
++++ b/arch/arm64/boot/dts/amlogic/meson-axg-jethome-jethub-j1xx.dtsi
+@@ -168,15 +168,15 @@ sn: sn@32 {
+ reg = <0x32 0x20>;
+ };
+
+- eth_mac: eth_mac@0 {
++ eth_mac: eth-mac@0 {
+ reg = <0x0 0x6>;
+ };
+
+- bt_mac: bt_mac@6 {
++ bt_mac: bt-mac@6 {
+ reg = <0x6 0x6>;
+ };
+
+- wifi_mac: wifi_mac@c {
++ wifi_mac: wifi-mac@c {
+ reg = <0xc 0x6>;
+ };
+
+--
+2.39.2
+
--- /dev/null
+From f7dc8770fdfbde8807fb3bacbb8fd9be28622ef5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Jan 2023 14:22:17 +0000
+Subject: arm64: dts: meson: bananapi-m5: switch VDDIO_C pin to OPEN_DRAIN
+
+From: Christian Hewitt <christianshewitt@gmail.com>
+
+[ Upstream commit 856968e066bd77b113965f1a355ec7401edff65f ]
+
+For proper warm (re)boot from SD card the BPI-M5 board requires TFLASH_VDD_EN
+and VDDIO_C pins to be switched to high impedance mode. This can be achieved
+using OPEN_DRAIN instead of ACTIVE_HIGH to leave the GPIO pins in input mode
+and retain high state (pin has the pull-up).
+
+This change is inspired by meson-sm1-odroid.dtsi where OPEN_DRAIN has been
+used to resolve similar problems with the Odroid C4 board (TF_IO in the C4
+dts is the equivalent regulator).
+
+Fixes: 976e920183e4 ("arm64: dts: meson-sm1: add Banana PI BPI-M5 board dts")
+Suggested-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Christian Hewitt <christianshewitt@gmail.com>
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://lore.kernel.org/r/20230127142221.3718184-2-christianshewitt@gmail.com
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/amlogic/meson-sm1-bananapi-m5.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/amlogic/meson-sm1-bananapi-m5.dts b/arch/arm64/boot/dts/amlogic/meson-sm1-bananapi-m5.dts
+index 6d0db667581fa..38ebe98ba9c6b 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-sm1-bananapi-m5.dts
++++ b/arch/arm64/boot/dts/amlogic/meson-sm1-bananapi-m5.dts
+@@ -123,7 +123,7 @@ vddio_c: regulator-vddio_c {
+ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <3300000>;
+
+- enable-gpio = <&gpio_ao GPIOE_2 GPIO_ACTIVE_HIGH>;
++ enable-gpio = <&gpio_ao GPIOE_2 GPIO_OPEN_DRAIN>;
+ enable-active-high;
+ regulator-always-on;
+
+--
+2.39.2
+
--- /dev/null
+From 79bbadc6d5c0c27b995d9898d7e62d32f86bc8a4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Jan 2023 22:13:49 +0100
+Subject: arm64: dts: meson-g12a: Fix internal Ethernet PHY unit name
+
+From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+
+[ Upstream commit e7303651bbc76c848007f1cfac1fbeaa65f600d1 ]
+
+Documentation/devicetree/bindings/net/ethernet-phy.yaml defines that the
+node name for Ethernet PHYs should match the following pattern:
+ ^ethernet-phy(@[a-f0-9]+)?$
+
+Replace the underscore with a hyphen to adhere to this binding.
+
+Fixes: 280c17df8fbf ("arm64: dts: meson: g12a: add mdio multiplexer")
+Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://lore.kernel.org/r/20230111211350.1461860-6-martin.blumenstingl@googlemail.com
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi b/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi
+index 7f55d97f6c283..c063a144e0e7b 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi
++++ b/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi
+@@ -1694,7 +1694,7 @@ int_mdio: mdio@1 {
+ #address-cells = <1>;
+ #size-cells = <0>;
+
+- internal_ephy: ethernet_phy@8 {
++ internal_ephy: ethernet-phy@8 {
+ compatible = "ethernet-phy-id0180.3301",
+ "ethernet-phy-ieee802.3-c22";
+ interrupts = <GIC_SPI 9 IRQ_TYPE_LEVEL_HIGH>;
+--
+2.39.2
+
--- /dev/null
+From dc637e1be97d4528f3054b246f4c06b551ca70ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Jan 2023 22:13:48 +0100
+Subject: arm64: dts: meson-gx: Fix Ethernet MAC address unit name
+
+From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+
+[ Upstream commit 8ed5310356bfa47cc6bb4221ae6b21258c52e3d1 ]
+
+Unit names should use hyphens instead of underscores to not cause
+warnings.
+
+Fixes: bfe59f92d306 ("ARM64: dts: amlogic: gxbb: Enable NVMEM")
+Suggested-by: Vyacheslav Bocharov <adeep@lexina.in>
+Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://lore.kernel.org/r/20230111211350.1461860-5-martin.blumenstingl@googlemail.com
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/amlogic/meson-gx.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gx.dtsi b/arch/arm64/boot/dts/amlogic/meson-gx.dtsi
+index 5eed15035b674..4371230b8fe31 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gx.dtsi
++++ b/arch/arm64/boot/dts/amlogic/meson-gx.dtsi
+@@ -233,7 +233,7 @@ sn: sn@14 {
+ reg = <0x14 0x10>;
+ };
+
+- eth_mac: eth_mac@34 {
++ eth_mac: eth-mac@34 {
+ reg = <0x34 0x10>;
+ };
+
+--
+2.39.2
+
--- /dev/null
+From 48aceda1836f00a4e11e919c23f79d27c4930a90 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Jan 2023 22:13:50 +0100
+Subject: arm64: dts: meson-gx: Fix the SCPI DVFS node name and unit address
+
+From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+
+[ Upstream commit f189c869ad92787ddd753558bcbae89d75825bb6 ]
+
+Node names should be generic and use hyphens instead of underscores to
+not cause warnings. Also nodes without a reg property should not have a
+unit-address. Change the scpi_dvfs node to use clock-controller as node
+name without a unit address (since it does not have a reg property).
+
+Fixes: 70db166a2baa ("ARM64: dts: meson-gxbb: Add SCPI with cpufreq & sensors Nodes")
+Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://lore.kernel.org/r/20230111211350.1461860-7-martin.blumenstingl@googlemail.com
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/amlogic/meson-gx.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gx.dtsi b/arch/arm64/boot/dts/amlogic/meson-gx.dtsi
+index 4371230b8fe31..09a016fd828aa 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gx.dtsi
++++ b/arch/arm64/boot/dts/amlogic/meson-gx.dtsi
+@@ -250,7 +250,7 @@ scpi {
+ scpi_clocks: clocks {
+ compatible = "arm,scpi-clocks";
+
+- scpi_dvfs: scpi_clocks@0 {
++ scpi_dvfs: clock-controller {
+ compatible = "arm,scpi-dvfs-clocks";
+ #clock-cells = <1>;
+ clock-indices = <0>;
+--
+2.39.2
+
--- /dev/null
+From 8634ab6d7fb4a7060bb78f111cad4e2743a7907a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Jan 2023 22:13:46 +0100
+Subject: arm64: dts: meson-gxl: jethub-j80: Fix Bluetooth MAC node name
+
+From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+
+[ Upstream commit cb199de1d3aecb02556d8a6e26393015effa0a9f ]
+
+Node names should use hyphens instead of underscores to not cause
+warnings.
+
+Fixes: abfaae24ecf3 ("arm64: dts: meson-gxl: add support for JetHub H1")
+Suggested-by: Vyacheslav Bocharov <adeep@lexina.in>
+Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://lore.kernel.org/r/20230111211350.1461860-3-martin.blumenstingl@googlemail.com
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../boot/dts/amlogic/meson-gxl-s905w-jethome-jethub-j80.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905w-jethome-jethub-j80.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905w-jethome-jethub-j80.dts
+index 270483e007bc8..bb7412070cb26 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905w-jethome-jethub-j80.dts
++++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905w-jethome-jethub-j80.dts
+@@ -86,7 +86,7 @@ sdio_pwrseq: sdio-pwrseq {
+ };
+
+ &efuse {
+- bt_mac: bt_mac@6 {
++ bt_mac: bt-mac@6 {
+ reg = <0x6 0x6>;
+ };
+
+--
+2.39.2
+
--- /dev/null
+From 02a992ee356c3bb0f7d9bc50939f04619ca138ff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Jan 2023 22:13:45 +0100
+Subject: arm64: dts: meson-gxl: jethub-j80: Fix WiFi MAC address node
+
+From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+
+[ Upstream commit f95acdb2b4af21caae2c76a48e565158181386ca ]
+
+Unit addresses should be written using lower-case hex characters. Use
+wifi_mac@c to fix a yaml schema validation error once the eFuse
+dt-bindings have been converted to a yaml schema:
+ efuse: Unevaluated properties are not allowed ('wifi_mac@C' was
+ unexpected)
+
+Also node names should use hyphens instead of underscores as the latter
+can also cause warnings.
+
+Fixes: abfaae24ecf3 ("arm64: dts: meson-gxl: add support for JetHub H1")
+Acked-by: Vyacheslav Bocharov <adeep@lexina.in>
+Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://lore.kernel.org/r/20230111211350.1461860-2-martin.blumenstingl@googlemail.com
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../boot/dts/amlogic/meson-gxl-s905w-jethome-jethub-j80.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905w-jethome-jethub-j80.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905w-jethome-jethub-j80.dts
+index 6831137c5c109..270483e007bc8 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905w-jethome-jethub-j80.dts
++++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905w-jethome-jethub-j80.dts
+@@ -90,7 +90,7 @@ bt_mac: bt_mac@6 {
+ reg = <0x6 0x6>;
+ };
+
+- wifi_mac: wifi_mac@C {
++ wifi_mac: wifi-mac@c {
+ reg = <0xc 0x6>;
+ };
+ };
+--
+2.39.2
+
--- /dev/null
+From 4f6a6c318ede402df9af25823728d48d5c8fd6f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Jan 2023 10:39:13 +0000
+Subject: arm64: dts: meson: radxa-zero: allow usb otg mode
+
+From: Christian Hewitt <christianshewitt@gmail.com>
+
+[ Upstream commit ce43ea00b927805c1fd0450ccc9b4b6069e292c5 ]
+
+Setting dr_mode to "host" prevents otg which can be useful on a board
+with limited connectivity options. So don't force host mode.
+
+Fixes: 26d1400f7457 ("arm64: dts: amlogic: add support for Radxa Zero")
+Signed-off-by: Christian Hewitt <christianshewitt@gmail.com>
+Acked-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://lore.kernel.org/r/20230127103913.3386435-1-christianshewitt@gmail.com
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/amlogic/meson-g12a-radxa-zero.dts | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/amlogic/meson-g12a-radxa-zero.dts b/arch/arm64/boot/dts/amlogic/meson-g12a-radxa-zero.dts
+index e3bb6df42ff3e..cf0a9be83fc47 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-g12a-radxa-zero.dts
++++ b/arch/arm64/boot/dts/amlogic/meson-g12a-radxa-zero.dts
+@@ -401,5 +401,4 @@ &uart_AO {
+
+ &usb {
+ status = "okay";
+- dr_mode = "host";
+ };
+--
+2.39.2
+
--- /dev/null
+From eabdcc7e412877296625d45757d2a7868cc3dfa4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Jan 2023 05:30:31 +0000
+Subject: arm64: dts: meson: remove CPU opps below 1GHz for G12A boards
+
+From: Christian Hewitt <christianshewitt@gmail.com>
+
+[ Upstream commit 3cbd431c2b34d84605d358c8c57654193fd661fb ]
+
+Amlogic G12A devices experience CPU stalls and random board wedges when
+the system idles and CPU cores clock down to lower opp points. Recent
+vendor kernels include a change to remove 100-250MHz and other distro
+sources also remove the 500/667MHz points. Unless all 100-667Mhz opps
+are removed or the CPU governor forced to performance stalls are still
+observed, so let's remove them to improve stability and uptime.
+
+Fixes: b190056fa9ee ("arm64: dts: meson-g12a: add cpus OPP table")
+Signed-off-by: Christian Hewitt <christianshewitt@gmail.com>
+Link: https://lore.kernel.org/r/20230119053031.21400-1-christianshewitt@gmail.com
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/amlogic/meson-g12a.dtsi | 20 --------------------
+ 1 file changed, 20 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/amlogic/meson-g12a.dtsi b/arch/arm64/boot/dts/amlogic/meson-g12a.dtsi
+index 7677764eeee6e..f58fd2a6fe61c 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-g12a.dtsi
++++ b/arch/arm64/boot/dts/amlogic/meson-g12a.dtsi
+@@ -58,26 +58,6 @@ cpu_opp_table: opp-table {
+ compatible = "operating-points-v2";
+ opp-shared;
+
+- opp-100000000 {
+- opp-hz = /bits/ 64 <100000000>;
+- opp-microvolt = <731000>;
+- };
+-
+- opp-250000000 {
+- opp-hz = /bits/ 64 <250000000>;
+- opp-microvolt = <731000>;
+- };
+-
+- opp-500000000 {
+- opp-hz = /bits/ 64 <500000000>;
+- opp-microvolt = <731000>;
+- };
+-
+- opp-667000000 {
+- opp-hz = /bits/ 64 <666666666>;
+- opp-microvolt = <731000>;
+- };
+-
+ opp-1000000000 {
+ opp-hz = /bits/ 64 <1000000000>;
+ opp-microvolt = <731000>;
+--
+2.39.2
+
--- /dev/null
+From 7b2faf3a9592427b78ef506858b9a2f130ed9cb3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Jan 2023 11:35:23 +0100
+Subject: arm64: dts: mt8186: Fix CPU map for single-cluster SoC
+
+From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+
+[ Upstream commit 1c473804b0c8a68c6ef2cf519b38ec6725ca4aa5 ]
+
+MT8186 features the ARM DynamIQ technology and combines both two
+Cortex-A76 (big) and six Cortex-A55 (LITTLE) CPUs in one cluster:
+fix the CPU map to reflect that.
+
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Fixes: 2e78620b1350 ("arm64: dts: Add MediaTek MT8186 dts and evaluation board and Makefile")
+Link: https://lore.kernel.org/r/20230126103526.417039-4-angelogioacchino.delregno@collabora.com
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8186.dtsi | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8186.dtsi b/arch/arm64/boot/dts/mediatek/mt8186.dtsi
+index 857b0c22422f4..0d8d2799d86d1 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8186.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8186.dtsi
+@@ -47,14 +47,12 @@ core4 {
+ core5 {
+ cpu = <&cpu5>;
+ };
+- };
+
+- cluster1 {
+- core0 {
++ core6 {
+ cpu = <&cpu6>;
+ };
+
+- core1 {
++ core7 {
+ cpu = <&cpu7>;
+ };
+ };
+--
+2.39.2
+
--- /dev/null
+From 233cc3f5f21450b6240ee59be9ef3f5dc6608c84 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Jan 2023 11:35:22 +0100
+Subject: arm64: dts: mt8192: Fix CPU map for single-cluster SoC
+
+From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+
+[ Upstream commit 160ce54d635455ffb5e9b42c5ba9cb9aaa98cdb2 ]
+
+MT8192 features the ARM DynamIQ technology and combines both four
+Cortex-A76 (big) and four Cortex-A55 (LITTLE) CPUs in one cluster:
+fix the CPU map to reflect that.
+
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Fixes: 48489980e27e ("arm64: dts: Add Mediatek SoC MT8192 and evaluation board dts and Makefile")
+Link: https://lore.kernel.org/r/20230126103526.417039-3-angelogioacchino.delregno@collabora.com
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8192.dtsi | 11 ++++-------
+ 1 file changed, 4 insertions(+), 7 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8192.dtsi b/arch/arm64/boot/dts/mediatek/mt8192.dtsi
+index 46a1e457fab45..627e3bf1c544b 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8192.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8192.dtsi
+@@ -158,19 +158,16 @@ core2 {
+ core3 {
+ cpu = <&cpu3>;
+ };
+- };
+-
+- cluster1 {
+- core0 {
++ core4 {
+ cpu = <&cpu4>;
+ };
+- core1 {
++ core5 {
+ cpu = <&cpu5>;
+ };
+- core2 {
++ core6 {
+ cpu = <&cpu6>;
+ };
+- core3 {
++ core7 {
+ cpu = <&cpu7>;
+ };
+ };
+--
+2.39.2
+
--- /dev/null
+From bb82ffa002d5270c76cc972d6adb69a4abe7bf11 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Jan 2023 11:35:21 +0100
+Subject: arm64: dts: mt8195: Fix CPU map for single-cluster SoC
+
+From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+
+[ Upstream commit cc4f0b13a887b483faa45084616998a21b63889d ]
+
+MT8195 features the ARM DynamIQ technology and combines both four
+Cortex-A78 (big) and four Cortex-A55 (LITTLE) CPUs in one cluster:
+fix the CPU map to reflect that.
+
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Fixes: 37f2582883be ("arm64: dts: Add mediatek SoC mt8195 and evaluation board")
+Link: https://lore.kernel.org/r/20230126103526.417039-2-angelogioacchino.delregno@collabora.com
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8195.dtsi | 10 ++++------
+ 1 file changed, 4 insertions(+), 6 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8195.dtsi b/arch/arm64/boot/dts/mediatek/mt8195.dtsi
+index d8d846a57d97f..f0bd5754d19d0 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8195.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8195.dtsi
+@@ -151,22 +151,20 @@ core2 {
+ core3 {
+ cpu = <&cpu3>;
+ };
+- };
+
+- cluster1 {
+- core0 {
++ core4 {
+ cpu = <&cpu4>;
+ };
+
+- core1 {
++ core5 {
+ cpu = <&cpu5>;
+ };
+
+- core2 {
++ core6 {
+ cpu = <&cpu6>;
+ };
+
+- core3 {
++ core7 {
+ cpu = <&cpu7>;
+ };
+ };
+--
+2.39.2
+
--- /dev/null
+From d2533009d3fb08342e58894c0d14c7e7784859a1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Jan 2023 17:44:43 +0100
+Subject: arm64: dts: qcom: ipq8074: correct Gen2 PCIe ranges
+
+From: Robert Marko <robimarko@gmail.com>
+
+[ Upstream commit 2055cb7dccea16bafa3adf9c5e3216949512c34a ]
+
+Current ranges property set in Gen2 PCIe node is incorrect, replace it
+with the downstream 5.4 QCA kernel value.
+
+Fixes: 33057e1672fe ("ARM: dts: ipq8074: Add pcie nodes")
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230113164449.906002-3-robimarko@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/ipq8074.dtsi | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/ipq8074.dtsi b/arch/arm64/boot/dts/qcom/ipq8074.dtsi
+index f099785facf39..df16ef5a90bb5 100644
+--- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi
++++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi
+@@ -773,9 +773,9 @@ pcie1: pci@10000000 {
+ phy-names = "pciephy";
+
+ ranges = <0x81000000 0 0x10200000 0x10200000
+- 0 0x100000 /* downstream I/O */
+- 0x82000000 0 0x10300000 0x10300000
+- 0 0xd00000>; /* non-prefetchable memory */
++ 0 0x10000>, /* downstream I/O */
++ <0x82000000 0 0x10220000 0x10220000
++ 0 0xfde0000>; /* non-prefetchable memory */
+
+ interrupts = <GIC_SPI 85 IRQ_TYPE_LEVEL_HIGH>;
+ interrupt-names = "msi";
+--
+2.39.2
+
--- /dev/null
+From 3ce18fe29013718a7023c0a6ec71ca14c1408bb8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Jan 2023 17:44:49 +0100
+Subject: arm64: dts: qcom: ipq8074: correct PCIe QMP PHY output clock names
+
+From: Robert Marko <robimarko@gmail.com>
+
+[ Upstream commit 0e8b90c0256cf9c9589e2cee517dedc987a34355 ]
+
+Current PCIe QMP PHY output name were changed in ("arm64: dts: qcom: Fix
+IPQ8074 PCIe PHY nodes") however it did not account for the fact that GCC
+driver is relying on the old names to match them as they are being used as
+the parent for the gcc_pcie0_pipe_clk and gcc_pcie1_pipe_clk.
+
+This broke parenting as GCC could not find the parent clock, so fix it by
+changing to the names that driver is expecting.
+
+Fixes: 942bcd33ed45 ("arm64: dts: qcom: Fix IPQ8074 PCIe PHY nodes")
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230113164449.906002-9-robimarko@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/ipq8074.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/ipq8074.dtsi b/arch/arm64/boot/dts/qcom/ipq8074.dtsi
+index e38aa76e54096..4294beeb494fd 100644
+--- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi
++++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi
+@@ -222,7 +222,7 @@ pcie_phy0: phy@84200 {
+ #clock-cells = <0>;
+ clocks = <&gcc GCC_PCIE0_PIPE_CLK>;
+ clock-names = "pipe0";
+- clock-output-names = "pcie_0_pipe_clk";
++ clock-output-names = "pcie20_phy0_pipe_clk";
+ };
+ };
+
+@@ -250,7 +250,7 @@ pcie_phy1: phy@8e200 {
+ #clock-cells = <0>;
+ clocks = <&gcc GCC_PCIE1_PIPE_CLK>;
+ clock-names = "pipe0";
+- clock-output-names = "pcie_1_pipe_clk";
++ clock-output-names = "pcie20_phy1_pipe_clk";
+ };
+ };
+
+--
+2.39.2
+
--- /dev/null
+From 05772c78b658fd1f27c433b52dab976e5151de5f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 8 Jan 2023 14:04:40 +0100
+Subject: arm64: dts: qcom: ipq8074: correct USB3 QMP PHY-s clock output names
+
+From: Robert Marko <robimarko@gmail.com>
+
+[ Upstream commit 877cff3568c0f54511d77918ae16b2d6e9a0dfce ]
+
+It seems that clock-output-names for the USB3 QMP PHY-s where set without
+actually checking what is the GCC clock driver expecting, so clock core
+could never actually find the parents for usb0_pipe_clk_src and
+usb1_pipe_clk_src clocks in the GCC driver.
+
+So, correct the names to be what the driver expects so that parenting
+works.
+
+Before:
+gcc_usb0_pipe_clk_src 0 0 0 125000000 0 0 50000 Y
+gcc_usb1_pipe_clk_src 0 0 0 125000000 0 0 50000 Y
+
+After:
+ usb3phy_0_cc_pipe_clk 1 1 0 125000000 0 0 50000 Y
+ usb0_pipe_clk_src 1 1 0 125000000 0 0 50000 Y
+ gcc_usb0_pipe_clk 1 1 0 125000000 0 0 50000 Y
+ usb3phy_1_cc_pipe_clk 1 1 0 125000000 0 0 50000 Y
+ usb1_pipe_clk_src 1 1 0 125000000 0 0 50000 Y
+ gcc_usb1_pipe_clk 1 1 0 125000000 0 0 50000 Y
+
+Fixes: 5e09bc51d07b ("arm64: dts: ipq8074: enable USB support")
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230108130440.670181-2-robimarko@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/ipq8074.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/ipq8074.dtsi b/arch/arm64/boot/dts/qcom/ipq8074.dtsi
+index 4e51d8e3df043..9dcb48ebc4661 100644
+--- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi
++++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi
+@@ -137,7 +137,7 @@ usb1_ssphy: phy@58200 {
+ #clock-cells = <0>;
+ clocks = <&gcc GCC_USB1_PIPE_CLK>;
+ clock-names = "pipe0";
+- clock-output-names = "gcc_usb1_pipe_clk_src";
++ clock-output-names = "usb3phy_1_cc_pipe_clk";
+ };
+ };
+
+@@ -180,7 +180,7 @@ usb0_ssphy: phy@78200 {
+ #clock-cells = <0>;
+ clocks = <&gcc GCC_USB0_PIPE_CLK>;
+ clock-names = "pipe0";
+- clock-output-names = "gcc_usb0_pipe_clk_src";
++ clock-output-names = "usb3phy_0_cc_pipe_clk";
+ };
+ };
+
+--
+2.39.2
+
--- /dev/null
+From 0f0554462ea58bd6e69074b1d2b926374e203c47 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Jan 2023 17:44:41 +0100
+Subject: arm64: dts: qcom: ipq8074: fix Gen2 PCIe QMP PHY
+
+From: Robert Marko <robimarko@gmail.com>
+
+[ Upstream commit 100d9c94ccf15b02742c326cd04f422ab729153b ]
+
+Serdes register space sizes are incorrect, update them to match the
+actual sizes from downstream QCA 5.4 kernel.
+
+Fixes: 942bcd33ed45 ("arm64: dts: qcom: Fix IPQ8074 PCIe PHY nodes")
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230113164449.906002-1-robimarko@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/ipq8074.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/ipq8074.dtsi b/arch/arm64/boot/dts/qcom/ipq8074.dtsi
+index 9dcb48ebc4661..90b0abf8bbbcd 100644
+--- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi
++++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi
+@@ -242,9 +242,9 @@ pcie_qmp1: phy@8e000 {
+ status = "disabled";
+
+ pcie_phy1: phy@8e200 {
+- reg = <0x8e200 0x16c>,
++ reg = <0x8e200 0x130>,
+ <0x8e400 0x200>,
+- <0x8e800 0x4f4>;
++ <0x8e800 0x1f8>;
+ #phy-cells = <0>;
+ #clock-cells = <0>;
+ clocks = <&gcc GCC_PCIE1_PIPE_CLK>;
+--
+2.39.2
+
--- /dev/null
+From d65d8af79cf87fd2a6fff5aed409e7542dfc2fa0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Jan 2023 17:44:48 +0100
+Subject: arm64: dts: qcom: ipq8074: fix Gen3 PCIe node
+
+From: Robert Marko <robimarko@gmail.com>
+
+[ Upstream commit 3e83a9c41ab0244a45a4a2800b9adb8de0d15f82 ]
+
+IPQ8074 comes in 2 silicon versions:
+* v1 with 2x Gen2 PCIe ports and QMP PHY-s
+* v2 with 1x Gen3 and 1x Gen2 PCIe ports and QMP PHY-s
+
+v2 is the final and production version that is actually supported by the
+kernel, however it looks like PCIe related nodes were added for the v1 SoC.
+
+Finish the PCIe fixup by using the correct compatible, adding missing ATU
+register space, declaring max-link-speed, use correct ranges, add missing
+clocks and resets.
+
+Fixes: 33057e1672fe ("ARM: dts: ipq8074: Add pcie nodes")
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230113164449.906002-8-robimarko@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/ipq8074.dtsi | 30 +++++++++++++++------------
+ 1 file changed, 17 insertions(+), 13 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/ipq8074.dtsi b/arch/arm64/boot/dts/qcom/ipq8074.dtsi
+index df16ef5a90bb5..e38aa76e54096 100644
+--- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi
++++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi
+@@ -818,16 +818,18 @@ IRQ_TYPE_LEVEL_HIGH>, /* int_c */
+ };
+
+ pcie0: pci@20000000 {
+- compatible = "qcom,pcie-ipq8074";
++ compatible = "qcom,pcie-ipq8074-gen3";
+ reg = <0x20000000 0xf1d>,
+ <0x20000f20 0xa8>,
+- <0x00080000 0x2000>,
++ <0x20001000 0x1000>,
++ <0x00080000 0x4000>,
+ <0x20100000 0x1000>;
+- reg-names = "dbi", "elbi", "parf", "config";
++ reg-names = "dbi", "elbi", "atu", "parf", "config";
+ device_type = "pci";
+ linux,pci-domain = <0>;
+ bus-range = <0x00 0xff>;
+ num-lanes = <1>;
++ max-link-speed = <3>;
+ #address-cells = <3>;
+ #size-cells = <2>;
+
+@@ -835,9 +837,9 @@ pcie0: pci@20000000 {
+ phy-names = "pciephy";
+
+ ranges = <0x81000000 0 0x20200000 0x20200000
+- 0 0x100000 /* downstream I/O */
+- 0x82000000 0 0x20300000 0x20300000
+- 0 0xd00000>; /* non-prefetchable memory */
++ 0 0x10000>, /* downstream I/O */
++ <0x82000000 0 0x20220000 0x20220000
++ 0 0xfde0000>; /* non-prefetchable memory */
+
+ interrupts = <GIC_SPI 52 IRQ_TYPE_LEVEL_HIGH>;
+ interrupt-names = "msi";
+@@ -855,28 +857,30 @@ IRQ_TYPE_LEVEL_HIGH>, /* int_c */
+ clocks = <&gcc GCC_SYS_NOC_PCIE0_AXI_CLK>,
+ <&gcc GCC_PCIE0_AXI_M_CLK>,
+ <&gcc GCC_PCIE0_AXI_S_CLK>,
+- <&gcc GCC_PCIE0_AHB_CLK>,
+- <&gcc GCC_PCIE0_AUX_CLK>;
+-
++ <&gcc GCC_PCIE0_AXI_S_BRIDGE_CLK>,
++ <&gcc GCC_PCIE0_RCHNG_CLK>;
+ clock-names = "iface",
+ "axi_m",
+ "axi_s",
+- "ahb",
+- "aux";
++ "axi_bridge",
++ "rchng";
++
+ resets = <&gcc GCC_PCIE0_PIPE_ARES>,
+ <&gcc GCC_PCIE0_SLEEP_ARES>,
+ <&gcc GCC_PCIE0_CORE_STICKY_ARES>,
+ <&gcc GCC_PCIE0_AXI_MASTER_ARES>,
+ <&gcc GCC_PCIE0_AXI_SLAVE_ARES>,
+ <&gcc GCC_PCIE0_AHB_ARES>,
+- <&gcc GCC_PCIE0_AXI_MASTER_STICKY_ARES>;
++ <&gcc GCC_PCIE0_AXI_MASTER_STICKY_ARES>,
++ <&gcc GCC_PCIE0_AXI_SLAVE_STICKY_ARES>;
+ reset-names = "pipe",
+ "sleep",
+ "sticky",
+ "axi_m",
+ "axi_s",
+ "ahb",
+- "axi_m_sticky";
++ "axi_m_sticky",
++ "axi_s_sticky";
+ status = "disabled";
+ };
+ };
+--
+2.39.2
+
--- /dev/null
+From d9bda2809b7e2657bfb23c853ffcd56cb29e7770 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Jan 2023 17:44:42 +0100
+Subject: arm64: dts: qcom: ipq8074: fix Gen3 PCIe QMP PHY
+
+From: Robert Marko <robimarko@gmail.com>
+
+[ Upstream commit 7ba33591b45f9d547a317e42f1c2acd19c925eb6 ]
+
+IPQ8074 comes in 2 silicon versions:
+* v1 with 2x Gen2 PCIe ports and QMP PHY-s
+* v2 with 1x Gen3 and 1x Gen2 PCIe ports and QMP PHY-s
+
+v2 is the final and production version that is actually supported by the
+kernel, however it looks like PCIe related nodes were added for the v1 SoC.
+
+Now that we have Gen3 QMP PHY support, we can start fixing the PCIe support
+by fixing the Gen3 QMP PHY node first.
+
+Change the compatible to the Gen3 QMP PHY, correct the register space start
+and size, add the missing misc PCS register space.
+
+Fixes: 33057e1672fe ("ARM: dts: ipq8074: Add pcie nodes")
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230113164449.906002-2-robimarko@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/ipq8074.dtsi | 15 ++++++++-------
+ 1 file changed, 8 insertions(+), 7 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/ipq8074.dtsi b/arch/arm64/boot/dts/qcom/ipq8074.dtsi
+index 90b0abf8bbbcd..f099785facf39 100644
+--- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi
++++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi
+@@ -197,9 +197,9 @@ qusb_phy_0: phy@79000 {
+ status = "disabled";
+ };
+
+- pcie_qmp0: phy@86000 {
+- compatible = "qcom,ipq8074-qmp-pcie-phy";
+- reg = <0x00086000 0x1c4>;
++ pcie_qmp0: phy@84000 {
++ compatible = "qcom,ipq8074-qmp-gen3-pcie-phy";
++ reg = <0x00084000 0x1bc>;
+ #address-cells = <1>;
+ #size-cells = <1>;
+ ranges;
+@@ -213,10 +213,11 @@ pcie_qmp0: phy@86000 {
+ "common";
+ status = "disabled";
+
+- pcie_phy0: phy@86200 {
+- reg = <0x86200 0x16c>,
+- <0x86400 0x200>,
+- <0x86800 0x4f4>;
++ pcie_phy0: phy@84200 {
++ reg = <0x84200 0x16c>,
++ <0x84400 0x200>,
++ <0x84800 0x1f0>,
++ <0x84c00 0xf4>;
+ #phy-cells = <0>;
+ #clock-cells = <0>;
+ clocks = <&gcc GCC_PCIE0_PIPE_CLK>;
+--
+2.39.2
+
--- /dev/null
+From 45ce4081cfad422d2d7a16144a062245d26ac2c4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Feb 2023 11:44:51 +0100
+Subject: arm64: dts: qcom: msm8953: correct TLMM gpio-ranges
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit a4fb71497df23cb0d02d70fa2b8f8786328e325d ]
+
+Correct the number of GPIOs in TLMM pin controller.
+
+Fixes: 9fb08c801923 ("arm64: dts: qcom: Add MSM8953 device tree")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: Luca Weiss <luca@z3ntu.xyz>
+Acked-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230202104452.299048-10-krzysztof.kozlowski@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/msm8953.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/msm8953.dtsi b/arch/arm64/boot/dts/qcom/msm8953.dtsi
+index 32349174c4bd9..70f033656b555 100644
+--- a/arch/arm64/boot/dts/qcom/msm8953.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8953.dtsi
+@@ -455,7 +455,7 @@ tlmm: pinctrl@1000000 {
+ reg = <0x1000000 0x300000>;
+ interrupts = <GIC_SPI 208 IRQ_TYPE_LEVEL_HIGH>;
+ gpio-controller;
+- gpio-ranges = <&tlmm 0 0 155>;
++ gpio-ranges = <&tlmm 0 0 142>;
+ #gpio-cells = <2>;
+ interrupt-controller;
+ #interrupt-cells = <2>;
+--
+2.39.2
+
--- /dev/null
+From 3b2f67e9a72674ef95a46864fad9176831f83f72 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 1 Jan 2023 21:40:29 +0200
+Subject: arm64: dts: qcom: msm8956: use SoC-specific compat for tsens
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit 0b3aa9aa629c10928e86f6c9666a5e0b14655b2a ]
+
+The slope values used during tsens calibration differ between msm8976
+and msm8956 SoCs. Use SoC-specific compat value for the msm8956 SoC.
+
+Fixes: 0484d3ce0902 ("arm64: dts: qcom: Add DTS for MSM8976 and MSM8956 SoCs")
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230101194034.831222-16-dmitry.baryshkov@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/msm8956.dtsi | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/qcom/msm8956.dtsi b/arch/arm64/boot/dts/qcom/msm8956.dtsi
+index e432512d8716a..668e05185c21e 100644
+--- a/arch/arm64/boot/dts/qcom/msm8956.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8956.dtsi
+@@ -12,6 +12,10 @@ &pmu {
+ interrupts = <GIC_PPI 7 (GIC_CPU_MASK_SIMPLE(6) | IRQ_TYPE_LEVEL_HIGH)>;
+ };
+
++&tsens {
++ compatible = "qcom,msm8956-tsens", "qcom,tsens-v1";
++};
++
+ /*
+ * You might be wondering.. why is it so empty out there?
+ * Well, the SoCs are almost identical.
+--
+2.39.2
+
--- /dev/null
+From 6bd515fbcc034338ddd220fceea38dd105d651e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Dec 2022 19:54:39 +0100
+Subject: arm64: dts: qcom: msm8992-bullhead: Disable dfps_data_mem
+
+From: Petr Vorel <petr.vorel@gmail.com>
+
+[ Upstream commit 4dee5aa44b924036511a744ceb3abb1ceeb96bb6 ]
+
+It's disabled on downstream [1] thus not shown on downstream dmesg.
+
+Removing it fixes warnings on v6.1:
+
+[ 0.000000] OF: reserved mem: OVERLAP DETECTED!
+[ 0.000000] dfps_data_mem@3400000 (0x0000000003400000--0x0000000003401000) overlaps with memory@3400000 (0x0000000003400000--0x0000000004600000)
+
+[1] https://android.googlesource.com/kernel/msm.git/+/android-7.0.0_r0.17/arch/arm64/boot/dts/lge/msm8992-bullhead.dtsi#137
+
+Fixes: 976d321f32dc ("arm64: dts: qcom: msm8992: Make the DT an overlay on top of 8994")
+
+Signed-off-by: Petr Vorel <petr.vorel@gmail.com>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20221226185440.440968-3-pevik@seznam.cz
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/msm8992-lg-bullhead.dtsi | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/qcom/msm8992-lg-bullhead.dtsi b/arch/arm64/boot/dts/qcom/msm8992-lg-bullhead.dtsi
+index 123ec67fb385a..4bceb362a5c02 100644
+--- a/arch/arm64/boot/dts/qcom/msm8992-lg-bullhead.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8992-lg-bullhead.dtsi
+@@ -15,6 +15,9 @@
+ /* cont_splash_mem has different memory mapping */
+ /delete-node/ &cont_splash_mem;
+
++/* disabled on downstream, conflicts with cont_splash_mem */
++/delete-node/ &dfps_data_mem;
++
+ / {
+ model = "LG Nexus 5X";
+ compatible = "lg,bullhead", "qcom,msm8992";
+--
+2.39.2
+
--- /dev/null
+From f78c68dde3fb9de6cf55df4211221bcec35b1dfe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Dec 2022 19:54:38 +0100
+Subject: arm64: dts: qcom: msm8992-bullhead: Fix cont_splash_mem size
+
+From: Petr Vorel <petr.vorel@gmail.com>
+
+[ Upstream commit 26a91359aea4d89e7d3646d806eed0f3755b74bd ]
+
+Original google firmware reports 12 MiB:
+[ 0.000000] cma: Found cont_splash_mem@0, memory base 0x0000000003400000, size 12 MiB, limit 0xffffffffffffffff
+
+which is actually 12*1024*1024 = 0xc00000.
+
+This matches the aosp source [1]:
+&cont_splash_mem {
+ reg = <0 0x03400000 0 0xc00000>;
+};
+
+Fixes: 3cb6a271f4b0 ("arm64: dts: qcom: msm8992-bullhead: Fix cont_splash_mem mapping")
+Fixes: 976d321f32dc ("arm64: dts: qcom: msm8992: Make the DT an overlay on top of 8994")
+
+[1] https://android.googlesource.com/kernel/msm.git/+/android-7.0.0_r0.17/arch/arm64/boot/dts/lge/msm8992-bullhead.dtsi#141
+
+Signed-off-by: Petr Vorel <petr.vorel@gmail.com>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20221226185440.440968-2-pevik@seznam.cz
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/msm8992-lg-bullhead.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/msm8992-lg-bullhead.dtsi b/arch/arm64/boot/dts/qcom/msm8992-lg-bullhead.dtsi
+index 79de9cc395c4c..123ec67fb385a 100644
+--- a/arch/arm64/boot/dts/qcom/msm8992-lg-bullhead.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8992-lg-bullhead.dtsi
+@@ -2,7 +2,7 @@
+ /*
+ * Copyright (c) 2015, LGE Inc. All rights reserved.
+ * Copyright (c) 2016, The Linux Foundation. All rights reserved.
+- * Copyright (c) 2021, Petr Vorel <petr.vorel@gmail.com>
++ * Copyright (c) 2021-2022, Petr Vorel <petr.vorel@gmail.com>
+ * Copyright (c) 2022, Dominik Kobinski <dominikkobinski314@gmail.com>
+ */
+
+@@ -49,7 +49,7 @@ ramoops@1ff00000 {
+ };
+
+ cont_splash_mem: memory@3400000 {
+- reg = <0 0x03400000 0 0x1200000>;
++ reg = <0 0x03400000 0 0xc00000>;
+ no-map;
+ };
+
+--
+2.39.2
+
--- /dev/null
+From d7ff9e8b1f0951af2fa8f3301bea062ca5f7a0ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Feb 2023 16:48:19 +1100
+Subject: arm64: dts: qcom: msm8992-lg-bullhead: Correct memory overlaps with
+ the SMEM and MPSS memory regions
+
+From: Jamie Douglass <jamiemdouglass@gmail.com>
+
+[ Upstream commit d44106883d74992343710f18c4aaae937c7cefab ]
+
+The memory region reserved by a previous commit (see fixes tag below)
+overlaps with the SMEM and MPSS memory regions, causing error messages in
+dmesg:
+ OF: reserved mem: OVERLAP DETECTED!
+ reserved@5000000 (0x0000000005000000--0x0000000007200000)
+ overlaps with smem_region@6a00000
+ (0x0000000006a00000--0x0000000006c00000)
+
+ OF: reserved mem: OVERLAP DETECTED!
+ reserved@6c00000 (0x0000000006c00000--0x0000000007200000)
+ overlaps with memory@7000000
+ (0x0000000007000000--0x000000000ca00000)
+
+This patch resolves both of these by splitting the previously reserved
+memory region into two sections either side of the SMEM region and by
+cutting off the second memory region to 0x7000000.
+
+Fixes: 22c7e1a0fa45 ("arm64: dts: msm8992-bullhead: add memory hole region")
+Signed-off-by: Jamie Douglass <jamiemdouglass@gmail.com>
+Reviewed-by: Petr Vorel <pvorel@suse.cz>
+Tested-by: Petr Vorel <pvorel@suse.cz>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230202054819.16079-1-jamiemdouglass@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/msm8992-lg-bullhead.dtsi | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/msm8992-lg-bullhead.dtsi b/arch/arm64/boot/dts/qcom/msm8992-lg-bullhead.dtsi
+index 4bceb362a5c02..cdd796040703c 100644
+--- a/arch/arm64/boot/dts/qcom/msm8992-lg-bullhead.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8992-lg-bullhead.dtsi
+@@ -56,8 +56,13 @@ cont_splash_mem: memory@3400000 {
+ no-map;
+ };
+
+- removed_region: reserved@5000000 {
+- reg = <0 0x05000000 0 0x2200000>;
++ reserved@5000000 {
++ reg = <0x0 0x05000000 0x0 0x1a00000>;
++ no-map;
++ };
++
++ reserved@6c00000 {
++ reg = <0x0 0x06c00000 0x0 0x400000>;
+ no-map;
+ };
+ };
+--
+2.39.2
+
--- /dev/null
+From 3c072047654c0b487b322dddc487ada44ad1125e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Feb 2023 11:09:52 +0100
+Subject: arm64: dts: qcom: msm8992-lg-bullhead: Enable regulators
+
+From: Petr Vorel <pvorel@suse.cz>
+
+[ Upstream commit 2866527093ddbc6356bb31f560f0b4b4decf3e2e ]
+
+Enable pm8994_s1, pm8994_l{26,29,30,32} regulators.
+Use values from downstream kernel on bullhead rev 1.01.
+
+NOTE: downstream kernel on angler rev 1.01 differences:
+* pm8994_l29: regulator-min-microvolt = <2700000>
+* pm8994_l{20,28,31}: use regulator-boot-on
+
+Verification:
+[ 1.832460] s1: Bringing 0uV into 1025000-1025000uV
+...
+[ 2.057667] l26: Bringing 0uV into 987500-987500uV
+...
+[ 2.075722] l29: Bringing 0uV into 2800000-2800000uV
+[ 2.076604] l30: Bringing 0uV into 1800000-1800000uV
+[ 2.082431] l31: Bringing 0uV into 1262500-1262500uV
+[ 2.095767] l32: Bringing 0uV into 1800000-1800000uV
+
+Fixes: f3b2c99e73be ("arm64: dts: Enable onboard SDHCI on msm8992")
+Signed-off-by: Petr Vorel <pvorel@suse.cz>
+Tested-by: Jamie Douglass <jamiemdouglass@gmail.com>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230203100952.13857-1-pvorel@suse.cz
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../boot/dts/qcom/msm8992-lg-bullhead.dtsi | 32 ++++++-------------
+ 1 file changed, 10 insertions(+), 22 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/msm8992-lg-bullhead.dtsi b/arch/arm64/boot/dts/qcom/msm8992-lg-bullhead.dtsi
+index cdd796040703c..cd77dcb558722 100644
+--- a/arch/arm64/boot/dts/qcom/msm8992-lg-bullhead.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8992-lg-bullhead.dtsi
+@@ -94,8 +94,8 @@ pm8994_regulators: regulators-0 {
+ /* S1, S2, S6 and S12 are managed by RPMPD */
+
+ pm8994_s1: s1 {
+- regulator-min-microvolt = <800000>;
+- regulator-max-microvolt = <800000>;
++ regulator-min-microvolt = <1025000>;
++ regulator-max-microvolt = <1025000>;
+ };
+
+ pm8994_s2: s2 {
+@@ -251,11 +251,8 @@ pm8994_l25: l25 {
+ };
+
+ pm8994_l26: l26 {
+- /*
+- * TODO: value from downstream
+- * regulator-min-microvolt = <987500>;
+- * fails to apply
+- */
++ regulator-min-microvolt = <987500>;
++ regulator-max-microvolt = <987500>;
+ };
+
+ pm8994_l27: l27 {
+@@ -269,19 +266,13 @@ pm8994_l28: l28 {
+ };
+
+ pm8994_l29: l29 {
+- /*
+- * TODO: Unsupported voltage range.
+- * regulator-min-microvolt = <2800000>;
+- * regulator-max-microvolt = <2800000>;
+- */
++ regulator-min-microvolt = <2800000>;
++ regulator-max-microvolt = <2800000>;
+ };
+
+ pm8994_l30: l30 {
+- /*
+- * TODO: get this verified
+- * regulator-min-microvolt = <1800000>;
+- * regulator-max-microvolt = <1800000>;
+- */
++ regulator-min-microvolt = <1800000>;
++ regulator-max-microvolt = <1800000>;
+ };
+
+ pm8994_l31: l31 {
+@@ -290,11 +281,8 @@ pm8994_l31: l31 {
+ };
+
+ pm8994_l32: l32 {
+- /*
+- * TODO: get this verified
+- * regulator-min-microvolt = <1800000>;
+- * regulator-max-microvolt = <1800000>;
+- */
++ regulator-min-microvolt = <1800000>;
++ regulator-max-microvolt = <1800000>;
+ };
+ };
+
+--
+2.39.2
+
--- /dev/null
+From d7da3e5d4f4641941de3d7462858cdaaf2069195 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Dec 2022 21:03:53 +0100
+Subject: arm64: dts: qcom: msm8996: Add additional A2NoC clocks
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit 67fb53745e0b38275fa0b422b6a3c6c1c028c9a2 ]
+
+On eMMC devices, the UFS clocks aren't started in the bootloader (or well,
+at least it should not be, as that would just leak power..), which results
+in platform reboots when trying to access the unclocked UFS hardware,
+which unfortunately happens on each and every boot, as interconnect calls
+sync_state and goes over each and every path.
+
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Tested-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> #db820c
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20221210200353.418391-6-konrad.dybcio@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/msm8996.dtsi | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/msm8996.dtsi b/arch/arm64/boot/dts/qcom/msm8996.dtsi
+index a444d9b531228..71678749d66f6 100644
+--- a/arch/arm64/boot/dts/qcom/msm8996.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8996.dtsi
+@@ -830,9 +830,11 @@ a2noc: interconnect@583000 {
+ compatible = "qcom,msm8996-a2noc";
+ reg = <0x00583000 0x7000>;
+ #interconnect-cells = <1>;
+- clock-names = "bus", "bus_a";
++ clock-names = "bus", "bus_a", "aggre2_ufs_axi", "ufs_axi";
+ clocks = <&rpmcc RPM_SMD_AGGR2_NOC_CLK>,
+- <&rpmcc RPM_SMD_AGGR2_NOC_A_CLK>;
++ <&rpmcc RPM_SMD_AGGR2_NOC_A_CLK>,
++ <&gcc GCC_AGGRE2_UFS_AXI_CLK>,
++ <&gcc GCC_UFS_AXI_CLK>;
+ };
+
+ mnoc: interconnect@5a4000 {
+--
+2.39.2
+
--- /dev/null
+From 1be1468d7d8951453687bb35bb1c4f899a2d80f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Jan 2023 06:24:06 +0200
+Subject: arm64: dts: qcom: msm8996-oneplus-common: drop vdda-supply from DSI
+ PHY
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit 1de4e112b97c77efb5cbee39db8541e33dd2b0d5 ]
+
+14nm DSI PHY has the only supply, vcca. Drop the extra vdda-supply.
+
+Fixes: 5a134c940cd3 ("arm64: dts: qcom: msm8996: add support for oneplus3(t)")
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230109042406.312047-1-dmitry.baryshkov@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/msm8996-oneplus-common.dtsi | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/msm8996-oneplus-common.dtsi b/arch/arm64/boot/dts/qcom/msm8996-oneplus-common.dtsi
+index 20f5c103c63b7..2994337c60464 100644
+--- a/arch/arm64/boot/dts/qcom/msm8996-oneplus-common.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8996-oneplus-common.dtsi
+@@ -179,7 +179,6 @@ &dsi0_out {
+ };
+
+ &dsi0_phy {
+- vdda-supply = <&vreg_l2a_1p25>;
+ vcca-supply = <&vreg_l28a_0p925>;
+ status = "okay";
+ };
+--
+2.39.2
+
--- /dev/null
+From bc0b0178f834becc4422f73485b0807247afabbd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Jan 2023 14:05:44 +0200
+Subject: arm64: dts: qcom: msm8996: support using GPLL0 as kryocc input
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit ac0d84d4556cecf81ba0b1631d25d9a395235a5c ]
+
+In some cases the driver might need using GPLL0 to drive CPU clocks.
+Bring it in through the sys_apcs_aux clock.
+
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230113120544.59320-15-dmitry.baryshkov@linaro.org
+Stable-dep-of: 8ae72166c2b7 ("arm64: dts: qcom: msm8996 switch from RPM_SMD_BB_CLK1 to RPM_SMD_XO_CLK_SRC")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/msm8996.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/msm8996.dtsi b/arch/arm64/boot/dts/qcom/msm8996.dtsi
+index d31464204f696..286f7b44057dd 100644
+--- a/arch/arm64/boot/dts/qcom/msm8996.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8996.dtsi
+@@ -2940,8 +2940,8 @@ kryocc: clock-controller@6400000 {
+ compatible = "qcom,msm8996-apcc";
+ reg = <0x06400000 0x90000>;
+
+- clock-names = "xo";
+- clocks = <&rpmcc RPM_SMD_BB_CLK1>;
++ clock-names = "xo", "sys_apcs_aux";
++ clocks = <&rpmcc RPM_SMD_BB_CLK1>, <&apcs_glb>;
+
+ #clock-cells = <1>;
+ };
+--
+2.39.2
+
--- /dev/null
+From b8cad53a0f312ace2df9f59641a8a112f94228e4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Jan 2023 08:14:15 +0200
+Subject: arm64: dts: qcom: msm8996 switch from RPM_SMD_BB_CLK1 to
+ RPM_SMD_XO_CLK_SRC
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit 8ae72166c2b73b0f2ce498ea15d4feceb9fef50e ]
+
+The vendor kernel uses RPM_SMD_XO_CLK_SRC clock as an CXO clock rather
+than using the RPM_SMD_BB_CLK1 directly. Follow this example and switch
+msm8996.dtsi to use RPM_SMD_XO_CLK_SRC clock instead of RPM_SMB_BB_CLK1.
+
+Fixes: 2b8c9c77c268 ("arm64: dts: qcom: msm8996: convert xo_board to RPM_SMD_BB_CLK1")
+Suggested-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230120061417.2623751-7-dmitry.baryshkov@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/msm8996.dtsi | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/msm8996.dtsi b/arch/arm64/boot/dts/qcom/msm8996.dtsi
+index 286f7b44057dd..a444d9b531228 100644
+--- a/arch/arm64/boot/dts/qcom/msm8996.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8996.dtsi
+@@ -713,7 +713,7 @@ gcc: clock-controller@300000 {
+ #power-domain-cells = <1>;
+ reg = <0x00300000 0x90000>;
+
+- clocks = <&rpmcc RPM_SMD_BB_CLK1>,
++ clocks = <&rpmcc RPM_SMD_XO_CLK_SRC>,
+ <&rpmcc RPM_SMD_LN_BB_CLK>,
+ <&sleep_clk>,
+ <&pciephy_0>,
+@@ -1050,7 +1050,7 @@ dsi0_phy: phy@994400 {
+ #clock-cells = <1>;
+ #phy-cells = <0>;
+
+- clocks = <&mmcc MDSS_AHB_CLK>, <&rpmcc RPM_SMD_BB_CLK1>;
++ clocks = <&mmcc MDSS_AHB_CLK>, <&rpmcc RPM_SMD_XO_CLK_SRC>;
+ clock-names = "iface", "ref";
+ status = "disabled";
+ };
+@@ -1117,7 +1117,7 @@ dsi1_phy: phy@996400 {
+ #clock-cells = <1>;
+ #phy-cells = <0>;
+
+- clocks = <&mmcc MDSS_AHB_CLK>, <&rpmcc RPM_SMD_BB_CLK1>;
++ clocks = <&mmcc MDSS_AHB_CLK>, <&rpmcc RPM_SMD_XO_CLK_SRC>;
+ clock-names = "iface", "ref";
+ status = "disabled";
+ };
+@@ -2941,7 +2941,7 @@ kryocc: clock-controller@6400000 {
+ reg = <0x06400000 0x90000>;
+
+ clock-names = "xo", "sys_apcs_aux";
+- clocks = <&rpmcc RPM_SMD_BB_CLK1>, <&apcs_glb>;
++ clocks = <&rpmcc RPM_SMD_XO_A_CLK_SRC>, <&apcs_glb>;
+
+ #clock-cells = <1>;
+ };
+@@ -3060,7 +3060,7 @@ sdhc1: mmc@7464900 {
+ clock-names = "iface", "core", "xo";
+ clocks = <&gcc GCC_SDCC1_AHB_CLK>,
+ <&gcc GCC_SDCC1_APPS_CLK>,
+- <&rpmcc RPM_SMD_BB_CLK1>;
++ <&rpmcc RPM_SMD_XO_CLK_SRC>;
+ resets = <&gcc GCC_SDCC1_BCR>;
+
+ pinctrl-names = "default", "sleep";
+@@ -3084,7 +3084,7 @@ sdhc2: mmc@74a4900 {
+ clock-names = "iface", "core", "xo";
+ clocks = <&gcc GCC_SDCC2_AHB_CLK>,
+ <&gcc GCC_SDCC2_APPS_CLK>,
+- <&rpmcc RPM_SMD_BB_CLK1>;
++ <&rpmcc RPM_SMD_XO_CLK_SRC>;
+ resets = <&gcc GCC_SDCC2_BCR>;
+
+ pinctrl-names = "default", "sleep";
+@@ -3406,7 +3406,7 @@ adsp_pil: remoteproc@9300000 {
+ interrupt-names = "wdog", "fatal", "ready",
+ "handover", "stop-ack";
+
+- clocks = <&rpmcc RPM_SMD_BB_CLK1>;
++ clocks = <&rpmcc RPM_SMD_XO_CLK_SRC>;
+ clock-names = "xo";
+
+ memory-region = <&adsp_mem>;
+--
+2.39.2
+
--- /dev/null
+From 67483e06a5f28d7367d581221a9e15ffb35a71d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Nov 2022 23:01:47 +0100
+Subject: arm64: dts: qcom: msm8996-tone: Fix USB taking 6 minutes to wake up
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit 43069b9cd358aebc692e654de91ee06ff66e26af ]
+
+The hardware turns out to be pretty sluggish at assuming it can only
+do USB2 with just a USB2 phy assigned to it - before it needed about
+6 minutes to acknowledge that.
+
+Limit it to USB-HS explicitly to make USB come up about 720x faster.
+
+Fixes: 9da65e441d4d ("arm64: dts: qcom: Add support for SONY Xperia X Performance / XZ / XZs (msm8996, Tone platform)")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20221124220147.102611-1-konrad.dybcio@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/msm8996-sony-xperia-tone.dtsi | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/msm8996-sony-xperia-tone.dtsi b/arch/arm64/boot/dts/qcom/msm8996-sony-xperia-tone.dtsi
+index dec361b93ccea..be62899edf8e3 100644
+--- a/arch/arm64/boot/dts/qcom/msm8996-sony-xperia-tone.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8996-sony-xperia-tone.dtsi
+@@ -943,10 +943,6 @@ touch_int_sleep: touch-int-sleep-state {
+ };
+ };
+
+-/*
+- * For reasons that are currently unknown (but probably related to fusb301), USB takes about
+- * 6 minutes to wake up (nothing interesting in kernel logs), but then it works as it should.
+- */
+ &usb3 {
+ status = "okay";
+ qcom,select-utmi-as-pipe-clk;
+@@ -955,6 +951,7 @@ &usb3 {
+ &usb3_dwc3 {
+ extcon = <&usb3_id>;
+ dr_mode = "peripheral";
++ maximum-speed = "high-speed";
+ phys = <&hsusb_phy1>;
+ phy-names = "usb2-phy";
+ snps,hird-threshold = /bits/ 8 <0>;
+--
+2.39.2
+
--- /dev/null
+From 3bb80770ac028fe377350bca4905f994891329f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Dec 2022 22:54:37 +0100
+Subject: arm64: dts: qcom: pmi8950: Correct rev_1250v channel label to mv
+
+From: Marijn Suijten <marijn.suijten@somainline.org>
+
+[ Upstream commit 3c3d2cb221b8647d1c547b4c44d2d6060cc742a9 ]
+
+This was pointed out in review but never followed up on thanks to
+sidetracked discussions about labels vs node names.
+
+Fixes: 0d97fdf380b4 ("arm64: dts: qcom: Add configuration for PMI8950 peripheral")
+Signed-off-by: Marijn Suijten <marijn.suijten@somainline.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Reviewed-by: Luca Weiss <luca@z3ntu.xyz>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20221209215437.1783067-1-marijn.suijten@somainline.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/pmi8950.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/pmi8950.dtsi b/arch/arm64/boot/dts/qcom/pmi8950.dtsi
+index 32d27e2187e38..8008f02434a9e 100644
+--- a/arch/arm64/boot/dts/qcom/pmi8950.dtsi
++++ b/arch/arm64/boot/dts/qcom/pmi8950.dtsi
+@@ -47,7 +47,7 @@ adc-chan@9 {
+ adc-chan@a {
+ reg = <VADC_REF_1250MV>;
+ qcom,pre-scaling = <1 1>;
+- label = "ref_1250v";
++ label = "ref_1250mv";
+ };
+
+ adc-chan@d {
+--
+2.39.2
+
--- /dev/null
+From a9d4afc5418c79937de16a75577d08eb109bafc1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Feb 2023 22:29:30 +0100
+Subject: arm64: dts: qcom: pmk8350: Use the correct PON compatible
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit c0ee8e0ba5cc17623e63349a168b41e407b1eef0 ]
+
+A special compatible was introduced for PMK8350 both in the driver and
+the bindings to facilitate for 2 base registers (PBS & HLOS). Use it.
+
+Fixes: b2de43136058 ("arm64: dts: qcom: pmk8350: Add peripherals for pmk8350")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230213212930.2115182-1-konrad.dybcio@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/pmk8350.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/pmk8350.dtsi b/arch/arm64/boot/dts/qcom/pmk8350.dtsi
+index 32f5e6af8c11c..f26fb7d32faf2 100644
+--- a/arch/arm64/boot/dts/qcom/pmk8350.dtsi
++++ b/arch/arm64/boot/dts/qcom/pmk8350.dtsi
+@@ -21,7 +21,7 @@ pmk8350: pmic@PMK8350_SID {
+ #size-cells = <0>;
+
+ pmk8350_pon: pon@1300 {
+- compatible = "qcom,pm8998-pon";
++ compatible = "qcom,pmk8350-pon";
+ reg = <0x1300>, <0x800>;
+ reg-names = "hlos", "pbs";
+
+--
+2.39.2
+
--- /dev/null
+From 435711fbf6a7af04d5c36a25a29d16305732a9f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Dec 2022 06:21:51 +0200
+Subject: arm64: dts: qcom: qcs404: use symbol names for PCIe resets
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit 41a37d157a613444c97e8f71a5fb2a21116b70d7 ]
+
+The commit e5bbbff5b7d7 ("clk: gcc-qcs404: Add PCIe resets") added names
+for PCIe resets, but it did not change the existing qcs404.dtsi to use
+these names. Do it now and use symbol names to make it easier to check
+and modify the dtsi in future.
+
+Fixes: e5bbbff5b7d7 ("clk: gcc-qcs404: Add PCIe resets")
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20221226042154.2666748-14-dmitry.baryshkov@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/qcs404.dtsi | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/qcs404.dtsi b/arch/arm64/boot/dts/qcom/qcs404.dtsi
+index a5324eecb50a9..502dd6db491e2 100644
+--- a/arch/arm64/boot/dts/qcom/qcs404.dtsi
++++ b/arch/arm64/boot/dts/qcom/qcs404.dtsi
+@@ -806,7 +806,7 @@ pcie_phy: phy@7786000 {
+
+ clocks = <&gcc GCC_PCIE_0_PIPE_CLK>;
+ resets = <&gcc GCC_PCIEPHY_0_PHY_BCR>,
+- <&gcc 21>;
++ <&gcc GCC_PCIE_0_PIPE_ARES>;
+ reset-names = "phy", "pipe";
+
+ clock-output-names = "pcie_0_pipe_clk";
+@@ -1336,12 +1336,12 @@ pcie: pci@10000000 {
+ <&gcc GCC_PCIE_0_SLV_AXI_CLK>;
+ clock-names = "iface", "aux", "master_bus", "slave_bus";
+
+- resets = <&gcc 18>,
+- <&gcc 17>,
+- <&gcc 15>,
+- <&gcc 19>,
++ resets = <&gcc GCC_PCIE_0_AXI_MASTER_ARES>,
++ <&gcc GCC_PCIE_0_AXI_SLAVE_ARES>,
++ <&gcc GCC_PCIE_0_AXI_MASTER_STICKY_ARES>,
++ <&gcc GCC_PCIE_0_CORE_STICKY_ARES>,
+ <&gcc GCC_PCIE_0_BCR>,
+- <&gcc 16>;
++ <&gcc GCC_PCIE_0_AHB_ARES>;
+ reset-names = "axi_m",
+ "axi_s",
+ "axi_m_sticky",
+--
+2.39.2
+
--- /dev/null
+From 0270bda8a253950d030541372e5fd0dfa2a0697c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Dec 2022 14:52:43 +0300
+Subject: arm64: dts: qcom: Re-enable resin on MSM8998 and SDM845 boards
+
+From: Dzmitry Sankouski <dsankouski@gmail.com>
+
+[ Upstream commit 4c881ab73a64cdbf8691e258ef17b740d27040a0 ]
+
+resin node declaration was moved to pm8998.dtsi file (in disabled state).
+MSM8998 and SDM845 boards defining resin node did not previously have
+status="okay" and ended up disabled.
+Re-enable it by using resin node link from pm8998.dtsi with status="okay".
+
+Fixes: f86ae6f23a9e ("arm64: dts: qcom: sagit: add initial device tree for sagit")
+Signed-off-by: Dzmitry Sankouski <dsankouski@gmail.com>
+Reviewed-by: Marijn Suijten <marijn.suijten@somainline.org>
+Reported-by: Marijn Suijten <marijn.suijten@somainline.org>
+Link: https://lore.kernel.org/linux-arm-msm/20221222115922.jlachctn4lxopp7a@SoMainline.org/
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20221228115243.201038-1-dsankouski@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/msm8998-fxtec-pro1.dts | 11 +++--------
+ .../boot/dts/qcom/msm8998-sony-xperia-yoshino.dtsi | 11 +++--------
+ arch/arm64/boot/dts/qcom/sdm845-db845c.dts | 11 +++--------
+ arch/arm64/boot/dts/qcom/sdm845-lg-common.dtsi | 11 +++--------
+ arch/arm64/boot/dts/qcom/sdm845-shift-axolotl.dts | 11 +++--------
+ .../boot/dts/qcom/sdm845-xiaomi-beryllium-common.dtsi | 11 +++--------
+ arch/arm64/boot/dts/qcom/sdm845-xiaomi-polaris.dts | 11 +++--------
+ 7 files changed, 21 insertions(+), 56 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/msm8998-fxtec-pro1.dts b/arch/arm64/boot/dts/qcom/msm8998-fxtec-pro1.dts
+index 310f7a2df1e83..510d12c8c5126 100644
+--- a/arch/arm64/boot/dts/qcom/msm8998-fxtec-pro1.dts
++++ b/arch/arm64/boot/dts/qcom/msm8998-fxtec-pro1.dts
+@@ -364,14 +364,9 @@ cam_snapshot_pin_a: cam-snapshot-btn-active-state {
+ };
+ };
+
+-&pm8998_pon {
+- resin {
+- compatible = "qcom,pm8941-resin";
+- interrupts = <GIC_SPI 0x8 1 IRQ_TYPE_EDGE_BOTH>;
+- bias-pull-up;
+- debounce = <15625>;
+- linux,code = <KEY_VOLUMEDOWN>;
+- };
++&pm8998_resin {
++ linux,code = <KEY_VOLUMEDOWN>;
++ status = "okay";
+ };
+
+ &qusb2phy {
+diff --git a/arch/arm64/boot/dts/qcom/msm8998-sony-xperia-yoshino.dtsi b/arch/arm64/boot/dts/qcom/msm8998-sony-xperia-yoshino.dtsi
+index 5da87baa2b23b..3bbd5df196bfc 100644
+--- a/arch/arm64/boot/dts/qcom/msm8998-sony-xperia-yoshino.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8998-sony-xperia-yoshino.dtsi
+@@ -357,14 +357,9 @@ vib_default: vib-en-state {
+ };
+ };
+
+-&pm8998_pon {
+- resin {
+- compatible = "qcom,pm8941-resin";
+- interrupts = <GIC_SPI 0x8 1 IRQ_TYPE_EDGE_BOTH>;
+- debounce = <15625>;
+- bias-pull-up;
+- linux,code = <KEY_VOLUMEUP>;
+- };
++&pm8998_resin {
++ linux,code = <KEY_VOLUMEUP>;
++ status = "okay";
+ };
+
+ &qusb2phy {
+diff --git a/arch/arm64/boot/dts/qcom/sdm845-db845c.dts b/arch/arm64/boot/dts/qcom/sdm845-db845c.dts
+index f41c6d600ea8c..878801f540c54 100644
+--- a/arch/arm64/boot/dts/qcom/sdm845-db845c.dts
++++ b/arch/arm64/boot/dts/qcom/sdm845-db845c.dts
+@@ -615,14 +615,9 @@ vol_up_pin_a: vol-up-active-state {
+ };
+ };
+
+-&pm8998_pon {
+- resin {
+- compatible = "qcom,pm8941-resin";
+- interrupts = <0x0 0x8 1 IRQ_TYPE_EDGE_BOTH>;
+- debounce = <15625>;
+- bias-pull-up;
+- linux,code = <KEY_VOLUMEDOWN>;
+- };
++&pm8998_resin {
++ linux,code = <KEY_VOLUMEDOWN>;
++ status = "okay";
+ };
+
+ &pmi8998_lpg {
+diff --git a/arch/arm64/boot/dts/qcom/sdm845-lg-common.dtsi b/arch/arm64/boot/dts/qcom/sdm845-lg-common.dtsi
+index 1eb423e4be24c..943287804e1a6 100644
+--- a/arch/arm64/boot/dts/qcom/sdm845-lg-common.dtsi
++++ b/arch/arm64/boot/dts/qcom/sdm845-lg-common.dtsi
+@@ -482,14 +482,9 @@ &mss_pil {
+ status = "okay";
+ };
+
+-&pm8998_pon {
+- resin {
+- compatible = "qcom,pm8941-resin";
+- interrupts = <0x0 0x8 1 IRQ_TYPE_EDGE_BOTH>;
+- debounce = <15625>;
+- bias-pull-up;
+- linux,code = <KEY_VOLUMEDOWN>;
+- };
++&pm8998_resin {
++ linux,code = <KEY_VOLUMEDOWN>;
++ status = "okay";
+ };
+
+ &sdhc_2 {
+diff --git a/arch/arm64/boot/dts/qcom/sdm845-shift-axolotl.dts b/arch/arm64/boot/dts/qcom/sdm845-shift-axolotl.dts
+index bb77ccfdc68c0..e6191602c70a8 100644
+--- a/arch/arm64/boot/dts/qcom/sdm845-shift-axolotl.dts
++++ b/arch/arm64/boot/dts/qcom/sdm845-shift-axolotl.dts
+@@ -522,14 +522,9 @@ pinconf {
+ };
+ };
+
+-&pm8998_pon {
+- volume_down_resin: resin {
+- compatible = "qcom,pm8941-resin";
+- interrupts = <0x0 0x8 1 IRQ_TYPE_EDGE_BOTH>;
+- debounce = <15625>;
+- bias-pull-up;
+- linux,code = <KEY_VOLUMEDOWN>;
+- };
++&pm8998_resin {
++ linux,code = <KEY_VOLUMEDOWN>;
++ status = "okay";
+ };
+
+ &pmi8998_lpg {
+diff --git a/arch/arm64/boot/dts/qcom/sdm845-xiaomi-beryllium-common.dtsi b/arch/arm64/boot/dts/qcom/sdm845-xiaomi-beryllium-common.dtsi
+index eb6b2b676eca4..1b12b1a4dcbc7 100644
+--- a/arch/arm64/boot/dts/qcom/sdm845-xiaomi-beryllium-common.dtsi
++++ b/arch/arm64/boot/dts/qcom/sdm845-xiaomi-beryllium-common.dtsi
+@@ -325,14 +325,9 @@ &pmi8998_wled {
+ qcom,cabc;
+ };
+
+-&pm8998_pon {
+- resin {
+- compatible = "qcom,pm8941-resin";
+- interrupts = <0x0 0x8 1 IRQ_TYPE_EDGE_BOTH>;
+- debounce = <15625>;
+- bias-pull-up;
+- linux,code = <KEY_VOLUMEDOWN>;
+- };
++&pm8998_resin {
++ linux,code = <KEY_VOLUMEDOWN>;
++ status = "okay";
+ };
+
+ &pmi8998_rradc {
+diff --git a/arch/arm64/boot/dts/qcom/sdm845-xiaomi-polaris.dts b/arch/arm64/boot/dts/qcom/sdm845-xiaomi-polaris.dts
+index 38ba809a95cd6..fba229d0bd108 100644
+--- a/arch/arm64/boot/dts/qcom/sdm845-xiaomi-polaris.dts
++++ b/arch/arm64/boot/dts/qcom/sdm845-xiaomi-polaris.dts
+@@ -530,14 +530,9 @@ pinconf {
+ };
+ };
+
+-&pm8998_pon {
+- resin {
+- interrupts = <0x0 0x8 1 IRQ_TYPE_EDGE_BOTH>;
+- compatible = "qcom,pm8941-resin";
+- linux,code = <KEY_VOLUMEDOWN>;
+- debounce = <15625>;
+- bias-pull-up;
+- };
++&pm8998_resin {
++ linux,code = <KEY_VOLUMEDOWN>;
++ status = "okay";
+ };
+
+ &q6afedai {
+--
+2.39.2
+
--- /dev/null
+From a8b0a1ac07408b4586da15d8b53a42e3bb2116df Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Dec 2022 11:19:17 +0100
+Subject: arm64: dts: qcom: sc7180: correct SPMI bus address cells
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit 1f75745537222172f84783d369bbd1fb2d4b6414 ]
+
+The SPMI bus uses two address cells and zero size cells (second reg
+entry - SPMI_USID - is not the size):
+
+ spmi@c440000: #address-cells:0:0: 2 was expected
+
+Fixes: 0f9dc5f09fbd ("arm64: dts: qcom: sc7180: Add SPMI PMIC arbiter device")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20221213101921.47924-1-krzysztof.kozlowski@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sc7180.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sc7180.dtsi b/arch/arm64/boot/dts/qcom/sc7180.dtsi
+index f71cf21a8dd8a..e45726be81c82 100644
+--- a/arch/arm64/boot/dts/qcom/sc7180.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc7180.dtsi
+@@ -3274,8 +3274,8 @@ spmi_bus: spmi@c440000 {
+ interrupts-extended = <&pdc 1 IRQ_TYPE_LEVEL_HIGH>;
+ qcom,ee = <0>;
+ qcom,channel = <0>;
+- #address-cells = <1>;
+- #size-cells = <1>;
++ #address-cells = <2>;
++ #size-cells = <0>;
+ interrupt-controller;
+ #interrupt-cells = <4>;
+ cell-index = <0>;
+--
+2.39.2
+
--- /dev/null
+From 10ec52a8ca1a31d8e998c8492545544207e3bbe3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Dec 2022 11:19:18 +0100
+Subject: arm64: dts: qcom: sc7280: correct SPMI bus address cells
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit 8da3786a91e56fe0c4aeb2c2209744474af6e517 ]
+
+The SPMI bus uses two address cells and zero size cells (second reg
+entry - SPMI_USID - is not the size):
+
+ spmi@c440000: #address-cells:0:0: 2 was expected
+
+Fixes: 14abf8dfe364 ("arm64: dts: qcom: sc7280: Add SPMI PMIC arbiter device for SC7280")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20221213101921.47924-2-krzysztof.kozlowski@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sc7280.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sc7280.dtsi b/arch/arm64/boot/dts/qcom/sc7280.dtsi
+index 0adf13399e649..3bedd45e14afd 100644
+--- a/arch/arm64/boot/dts/qcom/sc7280.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc7280.dtsi
+@@ -4246,8 +4246,8 @@ spmi_bus: spmi@c440000 {
+ interrupts-extended = <&pdc 1 IRQ_TYPE_LEVEL_HIGH>;
+ qcom,ee = <0>;
+ qcom,channel = <0>;
+- #address-cells = <1>;
+- #size-cells = <1>;
++ #address-cells = <2>;
++ #size-cells = <0>;
+ interrupt-controller;
+ #interrupt-cells = <4>;
+ };
+--
+2.39.2
+
--- /dev/null
+From 78037630debc0a3aa80f6226321e1e840867b512 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Dec 2022 11:19:19 +0100
+Subject: arm64: dts: qcom: sc8280xp: correct SPMI bus address cells
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit 76d9e8b4d54ae2cb91a68f0cb82624887de767a7 ]
+
+The SPMI bus uses two address cells and zero size cells (second reg
+entry - SPMI_USID - is not the size):
+
+ spmi@c440000: #address-cells:0:0: 2 was expected
+
+Fixes: 152d1faf1e2f ("arm64: dts: qcom: add SC8280XP platform")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Reviewed-by: Johan Hovold <johan+linaro@kernel.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20221213101921.47924-3-krzysztof.kozlowski@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sc8280xp.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi
+index 71cf81a8eb4da..d1bc0e60cfd47 100644
+--- a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi
+@@ -2051,8 +2051,8 @@ spmi_bus: spmi@c440000 {
+ interrupts-extended = <&pdc 1 IRQ_TYPE_LEVEL_HIGH>;
+ qcom,ee = <0>;
+ qcom,channel = <0>;
+- #address-cells = <1>;
+- #size-cells = <1>;
++ #address-cells = <2>;
++ #size-cells = <0>;
+ interrupt-controller;
+ #interrupt-cells = <4>;
+ };
+--
+2.39.2
+
--- /dev/null
+From 3d4a4aaa18ab66f07fcf619f84489e0e6c844b1a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Jan 2023 05:51:17 -0800
+Subject: arm64: dts: qcom: sc8280xp: Vote for CX in USB controllers
+
+From: Bjorn Andersson <quic_bjorande@quicinc.com>
+
+[ Upstream commit fe07640280cd29ac2997a617a1fb5487feef9387 ]
+
+Running GCC_USB30_*_MASTER_CLK at 200MHz requires CX at nominal level,
+not doing so results in occasional lockups. This was previously hidden
+by the fact that the display stack incorrectly voted for CX (instead of
+MMCX).
+
+Fixes: 152d1faf1e2f ("arm64: dts: qcom: add SC8280XP platform")
+Signed-off-by: Bjorn Andersson <quic_bjorande@quicinc.com>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230112135117.3836655-1-quic_bjorande@quicinc.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sc8280xp.dtsi | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi
+index d1bc0e60cfd47..8363e82369854 100644
+--- a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi
+@@ -1863,6 +1863,7 @@ usb_0: usb@a6f8800 {
+ "ss_phy_irq";
+
+ power-domains = <&gcc USB30_PRIM_GDSC>;
++ required-opps = <&rpmhpd_opp_nom>;
+
+ resets = <&gcc GCC_USB30_PRIM_BCR>;
+
+@@ -1917,6 +1918,7 @@ usb_1: usb@a8f8800 {
+ "ss_phy_irq";
+
+ power-domains = <&gcc USB30_SEC_GDSC>;
++ required-opps = <&rpmhpd_opp_nom>;
+
+ resets = <&gcc GCC_USB30_SEC_BCR>;
+
+--
+2.39.2
+
--- /dev/null
+From a7f97cb0a9b6be872c34b625e37b61b27f4d3c00 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Dec 2022 17:52:37 -0500
+Subject: arm64: dts: qcom: sdm670-google-sargo: keep pm660 ldo8 on
+
+From: Richard Acayan <mailingradian@gmail.com>
+
+[ Upstream commit 861b67fbdccd62a9319d7350b1924d95f597db09 ]
+
+According to the downstream device tree, the regulator that powers the
+I/O for eMMC should not be turned off. Keep it always on just in case
+the eMMC driver fails and doesn't enable it, or unloads and disables it.
+
+Fixes: 07c8ded6e373 ("arm64: dts: qcom: add sdm670 and pixel 3a device trees")
+Link: https://android.googlesource.com/kernel/msm/+/9ed6ddbe955d3b84d1416a1cf77e83904d1e8421/arch/arm64/boot/dts/google/sdm670-bonito-common.dtsi#105
+Signed-off-by: Richard Acayan <mailingradian@gmail.com>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20221205225237.200564-1-mailingradian@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sdm670-google-sargo.dts | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/boot/dts/qcom/sdm670-google-sargo.dts b/arch/arm64/boot/dts/qcom/sdm670-google-sargo.dts
+index cf2ae540db125..e3e61b9d1b9d7 100644
+--- a/arch/arm64/boot/dts/qcom/sdm670-google-sargo.dts
++++ b/arch/arm64/boot/dts/qcom/sdm670-google-sargo.dts
+@@ -256,6 +256,7 @@ vreg_l8a_1p8: ldo8 {
+ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <1800000>;
+ regulator-enable-ramp-delay = <250>;
++ regulator-always-on;
+ };
+
+ vreg_l9a_1p8: ldo9 {
+--
+2.39.2
+
--- /dev/null
+From 9a534ff084d39f2b672b0eaa30098b84d4090bea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Dec 2022 16:13:16 +0100
+Subject: arm64: dts: qcom: sdm845-db845c: fix audio codec interrupt pin name
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit 740862bb5f59b93efb390a417995f88a64bdc323 ]
+
+The pin config entry should have a string, not number, for the GPIO used
+as WCD9340 audio codec interrupt.
+
+Fixes: 89a32a4e769c ("arm64: dts: qcom: db845c: add analog audio support")
+Reported-by: Doug Anderson <dianders@chromium.org>
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20221222151319.122398-1-krzysztof.kozlowski@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sdm845-db845c.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sdm845-db845c.dts b/arch/arm64/boot/dts/qcom/sdm845-db845c.dts
+index 878801f540c54..75a4645936232 100644
+--- a/arch/arm64/boot/dts/qcom/sdm845-db845c.dts
++++ b/arch/arm64/boot/dts/qcom/sdm845-db845c.dts
+@@ -974,7 +974,7 @@ sdc2_card_det_n: sd-card-det-n {
+ };
+
+ wcd_intr_default: wcd_intr_default {
+- pins = <54>;
++ pins = "gpio54";
+ function = "gpio";
+
+ input-enable;
+--
+2.39.2
+
--- /dev/null
+From 114c91f2f61445056fe5128bfb9bdc70e53e494e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Jan 2023 06:21:26 +0200
+Subject: arm64: dts: qcom: sdm845: make DP node follow the schema
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit 19e509d5ea229244b9205f8671bb75b13738a1f9 ]
+
+Drop the #clock-cells (probably a leftover from the times before the DP
+PHY split)
+
+Fixes: eaac4e55a6f4 ("arm64: dts: qcom: sdm845: add displayport node")
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230110042126.702147-1-dmitry.baryshkov@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sdm845.dtsi | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sdm845.dtsi b/arch/arm64/boot/dts/qcom/sdm845.dtsi
+index 65032b94b46d6..f36c23e7a2248 100644
+--- a/arch/arm64/boot/dts/qcom/sdm845.dtsi
++++ b/arch/arm64/boot/dts/qcom/sdm845.dtsi
+@@ -4593,7 +4593,6 @@ mdss_dp: displayport-controller@ae90000 {
+ <&dispcc DISP_CC_MDSS_DP_PIXEL_CLK>;
+ clock-names = "core_iface", "core_aux", "ctrl_link",
+ "ctrl_link_iface", "stream_pixel";
+- #clock-cells = <1>;
+ assigned-clocks = <&dispcc DISP_CC_MDSS_DP_LINK_CLK_SRC>,
+ <&dispcc DISP_CC_MDSS_DP_PIXEL_CLK_SRC>;
+ assigned-clock-parents = <&dp_phy 0>, <&dp_phy 1>;
+--
+2.39.2
+
--- /dev/null
+From 0c3c37820556a8f7655242217ecc2d9488089b4d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Dec 2022 16:13:17 +0100
+Subject: arm64: dts: qcom: sdm845-xiaomi-beryllium: fix audio codec interrupt
+ pin name
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit e5011447376e1b050847ccb2ef7933176ce4de41 ]
+
+The pin config entry should have a string, not number, for the GPIO used
+as WCD9340 audio codec interrupt.
+
+Fixes: dd6459a0890a ("arm64: dts: qcom: split beryllium dts into common dtsi and tianma dts")
+Reported-by: Doug Anderson <dianders@chromium.org>
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20221222151319.122398-2-krzysztof.kozlowski@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sdm845-xiaomi-beryllium-common.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sdm845-xiaomi-beryllium-common.dtsi b/arch/arm64/boot/dts/qcom/sdm845-xiaomi-beryllium-common.dtsi
+index 1b12b1a4dcbc7..d2866155dd870 100644
+--- a/arch/arm64/boot/dts/qcom/sdm845-xiaomi-beryllium-common.dtsi
++++ b/arch/arm64/boot/dts/qcom/sdm845-xiaomi-beryllium-common.dtsi
+@@ -467,7 +467,7 @@ sdc2_card_det_n: sd-card-det-n {
+ };
+
+ wcd_intr_default: wcd_intr_default {
+- pins = <54>;
++ pins = "gpio54";
+ function = "gpio";
+
+ input-enable;
+--
+2.39.2
+
--- /dev/null
+From 34101bd0733c5fb5ea3e45fe93b27481e1dd6ea4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Feb 2023 11:44:52 +0100
+Subject: arm64: dts: qcom: sm6115: correct TLMM gpio-ranges
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit 272fc52431611d779de132c4e03de6e0c1199731 ]
+
+Correct the number of GPIOs in TLMM pin controller.
+
+Fixes: 97e563bf5ba1 ("arm64: dts: qcom: sm6115: Add basic soc dtsi")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: Iskren Chernev <me@iskren.info>
+Acked-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230202104452.299048-11-krzysztof.kozlowski@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm6115.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm6115.dtsi b/arch/arm64/boot/dts/qcom/sm6115.dtsi
+index 81523ab7ff602..9de56365703cf 100644
+--- a/arch/arm64/boot/dts/qcom/sm6115.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm6115.dtsi
+@@ -363,7 +363,7 @@ tlmm: pinctrl@500000 {
+ reg-names = "west", "south", "east";
+ interrupts = <GIC_SPI 227 IRQ_TYPE_LEVEL_HIGH>;
+ gpio-controller;
+- gpio-ranges = <&tlmm 0 0 121>;
++ gpio-ranges = <&tlmm 0 0 114>; /* GPIOs + ufs_reset */
+ #gpio-cells = <2>;
+ interrupt-controller;
+ #interrupt-cells = <2>;
+--
+2.39.2
+
--- /dev/null
+From 36d7788ed03b395b46ce3ce0722ed19abe28794e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Dec 2022 21:13:57 +0100
+Subject: arm64: dts: qcom: sm6115: Fix UFS node
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit 01b6041454e8bc4f5feb76e6bcdc83a48cea21f2 ]
+
+In its current form, UFS did not even probe successfully - it failed
+when trying to set XO (ref_clk) to 300 MHz instead of doing so to
+the ICE clk. Moreover, the missing reg-names prevented ICE from
+working or being discovered at all. Fix both of these issues.
+
+As a sidenote, the log reveals that this SoC uses UFS ICE v3.1.0.
+
+Fixes: 97e563bf5ba1 ("arm64: dts: qcom: sm6115: Add basic soc dtsi")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Reviewed-by: Iskren Chernev <me@iskren.info>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20221208201401.530555-1-konrad.dybcio@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm6115.dtsi | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm6115.dtsi b/arch/arm64/boot/dts/qcom/sm6115.dtsi
+index 572bf04adf906..3f4017bc667d6 100644
+--- a/arch/arm64/boot/dts/qcom/sm6115.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm6115.dtsi
+@@ -704,6 +704,7 @@ opp-202000000 {
+ ufs_mem_hc: ufs@4804000 {
+ compatible = "qcom,sm6115-ufshc", "qcom,ufshc", "jedec,ufs-2.0";
+ reg = <0x04804000 0x3000>, <0x04810000 0x8000>;
++ reg-names = "std", "ice";
+ interrupts = <GIC_SPI 356 IRQ_TYPE_LEVEL_HIGH>;
+ phys = <&ufs_mem_phy_lanes>;
+ phy-names = "ufsphy";
+@@ -736,10 +737,10 @@ ufs_mem_hc: ufs@4804000 {
+ <0 0>,
+ <0 0>,
+ <37500000 150000000>,
+- <75000000 300000000>,
+ <0 0>,
+ <0 0>,
+- <0 0>;
++ <0 0>,
++ <75000000 300000000>;
+
+ status = "disabled";
+ };
+--
+2.39.2
+
--- /dev/null
+From bef2a07bdad6179c9c1a4e5fb3341b3aef9ec295 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Dec 2022 21:13:58 +0100
+Subject: arm64: dts: qcom: sm6115: Provide xo clk to rpmcc
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit ad9514be8ddb9d3a8c262aa415c2f1c1f4cc97f9 ]
+
+rpmcc used to rely on global clock lookup (and still does so for
+backwards compat reasons) of "xo_board", which was common back
+when we did not care about things like underscores in node names.
+Nowadays it expects to be fed a reference to the fixed clock.
+Satisfy that requirement to make sure rpm clock rates are not all
+stuck at zero.
+
+Fixes: 97e563bf5ba1 ("arm64: dts: qcom: sm6115: Add basic soc dtsi")
+Reported-by: Adam Skladowski <a39.skl@gmail.com>
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20221208201401.530555-2-konrad.dybcio@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm6115.dtsi | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm6115.dtsi b/arch/arm64/boot/dts/qcom/sm6115.dtsi
+index 3f4017bc667d6..81523ab7ff602 100644
+--- a/arch/arm64/boot/dts/qcom/sm6115.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm6115.dtsi
+@@ -296,6 +296,8 @@ rpm_requests: rpm-requests {
+
+ rpmcc: clock-controller {
+ compatible = "qcom,rpmcc-sm6115", "qcom,rpmcc";
++ clocks = <&xo_board>;
++ clock-names = "xo";
+ #clock-cells = <1>;
+ };
+
+--
+2.39.2
+
--- /dev/null
+From 908eb5a6956347aaced2ffe7bc0642322f2167c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Dec 2022 22:33:43 +0100
+Subject: arm64: dts: qcom: sm6125: Reorder HSUSB PHY clocks to match bindings
+
+From: Marijn Suijten <marijn.suijten@somainline.org>
+
+[ Upstream commit 8416262b0ea46d84767141b074748f4d4f37736a ]
+
+Reorder the clocks and corresponding names to match the QUSB2 phy
+schema, fixing the following CHECK_DTBS errors:
+
+ arch/arm64/boot/dts/qcom/sm6125-sony-xperia-seine-pdx201.dtb: phy@1613000: clock-names:0: 'cfg_ahb' was expected
+ From schema: /newdata/aosp-r/kernel/mainline/kernel/Documentation/devicetree/bindings/phy/qcom,qusb2-phy.yaml
+ arch/arm64/boot/dts/qcom/sm6125-sony-xperia-seine-pdx201.dtb: phy@1613000: clock-names:1: 'ref' was expected
+ From schema: /newdata/aosp-r/kernel/mainline/kernel/Documentation/devicetree/bindings/phy/qcom,qusb2-phy.yaml
+
+Fixes: cff4bbaf2a2d ("arm64: dts: qcom: Add support for SM6125")
+Signed-off-by: Marijn Suijten <marijn.suijten@somainline.org>
+Reviewed-by: Martin Botka <martin.botka@somainline.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20221216213343.1140143-1-marijn.suijten@somainline.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm6125.dtsi | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm6125.dtsi b/arch/arm64/boot/dts/qcom/sm6125.dtsi
+index 7e25a4f85594f..bf9e8d45ee44f 100644
+--- a/arch/arm64/boot/dts/qcom/sm6125.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm6125.dtsi
+@@ -442,9 +442,9 @@ hsusb_phy1: phy@1613000 {
+ reg = <0x01613000 0x180>;
+ #phy-cells = <0>;
+
+- clocks = <&rpmcc RPM_SMD_XO_CLK_SRC>,
+- <&gcc GCC_AHB2PHY_USB_CLK>;
+- clock-names = "ref", "cfg_ahb";
++ clocks = <&gcc GCC_AHB2PHY_USB_CLK>,
++ <&rpmcc RPM_SMD_XO_CLK_SRC>;
++ clock-names = "cfg_ahb", "ref";
+
+ resets = <&gcc GCC_QUSB2PHY_PRIM_BCR>;
+ status = "disabled";
+--
+2.39.2
+
--- /dev/null
+From 830b82b4d58a70b0d326ef9157bcb1db39686f81 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Dec 2022 20:24:43 +0100
+Subject: arm64: dts: qcom: sm6125-seine: Clean up gpio-keys (volume down)
+
+From: Marijn Suijten <marijn.suijten@somainline.org>
+
+[ Upstream commit a9f6a13da473bb6c7406d2784d9e3792f6763cba ]
+
+- Remove autorepeat (leave key repetition to userspace);
+- Remove unneeded status = "okay" (this is the default);
+- Remove unneeded linux,input-type <EV_KEY> (this is the default for
+ gpio-keys);
+- Allow the interrupt line for this button to be disabled;
+- Use a full, descriptive node name;
+- Set proper bias on the GPIO via pinctrl;
+- Sort properties;
+- Replace deprecated gpio-key,wakeup property with wakeup-source.
+
+Fixes: 82e1783890b7 ("arm64: dts: qcom: sm6125: Add support for Sony Xperia 10II")
+Signed-off-by: Marijn Suijten <marijn.suijten@somainline.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20221222192443.119103-1-marijn.suijten@somainline.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../qcom/sm6125-sony-xperia-seine-pdx201.dts | 19 ++++++++++++++-----
+ 1 file changed, 14 insertions(+), 5 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm6125-sony-xperia-seine-pdx201.dts b/arch/arm64/boot/dts/qcom/sm6125-sony-xperia-seine-pdx201.dts
+index 0de6c5b7f742e..09cff5d1d0ae8 100644
+--- a/arch/arm64/boot/dts/qcom/sm6125-sony-xperia-seine-pdx201.dts
++++ b/arch/arm64/boot/dts/qcom/sm6125-sony-xperia-seine-pdx201.dts
+@@ -41,17 +41,18 @@ extcon_usb: extcon-usb {
+ };
+
+ gpio-keys {
+- status = "okay";
+ compatible = "gpio-keys";
+- autorepeat;
+
+- key-vol-dn {
++ pinctrl-0 = <&vol_down_n>;
++ pinctrl-names = "default";
++
++ key-volume-down {
+ label = "Volume Down";
+ gpios = <&tlmm 47 GPIO_ACTIVE_LOW>;
+- linux,input-type = <1>;
+ linux,code = <KEY_VOLUMEDOWN>;
+- gpio-key,wakeup;
+ debounce-interval = <15>;
++ linux,can-disable;
++ wakeup-source;
+ };
+ };
+
+@@ -270,6 +271,14 @@ &sdhc_1 {
+
+ &tlmm {
+ gpio-reserved-ranges = <22 2>, <28 6>;
++
++ vol_down_n: vol-down-n-state {
++ pins = "gpio47";
++ function = "gpio";
++ drive-strength = <2>;
++ bias-disable;
++ input-enable;
++ };
+ };
+
+ &usb3 {
+--
+2.39.2
+
--- /dev/null
+From 7dcbd501a1f3142572545390deb45503b6621825 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Dec 2022 11:25:59 +0100
+Subject: arm64: dts: qcom: sm6350: Fix up the ramoops node
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit 3b2ff50da499178cc418f4b319e279d1b52958ed ]
+
+Fix up the ramoops node to make it match bindings and style:
+
+- remove "removed-dma-pool"
+- don't pad size to 8 hex digits
+- change cc-size to ecc-size so that it's used
+- increase ecc-size from to 16
+- remove the zeroed ftrace-size
+
+Fixes: 5f82b9cda61e ("arm64: dts: qcom: Add SM6350 device tree")
+Reported-by: Luca Weiss <luca.weiss@fairphone.com>
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20221210102600.589028-1-konrad.dybcio@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm6350.dtsi | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm6350.dtsi b/arch/arm64/boot/dts/qcom/sm6350.dtsi
+index 43324bf291c30..00e43a0d2dd67 100644
+--- a/arch/arm64/boot/dts/qcom/sm6350.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm6350.dtsi
+@@ -342,13 +342,12 @@ last_log_region: memory@ffbc0000 {
+ };
+
+ ramoops: ramoops@ffc00000 {
+- compatible = "removed-dma-pool", "ramoops";
+- reg = <0 0xffc00000 0 0x00100000>;
++ compatible = "ramoops";
++ reg = <0 0xffc00000 0 0x100000>;
+ record-size = <0x1000>;
+ console-size = <0x40000>;
+- ftrace-size = <0x0>;
+ msg-size = <0x20000 0x20000>;
+- cc-size = <0x0>;
++ ecc-size = <16>;
+ no-map;
+ };
+
+--
+2.39.2
+
--- /dev/null
+From 175cd1457f89299f0355e82bce2d55090d818e5c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Dec 2022 22:59:06 +0100
+Subject: arm64: dts: qcom: sm6350-lena: Flatten gpio-keys pinctrl state
+
+From: Marijn Suijten <marijn.suijten@somainline.org>
+
+[ Upstream commit a40f5ae1ea64ab9e981faf47c31817dc4d7923e4 ]
+
+Pinctrl states typically collate multiple related pins. In the case of
+gpio-keys there's no hardware-defined relation at all except all pins
+representing a key; and especially on Sony's lena board there's only one
+pin regardless. Flatten it similar to other boards [1].
+
+As a drive-by fix, clean up the label string.
+
+[1]: https://lore.kernel.org/linux-arm-msm/11174eb6-0a9d-7df1-6f06-da4010f76453@linaro.org/
+
+Fixes: 2b8bbe985659 ("arm64: dts: qcom: sm6350-lena: Include pm6350 and configure buttons")
+Signed-off-by: Marijn Suijten <marijn.suijten@somainline.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20221222215906.324092-1-marijn.suijten@somainline.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../qcom/sm6350-sony-xperia-lena-pdx213.dts | 18 ++++++++----------
+ 1 file changed, 8 insertions(+), 10 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm6350-sony-xperia-lena-pdx213.dts b/arch/arm64/boot/dts/qcom/sm6350-sony-xperia-lena-pdx213.dts
+index 94f77d376662e..4916d0db5b47f 100644
+--- a/arch/arm64/boot/dts/qcom/sm6350-sony-xperia-lena-pdx213.dts
++++ b/arch/arm64/boot/dts/qcom/sm6350-sony-xperia-lena-pdx213.dts
+@@ -35,10 +35,10 @@ framebuffer: framebuffer@a0000000 {
+ gpio-keys {
+ compatible = "gpio-keys";
+ pinctrl-names = "default";
+- pinctrl-0 = <&gpio_keys_state>;
++ pinctrl-0 = <&vol_down_n>;
+
+ key-volume-down {
+- label = "volume_down";
++ label = "Volume Down";
+ linux,code = <KEY_VOLUMEDOWN>;
+ gpios = <&pm6350_gpios 2 GPIO_ACTIVE_LOW>;
+ };
+@@ -305,14 +305,12 @@ touchscreen@48 {
+ };
+
+ &pm6350_gpios {
+- gpio_keys_state: gpio-keys-state {
+- key-volume-down-pins {
+- pins = "gpio2";
+- function = PMIC_GPIO_FUNC_NORMAL;
+- power-source = <0>;
+- bias-disable;
+- input-enable;
+- };
++ vol_down_n: vol-down-n-state {
++ pins = "gpio2";
++ function = PMIC_GPIO_FUNC_NORMAL;
++ power-source = <0>;
++ bias-disable;
++ input-enable;
+ };
+ };
+
+--
+2.39.2
+
--- /dev/null
+From 1de247d8f5dc86c5a04d6d5a77067abec9f707f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Dec 2022 20:17:33 +0100
+Subject: arm64: dts: qcom: sm8150-kumano: Panel framebuffer is 2.5k instead of
+ 4k
+
+From: Marijn Suijten <marijn.suijten@somainline.org>
+
+[ Upstream commit be8de06dc397c45cb0f3fe04084089c3f06c419f ]
+
+The framebuffer configuration for kumano griffin, written in kumano dtsi
+(which is overwritten in bahamut dts for its smaller panel) has to use a
+1096x2560 configuration as this is what the panel (and framebuffer area)
+has been initialized to. Downstream userspace also has access to (and
+uses) this 2.5k mode by default, and only switches the panel to 4k when
+requested.
+
+Fixes: d0a6ce59ea4e ("arm64: dts: qcom: sm8150: Add support for SONY Xperia 1 / 5 (Kumano platform)")
+Signed-off-by: Marijn Suijten <marijn.suijten@somainline.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20221209191733.1458031-1-marijn.suijten@somainline.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm8150-sony-xperia-kumano.dtsi | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8150-sony-xperia-kumano.dtsi b/arch/arm64/boot/dts/qcom/sm8150-sony-xperia-kumano.dtsi
+index c958a8b167303..fd8c0097072ab 100644
+--- a/arch/arm64/boot/dts/qcom/sm8150-sony-xperia-kumano.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm8150-sony-xperia-kumano.dtsi
+@@ -33,9 +33,10 @@ chosen {
+ framebuffer: framebuffer@9c000000 {
+ compatible = "simple-framebuffer";
+ reg = <0 0x9c000000 0 0x2300000>;
+- width = <1644>;
+- height = <3840>;
+- stride = <(1644 * 4)>;
++ /* Griffin BL initializes in 2.5k mode, not 4k */
++ width = <1096>;
++ height = <2560>;
++ stride = <(1096 * 4)>;
+ format = "a8r8g8b8";
+ /*
+ * That's (going to be) a lot of clocks, but it's necessary due
+--
+2.39.2
+
--- /dev/null
+From 8e8ec7e15a316b7e20809f2f8aca20fc0a3bf262 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Jan 2023 09:49:49 +0100
+Subject: arm64: dts: qcom: sm8350: drop incorrect cells from serial
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit 6027331e6eae9eb957d1b73a7e3255f4151d6163 ]
+
+The serial/UART device node does not have children with unit addresses,
+so address/size cells are not correct.
+
+Fixes: cf03cd7e12bd ("arm64: dts: qcom: sm8350: Set up WRAP0 QUPs")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230124084951.38195-2-krzysztof.kozlowski@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm8350.dtsi | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8350.dtsi b/arch/arm64/boot/dts/qcom/sm8350.dtsi
+index fb3cd20a82b5e..646c64f0d1e28 100644
+--- a/arch/arm64/boot/dts/qcom/sm8350.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm8350.dtsi
+@@ -1043,8 +1043,6 @@ uart2: serial@98c000 {
+ interrupts = <GIC_SPI 604 IRQ_TYPE_LEVEL_HIGH>;
+ power-domains = <&rpmhpd SM8350_CX>;
+ operating-points-v2 = <&qup_opp_table_100mhz>;
+- #address-cells = <1>;
+- #size-cells = <0>;
+ status = "disabled";
+ };
+
+--
+2.39.2
+
--- /dev/null
+From 4ddb63aeda5e0dba7e4df6f50505e4c990865d16 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Nov 2022 16:20:28 +0100
+Subject: arm64: dts: qcom: sm8350-sagami: Add GPIO line names for PMIC GPIOs
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit 7c679f2a2af84edbec0c28171af8c42c6da9af14 ]
+
+Sony ever so graciously provides GPIO line names in their downstream
+kernel (though sometimes they are not 100% accurate and you can judge
+that by simply looking at them and with what drivers they are used).
+
+Add these to the PDX213&214 DTSIs to better document the hardware.
+
+Diff between 223 and 224:
+
+pm8350b
+< gpio-line-names = "NC", /* GPIO_1 */
+> gpio-line-names = "CAM_PWR_A_CS", /* GPIO_1 */
+< "NC",
+> "CAM_PWR_LD_EN",
+
+pm8350c
+< "NC",
+> "WLC_TXPWR_EN",
+
+Which is due to different camera power wiring on 213 and lack of an
+additional SLG51000 PMIC on 214.
+
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20221118152028.59312-3-konrad.dybcio@linaro.org
+Stable-dep-of: dcc7cd5c46ca ("arm64: dts: qcom: sm8350-sagami: Rectify GPIO keys")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../qcom/sm8350-sony-xperia-sagami-pdx214.dts | 23 +++++++++++++++++++
+ .../qcom/sm8350-sony-xperia-sagami-pdx215.dts | 21 +++++++++++++++++
+ .../dts/qcom/sm8350-sony-xperia-sagami.dtsi | 20 ++++++++++++++++
+ 3 files changed, 64 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8350-sony-xperia-sagami-pdx214.dts b/arch/arm64/boot/dts/qcom/sm8350-sony-xperia-sagami-pdx214.dts
+index cc650508dc2d6..e6824c8c2774d 100644
+--- a/arch/arm64/boot/dts/qcom/sm8350-sony-xperia-sagami-pdx214.dts
++++ b/arch/arm64/boot/dts/qcom/sm8350-sony-xperia-sagami-pdx214.dts
+@@ -17,3 +17,26 @@ &framebuffer {
+ height = <2520>;
+ stride = <(1080 * 4)>;
+ };
++
++&pm8350b_gpios {
++ gpio-line-names = "NC", /* GPIO_1 */
++ "NC",
++ "NC",
++ "NC",
++ "SNAPSHOT_N",
++ "NC",
++ "NC",
++ "FOCUS_N";
++};
++
++&pm8350c_gpios {
++ gpio-line-names = "FL_STROBE_TRIG_WIDE", /* GPIO_1 */
++ "FL_STROBE_TRIG_TELE",
++ "NC",
++ "NC",
++ "NC",
++ "RGBC_IR_PWR_EN",
++ "NC",
++ "NC",
++ "WIDEC_PWR_EN";
++};
+diff --git a/arch/arm64/boot/dts/qcom/sm8350-sony-xperia-sagami-pdx215.dts b/arch/arm64/boot/dts/qcom/sm8350-sony-xperia-sagami-pdx215.dts
+index d4afaa393c9a9..c6f402c3ef352 100644
+--- a/arch/arm64/boot/dts/qcom/sm8350-sony-xperia-sagami-pdx215.dts
++++ b/arch/arm64/boot/dts/qcom/sm8350-sony-xperia-sagami-pdx215.dts
+@@ -68,6 +68,15 @@ slg51000_a_ldo7: ldo7 {
+ };
+
+ &pm8350b_gpios {
++ gpio-line-names = "CAM_PWR_A_CS", /* GPIO_1 */
++ "NC",
++ "NC",
++ "NC",
++ "SNAPSHOT_N",
++ "CAM_PWR_LD_EN",
++ "NC",
++ "FOCUS_N";
++
+ cam_pwr_a_cs: cam-pwr-a-cs-state {
+ pins = "gpio1";
+ function = "normal";
+@@ -78,6 +87,18 @@ cam_pwr_a_cs: cam-pwr-a-cs-state {
+ };
+ };
+
++&pm8350c_gpios {
++ gpio-line-names = "FL_STROBE_TRIG_WIDE", /* GPIO_1 */
++ "FL_STROBE_TRIG_TELE",
++ "NC",
++ "WLC_TXPWR_EN",
++ "NC",
++ "RGBC_IR_PWR_EN",
++ "NC",
++ "NC",
++ "WIDEC_PWR_EN";
++};
++
+ &tlmm {
+ gpio-line-names = "APPS_I2C_0_SDA", /* GPIO_0 */
+ "APPS_I2C_0_SCL",
+diff --git a/arch/arm64/boot/dts/qcom/sm8350-sony-xperia-sagami.dtsi b/arch/arm64/boot/dts/qcom/sm8350-sony-xperia-sagami.dtsi
+index a10306d82a3a1..41c4101ec8f08 100644
+--- a/arch/arm64/boot/dts/qcom/sm8350-sony-xperia-sagami.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm8350-sony-xperia-sagami.dtsi
+@@ -534,6 +534,26 @@ &mpss {
+ firmware-name = "qcom/sm8350/Sony/sagami/modem.mbn";
+ };
+
++&pm8350_gpios {
++ gpio-line-names = "ASSIGN1_THERM", /* GPIO_1 */
++ "LCD_ID",
++ "SDR_MMW_THERM",
++ "RF_ID",
++ "NC",
++ "FP_LDO_EN",
++ "SP_ARI_PWR_ALARM",
++ "NC",
++ "G_ASSIST_N",
++ "PM8350_OPTION"; /* GPIO_10 */
++};
++
++&pmk8350_gpios {
++ gpio-line-names = "NC", /* GPIO_1 */
++ "NC",
++ "VOL_DOWN_N",
++ "PMK8350_OPTION";
++};
++
+ &pmk8350_rtc {
+ status = "okay";
+ };
+--
+2.39.2
+
--- /dev/null
+From 11838a98ceb2c3bc79871d469a74df7c5150e21d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Nov 2022 16:20:27 +0100
+Subject: arm64: dts: qcom: sm8350-sagami: Configure SLG51000 PMIC on PDX215
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit 8875b1d71f112b30e4c7e65ed337096bc0cc396b ]
+
+Remove the mention of this PMIC from the common DTSI, as it's not
+used on PDX214. Add the required nodes to support it on PDX215.
+
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20221118152028.59312-2-konrad.dybcio@linaro.org
+Stable-dep-of: dcc7cd5c46ca ("arm64: dts: qcom: sm8350-sagami: Rectify GPIO keys")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../qcom/sm8350-sony-xperia-sagami-pdx215.dts | 66 +++++++++++++++++++
+ .../dts/qcom/sm8350-sony-xperia-sagami.dtsi | 2 +-
+ 2 files changed, 67 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8350-sony-xperia-sagami-pdx215.dts b/arch/arm64/boot/dts/qcom/sm8350-sony-xperia-sagami-pdx215.dts
+index c74c973a69d2d..d4afaa393c9a9 100644
+--- a/arch/arm64/boot/dts/qcom/sm8350-sony-xperia-sagami-pdx215.dts
++++ b/arch/arm64/boot/dts/qcom/sm8350-sony-xperia-sagami-pdx215.dts
+@@ -12,6 +12,72 @@ / {
+ compatible = "sony,pdx215-generic", "qcom,sm8350";
+ };
+
++&i2c13 {
++ pmic@75 {
++ compatible = "dlg,slg51000";
++ reg = <0x75>;
++ dlg,cs-gpios = <&pm8350b_gpios 1 GPIO_ACTIVE_HIGH>;
++
++ pinctrl-names = "default";
++ pinctrl-0 = <&cam_pwr_a_cs>;
++
++ regulators {
++ slg51000_a_ldo1: ldo1 {
++ regulator-name = "slg51000_a_ldo1";
++ regulator-min-microvolt = <2400000>;
++ regulator-max-microvolt = <3300000>;
++ };
++
++ slg51000_a_ldo2: ldo2 {
++ regulator-name = "slg51000_a_ldo2";
++ regulator-min-microvolt = <2400000>;
++ regulator-max-microvolt = <3300000>;
++ };
++
++ slg51000_a_ldo3: ldo3 {
++ regulator-name = "slg51000_a_ldo3";
++ regulator-min-microvolt = <1200000>;
++ regulator-max-microvolt = <3750000>;
++ };
++
++ slg51000_a_ldo4: ldo4 {
++ regulator-name = "slg51000_a_ldo4";
++ regulator-min-microvolt = <1200000>;
++ regulator-max-microvolt = <3750000>;
++ };
++
++ slg51000_a_ldo5: ldo5 {
++ regulator-name = "slg51000_a_ldo5";
++ regulator-min-microvolt = <500000>;
++ regulator-max-microvolt = <1200000>;
++ };
++
++ slg51000_a_ldo6: ldo6 {
++ regulator-name = "slg51000_a_ldo6";
++ regulator-min-microvolt = <500000>;
++ regulator-max-microvolt = <1200000>;
++ };
++
++ slg51000_a_ldo7: ldo7 {
++ regulator-name = "slg51000_a_ldo7";
++ regulator-min-microvolt = <1200000>;
++ regulator-max-microvolt = <3750000>;
++ };
++ };
++ };
++};
++
++&pm8350b_gpios {
++ cam_pwr_a_cs: cam-pwr-a-cs-state {
++ pins = "gpio1";
++ function = "normal";
++ qcom,drive-strength = <PMIC_GPIO_STRENGTH_LOW>;
++ power-source = <1>;
++ drive-push-pull;
++ output-high;
++ };
++};
++
+ &tlmm {
+ gpio-line-names = "APPS_I2C_0_SDA", /* GPIO_0 */
+ "APPS_I2C_0_SCL",
+diff --git a/arch/arm64/boot/dts/qcom/sm8350-sony-xperia-sagami.dtsi b/arch/arm64/boot/dts/qcom/sm8350-sony-xperia-sagami.dtsi
+index 1f2d660f8f86c..a10306d82a3a1 100644
+--- a/arch/arm64/boot/dts/qcom/sm8350-sony-xperia-sagami.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm8350-sony-xperia-sagami.dtsi
+@@ -3,6 +3,7 @@
+ * Copyright (c) 2021, Konrad Dybcio <konrad.dybcio@somainline.org>
+ */
+
++#include <dt-bindings/pinctrl/qcom,pmic-gpio.h>
+ #include <dt-bindings/regulator/qcom,rpmh-regulator.h>
+ #include "sm8350.dtsi"
+ #include "pm8350.dtsi"
+@@ -506,7 +507,6 @@ &i2c13 {
+ clock-frequency = <100000>;
+
+ /* Qualcomm PM8008i/PM8008j (?) @ 8, 9, c, d */
+- /* Dialog SLG51000 CMIC @ 75 */
+ };
+
+ &i2c15 {
+--
+2.39.2
+
--- /dev/null
+From d532124e2413d5737bde18fdc6dd415af29bae72 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Dec 2022 11:27:12 +0100
+Subject: arm64: dts: qcom: sm8350-sagami: Rectify GPIO keys
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit dcc7cd5c46ca5e7bb8e4910ed8259597439c7246 ]
+
+With enough pins set properly, the hardware buttons now also work
+like a charm.
+
+Fixes: c2721b0c23d9 ("arm64: dts: qcom: Add support for Xperia 1 III / 5 III")
+Tested-by: Marijn Suijten <marijn.suijten@somainline.org> # On Xperia 1 III and Xperia 5 III
+Reviewed-by: Marijn Suijten <marijn.suijten@somainline.org>
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20221229102712.983306-1-konrad.dybcio@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../dts/qcom/sm8350-sony-xperia-sagami.dtsi | 66 ++++++++++++++++++-
+ 1 file changed, 64 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8350-sony-xperia-sagami.dtsi b/arch/arm64/boot/dts/qcom/sm8350-sony-xperia-sagami.dtsi
+index 41c4101ec8f08..8df6ccbedfae7 100644
+--- a/arch/arm64/boot/dts/qcom/sm8350-sony-xperia-sagami.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm8350-sony-xperia-sagami.dtsi
+@@ -49,7 +49,35 @@ framebuffer: framebuffer@e1000000 {
+ gpio-keys {
+ compatible = "gpio-keys";
+
+- /* For reasons still unknown, GAssist key and Camera Focus/Shutter don't work.. */
++ pinctrl-names = "default";
++ pinctrl-0 = <&focus_n &snapshot_n &vol_down_n &g_assist_n>;
++
++ key-camera-focus {
++ label = "Camera Focus";
++ linux,code = <KEY_CAMERA_FOCUS>;
++ gpios = <&pm8350b_gpios 8 GPIO_ACTIVE_LOW>;
++ debounce-interval = <15>;
++ linux,can-disable;
++ wakeup-source;
++ };
++
++ key-camera-snapshot {
++ label = "Camera Snapshot";
++ linux,code = <KEY_CAMERA>;
++ gpios = <&pm8350b_gpios 5 GPIO_ACTIVE_LOW>;
++ debounce-interval = <15>;
++ linux,can-disable;
++ wakeup-source;
++ };
++
++ key-google-assist {
++ label = "Google Assistant Key";
++ gpios = <&pm8350_gpios 9 GPIO_ACTIVE_LOW>;
++ linux,code = <KEY_LEFTMETA>;
++ debounce-interval = <15>;
++ linux,can-disable;
++ wakeup-source;
++ };
+
+ key-vol-down {
+ label = "Volume Down";
+@@ -57,7 +85,7 @@ key-vol-down {
+ gpios = <&pmk8350_gpios 3 GPIO_ACTIVE_LOW>;
+ debounce-interval = <15>;
+ linux,can-disable;
+- gpio-key,wakeup;
++ wakeup-source;
+ };
+ };
+
+@@ -545,6 +573,32 @@ &pm8350_gpios {
+ "NC",
+ "G_ASSIST_N",
+ "PM8350_OPTION"; /* GPIO_10 */
++
++ g_assist_n: g-assist-n-state {
++ pins = "gpio9";
++ function = "normal";
++ power-source = <1>;
++ bias-pull-up;
++ input-enable;
++ };
++};
++
++&pm8350b_gpios {
++ snapshot_n: snapshot-n-state {
++ pins = "gpio5";
++ function = "normal";
++ power-source = <0>;
++ bias-pull-up;
++ input-enable;
++ };
++
++ focus_n: focus-n-state {
++ pins = "gpio8";
++ function = "normal";
++ power-source = <0>;
++ input-enable;
++ bias-pull-up;
++ };
+ };
+
+ &pmk8350_gpios {
+@@ -552,6 +606,14 @@ &pmk8350_gpios {
+ "NC",
+ "VOL_DOWN_N",
+ "PMK8350_OPTION";
++
++ vol_down_n: vol-down-n-state {
++ pins = "gpio3";
++ function = "normal";
++ power-source = <0>;
++ bias-pull-up;
++ input-enable;
++ };
+ };
+
+ &pmk8350_rtc {
+--
+2.39.2
+
--- /dev/null
+From 637c6446c8ae3d3427eb9cceffef9d702ff269ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Dec 2022 14:21:21 +0100
+Subject: arm64: dts: qcom: sm8450: correct Soundwire wakeup interrupt name
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit 5eafe69af43d77cb117f27201076ee50f48363f1 ]
+
+The bindings expect second Soundwire interrupt to be "wakeup" (Linux
+driver takes by index):
+
+ sm8450-hdk.dtb: soundwire-controller@33b0000: interrupt-names:1: 'wakeup' was expected
+
+Fixes: 14341e76dbc7 ("arm64: dts: qcom: sm8450: add Soundwire and LPASS")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20221223132121.81130-1-krzysztof.kozlowski@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm8450.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8450.dtsi b/arch/arm64/boot/dts/qcom/sm8450.dtsi
+index 570475040d95c..eb3318516243c 100644
+--- a/arch/arm64/boot/dts/qcom/sm8450.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm8450.dtsi
+@@ -2263,7 +2263,7 @@ swr2: soundwire-controller@33b0000 {
+ reg = <0 0x33b0000 0 0x2000>;
+ interrupts-extended = <&intc GIC_SPI 496 IRQ_TYPE_LEVEL_HIGH>,
+ <&intc GIC_SPI 520 IRQ_TYPE_LEVEL_HIGH>;
+- interrupt-names = "core", "wake";
++ interrupt-names = "core", "wakeup";
+
+ clocks = <&vamacro>;
+ clock-names = "iface";
+--
+2.39.2
+
--- /dev/null
+From f744ab5a7b4db09a8ad89f0399489a6be2f6b402 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Jan 2023 09:49:50 +0100
+Subject: arm64: dts: qcom: sm8450: drop incorrect cells from serial
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit 60d2da2c916956535cf37b7bf1ae8fefbf432e55 ]
+
+The serial/UART device node does not have children with unit addresses,
+so address/size cells are not correct.
+
+Fixes: f5837418479a ("arm64: dts: qcom: sm8450: add uart20 node")
+Fixes: 5188049c9b36 ("arm64: dts: qcom: Add base SM8450 DTSI")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230124084951.38195-3-krzysztof.kozlowski@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm8450.dtsi | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8450.dtsi b/arch/arm64/boot/dts/qcom/sm8450.dtsi
+index eb3318516243c..f57980a32b433 100644
+--- a/arch/arm64/boot/dts/qcom/sm8450.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm8450.dtsi
+@@ -997,8 +997,6 @@ uart20: serial@894000 {
+ pinctrl-names = "default";
+ pinctrl-0 = <&qup_uart20_default>;
+ interrupts = <GIC_SPI 587 IRQ_TYPE_LEVEL_HIGH>;
+- #address-cells = <1>;
+- #size-cells = <0>;
+ status = "disabled";
+ };
+
+@@ -1391,8 +1389,6 @@ uart7: serial@99c000 {
+ pinctrl-names = "default";
+ pinctrl-0 = <&qup_uart7_tx>, <&qup_uart7_rx>;
+ interrupts = <GIC_SPI 608 IRQ_TYPE_LEVEL_HIGH>;
+- #address-cells = <1>;
+- #size-cells = <0>;
+ status = "disabled";
+ };
+ };
+--
+2.39.2
+
--- /dev/null
+From d719b593bf97a5fdf73cb2a1d08078b0fc5153c2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Feb 2023 15:23:09 +0100
+Subject: arm64: dts: qcom: sm8450-nagara: Correct firmware paths
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit e27f38e6255306527e32af85592d805f3360ff94 ]
+
+Nagara is definitely not SM8350, fix it!
+
+Fixes: c53532f7825c ("arm64: dts: qcom: pdx223: correct firmware paths")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230203142309.1106349-1-konrad.dybcio@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm8450-sony-xperia-nagara.dtsi | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8450-sony-xperia-nagara.dtsi b/arch/arm64/boot/dts/qcom/sm8450-sony-xperia-nagara.dtsi
+index 38256226d2297..e437e9a12069f 100644
+--- a/arch/arm64/boot/dts/qcom/sm8450-sony-xperia-nagara.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm8450-sony-xperia-nagara.dtsi
+@@ -534,17 +534,17 @@ &pcie0_phy {
+ };
+
+ &remoteproc_adsp {
+- firmware-name = "qcom/sm8350/Sony/nagara/adsp.mbn";
++ firmware-name = "qcom/sm8450/Sony/nagara/adsp.mbn";
+ status = "okay";
+ };
+
+ &remoteproc_cdsp {
+- firmware-name = "qcom/sm8350/Sony/nagara/cdsp.mbn";
++ firmware-name = "qcom/sm8450/Sony/nagara/cdsp.mbn";
+ status = "okay";
+ };
+
+ &remoteproc_slpi {
+- firmware-name = "qcom/sm8350/Sony/nagara/slpi.mbn";
++ firmware-name = "qcom/sm8450/Sony/nagara/slpi.mbn";
+ status = "okay";
+ };
+
+--
+2.39.2
+
--- /dev/null
+From 1aaa53f55ad84b4abe23c0a382b76fcccfbba645 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 14 Jan 2023 16:56:45 -0600
+Subject: arm64: dts: renesas: beacon-renesom: Fix gpio expander reference
+
+From: Adam Ford <aford173@gmail.com>
+
+[ Upstream commit d7f9492dfc03153ac56ab59066a196558748f575 ]
+
+The board used to originally introduce the Beacon Embedded RZ/G2[M/N/H]
+boards had a GPIO expander with address 20, but this was changed when
+the final board went to production.
+
+The production boards changed both the part itself and the address.
+With the incorrect address, the LCD cannot come up. If the LCD fails,
+the rcar-du driver fails to come up, and that also breaks HDMI.
+
+Pre-release board were not shipped to the general public, so it should
+be safe to push this as a fix. Anyone with a production board would
+have video fail due to this GPIO expander change.
+
+Fixes: a1d8a344f1ca ("arm64: dts: renesas: Introduce r8a774a1-beacon-rzg2m-kit")
+Signed-off-by: Adam Ford <aford173@gmail.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/20230114225647.227972-1-aford173@gmail.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../dts/renesas/beacon-renesom-baseboard.dtsi | 24 ++++++++-----------
+ 1 file changed, 10 insertions(+), 14 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/renesas/beacon-renesom-baseboard.dtsi b/arch/arm64/boot/dts/renesas/beacon-renesom-baseboard.dtsi
+index 8166e3c1ff4e5..cafde91b4721b 100644
+--- a/arch/arm64/boot/dts/renesas/beacon-renesom-baseboard.dtsi
++++ b/arch/arm64/boot/dts/renesas/beacon-renesom-baseboard.dtsi
+@@ -437,20 +437,6 @@ wm8962_endpoint: endpoint {
+ };
+ };
+
+- /* 0 - lcd_reset */
+- /* 1 - lcd_pwr */
+- /* 2 - lcd_select */
+- /* 3 - backlight-enable */
+- /* 4 - Touch_shdwn */
+- /* 5 - LCD_H_pol */
+- /* 6 - lcd_V_pol */
+- gpio_exp1: gpio@20 {
+- compatible = "onnn,pca9654";
+- reg = <0x20>;
+- gpio-controller;
+- #gpio-cells = <2>;
+- };
+-
+ touchscreen@26 {
+ compatible = "ilitek,ili2117";
+ reg = <0x26>;
+@@ -482,6 +468,16 @@ hd3ss3220_out_ep: endpoint {
+ };
+ };
+ };
++
++ gpio_exp1: gpio@70 {
++ compatible = "nxp,pca9538";
++ reg = <0x70>;
++ gpio-controller;
++ #gpio-cells = <2>;
++ gpio-line-names = "lcd_reset", "lcd_pwr", "lcd_select",
++ "backlight-enable", "Touch_shdwn",
++ "LCD_H_pol", "lcd_V_pol";
++ };
+ };
+
+ &lvds0 {
+--
+2.39.2
+
--- /dev/null
+From 3f16f660bfc27284687824279933927b4e62423c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Jan 2023 11:18:40 +0530
+Subject: arm64: dts: ti: k3-am62-main: Fix clocks for McSPI
+
+From: Dhruva Gole <d-gole@ti.com>
+
+[ Upstream commit 6be5d8e5d1804eb4cec29cd8a85dc9cb18683b5d ]
+
+Fixes the clock Device ID's in the DT according to the tisci docs clock
+identifiers for AM62x
+
+Fixes: c37c58fdeb8a ("arm64: dts: ti: k3-am62: Add more peripheral nodes")
+Reviewed-by: Bryan Brattlof <bb@ti.com>
+Signed-off-by: Dhruva Gole <d-gole@ti.com>
+Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
+Link: https://lore.kernel.org/r/20230103054840.1133711-1-d-gole@ti.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/ti/k3-am62-main.dtsi | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/ti/k3-am62-main.dtsi b/arch/arm64/boot/dts/ti/k3-am62-main.dtsi
+index 072903649d6ee..ae1ec58117c35 100644
+--- a/arch/arm64/boot/dts/ti/k3-am62-main.dtsi
++++ b/arch/arm64/boot/dts/ti/k3-am62-main.dtsi
+@@ -413,7 +413,7 @@ main_spi0: spi@20100000 {
+ #address-cells = <1>;
+ #size-cells = <0>;
+ power-domains = <&k3_pds 141 TI_SCI_PD_EXCLUSIVE>;
+- clocks = <&k3_clks 172 0>;
++ clocks = <&k3_clks 141 0>;
+ status = "disabled";
+ };
+
+@@ -424,7 +424,7 @@ main_spi1: spi@20110000 {
+ #address-cells = <1>;
+ #size-cells = <0>;
+ power-domains = <&k3_pds 142 TI_SCI_PD_EXCLUSIVE>;
+- clocks = <&k3_clks 173 0>;
++ clocks = <&k3_clks 142 0>;
+ status = "disabled";
+ };
+
+@@ -435,7 +435,7 @@ main_spi2: spi@20120000 {
+ #address-cells = <1>;
+ #size-cells = <0>;
+ power-domains = <&k3_pds 143 TI_SCI_PD_EXCLUSIVE>;
+- clocks = <&k3_clks 174 0>;
++ clocks = <&k3_clks 143 0>;
+ status = "disabled";
+ };
+
+--
+2.39.2
+
--- /dev/null
+From 3d534a1c7abec8c4f079b1ba9a3e3e992b4dc603 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Jan 2023 09:56:22 +0530
+Subject: arm64: dts: ti: k3-j7200: Fix wakeup pinmux range
+
+From: Vaishnav Achath <vaishnav.a@ti.com>
+
+[ Upstream commit 9ae21ac445e911e3541985c20052fc05d60f6879 ]
+
+The WKUP_PADCONFIG register region in J7200 has multiple non-addressable
+regions, split the existing wkup_pmx region as follows to avoid the
+non-addressable regions and include all valid WKUP_PADCONFIG registers.
+Also update references to old nodes with new ones.
+
+wkup_pmx0 -> 13 pins (WKUP_PADCONFIG 0 - 12)
+wkup_pmx1 -> 2 pins (WKUP_PADCONFIG 14 - 15)
+wkup_pmx2 -> 59 pins (WKUP_PADCONFIG 26 - 84)
+wkup_pmx3 -> 8 pins (WKUP_PADCONFIG 93 - 100)
+
+J7200 Datasheet (Table 6-106, Section 6.4 Pin Multiplexing) :
+ https://www.ti.com/lit/ds/symlink/dra821u.pdf
+
+Fixes: d361ed88455f ("arm64: dts: ti: Add support for J7200 SoC")
+
+Signed-off-by: Vaishnav Achath <vaishnav.a@ti.com>
+Reviewed-by: Jayesh Choudhary <j-choudhary@ti.com>
+Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
+Link: https://lore.kernel.org/r/20230119042622.22310-1-vaishnav.a@ti.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../dts/ti/k3-j7200-common-proc-board.dts | 2 +-
+ .../boot/dts/ti/k3-j7200-mcu-wakeup.dtsi | 29 ++++++++++++++++++-
+ 2 files changed, 29 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/ti/k3-j7200-common-proc-board.dts b/arch/arm64/boot/dts/ti/k3-j7200-common-proc-board.dts
+index 6240856e48631..0d39d6b8cc0ca 100644
+--- a/arch/arm64/boot/dts/ti/k3-j7200-common-proc-board.dts
++++ b/arch/arm64/boot/dts/ti/k3-j7200-common-proc-board.dts
+@@ -80,7 +80,7 @@ vdd_sd_dv: gpio-regulator-TLV71033 {
+ };
+ };
+
+-&wkup_pmx0 {
++&wkup_pmx2 {
+ mcu_cpsw_pins_default: mcu-cpsw-pins-default {
+ pinctrl-single,pins = <
+ J721E_WKUP_IOPAD(0x0068, PIN_OUTPUT, 0) /* MCU_RGMII1_TX_CTL */
+diff --git a/arch/arm64/boot/dts/ti/k3-j7200-mcu-wakeup.dtsi b/arch/arm64/boot/dts/ti/k3-j7200-mcu-wakeup.dtsi
+index fe669deba4896..de56a0165bd0c 100644
+--- a/arch/arm64/boot/dts/ti/k3-j7200-mcu-wakeup.dtsi
++++ b/arch/arm64/boot/dts/ti/k3-j7200-mcu-wakeup.dtsi
+@@ -56,7 +56,34 @@ chipid@43000014 {
+ wkup_pmx0: pinctrl@4301c000 {
+ compatible = "pinctrl-single";
+ /* Proxy 0 addressing */
+- reg = <0x00 0x4301c000 0x00 0x178>;
++ reg = <0x00 0x4301c000 0x00 0x34>;
++ #pinctrl-cells = <1>;
++ pinctrl-single,register-width = <32>;
++ pinctrl-single,function-mask = <0xffffffff>;
++ };
++
++ wkup_pmx1: pinctrl@0x4301c038 {
++ compatible = "pinctrl-single";
++ /* Proxy 0 addressing */
++ reg = <0x00 0x4301c038 0x00 0x8>;
++ #pinctrl-cells = <1>;
++ pinctrl-single,register-width = <32>;
++ pinctrl-single,function-mask = <0xffffffff>;
++ };
++
++ wkup_pmx2: pinctrl@0x4301c068 {
++ compatible = "pinctrl-single";
++ /* Proxy 0 addressing */
++ reg = <0x00 0x4301c068 0x00 0xec>;
++ #pinctrl-cells = <1>;
++ pinctrl-single,register-width = <32>;
++ pinctrl-single,function-mask = <0xffffffff>;
++ };
++
++ wkup_pmx3: pinctrl@0x4301c174 {
++ compatible = "pinctrl-single";
++ /* Proxy 0 addressing */
++ reg = <0x00 0x4301c174 0x00 0x20>;
+ #pinctrl-cells = <1>;
+ pinctrl-single,register-width = <32>;
+ pinctrl-single,function-mask = <0xffffffff>;
+--
+2.39.2
+
--- /dev/null
+From 75bf05df1c5b6d5677866f9e46981450185c8463 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Dec 2022 12:55:55 +0000
+Subject: arm64/sysreg: Fix errors in 32 bit enumeration values
+
+From: Mark Brown <broonie@kernel.org>
+
+[ Upstream commit 8c6e105558628b63292ae770198f11a1d5535660 ]
+
+The recently converted 32 bit ID registers have errors in MVFR0_EL1.FPSP,
+MVFR0_EL1.SIMDReg and MVFR1_EL1.SIMDHP where enumeration values which
+should be 0b0010 are specified as 0b0001. Correct these.
+
+Fixes: e79c94a2a487 ("arm64/sysreg: Convert MVFR0_EL1 to automatic generation")
+Fixes: c9b718eda706 ("arm64/sysreg: Convert MVFR1_EL1 to automatic generation")
+Reviewed-by: Mark Rutland <mark.rutland@arm.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Link: https://lore.kernel.org/r/20221207-arm64-sysreg-helpers-v3-2-0d71a7b174a8@kernel.org
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/tools/sysreg | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm64/tools/sysreg b/arch/arm64/tools/sysreg
+index 184e58fd5631a..e8fb6684d7f3c 100644
+--- a/arch/arm64/tools/sysreg
++++ b/arch/arm64/tools/sysreg
+@@ -689,17 +689,17 @@ EndEnum
+ Enum 11:8 FPDP
+ 0b0000 NI
+ 0b0001 VFPv2
+- 0b0001 VFPv3
++ 0b0010 VFPv3
+ EndEnum
+ Enum 7:4 FPSP
+ 0b0000 NI
+ 0b0001 VFPv2
+- 0b0001 VFPv3
++ 0b0010 VFPv3
+ EndEnum
+ Enum 3:0 SIMDReg
+ 0b0000 NI
+ 0b0001 IMP_16x64
+- 0b0001 IMP_32x64
++ 0b0010 IMP_32x64
+ EndEnum
+ EndSysreg
+
+@@ -718,7 +718,7 @@ EndEnum
+ Enum 23:20 SIMDHP
+ 0b0000 NI
+ 0b0001 SIMDHP
+- 0b0001 SIMDHP_FLOAT
++ 0b0010 SIMDHP_FLOAT
+ EndEnum
+ Enum 19:16 SIMDSP
+ 0b0000 NI
+--
+2.39.2
+
--- /dev/null
+From faffc9b45d458b70532c75d23f0feec981d17eab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Nov 2022 09:38:34 +0100
+Subject: arm64: tegra: Bump #address-cells and #size-cells
+
+From: Thierry Reding <treding@nvidia.com>
+
+[ Upstream commit 2838cfddbc1c4e12dacf8219efb481ab11c114a4 ]
+
+The #address-cells and #size-cells properties for the top-level bus were
+set to 1 because that was enough to represent the register ranges of all
+the IP blocks on that bus. However, most of these devices can do DMA to
+a larger address space, so translation of DMA addresses needs to happen
+in a 64-bit address space.
+
+Partially this was already done by the memory controller increasing that
+address space by setting #address-cells and #size-cells to 2, but a full
+DMA address translation would still cause truncation when traversing to
+the top-level bus.
+
+Fix this by setting #address-cells = <2> and #size-cells = <2> on the
+top-level bus and adjusting all "reg" and "ranges" properties of its
+children.
+
+While at it, also move the PCI and GPU nodes back under the top-level
+bus where they belong. The were put outside of it to work around this
+same problem.
+
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Stable-dep-of: 361238cdc525 ("arm64: tegra: Mark host1x as dma-coherent on Tegra194/234")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../boot/dts/nvidia/tegra194-p2972-0000.dts | 84 +-
+ .../boot/dts/nvidia/tegra194-p3509-0000.dtsi | 54 +-
+ arch/arm64/boot/dts/nvidia/tegra194.dtsi | 1128 ++++++------
+ .../nvidia/tegra234-p3737-0000+p3701-0000.dts | 102 +-
+ arch/arm64/boot/dts/nvidia/tegra234.dtsi | 1530 +++++++++--------
+ 5 files changed, 1453 insertions(+), 1445 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/nvidia/tegra194-p2972-0000.dts b/arch/arm64/boot/dts/nvidia/tegra194-p2972-0000.dts
+index bc1041d11f6dc..f018fc4c0f707 100644
+--- a/arch/arm64/boot/dts/nvidia/tegra194-p2972-0000.dts
++++ b/arch/arm64/boot/dts/nvidia/tegra194-p2972-0000.dts
+@@ -2184,67 +2184,67 @@ sor@15b80000 {
+ GPIO_ACTIVE_LOW>;
+ };
+ };
+- };
+
+- pcie@14100000 {
+- status = "okay";
++ pcie@14100000 {
++ status = "okay";
+
+- vddio-pex-ctl-supply = <&vdd_1v8ao>;
++ vddio-pex-ctl-supply = <&vdd_1v8ao>;
+
+- phys = <&p2u_hsio_0>;
+- phy-names = "p2u-0";
+- };
++ phys = <&p2u_hsio_0>;
++ phy-names = "p2u-0";
++ };
+
+- pcie@14140000 {
+- status = "okay";
++ pcie@14140000 {
++ status = "okay";
+
+- vddio-pex-ctl-supply = <&vdd_1v8ao>;
++ vddio-pex-ctl-supply = <&vdd_1v8ao>;
+
+- phys = <&p2u_hsio_7>;
+- phy-names = "p2u-0";
+- };
++ phys = <&p2u_hsio_7>;
++ phy-names = "p2u-0";
++ };
+
+- pcie@14180000 {
+- status = "okay";
++ pcie@14180000 {
++ status = "okay";
+
+- vddio-pex-ctl-supply = <&vdd_1v8ao>;
++ vddio-pex-ctl-supply = <&vdd_1v8ao>;
+
+- phys = <&p2u_hsio_2>, <&p2u_hsio_3>, <&p2u_hsio_4>,
+- <&p2u_hsio_5>;
+- phy-names = "p2u-0", "p2u-1", "p2u-2", "p2u-3";
+- };
++ phys = <&p2u_hsio_2>, <&p2u_hsio_3>, <&p2u_hsio_4>,
++ <&p2u_hsio_5>;
++ phy-names = "p2u-0", "p2u-1", "p2u-2", "p2u-3";
++ };
+
+- pcie@141a0000 {
+- status = "okay";
++ pcie@141a0000 {
++ status = "okay";
+
+- vddio-pex-ctl-supply = <&vdd_1v8ao>;
+- vpcie3v3-supply = <&vdd_3v3_pcie>;
+- vpcie12v-supply = <&vdd_12v_pcie>;
++ vddio-pex-ctl-supply = <&vdd_1v8ao>;
++ vpcie3v3-supply = <&vdd_3v3_pcie>;
++ vpcie12v-supply = <&vdd_12v_pcie>;
+
+- phys = <&p2u_nvhs_0>, <&p2u_nvhs_1>, <&p2u_nvhs_2>,
+- <&p2u_nvhs_3>, <&p2u_nvhs_4>, <&p2u_nvhs_5>,
+- <&p2u_nvhs_6>, <&p2u_nvhs_7>;
++ phys = <&p2u_nvhs_0>, <&p2u_nvhs_1>, <&p2u_nvhs_2>,
++ <&p2u_nvhs_3>, <&p2u_nvhs_4>, <&p2u_nvhs_5>,
++ <&p2u_nvhs_6>, <&p2u_nvhs_7>;
+
+- phy-names = "p2u-0", "p2u-1", "p2u-2", "p2u-3", "p2u-4",
+- "p2u-5", "p2u-6", "p2u-7";
+- };
++ phy-names = "p2u-0", "p2u-1", "p2u-2", "p2u-3", "p2u-4",
++ "p2u-5", "p2u-6", "p2u-7";
++ };
+
+- pcie-ep@141a0000 {
+- status = "disabled";
++ pcie-ep@141a0000 {
++ status = "disabled";
+
+- vddio-pex-ctl-supply = <&vdd_1v8ao>;
++ vddio-pex-ctl-supply = <&vdd_1v8ao>;
+
+- reset-gpios = <&gpio TEGRA194_MAIN_GPIO(GG, 1) GPIO_ACTIVE_LOW>;
++ reset-gpios = <&gpio TEGRA194_MAIN_GPIO(GG, 1) GPIO_ACTIVE_LOW>;
+
+- nvidia,refclk-select-gpios = <&gpio_aon TEGRA194_AON_GPIO(AA, 5)
+- GPIO_ACTIVE_HIGH>;
++ nvidia,refclk-select-gpios = <&gpio_aon TEGRA194_AON_GPIO(AA, 5)
++ GPIO_ACTIVE_HIGH>;
+
+- phys = <&p2u_nvhs_0>, <&p2u_nvhs_1>, <&p2u_nvhs_2>,
+- <&p2u_nvhs_3>, <&p2u_nvhs_4>, <&p2u_nvhs_5>,
+- <&p2u_nvhs_6>, <&p2u_nvhs_7>;
++ phys = <&p2u_nvhs_0>, <&p2u_nvhs_1>, <&p2u_nvhs_2>,
++ <&p2u_nvhs_3>, <&p2u_nvhs_4>, <&p2u_nvhs_5>,
++ <&p2u_nvhs_6>, <&p2u_nvhs_7>;
+
+- phy-names = "p2u-0", "p2u-1", "p2u-2", "p2u-3", "p2u-4",
+- "p2u-5", "p2u-6", "p2u-7";
++ phy-names = "p2u-0", "p2u-1", "p2u-2", "p2u-3", "p2u-4",
++ "p2u-5", "p2u-6", "p2u-7";
++ };
+ };
+
+ fan: pwm-fan {
+diff --git a/arch/arm64/boot/dts/nvidia/tegra194-p3509-0000.dtsi b/arch/arm64/boot/dts/nvidia/tegra194-p3509-0000.dtsi
+index f212f6aced047..617fbfaaf02f6 100644
+--- a/arch/arm64/boot/dts/nvidia/tegra194-p3509-0000.dtsi
++++ b/arch/arm64/boot/dts/nvidia/tegra194-p3509-0000.dtsi
+@@ -2209,46 +2209,46 @@ sor@15b40000 {
+ GPIO_ACTIVE_LOW>;
+ };
+ };
+- };
+
+- pcie@14160000 {
+- status = "okay";
++ pcie@14160000 {
++ status = "okay";
+
+- vddio-pex-ctl-supply = <&vdd_1v8ao>;
++ vddio-pex-ctl-supply = <&vdd_1v8ao>;
+
+- phys = <&p2u_hsio_11>;
+- phy-names = "p2u-0";
+- };
++ phys = <&p2u_hsio_11>;
++ phy-names = "p2u-0";
++ };
+
+- pcie@141a0000 {
+- status = "okay";
++ pcie@141a0000 {
++ status = "okay";
+
+- vddio-pex-ctl-supply = <&vdd_1v8ao>;
++ vddio-pex-ctl-supply = <&vdd_1v8ao>;
+
+- phys = <&p2u_nvhs_0>, <&p2u_nvhs_1>, <&p2u_nvhs_2>,
+- <&p2u_nvhs_3>, <&p2u_nvhs_4>, <&p2u_nvhs_5>,
+- <&p2u_nvhs_6>, <&p2u_nvhs_7>;
++ phys = <&p2u_nvhs_0>, <&p2u_nvhs_1>, <&p2u_nvhs_2>,
++ <&p2u_nvhs_3>, <&p2u_nvhs_4>, <&p2u_nvhs_5>,
++ <&p2u_nvhs_6>, <&p2u_nvhs_7>;
+
+- phy-names = "p2u-0", "p2u-1", "p2u-2", "p2u-3", "p2u-4",
+- "p2u-5", "p2u-6", "p2u-7";
+- };
++ phy-names = "p2u-0", "p2u-1", "p2u-2", "p2u-3", "p2u-4",
++ "p2u-5", "p2u-6", "p2u-7";
++ };
+
+- pcie-ep@141a0000 {
+- status = "disabled";
++ pcie-ep@141a0000 {
++ status = "disabled";
+
+- vddio-pex-ctl-supply = <&vdd_1v8ao>;
++ vddio-pex-ctl-supply = <&vdd_1v8ao>;
+
+- reset-gpios = <&gpio TEGRA194_MAIN_GPIO(GG, 1) GPIO_ACTIVE_LOW>;
++ reset-gpios = <&gpio TEGRA194_MAIN_GPIO(GG, 1) GPIO_ACTIVE_LOW>;
+
+- nvidia,refclk-select-gpios = <&gpio_aon TEGRA194_AON_GPIO(AA, 5)
+- GPIO_ACTIVE_HIGH>;
++ nvidia,refclk-select-gpios = <&gpio_aon TEGRA194_AON_GPIO(AA, 5)
++ GPIO_ACTIVE_HIGH>;
+
+- phys = <&p2u_nvhs_0>, <&p2u_nvhs_1>, <&p2u_nvhs_2>,
+- <&p2u_nvhs_3>, <&p2u_nvhs_4>, <&p2u_nvhs_5>,
+- <&p2u_nvhs_6>, <&p2u_nvhs_7>;
++ phys = <&p2u_nvhs_0>, <&p2u_nvhs_1>, <&p2u_nvhs_2>,
++ <&p2u_nvhs_3>, <&p2u_nvhs_4>, <&p2u_nvhs_5>,
++ <&p2u_nvhs_6>, <&p2u_nvhs_7>;
+
+- phy-names = "p2u-0", "p2u-1", "p2u-2", "p2u-3", "p2u-4",
+- "p2u-5", "p2u-6", "p2u-7";
++ phy-names = "p2u-0", "p2u-1", "p2u-2", "p2u-3", "p2u-4",
++ "p2u-5", "p2u-6", "p2u-7";
++ };
+ };
+
+ fan: pwm-fan {
+diff --git a/arch/arm64/boot/dts/nvidia/tegra194.dtsi b/arch/arm64/boot/dts/nvidia/tegra194.dtsi
+index 4afcbd60e144e..b941b1c77713c 100644
+--- a/arch/arm64/boot/dts/nvidia/tegra194.dtsi
++++ b/arch/arm64/boot/dts/nvidia/tegra194.dtsi
+@@ -19,21 +19,22 @@ / {
+ /* control backbone */
+ bus@0 {
+ compatible = "simple-bus";
+- #address-cells = <1>;
+- #size-cells = <1>;
+- ranges = <0x0 0x0 0x0 0x40000000>;
++
++ #address-cells = <2>;
++ #size-cells = <2>;
++ ranges = <0x0 0x0 0x0 0x0 0x0 0x40000000>;
+
+ apbmisc: misc@100000 {
+ compatible = "nvidia,tegra194-misc";
+- reg = <0x00100000 0xf000>,
+- <0x0010f000 0x1000>;
++ reg = <0x0 0x00100000 0x0 0xf000>,
++ <0x0 0x0010f000 0x0 0x1000>;
+ };
+
+ gpio: gpio@2200000 {
+ compatible = "nvidia,tegra194-gpio";
+ reg-names = "security", "gpio";
+- reg = <0x2200000 0x10000>,
+- <0x2210000 0x10000>;
++ reg = <0x0 0x2200000 0x0 0x10000>,
++ <0x0 0x2210000 0x0 0x10000>;
+ interrupts = <GIC_SPI 288 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 289 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 290 IRQ_TYPE_LEVEL_HIGH>,
+@@ -91,7 +92,7 @@ gpio: gpio@2200000 {
+
+ cbb-noc@2300000 {
+ compatible = "nvidia,tegra194-cbb-noc";
+- reg = <0x02300000 0x1000>;
++ reg = <0x0 0x02300000 0x0 0x1000>;
+ interrupts = <GIC_SPI 230 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 231 IRQ_TYPE_LEVEL_HIGH>;
+ nvidia,axi2apb = <&axi2apb>;
+@@ -101,12 +102,12 @@ cbb-noc@2300000 {
+
+ axi2apb: axi2apb@2390000 {
+ compatible = "nvidia,tegra194-axi2apb";
+- reg = <0x2390000 0x1000>,
+- <0x23a0000 0x1000>,
+- <0x23b0000 0x1000>,
+- <0x23c0000 0x1000>,
+- <0x23d0000 0x1000>,
+- <0x23e0000 0x1000>;
++ reg = <0x0 0x2390000 0x0 0x1000>,
++ <0x0 0x23a0000 0x0 0x1000>,
++ <0x0 0x23b0000 0x0 0x1000>,
++ <0x0 0x23c0000 0x0 0x1000>,
++ <0x0 0x23d0000 0x0 0x1000>,
++ <0x0 0x23e0000 0x0 0x1000>;
+ status = "okay";
+ };
+
+@@ -114,7 +115,7 @@ ethernet@2490000 {
+ compatible = "nvidia,tegra194-eqos",
+ "nvidia,tegra186-eqos",
+ "snps,dwc-qos-ethernet-4.10";
+- reg = <0x02490000 0x10000>;
++ reg = <0x0 0x02490000 0x0 0x10000>;
+ interrupts = <GIC_SPI 194 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&bpmp TEGRA194_CLK_AXI_CBB>,
+ <&bpmp TEGRA194_CLK_EQOS_AXI>,
+@@ -140,7 +141,7 @@ ethernet@2490000 {
+ gpcdma: dma-controller@2600000 {
+ compatible = "nvidia,tegra194-gpcdma",
+ "nvidia,tegra186-gpcdma";
+- reg = <0x2600000 0x210000>;
++ reg = <0x0 0x2600000 0x0 0x210000>;
+ resets = <&bpmp TEGRA194_RESET_GPCDMA>;
+ reset-names = "gpcdma";
+ interrupts = <GIC_SPI 75 IRQ_TYPE_LEVEL_HIGH>,
+@@ -189,15 +190,16 @@ aconnect@2900000 {
+ <&bpmp TEGRA194_CLK_APB2APE>;
+ clock-names = "ape", "apb2ape";
+ power-domains = <&bpmp TEGRA194_POWER_DOMAIN_AUD>;
+- #address-cells = <1>;
+- #size-cells = <1>;
+- ranges = <0x02900000 0x02900000 0x200000>;
+ status = "disabled";
+
++ #address-cells = <2>;
++ #size-cells = <2>;
++ ranges = <0x0 0x02900000 0x0 0x02900000 0x0 0x200000>;
++
+ adma: dma-controller@2930000 {
+ compatible = "nvidia,tegra194-adma",
+ "nvidia,tegra186-adma";
+- reg = <0x02930000 0x20000>;
++ reg = <0x0 0x02930000 0x0 0x20000>;
+ interrupt-parent = <&agic>;
+ interrupts = <GIC_SPI 0 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 1 IRQ_TYPE_LEVEL_HIGH>,
+@@ -242,8 +244,8 @@ agic: interrupt-controller@2a40000 {
+ "nvidia,tegra210-agic";
+ #interrupt-cells = <3>;
+ interrupt-controller;
+- reg = <0x02a41000 0x1000>,
+- <0x02a42000 0x2000>;
++ reg = <0x0 0x02a41000 0x0 0x1000>,
++ <0x0 0x02a42000 0x0 0x2000>;
+ interrupts = <GIC_SPI 145
+ (GIC_CPU_MASK_SIMPLE(4) |
+ IRQ_TYPE_LEVEL_HIGH)>;
+@@ -255,20 +257,21 @@ agic: interrupt-controller@2a40000 {
+ tegra_ahub: ahub@2900800 {
+ compatible = "nvidia,tegra194-ahub",
+ "nvidia,tegra186-ahub";
+- reg = <0x02900800 0x800>;
++ reg = <0x0 0x02900800 0x0 0x800>;
+ clocks = <&bpmp TEGRA194_CLK_AHUB>;
+ clock-names = "ahub";
+ assigned-clocks = <&bpmp TEGRA194_CLK_AHUB>;
+ assigned-clock-parents = <&bpmp TEGRA194_CLK_PLLA_OUT0>;
+- #address-cells = <1>;
+- #size-cells = <1>;
+- ranges = <0x02900800 0x02900800 0x11800>;
+ status = "disabled";
+
++ #address-cells = <2>;
++ #size-cells = <2>;
++ ranges = <0x0 0x02900800 0x0 0x02900800 0x0 0x11800>;
++
+ tegra_admaif: admaif@290f000 {
+ compatible = "nvidia,tegra194-admaif",
+ "nvidia,tegra186-admaif";
+- reg = <0x0290f000 0x1000>;
++ reg = <0x0 0x0290f000 0x0 0x1000>;
+ dmas = <&adma 1>, <&adma 1>,
+ <&adma 2>, <&adma 2>,
+ <&adma 3>, <&adma 3>,
+@@ -319,7 +322,7 @@ tegra_admaif: admaif@290f000 {
+ tegra_i2s1: i2s@2901000 {
+ compatible = "nvidia,tegra194-i2s",
+ "nvidia,tegra210-i2s";
+- reg = <0x2901000 0x100>;
++ reg = <0x0 0x2901000 0x0 0x100>;
+ clocks = <&bpmp TEGRA194_CLK_I2S1>,
+ <&bpmp TEGRA194_CLK_I2S1_SYNC_INPUT>;
+ clock-names = "i2s", "sync_input";
+@@ -333,7 +336,7 @@ tegra_i2s1: i2s@2901000 {
+ tegra_i2s2: i2s@2901100 {
+ compatible = "nvidia,tegra194-i2s",
+ "nvidia,tegra210-i2s";
+- reg = <0x2901100 0x100>;
++ reg = <0x0 0x2901100 0x0 0x100>;
+ clocks = <&bpmp TEGRA194_CLK_I2S2>,
+ <&bpmp TEGRA194_CLK_I2S2_SYNC_INPUT>;
+ clock-names = "i2s", "sync_input";
+@@ -347,7 +350,7 @@ tegra_i2s2: i2s@2901100 {
+ tegra_i2s3: i2s@2901200 {
+ compatible = "nvidia,tegra194-i2s",
+ "nvidia,tegra210-i2s";
+- reg = <0x2901200 0x100>;
++ reg = <0x0 0x2901200 0x0 0x100>;
+ clocks = <&bpmp TEGRA194_CLK_I2S3>,
+ <&bpmp TEGRA194_CLK_I2S3_SYNC_INPUT>;
+ clock-names = "i2s", "sync_input";
+@@ -361,7 +364,7 @@ tegra_i2s3: i2s@2901200 {
+ tegra_i2s4: i2s@2901300 {
+ compatible = "nvidia,tegra194-i2s",
+ "nvidia,tegra210-i2s";
+- reg = <0x2901300 0x100>;
++ reg = <0x0 0x2901300 0x0 0x100>;
+ clocks = <&bpmp TEGRA194_CLK_I2S4>,
+ <&bpmp TEGRA194_CLK_I2S4_SYNC_INPUT>;
+ clock-names = "i2s", "sync_input";
+@@ -375,7 +378,7 @@ tegra_i2s4: i2s@2901300 {
+ tegra_i2s5: i2s@2901400 {
+ compatible = "nvidia,tegra194-i2s",
+ "nvidia,tegra210-i2s";
+- reg = <0x2901400 0x100>;
++ reg = <0x0 0x2901400 0x0 0x100>;
+ clocks = <&bpmp TEGRA194_CLK_I2S5>,
+ <&bpmp TEGRA194_CLK_I2S5_SYNC_INPUT>;
+ clock-names = "i2s", "sync_input";
+@@ -389,7 +392,7 @@ tegra_i2s5: i2s@2901400 {
+ tegra_i2s6: i2s@2901500 {
+ compatible = "nvidia,tegra194-i2s",
+ "nvidia,tegra210-i2s";
+- reg = <0x2901500 0x100>;
++ reg = <0x0 0x2901500 0x0 0x100>;
+ clocks = <&bpmp TEGRA194_CLK_I2S6>,
+ <&bpmp TEGRA194_CLK_I2S6_SYNC_INPUT>;
+ clock-names = "i2s", "sync_input";
+@@ -403,7 +406,7 @@ tegra_i2s6: i2s@2901500 {
+ tegra_dmic1: dmic@2904000 {
+ compatible = "nvidia,tegra194-dmic",
+ "nvidia,tegra210-dmic";
+- reg = <0x2904000 0x100>;
++ reg = <0x0 0x2904000 0x0 0x100>;
+ clocks = <&bpmp TEGRA194_CLK_DMIC1>;
+ clock-names = "dmic";
+ assigned-clocks = <&bpmp TEGRA194_CLK_DMIC1>;
+@@ -416,7 +419,7 @@ tegra_dmic1: dmic@2904000 {
+ tegra_dmic2: dmic@2904100 {
+ compatible = "nvidia,tegra194-dmic",
+ "nvidia,tegra210-dmic";
+- reg = <0x2904100 0x100>;
++ reg = <0x0 0x2904100 0x0 0x100>;
+ clocks = <&bpmp TEGRA194_CLK_DMIC2>;
+ clock-names = "dmic";
+ assigned-clocks = <&bpmp TEGRA194_CLK_DMIC2>;
+@@ -429,7 +432,7 @@ tegra_dmic2: dmic@2904100 {
+ tegra_dmic3: dmic@2904200 {
+ compatible = "nvidia,tegra194-dmic",
+ "nvidia,tegra210-dmic";
+- reg = <0x2904200 0x100>;
++ reg = <0x0 0x2904200 0x0 0x100>;
+ clocks = <&bpmp TEGRA194_CLK_DMIC3>;
+ clock-names = "dmic";
+ assigned-clocks = <&bpmp TEGRA194_CLK_DMIC3>;
+@@ -442,7 +445,7 @@ tegra_dmic3: dmic@2904200 {
+ tegra_dmic4: dmic@2904300 {
+ compatible = "nvidia,tegra194-dmic",
+ "nvidia,tegra210-dmic";
+- reg = <0x2904300 0x100>;
++ reg = <0x0 0x2904300 0x0 0x100>;
+ clocks = <&bpmp TEGRA194_CLK_DMIC4>;
+ clock-names = "dmic";
+ assigned-clocks = <&bpmp TEGRA194_CLK_DMIC4>;
+@@ -455,7 +458,7 @@ tegra_dmic4: dmic@2904300 {
+ tegra_dspk1: dspk@2905000 {
+ compatible = "nvidia,tegra194-dspk",
+ "nvidia,tegra186-dspk";
+- reg = <0x2905000 0x100>;
++ reg = <0x0 0x2905000 0x0 0x100>;
+ clocks = <&bpmp TEGRA194_CLK_DSPK1>;
+ clock-names = "dspk";
+ assigned-clocks = <&bpmp TEGRA194_CLK_DSPK1>;
+@@ -468,7 +471,7 @@ tegra_dspk1: dspk@2905000 {
+ tegra_dspk2: dspk@2905100 {
+ compatible = "nvidia,tegra194-dspk",
+ "nvidia,tegra186-dspk";
+- reg = <0x2905100 0x100>;
++ reg = <0x0 0x2905100 0x0 0x100>;
+ clocks = <&bpmp TEGRA194_CLK_DSPK2>;
+ clock-names = "dspk";
+ assigned-clocks = <&bpmp TEGRA194_CLK_DSPK2>;
+@@ -481,7 +484,7 @@ tegra_dspk2: dspk@2905100 {
+ tegra_sfc1: sfc@2902000 {
+ compatible = "nvidia,tegra194-sfc",
+ "nvidia,tegra210-sfc";
+- reg = <0x2902000 0x200>;
++ reg = <0x0 0x2902000 0x0 0x200>;
+ sound-name-prefix = "SFC1";
+ status = "disabled";
+ };
+@@ -489,7 +492,7 @@ tegra_sfc1: sfc@2902000 {
+ tegra_sfc2: sfc@2902200 {
+ compatible = "nvidia,tegra194-sfc",
+ "nvidia,tegra210-sfc";
+- reg = <0x2902200 0x200>;
++ reg = <0x0 0x2902200 0x0 0x200>;
+ sound-name-prefix = "SFC2";
+ status = "disabled";
+ };
+@@ -497,7 +500,7 @@ tegra_sfc2: sfc@2902200 {
+ tegra_sfc3: sfc@2902400 {
+ compatible = "nvidia,tegra194-sfc",
+ "nvidia,tegra210-sfc";
+- reg = <0x2902400 0x200>;
++ reg = <0x0 0x2902400 0x0 0x200>;
+ sound-name-prefix = "SFC3";
+ status = "disabled";
+ };
+@@ -505,7 +508,7 @@ tegra_sfc3: sfc@2902400 {
+ tegra_sfc4: sfc@2902600 {
+ compatible = "nvidia,tegra194-sfc",
+ "nvidia,tegra210-sfc";
+- reg = <0x2902600 0x200>;
++ reg = <0x0 0x2902600 0x0 0x200>;
+ sound-name-prefix = "SFC4";
+ status = "disabled";
+ };
+@@ -513,7 +516,7 @@ tegra_sfc4: sfc@2902600 {
+ tegra_mvc1: mvc@290a000 {
+ compatible = "nvidia,tegra194-mvc",
+ "nvidia,tegra210-mvc";
+- reg = <0x290a000 0x200>;
++ reg = <0x0 0x290a000 0x0 0x200>;
+ sound-name-prefix = "MVC1";
+ status = "disabled";
+ };
+@@ -521,35 +524,35 @@ tegra_mvc1: mvc@290a000 {
+ tegra_mvc2: mvc@290a200 {
+ compatible = "nvidia,tegra194-mvc",
+ "nvidia,tegra210-mvc";
+- reg = <0x290a200 0x200>;
++ reg = <0x0 0x290a200 0x0 0x200>;
+ sound-name-prefix = "MVC2";
+ status = "disabled";
+ };
+
+ tegra_amx1: amx@2903000 {
+ compatible = "nvidia,tegra194-amx";
+- reg = <0x2903000 0x100>;
++ reg = <0x0 0x2903000 0x0 0x100>;
+ sound-name-prefix = "AMX1";
+ status = "disabled";
+ };
+
+ tegra_amx2: amx@2903100 {
+ compatible = "nvidia,tegra194-amx";
+- reg = <0x2903100 0x100>;
++ reg = <0x0 0x2903100 0x0 0x100>;
+ sound-name-prefix = "AMX2";
+ status = "disabled";
+ };
+
+ tegra_amx3: amx@2903200 {
+ compatible = "nvidia,tegra194-amx";
+- reg = <0x2903200 0x100>;
++ reg = <0x0 0x2903200 0x0 0x100>;
+ sound-name-prefix = "AMX3";
+ status = "disabled";
+ };
+
+ tegra_amx4: amx@2903300 {
+ compatible = "nvidia,tegra194-amx";
+- reg = <0x2903300 0x100>;
++ reg = <0x0 0x2903300 0x0 0x100>;
+ sound-name-prefix = "AMX4";
+ status = "disabled";
+ };
+@@ -557,7 +560,7 @@ tegra_amx4: amx@2903300 {
+ tegra_adx1: adx@2903800 {
+ compatible = "nvidia,tegra194-adx",
+ "nvidia,tegra210-adx";
+- reg = <0x2903800 0x100>;
++ reg = <0x0 0x2903800 0x0 0x100>;
+ sound-name-prefix = "ADX1";
+ status = "disabled";
+ };
+@@ -565,7 +568,7 @@ tegra_adx1: adx@2903800 {
+ tegra_adx2: adx@2903900 {
+ compatible = "nvidia,tegra194-adx",
+ "nvidia,tegra210-adx";
+- reg = <0x2903900 0x100>;
++ reg = <0x0 0x2903900 0x0 0x100>;
+ sound-name-prefix = "ADX2";
+ status = "disabled";
+ };
+@@ -573,7 +576,7 @@ tegra_adx2: adx@2903900 {
+ tegra_adx3: adx@2903a00 {
+ compatible = "nvidia,tegra194-adx",
+ "nvidia,tegra210-adx";
+- reg = <0x2903a00 0x100>;
++ reg = <0x0 0x2903a00 0x0 0x100>;
+ sound-name-prefix = "ADX3";
+ status = "disabled";
+ };
+@@ -581,7 +584,7 @@ tegra_adx3: adx@2903a00 {
+ tegra_adx4: adx@2903b00 {
+ compatible = "nvidia,tegra194-adx",
+ "nvidia,tegra210-adx";
+- reg = <0x2903b00 0x100>;
++ reg = <0x0 0x2903b00 0x0 0x100>;
+ sound-name-prefix = "ADX4";
+ status = "disabled";
+ };
+@@ -589,30 +592,31 @@ tegra_adx4: adx@2903b00 {
+ tegra_ope1: processing-engine@2908000 {
+ compatible = "nvidia,tegra194-ope",
+ "nvidia,tegra210-ope";
+- reg = <0x2908000 0x100>;
+- #address-cells = <1>;
+- #size-cells = <1>;
+- ranges;
++ reg = <0x0 0x2908000 0x0 0x100>;
+ sound-name-prefix = "OPE1";
+ status = "disabled";
+
++ #address-cells = <2>;
++ #size-cells = <2>;
++ ranges;
++
+ equalizer@2908100 {
+ compatible = "nvidia,tegra194-peq",
+ "nvidia,tegra210-peq";
+- reg = <0x2908100 0x100>;
++ reg = <0x0 0x2908100 0x0 0x100>;
+ };
+
+ dynamic-range-compressor@2908200 {
+ compatible = "nvidia,tegra194-mbdrc",
+ "nvidia,tegra210-mbdrc";
+- reg = <0x2908200 0x200>;
++ reg = <0x0 0x2908200 0x0 0x200>;
+ };
+ };
+
+ tegra_amixer: amixer@290bb00 {
+ compatible = "nvidia,tegra194-amixer",
+ "nvidia,tegra210-amixer";
+- reg = <0x290bb00 0x800>;
++ reg = <0x0 0x290bb00 0x0 0x800>;
+ sound-name-prefix = "MIXER1";
+ status = "disabled";
+ };
+@@ -620,7 +624,7 @@ tegra_amixer: amixer@290bb00 {
+ tegra_asrc: asrc@2910000 {
+ compatible = "nvidia,tegra194-asrc",
+ "nvidia,tegra186-asrc";
+- reg = <0x2910000 0x2000>;
++ reg = <0x0 0x2910000 0x0 0x2000>;
+ sound-name-prefix = "ASRC1";
+ status = "disabled";
+ };
+@@ -629,7 +633,7 @@ tegra_asrc: asrc@2910000 {
+
+ pinmux: pinmux@2430000 {
+ compatible = "nvidia,tegra194-pinmux";
+- reg = <0x2430000 0x17000>;
++ reg = <0x0 0x2430000 0x0 0x17000>;
+ status = "okay";
+
+ pex_rst_c5_out_state: pinmux-pex-rst-c5-out {
+@@ -657,24 +661,24 @@ clkreq {
+
+ mc: memory-controller@2c00000 {
+ compatible = "nvidia,tegra194-mc";
+- reg = <0x02c00000 0x10000>, /* MC-SID */
+- <0x02c10000 0x10000>, /* MC Broadcast*/
+- <0x02c20000 0x10000>, /* MC0 */
+- <0x02c30000 0x10000>, /* MC1 */
+- <0x02c40000 0x10000>, /* MC2 */
+- <0x02c50000 0x10000>, /* MC3 */
+- <0x02b80000 0x10000>, /* MC4 */
+- <0x02b90000 0x10000>, /* MC5 */
+- <0x02ba0000 0x10000>, /* MC6 */
+- <0x02bb0000 0x10000>, /* MC7 */
+- <0x01700000 0x10000>, /* MC8 */
+- <0x01710000 0x10000>, /* MC9 */
+- <0x01720000 0x10000>, /* MC10 */
+- <0x01730000 0x10000>, /* MC11 */
+- <0x01740000 0x10000>, /* MC12 */
+- <0x01750000 0x10000>, /* MC13 */
+- <0x01760000 0x10000>, /* MC14 */
+- <0x01770000 0x10000>; /* MC15 */
++ reg = <0x0 0x02c00000 0x0 0x10000>, /* MC-SID */
++ <0x0 0x02c10000 0x0 0x10000>, /* MC Broadcast*/
++ <0x0 0x02c20000 0x0 0x10000>, /* MC0 */
++ <0x0 0x02c30000 0x0 0x10000>, /* MC1 */
++ <0x0 0x02c40000 0x0 0x10000>, /* MC2 */
++ <0x0 0x02c50000 0x0 0x10000>, /* MC3 */
++ <0x0 0x02b80000 0x0 0x10000>, /* MC4 */
++ <0x0 0x02b90000 0x0 0x10000>, /* MC5 */
++ <0x0 0x02ba0000 0x0 0x10000>, /* MC6 */
++ <0x0 0x02bb0000 0x0 0x10000>, /* MC7 */
++ <0x0 0x01700000 0x0 0x10000>, /* MC8 */
++ <0x0 0x01710000 0x0 0x10000>, /* MC9 */
++ <0x0 0x01720000 0x0 0x10000>, /* MC10 */
++ <0x0 0x01730000 0x0 0x10000>, /* MC11 */
++ <0x0 0x01740000 0x0 0x10000>, /* MC12 */
++ <0x0 0x01750000 0x0 0x10000>, /* MC13 */
++ <0x0 0x01760000 0x0 0x10000>, /* MC14 */
++ <0x0 0x01770000 0x0 0x10000>; /* MC15 */
+ reg-names = "sid", "broadcast", "ch0", "ch1", "ch2", "ch3",
+ "ch4", "ch5", "ch6", "ch7", "ch8", "ch9", "ch10",
+ "ch11", "ch12", "ch13", "ch14", "ch15";
+@@ -684,10 +688,9 @@ mc: memory-controller@2c00000 {
+
+ #address-cells = <2>;
+ #size-cells = <2>;
+-
+- ranges = <0x01700000 0x0 0x01700000 0x0 0x100000>,
+- <0x02b80000 0x0 0x02b80000 0x0 0x040000>,
+- <0x02c00000 0x0 0x02c00000 0x0 0x100000>;
++ ranges = <0x0 0x01700000 0x0 0x01700000 0x0 0x100000>,
++ <0x0 0x02b80000 0x0 0x02b80000 0x0 0x040000>,
++ <0x0 0x02c00000 0x0 0x02c00000 0x0 0x100000>;
+
+ /*
+ * Bit 39 of addresses passing through the memory
+@@ -704,7 +707,7 @@ mc: memory-controller@2c00000 {
+ *
+ * Limit the DMA range for memory clients to [38:0].
+ */
+- dma-ranges = <0x0 0x0 0x0 0x80 0x0>;
++ dma-ranges = <0x0 0x0 0x0 0x0 0x80 0x0>;
+
+ emc: external-memory-controller@2c60000 {
+ compatible = "nvidia,tegra194-emc";
+@@ -722,7 +725,7 @@ emc: external-memory-controller@2c60000 {
+
+ timer@3010000 {
+ compatible = "nvidia,tegra186-timer";
+- reg = <0x03010000 0x000e0000>;
++ reg = <0x0 0x03010000 0x0 0x000e0000>;
+ interrupts = <GIC_SPI 0 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 1 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 2 IRQ_TYPE_LEVEL_HIGH>,
+@@ -738,7 +741,7 @@ timer@3010000 {
+
+ uarta: serial@3100000 {
+ compatible = "nvidia,tegra194-uart", "nvidia,tegra20-uart";
+- reg = <0x03100000 0x40>;
++ reg = <0x0 0x03100000 0x0 0x40>;
+ reg-shift = <2>;
+ interrupts = <GIC_SPI 112 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&bpmp TEGRA194_CLK_UARTA>;
+@@ -750,7 +753,7 @@ uarta: serial@3100000 {
+
+ uartb: serial@3110000 {
+ compatible = "nvidia,tegra194-uart", "nvidia,tegra20-uart";
+- reg = <0x03110000 0x40>;
++ reg = <0x0 0x03110000 0x0 0x40>;
+ reg-shift = <2>;
+ interrupts = <GIC_SPI 113 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&bpmp TEGRA194_CLK_UARTB>;
+@@ -762,7 +765,7 @@ uartb: serial@3110000 {
+
+ uartd: serial@3130000 {
+ compatible = "nvidia,tegra194-uart", "nvidia,tegra20-uart";
+- reg = <0x03130000 0x40>;
++ reg = <0x0 0x03130000 0x0 0x40>;
+ reg-shift = <2>;
+ interrupts = <GIC_SPI 115 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&bpmp TEGRA194_CLK_UARTD>;
+@@ -774,7 +777,7 @@ uartd: serial@3130000 {
+
+ uarte: serial@3140000 {
+ compatible = "nvidia,tegra194-uart", "nvidia,tegra20-uart";
+- reg = <0x03140000 0x40>;
++ reg = <0x0 0x03140000 0x0 0x40>;
+ reg-shift = <2>;
+ interrupts = <GIC_SPI 116 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&bpmp TEGRA194_CLK_UARTE>;
+@@ -786,7 +789,7 @@ uarte: serial@3140000 {
+
+ uartf: serial@3150000 {
+ compatible = "nvidia,tegra194-uart", "nvidia,tegra20-uart";
+- reg = <0x03150000 0x40>;
++ reg = <0x0 0x03150000 0x0 0x40>;
+ reg-shift = <2>;
+ interrupts = <GIC_SPI 117 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&bpmp TEGRA194_CLK_UARTF>;
+@@ -798,7 +801,7 @@ uartf: serial@3150000 {
+
+ gen1_i2c: i2c@3160000 {
+ compatible = "nvidia,tegra194-i2c";
+- reg = <0x03160000 0x10000>;
++ reg = <0x0 0x03160000 0x0 0x10000>;
+ interrupts = <GIC_SPI 25 IRQ_TYPE_LEVEL_HIGH>;
+ #address-cells = <1>;
+ #size-cells = <0>;
+@@ -815,7 +818,7 @@ gen1_i2c: i2c@3160000 {
+
+ uarth: serial@3170000 {
+ compatible = "nvidia,tegra194-uart", "nvidia,tegra20-uart";
+- reg = <0x03170000 0x40>;
++ reg = <0x0 0x03170000 0x0 0x40>;
+ reg-shift = <2>;
+ interrupts = <GIC_SPI 207 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&bpmp TEGRA194_CLK_UARTH>;
+@@ -827,7 +830,7 @@ uarth: serial@3170000 {
+
+ cam_i2c: i2c@3180000 {
+ compatible = "nvidia,tegra194-i2c";
+- reg = <0x03180000 0x10000>;
++ reg = <0x0 0x03180000 0x0 0x10000>;
+ interrupts = <GIC_SPI 27 IRQ_TYPE_LEVEL_HIGH>;
+ #address-cells = <1>;
+ #size-cells = <0>;
+@@ -845,7 +848,7 @@ cam_i2c: i2c@3180000 {
+ /* shares pads with dpaux1 */
+ dp_aux_ch1_i2c: i2c@3190000 {
+ compatible = "nvidia,tegra194-i2c";
+- reg = <0x03190000 0x10000>;
++ reg = <0x0 0x03190000 0x0 0x10000>;
+ interrupts = <GIC_SPI 28 IRQ_TYPE_LEVEL_HIGH>;
+ #address-cells = <1>;
+ #size-cells = <0>;
+@@ -866,7 +869,7 @@ dp_aux_ch1_i2c: i2c@3190000 {
+ /* shares pads with dpaux0 */
+ dp_aux_ch0_i2c: i2c@31b0000 {
+ compatible = "nvidia,tegra194-i2c";
+- reg = <0x031b0000 0x10000>;
++ reg = <0x0 0x031b0000 0x0 0x10000>;
+ interrupts = <GIC_SPI 30 IRQ_TYPE_LEVEL_HIGH>;
+ #address-cells = <1>;
+ #size-cells = <0>;
+@@ -887,7 +890,7 @@ dp_aux_ch0_i2c: i2c@31b0000 {
+ /* shares pads with dpaux2 */
+ dp_aux_ch2_i2c: i2c@31c0000 {
+ compatible = "nvidia,tegra194-i2c";
+- reg = <0x031c0000 0x10000>;
++ reg = <0x0 0x031c0000 0x0 0x10000>;
+ interrupts = <GIC_SPI 31 IRQ_TYPE_LEVEL_HIGH>;
+ #address-cells = <1>;
+ #size-cells = <0>;
+@@ -908,7 +911,7 @@ dp_aux_ch2_i2c: i2c@31c0000 {
+ /* shares pads with dpaux3 */
+ dp_aux_ch3_i2c: i2c@31e0000 {
+ compatible = "nvidia,tegra194-i2c";
+- reg = <0x031e0000 0x10000>;
++ reg = <0x0 0x031e0000 0x0 0x10000>;
+ interrupts = <GIC_SPI 33 IRQ_TYPE_LEVEL_HIGH>;
+ #address-cells = <1>;
+ #size-cells = <0>;
+@@ -928,7 +931,7 @@ dp_aux_ch3_i2c: i2c@31e0000 {
+
+ spi@3270000 {
+ compatible = "nvidia,tegra194-qspi";
+- reg = <0x3270000 0x1000>;
++ reg = <0x0 0x3270000 0x0 0x1000>;
+ interrupts = <GIC_SPI 35 IRQ_TYPE_LEVEL_HIGH>;
+ #address-cells = <1>;
+ #size-cells = <0>;
+@@ -941,7 +944,7 @@ spi@3270000 {
+
+ spi@3300000 {
+ compatible = "nvidia,tegra194-qspi";
+- reg = <0x3300000 0x1000>;
++ reg = <0x0 0x3300000 0x0 0x1000>;
+ interrupts = <GIC_SPI 39 IRQ_TYPE_LEVEL_HIGH>;
+ #address-cells = <1>;
+ #size-cells = <0>;
+@@ -955,7 +958,7 @@ spi@3300000 {
+ pwm1: pwm@3280000 {
+ compatible = "nvidia,tegra194-pwm",
+ "nvidia,tegra186-pwm";
+- reg = <0x3280000 0x10000>;
++ reg = <0x0 0x3280000 0x0 0x10000>;
+ clocks = <&bpmp TEGRA194_CLK_PWM1>;
+ resets = <&bpmp TEGRA194_RESET_PWM1>;
+ reset-names = "pwm";
+@@ -966,7 +969,7 @@ pwm1: pwm@3280000 {
+ pwm2: pwm@3290000 {
+ compatible = "nvidia,tegra194-pwm",
+ "nvidia,tegra186-pwm";
+- reg = <0x3290000 0x10000>;
++ reg = <0x0 0x3290000 0x0 0x10000>;
+ clocks = <&bpmp TEGRA194_CLK_PWM2>;
+ resets = <&bpmp TEGRA194_RESET_PWM2>;
+ reset-names = "pwm";
+@@ -977,7 +980,7 @@ pwm2: pwm@3290000 {
+ pwm3: pwm@32a0000 {
+ compatible = "nvidia,tegra194-pwm",
+ "nvidia,tegra186-pwm";
+- reg = <0x32a0000 0x10000>;
++ reg = <0x0 0x32a0000 0x0 0x10000>;
+ clocks = <&bpmp TEGRA194_CLK_PWM3>;
+ resets = <&bpmp TEGRA194_RESET_PWM3>;
+ reset-names = "pwm";
+@@ -988,7 +991,7 @@ pwm3: pwm@32a0000 {
+ pwm5: pwm@32c0000 {
+ compatible = "nvidia,tegra194-pwm",
+ "nvidia,tegra186-pwm";
+- reg = <0x32c0000 0x10000>;
++ reg = <0x0 0x32c0000 0x0 0x10000>;
+ clocks = <&bpmp TEGRA194_CLK_PWM5>;
+ resets = <&bpmp TEGRA194_RESET_PWM5>;
+ reset-names = "pwm";
+@@ -999,7 +1002,7 @@ pwm5: pwm@32c0000 {
+ pwm6: pwm@32d0000 {
+ compatible = "nvidia,tegra194-pwm",
+ "nvidia,tegra186-pwm";
+- reg = <0x32d0000 0x10000>;
++ reg = <0x0 0x32d0000 0x0 0x10000>;
+ clocks = <&bpmp TEGRA194_CLK_PWM6>;
+ resets = <&bpmp TEGRA194_RESET_PWM6>;
+ reset-names = "pwm";
+@@ -1010,7 +1013,7 @@ pwm6: pwm@32d0000 {
+ pwm7: pwm@32e0000 {
+ compatible = "nvidia,tegra194-pwm",
+ "nvidia,tegra186-pwm";
+- reg = <0x32e0000 0x10000>;
++ reg = <0x0 0x32e0000 0x0 0x10000>;
+ clocks = <&bpmp TEGRA194_CLK_PWM7>;
+ resets = <&bpmp TEGRA194_RESET_PWM7>;
+ reset-names = "pwm";
+@@ -1021,7 +1024,7 @@ pwm7: pwm@32e0000 {
+ pwm8: pwm@32f0000 {
+ compatible = "nvidia,tegra194-pwm",
+ "nvidia,tegra186-pwm";
+- reg = <0x32f0000 0x10000>;
++ reg = <0x0 0x32f0000 0x0 0x10000>;
+ clocks = <&bpmp TEGRA194_CLK_PWM8>;
+ resets = <&bpmp TEGRA194_RESET_PWM8>;
+ reset-names = "pwm";
+@@ -1031,7 +1034,7 @@ pwm8: pwm@32f0000 {
+
+ sdmmc1: mmc@3400000 {
+ compatible = "nvidia,tegra194-sdhci";
+- reg = <0x03400000 0x10000>;
++ reg = <0x0 0x03400000 0x0 0x10000>;
+ interrupts = <GIC_SPI 62 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&bpmp TEGRA194_CLK_SDMMC1>,
+ <&bpmp TEGRA194_CLK_SDMMC_LEGACY_TM>;
+@@ -1070,7 +1073,7 @@ sdmmc1: mmc@3400000 {
+
+ sdmmc3: mmc@3440000 {
+ compatible = "nvidia,tegra194-sdhci";
+- reg = <0x03440000 0x10000>;
++ reg = <0x0 0x03440000 0x0 0x10000>;
+ interrupts = <GIC_SPI 64 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&bpmp TEGRA194_CLK_SDMMC3>,
+ <&bpmp TEGRA194_CLK_SDMMC_LEGACY_TM>;
+@@ -1110,7 +1113,7 @@ sdmmc3: mmc@3440000 {
+
+ sdmmc4: mmc@3460000 {
+ compatible = "nvidia,tegra194-sdhci";
+- reg = <0x03460000 0x10000>;
++ reg = <0x0 0x03460000 0x0 0x10000>;
+ interrupts = <GIC_SPI 65 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&bpmp TEGRA194_CLK_SDMMC4>,
+ <&bpmp TEGRA194_CLK_SDMMC_LEGACY_TM>;
+@@ -1147,7 +1150,7 @@ sdmmc4: mmc@3460000 {
+
+ hda@3510000 {
+ compatible = "nvidia,tegra194-hda";
+- reg = <0x3510000 0x10000>;
++ reg = <0x0 0x3510000 0x0 0x10000>;
+ interrupts = <GIC_SPI 161 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&bpmp TEGRA194_CLK_HDA>,
+ <&bpmp TEGRA194_CLK_HDA2HDMICODEC>,
+@@ -1166,8 +1169,8 @@ hda@3510000 {
+
+ xusb_padctl: padctl@3520000 {
+ compatible = "nvidia,tegra194-xusb-padctl";
+- reg = <0x03520000 0x1000>,
+- <0x03540000 0x1000>;
++ reg = <0x0 0x03520000 0x0 0x1000>,
++ <0x0 0x03540000 0x0 0x1000>;
+ reg-names = "padctl", "ao";
+ interrupts = <GIC_SPI 167 IRQ_TYPE_LEVEL_HIGH>;
+
+@@ -1274,8 +1277,8 @@ usb3-3 {
+
+ usb@3550000 {
+ compatible = "nvidia,tegra194-xudc";
+- reg = <0x03550000 0x8000>,
+- <0x03558000 0x1000>;
++ reg = <0x0 0x03550000 0x0 0x8000>,
++ <0x0 0x03558000 0x0 0x1000>;
+ reg-names = "base", "fpci";
+ interrupts = <GIC_SPI 166 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&bpmp TEGRA194_CLK_XUSB_CORE_DEV>,
+@@ -1296,8 +1299,8 @@ usb@3550000 {
+
+ usb@3610000 {
+ compatible = "nvidia,tegra194-xusb";
+- reg = <0x03610000 0x40000>,
+- <0x03600000 0x10000>;
++ reg = <0x0 0x03610000 0x0 0x40000>,
++ <0x0 0x03600000 0x0 0x10000>;
+ reg-names = "hcd", "fpci";
+
+ interrupts = <GIC_SPI 163 IRQ_TYPE_LEVEL_HIGH>,
+@@ -1331,7 +1334,7 @@ usb@3610000 {
+
+ fuse@3820000 {
+ compatible = "nvidia,tegra194-efuse";
+- reg = <0x03820000 0x10000>;
++ reg = <0x0 0x03820000 0x0 0x10000>;
+ clocks = <&bpmp TEGRA194_CLK_FUSE>;
+ clock-names = "fuse";
+ };
+@@ -1340,10 +1343,10 @@ gic: interrupt-controller@3881000 {
+ compatible = "arm,gic-400";
+ #interrupt-cells = <3>;
+ interrupt-controller;
+- reg = <0x03881000 0x1000>,
+- <0x03882000 0x2000>,
+- <0x03884000 0x2000>,
+- <0x03886000 0x2000>;
++ reg = <0x0 0x03881000 0x0 0x1000>,
++ <0x0 0x03882000 0x0 0x2000>,
++ <0x0 0x03884000 0x0 0x2000>,
++ <0x0 0x03886000 0x0 0x2000>;
+ interrupts = <GIC_PPI 9
+ (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_HIGH)>;
+ interrupt-parent = <&gic>;
+@@ -1351,7 +1354,7 @@ gic: interrupt-controller@3881000 {
+
+ cec@3960000 {
+ compatible = "nvidia,tegra194-cec";
+- reg = <0x03960000 0x10000>;
++ reg = <0x0 0x03960000 0x0 0x10000>;
+ interrupts = <GIC_SPI 162 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&bpmp TEGRA194_CLK_CEC>;
+ clock-names = "cec";
+@@ -1360,7 +1363,7 @@ cec@3960000 {
+
+ hte_lic: hardware-timestamp@3aa0000 {
+ compatible = "nvidia,tegra194-gte-lic";
+- reg = <0x3aa0000 0x10000>;
++ reg = <0x0 0x3aa0000 0x0 0x10000>;
+ interrupts = <GIC_SPI 11 IRQ_TYPE_LEVEL_HIGH>;
+ nvidia,int-threshold = <1>;
+ nvidia,slices = <11>;
+@@ -1370,7 +1373,7 @@ hte_lic: hardware-timestamp@3aa0000 {
+
+ hsp_top0: hsp@3c00000 {
+ compatible = "nvidia,tegra194-hsp";
+- reg = <0x03c00000 0xa0000>;
++ reg = <0x0 0x03c00000 0x0 0xa0000>;
+ interrupts = <GIC_SPI 176 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 120 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 121 IRQ_TYPE_LEVEL_HIGH>,
+@@ -1388,7 +1391,7 @@ hsp_top0: hsp@3c00000 {
+
+ p2u_hsio_0: phy@3e10000 {
+ compatible = "nvidia,tegra194-p2u";
+- reg = <0x03e10000 0x10000>;
++ reg = <0x0 0x03e10000 0x0 0x10000>;
+ reg-names = "ctl";
+
+ #phy-cells = <0>;
+@@ -1396,7 +1399,7 @@ p2u_hsio_0: phy@3e10000 {
+
+ p2u_hsio_1: phy@3e20000 {
+ compatible = "nvidia,tegra194-p2u";
+- reg = <0x03e20000 0x10000>;
++ reg = <0x0 0x03e20000 0x0 0x10000>;
+ reg-names = "ctl";
+
+ #phy-cells = <0>;
+@@ -1404,7 +1407,7 @@ p2u_hsio_1: phy@3e20000 {
+
+ p2u_hsio_2: phy@3e30000 {
+ compatible = "nvidia,tegra194-p2u";
+- reg = <0x03e30000 0x10000>;
++ reg = <0x0 0x03e30000 0x0 0x10000>;
+ reg-names = "ctl";
+
+ #phy-cells = <0>;
+@@ -1412,7 +1415,7 @@ p2u_hsio_2: phy@3e30000 {
+
+ p2u_hsio_3: phy@3e40000 {
+ compatible = "nvidia,tegra194-p2u";
+- reg = <0x03e40000 0x10000>;
++ reg = <0x0 0x03e40000 0x0 0x10000>;
+ reg-names = "ctl";
+
+ #phy-cells = <0>;
+@@ -1420,7 +1423,7 @@ p2u_hsio_3: phy@3e40000 {
+
+ p2u_hsio_4: phy@3e50000 {
+ compatible = "nvidia,tegra194-p2u";
+- reg = <0x03e50000 0x10000>;
++ reg = <0x0 0x03e50000 0x0 0x10000>;
+ reg-names = "ctl";
+
+ #phy-cells = <0>;
+@@ -1428,7 +1431,7 @@ p2u_hsio_4: phy@3e50000 {
+
+ p2u_hsio_5: phy@3e60000 {
+ compatible = "nvidia,tegra194-p2u";
+- reg = <0x03e60000 0x10000>;
++ reg = <0x0 0x03e60000 0x0 0x10000>;
+ reg-names = "ctl";
+
+ #phy-cells = <0>;
+@@ -1436,7 +1439,7 @@ p2u_hsio_5: phy@3e60000 {
+
+ p2u_hsio_6: phy@3e70000 {
+ compatible = "nvidia,tegra194-p2u";
+- reg = <0x03e70000 0x10000>;
++ reg = <0x0 0x03e70000 0x0 0x10000>;
+ reg-names = "ctl";
+
+ #phy-cells = <0>;
+@@ -1444,7 +1447,7 @@ p2u_hsio_6: phy@3e70000 {
+
+ p2u_hsio_7: phy@3e80000 {
+ compatible = "nvidia,tegra194-p2u";
+- reg = <0x03e80000 0x10000>;
++ reg = <0x0 0x03e80000 0x0 0x10000>;
+ reg-names = "ctl";
+
+ #phy-cells = <0>;
+@@ -1452,7 +1455,7 @@ p2u_hsio_7: phy@3e80000 {
+
+ p2u_hsio_8: phy@3e90000 {
+ compatible = "nvidia,tegra194-p2u";
+- reg = <0x03e90000 0x10000>;
++ reg = <0x0 0x03e90000 0x0 0x10000>;
+ reg-names = "ctl";
+
+ #phy-cells = <0>;
+@@ -1460,7 +1463,7 @@ p2u_hsio_8: phy@3e90000 {
+
+ p2u_hsio_9: phy@3ea0000 {
+ compatible = "nvidia,tegra194-p2u";
+- reg = <0x03ea0000 0x10000>;
++ reg = <0x0 0x03ea0000 0x0 0x10000>;
+ reg-names = "ctl";
+
+ #phy-cells = <0>;
+@@ -1468,7 +1471,7 @@ p2u_hsio_9: phy@3ea0000 {
+
+ p2u_nvhs_0: phy@3eb0000 {
+ compatible = "nvidia,tegra194-p2u";
+- reg = <0x03eb0000 0x10000>;
++ reg = <0x0 0x03eb0000 0x0 0x10000>;
+ reg-names = "ctl";
+
+ #phy-cells = <0>;
+@@ -1476,7 +1479,7 @@ p2u_nvhs_0: phy@3eb0000 {
+
+ p2u_nvhs_1: phy@3ec0000 {
+ compatible = "nvidia,tegra194-p2u";
+- reg = <0x03ec0000 0x10000>;
++ reg = <0x0 0x03ec0000 0x0 0x10000>;
+ reg-names = "ctl";
+
+ #phy-cells = <0>;
+@@ -1484,7 +1487,7 @@ p2u_nvhs_1: phy@3ec0000 {
+
+ p2u_nvhs_2: phy@3ed0000 {
+ compatible = "nvidia,tegra194-p2u";
+- reg = <0x03ed0000 0x10000>;
++ reg = <0x0 0x03ed0000 0x0 0x10000>;
+ reg-names = "ctl";
+
+ #phy-cells = <0>;
+@@ -1492,7 +1495,7 @@ p2u_nvhs_2: phy@3ed0000 {
+
+ p2u_nvhs_3: phy@3ee0000 {
+ compatible = "nvidia,tegra194-p2u";
+- reg = <0x03ee0000 0x10000>;
++ reg = <0x0 0x03ee0000 0x0 0x10000>;
+ reg-names = "ctl";
+
+ #phy-cells = <0>;
+@@ -1500,7 +1503,7 @@ p2u_nvhs_3: phy@3ee0000 {
+
+ p2u_nvhs_4: phy@3ef0000 {
+ compatible = "nvidia,tegra194-p2u";
+- reg = <0x03ef0000 0x10000>;
++ reg = <0x0 0x03ef0000 0x0 0x10000>;
+ reg-names = "ctl";
+
+ #phy-cells = <0>;
+@@ -1508,7 +1511,7 @@ p2u_nvhs_4: phy@3ef0000 {
+
+ p2u_nvhs_5: phy@3f00000 {
+ compatible = "nvidia,tegra194-p2u";
+- reg = <0x03f00000 0x10000>;
++ reg = <0x0 0x03f00000 0x0 0x10000>;
+ reg-names = "ctl";
+
+ #phy-cells = <0>;
+@@ -1516,7 +1519,7 @@ p2u_nvhs_5: phy@3f00000 {
+
+ p2u_nvhs_6: phy@3f10000 {
+ compatible = "nvidia,tegra194-p2u";
+- reg = <0x03f10000 0x10000>;
++ reg = <0x0 0x03f10000 0x0 0x10000>;
+ reg-names = "ctl";
+
+ #phy-cells = <0>;
+@@ -1524,7 +1527,7 @@ p2u_nvhs_6: phy@3f10000 {
+
+ p2u_nvhs_7: phy@3f20000 {
+ compatible = "nvidia,tegra194-p2u";
+- reg = <0x03f20000 0x10000>;
++ reg = <0x0 0x03f20000 0x0 0x10000>;
+ reg-names = "ctl";
+
+ #phy-cells = <0>;
+@@ -1532,7 +1535,7 @@ p2u_nvhs_7: phy@3f20000 {
+
+ p2u_hsio_10: phy@3f30000 {
+ compatible = "nvidia,tegra194-p2u";
+- reg = <0x03f30000 0x10000>;
++ reg = <0x0 0x03f30000 0x0 0x10000>;
+ reg-names = "ctl";
+
+ #phy-cells = <0>;
+@@ -1540,7 +1543,7 @@ p2u_hsio_10: phy@3f30000 {
+
+ p2u_hsio_11: phy@3f40000 {
+ compatible = "nvidia,tegra194-p2u";
+- reg = <0x03f40000 0x10000>;
++ reg = <0x0 0x03f40000 0x0 0x10000>;
+ reg-names = "ctl";
+
+ #phy-cells = <0>;
+@@ -1548,7 +1551,7 @@ p2u_hsio_11: phy@3f40000 {
+
+ sce-noc@b600000 {
+ compatible = "nvidia,tegra194-sce-noc";
+- reg = <0xb600000 0x1000>;
++ reg = <0x0 0xb600000 0x0 0x1000>;
+ interrupts = <GIC_SPI 261 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 173 IRQ_TYPE_LEVEL_HIGH>;
+ nvidia,axi2apb = <&axi2apb>;
+@@ -1558,7 +1561,7 @@ sce-noc@b600000 {
+
+ rce-noc@be00000 {
+ compatible = "nvidia,tegra194-rce-noc";
+- reg = <0xbe00000 0x1000>;
++ reg = <0x0 0xbe00000 0x0 0x1000>;
+ interrupts = <GIC_SPI 259 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 175 IRQ_TYPE_LEVEL_HIGH>;
+ nvidia,axi2apb = <&axi2apb>;
+@@ -1568,7 +1571,7 @@ rce-noc@be00000 {
+
+ hsp_aon: hsp@c150000 {
+ compatible = "nvidia,tegra194-hsp";
+- reg = <0x0c150000 0x90000>;
++ reg = <0x0 0x0c150000 0x0 0x90000>;
+ interrupts = <GIC_SPI 133 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 134 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 135 IRQ_TYPE_LEVEL_HIGH>,
+@@ -1583,7 +1586,7 @@ hsp_aon: hsp@c150000 {
+
+ hte_aon: hardware-timestamp@c1e0000 {
+ compatible = "nvidia,tegra194-gte-aon";
+- reg = <0xc1e0000 0x10000>;
++ reg = <0x0 0xc1e0000 0x0 0x10000>;
+ interrupts = <GIC_SPI 13 IRQ_TYPE_LEVEL_HIGH>;
+ nvidia,int-threshold = <1>;
+ nvidia,slices = <3>;
+@@ -1593,7 +1596,7 @@ hte_aon: hardware-timestamp@c1e0000 {
+
+ gen2_i2c: i2c@c240000 {
+ compatible = "nvidia,tegra194-i2c";
+- reg = <0x0c240000 0x10000>;
++ reg = <0x0 0x0c240000 0x0 0x10000>;
+ interrupts = <GIC_SPI 26 IRQ_TYPE_LEVEL_HIGH>;
+ #address-cells = <1>;
+ #size-cells = <0>;
+@@ -1610,7 +1613,7 @@ gen2_i2c: i2c@c240000 {
+
+ gen8_i2c: i2c@c250000 {
+ compatible = "nvidia,tegra194-i2c";
+- reg = <0x0c250000 0x10000>;
++ reg = <0x0 0x0c250000 0x0 0x10000>;
+ interrupts = <GIC_SPI 32 IRQ_TYPE_LEVEL_HIGH>;
+ #address-cells = <1>;
+ #size-cells = <0>;
+@@ -1627,7 +1630,7 @@ gen8_i2c: i2c@c250000 {
+
+ uartc: serial@c280000 {
+ compatible = "nvidia,tegra194-uart", "nvidia,tegra20-uart";
+- reg = <0x0c280000 0x40>;
++ reg = <0x0 0x0c280000 0x0 0x40>;
+ reg-shift = <2>;
+ interrupts = <GIC_SPI 114 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&bpmp TEGRA194_CLK_UARTC>;
+@@ -1639,7 +1642,7 @@ uartc: serial@c280000 {
+
+ uartg: serial@c290000 {
+ compatible = "nvidia,tegra194-uart", "nvidia,tegra20-uart";
+- reg = <0x0c290000 0x40>;
++ reg = <0x0 0x0c290000 0x0 0x40>;
+ reg-shift = <2>;
+ interrupts = <GIC_SPI 118 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&bpmp TEGRA194_CLK_UARTG>;
+@@ -1651,7 +1654,7 @@ uartg: serial@c290000 {
+
+ rtc: rtc@c2a0000 {
+ compatible = "nvidia,tegra194-rtc", "nvidia,tegra20-rtc";
+- reg = <0x0c2a0000 0x10000>;
++ reg = <0x0 0x0c2a0000 0x0 0x10000>;
+ interrupt-parent = <&pmc>;
+ interrupts = <73 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&bpmp TEGRA194_CLK_CLK_32K>;
+@@ -1662,8 +1665,8 @@ rtc: rtc@c2a0000 {
+ gpio_aon: gpio@c2f0000 {
+ compatible = "nvidia,tegra194-gpio-aon";
+ reg-names = "security", "gpio";
+- reg = <0xc2f0000 0x1000>,
+- <0xc2f1000 0x1000>;
++ reg = <0x0 0xc2f0000 0x0 0x1000>,
++ <0x0 0xc2f1000 0x0 0x1000>;
+ interrupts = <GIC_SPI 56 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 57 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 58 IRQ_TYPE_LEVEL_HIGH>,
+@@ -1677,7 +1680,7 @@ gpio_aon: gpio@c2f0000 {
+
+ pinmux_aon: pinmux@c300000 {
+ compatible = "nvidia,tegra194-pinmux-aon";
+- reg = <0xc300000 0x4000>;
++ reg = <0x0 0xc300000 0x0 0x4000>;
+
+ status = "okay";
+ };
+@@ -1685,7 +1688,7 @@ pinmux_aon: pinmux@c300000 {
+ pwm4: pwm@c340000 {
+ compatible = "nvidia,tegra194-pwm",
+ "nvidia,tegra186-pwm";
+- reg = <0xc340000 0x10000>;
++ reg = <0x0 0xc340000 0x0 0x10000>;
+ clocks = <&bpmp TEGRA194_CLK_PWM4>;
+ resets = <&bpmp TEGRA194_RESET_PWM4>;
+ reset-names = "pwm";
+@@ -1695,11 +1698,11 @@ pwm4: pwm@c340000 {
+
+ pmc: pmc@c360000 {
+ compatible = "nvidia,tegra194-pmc";
+- reg = <0x0c360000 0x10000>,
+- <0x0c370000 0x10000>,
+- <0x0c380000 0x10000>,
+- <0x0c390000 0x10000>,
+- <0x0c3a0000 0x10000>;
++ reg = <0x0 0x0c360000 0x0 0x10000>,
++ <0x0 0x0c370000 0x0 0x10000>,
++ <0x0 0x0c380000 0x0 0x10000>,
++ <0x0 0x0c390000 0x0 0x10000>,
++ <0x0 0x0c3a0000 0x0 0x10000>;
+ reg-names = "pmc", "wake", "aotag", "scratch", "misc";
+
+ #interrupt-cells = <2>;
+@@ -1727,7 +1730,7 @@ sdmmc3_1v8: sdmmc3-1v8 {
+
+ aon-noc@c600000 {
+ compatible = "nvidia,tegra194-aon-noc";
+- reg = <0xc600000 0x1000>;
++ reg = <0x0 0xc600000 0x0 0x1000>;
+ interrupts = <GIC_SPI 260 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 172 IRQ_TYPE_LEVEL_HIGH>;
+ nvidia,apbmisc = <&apbmisc>;
+@@ -1736,7 +1739,7 @@ aon-noc@c600000 {
+
+ bpmp-noc@d600000 {
+ compatible = "nvidia,tegra194-bpmp-noc";
+- reg = <0xd600000 0x1000>;
++ reg = <0x0 0xd600000 0x0 0x1000>;
+ interrupts = <GIC_SPI 262 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 174 IRQ_TYPE_LEVEL_HIGH>;
+ nvidia,axi2apb = <&axi2apb>;
+@@ -1746,7 +1749,7 @@ bpmp-noc@d600000 {
+
+ iommu@10000000 {
+ compatible = "nvidia,tegra194-smmu", "nvidia,smmu-500";
+- reg = <0x10000000 0x800000>;
++ reg = <0x0 0x10000000 0x0 0x800000>;
+ interrupts = <GIC_SPI 240 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 240 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 240 IRQ_TYPE_LEVEL_HIGH>,
+@@ -1822,8 +1825,8 @@ iommu@10000000 {
+
+ smmu: iommu@12000000 {
+ compatible = "nvidia,tegra194-smmu", "nvidia,smmu-500";
+- reg = <0x12000000 0x800000>,
+- <0x11000000 0x800000>;
++ reg = <0x0 0x12000000 0x0 0x800000>,
++ <0x0 0x11000000 0x0 0x800000>;
+ interrupts = <GIC_SPI 170 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 232 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 170 IRQ_TYPE_LEVEL_HIGH>,
+@@ -1900,8 +1903,8 @@ smmu: iommu@12000000 {
+
+ host1x@13e00000 {
+ compatible = "nvidia,tegra194-host1x";
+- reg = <0x13e00000 0x10000>,
+- <0x13e10000 0x10000>;
++ reg = <0x0 0x13e00000 0x0 0x10000>,
++ <0x0 0x13e10000 0x0 0x10000>;
+ reg-names = "hypervisor", "vm";
+ interrupts = <GIC_SPI 265 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 263 IRQ_TYPE_LEVEL_HIGH>;
+@@ -1911,10 +1914,10 @@ host1x@13e00000 {
+ resets = <&bpmp TEGRA194_RESET_HOST1X>;
+ reset-names = "host1x";
+
+- #address-cells = <1>;
+- #size-cells = <1>;
++ #address-cells = <2>;
++ #size-cells = <2>;
++ ranges = <0x0 0x14800000 0x0 0x14800000 0x0 0x02800000>;
+
+- ranges = <0x14800000 0x14800000 0x02800000>;
+ interconnects = <&mc TEGRA194_MEMORY_CLIENT_HOST1XDMAR &emc>;
+ interconnect-names = "dma-mem";
+ iommus = <&smmu TEGRA194_SID_HOST1X>;
+@@ -1931,7 +1934,7 @@ host1x@13e00000 {
+
+ nvdec@15140000 {
+ compatible = "nvidia,tegra194-nvdec";
+- reg = <0x15140000 0x00040000>;
++ reg = <0x0 0x15140000 0x0 0x00040000>;
+ clocks = <&bpmp TEGRA194_CLK_NVDEC1>;
+ clock-names = "nvdec";
+ resets = <&bpmp TEGRA194_RESET_NVDEC1>;
+@@ -1950,7 +1953,7 @@ nvdec@15140000 {
+
+ display-hub@15200000 {
+ compatible = "nvidia,tegra194-display";
+- reg = <0x15200000 0x00040000>;
++ reg = <0x0 0x15200000 0x0 0x00040000>;
+ resets = <&bpmp TEGRA194_RESET_NVDISPLAY0_MISC>,
+ <&bpmp TEGRA194_RESET_NVDISPLAY0_WGRP0>,
+ <&bpmp TEGRA194_RESET_NVDISPLAY0_WGRP1>,
+@@ -1967,14 +1970,13 @@ display-hub@15200000 {
+
+ power-domains = <&bpmp TEGRA194_POWER_DOMAIN_DISP>;
+
+- #address-cells = <1>;
+- #size-cells = <1>;
+-
+- ranges = <0x15200000 0x15200000 0x40000>;
++ #address-cells = <2>;
++ #size-cells = <2>;
++ ranges = <0x0 0x15200000 0x0 0x15200000 0x0 0x40000>;
+
+ display@15200000 {
+ compatible = "nvidia,tegra194-dc";
+- reg = <0x15200000 0x10000>;
++ reg = <0x0 0x15200000 0x0 0x10000>;
+ interrupts = <GIC_SPI 153 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&bpmp TEGRA194_CLK_NVDISPLAY_P0>;
+ clock-names = "dc";
+@@ -1992,7 +1994,7 @@ display@15200000 {
+
+ display@15210000 {
+ compatible = "nvidia,tegra194-dc";
+- reg = <0x15210000 0x10000>;
++ reg = <0x0 0x15210000 0x0 0x10000>;
+ interrupts = <GIC_SPI 154 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&bpmp TEGRA194_CLK_NVDISPLAY_P1>;
+ clock-names = "dc";
+@@ -2010,7 +2012,7 @@ display@15210000 {
+
+ display@15220000 {
+ compatible = "nvidia,tegra194-dc";
+- reg = <0x15220000 0x10000>;
++ reg = <0x0 0x15220000 0x0 0x10000>;
+ interrupts = <GIC_SPI 155 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&bpmp TEGRA194_CLK_NVDISPLAY_P2>;
+ clock-names = "dc";
+@@ -2028,7 +2030,7 @@ display@15220000 {
+
+ display@15230000 {
+ compatible = "nvidia,tegra194-dc";
+- reg = <0x15230000 0x10000>;
++ reg = <0x0 0x15230000 0x0 0x10000>;
+ interrupts = <GIC_SPI 242 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&bpmp TEGRA194_CLK_NVDISPLAY_P3>;
+ clock-names = "dc";
+@@ -2047,7 +2049,7 @@ display@15230000 {
+
+ vic@15340000 {
+ compatible = "nvidia,tegra194-vic";
+- reg = <0x15340000 0x00040000>;
++ reg = <0x0 0x15340000 0x0 0x00040000>;
+ interrupts = <GIC_SPI 206 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&bpmp TEGRA194_CLK_VIC>;
+ clock-names = "vic";
+@@ -2064,7 +2066,7 @@ vic@15340000 {
+
+ nvjpg@15380000 {
+ compatible = "nvidia,tegra194-nvjpg";
+- reg = <0x15380000 0x40000>;
++ reg = <0x0 0x15380000 0x0 0x40000>;
+ clocks = <&bpmp TEGRA194_CLK_NVJPG>;
+ clock-names = "nvjpg";
+ resets = <&bpmp TEGRA194_RESET_NVJPG>;
+@@ -2080,7 +2082,7 @@ nvjpg@15380000 {
+
+ nvdec@15480000 {
+ compatible = "nvidia,tegra194-nvdec";
+- reg = <0x15480000 0x00040000>;
++ reg = <0x0 0x15480000 0x0 0x00040000>;
+ clocks = <&bpmp TEGRA194_CLK_NVDEC>;
+ clock-names = "nvdec";
+ resets = <&bpmp TEGRA194_RESET_NVDEC>;
+@@ -2099,7 +2101,7 @@ nvdec@15480000 {
+
+ nvenc@154c0000 {
+ compatible = "nvidia,tegra194-nvenc";
+- reg = <0x154c0000 0x40000>;
++ reg = <0x0 0x154c0000 0x0 0x40000>;
+ clocks = <&bpmp TEGRA194_CLK_NVENC>;
+ clock-names = "nvenc";
+ resets = <&bpmp TEGRA194_RESET_NVENC>;
+@@ -2118,7 +2120,7 @@ nvenc@154c0000 {
+
+ dpaux0: dpaux@155c0000 {
+ compatible = "nvidia,tegra194-dpaux";
+- reg = <0x155c0000 0x10000>;
++ reg = <0x0 0x155c0000 0x0 0x10000>;
+ interrupts = <GIC_SPI 159 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&bpmp TEGRA194_CLK_DPAUX>,
+ <&bpmp TEGRA194_CLK_PLLDP>;
+@@ -2152,7 +2154,7 @@ i2c-bus {
+
+ dpaux1: dpaux@155d0000 {
+ compatible = "nvidia,tegra194-dpaux";
+- reg = <0x155d0000 0x10000>;
++ reg = <0x0 0x155d0000 0x0 0x10000>;
+ interrupts = <GIC_SPI 160 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&bpmp TEGRA194_CLK_DPAUX1>,
+ <&bpmp TEGRA194_CLK_PLLDP>;
+@@ -2186,7 +2188,7 @@ i2c-bus {
+
+ dpaux2: dpaux@155e0000 {
+ compatible = "nvidia,tegra194-dpaux";
+- reg = <0x155e0000 0x10000>;
++ reg = <0x0 0x155e0000 0x0 0x10000>;
+ interrupts = <GIC_SPI 245 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&bpmp TEGRA194_CLK_DPAUX2>,
+ <&bpmp TEGRA194_CLK_PLLDP>;
+@@ -2220,7 +2222,7 @@ i2c-bus {
+
+ dpaux3: dpaux@155f0000 {
+ compatible = "nvidia,tegra194-dpaux";
+- reg = <0x155f0000 0x10000>;
++ reg = <0x0 0x155f0000 0x0 0x10000>;
+ interrupts = <GIC_SPI 246 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&bpmp TEGRA194_CLK_DPAUX3>,
+ <&bpmp TEGRA194_CLK_PLLDP>;
+@@ -2254,7 +2256,7 @@ i2c-bus {
+
+ nvenc@15a80000 {
+ compatible = "nvidia,tegra194-nvenc";
+- reg = <0x15a80000 0x00040000>;
++ reg = <0x0 0x15a80000 0x0 0x00040000>;
+ clocks = <&bpmp TEGRA194_CLK_NVENC1>;
+ clock-names = "nvenc";
+ resets = <&bpmp TEGRA194_RESET_NVENC1>;
+@@ -2273,7 +2275,7 @@ nvenc@15a80000 {
+
+ sor0: sor@15b00000 {
+ compatible = "nvidia,tegra194-sor";
+- reg = <0x15b00000 0x40000>;
++ reg = <0x0 0x15b00000 0x0 0x40000>;
+ interrupts = <GIC_SPI 157 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&bpmp TEGRA194_CLK_SOR0_REF>,
+ <&bpmp TEGRA194_CLK_SOR0_OUT>,
+@@ -2297,7 +2299,7 @@ sor0: sor@15b00000 {
+
+ sor1: sor@15b40000 {
+ compatible = "nvidia,tegra194-sor";
+- reg = <0x15b40000 0x40000>;
++ reg = <0x0 0x15b40000 0x0 0x40000>;
+ interrupts = <GIC_SPI 158 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&bpmp TEGRA194_CLK_SOR1_REF>,
+ <&bpmp TEGRA194_CLK_SOR1_OUT>,
+@@ -2321,7 +2323,7 @@ sor1: sor@15b40000 {
+
+ sor2: sor@15b80000 {
+ compatible = "nvidia,tegra194-sor";
+- reg = <0x15b80000 0x40000>;
++ reg = <0x0 0x15b80000 0x0 0x40000>;
+ interrupts = <GIC_SPI 243 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&bpmp TEGRA194_CLK_SOR2_REF>,
+ <&bpmp TEGRA194_CLK_SOR2_OUT>,
+@@ -2345,7 +2347,7 @@ sor2: sor@15b80000 {
+
+ sor3: sor@15bc0000 {
+ compatible = "nvidia,tegra194-sor";
+- reg = <0x15bc0000 0x40000>;
++ reg = <0x0 0x15bc0000 0x0 0x40000>;
+ interrupts = <GIC_SPI 244 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&bpmp TEGRA194_CLK_SOR3_REF>,
+ <&bpmp TEGRA194_CLK_SOR3_OUT>,
+@@ -2368,482 +2370,484 @@ sor3: sor@15bc0000 {
+ };
+ };
+
+- gpu@17000000 {
+- compatible = "nvidia,gv11b";
+- reg = <0x17000000 0x1000000>,
+- <0x18000000 0x1000000>;
+- interrupts = <GIC_SPI 70 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 71 IRQ_TYPE_LEVEL_HIGH>;
+- interrupt-names = "stall", "nonstall";
+- clocks = <&bpmp TEGRA194_CLK_GPCCLK>,
+- <&bpmp TEGRA194_CLK_GPU_PWR>,
+- <&bpmp TEGRA194_CLK_FUSE>;
+- clock-names = "gpu", "pwr", "fuse";
+- resets = <&bpmp TEGRA194_RESET_GPU>;
+- reset-names = "gpu";
+- dma-coherent;
++ pcie@14100000 {
++ compatible = "nvidia,tegra194-pcie";
++ power-domains = <&bpmp TEGRA194_POWER_DOMAIN_PCIEX1A>;
++ reg = <0x0 0x14100000 0x0 0x00020000>, /* appl registers (128K) */
++ <0x0 0x30000000 0x0 0x00040000>, /* configuration space (256K) */
++ <0x0 0x30040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */
++ <0x0 0x30080000 0x0 0x00040000>; /* DBI reg space (256K) */
++ reg-names = "appl", "config", "atu_dma", "dbi";
+
+- power-domains = <&bpmp TEGRA194_POWER_DOMAIN_GPU>;
+- interconnects = <&mc TEGRA194_MEMORY_CLIENT_NVL1R &emc>,
+- <&mc TEGRA194_MEMORY_CLIENT_NVL1RHP &emc>,
+- <&mc TEGRA194_MEMORY_CLIENT_NVL1W &emc>,
+- <&mc TEGRA194_MEMORY_CLIENT_NVL2R &emc>,
+- <&mc TEGRA194_MEMORY_CLIENT_NVL2RHP &emc>,
+- <&mc TEGRA194_MEMORY_CLIENT_NVL2W &emc>,
+- <&mc TEGRA194_MEMORY_CLIENT_NVL3R &emc>,
+- <&mc TEGRA194_MEMORY_CLIENT_NVL3RHP &emc>,
+- <&mc TEGRA194_MEMORY_CLIENT_NVL3W &emc>,
+- <&mc TEGRA194_MEMORY_CLIENT_NVL4R &emc>,
+- <&mc TEGRA194_MEMORY_CLIENT_NVL4RHP &emc>,
+- <&mc TEGRA194_MEMORY_CLIENT_NVL4W &emc>;
+- interconnect-names = "dma-mem", "read-0-hp", "write-0",
+- "read-1", "read-1-hp", "write-1",
+- "read-2", "read-2-hp", "write-2",
+- "read-3", "read-3-hp", "write-3";
+- };
+- };
++ status = "disabled";
+
+- pcie@14100000 {
+- compatible = "nvidia,tegra194-pcie";
+- power-domains = <&bpmp TEGRA194_POWER_DOMAIN_PCIEX1A>;
+- reg = <0x00 0x14100000 0x0 0x00020000>, /* appl registers (128K) */
+- <0x00 0x30000000 0x0 0x00040000>, /* configuration space (256K) */
+- <0x00 0x30040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */
+- <0x00 0x30080000 0x0 0x00040000>; /* DBI reg space (256K) */
+- reg-names = "appl", "config", "atu_dma", "dbi";
++ #address-cells = <3>;
++ #size-cells = <2>;
++ device_type = "pci";
++ num-lanes = <1>;
++ linux,pci-domain = <1>;
+
+- status = "disabled";
++ clocks = <&bpmp TEGRA194_CLK_PEX0_CORE_1>;
++ clock-names = "core";
+
+- #address-cells = <3>;
+- #size-cells = <2>;
+- device_type = "pci";
+- num-lanes = <1>;
+- linux,pci-domain = <1>;
++ resets = <&bpmp TEGRA194_RESET_PEX0_CORE_1_APB>,
++ <&bpmp TEGRA194_RESET_PEX0_CORE_1>;
++ reset-names = "apb", "core";
+
+- clocks = <&bpmp TEGRA194_CLK_PEX0_CORE_1>;
+- clock-names = "core";
++ interrupts = <GIC_SPI 45 IRQ_TYPE_LEVEL_HIGH>, /* controller interrupt */
++ <GIC_SPI 46 IRQ_TYPE_LEVEL_HIGH>; /* MSI interrupt */
++ interrupt-names = "intr", "msi";
+
+- resets = <&bpmp TEGRA194_RESET_PEX0_CORE_1_APB>,
+- <&bpmp TEGRA194_RESET_PEX0_CORE_1>;
+- reset-names = "apb", "core";
++ #interrupt-cells = <1>;
++ interrupt-map-mask = <0 0 0 0>;
++ interrupt-map = <0 0 0 0 &gic GIC_SPI 45 IRQ_TYPE_LEVEL_HIGH>;
+
+- interrupts = <GIC_SPI 45 IRQ_TYPE_LEVEL_HIGH>, /* controller interrupt */
+- <GIC_SPI 46 IRQ_TYPE_LEVEL_HIGH>; /* MSI interrupt */
+- interrupt-names = "intr", "msi";
++ nvidia,bpmp = <&bpmp 1>;
+
+- #interrupt-cells = <1>;
+- interrupt-map-mask = <0 0 0 0>;
+- interrupt-map = <0 0 0 0 &gic GIC_SPI 45 IRQ_TYPE_LEVEL_HIGH>;
++ nvidia,aspm-cmrt-us = <60>;
++ nvidia,aspm-pwr-on-t-us = <20>;
++ nvidia,aspm-l0s-entrance-latency-us = <3>;
+
+- nvidia,bpmp = <&bpmp 1>;
++ bus-range = <0x0 0xff>;
+
+- nvidia,aspm-cmrt-us = <60>;
+- nvidia,aspm-pwr-on-t-us = <20>;
+- nvidia,aspm-l0s-entrance-latency-us = <3>;
++ ranges = <0x43000000 0x12 0x00000000 0x12 0x00000000 0x0 0x30000000>, /* prefetchable memory (768 MiB) */
++ <0x02000000 0x0 0x40000000 0x12 0x30000000 0x0 0x0fff0000>, /* non-prefetchable memory (256 MiB - 64 KiB) */
++ <0x01000000 0x0 0x00000000 0x12 0x3fff0000 0x0 0x00010000>; /* downstream I/O (64 KiB) */
+
+- bus-range = <0x0 0xff>;
++ interconnects = <&mc TEGRA194_MEMORY_CLIENT_PCIE1R &emc>,
++ <&mc TEGRA194_MEMORY_CLIENT_PCIE1W &emc>;
++ interconnect-names = "dma-mem", "write";
++ iommu-map = <0x0 &smmu TEGRA194_SID_PCIE1 0x1000>;
++ iommu-map-mask = <0x0>;
++ dma-coherent;
++ };
+
+- ranges = <0x43000000 0x12 0x00000000 0x12 0x00000000 0x0 0x30000000>, /* prefetchable memory (768 MiB) */
+- <0x02000000 0x0 0x40000000 0x12 0x30000000 0x0 0x0fff0000>, /* non-prefetchable memory (256 MiB - 64 KiB) */
+- <0x01000000 0x0 0x00000000 0x12 0x3fff0000 0x0 0x00010000>; /* downstream I/O (64 KiB) */
++ pcie@14120000 {
++ compatible = "nvidia,tegra194-pcie";
++ power-domains = <&bpmp TEGRA194_POWER_DOMAIN_PCIEX1A>;
++ reg = <0x00 0x14120000 0x0 0x00020000>, /* appl registers (128K) */
++ <0x00 0x32000000 0x0 0x00040000>, /* configuration space (256K) */
++ <0x00 0x32040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */
++ <0x00 0x32080000 0x0 0x00040000>; /* DBI reg space (256K) */
++ reg-names = "appl", "config", "atu_dma", "dbi";
+
+- interconnects = <&mc TEGRA194_MEMORY_CLIENT_PCIE1R &emc>,
+- <&mc TEGRA194_MEMORY_CLIENT_PCIE1W &emc>;
+- interconnect-names = "dma-mem", "write";
+- iommu-map = <0x0 &smmu TEGRA194_SID_PCIE1 0x1000>;
+- iommu-map-mask = <0x0>;
+- dma-coherent;
+- };
++ status = "disabled";
+
+- pcie@14120000 {
+- compatible = "nvidia,tegra194-pcie";
+- power-domains = <&bpmp TEGRA194_POWER_DOMAIN_PCIEX1A>;
+- reg = <0x00 0x14120000 0x0 0x00020000>, /* appl registers (128K) */
+- <0x00 0x32000000 0x0 0x00040000>, /* configuration space (256K) */
+- <0x00 0x32040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */
+- <0x00 0x32080000 0x0 0x00040000>; /* DBI reg space (256K) */
+- reg-names = "appl", "config", "atu_dma", "dbi";
++ #address-cells = <3>;
++ #size-cells = <2>;
++ device_type = "pci";
++ num-lanes = <1>;
++ linux,pci-domain = <2>;
+
+- status = "disabled";
++ clocks = <&bpmp TEGRA194_CLK_PEX0_CORE_2>;
++ clock-names = "core";
+
+- #address-cells = <3>;
+- #size-cells = <2>;
+- device_type = "pci";
+- num-lanes = <1>;
+- linux,pci-domain = <2>;
++ resets = <&bpmp TEGRA194_RESET_PEX0_CORE_2_APB>,
++ <&bpmp TEGRA194_RESET_PEX0_CORE_2>;
++ reset-names = "apb", "core";
+
+- clocks = <&bpmp TEGRA194_CLK_PEX0_CORE_2>;
+- clock-names = "core";
++ interrupts = <GIC_SPI 47 IRQ_TYPE_LEVEL_HIGH>, /* controller interrupt */
++ <GIC_SPI 48 IRQ_TYPE_LEVEL_HIGH>; /* MSI interrupt */
++ interrupt-names = "intr", "msi";
+
+- resets = <&bpmp TEGRA194_RESET_PEX0_CORE_2_APB>,
+- <&bpmp TEGRA194_RESET_PEX0_CORE_2>;
+- reset-names = "apb", "core";
++ #interrupt-cells = <1>;
++ interrupt-map-mask = <0 0 0 0>;
++ interrupt-map = <0 0 0 0 &gic GIC_SPI 47 IRQ_TYPE_LEVEL_HIGH>;
+
+- interrupts = <GIC_SPI 47 IRQ_TYPE_LEVEL_HIGH>, /* controller interrupt */
+- <GIC_SPI 48 IRQ_TYPE_LEVEL_HIGH>; /* MSI interrupt */
+- interrupt-names = "intr", "msi";
++ nvidia,bpmp = <&bpmp 2>;
+
+- #interrupt-cells = <1>;
+- interrupt-map-mask = <0 0 0 0>;
+- interrupt-map = <0 0 0 0 &gic GIC_SPI 47 IRQ_TYPE_LEVEL_HIGH>;
++ nvidia,aspm-cmrt-us = <60>;
++ nvidia,aspm-pwr-on-t-us = <20>;
++ nvidia,aspm-l0s-entrance-latency-us = <3>;
+
+- nvidia,bpmp = <&bpmp 2>;
++ bus-range = <0x0 0xff>;
+
+- nvidia,aspm-cmrt-us = <60>;
+- nvidia,aspm-pwr-on-t-us = <20>;
+- nvidia,aspm-l0s-entrance-latency-us = <3>;
++ ranges = <0x43000000 0x12 0x40000000 0x12 0x40000000 0x0 0x30000000>, /* prefetchable memory (768 MiB) */
++ <0x02000000 0x0 0x40000000 0x12 0x70000000 0x0 0x0fff0000>, /* non-prefetchable memory (256 MiB - 64 KiB) */
++ <0x01000000 0x0 0x00000000 0x12 0x7fff0000 0x0 0x00010000>; /* downstream I/O (64 KiB) */
+
+- bus-range = <0x0 0xff>;
++ interconnects = <&mc TEGRA194_MEMORY_CLIENT_PCIE2AR &emc>,
++ <&mc TEGRA194_MEMORY_CLIENT_PCIE2AW &emc>;
++ interconnect-names = "dma-mem", "write";
++ iommu-map = <0x0 &smmu TEGRA194_SID_PCIE2 0x1000>;
++ iommu-map-mask = <0x0>;
++ dma-coherent;
++ };
+
+- ranges = <0x43000000 0x12 0x40000000 0x12 0x40000000 0x0 0x30000000>, /* prefetchable memory (768 MiB) */
+- <0x02000000 0x0 0x40000000 0x12 0x70000000 0x0 0x0fff0000>, /* non-prefetchable memory (256 MiB - 64 KiB) */
+- <0x01000000 0x0 0x00000000 0x12 0x7fff0000 0x0 0x00010000>; /* downstream I/O (64 KiB) */
++ pcie@14140000 {
++ compatible = "nvidia,tegra194-pcie";
++ power-domains = <&bpmp TEGRA194_POWER_DOMAIN_PCIEX1A>;
++ reg = <0x00 0x14140000 0x0 0x00020000>, /* appl registers (128K) */
++ <0x00 0x34000000 0x0 0x00040000>, /* configuration space (256K) */
++ <0x00 0x34040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */
++ <0x00 0x34080000 0x0 0x00040000>; /* DBI reg space (256K) */
++ reg-names = "appl", "config", "atu_dma", "dbi";
+
+- interconnects = <&mc TEGRA194_MEMORY_CLIENT_PCIE2AR &emc>,
+- <&mc TEGRA194_MEMORY_CLIENT_PCIE2AW &emc>;
+- interconnect-names = "dma-mem", "write";
+- iommu-map = <0x0 &smmu TEGRA194_SID_PCIE2 0x1000>;
+- iommu-map-mask = <0x0>;
+- dma-coherent;
+- };
++ status = "disabled";
+
+- pcie@14140000 {
+- compatible = "nvidia,tegra194-pcie";
+- power-domains = <&bpmp TEGRA194_POWER_DOMAIN_PCIEX1A>;
+- reg = <0x00 0x14140000 0x0 0x00020000>, /* appl registers (128K) */
+- <0x00 0x34000000 0x0 0x00040000>, /* configuration space (256K) */
+- <0x00 0x34040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */
+- <0x00 0x34080000 0x0 0x00040000>; /* DBI reg space (256K) */
+- reg-names = "appl", "config", "atu_dma", "dbi";
++ #address-cells = <3>;
++ #size-cells = <2>;
++ device_type = "pci";
++ num-lanes = <1>;
++ linux,pci-domain = <3>;
+
+- status = "disabled";
++ clocks = <&bpmp TEGRA194_CLK_PEX0_CORE_3>;
++ clock-names = "core";
+
+- #address-cells = <3>;
+- #size-cells = <2>;
+- device_type = "pci";
+- num-lanes = <1>;
+- linux,pci-domain = <3>;
++ resets = <&bpmp TEGRA194_RESET_PEX0_CORE_3_APB>,
++ <&bpmp TEGRA194_RESET_PEX0_CORE_3>;
++ reset-names = "apb", "core";
+
+- clocks = <&bpmp TEGRA194_CLK_PEX0_CORE_3>;
+- clock-names = "core";
++ interrupts = <GIC_SPI 49 IRQ_TYPE_LEVEL_HIGH>, /* controller interrupt */
++ <GIC_SPI 50 IRQ_TYPE_LEVEL_HIGH>; /* MSI interrupt */
++ interrupt-names = "intr", "msi";
+
+- resets = <&bpmp TEGRA194_RESET_PEX0_CORE_3_APB>,
+- <&bpmp TEGRA194_RESET_PEX0_CORE_3>;
+- reset-names = "apb", "core";
++ #interrupt-cells = <1>;
++ interrupt-map-mask = <0 0 0 0>;
++ interrupt-map = <0 0 0 0 &gic GIC_SPI 49 IRQ_TYPE_LEVEL_HIGH>;
+
+- interrupts = <GIC_SPI 49 IRQ_TYPE_LEVEL_HIGH>, /* controller interrupt */
+- <GIC_SPI 50 IRQ_TYPE_LEVEL_HIGH>; /* MSI interrupt */
+- interrupt-names = "intr", "msi";
++ nvidia,bpmp = <&bpmp 3>;
+
+- #interrupt-cells = <1>;
+- interrupt-map-mask = <0 0 0 0>;
+- interrupt-map = <0 0 0 0 &gic GIC_SPI 49 IRQ_TYPE_LEVEL_HIGH>;
++ nvidia,aspm-cmrt-us = <60>;
++ nvidia,aspm-pwr-on-t-us = <20>;
++ nvidia,aspm-l0s-entrance-latency-us = <3>;
+
+- nvidia,bpmp = <&bpmp 3>;
++ bus-range = <0x0 0xff>;
+
+- nvidia,aspm-cmrt-us = <60>;
+- nvidia,aspm-pwr-on-t-us = <20>;
+- nvidia,aspm-l0s-entrance-latency-us = <3>;
++ ranges = <0x43000000 0x12 0x80000000 0x12 0x80000000 0x0 0x30000000>, /* prefetchable memory (768 MiB) */
++ <0x02000000 0x0 0x40000000 0x12 0xb0000000 0x0 0x0fff0000>, /* non-prefetchable memory (256 MiB + 64 KiB) */
++ <0x01000000 0x0 0x00000000 0x12 0xbfff0000 0x0 0x00010000>; /* downstream I/O (64 KiB) */
+
+- bus-range = <0x0 0xff>;
++ interconnects = <&mc TEGRA194_MEMORY_CLIENT_PCIE3R &emc>,
++ <&mc TEGRA194_MEMORY_CLIENT_PCIE3W &emc>;
++ interconnect-names = "dma-mem", "write";
++ iommu-map = <0x0 &smmu TEGRA194_SID_PCIE3 0x1000>;
++ iommu-map-mask = <0x0>;
++ dma-coherent;
++ };
+
+- ranges = <0x43000000 0x12 0x80000000 0x12 0x80000000 0x0 0x30000000>, /* prefetchable memory (768 MiB) */
+- <0x02000000 0x0 0x40000000 0x12 0xb0000000 0x0 0x0fff0000>, /* non-prefetchable memory (256 MiB + 64 KiB) */
+- <0x01000000 0x0 0x00000000 0x12 0xbfff0000 0x0 0x00010000>; /* downstream I/O (64 KiB) */
++ pcie@14160000 {
++ compatible = "nvidia,tegra194-pcie";
++ power-domains = <&bpmp TEGRA194_POWER_DOMAIN_PCIEX4A>;
++ reg = <0x00 0x14160000 0x0 0x00020000>, /* appl registers (128K) */
++ <0x00 0x36000000 0x0 0x00040000>, /* configuration space (256K) */
++ <0x00 0x36040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */
++ <0x00 0x36080000 0x0 0x00040000>; /* DBI reg space (256K) */
++ reg-names = "appl", "config", "atu_dma", "dbi";
+
+- interconnects = <&mc TEGRA194_MEMORY_CLIENT_PCIE3R &emc>,
+- <&mc TEGRA194_MEMORY_CLIENT_PCIE3W &emc>;
+- interconnect-names = "dma-mem", "write";
+- iommu-map = <0x0 &smmu TEGRA194_SID_PCIE3 0x1000>;
+- iommu-map-mask = <0x0>;
+- dma-coherent;
+- };
++ status = "disabled";
+
+- pcie@14160000 {
+- compatible = "nvidia,tegra194-pcie";
+- power-domains = <&bpmp TEGRA194_POWER_DOMAIN_PCIEX4A>;
+- reg = <0x00 0x14160000 0x0 0x00020000>, /* appl registers (128K) */
+- <0x00 0x36000000 0x0 0x00040000>, /* configuration space (256K) */
+- <0x00 0x36040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */
+- <0x00 0x36080000 0x0 0x00040000>; /* DBI reg space (256K) */
+- reg-names = "appl", "config", "atu_dma", "dbi";
++ #address-cells = <3>;
++ #size-cells = <2>;
++ device_type = "pci";
++ num-lanes = <4>;
++ linux,pci-domain = <4>;
+
+- status = "disabled";
++ clocks = <&bpmp TEGRA194_CLK_PEX0_CORE_4>;
++ clock-names = "core";
+
+- #address-cells = <3>;
+- #size-cells = <2>;
+- device_type = "pci";
+- num-lanes = <4>;
+- linux,pci-domain = <4>;
++ resets = <&bpmp TEGRA194_RESET_PEX0_CORE_4_APB>,
++ <&bpmp TEGRA194_RESET_PEX0_CORE_4>;
++ reset-names = "apb", "core";
+
+- clocks = <&bpmp TEGRA194_CLK_PEX0_CORE_4>;
+- clock-names = "core";
++ interrupts = <GIC_SPI 51 IRQ_TYPE_LEVEL_HIGH>, /* controller interrupt */
++ <GIC_SPI 52 IRQ_TYPE_LEVEL_HIGH>; /* MSI interrupt */
++ interrupt-names = "intr", "msi";
+
+- resets = <&bpmp TEGRA194_RESET_PEX0_CORE_4_APB>,
+- <&bpmp TEGRA194_RESET_PEX0_CORE_4>;
+- reset-names = "apb", "core";
++ #interrupt-cells = <1>;
++ interrupt-map-mask = <0 0 0 0>;
++ interrupt-map = <0 0 0 0 &gic GIC_SPI 51 IRQ_TYPE_LEVEL_HIGH>;
+
+- interrupts = <GIC_SPI 51 IRQ_TYPE_LEVEL_HIGH>, /* controller interrupt */
+- <GIC_SPI 52 IRQ_TYPE_LEVEL_HIGH>; /* MSI interrupt */
+- interrupt-names = "intr", "msi";
++ nvidia,bpmp = <&bpmp 4>;
+
+- #interrupt-cells = <1>;
+- interrupt-map-mask = <0 0 0 0>;
+- interrupt-map = <0 0 0 0 &gic GIC_SPI 51 IRQ_TYPE_LEVEL_HIGH>;
++ nvidia,aspm-cmrt-us = <60>;
++ nvidia,aspm-pwr-on-t-us = <20>;
++ nvidia,aspm-l0s-entrance-latency-us = <3>;
+
+- nvidia,bpmp = <&bpmp 4>;
++ bus-range = <0x0 0xff>;
+
+- nvidia,aspm-cmrt-us = <60>;
+- nvidia,aspm-pwr-on-t-us = <20>;
+- nvidia,aspm-l0s-entrance-latency-us = <3>;
++ ranges = <0x43000000 0x14 0x00000000 0x14 0x00000000 0x3 0x40000000>, /* prefetchable memory (13 GiB) */
++ <0x02000000 0x0 0x40000000 0x17 0x40000000 0x0 0xbfff0000>, /* non-prefetchable memory (3 GiB - 64 KiB) */
++ <0x01000000 0x0 0x00000000 0x17 0xffff0000 0x0 0x00010000>; /* downstream I/O (64 KiB) */
+
+- bus-range = <0x0 0xff>;
++ interconnects = <&mc TEGRA194_MEMORY_CLIENT_PCIE4R &emc>,
++ <&mc TEGRA194_MEMORY_CLIENT_PCIE4W &emc>;
++ interconnect-names = "dma-mem", "write";
++ iommu-map = <0x0 &smmu TEGRA194_SID_PCIE4 0x1000>;
++ iommu-map-mask = <0x0>;
++ dma-coherent;
++ };
+
+- ranges = <0x43000000 0x14 0x00000000 0x14 0x00000000 0x3 0x40000000>, /* prefetchable memory (13 GiB) */
+- <0x02000000 0x0 0x40000000 0x17 0x40000000 0x0 0xbfff0000>, /* non-prefetchable memory (3 GiB - 64 KiB) */
+- <0x01000000 0x0 0x00000000 0x17 0xffff0000 0x0 0x00010000>; /* downstream I/O (64 KiB) */
++ pcie-ep@14160000 {
++ compatible = "nvidia,tegra194-pcie-ep";
++ power-domains = <&bpmp TEGRA194_POWER_DOMAIN_PCIEX4A>;
++ reg = <0x00 0x14160000 0x0 0x00020000>, /* appl registers (128K) */
++ <0x00 0x36040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */
++ <0x00 0x36080000 0x0 0x00040000>, /* DBI reg space (256K) */
++ <0x14 0x00000000 0x4 0x00000000>; /* Address Space (16G) */
++ reg-names = "appl", "atu_dma", "dbi", "addr_space";
+
+- interconnects = <&mc TEGRA194_MEMORY_CLIENT_PCIE4R &emc>,
+- <&mc TEGRA194_MEMORY_CLIENT_PCIE4W &emc>;
+- interconnect-names = "dma-mem", "write";
+- iommu-map = <0x0 &smmu TEGRA194_SID_PCIE4 0x1000>;
+- iommu-map-mask = <0x0>;
+- dma-coherent;
+- };
++ status = "disabled";
+
+- pcie@14180000 {
+- compatible = "nvidia,tegra194-pcie";
+- power-domains = <&bpmp TEGRA194_POWER_DOMAIN_PCIEX8B>;
+- reg = <0x00 0x14180000 0x0 0x00020000>, /* appl registers (128K) */
+- <0x00 0x38000000 0x0 0x00040000>, /* configuration space (256K) */
+- <0x00 0x38040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */
+- <0x00 0x38080000 0x0 0x00040000>; /* DBI reg space (256K) */
+- reg-names = "appl", "config", "atu_dma", "dbi";
++ num-lanes = <4>;
++ num-ib-windows = <2>;
++ num-ob-windows = <8>;
+
+- status = "disabled";
++ clocks = <&bpmp TEGRA194_CLK_PEX0_CORE_4>;
++ clock-names = "core";
+
+- #address-cells = <3>;
+- #size-cells = <2>;
+- device_type = "pci";
+- num-lanes = <8>;
+- linux,pci-domain = <0>;
++ resets = <&bpmp TEGRA194_RESET_PEX0_CORE_4_APB>,
++ <&bpmp TEGRA194_RESET_PEX0_CORE_4>;
++ reset-names = "apb", "core";
+
+- clocks = <&bpmp TEGRA194_CLK_PEX0_CORE_0>;
+- clock-names = "core";
++ interrupts = <GIC_SPI 51 IRQ_TYPE_LEVEL_HIGH>; /* controller interrupt */
++ interrupt-names = "intr";
+
+- resets = <&bpmp TEGRA194_RESET_PEX0_CORE_0_APB>,
+- <&bpmp TEGRA194_RESET_PEX0_CORE_0>;
+- reset-names = "apb", "core";
++ nvidia,bpmp = <&bpmp 4>;
+
+- interrupts = <GIC_SPI 72 IRQ_TYPE_LEVEL_HIGH>, /* controller interrupt */
+- <GIC_SPI 73 IRQ_TYPE_LEVEL_HIGH>; /* MSI interrupt */
+- interrupt-names = "intr", "msi";
++ nvidia,aspm-cmrt-us = <60>;
++ nvidia,aspm-pwr-on-t-us = <20>;
++ nvidia,aspm-l0s-entrance-latency-us = <3>;
+
+- #interrupt-cells = <1>;
+- interrupt-map-mask = <0 0 0 0>;
+- interrupt-map = <0 0 0 0 &gic GIC_SPI 72 IRQ_TYPE_LEVEL_HIGH>;
++ interconnects = <&mc TEGRA194_MEMORY_CLIENT_PCIE4R &emc>,
++ <&mc TEGRA194_MEMORY_CLIENT_PCIE4W &emc>;
++ interconnect-names = "dma-mem", "write";
++ iommu-map = <0x0 &smmu TEGRA194_SID_PCIE4 0x1000>;
++ iommu-map-mask = <0x0>;
++ dma-coherent;
++ };
+
+- nvidia,bpmp = <&bpmp 0>;
++ pcie@14180000 {
++ compatible = "nvidia,tegra194-pcie";
++ power-domains = <&bpmp TEGRA194_POWER_DOMAIN_PCIEX8B>;
++ reg = <0x00 0x14180000 0x0 0x00020000>, /* appl registers (128K) */
++ <0x00 0x38000000 0x0 0x00040000>, /* configuration space (256K) */
++ <0x00 0x38040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */
++ <0x00 0x38080000 0x0 0x00040000>; /* DBI reg space (256K) */
++ reg-names = "appl", "config", "atu_dma", "dbi";
+
+- nvidia,aspm-cmrt-us = <60>;
+- nvidia,aspm-pwr-on-t-us = <20>;
+- nvidia,aspm-l0s-entrance-latency-us = <3>;
++ status = "disabled";
+
+- bus-range = <0x0 0xff>;
++ #address-cells = <3>;
++ #size-cells = <2>;
++ device_type = "pci";
++ num-lanes = <8>;
++ linux,pci-domain = <0>;
+
+- ranges = <0x43000000 0x18 0x00000000 0x18 0x00000000 0x3 0x40000000>, /* prefetchable memory (13 GiB) */
+- <0x02000000 0x0 0x40000000 0x1b 0x40000000 0x0 0xbfff0000>, /* non-prefetchable memory (3 GiB - 64 KiB) */
+- <0x01000000 0x0 0x00000000 0x1b 0xffff0000 0x0 0x00010000>; /* downstream I/O (64 KiB) */
++ clocks = <&bpmp TEGRA194_CLK_PEX0_CORE_0>;
++ clock-names = "core";
+
+- interconnects = <&mc TEGRA194_MEMORY_CLIENT_PCIE0R &emc>,
+- <&mc TEGRA194_MEMORY_CLIENT_PCIE0W &emc>;
+- interconnect-names = "dma-mem", "write";
+- iommu-map = <0x0 &smmu TEGRA194_SID_PCIE0 0x1000>;
+- iommu-map-mask = <0x0>;
+- dma-coherent;
+- };
++ resets = <&bpmp TEGRA194_RESET_PEX0_CORE_0_APB>,
++ <&bpmp TEGRA194_RESET_PEX0_CORE_0>;
++ reset-names = "apb", "core";
+
+- pcie@141a0000 {
+- compatible = "nvidia,tegra194-pcie";
+- power-domains = <&bpmp TEGRA194_POWER_DOMAIN_PCIEX8A>;
+- reg = <0x00 0x141a0000 0x0 0x00020000>, /* appl registers (128K) */
+- <0x00 0x3a000000 0x0 0x00040000>, /* configuration space (256K) */
+- <0x00 0x3a040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */
+- <0x00 0x3a080000 0x0 0x00040000>; /* DBI reg space (256K) */
+- reg-names = "appl", "config", "atu_dma", "dbi";
++ interrupts = <GIC_SPI 72 IRQ_TYPE_LEVEL_HIGH>, /* controller interrupt */
++ <GIC_SPI 73 IRQ_TYPE_LEVEL_HIGH>; /* MSI interrupt */
++ interrupt-names = "intr", "msi";
+
+- status = "disabled";
++ #interrupt-cells = <1>;
++ interrupt-map-mask = <0 0 0 0>;
++ interrupt-map = <0 0 0 0 &gic GIC_SPI 72 IRQ_TYPE_LEVEL_HIGH>;
+
+- #address-cells = <3>;
+- #size-cells = <2>;
+- device_type = "pci";
+- num-lanes = <8>;
+- linux,pci-domain = <5>;
++ nvidia,bpmp = <&bpmp 0>;
+
+- pinctrl-names = "default";
+- pinctrl-0 = <&pex_rst_c5_out_state>, <&clkreq_c5_bi_dir_state>;
++ nvidia,aspm-cmrt-us = <60>;
++ nvidia,aspm-pwr-on-t-us = <20>;
++ nvidia,aspm-l0s-entrance-latency-us = <3>;
+
+- clocks = <&bpmp TEGRA194_CLK_PEX1_CORE_5>;
+- clock-names = "core";
++ bus-range = <0x0 0xff>;
+
+- resets = <&bpmp TEGRA194_RESET_PEX1_CORE_5_APB>,
+- <&bpmp TEGRA194_RESET_PEX1_CORE_5>;
+- reset-names = "apb", "core";
++ ranges = <0x43000000 0x18 0x00000000 0x18 0x00000000 0x3 0x40000000>, /* prefetchable memory (13 GiB) */
++ <0x02000000 0x0 0x40000000 0x1b 0x40000000 0x0 0xbfff0000>, /* non-prefetchable memory (3 GiB - 64 KiB) */
++ <0x01000000 0x0 0x00000000 0x1b 0xffff0000 0x0 0x00010000>; /* downstream I/O (64 KiB) */
+
+- interrupts = <GIC_SPI 53 IRQ_TYPE_LEVEL_HIGH>, /* controller interrupt */
+- <GIC_SPI 54 IRQ_TYPE_LEVEL_HIGH>; /* MSI interrupt */
+- interrupt-names = "intr", "msi";
++ interconnects = <&mc TEGRA194_MEMORY_CLIENT_PCIE0R &emc>,
++ <&mc TEGRA194_MEMORY_CLIENT_PCIE0W &emc>;
++ interconnect-names = "dma-mem", "write";
++ iommu-map = <0x0 &smmu TEGRA194_SID_PCIE0 0x1000>;
++ iommu-map-mask = <0x0>;
++ dma-coherent;
++ };
+
+- nvidia,bpmp = <&bpmp 5>;
++ pcie-ep@14180000 {
++ compatible = "nvidia,tegra194-pcie-ep";
++ power-domains = <&bpmp TEGRA194_POWER_DOMAIN_PCIEX8B>;
++ reg = <0x00 0x14180000 0x0 0x00020000>, /* appl registers (128K) */
++ <0x00 0x38040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */
++ <0x00 0x38080000 0x0 0x00040000>, /* DBI reg space (256K) */
++ <0x18 0x00000000 0x4 0x00000000>; /* Address Space (16G) */
++ reg-names = "appl", "atu_dma", "dbi", "addr_space";
+
+- #interrupt-cells = <1>;
+- interrupt-map-mask = <0 0 0 0>;
+- interrupt-map = <0 0 0 0 &gic GIC_SPI 53 IRQ_TYPE_LEVEL_HIGH>;
++ status = "disabled";
+
+- nvidia,aspm-cmrt-us = <60>;
+- nvidia,aspm-pwr-on-t-us = <20>;
+- nvidia,aspm-l0s-entrance-latency-us = <3>;
++ num-lanes = <8>;
++ num-ib-windows = <2>;
++ num-ob-windows = <8>;
+
+- bus-range = <0x0 0xff>;
++ clocks = <&bpmp TEGRA194_CLK_PEX0_CORE_0>;
++ clock-names = "core";
+
+- ranges = <0x43000000 0x1c 0x00000000 0x1c 0x00000000 0x3 0x40000000>, /* prefetchable memory (13 GiB) */
+- <0x02000000 0x0 0x40000000 0x1f 0x40000000 0x0 0xbfff0000>, /* non-prefetchable memory (3 GiB - 64 KiB) */
+- <0x01000000 0x0 0x00000000 0x1f 0xffff0000 0x0 0x00010000>; /* downstream I/O (64 KiB) */
++ resets = <&bpmp TEGRA194_RESET_PEX0_CORE_0_APB>,
++ <&bpmp TEGRA194_RESET_PEX0_CORE_0>;
++ reset-names = "apb", "core";
+
+- interconnects = <&mc TEGRA194_MEMORY_CLIENT_PCIE5R &emc>,
+- <&mc TEGRA194_MEMORY_CLIENT_PCIE5W &emc>;
+- interconnect-names = "dma-mem", "write";
+- iommu-map = <0x0 &smmu TEGRA194_SID_PCIE5 0x1000>;
+- iommu-map-mask = <0x0>;
+- dma-coherent;
+- };
++ interrupts = <GIC_SPI 72 IRQ_TYPE_LEVEL_HIGH>; /* controller interrupt */
++ interrupt-names = "intr";
+
+- pcie-ep@14160000 {
+- compatible = "nvidia,tegra194-pcie-ep";
+- power-domains = <&bpmp TEGRA194_POWER_DOMAIN_PCIEX4A>;
+- reg = <0x00 0x14160000 0x0 0x00020000>, /* appl registers (128K) */
+- <0x00 0x36040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */
+- <0x00 0x36080000 0x0 0x00040000>, /* DBI reg space (256K) */
+- <0x14 0x00000000 0x4 0x00000000>; /* Address Space (16G) */
+- reg-names = "appl", "atu_dma", "dbi", "addr_space";
++ nvidia,bpmp = <&bpmp 0>;
+
+- status = "disabled";
++ nvidia,aspm-cmrt-us = <60>;
++ nvidia,aspm-pwr-on-t-us = <20>;
++ nvidia,aspm-l0s-entrance-latency-us = <3>;
+
+- num-lanes = <4>;
+- num-ib-windows = <2>;
+- num-ob-windows = <8>;
++ interconnects = <&mc TEGRA194_MEMORY_CLIENT_PCIE0R &emc>,
++ <&mc TEGRA194_MEMORY_CLIENT_PCIE0W &emc>;
++ interconnect-names = "dma-mem", "write";
++ iommu-map = <0x0 &smmu TEGRA194_SID_PCIE0 0x1000>;
++ iommu-map-mask = <0x0>;
++ dma-coherent;
++ };
+
+- clocks = <&bpmp TEGRA194_CLK_PEX0_CORE_4>;
+- clock-names = "core";
++ pcie@141a0000 {
++ compatible = "nvidia,tegra194-pcie";
++ power-domains = <&bpmp TEGRA194_POWER_DOMAIN_PCIEX8A>;
++ reg = <0x00 0x141a0000 0x0 0x00020000>, /* appl registers (128K) */
++ <0x00 0x3a000000 0x0 0x00040000>, /* configuration space (256K) */
++ <0x00 0x3a040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */
++ <0x00 0x3a080000 0x0 0x00040000>; /* DBI reg space (256K) */
++ reg-names = "appl", "config", "atu_dma", "dbi";
+
+- resets = <&bpmp TEGRA194_RESET_PEX0_CORE_4_APB>,
+- <&bpmp TEGRA194_RESET_PEX0_CORE_4>;
+- reset-names = "apb", "core";
++ status = "disabled";
+
+- interrupts = <GIC_SPI 51 IRQ_TYPE_LEVEL_HIGH>; /* controller interrupt */
+- interrupt-names = "intr";
++ #address-cells = <3>;
++ #size-cells = <2>;
++ device_type = "pci";
++ num-lanes = <8>;
++ linux,pci-domain = <5>;
+
+- nvidia,bpmp = <&bpmp 4>;
++ pinctrl-names = "default";
++ pinctrl-0 = <&pex_rst_c5_out_state>, <&clkreq_c5_bi_dir_state>;
+
+- nvidia,aspm-cmrt-us = <60>;
+- nvidia,aspm-pwr-on-t-us = <20>;
+- nvidia,aspm-l0s-entrance-latency-us = <3>;
++ clocks = <&bpmp TEGRA194_CLK_PEX1_CORE_5>;
++ clock-names = "core";
+
+- interconnects = <&mc TEGRA194_MEMORY_CLIENT_PCIE4R &emc>,
+- <&mc TEGRA194_MEMORY_CLIENT_PCIE4W &emc>;
+- interconnect-names = "dma-mem", "write";
+- iommu-map = <0x0 &smmu TEGRA194_SID_PCIE4 0x1000>;
+- iommu-map-mask = <0x0>;
+- dma-coherent;
+- };
++ resets = <&bpmp TEGRA194_RESET_PEX1_CORE_5_APB>,
++ <&bpmp TEGRA194_RESET_PEX1_CORE_5>;
++ reset-names = "apb", "core";
+
+- pcie-ep@14180000 {
+- compatible = "nvidia,tegra194-pcie-ep";
+- power-domains = <&bpmp TEGRA194_POWER_DOMAIN_PCIEX8B>;
+- reg = <0x00 0x14180000 0x0 0x00020000>, /* appl registers (128K) */
+- <0x00 0x38040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */
+- <0x00 0x38080000 0x0 0x00040000>, /* DBI reg space (256K) */
+- <0x18 0x00000000 0x4 0x00000000>; /* Address Space (16G) */
+- reg-names = "appl", "atu_dma", "dbi", "addr_space";
++ interrupts = <GIC_SPI 53 IRQ_TYPE_LEVEL_HIGH>, /* controller interrupt */
++ <GIC_SPI 54 IRQ_TYPE_LEVEL_HIGH>; /* MSI interrupt */
++ interrupt-names = "intr", "msi";
+
+- status = "disabled";
++ nvidia,bpmp = <&bpmp 5>;
+
+- num-lanes = <8>;
+- num-ib-windows = <2>;
+- num-ob-windows = <8>;
++ #interrupt-cells = <1>;
++ interrupt-map-mask = <0 0 0 0>;
++ interrupt-map = <0 0 0 0 &gic GIC_SPI 53 IRQ_TYPE_LEVEL_HIGH>;
+
+- clocks = <&bpmp TEGRA194_CLK_PEX0_CORE_0>;
+- clock-names = "core";
++ nvidia,aspm-cmrt-us = <60>;
++ nvidia,aspm-pwr-on-t-us = <20>;
++ nvidia,aspm-l0s-entrance-latency-us = <3>;
+
+- resets = <&bpmp TEGRA194_RESET_PEX0_CORE_0_APB>,
+- <&bpmp TEGRA194_RESET_PEX0_CORE_0>;
+- reset-names = "apb", "core";
++ bus-range = <0x0 0xff>;
+
+- interrupts = <GIC_SPI 72 IRQ_TYPE_LEVEL_HIGH>; /* controller interrupt */
+- interrupt-names = "intr";
++ ranges = <0x43000000 0x1c 0x00000000 0x1c 0x00000000 0x3 0x40000000>, /* prefetchable memory (13 GiB) */
++ <0x02000000 0x0 0x40000000 0x1f 0x40000000 0x0 0xbfff0000>, /* non-prefetchable memory (3 GiB - 64 KiB) */
++ <0x01000000 0x0 0x00000000 0x1f 0xffff0000 0x0 0x00010000>; /* downstream I/O (64 KiB) */
+
+- nvidia,bpmp = <&bpmp 0>;
++ interconnects = <&mc TEGRA194_MEMORY_CLIENT_PCIE5R &emc>,
++ <&mc TEGRA194_MEMORY_CLIENT_PCIE5W &emc>;
++ interconnect-names = "dma-mem", "write";
++ iommu-map = <0x0 &smmu TEGRA194_SID_PCIE5 0x1000>;
++ iommu-map-mask = <0x0>;
++ dma-coherent;
++ };
+
+- nvidia,aspm-cmrt-us = <60>;
+- nvidia,aspm-pwr-on-t-us = <20>;
+- nvidia,aspm-l0s-entrance-latency-us = <3>;
++ pcie-ep@141a0000 {
++ compatible = "nvidia,tegra194-pcie-ep";
++ power-domains = <&bpmp TEGRA194_POWER_DOMAIN_PCIEX8A>;
++ reg = <0x00 0x141a0000 0x0 0x00020000>, /* appl registers (128K) */
++ <0x00 0x3a040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */
++ <0x00 0x3a080000 0x0 0x00040000>, /* DBI reg space (256K) */
++ <0x1c 0x00000000 0x4 0x00000000>; /* Address Space (16G) */
++ reg-names = "appl", "atu_dma", "dbi", "addr_space";
+
+- interconnects = <&mc TEGRA194_MEMORY_CLIENT_PCIE0R &emc>,
+- <&mc TEGRA194_MEMORY_CLIENT_PCIE0W &emc>;
+- interconnect-names = "dma-mem", "write";
+- iommu-map = <0x0 &smmu TEGRA194_SID_PCIE0 0x1000>;
+- iommu-map-mask = <0x0>;
+- dma-coherent;
+- };
++ status = "disabled";
+
+- pcie-ep@141a0000 {
+- compatible = "nvidia,tegra194-pcie-ep";
+- power-domains = <&bpmp TEGRA194_POWER_DOMAIN_PCIEX8A>;
+- reg = <0x00 0x141a0000 0x0 0x00020000>, /* appl registers (128K) */
+- <0x00 0x3a040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */
+- <0x00 0x3a080000 0x0 0x00040000>, /* DBI reg space (256K) */
+- <0x1c 0x00000000 0x4 0x00000000>; /* Address Space (16G) */
+- reg-names = "appl", "atu_dma", "dbi", "addr_space";
++ num-lanes = <8>;
++ num-ib-windows = <2>;
++ num-ob-windows = <8>;
+
+- status = "disabled";
++ pinctrl-names = "default";
++ pinctrl-0 = <&clkreq_c5_bi_dir_state>;
+
+- num-lanes = <8>;
+- num-ib-windows = <2>;
+- num-ob-windows = <8>;
++ clocks = <&bpmp TEGRA194_CLK_PEX1_CORE_5>;
++ clock-names = "core";
+
+- pinctrl-names = "default";
+- pinctrl-0 = <&clkreq_c5_bi_dir_state>;
++ resets = <&bpmp TEGRA194_RESET_PEX1_CORE_5_APB>,
++ <&bpmp TEGRA194_RESET_PEX1_CORE_5>;
++ reset-names = "apb", "core";
+
+- clocks = <&bpmp TEGRA194_CLK_PEX1_CORE_5>;
+- clock-names = "core";
++ interrupts = <GIC_SPI 53 IRQ_TYPE_LEVEL_HIGH>; /* controller interrupt */
++ interrupt-names = "intr";
+
+- resets = <&bpmp TEGRA194_RESET_PEX1_CORE_5_APB>,
+- <&bpmp TEGRA194_RESET_PEX1_CORE_5>;
+- reset-names = "apb", "core";
++ nvidia,bpmp = <&bpmp 5>;
+
+- interrupts = <GIC_SPI 53 IRQ_TYPE_LEVEL_HIGH>; /* controller interrupt */
+- interrupt-names = "intr";
++ nvidia,aspm-cmrt-us = <60>;
++ nvidia,aspm-pwr-on-t-us = <20>;
++ nvidia,aspm-l0s-entrance-latency-us = <3>;
+
+- nvidia,bpmp = <&bpmp 5>;
++ interconnects = <&mc TEGRA194_MEMORY_CLIENT_PCIE5R &emc>,
++ <&mc TEGRA194_MEMORY_CLIENT_PCIE5W &emc>;
++ interconnect-names = "dma-mem", "write";
++ iommu-map = <0x0 &smmu TEGRA194_SID_PCIE5 0x1000>;
++ iommu-map-mask = <0x0>;
++ dma-coherent;
++ };
+
+- nvidia,aspm-cmrt-us = <60>;
+- nvidia,aspm-pwr-on-t-us = <20>;
+- nvidia,aspm-l0s-entrance-latency-us = <3>;
++ gpu@17000000 {
++ compatible = "nvidia,gv11b";
++ reg = <0x0 0x17000000 0x0 0x1000000>,
++ <0x0 0x18000000 0x0 0x1000000>;
++ interrupts = <GIC_SPI 70 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 71 IRQ_TYPE_LEVEL_HIGH>;
++ interrupt-names = "stall", "nonstall";
++ clocks = <&bpmp TEGRA194_CLK_GPCCLK>,
++ <&bpmp TEGRA194_CLK_GPU_PWR>,
++ <&bpmp TEGRA194_CLK_FUSE>;
++ clock-names = "gpu", "pwr", "fuse";
++ resets = <&bpmp TEGRA194_RESET_GPU>;
++ reset-names = "gpu";
++ dma-coherent;
+
+- interconnects = <&mc TEGRA194_MEMORY_CLIENT_PCIE5R &emc>,
+- <&mc TEGRA194_MEMORY_CLIENT_PCIE5W &emc>;
+- interconnect-names = "dma-mem", "write";
+- iommu-map = <0x0 &smmu TEGRA194_SID_PCIE5 0x1000>;
+- iommu-map-mask = <0x0>;
+- dma-coherent;
++ power-domains = <&bpmp TEGRA194_POWER_DOMAIN_GPU>;
++ interconnects = <&mc TEGRA194_MEMORY_CLIENT_NVL1R &emc>,
++ <&mc TEGRA194_MEMORY_CLIENT_NVL1RHP &emc>,
++ <&mc TEGRA194_MEMORY_CLIENT_NVL1W &emc>,
++ <&mc TEGRA194_MEMORY_CLIENT_NVL2R &emc>,
++ <&mc TEGRA194_MEMORY_CLIENT_NVL2RHP &emc>,
++ <&mc TEGRA194_MEMORY_CLIENT_NVL2W &emc>,
++ <&mc TEGRA194_MEMORY_CLIENT_NVL3R &emc>,
++ <&mc TEGRA194_MEMORY_CLIENT_NVL3RHP &emc>,
++ <&mc TEGRA194_MEMORY_CLIENT_NVL3W &emc>,
++ <&mc TEGRA194_MEMORY_CLIENT_NVL4R &emc>,
++ <&mc TEGRA194_MEMORY_CLIENT_NVL4RHP &emc>,
++ <&mc TEGRA194_MEMORY_CLIENT_NVL4W &emc>;
++ interconnect-names = "dma-mem", "read-0-hp", "write-0",
++ "read-1", "read-1-hp", "write-1",
++ "read-2", "read-2-hp", "write-2",
++ "read-3", "read-3-hp", "write-3";
++ };
+ };
+
+ sram@40000000 {
+ compatible = "nvidia,tegra194-sysram", "mmio-sram";
+ reg = <0x0 0x40000000 0x0 0x50000>;
++
+ #address-cells = <1>;
+ #size-cells = <1>;
+ ranges = <0x0 0x0 0x40000000 0x50000>;
++
+ no-memory-wc;
+
+ cpu_bpmp_tx: sram@4e000 {
+diff --git a/arch/arm64/boot/dts/nvidia/tegra234-p3737-0000+p3701-0000.dts b/arch/arm64/boot/dts/nvidia/tegra234-p3737-0000+p3701-0000.dts
+index 96aa2267b06d8..431f42a266f5b 100644
+--- a/arch/arm64/boot/dts/nvidia/tegra234-p3737-0000+p3701-0000.dts
++++ b/arch/arm64/boot/dts/nvidia/tegra234-p3737-0000+p3701-0000.dts
+@@ -2048,6 +2048,57 @@ mgbe0_phy: phy@0 {
+ };
+ };
+ };
++
++ pcie@14100000 {
++ status = "okay";
++
++ vddio-pex-ctl-supply = <&vdd_1v8_ao>;
++
++ phys = <&p2u_hsio_3>;
++ phy-names = "p2u-0";
++ };
++
++ pcie@14160000 {
++ status = "okay";
++
++ vddio-pex-ctl-supply = <&vdd_1v8_ao>;
++
++ phys = <&p2u_hsio_4>, <&p2u_hsio_5>, <&p2u_hsio_6>,
++ <&p2u_hsio_7>;
++ phy-names = "p2u-0", "p2u-1", "p2u-2", "p2u-3";
++ };
++
++ pcie@141a0000 {
++ status = "okay";
++
++ vddio-pex-ctl-supply = <&vdd_1v8_ls>;
++ vpcie3v3-supply = <&vdd_3v3_pcie>;
++ vpcie12v-supply = <&vdd_12v_pcie>;
++
++ phys = <&p2u_nvhs_0>, <&p2u_nvhs_1>, <&p2u_nvhs_2>,
++ <&p2u_nvhs_3>, <&p2u_nvhs_4>, <&p2u_nvhs_5>,
++ <&p2u_nvhs_6>, <&p2u_nvhs_7>;
++ phy-names = "p2u-0", "p2u-1", "p2u-2", "p2u-3", "p2u-4",
++ "p2u-5", "p2u-6", "p2u-7";
++ };
++
++ pcie-ep@141a0000 {
++ status = "disabled";
++
++ vddio-pex-ctl-supply = <&vdd_1v8_ls>;
++
++ reset-gpios = <&gpio TEGRA234_MAIN_GPIO(AF, 1) GPIO_ACTIVE_LOW>;
++
++ nvidia,refclk-select-gpios = <&gpio_aon
++ TEGRA234_AON_GPIO(AA, 4)
++ GPIO_ACTIVE_HIGH>;
++
++ phys = <&p2u_nvhs_0>, <&p2u_nvhs_1>, <&p2u_nvhs_2>,
++ <&p2u_nvhs_3>, <&p2u_nvhs_4>, <&p2u_nvhs_5>,
++ <&p2u_nvhs_6>, <&p2u_nvhs_7>;
++ phy-names = "p2u-0", "p2u-1", "p2u-2", "p2u-3", "p2u-4",
++ "p2u-5", "p2u-6", "p2u-7";
++ };
+ };
+
+ gpio-keys {
+@@ -2145,57 +2196,6 @@ sound {
+ label = "NVIDIA Jetson AGX Orin APE";
+ };
+
+- pcie@14100000 {
+- status = "okay";
+-
+- vddio-pex-ctl-supply = <&vdd_1v8_ao>;
+-
+- phys = <&p2u_hsio_3>;
+- phy-names = "p2u-0";
+- };
+-
+- pcie@14160000 {
+- status = "okay";
+-
+- vddio-pex-ctl-supply = <&vdd_1v8_ao>;
+-
+- phys = <&p2u_hsio_4>, <&p2u_hsio_5>, <&p2u_hsio_6>,
+- <&p2u_hsio_7>;
+- phy-names = "p2u-0", "p2u-1", "p2u-2", "p2u-3";
+- };
+-
+- pcie@141a0000 {
+- status = "okay";
+-
+- vddio-pex-ctl-supply = <&vdd_1v8_ls>;
+- vpcie3v3-supply = <&vdd_3v3_pcie>;
+- vpcie12v-supply = <&vdd_12v_pcie>;
+-
+- phys = <&p2u_nvhs_0>, <&p2u_nvhs_1>, <&p2u_nvhs_2>,
+- <&p2u_nvhs_3>, <&p2u_nvhs_4>, <&p2u_nvhs_5>,
+- <&p2u_nvhs_6>, <&p2u_nvhs_7>;
+- phy-names = "p2u-0", "p2u-1", "p2u-2", "p2u-3", "p2u-4",
+- "p2u-5", "p2u-6", "p2u-7";
+- };
+-
+- pcie-ep@141a0000 {
+- status = "disabled";
+-
+- vddio-pex-ctl-supply = <&vdd_1v8_ls>;
+-
+- reset-gpios = <&gpio TEGRA234_MAIN_GPIO(AF, 1) GPIO_ACTIVE_LOW>;
+-
+- nvidia,refclk-select-gpios = <&gpio_aon
+- TEGRA234_AON_GPIO(AA, 4)
+- GPIO_ACTIVE_HIGH>;
+-
+- phys = <&p2u_nvhs_0>, <&p2u_nvhs_1>, <&p2u_nvhs_2>,
+- <&p2u_nvhs_3>, <&p2u_nvhs_4>, <&p2u_nvhs_5>,
+- <&p2u_nvhs_6>, <&p2u_nvhs_7>;
+- phy-names = "p2u-0", "p2u-1", "p2u-2", "p2u-3", "p2u-4",
+- "p2u-5", "p2u-6", "p2u-7";
+- };
+-
+ pwm-fan {
+ compatible = "pwm-fan";
+ pwms = <&pwm3 0 45334>;
+diff --git a/arch/arm64/boot/dts/nvidia/tegra234.dtsi b/arch/arm64/boot/dts/nvidia/tegra234.dtsi
+index eaf05ee9acd18..3d680ee0f4d17 100644
+--- a/arch/arm64/boot/dts/nvidia/tegra234.dtsi
++++ b/arch/arm64/boot/dts/nvidia/tegra234.dtsi
+@@ -17,15 +17,15 @@ / {
+
+ bus@0 {
+ compatible = "simple-bus";
+- #address-cells = <1>;
+- #size-cells = <1>;
+
+- ranges = <0x0 0x0 0x0 0x40000000>;
++ #address-cells = <2>;
++ #size-cells = <2>;
++ ranges = <0x0 0x0 0x0 0x0 0x0 0x40000000>;
+
+ gpcdma: dma-controller@2600000 {
+ compatible = "nvidia,tegra234-gpcdma",
+ "nvidia,tegra186-gpcdma";
+- reg = <0x2600000 0x210000>;
++ reg = <0x0 0x2600000 0x0 0x210000>;
+ resets = <&bpmp TEGRA234_RESET_GPCDMA>;
+ reset-names = "gpcdma";
+ interrupts = <GIC_SPI 75 IRQ_TYPE_LEVEL_HIGH>,
+@@ -73,27 +73,29 @@ aconnect@2900000 {
+ <&bpmp TEGRA234_CLK_APB2APE>;
+ clock-names = "ape", "apb2ape";
+ power-domains = <&bpmp TEGRA234_POWER_DOMAIN_AUD>;
+- #address-cells = <1>;
+- #size-cells = <1>;
+- ranges = <0x02900000 0x02900000 0x200000>;
+ status = "disabled";
+
++ #address-cells = <2>;
++ #size-cells = <2>;
++ ranges = <0x0 0x02900000 0x0 0x02900000 0x0 0x200000>;
++
+ tegra_ahub: ahub@2900800 {
+ compatible = "nvidia,tegra234-ahub";
+- reg = <0x02900800 0x800>;
++ reg = <0x0 0x02900800 0x0 0x800>;
+ clocks = <&bpmp TEGRA234_CLK_AHUB>;
+ clock-names = "ahub";
+ assigned-clocks = <&bpmp TEGRA234_CLK_AHUB>;
+ assigned-clock-parents = <&bpmp TEGRA234_CLK_PLLA_OUT0>;
+- #address-cells = <1>;
+- #size-cells = <1>;
+- ranges = <0x02900800 0x02900800 0x11800>;
+ status = "disabled";
+
++ #address-cells = <2>;
++ #size-cells = <2>;
++ ranges = <0x0 0x02900800 0x0 0x02900800 0x0 0x11800>;
++
+ tegra_i2s1: i2s@2901000 {
+ compatible = "nvidia,tegra234-i2s",
+ "nvidia,tegra210-i2s";
+- reg = <0x2901000 0x100>;
++ reg = <0x0 0x2901000 0x0 0x100>;
+ clocks = <&bpmp TEGRA234_CLK_I2S1>,
+ <&bpmp TEGRA234_CLK_I2S1_SYNC_INPUT>;
+ clock-names = "i2s", "sync_input";
+@@ -107,7 +109,7 @@ tegra_i2s1: i2s@2901000 {
+ tegra_i2s2: i2s@2901100 {
+ compatible = "nvidia,tegra234-i2s",
+ "nvidia,tegra210-i2s";
+- reg = <0x2901100 0x100>;
++ reg = <0x0 0x2901100 0x0 0x100>;
+ clocks = <&bpmp TEGRA234_CLK_I2S2>,
+ <&bpmp TEGRA234_CLK_I2S2_SYNC_INPUT>;
+ clock-names = "i2s", "sync_input";
+@@ -121,7 +123,7 @@ tegra_i2s2: i2s@2901100 {
+ tegra_i2s3: i2s@2901200 {
+ compatible = "nvidia,tegra234-i2s",
+ "nvidia,tegra210-i2s";
+- reg = <0x2901200 0x100>;
++ reg = <0x0 0x2901200 0x0 0x100>;
+ clocks = <&bpmp TEGRA234_CLK_I2S3>,
+ <&bpmp TEGRA234_CLK_I2S3_SYNC_INPUT>;
+ clock-names = "i2s", "sync_input";
+@@ -135,7 +137,7 @@ tegra_i2s3: i2s@2901200 {
+ tegra_i2s4: i2s@2901300 {
+ compatible = "nvidia,tegra234-i2s",
+ "nvidia,tegra210-i2s";
+- reg = <0x2901300 0x100>;
++ reg = <0x0 0x2901300 0x0 0x100>;
+ clocks = <&bpmp TEGRA234_CLK_I2S4>,
+ <&bpmp TEGRA234_CLK_I2S4_SYNC_INPUT>;
+ clock-names = "i2s", "sync_input";
+@@ -149,7 +151,7 @@ tegra_i2s4: i2s@2901300 {
+ tegra_i2s5: i2s@2901400 {
+ compatible = "nvidia,tegra234-i2s",
+ "nvidia,tegra210-i2s";
+- reg = <0x2901400 0x100>;
++ reg = <0x0 0x2901400 0x0 0x100>;
+ clocks = <&bpmp TEGRA234_CLK_I2S5>,
+ <&bpmp TEGRA234_CLK_I2S5_SYNC_INPUT>;
+ clock-names = "i2s", "sync_input";
+@@ -163,7 +165,7 @@ tegra_i2s5: i2s@2901400 {
+ tegra_i2s6: i2s@2901500 {
+ compatible = "nvidia,tegra234-i2s",
+ "nvidia,tegra210-i2s";
+- reg = <0x2901500 0x100>;
++ reg = <0x0 0x2901500 0x0 0x100>;
+ clocks = <&bpmp TEGRA234_CLK_I2S6>,
+ <&bpmp TEGRA234_CLK_I2S6_SYNC_INPUT>;
+ clock-names = "i2s", "sync_input";
+@@ -177,7 +179,7 @@ tegra_i2s6: i2s@2901500 {
+ tegra_sfc1: sfc@2902000 {
+ compatible = "nvidia,tegra234-sfc",
+ "nvidia,tegra210-sfc";
+- reg = <0x2902000 0x200>;
++ reg = <0x0 0x2902000 0x0 0x200>;
+ sound-name-prefix = "SFC1";
+ status = "disabled";
+ };
+@@ -185,7 +187,7 @@ tegra_sfc1: sfc@2902000 {
+ tegra_sfc2: sfc@2902200 {
+ compatible = "nvidia,tegra234-sfc",
+ "nvidia,tegra210-sfc";
+- reg = <0x2902200 0x200>;
++ reg = <0x0 0x2902200 0x0 0x200>;
+ sound-name-prefix = "SFC2";
+ status = "disabled";
+ };
+@@ -193,7 +195,7 @@ tegra_sfc2: sfc@2902200 {
+ tegra_sfc3: sfc@2902400 {
+ compatible = "nvidia,tegra234-sfc",
+ "nvidia,tegra210-sfc";
+- reg = <0x2902400 0x200>;
++ reg = <0x0 0x2902400 0x0 0x200>;
+ sound-name-prefix = "SFC3";
+ status = "disabled";
+ };
+@@ -201,7 +203,7 @@ tegra_sfc3: sfc@2902400 {
+ tegra_sfc4: sfc@2902600 {
+ compatible = "nvidia,tegra234-sfc",
+ "nvidia,tegra210-sfc";
+- reg = <0x2902600 0x200>;
++ reg = <0x0 0x2902600 0x0 0x200>;
+ sound-name-prefix = "SFC4";
+ status = "disabled";
+ };
+@@ -209,7 +211,7 @@ tegra_sfc4: sfc@2902600 {
+ tegra_amx1: amx@2903000 {
+ compatible = "nvidia,tegra234-amx",
+ "nvidia,tegra194-amx";
+- reg = <0x2903000 0x100>;
++ reg = <0x0 0x2903000 0x0 0x100>;
+ sound-name-prefix = "AMX1";
+ status = "disabled";
+ };
+@@ -217,7 +219,7 @@ tegra_amx1: amx@2903000 {
+ tegra_amx2: amx@2903100 {
+ compatible = "nvidia,tegra234-amx",
+ "nvidia,tegra194-amx";
+- reg = <0x2903100 0x100>;
++ reg = <0x0 0x2903100 0x0 0x100>;
+ sound-name-prefix = "AMX2";
+ status = "disabled";
+ };
+@@ -225,7 +227,7 @@ tegra_amx2: amx@2903100 {
+ tegra_amx3: amx@2903200 {
+ compatible = "nvidia,tegra234-amx",
+ "nvidia,tegra194-amx";
+- reg = <0x2903200 0x100>;
++ reg = <0x0 0x2903200 0x0 0x100>;
+ sound-name-prefix = "AMX3";
+ status = "disabled";
+ };
+@@ -233,7 +235,7 @@ tegra_amx3: amx@2903200 {
+ tegra_amx4: amx@2903300 {
+ compatible = "nvidia,tegra234-amx",
+ "nvidia,tegra194-amx";
+- reg = <0x2903300 0x100>;
++ reg = <0x0 0x2903300 0x0 0x100>;
+ sound-name-prefix = "AMX4";
+ status = "disabled";
+ };
+@@ -241,7 +243,7 @@ tegra_amx4: amx@2903300 {
+ tegra_adx1: adx@2903800 {
+ compatible = "nvidia,tegra234-adx",
+ "nvidia,tegra210-adx";
+- reg = <0x2903800 0x100>;
++ reg = <0x0 0x2903800 0x0 0x100>;
+ sound-name-prefix = "ADX1";
+ status = "disabled";
+ };
+@@ -249,7 +251,7 @@ tegra_adx1: adx@2903800 {
+ tegra_adx2: adx@2903900 {
+ compatible = "nvidia,tegra234-adx",
+ "nvidia,tegra210-adx";
+- reg = <0x2903900 0x100>;
++ reg = <0x0 0x2903900 0x0 0x100>;
+ sound-name-prefix = "ADX2";
+ status = "disabled";
+ };
+@@ -257,7 +259,7 @@ tegra_adx2: adx@2903900 {
+ tegra_adx3: adx@2903a00 {
+ compatible = "nvidia,tegra234-adx",
+ "nvidia,tegra210-adx";
+- reg = <0x2903a00 0x100>;
++ reg = <0x0 0x2903a00 0x0 0x100>;
+ sound-name-prefix = "ADX3";
+ status = "disabled";
+ };
+@@ -265,7 +267,7 @@ tegra_adx3: adx@2903a00 {
+ tegra_adx4: adx@2903b00 {
+ compatible = "nvidia,tegra234-adx",
+ "nvidia,tegra210-adx";
+- reg = <0x2903b00 0x100>;
++ reg = <0x0 0x2903b00 0x0 0x100>;
+ sound-name-prefix = "ADX4";
+ status = "disabled";
+ };
+@@ -274,7 +276,7 @@ tegra_adx4: adx@2903b00 {
+ tegra_dmic1: dmic@2904000 {
+ compatible = "nvidia,tegra234-dmic",
+ "nvidia,tegra210-dmic";
+- reg = <0x2904000 0x100>;
++ reg = <0x0 0x2904000 0x0 0x100>;
+ clocks = <&bpmp TEGRA234_CLK_DMIC1>;
+ clock-names = "dmic";
+ assigned-clocks = <&bpmp TEGRA234_CLK_DMIC1>;
+@@ -287,7 +289,7 @@ tegra_dmic1: dmic@2904000 {
+ tegra_dmic2: dmic@2904100 {
+ compatible = "nvidia,tegra234-dmic",
+ "nvidia,tegra210-dmic";
+- reg = <0x2904100 0x100>;
++ reg = <0x0 0x2904100 0x0 0x100>;
+ clocks = <&bpmp TEGRA234_CLK_DMIC2>;
+ clock-names = "dmic";
+ assigned-clocks = <&bpmp TEGRA234_CLK_DMIC2>;
+@@ -300,7 +302,7 @@ tegra_dmic2: dmic@2904100 {
+ tegra_dmic3: dmic@2904200 {
+ compatible = "nvidia,tegra234-dmic",
+ "nvidia,tegra210-dmic";
+- reg = <0x2904200 0x100>;
++ reg = <0x0 0x2904200 0x0 0x100>;
+ clocks = <&bpmp TEGRA234_CLK_DMIC3>;
+ clock-names = "dmic";
+ assigned-clocks = <&bpmp TEGRA234_CLK_DMIC3>;
+@@ -313,7 +315,7 @@ tegra_dmic3: dmic@2904200 {
+ tegra_dmic4: dmic@2904300 {
+ compatible = "nvidia,tegra234-dmic",
+ "nvidia,tegra210-dmic";
+- reg = <0x2904300 0x100>;
++ reg = <0x0 0x2904300 0x0 0x100>;
+ clocks = <&bpmp TEGRA234_CLK_DMIC4>;
+ clock-names = "dmic";
+ assigned-clocks = <&bpmp TEGRA234_CLK_DMIC4>;
+@@ -326,7 +328,7 @@ tegra_dmic4: dmic@2904300 {
+ tegra_dspk1: dspk@2905000 {
+ compatible = "nvidia,tegra234-dspk",
+ "nvidia,tegra186-dspk";
+- reg = <0x2905000 0x100>;
++ reg = <0x0 0x2905000 0x0 0x100>;
+ clocks = <&bpmp TEGRA234_CLK_DSPK1>;
+ clock-names = "dspk";
+ assigned-clocks = <&bpmp TEGRA234_CLK_DSPK1>;
+@@ -339,7 +341,7 @@ tegra_dspk1: dspk@2905000 {
+ tegra_dspk2: dspk@2905100 {
+ compatible = "nvidia,tegra234-dspk",
+ "nvidia,tegra186-dspk";
+- reg = <0x2905100 0x100>;
++ reg = <0x0 0x2905100 0x0 0x100>;
+ clocks = <&bpmp TEGRA234_CLK_DSPK2>;
+ clock-names = "dspk";
+ assigned-clocks = <&bpmp TEGRA234_CLK_DSPK2>;
+@@ -352,30 +354,31 @@ tegra_dspk2: dspk@2905100 {
+ tegra_ope1: processing-engine@2908000 {
+ compatible = "nvidia,tegra234-ope",
+ "nvidia,tegra210-ope";
+- reg = <0x2908000 0x100>;
+- #address-cells = <1>;
+- #size-cells = <1>;
+- ranges;
++ reg = <0x0 0x2908000 0x0 0x100>;
+ sound-name-prefix = "OPE1";
+ status = "disabled";
+
++ #address-cells = <2>;
++ #size-cells = <2>;
++ ranges;
++
+ equalizer@2908100 {
+ compatible = "nvidia,tegra234-peq",
+ "nvidia,tegra210-peq";
+- reg = <0x2908100 0x100>;
++ reg = <0x0 0x2908100 0x0 0x100>;
+ };
+
+ dynamic-range-compressor@2908200 {
+ compatible = "nvidia,tegra234-mbdrc",
+ "nvidia,tegra210-mbdrc";
+- reg = <0x2908200 0x200>;
++ reg = <0x0 0x2908200 0x0 0x200>;
+ };
+ };
+
+ tegra_mvc1: mvc@290a000 {
+ compatible = "nvidia,tegra234-mvc",
+ "nvidia,tegra210-mvc";
+- reg = <0x290a000 0x200>;
++ reg = <0x0 0x290a000 0x0 0x200>;
+ sound-name-prefix = "MVC1";
+ status = "disabled";
+ };
+@@ -383,7 +386,7 @@ tegra_mvc1: mvc@290a000 {
+ tegra_mvc2: mvc@290a200 {
+ compatible = "nvidia,tegra234-mvc",
+ "nvidia,tegra210-mvc";
+- reg = <0x290a200 0x200>;
++ reg = <0x0 0x290a200 0x0 0x200>;
+ sound-name-prefix = "MVC2";
+ status = "disabled";
+ };
+@@ -391,7 +394,7 @@ tegra_mvc2: mvc@290a200 {
+ tegra_amixer: amixer@290bb00 {
+ compatible = "nvidia,tegra234-amixer",
+ "nvidia,tegra210-amixer";
+- reg = <0x290bb00 0x800>;
++ reg = <0x0 0x290bb00 0x0 0x800>;
+ sound-name-prefix = "MIXER1";
+ status = "disabled";
+ };
+@@ -399,7 +402,7 @@ tegra_amixer: amixer@290bb00 {
+ tegra_admaif: admaif@290f000 {
+ compatible = "nvidia,tegra234-admaif",
+ "nvidia,tegra186-admaif";
+- reg = <0x0290f000 0x1000>;
++ reg = <0x0 0x0290f000 0x0 0x1000>;
+ dmas = <&adma 1>, <&adma 1>,
+ <&adma 2>, <&adma 2>,
+ <&adma 3>, <&adma 3>,
+@@ -450,7 +453,7 @@ tegra_admaif: admaif@290f000 {
+ tegra_asrc: asrc@2910000 {
+ compatible = "nvidia,tegra234-asrc",
+ "nvidia,tegra186-asrc";
+- reg = <0x2910000 0x2000>;
++ reg = <0x0 0x2910000 0x0 0x2000>;
+ sound-name-prefix = "ASRC1";
+ status = "disabled";
+ };
+@@ -459,7 +462,7 @@ tegra_asrc: asrc@2910000 {
+ adma: dma-controller@2930000 {
+ compatible = "nvidia,tegra234-adma",
+ "nvidia,tegra186-adma";
+- reg = <0x02930000 0x20000>;
++ reg = <0x0 0x02930000 0x0 0x20000>;
+ interrupt-parent = <&agic>;
+ interrupts = <GIC_SPI 0 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 1 IRQ_TYPE_LEVEL_HIGH>,
+@@ -504,8 +507,8 @@ agic: interrupt-controller@2a40000 {
+ "nvidia,tegra210-agic";
+ #interrupt-cells = <3>;
+ interrupt-controller;
+- reg = <0x02a41000 0x1000>,
+- <0x02a42000 0x2000>;
++ reg = <0x0 0x02a41000 0x0 0x1000>,
++ <0x0 0x02a42000 0x0 0x2000>;
+ interrupts = <GIC_SPI 145
+ (GIC_CPU_MASK_SIMPLE(4) |
+ IRQ_TYPE_LEVEL_HIGH)>;
+@@ -517,14 +520,14 @@ agic: interrupt-controller@2a40000 {
+
+ misc@100000 {
+ compatible = "nvidia,tegra234-misc";
+- reg = <0x00100000 0xf000>,
+- <0x0010f000 0x1000>;
++ reg = <0x0 0x00100000 0x0 0xf000>,
++ <0x0 0x0010f000 0x0 0x1000>;
+ status = "okay";
+ };
+
+ timer@2080000 {
+ compatible = "nvidia,tegra234-timer";
+- reg = <0x02080000 0x00121000>;
++ reg = <0x0 0x02080000 0x0 0x00121000>;
+ interrupts = <GIC_SPI 0 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 1 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 2 IRQ_TYPE_LEVEL_HIGH>,
+@@ -546,9 +549,9 @@ timer@2080000 {
+
+ host1x@13e00000 {
+ compatible = "nvidia,tegra234-host1x";
+- reg = <0x13e00000 0x10000>,
+- <0x13e10000 0x10000>,
+- <0x13e40000 0x10000>;
++ reg = <0x0 0x13e00000 0x0 0x10000>,
++ <0x0 0x13e10000 0x0 0x10000>,
++ <0x0 0x13e40000 0x0 0x10000>;
+ reg-names = "common", "hypervisor", "vm";
+ interrupts = <GIC_SPI 448 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 449 IRQ_TYPE_LEVEL_HIGH>,
+@@ -564,10 +567,10 @@ host1x@13e00000 {
+ clocks = <&bpmp TEGRA234_CLK_HOST1X>;
+ clock-names = "host1x";
+
+- #address-cells = <1>;
+- #size-cells = <1>;
++ #address-cells = <2>;
++ #size-cells = <2>;
++ ranges = <0x0 0x14800000 0x0 0x14800000 0x0 0x02000000>;
+
+- ranges = <0x14800000 0x14800000 0x02000000>;
+ interconnects = <&mc TEGRA234_MEMORY_CLIENT_HOST1XDMAR &emc>;
+ interconnect-names = "dma-mem";
+ iommus = <&smmu_niso1 TEGRA234_SID_HOST1X>;
+@@ -592,7 +595,7 @@ host1x@13e00000 {
+
+ vic@15340000 {
+ compatible = "nvidia,tegra234-vic";
+- reg = <0x15340000 0x00040000>;
++ reg = <0x0 0x15340000 0x0 0x00040000>;
+ interrupts = <GIC_SPI 206 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&bpmp TEGRA234_CLK_VIC>;
+ clock-names = "vic";
+@@ -609,7 +612,7 @@ vic@15340000 {
+
+ nvdec@15480000 {
+ compatible = "nvidia,tegra234-nvdec";
+- reg = <0x15480000 0x00040000>;
++ reg = <0x0 0x15480000 0x0 0x00040000>;
+ clocks = <&bpmp TEGRA234_CLK_NVDEC>,
+ <&bpmp TEGRA234_CLK_FUSE>,
+ <&bpmp TEGRA234_CLK_TSEC_PKA>;
+@@ -647,8 +650,8 @@ nvdec@15480000 {
+ gpio: gpio@2200000 {
+ compatible = "nvidia,tegra234-gpio";
+ reg-names = "security", "gpio";
+- reg = <0x02200000 0x10000>,
+- <0x02210000 0x10000>;
++ reg = <0x0 0x02200000 0x0 0x10000>,
++ <0x0 0x02210000 0x0 0x10000>;
+ interrupts = <GIC_SPI 288 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 289 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 290 IRQ_TYPE_LEVEL_HIGH>,
+@@ -705,24 +708,24 @@ gpio: gpio@2200000 {
+
+ mc: memory-controller@2c00000 {
+ compatible = "nvidia,tegra234-mc";
+- reg = <0x02c00000 0x10000>, /* MC-SID */
+- <0x02c10000 0x10000>, /* MC Broadcast*/
+- <0x02c20000 0x10000>, /* MC0 */
+- <0x02c30000 0x10000>, /* MC1 */
+- <0x02c40000 0x10000>, /* MC2 */
+- <0x02c50000 0x10000>, /* MC3 */
+- <0x02b80000 0x10000>, /* MC4 */
+- <0x02b90000 0x10000>, /* MC5 */
+- <0x02ba0000 0x10000>, /* MC6 */
+- <0x02bb0000 0x10000>, /* MC7 */
+- <0x01700000 0x10000>, /* MC8 */
+- <0x01710000 0x10000>, /* MC9 */
+- <0x01720000 0x10000>, /* MC10 */
+- <0x01730000 0x10000>, /* MC11 */
+- <0x01740000 0x10000>, /* MC12 */
+- <0x01750000 0x10000>, /* MC13 */
+- <0x01760000 0x10000>, /* MC14 */
+- <0x01770000 0x10000>; /* MC15 */
++ reg = <0x0 0x02c00000 0x0 0x10000>, /* MC-SID */
++ <0x0 0x02c10000 0x0 0x10000>, /* MC Broadcast*/
++ <0x0 0x02c20000 0x0 0x10000>, /* MC0 */
++ <0x0 0x02c30000 0x0 0x10000>, /* MC1 */
++ <0x0 0x02c40000 0x0 0x10000>, /* MC2 */
++ <0x0 0x02c50000 0x0 0x10000>, /* MC3 */
++ <0x0 0x02b80000 0x0 0x10000>, /* MC4 */
++ <0x0 0x02b90000 0x0 0x10000>, /* MC5 */
++ <0x0 0x02ba0000 0x0 0x10000>, /* MC6 */
++ <0x0 0x02bb0000 0x0 0x10000>, /* MC7 */
++ <0x0 0x01700000 0x0 0x10000>, /* MC8 */
++ <0x0 0x01710000 0x0 0x10000>, /* MC9 */
++ <0x0 0x01720000 0x0 0x10000>, /* MC10 */
++ <0x0 0x01730000 0x0 0x10000>, /* MC11 */
++ <0x0 0x01740000 0x0 0x10000>, /* MC12 */
++ <0x0 0x01750000 0x0 0x10000>, /* MC13 */
++ <0x0 0x01760000 0x0 0x10000>, /* MC14 */
++ <0x0 0x01770000 0x0 0x10000>; /* MC15 */
+ reg-names = "sid", "broadcast", "ch0", "ch1", "ch2", "ch3",
+ "ch4", "ch5", "ch6", "ch7", "ch8", "ch9", "ch10",
+ "ch11", "ch12", "ch13", "ch14", "ch15";
+@@ -732,10 +735,9 @@ mc: memory-controller@2c00000 {
+
+ #address-cells = <2>;
+ #size-cells = <2>;
+-
+- ranges = <0x01700000 0x0 0x01700000 0x0 0x100000>,
+- <0x02b80000 0x0 0x02b80000 0x0 0x040000>,
+- <0x02c00000 0x0 0x02c00000 0x0 0x100000>;
++ ranges = <0x0 0x01700000 0x0 0x01700000 0x0 0x100000>,
++ <0x0 0x02b80000 0x0 0x02b80000 0x0 0x040000>,
++ <0x0 0x02c00000 0x0 0x02c00000 0x0 0x100000>;
+
+ /*
+ * Bit 39 of addresses passing through the memory
+@@ -752,7 +754,7 @@ mc: memory-controller@2c00000 {
+ *
+ * Limit the DMA range for memory clients to [38:0].
+ */
+- dma-ranges = <0x0 0x0 0x0 0x80 0x0>;
++ dma-ranges = <0x0 0x0 0x0 0x0 0x80 0x0>;
+
+ emc: external-memory-controller@2c60000 {
+ compatible = "nvidia,tegra234-emc";
+@@ -771,7 +773,7 @@ emc: external-memory-controller@2c60000 {
+
+ uarta: serial@3100000 {
+ compatible = "nvidia,tegra234-uart", "nvidia,tegra20-uart";
+- reg = <0x03100000 0x10000>;
++ reg = <0x0 0x03100000 0x0 0x10000>;
+ interrupts = <GIC_SPI 112 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&bpmp TEGRA234_CLK_UARTA>;
+ clock-names = "serial";
+@@ -782,7 +784,7 @@ uarta: serial@3100000 {
+
+ gen1_i2c: i2c@3160000 {
+ compatible = "nvidia,tegra194-i2c";
+- reg = <0x3160000 0x100>;
++ reg = <0x0 0x3160000 0x0 0x100>;
+ status = "disabled";
+ interrupts = <GIC_SPI 25 IRQ_TYPE_LEVEL_HIGH>;
+ clock-frequency = <400000>;
+@@ -801,7 +803,7 @@ gen1_i2c: i2c@3160000 {
+
+ cam_i2c: i2c@3180000 {
+ compatible = "nvidia,tegra194-i2c";
+- reg = <0x3180000 0x100>;
++ reg = <0x0 0x3180000 0x0 0x100>;
+ interrupts = <GIC_SPI 27 IRQ_TYPE_LEVEL_HIGH>;
+ status = "disabled";
+ clock-frequency = <400000>;
+@@ -820,7 +822,7 @@ cam_i2c: i2c@3180000 {
+
+ dp_aux_ch1_i2c: i2c@3190000 {
+ compatible = "nvidia,tegra194-i2c";
+- reg = <0x3190000 0x100>;
++ reg = <0x0 0x3190000 0x0 0x100>;
+ interrupts = <GIC_SPI 28 IRQ_TYPE_LEVEL_HIGH>;
+ status = "disabled";
+ clock-frequency = <100000>;
+@@ -839,7 +841,7 @@ dp_aux_ch1_i2c: i2c@3190000 {
+
+ dp_aux_ch0_i2c: i2c@31b0000 {
+ compatible = "nvidia,tegra194-i2c";
+- reg = <0x31b0000 0x100>;
++ reg = <0x0 0x31b0000 0x0 0x100>;
+ interrupts = <GIC_SPI 30 IRQ_TYPE_LEVEL_HIGH>;
+ status = "disabled";
+ clock-frequency = <100000>;
+@@ -858,7 +860,7 @@ dp_aux_ch0_i2c: i2c@31b0000 {
+
+ dp_aux_ch2_i2c: i2c@31c0000 {
+ compatible = "nvidia,tegra194-i2c";
+- reg = <0x31c0000 0x100>;
++ reg = <0x0 0x31c0000 0x0 0x100>;
+ interrupts = <GIC_SPI 31 IRQ_TYPE_LEVEL_HIGH>;
+ status = "disabled";
+ clock-frequency = <100000>;
+@@ -877,14 +879,14 @@ dp_aux_ch2_i2c: i2c@31c0000 {
+
+ uarti: serial@31d0000 {
+ compatible = "arm,sbsa-uart";
+- reg = <0x31d0000 0x10000>;
++ reg = <0x0 0x31d0000 0x0 0x10000>;
+ interrupts = <GIC_SPI 285 IRQ_TYPE_LEVEL_HIGH>;
+ status = "disabled";
+ };
+
+ dp_aux_ch3_i2c: i2c@31e0000 {
+ compatible = "nvidia,tegra194-i2c";
+- reg = <0x31e0000 0x100>;
++ reg = <0x0 0x31e0000 0x0 0x100>;
+ interrupts = <GIC_SPI 33 IRQ_TYPE_LEVEL_HIGH>;
+ status = "disabled";
+ clock-frequency = <100000>;
+@@ -903,7 +905,7 @@ dp_aux_ch3_i2c: i2c@31e0000 {
+
+ spi@3270000 {
+ compatible = "nvidia,tegra234-qspi";
+- reg = <0x3270000 0x1000>;
++ reg = <0x0 0x3270000 0x0 0x1000>;
+ interrupts = <GIC_SPI 35 IRQ_TYPE_LEVEL_HIGH>;
+ #address-cells = <1>;
+ #size-cells = <0>;
+@@ -916,7 +918,7 @@ spi@3270000 {
+
+ pwm1: pwm@3280000 {
+ compatible = "nvidia,tegra234-pwm", "nvidia,tegra194-pwm";
+- reg = <0x3280000 0x10000>;
++ reg = <0x0 0x3280000 0x0 0x10000>;
+ clocks = <&bpmp TEGRA234_CLK_PWM1>;
+ resets = <&bpmp TEGRA234_RESET_PWM1>;
+ reset-names = "pwm";
+@@ -926,7 +928,7 @@ pwm1: pwm@3280000 {
+
+ pwm2: pwm@3290000 {
+ compatible = "nvidia,tegra234-pwm", "nvidia,tegra194-pwm";
+- reg = <0x3290000 0x10000>;
++ reg = <0x0 0x3290000 0x0 0x10000>;
+ clocks = <&bpmp TEGRA234_CLK_PWM2>;
+ resets = <&bpmp TEGRA234_RESET_PWM2>;
+ reset-names = "pwm";
+@@ -936,7 +938,7 @@ pwm2: pwm@3290000 {
+
+ pwm3: pwm@32a0000 {
+ compatible = "nvidia,tegra234-pwm", "nvidia,tegra194-pwm";
+- reg = <0x32a0000 0x10000>;
++ reg = <0x0 0x32a0000 0x0 0x10000>;
+ clocks = <&bpmp TEGRA234_CLK_PWM3>;
+ resets = <&bpmp TEGRA234_RESET_PWM3>;
+ reset-names = "pwm";
+@@ -946,7 +948,7 @@ pwm3: pwm@32a0000 {
+
+ pwm5: pwm@32c0000 {
+ compatible = "nvidia,tegra234-pwm", "nvidia,tegra194-pwm";
+- reg = <0x32c0000 0x10000>;
++ reg = <0x0 0x32c0000 0x0 0x10000>;
+ clocks = <&bpmp TEGRA234_CLK_PWM5>;
+ resets = <&bpmp TEGRA234_RESET_PWM5>;
+ reset-names = "pwm";
+@@ -956,7 +958,7 @@ pwm5: pwm@32c0000 {
+
+ pwm6: pwm@32d0000 {
+ compatible = "nvidia,tegra234-pwm", "nvidia,tegra194-pwm";
+- reg = <0x32d0000 0x10000>;
++ reg = <0x0 0x32d0000 0x0 0x10000>;
+ clocks = <&bpmp TEGRA234_CLK_PWM6>;
+ resets = <&bpmp TEGRA234_RESET_PWM6>;
+ reset-names = "pwm";
+@@ -966,7 +968,7 @@ pwm6: pwm@32d0000 {
+
+ pwm7: pwm@32e0000 {
+ compatible = "nvidia,tegra234-pwm", "nvidia,tegra194-pwm";
+- reg = <0x32e0000 0x10000>;
++ reg = <0x0 0x32e0000 0x0 0x10000>;
+ clocks = <&bpmp TEGRA234_CLK_PWM7>;
+ resets = <&bpmp TEGRA234_RESET_PWM7>;
+ reset-names = "pwm";
+@@ -976,7 +978,7 @@ pwm7: pwm@32e0000 {
+
+ pwm8: pwm@32f0000 {
+ compatible = "nvidia,tegra234-pwm", "nvidia,tegra194-pwm";
+- reg = <0x32f0000 0x10000>;
++ reg = <0x0 0x32f0000 0x0 0x10000>;
+ clocks = <&bpmp TEGRA234_CLK_PWM8>;
+ resets = <&bpmp TEGRA234_RESET_PWM8>;
+ reset-names = "pwm";
+@@ -986,7 +988,7 @@ pwm8: pwm@32f0000 {
+
+ spi@3300000 {
+ compatible = "nvidia,tegra234-qspi";
+- reg = <0x3300000 0x1000>;
++ reg = <0x0 0x3300000 0x0 0x1000>;
+ interrupts = <GIC_SPI 39 IRQ_TYPE_LEVEL_HIGH>;
+ #address-cells = <1>;
+ #size-cells = <0>;
+@@ -999,7 +1001,7 @@ spi@3300000 {
+
+ mmc@3400000 {
+ compatible = "nvidia,tegra234-sdhci", "nvidia,tegra186-sdhci";
+- reg = <0x03400000 0x20000>;
++ reg = <0x0 0x03400000 0x0 0x20000>;
+ interrupts = <GIC_SPI 62 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&bpmp TEGRA234_CLK_SDMMC1>,
+ <&bpmp TEGRA234_CLK_SDMMC_LEGACY_TM>;
+@@ -1034,7 +1036,7 @@ mmc@3400000 {
+
+ mmc@3460000 {
+ compatible = "nvidia,tegra234-sdhci", "nvidia,tegra186-sdhci";
+- reg = <0x03460000 0x20000>;
++ reg = <0x0 0x03460000 0x0 0x20000>;
+ interrupts = <GIC_SPI 65 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&bpmp TEGRA234_CLK_SDMMC4>,
+ <&bpmp TEGRA234_CLK_SDMMC_LEGACY_TM>;
+@@ -1063,7 +1065,7 @@ mmc@3460000 {
+
+ hda@3510000 {
+ compatible = "nvidia,tegra234-hda";
+- reg = <0x3510000 0x10000>;
++ reg = <0x0 0x3510000 0x0 0x10000>;
+ interrupts = <GIC_SPI 60 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&bpmp TEGRA234_CLK_AZA_BIT>,
+ <&bpmp TEGRA234_CLK_AZA_2XBIT>;
+@@ -1081,14 +1083,14 @@ hda@3510000 {
+
+ fuse@3810000 {
+ compatible = "nvidia,tegra234-efuse";
+- reg = <0x03810000 0x10000>;
++ reg = <0x0 0x03810000 0x0 0x10000>;
+ clocks = <&bpmp TEGRA234_CLK_FUSE>;
+ clock-names = "fuse";
+ };
+
+ hsp_top0: hsp@3c00000 {
+ compatible = "nvidia,tegra234-hsp", "nvidia,tegra194-hsp";
+- reg = <0x03c00000 0xa0000>;
++ reg = <0x0 0x03c00000 0x0 0xa0000>;
+ interrupts = <GIC_SPI 176 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 120 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 121 IRQ_TYPE_LEVEL_HIGH>,
+@@ -1106,7 +1108,7 @@ hsp_top0: hsp@3c00000 {
+
+ p2u_hsio_0: phy@3e00000 {
+ compatible = "nvidia,tegra234-p2u";
+- reg = <0x03e00000 0x10000>;
++ reg = <0x0 0x03e00000 0x0 0x10000>;
+ reg-names = "ctl";
+
+ #phy-cells = <0>;
+@@ -1114,7 +1116,7 @@ p2u_hsio_0: phy@3e00000 {
+
+ p2u_hsio_1: phy@3e10000 {
+ compatible = "nvidia,tegra234-p2u";
+- reg = <0x03e10000 0x10000>;
++ reg = <0x0 0x03e10000 0x0 0x10000>;
+ reg-names = "ctl";
+
+ #phy-cells = <0>;
+@@ -1122,7 +1124,7 @@ p2u_hsio_1: phy@3e10000 {
+
+ p2u_hsio_2: phy@3e20000 {
+ compatible = "nvidia,tegra234-p2u";
+- reg = <0x03e20000 0x10000>;
++ reg = <0x0 0x03e20000 0x0 0x10000>;
+ reg-names = "ctl";
+
+ #phy-cells = <0>;
+@@ -1130,7 +1132,7 @@ p2u_hsio_2: phy@3e20000 {
+
+ p2u_hsio_3: phy@3e30000 {
+ compatible = "nvidia,tegra234-p2u";
+- reg = <0x03e30000 0x10000>;
++ reg = <0x0 0x03e30000 0x0 0x10000>;
+ reg-names = "ctl";
+
+ #phy-cells = <0>;
+@@ -1138,7 +1140,7 @@ p2u_hsio_3: phy@3e30000 {
+
+ p2u_hsio_4: phy@3e40000 {
+ compatible = "nvidia,tegra234-p2u";
+- reg = <0x03e40000 0x10000>;
++ reg = <0x0 0x03e40000 0x0 0x10000>;
+ reg-names = "ctl";
+
+ #phy-cells = <0>;
+@@ -1146,7 +1148,7 @@ p2u_hsio_4: phy@3e40000 {
+
+ p2u_hsio_5: phy@3e50000 {
+ compatible = "nvidia,tegra234-p2u";
+- reg = <0x03e50000 0x10000>;
++ reg = <0x0 0x03e50000 0x0 0x10000>;
+ reg-names = "ctl";
+
+ #phy-cells = <0>;
+@@ -1154,7 +1156,7 @@ p2u_hsio_5: phy@3e50000 {
+
+ p2u_hsio_6: phy@3e60000 {
+ compatible = "nvidia,tegra234-p2u";
+- reg = <0x03e60000 0x10000>;
++ reg = <0x0 0x03e60000 0x0 0x10000>;
+ reg-names = "ctl";
+
+ #phy-cells = <0>;
+@@ -1162,7 +1164,7 @@ p2u_hsio_6: phy@3e60000 {
+
+ p2u_hsio_7: phy@3e70000 {
+ compatible = "nvidia,tegra234-p2u";
+- reg = <0x03e70000 0x10000>;
++ reg = <0x0 0x03e70000 0x0 0x10000>;
+ reg-names = "ctl";
+
+ #phy-cells = <0>;
+@@ -1170,7 +1172,7 @@ p2u_hsio_7: phy@3e70000 {
+
+ p2u_nvhs_0: phy@3e90000 {
+ compatible = "nvidia,tegra234-p2u";
+- reg = <0x03e90000 0x10000>;
++ reg = <0x0 0x03e90000 0x0 0x10000>;
+ reg-names = "ctl";
+
+ #phy-cells = <0>;
+@@ -1178,7 +1180,7 @@ p2u_nvhs_0: phy@3e90000 {
+
+ p2u_nvhs_1: phy@3ea0000 {
+ compatible = "nvidia,tegra234-p2u";
+- reg = <0x03ea0000 0x10000>;
++ reg = <0x0 0x03ea0000 0x0 0x10000>;
+ reg-names = "ctl";
+
+ #phy-cells = <0>;
+@@ -1186,7 +1188,7 @@ p2u_nvhs_1: phy@3ea0000 {
+
+ p2u_nvhs_2: phy@3eb0000 {
+ compatible = "nvidia,tegra234-p2u";
+- reg = <0x03eb0000 0x10000>;
++ reg = <0x0 0x03eb0000 0x0 0x10000>;
+ reg-names = "ctl";
+
+ #phy-cells = <0>;
+@@ -1194,7 +1196,7 @@ p2u_nvhs_2: phy@3eb0000 {
+
+ p2u_nvhs_3: phy@3ec0000 {
+ compatible = "nvidia,tegra234-p2u";
+- reg = <0x03ec0000 0x10000>;
++ reg = <0x0 0x03ec0000 0x0 0x10000>;
+ reg-names = "ctl";
+
+ #phy-cells = <0>;
+@@ -1202,7 +1204,7 @@ p2u_nvhs_3: phy@3ec0000 {
+
+ p2u_nvhs_4: phy@3ed0000 {
+ compatible = "nvidia,tegra234-p2u";
+- reg = <0x03ed0000 0x10000>;
++ reg = <0x0 0x03ed0000 0x0 0x10000>;
+ reg-names = "ctl";
+
+ #phy-cells = <0>;
+@@ -1210,7 +1212,7 @@ p2u_nvhs_4: phy@3ed0000 {
+
+ p2u_nvhs_5: phy@3ee0000 {
+ compatible = "nvidia,tegra234-p2u";
+- reg = <0x03ee0000 0x10000>;
++ reg = <0x0 0x03ee0000 0x0 0x10000>;
+ reg-names = "ctl";
+
+ #phy-cells = <0>;
+@@ -1218,7 +1220,7 @@ p2u_nvhs_5: phy@3ee0000 {
+
+ p2u_nvhs_6: phy@3ef0000 {
+ compatible = "nvidia,tegra234-p2u";
+- reg = <0x03ef0000 0x10000>;
++ reg = <0x0 0x03ef0000 0x0 0x10000>;
+ reg-names = "ctl";
+
+ #phy-cells = <0>;
+@@ -1226,7 +1228,7 @@ p2u_nvhs_6: phy@3ef0000 {
+
+ p2u_nvhs_7: phy@3f00000 {
+ compatible = "nvidia,tegra234-p2u";
+- reg = <0x03f00000 0x10000>;
++ reg = <0x0 0x03f00000 0x0 0x10000>;
+ reg-names = "ctl";
+
+ #phy-cells = <0>;
+@@ -1234,7 +1236,7 @@ p2u_nvhs_7: phy@3f00000 {
+
+ p2u_gbe_0: phy@3f20000 {
+ compatible = "nvidia,tegra234-p2u";
+- reg = <0x03f20000 0x10000>;
++ reg = <0x0 0x03f20000 0x0 0x10000>;
+ reg-names = "ctl";
+
+ #phy-cells = <0>;
+@@ -1242,7 +1244,7 @@ p2u_gbe_0: phy@3f20000 {
+
+ p2u_gbe_1: phy@3f30000 {
+ compatible = "nvidia,tegra234-p2u";
+- reg = <0x03f30000 0x10000>;
++ reg = <0x0 0x03f30000 0x0 0x10000>;
+ reg-names = "ctl";
+
+ #phy-cells = <0>;
+@@ -1250,7 +1252,7 @@ p2u_gbe_1: phy@3f30000 {
+
+ p2u_gbe_2: phy@3f40000 {
+ compatible = "nvidia,tegra234-p2u";
+- reg = <0x03f40000 0x10000>;
++ reg = <0x0 0x03f40000 0x0 0x10000>;
+ reg-names = "ctl";
+
+ #phy-cells = <0>;
+@@ -1258,7 +1260,7 @@ p2u_gbe_2: phy@3f40000 {
+
+ p2u_gbe_3: phy@3f50000 {
+ compatible = "nvidia,tegra234-p2u";
+- reg = <0x03f50000 0x10000>;
++ reg = <0x0 0x03f50000 0x0 0x10000>;
+ reg-names = "ctl";
+
+ #phy-cells = <0>;
+@@ -1266,7 +1268,7 @@ p2u_gbe_3: phy@3f50000 {
+
+ p2u_gbe_4: phy@3f60000 {
+ compatible = "nvidia,tegra234-p2u";
+- reg = <0x03f60000 0x10000>;
++ reg = <0x0 0x03f60000 0x0 0x10000>;
+ reg-names = "ctl";
+
+ #phy-cells = <0>;
+@@ -1274,7 +1276,7 @@ p2u_gbe_4: phy@3f60000 {
+
+ p2u_gbe_5: phy@3f70000 {
+ compatible = "nvidia,tegra234-p2u";
+- reg = <0x03f70000 0x10000>;
++ reg = <0x0 0x03f70000 0x0 0x10000>;
+ reg-names = "ctl";
+
+ #phy-cells = <0>;
+@@ -1282,7 +1284,7 @@ p2u_gbe_5: phy@3f70000 {
+
+ p2u_gbe_6: phy@3f80000 {
+ compatible = "nvidia,tegra234-p2u";
+- reg = <0x03f80000 0x10000>;
++ reg = <0x0 0x03f80000 0x0 0x10000>;
+ reg-names = "ctl";
+
+ #phy-cells = <0>;
+@@ -1290,7 +1292,7 @@ p2u_gbe_6: phy@3f80000 {
+
+ p2u_gbe_7: phy@3f90000 {
+ compatible = "nvidia,tegra234-p2u";
+- reg = <0x03f90000 0x10000>;
++ reg = <0x0 0x03f90000 0x0 0x10000>;
+ reg-names = "ctl";
+
+ #phy-cells = <0>;
+@@ -1298,9 +1300,9 @@ p2u_gbe_7: phy@3f90000 {
+
+ ethernet@6800000 {
+ compatible = "nvidia,tegra234-mgbe";
+- reg = <0x06800000 0x10000>,
+- <0x06810000 0x10000>,
+- <0x068a0000 0x10000>;
++ reg = <0x0 0x06800000 0x0 0x10000>,
++ <0x0 0x06810000 0x0 0x10000>,
++ <0x0 0x068a0000 0x0 0x10000>;
+ reg-names = "hypervisor", "mac", "xpcs";
+ interrupts = <GIC_SPI 384 IRQ_TYPE_LEVEL_HIGH>;
+ interrupt-names = "common";
+@@ -1332,9 +1334,9 @@ ethernet@6800000 {
+
+ ethernet@6900000 {
+ compatible = "nvidia,tegra234-mgbe";
+- reg = <0x06900000 0x10000>,
+- <0x06910000 0x10000>,
+- <0x069a0000 0x10000>;
++ reg = <0x0 0x06900000 0x0 0x10000>,
++ <0x0 0x06910000 0x0 0x10000>,
++ <0x0 0x069a0000 0x0 0x10000>;
+ reg-names = "hypervisor", "mac", "xpcs";
+ interrupts = <GIC_SPI 392 IRQ_TYPE_LEVEL_HIGH>;
+ interrupt-names = "common";
+@@ -1366,9 +1368,9 @@ ethernet@6900000 {
+
+ ethernet@6a00000 {
+ compatible = "nvidia,tegra234-mgbe";
+- reg = <0x06a00000 0x10000>,
+- <0x06a10000 0x10000>,
+- <0x06aa0000 0x10000>;
++ reg = <0x0 0x06a00000 0x0 0x10000>,
++ <0x0 0x06a10000 0x0 0x10000>,
++ <0x0 0x06aa0000 0x0 0x10000>;
+ reg-names = "hypervisor", "mac", "xpcs";
+ interrupts = <GIC_SPI 400 IRQ_TYPE_LEVEL_HIGH>;
+ interrupt-names = "common";
+@@ -1400,9 +1402,9 @@ ethernet@6a00000 {
+
+ ethernet@6b00000 {
+ compatible = "nvidia,tegra234-mgbe";
+- reg = <0x06b00000 0x10000>,
+- <0x06b10000 0x10000>,
+- <0x06ba0000 0x10000>;
++ reg = <0x0 0x06b00000 0x0 0x10000>,
++ <0x0 0x06b10000 0x0 0x10000>,
++ <0x0 0x06ba0000 0x0 0x10000>;
+ reg-names = "hypervisor", "mac", "xpcs";
+ interrupts = <GIC_SPI 408 IRQ_TYPE_LEVEL_HIGH>;
+ interrupt-names = "common";
+@@ -1434,8 +1436,8 @@ ethernet@6b00000 {
+
+ smmu_niso1: iommu@8000000 {
+ compatible = "nvidia,tegra234-smmu", "nvidia,smmu-500";
+- reg = <0x8000000 0x1000000>,
+- <0x7000000 0x1000000>;
++ reg = <0x0 0x8000000 0x0 0x1000000>,
++ <0x0 0x7000000 0x0 0x1000000>;
+ interrupts = <GIC_SPI 238 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 242 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 238 IRQ_TYPE_LEVEL_HIGH>,
+@@ -1576,21 +1578,21 @@ smmu_niso1: iommu@8000000 {
+
+ sce-fabric@b600000 {
+ compatible = "nvidia,tegra234-sce-fabric";
+- reg = <0xb600000 0x40000>;
++ reg = <0x0 0xb600000 0x0 0x40000>;
+ interrupts = <GIC_SPI 173 IRQ_TYPE_LEVEL_HIGH>;
+ status = "okay";
+ };
+
+ rce-fabric@be00000 {
+ compatible = "nvidia,tegra234-rce-fabric";
+- reg = <0xbe00000 0x40000>;
++ reg = <0x0 0xbe00000 0x0 0x40000>;
+ interrupts = <GIC_SPI 175 IRQ_TYPE_LEVEL_HIGH>;
+ status = "okay";
+ };
+
+ hsp_aon: hsp@c150000 {
+ compatible = "nvidia,tegra234-hsp", "nvidia,tegra194-hsp";
+- reg = <0x0c150000 0x90000>;
++ reg = <0x0 0x0c150000 0x0 0x90000>;
+ interrupts = <GIC_SPI 133 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 134 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 135 IRQ_TYPE_LEVEL_HIGH>,
+@@ -1605,7 +1607,7 @@ hsp_aon: hsp@c150000 {
+
+ gen2_i2c: i2c@c240000 {
+ compatible = "nvidia,tegra194-i2c";
+- reg = <0xc240000 0x100>;
++ reg = <0x0 0xc240000 0x0 0x100>;
+ interrupts = <GIC_SPI 26 IRQ_TYPE_LEVEL_HIGH>;
+ status = "disabled";
+ clock-frequency = <100000>;
+@@ -1624,7 +1626,7 @@ gen2_i2c: i2c@c240000 {
+
+ gen8_i2c: i2c@c250000 {
+ compatible = "nvidia,tegra194-i2c";
+- reg = <0xc250000 0x100>;
++ reg = <0x0 0xc250000 0x0 0x100>;
+ interrupts = <GIC_SPI 32 IRQ_TYPE_LEVEL_HIGH>;
+ status = "disabled";
+ clock-frequency = <400000>;
+@@ -1643,7 +1645,7 @@ gen8_i2c: i2c@c250000 {
+
+ rtc@c2a0000 {
+ compatible = "nvidia,tegra234-rtc", "nvidia,tegra20-rtc";
+- reg = <0x0c2a0000 0x10000>;
++ reg = <0x0 0x0c2a0000 0x0 0x10000>;
+ interrupt-parent = <&pmc>;
+ interrupts = <73 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&bpmp TEGRA234_CLK_CLK_32K>;
+@@ -1654,8 +1656,8 @@ rtc@c2a0000 {
+ gpio_aon: gpio@c2f0000 {
+ compatible = "nvidia,tegra234-gpio-aon";
+ reg-names = "security", "gpio";
+- reg = <0x0c2f0000 0x1000>,
+- <0x0c2f1000 0x1000>;
++ reg = <0x0 0x0c2f0000 0x0 0x1000>,
++ <0x0 0x0c2f1000 0x0 0x1000>;
+ interrupts = <GIC_SPI 56 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 57 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 58 IRQ_TYPE_LEVEL_HIGH>,
+@@ -1668,7 +1670,7 @@ gpio_aon: gpio@c2f0000 {
+
+ pwm4: pwm@c340000 {
+ compatible = "nvidia,tegra234-pwm", "nvidia,tegra194-pwm";
+- reg = <0xc340000 0x10000>;
++ reg = <0x0 0xc340000 0x0 0x10000>;
+ clocks = <&bpmp TEGRA234_CLK_PWM4>;
+ resets = <&bpmp TEGRA234_RESET_PWM4>;
+ reset-names = "pwm";
+@@ -1678,11 +1680,11 @@ pwm4: pwm@c340000 {
+
+ pmc: pmc@c360000 {
+ compatible = "nvidia,tegra234-pmc";
+- reg = <0x0c360000 0x10000>,
+- <0x0c370000 0x10000>,
+- <0x0c380000 0x10000>,
+- <0x0c390000 0x10000>,
+- <0x0c3a0000 0x10000>;
++ reg = <0x0 0x0c360000 0x0 0x10000>,
++ <0x0 0x0c370000 0x0 0x10000>,
++ <0x0 0x0c380000 0x0 0x10000>,
++ <0x0 0x0c390000 0x0 0x10000>,
++ <0x0 0x0c3a0000 0x0 0x10000>;
+ reg-names = "pmc", "wake", "aotag", "scratch", "misc";
+
+ #interrupt-cells = <2>;
+@@ -1711,29 +1713,36 @@ sdmmc3_1v8: sdmmc3-1v8 {
+
+ aon-fabric@c600000 {
+ compatible = "nvidia,tegra234-aon-fabric";
+- reg = <0xc600000 0x40000>;
++ reg = <0x0 0xc600000 0x0 0x40000>;
+ interrupts = <GIC_SPI 172 IRQ_TYPE_LEVEL_HIGH>;
+ status = "okay";
+ };
+
+ bpmp-fabric@d600000 {
+ compatible = "nvidia,tegra234-bpmp-fabric";
+- reg = <0xd600000 0x40000>;
++ reg = <0x0 0xd600000 0x0 0x40000>;
+ interrupts = <GIC_SPI 174 IRQ_TYPE_LEVEL_HIGH>;
+ status = "okay";
+ };
+
+ dce-fabric@de00000 {
+ compatible = "nvidia,tegra234-sce-fabric";
+- reg = <0xde00000 0x40000>;
++ reg = <0x0 0xde00000 0x0 0x40000>;
+ interrupts = <GIC_SPI 381 IRQ_TYPE_LEVEL_HIGH>;
+ status = "okay";
+ };
+
++ ccplex@e000000 {
++ compatible = "nvidia,tegra234-ccplex-cluster";
++ reg = <0x0 0x0e000000 0x0 0x5ffff>;
++ nvidia,bpmp = <&bpmp>;
++ status = "okay";
++ };
++
+ gic: interrupt-controller@f400000 {
+ compatible = "arm,gic-v3";
+- reg = <0x0f400000 0x010000>, /* GICD */
+- <0x0f440000 0x200000>; /* GICR */
++ reg = <0x0 0x0f400000 0x0 0x010000>, /* GICD */
++ <0x0 0x0f440000 0x0 0x200000>; /* GICR */
+ interrupt-parent = <&gic>;
+ interrupts = <GIC_PPI 9 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_HIGH)>;
+
+@@ -1744,7 +1753,7 @@ gic: interrupt-controller@f400000 {
+
+ smmu_iso: iommu@10000000 {
+ compatible = "nvidia,tegra234-smmu", "nvidia,smmu-500";
+- reg = <0x10000000 0x1000000>;
++ reg = <0x0 0x10000000 0x0 0x1000000>;
+ interrupts = <GIC_SPI 240 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 240 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 240 IRQ_TYPE_LEVEL_HIGH>,
+@@ -1884,8 +1893,8 @@ smmu_iso: iommu@10000000 {
+
+ smmu_niso0: iommu@12000000 {
+ compatible = "nvidia,tegra234-smmu", "nvidia,smmu-500";
+- reg = <0x12000000 0x1000000>,
+- <0x11000000 0x1000000>;
++ reg = <0x0 0x12000000 0x0 0x1000000>,
++ <0x0 0x11000000 0x0 0x1000000>;
+ interrupts = <GIC_SPI 170 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 232 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 170 IRQ_TYPE_LEVEL_HIGH>,
+@@ -2026,771 +2035,766 @@ smmu_niso0: iommu@12000000 {
+
+ cbb-fabric@13a00000 {
+ compatible = "nvidia,tegra234-cbb-fabric";
+- reg = <0x13a00000 0x400000>;
++ reg = <0x0 0x13a00000 0x0 0x400000>;
+ interrupts = <GIC_SPI 231 IRQ_TYPE_LEVEL_HIGH>;
+ status = "okay";
+ };
+- };
+
+- ccplex@e000000 {
+- compatible = "nvidia,tegra234-ccplex-cluster";
+- reg = <0x0 0x0e000000 0x0 0x5ffff>;
+- nvidia,bpmp = <&bpmp>;
+- status = "okay";
+- };
++ pcie@140a0000 {
++ compatible = "nvidia,tegra234-pcie";
++ power-domains = <&bpmp TEGRA234_POWER_DOMAIN_PCIEX4CA>;
++ reg = <0x00 0x140a0000 0x0 0x00020000>, /* appl registers (128K) */
++ <0x00 0x2a000000 0x0 0x00040000>, /* configuration space (256K) */
++ <0x00 0x2a040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */
++ <0x00 0x2a080000 0x0 0x00040000>, /* DBI reg space (256K) */
++ <0x35 0x30000000 0x0 0x10000000>; /* ECAM (256MB) */
++ reg-names = "appl", "config", "atu_dma", "dbi", "ecam";
+
+- pcie@140a0000 {
+- compatible = "nvidia,tegra234-pcie";
+- power-domains = <&bpmp TEGRA234_POWER_DOMAIN_PCIEX4CA>;
+- reg = <0x00 0x140a0000 0x0 0x00020000>, /* appl registers (128K) */
+- <0x00 0x2a000000 0x0 0x00040000>, /* configuration space (256K) */
+- <0x00 0x2a040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */
+- <0x00 0x2a080000 0x0 0x00040000>, /* DBI reg space (256K) */
+- <0x35 0x30000000 0x0 0x10000000>; /* ECAM (256MB) */
+- reg-names = "appl", "config", "atu_dma", "dbi", "ecam";
+-
+- #address-cells = <3>;
+- #size-cells = <2>;
+- device_type = "pci";
+- num-lanes = <4>;
+- num-viewport = <8>;
+- linux,pci-domain = <8>;
++ #address-cells = <3>;
++ #size-cells = <2>;
++ device_type = "pci";
++ num-lanes = <4>;
++ num-viewport = <8>;
++ linux,pci-domain = <8>;
+
+- clocks = <&bpmp TEGRA234_CLK_PEX2_C8_CORE>;
+- clock-names = "core";
++ clocks = <&bpmp TEGRA234_CLK_PEX2_C8_CORE>;
++ clock-names = "core";
+
+- resets = <&bpmp TEGRA234_RESET_PEX2_CORE_8_APB>,
+- <&bpmp TEGRA234_RESET_PEX2_CORE_8>;
+- reset-names = "apb", "core";
++ resets = <&bpmp TEGRA234_RESET_PEX2_CORE_8_APB>,
++ <&bpmp TEGRA234_RESET_PEX2_CORE_8>;
++ reset-names = "apb", "core";
+
+- interrupts = <GIC_SPI 356 IRQ_TYPE_LEVEL_HIGH>, /* controller interrupt */
+- <GIC_SPI 357 IRQ_TYPE_LEVEL_HIGH>; /* MSI interrupt */
+- interrupt-names = "intr", "msi";
++ interrupts = <GIC_SPI 356 IRQ_TYPE_LEVEL_HIGH>, /* controller interrupt */
++ <GIC_SPI 357 IRQ_TYPE_LEVEL_HIGH>; /* MSI interrupt */
++ interrupt-names = "intr", "msi";
+
+- #interrupt-cells = <1>;
+- interrupt-map-mask = <0 0 0 0>;
+- interrupt-map = <0 0 0 0 &gic GIC_SPI 356 IRQ_TYPE_LEVEL_HIGH>;
++ #interrupt-cells = <1>;
++ interrupt-map-mask = <0 0 0 0>;
++ interrupt-map = <0 0 0 0 &gic GIC_SPI 356 IRQ_TYPE_LEVEL_HIGH>;
+
+- nvidia,bpmp = <&bpmp 8>;
++ nvidia,bpmp = <&bpmp 8>;
+
+- nvidia,aspm-cmrt-us = <60>;
+- nvidia,aspm-pwr-on-t-us = <20>;
+- nvidia,aspm-l0s-entrance-latency-us = <3>;
++ nvidia,aspm-cmrt-us = <60>;
++ nvidia,aspm-pwr-on-t-us = <20>;
++ nvidia,aspm-l0s-entrance-latency-us = <3>;
+
+- bus-range = <0x0 0xff>;
++ bus-range = <0x0 0xff>;
+
+- ranges = <0x43000000 0x32 0x40000000 0x32 0x40000000 0x2 0xe8000000>, /* prefetchable memory (11904 MB) */
+- <0x02000000 0x0 0x40000000 0x35 0x28000000 0x0 0x08000000>, /* non-prefetchable memory (128 MB) */
+- <0x01000000 0x0 0x2a100000 0x00 0x2a100000 0x0 0x00100000>; /* downstream I/O (1 MB) */
++ ranges = <0x43000000 0x32 0x40000000 0x32 0x40000000 0x2 0xe8000000>, /* prefetchable memory (11904 MB) */
++ <0x02000000 0x0 0x40000000 0x35 0x28000000 0x0 0x08000000>, /* non-prefetchable memory (128 MB) */
++ <0x01000000 0x0 0x2a100000 0x00 0x2a100000 0x0 0x00100000>; /* downstream I/O (1 MB) */
+
+- interconnects = <&mc TEGRA234_MEMORY_CLIENT_PCIE8AR &emc>,
+- <&mc TEGRA234_MEMORY_CLIENT_PCIE8AW &emc>;
+- interconnect-names = "dma-mem", "write";
+- iommu-map = <0x0 &smmu_niso1 TEGRA234_SID_PCIE8 0x1000>;
+- iommu-map-mask = <0x0>;
+- dma-coherent;
++ interconnects = <&mc TEGRA234_MEMORY_CLIENT_PCIE8AR &emc>,
++ <&mc TEGRA234_MEMORY_CLIENT_PCIE8AW &emc>;
++ interconnect-names = "dma-mem", "write";
++ iommu-map = <0x0 &smmu_niso1 TEGRA234_SID_PCIE8 0x1000>;
++ iommu-map-mask = <0x0>;
++ dma-coherent;
+
+- status = "disabled";
+- };
++ status = "disabled";
++ };
+
+- pcie@140c0000 {
+- compatible = "nvidia,tegra234-pcie";
+- power-domains = <&bpmp TEGRA234_POWER_DOMAIN_PCIEX4CB>;
+- reg = <0x00 0x140c0000 0x0 0x00020000>, /* appl registers (128K) */
+- <0x00 0x2c000000 0x0 0x00040000>, /* configuration space (256K) */
+- <0x00 0x2c040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */
+- <0x00 0x2c080000 0x0 0x00040000>, /* DBI reg space (256K) */
+- <0x38 0x30000000 0x0 0x10000000>; /* ECAM (256MB) */
+- reg-names = "appl", "config", "atu_dma", "dbi", "ecam";
+-
+- #address-cells = <3>;
+- #size-cells = <2>;
+- device_type = "pci";
+- num-lanes = <4>;
+- num-viewport = <8>;
+- linux,pci-domain = <9>;
++ pcie@140c0000 {
++ compatible = "nvidia,tegra234-pcie";
++ power-domains = <&bpmp TEGRA234_POWER_DOMAIN_PCIEX4CB>;
++ reg = <0x00 0x140c0000 0x0 0x00020000>, /* appl registers (128K) */
++ <0x00 0x2c000000 0x0 0x00040000>, /* configuration space (256K) */
++ <0x00 0x2c040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */
++ <0x00 0x2c080000 0x0 0x00040000>, /* DBI reg space (256K) */
++ <0x38 0x30000000 0x0 0x10000000>; /* ECAM (256MB) */
++ reg-names = "appl", "config", "atu_dma", "dbi", "ecam";
+
+- clocks = <&bpmp TEGRA234_CLK_PEX2_C9_CORE>;
+- clock-names = "core";
++ #address-cells = <3>;
++ #size-cells = <2>;
++ device_type = "pci";
++ num-lanes = <4>;
++ num-viewport = <8>;
++ linux,pci-domain = <9>;
+
+- resets = <&bpmp TEGRA234_RESET_PEX2_CORE_9_APB>,
+- <&bpmp TEGRA234_RESET_PEX2_CORE_9>;
+- reset-names = "apb", "core";
++ clocks = <&bpmp TEGRA234_CLK_PEX2_C9_CORE>;
++ clock-names = "core";
+
+- interrupts = <GIC_SPI 358 IRQ_TYPE_LEVEL_HIGH>, /* controller interrupt */
+- <GIC_SPI 359 IRQ_TYPE_LEVEL_HIGH>; /* MSI interrupt */
+- interrupt-names = "intr", "msi";
++ resets = <&bpmp TEGRA234_RESET_PEX2_CORE_9_APB>,
++ <&bpmp TEGRA234_RESET_PEX2_CORE_9>;
++ reset-names = "apb", "core";
+
+- #interrupt-cells = <1>;
+- interrupt-map-mask = <0 0 0 0>;
+- interrupt-map = <0 0 0 0 &gic GIC_SPI 358 IRQ_TYPE_LEVEL_HIGH>;
++ interrupts = <GIC_SPI 358 IRQ_TYPE_LEVEL_HIGH>, /* controller interrupt */
++ <GIC_SPI 359 IRQ_TYPE_LEVEL_HIGH>; /* MSI interrupt */
++ interrupt-names = "intr", "msi";
+
+- nvidia,bpmp = <&bpmp 9>;
++ #interrupt-cells = <1>;
++ interrupt-map-mask = <0 0 0 0>;
++ interrupt-map = <0 0 0 0 &gic GIC_SPI 358 IRQ_TYPE_LEVEL_HIGH>;
+
+- nvidia,aspm-cmrt-us = <60>;
+- nvidia,aspm-pwr-on-t-us = <20>;
+- nvidia,aspm-l0s-entrance-latency-us = <3>;
++ nvidia,bpmp = <&bpmp 9>;
+
+- bus-range = <0x0 0xff>;
++ nvidia,aspm-cmrt-us = <60>;
++ nvidia,aspm-pwr-on-t-us = <20>;
++ nvidia,aspm-l0s-entrance-latency-us = <3>;
+
+- ranges = <0x43000000 0x35 0x40000000 0x35 0x40000000 0x2 0xc0000000>, /* prefetchable memory (11264 MB) */
+- <0x02000000 0x0 0x40000000 0x38 0x28000000 0x0 0x08000000>, /* non-prefetchable memory (128 MB) */
+- <0x01000000 0x0 0x2c100000 0x00 0x2c100000 0x0 0x00100000>; /* downstream I/O (1 MB) */
++ bus-range = <0x0 0xff>;
+
+- interconnects = <&mc TEGRA234_MEMORY_CLIENT_PCIE9AR &emc>,
+- <&mc TEGRA234_MEMORY_CLIENT_PCIE9AW &emc>;
+- interconnect-names = "dma-mem", "write";
+- iommu-map = <0x0 &smmu_niso0 TEGRA234_SID_PCIE9 0x1000>;
+- iommu-map-mask = <0x0>;
+- dma-coherent;
++ ranges = <0x43000000 0x35 0x40000000 0x35 0x40000000 0x2 0xc0000000>, /* prefetchable memory (11264 MB) */
++ <0x02000000 0x0 0x40000000 0x38 0x28000000 0x0 0x08000000>, /* non-prefetchable memory (128 MB) */
++ <0x01000000 0x0 0x2c100000 0x00 0x2c100000 0x0 0x00100000>; /* downstream I/O (1 MB) */
+
+- status = "disabled";
+- };
++ interconnects = <&mc TEGRA234_MEMORY_CLIENT_PCIE9AR &emc>,
++ <&mc TEGRA234_MEMORY_CLIENT_PCIE9AW &emc>;
++ interconnect-names = "dma-mem", "write";
++ iommu-map = <0x0 &smmu_niso0 TEGRA234_SID_PCIE9 0x1000>;
++ iommu-map-mask = <0x0>;
++ dma-coherent;
+
+- pcie@140e0000 {
+- compatible = "nvidia,tegra234-pcie";
+- power-domains = <&bpmp TEGRA234_POWER_DOMAIN_PCIEX4CC>;
+- reg = <0x00 0x140e0000 0x0 0x00020000>, /* appl registers (128K) */
+- <0x00 0x2e000000 0x0 0x00040000>, /* configuration space (256K) */
+- <0x00 0x2e040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */
+- <0x00 0x2e080000 0x0 0x00040000>, /* DBI reg space (256K) */
+- <0x3b 0x30000000 0x0 0x10000000>; /* ECAM (256MB) */
+- reg-names = "appl", "config", "atu_dma", "dbi", "ecam";
+-
+- #address-cells = <3>;
+- #size-cells = <2>;
+- device_type = "pci";
+- num-lanes = <4>;
+- num-viewport = <8>;
+- linux,pci-domain = <10>;
++ status = "disabled";
++ };
+
+- clocks = <&bpmp TEGRA234_CLK_PEX2_C10_CORE>;
+- clock-names = "core";
++ pcie@140e0000 {
++ compatible = "nvidia,tegra234-pcie";
++ power-domains = <&bpmp TEGRA234_POWER_DOMAIN_PCIEX4CC>;
++ reg = <0x00 0x140e0000 0x0 0x00020000>, /* appl registers (128K) */
++ <0x00 0x2e000000 0x0 0x00040000>, /* configuration space (256K) */
++ <0x00 0x2e040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */
++ <0x00 0x2e080000 0x0 0x00040000>, /* DBI reg space (256K) */
++ <0x3b 0x30000000 0x0 0x10000000>; /* ECAM (256MB) */
++ reg-names = "appl", "config", "atu_dma", "dbi", "ecam";
+
+- resets = <&bpmp TEGRA234_RESET_PEX2_CORE_10_APB>,
+- <&bpmp TEGRA234_RESET_PEX2_CORE_10>;
+- reset-names = "apb", "core";
++ #address-cells = <3>;
++ #size-cells = <2>;
++ device_type = "pci";
++ num-lanes = <4>;
++ num-viewport = <8>;
++ linux,pci-domain = <10>;
+
+- interrupts = <GIC_SPI 360 IRQ_TYPE_LEVEL_HIGH>, /* controller interrupt */
+- <GIC_SPI 361 IRQ_TYPE_LEVEL_HIGH>; /* MSI interrupt */
+- interrupt-names = "intr", "msi";
++ clocks = <&bpmp TEGRA234_CLK_PEX2_C10_CORE>;
++ clock-names = "core";
+
+- #interrupt-cells = <1>;
+- interrupt-map-mask = <0 0 0 0>;
+- interrupt-map = <0 0 0 0 &gic GIC_SPI 360 IRQ_TYPE_LEVEL_HIGH>;
++ resets = <&bpmp TEGRA234_RESET_PEX2_CORE_10_APB>,
++ <&bpmp TEGRA234_RESET_PEX2_CORE_10>;
++ reset-names = "apb", "core";
+
+- nvidia,bpmp = <&bpmp 10>;
++ interrupts = <GIC_SPI 360 IRQ_TYPE_LEVEL_HIGH>, /* controller interrupt */
++ <GIC_SPI 361 IRQ_TYPE_LEVEL_HIGH>; /* MSI interrupt */
++ interrupt-names = "intr", "msi";
+
+- nvidia,aspm-cmrt-us = <60>;
+- nvidia,aspm-pwr-on-t-us = <20>;
+- nvidia,aspm-l0s-entrance-latency-us = <3>;
++ #interrupt-cells = <1>;
++ interrupt-map-mask = <0 0 0 0>;
++ interrupt-map = <0 0 0 0 &gic GIC_SPI 360 IRQ_TYPE_LEVEL_HIGH>;
+
+- bus-range = <0x0 0xff>;
++ nvidia,bpmp = <&bpmp 10>;
+
+- ranges = <0x43000000 0x38 0x40000000 0x38 0x40000000 0x2 0xe8000000>, /* prefetchable memory (11904 MB) */
+- <0x02000000 0x0 0x40000000 0x3b 0x28000000 0x0 0x08000000>, /* non-prefetchable memory (128 MB) */
+- <0x01000000 0x0 0x2e100000 0x00 0x2e100000 0x0 0x00100000>; /* downstream I/O (1 MB) */
++ nvidia,aspm-cmrt-us = <60>;
++ nvidia,aspm-pwr-on-t-us = <20>;
++ nvidia,aspm-l0s-entrance-latency-us = <3>;
+
+- interconnects = <&mc TEGRA234_MEMORY_CLIENT_PCIE10AR &emc>,
+- <&mc TEGRA234_MEMORY_CLIENT_PCIE10AW &emc>;
+- interconnect-names = "dma-mem", "write";
+- iommu-map = <0x0 &smmu_niso1 TEGRA234_SID_PCIE10 0x1000>;
+- iommu-map-mask = <0x0>;
+- dma-coherent;
++ bus-range = <0x0 0xff>;
+
+- status = "disabled";
+- };
++ ranges = <0x43000000 0x38 0x40000000 0x38 0x40000000 0x2 0xe8000000>, /* prefetchable memory (11904 MB) */
++ <0x02000000 0x0 0x40000000 0x3b 0x28000000 0x0 0x08000000>, /* non-prefetchable memory (128 MB) */
++ <0x01000000 0x0 0x2e100000 0x00 0x2e100000 0x0 0x00100000>; /* downstream I/O (1 MB) */
+
+- pcie@14100000 {
+- compatible = "nvidia,tegra234-pcie";
+- power-domains = <&bpmp TEGRA234_POWER_DOMAIN_PCIEX1A>;
+- reg = <0x00 0x14100000 0x0 0x00020000>, /* appl registers (128K) */
+- <0x00 0x30000000 0x0 0x00040000>, /* configuration space (256K) */
+- <0x00 0x30040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */
+- <0x00 0x30080000 0x0 0x00040000>, /* DBI reg space (256K) */
+- <0x20 0xb0000000 0x0 0x10000000>; /* ECAM (256MB) */
+- reg-names = "appl", "config", "atu_dma", "dbi", "ecam";
+-
+- #address-cells = <3>;
+- #size-cells = <2>;
+- device_type = "pci";
+- num-lanes = <1>;
+- num-viewport = <8>;
+- linux,pci-domain = <1>;
++ interconnects = <&mc TEGRA234_MEMORY_CLIENT_PCIE10AR &emc>,
++ <&mc TEGRA234_MEMORY_CLIENT_PCIE10AW &emc>;
++ interconnect-names = "dma-mem", "write";
++ iommu-map = <0x0 &smmu_niso1 TEGRA234_SID_PCIE10 0x1000>;
++ iommu-map-mask = <0x0>;
++ dma-coherent;
+
+- clocks = <&bpmp TEGRA234_CLK_PEX0_C1_CORE>;
+- clock-names = "core";
++ status = "disabled";
++ };
+
+- resets = <&bpmp TEGRA234_RESET_PEX0_CORE_1_APB>,
+- <&bpmp TEGRA234_RESET_PEX0_CORE_1>;
+- reset-names = "apb", "core";
++ pcie-ep@140e0000 {
++ compatible = "nvidia,tegra234-pcie-ep";
++ power-domains = <&bpmp TEGRA234_POWER_DOMAIN_PCIEX4CC>;
++ reg = <0x00 0x140e0000 0x0 0x00020000>, /* appl registers (128K) */
++ <0x00 0x2e040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */
++ <0x00 0x2e080000 0x0 0x00040000>, /* DBI space (256K) */
++ <0x38 0x40000000 0x3 0x00000000>; /* Address Space (12G) */
++ reg-names = "appl", "atu_dma", "dbi", "addr_space";
+
+- interrupts = <GIC_SPI 45 IRQ_TYPE_LEVEL_HIGH>, /* controller interrupt */
+- <GIC_SPI 46 IRQ_TYPE_LEVEL_HIGH>; /* MSI interrupt */
+- interrupt-names = "intr", "msi";
++ num-lanes = <4>;
+
+- #interrupt-cells = <1>;
+- interrupt-map-mask = <0 0 0 0>;
+- interrupt-map = <0 0 0 0 &gic GIC_SPI 45 IRQ_TYPE_LEVEL_HIGH>;
++ clocks = <&bpmp TEGRA234_CLK_PEX2_C10_CORE>;
++ clock-names = "core";
+
+- nvidia,bpmp = <&bpmp 1>;
++ resets = <&bpmp TEGRA234_RESET_PEX2_CORE_10_APB>,
++ <&bpmp TEGRA234_RESET_PEX2_CORE_10>;
++ reset-names = "apb", "core";
+
+- nvidia,aspm-cmrt-us = <60>;
+- nvidia,aspm-pwr-on-t-us = <20>;
+- nvidia,aspm-l0s-entrance-latency-us = <3>;
++ interrupts = <GIC_SPI 360 IRQ_TYPE_LEVEL_HIGH>; /* controller interrupt */
++ interrupt-names = "intr";
+
+- bus-range = <0x0 0xff>;
++ nvidia,bpmp = <&bpmp 10>;
+
+- ranges = <0x43000000 0x20 0x80000000 0x20 0x80000000 0x0 0x28000000>, /* prefetchable memory (640 MB) */
+- <0x02000000 0x0 0x40000000 0x20 0xa8000000 0x0 0x08000000>, /* non-prefetchable memory (128 MB) */
+- <0x01000000 0x0 0x30100000 0x00 0x30100000 0x0 0x00100000>; /* downstream I/O (1 MB) */
++ nvidia,enable-ext-refclk;
++ nvidia,aspm-cmrt-us = <60>;
++ nvidia,aspm-pwr-on-t-us = <20>;
++ nvidia,aspm-l0s-entrance-latency-us = <3>;
+
+- interconnects = <&mc TEGRA234_MEMORY_CLIENT_PCIE1R &emc>,
+- <&mc TEGRA234_MEMORY_CLIENT_PCIE1W &emc>;
+- interconnect-names = "dma-mem", "write";
+- iommu-map = <0x0 &smmu_niso1 TEGRA234_SID_PCIE1 0x1000>;
+- iommu-map-mask = <0x0>;
+- dma-coherent;
++ interconnects = <&mc TEGRA234_MEMORY_CLIENT_PCIE10AR &emc>,
++ <&mc TEGRA234_MEMORY_CLIENT_PCIE10AW &emc>;
++ interconnect-names = "dma-mem", "write";
++ iommu-map = <0x0 &smmu_niso1 TEGRA234_SID_PCIE10 0x1000>;
++ iommu-map-mask = <0x0>;
++ dma-coherent;
+
+- status = "disabled";
+- };
++ status = "disabled";
++ };
+
+- pcie@14120000 {
+- compatible = "nvidia,tegra234-pcie";
+- power-domains = <&bpmp TEGRA234_POWER_DOMAIN_PCIEX1A>;
+- reg = <0x00 0x14120000 0x0 0x00020000>, /* appl registers (128K) */
+- <0x00 0x32000000 0x0 0x00040000>, /* configuration space (256K) */
+- <0x00 0x32040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */
+- <0x00 0x32080000 0x0 0x00040000>, /* DBI reg space (256K) */
+- <0x20 0xf0000000 0x0 0x10000000>; /* ECAM (256MB) */
+- reg-names = "appl", "config", "atu_dma", "dbi", "ecam";
+-
+- #address-cells = <3>;
+- #size-cells = <2>;
+- device_type = "pci";
+- num-lanes = <1>;
+- num-viewport = <8>;
+- linux,pci-domain = <2>;
++ pcie@14100000 {
++ compatible = "nvidia,tegra234-pcie";
++ power-domains = <&bpmp TEGRA234_POWER_DOMAIN_PCIEX1A>;
++ reg = <0x00 0x14100000 0x0 0x00020000>, /* appl registers (128K) */
++ <0x00 0x30000000 0x0 0x00040000>, /* configuration space (256K) */
++ <0x00 0x30040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */
++ <0x00 0x30080000 0x0 0x00040000>, /* DBI reg space (256K) */
++ <0x20 0xb0000000 0x0 0x10000000>; /* ECAM (256MB) */
++ reg-names = "appl", "config", "atu_dma", "dbi", "ecam";
+
+- clocks = <&bpmp TEGRA234_CLK_PEX0_C2_CORE>;
+- clock-names = "core";
++ #address-cells = <3>;
++ #size-cells = <2>;
++ device_type = "pci";
++ num-lanes = <1>;
++ num-viewport = <8>;
++ linux,pci-domain = <1>;
+
+- resets = <&bpmp TEGRA234_RESET_PEX0_CORE_2_APB>,
+- <&bpmp TEGRA234_RESET_PEX0_CORE_2>;
+- reset-names = "apb", "core";
++ clocks = <&bpmp TEGRA234_CLK_PEX0_C1_CORE>;
++ clock-names = "core";
+
+- interrupts = <GIC_SPI 47 IRQ_TYPE_LEVEL_HIGH>, /* controller interrupt */
+- <GIC_SPI 48 IRQ_TYPE_LEVEL_HIGH>; /* MSI interrupt */
+- interrupt-names = "intr", "msi";
++ resets = <&bpmp TEGRA234_RESET_PEX0_CORE_1_APB>,
++ <&bpmp TEGRA234_RESET_PEX0_CORE_1>;
++ reset-names = "apb", "core";
+
+- #interrupt-cells = <1>;
+- interrupt-map-mask = <0 0 0 0>;
+- interrupt-map = <0 0 0 0 &gic GIC_SPI 47 IRQ_TYPE_LEVEL_HIGH>;
++ interrupts = <GIC_SPI 45 IRQ_TYPE_LEVEL_HIGH>, /* controller interrupt */
++ <GIC_SPI 46 IRQ_TYPE_LEVEL_HIGH>; /* MSI interrupt */
++ interrupt-names = "intr", "msi";
+
+- nvidia,bpmp = <&bpmp 2>;
++ #interrupt-cells = <1>;
++ interrupt-map-mask = <0 0 0 0>;
++ interrupt-map = <0 0 0 0 &gic GIC_SPI 45 IRQ_TYPE_LEVEL_HIGH>;
+
+- nvidia,aspm-cmrt-us = <60>;
+- nvidia,aspm-pwr-on-t-us = <20>;
+- nvidia,aspm-l0s-entrance-latency-us = <3>;
++ nvidia,bpmp = <&bpmp 1>;
+
+- bus-range = <0x0 0xff>;
++ nvidia,aspm-cmrt-us = <60>;
++ nvidia,aspm-pwr-on-t-us = <20>;
++ nvidia,aspm-l0s-entrance-latency-us = <3>;
+
+- ranges = <0x43000000 0x20 0xc0000000 0x20 0xc0000000 0x0 0x28000000>, /* prefetchable memory (640 MB) */
+- <0x02000000 0x0 0x40000000 0x20 0xe8000000 0x0 0x08000000>, /* non-prefetchable memory (128 MB) */
+- <0x01000000 0x0 0x32100000 0x00 0x32100000 0x0 0x00100000>; /* downstream I/O (1 MB) */
++ bus-range = <0x0 0xff>;
+
+- interconnects = <&mc TEGRA234_MEMORY_CLIENT_PCIE2AR &emc>,
+- <&mc TEGRA234_MEMORY_CLIENT_PCIE2AW &emc>;
+- interconnect-names = "dma-mem", "write";
+- iommu-map = <0x0 &smmu_niso1 TEGRA234_SID_PCIE2 0x1000>;
+- iommu-map-mask = <0x0>;
+- dma-coherent;
++ ranges = <0x43000000 0x20 0x80000000 0x20 0x80000000 0x0 0x28000000>, /* prefetchable memory (640 MB) */
++ <0x02000000 0x0 0x40000000 0x20 0xa8000000 0x0 0x08000000>, /* non-prefetchable memory (128 MB) */
++ <0x01000000 0x0 0x30100000 0x00 0x30100000 0x0 0x00100000>; /* downstream I/O (1 MB) */
+
+- status = "disabled";
+- };
++ interconnects = <&mc TEGRA234_MEMORY_CLIENT_PCIE1R &emc>,
++ <&mc TEGRA234_MEMORY_CLIENT_PCIE1W &emc>;
++ interconnect-names = "dma-mem", "write";
++ iommu-map = <0x0 &smmu_niso1 TEGRA234_SID_PCIE1 0x1000>;
++ iommu-map-mask = <0x0>;
++ dma-coherent;
+
+- pcie@14140000 {
+- compatible = "nvidia,tegra234-pcie";
+- power-domains = <&bpmp TEGRA234_POWER_DOMAIN_PCIEX1A>;
+- reg = <0x00 0x14140000 0x0 0x00020000>, /* appl registers (128K) */
+- <0x00 0x34000000 0x0 0x00040000>, /* configuration space (256K) */
+- <0x00 0x34040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */
+- <0x00 0x34080000 0x0 0x00040000>, /* DBI reg space (256K) */
+- <0x21 0x30000000 0x0 0x10000000>; /* ECAM (256MB) */
+- reg-names = "appl", "config", "atu_dma", "dbi", "ecam";
+-
+- #address-cells = <3>;
+- #size-cells = <2>;
+- device_type = "pci";
+- num-lanes = <1>;
+- num-viewport = <8>;
+- linux,pci-domain = <3>;
++ status = "disabled";
++ };
+
+- clocks = <&bpmp TEGRA234_CLK_PEX0_C3_CORE>;
+- clock-names = "core";
++ pcie@14120000 {
++ compatible = "nvidia,tegra234-pcie";
++ power-domains = <&bpmp TEGRA234_POWER_DOMAIN_PCIEX1A>;
++ reg = <0x00 0x14120000 0x0 0x00020000>, /* appl registers (128K) */
++ <0x00 0x32000000 0x0 0x00040000>, /* configuration space (256K) */
++ <0x00 0x32040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */
++ <0x00 0x32080000 0x0 0x00040000>, /* DBI reg space (256K) */
++ <0x20 0xf0000000 0x0 0x10000000>; /* ECAM (256MB) */
++ reg-names = "appl", "config", "atu_dma", "dbi", "ecam";
+
+- resets = <&bpmp TEGRA234_RESET_PEX0_CORE_3_APB>,
+- <&bpmp TEGRA234_RESET_PEX0_CORE_3>;
+- reset-names = "apb", "core";
++ #address-cells = <3>;
++ #size-cells = <2>;
++ device_type = "pci";
++ num-lanes = <1>;
++ num-viewport = <8>;
++ linux,pci-domain = <2>;
+
+- interrupts = <GIC_SPI 49 IRQ_TYPE_LEVEL_HIGH>, /* controller interrupt */
+- <GIC_SPI 50 IRQ_TYPE_LEVEL_HIGH>; /* MSI interrupt */
+- interrupt-names = "intr", "msi";
++ clocks = <&bpmp TEGRA234_CLK_PEX0_C2_CORE>;
++ clock-names = "core";
+
+- #interrupt-cells = <1>;
+- interrupt-map-mask = <0 0 0 0>;
+- interrupt-map = <0 0 0 0 &gic GIC_SPI 49 IRQ_TYPE_LEVEL_HIGH>;
++ resets = <&bpmp TEGRA234_RESET_PEX0_CORE_2_APB>,
++ <&bpmp TEGRA234_RESET_PEX0_CORE_2>;
++ reset-names = "apb", "core";
+
+- nvidia,bpmp = <&bpmp 3>;
++ interrupts = <GIC_SPI 47 IRQ_TYPE_LEVEL_HIGH>, /* controller interrupt */
++ <GIC_SPI 48 IRQ_TYPE_LEVEL_HIGH>; /* MSI interrupt */
++ interrupt-names = "intr", "msi";
+
+- nvidia,aspm-cmrt-us = <60>;
+- nvidia,aspm-pwr-on-t-us = <20>;
+- nvidia,aspm-l0s-entrance-latency-us = <3>;
++ #interrupt-cells = <1>;
++ interrupt-map-mask = <0 0 0 0>;
++ interrupt-map = <0 0 0 0 &gic GIC_SPI 47 IRQ_TYPE_LEVEL_HIGH>;
+
+- bus-range = <0x0 0xff>;
++ nvidia,bpmp = <&bpmp 2>;
+
+- ranges = <0x43000000 0x21 0x00000000 0x21 0x00000000 0x0 0x28000000>, /* prefetchable memory (640 MB) */
+- <0x02000000 0x0 0x40000000 0x21 0x28000000 0x0 0x08000000>, /* non-prefetchable memory (128 MB) */
+- <0x01000000 0x0 0x34100000 0x00 0x34100000 0x0 0x00100000>; /* downstream I/O (1 MB) */
++ nvidia,aspm-cmrt-us = <60>;
++ nvidia,aspm-pwr-on-t-us = <20>;
++ nvidia,aspm-l0s-entrance-latency-us = <3>;
+
+- interconnects = <&mc TEGRA234_MEMORY_CLIENT_PCIE3R &emc>,
+- <&mc TEGRA234_MEMORY_CLIENT_PCIE3W &emc>;
+- interconnect-names = "dma-mem", "write";
+- iommu-map = <0x0 &smmu_niso1 TEGRA234_SID_PCIE3 0x1000>;
+- iommu-map-mask = <0x0>;
+- dma-coherent;
++ bus-range = <0x0 0xff>;
+
+- status = "disabled";
+- };
++ ranges = <0x43000000 0x20 0xc0000000 0x20 0xc0000000 0x0 0x28000000>, /* prefetchable memory (640 MB) */
++ <0x02000000 0x0 0x40000000 0x20 0xe8000000 0x0 0x08000000>, /* non-prefetchable memory (128 MB) */
++ <0x01000000 0x0 0x32100000 0x00 0x32100000 0x0 0x00100000>; /* downstream I/O (1 MB) */
+
+- pcie@14160000 {
+- compatible = "nvidia,tegra234-pcie";
+- power-domains = <&bpmp TEGRA234_POWER_DOMAIN_PCIEX4BB>;
+- reg = <0x00 0x14160000 0x0 0x00020000>, /* appl registers (128K) */
+- <0x00 0x36000000 0x0 0x00040000>, /* configuration space (256K) */
+- <0x00 0x36040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */
+- <0x00 0x36080000 0x0 0x00040000>, /* DBI reg space (256K) */
+- <0x24 0x30000000 0x0 0x10000000>; /* ECAM (256MB) */
+- reg-names = "appl", "config", "atu_dma", "dbi", "ecam";
+-
+- #address-cells = <3>;
+- #size-cells = <2>;
+- device_type = "pci";
+- num-lanes = <4>;
+- num-viewport = <8>;
+- linux,pci-domain = <4>;
++ interconnects = <&mc TEGRA234_MEMORY_CLIENT_PCIE2AR &emc>,
++ <&mc TEGRA234_MEMORY_CLIENT_PCIE2AW &emc>;
++ interconnect-names = "dma-mem", "write";
++ iommu-map = <0x0 &smmu_niso1 TEGRA234_SID_PCIE2 0x1000>;
++ iommu-map-mask = <0x0>;
++ dma-coherent;
+
+- clocks = <&bpmp TEGRA234_CLK_PEX0_C4_CORE>;
+- clock-names = "core";
++ status = "disabled";
++ };
+
+- resets = <&bpmp TEGRA234_RESET_PEX0_CORE_4_APB>,
+- <&bpmp TEGRA234_RESET_PEX0_CORE_4>;
+- reset-names = "apb", "core";
++ pcie@14140000 {
++ compatible = "nvidia,tegra234-pcie";
++ power-domains = <&bpmp TEGRA234_POWER_DOMAIN_PCIEX1A>;
++ reg = <0x00 0x14140000 0x0 0x00020000>, /* appl registers (128K) */
++ <0x00 0x34000000 0x0 0x00040000>, /* configuration space (256K) */
++ <0x00 0x34040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */
++ <0x00 0x34080000 0x0 0x00040000>, /* DBI reg space (256K) */
++ <0x21 0x30000000 0x0 0x10000000>; /* ECAM (256MB) */
++ reg-names = "appl", "config", "atu_dma", "dbi", "ecam";
+
+- interrupts = <GIC_SPI 51 IRQ_TYPE_LEVEL_HIGH>, /* controller interrupt */
+- <GIC_SPI 52 IRQ_TYPE_LEVEL_HIGH>; /* MSI interrupt */
+- interrupt-names = "intr", "msi";
++ #address-cells = <3>;
++ #size-cells = <2>;
++ device_type = "pci";
++ num-lanes = <1>;
++ num-viewport = <8>;
++ linux,pci-domain = <3>;
+
+- #interrupt-cells = <1>;
+- interrupt-map-mask = <0 0 0 0>;
+- interrupt-map = <0 0 0 0 &gic GIC_SPI 51 IRQ_TYPE_LEVEL_HIGH>;
++ clocks = <&bpmp TEGRA234_CLK_PEX0_C3_CORE>;
++ clock-names = "core";
+
+- nvidia,bpmp = <&bpmp 4>;
++ resets = <&bpmp TEGRA234_RESET_PEX0_CORE_3_APB>,
++ <&bpmp TEGRA234_RESET_PEX0_CORE_3>;
++ reset-names = "apb", "core";
+
+- nvidia,aspm-cmrt-us = <60>;
+- nvidia,aspm-pwr-on-t-us = <20>;
+- nvidia,aspm-l0s-entrance-latency-us = <3>;
++ interrupts = <GIC_SPI 49 IRQ_TYPE_LEVEL_HIGH>, /* controller interrupt */
++ <GIC_SPI 50 IRQ_TYPE_LEVEL_HIGH>; /* MSI interrupt */
++ interrupt-names = "intr", "msi";
+
+- bus-range = <0x0 0xff>;
++ #interrupt-cells = <1>;
++ interrupt-map-mask = <0 0 0 0>;
++ interrupt-map = <0 0 0 0 &gic GIC_SPI 49 IRQ_TYPE_LEVEL_HIGH>;
+
+- ranges = <0x43000000 0x21 0x40000000 0x21 0x40000000 0x2 0xe8000000>, /* prefetchable memory (11904 MB) */
+- <0x02000000 0x0 0x40000000 0x24 0x28000000 0x0 0x08000000>, /* non-prefetchable memory (128 MB) */
+- <0x01000000 0x0 0x36100000 0x00 0x36100000 0x0 0x00100000>; /* downstream I/O (1 MB) */
++ nvidia,bpmp = <&bpmp 3>;
+
+- interconnects = <&mc TEGRA234_MEMORY_CLIENT_PCIE4R &emc>,
+- <&mc TEGRA234_MEMORY_CLIENT_PCIE4W &emc>;
+- interconnect-names = "dma-mem", "write";
+- iommu-map = <0x0 &smmu_niso0 TEGRA234_SID_PCIE4 0x1000>;
+- iommu-map-mask = <0x0>;
+- dma-coherent;
++ nvidia,aspm-cmrt-us = <60>;
++ nvidia,aspm-pwr-on-t-us = <20>;
++ nvidia,aspm-l0s-entrance-latency-us = <3>;
+
+- status = "disabled";
+- };
++ bus-range = <0x0 0xff>;
+
+- pcie@14180000 {
+- compatible = "nvidia,tegra234-pcie";
+- power-domains = <&bpmp TEGRA234_POWER_DOMAIN_PCIEX4BA>;
+- reg = <0x00 0x14180000 0x0 0x00020000>, /* appl registers (128K) */
+- <0x00 0x38000000 0x0 0x00040000>, /* configuration space (256K) */
+- <0x00 0x38040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */
+- <0x00 0x38080000 0x0 0x00040000>, /* DBI reg space (256K) */
+- <0x27 0x30000000 0x0 0x10000000>; /* ECAM (256MB) */
+- reg-names = "appl", "config", "atu_dma", "dbi", "ecam";
+-
+- #address-cells = <3>;
+- #size-cells = <2>;
+- device_type = "pci";
+- num-lanes = <4>;
+- num-viewport = <8>;
+- linux,pci-domain = <0>;
++ ranges = <0x43000000 0x21 0x00000000 0x21 0x00000000 0x0 0x28000000>, /* prefetchable memory (640 MB) */
++ <0x02000000 0x0 0x40000000 0x21 0x28000000 0x0 0x08000000>, /* non-prefetchable memory (128 MB) */
++ <0x01000000 0x0 0x34100000 0x00 0x34100000 0x0 0x00100000>; /* downstream I/O (1 MB) */
+
+- clocks = <&bpmp TEGRA234_CLK_PEX0_C0_CORE>;
+- clock-names = "core";
++ interconnects = <&mc TEGRA234_MEMORY_CLIENT_PCIE3R &emc>,
++ <&mc TEGRA234_MEMORY_CLIENT_PCIE3W &emc>;
++ interconnect-names = "dma-mem", "write";
++ iommu-map = <0x0 &smmu_niso1 TEGRA234_SID_PCIE3 0x1000>;
++ iommu-map-mask = <0x0>;
++ dma-coherent;
+
+- resets = <&bpmp TEGRA234_RESET_PEX0_CORE_0_APB>,
+- <&bpmp TEGRA234_RESET_PEX0_CORE_0>;
+- reset-names = "apb", "core";
++ status = "disabled";
++ };
+
+- interrupts = <GIC_SPI 72 IRQ_TYPE_LEVEL_HIGH>, /* controller interrupt */
+- <GIC_SPI 73 IRQ_TYPE_LEVEL_HIGH>; /* MSI interrupt */
+- interrupt-names = "intr", "msi";
++ pcie@14160000 {
++ compatible = "nvidia,tegra234-pcie";
++ power-domains = <&bpmp TEGRA234_POWER_DOMAIN_PCIEX4BB>;
++ reg = <0x00 0x14160000 0x0 0x00020000>, /* appl registers (128K) */
++ <0x00 0x36000000 0x0 0x00040000>, /* configuration space (256K) */
++ <0x00 0x36040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */
++ <0x00 0x36080000 0x0 0x00040000>, /* DBI reg space (256K) */
++ <0x24 0x30000000 0x0 0x10000000>; /* ECAM (256MB) */
++ reg-names = "appl", "config", "atu_dma", "dbi", "ecam";
+
+- #interrupt-cells = <1>;
+- interrupt-map-mask = <0 0 0 0>;
+- interrupt-map = <0 0 0 0 &gic GIC_SPI 72 IRQ_TYPE_LEVEL_HIGH>;
++ #address-cells = <3>;
++ #size-cells = <2>;
++ device_type = "pci";
++ num-lanes = <4>;
++ num-viewport = <8>;
++ linux,pci-domain = <4>;
+
+- nvidia,bpmp = <&bpmp 0>;
++ clocks = <&bpmp TEGRA234_CLK_PEX0_C4_CORE>;
++ clock-names = "core";
+
+- nvidia,aspm-cmrt-us = <60>;
+- nvidia,aspm-pwr-on-t-us = <20>;
+- nvidia,aspm-l0s-entrance-latency-us = <3>;
++ resets = <&bpmp TEGRA234_RESET_PEX0_CORE_4_APB>,
++ <&bpmp TEGRA234_RESET_PEX0_CORE_4>;
++ reset-names = "apb", "core";
+
+- bus-range = <0x0 0xff>;
++ interrupts = <GIC_SPI 51 IRQ_TYPE_LEVEL_HIGH>, /* controller interrupt */
++ <GIC_SPI 52 IRQ_TYPE_LEVEL_HIGH>; /* MSI interrupt */
++ interrupt-names = "intr", "msi";
+
+- ranges = <0x43000000 0x24 0x40000000 0x24 0x40000000 0x2 0xe8000000>, /* prefetchable memory (11904 MB) */
+- <0x02000000 0x0 0x40000000 0x27 0x28000000 0x0 0x08000000>, /* non-prefetchable memory (128 MB) */
+- <0x01000000 0x0 0x38100000 0x00 0x38100000 0x0 0x00100000>; /* downstream I/O (1 MB) */
++ #interrupt-cells = <1>;
++ interrupt-map-mask = <0 0 0 0>;
++ interrupt-map = <0 0 0 0 &gic GIC_SPI 51 IRQ_TYPE_LEVEL_HIGH>;
+
+- interconnects = <&mc TEGRA234_MEMORY_CLIENT_PCIE0R &emc>,
+- <&mc TEGRA234_MEMORY_CLIENT_PCIE0W &emc>;
+- interconnect-names = "dma-mem", "write";
+- iommu-map = <0x0 &smmu_niso0 TEGRA234_SID_PCIE0 0x1000>;
+- iommu-map-mask = <0x0>;
+- dma-coherent;
++ nvidia,bpmp = <&bpmp 4>;
+
+- status = "disabled";
+- };
++ nvidia,aspm-cmrt-us = <60>;
++ nvidia,aspm-pwr-on-t-us = <20>;
++ nvidia,aspm-l0s-entrance-latency-us = <3>;
+
+- pcie@141a0000 {
+- compatible = "nvidia,tegra234-pcie";
+- power-domains = <&bpmp TEGRA234_POWER_DOMAIN_PCIEX8A>;
+- reg = <0x00 0x141a0000 0x0 0x00020000>, /* appl registers (128K) */
+- <0x00 0x3a000000 0x0 0x00040000>, /* configuration space (256K) */
+- <0x00 0x3a040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */
+- <0x00 0x3a080000 0x0 0x00040000>, /* DBI reg space (256K) */
+- <0x2b 0x30000000 0x0 0x10000000>; /* ECAM (256MB) */
+- reg-names = "appl", "config", "atu_dma", "dbi", "ecam";
+-
+- #address-cells = <3>;
+- #size-cells = <2>;
+- device_type = "pci";
+- num-lanes = <8>;
+- num-viewport = <8>;
+- linux,pci-domain = <5>;
++ bus-range = <0x0 0xff>;
+
+- clocks = <&bpmp TEGRA234_CLK_PEX1_C5_CORE>;
+- clock-names = "core";
++ ranges = <0x43000000 0x21 0x40000000 0x21 0x40000000 0x2 0xe8000000>, /* prefetchable memory (11904 MB) */
++ <0x02000000 0x0 0x40000000 0x24 0x28000000 0x0 0x08000000>, /* non-prefetchable memory (128 MB) */
++ <0x01000000 0x0 0x36100000 0x00 0x36100000 0x0 0x00100000>; /* downstream I/O (1 MB) */
+
+- resets = <&bpmp TEGRA234_RESET_PEX1_CORE_5_APB>,
+- <&bpmp TEGRA234_RESET_PEX1_CORE_5>;
+- reset-names = "apb", "core";
++ interconnects = <&mc TEGRA234_MEMORY_CLIENT_PCIE4R &emc>,
++ <&mc TEGRA234_MEMORY_CLIENT_PCIE4W &emc>;
++ interconnect-names = "dma-mem", "write";
++ iommu-map = <0x0 &smmu_niso0 TEGRA234_SID_PCIE4 0x1000>;
++ iommu-map-mask = <0x0>;
++ dma-coherent;
+
+- interrupts = <GIC_SPI 53 IRQ_TYPE_LEVEL_HIGH>, /* controller interrupt */
+- <GIC_SPI 54 IRQ_TYPE_LEVEL_HIGH>; /* MSI interrupt */
+- interrupt-names = "intr", "msi";
++ status = "disabled";
++ };
+
+- #interrupt-cells = <1>;
+- interrupt-map-mask = <0 0 0 0>;
+- interrupt-map = <0 0 0 0 &gic GIC_SPI 53 IRQ_TYPE_LEVEL_HIGH>;
++ pcie@14180000 {
++ compatible = "nvidia,tegra234-pcie";
++ power-domains = <&bpmp TEGRA234_POWER_DOMAIN_PCIEX4BA>;
++ reg = <0x00 0x14180000 0x0 0x00020000>, /* appl registers (128K) */
++ <0x00 0x38000000 0x0 0x00040000>, /* configuration space (256K) */
++ <0x00 0x38040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */
++ <0x00 0x38080000 0x0 0x00040000>, /* DBI reg space (256K) */
++ <0x27 0x30000000 0x0 0x10000000>; /* ECAM (256MB) */
++ reg-names = "appl", "config", "atu_dma", "dbi", "ecam";
+
+- nvidia,bpmp = <&bpmp 5>;
++ #address-cells = <3>;
++ #size-cells = <2>;
++ device_type = "pci";
++ num-lanes = <4>;
++ num-viewport = <8>;
++ linux,pci-domain = <0>;
+
+- nvidia,aspm-cmrt-us = <60>;
+- nvidia,aspm-pwr-on-t-us = <20>;
+- nvidia,aspm-l0s-entrance-latency-us = <3>;
++ clocks = <&bpmp TEGRA234_CLK_PEX0_C0_CORE>;
++ clock-names = "core";
+
+- bus-range = <0x0 0xff>;
++ resets = <&bpmp TEGRA234_RESET_PEX0_CORE_0_APB>,
++ <&bpmp TEGRA234_RESET_PEX0_CORE_0>;
++ reset-names = "apb", "core";
+
+- ranges = <0x43000000 0x28 0x00000000 0x28 0x00000000 0x3 0x28000000>, /* prefetchable memory (12928 MB) */
+- <0x02000000 0x0 0x40000000 0x2b 0x28000000 0x0 0x08000000>, /* non-prefetchable memory (128 MB) */
+- <0x01000000 0x0 0x3a100000 0x00 0x3a100000 0x0 0x00100000>; /* downstream I/O (1 MB) */
++ interrupts = <GIC_SPI 72 IRQ_TYPE_LEVEL_HIGH>, /* controller interrupt */
++ <GIC_SPI 73 IRQ_TYPE_LEVEL_HIGH>; /* MSI interrupt */
++ interrupt-names = "intr", "msi";
+
+- interconnects = <&mc TEGRA234_MEMORY_CLIENT_PCIE5R &emc>,
+- <&mc TEGRA234_MEMORY_CLIENT_PCIE5W &emc>;
+- interconnect-names = "dma-mem", "write";
+- iommu-map = <0x0 &smmu_niso0 TEGRA234_SID_PCIE5 0x1000>;
+- iommu-map-mask = <0x0>;
+- dma-coherent;
++ #interrupt-cells = <1>;
++ interrupt-map-mask = <0 0 0 0>;
++ interrupt-map = <0 0 0 0 &gic GIC_SPI 72 IRQ_TYPE_LEVEL_HIGH>;
+
+- status = "disabled";
+- };
++ nvidia,bpmp = <&bpmp 0>;
+
+- pcie@141c0000 {
+- compatible = "nvidia,tegra234-pcie";
+- power-domains = <&bpmp TEGRA234_POWER_DOMAIN_PCIEX4A>;
+- reg = <0x00 0x141c0000 0x0 0x00020000>, /* appl registers (128K) */
+- <0x00 0x3c000000 0x0 0x00040000>, /* configuration space (256K) */
+- <0x00 0x3c040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */
+- <0x00 0x3c080000 0x0 0x00040000>, /* DBI reg space (256K) */
+- <0x2e 0x30000000 0x0 0x10000000>; /* ECAM (256MB) */
+- reg-names = "appl", "config", "atu_dma", "dbi", "ecam";
+-
+- #address-cells = <3>;
+- #size-cells = <2>;
+- device_type = "pci";
+- num-lanes = <4>;
+- num-viewport = <8>;
+- linux,pci-domain = <6>;
++ nvidia,aspm-cmrt-us = <60>;
++ nvidia,aspm-pwr-on-t-us = <20>;
++ nvidia,aspm-l0s-entrance-latency-us = <3>;
++
++ bus-range = <0x0 0xff>;
+
+- clocks = <&bpmp TEGRA234_CLK_PEX1_C6_CORE>;
+- clock-names = "core";
++ ranges = <0x43000000 0x24 0x40000000 0x24 0x40000000 0x2 0xe8000000>, /* prefetchable memory (11904 MB) */
++ <0x02000000 0x0 0x40000000 0x27 0x28000000 0x0 0x08000000>, /* non-prefetchable memory (128 MB) */
++ <0x01000000 0x0 0x38100000 0x00 0x38100000 0x0 0x00100000>; /* downstream I/O (1 MB) */
+
+- resets = <&bpmp TEGRA234_RESET_PEX1_CORE_6_APB>,
+- <&bpmp TEGRA234_RESET_PEX1_CORE_6>;
+- reset-names = "apb", "core";
++ interconnects = <&mc TEGRA234_MEMORY_CLIENT_PCIE0R &emc>,
++ <&mc TEGRA234_MEMORY_CLIENT_PCIE0W &emc>;
++ interconnect-names = "dma-mem", "write";
++ iommu-map = <0x0 &smmu_niso0 TEGRA234_SID_PCIE0 0x1000>;
++ iommu-map-mask = <0x0>;
++ dma-coherent;
+
+- interrupts = <GIC_SPI 352 IRQ_TYPE_LEVEL_HIGH>, /* controller interrupt */
+- <GIC_SPI 353 IRQ_TYPE_LEVEL_HIGH>; /* MSI interrupt */
+- interrupt-names = "intr", "msi";
++ status = "disabled";
++ };
+
+- #interrupt-cells = <1>;
+- interrupt-map-mask = <0 0 0 0>;
+- interrupt-map = <0 0 0 0 &gic GIC_SPI 352 IRQ_TYPE_LEVEL_HIGH>;
++ pcie@141a0000 {
++ compatible = "nvidia,tegra234-pcie";
++ power-domains = <&bpmp TEGRA234_POWER_DOMAIN_PCIEX8A>;
++ reg = <0x00 0x141a0000 0x0 0x00020000>, /* appl registers (128K) */
++ <0x00 0x3a000000 0x0 0x00040000>, /* configuration space (256K) */
++ <0x00 0x3a040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */
++ <0x00 0x3a080000 0x0 0x00040000>, /* DBI reg space (256K) */
++ <0x2b 0x30000000 0x0 0x10000000>; /* ECAM (256MB) */
++ reg-names = "appl", "config", "atu_dma", "dbi", "ecam";
+
+- nvidia,bpmp = <&bpmp 6>;
++ #address-cells = <3>;
++ #size-cells = <2>;
++ device_type = "pci";
++ num-lanes = <8>;
++ num-viewport = <8>;
++ linux,pci-domain = <5>;
+
+- nvidia,aspm-cmrt-us = <60>;
+- nvidia,aspm-pwr-on-t-us = <20>;
+- nvidia,aspm-l0s-entrance-latency-us = <3>;
++ clocks = <&bpmp TEGRA234_CLK_PEX1_C5_CORE>;
++ clock-names = "core";
+
+- bus-range = <0x0 0xff>;
++ resets = <&bpmp TEGRA234_RESET_PEX1_CORE_5_APB>,
++ <&bpmp TEGRA234_RESET_PEX1_CORE_5>;
++ reset-names = "apb", "core";
+
+- ranges = <0x43000000 0x2b 0x40000000 0x2b 0x40000000 0x2 0xe8000000>, /* prefetchable memory (11904 MB) */
+- <0x02000000 0x0 0x40000000 0x2e 0x28000000 0x0 0x08000000>, /* non-prefetchable memory (128 MB) */
+- <0x01000000 0x0 0x3c100000 0x00 0x3c100000 0x0 0x00100000>; /* downstream I/O (1 MB) */
++ interrupts = <GIC_SPI 53 IRQ_TYPE_LEVEL_HIGH>, /* controller interrupt */
++ <GIC_SPI 54 IRQ_TYPE_LEVEL_HIGH>; /* MSI interrupt */
++ interrupt-names = "intr", "msi";
+
+- interconnects = <&mc TEGRA234_MEMORY_CLIENT_PCIE6AR &emc>,
+- <&mc TEGRA234_MEMORY_CLIENT_PCIE6AW &emc>;
+- interconnect-names = "dma-mem", "write";
+- iommu-map = <0x0 &smmu_niso0 TEGRA234_SID_PCIE6 0x1000>;
+- iommu-map-mask = <0x0>;
+- dma-coherent;
++ #interrupt-cells = <1>;
++ interrupt-map-mask = <0 0 0 0>;
++ interrupt-map = <0 0 0 0 &gic GIC_SPI 53 IRQ_TYPE_LEVEL_HIGH>;
+
+- status = "disabled";
+- };
++ nvidia,bpmp = <&bpmp 5>;
+
+- pcie@141e0000 {
+- compatible = "nvidia,tegra234-pcie";
+- power-domains = <&bpmp TEGRA234_POWER_DOMAIN_PCIEX8B>;
+- reg = <0x00 0x141e0000 0x0 0x00020000>, /* appl registers (128K) */
+- <0x00 0x3e000000 0x0 0x00040000>, /* configuration space (256K) */
+- <0x00 0x3e040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */
+- <0x00 0x3e080000 0x0 0x00040000>, /* DBI reg space (256K) */
+- <0x32 0x30000000 0x0 0x10000000>; /* ECAM (256MB) */
+- reg-names = "appl", "config", "atu_dma", "dbi", "ecam";
+-
+- #address-cells = <3>;
+- #size-cells = <2>;
+- device_type = "pci";
+- num-lanes = <8>;
+- num-viewport = <8>;
+- linux,pci-domain = <7>;
++ nvidia,aspm-cmrt-us = <60>;
++ nvidia,aspm-pwr-on-t-us = <20>;
++ nvidia,aspm-l0s-entrance-latency-us = <3>;
++
++ bus-range = <0x0 0xff>;
+
+- clocks = <&bpmp TEGRA234_CLK_PEX2_C7_CORE>;
+- clock-names = "core";
++ ranges = <0x43000000 0x28 0x00000000 0x28 0x00000000 0x3 0x28000000>, /* prefetchable memory (12928 MB) */
++ <0x02000000 0x0 0x40000000 0x2b 0x28000000 0x0 0x08000000>, /* non-prefetchable memory (128 MB) */
++ <0x01000000 0x0 0x3a100000 0x00 0x3a100000 0x0 0x00100000>; /* downstream I/O (1 MB) */
+
+- resets = <&bpmp TEGRA234_RESET_PEX2_CORE_7_APB>,
+- <&bpmp TEGRA234_RESET_PEX2_CORE_7>;
+- reset-names = "apb", "core";
++ interconnects = <&mc TEGRA234_MEMORY_CLIENT_PCIE5R &emc>,
++ <&mc TEGRA234_MEMORY_CLIENT_PCIE5W &emc>;
++ interconnect-names = "dma-mem", "write";
++ iommu-map = <0x0 &smmu_niso0 TEGRA234_SID_PCIE5 0x1000>;
++ iommu-map-mask = <0x0>;
++ dma-coherent;
+
+- interrupts = <GIC_SPI 354 IRQ_TYPE_LEVEL_HIGH>, /* controller interrupt */
+- <GIC_SPI 355 IRQ_TYPE_LEVEL_HIGH>; /* MSI interrupt */
+- interrupt-names = "intr", "msi";
++ status = "disabled";
++ };
+
+- #interrupt-cells = <1>;
+- interrupt-map-mask = <0 0 0 0>;
+- interrupt-map = <0 0 0 0 &gic GIC_SPI 354 IRQ_TYPE_LEVEL_HIGH>;
++ pcie-ep@141a0000 {
++ compatible = "nvidia,tegra234-pcie-ep";
++ power-domains = <&bpmp TEGRA234_POWER_DOMAIN_PCIEX8A>;
++ reg = <0x00 0x141a0000 0x0 0x00020000>, /* appl registers (128K) */
++ <0x00 0x3a040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */
++ <0x00 0x3a080000 0x0 0x00040000>, /* DBI reg space (256K) */
++ <0x27 0x40000000 0x4 0x00000000>; /* Address Space (16G) */
++ reg-names = "appl", "atu_dma", "dbi", "addr_space";
+
+- nvidia,bpmp = <&bpmp 7>;
++ num-lanes = <8>;
+
+- nvidia,aspm-cmrt-us = <60>;
+- nvidia,aspm-pwr-on-t-us = <20>;
+- nvidia,aspm-l0s-entrance-latency-us = <3>;
++ clocks = <&bpmp TEGRA234_CLK_PEX1_C5_CORE>;
++ clock-names = "core";
+
+- bus-range = <0x0 0xff>;
++ resets = <&bpmp TEGRA234_RESET_PEX1_CORE_5_APB>,
++ <&bpmp TEGRA234_RESET_PEX1_CORE_5>;
++ reset-names = "apb", "core";
+
+- ranges = <0x43000000 0x30 0x00000000 0x30 0x00000000 0x2 0x28000000>, /* prefetchable memory (8832 MB) */
+- <0x02000000 0x0 0x40000000 0x32 0x28000000 0x0 0x08000000>, /* non-prefetchable memory (128 MB) */
+- <0x01000000 0x0 0x3e100000 0x00 0x3e100000 0x0 0x00100000>; /* downstream I/O (1 MB) */
++ interrupts = <GIC_SPI 53 IRQ_TYPE_LEVEL_HIGH>; /* controller interrupt */
++ interrupt-names = "intr";
+
+- interconnects = <&mc TEGRA234_MEMORY_CLIENT_PCIE7AR &emc>,
+- <&mc TEGRA234_MEMORY_CLIENT_PCIE7AW &emc>;
+- interconnect-names = "dma-mem", "write";
+- iommu-map = <0x0 &smmu_niso1 TEGRA234_SID_PCIE7 0x1000>;
+- iommu-map-mask = <0x0>;
+- dma-coherent;
++ nvidia,bpmp = <&bpmp 5>;
+
+- status = "disabled";
+- };
++ nvidia,enable-ext-refclk;
++ nvidia,aspm-cmrt-us = <60>;
++ nvidia,aspm-pwr-on-t-us = <20>;
++ nvidia,aspm-l0s-entrance-latency-us = <3>;
++
++ interconnects = <&mc TEGRA234_MEMORY_CLIENT_PCIE5R &emc>,
++ <&mc TEGRA234_MEMORY_CLIENT_PCIE5W &emc>;
++ interconnect-names = "dma-mem", "write";
++ iommu-map = <0x0 &smmu_niso0 TEGRA234_SID_PCIE5 0x1000>;
++ iommu-map-mask = <0x0>;
++ dma-coherent;
+
+- pcie-ep@141a0000 {
+- compatible = "nvidia,tegra234-pcie-ep";
+- power-domains = <&bpmp TEGRA234_POWER_DOMAIN_PCIEX8A>;
+- reg = <0x00 0x141a0000 0x0 0x00020000>, /* appl registers (128K) */
+- <0x00 0x3a040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */
+- <0x00 0x3a080000 0x0 0x00040000>, /* DBI reg space (256K) */
+- <0x27 0x40000000 0x4 0x00000000>; /* Address Space (16G) */
+- reg-names = "appl", "atu_dma", "dbi", "addr_space";
++ status = "disabled";
++ };
+
+- num-lanes = <8>;
++ pcie@141c0000 {
++ compatible = "nvidia,tegra234-pcie";
++ power-domains = <&bpmp TEGRA234_POWER_DOMAIN_PCIEX4A>;
++ reg = <0x00 0x141c0000 0x0 0x00020000>, /* appl registers (128K) */
++ <0x00 0x3c000000 0x0 0x00040000>, /* configuration space (256K) */
++ <0x00 0x3c040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */
++ <0x00 0x3c080000 0x0 0x00040000>, /* DBI reg space (256K) */
++ <0x2e 0x30000000 0x0 0x10000000>; /* ECAM (256MB) */
++ reg-names = "appl", "config", "atu_dma", "dbi", "ecam";
+
+- clocks = <&bpmp TEGRA234_CLK_PEX1_C5_CORE>;
+- clock-names = "core";
++ #address-cells = <3>;
++ #size-cells = <2>;
++ device_type = "pci";
++ num-lanes = <4>;
++ num-viewport = <8>;
++ linux,pci-domain = <6>;
+
+- resets = <&bpmp TEGRA234_RESET_PEX1_CORE_5_APB>,
+- <&bpmp TEGRA234_RESET_PEX1_CORE_5>;
+- reset-names = "apb", "core";
++ clocks = <&bpmp TEGRA234_CLK_PEX1_C6_CORE>;
++ clock-names = "core";
+
+- interrupts = <GIC_SPI 53 IRQ_TYPE_LEVEL_HIGH>; /* controller interrupt */
+- interrupt-names = "intr";
++ resets = <&bpmp TEGRA234_RESET_PEX1_CORE_6_APB>,
++ <&bpmp TEGRA234_RESET_PEX1_CORE_6>;
++ reset-names = "apb", "core";
+
+- nvidia,bpmp = <&bpmp 5>;
++ interrupts = <GIC_SPI 352 IRQ_TYPE_LEVEL_HIGH>, /* controller interrupt */
++ <GIC_SPI 353 IRQ_TYPE_LEVEL_HIGH>; /* MSI interrupt */
++ interrupt-names = "intr", "msi";
+
+- nvidia,enable-ext-refclk;
+- nvidia,aspm-cmrt-us = <60>;
+- nvidia,aspm-pwr-on-t-us = <20>;
+- nvidia,aspm-l0s-entrance-latency-us = <3>;
++ #interrupt-cells = <1>;
++ interrupt-map-mask = <0 0 0 0>;
++ interrupt-map = <0 0 0 0 &gic GIC_SPI 352 IRQ_TYPE_LEVEL_HIGH>;
+
+- interconnects = <&mc TEGRA234_MEMORY_CLIENT_PCIE5R &emc>,
+- <&mc TEGRA234_MEMORY_CLIENT_PCIE5W &emc>;
+- interconnect-names = "dma-mem", "write";
+- iommu-map = <0x0 &smmu_niso0 TEGRA234_SID_PCIE5 0x1000>;
+- iommu-map-mask = <0x0>;
+- dma-coherent;
++ nvidia,bpmp = <&bpmp 6>;
+
+- status = "disabled";
+- };
++ nvidia,aspm-cmrt-us = <60>;
++ nvidia,aspm-pwr-on-t-us = <20>;
++ nvidia,aspm-l0s-entrance-latency-us = <3>;
+
+- pcie-ep@141c0000{
+- compatible = "nvidia,tegra234-pcie-ep";
+- power-domains = <&bpmp TEGRA234_POWER_DOMAIN_PCIEX4A>;
+- reg = <0x00 0x141c0000 0x0 0x00020000>, /* appl registers (128K) */
+- <0x00 0x3c040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */
+- <0x00 0x3c080000 0x0 0x00040000>, /* DBI space (256K) */
+- <0x2b 0x40000000 0x3 0x00000000>; /* Address Space (12G) */
+- reg-names = "appl", "atu_dma", "dbi", "addr_space";
++ bus-range = <0x0 0xff>;
+
+- num-lanes = <4>;
++ ranges = <0x43000000 0x2b 0x40000000 0x2b 0x40000000 0x2 0xe8000000>, /* prefetchable memory (11904 MB) */
++ <0x02000000 0x0 0x40000000 0x2e 0x28000000 0x0 0x08000000>, /* non-prefetchable memory (128 MB) */
++ <0x01000000 0x0 0x3c100000 0x00 0x3c100000 0x0 0x00100000>; /* downstream I/O (1 MB) */
+
+- clocks = <&bpmp TEGRA234_CLK_PEX1_C6_CORE>;
+- clock-names = "core";
++ interconnects = <&mc TEGRA234_MEMORY_CLIENT_PCIE6AR &emc>,
++ <&mc TEGRA234_MEMORY_CLIENT_PCIE6AW &emc>;
++ interconnect-names = "dma-mem", "write";
++ iommu-map = <0x0 &smmu_niso0 TEGRA234_SID_PCIE6 0x1000>;
++ iommu-map-mask = <0x0>;
++ dma-coherent;
+
+- resets = <&bpmp TEGRA234_RESET_PEX1_CORE_6_APB>,
+- <&bpmp TEGRA234_RESET_PEX1_CORE_6>;
+- reset-names = "apb", "core";
++ status = "disabled";
++ };
+
+- interrupts = <GIC_SPI 352 IRQ_TYPE_LEVEL_HIGH>; /* controller interrupt */
+- interrupt-names = "intr";
++ pcie-ep@141c0000 {
++ compatible = "nvidia,tegra234-pcie-ep";
++ power-domains = <&bpmp TEGRA234_POWER_DOMAIN_PCIEX4A>;
++ reg = <0x00 0x141c0000 0x0 0x00020000>, /* appl registers (128K) */
++ <0x00 0x3c040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */
++ <0x00 0x3c080000 0x0 0x00040000>, /* DBI space (256K) */
++ <0x2b 0x40000000 0x3 0x00000000>; /* Address Space (12G) */
++ reg-names = "appl", "atu_dma", "dbi", "addr_space";
+
+- nvidia,bpmp = <&bpmp 6>;
++ num-lanes = <4>;
+
+- nvidia,enable-ext-refclk;
+- nvidia,aspm-cmrt-us = <60>;
+- nvidia,aspm-pwr-on-t-us = <20>;
+- nvidia,aspm-l0s-entrance-latency-us = <3>;
++ clocks = <&bpmp TEGRA234_CLK_PEX1_C6_CORE>;
++ clock-names = "core";
+
+- interconnects = <&mc TEGRA234_MEMORY_CLIENT_PCIE6AR &emc>,
+- <&mc TEGRA234_MEMORY_CLIENT_PCIE6AW &emc>;
+- interconnect-names = "dma-mem", "write";
+- iommu-map = <0x0 &smmu_niso0 TEGRA234_SID_PCIE6 0x1000>;
+- iommu-map-mask = <0x0>;
+- dma-coherent;
++ resets = <&bpmp TEGRA234_RESET_PEX1_CORE_6_APB>,
++ <&bpmp TEGRA234_RESET_PEX1_CORE_6>;
++ reset-names = "apb", "core";
+
+- status = "disabled";
+- };
++ interrupts = <GIC_SPI 352 IRQ_TYPE_LEVEL_HIGH>; /* controller interrupt */
++ interrupt-names = "intr";
+
+- pcie-ep@141e0000{
+- compatible = "nvidia,tegra234-pcie-ep";
+- power-domains = <&bpmp TEGRA234_POWER_DOMAIN_PCIEX8B>;
+- reg = <0x00 0x141e0000 0x0 0x00020000>, /* appl registers (128K) */
+- <0x00 0x3e040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */
+- <0x00 0x3e080000 0x0 0x00040000>, /* DBI space (256K) */
+- <0x2e 0x40000000 0x4 0x00000000>; /* Address Space (16G) */
+- reg-names = "appl", "atu_dma", "dbi", "addr_space";
++ nvidia,bpmp = <&bpmp 6>;
+
+- num-lanes = <8>;
++ nvidia,enable-ext-refclk;
++ nvidia,aspm-cmrt-us = <60>;
++ nvidia,aspm-pwr-on-t-us = <20>;
++ nvidia,aspm-l0s-entrance-latency-us = <3>;
+
+- clocks = <&bpmp TEGRA234_CLK_PEX2_C7_CORE>;
+- clock-names = "core";
++ interconnects = <&mc TEGRA234_MEMORY_CLIENT_PCIE6AR &emc>,
++ <&mc TEGRA234_MEMORY_CLIENT_PCIE6AW &emc>;
++ interconnect-names = "dma-mem", "write";
++ iommu-map = <0x0 &smmu_niso0 TEGRA234_SID_PCIE6 0x1000>;
++ iommu-map-mask = <0x0>;
++ dma-coherent;
+
+- resets = <&bpmp TEGRA234_RESET_PEX2_CORE_7_APB>,
+- <&bpmp TEGRA234_RESET_PEX2_CORE_7>;
+- reset-names = "apb", "core";
++ status = "disabled";
++ };
+
+- interrupts = <GIC_SPI 354 IRQ_TYPE_LEVEL_HIGH>; /* controller interrupt */
+- interrupt-names = "intr";
++ pcie@141e0000 {
++ compatible = "nvidia,tegra234-pcie";
++ power-domains = <&bpmp TEGRA234_POWER_DOMAIN_PCIEX8B>;
++ reg = <0x00 0x141e0000 0x0 0x00020000>, /* appl registers (128K) */
++ <0x00 0x3e000000 0x0 0x00040000>, /* configuration space (256K) */
++ <0x00 0x3e040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */
++ <0x00 0x3e080000 0x0 0x00040000>, /* DBI reg space (256K) */
++ <0x32 0x30000000 0x0 0x10000000>; /* ECAM (256MB) */
++ reg-names = "appl", "config", "atu_dma", "dbi", "ecam";
+
+- nvidia,bpmp = <&bpmp 7>;
++ #address-cells = <3>;
++ #size-cells = <2>;
++ device_type = "pci";
++ num-lanes = <8>;
++ num-viewport = <8>;
++ linux,pci-domain = <7>;
+
+- nvidia,enable-ext-refclk;
+- nvidia,aspm-cmrt-us = <60>;
+- nvidia,aspm-pwr-on-t-us = <20>;
+- nvidia,aspm-l0s-entrance-latency-us = <3>;
++ clocks = <&bpmp TEGRA234_CLK_PEX2_C7_CORE>;
++ clock-names = "core";
+
+- interconnects = <&mc TEGRA234_MEMORY_CLIENT_PCIE7AR &emc>,
+- <&mc TEGRA234_MEMORY_CLIENT_PCIE7AW &emc>;
+- interconnect-names = "dma-mem", "write";
+- iommu-map = <0x0 &smmu_niso1 TEGRA234_SID_PCIE7 0x1000>;
+- iommu-map-mask = <0x0>;
+- dma-coherent;
++ resets = <&bpmp TEGRA234_RESET_PEX2_CORE_7_APB>,
++ <&bpmp TEGRA234_RESET_PEX2_CORE_7>;
++ reset-names = "apb", "core";
+
+- status = "disabled";
+- };
++ interrupts = <GIC_SPI 354 IRQ_TYPE_LEVEL_HIGH>, /* controller interrupt */
++ <GIC_SPI 355 IRQ_TYPE_LEVEL_HIGH>; /* MSI interrupt */
++ interrupt-names = "intr", "msi";
+
+- pcie-ep@140e0000{
+- compatible = "nvidia,tegra234-pcie-ep";
+- power-domains = <&bpmp TEGRA234_POWER_DOMAIN_PCIEX4CC>;
+- reg = <0x00 0x140e0000 0x0 0x00020000>, /* appl registers (128K) */
+- <0x00 0x2e040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */
+- <0x00 0x2e080000 0x0 0x00040000>, /* DBI space (256K) */
+- <0x38 0x40000000 0x3 0x00000000>; /* Address Space (12G) */
+- reg-names = "appl", "atu_dma", "dbi", "addr_space";
++ #interrupt-cells = <1>;
++ interrupt-map-mask = <0 0 0 0>;
++ interrupt-map = <0 0 0 0 &gic GIC_SPI 354 IRQ_TYPE_LEVEL_HIGH>;
+
+- num-lanes = <4>;
++ nvidia,bpmp = <&bpmp 7>;
+
+- clocks = <&bpmp TEGRA234_CLK_PEX2_C10_CORE>;
+- clock-names = "core";
++ nvidia,aspm-cmrt-us = <60>;
++ nvidia,aspm-pwr-on-t-us = <20>;
++ nvidia,aspm-l0s-entrance-latency-us = <3>;
+
+- resets = <&bpmp TEGRA234_RESET_PEX2_CORE_10_APB>,
+- <&bpmp TEGRA234_RESET_PEX2_CORE_10>;
+- reset-names = "apb", "core";
++ bus-range = <0x0 0xff>;
+
+- interrupts = <GIC_SPI 360 IRQ_TYPE_LEVEL_HIGH>; /* controller interrupt */
+- interrupt-names = "intr";
++ ranges = <0x43000000 0x30 0x00000000 0x30 0x00000000 0x2 0x28000000>, /* prefetchable memory (8832 MB) */
++ <0x02000000 0x0 0x40000000 0x32 0x28000000 0x0 0x08000000>, /* non-prefetchable memory (128 MB) */
++ <0x01000000 0x0 0x3e100000 0x00 0x3e100000 0x0 0x00100000>; /* downstream I/O (1 MB) */
+
+- nvidia,bpmp = <&bpmp 10>;
++ interconnects = <&mc TEGRA234_MEMORY_CLIENT_PCIE7AR &emc>,
++ <&mc TEGRA234_MEMORY_CLIENT_PCIE7AW &emc>;
++ interconnect-names = "dma-mem", "write";
++ iommu-map = <0x0 &smmu_niso1 TEGRA234_SID_PCIE7 0x1000>;
++ iommu-map-mask = <0x0>;
++ dma-coherent;
+
+- nvidia,enable-ext-refclk;
+- nvidia,aspm-cmrt-us = <60>;
+- nvidia,aspm-pwr-on-t-us = <20>;
+- nvidia,aspm-l0s-entrance-latency-us = <3>;
++ status = "disabled";
++ };
+
+- interconnects = <&mc TEGRA234_MEMORY_CLIENT_PCIE10AR &emc>,
+- <&mc TEGRA234_MEMORY_CLIENT_PCIE10AW &emc>;
+- interconnect-names = "dma-mem", "write";
+- iommu-map = <0x0 &smmu_niso1 TEGRA234_SID_PCIE10 0x1000>;
+- iommu-map-mask = <0x0>;
+- dma-coherent;
++ pcie-ep@141e0000 {
++ compatible = "nvidia,tegra234-pcie-ep";
++ power-domains = <&bpmp TEGRA234_POWER_DOMAIN_PCIEX8B>;
++ reg = <0x00 0x141e0000 0x0 0x00020000>, /* appl registers (128K) */
++ <0x00 0x3e040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */
++ <0x00 0x3e080000 0x0 0x00040000>, /* DBI space (256K) */
++ <0x2e 0x40000000 0x4 0x00000000>; /* Address Space (16G) */
++ reg-names = "appl", "atu_dma", "dbi", "addr_space";
+
+- status = "disabled";
++ num-lanes = <8>;
++
++ clocks = <&bpmp TEGRA234_CLK_PEX2_C7_CORE>;
++ clock-names = "core";
++
++ resets = <&bpmp TEGRA234_RESET_PEX2_CORE_7_APB>,
++ <&bpmp TEGRA234_RESET_PEX2_CORE_7>;
++ reset-names = "apb", "core";
++
++ interrupts = <GIC_SPI 354 IRQ_TYPE_LEVEL_HIGH>; /* controller interrupt */
++ interrupt-names = "intr";
++
++ nvidia,bpmp = <&bpmp 7>;
++
++ nvidia,enable-ext-refclk;
++ nvidia,aspm-cmrt-us = <60>;
++ nvidia,aspm-pwr-on-t-us = <20>;
++ nvidia,aspm-l0s-entrance-latency-us = <3>;
++
++ interconnects = <&mc TEGRA234_MEMORY_CLIENT_PCIE7AR &emc>,
++ <&mc TEGRA234_MEMORY_CLIENT_PCIE7AW &emc>;
++ interconnect-names = "dma-mem", "write";
++ iommu-map = <0x0 &smmu_niso1 TEGRA234_SID_PCIE7 0x1000>;
++ iommu-map-mask = <0x0>;
++ dma-coherent;
++
++ status = "disabled";
++ };
+ };
+
+ sram@40000000 {
+ compatible = "nvidia,tegra234-sysram", "mmio-sram";
+ reg = <0x0 0x40000000 0x0 0x80000>;
++
+ #address-cells = <1>;
+ #size-cells = <1>;
+ ranges = <0x0 0x0 0x40000000 0x80000>;
++
+ no-memory-wc;
+
+ cpu_bpmp_tx: sram@70000 {
+--
+2.39.2
+
--- /dev/null
+From e5efd358eaf31315be83dac9c298d409978e3606 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Nov 2022 07:35:31 +0100
+Subject: arm64: tegra: Fix duplicate regulator on Jetson TX1
+
+From: Thierry Reding <treding@nvidia.com>
+
+[ Upstream commit 29bcc1eaca315326d1cc883fbe9b451d1f9e3fa5 ]
+
+When the top-level regulators were renamed, the 1.2V camera regulator
+accidentally ended up with the same DT node name as the 1.8V camera
+regulator.
+
+Fixes: 097e01c61015 ("arm64: tegra: Rename top-level regulators")
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/nvidia/tegra210-p2597.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/nvidia/tegra210-p2597.dtsi b/arch/arm64/boot/dts/nvidia/tegra210-p2597.dtsi
+index dd9a17922fe5c..a87e103f3828d 100644
+--- a/arch/arm64/boot/dts/nvidia/tegra210-p2597.dtsi
++++ b/arch/arm64/boot/dts/nvidia/tegra210-p2597.dtsi
+@@ -1667,7 +1667,7 @@ vdd_hdmi: regulator-vdd-hdmi {
+ vin-supply = <&vdd_5v0_sys>;
+ };
+
+- vdd_cam_1v2: regulator-vdd-cam-1v8 {
++ vdd_cam_1v2: regulator-vdd-cam-1v2 {
+ compatible = "regulator-fixed";
+ regulator-name = "vdd-cam-1v2";
+ regulator-min-microvolt = <1200000>;
+--
+2.39.2
+
--- /dev/null
+From 066815380e4ea16ec3801ed28e85f56c0fa0cd6d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Jan 2023 15:38:58 +0200
+Subject: arm64: tegra: Mark host1x as dma-coherent on Tegra194/234
+
+From: Mikko Perttunen <mperttunen@nvidia.com>
+
+[ Upstream commit 361238cdc52523fd7b1f3aa447c0579f42448b00 ]
+
+Ensure appropriate configuration is done to make the host1x device
+and context devices DMA coherent by adding the dma-coherent flag.
+
+Fixes: b35f5b53a87b ("arm64: tegra: Add context isolation domains on Tegra234")
+Signed-off-by: Mikko Perttunen <mperttunen@nvidia.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/nvidia/tegra194.dtsi | 1 +
+ arch/arm64/boot/dts/nvidia/tegra234.dtsi | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/nvidia/tegra194.dtsi b/arch/arm64/boot/dts/nvidia/tegra194.dtsi
+index 45a204d753b1b..76c672d2196be 100644
+--- a/arch/arm64/boot/dts/nvidia/tegra194.dtsi
++++ b/arch/arm64/boot/dts/nvidia/tegra194.dtsi
+@@ -1922,6 +1922,7 @@ host1x@13e00000 {
+ interconnects = <&mc TEGRA194_MEMORY_CLIENT_HOST1XDMAR &emc>;
+ interconnect-names = "dma-mem";
+ iommus = <&smmu TEGRA194_SID_HOST1X>;
++ dma-coherent;
+
+ /* Context isolation domains */
+ iommu-map = <0 &smmu TEGRA194_SID_HOST1X_CTX0 1>,
+diff --git a/arch/arm64/boot/dts/nvidia/tegra234.dtsi b/arch/arm64/boot/dts/nvidia/tegra234.dtsi
+index 7a3112c82cdc7..cee86dcb68712 100644
+--- a/arch/arm64/boot/dts/nvidia/tegra234.dtsi
++++ b/arch/arm64/boot/dts/nvidia/tegra234.dtsi
+@@ -1967,6 +1967,7 @@ host1x@13e00000 {
+ interconnects = <&mc TEGRA234_MEMORY_CLIENT_HOST1XDMAR &emc>;
+ interconnect-names = "dma-mem";
+ iommus = <&smmu_niso1 TEGRA234_SID_HOST1X>;
++ dma-coherent;
+
+ /* Context isolation domains */
+ iommu-map = <0 &smmu_niso0 TEGRA234_SID_HOST1X_CTX0 1>,
+--
+2.39.2
+
--- /dev/null
+From 664c3f15ccaaab88786afefefb664c5283b9645e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Nov 2022 11:25:05 +0100
+Subject: arm64: tegra: Sort nodes by unit-address, then alphabetically
+
+From: Thierry Reding <treding@nvidia.com>
+
+[ Upstream commit 79ed18d9ece474c15a2578e1cc5bfb4fce7a8eb7 ]
+
+Nodes in device tree should be sorted by unit-address, followed by nodes
+without a unit-address, sorted alphabetically. Some exceptions are the
+top-level aliases, chosen, firmware, memory and reserved-memory nodes,
+which are expected to come first.
+
+These rules apply recursively with some exceptions, such as pinmux nodes
+or regulator nodes, which often follow more complicated ordering (often
+by "importance").
+
+While at it, change the name of some of the nodes to follow standard
+naming conventions, which helps with the sorting order and reduces the
+amount of warnings from the DT validation tools.
+
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Stable-dep-of: 361238cdc525 ("arm64: tegra: Mark host1x as dma-coherent on Tegra194/234")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../arm64/boot/dts/nvidia/tegra132-norrin.dts | 16 +-
+ arch/arm64/boot/dts/nvidia/tegra132.dtsi | 232 +-
+ .../boot/dts/nvidia/tegra186-p2771-0000.dts | 2564 ++++++++---------
+ .../arm64/boot/dts/nvidia/tegra186-p3310.dtsi | 86 +-
+ .../nvidia/tegra186-p3509-0000+p3636-0001.dts | 1730 +++++------
+ arch/arm64/boot/dts/nvidia/tegra186.dtsi | 470 +--
+ .../arm64/boot/dts/nvidia/tegra194-p2888.dtsi | 36 +-
+ .../boot/dts/nvidia/tegra194-p2972-0000.dts | 2322 +++++++--------
+ .../boot/dts/nvidia/tegra194-p3509-0000.dtsi | 2435 ++++++++--------
+ .../arm64/boot/dts/nvidia/tegra194-p3668.dtsi | 36 +-
+ arch/arm64/boot/dts/nvidia/tegra194.dtsi | 519 ++--
+ .../arm64/boot/dts/nvidia/tegra210-p2180.dtsi | 66 +-
+ .../boot/dts/nvidia/tegra210-p2371-2180.dts | 278 +-
+ .../arm64/boot/dts/nvidia/tegra210-p2595.dtsi | 3 +
+ .../arm64/boot/dts/nvidia/tegra210-p2597.dtsi | 3 +
+ .../arm64/boot/dts/nvidia/tegra210-p2894.dtsi | 86 +-
+ .../boot/dts/nvidia/tegra210-p3450-0000.dts | 384 +--
+ arch/arm64/boot/dts/nvidia/tegra210-smaug.dts | 66 +-
+ arch/arm64/boot/dts/nvidia/tegra210.dtsi | 310 +-
+ .../boot/dts/nvidia/tegra234-p3701-0000.dtsi | 70 +-
+ .../nvidia/tegra234-p3737-0000+p3701-0000.dts | 2486 ++++++++--------
+ arch/arm64/boot/dts/nvidia/tegra234.dtsi | 390 +--
+ 22 files changed, 7297 insertions(+), 7291 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/nvidia/tegra132-norrin.dts b/arch/arm64/boot/dts/nvidia/tegra132-norrin.dts
+index 3e8dee85d55f2..d4c034ac12447 100644
+--- a/arch/arm64/boot/dts/nvidia/tegra132-norrin.dts
++++ b/arch/arm64/boot/dts/nvidia/tegra132-norrin.dts
+@@ -1030,6 +1030,14 @@ clk32k_in: clock-32k {
+ gpio-keys {
+ compatible = "gpio-keys";
+
++ key-power {
++ label = "Power";
++ gpios = <&gpio TEGRA_GPIO(Q, 0) GPIO_ACTIVE_LOW>;
++ linux,code = <KEY_POWER>;
++ debounce-interval = <10>;
++ wakeup-source;
++ };
++
+ switch-lid {
+ label = "Lid";
+ gpios = <&gpio TEGRA_GPIO(R, 4) GPIO_ACTIVE_LOW>;
+@@ -1038,14 +1046,6 @@ switch-lid {
+ debounce-interval = <1>;
+ wakeup-source;
+ };
+-
+- key-power {
+- label = "Power";
+- gpios = <&gpio TEGRA_GPIO(Q, 0) GPIO_ACTIVE_LOW>;
+- linux,code = <KEY_POWER>;
+- debounce-interval = <10>;
+- wakeup-source;
+- };
+ };
+
+ panel: panel {
+diff --git a/arch/arm64/boot/dts/nvidia/tegra132.dtsi b/arch/arm64/boot/dts/nvidia/tegra132.dtsi
+index 858fc01cecb69..c017764bc27e9 100644
+--- a/arch/arm64/boot/dts/nvidia/tegra132.dtsi
++++ b/arch/arm64/boot/dts/nvidia/tegra132.dtsi
+@@ -893,122 +893,6 @@ throttle_heavy: heavy {
+ };
+ };
+
+- thermal-zones {
+- cpu-thermal {
+- polling-delay-passive = <1000>;
+- polling-delay = <0>;
+-
+- thermal-sensors =
+- <&soctherm TEGRA124_SOCTHERM_SENSOR_CPU>;
+-
+- trips {
+- cpu_shutdown_trip {
+- temperature = <105000>;
+- hysteresis = <1000>;
+- type = "critical";
+- };
+-
+- cpu_throttle_trip: throttle-trip {
+- temperature = <102000>;
+- hysteresis = <1000>;
+- type = "hot";
+- };
+- };
+-
+- cooling-maps {
+- map0 {
+- trip = <&cpu_throttle_trip>;
+- cooling-device = <&throttle_heavy 1 1>;
+- };
+- };
+- };
+-
+- mem-thermal {
+- polling-delay-passive = <0>;
+- polling-delay = <0>;
+-
+- thermal-sensors =
+- <&soctherm TEGRA124_SOCTHERM_SENSOR_MEM>;
+-
+- trips {
+- mem_shutdown_trip {
+- temperature = <101000>;
+- hysteresis = <1000>;
+- type = "critical";
+- };
+- mem_throttle_trip {
+- temperature = <99000>;
+- hysteresis = <1000>;
+- type = "hot";
+- };
+- };
+-
+- cooling-maps {
+- /*
+- * There are currently no cooling maps,
+- * because there are no cooling devices.
+- */
+- };
+- };
+-
+- gpu-thermal {
+- polling-delay-passive = <1000>;
+- polling-delay = <0>;
+-
+- thermal-sensors =
+- <&soctherm TEGRA124_SOCTHERM_SENSOR_GPU>;
+-
+- trips {
+- gpu_shutdown_trip {
+- temperature = <101000>;
+- hysteresis = <1000>;
+- type = "critical";
+- };
+-
+- gpu_throttle_trip: throttle-trip {
+- temperature = <99000>;
+- hysteresis = <1000>;
+- type = "hot";
+- };
+- };
+-
+- cooling-maps {
+- map0 {
+- trip = <&gpu_throttle_trip>;
+- cooling-device = <&throttle_heavy 1 1>;
+- };
+- };
+- };
+-
+- pllx-thermal {
+- polling-delay-passive = <0>;
+- polling-delay = <0>;
+-
+- thermal-sensors =
+- <&soctherm TEGRA124_SOCTHERM_SENSOR_PLLX>;
+-
+- trips {
+- pllx_shutdown_trip {
+- temperature = <105000>;
+- hysteresis = <1000>;
+- type = "critical";
+- };
+- pllx_throttle_trip {
+- temperature = <99000>;
+- hysteresis = <1000>;
+- type = "hot";
+- };
+- };
+-
+- cooling-maps {
+- /*
+- * There are currently no cooling maps,
+- * because there are no cooling devices.
+- */
+- };
+- };
+- };
+-
+ ahub@70300000 {
+ compatible = "nvidia,tegra124-ahub";
+ reg = <0x0 0x70300000 0x0 0x200>,
+@@ -1255,6 +1139,122 @@ cpu@1 {
+ };
+ };
+
++ thermal-zones {
++ cpu-thermal {
++ polling-delay-passive = <1000>;
++ polling-delay = <0>;
++
++ thermal-sensors =
++ <&soctherm TEGRA124_SOCTHERM_SENSOR_CPU>;
++
++ trips {
++ cpu_shutdown_trip {
++ temperature = <105000>;
++ hysteresis = <1000>;
++ type = "critical";
++ };
++
++ cpu_throttle_trip: throttle-trip {
++ temperature = <102000>;
++ hysteresis = <1000>;
++ type = "hot";
++ };
++ };
++
++ cooling-maps {
++ map0 {
++ trip = <&cpu_throttle_trip>;
++ cooling-device = <&throttle_heavy 1 1>;
++ };
++ };
++ };
++
++ mem-thermal {
++ polling-delay-passive = <0>;
++ polling-delay = <0>;
++
++ thermal-sensors =
++ <&soctherm TEGRA124_SOCTHERM_SENSOR_MEM>;
++
++ trips {
++ mem_shutdown_trip {
++ temperature = <101000>;
++ hysteresis = <1000>;
++ type = "critical";
++ };
++ mem_throttle_trip {
++ temperature = <99000>;
++ hysteresis = <1000>;
++ type = "hot";
++ };
++ };
++
++ cooling-maps {
++ /*
++ * There are currently no cooling maps,
++ * because there are no cooling devices.
++ */
++ };
++ };
++
++ gpu-thermal {
++ polling-delay-passive = <1000>;
++ polling-delay = <0>;
++
++ thermal-sensors =
++ <&soctherm TEGRA124_SOCTHERM_SENSOR_GPU>;
++
++ trips {
++ gpu_shutdown_trip {
++ temperature = <101000>;
++ hysteresis = <1000>;
++ type = "critical";
++ };
++
++ gpu_throttle_trip: throttle-trip {
++ temperature = <99000>;
++ hysteresis = <1000>;
++ type = "hot";
++ };
++ };
++
++ cooling-maps {
++ map0 {
++ trip = <&gpu_throttle_trip>;
++ cooling-device = <&throttle_heavy 1 1>;
++ };
++ };
++ };
++
++ pllx-thermal {
++ polling-delay-passive = <0>;
++ polling-delay = <0>;
++
++ thermal-sensors =
++ <&soctherm TEGRA124_SOCTHERM_SENSOR_PLLX>;
++
++ trips {
++ pllx_shutdown_trip {
++ temperature = <105000>;
++ hysteresis = <1000>;
++ type = "critical";
++ };
++ pllx_throttle_trip {
++ temperature = <99000>;
++ hysteresis = <1000>;
++ type = "hot";
++ };
++ };
++
++ cooling-maps {
++ /*
++ * There are currently no cooling maps,
++ * because there are no cooling devices.
++ */
++ };
++ };
++ };
++
+ timer {
+ compatible = "arm,armv7-timer";
+ interrupts = <GIC_PPI 13
+diff --git a/arch/arm64/boot/dts/nvidia/tegra186-p2771-0000.dts b/arch/arm64/boot/dts/nvidia/tegra186-p2771-0000.dts
+index 47cf2013afcc3..15aa49fc45039 100644
+--- a/arch/arm64/boot/dts/nvidia/tegra186-p2771-0000.dts
++++ b/arch/arm64/boot/dts/nvidia/tegra186-p2771-0000.dts
+@@ -13,922 +13,984 @@ / {
+ aconnect@2900000 {
+ status = "okay";
+
+- dma-controller@2930000 {
+- status = "okay";
+- };
+-
+- interrupt-controller@2a40000 {
+- status = "okay";
+- };
+-
+ ahub@2900800 {
+ status = "okay";
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ i2s@2901000 {
++ status = "okay";
+
+- port@0 {
+- reg = <0x0>;
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- xbar_admaif0_ep: endpoint {
+- remote-endpoint = <&admaif0_ep>;
++ port@0 {
++ reg = <0>;
++
++ i2s1_cif_ep: endpoint {
++ remote-endpoint = <&xbar_i2s1_ep>;
++ };
+ };
+- };
+
+- port@1 {
+- reg = <0x1>;
++ i2s1_port: port@1 {
++ reg = <1>;
+
+- xbar_admaif1_ep: endpoint {
+- remote-endpoint = <&admaif1_ep>;
++ i2s1_dap_ep: endpoint {
++ dai-format = "i2s";
++ /* Placeholder for external Codec */
++ };
+ };
+ };
++ };
+
+- port@2 {
+- reg = <0x2>;
++ i2s@2901100 {
++ status = "okay";
+
+- xbar_admaif2_ep: endpoint {
+- remote-endpoint = <&admaif2_ep>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- port@3 {
+- reg = <0x3>;
++ port@0 {
++ reg = <0>;
+
+- xbar_admaif3_ep: endpoint {
+- remote-endpoint = <&admaif3_ep>;
++ i2s2_cif_ep: endpoint {
++ remote-endpoint = <&xbar_i2s2_ep>;
++ };
+ };
+- };
+
+- port@4 {
+- reg = <0x4>;
++ i2s2_port: port@1 {
++ reg = <1>;
+
+- xbar_admaif4_ep: endpoint {
+- remote-endpoint = <&admaif4_ep>;
++ i2s2_dap_ep: endpoint {
++ dai-format = "i2s";
++ /* Placeholder for external Codec */
++ };
+ };
+ };
++ };
+
+- port@5 {
+- reg = <0x5>;
++ i2s@2901200 {
++ status = "okay";
+
+- xbar_admaif5_ep: endpoint {
+- remote-endpoint = <&admaif5_ep>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- port@6 {
+- reg = <0x6>;
++ port@0 {
++ reg = <0>;
+
+- xbar_admaif6_ep: endpoint {
+- remote-endpoint = <&admaif6_ep>;
++ i2s3_cif_ep: endpoint {
++ remote-endpoint = <&xbar_i2s3_ep>;
++ };
+ };
+- };
+
+- port@7 {
+- reg = <0x7>;
++ i2s3_port: port@1 {
++ reg = <1>;
+
+- xbar_admaif7_ep: endpoint {
+- remote-endpoint = <&admaif7_ep>;
++ i2s3_dap_ep: endpoint {
++ dai-format = "i2s";
++ /* Placeholder for external Codec */
++ };
+ };
+ };
++ };
+
+- port@8 {
+- reg = <0x8>;
++ i2s@2901300 {
++ status = "okay";
+
+- xbar_admaif8_ep: endpoint {
+- remote-endpoint = <&admaif8_ep>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- port@9 {
+- reg = <0x9>;
++ port@0 {
++ reg = <0>;
+
+- xbar_admaif9_ep: endpoint {
+- remote-endpoint = <&admaif9_ep>;
++ i2s4_cif_ep: endpoint {
++ remote-endpoint = <&xbar_i2s4_ep>;
++ };
+ };
+- };
+
+- port@a {
+- reg = <0xa>;
++ i2s4_port: port@1 {
++ reg = <1>;
+
+- xbar_admaif10_ep: endpoint {
+- remote-endpoint = <&admaif10_ep>;
++ i2s4_dap_ep: endpoint {
++ dai-format = "i2s";
++ /* Placeholder for external Codec */
++ };
+ };
+ };
++ };
+
+- port@b {
+- reg = <0xb>;
++ i2s@2901400 {
++ status = "okay";
+
+- xbar_admaif11_ep: endpoint {
+- remote-endpoint = <&admaif11_ep>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- port@c {
+- reg = <0xc>;
++ port@0 {
++ reg = <0>;
+
+- xbar_admaif12_ep: endpoint {
+- remote-endpoint = <&admaif12_ep>;
++ i2s5_cif_ep: endpoint {
++ remote-endpoint = <&xbar_i2s5_ep>;
++ };
+ };
+- };
+
+- port@d {
+- reg = <0xd>;
++ i2s5_port: port@1 {
++ reg = <1>;
+
+- xbar_admaif13_ep: endpoint {
+- remote-endpoint = <&admaif13_ep>;
++ i2s5_dap_ep: endpoint {
++ dai-format = "i2s";
++ /* Placeholder for external Codec */
++ };
+ };
+ };
++ };
+
+- port@e {
+- reg = <0xe>;
++ i2s@2901500 {
++ status = "okay";
+
+- xbar_admaif14_ep: endpoint {
+- remote-endpoint = <&admaif14_ep>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- port@f {
+- reg = <0xf>;
++ port@0 {
++ reg = <0>;
+
+- xbar_admaif15_ep: endpoint {
+- remote-endpoint = <&admaif15_ep>;
++ i2s6_cif_ep: endpoint {
++ remote-endpoint = <&xbar_i2s6_ep>;
++ };
+ };
+- };
+
+- port@10 {
+- reg = <0x10>;
++ i2s6_port: port@1 {
++ reg = <1>;
+
+- xbar_admaif16_ep: endpoint {
+- remote-endpoint = <&admaif16_ep>;
++ i2s6_dap_ep: endpoint {
++ dai-format = "i2s";
++ /* Placeholder for external Codec */
++ };
+ };
+ };
++ };
+
+- port@11 {
+- reg = <0x11>;
++ sfc@2902000 {
++ status = "okay";
+
+- xbar_admaif17_ep: endpoint {
+- remote-endpoint = <&admaif17_ep>;
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
++
++ port@0 {
++ reg = <0>;
++
++ sfc1_cif_in_ep: endpoint {
++ remote-endpoint = <&xbar_sfc1_in_ep>;
++ convert-rate = <44100>;
++ };
+ };
+- };
+
+- port@12 {
+- reg = <0x12>;
++ sfc1_out_port: port@1 {
++ reg = <1>;
+
+- xbar_admaif18_ep: endpoint {
+- remote-endpoint = <&admaif18_ep>;
++ sfc1_cif_out_ep: endpoint {
++ remote-endpoint = <&xbar_sfc1_out_ep>;
++ convert-rate = <48000>;
++ };
+ };
+ };
++ };
+
+- port@13 {
+- reg = <0x13>;
++ sfc@2902200 {
++ status = "okay";
+
+- xbar_admaif19_ep: endpoint {
+- remote-endpoint = <&admaif19_ep>;
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
++
++ port@0 {
++ reg = <0>;
++
++ sfc2_cif_in_ep: endpoint {
++ remote-endpoint = <&xbar_sfc2_in_ep>;
++ };
+ };
+- };
+
+- xbar_i2s1_port: port@14 {
+- reg = <0x14>;
++ sfc2_out_port: port@1 {
++ reg = <1>;
+
+- xbar_i2s1_ep: endpoint {
+- remote-endpoint = <&i2s1_cif_ep>;
++ sfc2_cif_out_ep: endpoint {
++ remote-endpoint = <&xbar_sfc2_out_ep>;
++ };
+ };
+ };
++ };
++
++ sfc@2902400 {
++ status = "okay";
++
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- xbar_i2s2_port: port@15 {
+- reg = <0x15>;
++ port@0 {
++ reg = <0>;
+
+- xbar_i2s2_ep: endpoint {
+- remote-endpoint = <&i2s2_cif_ep>;
++ sfc3_cif_in_ep: endpoint {
++ remote-endpoint = <&xbar_sfc3_in_ep>;
++ };
+ };
+- };
+
+- xbar_i2s3_port: port@16 {
+- reg = <0x16>;
++ sfc3_out_port: port@1 {
++ reg = <1>;
+
+- xbar_i2s3_ep: endpoint {
+- remote-endpoint = <&i2s3_cif_ep>;
++ sfc3_cif_out_ep: endpoint {
++ remote-endpoint = <&xbar_sfc3_out_ep>;
++ };
+ };
+ };
++ };
+
+- xbar_i2s4_port: port@17 {
+- reg = <0x17>;
++ sfc@2902600 {
++ status = "okay";
+
+- xbar_i2s4_ep: endpoint {
+- remote-endpoint = <&i2s4_cif_ep>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- xbar_i2s5_port: port@18 {
+- reg = <0x18>;
++ port@0 {
++ reg = <0>;
+
+- xbar_i2s5_ep: endpoint {
+- remote-endpoint = <&i2s5_cif_ep>;
++ sfc4_cif_in_ep: endpoint {
++ remote-endpoint = <&xbar_sfc4_in_ep>;
++ };
+ };
+- };
+
+- xbar_i2s6_port: port@19 {
+- reg = <0x19>;
++ sfc4_out_port: port@1 {
++ reg = <1>;
+
+- xbar_i2s6_ep: endpoint {
+- remote-endpoint = <&i2s6_cif_ep>;
++ sfc4_cif_out_ep: endpoint {
++ remote-endpoint = <&xbar_sfc4_out_ep>;
++ };
+ };
+ };
++ };
+
+- xbar_dmic1_port: port@1a {
+- reg = <0x1a>;
++ amx@2903000 {
++ status = "okay";
+
+- xbar_dmic1_ep: endpoint {
+- remote-endpoint = <&dmic1_cif_ep>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- xbar_dmic2_port: port@1b {
+- reg = <0x1b>;
++ port@0 {
++ reg = <0>;
+
+- xbar_dmic2_ep: endpoint {
+- remote-endpoint = <&dmic2_cif_ep>;
++ amx1_in1_ep: endpoint {
++ remote-endpoint = <&xbar_amx1_in1_ep>;
++ };
+ };
+- };
+
+- xbar_dmic3_port: port@1c {
+- reg = <0x1c>;
++ port@1 {
++ reg = <1>;
+
+- xbar_dmic3_ep: endpoint {
+- remote-endpoint = <&dmic3_cif_ep>;
++ amx1_in2_ep: endpoint {
++ remote-endpoint = <&xbar_amx1_in2_ep>;
++ };
+ };
+- };
+
+- xbar_dspk1_port: port@1e {
+- reg = <0x1e>;
++ port@2 {
++ reg = <2>;
+
+- xbar_dspk1_ep: endpoint {
+- remote-endpoint = <&dspk1_cif_ep>;
++ amx1_in3_ep: endpoint {
++ remote-endpoint = <&xbar_amx1_in3_ep>;
++ };
+ };
+- };
+
+- xbar_dspk2_port: port@1f {
+- reg = <0x1f>;
++ port@3 {
++ reg = <3>;
+
+- xbar_dspk2_ep: endpoint {
+- remote-endpoint = <&dspk2_cif_ep>;
++ amx1_in4_ep: endpoint {
++ remote-endpoint = <&xbar_amx1_in4_ep>;
++ };
+ };
+- };
+
+- xbar_sfc1_in_port: port@20 {
+- reg = <0x20>;
++ amx1_out_port: port@4 {
++ reg = <4>;
+
+- xbar_sfc1_in_ep: endpoint {
+- remote-endpoint = <&sfc1_cif_in_ep>;
++ amx1_out_ep: endpoint {
++ remote-endpoint = <&xbar_amx1_out_ep>;
++ };
+ };
+ };
++ };
+
+- port@21 {
+- reg = <0x21>;
++ amx@2903100 {
++ status = "okay";
+
+- xbar_sfc1_out_ep: endpoint {
+- remote-endpoint = <&sfc1_cif_out_ep>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- xbar_sfc2_in_port: port@22 {
+- reg = <0x22>;
++ port@0 {
++ reg = <0>;
+
+- xbar_sfc2_in_ep: endpoint {
+- remote-endpoint = <&sfc2_cif_in_ep>;
++ amx2_in1_ep: endpoint {
++ remote-endpoint = <&xbar_amx2_in1_ep>;
++ };
+ };
+- };
+
+- port@23 {
+- reg = <0x23>;
++ port@1 {
++ reg = <1>;
+
+- xbar_sfc2_out_ep: endpoint {
+- remote-endpoint = <&sfc2_cif_out_ep>;
++ amx2_in2_ep: endpoint {
++ remote-endpoint = <&xbar_amx2_in2_ep>;
++ };
+ };
+- };
+
+- xbar_sfc3_in_port: port@24 {
+- reg = <0x24>;
++ amx2_in3_port: port@2 {
++ reg = <2>;
+
+- xbar_sfc3_in_ep: endpoint {
+- remote-endpoint = <&sfc3_cif_in_ep>;
++ amx2_in3_ep: endpoint {
++ remote-endpoint = <&xbar_amx2_in3_ep>;
++ };
+ };
+- };
+
+- port@25 {
+- reg = <0x25>;
++ amx2_in4_port: port@3 {
++ reg = <3>;
+
+- xbar_sfc3_out_ep: endpoint {
+- remote-endpoint = <&sfc3_cif_out_ep>;
++ amx2_in4_ep: endpoint {
++ remote-endpoint = <&xbar_amx2_in4_ep>;
++ };
+ };
+- };
+
+- xbar_sfc4_in_port: port@26 {
+- reg = <0x26>;
++ amx2_out_port: port@4 {
++ reg = <4>;
+
+- xbar_sfc4_in_ep: endpoint {
+- remote-endpoint = <&sfc4_cif_in_ep>;
++ amx2_out_ep: endpoint {
++ remote-endpoint = <&xbar_amx2_out_ep>;
++ };
+ };
+ };
++ };
+
+- port@27 {
+- reg = <0x27>;
++ amx@2903200 {
++ status = "okay";
+
+- xbar_sfc4_out_ep: endpoint {
+- remote-endpoint = <&sfc4_cif_out_ep>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- xbar_mvc1_in_port: port@28 {
+- reg = <0x28>;
++ port@0 {
++ reg = <0>;
+
+- xbar_mvc1_in_ep: endpoint {
+- remote-endpoint = <&mvc1_cif_in_ep>;
++ amx3_in1_ep: endpoint {
++ remote-endpoint = <&xbar_amx3_in1_ep>;
++ };
+ };
+- };
+
+- port@29 {
+- reg = <0x29>;
++ port@1 {
++ reg = <1>;
+
+- xbar_mvc1_out_ep: endpoint {
+- remote-endpoint = <&mvc1_cif_out_ep>;
++ amx3_in2_ep: endpoint {
++ remote-endpoint = <&xbar_amx3_in2_ep>;
++ };
+ };
+- };
+
+- xbar_mvc2_in_port: port@2a {
+- reg = <0x2a>;
++ port@2 {
++ reg = <2>;
+
+- xbar_mvc2_in_ep: endpoint {
+- remote-endpoint = <&mvc2_cif_in_ep>;
++ amx3_in3_ep: endpoint {
++ remote-endpoint = <&xbar_amx3_in3_ep>;
++ };
+ };
+- };
+
+- port@2b {
+- reg = <0x2b>;
++ port@3 {
++ reg = <3>;
+
+- xbar_mvc2_out_ep: endpoint {
+- remote-endpoint = <&mvc2_cif_out_ep>;
++ amx3_in4_ep: endpoint {
++ remote-endpoint = <&xbar_amx3_in4_ep>;
++ };
+ };
+- };
+
+- xbar_amx1_in1_port: port@2c {
+- reg = <0x2c>;
++ amx3_out_port: port@4 {
++ reg = <4>;
+
+- xbar_amx1_in1_ep: endpoint {
+- remote-endpoint = <&amx1_in1_ep>;
++ amx3_out_ep: endpoint {
++ remote-endpoint = <&xbar_amx3_out_ep>;
++ };
+ };
+ };
++ };
+
+- xbar_amx1_in2_port: port@2d {
+- reg = <0x2d>;
++ amx@2903300 {
++ status = "okay";
+
+- xbar_amx1_in2_ep: endpoint {
+- remote-endpoint = <&amx1_in2_ep>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- xbar_amx1_in3_port: port@2e {
+- reg = <0x2e>;
++ port@0 {
++ reg = <0>;
+
+- xbar_amx1_in3_ep: endpoint {
+- remote-endpoint = <&amx1_in3_ep>;
++ amx4_in1_ep: endpoint {
++ remote-endpoint = <&xbar_amx4_in1_ep>;
++ };
+ };
+- };
+
+- xbar_amx1_in4_port: port@2f {
+- reg = <0x2f>;
++ port@1 {
++ reg = <1>;
+
+- xbar_amx1_in4_ep: endpoint {
+- remote-endpoint = <&amx1_in4_ep>;
++ amx4_in2_ep: endpoint {
++ remote-endpoint = <&xbar_amx4_in2_ep>;
++ };
+ };
+- };
+
+- port@30 {
+- reg = <0x30>;
++ port@2 {
++ reg = <2>;
+
+- xbar_amx1_out_ep: endpoint {
+- remote-endpoint = <&amx1_out_ep>;
++ amx4_in3_ep: endpoint {
++ remote-endpoint = <&xbar_amx4_in3_ep>;
++ };
+ };
+- };
+
+- xbar_amx2_in1_port: port@31 {
+- reg = <0x31>;
++ port@3 {
++ reg = <3>;
+
+- xbar_amx2_in1_ep: endpoint {
+- remote-endpoint = <&amx2_in1_ep>;
++ amx4_in4_ep: endpoint {
++ remote-endpoint = <&xbar_amx4_in4_ep>;
++ };
+ };
+- };
+
+- xbar_amx2_in2_port: port@32 {
+- reg = <0x32>;
++ amx4_out_port: port@4 {
++ reg = <4>;
+
+- xbar_amx2_in2_ep: endpoint {
+- remote-endpoint = <&amx2_in2_ep>;
++ amx4_out_ep: endpoint {
++ remote-endpoint = <&xbar_amx4_out_ep>;
++ };
+ };
+ };
++ };
+
+- xbar_amx2_in3_port: port@33 {
+- reg = <0x33>;
++ adx@2903800 {
++ status = "okay";
+
+- xbar_amx2_in3_ep: endpoint {
+- remote-endpoint = <&amx2_in3_ep>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- xbar_amx2_in4_port: port@34 {
+- reg = <0x34>;
++ port@0 {
++ reg = <0>;
+
+- xbar_amx2_in4_ep: endpoint {
+- remote-endpoint = <&amx2_in4_ep>;
++ adx1_in_ep: endpoint {
++ remote-endpoint = <&xbar_adx1_in_ep>;
++ };
+ };
+- };
+
+- port@35 {
+- reg = <0x35>;
++ adx1_out1_port: port@1 {
++ reg = <1>;
+
+- xbar_amx2_out_ep: endpoint {
+- remote-endpoint = <&amx2_out_ep>;
++ adx1_out1_ep: endpoint {
++ remote-endpoint = <&xbar_adx1_out1_ep>;
++ };
+ };
+- };
+
+- xbar_amx3_in1_port: port@36 {
+- reg = <0x36>;
++ adx1_out2_port: port@2 {
++ reg = <2>;
+
+- xbar_amx3_in1_ep: endpoint {
+- remote-endpoint = <&amx3_in1_ep>;
++ adx1_out2_ep: endpoint {
++ remote-endpoint = <&xbar_adx1_out2_ep>;
++ };
+ };
+- };
+
+- xbar_amx3_in2_port: port@37 {
+- reg = <0x37>;
++ adx1_out3_port: port@3 {
++ reg = <3>;
+
+- xbar_amx3_in2_ep: endpoint {
+- remote-endpoint = <&amx3_in2_ep>;
++ adx1_out3_ep: endpoint {
++ remote-endpoint = <&xbar_adx1_out3_ep>;
++ };
+ };
+- };
+
+- xbar_amx3_in3_port: port@38 {
+- reg = <0x38>;
++ adx1_out4_port: port@4 {
++ reg = <4>;
+
+- xbar_amx3_in3_ep: endpoint {
+- remote-endpoint = <&amx3_in3_ep>;
++ adx1_out4_ep: endpoint {
++ remote-endpoint = <&xbar_adx1_out4_ep>;
++ };
+ };
+ };
++ };
+
+- xbar_amx3_in4_port: port@39 {
+- reg = <0x39>;
++ adx@2903900 {
++ status = "okay";
+
+- xbar_amx3_in4_ep: endpoint {
+- remote-endpoint = <&amx3_in4_ep>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- port@3a {
+- reg = <0x3a>;
++ port@0 {
++ reg = <0>;
+
+- xbar_amx3_out_ep: endpoint {
+- remote-endpoint = <&amx3_out_ep>;
++ adx2_in_ep: endpoint {
++ remote-endpoint = <&xbar_adx2_in_ep>;
++ };
+ };
+- };
+
+- xbar_amx4_in1_port: port@3b {
+- reg = <0x3b>;
++ adx2_out1_port: port@1 {
++ reg = <1>;
+
+- xbar_amx4_in1_ep: endpoint {
+- remote-endpoint = <&amx4_in1_ep>;
++ adx2_out1_ep: endpoint {
++ remote-endpoint = <&xbar_adx2_out1_ep>;
++ };
+ };
+- };
+
+- xbar_amx4_in2_port: port@3c {
+- reg = <0x3c>;
++ adx2_out2_port: port@2 {
++ reg = <2>;
+
+- xbar_amx4_in2_ep: endpoint {
+- remote-endpoint = <&amx4_in2_ep>;
++ adx2_out2_ep: endpoint {
++ remote-endpoint = <&xbar_adx2_out2_ep>;
++ };
+ };
+- };
+
+- xbar_amx4_in3_port: port@3d {
+- reg = <0x3d>;
++ adx2_out3_port: port@3 {
++ reg = <3>;
+
+- xbar_amx4_in3_ep: endpoint {
+- remote-endpoint = <&amx4_in3_ep>;
++ adx2_out3_ep: endpoint {
++ remote-endpoint = <&xbar_adx2_out3_ep>;
++ };
+ };
+- };
+
+- xbar_amx4_in4_port: port@3e {
+- reg = <0x3e>;
++ adx2_out4_port: port@4 {
++ reg = <4>;
+
+- xbar_amx4_in4_ep: endpoint {
+- remote-endpoint = <&amx4_in4_ep>;
++ adx2_out4_ep: endpoint {
++ remote-endpoint = <&xbar_adx2_out4_ep>;
++ };
+ };
+ };
++ };
+
+- port@3f {
+- reg = <0x3f>;
++ adx@2903a00 {
++ status = "okay";
+
+- xbar_amx4_out_ep: endpoint {
+- remote-endpoint = <&amx4_out_ep>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- xbar_adx1_in_port: port@40 {
+- reg = <0x40>;
++ port@0 {
++ reg = <0>;
+
+- xbar_adx1_in_ep: endpoint {
+- remote-endpoint = <&adx1_in_ep>;
++ adx3_in_ep: endpoint {
++ remote-endpoint = <&xbar_adx3_in_ep>;
++ };
+ };
+- };
+
+- port@41 {
+- reg = <0x41>;
++ adx3_out1_port: port@1 {
++ reg = <1>;
+
+- xbar_adx1_out1_ep: endpoint {
+- remote-endpoint = <&adx1_out1_ep>;
++ adx3_out1_ep: endpoint {
++ remote-endpoint = <&xbar_adx3_out1_ep>;
++ };
+ };
+- };
+
+- port@42 {
+- reg = <0x42>;
++ adx3_out2_port: port@2 {
++ reg = <2>;
+
+- xbar_adx1_out2_ep: endpoint {
+- remote-endpoint = <&adx1_out2_ep>;
++ adx3_out2_ep: endpoint {
++ remote-endpoint = <&xbar_adx3_out2_ep>;
++ };
+ };
+- };
+
+- port@43 {
+- reg = <0x43>;
++ adx3_out3_port: port@3 {
++ reg = <3>;
+
+- xbar_adx1_out3_ep: endpoint {
+- remote-endpoint = <&adx1_out3_ep>;
++ adx3_out3_ep: endpoint {
++ remote-endpoint = <&xbar_adx3_out3_ep>;
++ };
+ };
+- };
+
+- port@44 {
+- reg = <0x44>;
++ adx3_out4_port: port@4 {
++ reg = <4>;
+
+- xbar_adx1_out4_ep: endpoint {
+- remote-endpoint = <&adx1_out4_ep>;
++ adx3_out4_ep: endpoint {
++ remote-endpoint = <&xbar_adx3_out4_ep>;
++ };
+ };
+ };
++ };
+
+- xbar_adx2_in_port: port@45 {
+- reg = <0x45>;
++ adx@2903b00 {
++ status = "okay";
+
+- xbar_adx2_in_ep: endpoint {
+- remote-endpoint = <&adx2_in_ep>;
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
++
++ port@0 {
++ reg = <0>;
++
++ adx4_in_ep: endpoint {
++ remote-endpoint = <&xbar_adx4_in_ep>;
++ };
+ };
+- };
+
+- port@46 {
+- reg = <0x46>;
++ adx4_out1_port: port@1 {
++ reg = <1>;
+
+- xbar_adx2_out1_ep: endpoint {
+- remote-endpoint = <&adx2_out1_ep>;
++ adx4_out1_ep: endpoint {
++ remote-endpoint = <&xbar_adx4_out1_ep>;
++ };
+ };
+- };
+
+- port@47 {
+- reg = <0x47>;
++ adx4_out2_port: port@2 {
++ reg = <2>;
+
+- xbar_adx2_out2_ep: endpoint {
+- remote-endpoint = <&adx2_out2_ep>;
++ adx4_out2_ep: endpoint {
++ remote-endpoint = <&xbar_adx4_out2_ep>;
++ };
+ };
+- };
+
+- port@48 {
+- reg = <0x48>;
++ adx4_out3_port: port@3 {
++ reg = <3>;
+
+- xbar_adx2_out3_ep: endpoint {
+- remote-endpoint = <&adx2_out3_ep>;
++ adx4_out3_ep: endpoint {
++ remote-endpoint = <&xbar_adx4_out3_ep>;
++ };
+ };
+- };
+
+- port@49 {
+- reg = <0x49>;
++ adx4_out4_port: port@4 {
++ reg = <4>;
+
+- xbar_adx2_out4_ep: endpoint {
+- remote-endpoint = <&adx2_out4_ep>;
++ adx4_out4_ep: endpoint {
++ remote-endpoint = <&xbar_adx4_out4_ep>;
++ };
+ };
+ };
++ };
+
+- xbar_adx3_in_port: port@4a {
+- reg = <0x4a>;
++ dmic@2904000 {
++ status = "okay";
+
+- xbar_adx3_in_ep: endpoint {
+- remote-endpoint = <&adx3_in_ep>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- port@4b {
+- reg = <0x4b>;
++ port@0 {
++ reg = <0>;
+
+- xbar_adx3_out1_ep: endpoint {
+- remote-endpoint = <&adx3_out1_ep>;
++ dmic1_cif_ep: endpoint {
++ remote-endpoint = <&xbar_dmic1_ep>;
++ };
+ };
+- };
+
+- port@4c {
+- reg = <0x4c>;
++ dmic1_port: port@1 {
++ reg = <1>;
+
+- xbar_adx3_out2_ep: endpoint {
+- remote-endpoint = <&adx3_out2_ep>;
++ dmic1_dap_ep: endpoint {
++ /* Place holder for external Codec */
++ };
+ };
+ };
++ };
+
+- port@4d {
+- reg = <0x4d>;
++ dmic@2904100 {
++ status = "okay";
+
+- xbar_adx3_out3_ep: endpoint {
+- remote-endpoint = <&adx3_out3_ep>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- port@4e {
+- reg = <0x4e>;
++ port@0 {
++ reg = <0>;
+
+- xbar_adx3_out4_ep: endpoint {
+- remote-endpoint = <&adx3_out4_ep>;
++ dmic2_cif_ep: endpoint {
++ remote-endpoint = <&xbar_dmic2_ep>;
++ };
+ };
+- };
+
+- xbar_adx4_in_port: port@4f {
+- reg = <0x4f>;
++ dmic2_port: port@1 {
++ reg = <1>;
+
+- xbar_adx4_in_ep: endpoint {
+- remote-endpoint = <&adx4_in_ep>;
++ dmic2_dap_ep: endpoint {
++ /* Place holder for external Codec */
++ };
+ };
+ };
++ };
+
+- port@50 {
+- reg = <0x50>;
++ dmic@2904200 {
++ status = "okay";
+
+- xbar_adx4_out1_ep: endpoint {
+- remote-endpoint = <&adx4_out1_ep>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- port@51 {
+- reg = <0x51>;
++ port@0 {
++ reg = <0>;
+
+- xbar_adx4_out2_ep: endpoint {
+- remote-endpoint = <&adx4_out2_ep>;
++ dmic3_cif_ep: endpoint {
++ remote-endpoint = <&xbar_dmic3_ep>;
++ };
+ };
+- };
+
+- port@52 {
+- reg = <0x52>;
++ dmic3_port: port@1 {
++ reg = <1>;
+
+- xbar_adx4_out3_ep: endpoint {
+- remote-endpoint = <&adx4_out3_ep>;
++ dmic3_dap_ep: endpoint {
++ /* Place holder for external Codec */
++ };
+ };
+ };
++ };
+
+- port@53 {
+- reg = <0x53>;
++ dspk@2905000 {
++ status = "okay";
+
+- xbar_adx4_out4_ep: endpoint {
+- remote-endpoint = <&adx4_out4_ep>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- xbar_mixer_in1_port: port@54 {
+- reg = <0x54>;
++ port@0 {
++ reg = <0>;
+
+- xbar_mixer_in1_ep: endpoint {
+- remote-endpoint = <&mixer_in1_ep>;
++ dspk1_cif_ep: endpoint {
++ remote-endpoint = <&xbar_dspk1_ep>;
++ };
+ };
+- };
+
+- xbar_mixer_in2_port: port@55 {
+- reg = <0x55>;
++ dspk1_port: port@1 {
++ reg = <1>;
+
+- xbar_mixer_in2_ep: endpoint {
+- remote-endpoint = <&mixer_in2_ep>;
++ dspk1_dap_ep: endpoint {
++ /* Place holder for external Codec */
++ };
+ };
+ };
++ };
+
+- xbar_mixer_in3_port: port@56 {
+- reg = <0x56>;
++ dspk@2905100 {
++ status = "okay";
+
+- xbar_mixer_in3_ep: endpoint {
+- remote-endpoint = <&mixer_in3_ep>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- xbar_mixer_in4_port: port@57 {
+- reg = <0x57>;
++ port@0 {
++ reg = <0>;
+
+- xbar_mixer_in4_ep: endpoint {
+- remote-endpoint = <&mixer_in4_ep>;
++ dspk2_cif_ep: endpoint {
++ remote-endpoint = <&xbar_dspk2_ep>;
++ };
+ };
+- };
+
+- xbar_mixer_in5_port: port@58 {
+- reg = <0x58>;
++ dspk2_port: port@1 {
++ reg = <1>;
+
+- xbar_mixer_in5_ep: endpoint {
+- remote-endpoint = <&mixer_in5_ep>;
++ dspk2_dap_ep: endpoint {
++ /* Place holder for external Codec */
++ };
+ };
+ };
++ };
+
+- xbar_mixer_in6_port: port@59 {
+- reg = <0x59>;
++ processing-engine@2908000 {
++ status = "okay";
+
+- xbar_mixer_in6_ep: endpoint {
+- remote-endpoint = <&mixer_in6_ep>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- xbar_mixer_in7_port: port@5a {
+- reg = <0x5a>;
++ port@0 {
++ reg = <0x0>;
+
+- xbar_mixer_in7_ep: endpoint {
+- remote-endpoint = <&mixer_in7_ep>;
++ ope1_cif_in_ep: endpoint {
++ remote-endpoint = <&xbar_ope1_in_ep>;
++ };
+ };
+- };
+
+- xbar_mixer_in8_port: port@5b {
+- reg = <0x5b>;
++ ope1_out_port: port@1 {
++ reg = <0x1>;
+
+- xbar_mixer_in8_ep: endpoint {
+- remote-endpoint = <&mixer_in8_ep>;
++ ope1_cif_out_ep: endpoint {
++ remote-endpoint = <&xbar_ope1_out_ep>;
++ };
+ };
+ };
++ };
+
+- xbar_mixer_in9_port: port@5c {
+- reg = <0x5c>;
++ mvc@290a000 {
++ status = "okay";
+
+- xbar_mixer_in9_ep: endpoint {
+- remote-endpoint = <&mixer_in9_ep>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- xbar_mixer_in10_port: port@5d {
+- reg = <0x5d>;
++ port@0 {
++ reg = <0>;
+
+- xbar_mixer_in10_ep: endpoint {
+- remote-endpoint = <&mixer_in10_ep>;
++ mvc1_cif_in_ep: endpoint {
++ remote-endpoint = <&xbar_mvc1_in_ep>;
++ };
+ };
+- };
+
+- port@5e {
+- reg = <0x5e>;
++ mvc1_out_port: port@1 {
++ reg = <1>;
+
+- xbar_mixer_out1_ep: endpoint {
+- remote-endpoint = <&mixer_out1_ep>;
++ mvc1_cif_out_ep: endpoint {
++ remote-endpoint = <&xbar_mvc1_out_ep>;
++ };
+ };
+ };
++ };
+
+- port@5f {
+- reg = <0x5f>;
++ mvc@290a200 {
++ status = "okay";
+
+- xbar_mixer_out2_ep: endpoint {
+- remote-endpoint = <&mixer_out2_ep>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- port@60 {
+- reg = <0x60>;
++ port@0 {
++ reg = <0>;
+
+- xbar_mixer_out3_ep: endpoint {
+- remote-endpoint = <&mixer_out3_ep>;
++ mvc2_cif_in_ep: endpoint {
++ remote-endpoint = <&xbar_mvc2_in_ep>;
++ };
+ };
+- };
+
+- port@61 {
+- reg = <0x61>;
++ mvc2_out_port: port@1 {
++ reg = <1>;
+
+- xbar_mixer_out4_ep: endpoint {
+- remote-endpoint = <&mixer_out4_ep>;
++ mvc2_cif_out_ep: endpoint {
++ remote-endpoint = <&xbar_mvc2_out_ep>;
++ };
+ };
+ };
++ };
+
+- port@62 {
+- reg = <0x62>;
++ amixer@290bb00 {
++ status = "okay";
+
+- xbar_mixer_out5_ep: endpoint {
+- remote-endpoint = <&mixer_out5_ep>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- xbar_asrc_in1_port: port@63 {
+- reg = <0x63>;
++ port@0 {
++ reg = <0x0>;
+
+- xbar_asrc_in1_ep: endpoint {
+- remote-endpoint = <&asrc_in1_ep>;
++ mixer_in1_ep: endpoint {
++ remote-endpoint = <&xbar_mixer_in1_ep>;
++ };
+ };
+- };
+
+- port@64 {
+- reg = <0x64>;
++ port@1 {
++ reg = <0x1>;
+
+- xbar_asrc_out1_ep: endpoint {
+- remote-endpoint = <&asrc_out1_ep>;
++ mixer_in2_ep: endpoint {
++ remote-endpoint = <&xbar_mixer_in2_ep>;
++ };
+ };
+- };
+
+- xbar_asrc_in2_port: port@65 {
+- reg = <0x65>;
++ port@2 {
++ reg = <0x2>;
+
+- xbar_asrc_in2_ep: endpoint {
+- remote-endpoint = <&asrc_in2_ep>;
++ mixer_in3_ep: endpoint {
++ remote-endpoint = <&xbar_mixer_in3_ep>;
++ };
+ };
+- };
+
+- port@66 {
+- reg = <0x66>;
++ port@3 {
++ reg = <0x3>;
+
+- xbar_asrc_out2_ep: endpoint {
+- remote-endpoint = <&asrc_out2_ep>;
++ mixer_in4_ep: endpoint {
++ remote-endpoint = <&xbar_mixer_in4_ep>;
++ };
+ };
+- };
+
+- xbar_asrc_in3_port: port@67 {
+- reg = <0x67>;
++ port@4 {
++ reg = <0x4>;
+
+- xbar_asrc_in3_ep: endpoint {
+- remote-endpoint = <&asrc_in3_ep>;
++ mixer_in5_ep: endpoint {
++ remote-endpoint = <&xbar_mixer_in5_ep>;
++ };
+ };
+- };
+
+- port@68 {
+- reg = <0x68>;
++ port@5 {
++ reg = <0x5>;
+
+- xbar_asrc_out3_ep: endpoint {
+- remote-endpoint = <&asrc_out3_ep>;
++ mixer_in6_ep: endpoint {
++ remote-endpoint = <&xbar_mixer_in6_ep>;
++ };
+ };
+- };
+
+- xbar_asrc_in4_port: port@69 {
+- reg = <0x69>;
++ port@6 {
++ reg = <0x6>;
+
+- xbar_asrc_in4_ep: endpoint {
+- remote-endpoint = <&asrc_in4_ep>;
++ mixer_in7_ep: endpoint {
++ remote-endpoint = <&xbar_mixer_in7_ep>;
++ };
+ };
+- };
+
+- port@6a {
+- reg = <0x6a>;
++ port@7 {
++ reg = <0x7>;
+
+- xbar_asrc_out4_ep: endpoint {
+- remote-endpoint = <&asrc_out4_ep>;
++ mixer_in8_ep: endpoint {
++ remote-endpoint = <&xbar_mixer_in8_ep>;
++ };
+ };
+- };
+
+- xbar_asrc_in5_port: port@6b {
+- reg = <0x6b>;
++ port@8 {
++ reg = <0x8>;
+
+- xbar_asrc_in5_ep: endpoint {
+- remote-endpoint = <&asrc_in5_ep>;
++ mixer_in9_ep: endpoint {
++ remote-endpoint = <&xbar_mixer_in9_ep>;
++ };
+ };
+- };
+
+- port@6c {
+- reg = <0x6c>;
++ port@9 {
++ reg = <0x9>;
+
+- xbar_asrc_out5_ep: endpoint {
+- remote-endpoint = <&asrc_out5_ep>;
++ mixer_in10_ep: endpoint {
++ remote-endpoint = <&xbar_mixer_in10_ep>;
++ };
+ };
+- };
+
+- xbar_asrc_in6_port: port@6d {
+- reg = <0x6d>;
++ mixer_out1_port: port@a {
++ reg = <0xa>;
+
+- xbar_asrc_in6_ep: endpoint {
+- remote-endpoint = <&asrc_in6_ep>;
++ mixer_out1_ep: endpoint {
++ remote-endpoint = <&xbar_mixer_out1_ep>;
++ };
+ };
+- };
+
+- port@6e {
+- reg = <0x6e>;
++ mixer_out2_port: port@b {
++ reg = <0xb>;
+
+- xbar_asrc_out6_ep: endpoint {
+- remote-endpoint = <&asrc_out6_ep>;
++ mixer_out2_ep: endpoint {
++ remote-endpoint = <&xbar_mixer_out2_ep>;
++ };
+ };
+- };
+
+- xbar_asrc_in7_port: port@6f {
+- reg = <0x6f>;
++ mixer_out3_port: port@c {
++ reg = <0xc>;
+
+- xbar_asrc_in7_ep: endpoint {
+- remote-endpoint = <&asrc_in7_ep>;
++ mixer_out3_ep: endpoint {
++ remote-endpoint = <&xbar_mixer_out3_ep>;
++ };
+ };
+- };
+
+- xbar_ope1_in_port: port@70 {
+- reg = <0x70>;
++ mixer_out4_port: port@d {
++ reg = <0xd>;
+
+- xbar_ope1_in_ep: endpoint {
+- remote-endpoint = <&ope1_cif_in_ep>;
++ mixer_out4_ep: endpoint {
++ remote-endpoint = <&xbar_mixer_out4_ep>;
++ };
+ };
+- };
+
+- port@71 {
+- reg = <0x71>;
++ mixer_out5_port: port@e {
++ reg = <0xe>;
+
+- xbar_ope1_out_ep: endpoint {
+- remote-endpoint = <&ope1_cif_out_ep>;
++ mixer_out5_ep: endpoint {
++ remote-endpoint = <&xbar_mixer_out5_ep>;
++ };
+ };
+ };
+ };
+@@ -1102,33 +1164,7 @@ admaif19_ep: endpoint {
+ };
+ };
+
+- i2s@2901000 {
+- status = "okay";
+-
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
+-
+- port@0 {
+- reg = <0>;
+-
+- i2s1_cif_ep: endpoint {
+- remote-endpoint = <&xbar_i2s1_ep>;
+- };
+- };
+-
+- i2s1_port: port@1 {
+- reg = <1>;
+-
+- i2s1_dap_ep: endpoint {
+- dai-format = "i2s";
+- /* Placeholder for external Codec */
+- };
+- };
+- };
+- };
+-
+- i2s@2901100 {
++ asrc@2910000 {
+ status = "okay";
+
+ ports {
+@@ -1136,1064 +1172,1028 @@ ports {
+ #size-cells = <0>;
+
+ port@0 {
+- reg = <0>;
++ reg = <0x0>;
+
+- i2s2_cif_ep: endpoint {
+- remote-endpoint = <&xbar_i2s2_ep>;
++ asrc_in1_ep: endpoint {
++ remote-endpoint = <&xbar_asrc_in1_ep>;
+ };
+ };
+
+- i2s2_port: port@1 {
+- reg = <1>;
++ port@1 {
++ reg = <0x1>;
+
+- i2s2_dap_ep: endpoint {
+- dai-format = "i2s";
+- /* Placeholder for external Codec */
++ asrc_in2_ep: endpoint {
++ remote-endpoint = <&xbar_asrc_in2_ep>;
+ };
+ };
+- };
+- };
+-
+- i2s@2901200 {
+- status = "okay";
+-
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
+
+- port@0 {
+- reg = <0>;
++ port@2 {
++ reg = <0x2>;
+
+- i2s3_cif_ep: endpoint {
+- remote-endpoint = <&xbar_i2s3_ep>;
++ asrc_in3_ep: endpoint {
++ remote-endpoint = <&xbar_asrc_in3_ep>;
+ };
+ };
+
+- i2s3_port: port@1 {
+- reg = <1>;
++ port@3 {
++ reg = <0x3>;
+
+- i2s3_dap_ep: endpoint {
+- dai-format = "i2s";
+- /* Placeholder for external Codec */
++ asrc_in4_ep: endpoint {
++ remote-endpoint = <&xbar_asrc_in4_ep>;
+ };
+ };
+- };
+- };
+-
+- i2s@2901300 {
+- status = "okay";
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ port@4 {
++ reg = <0x4>;
+
+- port@0 {
+- reg = <0>;
++ asrc_in5_ep: endpoint {
++ remote-endpoint = <&xbar_asrc_in5_ep>;
++ };
++ };
+
+- i2s4_cif_ep: endpoint {
+- remote-endpoint = <&xbar_i2s4_ep>;
++ port@5 {
++ reg = <0x5>;
++
++ asrc_in6_ep: endpoint {
++ remote-endpoint = <&xbar_asrc_in6_ep>;
+ };
+ };
+
+- i2s4_port: port@1 {
+- reg = <1>;
++ port@6 {
++ reg = <0x6>;
+
+- i2s4_dap_ep: endpoint {
+- dai-format = "i2s";
+- /* Placeholder for external Codec */
++ asrc_in7_ep: endpoint {
++ remote-endpoint = <&xbar_asrc_in7_ep>;
+ };
+ };
+- };
+- };
+
+- i2s@2901400 {
+- status = "okay";
++ asrc_out1_port: port@7 {
++ reg = <0x7>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ asrc_out1_ep: endpoint {
++ remote-endpoint = <&xbar_asrc_out1_ep>;
++ };
++ };
+
+- port@0 {
+- reg = <0>;
++ asrc_out2_port: port@8 {
++ reg = <0x8>;
+
+- i2s5_cif_ep: endpoint {
+- remote-endpoint = <&xbar_i2s5_ep>;
++ asrc_out2_ep: endpoint {
++ remote-endpoint = <&xbar_asrc_out2_ep>;
+ };
+ };
+
+- i2s5_port: port@1 {
+- reg = <1>;
++ asrc_out3_port: port@9 {
++ reg = <0x9>;
+
+- i2s5_dap_ep: endpoint {
+- dai-format = "i2s";
+- /* Placeholder for external Codec */
++ asrc_out3_ep: endpoint {
++ remote-endpoint = <&xbar_asrc_out3_ep>;
+ };
+ };
+- };
+- };
+
+- i2s@2901500 {
+- status = "okay";
++ asrc_out4_port: port@a {
++ reg = <0xa>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ asrc_out4_ep: endpoint {
++ remote-endpoint = <&xbar_asrc_out4_ep>;
++ };
++ };
+
+- port@0 {
+- reg = <0>;
++ asrc_out5_port: port@b {
++ reg = <0xb>;
+
+- i2s6_cif_ep: endpoint {
+- remote-endpoint = <&xbar_i2s6_ep>;
++ asrc_out5_ep: endpoint {
++ remote-endpoint = <&xbar_asrc_out5_ep>;
+ };
+ };
+
+- i2s6_port: port@1 {
+- reg = <1>;
++ asrc_out6_port: port@c {
++ reg = <0xc>;
+
+- i2s6_dap_ep: endpoint {
+- dai-format = "i2s";
+- /* Placeholder for external Codec */
++ asrc_out6_ep: endpoint {
++ remote-endpoint = <&xbar_asrc_out6_ep>;
+ };
+ };
+ };
+ };
+
+- dmic@2904000 {
+- status = "okay";
+-
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- port@0 {
+- reg = <0>;
++ port@0 {
++ reg = <0x0>;
+
+- dmic1_cif_ep: endpoint {
+- remote-endpoint = <&xbar_dmic1_ep>;
+- };
++ xbar_admaif0_ep: endpoint {
++ remote-endpoint = <&admaif0_ep>;
+ };
++ };
+
+- dmic1_port: port@1 {
+- reg = <1>;
++ port@1 {
++ reg = <0x1>;
+
+- dmic1_dap_ep: endpoint {
+- /* Place holder for external Codec */
+- };
++ xbar_admaif1_ep: endpoint {
++ remote-endpoint = <&admaif1_ep>;
+ };
+ };
+- };
+
+- dmic@2904100 {
+- status = "okay";
++ port@2 {
++ reg = <0x2>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ xbar_admaif2_ep: endpoint {
++ remote-endpoint = <&admaif2_ep>;
++ };
++ };
+
+- port@0 {
+- reg = <0>;
++ port@3 {
++ reg = <0x3>;
+
+- dmic2_cif_ep: endpoint {
+- remote-endpoint = <&xbar_dmic2_ep>;
+- };
++ xbar_admaif3_ep: endpoint {
++ remote-endpoint = <&admaif3_ep>;
+ };
++ };
+
+- dmic2_port: port@1 {
+- reg = <1>;
++ port@4 {
++ reg = <0x4>;
+
+- dmic2_dap_ep: endpoint {
+- /* Place holder for external Codec */
+- };
++ xbar_admaif4_ep: endpoint {
++ remote-endpoint = <&admaif4_ep>;
+ };
+ };
+- };
+
+- dmic@2904200 {
+- status = "okay";
++ port@5 {
++ reg = <0x5>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ xbar_admaif5_ep: endpoint {
++ remote-endpoint = <&admaif5_ep>;
++ };
++ };
+
+- port@0 {
+- reg = <0>;
++ port@6 {
++ reg = <0x6>;
+
+- dmic3_cif_ep: endpoint {
+- remote-endpoint = <&xbar_dmic3_ep>;
+- };
++ xbar_admaif6_ep: endpoint {
++ remote-endpoint = <&admaif6_ep>;
+ };
++ };
+
+- dmic3_port: port@1 {
+- reg = <1>;
++ port@7 {
++ reg = <0x7>;
+
+- dmic3_dap_ep: endpoint {
+- /* Place holder for external Codec */
+- };
++ xbar_admaif7_ep: endpoint {
++ remote-endpoint = <&admaif7_ep>;
+ };
+ };
+- };
+
+- dspk@2905000 {
+- status = "okay";
++ port@8 {
++ reg = <0x8>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ xbar_admaif8_ep: endpoint {
++ remote-endpoint = <&admaif8_ep>;
++ };
++ };
+
+- port@0 {
+- reg = <0>;
++ port@9 {
++ reg = <0x9>;
+
+- dspk1_cif_ep: endpoint {
+- remote-endpoint = <&xbar_dspk1_ep>;
+- };
++ xbar_admaif9_ep: endpoint {
++ remote-endpoint = <&admaif9_ep>;
+ };
++ };
+
+- dspk1_port: port@1 {
+- reg = <1>;
++ port@a {
++ reg = <0xa>;
+
+- dspk1_dap_ep: endpoint {
+- /* Place holder for external Codec */
+- };
++ xbar_admaif10_ep: endpoint {
++ remote-endpoint = <&admaif10_ep>;
+ };
+ };
+- };
+
+- dspk@2905100 {
+- status = "okay";
++ port@b {
++ reg = <0xb>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ xbar_admaif11_ep: endpoint {
++ remote-endpoint = <&admaif11_ep>;
++ };
++ };
+
+- port@0 {
+- reg = <0>;
++ port@c {
++ reg = <0xc>;
+
+- dspk2_cif_ep: endpoint {
+- remote-endpoint = <&xbar_dspk2_ep>;
+- };
++ xbar_admaif12_ep: endpoint {
++ remote-endpoint = <&admaif12_ep>;
+ };
++ };
+
+- dspk2_port: port@1 {
+- reg = <1>;
++ port@d {
++ reg = <0xd>;
+
+- dspk2_dap_ep: endpoint {
+- /* Place holder for external Codec */
+- };
++ xbar_admaif13_ep: endpoint {
++ remote-endpoint = <&admaif13_ep>;
+ };
+ };
+- };
+
+- sfc@2902000 {
+- status = "okay";
++ port@e {
++ reg = <0xe>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ xbar_admaif14_ep: endpoint {
++ remote-endpoint = <&admaif14_ep>;
++ };
++ };
+
+- port@0 {
+- reg = <0>;
++ port@f {
++ reg = <0xf>;
+
+- sfc1_cif_in_ep: endpoint {
+- remote-endpoint = <&xbar_sfc1_in_ep>;
+- convert-rate = <44100>;
+- };
++ xbar_admaif15_ep: endpoint {
++ remote-endpoint = <&admaif15_ep>;
+ };
++ };
+
+- sfc1_out_port: port@1 {
+- reg = <1>;
++ port@10 {
++ reg = <0x10>;
+
+- sfc1_cif_out_ep: endpoint {
+- remote-endpoint = <&xbar_sfc1_out_ep>;
+- convert-rate = <48000>;
+- };
++ xbar_admaif16_ep: endpoint {
++ remote-endpoint = <&admaif16_ep>;
+ };
+ };
+- };
+
+- sfc@2902200 {
+- status = "okay";
++ port@11 {
++ reg = <0x11>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ xbar_admaif17_ep: endpoint {
++ remote-endpoint = <&admaif17_ep>;
++ };
++ };
+
+- port@0 {
+- reg = <0>;
++ port@12 {
++ reg = <0x12>;
+
+- sfc2_cif_in_ep: endpoint {
+- remote-endpoint = <&xbar_sfc2_in_ep>;
+- };
++ xbar_admaif18_ep: endpoint {
++ remote-endpoint = <&admaif18_ep>;
+ };
++ };
+
+- sfc2_out_port: port@1 {
+- reg = <1>;
++ port@13 {
++ reg = <0x13>;
+
+- sfc2_cif_out_ep: endpoint {
+- remote-endpoint = <&xbar_sfc2_out_ep>;
+- };
++ xbar_admaif19_ep: endpoint {
++ remote-endpoint = <&admaif19_ep>;
+ };
+ };
+- };
+
+- sfc@2902400 {
+- status = "okay";
++ xbar_i2s1_port: port@14 {
++ reg = <0x14>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ xbar_i2s1_ep: endpoint {
++ remote-endpoint = <&i2s1_cif_ep>;
++ };
++ };
+
+- port@0 {
+- reg = <0>;
++ xbar_i2s2_port: port@15 {
++ reg = <0x15>;
+
+- sfc3_cif_in_ep: endpoint {
+- remote-endpoint = <&xbar_sfc3_in_ep>;
+- };
++ xbar_i2s2_ep: endpoint {
++ remote-endpoint = <&i2s2_cif_ep>;
+ };
++ };
+
+- sfc3_out_port: port@1 {
+- reg = <1>;
++ xbar_i2s3_port: port@16 {
++ reg = <0x16>;
+
+- sfc3_cif_out_ep: endpoint {
+- remote-endpoint = <&xbar_sfc3_out_ep>;
+- };
++ xbar_i2s3_ep: endpoint {
++ remote-endpoint = <&i2s3_cif_ep>;
+ };
+ };
+- };
+
+- sfc@2902600 {
+- status = "okay";
++ xbar_i2s4_port: port@17 {
++ reg = <0x17>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ xbar_i2s4_ep: endpoint {
++ remote-endpoint = <&i2s4_cif_ep>;
++ };
++ };
+
+- port@0 {
+- reg = <0>;
++ xbar_i2s5_port: port@18 {
++ reg = <0x18>;
+
+- sfc4_cif_in_ep: endpoint {
+- remote-endpoint = <&xbar_sfc4_in_ep>;
+- };
++ xbar_i2s5_ep: endpoint {
++ remote-endpoint = <&i2s5_cif_ep>;
+ };
++ };
+
+- sfc4_out_port: port@1 {
+- reg = <1>;
++ xbar_i2s6_port: port@19 {
++ reg = <0x19>;
+
+- sfc4_cif_out_ep: endpoint {
+- remote-endpoint = <&xbar_sfc4_out_ep>;
+- };
++ xbar_i2s6_ep: endpoint {
++ remote-endpoint = <&i2s6_cif_ep>;
+ };
+ };
+- };
+
+- mvc@290a000 {
+- status = "okay";
++ xbar_dmic1_port: port@1a {
++ reg = <0x1a>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ xbar_dmic1_ep: endpoint {
++ remote-endpoint = <&dmic1_cif_ep>;
++ };
++ };
+
+- port@0 {
+- reg = <0>;
++ xbar_dmic2_port: port@1b {
++ reg = <0x1b>;
+
+- mvc1_cif_in_ep: endpoint {
+- remote-endpoint = <&xbar_mvc1_in_ep>;
+- };
++ xbar_dmic2_ep: endpoint {
++ remote-endpoint = <&dmic2_cif_ep>;
+ };
++ };
+
+- mvc1_out_port: port@1 {
+- reg = <1>;
++ xbar_dmic3_port: port@1c {
++ reg = <0x1c>;
+
+- mvc1_cif_out_ep: endpoint {
+- remote-endpoint = <&xbar_mvc1_out_ep>;
+- };
++ xbar_dmic3_ep: endpoint {
++ remote-endpoint = <&dmic3_cif_ep>;
+ };
+ };
+- };
+
+- mvc@290a200 {
+- status = "okay";
++ xbar_dspk1_port: port@1e {
++ reg = <0x1e>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ xbar_dspk1_ep: endpoint {
++ remote-endpoint = <&dspk1_cif_ep>;
++ };
++ };
+
+- port@0 {
+- reg = <0>;
++ xbar_dspk2_port: port@1f {
++ reg = <0x1f>;
+
+- mvc2_cif_in_ep: endpoint {
+- remote-endpoint = <&xbar_mvc2_in_ep>;
+- };
++ xbar_dspk2_ep: endpoint {
++ remote-endpoint = <&dspk2_cif_ep>;
+ };
++ };
+
+- mvc2_out_port: port@1 {
+- reg = <1>;
++ xbar_sfc1_in_port: port@20 {
++ reg = <0x20>;
+
+- mvc2_cif_out_ep: endpoint {
+- remote-endpoint = <&xbar_mvc2_out_ep>;
+- };
++ xbar_sfc1_in_ep: endpoint {
++ remote-endpoint = <&sfc1_cif_in_ep>;
+ };
+ };
+- };
+
+- amx@2903000 {
+- status = "okay";
++ port@21 {
++ reg = <0x21>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ xbar_sfc1_out_ep: endpoint {
++ remote-endpoint = <&sfc1_cif_out_ep>;
++ };
++ };
+
+- port@0 {
+- reg = <0>;
++ xbar_sfc2_in_port: port@22 {
++ reg = <0x22>;
+
+- amx1_in1_ep: endpoint {
+- remote-endpoint = <&xbar_amx1_in1_ep>;
+- };
++ xbar_sfc2_in_ep: endpoint {
++ remote-endpoint = <&sfc2_cif_in_ep>;
+ };
++ };
+
+- port@1 {
+- reg = <1>;
++ port@23 {
++ reg = <0x23>;
+
+- amx1_in2_ep: endpoint {
+- remote-endpoint = <&xbar_amx1_in2_ep>;
+- };
++ xbar_sfc2_out_ep: endpoint {
++ remote-endpoint = <&sfc2_cif_out_ep>;
+ };
++ };
+
+- port@2 {
+- reg = <2>;
++ xbar_sfc3_in_port: port@24 {
++ reg = <0x24>;
+
+- amx1_in3_ep: endpoint {
+- remote-endpoint = <&xbar_amx1_in3_ep>;
+- };
++ xbar_sfc3_in_ep: endpoint {
++ remote-endpoint = <&sfc3_cif_in_ep>;
+ };
++ };
+
+- port@3 {
+- reg = <3>;
++ port@25 {
++ reg = <0x25>;
+
+- amx1_in4_ep: endpoint {
+- remote-endpoint = <&xbar_amx1_in4_ep>;
+- };
++ xbar_sfc3_out_ep: endpoint {
++ remote-endpoint = <&sfc3_cif_out_ep>;
+ };
++ };
+
+- amx1_out_port: port@4 {
+- reg = <4>;
++ xbar_sfc4_in_port: port@26 {
++ reg = <0x26>;
+
+- amx1_out_ep: endpoint {
+- remote-endpoint = <&xbar_amx1_out_ep>;
+- };
++ xbar_sfc4_in_ep: endpoint {
++ remote-endpoint = <&sfc4_cif_in_ep>;
+ };
+ };
+- };
+
+- amx@2903100 {
+- status = "okay";
++ port@27 {
++ reg = <0x27>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ xbar_sfc4_out_ep: endpoint {
++ remote-endpoint = <&sfc4_cif_out_ep>;
++ };
++ };
+
+- port@0 {
+- reg = <0>;
++ xbar_mvc1_in_port: port@28 {
++ reg = <0x28>;
+
+- amx2_in1_ep: endpoint {
+- remote-endpoint = <&xbar_amx2_in1_ep>;
+- };
++ xbar_mvc1_in_ep: endpoint {
++ remote-endpoint = <&mvc1_cif_in_ep>;
+ };
++ };
+
+- port@1 {
+- reg = <1>;
+-
+- amx2_in2_ep: endpoint {
+- remote-endpoint = <&xbar_amx2_in2_ep>;
+- };
++ port@29 {
++ reg = <0x29>;
++
++ xbar_mvc1_out_ep: endpoint {
++ remote-endpoint = <&mvc1_cif_out_ep>;
+ };
++ };
+
+- amx2_in3_port: port@2 {
+- reg = <2>;
++ xbar_mvc2_in_port: port@2a {
++ reg = <0x2a>;
+
+- amx2_in3_ep: endpoint {
+- remote-endpoint = <&xbar_amx2_in3_ep>;
+- };
++ xbar_mvc2_in_ep: endpoint {
++ remote-endpoint = <&mvc2_cif_in_ep>;
+ };
++ };
+
+- amx2_in4_port: port@3 {
+- reg = <3>;
++ port@2b {
++ reg = <0x2b>;
+
+- amx2_in4_ep: endpoint {
+- remote-endpoint = <&xbar_amx2_in4_ep>;
+- };
++ xbar_mvc2_out_ep: endpoint {
++ remote-endpoint = <&mvc2_cif_out_ep>;
+ };
++ };
+
+- amx2_out_port: port@4 {
+- reg = <4>;
++ xbar_amx1_in1_port: port@2c {
++ reg = <0x2c>;
+
+- amx2_out_ep: endpoint {
+- remote-endpoint = <&xbar_amx2_out_ep>;
+- };
++ xbar_amx1_in1_ep: endpoint {
++ remote-endpoint = <&amx1_in1_ep>;
+ };
+ };
+- };
+
+- amx@2903200 {
+- status = "okay";
++ xbar_amx1_in2_port: port@2d {
++ reg = <0x2d>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ xbar_amx1_in2_ep: endpoint {
++ remote-endpoint = <&amx1_in2_ep>;
++ };
++ };
+
+- port@0 {
+- reg = <0>;
++ xbar_amx1_in3_port: port@2e {
++ reg = <0x2e>;
+
+- amx3_in1_ep: endpoint {
+- remote-endpoint = <&xbar_amx3_in1_ep>;
+- };
++ xbar_amx1_in3_ep: endpoint {
++ remote-endpoint = <&amx1_in3_ep>;
+ };
++ };
+
+- port@1 {
+- reg = <1>;
++ xbar_amx1_in4_port: port@2f {
++ reg = <0x2f>;
+
+- amx3_in2_ep: endpoint {
+- remote-endpoint = <&xbar_amx3_in2_ep>;
+- };
++ xbar_amx1_in4_ep: endpoint {
++ remote-endpoint = <&amx1_in4_ep>;
+ };
++ };
+
+- port@2 {
+- reg = <2>;
++ port@30 {
++ reg = <0x30>;
+
+- amx3_in3_ep: endpoint {
+- remote-endpoint = <&xbar_amx3_in3_ep>;
+- };
++ xbar_amx1_out_ep: endpoint {
++ remote-endpoint = <&amx1_out_ep>;
+ };
++ };
+
+- port@3 {
+- reg = <3>;
++ xbar_amx2_in1_port: port@31 {
++ reg = <0x31>;
+
+- amx3_in4_ep: endpoint {
+- remote-endpoint = <&xbar_amx3_in4_ep>;
+- };
++ xbar_amx2_in1_ep: endpoint {
++ remote-endpoint = <&amx2_in1_ep>;
+ };
++ };
+
+- amx3_out_port: port@4 {
+- reg = <4>;
++ xbar_amx2_in2_port: port@32 {
++ reg = <0x32>;
+
+- amx3_out_ep: endpoint {
+- remote-endpoint = <&xbar_amx3_out_ep>;
+- };
++ xbar_amx2_in2_ep: endpoint {
++ remote-endpoint = <&amx2_in2_ep>;
+ };
+ };
+- };
+
+- amx@2903300 {
+- status = "okay";
++ xbar_amx2_in3_port: port@33 {
++ reg = <0x33>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ xbar_amx2_in3_ep: endpoint {
++ remote-endpoint = <&amx2_in3_ep>;
++ };
++ };
+
+- port@0 {
+- reg = <0>;
++ xbar_amx2_in4_port: port@34 {
++ reg = <0x34>;
+
+- amx4_in1_ep: endpoint {
+- remote-endpoint = <&xbar_amx4_in1_ep>;
+- };
++ xbar_amx2_in4_ep: endpoint {
++ remote-endpoint = <&amx2_in4_ep>;
+ };
++ };
+
+- port@1 {
+- reg = <1>;
++ port@35 {
++ reg = <0x35>;
+
+- amx4_in2_ep: endpoint {
+- remote-endpoint = <&xbar_amx4_in2_ep>;
+- };
++ xbar_amx2_out_ep: endpoint {
++ remote-endpoint = <&amx2_out_ep>;
+ };
++ };
+
+- port@2 {
+- reg = <2>;
++ xbar_amx3_in1_port: port@36 {
++ reg = <0x36>;
+
+- amx4_in3_ep: endpoint {
+- remote-endpoint = <&xbar_amx4_in3_ep>;
+- };
++ xbar_amx3_in1_ep: endpoint {
++ remote-endpoint = <&amx3_in1_ep>;
+ };
++ };
+
+- port@3 {
+- reg = <3>;
++ xbar_amx3_in2_port: port@37 {
++ reg = <0x37>;
+
+- amx4_in4_ep: endpoint {
+- remote-endpoint = <&xbar_amx4_in4_ep>;
+- };
++ xbar_amx3_in2_ep: endpoint {
++ remote-endpoint = <&amx3_in2_ep>;
+ };
++ };
+
+- amx4_out_port: port@4 {
+- reg = <4>;
++ xbar_amx3_in3_port: port@38 {
++ reg = <0x38>;
+
+- amx4_out_ep: endpoint {
+- remote-endpoint = <&xbar_amx4_out_ep>;
+- };
++ xbar_amx3_in3_ep: endpoint {
++ remote-endpoint = <&amx3_in3_ep>;
+ };
+ };
+- };
+
+- adx@2903800 {
+- status = "okay";
++ xbar_amx3_in4_port: port@39 {
++ reg = <0x39>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ xbar_amx3_in4_ep: endpoint {
++ remote-endpoint = <&amx3_in4_ep>;
++ };
++ };
+
+- port@0 {
+- reg = <0>;
++ port@3a {
++ reg = <0x3a>;
+
+- adx1_in_ep: endpoint {
+- remote-endpoint = <&xbar_adx1_in_ep>;
+- };
++ xbar_amx3_out_ep: endpoint {
++ remote-endpoint = <&amx3_out_ep>;
+ };
++ };
+
+- adx1_out1_port: port@1 {
+- reg = <1>;
++ xbar_amx4_in1_port: port@3b {
++ reg = <0x3b>;
+
+- adx1_out1_ep: endpoint {
+- remote-endpoint = <&xbar_adx1_out1_ep>;
+- };
++ xbar_amx4_in1_ep: endpoint {
++ remote-endpoint = <&amx4_in1_ep>;
+ };
++ };
+
+- adx1_out2_port: port@2 {
+- reg = <2>;
++ xbar_amx4_in2_port: port@3c {
++ reg = <0x3c>;
+
+- adx1_out2_ep: endpoint {
+- remote-endpoint = <&xbar_adx1_out2_ep>;
+- };
++ xbar_amx4_in2_ep: endpoint {
++ remote-endpoint = <&amx4_in2_ep>;
+ };
++ };
+
+- adx1_out3_port: port@3 {
+- reg = <3>;
++ xbar_amx4_in3_port: port@3d {
++ reg = <0x3d>;
+
+- adx1_out3_ep: endpoint {
+- remote-endpoint = <&xbar_adx1_out3_ep>;
+- };
++ xbar_amx4_in3_ep: endpoint {
++ remote-endpoint = <&amx4_in3_ep>;
+ };
++ };
+
+- adx1_out4_port: port@4 {
+- reg = <4>;
++ xbar_amx4_in4_port: port@3e {
++ reg = <0x3e>;
+
+- adx1_out4_ep: endpoint {
+- remote-endpoint = <&xbar_adx1_out4_ep>;
+- };
++ xbar_amx4_in4_ep: endpoint {
++ remote-endpoint = <&amx4_in4_ep>;
+ };
+ };
+- };
+
+- adx@2903900 {
+- status = "okay";
++ port@3f {
++ reg = <0x3f>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ xbar_amx4_out_ep: endpoint {
++ remote-endpoint = <&amx4_out_ep>;
++ };
++ };
+
+- port@0 {
+- reg = <0>;
++ xbar_adx1_in_port: port@40 {
++ reg = <0x40>;
+
+- adx2_in_ep: endpoint {
+- remote-endpoint = <&xbar_adx2_in_ep>;
+- };
++ xbar_adx1_in_ep: endpoint {
++ remote-endpoint = <&adx1_in_ep>;
+ };
++ };
+
+- adx2_out1_port: port@1 {
+- reg = <1>;
++ port@41 {
++ reg = <0x41>;
+
+- adx2_out1_ep: endpoint {
+- remote-endpoint = <&xbar_adx2_out1_ep>;
+- };
++ xbar_adx1_out1_ep: endpoint {
++ remote-endpoint = <&adx1_out1_ep>;
+ };
++ };
+
+- adx2_out2_port: port@2 {
+- reg = <2>;
+-
+- adx2_out2_ep: endpoint {
+- remote-endpoint = <&xbar_adx2_out2_ep>;
+- };
++ port@42 {
++ reg = <0x42>;
++
++ xbar_adx1_out2_ep: endpoint {
++ remote-endpoint = <&adx1_out2_ep>;
+ };
++ };
+
+- adx2_out3_port: port@3 {
+- reg = <3>;
++ port@43 {
++ reg = <0x43>;
+
+- adx2_out3_ep: endpoint {
+- remote-endpoint = <&xbar_adx2_out3_ep>;
+- };
++ xbar_adx1_out3_ep: endpoint {
++ remote-endpoint = <&adx1_out3_ep>;
+ };
++ };
+
+- adx2_out4_port: port@4 {
+- reg = <4>;
++ port@44 {
++ reg = <0x44>;
+
+- adx2_out4_ep: endpoint {
+- remote-endpoint = <&xbar_adx2_out4_ep>;
+- };
++ xbar_adx1_out4_ep: endpoint {
++ remote-endpoint = <&adx1_out4_ep>;
+ };
+ };
+- };
+
+- adx@2903a00 {
+- status = "okay";
++ xbar_adx2_in_port: port@45 {
++ reg = <0x45>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ xbar_adx2_in_ep: endpoint {
++ remote-endpoint = <&adx2_in_ep>;
++ };
++ };
+
+- port@0 {
+- reg = <0>;
++ port@46 {
++ reg = <0x46>;
+
+- adx3_in_ep: endpoint {
+- remote-endpoint = <&xbar_adx3_in_ep>;
+- };
++ xbar_adx2_out1_ep: endpoint {
++ remote-endpoint = <&adx2_out1_ep>;
+ };
++ };
+
+- adx3_out1_port: port@1 {
+- reg = <1>;
++ port@47 {
++ reg = <0x47>;
+
+- adx3_out1_ep: endpoint {
+- remote-endpoint = <&xbar_adx3_out1_ep>;
+- };
++ xbar_adx2_out2_ep: endpoint {
++ remote-endpoint = <&adx2_out2_ep>;
+ };
++ };
+
+- adx3_out2_port: port@2 {
+- reg = <2>;
++ port@48 {
++ reg = <0x48>;
+
+- adx3_out2_ep: endpoint {
+- remote-endpoint = <&xbar_adx3_out2_ep>;
+- };
++ xbar_adx2_out3_ep: endpoint {
++ remote-endpoint = <&adx2_out3_ep>;
+ };
++ };
+
+- adx3_out3_port: port@3 {
+- reg = <3>;
++ port@49 {
++ reg = <0x49>;
+
+- adx3_out3_ep: endpoint {
+- remote-endpoint = <&xbar_adx3_out3_ep>;
+- };
++ xbar_adx2_out4_ep: endpoint {
++ remote-endpoint = <&adx2_out4_ep>;
+ };
++ };
+
+- adx3_out4_port: port@4 {
+- reg = <4>;
++ xbar_adx3_in_port: port@4a {
++ reg = <0x4a>;
+
+- adx3_out4_ep: endpoint {
+- remote-endpoint = <&xbar_adx3_out4_ep>;
+- };
++ xbar_adx3_in_ep: endpoint {
++ remote-endpoint = <&adx3_in_ep>;
+ };
+ };
+- };
+
+- adx@2903b00 {
+- status = "okay";
++ port@4b {
++ reg = <0x4b>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ xbar_adx3_out1_ep: endpoint {
++ remote-endpoint = <&adx3_out1_ep>;
++ };
++ };
+
+- port@0 {
+- reg = <0>;
++ port@4c {
++ reg = <0x4c>;
+
+- adx4_in_ep: endpoint {
+- remote-endpoint = <&xbar_adx4_in_ep>;
+- };
++ xbar_adx3_out2_ep: endpoint {
++ remote-endpoint = <&adx3_out2_ep>;
+ };
++ };
+
+- adx4_out1_port: port@1 {
+- reg = <1>;
++ port@4d {
++ reg = <0x4d>;
+
+- adx4_out1_ep: endpoint {
+- remote-endpoint = <&xbar_adx4_out1_ep>;
+- };
++ xbar_adx3_out3_ep: endpoint {
++ remote-endpoint = <&adx3_out3_ep>;
+ };
++ };
+
+- adx4_out2_port: port@2 {
+- reg = <2>;
++ port@4e {
++ reg = <0x4e>;
+
+- adx4_out2_ep: endpoint {
+- remote-endpoint = <&xbar_adx4_out2_ep>;
+- };
++ xbar_adx3_out4_ep: endpoint {
++ remote-endpoint = <&adx3_out4_ep>;
+ };
++ };
+
+- adx4_out3_port: port@3 {
+- reg = <3>;
++ xbar_adx4_in_port: port@4f {
++ reg = <0x4f>;
+
+- adx4_out3_ep: endpoint {
+- remote-endpoint = <&xbar_adx4_out3_ep>;
+- };
++ xbar_adx4_in_ep: endpoint {
++ remote-endpoint = <&adx4_in_ep>;
+ };
++ };
+
+- adx4_out4_port: port@4 {
+- reg = <4>;
++ port@50 {
++ reg = <0x50>;
+
+- adx4_out4_ep: endpoint {
+- remote-endpoint = <&xbar_adx4_out4_ep>;
+- };
++ xbar_adx4_out1_ep: endpoint {
++ remote-endpoint = <&adx4_out1_ep>;
+ };
+ };
+- };
+
+- processing-engine@2908000 {
+- status = "okay";
++ port@51 {
++ reg = <0x51>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ xbar_adx4_out2_ep: endpoint {
++ remote-endpoint = <&adx4_out2_ep>;
++ };
++ };
+
+- port@0 {
+- reg = <0x0>;
++ port@52 {
++ reg = <0x52>;
+
+- ope1_cif_in_ep: endpoint {
+- remote-endpoint = <&xbar_ope1_in_ep>;
+- };
++ xbar_adx4_out3_ep: endpoint {
++ remote-endpoint = <&adx4_out3_ep>;
+ };
++ };
+
+- ope1_out_port: port@1 {
+- reg = <0x1>;
++ port@53 {
++ reg = <0x53>;
+
+- ope1_cif_out_ep: endpoint {
+- remote-endpoint = <&xbar_ope1_out_ep>;
+- };
++ xbar_adx4_out4_ep: endpoint {
++ remote-endpoint = <&adx4_out4_ep>;
+ };
+ };
+- };
+
+- amixer@290bb00 {
+- status = "okay";
++ xbar_mixer_in1_port: port@54 {
++ reg = <0x54>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ xbar_mixer_in1_ep: endpoint {
++ remote-endpoint = <&mixer_in1_ep>;
++ };
++ };
+
+- port@0 {
+- reg = <0x0>;
++ xbar_mixer_in2_port: port@55 {
++ reg = <0x55>;
+
+- mixer_in1_ep: endpoint {
+- remote-endpoint = <&xbar_mixer_in1_ep>;
+- };
++ xbar_mixer_in2_ep: endpoint {
++ remote-endpoint = <&mixer_in2_ep>;
+ };
++ };
+
+- port@1 {
+- reg = <0x1>;
++ xbar_mixer_in3_port: port@56 {
++ reg = <0x56>;
+
+- mixer_in2_ep: endpoint {
+- remote-endpoint = <&xbar_mixer_in2_ep>;
+- };
++ xbar_mixer_in3_ep: endpoint {
++ remote-endpoint = <&mixer_in3_ep>;
+ };
++ };
+
+- port@2 {
+- reg = <0x2>;
++ xbar_mixer_in4_port: port@57 {
++ reg = <0x57>;
+
+- mixer_in3_ep: endpoint {
+- remote-endpoint = <&xbar_mixer_in3_ep>;
+- };
++ xbar_mixer_in4_ep: endpoint {
++ remote-endpoint = <&mixer_in4_ep>;
+ };
++ };
+
+- port@3 {
+- reg = <0x3>;
++ xbar_mixer_in5_port: port@58 {
++ reg = <0x58>;
+
+- mixer_in4_ep: endpoint {
+- remote-endpoint = <&xbar_mixer_in4_ep>;
+- };
++ xbar_mixer_in5_ep: endpoint {
++ remote-endpoint = <&mixer_in5_ep>;
+ };
++ };
+
+- port@4 {
+- reg = <0x4>;
++ xbar_mixer_in6_port: port@59 {
++ reg = <0x59>;
+
+- mixer_in5_ep: endpoint {
+- remote-endpoint = <&xbar_mixer_in5_ep>;
+- };
++ xbar_mixer_in6_ep: endpoint {
++ remote-endpoint = <&mixer_in6_ep>;
+ };
++ };
+
+- port@5 {
+- reg = <0x5>;
++ xbar_mixer_in7_port: port@5a {
++ reg = <0x5a>;
+
+- mixer_in6_ep: endpoint {
+- remote-endpoint = <&xbar_mixer_in6_ep>;
+- };
++ xbar_mixer_in7_ep: endpoint {
++ remote-endpoint = <&mixer_in7_ep>;
+ };
++ };
+
+- port@6 {
+- reg = <0x6>;
+-
+- mixer_in7_ep: endpoint {
+- remote-endpoint = <&xbar_mixer_in7_ep>;
+- };
++ xbar_mixer_in8_port: port@5b {
++ reg = <0x5b>;
++
++ xbar_mixer_in8_ep: endpoint {
++ remote-endpoint = <&mixer_in8_ep>;
+ };
++ };
+
+- port@7 {
+- reg = <0x7>;
++ xbar_mixer_in9_port: port@5c {
++ reg = <0x5c>;
+
+- mixer_in8_ep: endpoint {
+- remote-endpoint = <&xbar_mixer_in8_ep>;
+- };
++ xbar_mixer_in9_ep: endpoint {
++ remote-endpoint = <&mixer_in9_ep>;
+ };
++ };
+
+- port@8 {
+- reg = <0x8>;
++ xbar_mixer_in10_port: port@5d {
++ reg = <0x5d>;
+
+- mixer_in9_ep: endpoint {
+- remote-endpoint = <&xbar_mixer_in9_ep>;
+- };
++ xbar_mixer_in10_ep: endpoint {
++ remote-endpoint = <&mixer_in10_ep>;
+ };
++ };
+
+- port@9 {
+- reg = <0x9>;
++ port@5e {
++ reg = <0x5e>;
+
+- mixer_in10_ep: endpoint {
+- remote-endpoint = <&xbar_mixer_in10_ep>;
+- };
++ xbar_mixer_out1_ep: endpoint {
++ remote-endpoint = <&mixer_out1_ep>;
+ };
++ };
+
+- mixer_out1_port: port@a {
+- reg = <0xa>;
++ port@5f {
++ reg = <0x5f>;
+
+- mixer_out1_ep: endpoint {
+- remote-endpoint = <&xbar_mixer_out1_ep>;
+- };
++ xbar_mixer_out2_ep: endpoint {
++ remote-endpoint = <&mixer_out2_ep>;
+ };
++ };
+
+- mixer_out2_port: port@b {
+- reg = <0xb>;
++ port@60 {
++ reg = <0x60>;
+
+- mixer_out2_ep: endpoint {
+- remote-endpoint = <&xbar_mixer_out2_ep>;
+- };
++ xbar_mixer_out3_ep: endpoint {
++ remote-endpoint = <&mixer_out3_ep>;
+ };
++ };
+
+- mixer_out3_port: port@c {
+- reg = <0xc>;
++ port@61 {
++ reg = <0x61>;
+
+- mixer_out3_ep: endpoint {
+- remote-endpoint = <&xbar_mixer_out3_ep>;
+- };
++ xbar_mixer_out4_ep: endpoint {
++ remote-endpoint = <&mixer_out4_ep>;
+ };
++ };
+
+- mixer_out4_port: port@d {
+- reg = <0xd>;
++ port@62 {
++ reg = <0x62>;
+
+- mixer_out4_ep: endpoint {
+- remote-endpoint = <&xbar_mixer_out4_ep>;
+- };
++ xbar_mixer_out5_ep: endpoint {
++ remote-endpoint = <&mixer_out5_ep>;
+ };
++ };
+
+- mixer_out5_port: port@e {
+- reg = <0xe>;
++ xbar_asrc_in1_port: port@63 {
++ reg = <0x63>;
+
+- mixer_out5_ep: endpoint {
+- remote-endpoint = <&xbar_mixer_out5_ep>;
+- };
++ xbar_asrc_in1_ep: endpoint {
++ remote-endpoint = <&asrc_in1_ep>;
+ };
+ };
+- };
+
+- asrc@2910000 {
+- status = "okay";
++ port@64 {
++ reg = <0x64>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ xbar_asrc_out1_ep: endpoint {
++ remote-endpoint = <&asrc_out1_ep>;
++ };
++ };
+
+- port@0 {
+- reg = <0x0>;
++ xbar_asrc_in2_port: port@65 {
++ reg = <0x65>;
+
+- asrc_in1_ep: endpoint {
+- remote-endpoint = <&xbar_asrc_in1_ep>;
+- };
++ xbar_asrc_in2_ep: endpoint {
++ remote-endpoint = <&asrc_in2_ep>;
+ };
++ };
+
+- port@1 {
+- reg = <0x1>;
++ port@66 {
++ reg = <0x66>;
+
+- asrc_in2_ep: endpoint {
+- remote-endpoint = <&xbar_asrc_in2_ep>;
+- };
++ xbar_asrc_out2_ep: endpoint {
++ remote-endpoint = <&asrc_out2_ep>;
+ };
++ };
+
+- port@2 {
+- reg = <0x2>;
++ xbar_asrc_in3_port: port@67 {
++ reg = <0x67>;
+
+- asrc_in3_ep: endpoint {
+- remote-endpoint = <&xbar_asrc_in3_ep>;
+- };
++ xbar_asrc_in3_ep: endpoint {
++ remote-endpoint = <&asrc_in3_ep>;
+ };
++ };
+
+- port@3 {
+- reg = <0x3>;
++ port@68 {
++ reg = <0x68>;
+
+- asrc_in4_ep: endpoint {
+- remote-endpoint = <&xbar_asrc_in4_ep>;
+- };
++ xbar_asrc_out3_ep: endpoint {
++ remote-endpoint = <&asrc_out3_ep>;
+ };
++ };
+
+- port@4 {
+- reg = <0x4>;
++ xbar_asrc_in4_port: port@69 {
++ reg = <0x69>;
+
+- asrc_in5_ep: endpoint {
+- remote-endpoint = <&xbar_asrc_in5_ep>;
+- };
++ xbar_asrc_in4_ep: endpoint {
++ remote-endpoint = <&asrc_in4_ep>;
+ };
++ };
+
+- port@5 {
+- reg = <0x5>;
++ port@6a {
++ reg = <0x6a>;
+
+- asrc_in6_ep: endpoint {
+- remote-endpoint = <&xbar_asrc_in6_ep>;
+- };
++ xbar_asrc_out4_ep: endpoint {
++ remote-endpoint = <&asrc_out4_ep>;
+ };
++ };
+
+- port@6 {
+- reg = <0x6>;
++ xbar_asrc_in5_port: port@6b {
++ reg = <0x6b>;
+
+- asrc_in7_ep: endpoint {
+- remote-endpoint = <&xbar_asrc_in7_ep>;
+- };
++ xbar_asrc_in5_ep: endpoint {
++ remote-endpoint = <&asrc_in5_ep>;
+ };
++ };
+
+- asrc_out1_port: port@7 {
+- reg = <0x7>;
++ port@6c {
++ reg = <0x6c>;
+
+- asrc_out1_ep: endpoint {
+- remote-endpoint = <&xbar_asrc_out1_ep>;
+- };
++ xbar_asrc_out5_ep: endpoint {
++ remote-endpoint = <&asrc_out5_ep>;
+ };
++ };
+
+- asrc_out2_port: port@8 {
+- reg = <0x8>;
++ xbar_asrc_in6_port: port@6d {
++ reg = <0x6d>;
+
+- asrc_out2_ep: endpoint {
+- remote-endpoint = <&xbar_asrc_out2_ep>;
+- };
++ xbar_asrc_in6_ep: endpoint {
++ remote-endpoint = <&asrc_in6_ep>;
+ };
++ };
+
+- asrc_out3_port: port@9 {
+- reg = <0x9>;
++ port@6e {
++ reg = <0x6e>;
+
+- asrc_out3_ep: endpoint {
+- remote-endpoint = <&xbar_asrc_out3_ep>;
+- };
++ xbar_asrc_out6_ep: endpoint {
++ remote-endpoint = <&asrc_out6_ep>;
+ };
++ };
+
+- asrc_out4_port: port@a {
+- reg = <0xa>;
++ xbar_asrc_in7_port: port@6f {
++ reg = <0x6f>;
+
+- asrc_out4_ep: endpoint {
+- remote-endpoint = <&xbar_asrc_out4_ep>;
+- };
++ xbar_asrc_in7_ep: endpoint {
++ remote-endpoint = <&asrc_in7_ep>;
+ };
++ };
+
+- asrc_out5_port: port@b {
+- reg = <0xb>;
++ xbar_ope1_in_port: port@70 {
++ reg = <0x70>;
+
+- asrc_out5_ep: endpoint {
+- remote-endpoint = <&xbar_asrc_out5_ep>;
+- };
++ xbar_ope1_in_ep: endpoint {
++ remote-endpoint = <&ope1_cif_in_ep>;
+ };
++ };
+
+- asrc_out6_port: port@c {
+- reg = <0xc>;
++ port@71 {
++ reg = <0x71>;
+
+- asrc_out6_ep: endpoint {
+- remote-endpoint = <&xbar_asrc_out6_ep>;
+- };
++ xbar_ope1_out_ep: endpoint {
++ remote-endpoint = <&ope1_cif_out_ep>;
+ };
+ };
+ };
+ };
++
++ dma-controller@2930000 {
++ status = "okay";
++ };
++
++ interrupt-controller@2a40000 {
++ status = "okay";
++ };
+ };
+
+ i2c@3160000 {
+@@ -2283,6 +2283,10 @@ mmc@3400000 {
+ vmmc-supply = <&vdd_sd>;
+ };
+
++ sata@3507000 {
++ status = "okay";
++ };
++
+ hda@3510000 {
+ nvidia,model = "NVIDIA Jetson TX2 HDA";
+ status = "okay";
+@@ -2471,10 +2475,6 @@ dpaux@155c0000 {
+ };
+ };
+
+- sata@3507000 {
+- status = "okay";
+- };
+-
+ gpio-keys {
+ compatible = "gpio-keys";
+
+@@ -2489,21 +2489,21 @@ key-power {
+ wakeup-source;
+ };
+
+- key-volume-up {
+- label = "Volume Up";
+- gpios = <&gpio_aon TEGRA186_AON_GPIO(FF, 1)
++ key-volume-down {
++ label = "Volume Down";
++ gpios = <&gpio_aon TEGRA186_AON_GPIO(FF, 2)
+ GPIO_ACTIVE_LOW>;
+ linux,input-type = <EV_KEY>;
+- linux,code = <KEY_VOLUMEUP>;
++ linux,code = <KEY_VOLUMEDOWN>;
+ debounce-interval = <10>;
+ };
+
+- key-volume-down {
+- label = "Volume Down";
+- gpios = <&gpio_aon TEGRA186_AON_GPIO(FF, 2)
++ key-volume-up {
++ label = "Volume Up";
++ gpios = <&gpio_aon TEGRA186_AON_GPIO(FF, 1)
+ GPIO_ACTIVE_LOW>;
+ linux,input-type = <EV_KEY>;
+- linux,code = <KEY_VOLUMEDOWN>;
++ linux,code = <KEY_VOLUMEUP>;
+ debounce-interval = <10>;
+ };
+ };
+diff --git a/arch/arm64/boot/dts/nvidia/tegra186-p3310.dtsi b/arch/arm64/boot/dts/nvidia/tegra186-p3310.dtsi
+index aff857df25cf4..a4264ea417285 100644
+--- a/arch/arm64/boot/dts/nvidia/tegra186-p3310.dtsi
++++ b/arch/arm64/boot/dts/nvidia/tegra186-p3310.dtsi
+@@ -190,32 +190,6 @@ pmc@c360000 {
+ nvidia,invert-interrupt;
+ };
+
+- cpus {
+- cpu@0 {
+- enable-method = "psci";
+- };
+-
+- cpu@1 {
+- enable-method = "psci";
+- };
+-
+- cpu@2 {
+- enable-method = "psci";
+- };
+-
+- cpu@3 {
+- enable-method = "psci";
+- };
+-
+- cpu@4 {
+- enable-method = "psci";
+- };
+-
+- cpu@5 {
+- enable-method = "psci";
+- };
+- };
+-
+ bpmp {
+ i2c {
+ status = "okay";
+@@ -235,6 +209,23 @@ pmic: pmic@3c {
+ pinctrl-names = "default";
+ pinctrl-0 = <&max77620_default>;
+
++ fps {
++ fps0 {
++ maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN0>;
++ maxim,shutdown-fps-time-period-us = <640>;
++ };
++
++ fps1 {
++ maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN1>;
++ maxim,shutdown-fps-time-period-us = <640>;
++ };
++
++ fps2 {
++ maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN0>;
++ maxim,shutdown-fps-time-period-us = <640>;
++ };
++ };
++
+ max77620_default: pinmux {
+ gpio0 {
+ pins = "gpio0";
+@@ -284,23 +275,6 @@ gpio7 {
+ };
+ };
+
+- fps {
+- fps0 {
+- maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN0>;
+- maxim,shutdown-fps-time-period-us = <640>;
+- };
+-
+- fps1 {
+- maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN1>;
+- maxim,shutdown-fps-time-period-us = <640>;
+- };
+-
+- fps2 {
+- maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN0>;
+- maxim,shutdown-fps-time-period-us = <640>;
+- };
+- };
+-
+ regulators {
+ in-sd0-supply = <&vdd_5v0_sys>;
+ in-sd1-supply = <&vdd_5v0_sys>;
+@@ -387,6 +361,32 @@ vdd_pex: ldo8 {
+ };
+ };
+
++ cpus {
++ cpu@0 {
++ enable-method = "psci";
++ };
++
++ cpu@1 {
++ enable-method = "psci";
++ };
++
++ cpu@2 {
++ enable-method = "psci";
++ };
++
++ cpu@3 {
++ enable-method = "psci";
++ };
++
++ cpu@4 {
++ enable-method = "psci";
++ };
++
++ cpu@5 {
++ enable-method = "psci";
++ };
++ };
++
+ psci {
+ compatible = "arm,psci-1.0";
+ status = "okay";
+diff --git a/arch/arm64/boot/dts/nvidia/tegra186-p3509-0000+p3636-0001.dts b/arch/arm64/boot/dts/nvidia/tegra186-p3509-0000+p3636-0001.dts
+index 3e83a4d52eb1e..26f71651933d1 100644
+--- a/arch/arm64/boot/dts/nvidia/tegra186-p3509-0000+p3636-0001.dts
++++ b/arch/arm64/boot/dts/nvidia/tegra186-p3509-0000+p3636-0001.dts
+@@ -56,679 +56,282 @@ phy: ethernet-phy@0 {
+ };
+ };
+
+- memory-controller@2c00000 {
+- status = "okay";
+- };
+-
+- timer@3010000 {
++ aconnect@2900000 {
+ status = "okay";
+- };
+
+- serial@3100000 {
+- status = "okay";
+- };
++ ahub@2900800 {
++ status = "okay";
+
+- i2c@3160000 {
+- status = "okay";
+- };
++ i2s@2901000 {
++ status = "okay";
+
+- i2c@3180000 {
+- status = "okay";
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- power-monitor@40 {
+- compatible = "ti,ina3221";
+- reg = <0x40>;
+- #address-cells = <1>;
+- #size-cells = <0>;
++ port@0 {
++ reg = <0>;
+
+- input@0 {
+- reg = <0>;
+- label = "VDD_IN";
+- shunt-resistor-micro-ohms = <5>;
+- };
++ i2s1_cif_ep: endpoint {
++ remote-endpoint = <&xbar_i2s1_ep>;
++ };
++ };
+
+- input@1 {
+- reg = <1>;
+- label = "VDD_CPU_GPU";
+- shunt-resistor-micro-ohms = <5>;
+- };
++ i2s1_port: port@1 {
++ reg = <1>;
+
+- input@2 {
+- reg = <2>;
+- label = "VDD_SOC";
+- shunt-resistor-micro-ohms = <5>;
++ i2s1_dap_ep: endpoint {
++ dai-format = "i2s";
++ /* Placeholder for external Codec */
++ };
++ };
++ };
+ };
+- };
+- };
+
+- ddc: i2c@3190000 {
+- status = "okay";
+- };
++ i2s@2901200 {
++ status = "okay";
+
+- i2c@31c0000 {
+- status = "okay";
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- i2c@31e0000 {
+- status = "okay";
+- };
++ port@0 {
++ reg = <0>;
+
+- /* SDMMC4 (eMMC) */
+- mmc@3460000 {
+- status = "okay";
+- bus-width = <8>;
+- non-removable;
++ i2s3_cif_ep: endpoint {
++ remote-endpoint = <&xbar_i2s3_ep>;
++ };
++ };
+
+- vqmmc-supply = <&vdd_1v8_ap>;
+- vmmc-supply = <&vdd_3v3_sys>;
+- };
++ i2s3_port: port@1 {
++ reg = <1>;
+
+- hda@3510000 {
+- nvidia,model = "NVIDIA Jetson TX2 NX HDA";
+- status = "okay";
+- };
++ i2s3_dap_ep: endpoint {
++ dai-format = "i2s";
++ /* Placeholder for external Codec */
++ };
++ };
++ };
++ };
+
+- padctl@3520000 {
+- status = "okay";
++ dmic@2904000 {
++ status = "okay";
+
+- avdd-pll-erefeut-supply = <&vdd_1v8_pll>;
+- avdd-usb-supply = <&vdd_3v3_sys>;
+- vclamp-usb-supply = <&vdd_1v8>;
+- vddio-hsic-supply = <&gnd>;
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- pads {
+- usb2 {
+- status = "okay";
++ port@0 {
++ reg = <0>;
+
+- lanes {
+- micro_b: usb2-0 {
+- nvidia,function = "xusb";
+- status = "okay";
++ dmic1_cif_ep: endpoint {
++ remote-endpoint = <&xbar_dmic1_ep>;
++ };
+ };
+
+- usb2-1 {
+- nvidia,function = "xusb";
+- status = "okay";
+- };
++ dmic1_port: port@1 {
++ reg = <1>;
+
+- usb2-2 {
+- nvidia,function = "xusb";
+- status = "okay";
++ dmic1_dap_ep: endpoint {
++ /* Place holder for external Codec */
++ };
+ };
+ };
+ };
+
+- usb3 {
++ dmic@2904100 {
+ status = "okay";
+
+- lanes {
+- usb3-1 {
+- nvidia,function = "xusb";
+- status = "okay";
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
++
++ port@0 {
++ reg = <0>;
++
++ dmic2_cif_ep: endpoint {
++ remote-endpoint = <&xbar_dmic2_ep>;
++ };
+ };
+- };
+- };
+- };
+
+- ports {
+- usb2-0 {
+- status = "okay";
+- mode = "otg";
+- vbus-supply = <&vdd_5v0_sys>;
+- usb-role-switch;
++ dmic2_port: port@1 {
++ reg = <1>;
+
+- connector {
+- compatible = "gpio-usb-b-connector",
+- "usb-b-connector";
+- label = "micro-USB";
+- type = "micro";
+- vbus-gpios = <&gpio
+- TEGRA186_MAIN_GPIO(L, 4)
+- GPIO_ACTIVE_LOW>;
+- id-gpios = <&pmic 0 GPIO_ACTIVE_HIGH>;
++ dmic2_dap_ep: endpoint {
++ /* Place holder for external Codec */
++ };
++ };
+ };
+ };
+
+- usb2-1 {
++ admaif@290f000 {
+ status = "okay";
+- mode = "host";
+
+- vbus-supply = <&vdd_5v0_sys>;
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- usb2-2 {
+- status = "okay";
+- mode = "host";
++ admaif0_port: port@0 {
++ reg = <0x0>;
+
+- vbus-supply = <&vdd_5v0_sys>;
+- };
++ admaif0_ep: endpoint {
++ remote-endpoint = <&xbar_admaif0_ep>;
++ };
++ };
+
+- usb3-1 {
+- nvidia,usb2-companion = <1>;
+- vbus-supply = <&vdd_5v0_sys>;
+- status = "okay";
+- };
+- };
+- };
++ admaif1_port: port@1 {
++ reg = <0x1>;
+
+- usb@3530000 {
+- status = "okay";
++ admaif1_ep: endpoint {
++ remote-endpoint = <&xbar_admaif1_ep>;
++ };
++ };
+
+- phys = <&{/padctl@3520000/pads/usb2/lanes/usb2-0}>,
+- <&{/padctl@3520000/pads/usb2/lanes/usb2-1}>,
+- <&{/padctl@3520000/pads/usb2/lanes/usb2-2}>,
+- <&{/padctl@3520000/pads/usb3/lanes/usb3-1}>;
+- phy-names = "usb2-0", "usb2-1", "usb2-2", "usb3-1";
+- };
++ admaif2_port: port@2 {
++ reg = <0x2>;
+
+- usb@3550000 {
+- status = "okay";
++ admaif2_ep: endpoint {
++ remote-endpoint = <&xbar_admaif2_ep>;
++ };
++ };
+
+- phys = <µ_b>;
+- phy-names = "usb2-0";
+- };
++ admaif3_port: port@3 {
++ reg = <0x3>;
+
+- hsp@3c00000 {
+- status = "okay";
+- };
++ admaif3_ep: endpoint {
++ remote-endpoint = <&xbar_admaif3_ep>;
++ };
++ };
+
+- i2c@c240000 {
+- status = "okay";
+- };
++ admaif4_port: port@4 {
++ reg = <0x4>;
+
+- i2c@c250000 {
+- status = "okay";
++ admaif4_ep: endpoint {
++ remote-endpoint = <&xbar_admaif4_ep>;
++ };
++ };
+
+- /* module ID EEPROM */
+- eeprom@50 {
+- compatible = "atmel,24c02";
+- reg = <0x50>;
++ admaif5_port: port@5 {
++ reg = <0x5>;
+
+- label = "module";
+- vcc-supply = <&vdd_1v8>;
+- address-width = <8>;
+- pagesize = <8>;
+- size = <256>;
+- read-only;
+- };
+-
+- /* carrier board ID EEPROM */
+- eeprom@57 {
+- compatible = "atmel,24c02";
+- reg = <0x57>;
+-
+- label = "system";
+- vcc-supply = <&vdd_1v8>;
+- address-width = <8>;
+- pagesize = <8>;
+- size = <256>;
+- read-only;
+- };
+- };
+-
+- rtc@c2a0000 {
+- status = "okay";
+- };
+-
+- pwm@c340000 {
+- status = "okay";
+- };
+-
+- pmc@c360000 {
+- nvidia,invert-interrupt;
+- };
+-
+- pcie@10003000 {
+- status = "okay";
+-
+- dvdd-pex-supply = <&vdd_pex>;
+- hvdd-pex-pll-supply = <&vdd_1v8>;
+- hvdd-pex-supply = <&vdd_1v8>;
+- vddio-pexctl-aud-supply = <&vdd_1v8>;
+-
+- pci@1,0 {
+- nvidia,num-lanes = <2>;
+- status = "okay";
+- };
+-
+- pci@2,0 {
+- nvidia,num-lanes = <1>;
+- status = "disabled";
+- };
+-
+- pci@3,0 {
+- nvidia,num-lanes = <1>;
+- status = "okay";
+- };
+- };
+-
+- host1x@13e00000 {
+- status = "okay";
+-
+- dpaux@15040000 {
+- status = "okay";
+- };
+-
+- display-hub@15200000 {
+- status = "okay";
+- };
+-
+- dsi@15300000 {
+- status = "disabled";
+- };
+-
+- /* DP */
+- sor@15540000 {
+- status = "okay";
+-
+- avdd-io-hdmi-dp-supply = <&vdd_hdmi_1v05>;
+- vdd-hdmi-dp-pll-supply = <&vdd_1v8_ap>;
+-
+- nvidia,dpaux = <&dpaux>;
+- };
+-
+- /* HDMI */
+- sor@15580000 {
+- status = "okay";
+-
+- avdd-io-hdmi-dp-supply = <&vdd_hdmi_1v05>;
+- vdd-hdmi-dp-pll-supply = <&vdd_1v8_ap>;
+- hdmi-supply = <&vdd_hdmi>;
+-
+- nvidia,ddc-i2c-bus = <&ddc>;
+- nvidia,hpd-gpio = <&gpio TEGRA186_MAIN_GPIO(P, 1)
+- GPIO_ACTIVE_LOW>;
+- };
+-
+- dpaux@155c0000 {
+- status = "okay";
+- };
+- };
+-
+- gpu@17000000 {
+- status = "okay";
+- };
+-
+- fan: pwm-fan {
+- compatible = "pwm-fan";
+- pwms = <&pwm4 0 45334>;
+-
+- cooling-levels = <0 64 128 255>;
+- #cooling-cells = <2>;
+- };
+-
+- gpio-keys {
+- compatible = "gpio-keys";
+-
+- key-power {
+- label = "Power";
+- gpios = <&gpio_aon TEGRA186_AON_GPIO(FF, 0)
+- GPIO_ACTIVE_LOW>;
+- linux,input-type = <EV_KEY>;
+- linux,code = <KEY_POWER>;
+- debounce-interval = <10>;
+- wakeup-event-action = <EV_ACT_ASSERTED>;
+- wakeup-source;
+- };
+-
+- key-volume-up {
+- label = "Volume Up";
+- gpios = <&gpio_aon TEGRA186_AON_GPIO(FF, 1)
+- GPIO_ACTIVE_LOW>;
+- linux,input-type = <EV_KEY>;
+- linux,code = <KEY_VOLUMEUP>;
+- debounce-interval = <10>;
+- };
+-
+- key-volume-down {
+- label = "Volume Down";
+- gpios = <&gpio_aon TEGRA186_AON_GPIO(FF, 2)
+- GPIO_ACTIVE_LOW>;
+- linux,input-type = <EV_KEY>;
+- linux,code = <KEY_VOLUMEDOWN>;
+- debounce-interval = <10>;
+- };
+- };
+-
+- cpus {
+- cpu@0 {
+- enable-method = "psci";
+- };
+-
+- cpu@1 {
+- enable-method = "psci";
+- };
+-
+- cpu@2 {
+- enable-method = "psci";
+- };
+-
+- cpu@3 {
+- enable-method = "psci";
+- };
+-
+- cpu@4 {
+- enable-method = "psci";
+- };
+-
+- cpu@5 {
+- enable-method = "psci";
+- };
+- };
+-
+- bpmp {
+- i2c {
+- status = "okay";
+-
+- pmic: pmic@3c {
+- compatible = "maxim,max77620";
+- reg = <0x3c>;
+-
+- interrupt-parent = <&pmc>;
+- interrupts = <24 IRQ_TYPE_LEVEL_LOW>;
+- #interrupt-cells = <2>;
+- interrupt-controller;
+-
+- #gpio-cells = <2>;
+- gpio-controller;
+-
+- pinctrl-names = "default";
+- pinctrl-0 = <&max77620_default>;
+-
+- max77620_default: pinmux {
+- gpio0 {
+- pins = "gpio0";
+- function = "gpio";
+- };
+-
+- gpio1 {
+- pins = "gpio1";
+- function = "fps-out";
+- maxim,active-fps-source = <MAX77620_FPS_SRC_0>;
+- };
+-
+- gpio2 {
+- pins = "gpio2";
+- function = "fps-out";
+- maxim,active-fps-source = <MAX77620_FPS_SRC_1>;
+- };
+-
+- gpio3 {
+- pins = "gpio3";
+- function = "fps-out";
+- maxim,active-fps-source = <MAX77620_FPS_SRC_1>;
+- };
+-
+- gpio4 {
+- pins = "gpio4";
+- function = "32k-out1";
+- drive-push-pull = <1>;
+- };
+-
+- gpio5 {
+- pins = "gpio5";
+- function = "gpio";
+- drive-push-pull = <0>;
+- };
+-
+- gpio6 {
+- pins = "gpio6";
+- function = "gpio";
+- drive-push-pull = <1>;
++ admaif5_ep: endpoint {
++ remote-endpoint = <&xbar_admaif5_ep>;
++ };
+ };
+
+- gpio7 {
+- pins = "gpio7";
+- function = "gpio";
+- drive-push-pull = <1>;
+- };
+- };
++ admaif6_port: port@6 {
++ reg = <0x6>;
+
+- fps {
+- fps0 {
+- maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN0>;
+- maxim,shutdown-fps-time-period-us = <640>;
++ admaif6_ep: endpoint {
++ remote-endpoint = <&xbar_admaif6_ep>;
++ };
+ };
+
+- fps1 {
+- maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN1>;
+- maxim,shutdown-fps-time-period-us = <640>;
+- };
++ admaif7_port: port@7 {
++ reg = <0x7>;
+
+- fps2 {
+- maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN0>;
+- maxim,shutdown-fps-time-period-us = <640>;
++ admaif7_ep: endpoint {
++ remote-endpoint = <&xbar_admaif7_ep>;
++ };
+ };
+- };
+-
+- regulators {
+- in-sd0-supply = <&vdd_5v0_sys>;
+- in-sd1-supply = <&vdd_5v0_sys>;
+- in-sd2-supply = <&vdd_5v0_sys>;
+- in-sd3-supply = <&vdd_5v0_sys>;
+
+- in-ldo0-1-supply = <&vdd_5v0_sys>;
+- in-ldo2-supply = <&vdd_5v0_sys>;
+- in-ldo3-5-supply = <&vdd_5v0_sys>;
+- in-ldo4-6-supply = <&vdd_1v8>;
+- in-ldo7-8-supply = <&avdd_dsi_csi>;
++ admaif8_port: port@8 {
++ reg = <0x8>;
+
+- sd0 {
+- regulator-name = "VDD_DDR_1V1_PMIC";
+- regulator-min-microvolt = <1100000>;
+- regulator-max-microvolt = <1100000>;
+- regulator-always-on;
+- regulator-boot-on;
++ admaif8_ep: endpoint {
++ remote-endpoint = <&xbar_admaif8_ep>;
++ };
+ };
+
+- avdd_dsi_csi: sd1 {
+- regulator-name = "AVDD_DSI_CSI_1V2";
+- regulator-min-microvolt = <1200000>;
+- regulator-max-microvolt = <1200000>;
+- };
++ admaif9_port: port@9 {
++ reg = <0x9>;
+
+- vdd_1v8: sd2 {
+- regulator-name = "VDD_1V8";
+- regulator-min-microvolt = <1800000>;
+- regulator-max-microvolt = <1800000>;
++ admaif9_ep: endpoint {
++ remote-endpoint = <&xbar_admaif9_ep>;
++ };
+ };
+
+- vdd_3v3_sys: sd3 {
+- regulator-name = "VDD_3V3_SYS";
+- regulator-min-microvolt = <3300000>;
+- regulator-max-microvolt = <3300000>;
+- };
++ admaif10_port: port@a {
++ reg = <0xa>;
+
+- vdd_1v8_pll: ldo0 {
+- regulator-name = "VDD_1V8_AP_PLL";
+- regulator-min-microvolt = <1800000>;
+- regulator-max-microvolt = <1800000>;
++ admaif10_ep: endpoint {
++ remote-endpoint = <&xbar_admaif10_ep>;
++ };
+ };
+
+- ldo2 {
+- regulator-name = "VDDIO_3V3_AOHV";
+- regulator-min-microvolt = <3300000>;
+- regulator-max-microvolt = <3300000>;
+- regulator-always-on;
+- regulator-boot-on;
+- };
++ admaif11_port: port@b {
++ reg = <0xb>;
+
+- vddio_sdmmc1: ldo3 {
+- regulator-name = "VDDIO_SDMMC1_AP";
+- regulator-min-microvolt = <1800000>;
+- regulator-max-microvolt = <3300000>;
++ admaif11_ep: endpoint {
++ remote-endpoint = <&xbar_admaif11_ep>;
++ };
+ };
+
+- ldo4 {
+- regulator-name = "VDD_RTC";
+- regulator-min-microvolt = <1000000>;
+- regulator-max-microvolt = <1000000>;
+- };
++ admaif12_port: port@c {
++ reg = <0xc>;
+
+- vddio_sdmmc3: ldo5 {
+- regulator-name = "VDDIO_SDMMC3_AP";
+- regulator-min-microvolt = <2800000>;
+- regulator-max-microvolt = <2800000>;
++ admaif12_ep: endpoint {
++ remote-endpoint = <&xbar_admaif12_ep>;
++ };
+ };
+
+- vdd_hdmi_1v05: ldo7 {
+- regulator-name = "VDD_HDMI_1V05";
+- regulator-min-microvolt = <1050000>;
+- regulator-max-microvolt = <1050000>;
+- };
++ admaif13_port: port@d {
++ reg = <0xd>;
+
+- vdd_pex: ldo8 {
+- regulator-name = "VDD_PEX_1V05";
+- regulator-min-microvolt = <1050000>;
+- regulator-max-microvolt = <1050000>;
++ admaif13_ep: endpoint {
++ remote-endpoint = <&xbar_admaif13_ep>;
++ };
+ };
+- };
+- };
+- };
+- };
+-
+- psci {
+- compatible = "arm,psci-1.0";
+- status = "okay";
+- method = "smc";
+- };
+-
+- gnd: regulator-gnd {
+- compatible = "regulator-fixed";
+- regulator-name = "GND";
+- regulator-min-microvolt = <0>;
+- regulator-max-microvolt = <0>;
+- regulator-always-on;
+- regulator-boot-on;
+- };
+-
+- vdd_5v0_sys: regulator-vdd-5v0-sys {
+- compatible = "regulator-fixed";
+- regulator-name = "VDD_5V0_SYS";
+- regulator-min-microvolt = <5000000>;
+- regulator-max-microvolt = <5000000>;
+- regulator-always-on;
+- regulator-boot-on;
+- };
+-
+- vdd_1v8_ap: regulator-vdd-1v8-ap {
+- compatible = "regulator-fixed";
+- regulator-name = "VDD_1V8_AP";
+- regulator-min-microvolt = <1800000>;
+- regulator-max-microvolt = <1800000>;
+-
+- gpio = <&pmic 1 GPIO_ACTIVE_HIGH>;
+- enable-active-high;
+-
+- vin-supply = <&vdd_1v8>;
+- };
+-
+- vdd_hdmi: regulator-vdd-hdmi {
+- compatible = "regulator-fixed";
+- regulator-name = "VDD_5V0_HDMI_CON";
+- regulator-min-microvolt = <5000000>;
+- regulator-max-microvolt = <5000000>;
+-
+- vin-supply = <&vdd_5v0_sys>;
+- };
+-
+- thermal-zones {
+- cpu-thermal {
+- polling-delay = <0>;
+- polling-delay-passive = <500>;
+- status = "okay";
+-
+- trips {
+- cpu_trip_critical: critical {
+- temperature = <96500>;
+- hysteresis = <0>;
+- type = "critical";
+- };
+-
+- cpu_trip_hot: hot {
+- temperature = <79000>;
+- hysteresis = <2000>;
+- type = "hot";
+- };
+-
+- cpu_trip_active: active {
+- temperature = <62000>;
+- hysteresis = <2000>;
+- type = "active";
+- };
+-
+- cpu_trip_passive: passive {
+- temperature = <45000>;
+- hysteresis = <2000>;
+- type = "passive";
+- };
+- };
+-
+- cooling-maps {
+- cpu-critical {
+- cooling-device = <&fan 3 3>;
+- trip = <&cpu_trip_critical>;
+- };
+
+- cpu-hot {
+- cooling-device = <&fan 2 2>;
+- trip = <&cpu_trip_hot>;
+- };
++ admaif14_port: port@e {
++ reg = <0xe>;
+
+- cpu-active {
+- cooling-device = <&fan 1 1>;
+- trip = <&cpu_trip_active>;
+- };
++ admaif14_ep: endpoint {
++ remote-endpoint = <&xbar_admaif14_ep>;
++ };
++ };
+
+- cpu-passive {
+- cooling-device = <&fan 0 0>;
+- trip = <&cpu_trip_passive>;
+- };
+- };
+- };
++ admaif15_port: port@f {
++ reg = <0xf>;
+
+- aux-thermal {
+- polling-delay = <0>;
+- polling-delay-passive = <500>;
+- status = "okay";
++ admaif15_ep: endpoint {
++ remote-endpoint = <&xbar_admaif15_ep>;
++ };
++ };
+
+- trips {
+- aux_alert0: critical {
+- temperature = <90000>;
+- hysteresis = <0>;
+- type = "critical";
+- };
+- };
+- };
++ admaif16_port: port@10 {
++ reg = <0x10>;
+
+- gpu-thermal {
+- polling-delay = <0>;
+- polling-delay-passive = <500>;
+- status = "okay";
++ admaif16_ep: endpoint {
++ remote-endpoint = <&xbar_admaif16_ep>;
++ };
++ };
+
+- trips {
+- gpu_alert0: critical {
+- temperature = <99000>;
+- hysteresis = <0>;
+- type = "critical";
+- };
+- };
+- };
+- };
++ admaif17_port: port@11 {
++ reg = <0x11>;
+
+- aconnect@2900000 {
+- status = "okay";
++ admaif17_ep: endpoint {
++ remote-endpoint = <&xbar_admaif17_ep>;
++ };
++ };
+
+- dma-controller@2930000 {
+- status = "okay";
+- };
++ admaif18_port: port@12 {
++ reg = <0x12>;
+
+- interrupt-controller@2a40000 {
+- status = "okay";
+- };
++ admaif18_ep: endpoint {
++ remote-endpoint = <&xbar_admaif18_ep>;
++ };
++ };
+
+- ahub@2900800 {
+- status = "okay";
++ admaif19_port: port@13 {
++ reg = <0x13>;
++
++ admaif19_ep: endpoint {
++ remote-endpoint = <&xbar_admaif19_ep>;
++ };
++ };
++ };
++ };
+
+ ports {
+ #address-cells = <1>;
+@@ -809,395 +412,708 @@ xbar_admaif8_ep: endpoint {
+ port@9 {
+ reg = <0x9>;
+
+- xbar_admaif9_ep: endpoint {
+- remote-endpoint = <&admaif9_ep>;
+- };
+- };
++ xbar_admaif9_ep: endpoint {
++ remote-endpoint = <&admaif9_ep>;
++ };
++ };
++
++ port@a {
++ reg = <0xa>;
++
++ xbar_admaif10_ep: endpoint {
++ remote-endpoint = <&admaif10_ep>;
++ };
++ };
++
++ port@b {
++ reg = <0xb>;
++
++ xbar_admaif11_ep: endpoint {
++ remote-endpoint = <&admaif11_ep>;
++ };
++ };
++
++ port@c {
++ reg = <0xc>;
++
++ xbar_admaif12_ep: endpoint {
++ remote-endpoint = <&admaif12_ep>;
++ };
++ };
++
++ port@d {
++ reg = <0xd>;
++
++ xbar_admaif13_ep: endpoint {
++ remote-endpoint = <&admaif13_ep>;
++ };
++ };
++
++ port@e {
++ reg = <0xe>;
++
++ xbar_admaif14_ep: endpoint {
++ remote-endpoint = <&admaif14_ep>;
++ };
++ };
++
++ port@f {
++ reg = <0xf>;
++
++ xbar_admaif15_ep: endpoint {
++ remote-endpoint = <&admaif15_ep>;
++ };
++ };
++
++ port@10 {
++ reg = <0x10>;
++
++ xbar_admaif16_ep: endpoint {
++ remote-endpoint = <&admaif16_ep>;
++ };
++ };
++
++ port@11 {
++ reg = <0x11>;
++
++ xbar_admaif17_ep: endpoint {
++ remote-endpoint = <&admaif17_ep>;
++ };
++ };
++
++ port@12 {
++ reg = <0x12>;
++
++ xbar_admaif18_ep: endpoint {
++ remote-endpoint = <&admaif18_ep>;
++ };
++ };
++
++ port@13 {
++ reg = <0x13>;
++
++ xbar_admaif19_ep: endpoint {
++ remote-endpoint = <&admaif19_ep>;
++ };
++ };
++
++ xbar_i2s1_port: port@14 {
++ reg = <0x14>;
++
++ xbar_i2s1_ep: endpoint {
++ remote-endpoint = <&i2s1_cif_ep>;
++ };
++ };
++
++ xbar_i2s3_port: port@16 {
++ reg = <0x16>;
++
++ xbar_i2s3_ep: endpoint {
++ remote-endpoint = <&i2s3_cif_ep>;
++ };
++ };
++
++ xbar_dmic1_port: port@1a {
++ reg = <0x1a>;
++
++ xbar_dmic1_ep: endpoint {
++ remote-endpoint = <&dmic1_cif_ep>;
++ };
++ };
++
++ xbar_dmic2_port: port@1b {
++ reg = <0x1b>;
++
++ xbar_dmic2_ep: endpoint {
++ remote-endpoint = <&dmic2_cif_ep>;
++ };
++ };
++ };
++ };
++
++ dma-controller@2930000 {
++ status = "okay";
++ };
++
++ interrupt-controller@2a40000 {
++ status = "okay";
++ };
++ };
++
++ memory-controller@2c00000 {
++ status = "okay";
++ };
++
++ timer@3010000 {
++ status = "okay";
++ };
++
++ serial@3100000 {
++ status = "okay";
++ };
++
++ i2c@3160000 {
++ status = "okay";
++ };
++
++ i2c@3180000 {
++ status = "okay";
++
++ power-monitor@40 {
++ compatible = "ti,ina3221";
++ reg = <0x40>;
++ #address-cells = <1>;
++ #size-cells = <0>;
++
++ input@0 {
++ reg = <0>;
++ label = "VDD_IN";
++ shunt-resistor-micro-ohms = <5>;
++ };
++
++ input@1 {
++ reg = <1>;
++ label = "VDD_CPU_GPU";
++ shunt-resistor-micro-ohms = <5>;
++ };
++
++ input@2 {
++ reg = <2>;
++ label = "VDD_SOC";
++ shunt-resistor-micro-ohms = <5>;
++ };
++ };
++ };
++
++ ddc: i2c@3190000 {
++ status = "okay";
++ };
++
++ i2c@31c0000 {
++ status = "okay";
++ };
++
++ i2c@31e0000 {
++ status = "okay";
++ };
+
+- port@a {
+- reg = <0xa>;
++ /* SDMMC4 (eMMC) */
++ mmc@3460000 {
++ status = "okay";
++ bus-width = <8>;
++ non-removable;
+
+- xbar_admaif10_ep: endpoint {
+- remote-endpoint = <&admaif10_ep>;
+- };
+- };
++ vqmmc-supply = <&vdd_1v8_ap>;
++ vmmc-supply = <&vdd_3v3_sys>;
++ };
+
+- port@b {
+- reg = <0xb>;
++ hda@3510000 {
++ nvidia,model = "NVIDIA Jetson TX2 NX HDA";
++ status = "okay";
++ };
+
+- xbar_admaif11_ep: endpoint {
+- remote-endpoint = <&admaif11_ep>;
+- };
+- };
++ padctl@3520000 {
++ status = "okay";
+
+- port@c {
+- reg = <0xc>;
++ avdd-pll-erefeut-supply = <&vdd_1v8_pll>;
++ avdd-usb-supply = <&vdd_3v3_sys>;
++ vclamp-usb-supply = <&vdd_1v8>;
++ vddio-hsic-supply = <&gnd>;
+
+- xbar_admaif12_ep: endpoint {
+- remote-endpoint = <&admaif12_ep>;
++ pads {
++ usb2 {
++ status = "okay";
++
++ lanes {
++ micro_b: usb2-0 {
++ nvidia,function = "xusb";
++ status = "okay";
+ };
+- };
+
+- port@d {
+- reg = <0xd>;
++ usb2-1 {
++ nvidia,function = "xusb";
++ status = "okay";
++ };
+
+- xbar_admaif13_ep: endpoint {
+- remote-endpoint = <&admaif13_ep>;
++ usb2-2 {
++ nvidia,function = "xusb";
++ status = "okay";
+ };
+ };
++ };
+
+- port@e {
+- reg = <0xe>;
++ usb3 {
++ status = "okay";
+
+- xbar_admaif14_ep: endpoint {
+- remote-endpoint = <&admaif14_ep>;
++ lanes {
++ usb3-1 {
++ nvidia,function = "xusb";
++ status = "okay";
+ };
+ };
++ };
++ };
+
+- port@f {
+- reg = <0xf>;
++ ports {
++ usb2-0 {
++ status = "okay";
++ mode = "otg";
++ vbus-supply = <&vdd_5v0_sys>;
++ usb-role-switch;
+
+- xbar_admaif15_ep: endpoint {
+- remote-endpoint = <&admaif15_ep>;
+- };
++ connector {
++ compatible = "gpio-usb-b-connector",
++ "usb-b-connector";
++ label = "micro-USB";
++ type = "micro";
++ vbus-gpios = <&gpio
++ TEGRA186_MAIN_GPIO(L, 4)
++ GPIO_ACTIVE_LOW>;
++ id-gpios = <&pmic 0 GPIO_ACTIVE_HIGH>;
+ };
++ };
+
+- port@10 {
+- reg = <0x10>;
++ usb2-1 {
++ status = "okay";
++ mode = "host";
+
+- xbar_admaif16_ep: endpoint {
+- remote-endpoint = <&admaif16_ep>;
+- };
+- };
++ vbus-supply = <&vdd_5v0_sys>;
++ };
+
+- port@11 {
+- reg = <0x11>;
++ usb2-2 {
++ status = "okay";
++ mode = "host";
+
+- xbar_admaif17_ep: endpoint {
+- remote-endpoint = <&admaif17_ep>;
+- };
+- };
++ vbus-supply = <&vdd_5v0_sys>;
++ };
+
+- port@12 {
+- reg = <0x12>;
++ usb3-1 {
++ nvidia,usb2-companion = <1>;
++ vbus-supply = <&vdd_5v0_sys>;
++ status = "okay";
++ };
++ };
++ };
+
+- xbar_admaif18_ep: endpoint {
+- remote-endpoint = <&admaif18_ep>;
+- };
+- };
++ usb@3530000 {
++ status = "okay";
+
+- port@13 {
+- reg = <0x13>;
++ phys = <&{/padctl@3520000/pads/usb2/lanes/usb2-0}>,
++ <&{/padctl@3520000/pads/usb2/lanes/usb2-1}>,
++ <&{/padctl@3520000/pads/usb2/lanes/usb2-2}>,
++ <&{/padctl@3520000/pads/usb3/lanes/usb3-1}>;
++ phy-names = "usb2-0", "usb2-1", "usb2-2", "usb3-1";
++ };
+
+- xbar_admaif19_ep: endpoint {
+- remote-endpoint = <&admaif19_ep>;
+- };
+- };
++ usb@3550000 {
++ status = "okay";
+
+- xbar_i2s1_port: port@14 {
+- reg = <0x14>;
++ phys = <µ_b>;
++ phy-names = "usb2-0";
++ };
+
+- xbar_i2s1_ep: endpoint {
+- remote-endpoint = <&i2s1_cif_ep>;
+- };
+- };
++ hsp@3c00000 {
++ status = "okay";
++ };
+
+- xbar_i2s3_port: port@16 {
+- reg = <0x16>;
++ i2c@c240000 {
++ status = "okay";
++ };
+
+- xbar_i2s3_ep: endpoint {
+- remote-endpoint = <&i2s3_cif_ep>;
+- };
+- };
++ i2c@c250000 {
++ status = "okay";
+
+- xbar_dmic1_port: port@1a {
+- reg = <0x1a>;
++ /* module ID EEPROM */
++ eeprom@50 {
++ compatible = "atmel,24c02";
++ reg = <0x50>;
+
+- xbar_dmic1_ep: endpoint {
+- remote-endpoint = <&dmic1_cif_ep>;
+- };
+- };
++ label = "module";
++ vcc-supply = <&vdd_1v8>;
++ address-width = <8>;
++ pagesize = <8>;
++ size = <256>;
++ read-only;
++ };
+
+- xbar_dmic2_port: port@1b {
+- reg = <0x1b>;
++ /* carrier board ID EEPROM */
++ eeprom@57 {
++ compatible = "atmel,24c02";
++ reg = <0x57>;
+
+- xbar_dmic2_ep: endpoint {
+- remote-endpoint = <&dmic2_cif_ep>;
+- };
+- };
+- };
++ label = "system";
++ vcc-supply = <&vdd_1v8>;
++ address-width = <8>;
++ pagesize = <8>;
++ size = <256>;
++ read-only;
++ };
++ };
+
+- admaif@290f000 {
+- status = "okay";
++ rtc@c2a0000 {
++ status = "okay";
++ };
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ pwm@c340000 {
++ status = "okay";
++ };
+
+- admaif0_port: port@0 {
+- reg = <0x0>;
++ pmc@c360000 {
++ nvidia,invert-interrupt;
++ };
+
+- admaif0_ep: endpoint {
+- remote-endpoint = <&xbar_admaif0_ep>;
+- };
+- };
++ pcie@10003000 {
++ status = "okay";
+
+- admaif1_port: port@1 {
+- reg = <0x1>;
++ dvdd-pex-supply = <&vdd_pex>;
++ hvdd-pex-pll-supply = <&vdd_1v8>;
++ hvdd-pex-supply = <&vdd_1v8>;
++ vddio-pexctl-aud-supply = <&vdd_1v8>;
+
+- admaif1_ep: endpoint {
+- remote-endpoint = <&xbar_admaif1_ep>;
+- };
+- };
++ pci@1,0 {
++ nvidia,num-lanes = <2>;
++ status = "okay";
++ };
+
+- admaif2_port: port@2 {
+- reg = <0x2>;
++ pci@2,0 {
++ nvidia,num-lanes = <1>;
++ status = "disabled";
++ };
+
+- admaif2_ep: endpoint {
+- remote-endpoint = <&xbar_admaif2_ep>;
+- };
+- };
++ pci@3,0 {
++ nvidia,num-lanes = <1>;
++ status = "okay";
++ };
++ };
+
+- admaif3_port: port@3 {
+- reg = <0x3>;
++ host1x@13e00000 {
++ status = "okay";
+
+- admaif3_ep: endpoint {
+- remote-endpoint = <&xbar_admaif3_ep>;
+- };
+- };
++ dpaux@15040000 {
++ status = "okay";
++ };
+
+- admaif4_port: port@4 {
+- reg = <0x4>;
++ display-hub@15200000 {
++ status = "okay";
++ };
+
+- admaif4_ep: endpoint {
+- remote-endpoint = <&xbar_admaif4_ep>;
+- };
+- };
++ dsi@15300000 {
++ status = "disabled";
++ };
+
+- admaif5_port: port@5 {
+- reg = <0x5>;
++ /* DP */
++ sor@15540000 {
++ status = "okay";
+
+- admaif5_ep: endpoint {
+- remote-endpoint = <&xbar_admaif5_ep>;
+- };
+- };
++ avdd-io-hdmi-dp-supply = <&vdd_hdmi_1v05>;
++ vdd-hdmi-dp-pll-supply = <&vdd_1v8_ap>;
+
+- admaif6_port: port@6 {
+- reg = <0x6>;
++ nvidia,dpaux = <&dpaux>;
++ };
+
+- admaif6_ep: endpoint {
+- remote-endpoint = <&xbar_admaif6_ep>;
+- };
+- };
++ /* HDMI */
++ sor@15580000 {
++ status = "okay";
+
+- admaif7_port: port@7 {
+- reg = <0x7>;
++ avdd-io-hdmi-dp-supply = <&vdd_hdmi_1v05>;
++ vdd-hdmi-dp-pll-supply = <&vdd_1v8_ap>;
++ hdmi-supply = <&vdd_hdmi>;
+
+- admaif7_ep: endpoint {
+- remote-endpoint = <&xbar_admaif7_ep>;
+- };
+- };
++ nvidia,ddc-i2c-bus = <&ddc>;
++ nvidia,hpd-gpio = <&gpio TEGRA186_MAIN_GPIO(P, 1)
++ GPIO_ACTIVE_LOW>;
++ };
+
+- admaif8_port: port@8 {
+- reg = <0x8>;
++ dpaux@155c0000 {
++ status = "okay";
++ };
++ };
+
+- admaif8_ep: endpoint {
+- remote-endpoint = <&xbar_admaif8_ep>;
+- };
+- };
++ gpu@17000000 {
++ status = "okay";
++ };
+
+- admaif9_port: port@9 {
+- reg = <0x9>;
++ bpmp {
++ i2c {
++ status = "okay";
+
+- admaif9_ep: endpoint {
+- remote-endpoint = <&xbar_admaif9_ep>;
+- };
+- };
++ pmic: pmic@3c {
++ compatible = "maxim,max77620";
++ reg = <0x3c>;
+
+- admaif10_port: port@a {
+- reg = <0xa>;
++ interrupt-parent = <&pmc>;
++ interrupts = <24 IRQ_TYPE_LEVEL_LOW>;
++ #interrupt-cells = <2>;
++ interrupt-controller;
+
+- admaif10_ep: endpoint {
+- remote-endpoint = <&xbar_admaif10_ep>;
+- };
+- };
++ #gpio-cells = <2>;
++ gpio-controller;
+
+- admaif11_port: port@b {
+- reg = <0xb>;
++ pinctrl-names = "default";
++ pinctrl-0 = <&max77620_default>;
+
+- admaif11_ep: endpoint {
+- remote-endpoint = <&xbar_admaif11_ep>;
+- };
++ fps {
++ fps0 {
++ maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN0>;
++ maxim,shutdown-fps-time-period-us = <640>;
+ };
+
+- admaif12_port: port@c {
+- reg = <0xc>;
++ fps1 {
++ maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN1>;
++ maxim,shutdown-fps-time-period-us = <640>;
++ };
+
+- admaif12_ep: endpoint {
+- remote-endpoint = <&xbar_admaif12_ep>;
+- };
++ fps2 {
++ maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN0>;
++ maxim,shutdown-fps-time-period-us = <640>;
+ };
++ };
+
+- admaif13_port: port@d {
+- reg = <0xd>;
++ max77620_default: pinmux {
++ gpio0 {
++ pins = "gpio0";
++ function = "gpio";
++ };
+
+- admaif13_ep: endpoint {
+- remote-endpoint = <&xbar_admaif13_ep>;
+- };
++ gpio1 {
++ pins = "gpio1";
++ function = "fps-out";
++ maxim,active-fps-source = <MAX77620_FPS_SRC_0>;
+ };
+
+- admaif14_port: port@e {
+- reg = <0xe>;
++ gpio2 {
++ pins = "gpio2";
++ function = "fps-out";
++ maxim,active-fps-source = <MAX77620_FPS_SRC_1>;
++ };
+
+- admaif14_ep: endpoint {
+- remote-endpoint = <&xbar_admaif14_ep>;
+- };
++ gpio3 {
++ pins = "gpio3";
++ function = "fps-out";
++ maxim,active-fps-source = <MAX77620_FPS_SRC_1>;
+ };
+
+- admaif15_port: port@f {
+- reg = <0xf>;
++ gpio4 {
++ pins = "gpio4";
++ function = "32k-out1";
++ drive-push-pull = <1>;
++ };
+
+- admaif15_ep: endpoint {
+- remote-endpoint = <&xbar_admaif15_ep>;
+- };
++ gpio5 {
++ pins = "gpio5";
++ function = "gpio";
++ drive-push-pull = <0>;
+ };
+
+- admaif16_port: port@10 {
+- reg = <0x10>;
++ gpio6 {
++ pins = "gpio6";
++ function = "gpio";
++ drive-push-pull = <1>;
++ };
+
+- admaif16_ep: endpoint {
+- remote-endpoint = <&xbar_admaif16_ep>;
+- };
++ gpio7 {
++ pins = "gpio7";
++ function = "gpio";
++ drive-push-pull = <1>;
+ };
++ };
+
+- admaif17_port: port@11 {
+- reg = <0x11>;
++ regulators {
++ in-sd0-supply = <&vdd_5v0_sys>;
++ in-sd1-supply = <&vdd_5v0_sys>;
++ in-sd2-supply = <&vdd_5v0_sys>;
++ in-sd3-supply = <&vdd_5v0_sys>;
+
+- admaif17_ep: endpoint {
+- remote-endpoint = <&xbar_admaif17_ep>;
+- };
++ in-ldo0-1-supply = <&vdd_5v0_sys>;
++ in-ldo2-supply = <&vdd_5v0_sys>;
++ in-ldo3-5-supply = <&vdd_5v0_sys>;
++ in-ldo4-6-supply = <&vdd_1v8>;
++ in-ldo7-8-supply = <&avdd_dsi_csi>;
++
++ sd0 {
++ regulator-name = "VDD_DDR_1V1_PMIC";
++ regulator-min-microvolt = <1100000>;
++ regulator-max-microvolt = <1100000>;
++ regulator-always-on;
++ regulator-boot-on;
+ };
+
+- admaif18_port: port@12 {
+- reg = <0x12>;
++ avdd_dsi_csi: sd1 {
++ regulator-name = "AVDD_DSI_CSI_1V2";
++ regulator-min-microvolt = <1200000>;
++ regulator-max-microvolt = <1200000>;
++ };
+
+- admaif18_ep: endpoint {
+- remote-endpoint = <&xbar_admaif18_ep>;
+- };
++ vdd_1v8: sd2 {
++ regulator-name = "VDD_1V8";
++ regulator-min-microvolt = <1800000>;
++ regulator-max-microvolt = <1800000>;
+ };
+
+- admaif19_port: port@13 {
+- reg = <0x13>;
++ vdd_3v3_sys: sd3 {
++ regulator-name = "VDD_3V3_SYS";
++ regulator-min-microvolt = <3300000>;
++ regulator-max-microvolt = <3300000>;
++ };
+
+- admaif19_ep: endpoint {
+- remote-endpoint = <&xbar_admaif19_ep>;
+- };
++ vdd_1v8_pll: ldo0 {
++ regulator-name = "VDD_1V8_AP_PLL";
++ regulator-min-microvolt = <1800000>;
++ regulator-max-microvolt = <1800000>;
+ };
+- };
+- };
+
+- i2s@2901000 {
+- status = "okay";
++ ldo2 {
++ regulator-name = "VDDIO_3V3_AOHV";
++ regulator-min-microvolt = <3300000>;
++ regulator-max-microvolt = <3300000>;
++ regulator-always-on;
++ regulator-boot-on;
++ };
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ vddio_sdmmc1: ldo3 {
++ regulator-name = "VDDIO_SDMMC1_AP";
++ regulator-min-microvolt = <1800000>;
++ regulator-max-microvolt = <3300000>;
++ };
+
+- port@0 {
+- reg = <0>;
++ ldo4 {
++ regulator-name = "VDD_RTC";
++ regulator-min-microvolt = <1000000>;
++ regulator-max-microvolt = <1000000>;
++ };
+
+- i2s1_cif_ep: endpoint {
+- remote-endpoint = <&xbar_i2s1_ep>;
+- };
++ vddio_sdmmc3: ldo5 {
++ regulator-name = "VDDIO_SDMMC3_AP";
++ regulator-min-microvolt = <2800000>;
++ regulator-max-microvolt = <2800000>;
+ };
+
+- i2s1_port: port@1 {
+- reg = <1>;
++ vdd_hdmi_1v05: ldo7 {
++ regulator-name = "VDD_HDMI_1V05";
++ regulator-min-microvolt = <1050000>;
++ regulator-max-microvolt = <1050000>;
++ };
+
+- i2s1_dap_ep: endpoint {
+- dai-format = "i2s";
+- /* Placeholder for external Codec */
+- };
++ vdd_pex: ldo8 {
++ regulator-name = "VDD_PEX_1V05";
++ regulator-min-microvolt = <1050000>;
++ regulator-max-microvolt = <1050000>;
+ };
+ };
+ };
++ };
++ };
+
+- i2s@2901200 {
+- status = "okay";
++ cpus {
++ cpu@0 {
++ enable-method = "psci";
++ };
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ cpu@1 {
++ enable-method = "psci";
++ };
+
+- port@0 {
+- reg = <0>;
++ cpu@2 {
++ enable-method = "psci";
++ };
+
+- i2s3_cif_ep: endpoint {
+- remote-endpoint = <&xbar_i2s3_ep>;
+- };
+- };
++ cpu@3 {
++ enable-method = "psci";
++ };
+
+- i2s3_port: port@1 {
+- reg = <1>;
++ cpu@4 {
++ enable-method = "psci";
++ };
+
+- i2s3_dap_ep: endpoint {
+- dai-format = "i2s";
+- /* Placeholder for external Codec */
+- };
+- };
+- };
+- };
++ cpu@5 {
++ enable-method = "psci";
++ };
++ };
+
+- dmic@2904000 {
+- status = "okay";
++ gpio-keys {
++ compatible = "gpio-keys";
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ key-power {
++ label = "Power";
++ gpios = <&gpio_aon TEGRA186_AON_GPIO(FF, 0)
++ GPIO_ACTIVE_LOW>;
++ linux,input-type = <EV_KEY>;
++ linux,code = <KEY_POWER>;
++ debounce-interval = <10>;
++ wakeup-event-action = <EV_ACT_ASSERTED>;
++ wakeup-source;
++ };
+
+- port@0 {
+- reg = <0>;
++ key-volume-down {
++ label = "Volume Down";
++ gpios = <&gpio_aon TEGRA186_AON_GPIO(FF, 2)
++ GPIO_ACTIVE_LOW>;
++ linux,input-type = <EV_KEY>;
++ linux,code = <KEY_VOLUMEDOWN>;
++ debounce-interval = <10>;
++ };
+
+- dmic1_cif_ep: endpoint {
+- remote-endpoint = <&xbar_dmic1_ep>;
+- };
+- };
++ key-volume-up {
++ label = "Volume Up";
++ gpios = <&gpio_aon TEGRA186_AON_GPIO(FF, 1)
++ GPIO_ACTIVE_LOW>;
++ linux,input-type = <EV_KEY>;
++ linux,code = <KEY_VOLUMEUP>;
++ debounce-interval = <10>;
++ };
++ };
+
+- dmic1_port: port@1 {
+- reg = <1>;
++ psci {
++ compatible = "arm,psci-1.0";
++ status = "okay";
++ method = "smc";
++ };
+
+- dmic1_dap_ep: endpoint {
+- /* Place holder for external Codec */
+- };
+- };
+- };
+- };
++ fan: pwm-fan {
++ compatible = "pwm-fan";
++ pwms = <&pwm4 0 45334>;
+
+- dmic@2904100 {
+- status = "okay";
++ cooling-levels = <0 64 128 255>;
++ #cooling-cells = <2>;
++ };
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ gnd: regulator-gnd {
++ compatible = "regulator-fixed";
++ regulator-name = "GND";
++ regulator-min-microvolt = <0>;
++ regulator-max-microvolt = <0>;
++ regulator-always-on;
++ regulator-boot-on;
++ };
+
+- port@0 {
+- reg = <0>;
++ vdd_5v0_sys: regulator-vdd-5v0-sys {
++ compatible = "regulator-fixed";
++ regulator-name = "VDD_5V0_SYS";
++ regulator-min-microvolt = <5000000>;
++ regulator-max-microvolt = <5000000>;
++ regulator-always-on;
++ regulator-boot-on;
++ };
+
+- dmic2_cif_ep: endpoint {
+- remote-endpoint = <&xbar_dmic2_ep>;
+- };
+- };
++ vdd_1v8_ap: regulator-vdd-1v8-ap {
++ compatible = "regulator-fixed";
++ regulator-name = "VDD_1V8_AP";
++ regulator-min-microvolt = <1800000>;
++ regulator-max-microvolt = <1800000>;
+
+- dmic2_port: port@1 {
+- reg = <1>;
++ gpio = <&pmic 1 GPIO_ACTIVE_HIGH>;
++ enable-active-high;
+
+- dmic2_dap_ep: endpoint {
+- /* Place holder for external Codec */
+- };
+- };
+- };
+- };
+- };
++ vin-supply = <&vdd_1v8>;
++ };
++
++ vdd_hdmi: regulator-vdd-hdmi {
++ compatible = "regulator-fixed";
++ regulator-name = "VDD_5V0_HDMI_CON";
++ regulator-min-microvolt = <5000000>;
++ regulator-max-microvolt = <5000000>;
++
++ vin-supply = <&vdd_5v0_sys>;
+ };
+
+ sound {
+@@ -1219,4 +1135,88 @@ sound {
+
+ label = "NVIDIA Jetson TX2 NX APE";
+ };
++
++ thermal-zones {
++ cpu-thermal {
++ polling-delay = <0>;
++ polling-delay-passive = <500>;
++ status = "okay";
++
++ trips {
++ cpu_trip_critical: critical {
++ temperature = <96500>;
++ hysteresis = <0>;
++ type = "critical";
++ };
++
++ cpu_trip_hot: hot {
++ temperature = <79000>;
++ hysteresis = <2000>;
++ type = "hot";
++ };
++
++ cpu_trip_active: active {
++ temperature = <62000>;
++ hysteresis = <2000>;
++ type = "active";
++ };
++
++ cpu_trip_passive: passive {
++ temperature = <45000>;
++ hysteresis = <2000>;
++ type = "passive";
++ };
++ };
++
++ cooling-maps {
++ cpu-critical {
++ cooling-device = <&fan 3 3>;
++ trip = <&cpu_trip_critical>;
++ };
++
++ cpu-hot {
++ cooling-device = <&fan 2 2>;
++ trip = <&cpu_trip_hot>;
++ };
++
++ cpu-active {
++ cooling-device = <&fan 1 1>;
++ trip = <&cpu_trip_active>;
++ };
++
++ cpu-passive {
++ cooling-device = <&fan 0 0>;
++ trip = <&cpu_trip_passive>;
++ };
++ };
++ };
++
++ aux-thermal {
++ polling-delay = <0>;
++ polling-delay-passive = <500>;
++ status = "okay";
++
++ trips {
++ aux_alert0: critical {
++ temperature = <90000>;
++ hysteresis = <0>;
++ type = "critical";
++ };
++ };
++ };
++
++ gpu-thermal {
++ polling-delay = <0>;
++ polling-delay-passive = <500>;
++ status = "okay";
++
++ trips {
++ gpu_alert0: critical {
++ temperature = <99000>;
++ hysteresis = <0>;
++ type = "critical";
++ };
++ };
++ };
++ };
+ };
+diff --git a/arch/arm64/boot/dts/nvidia/tegra186.dtsi b/arch/arm64/boot/dts/nvidia/tegra186.dtsi
+index b3f1494c02c11..0216b565a3703 100644
+--- a/arch/arm64/boot/dts/nvidia/tegra186.dtsi
++++ b/arch/arm64/boot/dts/nvidia/tegra186.dtsi
+@@ -129,62 +129,6 @@ aconnect@2900000 {
+ ranges = <0x02900000 0x0 0x02900000 0x200000>;
+ status = "disabled";
+
+- adma: dma-controller@2930000 {
+- compatible = "nvidia,tegra186-adma";
+- reg = <0x02930000 0x20000>;
+- interrupt-parent = <&agic>;
+- interrupts = <GIC_SPI 0 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 1 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 2 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 3 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 4 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 5 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 6 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 7 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 8 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 9 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 10 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 11 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 12 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 13 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 14 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 15 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 16 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 17 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 18 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 19 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 20 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 21 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 22 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 23 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 24 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 25 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 26 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 27 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 28 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 29 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 30 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 31 IRQ_TYPE_LEVEL_HIGH>;
+- #dma-cells = <1>;
+- clocks = <&bpmp TEGRA186_CLK_AHUB>;
+- clock-names = "d_audio";
+- status = "disabled";
+- };
+-
+- agic: interrupt-controller@2a40000 {
+- compatible = "nvidia,tegra186-agic",
+- "nvidia,tegra210-agic";
+- #interrupt-cells = <3>;
+- interrupt-controller;
+- reg = <0x02a41000 0x1000>,
+- <0x02a42000 0x2000>;
+- interrupts = <GIC_SPI 145
+- (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_HIGH)>;
+- clocks = <&bpmp TEGRA186_CLK_APE>;
+- clock-names = "clk";
+- status = "disabled";
+- };
+-
+ tegra_ahub: ahub@2900800 {
+ compatible = "nvidia,tegra186-ahub";
+ reg = <0x02900800 0x800>;
+@@ -197,52 +141,6 @@ tegra_ahub: ahub@2900800 {
+ ranges = <0x02900800 0x02900800 0x11800>;
+ status = "disabled";
+
+- tegra_admaif: admaif@290f000 {
+- compatible = "nvidia,tegra186-admaif";
+- reg = <0x0290f000 0x1000>;
+- dmas = <&adma 1>, <&adma 1>,
+- <&adma 2>, <&adma 2>,
+- <&adma 3>, <&adma 3>,
+- <&adma 4>, <&adma 4>,
+- <&adma 5>, <&adma 5>,
+- <&adma 6>, <&adma 6>,
+- <&adma 7>, <&adma 7>,
+- <&adma 8>, <&adma 8>,
+- <&adma 9>, <&adma 9>,
+- <&adma 10>, <&adma 10>,
+- <&adma 11>, <&adma 11>,
+- <&adma 12>, <&adma 12>,
+- <&adma 13>, <&adma 13>,
+- <&adma 14>, <&adma 14>,
+- <&adma 15>, <&adma 15>,
+- <&adma 16>, <&adma 16>,
+- <&adma 17>, <&adma 17>,
+- <&adma 18>, <&adma 18>,
+- <&adma 19>, <&adma 19>,
+- <&adma 20>, <&adma 20>;
+- dma-names = "rx1", "tx1",
+- "rx2", "tx2",
+- "rx3", "tx3",
+- "rx4", "tx4",
+- "rx5", "tx5",
+- "rx6", "tx6",
+- "rx7", "tx7",
+- "rx8", "tx8",
+- "rx9", "tx9",
+- "rx10", "tx10",
+- "rx11", "tx11",
+- "rx12", "tx12",
+- "rx13", "tx13",
+- "rx14", "tx14",
+- "rx15", "tx15",
+- "rx16", "tx16",
+- "rx17", "tx17",
+- "rx18", "tx18",
+- "rx19", "tx19",
+- "rx20", "tx20";
+- status = "disabled";
+- };
+-
+ tegra_i2s1: i2s@2901000 {
+ compatible = "nvidia,tegra186-i2s",
+ "nvidia,tegra210-i2s";
+@@ -327,78 +225,6 @@ tegra_i2s6: i2s@2901500 {
+ status = "disabled";
+ };
+
+- tegra_dmic1: dmic@2904000 {
+- compatible = "nvidia,tegra210-dmic";
+- reg = <0x2904000 0x100>;
+- clocks = <&bpmp TEGRA186_CLK_DMIC1>;
+- clock-names = "dmic";
+- assigned-clocks = <&bpmp TEGRA186_CLK_DMIC1>;
+- assigned-clock-parents = <&bpmp TEGRA186_CLK_PLL_A_OUT0>;
+- assigned-clock-rates = <3072000>;
+- sound-name-prefix = "DMIC1";
+- status = "disabled";
+- };
+-
+- tegra_dmic2: dmic@2904100 {
+- compatible = "nvidia,tegra210-dmic";
+- reg = <0x2904100 0x100>;
+- clocks = <&bpmp TEGRA186_CLK_DMIC2>;
+- clock-names = "dmic";
+- assigned-clocks = <&bpmp TEGRA186_CLK_DMIC2>;
+- assigned-clock-parents = <&bpmp TEGRA186_CLK_PLL_A_OUT0>;
+- assigned-clock-rates = <3072000>;
+- sound-name-prefix = "DMIC2";
+- status = "disabled";
+- };
+-
+- tegra_dmic3: dmic@2904200 {
+- compatible = "nvidia,tegra210-dmic";
+- reg = <0x2904200 0x100>;
+- clocks = <&bpmp TEGRA186_CLK_DMIC3>;
+- clock-names = "dmic";
+- assigned-clocks = <&bpmp TEGRA186_CLK_DMIC3>;
+- assigned-clock-parents = <&bpmp TEGRA186_CLK_PLL_A_OUT0>;
+- assigned-clock-rates = <3072000>;
+- sound-name-prefix = "DMIC3";
+- status = "disabled";
+- };
+-
+- tegra_dmic4: dmic@2904300 {
+- compatible = "nvidia,tegra210-dmic";
+- reg = <0x2904300 0x100>;
+- clocks = <&bpmp TEGRA186_CLK_DMIC4>;
+- clock-names = "dmic";
+- assigned-clocks = <&bpmp TEGRA186_CLK_DMIC4>;
+- assigned-clock-parents = <&bpmp TEGRA186_CLK_PLL_A_OUT0>;
+- assigned-clock-rates = <3072000>;
+- sound-name-prefix = "DMIC4";
+- status = "disabled";
+- };
+-
+- tegra_dspk1: dspk@2905000 {
+- compatible = "nvidia,tegra186-dspk";
+- reg = <0x2905000 0x100>;
+- clocks = <&bpmp TEGRA186_CLK_DSPK1>;
+- clock-names = "dspk";
+- assigned-clocks = <&bpmp TEGRA186_CLK_DSPK1>;
+- assigned-clock-parents = <&bpmp TEGRA186_CLK_PLL_A_OUT0>;
+- assigned-clock-rates = <12288000>;
+- sound-name-prefix = "DSPK1";
+- status = "disabled";
+- };
+-
+- tegra_dspk2: dspk@2905100 {
+- compatible = "nvidia,tegra186-dspk";
+- reg = <0x2905100 0x100>;
+- clocks = <&bpmp TEGRA186_CLK_DSPK2>;
+- clock-names = "dspk";
+- assigned-clocks = <&bpmp TEGRA186_CLK_DSPK2>;
+- assigned-clock-parents = <&bpmp TEGRA186_CLK_PLL_A_OUT0>;
+- assigned-clock-rates = <12288000>;
+- sound-name-prefix = "DSPK2";
+- status = "disabled";
+- };
+-
+ tegra_sfc1: sfc@2902000 {
+ compatible = "nvidia,tegra186-sfc",
+ "nvidia,tegra210-sfc";
+@@ -431,22 +257,6 @@ tegra_sfc4: sfc@2902600 {
+ status = "disabled";
+ };
+
+- tegra_mvc1: mvc@290a000 {
+- compatible = "nvidia,tegra186-mvc",
+- "nvidia,tegra210-mvc";
+- reg = <0x290a000 0x200>;
+- sound-name-prefix = "MVC1";
+- status = "disabled";
+- };
+-
+- tegra_mvc2: mvc@290a200 {
+- compatible = "nvidia,tegra186-mvc",
+- "nvidia,tegra210-mvc";
+- reg = <0x290a200 0x200>;
+- sound-name-prefix = "MVC2";
+- status = "disabled";
+- };
+-
+ tegra_amx1: amx@2903000 {
+ compatible = "nvidia,tegra186-amx",
+ "nvidia,tegra210-amx";
+@@ -511,6 +321,78 @@ tegra_adx4: adx@2903b00 {
+ status = "disabled";
+ };
+
++ tegra_dmic1: dmic@2904000 {
++ compatible = "nvidia,tegra210-dmic";
++ reg = <0x2904000 0x100>;
++ clocks = <&bpmp TEGRA186_CLK_DMIC1>;
++ clock-names = "dmic";
++ assigned-clocks = <&bpmp TEGRA186_CLK_DMIC1>;
++ assigned-clock-parents = <&bpmp TEGRA186_CLK_PLL_A_OUT0>;
++ assigned-clock-rates = <3072000>;
++ sound-name-prefix = "DMIC1";
++ status = "disabled";
++ };
++
++ tegra_dmic2: dmic@2904100 {
++ compatible = "nvidia,tegra210-dmic";
++ reg = <0x2904100 0x100>;
++ clocks = <&bpmp TEGRA186_CLK_DMIC2>;
++ clock-names = "dmic";
++ assigned-clocks = <&bpmp TEGRA186_CLK_DMIC2>;
++ assigned-clock-parents = <&bpmp TEGRA186_CLK_PLL_A_OUT0>;
++ assigned-clock-rates = <3072000>;
++ sound-name-prefix = "DMIC2";
++ status = "disabled";
++ };
++
++ tegra_dmic3: dmic@2904200 {
++ compatible = "nvidia,tegra210-dmic";
++ reg = <0x2904200 0x100>;
++ clocks = <&bpmp TEGRA186_CLK_DMIC3>;
++ clock-names = "dmic";
++ assigned-clocks = <&bpmp TEGRA186_CLK_DMIC3>;
++ assigned-clock-parents = <&bpmp TEGRA186_CLK_PLL_A_OUT0>;
++ assigned-clock-rates = <3072000>;
++ sound-name-prefix = "DMIC3";
++ status = "disabled";
++ };
++
++ tegra_dmic4: dmic@2904300 {
++ compatible = "nvidia,tegra210-dmic";
++ reg = <0x2904300 0x100>;
++ clocks = <&bpmp TEGRA186_CLK_DMIC4>;
++ clock-names = "dmic";
++ assigned-clocks = <&bpmp TEGRA186_CLK_DMIC4>;
++ assigned-clock-parents = <&bpmp TEGRA186_CLK_PLL_A_OUT0>;
++ assigned-clock-rates = <3072000>;
++ sound-name-prefix = "DMIC4";
++ status = "disabled";
++ };
++
++ tegra_dspk1: dspk@2905000 {
++ compatible = "nvidia,tegra186-dspk";
++ reg = <0x2905000 0x100>;
++ clocks = <&bpmp TEGRA186_CLK_DSPK1>;
++ clock-names = "dspk";
++ assigned-clocks = <&bpmp TEGRA186_CLK_DSPK1>;
++ assigned-clock-parents = <&bpmp TEGRA186_CLK_PLL_A_OUT0>;
++ assigned-clock-rates = <12288000>;
++ sound-name-prefix = "DSPK1";
++ status = "disabled";
++ };
++
++ tegra_dspk2: dspk@2905100 {
++ compatible = "nvidia,tegra186-dspk";
++ reg = <0x2905100 0x100>;
++ clocks = <&bpmp TEGRA186_CLK_DSPK2>;
++ clock-names = "dspk";
++ assigned-clocks = <&bpmp TEGRA186_CLK_DSPK2>;
++ assigned-clock-parents = <&bpmp TEGRA186_CLK_PLL_A_OUT0>;
++ assigned-clock-rates = <12288000>;
++ sound-name-prefix = "DSPK2";
++ status = "disabled";
++ };
++
+ tegra_ope1: processing-engine@2908000 {
+ compatible = "nvidia,tegra186-ope",
+ "nvidia,tegra210-ope";
+@@ -534,6 +416,22 @@ dynamic-range-compressor@2908200 {
+ };
+ };
+
++ tegra_mvc1: mvc@290a000 {
++ compatible = "nvidia,tegra186-mvc",
++ "nvidia,tegra210-mvc";
++ reg = <0x290a000 0x200>;
++ sound-name-prefix = "MVC1";
++ status = "disabled";
++ };
++
++ tegra_mvc2: mvc@290a200 {
++ compatible = "nvidia,tegra186-mvc",
++ "nvidia,tegra210-mvc";
++ reg = <0x290a200 0x200>;
++ sound-name-prefix = "MVC2";
++ status = "disabled";
++ };
++
+ tegra_amixer: amixer@290bb00 {
+ compatible = "nvidia,tegra186-amixer",
+ "nvidia,tegra210-amixer";
+@@ -542,6 +440,52 @@ tegra_amixer: amixer@290bb00 {
+ status = "disabled";
+ };
+
++ tegra_admaif: admaif@290f000 {
++ compatible = "nvidia,tegra186-admaif";
++ reg = <0x0290f000 0x1000>;
++ dmas = <&adma 1>, <&adma 1>,
++ <&adma 2>, <&adma 2>,
++ <&adma 3>, <&adma 3>,
++ <&adma 4>, <&adma 4>,
++ <&adma 5>, <&adma 5>,
++ <&adma 6>, <&adma 6>,
++ <&adma 7>, <&adma 7>,
++ <&adma 8>, <&adma 8>,
++ <&adma 9>, <&adma 9>,
++ <&adma 10>, <&adma 10>,
++ <&adma 11>, <&adma 11>,
++ <&adma 12>, <&adma 12>,
++ <&adma 13>, <&adma 13>,
++ <&adma 14>, <&adma 14>,
++ <&adma 15>, <&adma 15>,
++ <&adma 16>, <&adma 16>,
++ <&adma 17>, <&adma 17>,
++ <&adma 18>, <&adma 18>,
++ <&adma 19>, <&adma 19>,
++ <&adma 20>, <&adma 20>;
++ dma-names = "rx1", "tx1",
++ "rx2", "tx2",
++ "rx3", "tx3",
++ "rx4", "tx4",
++ "rx5", "tx5",
++ "rx6", "tx6",
++ "rx7", "tx7",
++ "rx8", "tx8",
++ "rx9", "tx9",
++ "rx10", "tx10",
++ "rx11", "tx11",
++ "rx12", "tx12",
++ "rx13", "tx13",
++ "rx14", "tx14",
++ "rx15", "tx15",
++ "rx16", "tx16",
++ "rx17", "tx17",
++ "rx18", "tx18",
++ "rx19", "tx19",
++ "rx20", "tx20";
++ status = "disabled";
++ };
++
+ tegra_asrc: asrc@2910000 {
+ compatible = "nvidia,tegra186-asrc";
+ reg = <0x2910000 0x2000>;
+@@ -549,6 +493,62 @@ tegra_asrc: asrc@2910000 {
+ status = "disabled";
+ };
+ };
++
++ adma: dma-controller@2930000 {
++ compatible = "nvidia,tegra186-adma";
++ reg = <0x02930000 0x20000>;
++ interrupt-parent = <&agic>;
++ interrupts = <GIC_SPI 0 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 1 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 2 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 3 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 4 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 5 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 6 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 7 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 8 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 9 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 10 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 11 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 12 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 13 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 14 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 15 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 16 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 17 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 18 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 19 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 20 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 21 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 22 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 23 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 24 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 25 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 26 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 27 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 28 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 29 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 30 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 31 IRQ_TYPE_LEVEL_HIGH>;
++ #dma-cells = <1>;
++ clocks = <&bpmp TEGRA186_CLK_AHUB>;
++ clock-names = "d_audio";
++ status = "disabled";
++ };
++
++ agic: interrupt-controller@2a40000 {
++ compatible = "nvidia,tegra186-agic",
++ "nvidia,tegra210-agic";
++ #interrupt-cells = <3>;
++ interrupt-controller;
++ reg = <0x02a41000 0x1000>,
++ <0x02a42000 0x2000>;
++ interrupts = <GIC_SPI 145
++ (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_HIGH)>;
++ clocks = <&bpmp TEGRA186_CLK_APE>;
++ clock-names = "clk";
++ status = "disabled";
++ };
+ };
+
+ mc: memory-controller@2c00000 {
+@@ -970,6 +970,34 @@ sdmmc4: mmc@3460000 {
+ status = "disabled";
+ };
+
++ sata@3507000 {
++ compatible = "nvidia,tegra186-ahci";
++ reg = <0x0 0x03507000 0x0 0x00002000>, /* AHCI */
++ <0x0 0x03500000 0x0 0x00007000>, /* SATA */
++ <0x0 0x03A90000 0x0 0x00010000>; /* SATA AUX */
++ interrupts = <GIC_SPI 197 IRQ_TYPE_LEVEL_HIGH>;
++
++ power-domains = <&bpmp TEGRA186_POWER_DOMAIN_SAX>;
++ interconnects = <&mc TEGRA186_MEMORY_CLIENT_SATAR &emc>,
++ <&mc TEGRA186_MEMORY_CLIENT_SATAW &emc>;
++ interconnect-names = "dma-mem", "write";
++ iommus = <&smmu TEGRA186_SID_SATA>;
++
++ clocks = <&bpmp TEGRA186_CLK_SATA>,
++ <&bpmp TEGRA186_CLK_SATA_OOB>;
++ clock-names = "sata", "sata-oob";
++ assigned-clocks = <&bpmp TEGRA186_CLK_SATA>,
++ <&bpmp TEGRA186_CLK_SATA_OOB>;
++ assigned-clock-parents = <&bpmp TEGRA186_CLK_PLLP_OUT0>,
++ <&bpmp TEGRA186_CLK_PLLP>;
++ assigned-clock-rates = <102000000>,
++ <204000000>;
++ resets = <&bpmp TEGRA186_RESET_SATA>,
++ <&bpmp TEGRA186_RESET_SATACOLD>;
++ reset-names = "sata", "sata-cold";
++ status = "disabled";
++ };
++
+ hda@3510000 {
+ compatible = "nvidia,tegra186-hda", "nvidia,tegra30-hda";
+ reg = <0x0 0x03510000 0x0 0x10000>;
+@@ -1286,18 +1314,13 @@ pmc: pmc@c360000 {
+ #interrupt-cells = <2>;
+ interrupt-controller;
+
+- sdmmc1_3v3: sdmmc1-3v3 {
+- pins = "sdmmc1-hv";
+- power-source = <TEGRA_IO_PAD_VOLTAGE_3V3>;
+- };
+-
+ sdmmc1_1v8: sdmmc1-1v8 {
+ pins = "sdmmc1-hv";
+ power-source = <TEGRA_IO_PAD_VOLTAGE_1V8>;
+ };
+
+- sdmmc2_3v3: sdmmc2-3v3 {
+- pins = "sdmmc2-hv";
++ sdmmc1_3v3: sdmmc1-3v3 {
++ pins = "sdmmc1-hv";
+ power-source = <TEGRA_IO_PAD_VOLTAGE_3V3>;
+ };
+
+@@ -1306,8 +1329,8 @@ sdmmc2_1v8: sdmmc2-1v8 {
+ power-source = <TEGRA_IO_PAD_VOLTAGE_1V8>;
+ };
+
+- sdmmc3_3v3: sdmmc3-3v3 {
+- pins = "sdmmc3-hv";
++ sdmmc2_3v3: sdmmc2-3v3 {
++ pins = "sdmmc2-hv";
+ power-source = <TEGRA_IO_PAD_VOLTAGE_3V3>;
+ };
+
+@@ -1315,6 +1338,11 @@ sdmmc3_1v8: sdmmc3-1v8 {
+ pins = "sdmmc3-hv";
+ power-source = <TEGRA_IO_PAD_VOLTAGE_1V8>;
+ };
++
++ sdmmc3_3v3: sdmmc3-3v3 {
++ pins = "sdmmc3-hv";
++ power-source = <TEGRA_IO_PAD_VOLTAGE_3V3>;
++ };
+ };
+
+ ccplex@e000000 {
+@@ -1894,34 +1922,6 @@ cpu_bpmp_rx: sram@4f000 {
+ };
+ };
+
+- sata@3507000 {
+- compatible = "nvidia,tegra186-ahci";
+- reg = <0x0 0x03507000 0x0 0x00002000>, /* AHCI */
+- <0x0 0x03500000 0x0 0x00007000>, /* SATA */
+- <0x0 0x03A90000 0x0 0x00010000>; /* SATA AUX */
+- interrupts = <GIC_SPI 197 IRQ_TYPE_LEVEL_HIGH>;
+-
+- power-domains = <&bpmp TEGRA186_POWER_DOMAIN_SAX>;
+- interconnects = <&mc TEGRA186_MEMORY_CLIENT_SATAR &emc>,
+- <&mc TEGRA186_MEMORY_CLIENT_SATAW &emc>;
+- interconnect-names = "dma-mem", "write";
+- iommus = <&smmu TEGRA186_SID_SATA>;
+-
+- clocks = <&bpmp TEGRA186_CLK_SATA>,
+- <&bpmp TEGRA186_CLK_SATA_OOB>;
+- clock-names = "sata", "sata-oob";
+- assigned-clocks = <&bpmp TEGRA186_CLK_SATA>,
+- <&bpmp TEGRA186_CLK_SATA_OOB>;
+- assigned-clock-parents = <&bpmp TEGRA186_CLK_PLLP_OUT0>,
+- <&bpmp TEGRA186_CLK_PLLP>;
+- assigned-clock-rates = <102000000>,
+- <204000000>;
+- resets = <&bpmp TEGRA186_RESET_SATA>,
+- <&bpmp TEGRA186_RESET_SATACOLD>;
+- reset-names = "sata", "sata-cold";
+- status = "disabled";
+- };
+-
+ bpmp: bpmp {
+ compatible = "nvidia,tegra186-bpmp";
+ interconnects = <&mc TEGRA186_MEMORY_CLIENT_BPMPR &emc>,
+@@ -2052,14 +2052,7 @@ L2_A57: l2-cache1 {
+ };
+ };
+
+- pmu_denver {
+- compatible = "nvidia,denver-pmu";
+- interrupts = <GIC_SPI 320 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 321 IRQ_TYPE_LEVEL_HIGH>;
+- interrupt-affinity = <&denver_0 &denver_1>;
+- };
+-
+- pmu_a57 {
++ pmu-a57 {
+ compatible = "arm,cortex-a57-pmu";
+ interrupts = <GIC_SPI 296 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 297 IRQ_TYPE_LEVEL_HIGH>,
+@@ -2068,6 +2061,13 @@ pmu_a57 {
+ interrupt-affinity = <&ca57_0 &ca57_1 &ca57_2 &ca57_3>;
+ };
+
++ pmu-denver {
++ compatible = "nvidia,denver-pmu";
++ interrupts = <GIC_SPI 320 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 321 IRQ_TYPE_LEVEL_HIGH>;
++ interrupt-affinity = <&denver_0 &denver_1>;
++ };
++
+ sound {
+ status = "disabled";
+
+diff --git a/arch/arm64/boot/dts/nvidia/tegra194-p2888.dtsi b/arch/arm64/boot/dts/nvidia/tegra194-p2888.dtsi
+index cd272d407e012..5b59c1986e9b5 100644
+--- a/arch/arm64/boot/dts/nvidia/tegra194-p2888.dtsi
++++ b/arch/arm64/boot/dts/nvidia/tegra194-p2888.dtsi
+@@ -147,6 +147,24 @@ pmic: pmic@3c {
+ pinctrl-names = "default";
+ pinctrl-0 = <&max20024_default>;
+
++ fps {
++ fps0 {
++ maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN0>;
++ maxim,shutdown-fps-time-period-us = <640>;
++ };
++
++ fps1 {
++ maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN1>;
++ maxim,shutdown-fps-time-period-us = <640>;
++ maxim,device-state-on-disabled-event = <MAX77620_FPS_INACTIVE_STATE_SLEEP>;
++ };
++
++ fps2 {
++ maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN0>;
++ maxim,shutdown-fps-time-period-us = <640>;
++ };
++ };
++
+ max20024_default: pinmux {
+ gpio0 {
+ pins = "gpio0";
+@@ -190,24 +208,6 @@ gpio7 {
+ };
+ };
+
+- fps {
+- fps0 {
+- maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN0>;
+- maxim,shutdown-fps-time-period-us = <640>;
+- };
+-
+- fps1 {
+- maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN1>;
+- maxim,shutdown-fps-time-period-us = <640>;
+- maxim,device-state-on-disabled-event = <MAX77620_FPS_INACTIVE_STATE_SLEEP>;
+- };
+-
+- fps2 {
+- maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN0>;
+- maxim,shutdown-fps-time-period-us = <640>;
+- };
+- };
+-
+ regulators {
+ in-sd0-supply = <&vdd_5v0_sys>;
+ in-sd1-supply = <&vdd_5v0_sys>;
+diff --git a/arch/arm64/boot/dts/nvidia/tegra194-p2972-0000.dts b/arch/arm64/boot/dts/nvidia/tegra194-p2972-0000.dts
+index f018fc4c0f707..64a3398fe7a6d 100644
+--- a/arch/arm64/boot/dts/nvidia/tegra194-p2972-0000.dts
++++ b/arch/arm64/boot/dts/nvidia/tegra194-p2972-0000.dts
+@@ -14,874 +14,830 @@ bus@0 {
+ aconnect@2900000 {
+ status = "okay";
+
+- dma-controller@2930000 {
+- status = "okay";
+- };
+-
+- interrupt-controller@2a40000 {
+- status = "okay";
+- };
+-
+ ahub@2900800 {
+ status = "okay";
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
+-
+- port@0 {
+- reg = <0x0>;
+-
+- xbar_admaif0_ep: endpoint {
+- remote-endpoint = <&admaif0_ep>;
+- };
+- };
+-
+- port@1 {
+- reg = <0x1>;
+-
+- xbar_admaif1_ep: endpoint {
+- remote-endpoint = <&admaif1_ep>;
+- };
+- };
+-
+- port@2 {
+- reg = <0x2>;
+-
+- xbar_admaif2_ep: endpoint {
+- remote-endpoint = <&admaif2_ep>;
+- };
+- };
+-
+- port@3 {
+- reg = <0x3>;
+-
+- xbar_admaif3_ep: endpoint {
+- remote-endpoint = <&admaif3_ep>;
+- };
+- };
+-
+- port@4 {
+- reg = <0x4>;
+-
+- xbar_admaif4_ep: endpoint {
+- remote-endpoint = <&admaif4_ep>;
+- };
+- };
+-
+- port@5 {
+- reg = <0x5>;
+-
+- xbar_admaif5_ep: endpoint {
+- remote-endpoint = <&admaif5_ep>;
+- };
+- };
+-
+- port@6 {
+- reg = <0x6>;
+-
+- xbar_admaif6_ep: endpoint {
+- remote-endpoint = <&admaif6_ep>;
+- };
+- };
+-
+- port@7 {
+- reg = <0x7>;
++ i2s@2901000 {
++ status = "okay";
+
+- xbar_admaif7_ep: endpoint {
+- remote-endpoint = <&admaif7_ep>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- port@8 {
+- reg = <0x8>;
++ port@0 {
++ reg = <0>;
+
+- xbar_admaif8_ep: endpoint {
+- remote-endpoint = <&admaif8_ep>;
++ i2s1_cif_ep: endpoint {
++ remote-endpoint = <&xbar_i2s1_ep>;
++ };
+ };
+- };
+
+- port@9 {
+- reg = <0x9>;
++ i2s1_port: port@1 {
++ reg = <1>;
+
+- xbar_admaif9_ep: endpoint {
+- remote-endpoint = <&admaif9_ep>;
++ i2s1_dap_ep: endpoint {
++ dai-format = "i2s";
++ remote-endpoint = <&rt5658_ep>;
++ };
+ };
+ };
++ };
+
+- port@a {
+- reg = <0xa>;
++ i2s@2901100 {
++ status = "okay";
+
+- xbar_admaif10_ep: endpoint {
+- remote-endpoint = <&admaif10_ep>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- port@b {
+- reg = <0xb>;
++ port@0 {
++ reg = <0>;
+
+- xbar_admaif11_ep: endpoint {
+- remote-endpoint = <&admaif11_ep>;
++ i2s2_cif_ep: endpoint {
++ remote-endpoint = <&xbar_i2s2_ep>;
++ };
+ };
+- };
+
+- port@c {
+- reg = <0xc>;
++ i2s2_port: port@1 {
++ reg = <1>;
+
+- xbar_admaif12_ep: endpoint {
+- remote-endpoint = <&admaif12_ep>;
++ i2s2_dap_ep: endpoint {
++ dai-format = "i2s";
++ /* Place holder for external Codec */
++ };
+ };
+ };
++ };
+
+- port@d {
+- reg = <0xd>;
++ i2s@2901300 {
++ status = "okay";
+
+- xbar_admaif13_ep: endpoint {
+- remote-endpoint = <&admaif13_ep>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- port@e {
+- reg = <0xe>;
++ port@0 {
++ reg = <0>;
+
+- xbar_admaif14_ep: endpoint {
+- remote-endpoint = <&admaif14_ep>;
++ i2s4_cif_ep: endpoint {
++ remote-endpoint = <&xbar_i2s4_ep>;
++ };
+ };
+- };
+
+- port@f {
+- reg = <0xf>;
++ i2s4_port: port@1 {
++ reg = <1>;
+
+- xbar_admaif15_ep: endpoint {
+- remote-endpoint = <&admaif15_ep>;
++ i2s4_dap_ep: endpoint {
++ dai-format = "i2s";
++ /* Place holder for external Codec */
++ };
+ };
+ };
++ };
+
+- port@10 {
+- reg = <0x10>;
++ i2s@2901500 {
++ status = "okay";
+
+- xbar_admaif16_ep: endpoint {
+- remote-endpoint = <&admaif16_ep>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- port@11 {
+- reg = <0x11>;
++ port@0 {
++ reg = <0>;
+
+- xbar_admaif17_ep: endpoint {
+- remote-endpoint = <&admaif17_ep>;
++ i2s6_cif_ep: endpoint {
++ remote-endpoint = <&xbar_i2s6_ep>;
++ };
+ };
+- };
+
+- port@12 {
+- reg = <0x12>;
++ i2s6_port: port@1 {
++ reg = <1>;
+
+- xbar_admaif18_ep: endpoint {
+- remote-endpoint = <&admaif18_ep>;
++ i2s6_dap_ep: endpoint {
++ dai-format = "i2s";
++ /* Place holder for external Codec */
++ };
+ };
+ };
++ };
+
+- port@13 {
+- reg = <0x13>;
++ sfc@2902000 {
++ status = "okay";
+
+- xbar_admaif19_ep: endpoint {
+- remote-endpoint = <&admaif19_ep>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- xbar_i2s1_port: port@14 {
+- reg = <0x14>;
++ port@0 {
++ reg = <0>;
+
+- xbar_i2s1_ep: endpoint {
+- remote-endpoint = <&i2s1_cif_ep>;
++ sfc1_cif_in_ep: endpoint {
++ remote-endpoint = <&xbar_sfc1_in_ep>;
++ };
+ };
+- };
+
+- xbar_i2s2_port: port@15 {
+- reg = <0x15>;
++ sfc1_out_port: port@1 {
++ reg = <1>;
+
+- xbar_i2s2_ep: endpoint {
+- remote-endpoint = <&i2s2_cif_ep>;
++ sfc1_cif_out_ep: endpoint {
++ remote-endpoint = <&xbar_sfc1_out_ep>;
++ };
+ };
+ };
++ };
+
+- xbar_i2s4_port: port@17 {
+- reg = <0x17>;
++ sfc@2902200 {
++ status = "okay";
+
+- xbar_i2s4_ep: endpoint {
+- remote-endpoint = <&i2s4_cif_ep>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- xbar_i2s6_port: port@19 {
+- reg = <0x19>;
++ port@0 {
++ reg = <0>;
+
+- xbar_i2s6_ep: endpoint {
+- remote-endpoint = <&i2s6_cif_ep>;
++ sfc2_cif_in_ep: endpoint {
++ remote-endpoint = <&xbar_sfc2_in_ep>;
++ };
+ };
+- };
+
+- xbar_dmic3_port: port@1c {
+- reg = <0x1c>;
++ sfc2_out_port: port@1 {
++ reg = <1>;
+
+- xbar_dmic3_ep: endpoint {
+- remote-endpoint = <&dmic3_cif_ep>;
++ sfc2_cif_out_ep: endpoint {
++ remote-endpoint = <&xbar_sfc2_out_ep>;
++ };
+ };
+ };
++ };
+
+- xbar_sfc1_in_port: port@20 {
+- reg = <0x20>;
++ sfc@2902400 {
++ status = "okay";
+
+- xbar_sfc1_in_ep: endpoint {
+- remote-endpoint = <&sfc1_cif_in_ep>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- port@21 {
+- reg = <0x21>;
++ port@0 {
++ reg = <0>;
+
+- xbar_sfc1_out_ep: endpoint {
+- remote-endpoint = <&sfc1_cif_out_ep>;
++ sfc3_cif_in_ep: endpoint {
++ remote-endpoint = <&xbar_sfc3_in_ep>;
++ };
+ };
+- };
+
+- xbar_sfc2_in_port: port@22 {
+- reg = <0x22>;
++ sfc3_out_port: port@1 {
++ reg = <1>;
+
+- xbar_sfc2_in_ep: endpoint {
+- remote-endpoint = <&sfc2_cif_in_ep>;
++ sfc3_cif_out_ep: endpoint {
++ remote-endpoint = <&xbar_sfc3_out_ep>;
++ };
+ };
+ };
++ };
+
+- port@23 {
+- reg = <0x23>;
++ sfc@2902600 {
++ status = "okay";
+
+- xbar_sfc2_out_ep: endpoint {
+- remote-endpoint = <&sfc2_cif_out_ep>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- xbar_sfc3_in_port: port@24 {
+- reg = <0x24>;
++ port@0 {
++ reg = <0>;
+
+- xbar_sfc3_in_ep: endpoint {
+- remote-endpoint = <&sfc3_cif_in_ep>;
++ sfc4_cif_in_ep: endpoint {
++ remote-endpoint = <&xbar_sfc4_in_ep>;
++ };
+ };
+- };
+
+- port@25 {
+- reg = <0x25>;
++ sfc4_out_port: port@1 {
++ reg = <1>;
+
+- xbar_sfc3_out_ep: endpoint {
+- remote-endpoint = <&sfc3_cif_out_ep>;
++ sfc4_cif_out_ep: endpoint {
++ remote-endpoint = <&xbar_sfc4_out_ep>;
++ };
+ };
+ };
++ };
+
+- xbar_sfc4_in_port: port@26 {
+- reg = <0x26>;
++ amx@2903000 {
++ status = "okay";
+
+- xbar_sfc4_in_ep: endpoint {
+- remote-endpoint = <&sfc4_cif_in_ep>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- port@27 {
+- reg = <0x27>;
++ port@0 {
++ reg = <0>;
+
+- xbar_sfc4_out_ep: endpoint {
+- remote-endpoint = <&sfc4_cif_out_ep>;
++ amx1_in1_ep: endpoint {
++ remote-endpoint = <&xbar_amx1_in1_ep>;
++ };
+ };
+- };
+
+- xbar_mvc1_in_port: port@28 {
+- reg = <0x28>;
++ port@1 {
++ reg = <1>;
+
+- xbar_mvc1_in_ep: endpoint {
+- remote-endpoint = <&mvc1_cif_in_ep>;
++ amx1_in2_ep: endpoint {
++ remote-endpoint = <&xbar_amx1_in2_ep>;
++ };
+ };
+- };
+
+- port@29 {
+- reg = <0x29>;
++ port@2 {
++ reg = <2>;
+
+- xbar_mvc1_out_ep: endpoint {
+- remote-endpoint = <&mvc1_cif_out_ep>;
++ amx1_in3_ep: endpoint {
++ remote-endpoint = <&xbar_amx1_in3_ep>;
++ };
+ };
+- };
+
+- xbar_mvc2_in_port: port@2a {
+- reg = <0x2a>;
++ port@3 {
++ reg = <3>;
+
+- xbar_mvc2_in_ep: endpoint {
+- remote-endpoint = <&mvc2_cif_in_ep>;
++ amx1_in4_ep: endpoint {
++ remote-endpoint = <&xbar_amx1_in4_ep>;
++ };
+ };
+- };
+
+- port@2b {
+- reg = <0x2b>;
++ amx1_out_port: port@4 {
++ reg = <4>;
+
+- xbar_mvc2_out_ep: endpoint {
+- remote-endpoint = <&mvc2_cif_out_ep>;
++ amx1_out_ep: endpoint {
++ remote-endpoint = <&xbar_amx1_out_ep>;
++ };
+ };
+ };
++ };
+
+- xbar_amx1_in1_port: port@2c {
+- reg = <0x2c>;
++ amx@2903100 {
++ status = "okay";
+
+- xbar_amx1_in1_ep: endpoint {
+- remote-endpoint = <&amx1_in1_ep>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- xbar_amx1_in2_port: port@2d {
+- reg = <0x2d>;
++ port@0 {
++ reg = <0>;
+
+- xbar_amx1_in2_ep: endpoint {
+- remote-endpoint = <&amx1_in2_ep>;
++ amx2_in1_ep: endpoint {
++ remote-endpoint = <&xbar_amx2_in1_ep>;
++ };
+ };
+- };
+
+- xbar_amx1_in3_port: port@2e {
+- reg = <0x2e>;
++ port@1 {
++ reg = <1>;
+
+- xbar_amx1_in3_ep: endpoint {
+- remote-endpoint = <&amx1_in3_ep>;
++ amx2_in2_ep: endpoint {
++ remote-endpoint = <&xbar_amx2_in2_ep>;
++ };
+ };
+- };
+
+- xbar_amx1_in4_port: port@2f {
+- reg = <0x2f>;
++ amx2_in3_port: port@2 {
++ reg = <2>;
+
+- xbar_amx1_in4_ep: endpoint {
+- remote-endpoint = <&amx1_in4_ep>;
++ amx2_in3_ep: endpoint {
++ remote-endpoint = <&xbar_amx2_in3_ep>;
++ };
+ };
+- };
+
+- port@30 {
+- reg = <0x30>;
++ amx2_in4_port: port@3 {
++ reg = <3>;
+
+- xbar_amx1_out_ep: endpoint {
+- remote-endpoint = <&amx1_out_ep>;
++ amx2_in4_ep: endpoint {
++ remote-endpoint = <&xbar_amx2_in4_ep>;
++ };
+ };
+- };
+
+- xbar_amx2_in1_port: port@31 {
+- reg = <0x31>;
++ amx2_out_port: port@4 {
++ reg = <4>;
+
+- xbar_amx2_in1_ep: endpoint {
+- remote-endpoint = <&amx2_in1_ep>;
++ amx2_out_ep: endpoint {
++ remote-endpoint = <&xbar_amx2_out_ep>;
++ };
+ };
+ };
++ };
+
+- xbar_amx2_in2_port: port@32 {
+- reg = <0x32>;
++ amx@2903200 {
++ status = "okay";
+
+- xbar_amx2_in2_ep: endpoint {
+- remote-endpoint = <&amx2_in2_ep>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- xbar_amx2_in3_port: port@33 {
+- reg = <0x33>;
++ port@0 {
++ reg = <0>;
+
+- xbar_amx2_in3_ep: endpoint {
+- remote-endpoint = <&amx2_in3_ep>;
++ amx3_in1_ep: endpoint {
++ remote-endpoint = <&xbar_amx3_in1_ep>;
++ };
+ };
+- };
+
+- xbar_amx2_in4_port: port@34 {
+- reg = <0x34>;
++ port@1 {
++ reg = <1>;
+
+- xbar_amx2_in4_ep: endpoint {
+- remote-endpoint = <&amx2_in4_ep>;
++ amx3_in2_ep: endpoint {
++ remote-endpoint = <&xbar_amx3_in2_ep>;
++ };
+ };
+- };
+
+- port@35 {
+- reg = <0x35>;
++ port@2 {
++ reg = <2>;
+
+- xbar_amx2_out_ep: endpoint {
+- remote-endpoint = <&amx2_out_ep>;
++ amx3_in3_ep: endpoint {
++ remote-endpoint = <&xbar_amx3_in3_ep>;
++ };
+ };
+- };
+
+- xbar_amx3_in1_port: port@36 {
+- reg = <0x36>;
++ port@3 {
++ reg = <3>;
+
+- xbar_amx3_in1_ep: endpoint {
+- remote-endpoint = <&amx3_in1_ep>;
++ amx3_in4_ep: endpoint {
++ remote-endpoint = <&xbar_amx3_in4_ep>;
++ };
+ };
+- };
+
+- xbar_amx3_in2_port: port@37 {
+- reg = <0x37>;
++ amx3_out_port: port@4 {
++ reg = <4>;
+
+- xbar_amx3_in2_ep: endpoint {
+- remote-endpoint = <&amx3_in2_ep>;
++ amx3_out_ep: endpoint {
++ remote-endpoint = <&xbar_amx3_out_ep>;
++ };
+ };
+ };
++ };
+
+- xbar_amx3_in3_port: port@38 {
+- reg = <0x38>;
++ amx@2903300 {
++ status = "okay";
+
+- xbar_amx3_in3_ep: endpoint {
+- remote-endpoint = <&amx3_in3_ep>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- xbar_amx3_in4_port: port@39 {
+- reg = <0x39>;
++ port@0 {
++ reg = <0>;
+
+- xbar_amx3_in4_ep: endpoint {
+- remote-endpoint = <&amx3_in4_ep>;
++ amx4_in1_ep: endpoint {
++ remote-endpoint = <&xbar_amx4_in1_ep>;
++ };
+ };
+- };
+
+- port@3a {
+- reg = <0x3a>;
++ port@1 {
++ reg = <1>;
+
+- xbar_amx3_out_ep: endpoint {
+- remote-endpoint = <&amx3_out_ep>;
++ amx4_in2_ep: endpoint {
++ remote-endpoint = <&xbar_amx4_in2_ep>;
++ };
+ };
+- };
+
+- xbar_amx4_in1_port: port@3b {
+- reg = <0x3b>;
++ port@2 {
++ reg = <2>;
+
+- xbar_amx4_in1_ep: endpoint {
+- remote-endpoint = <&amx4_in1_ep>;
++ amx4_in3_ep: endpoint {
++ remote-endpoint = <&xbar_amx4_in3_ep>;
++ };
+ };
+- };
+
+- xbar_amx4_in2_port: port@3c {
+- reg = <0x3c>;
++ port@3 {
++ reg = <3>;
+
+- xbar_amx4_in2_ep: endpoint {
+- remote-endpoint = <&amx4_in2_ep>;
++ amx4_in4_ep: endpoint {
++ remote-endpoint = <&xbar_amx4_in4_ep>;
++ };
+ };
+- };
+
+- xbar_amx4_in3_port: port@3d {
+- reg = <0x3d>;
++ amx4_out_port: port@4 {
++ reg = <4>;
+
+- xbar_amx4_in3_ep: endpoint {
+- remote-endpoint = <&amx4_in3_ep>;
++ amx4_out_ep: endpoint {
++ remote-endpoint = <&xbar_amx4_out_ep>;
++ };
+ };
+ };
++ };
+
+- xbar_amx4_in4_port: port@3e {
+- reg = <0x3e>;
++ adx@2903800 {
++ status = "okay";
+
+- xbar_amx4_in4_ep: endpoint {
+- remote-endpoint = <&amx4_in4_ep>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- port@3f {
+- reg = <0x3f>;
++ port@0 {
++ reg = <0>;
+
+- xbar_amx4_out_ep: endpoint {
+- remote-endpoint = <&amx4_out_ep>;
++ adx1_in_ep: endpoint {
++ remote-endpoint = <&xbar_adx1_in_ep>;
++ };
+ };
+- };
+
+- xbar_adx1_in_port: port@40 {
+- reg = <0x40>;
++ adx1_out1_port: port@1 {
++ reg = <1>;
+
+- xbar_adx1_in_ep: endpoint {
+- remote-endpoint = <&adx1_in_ep>;
++ adx1_out1_ep: endpoint {
++ remote-endpoint = <&xbar_adx1_out1_ep>;
++ };
+ };
+- };
+
+- port@41 {
+- reg = <0x41>;
++ adx1_out2_port: port@2 {
++ reg = <2>;
+
+- xbar_adx1_out1_ep: endpoint {
+- remote-endpoint = <&adx1_out1_ep>;
++ adx1_out2_ep: endpoint {
++ remote-endpoint = <&xbar_adx1_out2_ep>;
++ };
+ };
+- };
+
+- port@42 {
+- reg = <0x42>;
++ adx1_out3_port: port@3 {
++ reg = <3>;
+
+- xbar_adx1_out2_ep: endpoint {
+- remote-endpoint = <&adx1_out2_ep>;
++ adx1_out3_ep: endpoint {
++ remote-endpoint = <&xbar_adx1_out3_ep>;
++ };
+ };
+- };
+
+- port@43 {
+- reg = <0x43>;
++ adx1_out4_port: port@4 {
++ reg = <4>;
+
+- xbar_adx1_out3_ep: endpoint {
+- remote-endpoint = <&adx1_out3_ep>;
++ adx1_out4_ep: endpoint {
++ remote-endpoint = <&xbar_adx1_out4_ep>;
++ };
+ };
+ };
++ };
+
+- port@44 {
+- reg = <0x44>;
++ adx@2903900 {
++ status = "okay";
+
+- xbar_adx1_out4_ep: endpoint {
+- remote-endpoint = <&adx1_out4_ep>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- xbar_adx2_in_port: port@45 {
+- reg = <0x45>;
++ port@0 {
++ reg = <0>;
+
+- xbar_adx2_in_ep: endpoint {
+- remote-endpoint = <&adx2_in_ep>;
++ adx2_in_ep: endpoint {
++ remote-endpoint = <&xbar_adx2_in_ep>;
++ };
+ };
+- };
+
+- port@46 {
+- reg = <0x46>;
++ adx2_out1_port: port@1 {
++ reg = <1>;
+
+- xbar_adx2_out1_ep: endpoint {
+- remote-endpoint = <&adx2_out1_ep>;
++ adx2_out1_ep: endpoint {
++ remote-endpoint = <&xbar_adx2_out1_ep>;
++ };
+ };
+- };
+
+- port@47 {
+- reg = <0x47>;
++ adx2_out2_port: port@2 {
++ reg = <2>;
+
+- xbar_adx2_out2_ep: endpoint {
+- remote-endpoint = <&adx2_out2_ep>;
++ adx2_out2_ep: endpoint {
++ remote-endpoint = <&xbar_adx2_out2_ep>;
++ };
+ };
+- };
+
+- port@48 {
+- reg = <0x48>;
++ adx2_out3_port: port@3 {
++ reg = <3>;
+
+- xbar_adx2_out3_ep: endpoint {
+- remote-endpoint = <&adx2_out3_ep>;
++ adx2_out3_ep: endpoint {
++ remote-endpoint = <&xbar_adx2_out3_ep>;
++ };
+ };
+- };
+
+- port@49 {
+- reg = <0x49>;
++ adx2_out4_port: port@4 {
++ reg = <4>;
+
+- xbar_adx2_out4_ep: endpoint {
+- remote-endpoint = <&adx2_out4_ep>;
++ adx2_out4_ep: endpoint {
++ remote-endpoint = <&xbar_adx2_out4_ep>;
++ };
+ };
+ };
++ };
+
+- xbar_adx3_in_port: port@4a {
+- reg = <0x4a>;
++ adx@2903a00 {
++ status = "okay";
+
+- xbar_adx3_in_ep: endpoint {
+- remote-endpoint = <&adx3_in_ep>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- port@4b {
+- reg = <0x4b>;
++ port@0 {
++ reg = <0>;
+
+- xbar_adx3_out1_ep: endpoint {
+- remote-endpoint = <&adx3_out1_ep>;
++ adx3_in_ep: endpoint {
++ remote-endpoint = <&xbar_adx3_in_ep>;
++ };
+ };
+- };
+
+- port@4c {
+- reg = <0x4c>;
++ adx3_out1_port: port@1 {
++ reg = <1>;
+
+- xbar_adx3_out2_ep: endpoint {
+- remote-endpoint = <&adx3_out2_ep>;
++ adx3_out1_ep: endpoint {
++ remote-endpoint = <&xbar_adx3_out1_ep>;
++ };
+ };
+- };
+
+- port@4d {
+- reg = <0x4d>;
++ adx3_out2_port: port@2 {
++ reg = <2>;
+
+- xbar_adx3_out3_ep: endpoint {
+- remote-endpoint = <&adx3_out3_ep>;
++ adx3_out2_ep: endpoint {
++ remote-endpoint = <&xbar_adx3_out2_ep>;
++ };
+ };
+- };
+
+- port@4e {
+- reg = <0x4e>;
++ adx3_out3_port: port@3 {
++ reg = <3>;
+
+- xbar_adx3_out4_ep: endpoint {
+- remote-endpoint = <&adx3_out4_ep>;
++ adx3_out3_ep: endpoint {
++ remote-endpoint = <&xbar_adx3_out3_ep>;
++ };
+ };
+- };
+
+- xbar_adx4_in_port: port@4f {
+- reg = <0x4f>;
++ adx3_out4_port: port@4 {
++ reg = <4>;
+
+- xbar_adx4_in_ep: endpoint {
+- remote-endpoint = <&adx4_in_ep>;
++ adx3_out4_ep: endpoint {
++ remote-endpoint = <&xbar_adx3_out4_ep>;
++ };
+ };
+ };
++ };
+
+- port@50 {
+- reg = <0x50>;
++ adx@2903b00 {
++ status = "okay";
+
+- xbar_adx4_out1_ep: endpoint {
+- remote-endpoint = <&adx4_out1_ep>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- port@51 {
+- reg = <0x51>;
++ port@0 {
++ reg = <0>;
+
+- xbar_adx4_out2_ep: endpoint {
+- remote-endpoint = <&adx4_out2_ep>;
++ adx4_in_ep: endpoint {
++ remote-endpoint = <&xbar_adx4_in_ep>;
++ };
+ };
+- };
+
+- port@52 {
+- reg = <0x52>;
++ adx4_out1_port: port@1 {
++ reg = <1>;
+
+- xbar_adx4_out3_ep: endpoint {
+- remote-endpoint = <&adx4_out3_ep>;
++ adx4_out1_ep: endpoint {
++ remote-endpoint = <&xbar_adx4_out1_ep>;
++ };
+ };
+- };
+
+- port@53 {
+- reg = <0x53>;
++ adx4_out2_port: port@2 {
++ reg = <2>;
+
+- xbar_adx4_out4_ep: endpoint {
+- remote-endpoint = <&adx4_out4_ep>;
++ adx4_out2_ep: endpoint {
++ remote-endpoint = <&xbar_adx4_out2_ep>;
++ };
+ };
+- };
+
+- xbar_mixer_in1_port: port@54 {
+- reg = <0x54>;
++ adx4_out3_port: port@3 {
++ reg = <3>;
+
+- xbar_mixer_in1_ep: endpoint {
+- remote-endpoint = <&mixer_in1_ep>;
++ adx4_out3_ep: endpoint {
++ remote-endpoint = <&xbar_adx4_out3_ep>;
++ };
+ };
+- };
+
+- xbar_mixer_in2_port: port@55 {
+- reg = <0x55>;
++ adx4_out4_port: port@4 {
++ reg = <4>;
+
+- xbar_mixer_in2_ep: endpoint {
+- remote-endpoint = <&mixer_in2_ep>;
++ adx4_out4_ep: endpoint {
++ remote-endpoint = <&xbar_adx4_out4_ep>;
++ };
+ };
+ };
++ };
+
+- xbar_mixer_in3_port: port@56 {
+- reg = <0x56>;
++ dmic@2904200 {
++ status = "okay";
+
+- xbar_mixer_in3_ep: endpoint {
+- remote-endpoint = <&mixer_in3_ep>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- xbar_mixer_in4_port: port@57 {
+- reg = <0x57>;
++ port@0 {
++ reg = <0>;
+
+- xbar_mixer_in4_ep: endpoint {
+- remote-endpoint = <&mixer_in4_ep>;
++ dmic3_cif_ep: endpoint {
++ remote-endpoint = <&xbar_dmic3_ep>;
++ };
+ };
+- };
+
+- xbar_mixer_in5_port: port@58 {
+- reg = <0x58>;
++ dmic3_port: port@1 {
++ reg = <1>;
+
+- xbar_mixer_in5_ep: endpoint {
+- remote-endpoint = <&mixer_in5_ep>;
++ dmic3_dap_ep: endpoint {
++ /* Place holder for external Codec */
++ };
+ };
+ };
++ };
+
+- xbar_mixer_in6_port: port@59 {
+- reg = <0x59>;
++ processing-engine@2908000 {
++ status = "okay";
+
+- xbar_mixer_in6_ep: endpoint {
+- remote-endpoint = <&mixer_in6_ep>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- xbar_mixer_in7_port: port@5a {
+- reg = <0x5a>;
++ port@0 {
++ reg = <0x0>;
+
+- xbar_mixer_in7_ep: endpoint {
+- remote-endpoint = <&mixer_in7_ep>;
++ ope1_cif_in_ep: endpoint {
++ remote-endpoint = <&xbar_ope1_in_ep>;
++ };
+ };
+- };
+
+- xbar_mixer_in8_port: port@5b {
+- reg = <0x5b>;
++ ope1_out_port: port@1 {
++ reg = <0x1>;
+
+- xbar_mixer_in8_ep: endpoint {
+- remote-endpoint = <&mixer_in8_ep>;
++ ope1_cif_out_ep: endpoint {
++ remote-endpoint = <&xbar_ope1_out_ep>;
++ };
+ };
+ };
++ };
+
+- xbar_mixer_in9_port: port@5c {
+- reg = <0x5c>;
++ mvc@290a000 {
++ status = "okay";
+
+- xbar_mixer_in9_ep: endpoint {
+- remote-endpoint = <&mixer_in9_ep>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- xbar_mixer_in10_port: port@5d {
+- reg = <0x5d>;
++ port@0 {
++ reg = <0>;
+
+- xbar_mixer_in10_ep: endpoint {
+- remote-endpoint = <&mixer_in10_ep>;
++ mvc1_cif_in_ep: endpoint {
++ remote-endpoint = <&xbar_mvc1_in_ep>;
++ };
+ };
+- };
+
+- port@5e {
+- reg = <0x5e>;
++ mvc1_out_port: port@1 {
++ reg = <1>;
+
+- xbar_mixer_out1_ep: endpoint {
+- remote-endpoint = <&mixer_out1_ep>;
++ mvc1_cif_out_ep: endpoint {
++ remote-endpoint = <&xbar_mvc1_out_ep>;
++ };
+ };
+ };
++ };
+
+- port@5f {
+- reg = <0x5f>;
++ mvc@290a200 {
++ status = "okay";
+
+- xbar_mixer_out2_ep: endpoint {
+- remote-endpoint = <&mixer_out2_ep>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- port@60 {
+- reg = <0x60>;
++ port@0 {
++ reg = <0>;
+
+- xbar_mixer_out3_ep: endpoint {
+- remote-endpoint = <&mixer_out3_ep>;
++ mvc2_cif_in_ep: endpoint {
++ remote-endpoint = <&xbar_mvc2_in_ep>;
++ };
+ };
+- };
+
+- port@61 {
+- reg = <0x61>;
++ mvc2_out_port: port@1 {
++ reg = <1>;
+
+- xbar_mixer_out4_ep: endpoint {
+- remote-endpoint = <&mixer_out4_ep>;
++ mvc2_cif_out_ep: endpoint {
++ remote-endpoint = <&xbar_mvc2_out_ep>;
++ };
+ };
+ };
++ };
+
+- port@62 {
+- reg = <0x62>;
++ amixer@290bb00 {
++ status = "okay";
+
+- xbar_mixer_out5_ep: endpoint {
+- remote-endpoint = <&mixer_out5_ep>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- xbar_asrc_in1_port: port@63 {
+- reg = <0x63>;
++ port@0 {
++ reg = <0x0>;
+
+- xbar_asrc_in1_ep: endpoint {
+- remote-endpoint = <&asrc_in1_ep>;
++ mixer_in1_ep: endpoint {
++ remote-endpoint = <&xbar_mixer_in1_ep>;
++ };
+ };
+- };
+
+- port@64 {
+- reg = <0x64>;
++ port@1 {
++ reg = <0x1>;
+
+- xbar_asrc_out1_ep: endpoint {
+- remote-endpoint = <&asrc_out1_ep>;
++ mixer_in2_ep: endpoint {
++ remote-endpoint = <&xbar_mixer_in2_ep>;
++ };
+ };
+- };
+
+- xbar_asrc_in2_port: port@65 {
+- reg = <0x65>;
++ port@2 {
++ reg = <0x2>;
+
+- xbar_asrc_in2_ep: endpoint {
+- remote-endpoint = <&asrc_in2_ep>;
++ mixer_in3_ep: endpoint {
++ remote-endpoint = <&xbar_mixer_in3_ep>;
++ };
+ };
+- };
+
+- port@66 {
+- reg = <0x66>;
++ port@3 {
++ reg = <0x3>;
+
+- xbar_asrc_out2_ep: endpoint {
+- remote-endpoint = <&asrc_out2_ep>;
++ mixer_in4_ep: endpoint {
++ remote-endpoint = <&xbar_mixer_in4_ep>;
++ };
+ };
+- };
+
+- xbar_asrc_in3_port: port@67 {
+- reg = <0x67>;
++ port@4 {
++ reg = <0x4>;
+
+- xbar_asrc_in3_ep: endpoint {
+- remote-endpoint = <&asrc_in3_ep>;
++ mixer_in5_ep: endpoint {
++ remote-endpoint = <&xbar_mixer_in5_ep>;
++ };
+ };
+- };
+
+- port@68 {
+- reg = <0x68>;
++ port@5 {
++ reg = <0x5>;
+
+- xbar_asrc_out3_ep: endpoint {
+- remote-endpoint = <&asrc_out3_ep>;
++ mixer_in6_ep: endpoint {
++ remote-endpoint = <&xbar_mixer_in6_ep>;
++ };
+ };
+- };
+
+- xbar_asrc_in4_port: port@69 {
+- reg = <0x69>;
++ port@6 {
++ reg = <0x6>;
+
+- xbar_asrc_in4_ep: endpoint {
+- remote-endpoint = <&asrc_in4_ep>;
++ mixer_in7_ep: endpoint {
++ remote-endpoint = <&xbar_mixer_in7_ep>;
++ };
+ };
+- };
+
+- port@6a {
+- reg = <0x6a>;
++ port@7 {
++ reg = <0x7>;
+
+- xbar_asrc_out4_ep: endpoint {
+- remote-endpoint = <&asrc_out4_ep>;
++ mixer_in8_ep: endpoint {
++ remote-endpoint = <&xbar_mixer_in8_ep>;
++ };
+ };
+- };
+
+- xbar_asrc_in5_port: port@6b {
+- reg = <0x6b>;
++ port@8 {
++ reg = <0x8>;
+
+- xbar_asrc_in5_ep: endpoint {
+- remote-endpoint = <&asrc_in5_ep>;
++ mixer_in9_ep: endpoint {
++ remote-endpoint = <&xbar_mixer_in9_ep>;
++ };
+ };
+- };
+
+- port@6c {
+- reg = <0x6c>;
++ port@9 {
++ reg = <0x9>;
+
+- xbar_asrc_out5_ep: endpoint {
+- remote-endpoint = <&asrc_out5_ep>;
++ mixer_in10_ep: endpoint {
++ remote-endpoint = <&xbar_mixer_in10_ep>;
++ };
+ };
+- };
+
+- xbar_asrc_in6_port: port@6d {
+- reg = <0x6d>;
++ mixer_out1_port: port@a {
++ reg = <0xa>;
+
+- xbar_asrc_in6_ep: endpoint {
+- remote-endpoint = <&asrc_in6_ep>;
++ mixer_out1_ep: endpoint {
++ remote-endpoint = <&xbar_mixer_out1_ep>;
++ };
+ };
+- };
+
+- port@6e {
+- reg = <0x6e>;
++ mixer_out2_port: port@b {
++ reg = <0xb>;
+
+- xbar_asrc_out6_ep: endpoint {
+- remote-endpoint = <&asrc_out6_ep>;
++ mixer_out2_ep: endpoint {
++ remote-endpoint = <&xbar_mixer_out2_ep>;
++ };
+ };
+- };
+
+- xbar_asrc_in7_port: port@6f {
+- reg = <0x6f>;
++ mixer_out3_port: port@c {
++ reg = <0xc>;
+
+- xbar_asrc_in7_ep: endpoint {
+- remote-endpoint = <&asrc_in7_ep>;
++ mixer_out3_ep: endpoint {
++ remote-endpoint = <&xbar_mixer_out3_ep>;
++ };
+ };
+- };
+
+- xbar_ope1_in_port: port@70 {
+- reg = <0x70>;
++ mixer_out4_port: port@d {
++ reg = <0xd>;
+
+- xbar_ope1_in_ep: endpoint {
+- remote-endpoint = <&ope1_cif_in_ep>;
++ mixer_out4_ep: endpoint {
++ remote-endpoint = <&xbar_mixer_out4_ep>;
++ };
+ };
+- };
+
+- port@71 {
+- reg = <0x71>;
++ mixer_out5_port: port@e {
++ reg = <0xe>;
+
+- xbar_ope1_out_ep: endpoint {
+- remote-endpoint = <&ope1_cif_out_ep>;
++ mixer_out5_ep: endpoint {
++ remote-endpoint = <&xbar_mixer_out5_ep>;
++ };
+ };
+ };
+ };
+@@ -1055,7 +1011,7 @@ admaif19_ep: endpoint {
+ };
+ };
+
+- i2s@2901000 {
++ asrc@2910000 {
+ status = "okay";
+
+ ports {
+@@ -1063,936 +1019,980 @@ ports {
+ #size-cells = <0>;
+
+ port@0 {
+- reg = <0>;
++ reg = <0x0>;
+
+- i2s1_cif_ep: endpoint {
+- remote-endpoint = <&xbar_i2s1_ep>;
++ asrc_in1_ep: endpoint {
++ remote-endpoint = <&xbar_asrc_in1_ep>;
+ };
+ };
+
+- i2s1_port: port@1 {
+- reg = <1>;
++ port@1 {
++ reg = <0x1>;
+
+- i2s1_dap_ep: endpoint {
+- dai-format = "i2s";
+- remote-endpoint = <&rt5658_ep>;
++ asrc_in2_ep: endpoint {
++ remote-endpoint = <&xbar_asrc_in2_ep>;
+ };
+ };
+- };
+- };
+
+- i2s@2901100 {
+- status = "okay";
++ port@2 {
++ reg = <0x2>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ asrc_in3_ep: endpoint {
++ remote-endpoint = <&xbar_asrc_in3_ep>;
++ };
++ };
+
+- port@0 {
+- reg = <0>;
++ port@3 {
++ reg = <0x3>;
+
+- i2s2_cif_ep: endpoint {
+- remote-endpoint = <&xbar_i2s2_ep>;
++ asrc_in4_ep: endpoint {
++ remote-endpoint = <&xbar_asrc_in4_ep>;
+ };
+ };
+
+- i2s2_port: port@1 {
+- reg = <1>;
++ port@4 {
++ reg = <0x4>;
+
+- i2s2_dap_ep: endpoint {
+- dai-format = "i2s";
+- /* Place holder for external Codec */
++ asrc_in5_ep: endpoint {
++ remote-endpoint = <&xbar_asrc_in5_ep>;
+ };
+ };
+- };
+- };
+
+- i2s@2901300 {
+- status = "okay";
++ port@5 {
++ reg = <0x5>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ asrc_in6_ep: endpoint {
++ remote-endpoint = <&xbar_asrc_in6_ep>;
++ };
++ };
+
+- port@0 {
+- reg = <0>;
++ port@6 {
++ reg = <0x6>;
+
+- i2s4_cif_ep: endpoint {
+- remote-endpoint = <&xbar_i2s4_ep>;
++ asrc_in7_ep: endpoint {
++ remote-endpoint = <&xbar_asrc_in7_ep>;
+ };
+ };
+
+- i2s4_port: port@1 {
+- reg = <1>;
++ asrc_out1_port: port@7 {
++ reg = <0x7>;
+
+- i2s4_dap_ep: endpoint {
+- dai-format = "i2s";
+- /* Place holder for external Codec */
++ asrc_out1_ep: endpoint {
++ remote-endpoint = <&xbar_asrc_out1_ep>;
+ };
+ };
+- };
+- };
+
+- i2s@2901500 {
+- status = "okay";
++ asrc_out2_port: port@8 {
++ reg = <0x8>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ asrc_out2_ep: endpoint {
++ remote-endpoint = <&xbar_asrc_out2_ep>;
++ };
++ };
+
+- port@0 {
+- reg = <0>;
++ asrc_out3_port: port@9 {
++ reg = <0x9>;
+
+- i2s6_cif_ep: endpoint {
+- remote-endpoint = <&xbar_i2s6_ep>;
++ asrc_out3_ep: endpoint {
++ remote-endpoint = <&xbar_asrc_out3_ep>;
+ };
+ };
+
+- i2s6_port: port@1 {
+- reg = <1>;
++ asrc_out4_port: port@a {
++ reg = <0xa>;
+
+- i2s6_dap_ep: endpoint {
+- dai-format = "i2s";
+- /* Place holder for external Codec */
++ asrc_out4_ep: endpoint {
++ remote-endpoint = <&xbar_asrc_out4_ep>;
++ };
++ };
++
++ asrc_out5_port: port@b {
++ reg = <0xb>;
++
++ asrc_out5_ep: endpoint {
++ remote-endpoint = <&xbar_asrc_out5_ep>;
++ };
++ };
++
++ asrc_out6_port: port@c {
++ reg = <0xc>;
++
++ asrc_out6_ep: endpoint {
++ remote-endpoint = <&xbar_asrc_out6_ep>;
+ };
+ };
+ };
+ };
+
+- dmic@2904200 {
+- status = "okay";
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ port@0 {
++ reg = <0x0>;
+
+- port@0 {
+- reg = <0>;
++ xbar_admaif0_ep: endpoint {
++ remote-endpoint = <&admaif0_ep>;
++ };
++ };
+
+- dmic3_cif_ep: endpoint {
+- remote-endpoint = <&xbar_dmic3_ep>;
+- };
++ port@1 {
++ reg = <0x1>;
++
++ xbar_admaif1_ep: endpoint {
++ remote-endpoint = <&admaif1_ep>;
+ };
++ };
+
+- dmic3_port: port@1 {
+- reg = <1>;
++ port@2 {
++ reg = <0x2>;
+
+- dmic3_dap_ep: endpoint {
+- /* Place holder for external Codec */
+- };
++ xbar_admaif2_ep: endpoint {
++ remote-endpoint = <&admaif2_ep>;
+ };
+ };
+- };
+
+- sfc@2902000 {
+- status = "okay";
++ port@3 {
++ reg = <0x3>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ xbar_admaif3_ep: endpoint {
++ remote-endpoint = <&admaif3_ep>;
++ };
++ };
+
+- port@0 {
+- reg = <0>;
++ port@4 {
++ reg = <0x4>;
++
++ xbar_admaif4_ep: endpoint {
++ remote-endpoint = <&admaif4_ep>;
++ };
++ };
++
++ port@5 {
++ reg = <0x5>;
++
++ xbar_admaif5_ep: endpoint {
++ remote-endpoint = <&admaif5_ep>;
++ };
++ };
++
++ port@6 {
++ reg = <0x6>;
++
++ xbar_admaif6_ep: endpoint {
++ remote-endpoint = <&admaif6_ep>;
++ };
++ };
++
++ port@7 {
++ reg = <0x7>;
++
++ xbar_admaif7_ep: endpoint {
++ remote-endpoint = <&admaif7_ep>;
++ };
++ };
++
++ port@8 {
++ reg = <0x8>;
+
+- sfc1_cif_in_ep: endpoint {
+- remote-endpoint = <&xbar_sfc1_in_ep>;
+- };
++ xbar_admaif8_ep: endpoint {
++ remote-endpoint = <&admaif8_ep>;
+ };
++ };
+
+- sfc1_out_port: port@1 {
+- reg = <1>;
++ port@9 {
++ reg = <0x9>;
+
+- sfc1_cif_out_ep: endpoint {
+- remote-endpoint = <&xbar_sfc1_out_ep>;
+- };
++ xbar_admaif9_ep: endpoint {
++ remote-endpoint = <&admaif9_ep>;
+ };
+ };
+- };
+
+- sfc@2902200 {
+- status = "okay";
++ port@a {
++ reg = <0xa>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ xbar_admaif10_ep: endpoint {
++ remote-endpoint = <&admaif10_ep>;
++ };
++ };
+
+- port@0 {
+- reg = <0>;
++ port@b {
++ reg = <0xb>;
+
+- sfc2_cif_in_ep: endpoint {
+- remote-endpoint = <&xbar_sfc2_in_ep>;
+- };
++ xbar_admaif11_ep: endpoint {
++ remote-endpoint = <&admaif11_ep>;
+ };
++ };
+
+- sfc2_out_port: port@1 {
+- reg = <1>;
++ port@c {
++ reg = <0xc>;
+
+- sfc2_cif_out_ep: endpoint {
+- remote-endpoint = <&xbar_sfc2_out_ep>;
+- };
++ xbar_admaif12_ep: endpoint {
++ remote-endpoint = <&admaif12_ep>;
+ };
+ };
+- };
+
+- sfc@2902400 {
+- status = "okay";
++ port@d {
++ reg = <0xd>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ xbar_admaif13_ep: endpoint {
++ remote-endpoint = <&admaif13_ep>;
++ };
++ };
+
+- port@0 {
+- reg = <0>;
++ port@e {
++ reg = <0xe>;
+
+- sfc3_cif_in_ep: endpoint {
+- remote-endpoint = <&xbar_sfc3_in_ep>;
+- };
++ xbar_admaif14_ep: endpoint {
++ remote-endpoint = <&admaif14_ep>;
+ };
++ };
+
+- sfc3_out_port: port@1 {
+- reg = <1>;
++ port@f {
++ reg = <0xf>;
+
+- sfc3_cif_out_ep: endpoint {
+- remote-endpoint = <&xbar_sfc3_out_ep>;
+- };
++ xbar_admaif15_ep: endpoint {
++ remote-endpoint = <&admaif15_ep>;
+ };
+ };
+- };
+
+- sfc@2902600 {
+- status = "okay";
++ port@10 {
++ reg = <0x10>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ xbar_admaif16_ep: endpoint {
++ remote-endpoint = <&admaif16_ep>;
++ };
++ };
+
+- port@0 {
+- reg = <0>;
++ port@11 {
++ reg = <0x11>;
+
+- sfc4_cif_in_ep: endpoint {
+- remote-endpoint = <&xbar_sfc4_in_ep>;
+- };
++ xbar_admaif17_ep: endpoint {
++ remote-endpoint = <&admaif17_ep>;
+ };
++ };
+
+- sfc4_out_port: port@1 {
+- reg = <1>;
++ port@12 {
++ reg = <0x12>;
+
+- sfc4_cif_out_ep: endpoint {
+- remote-endpoint = <&xbar_sfc4_out_ep>;
+- };
++ xbar_admaif18_ep: endpoint {
++ remote-endpoint = <&admaif18_ep>;
+ };
+ };
+- };
+
+- mvc@290a000 {
+- status = "okay";
++ port@13 {
++ reg = <0x13>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ xbar_admaif19_ep: endpoint {
++ remote-endpoint = <&admaif19_ep>;
++ };
++ };
+
+- port@0 {
+- reg = <0>;
++ xbar_i2s1_port: port@14 {
++ reg = <0x14>;
+
+- mvc1_cif_in_ep: endpoint {
+- remote-endpoint = <&xbar_mvc1_in_ep>;
+- };
++ xbar_i2s1_ep: endpoint {
++ remote-endpoint = <&i2s1_cif_ep>;
+ };
++ };
+
+- mvc1_out_port: port@1 {
+- reg = <1>;
++ xbar_i2s2_port: port@15 {
++ reg = <0x15>;
+
+- mvc1_cif_out_ep: endpoint {
+- remote-endpoint = <&xbar_mvc1_out_ep>;
+- };
++ xbar_i2s2_ep: endpoint {
++ remote-endpoint = <&i2s2_cif_ep>;
+ };
+ };
+- };
+
+- mvc@290a200 {
+- status = "okay";
++ xbar_i2s4_port: port@17 {
++ reg = <0x17>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ xbar_i2s4_ep: endpoint {
++ remote-endpoint = <&i2s4_cif_ep>;
++ };
++ };
+
+- port@0 {
+- reg = <0>;
++ xbar_i2s6_port: port@19 {
++ reg = <0x19>;
+
+- mvc2_cif_in_ep: endpoint {
+- remote-endpoint = <&xbar_mvc2_in_ep>;
+- };
++ xbar_i2s6_ep: endpoint {
++ remote-endpoint = <&i2s6_cif_ep>;
+ };
++ };
+
+- mvc2_out_port: port@1 {
+- reg = <1>;
++ xbar_dmic3_port: port@1c {
++ reg = <0x1c>;
+
+- mvc2_cif_out_ep: endpoint {
+- remote-endpoint = <&xbar_mvc2_out_ep>;
+- };
++ xbar_dmic3_ep: endpoint {
++ remote-endpoint = <&dmic3_cif_ep>;
+ };
+ };
+- };
+
+- amx@2903000 {
+- status = "okay";
++ xbar_sfc1_in_port: port@20 {
++ reg = <0x20>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ xbar_sfc1_in_ep: endpoint {
++ remote-endpoint = <&sfc1_cif_in_ep>;
++ };
++ };
+
+- port@0 {
+- reg = <0>;
++ port@21 {
++ reg = <0x21>;
+
+- amx1_in1_ep: endpoint {
+- remote-endpoint = <&xbar_amx1_in1_ep>;
+- };
++ xbar_sfc1_out_ep: endpoint {
++ remote-endpoint = <&sfc1_cif_out_ep>;
+ };
++ };
+
+- port@1 {
+- reg = <1>;
++ xbar_sfc2_in_port: port@22 {
++ reg = <0x22>;
+
+- amx1_in2_ep: endpoint {
+- remote-endpoint = <&xbar_amx1_in2_ep>;
+- };
++ xbar_sfc2_in_ep: endpoint {
++ remote-endpoint = <&sfc2_cif_in_ep>;
+ };
++ };
+
+- port@2 {
+- reg = <2>;
++ port@23 {
++ reg = <0x23>;
+
+- amx1_in3_ep: endpoint {
+- remote-endpoint = <&xbar_amx1_in3_ep>;
+- };
++ xbar_sfc2_out_ep: endpoint {
++ remote-endpoint = <&sfc2_cif_out_ep>;
+ };
++ };
+
+- port@3 {
+- reg = <3>;
++ xbar_sfc3_in_port: port@24 {
++ reg = <0x24>;
+
+- amx1_in4_ep: endpoint {
+- remote-endpoint = <&xbar_amx1_in4_ep>;
+- };
++ xbar_sfc3_in_ep: endpoint {
++ remote-endpoint = <&sfc3_cif_in_ep>;
+ };
++ };
+
+- amx1_out_port: port@4 {
+- reg = <4>;
++ port@25 {
++ reg = <0x25>;
+
+- amx1_out_ep: endpoint {
+- remote-endpoint = <&xbar_amx1_out_ep>;
+- };
++ xbar_sfc3_out_ep: endpoint {
++ remote-endpoint = <&sfc3_cif_out_ep>;
+ };
+ };
+- };
+
+- amx@2903100 {
+- status = "okay";
++ xbar_sfc4_in_port: port@26 {
++ reg = <0x26>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ xbar_sfc4_in_ep: endpoint {
++ remote-endpoint = <&sfc4_cif_in_ep>;
++ };
++ };
+
+- port@0 {
+- reg = <0>;
++ port@27 {
++ reg = <0x27>;
+
+- amx2_in1_ep: endpoint {
+- remote-endpoint = <&xbar_amx2_in1_ep>;
+- };
++ xbar_sfc4_out_ep: endpoint {
++ remote-endpoint = <&sfc4_cif_out_ep>;
++ };
++ };
++
++ xbar_mvc1_in_port: port@28 {
++ reg = <0x28>;
++
++ xbar_mvc1_in_ep: endpoint {
++ remote-endpoint = <&mvc1_cif_in_ep>;
+ };
++ };
+
+- port@1 {
+- reg = <1>;
++ port@29 {
++ reg = <0x29>;
+
+- amx2_in2_ep: endpoint {
+- remote-endpoint = <&xbar_amx2_in2_ep>;
+- };
++ xbar_mvc1_out_ep: endpoint {
++ remote-endpoint = <&mvc1_cif_out_ep>;
+ };
++ };
+
+- amx2_in3_port: port@2 {
+- reg = <2>;
++ xbar_mvc2_in_port: port@2a {
++ reg = <0x2a>;
+
+- amx2_in3_ep: endpoint {
+- remote-endpoint = <&xbar_amx2_in3_ep>;
+- };
++ xbar_mvc2_in_ep: endpoint {
++ remote-endpoint = <&mvc2_cif_in_ep>;
+ };
++ };
+
+- amx2_in4_port: port@3 {
+- reg = <3>;
++ port@2b {
++ reg = <0x2b>;
+
+- amx2_in4_ep: endpoint {
+- remote-endpoint = <&xbar_amx2_in4_ep>;
+- };
++ xbar_mvc2_out_ep: endpoint {
++ remote-endpoint = <&mvc2_cif_out_ep>;
+ };
++ };
+
+- amx2_out_port: port@4 {
+- reg = <4>;
++ xbar_amx1_in1_port: port@2c {
++ reg = <0x2c>;
+
+- amx2_out_ep: endpoint {
+- remote-endpoint = <&xbar_amx2_out_ep>;
+- };
++ xbar_amx1_in1_ep: endpoint {
++ remote-endpoint = <&amx1_in1_ep>;
+ };
+ };
+- };
+
+- amx@2903200 {
+- status = "okay";
++ xbar_amx1_in2_port: port@2d {
++ reg = <0x2d>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ xbar_amx1_in2_ep: endpoint {
++ remote-endpoint = <&amx1_in2_ep>;
++ };
++ };
+
+- port@0 {
+- reg = <0>;
++ xbar_amx1_in3_port: port@2e {
++ reg = <0x2e>;
+
+- amx3_in1_ep: endpoint {
+- remote-endpoint = <&xbar_amx3_in1_ep>;
+- };
++ xbar_amx1_in3_ep: endpoint {
++ remote-endpoint = <&amx1_in3_ep>;
+ };
++ };
+
+- port@1 {
+- reg = <1>;
++ xbar_amx1_in4_port: port@2f {
++ reg = <0x2f>;
+
+- amx3_in2_ep: endpoint {
+- remote-endpoint = <&xbar_amx3_in2_ep>;
+- };
++ xbar_amx1_in4_ep: endpoint {
++ remote-endpoint = <&amx1_in4_ep>;
+ };
++ };
+
+- port@2 {
+- reg = <2>;
++ port@30 {
++ reg = <0x30>;
+
+- amx3_in3_ep: endpoint {
+- remote-endpoint = <&xbar_amx3_in3_ep>;
+- };
++ xbar_amx1_out_ep: endpoint {
++ remote-endpoint = <&amx1_out_ep>;
+ };
++ };
+
+- port@3 {
+- reg = <3>;
++ xbar_amx2_in1_port: port@31 {
++ reg = <0x31>;
+
+- amx3_in4_ep: endpoint {
+- remote-endpoint = <&xbar_amx3_in4_ep>;
+- };
++ xbar_amx2_in1_ep: endpoint {
++ remote-endpoint = <&amx2_in1_ep>;
+ };
++ };
+
+- amx3_out_port: port@4 {
+- reg = <4>;
++ xbar_amx2_in2_port: port@32 {
++ reg = <0x32>;
+
+- amx3_out_ep: endpoint {
+- remote-endpoint = <&xbar_amx3_out_ep>;
+- };
++ xbar_amx2_in2_ep: endpoint {
++ remote-endpoint = <&amx2_in2_ep>;
+ };
+ };
+- };
+
+- amx@2903300 {
+- status = "okay";
++ xbar_amx2_in3_port: port@33 {
++ reg = <0x33>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ xbar_amx2_in3_ep: endpoint {
++ remote-endpoint = <&amx2_in3_ep>;
++ };
++ };
+
+- port@0 {
+- reg = <0>;
++ xbar_amx2_in4_port: port@34 {
++ reg = <0x34>;
+
+- amx4_in1_ep: endpoint {
+- remote-endpoint = <&xbar_amx4_in1_ep>;
+- };
++ xbar_amx2_in4_ep: endpoint {
++ remote-endpoint = <&amx2_in4_ep>;
+ };
++ };
+
+- port@1 {
+- reg = <1>;
++ port@35 {
++ reg = <0x35>;
+
+- amx4_in2_ep: endpoint {
+- remote-endpoint = <&xbar_amx4_in2_ep>;
+- };
++ xbar_amx2_out_ep: endpoint {
++ remote-endpoint = <&amx2_out_ep>;
+ };
++ };
+
+- port@2 {
+- reg = <2>;
++ xbar_amx3_in1_port: port@36 {
++ reg = <0x36>;
+
+- amx4_in3_ep: endpoint {
+- remote-endpoint = <&xbar_amx4_in3_ep>;
+- };
++ xbar_amx3_in1_ep: endpoint {
++ remote-endpoint = <&amx3_in1_ep>;
+ };
++ };
+
+- port@3 {
+- reg = <3>;
++ xbar_amx3_in2_port: port@37 {
++ reg = <0x37>;
+
+- amx4_in4_ep: endpoint {
+- remote-endpoint = <&xbar_amx4_in4_ep>;
+- };
++ xbar_amx3_in2_ep: endpoint {
++ remote-endpoint = <&amx3_in2_ep>;
+ };
++ };
+
+- amx4_out_port: port@4 {
+- reg = <4>;
++ xbar_amx3_in3_port: port@38 {
++ reg = <0x38>;
+
+- amx4_out_ep: endpoint {
+- remote-endpoint = <&xbar_amx4_out_ep>;
+- };
++ xbar_amx3_in3_ep: endpoint {
++ remote-endpoint = <&amx3_in3_ep>;
+ };
+ };
+- };
+
+- adx@2903800 {
+- status = "okay";
++ xbar_amx3_in4_port: port@39 {
++ reg = <0x39>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ xbar_amx3_in4_ep: endpoint {
++ remote-endpoint = <&amx3_in4_ep>;
++ };
++ };
+
+- port@0 {
+- reg = <0>;
++ port@3a {
++ reg = <0x3a>;
+
+- adx1_in_ep: endpoint {
+- remote-endpoint = <&xbar_adx1_in_ep>;
+- };
++ xbar_amx3_out_ep: endpoint {
++ remote-endpoint = <&amx3_out_ep>;
+ };
++ };
+
+- adx1_out1_port: port@1 {
+- reg = <1>;
++ xbar_amx4_in1_port: port@3b {
++ reg = <0x3b>;
+
+- adx1_out1_ep: endpoint {
+- remote-endpoint = <&xbar_adx1_out1_ep>;
+- };
++ xbar_amx4_in1_ep: endpoint {
++ remote-endpoint = <&amx4_in1_ep>;
+ };
++ };
+
+- adx1_out2_port: port@2 {
+- reg = <2>;
++ xbar_amx4_in2_port: port@3c {
++ reg = <0x3c>;
+
+- adx1_out2_ep: endpoint {
+- remote-endpoint = <&xbar_adx1_out2_ep>;
+- };
++ xbar_amx4_in2_ep: endpoint {
++ remote-endpoint = <&amx4_in2_ep>;
+ };
++ };
+
+- adx1_out3_port: port@3 {
+- reg = <3>;
++ xbar_amx4_in3_port: port@3d {
++ reg = <0x3d>;
+
+- adx1_out3_ep: endpoint {
+- remote-endpoint = <&xbar_adx1_out3_ep>;
+- };
++ xbar_amx4_in3_ep: endpoint {
++ remote-endpoint = <&amx4_in3_ep>;
+ };
++ };
+
+- adx1_out4_port: port@4 {
+- reg = <4>;
++ xbar_amx4_in4_port: port@3e {
++ reg = <0x3e>;
+
+- adx1_out4_ep: endpoint {
+- remote-endpoint = <&xbar_adx1_out4_ep>;
+- };
++ xbar_amx4_in4_ep: endpoint {
++ remote-endpoint = <&amx4_in4_ep>;
+ };
+ };
+- };
+
+- adx@2903900 {
+- status = "okay";
++ port@3f {
++ reg = <0x3f>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ xbar_amx4_out_ep: endpoint {
++ remote-endpoint = <&amx4_out_ep>;
++ };
++ };
+
+- port@0 {
+- reg = <0>;
++ xbar_adx1_in_port: port@40 {
++ reg = <0x40>;
+
+- adx2_in_ep: endpoint {
+- remote-endpoint = <&xbar_adx2_in_ep>;
+- };
++ xbar_adx1_in_ep: endpoint {
++ remote-endpoint = <&adx1_in_ep>;
+ };
++ };
+
+- adx2_out1_port: port@1 {
+- reg = <1>;
+-
+- adx2_out1_ep: endpoint {
+- remote-endpoint = <&xbar_adx2_out1_ep>;
+- };
++ port@41 {
++ reg = <0x41>;
++
++ xbar_adx1_out1_ep: endpoint {
++ remote-endpoint = <&adx1_out1_ep>;
+ };
++ };
+
+- adx2_out2_port: port@2 {
+- reg = <2>;
++ port@42 {
++ reg = <0x42>;
+
+- adx2_out2_ep: endpoint {
+- remote-endpoint = <&xbar_adx2_out2_ep>;
+- };
++ xbar_adx1_out2_ep: endpoint {
++ remote-endpoint = <&adx1_out2_ep>;
+ };
++ };
+
+- adx2_out3_port: port@3 {
+- reg = <3>;
++ port@43 {
++ reg = <0x43>;
+
+- adx2_out3_ep: endpoint {
+- remote-endpoint = <&xbar_adx2_out3_ep>;
+- };
++ xbar_adx1_out3_ep: endpoint {
++ remote-endpoint = <&adx1_out3_ep>;
+ };
++ };
+
+- adx2_out4_port: port@4 {
+- reg = <4>;
++ port@44 {
++ reg = <0x44>;
+
+- adx2_out4_ep: endpoint {
+- remote-endpoint = <&xbar_adx2_out4_ep>;
+- };
++ xbar_adx1_out4_ep: endpoint {
++ remote-endpoint = <&adx1_out4_ep>;
+ };
+ };
+- };
+
+- adx@2903a00 {
+- status = "okay";
++ xbar_adx2_in_port: port@45 {
++ reg = <0x45>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ xbar_adx2_in_ep: endpoint {
++ remote-endpoint = <&adx2_in_ep>;
++ };
++ };
+
+- port@0 {
+- reg = <0>;
++ port@46 {
++ reg = <0x46>;
+
+- adx3_in_ep: endpoint {
+- remote-endpoint = <&xbar_adx3_in_ep>;
+- };
++ xbar_adx2_out1_ep: endpoint {
++ remote-endpoint = <&adx2_out1_ep>;
+ };
++ };
+
+- adx3_out1_port: port@1 {
+- reg = <1>;
++ port@47 {
++ reg = <0x47>;
+
+- adx3_out1_ep: endpoint {
+- remote-endpoint = <&xbar_adx3_out1_ep>;
+- };
++ xbar_adx2_out2_ep: endpoint {
++ remote-endpoint = <&adx2_out2_ep>;
+ };
++ };
+
+- adx3_out2_port: port@2 {
+- reg = <2>;
++ port@48 {
++ reg = <0x48>;
+
+- adx3_out2_ep: endpoint {
+- remote-endpoint = <&xbar_adx3_out2_ep>;
+- };
++ xbar_adx2_out3_ep: endpoint {
++ remote-endpoint = <&adx2_out3_ep>;
+ };
++ };
+
+- adx3_out3_port: port@3 {
+- reg = <3>;
++ port@49 {
++ reg = <0x49>;
+
+- adx3_out3_ep: endpoint {
+- remote-endpoint = <&xbar_adx3_out3_ep>;
+- };
++ xbar_adx2_out4_ep: endpoint {
++ remote-endpoint = <&adx2_out4_ep>;
+ };
++ };
+
+- adx3_out4_port: port@4 {
+- reg = <4>;
++ xbar_adx3_in_port: port@4a {
++ reg = <0x4a>;
+
+- adx3_out4_ep: endpoint {
+- remote-endpoint = <&xbar_adx3_out4_ep>;
+- };
++ xbar_adx3_in_ep: endpoint {
++ remote-endpoint = <&adx3_in_ep>;
+ };
+ };
+- };
+
+- adx@2903b00 {
+- status = "okay";
++ port@4b {
++ reg = <0x4b>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ xbar_adx3_out1_ep: endpoint {
++ remote-endpoint = <&adx3_out1_ep>;
++ };
++ };
+
+- port@0 {
+- reg = <0>;
++ port@4c {
++ reg = <0x4c>;
+
+- adx4_in_ep: endpoint {
+- remote-endpoint = <&xbar_adx4_in_ep>;
+- };
++ xbar_adx3_out2_ep: endpoint {
++ remote-endpoint = <&adx3_out2_ep>;
+ };
++ };
+
+- adx4_out1_port: port@1 {
+- reg = <1>;
++ port@4d {
++ reg = <0x4d>;
+
+- adx4_out1_ep: endpoint {
+- remote-endpoint = <&xbar_adx4_out1_ep>;
+- };
++ xbar_adx3_out3_ep: endpoint {
++ remote-endpoint = <&adx3_out3_ep>;
+ };
++ };
+
+- adx4_out2_port: port@2 {
+- reg = <2>;
++ port@4e {
++ reg = <0x4e>;
+
+- adx4_out2_ep: endpoint {
+- remote-endpoint = <&xbar_adx4_out2_ep>;
+- };
++ xbar_adx3_out4_ep: endpoint {
++ remote-endpoint = <&adx3_out4_ep>;
+ };
++ };
+
+- adx4_out3_port: port@3 {
+- reg = <3>;
++ xbar_adx4_in_port: port@4f {
++ reg = <0x4f>;
+
+- adx4_out3_ep: endpoint {
+- remote-endpoint = <&xbar_adx4_out3_ep>;
+- };
++ xbar_adx4_in_ep: endpoint {
++ remote-endpoint = <&adx4_in_ep>;
+ };
++ };
+
+- adx4_out4_port: port@4 {
+- reg = <4>;
++ port@50 {
++ reg = <0x50>;
+
+- adx4_out4_ep: endpoint {
+- remote-endpoint = <&xbar_adx4_out4_ep>;
+- };
++ xbar_adx4_out1_ep: endpoint {
++ remote-endpoint = <&adx4_out1_ep>;
+ };
+ };
+- };
+
+- processing-engine@2908000 {
+- status = "okay";
++ port@51 {
++ reg = <0x51>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ xbar_adx4_out2_ep: endpoint {
++ remote-endpoint = <&adx4_out2_ep>;
++ };
++ };
+
+- port@0 {
+- reg = <0x0>;
++ port@52 {
++ reg = <0x52>;
+
+- ope1_cif_in_ep: endpoint {
+- remote-endpoint = <&xbar_ope1_in_ep>;
+- };
++ xbar_adx4_out3_ep: endpoint {
++ remote-endpoint = <&adx4_out3_ep>;
+ };
++ };
+
+- ope1_out_port: port@1 {
+- reg = <0x1>;
++ port@53 {
++ reg = <0x53>;
+
+- ope1_cif_out_ep: endpoint {
+- remote-endpoint = <&xbar_ope1_out_ep>;
+- };
++ xbar_adx4_out4_ep: endpoint {
++ remote-endpoint = <&adx4_out4_ep>;
+ };
+ };
+- };
+
+- amixer@290bb00 {
+- status = "okay";
++ xbar_mixer_in1_port: port@54 {
++ reg = <0x54>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ xbar_mixer_in1_ep: endpoint {
++ remote-endpoint = <&mixer_in1_ep>;
++ };
++ };
+
+- port@0 {
+- reg = <0x0>;
++ xbar_mixer_in2_port: port@55 {
++ reg = <0x55>;
+
+- mixer_in1_ep: endpoint {
+- remote-endpoint = <&xbar_mixer_in1_ep>;
+- };
++ xbar_mixer_in2_ep: endpoint {
++ remote-endpoint = <&mixer_in2_ep>;
+ };
++ };
+
+- port@1 {
+- reg = <0x1>;
++ xbar_mixer_in3_port: port@56 {
++ reg = <0x56>;
+
+- mixer_in2_ep: endpoint {
+- remote-endpoint = <&xbar_mixer_in2_ep>;
+- };
++ xbar_mixer_in3_ep: endpoint {
++ remote-endpoint = <&mixer_in3_ep>;
+ };
++ };
+
+- port@2 {
+- reg = <0x2>;
++ xbar_mixer_in4_port: port@57 {
++ reg = <0x57>;
+
+- mixer_in3_ep: endpoint {
+- remote-endpoint = <&xbar_mixer_in3_ep>;
+- };
++ xbar_mixer_in4_ep: endpoint {
++ remote-endpoint = <&mixer_in4_ep>;
+ };
++ };
+
+- port@3 {
+- reg = <0x3>;
++ xbar_mixer_in5_port: port@58 {
++ reg = <0x58>;
+
+- mixer_in4_ep: endpoint {
+- remote-endpoint = <&xbar_mixer_in4_ep>;
+- };
++ xbar_mixer_in5_ep: endpoint {
++ remote-endpoint = <&mixer_in5_ep>;
+ };
++ };
+
+- port@4 {
+- reg = <0x4>;
++ xbar_mixer_in6_port: port@59 {
++ reg = <0x59>;
+
+- mixer_in5_ep: endpoint {
+- remote-endpoint = <&xbar_mixer_in5_ep>;
+- };
++ xbar_mixer_in6_ep: endpoint {
++ remote-endpoint = <&mixer_in6_ep>;
+ };
++ };
+
+- port@5 {
+- reg = <0x5>;
++ xbar_mixer_in7_port: port@5a {
++ reg = <0x5a>;
+
+- mixer_in6_ep: endpoint {
+- remote-endpoint = <&xbar_mixer_in6_ep>;
+- };
++ xbar_mixer_in7_ep: endpoint {
++ remote-endpoint = <&mixer_in7_ep>;
+ };
++ };
+
+- port@6 {
+- reg = <0x6>;
++ xbar_mixer_in8_port: port@5b {
++ reg = <0x5b>;
+
+- mixer_in7_ep: endpoint {
+- remote-endpoint = <&xbar_mixer_in7_ep>;
+- };
++ xbar_mixer_in8_ep: endpoint {
++ remote-endpoint = <&mixer_in8_ep>;
+ };
++ };
+
+- port@7 {
+- reg = <0x7>;
++ xbar_mixer_in9_port: port@5c {
++ reg = <0x5c>;
+
+- mixer_in8_ep: endpoint {
+- remote-endpoint = <&xbar_mixer_in8_ep>;
+- };
++ xbar_mixer_in9_ep: endpoint {
++ remote-endpoint = <&mixer_in9_ep>;
+ };
++ };
+
+- port@8 {
+- reg = <0x8>;
++ xbar_mixer_in10_port: port@5d {
++ reg = <0x5d>;
+
+- mixer_in9_ep: endpoint {
+- remote-endpoint = <&xbar_mixer_in9_ep>;
+- };
++ xbar_mixer_in10_ep: endpoint {
++ remote-endpoint = <&mixer_in10_ep>;
+ };
++ };
+
+- port@9 {
+- reg = <0x9>;
++ port@5e {
++ reg = <0x5e>;
+
+- mixer_in10_ep: endpoint {
+- remote-endpoint = <&xbar_mixer_in10_ep>;
+- };
++ xbar_mixer_out1_ep: endpoint {
++ remote-endpoint = <&mixer_out1_ep>;
+ };
++ };
+
+- mixer_out1_port: port@a {
+- reg = <0xa>;
++ port@5f {
++ reg = <0x5f>;
+
+- mixer_out1_ep: endpoint {
+- remote-endpoint = <&xbar_mixer_out1_ep>;
+- };
++ xbar_mixer_out2_ep: endpoint {
++ remote-endpoint = <&mixer_out2_ep>;
+ };
++ };
+
+- mixer_out2_port: port@b {
+- reg = <0xb>;
++ port@60 {
++ reg = <0x60>;
+
+- mixer_out2_ep: endpoint {
+- remote-endpoint = <&xbar_mixer_out2_ep>;
+- };
++ xbar_mixer_out3_ep: endpoint {
++ remote-endpoint = <&mixer_out3_ep>;
+ };
++ };
+
+- mixer_out3_port: port@c {
+- reg = <0xc>;
++ port@61 {
++ reg = <0x61>;
+
+- mixer_out3_ep: endpoint {
+- remote-endpoint = <&xbar_mixer_out3_ep>;
+- };
++ xbar_mixer_out4_ep: endpoint {
++ remote-endpoint = <&mixer_out4_ep>;
+ };
++ };
+
+- mixer_out4_port: port@d {
+- reg = <0xd>;
++ port@62 {
++ reg = <0x62>;
+
+- mixer_out4_ep: endpoint {
+- remote-endpoint = <&xbar_mixer_out4_ep>;
+- };
++ xbar_mixer_out5_ep: endpoint {
++ remote-endpoint = <&mixer_out5_ep>;
+ };
++ };
+
+- mixer_out5_port: port@e {
+- reg = <0xe>;
++ xbar_asrc_in1_port: port@63 {
++ reg = <0x63>;
+
+- mixer_out5_ep: endpoint {
+- remote-endpoint = <&xbar_mixer_out5_ep>;
+- };
++ xbar_asrc_in1_ep: endpoint {
++ remote-endpoint = <&asrc_in1_ep>;
+ };
+ };
+- };
+
+- asrc@2910000 {
+- status = "okay";
++ port@64 {
++ reg = <0x64>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ xbar_asrc_out1_ep: endpoint {
++ remote-endpoint = <&asrc_out1_ep>;
++ };
++ };
+
+- port@0 {
+- reg = <0x0>;
++ xbar_asrc_in2_port: port@65 {
++ reg = <0x65>;
+
+- asrc_in1_ep: endpoint {
+- remote-endpoint = <&xbar_asrc_in1_ep>;
+- };
++ xbar_asrc_in2_ep: endpoint {
++ remote-endpoint = <&asrc_in2_ep>;
+ };
++ };
+
+- port@1 {
+- reg = <0x1>;
++ port@66 {
++ reg = <0x66>;
+
+- asrc_in2_ep: endpoint {
+- remote-endpoint = <&xbar_asrc_in2_ep>;
+- };
++ xbar_asrc_out2_ep: endpoint {
++ remote-endpoint = <&asrc_out2_ep>;
+ };
++ };
+
+- port@2 {
+- reg = <0x2>;
++ xbar_asrc_in3_port: port@67 {
++ reg = <0x67>;
+
+- asrc_in3_ep: endpoint {
+- remote-endpoint = <&xbar_asrc_in3_ep>;
+- };
++ xbar_asrc_in3_ep: endpoint {
++ remote-endpoint = <&asrc_in3_ep>;
+ };
++ };
+
+- port@3 {
+- reg = <0x3>;
++ port@68 {
++ reg = <0x68>;
+
+- asrc_in4_ep: endpoint {
+- remote-endpoint = <&xbar_asrc_in4_ep>;
+- };
++ xbar_asrc_out3_ep: endpoint {
++ remote-endpoint = <&asrc_out3_ep>;
+ };
++ };
+
+- port@4 {
+- reg = <0x4>;
++ xbar_asrc_in4_port: port@69 {
++ reg = <0x69>;
+
+- asrc_in5_ep: endpoint {
+- remote-endpoint = <&xbar_asrc_in5_ep>;
+- };
++ xbar_asrc_in4_ep: endpoint {
++ remote-endpoint = <&asrc_in4_ep>;
+ };
++ };
+
+- port@5 {
+- reg = <0x5>;
++ port@6a {
++ reg = <0x6a>;
+
+- asrc_in6_ep: endpoint {
+- remote-endpoint = <&xbar_asrc_in6_ep>;
+- };
++ xbar_asrc_out4_ep: endpoint {
++ remote-endpoint = <&asrc_out4_ep>;
+ };
++ };
+
+- port@6 {
+- reg = <0x6>;
++ xbar_asrc_in5_port: port@6b {
++ reg = <0x6b>;
+
+- asrc_in7_ep: endpoint {
+- remote-endpoint = <&xbar_asrc_in7_ep>;
+- };
++ xbar_asrc_in5_ep: endpoint {
++ remote-endpoint = <&asrc_in5_ep>;
+ };
++ };
+
+- asrc_out1_port: port@7 {
+- reg = <0x7>;
++ port@6c {
++ reg = <0x6c>;
+
+- asrc_out1_ep: endpoint {
+- remote-endpoint = <&xbar_asrc_out1_ep>;
+- };
++ xbar_asrc_out5_ep: endpoint {
++ remote-endpoint = <&asrc_out5_ep>;
+ };
++ };
+
+- asrc_out2_port: port@8 {
+- reg = <0x8>;
++ xbar_asrc_in6_port: port@6d {
++ reg = <0x6d>;
+
+- asrc_out2_ep: endpoint {
+- remote-endpoint = <&xbar_asrc_out2_ep>;
+- };
++ xbar_asrc_in6_ep: endpoint {
++ remote-endpoint = <&asrc_in6_ep>;
+ };
++ };
+
+- asrc_out3_port: port@9 {
+- reg = <0x9>;
++ port@6e {
++ reg = <0x6e>;
+
+- asrc_out3_ep: endpoint {
+- remote-endpoint = <&xbar_asrc_out3_ep>;
+- };
++ xbar_asrc_out6_ep: endpoint {
++ remote-endpoint = <&asrc_out6_ep>;
+ };
++ };
+
+- asrc_out4_port: port@a {
+- reg = <0xa>;
++ xbar_asrc_in7_port: port@6f {
++ reg = <0x6f>;
+
+- asrc_out4_ep: endpoint {
+- remote-endpoint = <&xbar_asrc_out4_ep>;
+- };
++ xbar_asrc_in7_ep: endpoint {
++ remote-endpoint = <&asrc_in7_ep>;
+ };
++ };
+
+- asrc_out5_port: port@b {
+- reg = <0xb>;
++ xbar_ope1_in_port: port@70 {
++ reg = <0x70>;
+
+- asrc_out5_ep: endpoint {
+- remote-endpoint = <&xbar_asrc_out5_ep>;
+- };
++ xbar_ope1_in_ep: endpoint {
++ remote-endpoint = <&ope1_cif_in_ep>;
+ };
++ };
+
+- asrc_out6_port: port@c {
+- reg = <0xc>;
++ port@71 {
++ reg = <0x71>;
+
+- asrc_out6_ep: endpoint {
+- remote-endpoint = <&xbar_asrc_out6_ep>;
+- };
++ xbar_ope1_out_ep: endpoint {
++ remote-endpoint = <&ope1_cif_out_ep>;
+ };
+ };
+ };
+ };
++
++ dma-controller@2930000 {
++ status = "okay";
++ };
++
++ interrupt-controller@2a40000 {
++ status = "okay";
++ };
+ };
+
+ i2c@3160000 {
+@@ -2247,14 +2247,6 @@ pcie-ep@141a0000 {
+ };
+ };
+
+- fan: pwm-fan {
+- compatible = "pwm-fan";
+- pwms = <&pwm4 0 45334>;
+-
+- cooling-levels = <0 64 128 255>;
+- #cooling-cells = <2>;
+- };
+-
+ gpio-keys {
+ compatible = "gpio-keys";
+
+@@ -2279,6 +2271,14 @@ key-power {
+ };
+ };
+
++ fan: pwm-fan {
++ compatible = "pwm-fan";
++ pwms = <&pwm4 0 45334>;
++
++ cooling-levels = <0 64 128 255>;
++ #cooling-cells = <2>;
++ };
++
+ sound {
+ compatible = "nvidia,tegra186-audio-graph-card";
+ status = "okay";
+diff --git a/arch/arm64/boot/dts/nvidia/tegra194-p3509-0000.dtsi b/arch/arm64/boot/dts/nvidia/tegra194-p3509-0000.dtsi
+index 617fbfaaf02f6..4a17ea5e40fd0 100644
+--- a/arch/arm64/boot/dts/nvidia/tegra194-p3509-0000.dtsi
++++ b/arch/arm64/boot/dts/nvidia/tegra194-p3509-0000.dtsi
+@@ -1,5 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0
+
++#include <dt-bindings/gpio/tegra194-gpio.h>
+ #include <dt-bindings/input/linux-event-codes.h>
+ #include <dt-bindings/input/gpio-keys.h>
+
+@@ -8,890 +9,880 @@ bus@0 {
+ aconnect@2900000 {
+ status = "okay";
+
+- dma-controller@2930000 {
+- status = "okay";
+- };
+-
+- interrupt-controller@2a40000 {
+- status = "okay";
+- };
+-
+ ahub@2900800 {
+ status = "okay";
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
+-
+- port@0 {
+- reg = <0x0>;
+-
+- xbar_admaif0_ep: endpoint {
+- remote-endpoint = <&admaif0_ep>;
+- };
+- };
+-
+- port@1 {
+- reg = <0x1>;
+-
+- xbar_admaif1_ep: endpoint {
+- remote-endpoint = <&admaif1_ep>;
+- };
+- };
+-
+- port@2 {
+- reg = <0x2>;
+-
+- xbar_admaif2_ep: endpoint {
+- remote-endpoint = <&admaif2_ep>;
+- };
+- };
+-
+- port@3 {
+- reg = <0x3>;
++ i2s@2901200 {
++ status = "okay";
+
+- xbar_admaif3_ep: endpoint {
+- remote-endpoint = <&admaif3_ep>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- port@4 {
+- reg = <0x4>;
++ port@0 {
++ reg = <0>;
+
+- xbar_admaif4_ep: endpoint {
+- remote-endpoint = <&admaif4_ep>;
++ i2s3_cif_ep: endpoint {
++ remote-endpoint = <&xbar_i2s3_ep>;
++ };
+ };
+- };
+
+- port@5 {
+- reg = <0x5>;
++ i2s3_port: port@1 {
++ reg = <1>;
+
+- xbar_admaif5_ep: endpoint {
+- remote-endpoint = <&admaif5_ep>;
++ i2s3_dap_ep: endpoint {
++ dai-format = "i2s";
++ /* Place holder for external Codec */
++ };
+ };
+ };
++ };
+
+- port@6 {
+- reg = <0x6>;
++ i2s@2901400 {
++ status = "okay";
+
+- xbar_admaif6_ep: endpoint {
+- remote-endpoint = <&admaif6_ep>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- port@7 {
+- reg = <0x7>;
++ port@0 {
++ reg = <0>;
+
+- xbar_admaif7_ep: endpoint {
+- remote-endpoint = <&admaif7_ep>;
++ i2s5_cif_ep: endpoint {
++ remote-endpoint = <&xbar_i2s5_ep>;
++ };
+ };
+- };
+
+- port@8 {
+- reg = <0x8>;
++ i2s5_port: port@1 {
++ reg = <1>;
+
+- xbar_admaif8_ep: endpoint {
+- remote-endpoint = <&admaif8_ep>;
++ i2s5_dap_ep: endpoint {
++ dai-format = "i2s";
++ /* Place holder for external Codec */
++ };
+ };
+ };
++ };
+
+- port@9 {
+- reg = <0x9>;
++ sfc@2902000 {
++ status = "okay";
+
+- xbar_admaif9_ep: endpoint {
+- remote-endpoint = <&admaif9_ep>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- port@a {
+- reg = <0xa>;
++ port@0 {
++ reg = <0>;
+
+- xbar_admaif10_ep: endpoint {
+- remote-endpoint = <&admaif10_ep>;
++ sfc1_cif_in_ep: endpoint {
++ remote-endpoint = <&xbar_sfc1_in_ep>;
++ convert-rate = <44100>;
++ };
+ };
+- };
+
+- port@b {
+- reg = <0xb>;
++ sfc1_out_port: port@1 {
++ reg = <1>;
+
+- xbar_admaif11_ep: endpoint {
+- remote-endpoint = <&admaif11_ep>;
++ sfc1_cif_out_ep: endpoint {
++ remote-endpoint = <&xbar_sfc1_out_ep>;
++ convert-rate = <48000>;
++ };
+ };
+ };
++ };
+
+- port@c {
+- reg = <0xc>;
++ sfc@2902200 {
++ status = "okay";
+
+- xbar_admaif12_ep: endpoint {
+- remote-endpoint = <&admaif12_ep>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- port@d {
+- reg = <0xd>;
++ port@0 {
++ reg = <0>;
+
+- xbar_admaif13_ep: endpoint {
+- remote-endpoint = <&admaif13_ep>;
++ sfc2_cif_in_ep: endpoint {
++ remote-endpoint = <&xbar_sfc2_in_ep>;
++ };
+ };
+- };
+
+- port@e {
+- reg = <0xe>;
++ sfc2_out_port: port@1 {
++ reg = <1>;
+
+- xbar_admaif14_ep: endpoint {
+- remote-endpoint = <&admaif14_ep>;
++ sfc2_cif_out_ep: endpoint {
++ remote-endpoint = <&xbar_sfc2_out_ep>;
++ };
+ };
+ };
++ };
+
+- port@f {
+- reg = <0xf>;
++ sfc@2902400 {
++ status = "okay";
+
+- xbar_admaif15_ep: endpoint {
+- remote-endpoint = <&admaif15_ep>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- port@10 {
+- reg = <0x10>;
++ port@0 {
++ reg = <0>;
+
+- xbar_admaif16_ep: endpoint {
+- remote-endpoint = <&admaif16_ep>;
++ sfc3_cif_in_ep: endpoint {
++ remote-endpoint = <&xbar_sfc3_in_ep>;
++ };
+ };
+- };
+
+- port@11 {
+- reg = <0x11>;
++ sfc3_out_port: port@1 {
++ reg = <1>;
+
+- xbar_admaif17_ep: endpoint {
+- remote-endpoint = <&admaif17_ep>;
++ sfc3_cif_out_ep: endpoint {
++ remote-endpoint = <&xbar_sfc3_out_ep>;
++ };
+ };
+ };
++ };
+
+- port@12 {
+- reg = <0x12>;
++ sfc@2902600 {
++ status = "okay";
+
+- xbar_admaif18_ep: endpoint {
+- remote-endpoint = <&admaif18_ep>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- port@13 {
+- reg = <0x13>;
++ port@0 {
++ reg = <0>;
+
+- xbar_admaif19_ep: endpoint {
+- remote-endpoint = <&admaif19_ep>;
++ sfc4_cif_in_ep: endpoint {
++ remote-endpoint = <&xbar_sfc4_in_ep>;
++ };
+ };
+- };
+
+- xbar_i2s3_port: port@16 {
+- reg = <0x16>;
++ sfc4_out_port: port@1 {
++ reg = <1>;
+
+- xbar_i2s3_ep: endpoint {
+- remote-endpoint = <&i2s3_cif_ep>;
++ sfc4_cif_out_ep: endpoint {
++ remote-endpoint = <&xbar_sfc4_out_ep>;
++ };
+ };
+ };
++ };
+
+- xbar_i2s5_port: port@18 {
+- reg = <0x18>;
++ amx@2903000 {
++ status = "okay";
+
+- xbar_i2s5_ep: endpoint {
+- remote-endpoint = <&i2s5_cif_ep>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- xbar_dmic1_port: port@1a {
+- reg = <0x1a>;
++ port@0 {
++ reg = <0>;
+
+- xbar_dmic1_ep: endpoint {
+- remote-endpoint = <&dmic1_cif_ep>;
++ amx1_in1_ep: endpoint {
++ remote-endpoint = <&xbar_amx1_in1_ep>;
++ };
+ };
+- };
+
+- xbar_dmic2_port: port@1b {
+- reg = <0x1b>;
++ port@1 {
++ reg = <1>;
+
+- xbar_dmic2_ep: endpoint {
+- remote-endpoint = <&dmic2_cif_ep>;
++ amx1_in2_ep: endpoint {
++ remote-endpoint = <&xbar_amx1_in2_ep>;
++ };
+ };
+- };
+
+- xbar_dmic4_port: port@1d {
+- reg = <0x1d>;
++ port@2 {
++ reg = <2>;
+
+- xbar_dmic4_ep: endpoint {
+- remote-endpoint = <&dmic4_cif_ep>;
++ amx1_in3_ep: endpoint {
++ remote-endpoint = <&xbar_amx1_in3_ep>;
++ };
+ };
+- };
+
+- xbar_dspk1_port: port@1e {
+- reg = <0x1e>;
++ port@3 {
++ reg = <3>;
+
+- xbar_dspk1_ep: endpoint {
+- remote-endpoint = <&dspk1_cif_ep>;
++ amx1_in4_ep: endpoint {
++ remote-endpoint = <&xbar_amx1_in4_ep>;
++ };
+ };
+- };
+
+- xbar_dspk2_port: port@1f {
+- reg = <0x1f>;
++ amx1_out_port: port@4 {
++ reg = <4>;
+
+- xbar_dspk2_ep: endpoint {
+- remote-endpoint = <&dspk2_cif_ep>;
++ amx1_out_ep: endpoint {
++ remote-endpoint = <&xbar_amx1_out_ep>;
++ };
+ };
+ };
++ };
+
+- xbar_sfc1_in_port: port@20 {
+- reg = <0x20>;
++ amx@2903100 {
++ status = "okay";
+
+- xbar_sfc1_in_ep: endpoint {
+- remote-endpoint = <&sfc1_cif_in_ep>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- port@21 {
+- reg = <0x21>;
++ port@0 {
++ reg = <0>;
+
+- xbar_sfc1_out_ep: endpoint {
+- remote-endpoint = <&sfc1_cif_out_ep>;
++ amx2_in1_ep: endpoint {
++ remote-endpoint = <&xbar_amx2_in1_ep>;
++ };
+ };
+- };
+
+- xbar_sfc2_in_port: port@22 {
+- reg = <0x22>;
++ port@1 {
++ reg = <1>;
+
+- xbar_sfc2_in_ep: endpoint {
+- remote-endpoint = <&sfc2_cif_in_ep>;
++ amx2_in2_ep: endpoint {
++ remote-endpoint = <&xbar_amx2_in2_ep>;
++ };
+ };
+- };
+
+- port@23 {
+- reg = <0x23>;
++ amx2_in3_port: port@2 {
++ reg = <2>;
+
+- xbar_sfc2_out_ep: endpoint {
+- remote-endpoint = <&sfc2_cif_out_ep>;
++ amx2_in3_ep: endpoint {
++ remote-endpoint = <&xbar_amx2_in3_ep>;
++ };
+ };
+- };
+
+- xbar_sfc3_in_port: port@24 {
+- reg = <0x24>;
++ amx2_in4_port: port@3 {
++ reg = <3>;
+
+- xbar_sfc3_in_ep: endpoint {
+- remote-endpoint = <&sfc3_cif_in_ep>;
++ amx2_in4_ep: endpoint {
++ remote-endpoint = <&xbar_amx2_in4_ep>;
++ };
+ };
+- };
+
+- port@25 {
+- reg = <0x25>;
++ amx2_out_port: port@4 {
++ reg = <4>;
+
+- xbar_sfc3_out_ep: endpoint {
+- remote-endpoint = <&sfc3_cif_out_ep>;
++ amx2_out_ep: endpoint {
++ remote-endpoint = <&xbar_amx2_out_ep>;
++ };
+ };
+ };
++ };
+
+- xbar_sfc4_in_port: port@26 {
+- reg = <0x26>;
++ amx@2903200 {
++ status = "okay";
+
+- xbar_sfc4_in_ep: endpoint {
+- remote-endpoint = <&sfc4_cif_in_ep>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- port@27 {
+- reg = <0x27>;
++ port@0 {
++ reg = <0>;
+
+- xbar_sfc4_out_ep: endpoint {
+- remote-endpoint = <&sfc4_cif_out_ep>;
++ amx3_in1_ep: endpoint {
++ remote-endpoint = <&xbar_amx3_in1_ep>;
++ };
+ };
+- };
+
+- xbar_mvc1_in_port: port@28 {
+- reg = <0x28>;
++ port@1 {
++ reg = <1>;
+
+- xbar_mvc1_in_ep: endpoint {
+- remote-endpoint = <&mvc1_cif_in_ep>;
++ amx3_in2_ep: endpoint {
++ remote-endpoint = <&xbar_amx3_in2_ep>;
++ };
+ };
+- };
+-
+- port@29 {
+- reg = <0x29>;
+
+- xbar_mvc1_out_ep: endpoint {
+- remote-endpoint = <&mvc1_cif_out_ep>;
++ port@2 {
++ reg = <2>;
++
++ amx3_in3_ep: endpoint {
++ remote-endpoint = <&xbar_amx3_in3_ep>;
++ };
+ };
+- };
+
+- xbar_mvc2_in_port: port@2a {
+- reg = <0x2a>;
++ port@3 {
++ reg = <3>;
+
+- xbar_mvc2_in_ep: endpoint {
+- remote-endpoint = <&mvc2_cif_in_ep>;
++ amx3_in4_ep: endpoint {
++ remote-endpoint = <&xbar_amx3_in4_ep>;
++ };
+ };
+- };
+
+- port@2b {
+- reg = <0x2b>;
++ amx3_out_port: port@4 {
++ reg = <4>;
+
+- xbar_mvc2_out_ep: endpoint {
+- remote-endpoint = <&mvc2_cif_out_ep>;
++ amx3_out_ep: endpoint {
++ remote-endpoint = <&xbar_amx3_out_ep>;
++ };
+ };
+ };
++ };
+
+- xbar_amx1_in1_port: port@2c {
+- reg = <0x2c>;
++ amx@2903300 {
++ status = "okay";
+
+- xbar_amx1_in1_ep: endpoint {
+- remote-endpoint = <&amx1_in1_ep>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- xbar_amx1_in2_port: port@2d {
+- reg = <0x2d>;
++ port@0 {
++ reg = <0>;
+
+- xbar_amx1_in2_ep: endpoint {
+- remote-endpoint = <&amx1_in2_ep>;
++ amx4_in1_ep: endpoint {
++ remote-endpoint = <&xbar_amx4_in1_ep>;
++ };
+ };
+- };
+
+- xbar_amx1_in3_port: port@2e {
+- reg = <0x2e>;
++ port@1 {
++ reg = <1>;
+
+- xbar_amx1_in3_ep: endpoint {
+- remote-endpoint = <&amx1_in3_ep>;
++ amx4_in2_ep: endpoint {
++ remote-endpoint = <&xbar_amx4_in2_ep>;
++ };
+ };
+- };
+
+- xbar_amx1_in4_port: port@2f {
+- reg = <0x2f>;
++ port@2 {
++ reg = <2>;
+
+- xbar_amx1_in4_ep: endpoint {
+- remote-endpoint = <&amx1_in4_ep>;
++ amx4_in3_ep: endpoint {
++ remote-endpoint = <&xbar_amx4_in3_ep>;
++ };
+ };
+- };
+
+- port@30 {
+- reg = <0x30>;
++ port@3 {
++ reg = <3>;
+
+- xbar_amx1_out_ep: endpoint {
+- remote-endpoint = <&amx1_out_ep>;
++ amx4_in4_ep: endpoint {
++ remote-endpoint = <&xbar_amx4_in4_ep>;
++ };
+ };
+- };
+
+- xbar_amx2_in1_port: port@31 {
+- reg = <0x31>;
++ amx4_out_port: port@4 {
++ reg = <4>;
+
+- xbar_amx2_in1_ep: endpoint {
+- remote-endpoint = <&amx2_in1_ep>;
++ amx4_out_ep: endpoint {
++ remote-endpoint = <&xbar_amx4_out_ep>;
++ };
+ };
+ };
++ };
+
+- xbar_amx2_in2_port: port@32 {
+- reg = <0x32>;
++ adx@2903800 {
++ status = "okay";
+
+- xbar_amx2_in2_ep: endpoint {
+- remote-endpoint = <&amx2_in2_ep>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- xbar_amx2_in3_port: port@33 {
+- reg = <0x33>;
++ port@0 {
++ reg = <0>;
+
+- xbar_amx2_in3_ep: endpoint {
+- remote-endpoint = <&amx2_in3_ep>;
++ adx1_in_ep: endpoint {
++ remote-endpoint = <&xbar_adx1_in_ep>;
++ };
+ };
+- };
+
+- xbar_amx2_in4_port: port@34 {
+- reg = <0x34>;
++ adx1_out1_port: port@1 {
++ reg = <1>;
+
+- xbar_amx2_in4_ep: endpoint {
+- remote-endpoint = <&amx2_in4_ep>;
++ adx1_out1_ep: endpoint {
++ remote-endpoint = <&xbar_adx1_out1_ep>;
++ };
+ };
+- };
+
+- port@35 {
+- reg = <0x35>;
++ adx1_out2_port: port@2 {
++ reg = <2>;
+
+- xbar_amx2_out_ep: endpoint {
+- remote-endpoint = <&amx2_out_ep>;
++ adx1_out2_ep: endpoint {
++ remote-endpoint = <&xbar_adx1_out2_ep>;
++ };
+ };
+- };
+
+- xbar_amx3_in1_port: port@36 {
+- reg = <0x36>;
++ adx1_out3_port: port@3 {
++ reg = <3>;
+
+- xbar_amx3_in1_ep: endpoint {
+- remote-endpoint = <&amx3_in1_ep>;
++ adx1_out3_ep: endpoint {
++ remote-endpoint = <&xbar_adx1_out3_ep>;
++ };
+ };
+- };
+
+- xbar_amx3_in2_port: port@37 {
+- reg = <0x37>;
++ adx1_out4_port: port@4 {
++ reg = <4>;
+
+- xbar_amx3_in2_ep: endpoint {
+- remote-endpoint = <&amx3_in2_ep>;
++ adx1_out4_ep: endpoint {
++ remote-endpoint = <&xbar_adx1_out4_ep>;
++ };
+ };
+ };
++ };
+
+- xbar_amx3_in3_port: port@38 {
+- reg = <0x38>;
++ adx@2903900 {
++ status = "okay";
+
+- xbar_amx3_in3_ep: endpoint {
+- remote-endpoint = <&amx3_in3_ep>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- xbar_amx3_in4_port: port@39 {
+- reg = <0x39>;
++ port@0 {
++ reg = <0>;
+
+- xbar_amx3_in4_ep: endpoint {
+- remote-endpoint = <&amx3_in4_ep>;
++ adx2_in_ep: endpoint {
++ remote-endpoint = <&xbar_adx2_in_ep>;
++ };
+ };
+- };
+
+- port@3a {
+- reg = <0x3a>;
++ adx2_out1_port: port@1 {
++ reg = <1>;
+
+- xbar_amx3_out_ep: endpoint {
+- remote-endpoint = <&amx3_out_ep>;
++ adx2_out1_ep: endpoint {
++ remote-endpoint = <&xbar_adx2_out1_ep>;
++ };
+ };
+- };
+
+- xbar_amx4_in1_port: port@3b {
+- reg = <0x3b>;
++ adx2_out2_port: port@2 {
++ reg = <2>;
+
+- xbar_amx4_in1_ep: endpoint {
+- remote-endpoint = <&amx4_in1_ep>;
++ adx2_out2_ep: endpoint {
++ remote-endpoint = <&xbar_adx2_out2_ep>;
++ };
+ };
+- };
+
+- xbar_amx4_in2_port: port@3c {
+- reg = <0x3c>;
++ adx2_out3_port: port@3 {
++ reg = <3>;
+
+- xbar_amx4_in2_ep: endpoint {
+- remote-endpoint = <&amx4_in2_ep>;
++ adx2_out3_ep: endpoint {
++ remote-endpoint = <&xbar_adx2_out3_ep>;
++ };
+ };
+- };
+
+- xbar_amx4_in3_port: port@3d {
+- reg = <0x3d>;
++ adx2_out4_port: port@4 {
++ reg = <4>;
+
+- xbar_amx4_in3_ep: endpoint {
+- remote-endpoint = <&amx4_in3_ep>;
++ adx2_out4_ep: endpoint {
++ remote-endpoint = <&xbar_adx2_out4_ep>;
++ };
+ };
+ };
++ };
+
+- xbar_amx4_in4_port: port@3e {
+- reg = <0x3e>;
++ adx@2903a00 {
++ status = "okay";
+
+- xbar_amx4_in4_ep: endpoint {
+- remote-endpoint = <&amx4_in4_ep>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- port@3f {
+- reg = <0x3f>;
++ port@0 {
++ reg = <0>;
+
+- xbar_amx4_out_ep: endpoint {
+- remote-endpoint = <&amx4_out_ep>;
++ adx3_in_ep: endpoint {
++ remote-endpoint = <&xbar_adx3_in_ep>;
++ };
+ };
+- };
+
+- xbar_adx1_in_port: port@40 {
+- reg = <0x40>;
++ adx3_out1_port: port@1 {
++ reg = <1>;
+
+- xbar_adx1_in_ep: endpoint {
+- remote-endpoint = <&adx1_in_ep>;
++ adx3_out1_ep: endpoint {
++ remote-endpoint = <&xbar_adx3_out1_ep>;
++ };
+ };
+- };
+
+- port@41 {
+- reg = <0x41>;
++ adx3_out2_port: port@2 {
++ reg = <2>;
+
+- xbar_adx1_out1_ep: endpoint {
+- remote-endpoint = <&adx1_out1_ep>;
++ adx3_out2_ep: endpoint {
++ remote-endpoint = <&xbar_adx3_out2_ep>;
++ };
+ };
+- };
+
+- port@42 {
+- reg = <0x42>;
++ adx3_out3_port: port@3 {
++ reg = <3>;
+
+- xbar_adx1_out2_ep: endpoint {
+- remote-endpoint = <&adx1_out2_ep>;
++ adx3_out3_ep: endpoint {
++ remote-endpoint = <&xbar_adx3_out3_ep>;
++ };
+ };
+- };
+
+- port@43 {
+- reg = <0x43>;
++ adx3_out4_port: port@4 {
++ reg = <4>;
+
+- xbar_adx1_out3_ep: endpoint {
+- remote-endpoint = <&adx1_out3_ep>;
++ adx3_out4_ep: endpoint {
++ remote-endpoint = <&xbar_adx3_out4_ep>;
++ };
+ };
+ };
++ };
+
+- port@44 {
+- reg = <0x44>;
++ adx@2903b00 {
++ status = "okay";
+
+- xbar_adx1_out4_ep: endpoint {
+- remote-endpoint = <&adx1_out4_ep>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- xbar_adx2_in_port: port@45 {
+- reg = <0x45>;
++ port@0 {
++ reg = <0>;
+
+- xbar_adx2_in_ep: endpoint {
+- remote-endpoint = <&adx2_in_ep>;
++ adx4_in_ep: endpoint {
++ remote-endpoint = <&xbar_adx4_in_ep>;
++ };
+ };
+- };
+
+- port@46 {
+- reg = <0x46>;
++ adx4_out1_port: port@1 {
++ reg = <1>;
+
+- xbar_adx2_out1_ep: endpoint {
+- remote-endpoint = <&adx2_out1_ep>;
++ adx4_out1_ep: endpoint {
++ remote-endpoint = <&xbar_adx4_out1_ep>;
++ };
+ };
+- };
+
+- port@47 {
+- reg = <0x47>;
++ adx4_out2_port: port@2 {
++ reg = <2>;
+
+- xbar_adx2_out2_ep: endpoint {
+- remote-endpoint = <&adx2_out2_ep>;
++ adx4_out2_ep: endpoint {
++ remote-endpoint = <&xbar_adx4_out2_ep>;
++ };
+ };
+- };
+
+- port@48 {
+- reg = <0x48>;
++ adx4_out3_port: port@3 {
++ reg = <3>;
+
+- xbar_adx2_out3_ep: endpoint {
+- remote-endpoint = <&adx2_out3_ep>;
++ adx4_out3_ep: endpoint {
++ remote-endpoint = <&xbar_adx4_out3_ep>;
++ };
+ };
+- };
+
+- port@49 {
+- reg = <0x49>;
++ adx4_out4_port: port@4 {
++ reg = <4>;
+
+- xbar_adx2_out4_ep: endpoint {
+- remote-endpoint = <&adx2_out4_ep>;
++ adx4_out4_ep: endpoint {
++ remote-endpoint = <&xbar_adx4_out4_ep>;
++ };
+ };
+ };
++ };
+
+- xbar_adx3_in_port: port@4a {
+- reg = <0x4a>;
++ dmic@2904000 {
++ status = "okay";
+
+- xbar_adx3_in_ep: endpoint {
+- remote-endpoint = <&adx3_in_ep>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- port@4b {
+- reg = <0x4b>;
++ port@0 {
++ reg = <0>;
+
+- xbar_adx3_out1_ep: endpoint {
+- remote-endpoint = <&adx3_out1_ep>;
++ dmic1_cif_ep: endpoint {
++ remote-endpoint = <&xbar_dmic1_ep>;
++ };
+ };
+- };
+
+- port@4c {
+- reg = <0x4c>;
++ dmic1_port: port@1 {
++ reg = <1>;
+
+- xbar_adx3_out2_ep: endpoint {
+- remote-endpoint = <&adx3_out2_ep>;
++ dmic1_dap_ep: endpoint {
++ /* Place holder for external Codec */
++ };
+ };
+ };
++ };
+
+- port@4d {
+- reg = <0x4d>;
++ dmic@2904100 {
++ status = "okay";
+
+- xbar_adx3_out3_ep: endpoint {
+- remote-endpoint = <&adx3_out3_ep>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- port@4e {
+- reg = <0x4e>;
++ port@0 {
++ reg = <0>;
+
+- xbar_adx3_out4_ep: endpoint {
+- remote-endpoint = <&adx3_out4_ep>;
++ dmic2_cif_ep: endpoint {
++ remote-endpoint = <&xbar_dmic2_ep>;
++ };
+ };
+- };
+
+- xbar_adx4_in_port: port@4f {
+- reg = <0x4f>;
++ dmic2_port: port@1 {
++ reg = <1>;
+
+- xbar_adx4_in_ep: endpoint {
+- remote-endpoint = <&adx4_in_ep>;
++ dmic2_dap_ep: endpoint {
++ /* Place holder for external Codec */
++ };
+ };
+ };
++ };
+
+- port@50 {
+- reg = <0x50>;
++ dmic@2904300 {
++ status = "okay";
+
+- xbar_adx4_out1_ep: endpoint {
+- remote-endpoint = <&adx4_out1_ep>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- port@51 {
+- reg = <0x51>;
++ port@0 {
++ reg = <0>;
+
+- xbar_adx4_out2_ep: endpoint {
+- remote-endpoint = <&adx4_out2_ep>;
++ dmic4_cif_ep: endpoint {
++ remote-endpoint = <&xbar_dmic4_ep>;
++ };
+ };
+- };
+
+- port@52 {
+- reg = <0x52>;
++ dmic4_port: port@1 {
++ reg = <1>;
+
+- xbar_adx4_out3_ep: endpoint {
+- remote-endpoint = <&adx4_out3_ep>;
++ dmic4_dap_ep: endpoint {
++ /* Place holder for external Codec */
++ };
+ };
+ };
++ };
+
+- port@53 {
+- reg = <0x53>;
++ dspk@2905000 {
++ status = "okay";
+
+- xbar_adx4_out4_ep: endpoint {
+- remote-endpoint = <&adx4_out4_ep>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- xbar_mixer_in1_port: port@54 {
+- reg = <0x54>;
++ port@0 {
++ reg = <0>;
+
+- xbar_mixer_in1_ep: endpoint {
+- remote-endpoint = <&mixer_in1_ep>;
++ dspk1_cif_ep: endpoint {
++ remote-endpoint = <&xbar_dspk1_ep>;
++ };
+ };
+- };
+
+- xbar_mixer_in2_port: port@55 {
+- reg = <0x55>;
++ dspk1_port: port@1 {
++ reg = <1>;
+
+- xbar_mixer_in2_ep: endpoint {
+- remote-endpoint = <&mixer_in2_ep>;
++ dspk1_dap_ep: endpoint {
++ /* Place holder for external Codec */
++ };
+ };
+ };
++ };
+
+- xbar_mixer_in3_port: port@56 {
+- reg = <0x56>;
++ dspk@2905100 {
++ status = "okay";
+
+- xbar_mixer_in3_ep: endpoint {
+- remote-endpoint = <&mixer_in3_ep>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- xbar_mixer_in4_port: port@57 {
+- reg = <0x57>;
++ port@0 {
++ reg = <0>;
+
+- xbar_mixer_in4_ep: endpoint {
+- remote-endpoint = <&mixer_in4_ep>;
++ dspk2_cif_ep: endpoint {
++ remote-endpoint = <&xbar_dspk2_ep>;
++ };
+ };
+- };
+
+- xbar_mixer_in5_port: port@58 {
+- reg = <0x58>;
++ dspk2_port: port@1 {
++ reg = <1>;
+
+- xbar_mixer_in5_ep: endpoint {
+- remote-endpoint = <&mixer_in5_ep>;
++ dspk2_dap_ep: endpoint {
++ /* Place holder for external Codec */
++ };
+ };
+ };
++ };
+
+- xbar_mixer_in6_port: port@59 {
+- reg = <0x59>;
++ processing-engine@2908000 {
++ status = "okay";
+
+- xbar_mixer_in6_ep: endpoint {
+- remote-endpoint = <&mixer_in6_ep>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- xbar_mixer_in7_port: port@5a {
+- reg = <0x5a>;
++ port@0 {
++ reg = <0x0>;
+
+- xbar_mixer_in7_ep: endpoint {
+- remote-endpoint = <&mixer_in7_ep>;
++ ope1_cif_in_ep: endpoint {
++ remote-endpoint = <&xbar_ope1_in_ep>;
++ };
+ };
+- };
+
+- xbar_mixer_in8_port: port@5b {
+- reg = <0x5b>;
++ ope1_out_port: port@1 {
++ reg = <0x1>;
+
+- xbar_mixer_in8_ep: endpoint {
+- remote-endpoint = <&mixer_in8_ep>;
++ ope1_cif_out_ep: endpoint {
++ remote-endpoint = <&xbar_ope1_out_ep>;
++ };
+ };
+ };
++ };
+
+- xbar_mixer_in9_port: port@5c {
+- reg = <0x5c>;
++ mvc@290a000 {
++ status = "okay";
+
+- xbar_mixer_in9_ep: endpoint {
+- remote-endpoint = <&mixer_in9_ep>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- xbar_mixer_in10_port: port@5d {
+- reg = <0x5d>;
++ port@0 {
++ reg = <0>;
+
+- xbar_mixer_in10_ep: endpoint {
+- remote-endpoint = <&mixer_in10_ep>;
++ mvc1_cif_in_ep: endpoint {
++ remote-endpoint = <&xbar_mvc1_in_ep>;
++ };
+ };
+- };
+
+- port@5e {
+- reg = <0x5e>;
++ mvc1_out_port: port@1 {
++ reg = <1>;
+
+- xbar_mixer_out1_ep: endpoint {
+- remote-endpoint = <&mixer_out1_ep>;
++ mvc1_cif_out_ep: endpoint {
++ remote-endpoint = <&xbar_mvc1_out_ep>;
++ };
+ };
+ };
++ };
+
+- port@5f {
+- reg = <0x5f>;
++ mvc@290a200 {
++ status = "okay";
+
+- xbar_mixer_out2_ep: endpoint {
+- remote-endpoint = <&mixer_out2_ep>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- port@60 {
+- reg = <0x60>;
++ port@0 {
++ reg = <0>;
+
+- xbar_mixer_out3_ep: endpoint {
+- remote-endpoint = <&mixer_out3_ep>;
++ mvc2_cif_in_ep: endpoint {
++ remote-endpoint = <&xbar_mvc2_in_ep>;
++ };
+ };
+- };
+
+- port@61 {
+- reg = <0x61>;
++ mvc2_out_port: port@1 {
++ reg = <1>;
+
+- xbar_mixer_out4_ep: endpoint {
+- remote-endpoint = <&mixer_out4_ep>;
++ mvc2_cif_out_ep: endpoint {
++ remote-endpoint = <&xbar_mvc2_out_ep>;
++ };
+ };
+ };
++ };
+
+- port@62 {
+- reg = <0x62>;
++ amixer@290bb00 {
++ status = "okay";
+
+- xbar_mixer_out5_ep: endpoint {
+- remote-endpoint = <&mixer_out5_ep>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- xbar_asrc_in1_port: port@63 {
+- reg = <0x63>;
++ port@0 {
++ reg = <0x0>;
+
+- xbar_asrc_in1_ep: endpoint {
+- remote-endpoint = <&asrc_in1_ep>;
++ mixer_in1_ep: endpoint {
++ remote-endpoint = <&xbar_mixer_in1_ep>;
++ };
+ };
+- };
+
+- port@64 {
+- reg = <0x64>;
++ port@1 {
++ reg = <0x1>;
+
+- xbar_asrc_out1_ep: endpoint {
+- remote-endpoint = <&asrc_out1_ep>;
++ mixer_in2_ep: endpoint {
++ remote-endpoint = <&xbar_mixer_in2_ep>;
++ };
+ };
+- };
+
+- xbar_asrc_in2_port: port@65 {
+- reg = <0x65>;
++ port@2 {
++ reg = <0x2>;
+
+- xbar_asrc_in2_ep: endpoint {
+- remote-endpoint = <&asrc_in2_ep>;
++ mixer_in3_ep: endpoint {
++ remote-endpoint = <&xbar_mixer_in3_ep>;
++ };
+ };
+- };
+
+- port@66 {
+- reg = <0x66>;
++ port@3 {
++ reg = <0x3>;
+
+- xbar_asrc_out2_ep: endpoint {
+- remote-endpoint = <&asrc_out2_ep>;
++ mixer_in4_ep: endpoint {
++ remote-endpoint = <&xbar_mixer_in4_ep>;
++ };
+ };
+- };
+
+- xbar_asrc_in3_port: port@67 {
+- reg = <0x67>;
++ port@4 {
++ reg = <0x4>;
+
+- xbar_asrc_in3_ep: endpoint {
+- remote-endpoint = <&asrc_in3_ep>;
++ mixer_in5_ep: endpoint {
++ remote-endpoint = <&xbar_mixer_in5_ep>;
++ };
+ };
+- };
+
+- port@68 {
+- reg = <0x68>;
++ port@5 {
++ reg = <0x5>;
+
+- xbar_asrc_out3_ep: endpoint {
+- remote-endpoint = <&asrc_out3_ep>;
++ mixer_in6_ep: endpoint {
++ remote-endpoint = <&xbar_mixer_in6_ep>;
++ };
+ };
+- };
+
+- xbar_asrc_in4_port: port@69 {
+- reg = <0x69>;
++ port@6 {
++ reg = <0x6>;
+
+- xbar_asrc_in4_ep: endpoint {
+- remote-endpoint = <&asrc_in4_ep>;
++ mixer_in7_ep: endpoint {
++ remote-endpoint = <&xbar_mixer_in7_ep>;
++ };
+ };
+- };
+
+- port@6a {
+- reg = <0x6a>;
++ port@7 {
++ reg = <0x7>;
+
+- xbar_asrc_out4_ep: endpoint {
+- remote-endpoint = <&asrc_out4_ep>;
++ mixer_in8_ep: endpoint {
++ remote-endpoint = <&xbar_mixer_in8_ep>;
++ };
+ };
+- };
+
+- xbar_asrc_in5_port: port@6b {
+- reg = <0x6b>;
++ port@8 {
++ reg = <0x8>;
+
+- xbar_asrc_in5_ep: endpoint {
+- remote-endpoint = <&asrc_in5_ep>;
++ mixer_in9_ep: endpoint {
++ remote-endpoint = <&xbar_mixer_in9_ep>;
++ };
+ };
+- };
+
+- port@6c {
+- reg = <0x6c>;
++ port@9 {
++ reg = <0x9>;
+
+- xbar_asrc_out5_ep: endpoint {
+- remote-endpoint = <&asrc_out5_ep>;
++ mixer_in10_ep: endpoint {
++ remote-endpoint = <&xbar_mixer_in10_ep>;
++ };
+ };
+- };
+
+- xbar_asrc_in6_port: port@6d {
+- reg = <0x6d>;
++ mixer_out1_port: port@a {
++ reg = <0xa>;
+
+- xbar_asrc_in6_ep: endpoint {
+- remote-endpoint = <&asrc_in6_ep>;
++ mixer_out1_ep: endpoint {
++ remote-endpoint = <&xbar_mixer_out1_ep>;
++ };
+ };
+- };
+
+- port@6e {
+- reg = <0x6e>;
++ mixer_out2_port: port@b {
++ reg = <0xb>;
+
+- xbar_asrc_out6_ep: endpoint {
+- remote-endpoint = <&asrc_out6_ep>;
++ mixer_out2_ep: endpoint {
++ remote-endpoint = <&xbar_mixer_out2_ep>;
++ };
+ };
+- };
+
+- xbar_asrc_in7_port: port@6f {
+- reg = <0x6f>;
++ mixer_out3_port: port@c {
++ reg = <0xc>;
+
+- xbar_asrc_in7_ep: endpoint {
+- remote-endpoint = <&asrc_in7_ep>;
++ mixer_out3_ep: endpoint {
++ remote-endpoint = <&xbar_mixer_out3_ep>;
++ };
+ };
+- };
+
+- xbar_ope1_in_port: port@70 {
+- reg = <0x70>;
++ mixer_out4_port: port@d {
++ reg = <0xd>;
+
+- xbar_ope1_in_ep: endpoint {
+- remote-endpoint = <&ope1_cif_in_ep>;
++ mixer_out4_ep: endpoint {
++ remote-endpoint = <&xbar_mixer_out4_ep>;
++ };
+ };
+- };
+
+- port@71 {
+- reg = <0x71>;
++ mixer_out5_port: port@e {
++ reg = <0xe>;
+
+- xbar_ope1_out_ep: endpoint {
+- remote-endpoint = <&ope1_cif_out_ep>;
++ mixer_out5_ep: endpoint {
++ remote-endpoint = <&xbar_mixer_out5_ep>;
++ };
+ };
+ };
+ };
+@@ -1065,7 +1056,7 @@ admaif19_ep: endpoint {
+ };
+ };
+
+- i2s@2901200 {
++ asrc@2910000 {
+ status = "okay";
+
+ ports {
+@@ -1073,990 +1064,996 @@ ports {
+ #size-cells = <0>;
+
+ port@0 {
+- reg = <0>;
++ reg = <0x0>;
+
+- i2s3_cif_ep: endpoint {
+- remote-endpoint = <&xbar_i2s3_ep>;
++ asrc_in1_ep: endpoint {
++ remote-endpoint = <&xbar_asrc_in1_ep>;
+ };
+ };
+
+- i2s3_port: port@1 {
+- reg = <1>;
++ port@1 {
++ reg = <0x1>;
+
+- i2s3_dap_ep: endpoint {
+- dai-format = "i2s";
+- /* Place holder for external Codec */
++ asrc_in2_ep: endpoint {
++ remote-endpoint = <&xbar_asrc_in2_ep>;
++ };
++ };
++
++ port@2 {
++ reg = <0x2>;
++
++ asrc_in3_ep: endpoint {
++ remote-endpoint = <&xbar_asrc_in3_ep>;
++ };
++ };
++
++ port@3 {
++ reg = <0x3>;
++
++ asrc_in4_ep: endpoint {
++ remote-endpoint = <&xbar_asrc_in4_ep>;
+ };
+ };
+- };
+- };
+
+- i2s@2901400 {
+- status = "okay";
++ port@4 {
++ reg = <0x4>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ asrc_in5_ep: endpoint {
++ remote-endpoint = <&xbar_asrc_in5_ep>;
++ };
++ };
+
+- port@0 {
+- reg = <0>;
++ port@5 {
++ reg = <0x5>;
+
+- i2s5_cif_ep: endpoint {
+- remote-endpoint = <&xbar_i2s5_ep>;
++ asrc_in6_ep: endpoint {
++ remote-endpoint = <&xbar_asrc_in6_ep>;
+ };
+ };
+
+- i2s5_port: port@1 {
+- reg = <1>;
++ port@6 {
++ reg = <0x6>;
+
+- i2s5_dap_ep: endpoint {
+- dai-format = "i2s";
+- /* Place holder for external Codec */
++ asrc_in7_ep: endpoint {
++ remote-endpoint = <&xbar_asrc_in7_ep>;
+ };
+ };
+- };
+- };
+
+- dmic@2904000 {
+- status = "okay";
++ asrc_out1_port: port@7 {
++ reg = <0x7>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ asrc_out1_ep: endpoint {
++ remote-endpoint = <&xbar_asrc_out1_ep>;
++ };
++ };
+
+- port@0 {
+- reg = <0>;
++ asrc_out2_port: port@8 {
++ reg = <0x8>;
+
+- dmic1_cif_ep: endpoint {
+- remote-endpoint = <&xbar_dmic1_ep>;
++ asrc_out2_ep: endpoint {
++ remote-endpoint = <&xbar_asrc_out2_ep>;
+ };
+ };
+
+- dmic1_port: port@1 {
+- reg = <1>;
++ asrc_out3_port: port@9 {
++ reg = <0x9>;
+
+- dmic1_dap_ep: endpoint {
+- /* Place holder for external Codec */
++ asrc_out3_ep: endpoint {
++ remote-endpoint = <&xbar_asrc_out3_ep>;
+ };
+ };
+- };
+- };
+
+- dmic@2904100 {
+- status = "okay";
++ asrc_out4_port: port@a {
++ reg = <0xa>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ asrc_out4_ep: endpoint {
++ remote-endpoint = <&xbar_asrc_out4_ep>;
++ };
++ };
+
+- port@0 {
+- reg = <0>;
++ asrc_out5_port: port@b {
++ reg = <0xb>;
+
+- dmic2_cif_ep: endpoint {
+- remote-endpoint = <&xbar_dmic2_ep>;
++ asrc_out5_ep: endpoint {
++ remote-endpoint = <&xbar_asrc_out5_ep>;
+ };
+ };
+
+- dmic2_port: port@1 {
+- reg = <1>;
++ asrc_out6_port: port@c {
++ reg = <0xc>;
+
+- dmic2_dap_ep: endpoint {
+- /* Place holder for external Codec */
++ asrc_out6_ep: endpoint {
++ remote-endpoint = <&xbar_asrc_out6_ep>;
+ };
+ };
+ };
+ };
+
+- dmic@2904300 {
+- status = "okay";
+-
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- port@0 {
+- reg = <0>;
++ port@0 {
++ reg = <0x0>;
+
+- dmic4_cif_ep: endpoint {
+- remote-endpoint = <&xbar_dmic4_ep>;
+- };
++ xbar_admaif0_ep: endpoint {
++ remote-endpoint = <&admaif0_ep>;
+ };
++ };
+
+- dmic4_port: port@1 {
+- reg = <1>;
++ port@1 {
++ reg = <0x1>;
+
+- dmic4_dap_ep: endpoint {
+- /* Place holder for external Codec */
+- };
++ xbar_admaif1_ep: endpoint {
++ remote-endpoint = <&admaif1_ep>;
+ };
+ };
+- };
+
+- dspk@2905000 {
+- status = "okay";
++ port@2 {
++ reg = <0x2>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ xbar_admaif2_ep: endpoint {
++ remote-endpoint = <&admaif2_ep>;
++ };
++ };
+
+- port@0 {
+- reg = <0>;
++ port@3 {
++ reg = <0x3>;
+
+- dspk1_cif_ep: endpoint {
+- remote-endpoint = <&xbar_dspk1_ep>;
+- };
++ xbar_admaif3_ep: endpoint {
++ remote-endpoint = <&admaif3_ep>;
+ };
++ };
+
+- dspk1_port: port@1 {
+- reg = <1>;
++ port@4 {
++ reg = <0x4>;
+
+- dspk1_dap_ep: endpoint {
+- /* Place holder for external Codec */
+- };
++ xbar_admaif4_ep: endpoint {
++ remote-endpoint = <&admaif4_ep>;
+ };
+ };
+- };
+
+- dspk@2905100 {
+- status = "okay";
++ port@5 {
++ reg = <0x5>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ xbar_admaif5_ep: endpoint {
++ remote-endpoint = <&admaif5_ep>;
++ };
++ };
+
+- port@0 {
+- reg = <0>;
++ port@6 {
++ reg = <0x6>;
+
+- dspk2_cif_ep: endpoint {
+- remote-endpoint = <&xbar_dspk2_ep>;
+- };
++ xbar_admaif6_ep: endpoint {
++ remote-endpoint = <&admaif6_ep>;
+ };
++ };
+
+- dspk2_port: port@1 {
+- reg = <1>;
++ port@7 {
++ reg = <0x7>;
+
+- dspk2_dap_ep: endpoint {
+- /* Place holder for external Codec */
+- };
++ xbar_admaif7_ep: endpoint {
++ remote-endpoint = <&admaif7_ep>;
+ };
+ };
+- };
+
+- sfc@2902000 {
+- status = "okay";
++ port@8 {
++ reg = <0x8>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ xbar_admaif8_ep: endpoint {
++ remote-endpoint = <&admaif8_ep>;
++ };
++ };
+
+- port@0 {
+- reg = <0>;
++ port@9 {
++ reg = <0x9>;
+
+- sfc1_cif_in_ep: endpoint {
+- remote-endpoint = <&xbar_sfc1_in_ep>;
+- convert-rate = <44100>;
+- };
++ xbar_admaif9_ep: endpoint {
++ remote-endpoint = <&admaif9_ep>;
+ };
++ };
+
+- sfc1_out_port: port@1 {
+- reg = <1>;
++ port@a {
++ reg = <0xa>;
+
+- sfc1_cif_out_ep: endpoint {
+- remote-endpoint = <&xbar_sfc1_out_ep>;
+- convert-rate = <48000>;
+- };
++ xbar_admaif10_ep: endpoint {
++ remote-endpoint = <&admaif10_ep>;
+ };
+ };
+- };
+
+- sfc@2902200 {
+- status = "okay";
++ port@b {
++ reg = <0xb>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ xbar_admaif11_ep: endpoint {
++ remote-endpoint = <&admaif11_ep>;
++ };
++ };
+
+- port@0 {
+- reg = <0>;
++ port@c {
++ reg = <0xc>;
+
+- sfc2_cif_in_ep: endpoint {
+- remote-endpoint = <&xbar_sfc2_in_ep>;
+- };
++ xbar_admaif12_ep: endpoint {
++ remote-endpoint = <&admaif12_ep>;
+ };
++ };
+
+- sfc2_out_port: port@1 {
+- reg = <1>;
++ port@d {
++ reg = <0xd>;
+
+- sfc2_cif_out_ep: endpoint {
+- remote-endpoint = <&xbar_sfc2_out_ep>;
+- };
++ xbar_admaif13_ep: endpoint {
++ remote-endpoint = <&admaif13_ep>;
+ };
+ };
+- };
+
+- sfc@2902400 {
+- status = "okay";
++ port@e {
++ reg = <0xe>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ xbar_admaif14_ep: endpoint {
++ remote-endpoint = <&admaif14_ep>;
++ };
++ };
+
+- port@0 {
+- reg = <0>;
++ port@f {
++ reg = <0xf>;
+
+- sfc3_cif_in_ep: endpoint {
+- remote-endpoint = <&xbar_sfc3_in_ep>;
+- };
++ xbar_admaif15_ep: endpoint {
++ remote-endpoint = <&admaif15_ep>;
+ };
++ };
+
+- sfc3_out_port: port@1 {
+- reg = <1>;
++ port@10 {
++ reg = <0x10>;
+
+- sfc3_cif_out_ep: endpoint {
+- remote-endpoint = <&xbar_sfc3_out_ep>;
+- };
++ xbar_admaif16_ep: endpoint {
++ remote-endpoint = <&admaif16_ep>;
+ };
+ };
+- };
+
+- sfc@2902600 {
+- status = "okay";
++ port@11 {
++ reg = <0x11>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ xbar_admaif17_ep: endpoint {
++ remote-endpoint = <&admaif17_ep>;
++ };
++ };
+
+- port@0 {
+- reg = <0>;
++ port@12 {
++ reg = <0x12>;
+
+- sfc4_cif_in_ep: endpoint {
+- remote-endpoint = <&xbar_sfc4_in_ep>;
+- };
++ xbar_admaif18_ep: endpoint {
++ remote-endpoint = <&admaif18_ep>;
+ };
++ };
+
+- sfc4_out_port: port@1 {
+- reg = <1>;
++ port@13 {
++ reg = <0x13>;
+
+- sfc4_cif_out_ep: endpoint {
+- remote-endpoint = <&xbar_sfc4_out_ep>;
+- };
++ xbar_admaif19_ep: endpoint {
++ remote-endpoint = <&admaif19_ep>;
+ };
+ };
+- };
+
+- mvc@290a000 {
+- status = "okay";
++ xbar_i2s3_port: port@16 {
++ reg = <0x16>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ xbar_i2s3_ep: endpoint {
++ remote-endpoint = <&i2s3_cif_ep>;
++ };
++ };
+
+- port@0 {
+- reg = <0>;
++ xbar_i2s5_port: port@18 {
++ reg = <0x18>;
+
+- mvc1_cif_in_ep: endpoint {
+- remote-endpoint = <&xbar_mvc1_in_ep>;
+- };
++ xbar_i2s5_ep: endpoint {
++ remote-endpoint = <&i2s5_cif_ep>;
+ };
++ };
+
+- mvc1_out_port: port@1 {
+- reg = <1>;
++ xbar_dmic1_port: port@1a {
++ reg = <0x1a>;
+
+- mvc1_cif_out_ep: endpoint {
+- remote-endpoint = <&xbar_mvc1_out_ep>;
+- };
++ xbar_dmic1_ep: endpoint {
++ remote-endpoint = <&dmic1_cif_ep>;
+ };
+ };
+- };
+
+- mvc@290a200 {
+- status = "okay";
++ xbar_dmic2_port: port@1b {
++ reg = <0x1b>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ xbar_dmic2_ep: endpoint {
++ remote-endpoint = <&dmic2_cif_ep>;
++ };
++ };
+
+- port@0 {
+- reg = <0>;
++ xbar_dmic4_port: port@1d {
++ reg = <0x1d>;
+
+- mvc2_cif_in_ep: endpoint {
+- remote-endpoint = <&xbar_mvc2_in_ep>;
+- };
++ xbar_dmic4_ep: endpoint {
++ remote-endpoint = <&dmic4_cif_ep>;
+ };
++ };
+
+- mvc2_out_port: port@1 {
+- reg = <1>;
++ xbar_dspk1_port: port@1e {
++ reg = <0x1e>;
+
+- mvc2_cif_out_ep: endpoint {
+- remote-endpoint = <&xbar_mvc2_out_ep>;
+- };
++ xbar_dspk1_ep: endpoint {
++ remote-endpoint = <&dspk1_cif_ep>;
+ };
+ };
+- };
+
+- amx@2903000 {
+- status = "okay";
++ xbar_dspk2_port: port@1f {
++ reg = <0x1f>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ xbar_dspk2_ep: endpoint {
++ remote-endpoint = <&dspk2_cif_ep>;
++ };
++ };
+
+- port@0 {
+- reg = <0>;
++ xbar_sfc1_in_port: port@20 {
++ reg = <0x20>;
+
+- amx1_in1_ep: endpoint {
+- remote-endpoint = <&xbar_amx1_in1_ep>;
+- };
++ xbar_sfc1_in_ep: endpoint {
++ remote-endpoint = <&sfc1_cif_in_ep>;
+ };
++ };
+
+- port@1 {
+- reg = <1>;
++ port@21 {
++ reg = <0x21>;
+
+- amx1_in2_ep: endpoint {
+- remote-endpoint = <&xbar_amx1_in2_ep>;
+- };
++ xbar_sfc1_out_ep: endpoint {
++ remote-endpoint = <&sfc1_cif_out_ep>;
+ };
++ };
+
+- port@2 {
+- reg = <2>;
++ xbar_sfc2_in_port: port@22 {
++ reg = <0x22>;
+
+- amx1_in3_ep: endpoint {
+- remote-endpoint = <&xbar_amx1_in3_ep>;
+- };
++ xbar_sfc2_in_ep: endpoint {
++ remote-endpoint = <&sfc2_cif_in_ep>;
+ };
++ };
+
+- port@3 {
+- reg = <3>;
++ port@23 {
++ reg = <0x23>;
+
+- amx1_in4_ep: endpoint {
+- remote-endpoint = <&xbar_amx1_in4_ep>;
+- };
++ xbar_sfc2_out_ep: endpoint {
++ remote-endpoint = <&sfc2_cif_out_ep>;
+ };
++ };
+
+- amx1_out_port: port@4 {
+- reg = <4>;
++ xbar_sfc3_in_port: port@24 {
++ reg = <0x24>;
+
+- amx1_out_ep: endpoint {
+- remote-endpoint = <&xbar_amx1_out_ep>;
+- };
++ xbar_sfc3_in_ep: endpoint {
++ remote-endpoint = <&sfc3_cif_in_ep>;
+ };
+ };
+- };
+
+- amx@2903100 {
+- status = "okay";
++ port@25 {
++ reg = <0x25>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ xbar_sfc3_out_ep: endpoint {
++ remote-endpoint = <&sfc3_cif_out_ep>;
++ };
++ };
+
+- port@0 {
+- reg = <0>;
++ xbar_sfc4_in_port: port@26 {
++ reg = <0x26>;
+
+- amx2_in1_ep: endpoint {
+- remote-endpoint = <&xbar_amx2_in1_ep>;
+- };
++ xbar_sfc4_in_ep: endpoint {
++ remote-endpoint = <&sfc4_cif_in_ep>;
+ };
++ };
+
+- port@1 {
+- reg = <1>;
++ port@27 {
++ reg = <0x27>;
+
+- amx2_in2_ep: endpoint {
+- remote-endpoint = <&xbar_amx2_in2_ep>;
+- };
++ xbar_sfc4_out_ep: endpoint {
++ remote-endpoint = <&sfc4_cif_out_ep>;
+ };
++ };
+
+- amx2_in3_port: port@2 {
+- reg = <2>;
++ xbar_mvc1_in_port: port@28 {
++ reg = <0x28>;
+
+- amx2_in3_ep: endpoint {
+- remote-endpoint = <&xbar_amx2_in3_ep>;
+- };
++ xbar_mvc1_in_ep: endpoint {
++ remote-endpoint = <&mvc1_cif_in_ep>;
+ };
++ };
+
+- amx2_in4_port: port@3 {
+- reg = <3>;
++ port@29 {
++ reg = <0x29>;
+
+- amx2_in4_ep: endpoint {
+- remote-endpoint = <&xbar_amx2_in4_ep>;
+- };
++ xbar_mvc1_out_ep: endpoint {
++ remote-endpoint = <&mvc1_cif_out_ep>;
+ };
++ };
+
+- amx2_out_port: port@4 {
+- reg = <4>;
++ xbar_mvc2_in_port: port@2a {
++ reg = <0x2a>;
+
+- amx2_out_ep: endpoint {
+- remote-endpoint = <&xbar_amx2_out_ep>;
+- };
++ xbar_mvc2_in_ep: endpoint {
++ remote-endpoint = <&mvc2_cif_in_ep>;
+ };
+ };
+- };
+
+- amx@2903200 {
+- status = "okay";
++ port@2b {
++ reg = <0x2b>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ xbar_mvc2_out_ep: endpoint {
++ remote-endpoint = <&mvc2_cif_out_ep>;
++ };
++ };
+
+- port@0 {
+- reg = <0>;
++ xbar_amx1_in1_port: port@2c {
++ reg = <0x2c>;
++
++ xbar_amx1_in1_ep: endpoint {
++ remote-endpoint = <&amx1_in1_ep>;
++ };
++ };
+
+- amx3_in1_ep: endpoint {
+- remote-endpoint = <&xbar_amx3_in1_ep>;
+- };
++ xbar_amx1_in2_port: port@2d {
++ reg = <0x2d>;
++
++ xbar_amx1_in2_ep: endpoint {
++ remote-endpoint = <&amx1_in2_ep>;
+ };
++ };
+
+- port@1 {
+- reg = <1>;
++ xbar_amx1_in3_port: port@2e {
++ reg = <0x2e>;
+
+- amx3_in2_ep: endpoint {
+- remote-endpoint = <&xbar_amx3_in2_ep>;
+- };
++ xbar_amx1_in3_ep: endpoint {
++ remote-endpoint = <&amx1_in3_ep>;
+ };
++ };
+
+- port@2 {
+- reg = <2>;
++ xbar_amx1_in4_port: port@2f {
++ reg = <0x2f>;
+
+- amx3_in3_ep: endpoint {
+- remote-endpoint = <&xbar_amx3_in3_ep>;
+- };
++ xbar_amx1_in4_ep: endpoint {
++ remote-endpoint = <&amx1_in4_ep>;
+ };
++ };
+
+- port@3 {
+- reg = <3>;
++ port@30 {
++ reg = <0x30>;
+
+- amx3_in4_ep: endpoint {
+- remote-endpoint = <&xbar_amx3_in4_ep>;
+- };
++ xbar_amx1_out_ep: endpoint {
++ remote-endpoint = <&amx1_out_ep>;
+ };
++ };
+
+- amx3_out_port: port@4 {
+- reg = <4>;
++ xbar_amx2_in1_port: port@31 {
++ reg = <0x31>;
+
+- amx3_out_ep: endpoint {
+- remote-endpoint = <&xbar_amx3_out_ep>;
+- };
++ xbar_amx2_in1_ep: endpoint {
++ remote-endpoint = <&amx2_in1_ep>;
+ };
+ };
+- };
+
+- amx@2903300 {
+- status = "okay";
++ xbar_amx2_in2_port: port@32 {
++ reg = <0x32>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ xbar_amx2_in2_ep: endpoint {
++ remote-endpoint = <&amx2_in2_ep>;
++ };
++ };
+
+- port@0 {
+- reg = <0>;
++ xbar_amx2_in3_port: port@33 {
++ reg = <0x33>;
+
+- amx4_in1_ep: endpoint {
+- remote-endpoint = <&xbar_amx4_in1_ep>;
+- };
++ xbar_amx2_in3_ep: endpoint {
++ remote-endpoint = <&amx2_in3_ep>;
+ };
++ };
+
+- port@1 {
+- reg = <1>;
++ xbar_amx2_in4_port: port@34 {
++ reg = <0x34>;
+
+- amx4_in2_ep: endpoint {
+- remote-endpoint = <&xbar_amx4_in2_ep>;
+- };
++ xbar_amx2_in4_ep: endpoint {
++ remote-endpoint = <&amx2_in4_ep>;
+ };
++ };
+
+- port@2 {
+- reg = <2>;
++ port@35 {
++ reg = <0x35>;
+
+- amx4_in3_ep: endpoint {
+- remote-endpoint = <&xbar_amx4_in3_ep>;
+- };
++ xbar_amx2_out_ep: endpoint {
++ remote-endpoint = <&amx2_out_ep>;
+ };
++ };
+
+- port@3 {
+- reg = <3>;
++ xbar_amx3_in1_port: port@36 {
++ reg = <0x36>;
+
+- amx4_in4_ep: endpoint {
+- remote-endpoint = <&xbar_amx4_in4_ep>;
+- };
++ xbar_amx3_in1_ep: endpoint {
++ remote-endpoint = <&amx3_in1_ep>;
+ };
++ };
+
+- amx4_out_port: port@4 {
+- reg = <4>;
++ xbar_amx3_in2_port: port@37 {
++ reg = <0x37>;
+
+- amx4_out_ep: endpoint {
+- remote-endpoint = <&xbar_amx4_out_ep>;
+- };
++ xbar_amx3_in2_ep: endpoint {
++ remote-endpoint = <&amx3_in2_ep>;
+ };
+ };
+- };
+
+- adx@2903800 {
+- status = "okay";
++ xbar_amx3_in3_port: port@38 {
++ reg = <0x38>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ xbar_amx3_in3_ep: endpoint {
++ remote-endpoint = <&amx3_in3_ep>;
++ };
++ };
+
+- port@0 {
+- reg = <0>;
++ xbar_amx3_in4_port: port@39 {
++ reg = <0x39>;
+
+- adx1_in_ep: endpoint {
+- remote-endpoint = <&xbar_adx1_in_ep>;
+- };
++ xbar_amx3_in4_ep: endpoint {
++ remote-endpoint = <&amx3_in4_ep>;
+ };
++ };
+
+- adx1_out1_port: port@1 {
+- reg = <1>;
++ port@3a {
++ reg = <0x3a>;
+
+- adx1_out1_ep: endpoint {
+- remote-endpoint = <&xbar_adx1_out1_ep>;
+- };
++ xbar_amx3_out_ep: endpoint {
++ remote-endpoint = <&amx3_out_ep>;
+ };
++ };
+
+- adx1_out2_port: port@2 {
+- reg = <2>;
++ xbar_amx4_in1_port: port@3b {
++ reg = <0x3b>;
+
+- adx1_out2_ep: endpoint {
+- remote-endpoint = <&xbar_adx1_out2_ep>;
+- };
++ xbar_amx4_in1_ep: endpoint {
++ remote-endpoint = <&amx4_in1_ep>;
+ };
++ };
+
+- adx1_out3_port: port@3 {
+- reg = <3>;
++ xbar_amx4_in2_port: port@3c {
++ reg = <0x3c>;
+
+- adx1_out3_ep: endpoint {
+- remote-endpoint = <&xbar_adx1_out3_ep>;
+- };
++ xbar_amx4_in2_ep: endpoint {
++ remote-endpoint = <&amx4_in2_ep>;
+ };
++ };
+
+- adx1_out4_port: port@4 {
+- reg = <4>;
++ xbar_amx4_in3_port: port@3d {
++ reg = <0x3d>;
+
+- adx1_out4_ep: endpoint {
+- remote-endpoint = <&xbar_adx1_out4_ep>;
+- };
++ xbar_amx4_in3_ep: endpoint {
++ remote-endpoint = <&amx4_in3_ep>;
+ };
+ };
+- };
+
+- adx@2903900 {
+- status = "okay";
++ xbar_amx4_in4_port: port@3e {
++ reg = <0x3e>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ xbar_amx4_in4_ep: endpoint {
++ remote-endpoint = <&amx4_in4_ep>;
++ };
++ };
+
+- port@0 {
+- reg = <0>;
++ port@3f {
++ reg = <0x3f>;
+
+- adx2_in_ep: endpoint {
+- remote-endpoint = <&xbar_adx2_in_ep>;
+- };
++ xbar_amx4_out_ep: endpoint {
++ remote-endpoint = <&amx4_out_ep>;
+ };
++ };
+
+- adx2_out1_port: port@1 {
+- reg = <1>;
++ xbar_adx1_in_port: port@40 {
++ reg = <0x40>;
+
+- adx2_out1_ep: endpoint {
+- remote-endpoint = <&xbar_adx2_out1_ep>;
+- };
++ xbar_adx1_in_ep: endpoint {
++ remote-endpoint = <&adx1_in_ep>;
+ };
++ };
+
+- adx2_out2_port: port@2 {
+- reg = <2>;
++ port@41 {
++ reg = <0x41>;
+
+- adx2_out2_ep: endpoint {
+- remote-endpoint = <&xbar_adx2_out2_ep>;
+- };
++ xbar_adx1_out1_ep: endpoint {
++ remote-endpoint = <&adx1_out1_ep>;
+ };
++ };
+
+- adx2_out3_port: port@3 {
+- reg = <3>;
++ port@42 {
++ reg = <0x42>;
+
+- adx2_out3_ep: endpoint {
+- remote-endpoint = <&xbar_adx2_out3_ep>;
+- };
++ xbar_adx1_out2_ep: endpoint {
++ remote-endpoint = <&adx1_out2_ep>;
+ };
++ };
+
+- adx2_out4_port: port@4 {
+- reg = <4>;
++ port@43 {
++ reg = <0x43>;
+
+- adx2_out4_ep: endpoint {
+- remote-endpoint = <&xbar_adx2_out4_ep>;
+- };
++ xbar_adx1_out3_ep: endpoint {
++ remote-endpoint = <&adx1_out3_ep>;
+ };
+ };
+- };
+
+- adx@2903a00 {
+- status = "okay";
++ port@44 {
++ reg = <0x44>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ xbar_adx1_out4_ep: endpoint {
++ remote-endpoint = <&adx1_out4_ep>;
++ };
++ };
+
+- port@0 {
+- reg = <0>;
++ xbar_adx2_in_port: port@45 {
++ reg = <0x45>;
+
+- adx3_in_ep: endpoint {
+- remote-endpoint = <&xbar_adx3_in_ep>;
+- };
++ xbar_adx2_in_ep: endpoint {
++ remote-endpoint = <&adx2_in_ep>;
++ };
++ };
++
++ port@46 {
++ reg = <0x46>;
++
++ xbar_adx2_out1_ep: endpoint {
++ remote-endpoint = <&adx2_out1_ep>;
+ };
++ };
+
+- adx3_out1_port: port@1 {
+- reg = <1>;
++ port@47 {
++ reg = <0x47>;
+
+- adx3_out1_ep: endpoint {
+- remote-endpoint = <&xbar_adx3_out1_ep>;
+- };
++ xbar_adx2_out2_ep: endpoint {
++ remote-endpoint = <&adx2_out2_ep>;
+ };
++ };
+
+- adx3_out2_port: port@2 {
+- reg = <2>;
++ port@48 {
++ reg = <0x48>;
+
+- adx3_out2_ep: endpoint {
+- remote-endpoint = <&xbar_adx3_out2_ep>;
+- };
++ xbar_adx2_out3_ep: endpoint {
++ remote-endpoint = <&adx2_out3_ep>;
+ };
++ };
+
+- adx3_out3_port: port@3 {
+- reg = <3>;
++ port@49 {
++ reg = <0x49>;
+
+- adx3_out3_ep: endpoint {
+- remote-endpoint = <&xbar_adx3_out3_ep>;
+- };
++ xbar_adx2_out4_ep: endpoint {
++ remote-endpoint = <&adx2_out4_ep>;
+ };
++ };
+
+- adx3_out4_port: port@4 {
+- reg = <4>;
++ xbar_adx3_in_port: port@4a {
++ reg = <0x4a>;
+
+- adx3_out4_ep: endpoint {
+- remote-endpoint = <&xbar_adx3_out4_ep>;
+- };
++ xbar_adx3_in_ep: endpoint {
++ remote-endpoint = <&adx3_in_ep>;
+ };
+ };
+- };
+
+- adx@2903b00 {
+- status = "okay";
++ port@4b {
++ reg = <0x4b>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ xbar_adx3_out1_ep: endpoint {
++ remote-endpoint = <&adx3_out1_ep>;
++ };
++ };
+
+- port@0 {
+- reg = <0>;
++ port@4c {
++ reg = <0x4c>;
+
+- adx4_in_ep: endpoint {
+- remote-endpoint = <&xbar_adx4_in_ep>;
+- };
++ xbar_adx3_out2_ep: endpoint {
++ remote-endpoint = <&adx3_out2_ep>;
+ };
++ };
+
+- adx4_out1_port: port@1 {
+- reg = <1>;
++ port@4d {
++ reg = <0x4d>;
+
+- adx4_out1_ep: endpoint {
+- remote-endpoint = <&xbar_adx4_out1_ep>;
+- };
++ xbar_adx3_out3_ep: endpoint {
++ remote-endpoint = <&adx3_out3_ep>;
+ };
++ };
+
+- adx4_out2_port: port@2 {
+- reg = <2>;
++ port@4e {
++ reg = <0x4e>;
+
+- adx4_out2_ep: endpoint {
+- remote-endpoint = <&xbar_adx4_out2_ep>;
+- };
++ xbar_adx3_out4_ep: endpoint {
++ remote-endpoint = <&adx3_out4_ep>;
+ };
++ };
+
+- adx4_out3_port: port@3 {
+- reg = <3>;
++ xbar_adx4_in_port: port@4f {
++ reg = <0x4f>;
+
+- adx4_out3_ep: endpoint {
+- remote-endpoint = <&xbar_adx4_out3_ep>;
+- };
++ xbar_adx4_in_ep: endpoint {
++ remote-endpoint = <&adx4_in_ep>;
+ };
++ };
+
+- adx4_out4_port: port@4 {
+- reg = <4>;
++ port@50 {
++ reg = <0x50>;
+
+- adx4_out4_ep: endpoint {
+- remote-endpoint = <&xbar_adx4_out4_ep>;
+- };
++ xbar_adx4_out1_ep: endpoint {
++ remote-endpoint = <&adx4_out1_ep>;
+ };
+ };
+- };
+
+- processing-engine@2908000 {
+- status = "okay";
++ port@51 {
++ reg = <0x51>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ xbar_adx4_out2_ep: endpoint {
++ remote-endpoint = <&adx4_out2_ep>;
++ };
++ };
+
+- port@0 {
+- reg = <0x0>;
++ port@52 {
++ reg = <0x52>;
+
+- ope1_cif_in_ep: endpoint {
+- remote-endpoint = <&xbar_ope1_in_ep>;
+- };
++ xbar_adx4_out3_ep: endpoint {
++ remote-endpoint = <&adx4_out3_ep>;
+ };
++ };
+
+- ope1_out_port: port@1 {
+- reg = <0x1>;
++ port@53 {
++ reg = <0x53>;
+
+- ope1_cif_out_ep: endpoint {
+- remote-endpoint = <&xbar_ope1_out_ep>;
+- };
++ xbar_adx4_out4_ep: endpoint {
++ remote-endpoint = <&adx4_out4_ep>;
+ };
+ };
+- };
+
+- amixer@290bb00 {
+- status = "okay";
++ xbar_mixer_in1_port: port@54 {
++ reg = <0x54>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ xbar_mixer_in1_ep: endpoint {
++ remote-endpoint = <&mixer_in1_ep>;
++ };
++ };
+
+- port@0 {
+- reg = <0x0>;
++ xbar_mixer_in2_port: port@55 {
++ reg = <0x55>;
+
+- mixer_in1_ep: endpoint {
+- remote-endpoint = <&xbar_mixer_in1_ep>;
+- };
++ xbar_mixer_in2_ep: endpoint {
++ remote-endpoint = <&mixer_in2_ep>;
+ };
++ };
+
+- port@1 {
+- reg = <0x1>;
++ xbar_mixer_in3_port: port@56 {
++ reg = <0x56>;
+
+- mixer_in2_ep: endpoint {
+- remote-endpoint = <&xbar_mixer_in2_ep>;
+- };
++ xbar_mixer_in3_ep: endpoint {
++ remote-endpoint = <&mixer_in3_ep>;
+ };
++ };
+
+- port@2 {
+- reg = <0x2>;
++ xbar_mixer_in4_port: port@57 {
++ reg = <0x57>;
+
+- mixer_in3_ep: endpoint {
+- remote-endpoint = <&xbar_mixer_in3_ep>;
+- };
++ xbar_mixer_in4_ep: endpoint {
++ remote-endpoint = <&mixer_in4_ep>;
+ };
++ };
+
+- port@3 {
+- reg = <0x3>;
++ xbar_mixer_in5_port: port@58 {
++ reg = <0x58>;
+
+- mixer_in4_ep: endpoint {
+- remote-endpoint = <&xbar_mixer_in4_ep>;
+- };
++ xbar_mixer_in5_ep: endpoint {
++ remote-endpoint = <&mixer_in5_ep>;
+ };
++ };
+
+- port@4 {
+- reg = <0x4>;
++ xbar_mixer_in6_port: port@59 {
++ reg = <0x59>;
+
+- mixer_in5_ep: endpoint {
+- remote-endpoint = <&xbar_mixer_in5_ep>;
+- };
++ xbar_mixer_in6_ep: endpoint {
++ remote-endpoint = <&mixer_in6_ep>;
+ };
++ };
+
+- port@5 {
+- reg = <0x5>;
++ xbar_mixer_in7_port: port@5a {
++ reg = <0x5a>;
+
+- mixer_in6_ep: endpoint {
+- remote-endpoint = <&xbar_mixer_in6_ep>;
+- };
++ xbar_mixer_in7_ep: endpoint {
++ remote-endpoint = <&mixer_in7_ep>;
+ };
++ };
+
+- port@6 {
+- reg = <0x6>;
++ xbar_mixer_in8_port: port@5b {
++ reg = <0x5b>;
+
+- mixer_in7_ep: endpoint {
+- remote-endpoint = <&xbar_mixer_in7_ep>;
+- };
++ xbar_mixer_in8_ep: endpoint {
++ remote-endpoint = <&mixer_in8_ep>;
+ };
++ };
+
+- port@7 {
+- reg = <0x7>;
++ xbar_mixer_in9_port: port@5c {
++ reg = <0x5c>;
+
+- mixer_in8_ep: endpoint {
+- remote-endpoint = <&xbar_mixer_in8_ep>;
+- };
++ xbar_mixer_in9_ep: endpoint {
++ remote-endpoint = <&mixer_in9_ep>;
+ };
++ };
+
+- port@8 {
+- reg = <0x8>;
++ xbar_mixer_in10_port: port@5d {
++ reg = <0x5d>;
+
+- mixer_in9_ep: endpoint {
+- remote-endpoint = <&xbar_mixer_in9_ep>;
+- };
++ xbar_mixer_in10_ep: endpoint {
++ remote-endpoint = <&mixer_in10_ep>;
+ };
++ };
+
+- port@9 {
+- reg = <0x9>;
++ port@5e {
++ reg = <0x5e>;
+
+- mixer_in10_ep: endpoint {
+- remote-endpoint = <&xbar_mixer_in10_ep>;
+- };
++ xbar_mixer_out1_ep: endpoint {
++ remote-endpoint = <&mixer_out1_ep>;
+ };
++ };
+
+- mixer_out1_port: port@a {
+- reg = <0xa>;
+-
+- mixer_out1_ep: endpoint {
+- remote-endpoint = <&xbar_mixer_out1_ep>;
+- };
++ port@5f {
++ reg = <0x5f>;
++
++ xbar_mixer_out2_ep: endpoint {
++ remote-endpoint = <&mixer_out2_ep>;
+ };
++ };
+
+- mixer_out2_port: port@b {
+- reg = <0xb>;
++ port@60 {
++ reg = <0x60>;
+
+- mixer_out2_ep: endpoint {
+- remote-endpoint = <&xbar_mixer_out2_ep>;
+- };
++ xbar_mixer_out3_ep: endpoint {
++ remote-endpoint = <&mixer_out3_ep>;
+ };
++ };
+
+- mixer_out3_port: port@c {
+- reg = <0xc>;
++ port@61 {
++ reg = <0x61>;
+
+- mixer_out3_ep: endpoint {
+- remote-endpoint = <&xbar_mixer_out3_ep>;
+- };
++ xbar_mixer_out4_ep: endpoint {
++ remote-endpoint = <&mixer_out4_ep>;
+ };
++ };
+
+- mixer_out4_port: port@d {
+- reg = <0xd>;
++ port@62 {
++ reg = <0x62>;
+
+- mixer_out4_ep: endpoint {
+- remote-endpoint = <&xbar_mixer_out4_ep>;
+- };
++ xbar_mixer_out5_ep: endpoint {
++ remote-endpoint = <&mixer_out5_ep>;
+ };
++ };
+
+- mixer_out5_port: port@e {
+- reg = <0xe>;
++ xbar_asrc_in1_port: port@63 {
++ reg = <0x63>;
+
+- mixer_out5_ep: endpoint {
+- remote-endpoint = <&xbar_mixer_out5_ep>;
+- };
++ xbar_asrc_in1_ep: endpoint {
++ remote-endpoint = <&asrc_in1_ep>;
+ };
+ };
+- };
+
+- asrc@2910000 {
+- status = "okay";
++ port@64 {
++ reg = <0x64>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ xbar_asrc_out1_ep: endpoint {
++ remote-endpoint = <&asrc_out1_ep>;
++ };
++ };
+
+- port@0 {
+- reg = <0x0>;
++ xbar_asrc_in2_port: port@65 {
++ reg = <0x65>;
+
+- asrc_in1_ep: endpoint {
+- remote-endpoint = <&xbar_asrc_in1_ep>;
+- };
++ xbar_asrc_in2_ep: endpoint {
++ remote-endpoint = <&asrc_in2_ep>;
+ };
++ };
+
+- port@1 {
+- reg = <0x1>;
++ port@66 {
++ reg = <0x66>;
+
+- asrc_in2_ep: endpoint {
+- remote-endpoint = <&xbar_asrc_in2_ep>;
+- };
++ xbar_asrc_out2_ep: endpoint {
++ remote-endpoint = <&asrc_out2_ep>;
+ };
++ };
+
+- port@2 {
+- reg = <0x2>;
++ xbar_asrc_in3_port: port@67 {
++ reg = <0x67>;
+
+- asrc_in3_ep: endpoint {
+- remote-endpoint = <&xbar_asrc_in3_ep>;
+- };
++ xbar_asrc_in3_ep: endpoint {
++ remote-endpoint = <&asrc_in3_ep>;
+ };
++ };
+
+- port@3 {
+- reg = <0x3>;
++ port@68 {
++ reg = <0x68>;
+
+- asrc_in4_ep: endpoint {
+- remote-endpoint = <&xbar_asrc_in4_ep>;
+- };
++ xbar_asrc_out3_ep: endpoint {
++ remote-endpoint = <&asrc_out3_ep>;
+ };
++ };
+
+- port@4 {
+- reg = <0x4>;
++ xbar_asrc_in4_port: port@69 {
++ reg = <0x69>;
+
+- asrc_in5_ep: endpoint {
+- remote-endpoint = <&xbar_asrc_in5_ep>;
+- };
++ xbar_asrc_in4_ep: endpoint {
++ remote-endpoint = <&asrc_in4_ep>;
+ };
++ };
+
+- port@5 {
+- reg = <0x5>;
++ port@6a {
++ reg = <0x6a>;
+
+- asrc_in6_ep: endpoint {
+- remote-endpoint = <&xbar_asrc_in6_ep>;
+- };
++ xbar_asrc_out4_ep: endpoint {
++ remote-endpoint = <&asrc_out4_ep>;
+ };
++ };
+
+- port@6 {
+- reg = <0x6>;
++ xbar_asrc_in5_port: port@6b {
++ reg = <0x6b>;
+
+- asrc_in7_ep: endpoint {
+- remote-endpoint = <&xbar_asrc_in7_ep>;
+- };
++ xbar_asrc_in5_ep: endpoint {
++ remote-endpoint = <&asrc_in5_ep>;
+ };
++ };
+
+- asrc_out1_port: port@7 {
+- reg = <0x7>;
++ port@6c {
++ reg = <0x6c>;
+
+- asrc_out1_ep: endpoint {
+- remote-endpoint = <&xbar_asrc_out1_ep>;
+- };
++ xbar_asrc_out5_ep: endpoint {
++ remote-endpoint = <&asrc_out5_ep>;
+ };
++ };
+
+- asrc_out2_port: port@8 {
+- reg = <0x8>;
++ xbar_asrc_in6_port: port@6d {
++ reg = <0x6d>;
+
+- asrc_out2_ep: endpoint {
+- remote-endpoint = <&xbar_asrc_out2_ep>;
+- };
++ xbar_asrc_in6_ep: endpoint {
++ remote-endpoint = <&asrc_in6_ep>;
+ };
++ };
+
+- asrc_out3_port: port@9 {
+- reg = <0x9>;
++ port@6e {
++ reg = <0x6e>;
+
+- asrc_out3_ep: endpoint {
+- remote-endpoint = <&xbar_asrc_out3_ep>;
+- };
++ xbar_asrc_out6_ep: endpoint {
++ remote-endpoint = <&asrc_out6_ep>;
+ };
++ };
+
+- asrc_out4_port: port@a {
+- reg = <0xa>;
++ xbar_asrc_in7_port: port@6f {
++ reg = <0x6f>;
+
+- asrc_out4_ep: endpoint {
+- remote-endpoint = <&xbar_asrc_out4_ep>;
+- };
++ xbar_asrc_in7_ep: endpoint {
++ remote-endpoint = <&asrc_in7_ep>;
+ };
++ };
+
+- asrc_out5_port: port@b {
+- reg = <0xb>;
++ xbar_ope1_in_port: port@70 {
++ reg = <0x70>;
+
+- asrc_out5_ep: endpoint {
+- remote-endpoint = <&xbar_asrc_out5_ep>;
+- };
++ xbar_ope1_in_ep: endpoint {
++ remote-endpoint = <&ope1_cif_in_ep>;
+ };
++ };
+
+- asrc_out6_port: port@c {
+- reg = <0xc>;
++ port@71 {
++ reg = <0x71>;
+
+- asrc_out6_ep: endpoint {
+- remote-endpoint = <&xbar_asrc_out6_ep>;
+- };
++ xbar_ope1_out_ep: endpoint {
++ remote-endpoint = <&ope1_cif_out_ep>;
+ };
+ };
+ };
+ };
+- };
+
+- ddc: i2c@3190000 {
+- status = "okay";
++ dma-controller@2930000 {
++ status = "okay";
++ };
++
++ interrupt-controller@2a40000 {
++ status = "okay";
++ };
+ };
+
+ i2c@3160000 {
+@@ -2073,6 +2070,26 @@ eeprom@57 {
+ };
+ };
+
++ ddc: i2c@3190000 {
++ status = "okay";
++ };
++
++ spi@3270000 {
++ status = "okay";
++
++ flash@0 {
++ compatible = "jedec,spi-nor";
++ reg = <0>;
++ spi-max-frequency = <102000000>;
++ spi-tx-bus-width = <4>;
++ spi-rx-bus-width = <4>;
++ };
++ };
++
++ pwm@32d0000 {
++ status = "okay";
++ };
++
+ hda@3510000 {
+ nvidia,model = "NVIDIA Jetson Xavier NX HDA";
+ status = "okay";
+@@ -2141,15 +2158,6 @@ usb3-2 {
+ };
+ };
+
+- usb@3610000 {
+- status = "okay";
+-
+- phys = <&{/bus@0/padctl@3520000/pads/usb2/lanes/usb2-1}>,
+- <&{/bus@0/padctl@3520000/pads/usb2/lanes/usb2-2}>,
+- <&{/bus@0/padctl@3520000/pads/usb3/lanes/usb3-2}>;
+- phy-names = "usb2-1", "usb2-2", "usb3-2";
+- };
+-
+ usb@3550000 {
+ status = "okay";
+
+@@ -2157,20 +2165,13 @@ usb@3550000 {
+ phy-names = "usb2-0";
+ };
+
+- spi@3270000 {
++ usb@3610000 {
+ status = "okay";
+
+- flash@0 {
+- compatible = "jedec,spi-nor";
+- reg = <0>;
+- spi-max-frequency = <102000000>;
+- spi-tx-bus-width = <4>;
+- spi-rx-bus-width = <4>;
+- };
+- };
+-
+- pwm@32d0000 {
+- status = "okay";
++ phys = <&{/bus@0/padctl@3520000/pads/usb2/lanes/usb2-1}>,
++ <&{/bus@0/padctl@3520000/pads/usb2/lanes/usb2-2}>,
++ <&{/bus@0/padctl@3520000/pads/usb3/lanes/usb3-2}>;
++ phy-names = "usb2-1", "usb2-2", "usb3-2";
+ };
+
+ host1x@13e00000 {
+@@ -2251,14 +2252,6 @@ pcie-ep@141a0000 {
+ };
+ };
+
+- fan: pwm-fan {
+- compatible = "pwm-fan";
+- pwms = <&pwm6 0 45334>;
+-
+- cooling-levels = <0 64 128 255>;
+- #cooling-cells = <2>;
+- };
+-
+ gpio-keys {
+ compatible = "gpio-keys";
+
+@@ -2283,6 +2276,14 @@ key-power {
+ };
+ };
+
++ fan: pwm-fan {
++ compatible = "pwm-fan";
++ pwms = <&pwm6 0 45334>;
++
++ cooling-levels = <0 64 128 255>;
++ #cooling-cells = <2>;
++ };
++
+ vdd_5v0_sys: regulator-vdd-5v0-sys {
+ compatible = "regulator-fixed";
+ regulator-name = "VDD_5V_SYS";
+diff --git a/arch/arm64/boot/dts/nvidia/tegra194-p3668.dtsi b/arch/arm64/boot/dts/nvidia/tegra194-p3668.dtsi
+index 0751edddf7d59..58f190b0f8687 100644
+--- a/arch/arm64/boot/dts/nvidia/tegra194-p3668.dtsi
++++ b/arch/arm64/boot/dts/nvidia/tegra194-p3668.dtsi
+@@ -121,6 +121,24 @@ pmic: pmic@3c {
+ pinctrl-names = "default";
+ pinctrl-0 = <&max20024_default>;
+
++ fps {
++ fps0 {
++ maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN0>;
++ maxim,shutdown-fps-time-period-us = <640>;
++ };
++
++ fps1 {
++ maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN1>;
++ maxim,shutdown-fps-time-period-us = <640>;
++ maxim,device-state-on-disabled-event = <MAX77620_FPS_INACTIVE_STATE_SLEEP>;
++ };
++
++ fps2 {
++ maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN0>;
++ maxim,shutdown-fps-time-period-us = <640>;
++ };
++ };
++
+ max20024_default: pinmux {
+ gpio0 {
+ pins = "gpio0";
+@@ -164,24 +182,6 @@ gpio7 {
+ };
+ };
+
+- fps {
+- fps0 {
+- maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN0>;
+- maxim,shutdown-fps-time-period-us = <640>;
+- };
+-
+- fps1 {
+- maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN1>;
+- maxim,shutdown-fps-time-period-us = <640>;
+- maxim,device-state-on-disabled-event = <MAX77620_FPS_INACTIVE_STATE_SLEEP>;
+- };
+-
+- fps2 {
+- maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN0>;
+- maxim,shutdown-fps-time-period-us = <640>;
+- };
+- };
+-
+ regulators {
+ in-sd0-supply = <&vdd_5v0_sys>;
+ in-sd1-supply = <&vdd_5v0_sys>;
+diff --git a/arch/arm64/boot/dts/nvidia/tegra194.dtsi b/arch/arm64/boot/dts/nvidia/tegra194.dtsi
+index b941b1c77713c..45a204d753b1b 100644
+--- a/arch/arm64/boot/dts/nvidia/tegra194.dtsi
++++ b/arch/arm64/boot/dts/nvidia/tegra194.dtsi
+@@ -111,6 +111,34 @@ axi2apb: axi2apb@2390000 {
+ status = "okay";
+ };
+
++ pinmux: pinmux@2430000 {
++ compatible = "nvidia,tegra194-pinmux";
++ reg = <0x0 0x2430000 0x0 0x17000>;
++ status = "okay";
++
++ pex_clkreq_c5_bi_dir_state: pinmux-pex-clkreq-c5-bi-dir {
++ clkreq {
++ nvidia,pins = "pex_l5_clkreq_n_pgg0";
++ nvidia,schmitt = <TEGRA_PIN_DISABLE>;
++ nvidia,enable-input = <TEGRA_PIN_ENABLE>;
++ nvidia,io-hv = <TEGRA_PIN_ENABLE>;
++ nvidia,tristate = <TEGRA_PIN_DISABLE>;
++ nvidia,pull = <TEGRA_PIN_PULL_NONE>;
++ };
++ };
++
++ pex_rst_c5_out_state: pinmux-pex-rst-c5-out {
++ pex_rst {
++ nvidia,pins = "pex_l5_rst_n_pgg1";
++ nvidia,schmitt = <TEGRA_PIN_DISABLE>;
++ nvidia,enable-input = <TEGRA_PIN_DISABLE>;
++ nvidia,io-hv = <TEGRA_PIN_ENABLE>;
++ nvidia,tristate = <TEGRA_PIN_DISABLE>;
++ nvidia,pull = <TEGRA_PIN_PULL_NONE>;
++ };
++ };
++ };
++
+ ethernet@2490000 {
+ compatible = "nvidia,tegra194-eqos",
+ "nvidia,tegra186-eqos",
+@@ -196,64 +224,6 @@ aconnect@2900000 {
+ #size-cells = <2>;
+ ranges = <0x0 0x02900000 0x0 0x02900000 0x0 0x200000>;
+
+- adma: dma-controller@2930000 {
+- compatible = "nvidia,tegra194-adma",
+- "nvidia,tegra186-adma";
+- reg = <0x0 0x02930000 0x0 0x20000>;
+- interrupt-parent = <&agic>;
+- interrupts = <GIC_SPI 0 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 1 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 2 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 3 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 4 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 5 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 6 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 7 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 8 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 9 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 10 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 11 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 12 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 13 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 14 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 15 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 16 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 17 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 18 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 19 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 20 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 21 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 22 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 23 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 24 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 25 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 26 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 27 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 28 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 29 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 30 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 31 IRQ_TYPE_LEVEL_HIGH>;
+- #dma-cells = <1>;
+- clocks = <&bpmp TEGRA194_CLK_AHUB>;
+- clock-names = "d_audio";
+- status = "disabled";
+- };
+-
+- agic: interrupt-controller@2a40000 {
+- compatible = "nvidia,tegra194-agic",
+- "nvidia,tegra210-agic";
+- #interrupt-cells = <3>;
+- interrupt-controller;
+- reg = <0x0 0x02a41000 0x0 0x1000>,
+- <0x0 0x02a42000 0x0 0x2000>;
+- interrupts = <GIC_SPI 145
+- (GIC_CPU_MASK_SIMPLE(4) |
+- IRQ_TYPE_LEVEL_HIGH)>;
+- clocks = <&bpmp TEGRA194_CLK_APE>;
+- clock-names = "clk";
+- status = "disabled";
+- };
+-
+ tegra_ahub: ahub@2900800 {
+ compatible = "nvidia,tegra194-ahub",
+ "nvidia,tegra186-ahub";
+@@ -268,57 +238,6 @@ tegra_ahub: ahub@2900800 {
+ #size-cells = <2>;
+ ranges = <0x0 0x02900800 0x0 0x02900800 0x0 0x11800>;
+
+- tegra_admaif: admaif@290f000 {
+- compatible = "nvidia,tegra194-admaif",
+- "nvidia,tegra186-admaif";
+- reg = <0x0 0x0290f000 0x0 0x1000>;
+- dmas = <&adma 1>, <&adma 1>,
+- <&adma 2>, <&adma 2>,
+- <&adma 3>, <&adma 3>,
+- <&adma 4>, <&adma 4>,
+- <&adma 5>, <&adma 5>,
+- <&adma 6>, <&adma 6>,
+- <&adma 7>, <&adma 7>,
+- <&adma 8>, <&adma 8>,
+- <&adma 9>, <&adma 9>,
+- <&adma 10>, <&adma 10>,
+- <&adma 11>, <&adma 11>,
+- <&adma 12>, <&adma 12>,
+- <&adma 13>, <&adma 13>,
+- <&adma 14>, <&adma 14>,
+- <&adma 15>, <&adma 15>,
+- <&adma 16>, <&adma 16>,
+- <&adma 17>, <&adma 17>,
+- <&adma 18>, <&adma 18>,
+- <&adma 19>, <&adma 19>,
+- <&adma 20>, <&adma 20>;
+- dma-names = "rx1", "tx1",
+- "rx2", "tx2",
+- "rx3", "tx3",
+- "rx4", "tx4",
+- "rx5", "tx5",
+- "rx6", "tx6",
+- "rx7", "tx7",
+- "rx8", "tx8",
+- "rx9", "tx9",
+- "rx10", "tx10",
+- "rx11", "tx11",
+- "rx12", "tx12",
+- "rx13", "tx13",
+- "rx14", "tx14",
+- "rx15", "tx15",
+- "rx16", "tx16",
+- "rx17", "tx17",
+- "rx18", "tx18",
+- "rx19", "tx19",
+- "rx20", "tx20";
+- status = "disabled";
+- interconnects = <&mc TEGRA194_MEMORY_CLIENT_APEDMAR &emc>,
+- <&mc TEGRA194_MEMORY_CLIENT_APEDMAW &emc>;
+- interconnect-names = "dma-mem", "write";
+- iommus = <&smmu TEGRA194_SID_APE>;
+- };
+-
+ tegra_i2s1: i2s@2901000 {
+ compatible = "nvidia,tegra194-i2s",
+ "nvidia,tegra210-i2s";
+@@ -403,84 +322,6 @@ tegra_i2s6: i2s@2901500 {
+ status = "disabled";
+ };
+
+- tegra_dmic1: dmic@2904000 {
+- compatible = "nvidia,tegra194-dmic",
+- "nvidia,tegra210-dmic";
+- reg = <0x0 0x2904000 0x0 0x100>;
+- clocks = <&bpmp TEGRA194_CLK_DMIC1>;
+- clock-names = "dmic";
+- assigned-clocks = <&bpmp TEGRA194_CLK_DMIC1>;
+- assigned-clock-parents = <&bpmp TEGRA194_CLK_PLLA_OUT0>;
+- assigned-clock-rates = <3072000>;
+- sound-name-prefix = "DMIC1";
+- status = "disabled";
+- };
+-
+- tegra_dmic2: dmic@2904100 {
+- compatible = "nvidia,tegra194-dmic",
+- "nvidia,tegra210-dmic";
+- reg = <0x0 0x2904100 0x0 0x100>;
+- clocks = <&bpmp TEGRA194_CLK_DMIC2>;
+- clock-names = "dmic";
+- assigned-clocks = <&bpmp TEGRA194_CLK_DMIC2>;
+- assigned-clock-parents = <&bpmp TEGRA194_CLK_PLLA_OUT0>;
+- assigned-clock-rates = <3072000>;
+- sound-name-prefix = "DMIC2";
+- status = "disabled";
+- };
+-
+- tegra_dmic3: dmic@2904200 {
+- compatible = "nvidia,tegra194-dmic",
+- "nvidia,tegra210-dmic";
+- reg = <0x0 0x2904200 0x0 0x100>;
+- clocks = <&bpmp TEGRA194_CLK_DMIC3>;
+- clock-names = "dmic";
+- assigned-clocks = <&bpmp TEGRA194_CLK_DMIC3>;
+- assigned-clock-parents = <&bpmp TEGRA194_CLK_PLLA_OUT0>;
+- assigned-clock-rates = <3072000>;
+- sound-name-prefix = "DMIC3";
+- status = "disabled";
+- };
+-
+- tegra_dmic4: dmic@2904300 {
+- compatible = "nvidia,tegra194-dmic",
+- "nvidia,tegra210-dmic";
+- reg = <0x0 0x2904300 0x0 0x100>;
+- clocks = <&bpmp TEGRA194_CLK_DMIC4>;
+- clock-names = "dmic";
+- assigned-clocks = <&bpmp TEGRA194_CLK_DMIC4>;
+- assigned-clock-parents = <&bpmp TEGRA194_CLK_PLLA_OUT0>;
+- assigned-clock-rates = <3072000>;
+- sound-name-prefix = "DMIC4";
+- status = "disabled";
+- };
+-
+- tegra_dspk1: dspk@2905000 {
+- compatible = "nvidia,tegra194-dspk",
+- "nvidia,tegra186-dspk";
+- reg = <0x0 0x2905000 0x0 0x100>;
+- clocks = <&bpmp TEGRA194_CLK_DSPK1>;
+- clock-names = "dspk";
+- assigned-clocks = <&bpmp TEGRA194_CLK_DSPK1>;
+- assigned-clock-parents = <&bpmp TEGRA194_CLK_PLLA_OUT0>;
+- assigned-clock-rates = <12288000>;
+- sound-name-prefix = "DSPK1";
+- status = "disabled";
+- };
+-
+- tegra_dspk2: dspk@2905100 {
+- compatible = "nvidia,tegra194-dspk",
+- "nvidia,tegra186-dspk";
+- reg = <0x0 0x2905100 0x0 0x100>;
+- clocks = <&bpmp TEGRA194_CLK_DSPK2>;
+- clock-names = "dspk";
+- assigned-clocks = <&bpmp TEGRA194_CLK_DSPK2>;
+- assigned-clock-parents = <&bpmp TEGRA194_CLK_PLLA_OUT0>;
+- assigned-clock-rates = <12288000>;
+- sound-name-prefix = "DSPK2";
+- status = "disabled";
+- };
+-
+ tegra_sfc1: sfc@2902000 {
+ compatible = "nvidia,tegra194-sfc",
+ "nvidia,tegra210-sfc";
+@@ -513,22 +354,6 @@ tegra_sfc4: sfc@2902600 {
+ status = "disabled";
+ };
+
+- tegra_mvc1: mvc@290a000 {
+- compatible = "nvidia,tegra194-mvc",
+- "nvidia,tegra210-mvc";
+- reg = <0x0 0x290a000 0x0 0x200>;
+- sound-name-prefix = "MVC1";
+- status = "disabled";
+- };
+-
+- tegra_mvc2: mvc@290a200 {
+- compatible = "nvidia,tegra194-mvc",
+- "nvidia,tegra210-mvc";
+- reg = <0x0 0x290a200 0x0 0x200>;
+- sound-name-prefix = "MVC2";
+- status = "disabled";
+- };
+-
+ tegra_amx1: amx@2903000 {
+ compatible = "nvidia,tegra194-amx";
+ reg = <0x0 0x2903000 0x0 0x100>;
+@@ -589,6 +414,84 @@ tegra_adx4: adx@2903b00 {
+ status = "disabled";
+ };
+
++ tegra_dmic1: dmic@2904000 {
++ compatible = "nvidia,tegra194-dmic",
++ "nvidia,tegra210-dmic";
++ reg = <0x0 0x2904000 0x0 0x100>;
++ clocks = <&bpmp TEGRA194_CLK_DMIC1>;
++ clock-names = "dmic";
++ assigned-clocks = <&bpmp TEGRA194_CLK_DMIC1>;
++ assigned-clock-parents = <&bpmp TEGRA194_CLK_PLLA_OUT0>;
++ assigned-clock-rates = <3072000>;
++ sound-name-prefix = "DMIC1";
++ status = "disabled";
++ };
++
++ tegra_dmic2: dmic@2904100 {
++ compatible = "nvidia,tegra194-dmic",
++ "nvidia,tegra210-dmic";
++ reg = <0x0 0x2904100 0x0 0x100>;
++ clocks = <&bpmp TEGRA194_CLK_DMIC2>;
++ clock-names = "dmic";
++ assigned-clocks = <&bpmp TEGRA194_CLK_DMIC2>;
++ assigned-clock-parents = <&bpmp TEGRA194_CLK_PLLA_OUT0>;
++ assigned-clock-rates = <3072000>;
++ sound-name-prefix = "DMIC2";
++ status = "disabled";
++ };
++
++ tegra_dmic3: dmic@2904200 {
++ compatible = "nvidia,tegra194-dmic",
++ "nvidia,tegra210-dmic";
++ reg = <0x0 0x2904200 0x0 0x100>;
++ clocks = <&bpmp TEGRA194_CLK_DMIC3>;
++ clock-names = "dmic";
++ assigned-clocks = <&bpmp TEGRA194_CLK_DMIC3>;
++ assigned-clock-parents = <&bpmp TEGRA194_CLK_PLLA_OUT0>;
++ assigned-clock-rates = <3072000>;
++ sound-name-prefix = "DMIC3";
++ status = "disabled";
++ };
++
++ tegra_dmic4: dmic@2904300 {
++ compatible = "nvidia,tegra194-dmic",
++ "nvidia,tegra210-dmic";
++ reg = <0x0 0x2904300 0x0 0x100>;
++ clocks = <&bpmp TEGRA194_CLK_DMIC4>;
++ clock-names = "dmic";
++ assigned-clocks = <&bpmp TEGRA194_CLK_DMIC4>;
++ assigned-clock-parents = <&bpmp TEGRA194_CLK_PLLA_OUT0>;
++ assigned-clock-rates = <3072000>;
++ sound-name-prefix = "DMIC4";
++ status = "disabled";
++ };
++
++ tegra_dspk1: dspk@2905000 {
++ compatible = "nvidia,tegra194-dspk",
++ "nvidia,tegra186-dspk";
++ reg = <0x0 0x2905000 0x0 0x100>;
++ clocks = <&bpmp TEGRA194_CLK_DSPK1>;
++ clock-names = "dspk";
++ assigned-clocks = <&bpmp TEGRA194_CLK_DSPK1>;
++ assigned-clock-parents = <&bpmp TEGRA194_CLK_PLLA_OUT0>;
++ assigned-clock-rates = <12288000>;
++ sound-name-prefix = "DSPK1";
++ status = "disabled";
++ };
++
++ tegra_dspk2: dspk@2905100 {
++ compatible = "nvidia,tegra194-dspk",
++ "nvidia,tegra186-dspk";
++ reg = <0x0 0x2905100 0x0 0x100>;
++ clocks = <&bpmp TEGRA194_CLK_DSPK2>;
++ clock-names = "dspk";
++ assigned-clocks = <&bpmp TEGRA194_CLK_DSPK2>;
++ assigned-clock-parents = <&bpmp TEGRA194_CLK_PLLA_OUT0>;
++ assigned-clock-rates = <12288000>;
++ sound-name-prefix = "DSPK2";
++ status = "disabled";
++ };
++
+ tegra_ope1: processing-engine@2908000 {
+ compatible = "nvidia,tegra194-ope",
+ "nvidia,tegra210-ope";
+@@ -613,6 +516,22 @@ dynamic-range-compressor@2908200 {
+ };
+ };
+
++ tegra_mvc1: mvc@290a000 {
++ compatible = "nvidia,tegra194-mvc",
++ "nvidia,tegra210-mvc";
++ reg = <0x0 0x290a000 0x0 0x200>;
++ sound-name-prefix = "MVC1";
++ status = "disabled";
++ };
++
++ tegra_mvc2: mvc@290a200 {
++ compatible = "nvidia,tegra194-mvc",
++ "nvidia,tegra210-mvc";
++ reg = <0x0 0x290a200 0x0 0x200>;
++ sound-name-prefix = "MVC2";
++ status = "disabled";
++ };
++
+ tegra_amixer: amixer@290bb00 {
+ compatible = "nvidia,tegra194-amixer",
+ "nvidia,tegra210-amixer";
+@@ -621,6 +540,57 @@ tegra_amixer: amixer@290bb00 {
+ status = "disabled";
+ };
+
++ tegra_admaif: admaif@290f000 {
++ compatible = "nvidia,tegra194-admaif",
++ "nvidia,tegra186-admaif";
++ reg = <0x0 0x0290f000 0x0 0x1000>;
++ dmas = <&adma 1>, <&adma 1>,
++ <&adma 2>, <&adma 2>,
++ <&adma 3>, <&adma 3>,
++ <&adma 4>, <&adma 4>,
++ <&adma 5>, <&adma 5>,
++ <&adma 6>, <&adma 6>,
++ <&adma 7>, <&adma 7>,
++ <&adma 8>, <&adma 8>,
++ <&adma 9>, <&adma 9>,
++ <&adma 10>, <&adma 10>,
++ <&adma 11>, <&adma 11>,
++ <&adma 12>, <&adma 12>,
++ <&adma 13>, <&adma 13>,
++ <&adma 14>, <&adma 14>,
++ <&adma 15>, <&adma 15>,
++ <&adma 16>, <&adma 16>,
++ <&adma 17>, <&adma 17>,
++ <&adma 18>, <&adma 18>,
++ <&adma 19>, <&adma 19>,
++ <&adma 20>, <&adma 20>;
++ dma-names = "rx1", "tx1",
++ "rx2", "tx2",
++ "rx3", "tx3",
++ "rx4", "tx4",
++ "rx5", "tx5",
++ "rx6", "tx6",
++ "rx7", "tx7",
++ "rx8", "tx8",
++ "rx9", "tx9",
++ "rx10", "tx10",
++ "rx11", "tx11",
++ "rx12", "tx12",
++ "rx13", "tx13",
++ "rx14", "tx14",
++ "rx15", "tx15",
++ "rx16", "tx16",
++ "rx17", "tx17",
++ "rx18", "tx18",
++ "rx19", "tx19",
++ "rx20", "tx20";
++ status = "disabled";
++ interconnects = <&mc TEGRA194_MEMORY_CLIENT_APEDMAR &emc>,
++ <&mc TEGRA194_MEMORY_CLIENT_APEDMAW &emc>;
++ interconnect-names = "dma-mem", "write";
++ iommus = <&smmu TEGRA194_SID_APE>;
++ };
++
+ tegra_asrc: asrc@2910000 {
+ compatible = "nvidia,tegra194-asrc",
+ "nvidia,tegra186-asrc";
+@@ -629,33 +599,63 @@ tegra_asrc: asrc@2910000 {
+ status = "disabled";
+ };
+ };
+- };
+
+- pinmux: pinmux@2430000 {
+- compatible = "nvidia,tegra194-pinmux";
+- reg = <0x0 0x2430000 0x0 0x17000>;
+- status = "okay";
+-
+- pex_rst_c5_out_state: pinmux-pex-rst-c5-out {
+- pex_rst {
+- nvidia,pins = "pex_l5_rst_n_pgg1";
+- nvidia,schmitt = <TEGRA_PIN_DISABLE>;
+- nvidia,enable-input = <TEGRA_PIN_DISABLE>;
+- nvidia,io-hv = <TEGRA_PIN_ENABLE>;
+- nvidia,tristate = <TEGRA_PIN_DISABLE>;
+- nvidia,pull = <TEGRA_PIN_PULL_NONE>;
+- };
++ adma: dma-controller@2930000 {
++ compatible = "nvidia,tegra194-adma",
++ "nvidia,tegra186-adma";
++ reg = <0x0 0x02930000 0x0 0x20000>;
++ interrupt-parent = <&agic>;
++ interrupts = <GIC_SPI 0 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 1 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 2 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 3 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 4 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 5 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 6 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 7 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 8 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 9 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 10 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 11 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 12 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 13 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 14 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 15 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 16 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 17 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 18 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 19 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 20 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 21 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 22 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 23 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 24 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 25 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 26 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 27 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 28 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 29 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 30 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 31 IRQ_TYPE_LEVEL_HIGH>;
++ #dma-cells = <1>;
++ clocks = <&bpmp TEGRA194_CLK_AHUB>;
++ clock-names = "d_audio";
++ status = "disabled";
+ };
+
+- clkreq_c5_bi_dir_state: pinmux-clkreq-c5-bi-dir {
+- clkreq {
+- nvidia,pins = "pex_l5_clkreq_n_pgg0";
+- nvidia,schmitt = <TEGRA_PIN_DISABLE>;
+- nvidia,enable-input = <TEGRA_PIN_ENABLE>;
+- nvidia,io-hv = <TEGRA_PIN_ENABLE>;
+- nvidia,tristate = <TEGRA_PIN_DISABLE>;
+- nvidia,pull = <TEGRA_PIN_PULL_NONE>;
+- };
++ agic: interrupt-controller@2a40000 {
++ compatible = "nvidia,tegra194-agic",
++ "nvidia,tegra210-agic";
++ #interrupt-cells = <3>;
++ interrupt-controller;
++ reg = <0x0 0x02a41000 0x0 0x1000>,
++ <0x0 0x02a42000 0x0 0x2000>;
++ interrupts = <GIC_SPI 145
++ (GIC_CPU_MASK_SIMPLE(4) |
++ IRQ_TYPE_LEVEL_HIGH)>;
++ clocks = <&bpmp TEGRA194_CLK_APE>;
++ clock-names = "clk";
++ status = "disabled";
+ };
+ };
+
+@@ -942,19 +942,6 @@ spi@3270000 {
+ status = "disabled";
+ };
+
+- spi@3300000 {
+- compatible = "nvidia,tegra194-qspi";
+- reg = <0x0 0x3300000 0x0 0x1000>;
+- interrupts = <GIC_SPI 39 IRQ_TYPE_LEVEL_HIGH>;
+- #address-cells = <1>;
+- #size-cells = <0>;
+- clocks = <&bpmp TEGRA194_CLK_QSPI1>,
+- <&bpmp TEGRA194_CLK_QSPI1_PM>;
+- clock-names = "qspi", "qspi_out";
+- resets = <&bpmp TEGRA194_RESET_QSPI1>;
+- status = "disabled";
+- };
+-
+ pwm1: pwm@3280000 {
+ compatible = "nvidia,tegra194-pwm",
+ "nvidia,tegra186-pwm";
+@@ -1032,6 +1019,19 @@ pwm8: pwm@32f0000 {
+ #pwm-cells = <2>;
+ };
+
++ spi@3300000 {
++ compatible = "nvidia,tegra194-qspi";
++ reg = <0x0 0x3300000 0x0 0x1000>;
++ interrupts = <GIC_SPI 39 IRQ_TYPE_LEVEL_HIGH>;
++ #address-cells = <1>;
++ #size-cells = <0>;
++ clocks = <&bpmp TEGRA194_CLK_QSPI1>,
++ <&bpmp TEGRA194_CLK_QSPI1_PM>;
++ clock-names = "qspi", "qspi_out";
++ resets = <&bpmp TEGRA194_RESET_QSPI1>;
++ status = "disabled";
++ };
++
+ sdmmc1: mmc@3400000 {
+ compatible = "nvidia,tegra194-sdhci";
+ reg = <0x0 0x03400000 0x0 0x10000>;
+@@ -1707,17 +1707,14 @@ pmc: pmc@c360000 {
+
+ #interrupt-cells = <2>;
+ interrupt-controller;
+- sdmmc1_3v3: sdmmc1-3v3 {
+- pins = "sdmmc1-hv";
+- power-source = <TEGRA_IO_PAD_VOLTAGE_3V3>;
+- };
+
+ sdmmc1_1v8: sdmmc1-1v8 {
+ pins = "sdmmc1-hv";
+ power-source = <TEGRA_IO_PAD_VOLTAGE_1V8>;
+ };
+- sdmmc3_3v3: sdmmc3-3v3 {
+- pins = "sdmmc3-hv";
++
++ sdmmc1_3v3: sdmmc1-3v3 {
++ pins = "sdmmc1-hv";
+ power-source = <TEGRA_IO_PAD_VOLTAGE_3V3>;
+ };
+
+@@ -1726,6 +1723,10 @@ sdmmc3_1v8: sdmmc3-1v8 {
+ power-source = <TEGRA_IO_PAD_VOLTAGE_1V8>;
+ };
+
++ sdmmc3_3v3: sdmmc3-3v3 {
++ pins = "sdmmc3-hv";
++ power-source = <TEGRA_IO_PAD_VOLTAGE_3V3>;
++ };
+ };
+
+ aon-noc@c600000 {
+@@ -2373,10 +2374,10 @@ sor3: sor@15bc0000 {
+ pcie@14100000 {
+ compatible = "nvidia,tegra194-pcie";
+ power-domains = <&bpmp TEGRA194_POWER_DOMAIN_PCIEX1A>;
+- reg = <0x0 0x14100000 0x0 0x00020000>, /* appl registers (128K) */
+- <0x0 0x30000000 0x0 0x00040000>, /* configuration space (256K) */
+- <0x0 0x30040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */
+- <0x0 0x30080000 0x0 0x00040000>; /* DBI reg space (256K) */
++ reg = <0x00 0x14100000 0x0 0x00020000>, /* appl registers (128K) */
++ <0x00 0x30000000 0x0 0x00040000>, /* configuration space (256K) */
++ <0x00 0x30040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */
++ <0x00 0x30080000 0x0 0x00040000>; /* DBI reg space (256K) */
+ reg-names = "appl", "config", "atu_dma", "dbi";
+
+ status = "disabled";
+@@ -2726,7 +2727,7 @@ pcie@141a0000 {
+ linux,pci-domain = <5>;
+
+ pinctrl-names = "default";
+- pinctrl-0 = <&pex_rst_c5_out_state>, <&clkreq_c5_bi_dir_state>;
++ pinctrl-0 = <&pex_rst_c5_out_state>, <&pex_clkreq_c5_bi_dir_state>;
+
+ clocks = <&bpmp TEGRA194_CLK_PEX1_CORE_5>;
+ clock-names = "core";
+@@ -2779,7 +2780,7 @@ pcie-ep@141a0000 {
+ num-ob-windows = <8>;
+
+ pinctrl-names = "default";
+- pinctrl-0 = <&clkreq_c5_bi_dir_state>;
++ pinctrl-0 = <&pex_clkreq_c5_bi_dir_state>;
+
+ clocks = <&bpmp TEGRA194_CLK_PEX1_CORE_5>;
+ clock-names = "core";
+@@ -3121,6 +3122,13 @@ psci {
+ method = "smc";
+ };
+
++ tcu: serial {
++ compatible = "nvidia,tegra194-tcu";
++ mboxes = <&hsp_top0 TEGRA_HSP_MBOX_TYPE_SM TEGRA_HSP_SM_RX(0)>,
++ <&hsp_aon TEGRA_HSP_MBOX_TYPE_SM TEGRA_HSP_SM_TX(1)>;
++ mbox-names = "rx", "tx";
++ };
++
+ sound {
+ status = "disabled";
+
+@@ -3141,13 +3149,6 @@ sound {
+ assigned-clock-rates = <258000000>;
+ };
+
+- tcu: serial {
+- compatible = "nvidia,tegra194-tcu";
+- mboxes = <&hsp_top0 TEGRA_HSP_MBOX_TYPE_SM TEGRA_HSP_SM_RX(0)>,
+- <&hsp_aon TEGRA_HSP_MBOX_TYPE_SM TEGRA_HSP_SM_TX(1)>;
+- mbox-names = "rx", "tx";
+- };
+-
+ thermal-zones {
+ cpu-thermal {
+ thermal-sensors = <&{/bpmp/thermal} TEGRA194_BPMP_THERMAL_ZONE_CPU>;
+diff --git a/arch/arm64/boot/dts/nvidia/tegra210-p2180.dtsi b/arch/arm64/boot/dts/nvidia/tegra210-p2180.dtsi
+index 75eb743a72427..92163b6809801 100644
+--- a/arch/arm64/boot/dts/nvidia/tegra210-p2180.dtsi
++++ b/arch/arm64/boot/dts/nvidia/tegra210-p2180.dtsi
+@@ -31,6 +31,23 @@ serial@70006000 {
+ status = "okay";
+ };
+
++ i2c@7000c500 {
++ status = "okay";
++
++ /* module ID EEPROM */
++ eeprom@50 {
++ compatible = "atmel,24c02";
++ reg = <0x50>;
++
++ label = "module";
++ vcc-supply = <&vdd_1v8>;
++ address-width = <8>;
++ pagesize = <8>;
++ size = <256>;
++ read-only;
++ };
++ };
++
+ i2c@7000d000 {
+ status = "okay";
+ clock-frequency = <400000>;
+@@ -50,6 +67,22 @@ pmic: pmic@3c {
+ pinctrl-names = "default";
+ pinctrl-0 = <&max77620_default>;
+
++ fps {
++ fps0 {
++ maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN0>;
++ maxim,suspend-fps-time-period-us = <1280>;
++ };
++
++ fps1 {
++ maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN1>;
++ maxim,suspend-fps-time-period-us = <1280>;
++ };
++
++ fps2 {
++ maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN0>;
++ };
++ };
++
+ max77620_default: pinmux {
+ gpio0 {
+ pins = "gpio0";
+@@ -84,22 +117,6 @@ gpio5_6_7 {
+ };
+ };
+
+- fps {
+- fps0 {
+- maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN0>;
+- maxim,suspend-fps-time-period-us = <1280>;
+- };
+-
+- fps1 {
+- maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN1>;
+- maxim,suspend-fps-time-period-us = <1280>;
+- };
+-
+- fps2 {
+- maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN0>;
+- };
+- };
+-
+ regulators {
+ in-ldo0-1-supply = <&vdd_pre>;
+ in-ldo7-8-supply = <&vdd_pre>;
+@@ -265,23 +282,6 @@ avdd_1v05: ldo8 {
+ };
+ };
+
+- i2c@7000c500 {
+- status = "okay";
+-
+- /* module ID EEPROM */
+- eeprom@50 {
+- compatible = "atmel,24c02";
+- reg = <0x50>;
+-
+- label = "module";
+- vcc-supply = <&vdd_1v8>;
+- address-width = <8>;
+- pagesize = <8>;
+- size = <256>;
+- read-only;
+- };
+- };
+-
+ pmc@7000e400 {
+ nvidia,invert-interrupt;
+ nvidia,suspend-mode = <0>;
+diff --git a/arch/arm64/boot/dts/nvidia/tegra210-p2371-2180.dts b/arch/arm64/boot/dts/nvidia/tegra210-p2371-2180.dts
+index 1e26ca91a9449..38f4ff229beff 100644
+--- a/arch/arm64/boot/dts/nvidia/tegra210-p2371-2180.dts
++++ b/arch/arm64/boot/dts/nvidia/tegra210-p2371-2180.dts
+@@ -63,17 +63,17 @@ backlight: backlight@2c {
+ pwms = <&pwm 0 29334>;
+ pwm-names = "lp8557";
+
+- /* 3 LED string */
+- rom_14h {
+- rom-addr = /bits/ 8 <0x14>;
+- rom-val = /bits/ 8 <0x87>;
+- };
+-
+ /* boost frequency 1 MHz */
+ rom_13h {
+ rom-addr = /bits/ 8 <0x13>;
+ rom-val = /bits/ 8 <0x01>;
+ };
++
++ /* 3 LED string */
++ rom_14h {
++ rom-addr = /bits/ 8 <0x14>;
++ rom-val = /bits/ 8 <0x87>;
++ };
+ };
+ };
+
+@@ -116,14 +116,6 @@ clock@70110000 {
+ aconnect@702c0000 {
+ status = "okay";
+
+- dma-controller@702e2000 {
+- status = "okay";
+- };
+-
+- interrupt-controller@702f9000 {
+- status = "okay";
+- };
+-
+ ahub@702d0800 {
+ status = "okay";
+
+@@ -261,81 +253,6 @@ i2s5_dap_ep: endpoint {
+ };
+ };
+
+- dmic@702d4000 {
+- status = "okay";
+-
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
+-
+- port@0 {
+- reg = <0>;
+-
+- dmic1_cif_ep: endpoint {
+- remote-endpoint = <&xbar_dmic1_ep>;
+- };
+- };
+-
+- dmic1_port: port@1 {
+- reg = <1>;
+-
+- dmic1_dap_ep: endpoint {
+- /* Placeholder for external Codec */
+- };
+- };
+- };
+- };
+-
+- dmic@702d4100 {
+- status = "okay";
+-
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
+-
+- port@0 {
+- reg = <0>;
+-
+- dmic2_cif_ep: endpoint {
+- remote-endpoint = <&xbar_dmic2_ep>;
+- };
+- };
+-
+- dmic2_port: port@1 {
+- reg = <1>;
+-
+- dmic2_dap_ep: endpoint {
+- /* Placeholder for external Codec */
+- };
+- };
+- };
+- };
+-
+- dmic@702d4200 {
+- status = "okay";
+-
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
+-
+- port@0 {
+- reg = <0>;
+-
+- dmic3_cif_ep: endpoint {
+- remote-endpoint = <&xbar_dmic3_ep>;
+- };
+- };
+-
+- dmic3_port: port@1 {
+- reg = <1>;
+-
+- dmic3_dap_ep: endpoint {
+- /* Placeholder for external Codec */
+- };
+- };
+- };
+- };
+-
+ sfc@702d2000 {
+ status = "okay";
+
+@@ -436,56 +353,6 @@ sfc4_cif_out_ep: endpoint {
+ };
+ };
+
+- mvc@702da000 {
+- status = "okay";
+-
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
+-
+- port@0 {
+- reg = <0>;
+-
+- mvc1_cif_in_ep: endpoint {
+- remote-endpoint = <&xbar_mvc1_in_ep>;
+- };
+- };
+-
+- mvc1_out_port: port@1 {
+- reg = <1>;
+-
+- mvc1_cif_out_ep: endpoint {
+- remote-endpoint = <&xbar_mvc1_out_ep>;
+- };
+- };
+- };
+- };
+-
+- mvc@702da200 {
+- status = "okay";
+-
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
+-
+- port@0 {
+- reg = <0>;
+-
+- mvc2_cif_in_ep: endpoint {
+- remote-endpoint = <&xbar_mvc2_in_ep>;
+- };
+- };
+-
+- mvc2_out_port: port@1 {
+- reg = <1>;
+-
+- mvc2_cif_out_ep: endpoint {
+- remote-endpoint = <&xbar_mvc2_out_ep>;
+- };
+- };
+- };
+- };
+-
+ amx@702d3000 {
+ status = "okay";
+
+@@ -682,6 +549,81 @@ adx2_out4_ep: endpoint {
+ };
+ };
+
++ dmic@702d4000 {
++ status = "okay";
++
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
++
++ port@0 {
++ reg = <0>;
++
++ dmic1_cif_ep: endpoint {
++ remote-endpoint = <&xbar_dmic1_ep>;
++ };
++ };
++
++ dmic1_port: port@1 {
++ reg = <1>;
++
++ dmic1_dap_ep: endpoint {
++ /* Placeholder for external Codec */
++ };
++ };
++ };
++ };
++
++ dmic@702d4100 {
++ status = "okay";
++
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
++
++ port@0 {
++ reg = <0>;
++
++ dmic2_cif_ep: endpoint {
++ remote-endpoint = <&xbar_dmic2_ep>;
++ };
++ };
++
++ dmic2_port: port@1 {
++ reg = <1>;
++
++ dmic2_dap_ep: endpoint {
++ /* Placeholder for external Codec */
++ };
++ };
++ };
++ };
++
++ dmic@702d4200 {
++ status = "okay";
++
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
++
++ port@0 {
++ reg = <0>;
++
++ dmic3_cif_ep: endpoint {
++ remote-endpoint = <&xbar_dmic3_ep>;
++ };
++ };
++
++ dmic3_port: port@1 {
++ reg = <1>;
++
++ dmic3_dap_ep: endpoint {
++ /* Placeholder for external Codec */
++ };
++ };
++ };
++ };
++
+ processing-engine@702d8000 {
+ status = "okay";
+
+@@ -732,6 +674,56 @@ ope2_cif_out_ep: endpoint {
+ };
+ };
+
++ mvc@702da000 {
++ status = "okay";
++
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
++
++ port@0 {
++ reg = <0>;
++
++ mvc1_cif_in_ep: endpoint {
++ remote-endpoint = <&xbar_mvc1_in_ep>;
++ };
++ };
++
++ mvc1_out_port: port@1 {
++ reg = <1>;
++
++ mvc1_cif_out_ep: endpoint {
++ remote-endpoint = <&xbar_mvc1_out_ep>;
++ };
++ };
++ };
++ };
++
++ mvc@702da200 {
++ status = "okay";
++
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
++
++ port@0 {
++ reg = <0>;
++
++ mvc2_cif_in_ep: endpoint {
++ remote-endpoint = <&xbar_mvc2_in_ep>;
++ };
++ };
++
++ mvc2_out_port: port@1 {
++ reg = <1>;
++
++ mvc2_cif_out_ep: endpoint {
++ remote-endpoint = <&xbar_mvc2_out_ep>;
++ };
++ };
++ };
++ };
++
+ amixer@702dbb00 {
+ status = "okay";
+
+@@ -1335,6 +1327,14 @@ xbar_ope2_out_ep: endpoint {
+ };
+ };
+ };
++
++ dma-controller@702e2000 {
++ status = "okay";
++ };
++
++ interrupt-controller@702f9000 {
++ status = "okay";
++ };
+ };
+
+ sound {
+diff --git a/arch/arm64/boot/dts/nvidia/tegra210-p2595.dtsi b/arch/arm64/boot/dts/nvidia/tegra210-p2595.dtsi
+index 6ae292da72949..65181da730fa6 100644
+--- a/arch/arm64/boot/dts/nvidia/tegra210-p2595.dtsi
++++ b/arch/arm64/boot/dts/nvidia/tegra210-p2595.dtsi
+@@ -1,4 +1,7 @@
+ // SPDX-License-Identifier: GPL-2.0
++
++#include <dt-bindings/pinctrl/pinctrl-tegra.h>
++
+ / {
+ model = "NVIDIA Tegra210 P2595 I/O board";
+ compatible = "nvidia,p2595", "nvidia,tegra210";
+diff --git a/arch/arm64/boot/dts/nvidia/tegra210-p2597.dtsi b/arch/arm64/boot/dts/nvidia/tegra210-p2597.dtsi
+index a87e103f3828d..b4a1108c2dd74 100644
+--- a/arch/arm64/boot/dts/nvidia/tegra210-p2597.dtsi
++++ b/arch/arm64/boot/dts/nvidia/tegra210-p2597.dtsi
+@@ -1,5 +1,8 @@
+ // SPDX-License-Identifier: GPL-2.0
++
++#include <dt-bindings/gpio/tegra-gpio.h>
+ #include <dt-bindings/input/input.h>
++#include <dt-bindings/pinctrl/pinctrl-tegra.h>
+
+ / {
+ model = "NVIDIA Tegra210 P2597 I/O board";
+diff --git a/arch/arm64/boot/dts/nvidia/tegra210-p2894.dtsi b/arch/arm64/boot/dts/nvidia/tegra210-p2894.dtsi
+index 8e657b10569d6..1f263fd32a7a0 100644
+--- a/arch/arm64/boot/dts/nvidia/tegra210-p2894.dtsi
++++ b/arch/arm64/boot/dts/nvidia/tegra210-p2894.dtsi
+@@ -1342,7 +1342,35 @@ pmic: pmic@3c {
+ pinctrl-names = "default";
+ pinctrl-0 = <&max77620_default>;
+
+- max77620_default: pinmux@0 {
++ fps {
++ #address-cells = <1>;
++ #size-cells = <0>;
++
++ fps0 {
++ reg = <0>;
++ maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN0>;
++ };
++
++ fps1 {
++ reg = <1>;
++ maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN1>;
++ maxim,device-state-on-disabled-event = <MAX77620_FPS_INACTIVE_STATE_SLEEP>;
++ };
++
++ fps2 {
++ reg = <2>;
++ maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN0>;
++ };
++ };
++
++ hog-0 {
++ gpio-hog;
++ output-high;
++ gpios = <2 GPIO_ACTIVE_HIGH>,
++ <7 GPIO_ACTIVE_HIGH>;
++ };
++
++ max77620_default: pinmux {
+ gpio0 {
+ pins = "gpio0";
+ function = "gpio";
+@@ -1383,34 +1411,6 @@ gpio5_6_7 {
+ };
+ };
+
+- hog-0 {
+- gpio-hog;
+- output-high;
+- gpios = <2 GPIO_ACTIVE_HIGH>,
+- <7 GPIO_ACTIVE_HIGH>;
+- };
+-
+- fps {
+- #address-cells = <1>;
+- #size-cells = <0>;
+-
+- fps0 {
+- reg = <0>;
+- maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN0>;
+- };
+-
+- fps1 {
+- reg = <1>;
+- maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN1>;
+- maxim,device-state-on-disabled-event = <MAX77620_FPS_INACTIVE_STATE_SLEEP>;
+- };
+-
+- fps2 {
+- reg = <2>;
+- maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN0>;
+- };
+- };
+-
+ regulators {
+ in-ldo0-1-supply = <&max77620_sd2>;
+ in-ldo7-8-supply = <&max77620_sd2>;
+@@ -1592,20 +1592,6 @@ clk32k_in: clock-32k {
+ #clock-cells = <0>;
+ };
+
+- gpio-keys {
+- compatible = "gpio-keys";
+- status = "okay";
+-
+- key-power {
+- debounce-interval = <30>;
+- gpios = <&gpio TEGRA_GPIO(X, 7) GPIO_ACTIVE_LOW>;
+- label = "Power";
+- linux,code = <KEY_POWER>;
+- wakeup-event-action = <EV_ACT_ASSERTED>;
+- wakeup-source;
+- };
+- };
+-
+ cpus {
+ cpu@0 {
+ enable-method = "psci";
+@@ -1630,6 +1616,20 @@ cpu-sleep {
+ };
+ };
+
++ gpio-keys {
++ compatible = "gpio-keys";
++ status = "okay";
++
++ key-power {
++ debounce-interval = <30>;
++ gpios = <&gpio TEGRA_GPIO(X, 7) GPIO_ACTIVE_LOW>;
++ label = "Power";
++ linux,code = <KEY_POWER>;
++ wakeup-event-action = <EV_ACT_ASSERTED>;
++ wakeup-source;
++ };
++ };
++
+ psci {
+ compatible = "arm,psci-1.0";
+ method = "smc";
+diff --git a/arch/arm64/boot/dts/nvidia/tegra210-p3450-0000.dts b/arch/arm64/boot/dts/nvidia/tegra210-p3450-0000.dts
+index 2041371ea7ff8..c9f488e14f377 100644
+--- a/arch/arm64/boot/dts/nvidia/tegra210-p3450-0000.dts
++++ b/arch/arm64/boot/dts/nvidia/tegra210-p3450-0000.dts
+@@ -186,6 +186,22 @@ pmic: pmic@3c {
+ pinctrl-names = "default";
+ pinctrl-0 = <&max77620_default>;
+
++ fps {
++ fps0 {
++ maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN0>;
++ maxim,suspend-fps-time-period-us = <5120>;
++ };
++
++ fps1 {
++ maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN1>;
++ maxim,suspend-fps-time-period-us = <5120>;
++ };
++
++ fps2 {
++ maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN0>;
++ };
++ };
++
+ max77620_default: pinmux {
+ gpio0 {
+ pins = "gpio0";
+@@ -231,22 +247,6 @@ gpio5_6_7 {
+ };
+ };
+
+- fps {
+- fps0 {
+- maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN0>;
+- maxim,suspend-fps-time-period-us = <5120>;
+- };
+-
+- fps1 {
+- maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN1>;
+- maxim,suspend-fps-time-period-us = <5120>;
+- };
+-
+- fps2 {
+- maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN0>;
+- };
+- };
+-
+ regulators {
+ in-ldo0-1-supply = <&vdd_pre>;
+ in-ldo2-supply = <&vdd_3v3_sys>;
+@@ -611,14 +611,6 @@ clock@70110000 {
+ aconnect@702c0000 {
+ status = "okay";
+
+- dma-controller@702e2000 {
+- status = "okay";
+- };
+-
+- interrupt-controller@702f9000 {
+- status = "okay";
+- };
+-
+ ahub@702d0800 {
+ status = "okay";
+
+@@ -678,56 +670,6 @@ i2s4_dap_ep: endpoint {
+ };
+ };
+
+- dmic@702d4000 {
+- status = "okay";
+-
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
+-
+- port@0 {
+- reg = <0>;
+-
+- dmic1_cif_ep: endpoint {
+- remote-endpoint = <&xbar_dmic1_ep>;
+- };
+- };
+-
+- dmic1_port: port@1 {
+- reg = <1>;
+-
+- dmic1_dap_ep: endpoint {
+- /* Placeholder for external Codec */
+- };
+- };
+- };
+- };
+-
+- dmic@702d4100 {
+- status = "okay";
+-
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
+-
+- port@0 {
+- reg = <0>;
+-
+- dmic2_cif_ep: endpoint {
+- remote-endpoint = <&xbar_dmic2_ep>;
+- };
+- };
+-
+- dmic2_port: port@1 {
+- reg = <1>;
+-
+- dmic2_dap_ep: endpoint {
+- /* Placeholder for external Codec */
+- };
+- };
+- };
+- };
+-
+ sfc@702d2000 {
+ status = "okay";
+
+@@ -828,56 +770,6 @@ sfc4_cif_out_ep: endpoint {
+ };
+ };
+
+- mvc@702da000 {
+- status = "okay";
+-
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
+-
+- port@0 {
+- reg = <0>;
+-
+- mvc1_cif_in_ep: endpoint {
+- remote-endpoint = <&xbar_mvc1_in_ep>;
+- };
+- };
+-
+- mvc1_out_port: port@1 {
+- reg = <1>;
+-
+- mvc1_cif_out_ep: endpoint {
+- remote-endpoint = <&xbar_mvc1_out_ep>;
+- };
+- };
+- };
+- };
+-
+- mvc@702da200 {
+- status = "okay";
+-
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
+-
+- port@0 {
+- reg = <0>;
+-
+- mvc2_cif_in_ep: endpoint {
+- remote-endpoint = <&xbar_mvc2_in_ep>;
+- };
+- };
+-
+- mvc2_out_port: port@1 {
+- reg = <1>;
+-
+- mvc2_cif_out_ep: endpoint {
+- remote-endpoint = <&xbar_mvc2_out_ep>;
+- };
+- };
+- };
+- };
+-
+ amx@702d3000 {
+ status = "okay";
+
+@@ -1074,6 +966,56 @@ adx2_out4_ep: endpoint {
+ };
+ };
+
++ dmic@702d4000 {
++ status = "okay";
++
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
++
++ port@0 {
++ reg = <0>;
++
++ dmic1_cif_ep: endpoint {
++ remote-endpoint = <&xbar_dmic1_ep>;
++ };
++ };
++
++ dmic1_port: port@1 {
++ reg = <1>;
++
++ dmic1_dap_ep: endpoint {
++ /* Placeholder for external Codec */
++ };
++ };
++ };
++ };
++
++ dmic@702d4100 {
++ status = "okay";
++
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
++
++ port@0 {
++ reg = <0>;
++
++ dmic2_cif_ep: endpoint {
++ remote-endpoint = <&xbar_dmic2_ep>;
++ };
++ };
++
++ dmic2_port: port@1 {
++ reg = <1>;
++
++ dmic2_dap_ep: endpoint {
++ /* Placeholder for external Codec */
++ };
++ };
++ };
++ };
++
+ processing-engine@702d8000 {
+ status = "okay";
+
+@@ -1124,6 +1066,56 @@ ope2_cif_out_ep: endpoint {
+ };
+ };
+
++ mvc@702da000 {
++ status = "okay";
++
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
++
++ port@0 {
++ reg = <0>;
++
++ mvc1_cif_in_ep: endpoint {
++ remote-endpoint = <&xbar_mvc1_in_ep>;
++ };
++ };
++
++ mvc1_out_port: port@1 {
++ reg = <1>;
++
++ mvc1_cif_out_ep: endpoint {
++ remote-endpoint = <&xbar_mvc1_out_ep>;
++ };
++ };
++ };
++ };
++
++ mvc@702da200 {
++ status = "okay";
++
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
++
++ port@0 {
++ reg = <0>;
++
++ mvc2_cif_in_ep: endpoint {
++ remote-endpoint = <&xbar_mvc2_in_ep>;
++ };
++ };
++
++ mvc2_out_port: port@1 {
++ reg = <1>;
++
++ mvc2_cif_out_ep: endpoint {
++ remote-endpoint = <&xbar_mvc2_out_ep>;
++ };
++ };
++ };
++ };
++
+ amixer@702dbb00 {
+ status = "okay";
+
+@@ -1695,6 +1687,14 @@ xbar_ope2_out_ep: endpoint {
+ };
+ };
+ };
++
++ dma-controller@702e2000 {
++ status = "okay";
++ };
++
++ interrupt-controller@702f9000 {
++ status = "okay";
++ };
+ };
+
+ spi@70410000 {
+@@ -1739,69 +1739,17 @@ cpu-sleep {
+ };
+ };
+
+- fan: pwm-fan {
+- compatible = "pwm-fan";
+- pwms = <&pwm 3 45334>;
+-
+- cooling-levels = <0 64 128 255>;
+- #cooling-cells = <2>;
+- };
+-
+- thermal-zones {
+- cpu-thermal {
+- trips {
+- cpu_trip_critical: critical {
+- temperature = <96500>;
+- hysteresis = <0>;
+- type = "critical";
+- };
+-
+- cpu_trip_hot: hot {
+- temperature = <70000>;
+- hysteresis = <2000>;
+- type = "hot";
+- };
+-
+- cpu_trip_active: active {
+- temperature = <50000>;
+- hysteresis = <2000>;
+- type = "active";
+- };
+-
+- cpu_trip_passive: passive {
+- temperature = <30000>;
+- hysteresis = <2000>;
+- type = "passive";
+- };
+- };
+-
+- cooling-maps {
+- cpu-critical {
+- cooling-device = <&fan 3 3>;
+- trip = <&cpu_trip_critical>;
+- };
+-
+- cpu-hot {
+- cooling-device = <&fan 2 2>;
+- trip = <&cpu_trip_hot>;
+- };
+-
+- cpu-active {
+- cooling-device = <&fan 1 1>;
+- trip = <&cpu_trip_active>;
+- };
+-
+- cpu-passive {
+- cooling-device = <&fan 0 0>;
+- trip = <&cpu_trip_passive>;
+- };
+- };
+- };
+- };
+-
+ gpio-keys {
+ compatible = "gpio-keys";
+
++ key-force-recovery {
++ label = "Force Recovery";
++ gpios = <&gpio TEGRA_GPIO(X, 6) GPIO_ACTIVE_LOW>;
++ linux,input-type = <EV_KEY>;
++ linux,code = <BTN_1>;
++ debounce-interval = <30>;
++ };
++
+ key-power {
+ label = "Power";
+ gpios = <&gpio TEGRA_GPIO(X, 5) GPIO_ACTIVE_LOW>;
+@@ -1811,14 +1759,6 @@ key-power {
+ wakeup-event-action = <EV_ACT_ASSERTED>;
+ wakeup-source;
+ };
+-
+- key-force-recovery {
+- label = "Force Recovery";
+- gpios = <&gpio TEGRA_GPIO(X, 6) GPIO_ACTIVE_LOW>;
+- linux,input-type = <EV_KEY>;
+- linux,code = <BTN_1>;
+- debounce-interval = <30>;
+- };
+ };
+
+ psci {
+@@ -1826,6 +1766,14 @@ psci {
+ method = "smc";
+ };
+
++ fan: pwm-fan {
++ compatible = "pwm-fan";
++ pwms = <&pwm 3 45334>;
++
++ cooling-levels = <0 64 128 255>;
++ #cooling-cells = <2>;
++ };
++
+ vdd_5v0_sys: regulator-vdd-5v0-sys {
+ compatible = "regulator-fixed";
+
+@@ -1986,4 +1934,56 @@ sound {
+
+ label = "NVIDIA Jetson Nano APE";
+ };
++
++ thermal-zones {
++ cpu-thermal {
++ trips {
++ cpu_trip_critical: critical {
++ temperature = <96500>;
++ hysteresis = <0>;
++ type = "critical";
++ };
++
++ cpu_trip_hot: hot {
++ temperature = <70000>;
++ hysteresis = <2000>;
++ type = "hot";
++ };
++
++ cpu_trip_active: active {
++ temperature = <50000>;
++ hysteresis = <2000>;
++ type = "active";
++ };
++
++ cpu_trip_passive: passive {
++ temperature = <30000>;
++ hysteresis = <2000>;
++ type = "passive";
++ };
++ };
++
++ cooling-maps {
++ cpu-critical {
++ cooling-device = <&fan 3 3>;
++ trip = <&cpu_trip_critical>;
++ };
++
++ cpu-hot {
++ cooling-device = <&fan 2 2>;
++ trip = <&cpu_trip_hot>;
++ };
++
++ cpu-active {
++ cooling-device = <&fan 1 1>;
++ trip = <&cpu_trip_active>;
++ };
++
++ cpu-passive {
++ cooling-device = <&fan 0 0>;
++ trip = <&cpu_trip_passive>;
++ };
++ };
++ };
++ };
+ };
+diff --git a/arch/arm64/boot/dts/nvidia/tegra210-smaug.dts b/arch/arm64/boot/dts/nvidia/tegra210-smaug.dts
+index 7c569695b7052..d7d7c63e62e25 100644
+--- a/arch/arm64/boot/dts/nvidia/tegra210-smaug.dts
++++ b/arch/arm64/boot/dts/nvidia/tegra210-smaug.dts
+@@ -1389,6 +1389,23 @@ pmic: pmic@3c {
+ pinctrl-names = "default";
+ pinctrl-0 = <&max77620_default>;
+
++ fps {
++ fps0 {
++ maxim,shutdown-fps-time-period-us = <5120>;
++ maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN0>;
++ };
++
++ fps1 {
++ maxim,shutdown-fps-time-period-us = <5120>;
++ maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN1>;
++ maxim,device-state-on-disabled-event = <MAX77620_FPS_INACTIVE_STATE_SLEEP>;
++ };
++
++ fps2 {
++ maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN0>;
++ };
++ };
++
+ max77620_default: pinmux {
+ gpio0_1_2_7 {
+ pins = "gpio0", "gpio1", "gpio2", "gpio7";
+@@ -1409,32 +1426,15 @@ gpio3 {
+ maxim,active-fps-power-down-slot = <2>;
+ };
+
+- gpio5_6 {
+- pins = "gpio5", "gpio6";
+- function = "gpio";
+- drive-push-pull = <1>;
+- };
+-
+ gpio4 {
+ pins = "gpio4";
+ function = "32k-out1";
+ };
+- };
+-
+- fps {
+- fps0 {
+- maxim,shutdown-fps-time-period-us = <5120>;
+- maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN0>;
+- };
+-
+- fps1 {
+- maxim,shutdown-fps-time-period-us = <5120>;
+- maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN1>;
+- maxim,device-state-on-disabled-event = <MAX77620_FPS_INACTIVE_STATE_SLEEP>;
+- };
+
+- fps2 {
+- maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN0>;
++ gpio5_6 {
++ pins = "gpio5", "gpio6";
++ function = "gpio";
++ drive-push-pull = <1>;
+ };
+ };
+
+@@ -1800,6 +1800,18 @@ key-power {
+ wakeup-source;
+ };
+
++ key-volume-down {
++ label = "Volume Down";
++ gpios = <&gpio TEGRA_GPIO(X, 7) GPIO_ACTIVE_LOW>;
++ linux,code = <KEY_VOLUMEDOWN>;
++ };
++
++ key-volume-up {
++ label = "Volume Up";
++ gpios = <&gpio TEGRA_GPIO(M, 4) GPIO_ACTIVE_LOW>;
++ linux,code = <KEY_VOLUMEUP>;
++ };
++
+ switch-lid {
+ label = "Lid";
+ gpios = <&gpio TEGRA_GPIO(B, 4) GPIO_ACTIVE_LOW>;
+@@ -1815,18 +1827,6 @@ switch-tablet-mode {
+ linux,code = <SW_TABLET_MODE>;
+ wakeup-source;
+ };
+-
+- key-volume-down {
+- label = "Volume Down";
+- gpios = <&gpio TEGRA_GPIO(X, 7) GPIO_ACTIVE_LOW>;
+- linux,code = <KEY_VOLUMEDOWN>;
+- };
+-
+- key-volume-up {
+- label = "Volume Up";
+- gpios = <&gpio TEGRA_GPIO(M, 4) GPIO_ACTIVE_LOW>;
+- linux,code = <KEY_VOLUMEUP>;
+- };
+ };
+
+ max98357a {
+diff --git a/arch/arm64/boot/dts/nvidia/tegra210.dtsi b/arch/arm64/boot/dts/nvidia/tegra210.dtsi
+index bc0cacb20d7a3..980565bf02c9d 100644
+--- a/arch/arm64/boot/dts/nvidia/tegra210.dtsi
++++ b/arch/arm64/boot/dts/nvidia/tegra210.dtsi
+@@ -555,19 +555,19 @@ pinmux: pinmux@700008d4 {
+ reg = <0x0 0x700008d4 0x0 0x29c>, /* Pad control registers */
+ <0x0 0x70003000 0x0 0x294>; /* Mux registers */
+
+- sdmmc1_3v3_drv: pinmux-sdmmc1-3v3-drv {
++ sdmmc1_1v8_drv: pinmux-sdmmc1-1v8-drv {
+ sdmmc1 {
+ nvidia,pins = "drive_sdmmc1";
+- nvidia,pull-down-strength = <0x8>;
+- nvidia,pull-up-strength = <0x8>;
++ nvidia,pull-down-strength = <0x4>;
++ nvidia,pull-up-strength = <0x3>;
+ };
+ };
+
+- sdmmc1_1v8_drv: pinmux-sdmmc1-1v8-drv {
++ sdmmc1_3v3_drv: pinmux-sdmmc1-3v3-drv {
+ sdmmc1 {
+ nvidia,pins = "drive_sdmmc1";
+- nvidia,pull-down-strength = <0x4>;
+- nvidia,pull-up-strength = <0x3>;
++ nvidia,pull-down-strength = <0x8>;
++ nvidia,pull-up-strength = <0x8>;
+ };
+ };
+
+@@ -579,19 +579,19 @@ sdmmc2 {
+ };
+ };
+
+- sdmmc3_3v3_drv: pinmux-sdmmc3-3v3-drv {
++ sdmmc3_1v8_drv: pinmux-sdmmc3-1v8-drv {
+ sdmmc3 {
+ nvidia,pins = "drive_sdmmc3";
+- nvidia,pull-down-strength = <0x8>;
+- nvidia,pull-up-strength = <0x8>;
++ nvidia,pull-down-strength = <0x4>;
++ nvidia,pull-up-strength = <0x3>;
+ };
+ };
+
+- sdmmc3_1v8_drv: pinmux-sdmmc3-1v8-drv {
++ sdmmc3_3v3_drv: pinmux-sdmmc3-3v3-drv {
+ sdmmc3 {
+ nvidia,pins = "drive_sdmmc3";
+- nvidia,pull-down-strength = <0x4>;
+- nvidia,pull-up-strength = <0x3>;
++ nvidia,pull-down-strength = <0x8>;
++ nvidia,pull-up-strength = <0x8>;
+ };
+ };
+
+@@ -852,6 +852,38 @@ tegra_pmc: pmc@7000e400 {
+ #interrupt-cells = <2>;
+ interrupt-controller;
+
++ pinmux {
++ pex_dpd_disable: pex-dpd-disable {
++ pins = "pex-bias", "pex-clk1", "pex-clk2";
++ low-power-disable;
++ };
++
++ pex_dpd_enable: pex-dpd-enable {
++ pins = "pex-bias", "pex-clk1", "pex-clk2";
++ low-power-enable;
++ };
++
++ sdmmc1_1v8: sdmmc1-1v8 {
++ pins = "sdmmc1";
++ power-source = <TEGRA_IO_PAD_VOLTAGE_1V8>;
++ };
++
++ sdmmc1_3v3: sdmmc1-3v3 {
++ pins = "sdmmc1";
++ power-source = <TEGRA_IO_PAD_VOLTAGE_3V3>;
++ };
++
++ sdmmc3_1v8: sdmmc3-1v8 {
++ pins = "sdmmc3";
++ power-source = <TEGRA_IO_PAD_VOLTAGE_1V8>;
++ };
++
++ sdmmc3_3v3: sdmmc3-3v3 {
++ pins = "sdmmc3";
++ power-source = <TEGRA_IO_PAD_VOLTAGE_3V3>;
++ };
++ };
++
+ powergates {
+ pd_audio: aud {
+ clocks = <&tegra_car TEGRA210_CLK_APE>,
+@@ -881,21 +913,12 @@ pd_sor: sor {
+ #power-domain-cells = <0>;
+ };
+
+- pd_xusbss: xusba {
+- clocks = <&tegra_car TEGRA210_CLK_XUSB_SS>;
+- resets = <&tegra_car TEGRA210_CLK_XUSB_SS>;
+- #power-domain-cells = <0>;
+- };
+-
+- pd_xusbdev: xusbb {
+- clocks = <&tegra_car TEGRA210_CLK_XUSB_DEV>;
+- resets = <&tegra_car 95>;
+- #power-domain-cells = <0>;
+- };
+-
+- pd_xusbhost: xusbc {
+- clocks = <&tegra_car TEGRA210_CLK_XUSB_HOST>;
+- resets = <&tegra_car TEGRA210_CLK_XUSB_HOST>;
++ pd_venc: venc {
++ clocks = <&tegra_car TEGRA210_CLK_VI>,
++ <&tegra_car TEGRA210_CLK_CSI>;
++ resets = <&mc TEGRA210_MC_RESET_VI>,
++ <&tegra_car 20>,
++ <&tegra_car 52>;
+ #power-domain-cells = <0>;
+ };
+
+@@ -907,45 +930,22 @@ pd_vic: vic {
+ #power-domain-cells = <0>;
+ };
+
+- pd_venc: venc {
+- clocks = <&tegra_car TEGRA210_CLK_VI>,
+- <&tegra_car TEGRA210_CLK_CSI>;
+- resets = <&mc TEGRA210_MC_RESET_VI>,
+- <&tegra_car 20>,
+- <&tegra_car 52>;
++ pd_xusbss: xusba {
++ clocks = <&tegra_car TEGRA210_CLK_XUSB_SS>;
++ resets = <&tegra_car TEGRA210_CLK_XUSB_SS>;
+ #power-domain-cells = <0>;
+ };
+- };
+-
+- pinmux {
+- sdmmc1_3v3: sdmmc1-3v3 {
+- pins = "sdmmc1";
+- power-source = <TEGRA_IO_PAD_VOLTAGE_3V3>;
+- };
+-
+- sdmmc1_1v8: sdmmc1-1v8 {
+- pins = "sdmmc1";
+- power-source = <TEGRA_IO_PAD_VOLTAGE_1V8>;
+- };
+
+- sdmmc3_3v3: sdmmc3-3v3 {
+- pins = "sdmmc3";
+- power-source = <TEGRA_IO_PAD_VOLTAGE_3V3>;
+- };
+-
+- sdmmc3_1v8: sdmmc3-1v8 {
+- pins = "sdmmc3";
+- power-source = <TEGRA_IO_PAD_VOLTAGE_1V8>;
+- };
+-
+- pex_dpd_disable: pex-dpd-disable {
+- pins = "pex-bias", "pex-clk1", "pex-clk2";
+- low-power-disable;
++ pd_xusbdev: xusbb {
++ clocks = <&tegra_car TEGRA210_CLK_XUSB_DEV>;
++ resets = <&tegra_car 95>;
++ #power-domain-cells = <0>;
+ };
+
+- pex_dpd_enable: pex-dpd-enable {
+- pins = "pex-bias", "pex-clk1", "pex-clk2";
+- low-power-enable;
++ pd_xusbhost: xusbc {
++ clocks = <&tegra_car TEGRA210_CLK_XUSB_HOST>;
++ resets = <&tegra_car TEGRA210_CLK_XUSB_HOST>;
++ #power-domain-cells = <0>;
+ };
+ };
+ };
+@@ -1388,50 +1388,6 @@ aconnect@702c0000 {
+ ranges = <0x702c0000 0x0 0x702c0000 0x00040000>;
+ status = "disabled";
+
+- adma: dma-controller@702e2000 {
+- compatible = "nvidia,tegra210-adma";
+- reg = <0x702e2000 0x2000>;
+- interrupt-parent = <&agic>;
+- interrupts = <GIC_SPI 24 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 25 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 26 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 27 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 28 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 29 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 30 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 31 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 32 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 33 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 34 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 35 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 36 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 37 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 38 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 39 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 40 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 41 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 42 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 43 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 44 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 45 IRQ_TYPE_LEVEL_HIGH>;
+- #dma-cells = <1>;
+- clocks = <&tegra_car TEGRA210_CLK_D_AUDIO>;
+- clock-names = "d_audio";
+- status = "disabled";
+- };
+-
+- agic: interrupt-controller@702f9000 {
+- compatible = "nvidia,tegra210-agic";
+- #interrupt-cells = <3>;
+- interrupt-controller;
+- reg = <0x702f9000 0x1000>,
+- <0x702fa000 0x2000>;
+- interrupts = <GIC_SPI 102 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_HIGH)>;
+- clocks = <&tegra_car TEGRA210_CLK_APE>;
+- clock-names = "clk";
+- status = "disabled";
+- };
+-
+ tegra_ahub: ahub@702d0800 {
+ compatible = "nvidia,tegra210-ahub";
+ reg = <0x702d0800 0x800>;
+@@ -1620,42 +1576,6 @@ tegra_i2s5: i2s@702d1400 {
+ status = "disabled";
+ };
+
+- tegra_dmic1: dmic@702d4000 {
+- compatible = "nvidia,tegra210-dmic";
+- reg = <0x702d4000 0x100>;
+- clocks = <&tegra_car TEGRA210_CLK_DMIC1>;
+- clock-names = "dmic";
+- assigned-clocks = <&tegra_car TEGRA210_CLK_DMIC1>;
+- assigned-clock-parents = <&tegra_car TEGRA210_CLK_PLL_A_OUT0>;
+- assigned-clock-rates = <3072000>;
+- sound-name-prefix = "DMIC1";
+- status = "disabled";
+- };
+-
+- tegra_dmic2: dmic@702d4100 {
+- compatible = "nvidia,tegra210-dmic";
+- reg = <0x702d4100 0x100>;
+- clocks = <&tegra_car TEGRA210_CLK_DMIC2>;
+- clock-names = "dmic";
+- assigned-clocks = <&tegra_car TEGRA210_CLK_DMIC2>;
+- assigned-clock-parents = <&tegra_car TEGRA210_CLK_PLL_A_OUT0>;
+- assigned-clock-rates = <3072000>;
+- sound-name-prefix = "DMIC2";
+- status = "disabled";
+- };
+-
+- tegra_dmic3: dmic@702d4200 {
+- compatible = "nvidia,tegra210-dmic";
+- reg = <0x702d4200 0x100>;
+- clocks = <&tegra_car TEGRA210_CLK_DMIC3>;
+- clock-names = "dmic";
+- assigned-clocks = <&tegra_car TEGRA210_CLK_DMIC3>;
+- assigned-clock-parents = <&tegra_car TEGRA210_CLK_PLL_A_OUT0>;
+- assigned-clock-rates = <3072000>;
+- sound-name-prefix = "DMIC3";
+- status = "disabled";
+- };
+-
+ tegra_sfc1: sfc@702d2000 {
+ compatible = "nvidia,tegra210-sfc";
+ reg = <0x702d2000 0x200>;
+@@ -1684,20 +1604,6 @@ tegra_sfc4: sfc@702d2600 {
+ status = "disabled";
+ };
+
+- tegra_mvc1: mvc@702da000 {
+- compatible = "nvidia,tegra210-mvc";
+- reg = <0x702da000 0x200>;
+- sound-name-prefix = "MVC1";
+- status = "disabled";
+- };
+-
+- tegra_mvc2: mvc@702da200 {
+- compatible = "nvidia,tegra210-mvc";
+- reg = <0x702da200 0x200>;
+- sound-name-prefix = "MVC2";
+- status = "disabled";
+- };
+-
+ tegra_amx1: amx@702d3000 {
+ compatible = "nvidia,tegra210-amx";
+ reg = <0x702d3000 0x100>;
+@@ -1726,6 +1632,42 @@ tegra_adx2: adx@702d3900 {
+ status = "disabled";
+ };
+
++ tegra_dmic1: dmic@702d4000 {
++ compatible = "nvidia,tegra210-dmic";
++ reg = <0x702d4000 0x100>;
++ clocks = <&tegra_car TEGRA210_CLK_DMIC1>;
++ clock-names = "dmic";
++ assigned-clocks = <&tegra_car TEGRA210_CLK_DMIC1>;
++ assigned-clock-parents = <&tegra_car TEGRA210_CLK_PLL_A_OUT0>;
++ assigned-clock-rates = <3072000>;
++ sound-name-prefix = "DMIC1";
++ status = "disabled";
++ };
++
++ tegra_dmic2: dmic@702d4100 {
++ compatible = "nvidia,tegra210-dmic";
++ reg = <0x702d4100 0x100>;
++ clocks = <&tegra_car TEGRA210_CLK_DMIC2>;
++ clock-names = "dmic";
++ assigned-clocks = <&tegra_car TEGRA210_CLK_DMIC2>;
++ assigned-clock-parents = <&tegra_car TEGRA210_CLK_PLL_A_OUT0>;
++ assigned-clock-rates = <3072000>;
++ sound-name-prefix = "DMIC2";
++ status = "disabled";
++ };
++
++ tegra_dmic3: dmic@702d4200 {
++ compatible = "nvidia,tegra210-dmic";
++ reg = <0x702d4200 0x100>;
++ clocks = <&tegra_car TEGRA210_CLK_DMIC3>;
++ clock-names = "dmic";
++ assigned-clocks = <&tegra_car TEGRA210_CLK_DMIC3>;
++ assigned-clock-parents = <&tegra_car TEGRA210_CLK_PLL_A_OUT0>;
++ assigned-clock-rates = <3072000>;
++ sound-name-prefix = "DMIC3";
++ status = "disabled";
++ };
++
+ tegra_ope1: processing-engine@702d8000 {
+ compatible = "nvidia,tegra210-ope";
+ reg = <0x702d8000 0x100>;
+@@ -1766,6 +1708,20 @@ dynamic-range-compressor@702d8600 {
+ };
+ };
+
++ tegra_mvc1: mvc@702da000 {
++ compatible = "nvidia,tegra210-mvc";
++ reg = <0x702da000 0x200>;
++ sound-name-prefix = "MVC1";
++ status = "disabled";
++ };
++
++ tegra_mvc2: mvc@702da200 {
++ compatible = "nvidia,tegra210-mvc";
++ reg = <0x702da200 0x200>;
++ sound-name-prefix = "MVC2";
++ status = "disabled";
++ };
++
+ tegra_amixer: amixer@702dbb00 {
+ compatible = "nvidia,tegra210-amixer";
+ reg = <0x702dbb00 0x800>;
+@@ -1856,6 +1812,50 @@ xbar_admaif10_ep: endpoint {
+ };
+ };
+ };
++
++ adma: dma-controller@702e2000 {
++ compatible = "nvidia,tegra210-adma";
++ reg = <0x702e2000 0x2000>;
++ interrupt-parent = <&agic>;
++ interrupts = <GIC_SPI 24 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 25 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 26 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 27 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 28 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 29 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 30 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 31 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 32 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 33 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 34 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 35 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 36 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 37 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 38 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 39 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 40 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 41 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 42 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 43 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 44 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 45 IRQ_TYPE_LEVEL_HIGH>;
++ #dma-cells = <1>;
++ clocks = <&tegra_car TEGRA210_CLK_D_AUDIO>;
++ clock-names = "d_audio";
++ status = "disabled";
++ };
++
++ agic: interrupt-controller@702f9000 {
++ compatible = "nvidia,tegra210-agic";
++ #interrupt-cells = <3>;
++ interrupt-controller;
++ reg = <0x702f9000 0x1000>,
++ <0x702fa000 0x2000>;
++ interrupts = <GIC_SPI 102 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_HIGH)>;
++ clocks = <&tegra_car TEGRA210_CLK_APE>;
++ clock-names = "clk";
++ status = "disabled";
++ };
+ };
+
+ spi@70410000 {
+diff --git a/arch/arm64/boot/dts/nvidia/tegra234-p3701-0000.dtsi b/arch/arm64/boot/dts/nvidia/tegra234-p3701-0000.dtsi
+index 8b86ea9cb50c1..07aa5dc83fc6b 100644
+--- a/arch/arm64/boot/dts/nvidia/tegra234-p3701-0000.dtsi
++++ b/arch/arm64/boot/dts/nvidia/tegra234-p3701-0000.dtsi
+@@ -6,41 +6,6 @@ / {
+ model = "NVIDIA Jetson AGX Orin";
+ compatible = "nvidia,p3701-0000", "nvidia,tegra234";
+
+- vdd_1v8_ls: regulator-vdd-1v8-ls {
+- compatible = "regulator-fixed";
+- regulator-name = "VDD_1V8_LS";
+- regulator-min-microvolt = <1800000>;
+- regulator-max-microvolt = <1800000>;
+- regulator-always-on;
+- };
+-
+- vdd_1v8_ao: regulator-vdd-1v8-ao {
+- compatible = "regulator-fixed";
+- regulator-name = "VDD_1V8_AO";
+- regulator-min-microvolt = <1800000>;
+- regulator-max-microvolt = <1800000>;
+- regulator-always-on;
+- };
+-
+- vdd_3v3_pcie: regulator-vdd-3v3-pcie {
+- compatible = "regulator-fixed";
+- regulator-name = "VDD_3V3_PCIE";
+- regulator-min-microvolt = <3300000>;
+- regulator-max-microvolt = <3300000>;
+- gpio = <&gpio TEGRA234_MAIN_GPIO(Z, 2) GPIO_ACTIVE_HIGH>;
+- regulator-boot-on;
+- enable-active-high;
+- };
+-
+- vdd_12v_pcie: regulator-vdd-12v-pcie {
+- compatible = "regulator-fixed";
+- regulator-name = "VDD_12V_PCIE";
+- regulator-min-microvolt = <12000000>;
+- regulator-max-microvolt = <12000000>;
+- gpio = <&gpio TEGRA234_MAIN_GPIO(A, 1) GPIO_ACTIVE_LOW>;
+- regulator-boot-on;
+- };
+-
+ bus@0 {
+ spi@3270000 {
+ status = "okay";
+@@ -75,4 +40,39 @@ pmc@c360000 {
+ nvidia,invert-interrupt;
+ };
+ };
++
++ vdd_1v8_ls: regulator-vdd-1v8-ls {
++ compatible = "regulator-fixed";
++ regulator-name = "VDD_1V8_LS";
++ regulator-min-microvolt = <1800000>;
++ regulator-max-microvolt = <1800000>;
++ regulator-always-on;
++ };
++
++ vdd_1v8_ao: regulator-vdd-1v8-ao {
++ compatible = "regulator-fixed";
++ regulator-name = "VDD_1V8_AO";
++ regulator-min-microvolt = <1800000>;
++ regulator-max-microvolt = <1800000>;
++ regulator-always-on;
++ };
++
++ vdd_3v3_pcie: regulator-vdd-3v3-pcie {
++ compatible = "regulator-fixed";
++ regulator-name = "VDD_3V3_PCIE";
++ regulator-min-microvolt = <3300000>;
++ regulator-max-microvolt = <3300000>;
++ gpio = <&gpio TEGRA234_MAIN_GPIO(Z, 2) GPIO_ACTIVE_HIGH>;
++ regulator-boot-on;
++ enable-active-high;
++ };
++
++ vdd_12v_pcie: regulator-vdd-12v-pcie {
++ compatible = "regulator-fixed";
++ regulator-name = "VDD_12V_PCIE";
++ regulator-min-microvolt = <12000000>;
++ regulator-max-microvolt = <12000000>;
++ gpio = <&gpio TEGRA234_MAIN_GPIO(A, 1) GPIO_ACTIVE_LOW>;
++ regulator-boot-on;
++ };
+ };
+diff --git a/arch/arm64/boot/dts/nvidia/tegra234-p3737-0000+p3701-0000.dts b/arch/arm64/boot/dts/nvidia/tegra234-p3737-0000+p3701-0000.dts
+index 431f42a266f5b..a4d1be2d32929 100644
+--- a/arch/arm64/boot/dts/nvidia/tegra234-p3737-0000+p3701-0000.dts
++++ b/arch/arm64/boot/dts/nvidia/tegra234-p3737-0000+p3701-0000.dts
+@@ -17,6 +17,11 @@ aliases {
+ serial1 = &uarta;
+ };
+
++ chosen {
++ bootargs = "console=ttyTCU0,115200n8";
++ stdout-path = "serial0:115200n8";
++ };
++
+ bus@0 {
+ aconnect@2900000 {
+ status = "okay";
+@@ -24,997 +29,1001 @@ aconnect@2900000 {
+ ahub@2900800 {
+ status = "okay";
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ i2s@2901000 {
++ status = "okay";
+
+- port@0 {
+- reg = <0x0>;
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- xbar_admaif0: endpoint {
+- remote-endpoint = <&admaif0>;
++ port@0 {
++ reg = <0>;
++
++ i2s1_cif: endpoint {
++ remote-endpoint = <&xbar_i2s1>;
++ };
+ };
+- };
+
+- port@1 {
+- reg = <0x1>;
++ i2s1_port: port@1 {
++ reg = <1>;
+
+- xbar_admaif1: endpoint {
+- remote-endpoint = <&admaif1>;
++ i2s1_dap: endpoint {
++ dai-format = "i2s";
++ /* placeholder for external codec */
++ };
+ };
+ };
++ };
+
+- port@2 {
+- reg = <0x2>;
++ i2s@2901100 {
++ status = "okay";
+
+- xbar_admaif2: endpoint {
+- remote-endpoint = <&admaif2>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- port@3 {
+- reg = <0x3>;
++ port@0 {
++ reg = <0>;
+
+- xbar_admaif3: endpoint {
+- remote-endpoint = <&admaif3>;
++ i2s2_cif: endpoint {
++ remote-endpoint = <&xbar_i2s2>;
++ };
+ };
+- };
+
+- port@4 {
+- reg = <0x4>;
++ i2s2_port: port@1 {
++ reg = <1>;
+
+- xbar_admaif4: endpoint {
+- remote-endpoint = <&admaif4>;
++ i2s2_dap: endpoint {
++ dai-format = "i2s";
++ /* placeholder for external codec */
++ };
+ };
+ };
++ };
+
+- port@5 {
+- reg = <0x5>;
++ i2s@2901300 {
++ status = "okay";
+
+- xbar_admaif5: endpoint {
+- remote-endpoint = <&admaif5>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- port@6 {
+- reg = <0x6>;
++ port@0 {
++ reg = <0>;
+
+- xbar_admaif6: endpoint {
+- remote-endpoint = <&admaif6>;
++ i2s4_cif: endpoint {
++ remote-endpoint = <&xbar_i2s4>;
++ };
+ };
+- };
+
+- port@7 {
+- reg = <0x7>;
++ i2s4_port: port@1 {
++ reg = <1>;
+
+- xbar_admaif7: endpoint {
+- remote-endpoint = <&admaif7>;
++ i2s4_dap: endpoint {
++ dai-format = "i2s";
++ /* placeholder for external codec */
++ };
+ };
+ };
++ };
+
+- port@8 {
+- reg = <0x8>;
++ i2s@2901500 {
++ status = "okay";
+
+- xbar_admaif8: endpoint {
+- remote-endpoint = <&admaif8>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- port@9 {
+- reg = <0x9>;
++ port@0 {
++ reg = <0>;
+
+- xbar_admaif9: endpoint {
+- remote-endpoint = <&admaif9>;
++ i2s6_cif: endpoint {
++ remote-endpoint = <&xbar_i2s6>;
++ };
+ };
+- };
+
+- port@a {
+- reg = <0xa>;
++ i2s6_port: port@1 {
++ reg = <1>;
+
+- xbar_admaif10: endpoint {
+- remote-endpoint = <&admaif10>;
++ i2s6_dap: endpoint {
++ dai-format = "i2s";
++ /* placeholder for external codec */
++ };
+ };
+ };
++ };
+
+- port@b {
+- reg = <0xb>;
++ sfc@2902000 {
++ status = "okay";
+
+- xbar_admaif11: endpoint {
+- remote-endpoint = <&admaif11>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- port@c {
+- reg = <0xc>;
++ port@0 {
++ reg = <0>;
+
+- xbar_admaif12: endpoint {
+- remote-endpoint = <&admaif12>;
++ sfc1_cif_in: endpoint {
++ remote-endpoint = <&xbar_sfc1_in>;
++ };
+ };
+- };
+
+- port@d {
+- reg = <0xd>;
++ sfc1_out_port: port@1 {
++ reg = <1>;
+
+- xbar_admaif13: endpoint {
+- remote-endpoint = <&admaif13>;
++ sfc1_cif_out: endpoint {
++ remote-endpoint = <&xbar_sfc1_out>;
++ };
+ };
+ };
++ };
+
+- port@e {
+- reg = <0xe>;
++ sfc@2902200 {
++ status = "okay";
+
+- xbar_admaif14: endpoint {
+- remote-endpoint = <&admaif14>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- port@f {
+- reg = <0xf>;
++ port@0 {
++ reg = <0>;
+
+- xbar_admaif15: endpoint {
+- remote-endpoint = <&admaif15>;
++ sfc2_cif_in: endpoint {
++ remote-endpoint = <&xbar_sfc2_in>;
++ };
+ };
+- };
+
+- port@10 {
+- reg = <0x10>;
++ sfc2_out_port: port@1 {
++ reg = <1>;
+
+- xbar_admaif16: endpoint {
+- remote-endpoint = <&admaif16>;
++ sfc2_cif_out: endpoint {
++ remote-endpoint = <&xbar_sfc2_out>;
++ };
+ };
+ };
++ };
+
+- port@11 {
+- reg = <0x11>;
++ sfc@2902400 {
++ status = "okay";
+
+- xbar_admaif17: endpoint {
+- remote-endpoint = <&admaif17>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- port@12 {
+- reg = <0x12>;
++ port@0 {
++ reg = <0>;
+
+- xbar_admaif18: endpoint {
+- remote-endpoint = <&admaif18>;
++ sfc3_cif_in: endpoint {
++ remote-endpoint = <&xbar_sfc3_in>;
++ };
+ };
+- };
+
+- port@13 {
+- reg = <0x13>;
++ sfc3_out_port: port@1 {
++ reg = <1>;
+
+- xbar_admaif19: endpoint {
+- remote-endpoint = <&admaif19>;
++ sfc3_cif_out: endpoint {
++ remote-endpoint = <&xbar_sfc3_out>;
++ };
+ };
+ };
++ };
+
+- xbar_i2s1_port: port@14 {
+- reg = <0x14>;
++ sfc@2902600 {
++ status = "okay";
+
+- xbar_i2s1: endpoint {
+- remote-endpoint = <&i2s1_cif>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- xbar_i2s2_port: port@15 {
+- reg = <0x15>;
++ port@0 {
++ reg = <0>;
+
+- xbar_i2s2: endpoint {
+- remote-endpoint = <&i2s2_cif>;
++ sfc4_cif_in: endpoint {
++ remote-endpoint = <&xbar_sfc4_in>;
++ };
+ };
+- };
+
+- xbar_i2s4_port: port@17 {
+- reg = <0x17>;
++ sfc4_out_port: port@1 {
++ reg = <1>;
+
+- xbar_i2s4: endpoint {
+- remote-endpoint = <&i2s4_cif>;
++ sfc4_cif_out: endpoint {
++ remote-endpoint = <&xbar_sfc4_out>;
++ };
+ };
+ };
++ };
+
+- xbar_i2s6_port: port@19 {
+- reg = <0x19>;
+-
+- xbar_i2s6: endpoint {
+- remote-endpoint = <&i2s6_cif>;
+- };
+- };
+-
+- xbar_dmic3_port: port@1c {
+- reg = <0x1c>;
+-
+- xbar_dmic3: endpoint {
+- remote-endpoint = <&dmic3_cif>;
+- };
+- };
+-
+- xbar_sfc1_in_port: port@20 {
+- reg = <0x20>;
++ amx@2903000 {
++ status = "okay";
+
+- xbar_sfc1_in: endpoint {
+- remote-endpoint = <&sfc1_cif_in>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- port@21 {
+- reg = <0x21>;
++ port@0 {
++ reg = <0>;
+
+- xbar_sfc1_out: endpoint {
+- remote-endpoint = <&sfc1_cif_out>;
++ amx1_in1: endpoint {
++ remote-endpoint = <&xbar_amx1_in1>;
++ };
+ };
+- };
+
+- xbar_sfc2_in_port: port@22 {
+- reg = <0x22>;
++ port@1 {
++ reg = <1>;
+
+- xbar_sfc2_in: endpoint {
+- remote-endpoint = <&sfc2_cif_in>;
++ amx1_in2: endpoint {
++ remote-endpoint = <&xbar_amx1_in2>;
++ };
+ };
+- };
+
+- port@23 {
+- reg = <0x23>;
++ port@2 {
++ reg = <2>;
+
+- xbar_sfc2_out: endpoint {
+- remote-endpoint = <&sfc2_cif_out>;
++ amx1_in3: endpoint {
++ remote-endpoint = <&xbar_amx1_in3>;
++ };
+ };
+- };
+
+- xbar_sfc3_in_port: port@24 {
+- reg = <0x24>;
++ port@3 {
++ reg = <3>;
+
+- xbar_sfc3_in: endpoint {
+- remote-endpoint = <&sfc3_cif_in>;
++ amx1_in4: endpoint {
++ remote-endpoint = <&xbar_amx1_in4>;
++ };
+ };
+- };
+
+- port@25 {
+- reg = <0x25>;
++ amx1_out_port: port@4 {
++ reg = <4>;
+
+- xbar_sfc3_out: endpoint {
+- remote-endpoint = <&sfc3_cif_out>;
++ amx1_out: endpoint {
++ remote-endpoint = <&xbar_amx1_out>;
++ };
+ };
+ };
++ };
+
+- xbar_sfc4_in_port: port@26 {
+- reg = <0x26>;
++ amx@2903100 {
++ status = "okay";
+
+- xbar_sfc4_in: endpoint {
+- remote-endpoint = <&sfc4_cif_in>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- port@27 {
+- reg = <0x27>;
++ port@0 {
++ reg = <0>;
+
+- xbar_sfc4_out: endpoint {
+- remote-endpoint = <&sfc4_cif_out>;
++ amx2_in1: endpoint {
++ remote-endpoint = <&xbar_amx2_in1>;
++ };
+ };
+- };
+
+- xbar_mvc1_in_port: port@28 {
+- reg = <0x28>;
++ port@1 {
++ reg = <1>;
+
+- xbar_mvc1_in: endpoint {
+- remote-endpoint = <&mvc1_cif_in>;
++ amx2_in2: endpoint {
++ remote-endpoint = <&xbar_amx2_in2>;
++ };
+ };
+- };
+
+- port@29 {
+- reg = <0x29>;
++ port@2 {
++ reg = <2>;
+
+- xbar_mvc1_out: endpoint {
+- remote-endpoint = <&mvc1_cif_out>;
++ amx2_in3: endpoint {
++ remote-endpoint = <&xbar_amx2_in3>;
++ };
+ };
+- };
+
+- xbar_mvc2_in_port: port@2a {
+- reg = <0x2a>;
++ port@3 {
++ reg = <3>;
+
+- xbar_mvc2_in: endpoint {
+- remote-endpoint = <&mvc2_cif_in>;
++ amx2_in4: endpoint {
++ remote-endpoint = <&xbar_amx2_in4>;
++ };
+ };
+- };
+
+- port@2b {
+- reg = <0x2b>;
++ amx2_out_port: port@4 {
++ reg = <4>;
+
+- xbar_mvc2_out: endpoint {
+- remote-endpoint = <&mvc2_cif_out>;
++ amx2_out: endpoint {
++ remote-endpoint = <&xbar_amx2_out>;
++ };
+ };
+ };
++ };
+
+- xbar_amx1_in1_port: port@2c {
+- reg = <0x2c>;
++ amx@2903200 {
++ status = "okay";
+
+- xbar_amx1_in1: endpoint {
+- remote-endpoint = <&amx1_in1>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- xbar_amx1_in2_port: port@2d {
+- reg = <0x2d>;
++ port@0 {
++ reg = <0>;
+
+- xbar_amx1_in2: endpoint {
+- remote-endpoint = <&amx1_in2>;
++ amx3_in1: endpoint {
++ remote-endpoint = <&xbar_amx3_in1>;
++ };
+ };
+- };
+
+- xbar_amx1_in3_port: port@2e {
+- reg = <0x2e>;
++ port@1 {
++ reg = <1>;
+
+- xbar_amx1_in3: endpoint {
+- remote-endpoint = <&amx1_in3>;
++ amx3_in2: endpoint {
++ remote-endpoint = <&xbar_amx3_in2>;
++ };
+ };
+- };
+
+- xbar_amx1_in4_port: port@2f {
+- reg = <0x2f>;
++ port@2 {
++ reg = <2>;
+
+- xbar_amx1_in4: endpoint {
+- remote-endpoint = <&amx1_in4>;
++ amx3_in3: endpoint {
++ remote-endpoint = <&xbar_amx3_in3>;
++ };
+ };
+- };
+
+- port@30 {
+- reg = <0x30>;
++ port@3 {
++ reg = <3>;
+
+- xbar_amx1_out: endpoint {
+- remote-endpoint = <&amx1_out>;
++ amx3_in4: endpoint {
++ remote-endpoint = <&xbar_amx3_in4>;
++ };
+ };
+- };
+
+- xbar_amx2_in1_port: port@31 {
+- reg = <0x31>;
++ amx3_out_port: port@4 {
++ reg = <4>;
+
+- xbar_amx2_in1: endpoint {
+- remote-endpoint = <&amx2_in1>;
++ amx3_out: endpoint {
++ remote-endpoint = <&xbar_amx3_out>;
++ };
+ };
+ };
++ };
+
+- xbar_amx2_in2_port: port@32 {
+- reg = <0x32>;
++ amx@2903300 {
++ status = "okay";
+
+- xbar_amx2_in2: endpoint {
+- remote-endpoint = <&amx2_in2>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- xbar_amx2_in3_port: port@33 {
+- reg = <0x33>;
++ port@0 {
++ reg = <0>;
+
+- xbar_amx2_in3: endpoint {
+- remote-endpoint = <&amx2_in3>;
++ amx4_in1: endpoint {
++ remote-endpoint = <&xbar_amx4_in1>;
++ };
+ };
+- };
+
+- xbar_amx2_in4_port: port@34 {
+- reg = <0x34>;
++ port@1 {
++ reg = <1>;
+
+- xbar_amx2_in4: endpoint {
+- remote-endpoint = <&amx2_in4>;
++ amx4_in2: endpoint {
++ remote-endpoint = <&xbar_amx4_in2>;
++ };
+ };
+- };
+
+- port@35 {
+- reg = <0x35>;
++ port@2 {
++ reg = <2>;
+
+- xbar_amx2_out: endpoint {
+- remote-endpoint = <&amx2_out>;
++ amx4_in3: endpoint {
++ remote-endpoint = <&xbar_amx4_in3>;
++ };
+ };
+- };
+
+- xbar_amx3_in1_port: port@36 {
+- reg = <0x36>;
++ port@3 {
++ reg = <3>;
+
+- xbar_amx3_in1: endpoint {
+- remote-endpoint = <&amx3_in1>;
++ amx4_in4: endpoint {
++ remote-endpoint = <&xbar_amx4_in4>;
++ };
+ };
+- };
+
+- xbar_amx3_in2_port: port@37 {
+- reg = <0x37>;
++ amx4_out_port: port@4 {
++ reg = <4>;
+
+- xbar_amx3_in2: endpoint {
+- remote-endpoint = <&amx3_in2>;
++ amx4_out: endpoint {
++ remote-endpoint = <&xbar_amx4_out>;
++ };
+ };
+ };
++ };
+
+- xbar_amx3_in3_port: port@38 {
+- reg = <0x38>;
++ adx@2903800 {
++ status = "okay";
+
+- xbar_amx3_in3: endpoint {
+- remote-endpoint = <&amx3_in3>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- xbar_amx3_in4_port: port@39 {
+- reg = <0x39>;
++ port@0 {
++ reg = <0>;
+
+- xbar_amx3_in4: endpoint {
+- remote-endpoint = <&amx3_in4>;
++ adx1_in: endpoint {
++ remote-endpoint = <&xbar_adx1_in>;
++ };
+ };
+- };
+
+- port@3a {
+- reg = <0x3a>;
++ adx1_out1_port: port@1 {
++ reg = <1>;
+
+- xbar_amx3_out: endpoint {
+- remote-endpoint = <&amx3_out>;
++ adx1_out1: endpoint {
++ remote-endpoint = <&xbar_adx1_out1>;
++ };
+ };
+- };
+
+- xbar_amx4_in1_port: port@3b {
+- reg = <0x3b>;
++ adx1_out2_port: port@2 {
++ reg = <2>;
+
+- xbar_amx4_in1: endpoint {
+- remote-endpoint = <&amx4_in1>;
++ adx1_out2: endpoint {
++ remote-endpoint = <&xbar_adx1_out2>;
++ };
+ };
+- };
+
+- xbar_amx4_in2_port: port@3c {
+- reg = <0x3c>;
++ adx1_out3_port: port@3 {
++ reg = <3>;
+
+- xbar_amx4_in2: endpoint {
+- remote-endpoint = <&amx4_in2>;
++ adx1_out3: endpoint {
++ remote-endpoint = <&xbar_adx1_out3>;
++ };
+ };
+- };
+
+- xbar_amx4_in3_port: port@3d {
+- reg = <0x3d>;
++ adx1_out4_port: port@4 {
++ reg = <4>;
+
+- xbar_amx4_in3: endpoint {
+- remote-endpoint = <&amx4_in3>;
++ adx1_out4: endpoint {
++ remote-endpoint = <&xbar_adx1_out4>;
++ };
+ };
+ };
++ };
+
+- xbar_amx4_in4_port: port@3e {
+- reg = <0x3e>;
++ adx@2903900 {
++ status = "okay";
+
+- xbar_amx4_in4: endpoint {
+- remote-endpoint = <&amx4_in4>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- port@3f {
+- reg = <0x3f>;
++ port@0 {
++ reg = <0>;
+
+- xbar_amx4_out: endpoint {
+- remote-endpoint = <&amx4_out>;
++ adx2_in: endpoint {
++ remote-endpoint = <&xbar_adx2_in>;
++ };
+ };
+- };
+
+- xbar_adx1_in_port: port@40 {
+- reg = <0x40>;
++ adx2_out1_port: port@1 {
++ reg = <1>;
+
+- xbar_adx1_in: endpoint {
+- remote-endpoint = <&adx1_in>;
++ adx2_out1: endpoint {
++ remote-endpoint = <&xbar_adx2_out1>;
++ };
+ };
+- };
+
+- port@41 {
+- reg = <0x41>;
++ adx2_out2_port: port@2 {
++ reg = <2>;
+
+- xbar_adx1_out1: endpoint {
+- remote-endpoint = <&adx1_out1>;
++ adx2_out2: endpoint {
++ remote-endpoint = <&xbar_adx2_out2>;
++ };
+ };
+- };
+
+- port@42 {
+- reg = <0x42>;
++ adx2_out3_port: port@3 {
++ reg = <3>;
+
+- xbar_adx1_out2: endpoint {
+- remote-endpoint = <&adx1_out2>;
++ adx2_out3: endpoint {
++ remote-endpoint = <&xbar_adx2_out3>;
++ };
+ };
+- };
+
+- port@43 {
+- reg = <0x43>;
++ adx2_out4_port: port@4 {
++ reg = <4>;
+
+- xbar_adx1_out3: endpoint {
+- remote-endpoint = <&adx1_out3>;
++ adx2_out4: endpoint {
++ remote-endpoint = <&xbar_adx2_out4>;
++ };
+ };
+ };
++ };
+
+- port@44 {
+- reg = <0x44>;
++ adx@2903a00 {
++ status = "okay";
+
+- xbar_adx1_out4: endpoint {
+- remote-endpoint = <&adx1_out4>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- xbar_adx2_in_port: port@45 {
+- reg = <0x45>;
++ port@0 {
++ reg = <0>;
+
+- xbar_adx2_in: endpoint {
+- remote-endpoint = <&adx2_in>;
++ adx3_in: endpoint {
++ remote-endpoint = <&xbar_adx3_in>;
++ };
+ };
+- };
+
+- port@46 {
+- reg = <0x46>;
++ adx3_out1_port: port@1 {
++ reg = <1>;
+
+- xbar_adx2_out1: endpoint {
+- remote-endpoint = <&adx2_out1>;
++ adx3_out1: endpoint {
++ remote-endpoint = <&xbar_adx3_out1>;
++ };
+ };
+- };
+
+- port@47 {
+- reg = <0x47>;
++ adx3_out2_port: port@2 {
++ reg = <2>;
+
+- xbar_adx2_out2: endpoint {
+- remote-endpoint = <&adx2_out2>;
++ adx3_out2: endpoint {
++ remote-endpoint = <&xbar_adx3_out2>;
++ };
+ };
+- };
+
+- port@48 {
+- reg = <0x48>;
++ adx3_out3_port: port@3 {
++ reg = <3>;
+
+- xbar_adx2_out3: endpoint {
+- remote-endpoint = <&adx2_out3>;
++ adx3_out3: endpoint {
++ remote-endpoint = <&xbar_adx3_out3>;
++ };
+ };
+- };
+
+- port@49 {
+- reg = <0x49>;
++ adx3_out4_port: port@4 {
++ reg = <4>;
+
+- xbar_adx2_out4: endpoint {
+- remote-endpoint = <&adx2_out4>;
++ adx3_out4: endpoint {
++ remote-endpoint = <&xbar_adx3_out4>;
++ };
+ };
+ };
++ };
+
+- xbar_adx3_in_port: port@4a {
+- reg = <0x4a>;
++ adx@2903b00 {
++ status = "okay";
+
+- xbar_adx3_in: endpoint {
+- remote-endpoint = <&adx3_in>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- port@4b {
+- reg = <0x4b>;
++ port@0 {
++ reg = <0>;
+
+- xbar_adx3_out1: endpoint {
+- remote-endpoint = <&adx3_out1>;
++ adx4_in: endpoint {
++ remote-endpoint = <&xbar_adx4_in>;
++ };
+ };
+- };
+
+- port@4c {
+- reg = <0x4c>;
++ adx4_out1_port: port@1 {
++ reg = <1>;
+
+- xbar_adx3_out2: endpoint {
+- remote-endpoint = <&adx3_out2>;
++ adx4_out1: endpoint {
++ remote-endpoint = <&xbar_adx4_out1>;
++ };
+ };
+- };
+
+- port@4d {
+- reg = <0x4d>;
++ adx4_out2_port: port@2 {
++ reg = <2>;
+
+- xbar_adx3_out3: endpoint {
+- remote-endpoint = <&adx3_out3>;
++ adx4_out2: endpoint {
++ remote-endpoint = <&xbar_adx4_out2>;
++ };
+ };
+- };
+
+- port@4e {
+- reg = <0x4e>;
++ adx4_out3_port: port@3 {
++ reg = <3>;
+
+- xbar_adx3_out4: endpoint {
+- remote-endpoint = <&adx3_out4>;
++ adx4_out3: endpoint {
++ remote-endpoint = <&xbar_adx4_out3>;
++ };
+ };
+- };
+
+- xbar_adx4_in_port: port@4f {
+- reg = <0x4f>;
++ adx4_out4_port: port@4 {
++ reg = <4>;
+
+- xbar_adx4_in: endpoint {
+- remote-endpoint = <&adx4_in>;
++ adx4_out4: endpoint {
++ remote-endpoint = <&xbar_adx4_out4>;
++ };
+ };
+ };
++ };
+
+- port@50 {
+- reg = <0x50>;
++ dmic@2904200 {
++ status = "okay";
+
+- xbar_adx4_out1: endpoint {
+- remote-endpoint = <&adx4_out1>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- port@51 {
+- reg = <0x51>;
++ port@0 {
++ reg = <0>;
+
+- xbar_adx4_out2: endpoint {
+- remote-endpoint = <&adx4_out2>;
++ dmic3_cif: endpoint {
++ remote-endpoint = <&xbar_dmic3>;
++ };
+ };
+- };
+
+- port@52 {
+- reg = <0x52>;
++ dmic3_port: port@1 {
++ reg = <1>;
+
+- xbar_adx4_out3: endpoint {
+- remote-endpoint = <&adx4_out3>;
++ dmic3_dap: endpoint {
++ /* placeholder for external codec */
++ };
+ };
+ };
++ };
+
+- port@53 {
+- reg = <0x53>;
++ processing-engine@2908000 {
++ status = "okay";
+
+- xbar_adx4_out4: endpoint {
+- remote-endpoint = <&adx4_out4>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- xbar_mix_in1_port: port@54 {
+- reg = <0x54>;
++ port@0 {
++ reg = <0x0>;
+
+- xbar_mix_in1: endpoint {
+- remote-endpoint = <&mix_in1>;
++ ope1_cif_in_ep: endpoint {
++ remote-endpoint = <&xbar_ope1_in_ep>;
++ };
+ };
+- };
+
+- xbar_mix_in2_port: port@55 {
+- reg = <0x55>;
++ ope1_out_port: port@1 {
++ reg = <0x1>;
+
+- xbar_mix_in2: endpoint {
+- remote-endpoint = <&mix_in2>;
++ ope1_cif_out_ep: endpoint {
++ remote-endpoint = <&xbar_ope1_out_ep>;
++ };
+ };
+ };
++ };
+
+- xbar_mix_in3_port: port@56 {
+- reg = <0x56>;
++ mvc@290a000 {
++ status = "okay";
+
+- xbar_mix_in3: endpoint {
+- remote-endpoint = <&mix_in3>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- xbar_mix_in4_port: port@57 {
+- reg = <0x57>;
++ port@0 {
++ reg = <0>;
+
+- xbar_mix_in4: endpoint {
+- remote-endpoint = <&mix_in4>;
++ mvc1_cif_in: endpoint {
++ remote-endpoint = <&xbar_mvc1_in>;
++ };
+ };
+- };
+
+- xbar_mix_in5_port: port@58 {
+- reg = <0x58>;
++ mvc1_out_port: port@1 {
++ reg = <1>;
+
+- xbar_mix_in5: endpoint {
+- remote-endpoint = <&mix_in5>;
++ mvc1_cif_out: endpoint {
++ remote-endpoint = <&xbar_mvc1_out>;
++ };
+ };
+ };
++ };
+
+- xbar_mix_in6_port: port@59 {
+- reg = <0x59>;
++ mvc@290a200 {
++ status = "okay";
+
+- xbar_mix_in6: endpoint {
+- remote-endpoint = <&mix_in6>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- xbar_mix_in7_port: port@5a {
+- reg = <0x5a>;
++ port@0 {
++ reg = <0>;
+
+- xbar_mix_in7: endpoint {
+- remote-endpoint = <&mix_in7>;
++ mvc2_cif_in: endpoint {
++ remote-endpoint = <&xbar_mvc2_in>;
++ };
+ };
+- };
+
+- xbar_mix_in8_port: port@5b {
+- reg = <0x5b>;
++ mvc2_out_port: port@1 {
++ reg = <1>;
+
+- xbar_mix_in8: endpoint {
+- remote-endpoint = <&mix_in8>;
++ mvc2_cif_out: endpoint {
++ remote-endpoint = <&xbar_mvc2_out>;
++ };
+ };
+ };
++ };
+
+- xbar_mix_in9_port: port@5c {
+- reg = <0x5c>;
++ amixer@290bb00 {
++ status = "okay";
+
+- xbar_mix_in9: endpoint {
+- remote-endpoint = <&mix_in9>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- xbar_mix_in10_port: port@5d {
+- reg = <0x5d>;
++ port@0 {
++ reg = <0x0>;
+
+- xbar_mix_in10: endpoint {
+- remote-endpoint = <&mix_in10>;
++ mix_in1: endpoint {
++ remote-endpoint = <&xbar_mix_in1>;
++ };
+ };
+- };
+
+- port@5e {
+- reg = <0x5e>;
++ port@1 {
++ reg = <0x1>;
+
+- xbar_mix_out1: endpoint {
+- remote-endpoint = <&mix_out1>;
++ mix_in2: endpoint {
++ remote-endpoint = <&xbar_mix_in2>;
++ };
+ };
+- };
+
+- port@5f {
+- reg = <0x5f>;
++ port@2 {
++ reg = <0x2>;
+
+- xbar_mix_out2: endpoint {
+- remote-endpoint = <&mix_out2>;
++ mix_in3: endpoint {
++ remote-endpoint = <&xbar_mix_in3>;
++ };
+ };
+- };
+
+- port@60 {
+- reg = <0x60>;
++ port@3 {
++ reg = <0x3>;
+
+- xbar_mix_out3: endpoint {
+- remote-endpoint = <&mix_out3>;
++ mix_in4: endpoint {
++ remote-endpoint = <&xbar_mix_in4>;
++ };
+ };
+- };
+
+- port@61 {
+- reg = <0x61>;
++ port@4 {
++ reg = <0x4>;
+
+- xbar_mix_out4: endpoint {
+- remote-endpoint = <&mix_out4>;
++ mix_in5: endpoint {
++ remote-endpoint = <&xbar_mix_in5>;
++ };
+ };
+- };
+
+- port@62 {
+- reg = <0x62>;
++ port@5 {
++ reg = <0x5>;
+
+- xbar_mix_out5: endpoint {
+- remote-endpoint = <&mix_out5>;
++ mix_in6: endpoint {
++ remote-endpoint = <&xbar_mix_in6>;
++ };
+ };
+- };
+
+- xbar_asrc_in1_port: port@63 {
+- reg = <0x63>;
++ port@6 {
++ reg = <0x6>;
+
+- xbar_asrc_in1_ep: endpoint {
+- remote-endpoint = <&asrc_in1_ep>;
++ mix_in7: endpoint {
++ remote-endpoint = <&xbar_mix_in7>;
++ };
+ };
+- };
+
+- port@64 {
+- reg = <0x64>;
++ port@7 {
++ reg = <0x7>;
+
+- xbar_asrc_out1_ep: endpoint {
+- remote-endpoint = <&asrc_out1_ep>;
++ mix_in8: endpoint {
++ remote-endpoint = <&xbar_mix_in8>;
++ };
+ };
+- };
+
+- xbar_asrc_in2_port: port@65 {
+- reg = <0x65>;
++ port@8 {
++ reg = <0x8>;
+
+- xbar_asrc_in2_ep: endpoint {
+- remote-endpoint = <&asrc_in2_ep>;
++ mix_in9: endpoint {
++ remote-endpoint = <&xbar_mix_in9>;
++ };
+ };
+- };
+
+- port@66 {
+- reg = <0x66>;
++ port@9 {
++ reg = <0x9>;
+
+- xbar_asrc_out2_ep: endpoint {
+- remote-endpoint = <&asrc_out2_ep>;
++ mix_in10: endpoint {
++ remote-endpoint = <&xbar_mix_in10>;
++ };
+ };
+- };
+
+- xbar_asrc_in3_port: port@67 {
+- reg = <0x67>;
++ mix_out1_port: port@a {
++ reg = <0xa>;
+
+- xbar_asrc_in3_ep: endpoint {
+- remote-endpoint = <&asrc_in3_ep>;
++ mix_out1: endpoint {
++ remote-endpoint = <&xbar_mix_out1>;
++ };
+ };
+- };
+
+- port@68 {
+- reg = <0x68>;
++ mix_out2_port: port@b {
++ reg = <0xb>;
+
+- xbar_asrc_out3_ep: endpoint {
+- remote-endpoint = <&asrc_out3_ep>;
++ mix_out2: endpoint {
++ remote-endpoint = <&xbar_mix_out2>;
++ };
+ };
+- };
+
+- xbar_asrc_in4_port: port@69 {
+- reg = <0x69>;
++ mix_out3_port: port@c {
++ reg = <0xc>;
+
+- xbar_asrc_in4_ep: endpoint {
+- remote-endpoint = <&asrc_in4_ep>;
++ mix_out3: endpoint {
++ remote-endpoint = <&xbar_mix_out3>;
++ };
+ };
+- };
+
+- port@6a {
+- reg = <0x6a>;
++ mix_out4_port: port@d {
++ reg = <0xd>;
+
+- xbar_asrc_out4_ep: endpoint {
+- remote-endpoint = <&asrc_out4_ep>;
++ mix_out4: endpoint {
++ remote-endpoint = <&xbar_mix_out4>;
++ };
+ };
+- };
+
+- xbar_asrc_in5_port: port@6b {
+- reg = <0x6b>;
++ mix_out5_port: port@e {
++ reg = <0xe>;
+
+- xbar_asrc_in5_ep: endpoint {
+- remote-endpoint = <&asrc_in5_ep>;
++ mix_out5: endpoint {
++ remote-endpoint = <&xbar_mix_out5>;
++ };
+ };
+ };
++ };
+
+- port@6c {
+- reg = <0x6c>;
++ admaif@290f000 {
++ status = "okay";
+
+- xbar_asrc_out5_ep: endpoint {
+- remote-endpoint = <&asrc_out5_ep>;
+- };
+- };
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- xbar_asrc_in6_port: port@6d {
+- reg = <0x6d>;
++ admaif0_port: port@0 {
++ reg = <0x0>;
+
+- xbar_asrc_in6_ep: endpoint {
+- remote-endpoint = <&asrc_in6_ep>;
++ admaif0: endpoint {
++ remote-endpoint = <&xbar_admaif0>;
++ };
+ };
+- };
+
+- port@6e {
+- reg = <0x6e>;
++ admaif1_port: port@1 {
++ reg = <0x1>;
+
+- xbar_asrc_out6_ep: endpoint {
+- remote-endpoint = <&asrc_out6_ep>;
++ admaif1: endpoint {
++ remote-endpoint = <&xbar_admaif1>;
++ };
+ };
+- };
+
+- xbar_asrc_in7_port: port@6f {
+- reg = <0x6f>;
++ admaif2_port: port@2 {
++ reg = <0x2>;
+
+- xbar_asrc_in7_ep: endpoint {
+- remote-endpoint = <&asrc_in7_ep>;
++ admaif2: endpoint {
++ remote-endpoint = <&xbar_admaif2>;
++ };
+ };
+- };
+
+- xbar_ope1_in_port: port@70 {
+- reg = <0x70>;
++ admaif3_port: port@3 {
++ reg = <0x3>;
+
+- xbar_ope1_in_ep: endpoint {
+- remote-endpoint = <&ope1_cif_in_ep>;
++ admaif3: endpoint {
++ remote-endpoint = <&xbar_admaif3>;
++ };
+ };
+- };
+
+- port@71 {
+- reg = <0x71>;
++ admaif4_port: port@4 {
++ reg = <0x4>;
+
+- xbar_ope1_out_ep: endpoint {
+- remote-endpoint = <&ope1_cif_out_ep>;
++ admaif4: endpoint {
++ remote-endpoint = <&xbar_admaif4>;
++ };
+ };
+- };
+- };
+
+- i2s@2901000 {
+- status = "okay";
++ admaif5_port: port@5 {
++ reg = <0x5>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ admaif5: endpoint {
++ remote-endpoint = <&xbar_admaif5>;
++ };
++ };
+
+- port@0 {
+- reg = <0>;
++ admaif6_port: port@6 {
++ reg = <0x6>;
+
+- i2s1_cif: endpoint {
+- remote-endpoint = <&xbar_i2s1>;
++ admaif6: endpoint {
++ remote-endpoint = <&xbar_admaif6>;
+ };
+ };
+
+- i2s1_port: port@1 {
+- reg = <1>;
++ admaif7_port: port@7 {
++ reg = <0x7>;
+
+- i2s1_dap: endpoint {
+- dai-format = "i2s";
+- /* placeholder for external codec */
++ admaif7: endpoint {
++ remote-endpoint = <&xbar_admaif7>;
+ };
+ };
+- };
+- };
+
+- i2s@2901100 {
+- status = "okay";
++ admaif8_port: port@8 {
++ reg = <0x8>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ admaif8: endpoint {
++ remote-endpoint = <&xbar_admaif8>;
++ };
++ };
+
+- port@0 {
+- reg = <0>;
++ admaif9_port: port@9 {
++ reg = <0x9>;
+
+- i2s2_cif: endpoint {
+- remote-endpoint = <&xbar_i2s2>;
++ admaif9: endpoint {
++ remote-endpoint = <&xbar_admaif9>;
+ };
+ };
+
+- i2s2_port: port@1 {
+- reg = <1>;
++ admaif10_port: port@a {
++ reg = <0xa>;
+
+- i2s2_dap: endpoint {
+- dai-format = "i2s";
+- /* placeholder for external codec */
++ admaif10: endpoint {
++ remote-endpoint = <&xbar_admaif10>;
+ };
+ };
+- };
+- };
+
+- i2s@2901300 {
+- status = "okay";
++ admaif11_port: port@b {
++ reg = <0xb>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ admaif11: endpoint {
++ remote-endpoint = <&xbar_admaif11>;
++ };
++ };
+
+- port@0 {
+- reg = <0>;
++ admaif12_port: port@c {
++ reg = <0xc>;
+
+- i2s4_cif: endpoint {
+- remote-endpoint = <&xbar_i2s4>;
++ admaif12: endpoint {
++ remote-endpoint = <&xbar_admaif12>;
+ };
+ };
+
+- i2s4_port: port@1 {
+- reg = <1>;
++ admaif13_port: port@d {
++ reg = <0xd>;
+
+- i2s4_dap: endpoint {
+- dai-format = "i2s";
+- /* placeholder for external codec */
++ admaif13: endpoint {
++ remote-endpoint = <&xbar_admaif13>;
+ };
+ };
+- };
+- };
+
+- i2s@2901500 {
+- status = "okay";
++ admaif14_port: port@e {
++ reg = <0xe>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ admaif14: endpoint {
++ remote-endpoint = <&xbar_admaif14>;
++ };
++ };
+
+- port@0 {
+- reg = <0>;
++ admaif15_port: port@f {
++ reg = <0xf>;
+
+- i2s6_cif: endpoint {
+- remote-endpoint = <&xbar_i2s6>;
++ admaif15: endpoint {
++ remote-endpoint = <&xbar_admaif15>;
+ };
+ };
+
+- i2s6_port: port@1 {
+- reg = <1>;
++ admaif16_port: port@10 {
++ reg = <0x10>;
+
+- i2s6_dap: endpoint {
+- dai-format = "i2s";
+- /* placeholder for external codec */
++ admaif16: endpoint {
++ remote-endpoint = <&xbar_admaif16>;
+ };
+ };
+- };
+- };
+
+- sfc@2902000 {
+- status = "okay";
++ admaif17_port: port@11 {
++ reg = <0x11>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ admaif17: endpoint {
++ remote-endpoint = <&xbar_admaif17>;
++ };
++ };
+
+- port@0 {
+- reg = <0>;
++ admaif18_port: port@12 {
++ reg = <0x12>;
+
+- sfc1_cif_in: endpoint {
+- remote-endpoint = <&xbar_sfc1_in>;
++ admaif18: endpoint {
++ remote-endpoint = <&xbar_admaif18>;
+ };
+ };
+
+- sfc1_out_port: port@1 {
+- reg = <1>;
++ admaif19_port: port@13 {
++ reg = <0x13>;
+
+- sfc1_cif_out: endpoint {
+- remote-endpoint = <&xbar_sfc1_out>;
++ admaif19: endpoint {
++ remote-endpoint = <&xbar_admaif19>;
+ };
+ };
+ };
+ };
+
+- sfc@2902200 {
++ asrc@2910000 {
+ status = "okay";
+
+ ports {
+@@ -1022,972 +1031,968 @@ ports {
+ #size-cells = <0>;
+
+ port@0 {
+- reg = <0>;
++ reg = <0x0>;
+
+- sfc2_cif_in: endpoint {
+- remote-endpoint = <&xbar_sfc2_in>;
++ asrc_in1_ep: endpoint {
++ remote-endpoint = <&xbar_asrc_in1_ep>;
+ };
+ };
+
+- sfc2_out_port: port@1 {
+- reg = <1>;
++ port@1 {
++ reg = <0x1>;
+
+- sfc2_cif_out: endpoint {
+- remote-endpoint = <&xbar_sfc2_out>;
++ asrc_in2_ep: endpoint {
++ remote-endpoint = <&xbar_asrc_in2_ep>;
+ };
+ };
+- };
+- };
+-
+- sfc@2902400 {
+- status = "okay";
+-
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
+
+- port@0 {
+- reg = <0>;
++ port@2 {
++ reg = <0x2>;
+
+- sfc3_cif_in: endpoint {
+- remote-endpoint = <&xbar_sfc3_in>;
++ asrc_in3_ep: endpoint {
++ remote-endpoint = <&xbar_asrc_in3_ep>;
+ };
+ };
+
+- sfc3_out_port: port@1 {
+- reg = <1>;
++ port@3 {
++ reg = <0x3>;
+
+- sfc3_cif_out: endpoint {
+- remote-endpoint = <&xbar_sfc3_out>;
++ asrc_in4_ep: endpoint {
++ remote-endpoint = <&xbar_asrc_in4_ep>;
+ };
+ };
+- };
+- };
+
+- sfc@2902600 {
+- status = "okay";
++ port@4 {
++ reg = <0x4>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ asrc_in5_ep: endpoint {
++ remote-endpoint = <&xbar_asrc_in5_ep>;
++ };
++ };
+
+- port@0 {
+- reg = <0>;
++ port@5 {
++ reg = <0x5>;
+
+- sfc4_cif_in: endpoint {
+- remote-endpoint = <&xbar_sfc4_in>;
++ asrc_in6_ep: endpoint {
++ remote-endpoint = <&xbar_asrc_in6_ep>;
+ };
+ };
+
+- sfc4_out_port: port@1 {
+- reg = <1>;
++ port@6 {
++ reg = <0x6>;
+
+- sfc4_cif_out: endpoint {
+- remote-endpoint = <&xbar_sfc4_out>;
++ asrc_in7_ep: endpoint {
++ remote-endpoint = <&xbar_asrc_in7_ep>;
+ };
+ };
+- };
+- };
+
+- amx@2903000 {
+- status = "okay";
++ asrc_out1_port: port@7 {
++ reg = <0x7>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ asrc_out1_ep: endpoint {
++ remote-endpoint = <&xbar_asrc_out1_ep>;
++ };
++ };
+
+- port@0 {
+- reg = <0>;
++ asrc_out2_port: port@8 {
++ reg = <0x8>;
+
+- amx1_in1: endpoint {
+- remote-endpoint = <&xbar_amx1_in1>;
++ asrc_out2_ep: endpoint {
++ remote-endpoint = <&xbar_asrc_out2_ep>;
+ };
+ };
+
+- port@1 {
+- reg = <1>;
++ asrc_out3_port: port@9 {
++ reg = <0x9>;
+
+- amx1_in2: endpoint {
+- remote-endpoint = <&xbar_amx1_in2>;
++ asrc_out3_ep: endpoint {
++ remote-endpoint = <&xbar_asrc_out3_ep>;
+ };
+ };
+
+- port@2 {
+- reg = <2>;
++ asrc_out4_port: port@a {
++ reg = <0xa>;
+
+- amx1_in3: endpoint {
+- remote-endpoint = <&xbar_amx1_in3>;
++ asrc_out4_ep: endpoint {
++ remote-endpoint = <&xbar_asrc_out4_ep>;
+ };
+ };
+
+- port@3 {
+- reg = <3>;
++ asrc_out5_port: port@b {
++ reg = <0xb>;
+
+- amx1_in4: endpoint {
+- remote-endpoint = <&xbar_amx1_in4>;
++ asrc_out5_ep: endpoint {
++ remote-endpoint = <&xbar_asrc_out5_ep>;
+ };
+ };
+
+- amx1_out_port: port@4 {
+- reg = <4>;
++ asrc_out6_port: port@c {
++ reg = <0xc>;
+
+- amx1_out: endpoint {
+- remote-endpoint = <&xbar_amx1_out>;
++ asrc_out6_ep: endpoint {
++ remote-endpoint = <&xbar_asrc_out6_ep>;
+ };
+ };
+ };
+ };
+
+- amx@2903100 {
+- status = "okay";
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ port@0 {
++ reg = <0x0>;
+
+- port@0 {
+- reg = <0>;
++ xbar_admaif0: endpoint {
++ remote-endpoint = <&admaif0>;
++ };
++ };
+
+- amx2_in1: endpoint {
+- remote-endpoint = <&xbar_amx2_in1>;
+- };
++ port@1 {
++ reg = <0x1>;
++
++ xbar_admaif1: endpoint {
++ remote-endpoint = <&admaif1>;
+ };
++ };
+
+- port@1 {
+- reg = <1>;
++ port@2 {
++ reg = <0x2>;
+
+- amx2_in2: endpoint {
+- remote-endpoint = <&xbar_amx2_in2>;
+- };
++ xbar_admaif2: endpoint {
++ remote-endpoint = <&admaif2>;
+ };
++ };
+
+- port@2 {
+- reg = <2>;
++ port@3 {
++ reg = <0x3>;
+
+- amx2_in3: endpoint {
+- remote-endpoint = <&xbar_amx2_in3>;
+- };
++ xbar_admaif3: endpoint {
++ remote-endpoint = <&admaif3>;
+ };
++ };
+
+- port@3 {
+- reg = <3>;
++ port@4 {
++ reg = <0x4>;
+
+- amx2_in4: endpoint {
+- remote-endpoint = <&xbar_amx2_in4>;
+- };
++ xbar_admaif4: endpoint {
++ remote-endpoint = <&admaif4>;
+ };
++ };
+
+- amx2_out_port: port@4 {
+- reg = <4>;
++ port@5 {
++ reg = <0x5>;
+
+- amx2_out: endpoint {
+- remote-endpoint = <&xbar_amx2_out>;
+- };
++ xbar_admaif5: endpoint {
++ remote-endpoint = <&admaif5>;
++ };
++ };
++
++ port@6 {
++ reg = <0x6>;
++
++ xbar_admaif6: endpoint {
++ remote-endpoint = <&admaif6>;
++ };
++ };
++
++ port@7 {
++ reg = <0x7>;
++
++ xbar_admaif7: endpoint {
++ remote-endpoint = <&admaif7>;
++ };
++ };
++
++ port@8 {
++ reg = <0x8>;
++
++ xbar_admaif8: endpoint {
++ remote-endpoint = <&admaif8>;
+ };
+ };
+- };
+-
+- amx@2903200 {
+- status = "okay";
+-
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
+
+- port@0 {
+- reg = <0>;
++ port@9 {
++ reg = <0x9>;
+
+- amx3_in1: endpoint {
+- remote-endpoint = <&xbar_amx3_in1>;
+- };
++ xbar_admaif9: endpoint {
++ remote-endpoint = <&admaif9>;
+ };
++ };
+
+- port@1 {
+- reg = <1>;
++ port@a {
++ reg = <0xa>;
+
+- amx3_in2: endpoint {
+- remote-endpoint = <&xbar_amx3_in2>;
+- };
++ xbar_admaif10: endpoint {
++ remote-endpoint = <&admaif10>;
+ };
++ };
+
+- port@2 {
+- reg = <2>;
++ port@b {
++ reg = <0xb>;
+
+- amx3_in3: endpoint {
+- remote-endpoint = <&xbar_amx3_in3>;
+- };
++ xbar_admaif11: endpoint {
++ remote-endpoint = <&admaif11>;
+ };
++ };
+
+- port@3 {
+- reg = <3>;
++ port@c {
++ reg = <0xc>;
+
+- amx3_in4: endpoint {
+- remote-endpoint = <&xbar_amx3_in4>;
+- };
++ xbar_admaif12: endpoint {
++ remote-endpoint = <&admaif12>;
+ };
++ };
+
+- amx3_out_port: port@4 {
+- reg = <4>;
++ port@d {
++ reg = <0xd>;
+
+- amx3_out: endpoint {
+- remote-endpoint = <&xbar_amx3_out>;
+- };
++ xbar_admaif13: endpoint {
++ remote-endpoint = <&admaif13>;
+ };
+ };
+- };
+
+- amx@2903300 {
+- status = "okay";
++ port@e {
++ reg = <0xe>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ xbar_admaif14: endpoint {
++ remote-endpoint = <&admaif14>;
++ };
++ };
+
+- port@0 {
+- reg = <0>;
++ port@f {
++ reg = <0xf>;
+
+- amx4_in1: endpoint {
+- remote-endpoint = <&xbar_amx4_in1>;
+- };
++ xbar_admaif15: endpoint {
++ remote-endpoint = <&admaif15>;
+ };
++ };
+
+- port@1 {
+- reg = <1>;
++ port@10 {
++ reg = <0x10>;
+
+- amx4_in2: endpoint {
+- remote-endpoint = <&xbar_amx4_in2>;
+- };
++ xbar_admaif16: endpoint {
++ remote-endpoint = <&admaif16>;
+ };
++ };
+
+- port@2 {
+- reg = <2>;
++ port@11 {
++ reg = <0x11>;
+
+- amx4_in3: endpoint {
+- remote-endpoint = <&xbar_amx4_in3>;
+- };
++ xbar_admaif17: endpoint {
++ remote-endpoint = <&admaif17>;
+ };
++ };
+
+- port@3 {
+- reg = <3>;
++ port@12 {
++ reg = <0x12>;
+
+- amx4_in4: endpoint {
+- remote-endpoint = <&xbar_amx4_in4>;
+- };
++ xbar_admaif18: endpoint {
++ remote-endpoint = <&admaif18>;
+ };
++ };
+
+- amx4_out_port: port@4 {
+- reg = <4>;
++ port@13 {
++ reg = <0x13>;
+
+- amx4_out: endpoint {
+- remote-endpoint = <&xbar_amx4_out>;
+- };
++ xbar_admaif19: endpoint {
++ remote-endpoint = <&admaif19>;
+ };
+ };
+- };
+
+- adx@2903800 {
+- status = "okay";
++ xbar_i2s1_port: port@14 {
++ reg = <0x14>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ xbar_i2s1: endpoint {
++ remote-endpoint = <&i2s1_cif>;
++ };
++ };
+
+- port@0 {
+- reg = <0>;
++ xbar_i2s2_port: port@15 {
++ reg = <0x15>;
+
+- adx1_in: endpoint {
+- remote-endpoint = <&xbar_adx1_in>;
+- };
++ xbar_i2s2: endpoint {
++ remote-endpoint = <&i2s2_cif>;
+ };
++ };
+
+- adx1_out1_port: port@1 {
+- reg = <1>;
++ xbar_i2s4_port: port@17 {
++ reg = <0x17>;
+
+- adx1_out1: endpoint {
+- remote-endpoint = <&xbar_adx1_out1>;
+- };
++ xbar_i2s4: endpoint {
++ remote-endpoint = <&i2s4_cif>;
+ };
++ };
+
+- adx1_out2_port: port@2 {
+- reg = <2>;
++ xbar_i2s6_port: port@19 {
++ reg = <0x19>;
+
+- adx1_out2: endpoint {
+- remote-endpoint = <&xbar_adx1_out2>;
+- };
++ xbar_i2s6: endpoint {
++ remote-endpoint = <&i2s6_cif>;
+ };
++ };
+
+- adx1_out3_port: port@3 {
+- reg = <3>;
++ xbar_dmic3_port: port@1c {
++ reg = <0x1c>;
+
+- adx1_out3: endpoint {
+- remote-endpoint = <&xbar_adx1_out3>;
+- };
++ xbar_dmic3: endpoint {
++ remote-endpoint = <&dmic3_cif>;
+ };
++ };
+
+- adx1_out4_port: port@4 {
+- reg = <4>;
++ xbar_sfc1_in_port: port@20 {
++ reg = <0x20>;
+
+- adx1_out4: endpoint {
+- remote-endpoint = <&xbar_adx1_out4>;
+- };
++ xbar_sfc1_in: endpoint {
++ remote-endpoint = <&sfc1_cif_in>;
+ };
+ };
+- };
+
+- adx@2903900 {
+- status = "okay";
++ port@21 {
++ reg = <0x21>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ xbar_sfc1_out: endpoint {
++ remote-endpoint = <&sfc1_cif_out>;
++ };
++ };
+
+- port@0 {
+- reg = <0>;
++ xbar_sfc2_in_port: port@22 {
++ reg = <0x22>;
+
+- adx2_in: endpoint {
+- remote-endpoint = <&xbar_adx2_in>;
+- };
++ xbar_sfc2_in: endpoint {
++ remote-endpoint = <&sfc2_cif_in>;
+ };
++ };
+
+- adx2_out1_port: port@1 {
+- reg = <1>;
++ port@23 {
++ reg = <0x23>;
+
+- adx2_out1: endpoint {
+- remote-endpoint = <&xbar_adx2_out1>;
+- };
++ xbar_sfc2_out: endpoint {
++ remote-endpoint = <&sfc2_cif_out>;
+ };
++ };
+
+- adx2_out2_port: port@2 {
+- reg = <2>;
++ xbar_sfc3_in_port: port@24 {
++ reg = <0x24>;
+
+- adx2_out2: endpoint {
+- remote-endpoint = <&xbar_adx2_out2>;
+- };
++ xbar_sfc3_in: endpoint {
++ remote-endpoint = <&sfc3_cif_in>;
+ };
++ };
+
+- adx2_out3_port: port@3 {
+- reg = <3>;
++ port@25 {
++ reg = <0x25>;
+
+- adx2_out3: endpoint {
+- remote-endpoint = <&xbar_adx2_out3>;
+- };
++ xbar_sfc3_out: endpoint {
++ remote-endpoint = <&sfc3_cif_out>;
+ };
++ };
+
+- adx2_out4_port: port@4 {
+- reg = <4>;
++ xbar_sfc4_in_port: port@26 {
++ reg = <0x26>;
+
+- adx2_out4: endpoint {
+- remote-endpoint = <&xbar_adx2_out4>;
+- };
++ xbar_sfc4_in: endpoint {
++ remote-endpoint = <&sfc4_cif_in>;
+ };
+ };
+- };
+
+- adx@2903a00 {
+- status = "okay";
++ port@27 {
++ reg = <0x27>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ xbar_sfc4_out: endpoint {
++ remote-endpoint = <&sfc4_cif_out>;
++ };
++ };
+
+- port@0 {
+- reg = <0>;
++ xbar_mvc1_in_port: port@28 {
++ reg = <0x28>;
+
+- adx3_in: endpoint {
+- remote-endpoint = <&xbar_adx3_in>;
+- };
++ xbar_mvc1_in: endpoint {
++ remote-endpoint = <&mvc1_cif_in>;
+ };
++ };
+
+- adx3_out1_port: port@1 {
+- reg = <1>;
++ port@29 {
++ reg = <0x29>;
+
+- adx3_out1: endpoint {
+- remote-endpoint = <&xbar_adx3_out1>;
+- };
++ xbar_mvc1_out: endpoint {
++ remote-endpoint = <&mvc1_cif_out>;
+ };
++ };
+
+- adx3_out2_port: port@2 {
+- reg = <2>;
++ xbar_mvc2_in_port: port@2a {
++ reg = <0x2a>;
+
+- adx3_out2: endpoint {
+- remote-endpoint = <&xbar_adx3_out2>;
+- };
++ xbar_mvc2_in: endpoint {
++ remote-endpoint = <&mvc2_cif_in>;
+ };
++ };
+
+- adx3_out3_port: port@3 {
+- reg = <3>;
++ port@2b {
++ reg = <0x2b>;
+
+- adx3_out3: endpoint {
+- remote-endpoint = <&xbar_adx3_out3>;
+- };
++ xbar_mvc2_out: endpoint {
++ remote-endpoint = <&mvc2_cif_out>;
+ };
++ };
+
+- adx3_out4_port: port@4 {
+- reg = <4>;
++ xbar_amx1_in1_port: port@2c {
++ reg = <0x2c>;
+
+- adx3_out4: endpoint {
+- remote-endpoint = <&xbar_adx3_out4>;
+- };
++ xbar_amx1_in1: endpoint {
++ remote-endpoint = <&amx1_in1>;
+ };
+ };
+- };
+
+- adx@2903b00 {
+- status = "okay";
++ xbar_amx1_in2_port: port@2d {
++ reg = <0x2d>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ xbar_amx1_in2: endpoint {
++ remote-endpoint = <&amx1_in2>;
++ };
++ };
+
+- port@0 {
+- reg = <0>;
++ xbar_amx1_in3_port: port@2e {
++ reg = <0x2e>;
+
+- adx4_in: endpoint {
+- remote-endpoint = <&xbar_adx4_in>;
+- };
++ xbar_amx1_in3: endpoint {
++ remote-endpoint = <&amx1_in3>;
+ };
++ };
+
+- adx4_out1_port: port@1 {
+- reg = <1>;
++ xbar_amx1_in4_port: port@2f {
++ reg = <0x2f>;
+
+- adx4_out1: endpoint {
+- remote-endpoint = <&xbar_adx4_out1>;
+- };
++ xbar_amx1_in4: endpoint {
++ remote-endpoint = <&amx1_in4>;
+ };
++ };
+
+- adx4_out2_port: port@2 {
+- reg = <2>;
++ port@30 {
++ reg = <0x30>;
+
+- adx4_out2: endpoint {
+- remote-endpoint = <&xbar_adx4_out2>;
+- };
++ xbar_amx1_out: endpoint {
++ remote-endpoint = <&amx1_out>;
+ };
++ };
+
+- adx4_out3_port: port@3 {
+- reg = <3>;
++ xbar_amx2_in1_port: port@31 {
++ reg = <0x31>;
+
+- adx4_out3: endpoint {
+- remote-endpoint = <&xbar_adx4_out3>;
+- };
++ xbar_amx2_in1: endpoint {
++ remote-endpoint = <&amx2_in1>;
+ };
++ };
+
+- adx4_out4_port: port@4 {
+- reg = <4>;
++ xbar_amx2_in2_port: port@32 {
++ reg = <0x32>;
+
+- adx4_out4: endpoint {
+- remote-endpoint = <&xbar_adx4_out4>;
+- };
++ xbar_amx2_in2: endpoint {
++ remote-endpoint = <&amx2_in2>;
+ };
+ };
+- };
+
+- dmic@2904200 {
+- status = "okay";
++ xbar_amx2_in3_port: port@33 {
++ reg = <0x33>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ xbar_amx2_in3: endpoint {
++ remote-endpoint = <&amx2_in3>;
++ };
++ };
+
+- port@0 {
+- reg = <0>;
++ xbar_amx2_in4_port: port@34 {
++ reg = <0x34>;
+
+- dmic3_cif: endpoint {
+- remote-endpoint = <&xbar_dmic3>;
+- };
++ xbar_amx2_in4: endpoint {
++ remote-endpoint = <&amx2_in4>;
+ };
++ };
+
+- dmic3_port: port@1 {
+- reg = <1>;
++ port@35 {
++ reg = <0x35>;
+
+- dmic3_dap: endpoint {
+- /* placeholder for external codec */
+- };
++ xbar_amx2_out: endpoint {
++ remote-endpoint = <&amx2_out>;
+ };
+ };
+- };
+
+- processing-engine@2908000 {
+- status = "okay";
++ xbar_amx3_in1_port: port@36 {
++ reg = <0x36>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ xbar_amx3_in1: endpoint {
++ remote-endpoint = <&amx3_in1>;
++ };
++ };
+
+- port@0 {
+- reg = <0x0>;
++ xbar_amx3_in2_port: port@37 {
++ reg = <0x37>;
+
+- ope1_cif_in_ep: endpoint {
+- remote-endpoint = <&xbar_ope1_in_ep>;
+- };
++ xbar_amx3_in2: endpoint {
++ remote-endpoint = <&amx3_in2>;
+ };
++ };
+
+- ope1_out_port: port@1 {
+- reg = <0x1>;
++ xbar_amx3_in3_port: port@38 {
++ reg = <0x38>;
+
+- ope1_cif_out_ep: endpoint {
+- remote-endpoint = <&xbar_ope1_out_ep>;
+- };
++ xbar_amx3_in3: endpoint {
++ remote-endpoint = <&amx3_in3>;
+ };
+ };
+- };
+
+- mvc@290a000 {
+- status = "okay";
++ xbar_amx3_in4_port: port@39 {
++ reg = <0x39>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ xbar_amx3_in4: endpoint {
++ remote-endpoint = <&amx3_in4>;
++ };
++ };
+
+- port@0 {
+- reg = <0>;
++ port@3a {
++ reg = <0x3a>;
+
+- mvc1_cif_in: endpoint {
+- remote-endpoint = <&xbar_mvc1_in>;
+- };
++ xbar_amx3_out: endpoint {
++ remote-endpoint = <&amx3_out>;
+ };
++ };
+
+- mvc1_out_port: port@1 {
+- reg = <1>;
++ xbar_amx4_in1_port: port@3b {
++ reg = <0x3b>;
+
+- mvc1_cif_out: endpoint {
+- remote-endpoint = <&xbar_mvc1_out>;
+- };
++ xbar_amx4_in1: endpoint {
++ remote-endpoint = <&amx4_in1>;
+ };
+ };
+- };
+
+- mvc@290a200 {
+- status = "okay";
++ xbar_amx4_in2_port: port@3c {
++ reg = <0x3c>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ xbar_amx4_in2: endpoint {
++ remote-endpoint = <&amx4_in2>;
++ };
++ };
+
+- port@0 {
+- reg = <0>;
++ xbar_amx4_in3_port: port@3d {
++ reg = <0x3d>;
+
+- mvc2_cif_in: endpoint {
+- remote-endpoint = <&xbar_mvc2_in>;
+- };
++ xbar_amx4_in3: endpoint {
++ remote-endpoint = <&amx4_in3>;
+ };
++ };
+
+- mvc2_out_port: port@1 {
+- reg = <1>;
++ xbar_amx4_in4_port: port@3e {
++ reg = <0x3e>;
+
+- mvc2_cif_out: endpoint {
+- remote-endpoint = <&xbar_mvc2_out>;
+- };
++ xbar_amx4_in4: endpoint {
++ remote-endpoint = <&amx4_in4>;
+ };
+ };
+- };
+
+- amixer@290bb00 {
+- status = "okay";
++ port@3f {
++ reg = <0x3f>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ xbar_amx4_out: endpoint {
++ remote-endpoint = <&amx4_out>;
++ };
++ };
+
+- port@0 {
+- reg = <0x0>;
++ xbar_adx1_in_port: port@40 {
++ reg = <0x40>;
+
+- mix_in1: endpoint {
+- remote-endpoint = <&xbar_mix_in1>;
+- };
++ xbar_adx1_in: endpoint {
++ remote-endpoint = <&adx1_in>;
+ };
++ };
+
+- port@1 {
+- reg = <0x1>;
++ port@41 {
++ reg = <0x41>;
+
+- mix_in2: endpoint {
+- remote-endpoint = <&xbar_mix_in2>;
+- };
++ xbar_adx1_out1: endpoint {
++ remote-endpoint = <&adx1_out1>;
+ };
++ };
+
+- port@2 {
+- reg = <0x2>;
++ port@42 {
++ reg = <0x42>;
+
+- mix_in3: endpoint {
+- remote-endpoint = <&xbar_mix_in3>;
+- };
++ xbar_adx1_out2: endpoint {
++ remote-endpoint = <&adx1_out2>;
+ };
++ };
+
+- port@3 {
+- reg = <0x3>;
++ port@43 {
++ reg = <0x43>;
+
+- mix_in4: endpoint {
+- remote-endpoint = <&xbar_mix_in4>;
+- };
++ xbar_adx1_out3: endpoint {
++ remote-endpoint = <&adx1_out3>;
+ };
++ };
+
+- port@4 {
+- reg = <0x4>;
++ port@44 {
++ reg = <0x44>;
+
+- mix_in5: endpoint {
+- remote-endpoint = <&xbar_mix_in5>;
+- };
++ xbar_adx1_out4: endpoint {
++ remote-endpoint = <&adx1_out4>;
+ };
++ };
+
+- port@5 {
+- reg = <0x5>;
++ xbar_adx2_in_port: port@45 {
++ reg = <0x45>;
+
+- mix_in6: endpoint {
+- remote-endpoint = <&xbar_mix_in6>;
+- };
++ xbar_adx2_in: endpoint {
++ remote-endpoint = <&adx2_in>;
+ };
++ };
+
+- port@6 {
+- reg = <0x6>;
++ port@46 {
++ reg = <0x46>;
+
+- mix_in7: endpoint {
+- remote-endpoint = <&xbar_mix_in7>;
+- };
++ xbar_adx2_out1: endpoint {
++ remote-endpoint = <&adx2_out1>;
+ };
++ };
+
+- port@7 {
+- reg = <0x7>;
++ port@47 {
++ reg = <0x47>;
+
+- mix_in8: endpoint {
+- remote-endpoint = <&xbar_mix_in8>;
+- };
++ xbar_adx2_out2: endpoint {
++ remote-endpoint = <&adx2_out2>;
+ };
++ };
+
+- port@8 {
+- reg = <0x8>;
++ port@48 {
++ reg = <0x48>;
+
+- mix_in9: endpoint {
+- remote-endpoint = <&xbar_mix_in9>;
+- };
++ xbar_adx2_out3: endpoint {
++ remote-endpoint = <&adx2_out3>;
+ };
++ };
+
+- port@9 {
+- reg = <0x9>;
++ port@49 {
++ reg = <0x49>;
+
+- mix_in10: endpoint {
+- remote-endpoint = <&xbar_mix_in10>;
+- };
++ xbar_adx2_out4: endpoint {
++ remote-endpoint = <&adx2_out4>;
+ };
++ };
+
+- mix_out1_port: port@a {
+- reg = <0xa>;
++ xbar_adx3_in_port: port@4a {
++ reg = <0x4a>;
+
+- mix_out1: endpoint {
+- remote-endpoint = <&xbar_mix_out1>;
+- };
++ xbar_adx3_in: endpoint {
++ remote-endpoint = <&adx3_in>;
+ };
++ };
+
+- mix_out2_port: port@b {
+- reg = <0xb>;
++ port@4b {
++ reg = <0x4b>;
+
+- mix_out2: endpoint {
+- remote-endpoint = <&xbar_mix_out2>;
+- };
++ xbar_adx3_out1: endpoint {
++ remote-endpoint = <&adx3_out1>;
+ };
++ };
+
+- mix_out3_port: port@c {
+- reg = <0xc>;
++ port@4c {
++ reg = <0x4c>;
+
+- mix_out3: endpoint {
+- remote-endpoint = <&xbar_mix_out3>;
+- };
++ xbar_adx3_out2: endpoint {
++ remote-endpoint = <&adx3_out2>;
+ };
++ };
+
+- mix_out4_port: port@d {
+- reg = <0xd>;
++ port@4d {
++ reg = <0x4d>;
+
+- mix_out4: endpoint {
+- remote-endpoint = <&xbar_mix_out4>;
+- };
++ xbar_adx3_out3: endpoint {
++ remote-endpoint = <&adx3_out3>;
+ };
++ };
+
+- mix_out5_port: port@e {
+- reg = <0xe>;
++ port@4e {
++ reg = <0x4e>;
+
+- mix_out5: endpoint {
+- remote-endpoint = <&xbar_mix_out5>;
+- };
++ xbar_adx3_out4: endpoint {
++ remote-endpoint = <&adx3_out4>;
+ };
+ };
+- };
+
+- admaif@290f000 {
+- status = "okay";
++ xbar_adx4_in_port: port@4f {
++ reg = <0x4f>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ xbar_adx4_in: endpoint {
++ remote-endpoint = <&adx4_in>;
++ };
++ };
+
+- admaif0_port: port@0 {
+- reg = <0x0>;
++ port@50 {
++ reg = <0x50>;
+
+- admaif0: endpoint {
+- remote-endpoint = <&xbar_admaif0>;
+- };
++ xbar_adx4_out1: endpoint {
++ remote-endpoint = <&adx4_out1>;
+ };
++ };
+
+- admaif1_port: port@1 {
+- reg = <0x1>;
++ port@51 {
++ reg = <0x51>;
+
+- admaif1: endpoint {
+- remote-endpoint = <&xbar_admaif1>;
+- };
++ xbar_adx4_out2: endpoint {
++ remote-endpoint = <&adx4_out2>;
+ };
++ };
+
+- admaif2_port: port@2 {
+- reg = <0x2>;
++ port@52 {
++ reg = <0x52>;
+
+- admaif2: endpoint {
+- remote-endpoint = <&xbar_admaif2>;
+- };
++ xbar_adx4_out3: endpoint {
++ remote-endpoint = <&adx4_out3>;
+ };
++ };
+
+- admaif3_port: port@3 {
+- reg = <0x3>;
++ port@53 {
++ reg = <0x53>;
+
+- admaif3: endpoint {
+- remote-endpoint = <&xbar_admaif3>;
+- };
++ xbar_adx4_out4: endpoint {
++ remote-endpoint = <&adx4_out4>;
+ };
++ };
+
+- admaif4_port: port@4 {
+- reg = <0x4>;
++ xbar_mix_in1_port: port@54 {
++ reg = <0x54>;
+
+- admaif4: endpoint {
+- remote-endpoint = <&xbar_admaif4>;
+- };
++ xbar_mix_in1: endpoint {
++ remote-endpoint = <&mix_in1>;
+ };
++ };
+
+- admaif5_port: port@5 {
+- reg = <0x5>;
++ xbar_mix_in2_port: port@55 {
++ reg = <0x55>;
+
+- admaif5: endpoint {
+- remote-endpoint = <&xbar_admaif5>;
+- };
++ xbar_mix_in2: endpoint {
++ remote-endpoint = <&mix_in2>;
+ };
++ };
+
+- admaif6_port: port@6 {
+- reg = <0x6>;
++ xbar_mix_in3_port: port@56 {
++ reg = <0x56>;
+
+- admaif6: endpoint {
+- remote-endpoint = <&xbar_admaif6>;
+- };
++ xbar_mix_in3: endpoint {
++ remote-endpoint = <&mix_in3>;
+ };
++ };
+
+- admaif7_port: port@7 {
+- reg = <0x7>;
++ xbar_mix_in4_port: port@57 {
++ reg = <0x57>;
+
+- admaif7: endpoint {
+- remote-endpoint = <&xbar_admaif7>;
+- };
++ xbar_mix_in4: endpoint {
++ remote-endpoint = <&mix_in4>;
+ };
++ };
+
+- admaif8_port: port@8 {
+- reg = <0x8>;
++ xbar_mix_in5_port: port@58 {
++ reg = <0x58>;
+
+- admaif8: endpoint {
+- remote-endpoint = <&xbar_admaif8>;
+- };
++ xbar_mix_in5: endpoint {
++ remote-endpoint = <&mix_in5>;
+ };
++ };
+
+- admaif9_port: port@9 {
+- reg = <0x9>;
++ xbar_mix_in6_port: port@59 {
++ reg = <0x59>;
+
+- admaif9: endpoint {
+- remote-endpoint = <&xbar_admaif9>;
+- };
++ xbar_mix_in6: endpoint {
++ remote-endpoint = <&mix_in6>;
+ };
++ };
+
+- admaif10_port: port@a {
+- reg = <0xa>;
++ xbar_mix_in7_port: port@5a {
++ reg = <0x5a>;
+
+- admaif10: endpoint {
+- remote-endpoint = <&xbar_admaif10>;
+- };
++ xbar_mix_in7: endpoint {
++ remote-endpoint = <&mix_in7>;
+ };
++ };
+
+- admaif11_port: port@b {
+- reg = <0xb>;
++ xbar_mix_in8_port: port@5b {
++ reg = <0x5b>;
+
+- admaif11: endpoint {
+- remote-endpoint = <&xbar_admaif11>;
+- };
++ xbar_mix_in8: endpoint {
++ remote-endpoint = <&mix_in8>;
+ };
++ };
+
+- admaif12_port: port@c {
+- reg = <0xc>;
++ xbar_mix_in9_port: port@5c {
++ reg = <0x5c>;
+
+- admaif12: endpoint {
+- remote-endpoint = <&xbar_admaif12>;
+- };
++ xbar_mix_in9: endpoint {
++ remote-endpoint = <&mix_in9>;
+ };
++ };
+
+- admaif13_port: port@d {
+- reg = <0xd>;
++ xbar_mix_in10_port: port@5d {
++ reg = <0x5d>;
+
+- admaif13: endpoint {
+- remote-endpoint = <&xbar_admaif13>;
+- };
++ xbar_mix_in10: endpoint {
++ remote-endpoint = <&mix_in10>;
+ };
++ };
+
+- admaif14_port: port@e {
+- reg = <0xe>;
++ port@5e {
++ reg = <0x5e>;
+
+- admaif14: endpoint {
+- remote-endpoint = <&xbar_admaif14>;
+- };
++ xbar_mix_out1: endpoint {
++ remote-endpoint = <&mix_out1>;
+ };
++ };
+
+- admaif15_port: port@f {
+- reg = <0xf>;
++ port@5f {
++ reg = <0x5f>;
+
+- admaif15: endpoint {
+- remote-endpoint = <&xbar_admaif15>;
+- };
++ xbar_mix_out2: endpoint {
++ remote-endpoint = <&mix_out2>;
+ };
++ };
+
+- admaif16_port: port@10 {
+- reg = <0x10>;
++ port@60 {
++ reg = <0x60>;
+
+- admaif16: endpoint {
+- remote-endpoint = <&xbar_admaif16>;
+- };
++ xbar_mix_out3: endpoint {
++ remote-endpoint = <&mix_out3>;
+ };
++ };
+
+- admaif17_port: port@11 {
+- reg = <0x11>;
++ port@61 {
++ reg = <0x61>;
+
+- admaif17: endpoint {
+- remote-endpoint = <&xbar_admaif17>;
+- };
++ xbar_mix_out4: endpoint {
++ remote-endpoint = <&mix_out4>;
+ };
++ };
+
+- admaif18_port: port@12 {
+- reg = <0x12>;
++ port@62 {
++ reg = <0x62>;
+
+- admaif18: endpoint {
+- remote-endpoint = <&xbar_admaif18>;
+- };
++ xbar_mix_out5: endpoint {
++ remote-endpoint = <&mix_out5>;
+ };
++ };
+
+- admaif19_port: port@13 {
+- reg = <0x13>;
++ xbar_asrc_in1_port: port@63 {
++ reg = <0x63>;
+
+- admaif19: endpoint {
+- remote-endpoint = <&xbar_admaif19>;
+- };
++ xbar_asrc_in1_ep: endpoint {
++ remote-endpoint = <&asrc_in1_ep>;
+ };
+ };
+- };
+
+- asrc@2910000 {
+- status = "okay";
++ port@64 {
++ reg = <0x64>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
++ xbar_asrc_out1_ep: endpoint {
++ remote-endpoint = <&asrc_out1_ep>;
++ };
++ };
+
+- port@0 {
+- reg = <0x0>;
++ xbar_asrc_in2_port: port@65 {
++ reg = <0x65>;
+
+- asrc_in1_ep: endpoint {
+- remote-endpoint = <&xbar_asrc_in1_ep>;
+- };
++ xbar_asrc_in2_ep: endpoint {
++ remote-endpoint = <&asrc_in2_ep>;
+ };
++ };
+
+- port@1 {
+- reg = <0x1>;
++ port@66 {
++ reg = <0x66>;
+
+- asrc_in2_ep: endpoint {
+- remote-endpoint = <&xbar_asrc_in2_ep>;
+- };
++ xbar_asrc_out2_ep: endpoint {
++ remote-endpoint = <&asrc_out2_ep>;
+ };
++ };
+
+- port@2 {
+- reg = <0x2>;
++ xbar_asrc_in3_port: port@67 {
++ reg = <0x67>;
+
+- asrc_in3_ep: endpoint {
+- remote-endpoint = <&xbar_asrc_in3_ep>;
+- };
++ xbar_asrc_in3_ep: endpoint {
++ remote-endpoint = <&asrc_in3_ep>;
+ };
++ };
+
+- port@3 {
+- reg = <0x3>;
++ port@68 {
++ reg = <0x68>;
+
+- asrc_in4_ep: endpoint {
+- remote-endpoint = <&xbar_asrc_in4_ep>;
+- };
++ xbar_asrc_out3_ep: endpoint {
++ remote-endpoint = <&asrc_out3_ep>;
+ };
++ };
+
+- port@4 {
+- reg = <0x4>;
++ xbar_asrc_in4_port: port@69 {
++ reg = <0x69>;
+
+- asrc_in5_ep: endpoint {
+- remote-endpoint = <&xbar_asrc_in5_ep>;
+- };
++ xbar_asrc_in4_ep: endpoint {
++ remote-endpoint = <&asrc_in4_ep>;
+ };
++ };
+
+- port@5 {
+- reg = <0x5>;
++ port@6a {
++ reg = <0x6a>;
+
+- asrc_in6_ep: endpoint {
+- remote-endpoint = <&xbar_asrc_in6_ep>;
+- };
++ xbar_asrc_out4_ep: endpoint {
++ remote-endpoint = <&asrc_out4_ep>;
+ };
++ };
+
+- port@6 {
+- reg = <0x6>;
++ xbar_asrc_in5_port: port@6b {
++ reg = <0x6b>;
+
+- asrc_in7_ep: endpoint {
+- remote-endpoint = <&xbar_asrc_in7_ep>;
+- };
++ xbar_asrc_in5_ep: endpoint {
++ remote-endpoint = <&asrc_in5_ep>;
+ };
++ };
+
+- asrc_out1_port: port@7 {
+- reg = <0x7>;
++ port@6c {
++ reg = <0x6c>;
+
+- asrc_out1_ep: endpoint {
+- remote-endpoint = <&xbar_asrc_out1_ep>;
+- };
++ xbar_asrc_out5_ep: endpoint {
++ remote-endpoint = <&asrc_out5_ep>;
+ };
++ };
+
+- asrc_out2_port: port@8 {
+- reg = <0x8>;
++ xbar_asrc_in6_port: port@6d {
++ reg = <0x6d>;
+
+- asrc_out2_ep: endpoint {
+- remote-endpoint = <&xbar_asrc_out2_ep>;
+- };
++ xbar_asrc_in6_ep: endpoint {
++ remote-endpoint = <&asrc_in6_ep>;
+ };
++ };
+
+- asrc_out3_port: port@9 {
+- reg = <0x9>;
++ port@6e {
++ reg = <0x6e>;
+
+- asrc_out3_ep: endpoint {
+- remote-endpoint = <&xbar_asrc_out3_ep>;
+- };
++ xbar_asrc_out6_ep: endpoint {
++ remote-endpoint = <&asrc_out6_ep>;
+ };
++ };
+
+- asrc_out4_port: port@a {
+- reg = <0xa>;
++ xbar_asrc_in7_port: port@6f {
++ reg = <0x6f>;
+
+- asrc_out4_ep: endpoint {
+- remote-endpoint = <&xbar_asrc_out4_ep>;
+- };
++ xbar_asrc_in7_ep: endpoint {
++ remote-endpoint = <&asrc_in7_ep>;
+ };
++ };
+
+- asrc_out5_port: port@b {
+- reg = <0xb>;
++ xbar_ope1_in_port: port@70 {
++ reg = <0x70>;
+
+- asrc_out5_ep: endpoint {
+- remote-endpoint = <&xbar_asrc_out5_ep>;
+- };
++ xbar_ope1_in_ep: endpoint {
++ remote-endpoint = <&ope1_cif_in_ep>;
+ };
++ };
+
+- asrc_out6_port: port@c {
+- reg = <0xc>;
++ port@71 {
++ reg = <0x71>;
+
+- asrc_out6_ep: endpoint {
+- remote-endpoint = <&xbar_asrc_out6_ep>;
+- };
++ xbar_ope1_out_ep: endpoint {
++ remote-endpoint = <&ope1_cif_out_ep>;
+ };
+ };
+ };
+@@ -2022,14 +2027,7 @@ hda@3510000 {
+ nvidia,model = "NVIDIA Jetson AGX Orin HDA";
+ status = "okay";
+ };
+- };
+-
+- chosen {
+- bootargs = "console=ttyTCU0,115200n8";
+- stdout-path = "serial0:115200n8";
+- };
+
+- bus@0 {
+ ethernet@6800000 {
+ status = "okay";
+
+@@ -2129,6 +2127,14 @@ key-suspend {
+ };
+ };
+
++ pwm-fan {
++ compatible = "pwm-fan";
++ pwms = <&pwm3 0 45334>;
++
++ cooling-levels = <0 95 178 255>;
++ #cooling-cells = <2>;
++ };
++
+ serial {
+ status = "okay";
+ };
+@@ -2195,12 +2201,4 @@ sound {
+
+ label = "NVIDIA Jetson AGX Orin APE";
+ };
+-
+- pwm-fan {
+- compatible = "pwm-fan";
+- pwms = <&pwm3 0 45334>;
+-
+- cooling-levels = <0 95 178 255>;
+- #cooling-cells = <2>;
+- };
+ };
+diff --git a/arch/arm64/boot/dts/nvidia/tegra234.dtsi b/arch/arm64/boot/dts/nvidia/tegra234.dtsi
+index 3d680ee0f4d17..7a3112c82cdc7 100644
+--- a/arch/arm64/boot/dts/nvidia/tegra234.dtsi
++++ b/arch/arm64/boot/dts/nvidia/tegra234.dtsi
+@@ -22,6 +22,94 @@ bus@0 {
+ #size-cells = <2>;
+ ranges = <0x0 0x0 0x0 0x0 0x0 0x40000000>;
+
++ misc@100000 {
++ compatible = "nvidia,tegra234-misc";
++ reg = <0x0 0x00100000 0x0 0xf000>,
++ <0x0 0x0010f000 0x0 0x1000>;
++ status = "okay";
++ };
++
++ timer@2080000 {
++ compatible = "nvidia,tegra234-timer";
++ reg = <0x0 0x02080000 0x0 0x00121000>;
++ interrupts = <GIC_SPI 0 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 1 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 2 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 3 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 4 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 5 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 6 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 7 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 8 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 9 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 10 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 11 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 12 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 13 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 14 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 15 IRQ_TYPE_LEVEL_HIGH>;
++ status = "okay";
++ };
++
++ gpio: gpio@2200000 {
++ compatible = "nvidia,tegra234-gpio";
++ reg-names = "security", "gpio";
++ reg = <0x0 0x02200000 0x0 0x10000>,
++ <0x0 0x02210000 0x0 0x10000>;
++ interrupts = <GIC_SPI 288 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 289 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 290 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 291 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 292 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 293 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 294 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 295 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 296 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 297 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 298 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 299 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 300 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 301 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 302 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 303 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 304 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 305 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 306 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 307 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 308 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 309 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 310 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 311 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 312 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 313 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 314 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 315 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 316 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 317 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 318 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 319 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 320 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 321 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 322 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 323 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 324 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 325 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 326 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 327 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 328 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 329 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 330 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 331 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 332 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 333 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 334 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 335 IRQ_TYPE_LEVEL_HIGH>;
++ #interrupt-cells = <2>;
++ interrupt-controller;
++ #gpio-cells = <2>;
++ gpio-controller;
++ };
++
+ gpcdma: dma-controller@2600000 {
+ compatible = "nvidia,tegra234-gpcdma",
+ "nvidia,tegra186-gpcdma";
+@@ -518,194 +606,6 @@ agic: interrupt-controller@2a40000 {
+ };
+ };
+
+- misc@100000 {
+- compatible = "nvidia,tegra234-misc";
+- reg = <0x0 0x00100000 0x0 0xf000>,
+- <0x0 0x0010f000 0x0 0x1000>;
+- status = "okay";
+- };
+-
+- timer@2080000 {
+- compatible = "nvidia,tegra234-timer";
+- reg = <0x0 0x02080000 0x0 0x00121000>;
+- interrupts = <GIC_SPI 0 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 1 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 2 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 3 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 4 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 5 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 6 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 7 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 8 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 9 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 10 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 11 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 12 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 13 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 14 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 15 IRQ_TYPE_LEVEL_HIGH>;
+- status = "okay";
+- };
+-
+- host1x@13e00000 {
+- compatible = "nvidia,tegra234-host1x";
+- reg = <0x0 0x13e00000 0x0 0x10000>,
+- <0x0 0x13e10000 0x0 0x10000>,
+- <0x0 0x13e40000 0x0 0x10000>;
+- reg-names = "common", "hypervisor", "vm";
+- interrupts = <GIC_SPI 448 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 449 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 450 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 451 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 452 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 453 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 454 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 455 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 263 IRQ_TYPE_LEVEL_HIGH>;
+- interrupt-names = "syncpt0", "syncpt1", "syncpt2", "syncpt3", "syncpt4",
+- "syncpt5", "syncpt6", "syncpt7", "host1x";
+- clocks = <&bpmp TEGRA234_CLK_HOST1X>;
+- clock-names = "host1x";
+-
+- #address-cells = <2>;
+- #size-cells = <2>;
+- ranges = <0x0 0x14800000 0x0 0x14800000 0x0 0x02000000>;
+-
+- interconnects = <&mc TEGRA234_MEMORY_CLIENT_HOST1XDMAR &emc>;
+- interconnect-names = "dma-mem";
+- iommus = <&smmu_niso1 TEGRA234_SID_HOST1X>;
+-
+- /* Context isolation domains */
+- iommu-map = <0 &smmu_niso0 TEGRA234_SID_HOST1X_CTX0 1>,
+- <1 &smmu_niso0 TEGRA234_SID_HOST1X_CTX1 1>,
+- <2 &smmu_niso0 TEGRA234_SID_HOST1X_CTX2 1>,
+- <3 &smmu_niso0 TEGRA234_SID_HOST1X_CTX3 1>,
+- <4 &smmu_niso0 TEGRA234_SID_HOST1X_CTX4 1>,
+- <5 &smmu_niso0 TEGRA234_SID_HOST1X_CTX5 1>,
+- <6 &smmu_niso0 TEGRA234_SID_HOST1X_CTX6 1>,
+- <7 &smmu_niso0 TEGRA234_SID_HOST1X_CTX7 1>,
+- <8 &smmu_niso1 TEGRA234_SID_HOST1X_CTX0 1>,
+- <9 &smmu_niso1 TEGRA234_SID_HOST1X_CTX1 1>,
+- <10 &smmu_niso1 TEGRA234_SID_HOST1X_CTX2 1>,
+- <11 &smmu_niso1 TEGRA234_SID_HOST1X_CTX3 1>,
+- <12 &smmu_niso1 TEGRA234_SID_HOST1X_CTX4 1>,
+- <13 &smmu_niso1 TEGRA234_SID_HOST1X_CTX5 1>,
+- <14 &smmu_niso1 TEGRA234_SID_HOST1X_CTX6 1>,
+- <15 &smmu_niso1 TEGRA234_SID_HOST1X_CTX7 1>;
+-
+- vic@15340000 {
+- compatible = "nvidia,tegra234-vic";
+- reg = <0x0 0x15340000 0x0 0x00040000>;
+- interrupts = <GIC_SPI 206 IRQ_TYPE_LEVEL_HIGH>;
+- clocks = <&bpmp TEGRA234_CLK_VIC>;
+- clock-names = "vic";
+- resets = <&bpmp TEGRA234_RESET_VIC>;
+- reset-names = "vic";
+-
+- power-domains = <&bpmp TEGRA234_POWER_DOMAIN_VIC>;
+- interconnects = <&mc TEGRA234_MEMORY_CLIENT_VICSRD &emc>,
+- <&mc TEGRA234_MEMORY_CLIENT_VICSWR &emc>;
+- interconnect-names = "dma-mem", "write";
+- iommus = <&smmu_niso1 TEGRA234_SID_VIC>;
+- dma-coherent;
+- };
+-
+- nvdec@15480000 {
+- compatible = "nvidia,tegra234-nvdec";
+- reg = <0x0 0x15480000 0x0 0x00040000>;
+- clocks = <&bpmp TEGRA234_CLK_NVDEC>,
+- <&bpmp TEGRA234_CLK_FUSE>,
+- <&bpmp TEGRA234_CLK_TSEC_PKA>;
+- clock-names = "nvdec", "fuse", "tsec_pka";
+- resets = <&bpmp TEGRA234_RESET_NVDEC>;
+- reset-names = "nvdec";
+- power-domains = <&bpmp TEGRA234_POWER_DOMAIN_NVDEC>;
+- interconnects = <&mc TEGRA234_MEMORY_CLIENT_NVDECSRD &emc>,
+- <&mc TEGRA234_MEMORY_CLIENT_NVDECSWR &emc>;
+- interconnect-names = "dma-mem", "write";
+- iommus = <&smmu_niso1 TEGRA234_SID_NVDEC>;
+- dma-coherent;
+-
+- nvidia,memory-controller = <&mc>;
+-
+- /*
+- * Placeholder values that firmware needs to update with the real
+- * offsets parsed from the microcode headers.
+- */
+- nvidia,bl-manifest-offset = <0>;
+- nvidia,bl-data-offset = <0>;
+- nvidia,bl-code-offset = <0>;
+- nvidia,os-manifest-offset = <0>;
+- nvidia,os-data-offset = <0>;
+- nvidia,os-code-offset = <0>;
+-
+- /*
+- * Firmware needs to set this to "okay" once the above values have
+- * been updated.
+- */
+- status = "disabled";
+- };
+- };
+-
+- gpio: gpio@2200000 {
+- compatible = "nvidia,tegra234-gpio";
+- reg-names = "security", "gpio";
+- reg = <0x0 0x02200000 0x0 0x10000>,
+- <0x0 0x02210000 0x0 0x10000>;
+- interrupts = <GIC_SPI 288 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 289 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 290 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 291 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 292 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 293 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 294 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 295 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 296 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 297 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 298 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 299 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 300 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 301 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 302 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 303 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 304 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 305 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 306 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 307 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 308 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 309 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 310 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 311 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 312 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 313 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 314 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 315 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 316 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 317 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 318 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 319 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 320 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 321 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 322 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 323 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 324 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 325 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 326 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 327 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 328 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 329 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 330 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 331 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 332 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 333 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 334 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 335 IRQ_TYPE_LEVEL_HIGH>;
+- #interrupt-cells = <2>;
+- interrupt-controller;
+- #gpio-cells = <2>;
+- gpio-controller;
+- };
+-
+ mc: memory-controller@2c00000 {
+ compatible = "nvidia,tegra234-mc";
+ reg = <0x0 0x02c00000 0x0 0x10000>, /* MC-SID */
+@@ -1690,18 +1590,13 @@ pmc: pmc@c360000 {
+ #interrupt-cells = <2>;
+ interrupt-controller;
+
+- sdmmc1_3v3: sdmmc1-3v3 {
+- pins = "sdmmc1-hv";
+- power-source = <TEGRA_IO_PAD_VOLTAGE_3V3>;
+- };
+-
+ sdmmc1_1v8: sdmmc1-1v8 {
+ pins = "sdmmc1-hv";
+ power-source = <TEGRA_IO_PAD_VOLTAGE_1V8>;
+ };
+
+- sdmmc3_3v3: sdmmc3-3v3 {
+- pins = "sdmmc3-hv";
++ sdmmc1_3v3: sdmmc1-3v3 {
++ pins = "sdmmc1-hv";
+ power-source = <TEGRA_IO_PAD_VOLTAGE_3V3>;
+ };
+
+@@ -1709,6 +1604,11 @@ sdmmc3_1v8: sdmmc3-1v8 {
+ pins = "sdmmc3-hv";
+ power-source = <TEGRA_IO_PAD_VOLTAGE_1V8>;
+ };
++
++ sdmmc3_3v3: sdmmc3-3v3 {
++ pins = "sdmmc3-hv";
++ power-source = <TEGRA_IO_PAD_VOLTAGE_3V3>;
++ };
+ };
+
+ aon-fabric@c600000 {
+@@ -2040,6 +1940,106 @@ cbb-fabric@13a00000 {
+ status = "okay";
+ };
+
++ host1x@13e00000 {
++ compatible = "nvidia,tegra234-host1x";
++ reg = <0x0 0x13e00000 0x0 0x10000>,
++ <0x0 0x13e10000 0x0 0x10000>,
++ <0x0 0x13e40000 0x0 0x10000>;
++ reg-names = "common", "hypervisor", "vm";
++ interrupts = <GIC_SPI 448 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 449 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 450 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 451 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 452 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 453 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 454 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 455 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 263 IRQ_TYPE_LEVEL_HIGH>;
++ interrupt-names = "syncpt0", "syncpt1", "syncpt2", "syncpt3", "syncpt4",
++ "syncpt5", "syncpt6", "syncpt7", "host1x";
++ clocks = <&bpmp TEGRA234_CLK_HOST1X>;
++ clock-names = "host1x";
++
++ #address-cells = <2>;
++ #size-cells = <2>;
++ ranges = <0x0 0x14800000 0x0 0x14800000 0x0 0x02000000>;
++
++ interconnects = <&mc TEGRA234_MEMORY_CLIENT_HOST1XDMAR &emc>;
++ interconnect-names = "dma-mem";
++ iommus = <&smmu_niso1 TEGRA234_SID_HOST1X>;
++
++ /* Context isolation domains */
++ iommu-map = <0 &smmu_niso0 TEGRA234_SID_HOST1X_CTX0 1>,
++ <1 &smmu_niso0 TEGRA234_SID_HOST1X_CTX1 1>,
++ <2 &smmu_niso0 TEGRA234_SID_HOST1X_CTX2 1>,
++ <3 &smmu_niso0 TEGRA234_SID_HOST1X_CTX3 1>,
++ <4 &smmu_niso0 TEGRA234_SID_HOST1X_CTX4 1>,
++ <5 &smmu_niso0 TEGRA234_SID_HOST1X_CTX5 1>,
++ <6 &smmu_niso0 TEGRA234_SID_HOST1X_CTX6 1>,
++ <7 &smmu_niso0 TEGRA234_SID_HOST1X_CTX7 1>,
++ <8 &smmu_niso1 TEGRA234_SID_HOST1X_CTX0 1>,
++ <9 &smmu_niso1 TEGRA234_SID_HOST1X_CTX1 1>,
++ <10 &smmu_niso1 TEGRA234_SID_HOST1X_CTX2 1>,
++ <11 &smmu_niso1 TEGRA234_SID_HOST1X_CTX3 1>,
++ <12 &smmu_niso1 TEGRA234_SID_HOST1X_CTX4 1>,
++ <13 &smmu_niso1 TEGRA234_SID_HOST1X_CTX5 1>,
++ <14 &smmu_niso1 TEGRA234_SID_HOST1X_CTX6 1>,
++ <15 &smmu_niso1 TEGRA234_SID_HOST1X_CTX7 1>;
++
++ vic@15340000 {
++ compatible = "nvidia,tegra234-vic";
++ reg = <0x0 0x15340000 0x0 0x00040000>;
++ interrupts = <GIC_SPI 206 IRQ_TYPE_LEVEL_HIGH>;
++ clocks = <&bpmp TEGRA234_CLK_VIC>;
++ clock-names = "vic";
++ resets = <&bpmp TEGRA234_RESET_VIC>;
++ reset-names = "vic";
++
++ power-domains = <&bpmp TEGRA234_POWER_DOMAIN_VIC>;
++ interconnects = <&mc TEGRA234_MEMORY_CLIENT_VICSRD &emc>,
++ <&mc TEGRA234_MEMORY_CLIENT_VICSWR &emc>;
++ interconnect-names = "dma-mem", "write";
++ iommus = <&smmu_niso1 TEGRA234_SID_VIC>;
++ dma-coherent;
++ };
++
++ nvdec@15480000 {
++ compatible = "nvidia,tegra234-nvdec";
++ reg = <0x0 0x15480000 0x0 0x00040000>;
++ clocks = <&bpmp TEGRA234_CLK_NVDEC>,
++ <&bpmp TEGRA234_CLK_FUSE>,
++ <&bpmp TEGRA234_CLK_TSEC_PKA>;
++ clock-names = "nvdec", "fuse", "tsec_pka";
++ resets = <&bpmp TEGRA234_RESET_NVDEC>;
++ reset-names = "nvdec";
++ power-domains = <&bpmp TEGRA234_POWER_DOMAIN_NVDEC>;
++ interconnects = <&mc TEGRA234_MEMORY_CLIENT_NVDECSRD &emc>,
++ <&mc TEGRA234_MEMORY_CLIENT_NVDECSWR &emc>;
++ interconnect-names = "dma-mem", "write";
++ iommus = <&smmu_niso1 TEGRA234_SID_NVDEC>;
++ dma-coherent;
++
++ nvidia,memory-controller = <&mc>;
++
++ /*
++ * Placeholder values that firmware needs to update with the real
++ * offsets parsed from the microcode headers.
++ */
++ nvidia,bl-manifest-offset = <0>;
++ nvidia,bl-data-offset = <0>;
++ nvidia,bl-code-offset = <0>;
++ nvidia,os-manifest-offset = <0>;
++ nvidia,os-data-offset = <0>;
++ nvidia,os-code-offset = <0>;
++
++ /*
++ * Firmware needs to set this to "okay" once the above values have
++ * been updated.
++ */
++ status = "disabled";
++ };
++ };
++
+ pcie@140a0000 {
+ compatible = "nvidia,tegra234-pcie";
+ power-domains = <&bpmp TEGRA234_POWER_DOMAIN_PCIEX4CA>;
+--
+2.39.2
+
--- /dev/null
+From 4105df115c210fd1bf2cec2feb3018b92d0aa4e4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 23 Oct 2022 23:56:49 +0200
+Subject: arm64: zynqmp: Enable hs termination flag for USB dwc3 controller
+
+From: Michael Grzeschik <m.grzeschik@pengutronix.de>
+
+[ Upstream commit 32405e532d358a2f9d4befae928b9883c8597616 ]
+
+Since we need to support legacy phys with the dwc3 controller,
+we enable this quirk on the zynqmp platforms.
+
+Signed-off-by: Michael Grzeschik <m.grzeschik@pengutronix.de>
+Link: https://lore.kernel.org/r/20221023215649.221726-1-m.grzeschik@pengutronix.de
+Signed-off-by: Michal Simek <michal.simek@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/xilinx/zynqmp.dtsi | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi
+index 4325cb8526edc..f92df478f0eea 100644
+--- a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi
++++ b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi
+@@ -858,6 +858,7 @@ dwc3_0: usb@fe200000 {
+ clock-names = "bus_early", "ref";
+ iommus = <&smmu 0x860>;
+ snps,quirk-frame-length-adjustment = <0x20>;
++ snps,resume-hs-terminations;
+ /* dma-coherent; */
+ };
+ };
+@@ -884,6 +885,7 @@ dwc3_1: usb@fe300000 {
+ clock-names = "bus_early", "ref";
+ iommus = <&smmu 0x861>;
+ snps,quirk-frame-length-adjustment = <0x20>;
++ snps,resume-hs-terminations;
+ /* dma-coherent; */
+ };
+ };
+--
+2.39.2
+
--- /dev/null
+From 29749c2d58c565bbad59dd2576368b9be4b25d20 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Feb 2023 12:28:04 +0000
+Subject: ASoC: codecs: lpass: fix incorrect mclk rate
+
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+
+[ Upstream commit e7621434378c40b62ef858c14ae6415fb6469a8e ]
+
+For some reason we ended up with incorrect mclk rate which should be
+1920000 instead of 96000, So far we were getting lucky as the same clk
+is set to 192000 by wsa and va macro. This issue is discovered when there
+is no wsa macro active and only rx or tx path is tested.
+Fix this by setting correct rate.
+
+Fixes: c39667ddcfc5 ("ASoC: codecs: lpass-tx-macro: add support for lpass tx macro")
+Fixes: af3d54b99764 ("ASoC: codecs: lpass-rx-macro: add support for lpass rx macro")
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230209122806.18923-7-srinivas.kandagatla@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/lpass-rx-macro.c | 4 ++--
+ sound/soc/codecs/lpass-tx-macro.c | 4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/sound/soc/codecs/lpass-rx-macro.c b/sound/soc/codecs/lpass-rx-macro.c
+index dd6970d5eb8d1..8621cfabcf5b6 100644
+--- a/sound/soc/codecs/lpass-rx-macro.c
++++ b/sound/soc/codecs/lpass-rx-macro.c
+@@ -366,7 +366,7 @@
+ #define CDC_RX_DSD1_CFG2 (0x0F8C)
+ #define RX_MAX_OFFSET (0x0F8C)
+
+-#define MCLK_FREQ 9600000
++#define MCLK_FREQ 19200000
+
+ #define RX_MACRO_RATES (SNDRV_PCM_RATE_8000 | SNDRV_PCM_RATE_16000 |\
+ SNDRV_PCM_RATE_32000 | SNDRV_PCM_RATE_48000 |\
+@@ -3579,7 +3579,7 @@ static int rx_macro_probe(struct platform_device *pdev)
+
+ /* set MCLK and NPL rates */
+ clk_set_rate(rx->mclk, MCLK_FREQ);
+- clk_set_rate(rx->npl, 2 * MCLK_FREQ);
++ clk_set_rate(rx->npl, MCLK_FREQ);
+
+ ret = clk_prepare_enable(rx->macro);
+ if (ret)
+diff --git a/sound/soc/codecs/lpass-tx-macro.c b/sound/soc/codecs/lpass-tx-macro.c
+index b9475ba55e203..2449a2df66df0 100644
+--- a/sound/soc/codecs/lpass-tx-macro.c
++++ b/sound/soc/codecs/lpass-tx-macro.c
+@@ -203,7 +203,7 @@
+ #define TX_MACRO_AMIC_UNMUTE_DELAY_MS 100
+ #define TX_MACRO_DMIC_HPF_DELAY_MS 300
+ #define TX_MACRO_AMIC_HPF_DELAY_MS 300
+-#define MCLK_FREQ 9600000
++#define MCLK_FREQ 19200000
+
+ enum {
+ TX_MACRO_AIF_INVALID = 0,
+@@ -2014,7 +2014,7 @@ static int tx_macro_probe(struct platform_device *pdev)
+
+ /* set MCLK and NPL rates */
+ clk_set_rate(tx->mclk, MCLK_FREQ);
+- clk_set_rate(tx->npl, 2 * MCLK_FREQ);
++ clk_set_rate(tx->npl, MCLK_FREQ);
+
+ ret = clk_prepare_enable(tx->macro);
+ if (ret)
+--
+2.39.2
+
--- /dev/null
+From b11d685fd87e7ff6bf8704b0c37e3ff5ec075eea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Feb 2023 12:28:03 +0000
+Subject: ASoC: codecs: lpass: register mclk after runtime pm
+
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+
+[ Upstream commit 1dc3459009c33e335f0d62b84dd39a6bbd7fd5d2 ]
+
+move mclk out registration after runtime pm is enabled so that the
+clk framework can resume the codec if it requires to enable the mclk out.
+
+Fixes: c96baa2949b2 ("ASoC: codecs: wsa-macro: add runtime pm support")
+Fixes: 72ad25eabda0 ("ASoC: codecs: va-macro: add runtime pm support")
+Fixes: 366ff79ed539 ("ASoC: codecs: rx-macro: add runtime pm support")
+Fixes: 1fb83bc5cf64 ("ASoC: codecs: tx-macro: add runtime pm support")
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230209122806.18923-6-srinivas.kandagatla@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/lpass-rx-macro.c | 8 ++++----
+ sound/soc/codecs/lpass-tx-macro.c | 8 ++++----
+ sound/soc/codecs/lpass-va-macro.c | 20 ++++++++++----------
+ sound/soc/codecs/lpass-wsa-macro.c | 9 ++++-----
+ 4 files changed, 22 insertions(+), 23 deletions(-)
+
+diff --git a/sound/soc/codecs/lpass-rx-macro.c b/sound/soc/codecs/lpass-rx-macro.c
+index a9ef9d5ffcc5c..dd6970d5eb8d1 100644
+--- a/sound/soc/codecs/lpass-rx-macro.c
++++ b/sound/soc/codecs/lpass-rx-macro.c
+@@ -3601,10 +3601,6 @@ static int rx_macro_probe(struct platform_device *pdev)
+ if (ret)
+ goto err_fsgen;
+
+- ret = rx_macro_register_mclk_output(rx);
+- if (ret)
+- goto err_clkout;
+-
+ ret = devm_snd_soc_register_component(dev, &rx_macro_component_drv,
+ rx_macro_dai,
+ ARRAY_SIZE(rx_macro_dai));
+@@ -3618,6 +3614,10 @@ static int rx_macro_probe(struct platform_device *pdev)
+ pm_runtime_set_active(dev);
+ pm_runtime_enable(dev);
+
++ ret = rx_macro_register_mclk_output(rx);
++ if (ret)
++ goto err_clkout;
++
+ return 0;
+
+ err_clkout:
+diff --git a/sound/soc/codecs/lpass-tx-macro.c b/sound/soc/codecs/lpass-tx-macro.c
+index 2ef62d6edc302..b9475ba55e203 100644
+--- a/sound/soc/codecs/lpass-tx-macro.c
++++ b/sound/soc/codecs/lpass-tx-macro.c
+@@ -2036,10 +2036,6 @@ static int tx_macro_probe(struct platform_device *pdev)
+ if (ret)
+ goto err_fsgen;
+
+- ret = tx_macro_register_mclk_output(tx);
+- if (ret)
+- goto err_clkout;
+-
+ ret = devm_snd_soc_register_component(dev, &tx_macro_component_drv,
+ tx_macro_dai,
+ ARRAY_SIZE(tx_macro_dai));
+@@ -2052,6 +2048,10 @@ static int tx_macro_probe(struct platform_device *pdev)
+ pm_runtime_set_active(dev);
+ pm_runtime_enable(dev);
+
++ ret = tx_macro_register_mclk_output(tx);
++ if (ret)
++ goto err_clkout;
++
+ return 0;
+
+ err_clkout:
+diff --git a/sound/soc/codecs/lpass-va-macro.c b/sound/soc/codecs/lpass-va-macro.c
+index b0b6cf29cba30..1623ba78ddb3d 100644
+--- a/sound/soc/codecs/lpass-va-macro.c
++++ b/sound/soc/codecs/lpass-va-macro.c
+@@ -1524,16 +1524,6 @@ static int va_macro_probe(struct platform_device *pdev)
+ if (ret)
+ goto err_mclk;
+
+- ret = va_macro_register_fsgen_output(va);
+- if (ret)
+- goto err_clkout;
+-
+- va->fsgen = clk_hw_get_clk(&va->hw, "fsgen");
+- if (IS_ERR(va->fsgen)) {
+- ret = PTR_ERR(va->fsgen);
+- goto err_clkout;
+- }
+-
+ if (va->has_swr_master) {
+ /* Set default CLK div to 1 */
+ regmap_update_bits(va->regmap, CDC_VA_TOP_CSR_SWR_MIC_CTL0,
+@@ -1560,6 +1550,16 @@ static int va_macro_probe(struct platform_device *pdev)
+ pm_runtime_set_active(dev);
+ pm_runtime_enable(dev);
+
++ ret = va_macro_register_fsgen_output(va);
++ if (ret)
++ goto err_clkout;
++
++ va->fsgen = clk_hw_get_clk(&va->hw, "fsgen");
++ if (IS_ERR(va->fsgen)) {
++ ret = PTR_ERR(va->fsgen);
++ goto err_clkout;
++ }
++
+ return 0;
+
+ err_clkout:
+diff --git a/sound/soc/codecs/lpass-wsa-macro.c b/sound/soc/codecs/lpass-wsa-macro.c
+index 5cfe96f6e430e..c0b86d69c72e3 100644
+--- a/sound/soc/codecs/lpass-wsa-macro.c
++++ b/sound/soc/codecs/lpass-wsa-macro.c
+@@ -2451,11 +2451,6 @@ static int wsa_macro_probe(struct platform_device *pdev)
+ if (ret)
+ goto err_fsgen;
+
+- ret = wsa_macro_register_mclk_output(wsa);
+- if (ret)
+- goto err_clkout;
+-
+-
+ ret = devm_snd_soc_register_component(dev, &wsa_macro_component_drv,
+ wsa_macro_dai,
+ ARRAY_SIZE(wsa_macro_dai));
+@@ -2468,6 +2463,10 @@ static int wsa_macro_probe(struct platform_device *pdev)
+ pm_runtime_set_active(dev);
+ pm_runtime_enable(dev);
+
++ ret = wsa_macro_register_mclk_output(wsa);
++ if (ret)
++ goto err_clkout;
++
+ return 0;
+
+ err_clkout:
+--
+2.39.2
+
--- /dev/null
+From a41ca07caac98a7ec73881ca978aff64673777e9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Feb 2023 19:36:46 +0100
+Subject: ASoC: dt-bindings: meson: fix gx-card codec node regex
+
+From: Jerome Brunet <jbrunet@baylibre.com>
+
+[ Upstream commit 480b26226873c88e482575ceb0d0a38d76e1be57 ]
+
+'codec' is a valid node name when there is a single codec
+in the link. Fix the node regular expression to apply this.
+
+Fixes: fd00366b8e41 ("ASoC: meson: gx: add sound card dt-binding documentation")
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Link: https://lore.kernel.org/r/20230202183653.486216-3-jbrunet@baylibre.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../devicetree/bindings/sound/amlogic,gx-sound-card.yaml | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Documentation/devicetree/bindings/sound/amlogic,gx-sound-card.yaml b/Documentation/devicetree/bindings/sound/amlogic,gx-sound-card.yaml
+index 5b8d59245f82f..b358fd601ed38 100644
+--- a/Documentation/devicetree/bindings/sound/amlogic,gx-sound-card.yaml
++++ b/Documentation/devicetree/bindings/sound/amlogic,gx-sound-card.yaml
+@@ -62,7 +62,7 @@ patternProperties:
+ description: phandle of the CPU DAI
+
+ patternProperties:
+- "^codec-[0-9]+$":
++ "^codec(-[0-9]+)?$":
+ type: object
+ additionalProperties: false
+ description: |-
+--
+2.39.2
+
--- /dev/null
+From c959abd4b8566732b5e1c1ae137046ebc3257e02 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Jan 2023 15:07:54 +0800
+Subject: ASoC: fsl_sai: initialize is_dsp_mode flag
+
+From: Shengjiu Wang <shengjiu.wang@nxp.com>
+
+[ Upstream commit a23924b7dd7b748fff8e305e1daf590fed2af21b ]
+
+Initialize is_dsp_mode flag in the beginning of function
+fsl_sai_set_dai_fmt_tr().
+
+When the DAIFMT is DAIFMT_DSP_B the first time, is_dsp_mode is
+true, then the second time DAIFMT is DAIFMT_I2S, is_dsp_mode
+still true, which is a wrong state. So need to initialize
+is_dsp_mode flag every time.
+
+Fixes: a3f7dcc9cc03 ("ASoC: fsl-sai: Add SND_SOC_DAIFMT_DSP_A/B support.")
+Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
+Reviewed-by: Iuliana Prodan <iuliana.prodan@nxp.com>
+Link: https://lore.kernel.org/r/1673852874-32200-1-git-send-email-shengjiu.wang@nxp.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/fsl/fsl_sai.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/soc/fsl/fsl_sai.c b/sound/soc/fsl/fsl_sai.c
+index 35a52c3a020d1..4967f2daa6d97 100644
+--- a/sound/soc/fsl/fsl_sai.c
++++ b/sound/soc/fsl/fsl_sai.c
+@@ -281,6 +281,7 @@ static int fsl_sai_set_dai_fmt_tr(struct snd_soc_dai *cpu_dai,
+ val_cr4 |= FSL_SAI_CR4_MF;
+
+ sai->is_pdm_mode = false;
++ sai->is_dsp_mode = false;
+ /* DAI mode */
+ switch (fmt & SND_SOC_DAIFMT_FORMAT_MASK) {
+ case SND_SOC_DAIFMT_I2S:
+--
+2.39.2
+
--- /dev/null
+From d8019af63c9b9bf3d14047414bbca7172a0edce3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Jan 2023 14:41:29 -0800
+Subject: ASoC: kirkwood: Iterate over array indexes instead of using pointer
+ math
+
+From: Kees Cook <keescook@chromium.org>
+
+[ Upstream commit b3bcedc0402fcdc5c8624c433562d9d1882749d8 ]
+
+Walking the dram->cs array was seen as accesses beyond the first array
+item by the compiler. Instead, use the array index directly. This allows
+for run-time bounds checking under CONFIG_UBSAN_BOUNDS as well. Seen
+with GCC 13 with -fstrict-flex-arrays:
+
+../sound/soc/kirkwood/kirkwood-dma.c: In function
+'kirkwood_dma_conf_mbus_windows.constprop':
+../sound/soc/kirkwood/kirkwood-dma.c:90:24: warning: array subscript 0 is outside array bounds of 'const struct mbus_dram_window[0]' [-Warray-bounds=]
+ 90 | if ((cs->base & 0xffff0000) < (dma & 0xffff0000)) {
+ | ~~^~~~~~
+
+Cc: Liam Girdwood <lgirdwood@gmail.com>
+Cc: Mark Brown <broonie@kernel.org>
+Cc: Jaroslav Kysela <perex@perex.cz>
+Cc: Takashi Iwai <tiwai@suse.com>
+Cc: alsa-devel@alsa-project.org
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Link: https://lore.kernel.org/r/20230127224128.never.410-kees@kernel.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/kirkwood/kirkwood-dma.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/kirkwood/kirkwood-dma.c b/sound/soc/kirkwood/kirkwood-dma.c
+index 700a18561a940..640cebd2983e2 100644
+--- a/sound/soc/kirkwood/kirkwood-dma.c
++++ b/sound/soc/kirkwood/kirkwood-dma.c
+@@ -86,7 +86,7 @@ kirkwood_dma_conf_mbus_windows(void __iomem *base, int win,
+
+ /* try to find matching cs for current dma address */
+ for (i = 0; i < dram->num_cs; i++) {
+- const struct mbus_dram_window *cs = dram->cs + i;
++ const struct mbus_dram_window *cs = &dram->cs[i];
+ if ((cs->base & 0xffff0000) < (dma & 0xffff0000)) {
+ writel(cs->base & 0xffff0000,
+ base + KIRKWOOD_AUDIO_WIN_BASE_REG(win));
+--
+2.39.2
+
--- /dev/null
+From c532156cb212eacd677ea753945eca7009ac2b59 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Jan 2023 14:06:43 +0200
+Subject: ASoC: mchp-spdifrx: disable all interrupts in
+ mchp_spdifrx_dai_remove()
+
+From: Claudiu Beznea <claudiu.beznea@microchip.com>
+
+[ Upstream commit aaecdc32b7e35b4f9b457fb3509414aa9a932589 ]
+
+CSC interrupts which might be used in controls are on bits 8 and 9 of
+SPDIFRX_IDR register. Thus disable all the interrupts that are exported
+by driver.
+
+Fixes: ef265c55c1ac ("ASoC: mchp-spdifrx: add driver for SPDIF RX")
+Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Link: https://lore.kernel.org/r/20230130120647.638049-5-claudiu.beznea@microchip.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/atmel/mchp-spdifrx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/atmel/mchp-spdifrx.c b/sound/soc/atmel/mchp-spdifrx.c
+index 31ffaaf46dec0..b81fc77728dfc 100644
+--- a/sound/soc/atmel/mchp-spdifrx.c
++++ b/sound/soc/atmel/mchp-spdifrx.c
+@@ -921,7 +921,7 @@ static int mchp_spdifrx_dai_remove(struct snd_soc_dai *dai)
+ struct mchp_spdifrx_dev *dev = snd_soc_dai_get_drvdata(dai);
+
+ /* Disable interrupts */
+- regmap_write(dev->regmap, SPDIFRX_IDR, 0xFF);
++ regmap_write(dev->regmap, SPDIFRX_IDR, GENMASK(14, 0));
+
+ clk_disable_unprepare(dev->pclk);
+
+--
+2.39.2
+
--- /dev/null
+From 2dfecbb0b59567859a8543d89ee7e7c05bbb3739 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Jan 2023 14:06:42 +0200
+Subject: ASoC: mchp-spdifrx: fix controls that works with completion mechanism
+
+From: Claudiu Beznea <claudiu.beznea@microchip.com>
+
+[ Upstream commit d3681df44e856aab523a6eb7ba15b5e41efcbb1c ]
+
+Channel status get and channel subcode get controls relies on data
+returned by controls when certain IRQs are raised. To achieve that
+completions are used b/w controls and interrupt service routine. The
+concurrent accesses to these controls are protected by
+struct snd_card::controls_rwsem.
+
+Issues identified:
+- reinit_completion() may be called while waiting for completion
+ which should be avoided
+- in case of multiple threads waiting, the complete() call in interrupt
+ will signal only one waiting thread per interrupt which may lead to
+ timeout for the others
+- in case of channel status get as the CSC interrupt is not refcounted
+ ISR may disable interrupt for threads that were just enabled it.
+
+To solve these the access to controls were protected by a mutex. Along
+with this there is no need for spinlock to protect the software cache
+reads/updates b/w controls and ISR as the update is happening only when
+requested from control, and only one reader can reach the control.
+
+Fixes: ef265c55c1ac ("ASoC: mchp-spdifrx: add driver for SPDIF RX")
+Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Link: https://lore.kernel.org/r/20230130120647.638049-4-claudiu.beznea@microchip.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/atmel/mchp-spdifrx.c | 143 ++++++++++++++++++---------------
+ 1 file changed, 77 insertions(+), 66 deletions(-)
+
+diff --git a/sound/soc/atmel/mchp-spdifrx.c b/sound/soc/atmel/mchp-spdifrx.c
+index 7f359371b31bf..31ffaaf46dec0 100644
+--- a/sound/soc/atmel/mchp-spdifrx.c
++++ b/sound/soc/atmel/mchp-spdifrx.c
+@@ -217,7 +217,6 @@ struct mchp_spdifrx_ch_stat {
+ struct mchp_spdifrx_user_data {
+ unsigned char data[SPDIFRX_UD_BITS / 8];
+ struct completion done;
+- spinlock_t lock; /* protect access to user data */
+ };
+
+ struct mchp_spdifrx_mixer_control {
+@@ -231,8 +230,6 @@ struct mchp_spdifrx_mixer_control {
+ struct mchp_spdifrx_dev {
+ struct snd_dmaengine_dai_dma_data capture;
+ struct mchp_spdifrx_mixer_control control;
+- spinlock_t blockend_lock; /* protect access to blockend_refcount */
+- int blockend_refcount;
+ struct mutex mlock;
+ struct device *dev;
+ struct regmap *regmap;
+@@ -277,37 +274,11 @@ static void mchp_spdifrx_channel_user_data_read(struct mchp_spdifrx_dev *dev,
+ }
+ }
+
+-/* called from non-atomic context only */
+-static void mchp_spdifrx_isr_blockend_en(struct mchp_spdifrx_dev *dev)
+-{
+- unsigned long flags;
+-
+- spin_lock_irqsave(&dev->blockend_lock, flags);
+- dev->blockend_refcount++;
+- /* don't enable BLOCKEND interrupt if it's already enabled */
+- if (dev->blockend_refcount == 1)
+- regmap_write(dev->regmap, SPDIFRX_IER, SPDIFRX_IR_BLOCKEND);
+- spin_unlock_irqrestore(&dev->blockend_lock, flags);
+-}
+-
+-/* called from atomic/non-atomic context */
+-static void mchp_spdifrx_isr_blockend_dis(struct mchp_spdifrx_dev *dev)
+-{
+- unsigned long flags;
+-
+- spin_lock_irqsave(&dev->blockend_lock, flags);
+- dev->blockend_refcount--;
+- /* don't enable BLOCKEND interrupt if it's already enabled */
+- if (dev->blockend_refcount == 0)
+- regmap_write(dev->regmap, SPDIFRX_IDR, SPDIFRX_IR_BLOCKEND);
+- spin_unlock_irqrestore(&dev->blockend_lock, flags);
+-}
+-
+ static irqreturn_t mchp_spdif_interrupt(int irq, void *dev_id)
+ {
+ struct mchp_spdifrx_dev *dev = dev_id;
+ struct mchp_spdifrx_mixer_control *ctrl = &dev->control;
+- u32 sr, imr, pending, idr = 0;
++ u32 sr, imr, pending;
+ irqreturn_t ret = IRQ_NONE;
+ int ch;
+
+@@ -322,13 +293,10 @@ static irqreturn_t mchp_spdif_interrupt(int irq, void *dev_id)
+
+ if (pending & SPDIFRX_IR_BLOCKEND) {
+ for (ch = 0; ch < SPDIFRX_CHANNELS; ch++) {
+- spin_lock(&ctrl->user_data[ch].lock);
+ mchp_spdifrx_channel_user_data_read(dev, ch);
+- spin_unlock(&ctrl->user_data[ch].lock);
+-
+ complete(&ctrl->user_data[ch].done);
+ }
+- mchp_spdifrx_isr_blockend_dis(dev);
++ regmap_write(dev->regmap, SPDIFRX_IDR, SPDIFRX_IR_BLOCKEND);
+ ret = IRQ_HANDLED;
+ }
+
+@@ -336,7 +304,7 @@ static irqreturn_t mchp_spdif_interrupt(int irq, void *dev_id)
+ if (pending & SPDIFRX_IR_CSC(ch)) {
+ mchp_spdifrx_channel_status_read(dev, ch);
+ complete(&ctrl->ch_stat[ch].done);
+- idr |= SPDIFRX_IR_CSC(ch);
++ regmap_write(dev->regmap, SPDIFRX_IDR, SPDIFRX_IR_CSC(ch));
+ ret = IRQ_HANDLED;
+ }
+ }
+@@ -346,8 +314,6 @@ static irqreturn_t mchp_spdif_interrupt(int irq, void *dev_id)
+ ret = IRQ_HANDLED;
+ }
+
+- regmap_write(dev->regmap, SPDIFRX_IDR, idr);
+-
+ return ret;
+ }
+
+@@ -517,23 +483,51 @@ static int mchp_spdifrx_cs_get(struct mchp_spdifrx_dev *dev,
+ {
+ struct mchp_spdifrx_mixer_control *ctrl = &dev->control;
+ struct mchp_spdifrx_ch_stat *ch_stat = &ctrl->ch_stat[channel];
+- int ret;
++ int ret = 0;
++
++ mutex_lock(&dev->mlock);
+
+- regmap_write(dev->regmap, SPDIFRX_IER, SPDIFRX_IR_CSC(channel));
+- /* check for new data available */
+- ret = wait_for_completion_interruptible_timeout(&ch_stat->done,
+- msecs_to_jiffies(100));
+- /* IP might not be started or valid stream might not be present */
+- if (ret <= 0) {
+- dev_dbg(dev->dev, "channel status for channel %d timeout\n",
+- channel);
+- return ret ? : -ETIMEDOUT;
++ /*
++ * We may reach this point with both clocks enabled but the receiver
++ * still disabled. To void waiting for completion and return with
++ * timeout check the dev->trigger_enabled.
++ *
++ * To retrieve data:
++ * - if the receiver is enabled CSC IRQ will update the data in software
++ * caches (ch_stat->data)
++ * - otherwise we just update it here the software caches with latest
++ * available information and return it; in this case we don't need
++ * spin locking as the IRQ is disabled and will not be raised from
++ * anywhere else.
++ */
++
++ if (dev->trigger_enabled) {
++ reinit_completion(&ch_stat->done);
++ regmap_write(dev->regmap, SPDIFRX_IER, SPDIFRX_IR_CSC(channel));
++ /* Check for new data available */
++ ret = wait_for_completion_interruptible_timeout(&ch_stat->done,
++ msecs_to_jiffies(100));
++ /* Valid stream might not be present */
++ if (ret <= 0) {
++ dev_dbg(dev->dev, "channel status for channel %d timeout\n",
++ channel);
++ regmap_write(dev->regmap, SPDIFRX_IDR, SPDIFRX_IR_CSC(channel));
++ ret = ret ? : -ETIMEDOUT;
++ goto unlock;
++ } else {
++ ret = 0;
++ }
++ } else {
++ /* Update software cache with latest channel status. */
++ mchp_spdifrx_channel_status_read(dev, channel);
+ }
+
+ memcpy(uvalue->value.iec958.status, ch_stat->data,
+ sizeof(ch_stat->data));
+
+- return 0;
++unlock:
++ mutex_unlock(&dev->mlock);
++ return ret;
+ }
+
+ static int mchp_spdifrx_cs1_get(struct snd_kcontrol *kcontrol,
+@@ -567,29 +561,49 @@ static int mchp_spdifrx_subcode_ch_get(struct mchp_spdifrx_dev *dev,
+ int channel,
+ struct snd_ctl_elem_value *uvalue)
+ {
+- unsigned long flags;
+ struct mchp_spdifrx_mixer_control *ctrl = &dev->control;
+ struct mchp_spdifrx_user_data *user_data = &ctrl->user_data[channel];
+- int ret;
++ int ret = 0;
++
++ mutex_lock(&dev->mlock);
++
++ /*
++ * We may reach this point with both clocks enabled but the receiver
++ * still disabled. To void waiting for completion to just timeout we
++ * check here the dev->trigger_enabled flag.
++ *
++ * To retrieve data:
++ * - if the receiver is enabled we need to wait for blockend IRQ to read
++ * data to and update it for us in software caches
++ * - otherwise reading the SPDIFRX_CHUD() registers is enough.
++ */
+
+- reinit_completion(&user_data->done);
+- mchp_spdifrx_isr_blockend_en(dev);
+- ret = wait_for_completion_interruptible_timeout(&user_data->done,
+- msecs_to_jiffies(100));
+- /* IP might not be started or valid stream might not be present */
+- if (ret <= 0) {
+- dev_dbg(dev->dev, "user data for channel %d timeout\n",
+- channel);
+- mchp_spdifrx_isr_blockend_dis(dev);
+- return ret ? : -ETIMEDOUT;
++ if (dev->trigger_enabled) {
++ reinit_completion(&user_data->done);
++ regmap_write(dev->regmap, SPDIFRX_IER, SPDIFRX_IR_BLOCKEND);
++ ret = wait_for_completion_interruptible_timeout(&user_data->done,
++ msecs_to_jiffies(100));
++ /* Valid stream might not be present. */
++ if (ret <= 0) {
++ dev_dbg(dev->dev, "user data for channel %d timeout\n",
++ channel);
++ regmap_write(dev->regmap, SPDIFRX_IDR, SPDIFRX_IR_BLOCKEND);
++ ret = ret ? : -ETIMEDOUT;
++ goto unlock;
++ } else {
++ ret = 0;
++ }
++ } else {
++ /* Update software cache with last available data. */
++ mchp_spdifrx_channel_user_data_read(dev, channel);
+ }
+
+- spin_lock_irqsave(&user_data->lock, flags);
+ memcpy(uvalue->value.iec958.subcode, user_data->data,
+ sizeof(user_data->data));
+- spin_unlock_irqrestore(&user_data->lock, flags);
+
+- return 0;
++unlock:
++ mutex_unlock(&dev->mlock);
++ return ret;
+ }
+
+ static int mchp_spdifrx_subcode_ch1_get(struct snd_kcontrol *kcontrol,
+@@ -890,11 +904,9 @@ static int mchp_spdifrx_dai_probe(struct snd_soc_dai *dai)
+ SPDIFRX_MR_AUTORST_NOACTION |
+ SPDIFRX_MR_PACK_DISABLED);
+
+- dev->blockend_refcount = 0;
+ for (ch = 0; ch < SPDIFRX_CHANNELS; ch++) {
+ init_completion(&ctrl->ch_stat[ch].done);
+ init_completion(&ctrl->user_data[ch].done);
+- spin_lock_init(&ctrl->user_data[ch].lock);
+ }
+
+ /* Add controls */
+@@ -1005,7 +1017,6 @@ static int mchp_spdifrx_probe(struct platform_device *pdev)
+ */
+ clk_set_min_rate(dev->gclk, 48000 * SPDIFRX_GCLK_RATIO_MIN + 1);
+
+- spin_lock_init(&dev->blockend_lock);
+ mutex_init(&dev->mlock);
+
+ dev->dev = &pdev->dev;
+--
+2.39.2
+
--- /dev/null
+From 39deeadc7d18c63fe9e7b7fff6d686c786585233 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Jan 2023 14:06:40 +0200
+Subject: ASoC: mchp-spdifrx: fix controls which rely on rsr register
+
+From: Claudiu Beznea <claudiu.beznea@microchip.com>
+
+[ Upstream commit fa09fa60385abbf99342494b280da8b4aebbc0e9 ]
+
+The SPDIFRX block is clocked by 2 clocks: peripheral and generic clocks.
+Peripheral clock feeds user interface (registers) and generic clock feeds
+the receiver.
+
+To enable the receiver the generic clock needs to be enabled and also the
+ENABLE bit of MCHP_SPDIFRX_MR register need to be set.
+
+The signal control exported by mchp-spdifrx driver reports wrong status
+when the receiver is disabled. This can happen when requesting the signal
+and the capture was not previously started. To solve this the receiver
+needs to be enabled (by enabling generic clock and setting ENABLE bit of
+MR register) before reading the signal status.
+
+As with this fix there are 2 paths now that need to control the generic
+clock and ENABLE bit of SPDIFRX_MR register (one path though controls, one
+path though configuration) a mutex has been introduced. We can't rely on
+subsystem locking as the controls are protected by
+struct snd_card::controls_rwsem semaphore and configuration is protected
+by a different lock (embedded in snd_pcm_stream_lock_irq()).
+
+The introduction of mutex is also extended to other controls which rely on
+SPDIFRX_RSR.ULOCK bit as it has been discovered experimentally that having
+both clocks enabled but not the receiver (through ENABLE bit of SPDIFRX.MR)
+leads to inconsistent values of SPDIFRX_RSR.ULOCK. Thus on some controls we
+rely on software state (dev->trigger_enabled protected by mutex) to
+retrieve proper values.
+
+Fixes: ef265c55c1ac ("ASoC: mchp-spdifrx: add driver for SPDIF RX")
+Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Link: https://lore.kernel.org/r/20230130120647.638049-2-claudiu.beznea@microchip.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/atmel/mchp-spdifrx.c | 192 ++++++++++++++++++++++++---------
+ 1 file changed, 142 insertions(+), 50 deletions(-)
+
+diff --git a/sound/soc/atmel/mchp-spdifrx.c b/sound/soc/atmel/mchp-spdifrx.c
+index ec0705cc40fab..2d86e0ec930fa 100644
+--- a/sound/soc/atmel/mchp-spdifrx.c
++++ b/sound/soc/atmel/mchp-spdifrx.c
+@@ -233,11 +233,13 @@ struct mchp_spdifrx_dev {
+ struct mchp_spdifrx_mixer_control control;
+ spinlock_t blockend_lock; /* protect access to blockend_refcount */
+ int blockend_refcount;
++ struct mutex mlock;
+ struct device *dev;
+ struct regmap *regmap;
+ struct clk *pclk;
+ struct clk *gclk;
+ unsigned int fmt;
++ unsigned int trigger_enabled;
+ unsigned int gclk_enabled:1;
+ };
+
+@@ -353,47 +355,40 @@ static int mchp_spdifrx_trigger(struct snd_pcm_substream *substream, int cmd,
+ struct snd_soc_dai *dai)
+ {
+ struct mchp_spdifrx_dev *dev = snd_soc_dai_get_drvdata(dai);
+- u32 mr;
+- int running;
+- int ret;
+-
+- regmap_read(dev->regmap, SPDIFRX_MR, &mr);
+- running = !!(mr & SPDIFRX_MR_RXEN_ENABLE);
++ int ret = 0;
+
+ switch (cmd) {
+ case SNDRV_PCM_TRIGGER_START:
+ case SNDRV_PCM_TRIGGER_RESUME:
+ case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
+- if (!running) {
+- mr &= ~SPDIFRX_MR_RXEN_MASK;
+- mr |= SPDIFRX_MR_RXEN_ENABLE;
+- /* enable overrun interrupts */
+- regmap_write(dev->regmap, SPDIFRX_IER,
+- SPDIFRX_IR_OVERRUN);
+- }
++ mutex_lock(&dev->mlock);
++ /* Enable overrun interrupts */
++ regmap_write(dev->regmap, SPDIFRX_IER, SPDIFRX_IR_OVERRUN);
++
++ /* Enable receiver. */
++ regmap_update_bits(dev->regmap, SPDIFRX_MR, SPDIFRX_MR_RXEN_MASK,
++ SPDIFRX_MR_RXEN_ENABLE);
++ dev->trigger_enabled = true;
++ mutex_unlock(&dev->mlock);
+ break;
+ case SNDRV_PCM_TRIGGER_STOP:
+ case SNDRV_PCM_TRIGGER_SUSPEND:
+ case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
+- if (running) {
+- mr &= ~SPDIFRX_MR_RXEN_MASK;
+- mr |= SPDIFRX_MR_RXEN_DISABLE;
+- /* disable overrun interrupts */
+- regmap_write(dev->regmap, SPDIFRX_IDR,
+- SPDIFRX_IR_OVERRUN);
+- }
++ mutex_lock(&dev->mlock);
++ /* Disable overrun interrupts */
++ regmap_write(dev->regmap, SPDIFRX_IDR, SPDIFRX_IR_OVERRUN);
++
++ /* Disable receiver. */
++ regmap_update_bits(dev->regmap, SPDIFRX_MR, SPDIFRX_MR_RXEN_MASK,
++ SPDIFRX_MR_RXEN_DISABLE);
++ dev->trigger_enabled = false;
++ mutex_unlock(&dev->mlock);
+ break;
+ default:
+- return -EINVAL;
++ ret = -EINVAL;
+ }
+
+- ret = regmap_write(dev->regmap, SPDIFRX_MR, mr);
+- if (ret) {
+- dev_err(dev->dev, "unable to enable/disable RX: %d\n", ret);
+- return ret;
+- }
+-
+- return 0;
++ return ret;
+ }
+
+ static int mchp_spdifrx_hw_params(struct snd_pcm_substream *substream,
+@@ -413,13 +408,6 @@ static int mchp_spdifrx_hw_params(struct snd_pcm_substream *substream,
+ return -EINVAL;
+ }
+
+- regmap_read(dev->regmap, SPDIFRX_MR, &mr);
+-
+- if (mr & SPDIFRX_MR_RXEN_ENABLE) {
+- dev_err(dev->dev, "PCM already running\n");
+- return -EBUSY;
+- }
+-
+ if (params_channels(params) != SPDIFRX_CHANNELS) {
+ dev_err(dev->dev, "unsupported number of channels: %d\n",
+ params_channels(params));
+@@ -445,6 +433,13 @@ static int mchp_spdifrx_hw_params(struct snd_pcm_substream *substream,
+ return -EINVAL;
+ }
+
++ mutex_lock(&dev->mlock);
++ if (dev->trigger_enabled) {
++ dev_err(dev->dev, "PCM already running\n");
++ ret = -EBUSY;
++ goto unlock;
++ }
++
+ if (dev->gclk_enabled) {
+ clk_disable_unprepare(dev->gclk);
+ dev->gclk_enabled = 0;
+@@ -455,19 +450,24 @@ static int mchp_spdifrx_hw_params(struct snd_pcm_substream *substream,
+ dev_err(dev->dev,
+ "unable to set gclk min rate: rate %u * ratio %u + 1\n",
+ params_rate(params), SPDIFRX_GCLK_RATIO_MIN);
+- return ret;
++ goto unlock;
+ }
+ ret = clk_prepare_enable(dev->gclk);
+ if (ret) {
+ dev_err(dev->dev, "unable to enable gclk: %d\n", ret);
+- return ret;
++ goto unlock;
+ }
+ dev->gclk_enabled = 1;
+
+ dev_dbg(dev->dev, "GCLK range min set to %d\n",
+ params_rate(params) * SPDIFRX_GCLK_RATIO_MIN + 1);
+
+- return regmap_write(dev->regmap, SPDIFRX_MR, mr);
++ ret = regmap_write(dev->regmap, SPDIFRX_MR, mr);
++
++unlock:
++ mutex_unlock(&dev->mlock);
++
++ return ret;
+ }
+
+ static int mchp_spdifrx_hw_free(struct snd_pcm_substream *substream,
+@@ -475,10 +475,12 @@ static int mchp_spdifrx_hw_free(struct snd_pcm_substream *substream,
+ {
+ struct mchp_spdifrx_dev *dev = snd_soc_dai_get_drvdata(dai);
+
++ mutex_lock(&dev->mlock);
+ if (dev->gclk_enabled) {
+ clk_disable_unprepare(dev->gclk);
+ dev->gclk_enabled = 0;
+ }
++ mutex_unlock(&dev->mlock);
+ return 0;
+ }
+
+@@ -627,10 +629,24 @@ static int mchp_spdifrx_ulock_get(struct snd_kcontrol *kcontrol,
+ u32 val;
+ bool ulock_old = ctrl->ulock;
+
+- regmap_read(dev->regmap, SPDIFRX_RSR, &val);
+- ctrl->ulock = !(val & SPDIFRX_RSR_ULOCK);
++ mutex_lock(&dev->mlock);
++
++ /*
++ * The RSR.ULOCK has wrong value if both pclk and gclk are enabled
++ * and the receiver is disabled. Thus we take into account the
++ * dev->trigger_enabled here to return a real status.
++ */
++ if (dev->trigger_enabled) {
++ regmap_read(dev->regmap, SPDIFRX_RSR, &val);
++ ctrl->ulock = !(val & SPDIFRX_RSR_ULOCK);
++ } else {
++ ctrl->ulock = 0;
++ }
++
+ uvalue->value.integer.value[0] = ctrl->ulock;
+
++ mutex_unlock(&dev->mlock);
++
+ return ulock_old != ctrl->ulock;
+ }
+
+@@ -643,8 +659,22 @@ static int mchp_spdifrx_badf_get(struct snd_kcontrol *kcontrol,
+ u32 val;
+ bool badf_old = ctrl->badf;
+
+- regmap_read(dev->regmap, SPDIFRX_RSR, &val);
+- ctrl->badf = !!(val & SPDIFRX_RSR_BADF);
++ mutex_lock(&dev->mlock);
++
++ /*
++ * The RSR.ULOCK has wrong value if both pclk and gclk are enabled
++ * and the receiver is disabled. Thus we take into account the
++ * dev->trigger_enabled here to return a real status.
++ */
++ if (dev->trigger_enabled) {
++ regmap_read(dev->regmap, SPDIFRX_RSR, &val);
++ ctrl->badf = !!(val & SPDIFRX_RSR_BADF);
++ } else {
++ ctrl->badf = 0;
++ }
++
++ mutex_unlock(&dev->mlock);
++
+ uvalue->value.integer.value[0] = ctrl->badf;
+
+ return badf_old != ctrl->badf;
+@@ -656,11 +686,48 @@ static int mchp_spdifrx_signal_get(struct snd_kcontrol *kcontrol,
+ struct snd_soc_dai *dai = snd_kcontrol_chip(kcontrol);
+ struct mchp_spdifrx_dev *dev = snd_soc_dai_get_drvdata(dai);
+ struct mchp_spdifrx_mixer_control *ctrl = &dev->control;
+- u32 val;
++ u32 val = ~0U, loops = 10;
++ int ret;
+ bool signal_old = ctrl->signal;
+
+- regmap_read(dev->regmap, SPDIFRX_RSR, &val);
+- ctrl->signal = !(val & SPDIFRX_RSR_NOSIGNAL);
++ mutex_lock(&dev->mlock);
++
++ /*
++ * To get the signal we need to have receiver enabled. This
++ * could be enabled also from trigger() function thus we need to
++ * take care of not disabling the receiver when it runs.
++ */
++ if (!dev->trigger_enabled) {
++ ret = clk_prepare_enable(dev->gclk);
++ if (ret)
++ goto unlock;
++
++ regmap_update_bits(dev->regmap, SPDIFRX_MR, SPDIFRX_MR_RXEN_MASK,
++ SPDIFRX_MR_RXEN_ENABLE);
++
++ /* Wait for RSR.ULOCK bit. */
++ while (--loops) {
++ regmap_read(dev->regmap, SPDIFRX_RSR, &val);
++ if (!(val & SPDIFRX_RSR_ULOCK))
++ break;
++ usleep_range(100, 150);
++ }
++
++ regmap_update_bits(dev->regmap, SPDIFRX_MR, SPDIFRX_MR_RXEN_MASK,
++ SPDIFRX_MR_RXEN_DISABLE);
++
++ clk_disable_unprepare(dev->gclk);
++ } else {
++ regmap_read(dev->regmap, SPDIFRX_RSR, &val);
++ }
++
++unlock:
++ mutex_unlock(&dev->mlock);
++
++ if (!(val & SPDIFRX_RSR_ULOCK))
++ ctrl->signal = !(val & SPDIFRX_RSR_NOSIGNAL);
++ else
++ ctrl->signal = 0;
+ uvalue->value.integer.value[0] = ctrl->signal;
+
+ return signal_old != ctrl->signal;
+@@ -685,18 +752,32 @@ static int mchp_spdifrx_rate_get(struct snd_kcontrol *kcontrol,
+ u32 val;
+ int rate;
+
+- regmap_read(dev->regmap, SPDIFRX_RSR, &val);
+-
+- /* if the receiver is not locked, ISF data is invalid */
+- if (val & SPDIFRX_RSR_ULOCK || !(val & SPDIFRX_RSR_IFS_MASK)) {
++ mutex_lock(&dev->mlock);
++
++ /*
++ * The RSR.ULOCK has wrong value if both pclk and gclk are enabled
++ * and the receiver is disabled. Thus we take into account the
++ * dev->trigger_enabled here to return a real status.
++ */
++ if (dev->trigger_enabled) {
++ regmap_read(dev->regmap, SPDIFRX_RSR, &val);
++ /* If the receiver is not locked, ISF data is invalid. */
++ if (val & SPDIFRX_RSR_ULOCK || !(val & SPDIFRX_RSR_IFS_MASK)) {
++ ucontrol->value.integer.value[0] = 0;
++ goto unlock;
++ }
++ } else {
++ /* Reveicer is not locked, IFS data is invalid. */
+ ucontrol->value.integer.value[0] = 0;
+- return 0;
++ goto unlock;
+ }
+
+ rate = clk_get_rate(dev->gclk);
+
+ ucontrol->value.integer.value[0] = rate / (32 * SPDIFRX_RSR_IFS(val));
+
++unlock:
++ mutex_unlock(&dev->mlock);
+ return 0;
+ }
+
+@@ -913,7 +994,18 @@ static int mchp_spdifrx_probe(struct platform_device *pdev)
+ "failed to get the PMC generated clock: %d\n", err);
+ return err;
+ }
++
++ /*
++ * Signal control need a valid rate on gclk. hw_params() configures
++ * it propertly but requesting signal before any hw_params() has been
++ * called lead to invalid value returned for signal. Thus, configure
++ * gclk at a valid rate, here, in initialization, to simplify the
++ * control path.
++ */
++ clk_set_min_rate(dev->gclk, 48000 * SPDIFRX_GCLK_RATIO_MIN + 1);
++
+ spin_lock_init(&dev->blockend_lock);
++ mutex_init(&dev->mlock);
+
+ dev->dev = &pdev->dev;
+ dev->regmap = regmap;
+--
+2.39.2
+
--- /dev/null
+From 4e19c1aa4f3d9dc49e1ee90825b26d62d0c07d13 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Jan 2023 14:06:41 +0200
+Subject: ASoC: mchp-spdifrx: fix return value in case completion times out
+
+From: Claudiu Beznea <claudiu.beznea@microchip.com>
+
+[ Upstream commit a4c4161d6eae3ef5f486d1638ef452d9bc1376b0 ]
+
+wait_for_completion_interruptible_timeout() returns 0 in case of
+timeout. Check this into account when returning from function.
+
+Fixes: ef265c55c1ac ("ASoC: mchp-spdifrx: add driver for SPDIF RX")
+Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Link: https://lore.kernel.org/r/20230130120647.638049-3-claudiu.beznea@microchip.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/atmel/mchp-spdifrx.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/atmel/mchp-spdifrx.c b/sound/soc/atmel/mchp-spdifrx.c
+index 2d86e0ec930fa..7f359371b31bf 100644
+--- a/sound/soc/atmel/mchp-spdifrx.c
++++ b/sound/soc/atmel/mchp-spdifrx.c
+@@ -524,9 +524,10 @@ static int mchp_spdifrx_cs_get(struct mchp_spdifrx_dev *dev,
+ ret = wait_for_completion_interruptible_timeout(&ch_stat->done,
+ msecs_to_jiffies(100));
+ /* IP might not be started or valid stream might not be present */
+- if (ret < 0) {
++ if (ret <= 0) {
+ dev_dbg(dev->dev, "channel status for channel %d timeout\n",
+ channel);
++ return ret ? : -ETIMEDOUT;
+ }
+
+ memcpy(uvalue->value.iec958.status, ch_stat->data,
+@@ -580,7 +581,7 @@ static int mchp_spdifrx_subcode_ch_get(struct mchp_spdifrx_dev *dev,
+ dev_dbg(dev->dev, "user data for channel %d timeout\n",
+ channel);
+ mchp_spdifrx_isr_blockend_dis(dev);
+- return ret;
++ return ret ? : -ETIMEDOUT;
+ }
+
+ spin_lock_irqsave(&user_data->lock, flags);
+--
+2.39.2
+
--- /dev/null
+From 952a0f10a0467e37321e9a047089d091ed8188f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Feb 2023 09:34:19 -0700
+Subject: ASoC: mchp-spdifrx: Fix uninitialized use of mr in
+ mchp_spdifrx_hw_params()
+
+From: Nathan Chancellor <nathan@kernel.org>
+
+[ Upstream commit 218674a45930c700486d27b765bf2f1b43f8cbf7 ]
+
+Clang warns:
+
+ ../sound/soc/atmel/mchp-spdifrx.c:455:3: error: variable 'mr' is uninitialized when used here [-Werror,-Wuninitialized]
+ mr |= SPDIFRX_MR_ENDIAN_BIG;
+ ^~
+ ../sound/soc/atmel/mchp-spdifrx.c:432:8: note: initialize the variable 'mr' to silence this warning
+ u32 mr;
+ ^
+ = 0
+ 1 error generated.
+
+Zero initialize mr so that these bitwise OR and assignment operation
+works unconditionally.
+
+Fixes: fa09fa60385a ("ASoC: mchp-spdifrx: fix controls which rely on rsr register")
+Link: https://github.com/ClangBuiltLinux/linux/issues/1797
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Reviewed-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Link: https://lore.kernel.org/r/20230202-mchp-spdifrx-fix-uninit-mr-v1-1-629a045d7a2f@kernel.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/atmel/mchp-spdifrx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/atmel/mchp-spdifrx.c b/sound/soc/atmel/mchp-spdifrx.c
+index b81fc77728dfc..76ce37f641ebd 100644
+--- a/sound/soc/atmel/mchp-spdifrx.c
++++ b/sound/soc/atmel/mchp-spdifrx.c
+@@ -362,7 +362,7 @@ static int mchp_spdifrx_hw_params(struct snd_pcm_substream *substream,
+ struct snd_soc_dai *dai)
+ {
+ struct mchp_spdifrx_dev *dev = snd_soc_dai_get_drvdata(dai);
+- u32 mr;
++ u32 mr = 0;
+ int ret;
+
+ dev_dbg(dev->dev, "%s() rate=%u format=%#x width=%u channels=%u\n",
+--
+2.39.2
+
--- /dev/null
+From a8e20d2585043e5de9407e3d743b291bf20901c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Feb 2023 12:28:01 +0000
+Subject: ASoC: qcom: q6apm-dai: Add SNDRV_PCM_INFO_BATCH flag
+
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+
+[ Upstream commit aa759f3f9f4394a3af65ad1772fca6cb9dd9e4cc ]
+
+At the moment, playing audio with PulseAudio with the qdsp6 driver
+results in distorted sound. It seems like its timer-based scheduling
+does not work properly with qdsp6 since setting tsched=0 in
+the PulseAudio configuration avoids the issue.
+
+Apparently this happens when the pointer() callback is not accurate
+enough. There is a SNDRV_PCM_INFO_BATCH flag that can be used to stop
+PulseAudio from using timer-based scheduling by default.
+
+According to https://www.alsa-project.org/pipermail/alsa-devel/2014-March/073816.html:
+
+The flag is being used in the sense explained in the previous audio
+meeting -- the data transfer granularity isn't fine enough but aligned
+to the period size (or less).
+
+q6apm-dai reports the position as multiple of
+
+prtd->pcm_count = snd_pcm_lib_period_bytes(substream)
+
+so it indeed just a multiple of the period size.
+
+Therefore adding the flag here seems appropriate and makes audio
+work out of the box.
+
+Comment log inspired by Stephan Gerhold sent for q6asm-dai.c few years back.
+
+Fixes: 9b4fe0f1cd79 ("ASoC: qdsp6: audioreach: add q6apm-dai support")
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230209122806.18923-4-srinivas.kandagatla@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/qcom/qdsp6/q6apm-dai.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/qcom/qdsp6/q6apm-dai.c b/sound/soc/qcom/qdsp6/q6apm-dai.c
+index bd35067a40521..7f02f5b2c33fd 100644
+--- a/sound/soc/qcom/qdsp6/q6apm-dai.c
++++ b/sound/soc/qcom/qdsp6/q6apm-dai.c
+@@ -64,7 +64,8 @@ struct q6apm_dai_data {
+ static struct snd_pcm_hardware q6apm_dai_hardware_capture = {
+ .info = (SNDRV_PCM_INFO_MMAP | SNDRV_PCM_INFO_BLOCK_TRANSFER |
+ SNDRV_PCM_INFO_MMAP_VALID | SNDRV_PCM_INFO_INTERLEAVED |
+- SNDRV_PCM_INFO_PAUSE | SNDRV_PCM_INFO_RESUME),
++ SNDRV_PCM_INFO_PAUSE | SNDRV_PCM_INFO_RESUME |
++ SNDRV_PCM_INFO_BATCH),
+ .formats = (SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S24_LE),
+ .rates = SNDRV_PCM_RATE_8000_48000,
+ .rate_min = 8000,
+@@ -82,7 +83,8 @@ static struct snd_pcm_hardware q6apm_dai_hardware_capture = {
+ static struct snd_pcm_hardware q6apm_dai_hardware_playback = {
+ .info = (SNDRV_PCM_INFO_MMAP | SNDRV_PCM_INFO_BLOCK_TRANSFER |
+ SNDRV_PCM_INFO_MMAP_VALID | SNDRV_PCM_INFO_INTERLEAVED |
+- SNDRV_PCM_INFO_PAUSE | SNDRV_PCM_INFO_RESUME),
++ SNDRV_PCM_INFO_PAUSE | SNDRV_PCM_INFO_RESUME |
++ SNDRV_PCM_INFO_BATCH),
+ .formats = (SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S24_LE),
+ .rates = SNDRV_PCM_RATE_8000_192000,
+ .rate_min = 8000,
+--
+2.39.2
+
--- /dev/null
+From b521dccde554ce9aab242a2aaf664d16ba098aad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Feb 2023 12:28:00 +0000
+Subject: ASoC: qcom: q6apm-dai: fix race condition while updating the position
+ pointer
+
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+
+[ Upstream commit 84222ef54bfd8f043c23c8603fd5257a64b00780 ]
+
+It is noticed that the position pointer value seems to get a get corrupted
+due to missing locking between updating and reading.
+
+Fix this by adding a spinlock around the position pointer.
+
+Fixes: 9b4fe0f1cd79 ("ASoC: qdsp6: audioreach: add q6apm-dai support")
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230209122806.18923-3-srinivas.kandagatla@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/qcom/qdsp6/q6apm-dai.c | 16 +++++++++++++++-
+ 1 file changed, 15 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/qcom/qdsp6/q6apm-dai.c b/sound/soc/qcom/qdsp6/q6apm-dai.c
+index ee59ef36b85a6..bd35067a40521 100644
+--- a/sound/soc/qcom/qdsp6/q6apm-dai.c
++++ b/sound/soc/qcom/qdsp6/q6apm-dai.c
+@@ -8,6 +8,7 @@
+ #include <linux/slab.h>
+ #include <sound/soc.h>
+ #include <sound/soc-dapm.h>
++#include <linux/spinlock.h>
+ #include <sound/pcm.h>
+ #include <asm/dma.h>
+ #include <linux/dma-mapping.h>
+@@ -53,6 +54,7 @@ struct q6apm_dai_rtd {
+ uint16_t session_id;
+ enum stream_state state;
+ struct q6apm_graph *graph;
++ spinlock_t lock;
+ };
+
+ struct q6apm_dai_data {
+@@ -99,20 +101,25 @@ static void event_handler(uint32_t opcode, uint32_t token, uint32_t *payload, vo
+ {
+ struct q6apm_dai_rtd *prtd = priv;
+ struct snd_pcm_substream *substream = prtd->substream;
++ unsigned long flags;
+
+ switch (opcode) {
+ case APM_CLIENT_EVENT_CMD_EOS_DONE:
+ prtd->state = Q6APM_STREAM_STOPPED;
+ break;
+ case APM_CLIENT_EVENT_DATA_WRITE_DONE:
++ spin_lock_irqsave(&prtd->lock, flags);
+ prtd->pos += prtd->pcm_count;
++ spin_unlock_irqrestore(&prtd->lock, flags);
+ snd_pcm_period_elapsed(substream);
+ if (prtd->state == Q6APM_STREAM_RUNNING)
+ q6apm_write_async(prtd->graph, prtd->pcm_count, 0, 0, 0);
+
+ break;
+ case APM_CLIENT_EVENT_DATA_READ_DONE:
++ spin_lock_irqsave(&prtd->lock, flags);
+ prtd->pos += prtd->pcm_count;
++ spin_unlock_irqrestore(&prtd->lock, flags);
+ snd_pcm_period_elapsed(substream);
+ if (prtd->state == Q6APM_STREAM_RUNNING)
+ q6apm_read(prtd->graph);
+@@ -253,6 +260,7 @@ static int q6apm_dai_open(struct snd_soc_component *component,
+ if (prtd == NULL)
+ return -ENOMEM;
+
++ spin_lock_init(&prtd->lock);
+ prtd->substream = substream;
+ prtd->graph = q6apm_graph_open(dev, (q6apm_cb)event_handler, prtd, graph_id);
+ if (IS_ERR(prtd->graph)) {
+@@ -332,11 +340,17 @@ static snd_pcm_uframes_t q6apm_dai_pointer(struct snd_soc_component *component,
+ {
+ struct snd_pcm_runtime *runtime = substream->runtime;
+ struct q6apm_dai_rtd *prtd = runtime->private_data;
++ snd_pcm_uframes_t ptr;
++ unsigned long flags;
+
++ spin_lock_irqsave(&prtd->lock, flags);
+ if (prtd->pos == prtd->pcm_size)
+ prtd->pos = 0;
+
+- return bytes_to_frames(runtime, prtd->pos);
++ ptr = bytes_to_frames(runtime, prtd->pos);
++ spin_unlock_irqrestore(&prtd->lock, flags);
++
++ return ptr;
+ }
+
+ static int q6apm_dai_hw_params(struct snd_soc_component *component,
+--
+2.39.2
+
--- /dev/null
+From 550d09459d5267c1badc5cfdb016ca4b17789d24 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Feb 2023 12:27:59 +0000
+Subject: ASoC: qcom: q6apm-lpass-dai: unprepare stream if its already prepared
+
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+
+[ Upstream commit c2ac3aec474da0455df79c4a182f19687bc98d1d ]
+
+prepare callback can be called multiple times, so unprepare the stream
+if its already prepared.
+
+Without this DSP is not happy to setting the params on a already
+prepared graph.
+
+Fixes: 9b4fe0f1cd79 ("ASoC: qdsp6: audioreach: add q6apm-dai support")
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230209122806.18923-2-srinivas.kandagatla@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/qcom/qdsp6/q6apm-lpass-dais.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/sound/soc/qcom/qdsp6/q6apm-lpass-dais.c b/sound/soc/qcom/qdsp6/q6apm-lpass-dais.c
+index ce9e5646d8f3a..23d23bc6fbaa7 100644
+--- a/sound/soc/qcom/qdsp6/q6apm-lpass-dais.c
++++ b/sound/soc/qcom/qdsp6/q6apm-lpass-dais.c
+@@ -127,6 +127,11 @@ static int q6apm_lpass_dai_prepare(struct snd_pcm_substream *substream, struct s
+ int graph_id = dai->id;
+ int rc;
+
++ if (dai_data->is_port_started[dai->id]) {
++ q6apm_graph_stop(dai_data->graph[dai->id]);
++ dai_data->is_port_started[dai->id] = false;
++ }
++
+ /**
+ * It is recommend to load DSP with source graph first and then sink
+ * graph, so sequence for playback and capture will be different
+--
+2.39.2
+
--- /dev/null
+From 1f8f956f9c7c877b4efa23f2e3bd886d28e1ef79 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Feb 2023 01:59:52 +0000
+Subject: ASoC: rsnd: fixup #endif position
+
+From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+
+[ Upstream commit 49123b51cd896e00b256a27c2ce9e6bfe1bbc22f ]
+
+commit 1f9c82b5ab83ff2 ("ASoC: rsnd: add debugfs support") added
+CONFIG_DEBUG_FS related definitions on rsnd.h, but it should be
+added inside of RSND_H. This patch fixup it.
+
+Fixes: 1f9c82b5ab83 ("ASoC: rsnd: add debugfs support")
+Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Link: https://lore.kernel.org/r/877cx26t7r.wl-kuninori.morimoto.gx@renesas.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sh/rcar/rsnd.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/sh/rcar/rsnd.h b/sound/soc/sh/rcar/rsnd.h
+index d9cd190d7e198..f8ef6836ef84e 100644
+--- a/sound/soc/sh/rcar/rsnd.h
++++ b/sound/soc/sh/rcar/rsnd.h
+@@ -901,8 +901,6 @@ void rsnd_mod_make_sure(struct rsnd_mod *mod, enum rsnd_mod_type type);
+ if (!IS_BUILTIN(RSND_DEBUG_NO_DAI_CALL)) \
+ dev_dbg(dev, param)
+
+-#endif
+-
+ #ifdef CONFIG_DEBUG_FS
+ int rsnd_debugfs_probe(struct snd_soc_component *component);
+ void rsnd_debugfs_reg_show(struct seq_file *m, phys_addr_t _addr,
+@@ -913,3 +911,5 @@ void rsnd_debugfs_mod_reg_show(struct seq_file *m, struct rsnd_mod *mod,
+ #else
+ #define rsnd_debugfs_probe NULL
+ #endif
++
++#endif /* RSND_H */
+--
+2.39.2
+
--- /dev/null
+From 403825ef4890ff686e2c47dff0b7c194df914eee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Dec 2022 14:18:18 +0900
+Subject: ASoC: soc-compress: Reposition and add pcm_mutex
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: ê°•ì‹ í˜• <s47.kang@samsung.com>
+
+[ Upstream commit aa9ff6a4955fdba02b54fbc4386db876603703b7 ]
+
+If panic_on_warn is set and compress stream(DPCM) is started,
+then kernel panic occurred because card->pcm_mutex isn't held appropriately.
+In the following functions, warning were issued at this line
+"snd_soc_dpcm_mutex_assert_held".
+
+static int dpcm_be_connect(struct snd_soc_pcm_runtime *fe,
+ struct snd_soc_pcm_runtime *be, int stream)
+{
+ ...
+ snd_soc_dpcm_mutex_assert_held(fe);
+ ...
+}
+
+void dpcm_be_disconnect(struct snd_soc_pcm_runtime *fe, int stream)
+{
+ ...
+ snd_soc_dpcm_mutex_assert_held(fe);
+ ...
+}
+
+void snd_soc_runtime_action(struct snd_soc_pcm_runtime *rtd,
+ int stream, int action)
+{
+ ...
+ snd_soc_dpcm_mutex_assert_held(rtd);
+ ...
+}
+
+int dpcm_dapm_stream_event(struct snd_soc_pcm_runtime *fe, int dir,
+ int event)
+{
+ ...
+ snd_soc_dpcm_mutex_assert_held(fe);
+ ...
+}
+
+These functions are called by soc_compr_set_params_fe, soc_compr_open_fe
+and soc_compr_free_fe
+without pcm_mutex locking. And this is call stack.
+
+[ 414.527841][ T2179] pc : dpcm_process_paths+0x5a4/0x750
+[ 414.527848][ T2179] lr : dpcm_process_paths+0x37c/0x750
+[ 414.527945][ T2179] Call trace:
+[ 414.527949][ T2179] dpcm_process_paths+0x5a4/0x750
+[ 414.527955][ T2179] soc_compr_open_fe+0xb0/0x2cc
+[ 414.527972][ T2179] snd_compr_open+0x180/0x248
+[ 414.527981][ T2179] snd_open+0x15c/0x194
+[ 414.528003][ T2179] chrdev_open+0x1b0/0x220
+[ 414.528023][ T2179] do_dentry_open+0x30c/0x594
+[ 414.528045][ T2179] vfs_open+0x34/0x44
+[ 414.528053][ T2179] path_openat+0x914/0xb08
+[ 414.528062][ T2179] do_filp_open+0xc0/0x170
+[ 414.528068][ T2179] do_sys_openat2+0x94/0x18c
+[ 414.528076][ T2179] __arm64_sys_openat+0x78/0xa4
+[ 414.528084][ T2179] invoke_syscall+0x48/0x10c
+[ 414.528094][ T2179] el0_svc_common+0xbc/0x104
+[ 414.528099][ T2179] do_el0_svc+0x34/0xd8
+[ 414.528103][ T2179] el0_svc+0x34/0xc4
+[ 414.528125][ T2179] el0t_64_sync_handler+0x8c/0xfc
+[ 414.528133][ T2179] el0t_64_sync+0x1a0/0x1a4
+[ 414.528142][ T2179] Kernel panic - not syncing: panic_on_warn set ...
+
+So, I reposition and add pcm_mutex to resolve lockdep error.
+
+Signed-off-by: Shinhyung Kang <s47.kang@samsung.com>
+Link: https://lore.kernel.org/r/016401d90ac4$7b6848c0$7238da40$@samsung.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/soc-compress.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/sound/soc/soc-compress.c b/sound/soc/soc-compress.c
+index cb0ed2fea893a..e7aa6f360cabe 100644
+--- a/sound/soc/soc-compress.c
++++ b/sound/soc/soc-compress.c
+@@ -149,6 +149,8 @@ static int soc_compr_open_fe(struct snd_compr_stream *cstream)
+ if (ret < 0)
+ goto be_err;
+
++ mutex_lock_nested(&fe->card->pcm_mutex, fe->card->pcm_subclass);
++
+ /* calculate valid and active FE <-> BE dpcms */
+ dpcm_process_paths(fe, stream, &list, 1);
+ fe->dpcm[stream].runtime = fe_substream->runtime;
+@@ -184,7 +186,6 @@ static int soc_compr_open_fe(struct snd_compr_stream *cstream)
+ fe->dpcm[stream].state = SND_SOC_DPCM_STATE_OPEN;
+ fe->dpcm[stream].runtime_update = SND_SOC_DPCM_UPDATE_NO;
+
+- mutex_lock_nested(&fe->card->pcm_mutex, fe->card->pcm_subclass);
+ snd_soc_runtime_activate(fe, stream);
+ mutex_unlock(&fe->card->pcm_mutex);
+
+@@ -215,7 +216,6 @@ static int soc_compr_free_fe(struct snd_compr_stream *cstream)
+
+ mutex_lock_nested(&fe->card->pcm_mutex, fe->card->pcm_subclass);
+ snd_soc_runtime_deactivate(fe, stream);
+- mutex_unlock(&fe->card->pcm_mutex);
+
+ fe->dpcm[stream].runtime_update = SND_SOC_DPCM_UPDATE_FE;
+
+@@ -234,6 +234,8 @@ static int soc_compr_free_fe(struct snd_compr_stream *cstream)
+
+ dpcm_be_disconnect(fe, stream);
+
++ mutex_unlock(&fe->card->pcm_mutex);
++
+ fe->dpcm[stream].runtime = NULL;
+
+ snd_soc_link_compr_shutdown(cstream, 0);
+@@ -409,8 +411,9 @@ static int soc_compr_set_params_fe(struct snd_compr_stream *cstream,
+ ret = snd_soc_link_compr_set_params(cstream);
+ if (ret < 0)
+ goto out;
+-
++ mutex_lock_nested(&fe->card->pcm_mutex, fe->card->pcm_subclass);
+ dpcm_dapm_stream_event(fe, stream, SND_SOC_DAPM_STREAM_START);
++ mutex_unlock(&fe->card->pcm_mutex);
+ fe->dpcm[stream].state = SND_SOC_DPCM_STATE_PREPARE;
+
+ out:
+--
+2.39.2
+
--- /dev/null
+From fabfa1095667636409356d81831952d29b1b17bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Jan 2023 23:17:20 +0000
+Subject: ASoC: soc-compress.c: fixup private_data on snd_soc_new_compress()
+
+From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+
+[ Upstream commit ffe4c0f0bfaa571a676a0e946d4a6a0607f94294 ]
+
+commit d3268a40d4b19f ("ASoC: soc-compress.c: fix NULL dereference")
+enables DPCM capture, but it should independent from playback.
+This patch fixup it.
+
+Fixes: d3268a40d4b1 ("ASoC: soc-compress.c: fix NULL dereference")
+Link: https://lore.kernel.org/r/87tu0i6j7j.wl-kuninori.morimoto.gx@renesas.com
+Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Acked-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Link: https://lore.kernel.org/r/871qnkvo1s.wl-kuninori.morimoto.gx@renesas.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/soc-compress.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/soc-compress.c b/sound/soc/soc-compress.c
+index 870f13e1d389c..cb0ed2fea893a 100644
+--- a/sound/soc/soc-compress.c
++++ b/sound/soc/soc-compress.c
+@@ -623,7 +623,7 @@ int snd_soc_new_compress(struct snd_soc_pcm_runtime *rtd, int num)
+ rtd->fe_compr = 1;
+ if (rtd->dai_link->dpcm_playback)
+ be_pcm->streams[SNDRV_PCM_STREAM_PLAYBACK].substream->private_data = rtd;
+- else if (rtd->dai_link->dpcm_capture)
++ if (rtd->dai_link->dpcm_capture)
+ be_pcm->streams[SNDRV_PCM_STREAM_CAPTURE].substream->private_data = rtd;
+ memcpy(compr->ops, &soc_compr_dyn_ops, sizeof(soc_compr_dyn_ops));
+ } else {
+--
+2.39.2
+
--- /dev/null
+From e004631a03fbdae54bf6ba9a7aff74f1acd9edcf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Feb 2023 13:28:51 +0000
+Subject: ASoC: soc-dapm.h: fixup warning struct snd_pcm_substream not declared
+
+From: Lucas Tanure <lucas.tanure@collabora.com>
+
+[ Upstream commit fdff966bfde7cf0c85562d2bfb1ff1ba83da5f7b ]
+
+Add struct snd_pcm_substream forward declaration
+
+Fixes: 078a85f2806f ("ASoC: dapm: Only power up active channels from a DAI")
+Signed-off-by: Lucas Tanure <lucas.tanure@collabora.com>
+Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20230215132851.1626881-1-lucas.tanure@collabora.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/sound/soc-dapm.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/include/sound/soc-dapm.h b/include/sound/soc-dapm.h
+index 77495e5988c12..64915ebd641ee 100644
+--- a/include/sound/soc-dapm.h
++++ b/include/sound/soc-dapm.h
+@@ -16,6 +16,7 @@
+ #include <sound/asoc.h>
+
+ struct device;
++struct snd_pcm_substream;
+ struct snd_soc_pcm_runtime;
+ struct soc_enum;
+
+--
+2.39.2
+
--- /dev/null
+From b969fa8b24dfee48b00c2d6d36824b072e9c3b24 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Feb 2023 09:38:05 +0200
+Subject: ASoC: tlv320adcx140: fix 'ti,gpio-config' DT property init
+
+From: Steffen Aschbacher <steffen.aschbacher@stihl.de>
+
+[ Upstream commit 771725efe5e2e5396dd9d1220437e5f9d6b9ca9d ]
+
+When the 'ti,gpio-config' property is not defined, the
+device_property_count_u32() will return an error, rather than zero.
+
+The current check, only handles a return value of zero, which assumes that
+the property is defined and has nothing defined.
+
+This change extends the check to also check for an error case (most likely
+to be hit by the case that the 'ti,gpio-config' is not defined).
+
+In case that the 'ti,gpio-config' and the returned 'gpio_count' is not
+correct, there is a 'if (gpio_count != ADCX140_NUM_GPIO_CFGS)' check, a few
+lines lower that will return -EINVAL.
+This means that someone tried to define 'ti,gpio-config', but with the
+wrong number of GPIOs.
+
+Fixes: d5214321498a ("ASoC: tlv320adcx140: Add support for configuring GPIO pin")
+Signed-off-by: Steffen Aschbacher <steffen.aschbacher@stihl.de>
+Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
+Link: https://lore.kernel.org/r/20230213073805.14640-1-alex@shruggie.ro
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/tlv320adcx140.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/tlv320adcx140.c b/sound/soc/codecs/tlv320adcx140.c
+index 91a22d9279158..530f321d08e9c 100644
+--- a/sound/soc/codecs/tlv320adcx140.c
++++ b/sound/soc/codecs/tlv320adcx140.c
+@@ -925,7 +925,7 @@ static int adcx140_configure_gpio(struct adcx140_priv *adcx140)
+
+ gpio_count = device_property_count_u32(adcx140->dev,
+ "ti,gpio-config");
+- if (gpio_count == 0)
++ if (gpio_count <= 0)
+ return 0;
+
+ if (gpio_count != ADCX140_NUM_GPIO_CFGS)
+--
+2.39.2
+
--- /dev/null
+From 0b0543ca49b25727e5c1d1fb8610858e47aca02d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 28 Jan 2023 00:11:01 +0100
+Subject: ASoC: topology: Properly access value coming from topology file
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Amadeusz Sławiński <amadeuszx.slawinski@linux.intel.com>
+
+[ Upstream commit c5d184c92df2b631fb81fe2ce6e96bfc5ba720e5 ]
+
+When accessing values coming from topology, le32_to_cpu should be used.
+One of recent commits missed that.
+
+Fixes: 86e2d14b6d1a ("ASoC: topology: Add header payload_size verification")
+Reviewed-by: Cezary Rojewski <cezary.rojewski@intel.com>
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Signed-off-by: Amadeusz Sławiński <amadeuszx.slawinski@linux.intel.com>
+Link: https://lore.kernel.org/r/20230127231111.937721-2-amadeuszx.slawinski@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/soc-topology.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c
+index a79a2fb260b87..d68c48555a7e3 100644
+--- a/sound/soc/soc-topology.c
++++ b/sound/soc/soc-topology.c
+@@ -2408,7 +2408,7 @@ static int soc_valid_header(struct soc_tplg *tplg,
+ return -EINVAL;
+ }
+
+- if (soc_tplg_get_hdr_offset(tplg) + hdr->payload_size >= tplg->fw->size) {
++ if (soc_tplg_get_hdr_offset(tplg) + le32_to_cpu(hdr->payload_size) >= tplg->fw->size) {
+ dev_err(tplg->dev,
+ "ASoC: invalid header of type %d at offset %ld payload_size %d\n",
+ le32_to_cpu(hdr->type), soc_tplg_get_hdr_offset(tplg),
+--
+2.39.2
+
--- /dev/null
+From 12b0a6110ee85bcc57b43d6eecd74ad5694b4a02 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Jan 2023 19:03:48 +0800
+Subject: blk-cgroup: dropping parent refcount after pd_free_fn() is done
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit c7241babf0855d8a6180cd1743ff0ec34de40b4e ]
+
+Some cgroup policies will access parent pd through child pd even
+after pd_offline_fn() is done. If pd_free_fn() for parent is called
+before child, then UAF can be triggered. Hence it's better to guarantee
+the order of pd_free_fn().
+
+Currently refcount of parent blkg is dropped in __blkg_release(), which
+is before pd_free_fn() is called in blkg_free_work_fn() while
+blkg_free_work_fn() is called asynchronously.
+
+This patch make sure pd_free_fn() called from removing cgroup is ordered
+by delaying dropping parent refcount after calling pd_free_fn() for
+child.
+
+BTW, pd_free_fn() will also be called from blkcg_deactivate_policy()
+from deleting device, and following patches will guarantee the order.
+
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Acked-by: Tejun Heo <tj@kernel.org>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Link: https://lore.kernel.org/r/20230119110350.2287325-2-yukuai1@huaweicloud.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-cgroup.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
+index 9ac1efb053e08..aa890e3e4e509 100644
+--- a/block/blk-cgroup.c
++++ b/block/blk-cgroup.c
+@@ -124,6 +124,8 @@ static void blkg_free_workfn(struct work_struct *work)
+ if (blkg->pd[i])
+ blkcg_policy[i]->pd_free_fn(blkg->pd[i]);
+
++ if (blkg->parent)
++ blkg_put(blkg->parent);
+ if (blkg->q)
+ blk_put_queue(blkg->q);
+ free_percpu(blkg->iostat_cpu);
+@@ -158,8 +160,6 @@ static void __blkg_release(struct rcu_head *rcu)
+
+ /* release the blkcg and parent blkg refs this blkg has been holding */
+ css_put(&blkg->blkcg->css);
+- if (blkg->parent)
+- blkg_put(blkg->parent);
+ blkg_free(blkg);
+ }
+
+--
+2.39.2
+
--- /dev/null
+From f3136a113832f0a658956fa5406122f575691d0f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Jan 2023 19:03:50 +0800
+Subject: blk-cgroup: synchronize pd_free_fn() from blkg_free_workfn() and
+ blkcg_deactivate_policy()
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit f1c006f1c6850c14040f8337753a63119bba39b9 ]
+
+Currently parent pd can be freed before child pd:
+
+t1: remove cgroup C1
+blkcg_destroy_blkgs
+ blkg_destroy
+ list_del_init(&blkg->q_node)
+ // remove blkg from queue list
+ percpu_ref_kill(&blkg->refcnt)
+ blkg_release
+ call_rcu
+
+t2: from t1
+__blkg_release
+ blkg_free
+ schedule_work
+ t4: deactivate policy
+ blkcg_deactivate_policy
+ pd_free_fn
+ // parent of C1 is freed first
+t3: from t2
+ blkg_free_workfn
+ pd_free_fn
+
+If policy(for example, ioc_timer_fn() from iocost) access parent pd from
+child pd after pd_offline_fn(), then UAF can be triggered.
+
+Fix the problem by delaying 'list_del_init(&blkg->q_node)' from
+blkg_destroy() to blkg_free_workfn(), and using a new disk level mutex to
+synchronize blkg_free_workfn() and blkcg_deactivate_policy().
+
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Acked-by: Tejun Heo <tj@kernel.org>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Link: https://lore.kernel.org/r/20230119110350.2287325-4-yukuai1@huaweicloud.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-cgroup.c | 35 +++++++++++++++++++++++++++++------
+ include/linux/blkdev.h | 1 +
+ 2 files changed, 30 insertions(+), 6 deletions(-)
+
+diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
+index aa890e3e4e509..45881f8c79130 100644
+--- a/block/blk-cgroup.c
++++ b/block/blk-cgroup.c
+@@ -118,16 +118,32 @@ static void blkg_free_workfn(struct work_struct *work)
+ {
+ struct blkcg_gq *blkg = container_of(work, struct blkcg_gq,
+ free_work);
++ struct request_queue *q = blkg->q;
+ int i;
+
++ /*
++ * pd_free_fn() can also be called from blkcg_deactivate_policy(),
++ * in order to make sure pd_free_fn() is called in order, the deletion
++ * of the list blkg->q_node is delayed to here from blkg_destroy(), and
++ * blkcg_mutex is used to synchronize blkg_free_workfn() and
++ * blkcg_deactivate_policy().
++ */
++ if (q)
++ mutex_lock(&q->blkcg_mutex);
++
+ for (i = 0; i < BLKCG_MAX_POLS; i++)
+ if (blkg->pd[i])
+ blkcg_policy[i]->pd_free_fn(blkg->pd[i]);
+
+ if (blkg->parent)
+ blkg_put(blkg->parent);
+- if (blkg->q)
+- blk_put_queue(blkg->q);
++
++ if (q) {
++ list_del_init(&blkg->q_node);
++ mutex_unlock(&q->blkcg_mutex);
++ blk_put_queue(q);
++ }
++
+ free_percpu(blkg->iostat_cpu);
+ percpu_ref_exit(&blkg->refcnt);
+ kfree(blkg);
+@@ -458,9 +474,14 @@ static void blkg_destroy(struct blkcg_gq *blkg)
+ lockdep_assert_held(&blkg->q->queue_lock);
+ lockdep_assert_held(&blkcg->lock);
+
+- /* Something wrong if we are trying to remove same group twice */
+- WARN_ON_ONCE(list_empty(&blkg->q_node));
+- WARN_ON_ONCE(hlist_unhashed(&blkg->blkcg_node));
++ /*
++ * blkg stays on the queue list until blkg_free_workfn(), see details in
++ * blkg_free_workfn(), hence this function can be called from
++ * blkcg_destroy_blkgs() first and again from blkg_destroy_all() before
++ * blkg_free_workfn().
++ */
++ if (hlist_unhashed(&blkg->blkcg_node))
++ return;
+
+ for (i = 0; i < BLKCG_MAX_POLS; i++) {
+ struct blkcg_policy *pol = blkcg_policy[i];
+@@ -472,7 +493,6 @@ static void blkg_destroy(struct blkcg_gq *blkg)
+ blkg->online = false;
+
+ radix_tree_delete(&blkcg->blkg_tree, blkg->q->id);
+- list_del_init(&blkg->q_node);
+ hlist_del_init_rcu(&blkg->blkcg_node);
+
+ /*
+@@ -1273,6 +1293,7 @@ int blkcg_init_disk(struct gendisk *disk)
+ int ret;
+
+ INIT_LIST_HEAD(&q->blkg_list);
++ mutex_init(&q->blkcg_mutex);
+
+ new_blkg = blkg_alloc(&blkcg_root, disk, GFP_KERNEL);
+ if (!new_blkg)
+@@ -1510,6 +1531,7 @@ void blkcg_deactivate_policy(struct request_queue *q,
+ if (queue_is_mq(q))
+ blk_mq_freeze_queue(q);
+
++ mutex_lock(&q->blkcg_mutex);
+ spin_lock_irq(&q->queue_lock);
+
+ __clear_bit(pol->plid, q->blkcg_pols);
+@@ -1528,6 +1550,7 @@ void blkcg_deactivate_policy(struct request_queue *q,
+ }
+
+ spin_unlock_irq(&q->queue_lock);
++ mutex_unlock(&q->blkcg_mutex);
+
+ if (queue_is_mq(q))
+ blk_mq_unfreeze_queue(q);
+diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
+index 43d4e073b1115..10ee92db680c9 100644
+--- a/include/linux/blkdev.h
++++ b/include/linux/blkdev.h
+@@ -484,6 +484,7 @@ struct request_queue {
+ DECLARE_BITMAP (blkcg_pols, BLKCG_MAX_POLS);
+ struct blkcg_gq *root_blkg;
+ struct list_head blkg_list;
++ struct mutex blkcg_mutex;
+ #endif
+
+ struct queue_limits limits;
+--
+2.39.2
+
--- /dev/null
+From c34506f6b3e3f6affcdff58310c6a9637b4dd839 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Jan 2023 15:08:05 +0800
+Subject: blk-iocost: fix divide by 0 error in calc_lcoefs()
+
+From: Li Nan <linan122@huawei.com>
+
+[ Upstream commit 984af1e66b4126cf145153661cc24c213e2ec231 ]
+
+echo max of u64 to cost.model can cause divide by 0 error.
+
+ # echo 8:0 rbps=18446744073709551615 > /sys/fs/cgroup/io.cost.model
+
+ divide error: 0000 [#1] PREEMPT SMP
+ RIP: 0010:calc_lcoefs+0x4c/0xc0
+ Call Trace:
+ <TASK>
+ ioc_refresh_params+0x2b3/0x4f0
+ ioc_cost_model_write+0x3cb/0x4c0
+ ? _copy_from_iter+0x6d/0x6c0
+ ? kernfs_fop_write_iter+0xfc/0x270
+ cgroup_file_write+0xa0/0x200
+ kernfs_fop_write_iter+0x17d/0x270
+ vfs_write+0x414/0x620
+ ksys_write+0x73/0x160
+ __x64_sys_write+0x1e/0x30
+ do_syscall_64+0x35/0x80
+ entry_SYSCALL_64_after_hwframe+0x63/0xcd
+
+calc_lcoefs() uses the input value of cost.model in DIV_ROUND_UP_ULL,
+overflow would happen if bps plus IOC_PAGE_SIZE is greater than
+ULLONG_MAX, it can cause divide by 0 error.
+
+Fix the problem by setting basecost
+
+Signed-off-by: Li Nan <linan122@huawei.com>
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Acked-by: Tejun Heo <tj@kernel.org>
+Link: https://lore.kernel.org/r/20230117070806.3857142-5-yukuai1@huaweicloud.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-iocost.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/block/blk-iocost.c b/block/blk-iocost.c
+index 6955605629e4f..ec7219caea165 100644
+--- a/block/blk-iocost.c
++++ b/block/blk-iocost.c
+@@ -866,9 +866,14 @@ static void calc_lcoefs(u64 bps, u64 seqiops, u64 randiops,
+
+ *page = *seqio = *randio = 0;
+
+- if (bps)
+- *page = DIV64_U64_ROUND_UP(VTIME_PER_SEC,
+- DIV_ROUND_UP_ULL(bps, IOC_PAGE_SIZE));
++ if (bps) {
++ u64 bps_pages = DIV_ROUND_UP_ULL(bps, IOC_PAGE_SIZE);
++
++ if (bps_pages)
++ *page = DIV64_U64_ROUND_UP(VTIME_PER_SEC, bps_pages);
++ else
++ *page = 1;
++ }
+
+ if (seqiops) {
+ v = DIV64_U64_ROUND_UP(VTIME_PER_SEC, seqiops);
+--
+2.39.2
+
--- /dev/null
+From 2e4b8f23325b194cd2f10d7029418a6ae6f83d0a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Jan 2023 17:37:13 +0800
+Subject: blk-mq: avoid sleep in blk_mq_alloc_request_hctx
+
+From: Kemeng Shi <shikemeng@huaweicloud.com>
+
+[ Upstream commit 6ee858a3d3270a68902d66bb47c151a83622535c ]
+
+Commit 1f5bd336b9150 ("blk-mq: add blk_mq_alloc_request_hctx") add
+blk_mq_alloc_request_hctx to send commands to a specific queue. If
+BLK_MQ_REQ_NOWAIT is not set in tag allocation, we may change to different
+hctx after sleep and get tag from unexpected hctx. So BLK_MQ_REQ_NOWAIT
+must be set in flags for blk_mq_alloc_request_hctx.
+After commit 600c3b0cea784 ("blk-mq: open code __blk_mq_alloc_request in
+blk_mq_alloc_request_hctx"), blk_mq_alloc_request_hctx return -EINVAL
+if both BLK_MQ_REQ_NOWAIT and BLK_MQ_REQ_RESERVED are not set instead of
+if BLK_MQ_REQ_NOWAIT is not set. So if BLK_MQ_REQ_NOWAIT is not set and
+BLK_MQ_REQ_RESERVED is set, blk_mq_alloc_request_hctx could alloc tag
+from unexpected hctx. I guess what we need here is that return -EINVAL
+if either BLK_MQ_REQ_NOWAIT or BLK_MQ_REQ_RESERVED is not set.
+
+Currently both BLK_MQ_REQ_NOWAIT and BLK_MQ_REQ_RESERVED will be set if
+specific hctx is needed in nvme_auth_submit, nvmf_connect_io_queue
+and nvmf_connect_admin_queue. Fix the potential BLK_MQ_REQ_NOWAIT missed
+case in future.
+
+Fixes: 600c3b0cea78 ("blk-mq: open code __blk_mq_alloc_request in blk_mq_alloc_request_hctx")
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Kemeng Shi <shikemeng@huaweicloud.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-mq.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/block/blk-mq.c b/block/blk-mq.c
+index 9c8dc70020bc9..dc29a7c82bb82 100644
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -658,7 +658,8 @@ struct request *blk_mq_alloc_request_hctx(struct request_queue *q,
+ * allocator for this for the rare use case of a command tied to
+ * a specific queue.
+ */
+- if (WARN_ON_ONCE(!(flags & (BLK_MQ_REQ_NOWAIT | BLK_MQ_REQ_RESERVED))))
++ if (WARN_ON_ONCE(!(flags & BLK_MQ_REQ_NOWAIT)) ||
++ WARN_ON_ONCE(!(flags & BLK_MQ_REQ_RESERVED)))
+ return ERR_PTR(-EINVAL);
+
+ if (hctx_idx >= q->nr_hw_queues)
+--
+2.39.2
+
--- /dev/null
+From 76cf88909c3d920272873688068daee750c38d22 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Jan 2023 17:37:26 +0800
+Subject: blk-mq: correct stale comment of .get_budget
+
+From: Kemeng Shi <shikemeng@huaweicloud.com>
+
+[ Upstream commit 01542f651a9f58a9b176c3d3dc3eefbacee53b78 ]
+
+Commit 88022d7201e96 ("blk-mq: don't handle failure in .get_budget")
+remove BLK_STS_RESOURCE return value and we only check if we can get
+the budget from .get_budget() now.
+Correct stale comment that ".get_budget() returns BLK_STS_NO_RESOURCE"
+to ".get_budget() fails to get the budget".
+
+Fixes: 88022d7201e9 ("blk-mq: don't handle failure in .get_budget")
+Signed-off-by: Kemeng Shi <shikemeng@huaweicloud.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-mq-sched.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/block/blk-mq-sched.c b/block/blk-mq-sched.c
+index ae40cdb7a383c..06b312c691143 100644
+--- a/block/blk-mq-sched.c
++++ b/block/blk-mq-sched.c
+@@ -81,7 +81,7 @@ static bool blk_mq_dispatch_hctx_list(struct list_head *rq_list)
+ /*
+ * Only SCSI implements .get_budget and .put_budget, and SCSI restarts
+ * its queue by itself in its completion handler, so we don't need to
+- * restart queue if .get_budget() returns BLK_STS_NO_RESOURCE.
++ * restart queue if .get_budget() fails to get the budget.
+ *
+ * Returns -EAGAIN if hctx->dispatch was found non-empty and run_work has to
+ * be run again. This is necessary to avoid starving flushes.
+@@ -209,7 +209,7 @@ static struct blk_mq_ctx *blk_mq_next_ctx(struct blk_mq_hw_ctx *hctx,
+ /*
+ * Only SCSI implements .get_budget and .put_budget, and SCSI restarts
+ * its queue by itself in its completion handler, so we don't need to
+- * restart queue if .get_budget() returns BLK_STS_NO_RESOURCE.
++ * restart queue if .get_budget() fails to get the budget.
+ *
+ * Returns -EAGAIN if hctx->dispatch was found non-empty and run_work has to
+ * be run again. This is necessary to avoid starving flushes.
+--
+2.39.2
+
--- /dev/null
+From 1390a67a4d059d9317813843bebfd0357c7e1f7b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Jan 2023 17:37:16 +0800
+Subject: blk-mq: Fix potential io hung for shared sbitmap per tagset
+
+From: Kemeng Shi <shikemeng@huaweicloud.com>
+
+[ Upstream commit 47df9ce95cd568d3f84218c4f65e9fbd4dfeda55 ]
+
+Commit f906a6a0f4268 ("blk-mq: improve tag waiting setup for non-shared
+tags") mark restart for unshared tags for improvement. At that time,
+tags is only shared betweens queues and we can check if tags is shared
+by test BLK_MQ_F_TAG_SHARED.
+Afterwards, commit 32bc15afed04b ("blk-mq: Facilitate a shared sbitmap per
+tagset") enabled tags share betweens hctxs inside a queue. We only
+mark restart for shared hctxs inside a queue and may cause io hung if
+there is no tag currently allocated by hctxs going to be marked restart.
+Wait on sbitmap_queue instead of mark restart for shared hctxs case to
+fix this.
+
+Fixes: 32bc15afed04 ("blk-mq: Facilitate a shared sbitmap per tagset")
+Signed-off-by: Kemeng Shi <shikemeng@huaweicloud.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-mq.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/block/blk-mq.c b/block/blk-mq.c
+index 8bc6778454e10..b9e3b558367f1 100644
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -1831,7 +1831,8 @@ static bool blk_mq_mark_tag_wait(struct blk_mq_hw_ctx *hctx,
+ wait_queue_entry_t *wait;
+ bool ret;
+
+- if (!(hctx->flags & BLK_MQ_F_TAG_QUEUE_SHARED)) {
++ if (!(hctx->flags & BLK_MQ_F_TAG_QUEUE_SHARED) &&
++ !(blk_mq_is_shared_tags(hctx->flags))) {
+ blk_mq_sched_mark_restart_hctx(hctx);
+
+ /*
+@@ -2101,7 +2102,8 @@ bool blk_mq_dispatch_rq_list(struct blk_mq_hw_ctx *hctx, struct list_head *list,
+ bool needs_restart;
+ /* For non-shared tags, the RESTART check will suffice */
+ bool no_tag = prep == PREP_DISPATCH_NO_TAG &&
+- (hctx->flags & BLK_MQ_F_TAG_QUEUE_SHARED);
++ ((hctx->flags & BLK_MQ_F_TAG_QUEUE_SHARED) ||
++ blk_mq_is_shared_tags(hctx->flags));
+
+ if (nr_budgets)
+ blk_mq_release_budgets(q, list);
+--
+2.39.2
+
--- /dev/null
+From f1d1047eb46068126b280f8234069f5981f1ce41 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Jan 2023 17:37:14 +0800
+Subject: blk-mq: remove stale comment for blk_mq_sched_mark_restart_hctx
+
+From: Kemeng Shi <shikemeng@huaweicloud.com>
+
+[ Upstream commit c31e76bcc379182fe67a82c618493b7b8868c672 ]
+
+Commit 97889f9ac24f8 ("blk-mq: remove synchronize_rcu() from
+blk_mq_del_queue_tag_set()") remove handle of TAG_SHARED in restart,
+then shared_hctx_restart counted for how many hardware queues are marked
+for restart is removed too.
+Remove the stale comment that we still count hardware queues need restart.
+
+Fixes: 97889f9ac24f ("blk-mq: remove synchronize_rcu() from blk_mq_del_queue_tag_set()")
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Kemeng Shi <shikemeng@huaweicloud.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-mq-sched.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/block/blk-mq-sched.c b/block/blk-mq-sched.c
+index 23d1a90fec427..ae40cdb7a383c 100644
+--- a/block/blk-mq-sched.c
++++ b/block/blk-mq-sched.c
+@@ -19,8 +19,7 @@
+ #include "blk-wbt.h"
+
+ /*
+- * Mark a hardware queue as needing a restart. For shared queues, maintain
+- * a count of how many hardware queues are marked for restart.
++ * Mark a hardware queue as needing a restart.
+ */
+ void blk_mq_sched_mark_restart_hctx(struct blk_mq_hw_ctx *hctx)
+ {
+--
+2.39.2
+
--- /dev/null
+From f50a16af176d6fafdbefc156efa20632b0d5856a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Jan 2023 17:37:15 +0800
+Subject: blk-mq: wait on correct sbitmap_queue in blk_mq_mark_tag_wait
+
+From: Kemeng Shi <shikemeng@huaweicloud.com>
+
+[ Upstream commit 98b99e9412d0cde8c7b442bf5efb09528a2ede8b ]
+
+For shared queues case, we will only wait on bitmap_tags if we fail to get
+driver tag. However, rq could be from breserved_tags, then two problems
+will occur:
+1. io hung if no tag is currently allocated from bitmap_tags.
+2. unnecessary wakeup when tag is freed to bitmap_tags while no tag is
+freed to breserved_tags.
+Wait on the bitmap which rq from to fix this.
+
+Fixes: f906a6a0f426 ("blk-mq: improve tag waiting setup for non-shared tags")
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Kemeng Shi <shikemeng@huaweicloud.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-mq.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/block/blk-mq.c b/block/blk-mq.c
+index dc29a7c82bb82..8bc6778454e10 100644
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -1826,7 +1826,7 @@ static int blk_mq_dispatch_wake(wait_queue_entry_t *wait, unsigned mode,
+ static bool blk_mq_mark_tag_wait(struct blk_mq_hw_ctx *hctx,
+ struct request *rq)
+ {
+- struct sbitmap_queue *sbq = &hctx->tags->bitmap_tags;
++ struct sbitmap_queue *sbq;
+ struct wait_queue_head *wq;
+ wait_queue_entry_t *wait;
+ bool ret;
+@@ -1849,6 +1849,10 @@ static bool blk_mq_mark_tag_wait(struct blk_mq_hw_ctx *hctx,
+ if (!list_empty_careful(&wait->entry))
+ return false;
+
++ if (blk_mq_tag_is_reserved(rq->mq_hctx->sched_tags, rq->internal_tag))
++ sbq = &hctx->tags->breserved_tags;
++ else
++ sbq = &hctx->tags->bitmap_tags;
+ wq = &bt_wait_ptr(sbq, hctx)->wait;
+
+ spin_lock_irq(&wq->lock);
+--
+2.39.2
+
--- /dev/null
+From 60e365e68707438f05195629ede98e23cfd21f7b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Feb 2023 12:18:01 -0500
+Subject: block: bio-integrity: Copy flags when bio_integrity_payload is cloned
+
+From: Martin K. Petersen <martin.petersen@oracle.com>
+
+[ Upstream commit b6a4bdcda430e3ca43bbb9cb1d4d4d34ebe15c40 ]
+
+Make sure to copy the flags when a bio_integrity_payload is cloned.
+Otherwise per-I/O properties such as IP checksum flag will not be
+passed down to the HBA driver. Since the integrity buffer is owned by
+the original bio, the BIP_BLOCK_INTEGRITY flag needs to be masked off
+to avoid a double free in the completion path.
+
+Fixes: aae7df50190a ("block: Integrity checksum flag")
+Fixes: b1f01388574c ("block: Relocate bio integrity flags")
+Reported-by: Saurav Kashyap <skashyap@marvell.com>
+Tested-by: Saurav Kashyap <skashyap@marvell.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
+Link: https://lore.kernel.org/r/20230215171801.21062-1-martin.petersen@oracle.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/bio-integrity.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/block/bio-integrity.c b/block/bio-integrity.c
+index 3f5685c00e360..91ffee6fc8cb4 100644
+--- a/block/bio-integrity.c
++++ b/block/bio-integrity.c
+@@ -418,6 +418,7 @@ int bio_integrity_clone(struct bio *bio, struct bio *bio_src,
+
+ bip->bip_vcnt = bip_src->bip_vcnt;
+ bip->bip_iter = bip_src->bip_iter;
++ bip->bip_flags = bip_src->bip_flags & ~BIP_BLOCK_INTEGRITY;
+
+ return 0;
+ }
+--
+2.39.2
+
--- /dev/null
+From 108691940a36d406f99252e994ad1d583387b884 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Feb 2023 11:22:50 +0800
+Subject: block: Fix io statistics for cgroup in throttle path
+
+From: Jinke Han <hanjinke.666@bytedance.com>
+
+[ Upstream commit 0f7c8f0f7934c389b0f9fa1f151e753d8de6348f ]
+
+In the current code, io statistics are missing for cgroup when bio
+was throttled by blk-throttle. Fix it by moving the unreaching code
+to submit_bio_noacct_nocheck.
+
+Fixes: 3f98c753717c ("block: don't check bio in blk_throtl_dispatch_work_fn")
+Signed-off-by: Jinke Han <hanjinke.666@bytedance.com>
+Reviewed-by: Ming Lei <ming.lei@redhat.com>
+Acked-by: Muchun Song <songmuchun@bytedance.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Link: https://lore.kernel.org/r/20230216032250.74230-1-hanjinke.666@bytedance.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-core.c | 23 ++++++++++++-----------
+ 1 file changed, 12 insertions(+), 11 deletions(-)
+
+diff --git a/block/blk-core.c b/block/blk-core.c
+index b5098355d8b27..0a55844dfde27 100644
+--- a/block/blk-core.c
++++ b/block/blk-core.c
+@@ -684,6 +684,18 @@ static void __submit_bio_noacct_mq(struct bio *bio)
+
+ void submit_bio_noacct_nocheck(struct bio *bio)
+ {
++ blk_cgroup_bio_start(bio);
++ blkcg_bio_issue_init(bio);
++
++ if (!bio_flagged(bio, BIO_TRACE_COMPLETION)) {
++ trace_block_bio_queue(bio);
++ /*
++ * Now that enqueuing has been traced, we need to trace
++ * completion as well.
++ */
++ bio_set_flag(bio, BIO_TRACE_COMPLETION);
++ }
++
+ /*
+ * We only want one ->submit_bio to be active at a time, else stack
+ * usage with stacked devices could be a problem. Use current->bio_list
+@@ -788,17 +800,6 @@ void submit_bio_noacct(struct bio *bio)
+
+ if (blk_throtl_bio(bio))
+ return;
+-
+- blk_cgroup_bio_start(bio);
+- blkcg_bio_issue_init(bio);
+-
+- if (!bio_flagged(bio, BIO_TRACE_COMPLETION)) {
+- trace_block_bio_queue(bio);
+- /* Now that enqueuing has been traced, we need to trace
+- * completion as well.
+- */
+- bio_set_flag(bio, BIO_TRACE_COMPLETION);
+- }
+ submit_bio_noacct_nocheck(bio);
+ return;
+
+--
+2.39.2
+
--- /dev/null
+From 33c19c75ee85fa78ab81d906e4810d26bd685838 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Feb 2023 20:55:27 +0800
+Subject: block: sync mixed merged request's failfast with 1st bio's
+
+From: Ming Lei <ming.lei@redhat.com>
+
+[ Upstream commit 3ce6a115980c019928fcd06e01f64003886af79c ]
+
+We support mixed merge for requests/bios with different fastfail
+settings. When request fails, each time we only handle the portion
+with same failfast setting, then bios with failfast can be failed
+immediately, and bios without failfast can be retried.
+
+The idea is pretty good, but the current implementation has several
+defects:
+
+1) initially RA bio doesn't set failfast, however bio merge code
+doesn't consider this point, and just check its failfast setting for
+deciding if mixed merge is required. Fix this issue by adding helper
+of bio_failfast().
+
+2) when merging bio to request front, if this request is mixed
+merged, we have to sync request's faifast setting with 1st bio's
+failfast. Fix it by calling blk_update_mixed_merge().
+
+3) when merging bio to request back, if this request is mixed
+merged, we have to mark the bio as failfast, because blk_update_request
+simply updates request failfast with 1st bio's failfast. Fix
+it by calling blk_update_mixed_merge().
+
+Fixes one normal EXT4 READ IO failure issue, because it is observed
+that the normal READ IO is merged with RA IO, and the mixed merged
+request has different failfast setting with 1st bio's, so finally
+the normal READ IO doesn't get retried.
+
+Cc: Tejun Heo <tj@kernel.org>
+Fixes: 80a761fd33cf ("block: implement mixed merge of different failfast requests")
+Signed-off-by: Ming Lei <ming.lei@redhat.com>
+Link: https://lore.kernel.org/r/20230209125527.667004-1-ming.lei@redhat.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-merge.c | 35 +++++++++++++++++++++++++++++++++--
+ 1 file changed, 33 insertions(+), 2 deletions(-)
+
+diff --git a/block/blk-merge.c b/block/blk-merge.c
+index b7c193d67185d..30e4a99c2276b 100644
+--- a/block/blk-merge.c
++++ b/block/blk-merge.c
+@@ -757,6 +757,33 @@ void blk_rq_set_mixed_merge(struct request *rq)
+ rq->rq_flags |= RQF_MIXED_MERGE;
+ }
+
++static inline unsigned int bio_failfast(const struct bio *bio)
++{
++ if (bio->bi_opf & REQ_RAHEAD)
++ return REQ_FAILFAST_MASK;
++
++ return bio->bi_opf & REQ_FAILFAST_MASK;
++}
++
++/*
++ * After we are marked as MIXED_MERGE, any new RA bio has to be updated
++ * as failfast, and request's failfast has to be updated in case of
++ * front merge.
++ */
++static inline void blk_update_mixed_merge(struct request *req,
++ struct bio *bio, bool front_merge)
++{
++ if (req->rq_flags & RQF_MIXED_MERGE) {
++ if (bio->bi_opf & REQ_RAHEAD)
++ bio->bi_opf |= REQ_FAILFAST_MASK;
++
++ if (front_merge) {
++ req->cmd_flags &= ~REQ_FAILFAST_MASK;
++ req->cmd_flags |= bio->bi_opf & REQ_FAILFAST_MASK;
++ }
++ }
++}
++
+ static void blk_account_io_merge_request(struct request *req)
+ {
+ if (blk_do_io_stat(req)) {
+@@ -954,7 +981,7 @@ enum bio_merge_status {
+ static enum bio_merge_status bio_attempt_back_merge(struct request *req,
+ struct bio *bio, unsigned int nr_segs)
+ {
+- const blk_opf_t ff = bio->bi_opf & REQ_FAILFAST_MASK;
++ const blk_opf_t ff = bio_failfast(bio);
+
+ if (!ll_back_merge_fn(req, bio, nr_segs))
+ return BIO_MERGE_FAILED;
+@@ -965,6 +992,8 @@ static enum bio_merge_status bio_attempt_back_merge(struct request *req,
+ if ((req->cmd_flags & REQ_FAILFAST_MASK) != ff)
+ blk_rq_set_mixed_merge(req);
+
++ blk_update_mixed_merge(req, bio, false);
++
+ req->biotail->bi_next = bio;
+ req->biotail = bio;
+ req->__data_len += bio->bi_iter.bi_size;
+@@ -978,7 +1007,7 @@ static enum bio_merge_status bio_attempt_back_merge(struct request *req,
+ static enum bio_merge_status bio_attempt_front_merge(struct request *req,
+ struct bio *bio, unsigned int nr_segs)
+ {
+- const blk_opf_t ff = bio->bi_opf & REQ_FAILFAST_MASK;
++ const blk_opf_t ff = bio_failfast(bio);
+
+ if (!ll_front_merge_fn(req, bio, nr_segs))
+ return BIO_MERGE_FAILED;
+@@ -989,6 +1018,8 @@ static enum bio_merge_status bio_attempt_front_merge(struct request *req,
+ if ((req->cmd_flags & REQ_FAILFAST_MASK) != ff)
+ blk_rq_set_mixed_merge(req);
+
++ blk_update_mixed_merge(req, bio, true);
++
+ bio->bi_next = req->bio;
+ req->bio = bio;
+
+--
+2.39.2
+
--- /dev/null
+From b6ae1275350df3bf9fb6110e6f7592ef61a25d6e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Feb 2023 09:13:56 -0500
+Subject: block: ublk: check IO buffer based on flag need_get_data
+
+From: Liu Xiaodong <xiaodong.liu@intel.com>
+
+[ Upstream commit 2f1e07dda1e1310873647abc40bbc49eaf3b10e3 ]
+
+Currently, uring_cmd with UBLK_IO_FETCH_REQ or
+UBLK_IO_COMMIT_AND_FETCH_REQ is always checked whether
+userspace server has provided IO buffer even flag
+UBLK_F_NEED_GET_DATA is configured.
+
+This is a excessive check. If UBLK_F_NEED_GET_DATA is
+configured, FETCH_RQ doesn't need to provide IO buffer;
+COMMIT_AND_FETCH_REQ also doesn't need to do that if
+the IO type is not READ.
+
+Check ub_cmd->addr together with ublk_need_get_data()
+and IO type in ublk_ch_uring_cmd().
+
+With this fix, userspace server doesn't need to preserve
+buffers for every ublk_io when flag UBLK_F_NEED_GET_DATA
+is configured, in order to save memory.
+
+Signed-off-by: Liu Xiaodong <xiaodong.liu@intel.com>
+Fixes: c86019ff75c1 ("ublk_drv: add support for UBLK_IO_NEED_GET_DATA")
+Reviewed-by: Ming Lei <ming.lei@redhat.com>
+Link: https://lore.kernel.org/r/20230210141356.112321-1-xiaodong.liu@intel.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/ublk_drv.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c
+index 450bd54fd0061..4aec9be0ab77e 100644
+--- a/drivers/block/ublk_drv.c
++++ b/drivers/block/ublk_drv.c
+@@ -1206,6 +1206,7 @@ static int ublk_ch_uring_cmd(struct io_uring_cmd *cmd, unsigned int issue_flags)
+ u32 cmd_op = cmd->cmd_op;
+ unsigned tag = ub_cmd->tag;
+ int ret = -EINVAL;
++ struct request *req;
+
+ pr_devel("%s: received: cmd op %d queue %d tag %d result %d\n",
+ __func__, cmd->cmd_op, ub_cmd->q_id, tag,
+@@ -1256,8 +1257,8 @@ static int ublk_ch_uring_cmd(struct io_uring_cmd *cmd, unsigned int issue_flags)
+ */
+ if (io->flags & UBLK_IO_FLAG_OWNED_BY_SRV)
+ goto out;
+- /* FETCH_RQ has to provide IO buffer */
+- if (!ub_cmd->addr)
++ /* FETCH_RQ has to provide IO buffer if NEED GET DATA is not enabled */
++ if (!ub_cmd->addr && !ublk_need_get_data(ubq))
+ goto out;
+ io->cmd = cmd;
+ io->flags |= UBLK_IO_FLAG_ACTIVE;
+@@ -1266,8 +1267,12 @@ static int ublk_ch_uring_cmd(struct io_uring_cmd *cmd, unsigned int issue_flags)
+ ublk_mark_io_ready(ub, ubq);
+ break;
+ case UBLK_IO_COMMIT_AND_FETCH_REQ:
+- /* FETCH_RQ has to provide IO buffer */
+- if (!ub_cmd->addr)
++ req = blk_mq_tag_to_rq(ub->tag_set.tags[ub_cmd->q_id], tag);
++ /*
++ * COMMIT_AND_FETCH_REQ has to provide IO buffer if NEED GET DATA is
++ * not enabled or it is Read IO.
++ */
++ if (!ub_cmd->addr && (!ublk_need_get_data(ubq) || req_op(req) == REQ_OP_READ))
+ goto out;
+ if (!(io->flags & UBLK_IO_FLAG_OWNED_BY_SRV))
+ goto out;
+--
+2.39.2
+
--- /dev/null
+From 5384c09f4a604a1bd50145c68d13460ecb15d4e1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Feb 2023 19:39:15 -0700
+Subject: block: use proper return value from bio_failfast()
+
+From: Jens Axboe <axboe@kernel.dk>
+
+[ Upstream commit f3ca73862453ac1e64fc6968a14bf66d839cd2d8 ]
+
+kernel test robot complains about a type mismatch:
+
+ block/blk-merge.c:984:42: sparse: expected restricted blk_opf_t const [usertype] ff
+ block/blk-merge.c:984:42: sparse: got unsigned int
+ block/blk-merge.c:1010:42: sparse: sparse: incorrect type in initializer (different base types) @@ expected restricted blk_opf_t const [usertype] ff @@ got unsigned int @@
+ block/blk-merge.c:1010:42: sparse: expected restricted blk_opf_t const [usertype] ff
+ block/blk-merge.c:1010:42: sparse: got unsigned int
+
+because bio_failfast() is return an unsigned int rather than the
+appropriate blk_opt_f type. Fix it up.
+
+Fixes: 3ce6a115980c ("block: sync mixed merged request's failfast with 1st bio's")
+Reported-by: kernel test robot <lkp@intel.com>
+Link: https://lore.kernel.org/oe-kbuild-all/202302170743.GXypM9Rt-lkp@intel.com/
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-merge.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/block/blk-merge.c b/block/blk-merge.c
+index 30e4a99c2276b..808b58129d3e4 100644
+--- a/block/blk-merge.c
++++ b/block/blk-merge.c
+@@ -757,7 +757,7 @@ void blk_rq_set_mixed_merge(struct request *rq)
+ rq->rq_flags |= RQF_MIXED_MERGE;
+ }
+
+-static inline unsigned int bio_failfast(const struct bio *bio)
++static inline blk_opf_t bio_failfast(const struct bio *bio)
+ {
+ if (bio->bi_opf & REQ_RAHEAD)
+ return REQ_FAILFAST_MASK;
+--
+2.39.2
+
--- /dev/null
+From 8bc9fe05a79568c99174a798e0c7092e7c6af98f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Dec 2022 20:18:54 -0600
+Subject: Bluetooth: btusb: Add new PID/VID 0489:e0f2 for MT7921
+
+From: Mario Limonciello <mario.limonciello@amd.com>
+
+[ Upstream commit 83458a5f272b303479e7d2f451600817a7350b6b ]
+
+This bluetooth device is found in a combo WLAN/BT card
+for a MediaTek 7921e.
+
+The device information:
+
+T: Bus=01 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#= 2 Spd=480 MxCh= 0
+D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1
+P: Vendor=0489 ProdID=e0f2 Rev= 1.00
+S: Manufacturer=MediaTek Inc.
+S: Product=Wireless_Device
+S: SerialNumber=000000000
+C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=100mA
+A: FirstIf#= 0 IfCount= 3 Cls=e0(wlcon) Sub=01 Prot=01
+I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=125us
+E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms
+I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms
+I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms
+I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms
+I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms
+I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms
+I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms
+I:* If#= 2 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none)
+E: Ad=8a(I) Atr=03(Int.) MxPS= 64 Ivl=125us
+E: Ad=0a(O) Atr=03(Int.) MxPS= 64 Ivl=125us
+I: If#= 2 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none)
+E: Ad=8a(I) Atr=03(Int.) MxPS= 512 Ivl=125us
+E: Ad=0a(O) Atr=03(Int.) MxPS= 512 Ivl=125us
+
+Cc: Sean Wang <sean.wang@mediatek.com>
+Cc: Anson Tsao <anson.tsao@amd.com>
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/btusb.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index afd2f08ffe30f..acfd40f1cc75c 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -567,6 +567,9 @@ static const struct usb_device_id blacklist_table[] = {
+ { USB_DEVICE(0x0489, 0xe0e0), .driver_info = BTUSB_MEDIATEK |
+ BTUSB_WIDEBAND_SPEECH |
+ BTUSB_VALID_LE_STATES },
++ { USB_DEVICE(0x0489, 0xe0f2), .driver_info = BTUSB_MEDIATEK |
++ BTUSB_WIDEBAND_SPEECH |
++ BTUSB_VALID_LE_STATES },
+ { USB_DEVICE(0x04ca, 0x3802), .driver_info = BTUSB_MEDIATEK |
+ BTUSB_WIDEBAND_SPEECH |
+ BTUSB_VALID_LE_STATES },
+--
+2.39.2
+
--- /dev/null
+From 27585befb55047d89503300d1bff2ed2d9415c58 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Dec 2022 14:07:13 -0500
+Subject: Bluetooth: btusb: Add VID:PID 13d3:3529 for Realtek RTL8821CE
+
+From: Moises Cardona <moisesmcardona@gmail.com>
+
+[ Upstream commit 1eec3b95b5ce7fb2cdd273ac4f8b24b1ed6776a1 ]
+
+This patch adds VID:PID 13d3:3529 to the btusb.c file.
+
+This VID:PID is found in the Realtek RTL8821CE module
+(M.2 module AW-CB304NF on an ASUS E210MA laptop)
+
+Output of /sys/kernel/debug/usb/devices:
+
+T: Bus=01 Lev=01 Prnt=01 Port=07 Cnt=02 Dev#= 3 Spd=12 MxCh= 0
+D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
+P: Vendor=13d3 ProdID=3529 Rev= 1.10
+S: Manufacturer=Realtek
+S: Product=Bluetooth Radio
+C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA
+I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms
+E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms
+E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms
+I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms
+I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms
+I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms
+I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms
+I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms
+I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms
+
+Signed-off-by: Moises Cardona <moisesmcardona@gmail.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/btusb.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index acfd40f1cc75c..18bc947187115 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -493,6 +493,10 @@ static const struct usb_device_id blacklist_table[] = {
+ { USB_VENDOR_AND_INTERFACE_INFO(0x8087, 0xe0, 0x01, 0x01),
+ .driver_info = BTUSB_IGNORE },
+
++ /* Realtek 8821CE Bluetooth devices */
++ { USB_DEVICE(0x13d3, 0x3529), .driver_info = BTUSB_REALTEK |
++ BTUSB_WIDEBAND_SPEECH },
++
+ /* Realtek 8822CE Bluetooth devices */
+ { USB_DEVICE(0x0bda, 0xb00c), .driver_info = BTUSB_REALTEK |
+ BTUSB_WIDEBAND_SPEECH },
+--
+2.39.2
+
--- /dev/null
+From 44674b80a0096e5d1611c44a0bbee59288590946 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Dec 2022 21:12:47 +0100
+Subject: Bluetooth: Fix issue with Actions Semi ATS2851 based devices
+
+From: Marcel Holtmann <marcel@holtmann.org>
+
+[ Upstream commit 5d44f76fab0839799b19cbc88d13575da968dc08 ]
+
+Their devices claim to support the erroneous data reporting, but don't
+actually support the required commands. So blacklist them and add a
+quirk.
+
+ < HCI Command: Read Default Erroneous Data Reporting (0x03|0x005a) plen 0
+ > HCI Event: Command Status (0x0f) plen 4
+ Read Default Erroneous Data Reporting (0x03|0x005a) ncmd 1
+ Status: Unknown HCI Command (0x01)
+
+T: Bus=02 Lev=02 Prnt=08 Port=02 Cnt=01 Dev#= 10 Spd=12 MxCh= 0
+D: Ver= 2.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
+P: Vendor=10d7 ProdID=b012 Rev=88.91
+S: Manufacturer=Actions
+S: Product=general adapter
+S: SerialNumber=ACTIONS1234
+C:* #Ifs= 2 Cfg#= 1 Atr=c0 MxPwr=100mA
+I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=1ms
+E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms
+E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms
+I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=01(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms
+I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=01(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms
+I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=01(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms
+I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=01(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms
+I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=01(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms
+I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=01(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms
+
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/btusb.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index 2ad4efdd9e40b..afd2f08ffe30f 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -64,6 +64,7 @@ static struct usb_driver btusb_driver;
+ #define BTUSB_INTEL_BROKEN_SHUTDOWN_LED BIT(24)
+ #define BTUSB_INTEL_BROKEN_INITIAL_NCMD BIT(25)
+ #define BTUSB_INTEL_NO_WBS_SUPPORT BIT(26)
++#define BTUSB_ACTIONS_SEMI BIT(27)
+
+ static const struct usb_device_id btusb_table[] = {
+ /* Generic Bluetooth USB device */
+@@ -677,6 +678,9 @@ static const struct usb_device_id blacklist_table[] = {
+ { USB_DEVICE(0x0cb5, 0xc547), .driver_info = BTUSB_REALTEK |
+ BTUSB_WIDEBAND_SPEECH },
+
++ /* Actions Semiconductor ATS2851 based devices */
++ { USB_DEVICE(0x10d7, 0xb012), .driver_info = BTUSB_ACTIONS_SEMI },
++
+ /* Silicon Wave based devices */
+ { USB_DEVICE(0x0c10, 0x0000), .driver_info = BTUSB_SWAVE },
+
+@@ -4098,6 +4102,11 @@ static int btusb_probe(struct usb_interface *intf,
+ set_bit(BTUSB_USE_ALT3_FOR_WBS, &data->flags);
+ }
+
++ if (id->driver_info & BTUSB_ACTIONS_SEMI) {
++ /* Support is advertised, but not implemented */
++ set_bit(HCI_QUIRK_BROKEN_ERR_DATA_REPORTING, &hdev->quirks);
++ }
++
+ if (!reset)
+ set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
+
+--
+2.39.2
+
--- /dev/null
+From 5141b0c312c96a54250f2e926e70363f24ff8993 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Jan 2023 16:51:54 -0800
+Subject: Bluetooth: hci_conn: Refactor hci_bind_bis() since it always succeeds
+
+From: Kees Cook <keescook@chromium.org>
+
+[ Upstream commit a00a29b0eeea6caaaf9edc3dd284f81b072ee343 ]
+
+The compiler thinks "conn" might be NULL after a call to hci_bind_bis(),
+which cannot happen. Avoid any confusion by just making it not return a
+value since it cannot fail. Fixes the warnings seen with GCC 13:
+
+In function 'arch_atomic_dec_and_test',
+ inlined from 'atomic_dec_and_test' at ../include/linux/atomic/atomic-instrumented.h:576:9,
+ inlined from 'hci_conn_drop' at ../include/net/bluetooth/hci_core.h:1391:6,
+ inlined from 'hci_connect_bis' at ../net/bluetooth/hci_conn.c:2124:3:
+../arch/x86/include/asm/rmwcc.h:37:9: warning: array subscript 0 is outside array bounds of 'atomic_t[0]' [-Warray-bounds=]
+ 37 | asm volatile (fullop CC_SET(cc) \
+ | ^~~
+...
+In function 'hci_connect_bis':
+cc1: note: source object is likely at address zero
+
+Fixes: eca0ae4aea66 ("Bluetooth: Add initial implementation of BIS connections")
+Cc: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Cc: Marcel Holtmann <marcel@holtmann.org>
+Cc: Johan Hedberg <johan.hedberg@gmail.com>
+Cc: "David S. Miller" <davem@davemloft.net>
+Cc: Eric Dumazet <edumazet@google.com>
+Cc: Jakub Kicinski <kuba@kernel.org>
+Cc: Paolo Abeni <pabeni@redhat.com>
+Cc: linux-bluetooth@vger.kernel.org
+Cc: netdev@vger.kernel.org
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/hci_conn.c | 12 +++---------
+ 1 file changed, 3 insertions(+), 9 deletions(-)
+
+diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
+index acf563fbdfd95..61a34801e61ea 100644
+--- a/net/bluetooth/hci_conn.c
++++ b/net/bluetooth/hci_conn.c
+@@ -1981,16 +1981,14 @@ static void hci_iso_qos_setup(struct hci_dev *hdev, struct hci_conn *conn,
+ qos->latency = conn->le_conn_latency;
+ }
+
+-static struct hci_conn *hci_bind_bis(struct hci_conn *conn,
+- struct bt_iso_qos *qos)
++static void hci_bind_bis(struct hci_conn *conn,
++ struct bt_iso_qos *qos)
+ {
+ /* Update LINK PHYs according to QoS preference */
+ conn->le_tx_phy = qos->out.phy;
+ conn->le_tx_phy = qos->out.phy;
+ conn->iso_qos = *qos;
+ conn->state = BT_BOUND;
+-
+- return conn;
+ }
+
+ static int create_big_sync(struct hci_dev *hdev, void *data)
+@@ -2119,11 +2117,7 @@ struct hci_conn *hci_connect_bis(struct hci_dev *hdev, bdaddr_t *dst,
+ if (IS_ERR(conn))
+ return conn;
+
+- conn = hci_bind_bis(conn, qos);
+- if (!conn) {
+- hci_conn_drop(conn);
+- return ERR_PTR(-ENOMEM);
+- }
++ hci_bind_bis(conn, qos);
+
+ /* Add Basic Announcement into Peridic Adv Data if BASE is set */
+ if (base_len && base) {
+--
+2.39.2
+
--- /dev/null
+From 866a7e0f9f8e2e8057aee45d1d25da6530e56513 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Feb 2023 09:47:01 -0800
+Subject: Bluetooth: hci_qca: get wakeup status from serdev device handle
+
+From: Zhengping Jiang <jiangzp@google.com>
+
+[ Upstream commit 03b0093f7b310493bc944a20f725228cfe0d3fea ]
+
+Bluetooth controller attached via the UART is handled by the serdev driver.
+Get the wakeup status from the device handle through serdev, instead of the
+parent path.
+
+Fixes: c1a74160eaf1 ("Bluetooth: hci_qca: Add device_may_wakeup support")
+Signed-off-by: Zhengping Jiang <jiangzp@google.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/hci_qca.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/bluetooth/hci_qca.c b/drivers/bluetooth/hci_qca.c
+index bbe9cf1cae27f..d331772809d56 100644
+--- a/drivers/bluetooth/hci_qca.c
++++ b/drivers/bluetooth/hci_qca.c
+@@ -1588,10 +1588,11 @@ static bool qca_wakeup(struct hci_dev *hdev)
+ struct hci_uart *hu = hci_get_drvdata(hdev);
+ bool wakeup;
+
+- /* UART driver handles the interrupt from BT SoC.So we need to use
+- * device handle of UART driver to get the status of device may wakeup.
++ /* BT SoC attached through the serial bus is handled by the serdev driver.
++ * So we need to use the device handle of the serdev driver to get the
++ * status of device may wakeup.
+ */
+- wakeup = device_may_wakeup(hu->serdev->ctrl->dev.parent);
++ wakeup = device_may_wakeup(&hu->serdev->ctrl->dev);
+ bt_dev_dbg(hu->hdev, "wakeup status : %d", wakeup);
+
+ return wakeup;
+--
+2.39.2
+
--- /dev/null
+From 924d0aeb43e9d98037b9fb4605c6ce67f82a995a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Feb 2023 14:01:11 -0800
+Subject: Bluetooth: L2CAP: Fix potential user-after-free
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+[ Upstream commit df5703348813235874d851934e957c3723d71644 ]
+
+This fixes all instances of which requires to allocate a buffer calling
+alloc_skb which may release the chan lock and reacquire later which
+makes it possible that the chan is disconnected in the meantime.
+
+Fixes: a6a5568c03c4 ("Bluetooth: Lock the L2CAP channel when sending")
+Reported-by: Alexander Coffin <alex.coffin@matician.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/l2cap_core.c | 24 ------------------------
+ net/bluetooth/l2cap_sock.c | 8 ++++++++
+ 2 files changed, 8 insertions(+), 24 deletions(-)
+
+diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
+index a3e0dc6a6e732..adfc3ea06d088 100644
+--- a/net/bluetooth/l2cap_core.c
++++ b/net/bluetooth/l2cap_core.c
+@@ -2683,14 +2683,6 @@ int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len)
+ if (IS_ERR(skb))
+ return PTR_ERR(skb);
+
+- /* Channel lock is released before requesting new skb and then
+- * reacquired thus we need to recheck channel state.
+- */
+- if (chan->state != BT_CONNECTED) {
+- kfree_skb(skb);
+- return -ENOTCONN;
+- }
+-
+ l2cap_do_send(chan, skb);
+ return len;
+ }
+@@ -2735,14 +2727,6 @@ int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len)
+ if (IS_ERR(skb))
+ return PTR_ERR(skb);
+
+- /* Channel lock is released before requesting new skb and then
+- * reacquired thus we need to recheck channel state.
+- */
+- if (chan->state != BT_CONNECTED) {
+- kfree_skb(skb);
+- return -ENOTCONN;
+- }
+-
+ l2cap_do_send(chan, skb);
+ err = len;
+ break;
+@@ -2763,14 +2747,6 @@ int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len)
+ */
+ err = l2cap_segment_sdu(chan, &seg_queue, msg, len);
+
+- /* The channel could have been closed while segmenting,
+- * check that it is still connected.
+- */
+- if (chan->state != BT_CONNECTED) {
+- __skb_queue_purge(&seg_queue);
+- err = -ENOTCONN;
+- }
+-
+ if (err)
+ break;
+
+diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
+index ca8f07f3542b8..eebe256104bc0 100644
+--- a/net/bluetooth/l2cap_sock.c
++++ b/net/bluetooth/l2cap_sock.c
+@@ -1624,6 +1624,14 @@ static struct sk_buff *l2cap_sock_alloc_skb_cb(struct l2cap_chan *chan,
+ if (!skb)
+ return ERR_PTR(err);
+
++ /* Channel lock is released before requesting new skb and then
++ * reacquired thus we need to recheck channel state.
++ */
++ if (chan->state != BT_CONNECTED) {
++ kfree_skb(skb);
++ return ERR_PTR(-ENOTCONN);
++ }
++
+ skb->priority = sk->sk_priority;
+
+ bt_cb(skb)->l2cap.chan = chan;
+--
+2.39.2
+
--- /dev/null
+From a70f8c6267d9c6b9ef27bcfea315447001278cb0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Jan 2023 00:12:18 +0000
+Subject: bpf, docs: Fix modulo zero, division by zero, overflow, and underflow
+
+From: Dave Thaler <dthaler@microsoft.com>
+
+[ Upstream commit 0eb9d19e2201068260e439a5c96dc85f9f3722a2 ]
+
+Fix modulo zero, division by zero, overflow, and underflow. Also clarify how
+a negative immediate value is used in unsigned division.
+
+Signed-off-by: Dave Thaler <dthaler@microsoft.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/20230124001218.827-1-dthaler1968@googlemail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/bpf/instruction-set.rst | 16 ++++++++++++++--
+ 1 file changed, 14 insertions(+), 2 deletions(-)
+
+diff --git a/Documentation/bpf/instruction-set.rst b/Documentation/bpf/instruction-set.rst
+index e672d5ec6cc7b..2d3fe59bd260f 100644
+--- a/Documentation/bpf/instruction-set.rst
++++ b/Documentation/bpf/instruction-set.rst
+@@ -99,19 +99,26 @@ code value description
+ BPF_ADD 0x00 dst += src
+ BPF_SUB 0x10 dst -= src
+ BPF_MUL 0x20 dst \*= src
+-BPF_DIV 0x30 dst /= src
++BPF_DIV 0x30 dst = (src != 0) ? (dst / src) : 0
+ BPF_OR 0x40 dst \|= src
+ BPF_AND 0x50 dst &= src
+ BPF_LSH 0x60 dst <<= src
+ BPF_RSH 0x70 dst >>= src
+ BPF_NEG 0x80 dst = ~src
+-BPF_MOD 0x90 dst %= src
++BPF_MOD 0x90 dst = (src != 0) ? (dst % src) : dst
+ BPF_XOR 0xa0 dst ^= src
+ BPF_MOV 0xb0 dst = src
+ BPF_ARSH 0xc0 sign extending shift right
+ BPF_END 0xd0 byte swap operations (see `Byte swap instructions`_ below)
+ ======== ===== ==========================================================
+
++Underflow and overflow are allowed during arithmetic operations, meaning
++the 64-bit or 32-bit value will wrap. If eBPF program execution would
++result in division by zero, the destination register is instead set to zero.
++If execution would result in modulo by zero, for ``BPF_ALU64`` the value of
++the destination register is unchanged whereas for ``BPF_ALU`` the upper
++32 bits of the destination register are zeroed.
++
+ ``BPF_ADD | BPF_X | BPF_ALU`` means::
+
+ dst_reg = (u32) dst_reg + (u32) src_reg;
+@@ -128,6 +135,11 @@ BPF_END 0xd0 byte swap operations (see `Byte swap instructions`_ below)
+
+ dst_reg = dst_reg ^ imm32
+
++Also note that the division and modulo operations are unsigned. Thus, for
++``BPF_ALU``, 'imm' is first interpreted as an unsigned 32-bit value, whereas
++for ``BPF_ALU64``, 'imm' is first sign extended to 64 bits and the result
++interpreted as an unsigned 64-bit value. There are no instructions for
++signed division or modulo.
+
+ Byte swap instructions
+ ~~~~~~~~~~~~~~~~~~~~~~
+--
+2.39.2
+
--- /dev/null
+From 3f26a34f5b5a0fc9b988fa7ce9149a390295c5c6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Feb 2023 20:59:52 -0800
+Subject: bpf: Fix global subprog context argument resolution logic
+
+From: Andrii Nakryiko <andrii@kernel.org>
+
+[ Upstream commit d384dce281ed1b504fae2e279507827638d56fa3 ]
+
+KPROBE program's user-facing context type is defined as typedef
+bpf_user_pt_regs_t. This leads to a problem when trying to passing
+kprobe/uprobe/usdt context argument into global subprog, as kernel
+always strip away mods and typedefs of user-supplied type, but takes
+expected type from bpf_ctx_convert as is, which causes mismatch.
+
+Current way to work around this is to define a fake struct with the same
+name as expected typedef:
+
+ struct bpf_user_pt_regs_t {};
+
+ __noinline my_global_subprog(struct bpf_user_pt_regs_t *ctx) { ... }
+
+This patch fixes the issue by resolving expected type, if it's not
+a struct. It still leaves the above work-around working for backwards
+compatibility.
+
+Fixes: 91cc1a99740e ("bpf: Annotate context types")
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Stanislav Fomichev <sdf@google.com>
+Link: https://lore.kernel.org/bpf/20230216045954.3002473-2-andrii@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/btf.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
+index b7017cae6fd1e..530e200fbc477 100644
+--- a/kernel/bpf/btf.c
++++ b/kernel/bpf/btf.c
+@@ -5573,6 +5573,7 @@ btf_get_prog_ctx_type(struct bpf_verifier_log *log, const struct btf *btf,
+ if (!ctx_struct)
+ /* should not happen */
+ return NULL;
++again:
+ ctx_tname = btf_name_by_offset(btf_vmlinux, ctx_struct->name_off);
+ if (!ctx_tname) {
+ /* should not happen */
+@@ -5586,8 +5587,16 @@ btf_get_prog_ctx_type(struct bpf_verifier_log *log, const struct btf *btf,
+ * int socket_filter_bpf_prog(struct __sk_buff *skb)
+ * { // no fields of skb are ever used }
+ */
+- if (strcmp(ctx_tname, tname))
+- return NULL;
++ if (strcmp(ctx_tname, tname)) {
++ /* bpf_user_pt_regs_t is a typedef, so resolve it to
++ * underlying struct and check name again
++ */
++ if (!btf_type_is_modifier(ctx_struct))
++ return NULL;
++ while (btf_type_is_modifier(ctx_struct))
++ ctx_struct = btf_type_by_id(btf_vmlinux, ctx_struct->type);
++ goto again;
++ }
+ return ctx_type;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From fe82f5000e59246d6469429a720ef8bdd8560b51 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 21 Jan 2023 05:52:31 +0530
+Subject: bpf: Fix missing var_off check for ARG_PTR_TO_DYNPTR
+
+From: Kumar Kartikeya Dwivedi <memxor@gmail.com>
+
+[ Upstream commit 79168a669d8125453c8a271115f1ffd4294e61f6 ]
+
+Currently, the dynptr function is not checking the variable offset part
+of PTR_TO_STACK that it needs to check. The fixed offset is considered
+when computing the stack pointer index, but if the variable offset was
+not a constant (such that it could not be accumulated in reg->off), we
+will end up a discrepency where runtime pointer does not point to the
+actual stack slot we mark as STACK_DYNPTR.
+
+It is impossible to precisely track dynptr state when variable offset is
+not constant, hence, just like bpf_timer, kptr, bpf_spin_lock, etc.
+simply reject the case where reg->var_off is not constant. Then,
+consider both reg->off and reg->var_off.value when computing the stack
+pointer index.
+
+A new helper dynptr_get_spi is introduced to hide over these details
+since the dynptr needs to be located in multiple places outside the
+process_dynptr_func checks, hence once we know it's a PTR_TO_STACK, we
+need to enforce these checks in all places.
+
+Note that it is disallowed for unprivileged users to have a non-constant
+var_off, so this problem should only be possible to trigger from
+programs having CAP_PERFMON. However, its effects can vary.
+
+Without the fix, it is possible to replace the contents of the dynptr
+arbitrarily by making verifier mark different stack slots than actual
+location and then doing writes to the actual stack address of dynptr at
+runtime.
+
+Fixes: 97e03f521050 ("bpf: Add verifier support for dynptrs")
+Acked-by: Joanne Koong <joannelkoong@gmail.com>
+Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
+Link: https://lore.kernel.org/r/20230121002241.2113993-3-memxor@gmail.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/verifier.c | 84 +++++++++++++++----
+ .../bpf/prog_tests/kfunc_dynptr_param.c | 2 +-
+ .../testing/selftests/bpf/progs/dynptr_fail.c | 4 +-
+ 3 files changed, 69 insertions(+), 21 deletions(-)
+
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index c42cb70150e96..749e7f7a720f2 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -638,11 +638,34 @@ static void print_liveness(struct bpf_verifier_env *env,
+ verbose(env, "D");
+ }
+
+-static int get_spi(s32 off)
++static int __get_spi(s32 off)
+ {
+ return (-off - 1) / BPF_REG_SIZE;
+ }
+
++static int dynptr_get_spi(struct bpf_verifier_env *env, struct bpf_reg_state *reg)
++{
++ int off, spi;
++
++ if (!tnum_is_const(reg->var_off)) {
++ verbose(env, "dynptr has to be at a constant offset\n");
++ return -EINVAL;
++ }
++
++ off = reg->off + reg->var_off.value;
++ if (off % BPF_REG_SIZE) {
++ verbose(env, "cannot pass in dynptr at an offset=%d\n", off);
++ return -EINVAL;
++ }
++
++ spi = __get_spi(off);
++ if (spi < 1) {
++ verbose(env, "cannot pass in dynptr at an offset=%d\n", off);
++ return -EINVAL;
++ }
++ return spi;
++}
++
+ static bool is_spi_bounds_valid(struct bpf_func_state *state, int spi, int nr_slots)
+ {
+ int allocated_slots = state->allocated_stack / BPF_REG_SIZE;
+@@ -754,7 +777,9 @@ static int mark_stack_slots_dynptr(struct bpf_verifier_env *env, struct bpf_reg_
+ enum bpf_dynptr_type type;
+ int spi, i, id;
+
+- spi = get_spi(reg->off);
++ spi = dynptr_get_spi(env, reg);
++ if (spi < 0)
++ return spi;
+
+ if (!is_spi_bounds_valid(state, spi, BPF_DYNPTR_NR_SLOTS))
+ return -EINVAL;
+@@ -792,7 +817,9 @@ static int unmark_stack_slots_dynptr(struct bpf_verifier_env *env, struct bpf_re
+ struct bpf_func_state *state = func(env, reg);
+ int spi, i;
+
+- spi = get_spi(reg->off);
++ spi = dynptr_get_spi(env, reg);
++ if (spi < 0)
++ return spi;
+
+ if (!is_spi_bounds_valid(state, spi, BPF_DYNPTR_NR_SLOTS))
+ return -EINVAL;
+@@ -844,7 +871,11 @@ static bool is_dynptr_reg_valid_uninit(struct bpf_verifier_env *env, struct bpf_
+ if (reg->type == CONST_PTR_TO_DYNPTR)
+ return false;
+
+- spi = get_spi(reg->off);
++ spi = dynptr_get_spi(env, reg);
++ if (spi < 0)
++ return false;
++
++ /* We will do check_mem_access to check and update stack bounds later */
+ if (!is_spi_bounds_valid(state, spi, BPF_DYNPTR_NR_SLOTS))
+ return true;
+
+@@ -860,14 +891,15 @@ static bool is_dynptr_reg_valid_uninit(struct bpf_verifier_env *env, struct bpf_
+ static bool is_dynptr_reg_valid_init(struct bpf_verifier_env *env, struct bpf_reg_state *reg)
+ {
+ struct bpf_func_state *state = func(env, reg);
+- int spi;
+- int i;
++ int spi, i;
+
+ /* This already represents first slot of initialized bpf_dynptr */
+ if (reg->type == CONST_PTR_TO_DYNPTR)
+ return true;
+
+- spi = get_spi(reg->off);
++ spi = dynptr_get_spi(env, reg);
++ if (spi < 0)
++ return false;
+ if (!is_spi_bounds_valid(state, spi, BPF_DYNPTR_NR_SLOTS) ||
+ !state->stack[spi].spilled_ptr.dynptr.first_slot)
+ return false;
+@@ -896,7 +928,9 @@ static bool is_dynptr_type_expected(struct bpf_verifier_env *env, struct bpf_reg
+ if (reg->type == CONST_PTR_TO_DYNPTR) {
+ return reg->dynptr.type == dynptr_type;
+ } else {
+- spi = get_spi(reg->off);
++ spi = dynptr_get_spi(env, reg);
++ if (spi < 0)
++ return false;
+ return state->stack[spi].spilled_ptr.dynptr.type == dynptr_type;
+ }
+ }
+@@ -2425,7 +2459,9 @@ static int mark_dynptr_read(struct bpf_verifier_env *env, struct bpf_reg_state *
+ */
+ if (reg->type == CONST_PTR_TO_DYNPTR)
+ return 0;
+- spi = get_spi(reg->off);
++ spi = dynptr_get_spi(env, reg);
++ if (spi < 0)
++ return spi;
+ /* Caller ensures dynptr is valid and initialized, which means spi is in
+ * bounds and spi is the first dynptr slot. Simply mark stack slot as
+ * read.
+@@ -6007,12 +6043,15 @@ int process_dynptr_func(struct bpf_verifier_env *env, int regno,
+ }
+ /* CONST_PTR_TO_DYNPTR already has fixed and var_off as 0 due to
+ * check_func_arg_reg_off's logic. We only need to check offset
+- * alignment for PTR_TO_STACK.
++ * and its alignment for PTR_TO_STACK.
+ */
+- if (reg->type == PTR_TO_STACK && (reg->off % BPF_REG_SIZE)) {
+- verbose(env, "cannot pass in dynptr at an offset=%d\n", reg->off);
+- return -EINVAL;
++ if (reg->type == PTR_TO_STACK) {
++ int err = dynptr_get_spi(env, reg);
++
++ if (err < 0)
++ return err;
+ }
++
+ /* MEM_UNINIT - Points to memory that is an appropriate candidate for
+ * constructing a mutable bpf_dynptr object.
+ *
+@@ -6420,15 +6459,16 @@ int check_func_arg_reg_off(struct bpf_verifier_env *env,
+ }
+ }
+
+-static u32 dynptr_ref_obj_id(struct bpf_verifier_env *env, struct bpf_reg_state *reg)
++static int dynptr_ref_obj_id(struct bpf_verifier_env *env, struct bpf_reg_state *reg)
+ {
+ struct bpf_func_state *state = func(env, reg);
+ int spi;
+
+ if (reg->type == CONST_PTR_TO_DYNPTR)
+ return reg->ref_obj_id;
+-
+- spi = get_spi(reg->off);
++ spi = dynptr_get_spi(env, reg);
++ if (spi < 0)
++ return spi;
+ return state->stack[spi].spilled_ptr.ref_obj_id;
+ }
+
+@@ -6502,7 +6542,9 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
+ * PTR_TO_STACK.
+ */
+ if (reg->type == PTR_TO_STACK) {
+- spi = get_spi(reg->off);
++ spi = dynptr_get_spi(env, reg);
++ if (spi < 0)
++ return spi;
+ if (!is_spi_bounds_valid(state, spi, BPF_DYNPTR_NR_SLOTS) ||
+ !state->stack[spi].spilled_ptr.ref_obj_id) {
+ verbose(env, "arg %d is an unacquired reference\n", regno);
+@@ -7991,13 +8033,19 @@ static int check_helper_call(struct bpf_verifier_env *env, struct bpf_insn *insn
+ for (i = 0; i < MAX_BPF_FUNC_REG_ARGS; i++) {
+ if (arg_type_is_dynptr(fn->arg_type[i])) {
+ struct bpf_reg_state *reg = ®s[BPF_REG_1 + i];
++ int ref_obj_id;
+
+ if (meta.ref_obj_id) {
+ verbose(env, "verifier internal error: meta.ref_obj_id already set\n");
+ return -EFAULT;
+ }
+
+- meta.ref_obj_id = dynptr_ref_obj_id(env, reg);
++ ref_obj_id = dynptr_ref_obj_id(env, reg);
++ if (ref_obj_id < 0) {
++ verbose(env, "verifier internal error: failed to obtain dynptr ref_obj_id\n");
++ return ref_obj_id;
++ }
++ meta.ref_obj_id = ref_obj_id;
+ break;
+ }
+ }
+diff --git a/tools/testing/selftests/bpf/prog_tests/kfunc_dynptr_param.c b/tools/testing/selftests/bpf/prog_tests/kfunc_dynptr_param.c
+index a9229260a6cec..72800b1e8395a 100644
+--- a/tools/testing/selftests/bpf/prog_tests/kfunc_dynptr_param.c
++++ b/tools/testing/selftests/bpf/prog_tests/kfunc_dynptr_param.c
+@@ -18,7 +18,7 @@ static struct {
+ const char *expected_verifier_err_msg;
+ int expected_runtime_err;
+ } kfunc_dynptr_tests[] = {
+- {"not_valid_dynptr", "Expected an initialized dynptr as arg #1", 0},
++ {"not_valid_dynptr", "cannot pass in dynptr at an offset=-8", 0},
+ {"not_ptr_to_stack", "arg#0 expected pointer to stack or dynptr_ptr", 0},
+ {"dynptr_data_null", NULL, -EBADMSG},
+ };
+diff --git a/tools/testing/selftests/bpf/progs/dynptr_fail.c b/tools/testing/selftests/bpf/progs/dynptr_fail.c
+index 78debc1b38207..02d57b95cf6ec 100644
+--- a/tools/testing/selftests/bpf/progs/dynptr_fail.c
++++ b/tools/testing/selftests/bpf/progs/dynptr_fail.c
+@@ -382,7 +382,7 @@ int invalid_helper1(void *ctx)
+
+ /* A dynptr can't be passed into a helper function at a non-zero offset */
+ SEC("?raw_tp")
+-__failure __msg("Expected an initialized dynptr as arg #3")
++__failure __msg("cannot pass in dynptr at an offset=-8")
+ int invalid_helper2(void *ctx)
+ {
+ struct bpf_dynptr ptr;
+@@ -584,7 +584,7 @@ int invalid_read4(void *ctx)
+
+ /* Initializing a dynptr on an offset should fail */
+ SEC("?raw_tp")
+-__failure __msg("invalid write to stack")
++__failure __msg("cannot pass in dynptr at an offset=0")
+ int invalid_offset(void *ctx)
+ {
+ struct bpf_dynptr ptr;
+--
+2.39.2
+
--- /dev/null
+From 4415b00692984f455992391032f01f173dbb324e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 21 Jan 2023 05:52:32 +0530
+Subject: bpf: Fix partial dynptr stack slot reads/writes
+
+From: Kumar Kartikeya Dwivedi <memxor@gmail.com>
+
+[ Upstream commit ef8fc7a07c0e161841779d6fe3f6acd5a05c547c ]
+
+Currently, while reads are disallowed for dynptr stack slots, writes are
+not. Reads don't work from both direct access and helpers, while writes
+do work in both cases, but have the effect of overwriting the slot_type.
+
+While this is fine, handling for a few edge cases is missing. Firstly,
+a user can overwrite the stack slots of dynptr partially.
+
+Consider the following layout:
+spi: [d][d][?]
+ 2 1 0
+
+First slot is at spi 2, second at spi 1.
+Now, do a write of 1 to 8 bytes for spi 1.
+
+This will essentially either write STACK_MISC for all slot_types or
+STACK_MISC and STACK_ZERO (in case of size < BPF_REG_SIZE partial write
+of zeroes). The end result is that slot is scrubbed.
+
+Now, the layout is:
+spi: [d][m][?]
+ 2 1 0
+
+Suppose if user initializes spi = 1 as dynptr.
+We get:
+spi: [d][d][d]
+ 2 1 0
+
+But this time, both spi 2 and spi 1 have first_slot = true.
+
+Now, when passing spi 2 to dynptr helper, it will consider it as
+initialized as it does not check whether second slot has first_slot ==
+false. And spi 1 should already work as normal.
+
+This effectively replaced size + offset of first dynptr, hence allowing
+invalid OOB reads and writes.
+
+Make a few changes to protect against this:
+When writing to PTR_TO_STACK using BPF insns, when we touch spi of a
+STACK_DYNPTR type, mark both first and second slot (regardless of which
+slot we touch) as STACK_INVALID. Reads are already prevented.
+
+Second, prevent writing to stack memory from helpers if the range may
+contain any STACK_DYNPTR slots. Reads are already prevented.
+
+For helpers, we cannot allow it to destroy dynptrs from the writes as
+depending on arguments, helper may take uninit_mem and dynptr both at
+the same time. This would mean that helper may write to uninit_mem
+before it reads the dynptr, which would be bad.
+
+PTR_TO_MEM: [?????dd]
+
+Depending on the code inside the helper, it may end up overwriting the
+dynptr contents first and then read those as the dynptr argument.
+
+Verifier would only simulate destruction when it does byte by byte
+access simulation in check_helper_call for meta.access_size, and
+fail to catch this case, as it happens after argument checks.
+
+The same would need to be done for any other non-trivial objects created
+on the stack in the future, such as bpf_list_head on stack, or
+bpf_rb_root on stack.
+
+A common misunderstanding in the current code is that MEM_UNINIT means
+writes, but note that writes may also be performed even without
+MEM_UNINIT in case of helpers, in that case the code after handling meta
+&& meta->raw_mode will complain when it sees STACK_DYNPTR. So that
+invalid read case also covers writes to potential STACK_DYNPTR slots.
+The only loophole was in case of meta->raw_mode which simulated writes
+through instructions which could overwrite them.
+
+A future series sequenced after this will focus on the clean up of
+helper access checks and bugs around that.
+
+Fixes: 97e03f521050 ("bpf: Add verifier support for dynptrs")
+Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
+Link: https://lore.kernel.org/r/20230121002241.2113993-4-memxor@gmail.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/verifier.c | 88 +++++++++++++++++++
+ .../testing/selftests/bpf/progs/dynptr_fail.c | 6 +-
+ 2 files changed, 91 insertions(+), 3 deletions(-)
+
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index 749e7f7a720f2..68455fd56eea5 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -769,6 +769,8 @@ static void mark_dynptr_cb_reg(struct bpf_reg_state *reg,
+ __mark_dynptr_reg(reg, type, true);
+ }
+
++static int destroy_if_dynptr_stack_slot(struct bpf_verifier_env *env,
++ struct bpf_func_state *state, int spi);
+
+ static int mark_stack_slots_dynptr(struct bpf_verifier_env *env, struct bpf_reg_state *reg,
+ enum bpf_arg_type arg_type, int insn_idx)
+@@ -863,6 +865,55 @@ static int unmark_stack_slots_dynptr(struct bpf_verifier_env *env, struct bpf_re
+ return 0;
+ }
+
++static void __mark_reg_unknown(const struct bpf_verifier_env *env,
++ struct bpf_reg_state *reg);
++
++static int destroy_if_dynptr_stack_slot(struct bpf_verifier_env *env,
++ struct bpf_func_state *state, int spi)
++{
++ int i;
++
++ /* We always ensure that STACK_DYNPTR is never set partially,
++ * hence just checking for slot_type[0] is enough. This is
++ * different for STACK_SPILL, where it may be only set for
++ * 1 byte, so code has to use is_spilled_reg.
++ */
++ if (state->stack[spi].slot_type[0] != STACK_DYNPTR)
++ return 0;
++
++ /* Reposition spi to first slot */
++ if (!state->stack[spi].spilled_ptr.dynptr.first_slot)
++ spi = spi + 1;
++
++ if (dynptr_type_refcounted(state->stack[spi].spilled_ptr.dynptr.type)) {
++ verbose(env, "cannot overwrite referenced dynptr\n");
++ return -EINVAL;
++ }
++
++ mark_stack_slot_scratched(env, spi);
++ mark_stack_slot_scratched(env, spi - 1);
++
++ /* Writing partially to one dynptr stack slot destroys both. */
++ for (i = 0; i < BPF_REG_SIZE; i++) {
++ state->stack[spi].slot_type[i] = STACK_INVALID;
++ state->stack[spi - 1].slot_type[i] = STACK_INVALID;
++ }
++
++ /* TODO: Invalidate any slices associated with this dynptr */
++
++ /* Do not release reference state, we are destroying dynptr on stack,
++ * not using some helper to release it. Just reset register.
++ */
++ __mark_reg_not_init(env, &state->stack[spi].spilled_ptr);
++ __mark_reg_not_init(env, &state->stack[spi - 1].spilled_ptr);
++
++ /* Same reason as unmark_stack_slots_dynptr above */
++ state->stack[spi].spilled_ptr.live |= REG_LIVE_WRITTEN;
++ state->stack[spi - 1].spilled_ptr.live |= REG_LIVE_WRITTEN;
++
++ return 0;
++}
++
+ static bool is_dynptr_reg_valid_uninit(struct bpf_verifier_env *env, struct bpf_reg_state *reg)
+ {
+ struct bpf_func_state *state = func(env, reg);
+@@ -3406,6 +3457,10 @@ static int check_stack_write_fixed_off(struct bpf_verifier_env *env,
+ env->insn_aux_data[insn_idx].sanitize_stack_spill = true;
+ }
+
++ err = destroy_if_dynptr_stack_slot(env, state, spi);
++ if (err)
++ return err;
++
+ mark_stack_slot_scratched(env, spi);
+ if (reg && !(off % BPF_REG_SIZE) && register_is_bounded(reg) &&
+ !register_is_null(reg) && env->bpf_capable) {
+@@ -3519,6 +3574,14 @@ static int check_stack_write_var_off(struct bpf_verifier_env *env,
+ if (err)
+ return err;
+
++ for (i = min_off; i < max_off; i++) {
++ int spi;
++
++ spi = __get_spi(i);
++ err = destroy_if_dynptr_stack_slot(env, state, spi);
++ if (err)
++ return err;
++ }
+
+ /* Variable offset writes destroy any spilled pointers in range. */
+ for (i = min_off; i < max_off; i++) {
+@@ -5546,6 +5609,31 @@ static int check_stack_range_initialized(
+ }
+
+ if (meta && meta->raw_mode) {
++ /* Ensure we won't be overwriting dynptrs when simulating byte
++ * by byte access in check_helper_call using meta.access_size.
++ * This would be a problem if we have a helper in the future
++ * which takes:
++ *
++ * helper(uninit_mem, len, dynptr)
++ *
++ * Now, uninint_mem may overlap with dynptr pointer. Hence, it
++ * may end up writing to dynptr itself when touching memory from
++ * arg 1. This can be relaxed on a case by case basis for known
++ * safe cases, but reject due to the possibilitiy of aliasing by
++ * default.
++ */
++ for (i = min_off; i < max_off + access_size; i++) {
++ int stack_off = -i - 1;
++
++ spi = __get_spi(i);
++ /* raw_mode may write past allocated_stack */
++ if (state->allocated_stack <= stack_off)
++ continue;
++ if (state->stack[spi].slot_type[stack_off % BPF_REG_SIZE] == STACK_DYNPTR) {
++ verbose(env, "potential write to dynptr at off=%d disallowed\n", i);
++ return -EACCES;
++ }
++ }
+ meta->access_size = access_size;
+ meta->regno = regno;
+ return 0;
+diff --git a/tools/testing/selftests/bpf/progs/dynptr_fail.c b/tools/testing/selftests/bpf/progs/dynptr_fail.c
+index 02d57b95cf6ec..9dc3f23a82707 100644
+--- a/tools/testing/selftests/bpf/progs/dynptr_fail.c
++++ b/tools/testing/selftests/bpf/progs/dynptr_fail.c
+@@ -420,7 +420,7 @@ int invalid_write1(void *ctx)
+ * offset
+ */
+ SEC("?raw_tp")
+-__failure __msg("Expected an initialized dynptr as arg #3")
++__failure __msg("cannot overwrite referenced dynptr")
+ int invalid_write2(void *ctx)
+ {
+ struct bpf_dynptr ptr;
+@@ -444,7 +444,7 @@ int invalid_write2(void *ctx)
+ * non-const offset
+ */
+ SEC("?raw_tp")
+-__failure __msg("Expected an initialized dynptr as arg #1")
++__failure __msg("cannot overwrite referenced dynptr")
+ int invalid_write3(void *ctx)
+ {
+ struct bpf_dynptr ptr;
+@@ -476,7 +476,7 @@ static int invalid_write4_callback(__u32 index, void *data)
+ * be invalidated as a dynptr
+ */
+ SEC("?raw_tp")
+-__failure __msg("arg 1 is an unacquired reference")
++__failure __msg("cannot overwrite referenced dynptr")
+ int invalid_write4(void *ctx)
+ {
+ struct bpf_dynptr ptr;
+--
+2.39.2
+
--- /dev/null
+From f2451fdda58585c2f403f5e1d805fe1a716ef096 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 21 Jan 2023 05:52:30 +0530
+Subject: bpf: Fix state pruning for STACK_DYNPTR stack slots
+
+From: Kumar Kartikeya Dwivedi <memxor@gmail.com>
+
+[ Upstream commit d6fefa1105dacc8a742cdcf2f4bfb501c9e61349 ]
+
+The root of the problem is missing liveness marking for STACK_DYNPTR
+slots. This leads to all kinds of problems inside stacksafe.
+
+The verifier by default inside stacksafe ignores spilled_ptr in stack
+slots which do not have REG_LIVE_READ marks. Since this is being checked
+in the 'old' explored state, it must have already done clean_live_states
+for this old bpf_func_state. Hence, it won't be receiving any more
+liveness marks from to be explored insns (it has received REG_LIVE_DONE
+marking from liveness point of view).
+
+What this means is that verifier considers that it's safe to not compare
+the stack slot if was never read by children states. While liveness
+marks are usually propagated correctly following the parentage chain for
+spilled registers (SCALAR_VALUE and PTR_* types), the same is not the
+case for STACK_DYNPTR.
+
+clean_live_states hence simply rewrites these stack slots to the type
+STACK_INVALID since it sees no REG_LIVE_READ marks.
+
+The end result is that we will never see STACK_DYNPTR slots in explored
+state. Even if verifier was conservatively matching !REG_LIVE_READ
+slots, very next check continuing the stacksafe loop on seeing
+STACK_INVALID would again prevent further checks.
+
+Now as long as verifier stores an explored state which we can compare to
+when reaching a pruning point, we can abuse this bug to make verifier
+prune search for obviously unsafe paths using STACK_DYNPTR slots
+thinking they are never used hence safe.
+
+Doing this in unprivileged mode is a bit challenging. add_new_state is
+only set when seeing BPF_F_TEST_STATE_FREQ (which requires privileges)
+or when jmps_processed difference is >= 2 and insn_processed difference
+is >= 8. So coming up with the unprivileged case requires a little more
+work, but it is still totally possible. The test case being discussed
+below triggers the heuristic even in unprivileged mode.
+
+However, it no longer works since commit
+8addbfc7b308 ("bpf: Gate dynptr API behind CAP_BPF").
+
+Let's try to study the test step by step.
+
+Consider the following program (C style BPF ASM):
+
+0 r0 = 0;
+1 r6 = &ringbuf_map;
+3 r1 = r6;
+4 r2 = 8;
+5 r3 = 0;
+6 r4 = r10;
+7 r4 -= -16;
+8 call bpf_ringbuf_reserve_dynptr;
+9 if r0 == 0 goto pc+1;
+10 goto pc+1;
+11 *(r10 - 16) = 0xeB9F;
+12 r1 = r10;
+13 r1 -= -16;
+14 r2 = 0;
+15 call bpf_ringbuf_discard_dynptr;
+16 r0 = 0;
+17 exit;
+
+We know that insn 12 will be a pruning point, hence if we force
+add_new_state for it, it will first verify the following path as
+safe in straight line exploration:
+0 1 3 4 5 6 7 8 9 -> 10 -> (12) 13 14 15 16 17
+
+Then, when we arrive at insn 12 from the following path:
+0 1 3 4 5 6 7 8 9 -> 11 (12)
+
+We will find a state that has been verified as safe already at insn 12.
+Since register state is same at this point, regsafe will pass. Next, in
+stacksafe, for spi = 0 and spi = 1 (location of our dynptr) is skipped
+seeing !REG_LIVE_READ. The rest matches, so stacksafe returns true.
+Next, refsafe is also true as reference state is unchanged in both
+states.
+
+The states are considered equivalent and search is pruned.
+
+Hence, we are able to construct a dynptr with arbitrary contents and use
+the dynptr API to operate on this arbitrary pointer and arbitrary size +
+offset.
+
+To fix this, first define a mark_dynptr_read function that propagates
+liveness marks whenever a valid initialized dynptr is accessed by dynptr
+helpers. REG_LIVE_WRITTEN is marked whenever we initialize an
+uninitialized dynptr. This is done in mark_stack_slots_dynptr. It allows
+screening off mark_reg_read and not propagating marks upwards from that
+point.
+
+This ensures that we either set REG_LIVE_READ64 on both dynptr slots, or
+none, so clean_live_states either sets both slots to STACK_INVALID or
+none of them. This is the invariant the checks inside stacksafe rely on.
+
+Next, do a complete comparison of both stack slots whenever they have
+STACK_DYNPTR. Compare the dynptr type stored in the spilled_ptr, and
+also whether both form the same first_slot. Only then is the later path
+safe.
+
+Fixes: 97e03f521050 ("bpf: Add verifier support for dynptrs")
+Acked-by: Eduard Zingerman <eddyz87@gmail.com>
+Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
+Link: https://lore.kernel.org/r/20230121002241.2113993-2-memxor@gmail.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/verifier.c | 88 +++++++++++++++++++++++++++++++++++++++++--
+ 1 file changed, 84 insertions(+), 4 deletions(-)
+
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index 7ee2188272597..c42cb70150e96 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -781,6 +781,9 @@ static int mark_stack_slots_dynptr(struct bpf_verifier_env *env, struct bpf_reg_
+ state->stack[spi - 1].spilled_ptr.ref_obj_id = id;
+ }
+
++ state->stack[spi].spilled_ptr.live |= REG_LIVE_WRITTEN;
++ state->stack[spi - 1].spilled_ptr.live |= REG_LIVE_WRITTEN;
++
+ return 0;
+ }
+
+@@ -805,6 +808,31 @@ static int unmark_stack_slots_dynptr(struct bpf_verifier_env *env, struct bpf_re
+
+ __mark_reg_not_init(env, &state->stack[spi].spilled_ptr);
+ __mark_reg_not_init(env, &state->stack[spi - 1].spilled_ptr);
++
++ /* Why do we need to set REG_LIVE_WRITTEN for STACK_INVALID slot?
++ *
++ * While we don't allow reading STACK_INVALID, it is still possible to
++ * do <8 byte writes marking some but not all slots as STACK_MISC. Then,
++ * helpers or insns can do partial read of that part without failing,
++ * but check_stack_range_initialized, check_stack_read_var_off, and
++ * check_stack_read_fixed_off will do mark_reg_read for all 8-bytes of
++ * the slot conservatively. Hence we need to prevent those liveness
++ * marking walks.
++ *
++ * This was not a problem before because STACK_INVALID is only set by
++ * default (where the default reg state has its reg->parent as NULL), or
++ * in clean_live_states after REG_LIVE_DONE (at which point
++ * mark_reg_read won't walk reg->parent chain), but not randomly during
++ * verifier state exploration (like we did above). Hence, for our case
++ * parentage chain will still be live (i.e. reg->parent may be
++ * non-NULL), while earlier reg->parent was NULL, so we need
++ * REG_LIVE_WRITTEN to screen off read marker propagation when it is
++ * done later on reads or by mark_dynptr_read as well to unnecessary
++ * mark registers in verifier state.
++ */
++ state->stack[spi].spilled_ptr.live |= REG_LIVE_WRITTEN;
++ state->stack[spi - 1].spilled_ptr.live |= REG_LIVE_WRITTEN;
++
+ return 0;
+ }
+
+@@ -2386,6 +2414,30 @@ static int mark_reg_read(struct bpf_verifier_env *env,
+ return 0;
+ }
+
++static int mark_dynptr_read(struct bpf_verifier_env *env, struct bpf_reg_state *reg)
++{
++ struct bpf_func_state *state = func(env, reg);
++ int spi, ret;
++
++ /* For CONST_PTR_TO_DYNPTR, it must have already been done by
++ * check_reg_arg in check_helper_call and mark_btf_func_reg_size in
++ * check_kfunc_call.
++ */
++ if (reg->type == CONST_PTR_TO_DYNPTR)
++ return 0;
++ spi = get_spi(reg->off);
++ /* Caller ensures dynptr is valid and initialized, which means spi is in
++ * bounds and spi is the first dynptr slot. Simply mark stack slot as
++ * read.
++ */
++ ret = mark_reg_read(env, &state->stack[spi].spilled_ptr,
++ state->stack[spi].spilled_ptr.parent, REG_LIVE_READ64);
++ if (ret)
++ return ret;
++ return mark_reg_read(env, &state->stack[spi - 1].spilled_ptr,
++ state->stack[spi - 1].spilled_ptr.parent, REG_LIVE_READ64);
++}
++
+ /* This function is supposed to be used by the following 32-bit optimization
+ * code only. It returns TRUE if the source or destination register operates
+ * on 64-bit, otherwise return FALSE.
+@@ -5992,6 +6044,8 @@ int process_dynptr_func(struct bpf_verifier_env *env, int regno,
+
+ meta->uninit_dynptr_regno = regno;
+ } else /* MEM_RDONLY and None case from above */ {
++ int err;
++
+ /* For the reg->type == PTR_TO_STACK case, bpf_dynptr is never const */
+ if (reg->type == CONST_PTR_TO_DYNPTR && !(arg_type & MEM_RDONLY)) {
+ verbose(env, "cannot pass pointer to const bpf_dynptr, the helper mutates it\n");
+@@ -6025,6 +6079,10 @@ int process_dynptr_func(struct bpf_verifier_env *env, int regno,
+ err_extra, regno);
+ return -EINVAL;
+ }
++
++ err = mark_dynptr_read(env, reg);
++ if (err)
++ return err;
+ }
+ return 0;
+ }
+@@ -13231,10 +13289,9 @@ static bool stacksafe(struct bpf_verifier_env *env, struct bpf_func_state *old,
+ return false;
+ if (i % BPF_REG_SIZE != BPF_REG_SIZE - 1)
+ continue;
+- if (!is_spilled_reg(&old->stack[spi]))
+- continue;
+- if (!regsafe(env, &old->stack[spi].spilled_ptr,
+- &cur->stack[spi].spilled_ptr, idmap))
++ /* Both old and cur are having same slot_type */
++ switch (old->stack[spi].slot_type[BPF_REG_SIZE - 1]) {
++ case STACK_SPILL:
+ /* when explored and current stack slot are both storing
+ * spilled registers, check that stored pointers types
+ * are the same as well.
+@@ -13245,7 +13302,30 @@ static bool stacksafe(struct bpf_verifier_env *env, struct bpf_func_state *old,
+ * such verifier states are not equivalent.
+ * return false to continue verification of this path
+ */
++ if (!regsafe(env, &old->stack[spi].spilled_ptr,
++ &cur->stack[spi].spilled_ptr, idmap))
++ return false;
++ break;
++ case STACK_DYNPTR:
++ {
++ const struct bpf_reg_state *old_reg, *cur_reg;
++
++ old_reg = &old->stack[spi].spilled_ptr;
++ cur_reg = &cur->stack[spi].spilled_ptr;
++ if (old_reg->dynptr.type != cur_reg->dynptr.type ||
++ old_reg->dynptr.first_slot != cur_reg->dynptr.first_slot ||
++ !check_ids(old_reg->ref_obj_id, cur_reg->ref_obj_id, idmap))
++ return false;
++ break;
++ }
++ case STACK_MISC:
++ case STACK_ZERO:
++ case STACK_INVALID:
++ continue;
++ /* Ensure that new unhandled slot types return false by default */
++ default:
+ return false;
++ }
+ }
+ return true;
+ }
+--
+2.39.2
+
--- /dev/null
+From 23fa5f7877337506fad1db8daeaa3e4fe9b1d0fd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Feb 2023 16:21:31 +0800
+Subject: bpf: Zeroing allocated object from slab in bpf memory allocator
+
+From: Hou Tao <houtao1@huawei.com>
+
+[ Upstream commit 997849c4b969034e225153f41026657def66d286 ]
+
+Currently the freed element in bpf memory allocator may be immediately
+reused, for htab map the reuse will reinitialize special fields in map
+value (e.g., bpf_spin_lock), but lookup procedure may still access
+these special fields, and it may lead to hard-lockup as shown below:
+
+ NMI backtrace for cpu 16
+ CPU: 16 PID: 2574 Comm: htab.bin Tainted: G L 6.1.0+ #1
+ Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
+ RIP: 0010:queued_spin_lock_slowpath+0x283/0x2c0
+ ......
+ Call Trace:
+ <TASK>
+ copy_map_value_locked+0xb7/0x170
+ bpf_map_copy_value+0x113/0x3c0
+ __sys_bpf+0x1c67/0x2780
+ __x64_sys_bpf+0x1c/0x20
+ do_syscall_64+0x30/0x60
+ entry_SYSCALL_64_after_hwframe+0x46/0xb0
+ ......
+ </TASK>
+
+For htab map, just like the preallocated case, these is no need to
+initialize these special fields in map value again once these fields
+have been initialized. For preallocated htab map, these fields are
+initialized through __GFP_ZERO in bpf_map_area_alloc(), so do the
+similar thing for non-preallocated htab in bpf memory allocator. And
+there is no need to use __GFP_ZERO for per-cpu bpf memory allocator,
+because __alloc_percpu_gfp() does it implicitly.
+
+Fixes: 0fd7c5d43339 ("bpf: Optimize call_rcu in non-preallocated hash map.")
+Signed-off-by: Hou Tao <houtao1@huawei.com>
+Link: https://lore.kernel.org/r/20230215082132.3856544-2-houtao@huaweicloud.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/bpf.h | 7 +++++++
+ kernel/bpf/hashtab.c | 4 ++--
+ kernel/bpf/memalloc.c | 2 +-
+ 3 files changed, 10 insertions(+), 3 deletions(-)
+
+diff --git a/include/linux/bpf.h b/include/linux/bpf.h
+index 634d37a599fa7..cf0d88109e3f9 100644
+--- a/include/linux/bpf.h
++++ b/include/linux/bpf.h
+@@ -346,6 +346,13 @@ static inline void bpf_obj_init(const struct btf_field_offs *foffs, void *obj)
+ memset(obj + foffs->field_off[i], 0, foffs->field_sz[i]);
+ }
+
++/* 'dst' must be a temporary buffer and should not point to memory that is being
++ * used in parallel by a bpf program or bpf syscall, otherwise the access from
++ * the bpf program or bpf syscall may be corrupted by the reinitialization,
++ * leading to weird problems. Even 'dst' is newly-allocated from bpf memory
++ * allocator, it is still possible for 'dst' to be used in parallel by a bpf
++ * program or bpf syscall.
++ */
+ static inline void check_and_init_map_value(struct bpf_map *map, void *dst)
+ {
+ bpf_obj_init(map->field_offs, dst);
+diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c
+index 66bded1443773..5dfcb5ad0d068 100644
+--- a/kernel/bpf/hashtab.c
++++ b/kernel/bpf/hashtab.c
+@@ -1004,8 +1004,6 @@ static struct htab_elem *alloc_htab_elem(struct bpf_htab *htab, void *key,
+ l_new = ERR_PTR(-ENOMEM);
+ goto dec_count;
+ }
+- check_and_init_map_value(&htab->map,
+- l_new->key + round_up(key_size, 8));
+ }
+
+ memcpy(l_new->key, key, key_size);
+@@ -1592,6 +1590,7 @@ static int __htab_map_lookup_and_delete_elem(struct bpf_map *map, void *key,
+ else
+ copy_map_value(map, value, l->key +
+ roundup_key_size);
++ /* Zeroing special fields in the temp buffer */
+ check_and_init_map_value(map, value);
+ }
+
+@@ -1792,6 +1791,7 @@ __htab_map_lookup_and_delete_batch(struct bpf_map *map,
+ true);
+ else
+ copy_map_value(map, dst_val, value);
++ /* Zeroing special fields in the temp buffer */
+ check_and_init_map_value(map, dst_val);
+ }
+ if (do_delete) {
+diff --git a/kernel/bpf/memalloc.c b/kernel/bpf/memalloc.c
+index 1db156405b68b..7b784823a52ef 100644
+--- a/kernel/bpf/memalloc.c
++++ b/kernel/bpf/memalloc.c
+@@ -143,7 +143,7 @@ static void *__alloc(struct bpf_mem_cache *c, int node)
+ return obj;
+ }
+
+- return kmalloc_node(c->unit_size, flags, node);
++ return kmalloc_node(c->unit_size, flags | __GFP_ZERO, node);
+ }
+
+ static struct mem_cgroup *get_memcg(const struct bpf_mem_cache *c)
+--
+2.39.2
+
--- /dev/null
+From 1b50f1ea36c7d01975741afd3ae1446cf774cb73 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Jan 2023 12:34:42 +0100
+Subject: bpf_doc: Fix build error with older python versions
+
+From: Michal Suchanek <msuchanek@suse.de>
+
+[ Upstream commit 5fbea42387eba1c7517fcad79099df706def7054 ]
+
+The ability to subscript match result as an array is only available
+since python 3.6. Existing code in bpf_doc uses the older group()
+interface but commit 8a76145a2ec2 adds code using the new interface.
+
+Use the old interface consistently to avoid build error on older
+distributions like the below:
+
++ make -j48 -s -C /dev/shm/kbuild/linux.33946/current ARCH=powerpc HOSTCC=gcc CROSS_COMPILE=powerpc64-suse-linux- clean
+TypeError: '_sre.SRE_Match' object is not subscriptable
+
+Fixes: 8a76145a2ec2 ("bpf: explicitly define BPF_FUNC_xxx integer values")
+Signed-off-by: Michal Suchanek <msuchanek@suse.de>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Acked-by: Quentin Monnet <quentin@isovalent.com>
+Link: https://lore.kernel.org/bpf/20230109113442.20946-1-msuchanek@suse.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/bpf_doc.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/scripts/bpf_doc.py b/scripts/bpf_doc.py
+index e8d90829f23ed..38d51e05c7a2b 100755
+--- a/scripts/bpf_doc.py
++++ b/scripts/bpf_doc.py
+@@ -271,7 +271,7 @@ class HeaderParser(object):
+ if capture:
+ fn_defines_str += self.line
+ helper_name = capture.expand(r'bpf_\1')
+- self.helper_enum_vals[helper_name] = int(capture[2])
++ self.helper_enum_vals[helper_name] = int(capture.group(2))
+ self.helper_enum_pos[helper_name] = i
+ i += 1
+ else:
+--
+2.39.2
+
--- /dev/null
+From 9759dd22d272608ffd7901ce064fd05f3a33efb5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Jan 2023 16:40:23 +0100
+Subject: bpftool: Always disable stack protection for BPF objects
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Holger Hoffstätte <holger@applied-asynchrony.com>
+
+[ Upstream commit 878625e1c7a10dfbb1fdaaaae2c4d2a58fbce627 ]
+
+When the clang toolchain has stack protection enabled in order to be
+consistent with gcc - which just happens to be the case on Gentoo -
+the bpftool build fails:
+
+ [...]
+ clang \
+ -I. \
+ -I/tmp/portage/dev-util/bpftool-6.0.12/work/linux-6.0/tools/include/uapi/ \
+ -I/tmp/portage/dev-util/bpftool-6.0.12/work/linux-6.0/tools/bpf/bpftool/bootstrap/libbpf/include \
+ -g -O2 -Wall -target bpf -c skeleton/pid_iter.bpf.c -o pid_iter.bpf.o
+ clang \
+ -I. \
+ -I/tmp/portage/dev-util/bpftool-6.0.12/work/linux-6.0/tools/include/uapi/ \
+ -I/tmp/portage/dev-util/bpftool-6.0.12/work/linux-6.0/tools/bpf/bpftool/bootstrap/libbpf/include \
+ -g -O2 -Wall -target bpf -c skeleton/profiler.bpf.c -o profiler.bpf.o
+ skeleton/profiler.bpf.c:40:14: error: A call to built-in function '__stack_chk_fail' is not supported.
+ int BPF_PROG(fentry_XXX)
+ ^
+ skeleton/profiler.bpf.c:94:14: error: A call to built-in function '__stack_chk_fail' is not supported.
+ int BPF_PROG(fexit_XXX)
+ ^
+ 2 errors generated.
+ [...]
+
+Since stack-protector makes no sense for the BPF bits just unconditionally
+disable it.
+
+Bug: https://bugs.gentoo.org/890638
+Signed-off-by: Holger Hoffstätte <holger@applied-asynchrony.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Quentin Monnet <quentin@isovalent.com>
+Link: https://lore.kernel.org/bpf/74cd9d2e-6052-312a-241e-2b514a75c92c@applied-asynchrony.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/bpf/bpftool/Makefile | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/tools/bpf/bpftool/Makefile b/tools/bpf/bpftool/Makefile
+index f610e184ce02a..270066aff8bf1 100644
+--- a/tools/bpf/bpftool/Makefile
++++ b/tools/bpf/bpftool/Makefile
+@@ -215,7 +215,8 @@ $(OUTPUT)%.bpf.o: skeleton/%.bpf.c $(OUTPUT)vmlinux.h $(LIBBPF_BOOTSTRAP)
+ -I$(or $(OUTPUT),.) \
+ -I$(srctree)/tools/include/uapi/ \
+ -I$(LIBBPF_BOOTSTRAP_INCLUDE) \
+- -g -O2 -Wall -target bpf -c $< -o $@
++ -g -O2 -Wall -fno-stack-protector \
++ -target bpf -c $< -o $@
+ $(Q)$(LLVM_STRIP) -g $@
+
+ $(OUTPUT)%.skel.h: $(OUTPUT)%.bpf.o $(BPFTOOL_BOOTSTRAP)
+--
+2.39.2
+
--- /dev/null
+From cc11088458b0596b4aa238826203c9467f9e1fb2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Feb 2023 21:17:01 +0800
+Subject: bpftool: profile online CPUs instead of possible
+
+From: Tonghao Zhang <tong@infragraf.org>
+
+[ Upstream commit 377c16fa3f3c60d21e4b05314c8be034ce37f2eb ]
+
+The number of online cpu may be not equal to possible cpu.
+"bpftool prog profile" can not create pmu event on possible
+but on online cpu.
+
+$ dmidecode -s system-product-name
+PowerEdge R620
+$ cat /sys/devices/system/cpu/possible
+0-47
+$ cat /sys/devices/system/cpu/online
+0-31
+
+Disable cpu dynamically:
+$ echo 0 > /sys/devices/system/cpu/cpuX/online
+
+If one cpu is offline, perf_event_open will return ENODEV.
+To fix this issue:
+* check value returned and skip offline cpu.
+* close pmu_fd immediately on error path, avoid fd leaking.
+
+Fixes: 47c09d6a9f67 ("bpftool: Introduce "prog profile" command")
+Signed-off-by: Tonghao Zhang <tong@infragraf.org>
+Cc: Quentin Monnet <quentin@isovalent.com>
+Cc: Alexei Starovoitov <ast@kernel.org>
+Cc: Daniel Borkmann <daniel@iogearbox.net>
+Cc: Andrii Nakryiko <andrii@kernel.org>
+Cc: Martin KaFai Lau <martin.lau@linux.dev>
+Cc: Song Liu <song@kernel.org>
+Cc: Yonghong Song <yhs@fb.com>
+Cc: John Fastabend <john.fastabend@gmail.com>
+Cc: KP Singh <kpsingh@kernel.org>
+Cc: Stanislav Fomichev <sdf@google.com>
+Cc: Hao Luo <haoluo@google.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Acked-by: John Fastabend <john.fastabend@gmail.com>
+Link: https://lore.kernel.org/r/20230202131701.29519-1-tong@infragraf.org
+Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/bpf/bpftool/prog.c | 38 ++++++++++++++++++++++++++++++--------
+ 1 file changed, 30 insertions(+), 8 deletions(-)
+
+diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c
+index cfc9fdc1e8634..e87738dbffc10 100644
+--- a/tools/bpf/bpftool/prog.c
++++ b/tools/bpf/bpftool/prog.c
+@@ -2233,10 +2233,38 @@ static void profile_close_perf_events(struct profiler_bpf *obj)
+ profile_perf_event_cnt = 0;
+ }
+
++static int profile_open_perf_event(int mid, int cpu, int map_fd)
++{
++ int pmu_fd;
++
++ pmu_fd = syscall(__NR_perf_event_open, &metrics[mid].attr,
++ -1 /*pid*/, cpu, -1 /*group_fd*/, 0);
++ if (pmu_fd < 0) {
++ if (errno == ENODEV) {
++ p_info("cpu %d may be offline, skip %s profiling.",
++ cpu, metrics[mid].name);
++ profile_perf_event_cnt++;
++ return 0;
++ }
++ return -1;
++ }
++
++ if (bpf_map_update_elem(map_fd,
++ &profile_perf_event_cnt,
++ &pmu_fd, BPF_ANY) ||
++ ioctl(pmu_fd, PERF_EVENT_IOC_ENABLE, 0)) {
++ close(pmu_fd);
++ return -1;
++ }
++
++ profile_perf_events[profile_perf_event_cnt++] = pmu_fd;
++ return 0;
++}
++
+ static int profile_open_perf_events(struct profiler_bpf *obj)
+ {
+ unsigned int cpu, m;
+- int map_fd, pmu_fd;
++ int map_fd;
+
+ profile_perf_events = calloc(
+ sizeof(int), obj->rodata->num_cpu * obj->rodata->num_metric);
+@@ -2255,17 +2283,11 @@ static int profile_open_perf_events(struct profiler_bpf *obj)
+ if (!metrics[m].selected)
+ continue;
+ for (cpu = 0; cpu < obj->rodata->num_cpu; cpu++) {
+- pmu_fd = syscall(__NR_perf_event_open, &metrics[m].attr,
+- -1/*pid*/, cpu, -1/*group_fd*/, 0);
+- if (pmu_fd < 0 ||
+- bpf_map_update_elem(map_fd, &profile_perf_event_cnt,
+- &pmu_fd, BPF_ANY) ||
+- ioctl(pmu_fd, PERF_EVENT_IOC_ENABLE, 0)) {
++ if (profile_open_perf_event(m, cpu, map_fd)) {
+ p_err("failed to create event %s on cpu %d",
+ metrics[m].name, cpu);
+ return -1;
+ }
+- profile_perf_events[profile_perf_event_cnt++] = pmu_fd;
+ }
+ }
+ return 0;
+--
+2.39.2
+
--- /dev/null
+From ff93fea8c421fd637b8e49393d37d11a137626b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 17 Dec 2022 10:34:29 +0800
+Subject: btrfs: scrub: improve tree block error reporting
+
+From: Qu Wenruo <wqu@suse.com>
+
+[ Upstream commit 28232909ba43561887508a6ef46d7f33a648f375 ]
+
+[BUG]
+When debugging a scrub related metadata error, it turns out that our
+metadata error reporting is not ideal.
+
+The only 3 error messages are:
+
+- BTRFS error (device dm-2): bdev /dev/mapper/test-scratch1 errs: wr 0, rd 0, flush 0, corrupt 0, gen 1
+ Showing we have metadata generation mismatch errors.
+
+- BTRFS error (device dm-2): unable to fixup (regular) error at logical 7110656 on dev /dev/mapper/test-scratch1
+ Showing which tree blocks are corrupted.
+
+- BTRFS warning (device dm-2): checksum/header error at logical 24772608 on dev /dev/mapper/test-scratch2, physical 3801088: metadata node (level 1) in tree 5
+ Showing which physical range the corrupted metadata is at.
+
+We have to combine the above 3 to know we have a corrupted metadata with
+generation mismatch.
+
+And this is already the better case, if we have other problems, like
+fsid mismatch, we can not even know the cause.
+
+[CAUSE]
+The problem is caused by the fact that, scrub_checksum_tree_block()
+never outputs any error message.
+
+It just return two bits for scrub: sblock->header_error, and
+sblock->generation_error.
+
+And later we report error in scrub_print_warning(), but unfortunately we
+only have two bits, there is not really much thing we can done to print
+any detailed errors.
+
+[FIX]
+This patch will do the following to enhance the error reporting of
+metadata scrub:
+
+- Add extra warning (ratelimited) for every error we hit
+ This can help us to distinguish the different types of errors.
+ Some errors can help us to know what's going wrong immediately,
+ like bytenr mismatch.
+
+- Re-order the checks
+ Currently we check bytenr first, then immediately generation.
+ This can lead to false generation mismatch reports, while the fsid
+ mismatches.
+
+Here is the new output for the bug I'm debugging (we forgot to
+writeback tree blocks for commit roots):
+
+ BTRFS warning (device dm-2): tree block 24117248 mirror 1 has bad fsid, has b77cd862-f150-4c71-90ec-7baf0544d83f want 17df6abf-23cd-445f-b350-5b3e40bfd2fc
+ BTRFS warning (device dm-2): tree block 24117248 mirror 0 has bad fsid, has b77cd862-f150-4c71-90ec-7baf0544d83f want 17df6abf-23cd-445f-b350-5b3e40bfd2fc
+
+Now we can immediately know it's some tree blocks didn't even get written
+back, other than the original confusing generation mismatch.
+
+Signed-off-by: Qu Wenruo <wqu@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/scrub.c | 49 +++++++++++++++++++++++++++++++++++++++---------
+ 1 file changed, 40 insertions(+), 9 deletions(-)
+
+diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c
+index 52b346795f660..a5d026041be45 100644
+--- a/fs/btrfs/scrub.c
++++ b/fs/btrfs/scrub.c
+@@ -2053,20 +2053,33 @@ static int scrub_checksum_tree_block(struct scrub_block *sblock)
+ * a) don't have an extent buffer and
+ * b) the page is already kmapped
+ */
+- if (sblock->logical != btrfs_stack_header_bytenr(h))
++ if (sblock->logical != btrfs_stack_header_bytenr(h)) {
+ sblock->header_error = 1;
+-
+- if (sector->generation != btrfs_stack_header_generation(h)) {
+- sblock->header_error = 1;
+- sblock->generation_error = 1;
++ btrfs_warn_rl(fs_info,
++ "tree block %llu mirror %u has bad bytenr, has %llu want %llu",
++ sblock->logical, sblock->mirror_num,
++ btrfs_stack_header_bytenr(h),
++ sblock->logical);
++ goto out;
+ }
+
+- if (!scrub_check_fsid(h->fsid, sector))
++ if (!scrub_check_fsid(h->fsid, sector)) {
+ sblock->header_error = 1;
++ btrfs_warn_rl(fs_info,
++ "tree block %llu mirror %u has bad fsid, has %pU want %pU",
++ sblock->logical, sblock->mirror_num,
++ h->fsid, sblock->dev->fs_devices->fsid);
++ goto out;
++ }
+
+- if (memcmp(h->chunk_tree_uuid, fs_info->chunk_tree_uuid,
+- BTRFS_UUID_SIZE))
++ if (memcmp(h->chunk_tree_uuid, fs_info->chunk_tree_uuid, BTRFS_UUID_SIZE)) {
+ sblock->header_error = 1;
++ btrfs_warn_rl(fs_info,
++ "tree block %llu mirror %u has bad chunk tree uuid, has %pU want %pU",
++ sblock->logical, sblock->mirror_num,
++ h->chunk_tree_uuid, fs_info->chunk_tree_uuid);
++ goto out;
++ }
+
+ shash->tfm = fs_info->csum_shash;
+ crypto_shash_init(shash);
+@@ -2079,9 +2092,27 @@ static int scrub_checksum_tree_block(struct scrub_block *sblock)
+ }
+
+ crypto_shash_final(shash, calculated_csum);
+- if (memcmp(calculated_csum, on_disk_csum, sctx->fs_info->csum_size))
++ if (memcmp(calculated_csum, on_disk_csum, sctx->fs_info->csum_size)) {
+ sblock->checksum_error = 1;
++ btrfs_warn_rl(fs_info,
++ "tree block %llu mirror %u has bad csum, has " CSUM_FMT " want " CSUM_FMT,
++ sblock->logical, sblock->mirror_num,
++ CSUM_FMT_VALUE(fs_info->csum_size, on_disk_csum),
++ CSUM_FMT_VALUE(fs_info->csum_size, calculated_csum));
++ goto out;
++ }
++
++ if (sector->generation != btrfs_stack_header_generation(h)) {
++ sblock->header_error = 1;
++ sblock->generation_error = 1;
++ btrfs_warn_rl(fs_info,
++ "tree block %llu mirror %u has bad generation, has %llu want %llu",
++ sblock->logical, sblock->mirror_num,
++ btrfs_stack_header_generation(h),
++ sector->generation);
++ }
+
++out:
+ return sblock->header_error || sblock->checksum_error;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 8d19d796550094e95cdb1aeb5883c4cd7b171752 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 May 2021 01:01:37 +0200
+Subject: builddeb: clean generated package content
+
+From: Bastian Germann <bage@linutronix.de>
+
+[ Upstream commit c9f9cf2560e40b62015c6c4a04be60f55ce5240e ]
+
+For each binary Debian package, a directory with the package name is
+created in the debian directory. Correct the generated file matches in the
+package's clean target, which were renamed without adjusting the target.
+
+Fixes: 1694e94e4f46 ("builddeb: match temporary directory name to the package name")
+Signed-off-by: Bastian Germann <bage@linutronix.de>
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/package/mkdebian | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/scripts/package/mkdebian b/scripts/package/mkdebian
+index 6cf383225b8b5..c3bbef7a6754f 100755
+--- a/scripts/package/mkdebian
++++ b/scripts/package/mkdebian
+@@ -236,7 +236,7 @@ binary-arch: build-arch
+ KBUILD_BUILD_VERSION=${revision} -f \$(srctree)/Makefile intdeb-pkg
+
+ clean:
+- rm -rf debian/*tmp debian/files
++ rm -rf debian/files debian/linux-*
+ \$(MAKE) clean
+
+ binary: binary-arch
+--
+2.39.2
+
--- /dev/null
+From 5c827af1d2544f1249211dd1a3f78f66976f693a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Feb 2023 20:04:49 +0100
+Subject: can: esd_usb: Make use of can_change_state() and relocate checking
+ skb for NULL
+
+From: Frank Jungclaus <frank.jungclaus@esd.eu>
+
+[ Upstream commit 9684b000a86299b5968fef8ffbf1484def37452a ]
+
+Start a rework initiated by Vincents remarks "You should not report
+the greatest of txerr and rxerr but the one which actually increased."
+[1] and "As far as I understand, those flags should be set only when
+the threshold is reached" [2] .
+
+Therefore make use of can_change_state() to (among others) set the
+flags CAN_ERR_CRTL_[RT]X_WARNING and CAN_ERR_CRTL_[RT]X_PASSIVE,
+maintain CAN statistic counters for error_warning, error_passive and
+bus_off.
+
+Relocate testing alloc_can_err_skb() for NULL to the end of
+esd_usb_rx_event(), to have things like can_bus_off(),
+can_change_state() working even in out of memory conditions.
+
+Fixes: 96d8e90382dc ("can: Add driver for esd CAN-USB/2 device")
+Signed-off-by: Frank Jungclaus <frank.jungclaus@esd.eu>
+Link: [1] https://lore.kernel.org/all/CAMZ6RqKGBWe15aMkf8-QLf-cOQg99GQBebSm+1wEzTqHgvmNuw@mail.gmail.com/
+Link: [2] https://lore.kernel.org/all/CAMZ6Rq+QBO1yTX_o6GV0yhdBj-RzZSRGWDZBS0fs7zbSTy4hmA@mail.gmail.com/
+Link: https://lore.kernel.org/all/20230216190450.3901254-3-frank.jungclaus@esd.eu
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/usb/esd_usb.c | 50 +++++++++++++++++------------------
+ 1 file changed, 25 insertions(+), 25 deletions(-)
+
+diff --git a/drivers/net/can/usb/esd_usb.c b/drivers/net/can/usb/esd_usb.c
+index 5e182fadd875e..578b25f873e58 100644
+--- a/drivers/net/can/usb/esd_usb.c
++++ b/drivers/net/can/usb/esd_usb.c
+@@ -239,41 +239,42 @@ static void esd_usb_rx_event(struct esd_usb_net_priv *priv,
+ msg->msg.rx.dlc, state, ecc, rxerr, txerr);
+
+ skb = alloc_can_err_skb(priv->netdev, &cf);
+- if (skb == NULL) {
+- stats->rx_dropped++;
+- return;
+- }
+
+ if (state != priv->old_state) {
++ enum can_state tx_state, rx_state;
++ enum can_state new_state = CAN_STATE_ERROR_ACTIVE;
++
+ priv->old_state = state;
+
+ switch (state & ESD_BUSSTATE_MASK) {
+ case ESD_BUSSTATE_BUSOFF:
+- priv->can.state = CAN_STATE_BUS_OFF;
+- cf->can_id |= CAN_ERR_BUSOFF;
+- priv->can.can_stats.bus_off++;
++ new_state = CAN_STATE_BUS_OFF;
+ can_bus_off(priv->netdev);
+ break;
+ case ESD_BUSSTATE_WARN:
+- priv->can.state = CAN_STATE_ERROR_WARNING;
+- priv->can.can_stats.error_warning++;
++ new_state = CAN_STATE_ERROR_WARNING;
+ break;
+ case ESD_BUSSTATE_ERRPASSIVE:
+- priv->can.state = CAN_STATE_ERROR_PASSIVE;
+- priv->can.can_stats.error_passive++;
++ new_state = CAN_STATE_ERROR_PASSIVE;
+ break;
+ default:
+- priv->can.state = CAN_STATE_ERROR_ACTIVE;
++ new_state = CAN_STATE_ERROR_ACTIVE;
+ txerr = 0;
+ rxerr = 0;
+ break;
+ }
+- } else {
++
++ if (new_state != priv->can.state) {
++ tx_state = (txerr >= rxerr) ? new_state : 0;
++ rx_state = (txerr <= rxerr) ? new_state : 0;
++ can_change_state(priv->netdev, cf,
++ tx_state, rx_state);
++ }
++ } else if (skb) {
+ priv->can.can_stats.bus_error++;
+ stats->rx_errors++;
+
+- cf->can_id |= CAN_ERR_PROT | CAN_ERR_BUSERROR |
+- CAN_ERR_CNT;
++ cf->can_id |= CAN_ERR_PROT | CAN_ERR_BUSERROR;
+
+ switch (ecc & SJA1000_ECC_MASK) {
+ case SJA1000_ECC_BIT:
+@@ -295,21 +296,20 @@ static void esd_usb_rx_event(struct esd_usb_net_priv *priv,
+
+ /* Bit stream position in CAN frame as the error was detected */
+ cf->data[3] = ecc & SJA1000_ECC_SEG;
+-
+- if (priv->can.state == CAN_STATE_ERROR_WARNING ||
+- priv->can.state == CAN_STATE_ERROR_PASSIVE) {
+- cf->data[1] = (txerr > rxerr) ?
+- CAN_ERR_CRTL_TX_PASSIVE :
+- CAN_ERR_CRTL_RX_PASSIVE;
+- }
+- cf->data[6] = txerr;
+- cf->data[7] = rxerr;
+ }
+
+ priv->bec.txerr = txerr;
+ priv->bec.rxerr = rxerr;
+
+- netif_rx(skb);
++ if (skb) {
++ cf->can_id |= CAN_ERR_CNT;
++ cf->data[6] = txerr;
++ cf->data[7] = rxerr;
++
++ netif_rx(skb);
++ } else {
++ stats->rx_dropped++;
++ }
+ }
+ }
+
+--
+2.39.2
+
--- /dev/null
+From b72178545b521d5703a151510d1d6b8be857fd2e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Feb 2023 20:04:48 +0100
+Subject: can: esd_usb: Move mislocated storage of SJA1000_ECC_SEG bits in case
+ of a bus error
+
+From: Frank Jungclaus <frank.jungclaus@esd.eu>
+
+[ Upstream commit 118469f88180438ef43dee93d71f77c00e7b425d ]
+
+Move the supply for cf->data[3] (bit stream position of CAN error), in
+case of a bus- or protocol-error, outside of the "switch (ecc &
+SJA1000_ECC_MASK){}"-statement, because this bit stream position is
+independent of the error type.
+
+Fixes: 96d8e90382dc ("can: Add driver for esd CAN-USB/2 device")
+Signed-off-by: Frank Jungclaus <frank.jungclaus@esd.eu>
+Link: https://lore.kernel.org/all/20230216190450.3901254-2-frank.jungclaus@esd.eu
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/usb/esd_usb.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/can/usb/esd_usb.c b/drivers/net/can/usb/esd_usb.c
+index 42323f5e6f3a0..5e182fadd875e 100644
+--- a/drivers/net/can/usb/esd_usb.c
++++ b/drivers/net/can/usb/esd_usb.c
+@@ -286,7 +286,6 @@ static void esd_usb_rx_event(struct esd_usb_net_priv *priv,
+ cf->data[2] |= CAN_ERR_PROT_STUFF;
+ break;
+ default:
+- cf->data[3] = ecc & SJA1000_ECC_SEG;
+ break;
+ }
+
+@@ -294,6 +293,9 @@ static void esd_usb_rx_event(struct esd_usb_net_priv *priv,
+ if (!(ecc & SJA1000_ECC_DIR))
+ cf->data[2] |= CAN_ERR_PROT_TX;
+
++ /* Bit stream position in CAN frame as the error was detected */
++ cf->data[3] = ecc & SJA1000_ECC_SEG;
++
+ if (priv->can.state == CAN_STATE_ERROR_WARNING ||
+ priv->can.state == CAN_STATE_ERROR_PASSIVE) {
+ cf->data[1] = (txerr > rxerr) ?
+--
+2.39.2
+
--- /dev/null
+From c2a3abe08b51069faa28a03d29263761262a0c02 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Jan 2023 21:18:44 +0100
+Subject: can: isotp: check CAN address family in isotp_bind()
+
+From: Oliver Hartkopp <socketcan@hartkopp.net>
+
+[ Upstream commit c6adf659a8ba85913e16a571d5a9bcd17d3d1234 ]
+
+Add missing check to block non-AF_CAN binds.
+
+Syzbot created some code which matched the right sockaddr struct size
+but used AF_XDP (0x2C) instead of AF_CAN (0x1D) in the address family
+field:
+
+bind$xdp(r2, &(0x7f0000000540)={0x2c, 0x0, r4, 0x0, r2}, 0x10)
+ ^^^^
+This has no funtional impact but the userspace should be notified about
+the wrong address family field content.
+
+Link: https://syzkaller.appspot.com/text?tag=CrashLog&x=11ff9d8c480000
+Reported-by: syzbot+5aed6c3aaba661f5b917@syzkaller.appspotmail.com
+Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
+Link: https://lore.kernel.org/all/20230104201844.13168-1-socketcan@hartkopp.net
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/can/isotp.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/net/can/isotp.c b/net/can/isotp.c
+index fc81d77724a13..9bc344851704e 100644
+--- a/net/can/isotp.c
++++ b/net/can/isotp.c
+@@ -1220,6 +1220,9 @@ static int isotp_bind(struct socket *sock, struct sockaddr *uaddr, int len)
+ if (len < ISOTP_MIN_NAMELEN)
+ return -EINVAL;
+
++ if (addr->can_family != AF_CAN)
++ return -EINVAL;
++
+ /* sanitize tx CAN identifier */
+ if (tx_id & CAN_EFF_FLAG)
+ tx_id &= (CAN_EFF_FLAG | CAN_EFF_MASK);
+--
+2.39.2
+
--- /dev/null
+From 0aa0bb0201ee1bc4ff3ae94c40bb6e8076ea2ea6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Jan 2023 19:56:06 +0100
+Subject: can: rcar_canfd: Fix R-Car V3U CAN mode selection
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 0a016639ef92b28eb74ba4fed21bee1f1328513a ]
+
+When adding support for R-Car V3U, the Global FD Configuration register
+(CFDGFDCFG) and the Channel-specific CAN-FD Configuration Registers
+(CFDCmFDCFG) were mixed up. Use the correct register, and apply the
+selected CAN mode to all available channels.
+
+Annotate the corresponding register bits, to make it clear they do
+not exist on older variants.
+
+Fixes: 45721c406dcf50d4 ("can: rcar_canfd: Add support for r8a779a0 SoC")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/all/388ddf312917eb9f6cc460a481f68402a876f9b5.1674499048.git.geert+renesas@glider.be
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/rcar/rcar_canfd.c | 19 ++++++++++---------
+ 1 file changed, 10 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/net/can/rcar/rcar_canfd.c b/drivers/net/can/rcar/rcar_canfd.c
+index f6fa7157b99b0..88de17d0bd79d 100644
+--- a/drivers/net/can/rcar/rcar_canfd.c
++++ b/drivers/net/can/rcar/rcar_canfd.c
+@@ -197,8 +197,8 @@
+ #define RCANFD_DCFG_DBRP(x) (((x) & 0xff) << 0)
+
+ /* RSCFDnCFDCmFDCFG */
+-#define RCANFD_FDCFG_CLOE BIT(30)
+-#define RCANFD_FDCFG_FDOE BIT(28)
++#define RCANFD_V3U_FDCFG_CLOE BIT(30)
++#define RCANFD_V3U_FDCFG_FDOE BIT(28)
+ #define RCANFD_FDCFG_TDCE BIT(9)
+ #define RCANFD_FDCFG_TDCOC BIT(8)
+ #define RCANFD_FDCFG_TDCO(x) (((x) & 0x7f) >> 16)
+@@ -429,8 +429,8 @@
+ #define RCANFD_C_RPGACC(r) (0x1900 + (0x04 * (r)))
+
+ /* R-Car V3U Classical and CAN FD mode specific register map */
+-#define RCANFD_V3U_CFDCFG (0x1314)
+ #define RCANFD_V3U_DCFG(m) (0x1400 + (0x20 * (m)))
++#define RCANFD_V3U_FDCFG(m) (0x1404 + (0x20 * (m)))
+
+ #define RCANFD_V3U_GAFL_OFFSET (0x1800)
+
+@@ -689,12 +689,13 @@ static void rcar_canfd_tx_failure_cleanup(struct net_device *ndev)
+ static void rcar_canfd_set_mode(struct rcar_canfd_global *gpriv)
+ {
+ if (is_v3u(gpriv)) {
+- if (gpriv->fdmode)
+- rcar_canfd_set_bit(gpriv->base, RCANFD_V3U_CFDCFG,
+- RCANFD_FDCFG_FDOE);
+- else
+- rcar_canfd_set_bit(gpriv->base, RCANFD_V3U_CFDCFG,
+- RCANFD_FDCFG_CLOE);
++ u32 ch, val = gpriv->fdmode ? RCANFD_V3U_FDCFG_FDOE
++ : RCANFD_V3U_FDCFG_CLOE;
++
++ for_each_set_bit(ch, &gpriv->channels_mask,
++ gpriv->info->max_channels)
++ rcar_canfd_set_bit(gpriv->base, RCANFD_V3U_FDCFG(ch),
++ val);
+ } else {
+ if (gpriv->fdmode)
+ rcar_canfd_set_bit(gpriv->base, RCANFD_GRMCFG,
+--
+2.39.2
+
--- /dev/null
+From ea094b5fd17344413f8cbc9b7c1849ff1b403154 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Jan 2023 19:56:07 +0100
+Subject: can: rcar_canfd: Fix R-Car V3U GAFLCFG field accesses
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 9be8c5583581244d8a77e41afa16b8b0a5ddabc0 ]
+
+Each Global Acceptance Filter List Configuration Register (GAFLCFG)
+contains two fields, and stores the number of channel rules for one
+channel pair.
+
+As R-Car V3U and later can have more than 2 channels, the field
+selection should be based on the LSB (even or odd) of the channel
+number, instead of on the full channel number.
+
+Fixes: 45721c406dcf50d4 ("can: rcar_canfd: Add support for r8a779a0 SoC")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/all/36bcf0ffb96d6aaed970751f9546b901af638bcf.1674499048.git.geert+renesas@glider.be
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/rcar/rcar_canfd.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/can/rcar/rcar_canfd.c b/drivers/net/can/rcar/rcar_canfd.c
+index 88de17d0bd79d..77b21c82faf38 100644
+--- a/drivers/net/can/rcar/rcar_canfd.c
++++ b/drivers/net/can/rcar/rcar_canfd.c
+@@ -92,10 +92,10 @@
+ /* RSCFDnCFDGAFLCFG0 / RSCFDnGAFLCFG0 */
+ #define RCANFD_GAFLCFG_SETRNC(gpriv, n, x) \
+ (((x) & reg_v3u(gpriv, 0x1ff, 0xff)) << \
+- (reg_v3u(gpriv, 16, 24) - (n) * reg_v3u(gpriv, 16, 8)))
++ (reg_v3u(gpriv, 16, 24) - ((n) & 1) * reg_v3u(gpriv, 16, 8)))
+
+ #define RCANFD_GAFLCFG_GETRNC(gpriv, n, x) \
+- (((x) >> (reg_v3u(gpriv, 16, 24) - (n) * reg_v3u(gpriv, 16, 8))) & \
++ (((x) >> (reg_v3u(gpriv, 16, 24) - ((n) & 1) * reg_v3u(gpriv, 16, 8))) & \
+ reg_v3u(gpriv, 0x1ff, 0xff))
+
+ /* RSCFDnCFDGAFLECTR / RSCFDnGAFLECTR */
+--
+2.39.2
+
--- /dev/null
+From c5d4c899df0b06bcaf658db1afe75fccf89aa90e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Nov 2022 16:42:07 +0800
+Subject: cifs: Fix lost destroy smbd connection when MR allocate failed
+
+From: Zhang Xiaoxu <zhangxiaoxu5@huawei.com>
+
+[ Upstream commit e9d3401d95d62a9531082cd2453ed42f2740e3fd ]
+
+If the MR allocate failed, the smb direct connection info is NULL,
+then smbd_destroy() will directly return, then the connection info
+will be leaked.
+
+Let's set the smb direct connection info to the server before call
+smbd_destroy().
+
+Fixes: c7398583340a ("CIFS: SMBD: Implement RDMA memory registration")
+Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5@huawei.com>
+Acked-by: Paulo Alcantara (SUSE) <pc@cjr.nz>
+Reviewed-by: David Howells <dhowells@redhat.com>
+Reviewed-by: Tom Talpey <tom@talpey.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/cifs/smbdirect.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/cifs/smbdirect.c b/fs/cifs/smbdirect.c
+index 8c816b25ce7c6..101dab87cad1a 100644
+--- a/fs/cifs/smbdirect.c
++++ b/fs/cifs/smbdirect.c
+@@ -1700,6 +1700,7 @@ static struct smbd_connection *_smbd_get_connection(
+
+ allocate_mr_failed:
+ /* At this point, need to a full transport shutdown */
++ server->smbd_conn = info;
+ smbd_destroy(server);
+ return NULL;
+
+--
+2.39.2
+
--- /dev/null
+From 9f654cc42ad1a64f564bd6fa2fbc965aa5016d52 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Nov 2022 16:42:08 +0800
+Subject: cifs: Fix warning and UAF when destroy the MR list
+
+From: Zhang Xiaoxu <zhangxiaoxu5@huawei.com>
+
+[ Upstream commit 3e161c2791f8e661eed24a2c624087084d910215 ]
+
+If the MR allocate failed, the MR recovery work not initialized
+and list not cleared. Then will be warning and UAF when release
+the MR:
+
+ WARNING: CPU: 4 PID: 824 at kernel/workqueue.c:3066 __flush_work.isra.0+0xf7/0x110
+ CPU: 4 PID: 824 Comm: mount.cifs Not tainted 6.1.0-rc5+ #82
+ RIP: 0010:__flush_work.isra.0+0xf7/0x110
+ Call Trace:
+ <TASK>
+ __cancel_work_timer+0x2ba/0x2e0
+ smbd_destroy+0x4e1/0x990
+ _smbd_get_connection+0x1cbd/0x2110
+ smbd_get_connection+0x21/0x40
+ cifs_get_tcp_session+0x8ef/0xda0
+ mount_get_conns+0x60/0x750
+ cifs_mount+0x103/0xd00
+ cifs_smb3_do_mount+0x1dd/0xcb0
+ smb3_get_tree+0x1d5/0x300
+ vfs_get_tree+0x41/0xf0
+ path_mount+0x9b3/0xdd0
+ __x64_sys_mount+0x190/0x1d0
+ do_syscall_64+0x35/0x80
+ entry_SYSCALL_64_after_hwframe+0x46/0xb0
+
+ BUG: KASAN: use-after-free in smbd_destroy+0x4fc/0x990
+ Read of size 8 at addr ffff88810b156a08 by task mount.cifs/824
+ CPU: 4 PID: 824 Comm: mount.cifs Tainted: G W 6.1.0-rc5+ #82
+ Call Trace:
+ dump_stack_lvl+0x34/0x44
+ print_report+0x171/0x472
+ kasan_report+0xad/0x130
+ smbd_destroy+0x4fc/0x990
+ _smbd_get_connection+0x1cbd/0x2110
+ smbd_get_connection+0x21/0x40
+ cifs_get_tcp_session+0x8ef/0xda0
+ mount_get_conns+0x60/0x750
+ cifs_mount+0x103/0xd00
+ cifs_smb3_do_mount+0x1dd/0xcb0
+ smb3_get_tree+0x1d5/0x300
+ vfs_get_tree+0x41/0xf0
+ path_mount+0x9b3/0xdd0
+ __x64_sys_mount+0x190/0x1d0
+ do_syscall_64+0x35/0x80
+ entry_SYSCALL_64_after_hwframe+0x46/0xb0
+
+ Allocated by task 824:
+ kasan_save_stack+0x1e/0x40
+ kasan_set_track+0x21/0x30
+ __kasan_kmalloc+0x7a/0x90
+ _smbd_get_connection+0x1b6f/0x2110
+ smbd_get_connection+0x21/0x40
+ cifs_get_tcp_session+0x8ef/0xda0
+ mount_get_conns+0x60/0x750
+ cifs_mount+0x103/0xd00
+ cifs_smb3_do_mount+0x1dd/0xcb0
+ smb3_get_tree+0x1d5/0x300
+ vfs_get_tree+0x41/0xf0
+ path_mount+0x9b3/0xdd0
+ __x64_sys_mount+0x190/0x1d0
+ do_syscall_64+0x35/0x80
+ entry_SYSCALL_64_after_hwframe+0x46/0xb0
+
+ Freed by task 824:
+ kasan_save_stack+0x1e/0x40
+ kasan_set_track+0x21/0x30
+ kasan_save_free_info+0x2a/0x40
+ ____kasan_slab_free+0x143/0x1b0
+ __kmem_cache_free+0xc8/0x330
+ _smbd_get_connection+0x1c6a/0x2110
+ smbd_get_connection+0x21/0x40
+ cifs_get_tcp_session+0x8ef/0xda0
+ mount_get_conns+0x60/0x750
+ cifs_mount+0x103/0xd00
+ cifs_smb3_do_mount+0x1dd/0xcb0
+ smb3_get_tree+0x1d5/0x300
+ vfs_get_tree+0x41/0xf0
+ path_mount+0x9b3/0xdd0
+ __x64_sys_mount+0x190/0x1d0
+ do_syscall_64+0x35/0x80
+ entry_SYSCALL_64_after_hwframe+0x46/0xb0
+
+Let's initialize the MR recovery work before MR allocate to prevent
+the warning, remove the MRs from the list to prevent the UAF.
+
+Fixes: c7398583340a ("CIFS: SMBD: Implement RDMA memory registration")
+Acked-by: Paulo Alcantara (SUSE) <pc@cjr.nz>
+Reviewed-by: Tom Talpey <tom@talpey.com>
+Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5@huawei.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/cifs/smbdirect.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/fs/cifs/smbdirect.c b/fs/cifs/smbdirect.c
+index 101dab87cad1a..cf923f211c512 100644
+--- a/fs/cifs/smbdirect.c
++++ b/fs/cifs/smbdirect.c
+@@ -2218,6 +2218,7 @@ static int allocate_mr_list(struct smbd_connection *info)
+ atomic_set(&info->mr_ready_count, 0);
+ atomic_set(&info->mr_used_count, 0);
+ init_waitqueue_head(&info->wait_for_mr_cleanup);
++ INIT_WORK(&info->mr_recovery_work, smbd_mr_recovery_work);
+ /* Allocate more MRs (2x) than hardware responder_resources */
+ for (i = 0; i < info->responder_resources * 2; i++) {
+ smbdirect_mr = kzalloc(sizeof(*smbdirect_mr), GFP_KERNEL);
+@@ -2245,13 +2246,13 @@ static int allocate_mr_list(struct smbd_connection *info)
+ list_add_tail(&smbdirect_mr->list, &info->mr_list);
+ atomic_inc(&info->mr_ready_count);
+ }
+- INIT_WORK(&info->mr_recovery_work, smbd_mr_recovery_work);
+ return 0;
+
+ out:
+ kfree(smbdirect_mr);
+
+ list_for_each_entry_safe(smbdirect_mr, tmp, &info->mr_list, list) {
++ list_del(&smbdirect_mr->list);
+ ib_dereg_mr(smbdirect_mr->mr);
+ kfree(smbdirect_mr->sgl);
+ kfree(smbdirect_mr);
+--
+2.39.2
+
--- /dev/null
+From 4e2bdc9aa1a34402048333032ad51d1e395ff681 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Jan 2023 20:33:29 -0300
+Subject: cifs: prevent data race in smb2_reconnect()
+
+From: Paulo Alcantara <pc@cjr.nz>
+
+[ Upstream commit 3c0070f54b3128de498c2dd9934a21f0dd867111 ]
+
+Make sure to get an up-to-date TCP_Server_Info::nr_targets value prior
+to waiting the server to be reconnected in smb2_reconnect(). It is
+set in cifs_tcp_ses_needs_reconnect() and protected by
+TCP_Server_Info::srv_lock.
+
+Signed-off-by: Paulo Alcantara (SUSE) <pc@cjr.nz>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/cifs/smb2pdu.c | 119 +++++++++++++++++++++++++---------------------
+ 1 file changed, 64 insertions(+), 55 deletions(-)
+
+diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
+index 3b93680a319e4..5a063af8a094e 100644
+--- a/fs/cifs/smb2pdu.c
++++ b/fs/cifs/smb2pdu.c
+@@ -139,6 +139,66 @@ smb2_hdr_assemble(struct smb2_hdr *shdr, __le16 smb2_cmd,
+ return;
+ }
+
++static int wait_for_server_reconnect(struct TCP_Server_Info *server,
++ __le16 smb2_command, bool retry)
++{
++ int timeout = 10;
++ int rc;
++
++ spin_lock(&server->srv_lock);
++ if (server->tcpStatus != CifsNeedReconnect) {
++ spin_unlock(&server->srv_lock);
++ return 0;
++ }
++ timeout *= server->nr_targets;
++ spin_unlock(&server->srv_lock);
++
++ /*
++ * Return to caller for TREE_DISCONNECT and LOGOFF and CLOSE
++ * here since they are implicitly done when session drops.
++ */
++ switch (smb2_command) {
++ /*
++ * BB Should we keep oplock break and add flush to exceptions?
++ */
++ case SMB2_TREE_DISCONNECT:
++ case SMB2_CANCEL:
++ case SMB2_CLOSE:
++ case SMB2_OPLOCK_BREAK:
++ return -EAGAIN;
++ }
++
++ /*
++ * Give demultiplex thread up to 10 seconds to each target available for
++ * reconnect -- should be greater than cifs socket timeout which is 7
++ * seconds.
++ *
++ * On "soft" mounts we wait once. Hard mounts keep retrying until
++ * process is killed or server comes back on-line.
++ */
++ do {
++ rc = wait_event_interruptible_timeout(server->response_q,
++ (server->tcpStatus != CifsNeedReconnect),
++ timeout * HZ);
++ if (rc < 0) {
++ cifs_dbg(FYI, "%s: aborting reconnect due to received signal\n",
++ __func__);
++ return -ERESTARTSYS;
++ }
++
++ /* are we still trying to reconnect? */
++ spin_lock(&server->srv_lock);
++ if (server->tcpStatus != CifsNeedReconnect) {
++ spin_unlock(&server->srv_lock);
++ return 0;
++ }
++ spin_unlock(&server->srv_lock);
++ } while (retry);
++
++ cifs_dbg(FYI, "%s: gave up waiting on reconnect\n", __func__);
++ return -EHOSTDOWN;
++}
++
+ static int
+ smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon,
+ struct TCP_Server_Info *server)
+@@ -146,7 +206,6 @@ smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon,
+ int rc = 0;
+ struct nls_table *nls_codepage;
+ struct cifs_ses *ses;
+- int retries;
+
+ /*
+ * SMB2s NegProt, SessSetup, Logoff do not have tcon yet so
+@@ -184,61 +243,11 @@ smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon,
+ (!tcon->ses->server) || !server)
+ return -EIO;
+
+- ses = tcon->ses;
+- retries = server->nr_targets;
+-
+- /*
+- * Give demultiplex thread up to 10 seconds to each target available for
+- * reconnect -- should be greater than cifs socket timeout which is 7
+- * seconds.
+- */
+- while (server->tcpStatus == CifsNeedReconnect) {
+- /*
+- * Return to caller for TREE_DISCONNECT and LOGOFF and CLOSE
+- * here since they are implicitly done when session drops.
+- */
+- switch (smb2_command) {
+- /*
+- * BB Should we keep oplock break and add flush to exceptions?
+- */
+- case SMB2_TREE_DISCONNECT:
+- case SMB2_CANCEL:
+- case SMB2_CLOSE:
+- case SMB2_OPLOCK_BREAK:
+- return -EAGAIN;
+- }
+-
+- rc = wait_event_interruptible_timeout(server->response_q,
+- (server->tcpStatus != CifsNeedReconnect),
+- 10 * HZ);
+- if (rc < 0) {
+- cifs_dbg(FYI, "%s: aborting reconnect due to a received signal by the process\n",
+- __func__);
+- return -ERESTARTSYS;
+- }
+-
+- /* are we still trying to reconnect? */
+- spin_lock(&server->srv_lock);
+- if (server->tcpStatus != CifsNeedReconnect) {
+- spin_unlock(&server->srv_lock);
+- break;
+- }
+- spin_unlock(&server->srv_lock);
+-
+- if (retries && --retries)
+- continue;
++ rc = wait_for_server_reconnect(server, smb2_command, tcon->retry);
++ if (rc)
++ return rc;
+
+- /*
+- * on "soft" mounts we wait once. Hard mounts keep
+- * retrying until process is killed or server comes
+- * back on-line
+- */
+- if (!tcon->retry) {
+- cifs_dbg(FYI, "gave up waiting on reconnect in smb_init\n");
+- return -EHOSTDOWN;
+- }
+- retries = server->nr_targets;
+- }
++ ses = tcon->ses;
+
+ spin_lock(&ses->chan_lock);
+ if (!cifs_chan_needs_reconnect(ses, server) && !tcon->need_reconnect) {
+--
+2.39.2
+
--- /dev/null
+From 8984c125bfccfb7831623c5d6371852cd70d32d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Feb 2023 16:34:31 +0000
+Subject: cifs: use tcon allocation functions even for dummy tcon
+
+From: Shyam Prasad N <sprasad@microsoft.com>
+
+[ Upstream commit df57109bd50b9ed6911f3c2aa914189fe4c1fe2c ]
+
+In smb2_reconnect_server, we allocate a dummy tcon for
+calling reconnect for just the session. This should be
+allocated using tconInfoAlloc, and not kmalloc.
+
+Fixes: 3663c9045f51 ("cifs: check reconnects for channels of active tcons too")
+Signed-off-by: Shyam Prasad N <sprasad@microsoft.com>
+Reviewed-by: Paulo Alcantara (SUSE) <pc@cjr.nz>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/cifs/smb2pdu.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
+index 2c9ffa921e6f6..3b93680a319e4 100644
+--- a/fs/cifs/smb2pdu.c
++++ b/fs/cifs/smb2pdu.c
+@@ -3898,7 +3898,7 @@ void smb2_reconnect_server(struct work_struct *work)
+ goto done;
+
+ /* allocate a dummy tcon struct used for reconnect */
+- tcon = kzalloc(sizeof(struct cifs_tcon), GFP_KERNEL);
++ tcon = tconInfoAlloc();
+ if (!tcon) {
+ resched = true;
+ list_for_each_entry_safe(ses, ses2, &tmp_ses_list, rlist) {
+@@ -3921,7 +3921,7 @@ void smb2_reconnect_server(struct work_struct *work)
+ list_del_init(&ses->rlist);
+ cifs_put_smb_ses(ses);
+ }
+- kfree(tcon);
++ tconInfoFree(tcon);
+
+ done:
+ cifs_dbg(FYI, "Reconnecting tcons and channels finished\n");
+--
+2.39.2
+
--- /dev/null
+From 16168c8940697f00a4d58f353dddc5763e312424 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Feb 2023 19:49:42 +0000
+Subject: clocksource/drivers/riscv: Patch riscv_clock_next_event() jump before
+ first use
+
+From: Matt Evans <mev@rivosinc.com>
+
+[ Upstream commit 225b9596cb0227c1c1b1e4a836dad43595c3e61a ]
+
+A static key is used to select between SBI and Sstc timer usage in
+riscv_clock_next_event(), but currently the direction is resolved
+after cpuhp_setup_state() is called (which sets the next event). The
+first event will therefore fall through the sbi_set_timer() path; this
+breaks Sstc-only systems. So, apply the jump patching before first
+use.
+
+Fixes: 9f7a8ff6391f ("RISC-V: Prefer sstc extension if available")
+Signed-off-by: Matt Evans <mev@rivosinc.com>
+Reviewed-by: Palmer Dabbelt <palmer@rivosinc.com>
+Acked-by: Palmer Dabbelt <palmer@rivosinc.com>
+Reviewed-by: Anup Patel <anup@brainfault.org>
+Link: https://lore.kernel.org/r/CDDAB2D0-264E-42F3-8E31-BA210BEB8EC1@rivosinc.com
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/timer-riscv.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/clocksource/timer-riscv.c b/drivers/clocksource/timer-riscv.c
+index a0d66fabf0732..a01c2bd241349 100644
+--- a/drivers/clocksource/timer-riscv.c
++++ b/drivers/clocksource/timer-riscv.c
+@@ -177,6 +177,11 @@ static int __init riscv_timer_init_dt(struct device_node *n)
+ return error;
+ }
+
++ if (riscv_isa_extension_available(NULL, SSTC)) {
++ pr_info("Timer interrupt in S-mode is available via sstc extension\n");
++ static_branch_enable(&riscv_sstc_available);
++ }
++
+ error = cpuhp_setup_state(CPUHP_AP_RISCV_TIMER_STARTING,
+ "clockevents/riscv/timer:starting",
+ riscv_timer_starting_cpu, riscv_timer_dying_cpu);
+@@ -184,11 +189,6 @@ static int __init riscv_timer_init_dt(struct device_node *n)
+ pr_err("cpu hp setup state failed for RISCV timer [%d]\n",
+ error);
+
+- if (riscv_isa_extension_available(NULL, SSTC)) {
+- pr_info("Timer interrupt in S-mode is available via sstc extension\n");
+- static_branch_enable(&riscv_sstc_available);
+- }
+-
+ return error;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 05da158746497cd076be605e9c77ce3b047e3ffa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Dec 2022 16:25:12 +0800
+Subject: clocksource: Suspend the watchdog temporarily when high read latency
+ detected
+
+From: Feng Tang <feng.tang@intel.com>
+
+[ Upstream commit b7082cdfc464bf9231300605d03eebf943dda307 ]
+
+Bugs have been reported on 8 sockets x86 machines in which the TSC was
+wrongly disabled when the system is under heavy workload.
+
+ [ 818.380354] clocksource: timekeeping watchdog on CPU336: hpet wd-wd read-back delay of 1203520ns
+ [ 818.436160] clocksource: wd-tsc-wd read-back delay of 181880ns, clock-skew test skipped!
+ [ 819.402962] clocksource: timekeeping watchdog on CPU338: hpet wd-wd read-back delay of 324000ns
+ [ 819.448036] clocksource: wd-tsc-wd read-back delay of 337240ns, clock-skew test skipped!
+ [ 819.880863] clocksource: timekeeping watchdog on CPU339: hpet read-back delay of 150280ns, attempt 3, marking unstable
+ [ 819.936243] tsc: Marking TSC unstable due to clocksource watchdog
+ [ 820.068173] TSC found unstable after boot, most likely due to broken BIOS. Use 'tsc=unstable'.
+ [ 820.092382] sched_clock: Marking unstable (818769414384, 1195404998)
+ [ 820.643627] clocksource: Checking clocksource tsc synchronization from CPU 267 to CPUs 0,4,25,70,126,430,557,564.
+ [ 821.067990] clocksource: Switched to clocksource hpet
+
+This can be reproduced by running memory intensive 'stream' tests,
+or some of the stress-ng subcases such as 'ioport'.
+
+The reason for these issues is the when system is under heavy load, the
+read latency of the clocksources can be very high. Even lightweight TSC
+reads can show high latencies, and latencies are much worse for external
+clocksources such as HPET or the APIC PM timer. These latencies can
+result in false-positive clocksource-unstable determinations.
+
+These issues were initially reported by a customer running on a production
+system, and this problem was reproduced on several generations of Xeon
+servers, especially when running the stress-ng test. These Xeon servers
+were not production systems, but they did have the latest steppings
+and firmware.
+
+Given that the clocksource watchdog is a continual diagnostic check with
+frequency of twice a second, there is no need to rush it when the system
+is under heavy load. Therefore, when high clocksource read latencies
+are detected, suspend the watchdog timer for 5 minutes.
+
+Signed-off-by: Feng Tang <feng.tang@intel.com>
+Acked-by: Waiman Long <longman@redhat.com>
+Cc: John Stultz <jstultz@google.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Stephen Boyd <sboyd@kernel.org>
+Cc: Feng Tang <feng.tang@intel.com>
+Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/time/clocksource.c | 45 ++++++++++++++++++++++++++++-----------
+ 1 file changed, 32 insertions(+), 13 deletions(-)
+
+diff --git a/kernel/time/clocksource.c b/kernel/time/clocksource.c
+index 9cf32ccda715d..8cd74b89d5776 100644
+--- a/kernel/time/clocksource.c
++++ b/kernel/time/clocksource.c
+@@ -384,6 +384,15 @@ void clocksource_verify_percpu(struct clocksource *cs)
+ }
+ EXPORT_SYMBOL_GPL(clocksource_verify_percpu);
+
++static inline void clocksource_reset_watchdog(void)
++{
++ struct clocksource *cs;
++
++ list_for_each_entry(cs, &watchdog_list, wd_list)
++ cs->flags &= ~CLOCK_SOURCE_WATCHDOG;
++}
++
++
+ static void clocksource_watchdog(struct timer_list *unused)
+ {
+ u64 csnow, wdnow, cslast, wdlast, delta;
+@@ -391,6 +400,7 @@ static void clocksource_watchdog(struct timer_list *unused)
+ int64_t wd_nsec, cs_nsec;
+ struct clocksource *cs;
+ enum wd_read_status read_ret;
++ unsigned long extra_wait = 0;
+ u32 md;
+
+ spin_lock(&watchdog_lock);
+@@ -410,13 +420,30 @@ static void clocksource_watchdog(struct timer_list *unused)
+
+ read_ret = cs_watchdog_read(cs, &csnow, &wdnow);
+
+- if (read_ret != WD_READ_SUCCESS) {
+- if (read_ret == WD_READ_UNSTABLE)
+- /* Clock readout unreliable, so give it up. */
+- __clocksource_unstable(cs);
++ if (read_ret == WD_READ_UNSTABLE) {
++ /* Clock readout unreliable, so give it up. */
++ __clocksource_unstable(cs);
+ continue;
+ }
+
++ /*
++ * When WD_READ_SKIP is returned, it means the system is likely
++ * under very heavy load, where the latency of reading
++ * watchdog/clocksource is very big, and affect the accuracy of
++ * watchdog check. So give system some space and suspend the
++ * watchdog check for 5 minutes.
++ */
++ if (read_ret == WD_READ_SKIP) {
++ /*
++ * As the watchdog timer will be suspended, and
++ * cs->last could keep unchanged for 5 minutes, reset
++ * the counters.
++ */
++ clocksource_reset_watchdog();
++ extra_wait = HZ * 300;
++ break;
++ }
++
+ /* Clocksource initialized ? */
+ if (!(cs->flags & CLOCK_SOURCE_WATCHDOG) ||
+ atomic_read(&watchdog_reset_pending)) {
+@@ -512,7 +539,7 @@ static void clocksource_watchdog(struct timer_list *unused)
+ * pair clocksource_stop_watchdog() clocksource_start_watchdog().
+ */
+ if (!timer_pending(&watchdog_timer)) {
+- watchdog_timer.expires += WATCHDOG_INTERVAL;
++ watchdog_timer.expires += WATCHDOG_INTERVAL + extra_wait;
+ add_timer_on(&watchdog_timer, next_cpu);
+ }
+ out:
+@@ -537,14 +564,6 @@ static inline void clocksource_stop_watchdog(void)
+ watchdog_running = 0;
+ }
+
+-static inline void clocksource_reset_watchdog(void)
+-{
+- struct clocksource *cs;
+-
+- list_for_each_entry(cs, &watchdog_list, wd_list)
+- cs->flags &= ~CLOCK_SOURCE_WATCHDOG;
+-}
+-
+ static void clocksource_resume_watchdog(void)
+ {
+ atomic_inc(&watchdog_reset_pending);
+--
+2.39.2
+
--- /dev/null
+From 73fc6230a2164654bed16b88576ec286067ba610 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Jan 2023 14:39:21 -0800
+Subject: coda: Avoid partial allocation of sig_inputArgs
+
+From: Kees Cook <keescook@chromium.org>
+
+[ Upstream commit 48df133578c70185a95a49390d42df1996ddba2a ]
+
+GCC does not like having a partially allocated object, since it cannot
+reason about it for bounds checking when it is passed to other code.
+Instead, fully allocate sig_inputArgs. (Alternatively, sig_inputArgs
+should be defined as a struct coda_in_hdr, if it is actually not using
+any other part of the union.) Seen under GCC 13:
+
+../fs/coda/upcall.c: In function 'coda_upcall':
+../fs/coda/upcall.c:801:22: warning: array subscript 'union inputArgs[0]' is partly outside array bounds of 'unsigned char[20]' [-Warray-bounds=]
+ 801 | sig_inputArgs->ih.opcode = CODA_SIGNAL;
+ | ^~
+
+Cc: Jan Harkes <jaharkes@cs.cmu.edu>
+Cc: coda@cs.cmu.edu
+Cc: codalist@coda.cs.cmu.edu
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Link: https://lore.kernel.org/r/20230127223921.never.882-kees@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/coda/upcall.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/coda/upcall.c b/fs/coda/upcall.c
+index 59f6cfd06f96a..cd6a3721f6f69 100644
+--- a/fs/coda/upcall.c
++++ b/fs/coda/upcall.c
+@@ -791,7 +791,7 @@ static int coda_upcall(struct venus_comm *vcp,
+ sig_req = kmalloc(sizeof(struct upc_req), GFP_KERNEL);
+ if (!sig_req) goto exit;
+
+- sig_inputArgs = kvzalloc(sizeof(struct coda_in_hdr), GFP_KERNEL);
++ sig_inputArgs = kvzalloc(sizeof(*sig_inputArgs), GFP_KERNEL);
+ if (!sig_inputArgs) {
+ kfree(sig_req);
+ goto exit;
+--
+2.39.2
+
--- /dev/null
+From 7545e05b9cc4aa8b0252334ffaeb62470ff93b98 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Jan 2023 13:45:57 +0000
+Subject: Compiler attributes: GCC cold function alignment workarounds
+
+From: Mark Rutland <mark.rutland@arm.com>
+
+[ Upstream commit c27cd083cfb9d392f304657ed00fcde1136704e7 ]
+
+Contemporary versions of GCC (e.g. GCC 12.2.0) drop the alignment
+specified by '-falign-functions=N' for functions marked with the
+__cold__ attribute, and potentially for callees of __cold__ functions as
+these may be implicitly marked as __cold__ by the compiler. LLVM appears
+to respect '-falign-functions=N' in such cases.
+
+This has been reported to GCC in bug 88345:
+
+ https://gcc.gnu.org/bugzilla/show_bug.cgi?id=88345
+
+... which also covers alignment being dropped when '-Os' is used, which
+will be addressed in a separate patch.
+
+Currently, use of '-falign-functions=N' is limited to
+CONFIG_FUNCTION_ALIGNMENT, which is largely used for performance and/or
+analysis reasons (e.g. with CONFIG_DEBUG_FORCE_FUNCTION_ALIGN_64B), but
+isn't necessary for correct functionality. However, this dropped
+alignment isn't great for the performance and/or analysis cases.
+
+Subsequent patches will use CONFIG_FUNCTION_ALIGNMENT as part of arm64's
+ftrace implementation, which will require all instrumented functions to
+be aligned to at least 8-bytes.
+
+This patch works around the dropped alignment by avoiding the use of the
+__cold__ attribute when CONFIG_FUNCTION_ALIGNMENT is non-zero, and by
+specifically aligning abort(), which GCC implicitly marks as __cold__.
+As the __cold macro is now dependent upon config options (which is
+against the policy described at the top of compiler_attributes.h), it is
+moved into compiler_types.h.
+
+I've tested this by building and booting a kernel configured with
+defconfig + CONFIG_EXPERT=y + CONFIG_DEBUG_FORCE_FUNCTION_ALIGN_64B=y,
+and looking for misaligned text symbols in /proc/kallsyms:
+
+* arm64:
+
+ Before:
+ # uname -rm
+ 6.2.0-rc3 aarch64
+ # grep ' [Tt] ' /proc/kallsyms | grep -iv '[048c]0 [Tt] ' | wc -l
+ 5009
+
+ After:
+ # uname -rm
+ 6.2.0-rc3-00001-g2a2bedf8bfa9 aarch64
+ # grep ' [Tt] ' /proc/kallsyms | grep -iv '[048c]0 [Tt] ' | wc -l
+ 919
+
+* x86_64:
+
+ Before:
+ # uname -rm
+ 6.2.0-rc3 x86_64
+ # grep ' [Tt] ' /proc/kallsyms | grep -iv '[048c]0 [Tt] ' | wc -l
+ 11537
+
+ After:
+ # uname -rm
+ 6.2.0-rc3-00001-g2a2bedf8bfa9 x86_64
+ # grep ' [Tt] ' /proc/kallsyms | grep -iv '[048c]0 [Tt] ' | wc -l
+ 2805
+
+There's clearly a substantial reduction in the number of misaligned
+symbols. From manual inspection, the remaining unaligned text labels are
+a combination of ACPICA functions (due to the use of '-Os'), static call
+trampolines, and non-function labels in assembly, which will be dealt
+with in subsequent patches.
+
+Signed-off-by: Mark Rutland <mark.rutland@arm.com>
+Cc: Florent Revest <revest@chromium.org>
+Cc: Masami Hiramatsu <mhiramat@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Cc: Will Deacon <will@kernel.org>
+Cc: Miguel Ojeda <ojeda@kernel.org>
+Cc: Nick Desaulniers <ndesaulniers@google.com>
+Link: https://lore.kernel.org/r/20230123134603.1064407-3-mark.rutland@arm.com
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/compiler_attributes.h | 6 ------
+ include/linux/compiler_types.h | 27 +++++++++++++++++++++++++++
+ kernel/exit.c | 9 ++++++++-
+ 3 files changed, 35 insertions(+), 7 deletions(-)
+
+diff --git a/include/linux/compiler_attributes.h b/include/linux/compiler_attributes.h
+index 898b3458b24a0..b83126452c651 100644
+--- a/include/linux/compiler_attributes.h
++++ b/include/linux/compiler_attributes.h
+@@ -75,12 +75,6 @@
+ # define __assume_aligned(a, ...)
+ #endif
+
+-/*
+- * gcc: https://gcc.gnu.org/onlinedocs/gcc/Common-Function-Attributes.html#index-cold-function-attribute
+- * gcc: https://gcc.gnu.org/onlinedocs/gcc/Label-Attributes.html#index-cold-label-attribute
+- */
+-#define __cold __attribute__((__cold__))
+-
+ /*
+ * Note the long name.
+ *
+diff --git a/include/linux/compiler_types.h b/include/linux/compiler_types.h
+index 7c1afe0f4129c..aab34e30128e9 100644
+--- a/include/linux/compiler_types.h
++++ b/include/linux/compiler_types.h
+@@ -79,6 +79,33 @@ static inline void __chk_io_ptr(const volatile void __iomem *ptr) { }
+ /* Attributes */
+ #include <linux/compiler_attributes.h>
+
++#if CONFIG_FUNCTION_ALIGNMENT > 0
++#define __function_aligned __aligned(CONFIG_FUNCTION_ALIGNMENT)
++#else
++#define __function_aligned
++#endif
++
++/*
++ * gcc: https://gcc.gnu.org/onlinedocs/gcc/Common-Function-Attributes.html#index-cold-function-attribute
++ * gcc: https://gcc.gnu.org/onlinedocs/gcc/Label-Attributes.html#index-cold-label-attribute
++ *
++ * When -falign-functions=N is in use, we must avoid the cold attribute as
++ * contemporary versions of GCC drop the alignment for cold functions. Worse,
++ * GCC can implicitly mark callees of cold functions as cold themselves, so
++ * it's not sufficient to add __function_aligned here as that will not ensure
++ * that callees are correctly aligned.
++ *
++ * See:
++ *
++ * https://lore.kernel.org/lkml/Y77%2FqVgvaJidFpYt@FVFF77S0Q05N
++ * https://gcc.gnu.org/bugzilla/show_bug.cgi?id=88345#c9
++ */
++#if !defined(CONFIG_CC_IS_GCC) || (CONFIG_FUNCTION_ALIGNMENT == 0)
++#define __cold __attribute__((__cold__))
++#else
++#define __cold
++#endif
++
+ /* Builtins */
+
+ /*
+diff --git a/kernel/exit.c b/kernel/exit.c
+index bccfa4218356e..f2afdb0add7c5 100644
+--- a/kernel/exit.c
++++ b/kernel/exit.c
+@@ -1905,7 +1905,14 @@ bool thread_group_exited(struct pid *pid)
+ }
+ EXPORT_SYMBOL(thread_group_exited);
+
+-__weak void abort(void)
++/*
++ * This needs to be __function_aligned as GCC implicitly makes any
++ * implementation of abort() cold and drops alignment specified by
++ * -falign-functions=N.
++ *
++ * See https://gcc.gnu.org/bugzilla/show_bug.cgi?id=88345#c11
++ */
++__weak __function_aligned void abort(void)
+ {
+ BUG();
+
+--
+2.39.2
+
--- /dev/null
+From b6b405caa9f8219354c9077fd5ebe4cf220fa5d3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Jan 2023 20:44:05 +0100
+Subject: context_tracking: Fix noinstr vs KASAN
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+[ Upstream commit 0e26e1de0032779e43929174339429c16307a299 ]
+
+Low level noinstr context-tracking code is calling out to instrumented
+code on KASAN:
+
+ vmlinux.o: warning: objtool: __ct_user_enter+0x72: call to __kasan_check_write() leaves .noinstr.text section
+ vmlinux.o: warning: objtool: __ct_user_exit+0x47: call to __kasan_check_write() leaves .noinstr.text section
+
+Use even lower level atomic methods to avoid the instrumentation.
+
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Link: https://lore.kernel.org/r/20230112195542.458034262@infradead.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/context_tracking.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/kernel/context_tracking.c b/kernel/context_tracking.c
+index 77978e3723771..a09f1c19336ae 100644
+--- a/kernel/context_tracking.c
++++ b/kernel/context_tracking.c
+@@ -510,7 +510,7 @@ void noinstr __ct_user_enter(enum ctx_state state)
+ * In this we case we don't care about any concurrency/ordering.
+ */
+ if (!IS_ENABLED(CONFIG_CONTEXT_TRACKING_IDLE))
+- atomic_set(&ct->state, state);
++ arch_atomic_set(&ct->state, state);
+ } else {
+ /*
+ * Even if context tracking is disabled on this CPU, because it's outside
+@@ -527,7 +527,7 @@ void noinstr __ct_user_enter(enum ctx_state state)
+ */
+ if (!IS_ENABLED(CONFIG_CONTEXT_TRACKING_IDLE)) {
+ /* Tracking for vtime only, no concurrent RCU EQS accounting */
+- atomic_set(&ct->state, state);
++ arch_atomic_set(&ct->state, state);
+ } else {
+ /*
+ * Tracking for vtime and RCU EQS. Make sure we don't race
+@@ -535,7 +535,7 @@ void noinstr __ct_user_enter(enum ctx_state state)
+ * RCU only requires RCU_DYNTICKS_IDX increments to be fully
+ * ordered.
+ */
+- atomic_add(state, &ct->state);
++ arch_atomic_add(state, &ct->state);
+ }
+ }
+ }
+@@ -630,12 +630,12 @@ void noinstr __ct_user_exit(enum ctx_state state)
+ * In this we case we don't care about any concurrency/ordering.
+ */
+ if (!IS_ENABLED(CONFIG_CONTEXT_TRACKING_IDLE))
+- atomic_set(&ct->state, CONTEXT_KERNEL);
++ arch_atomic_set(&ct->state, CONTEXT_KERNEL);
+
+ } else {
+ if (!IS_ENABLED(CONFIG_CONTEXT_TRACKING_IDLE)) {
+ /* Tracking for vtime only, no concurrent RCU EQS accounting */
+- atomic_set(&ct->state, CONTEXT_KERNEL);
++ arch_atomic_set(&ct->state, CONTEXT_KERNEL);
+ } else {
+ /*
+ * Tracking for vtime and RCU EQS. Make sure we don't race
+@@ -643,7 +643,7 @@ void noinstr __ct_user_exit(enum ctx_state state)
+ * RCU only requires RCU_DYNTICKS_IDX increments to be fully
+ * ordered.
+ */
+- atomic_sub(state, &ct->state);
++ arch_atomic_sub(state, &ct->state);
+ }
+ }
+ }
+--
+2.39.2
+
--- /dev/null
+From 9306ff20af7537ac62dd73fbed57768f48cedf70 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Jan 2023 11:07:35 +0000
+Subject: coresight: cti: Add PM runtime call in enable_store
+
+From: Mao Jinlong <quic_jinlmao@quicinc.com>
+
+[ Upstream commit eff674a9b86a6ffdd10c3af3863545acf7f1ce4f ]
+
+In commit 6746eae4bbad ("coresight: cti: Fix hang in cti_disable_hw()")
+PM runtime calls are removed from cti_enable_hw/cti_disable_hw. When
+enabling CTI by writing enable sysfs node, clock for accessing CTI
+register won't be enabled. Device will crash due to register access
+issue. Add PM runtime call in enable_store to fix this issue.
+
+Fixes: 6746eae4bbad ("coresight: cti: Fix hang in cti_disable_hw()")
+Signed-off-by: Mao Jinlong <quic_jinlmao@quicinc.com>
+[Change to only call pm_runtime_put if a disable happened]
+Tested-by: Jinlong Mao <quic_jinlmao@quicinc.com>
+Signed-off-by: James Clark <james.clark@arm.com>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Link: https://lore.kernel.org/r/20230110110736.2709917-3-james.clark@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/coresight/coresight-cti-sysfs.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/hwtracing/coresight/coresight-cti-sysfs.c b/drivers/hwtracing/coresight/coresight-cti-sysfs.c
+index 6d59c815ecf5e..71e7a8266bb32 100644
+--- a/drivers/hwtracing/coresight/coresight-cti-sysfs.c
++++ b/drivers/hwtracing/coresight/coresight-cti-sysfs.c
+@@ -108,10 +108,19 @@ static ssize_t enable_store(struct device *dev,
+ if (ret)
+ return ret;
+
+- if (val)
++ if (val) {
++ ret = pm_runtime_resume_and_get(dev->parent);
++ if (ret)
++ return ret;
+ ret = cti_enable(drvdata->csdev);
+- else
++ if (ret)
++ pm_runtime_put(dev->parent);
++ } else {
+ ret = cti_disable(drvdata->csdev);
++ if (!ret)
++ pm_runtime_put(dev->parent);
++ }
++
+ if (ret)
+ return ret;
+ return size;
+--
+2.39.2
+
--- /dev/null
+From c644041ab22b293bf31fa0dce2f8e0f702827caa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Jan 2023 11:07:34 +0000
+Subject: coresight: cti: Prevent negative values of enable count
+
+From: James Clark <james.clark@arm.com>
+
+[ Upstream commit 3244fb6dbbf1ffc114cdf382cc167bdd8c18088a ]
+
+Writing 0 to the enable control repeatedly results in a negative value
+for enable_req_count. After this, writing 1 to the enable control
+appears to not work until the count returns to positive.
+
+Change it so that it's impossible for enable_req_count to be < 0.
+Return an error to indicate that the disable request was invalid.
+
+Fixes: 835d722ba10a ("coresight: cti: Initial CoreSight CTI Driver")
+Tested-by: Jinlong Mao <quic_jinlmao@quicinc.com>
+Signed-off-by: James Clark <james.clark@arm.com>
+Reviewed-by: Mike Leach <mike.leach@linaro.org>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Link: https://lore.kernel.org/r/20230110110736.2709917-2-james.clark@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/coresight/coresight-cti-core.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/hwtracing/coresight/coresight-cti-core.c b/drivers/hwtracing/coresight/coresight-cti-core.c
+index d2cf4f4848e1b..838872f2484d3 100644
+--- a/drivers/hwtracing/coresight/coresight-cti-core.c
++++ b/drivers/hwtracing/coresight/coresight-cti-core.c
+@@ -151,9 +151,16 @@ static int cti_disable_hw(struct cti_drvdata *drvdata)
+ {
+ struct cti_config *config = &drvdata->config;
+ struct coresight_device *csdev = drvdata->csdev;
++ int ret = 0;
+
+ spin_lock(&drvdata->spinlock);
+
++ /* don't allow negative refcounts, return an error */
++ if (!atomic_read(&drvdata->config.enable_req_count)) {
++ ret = -EINVAL;
++ goto cti_not_disabled;
++ }
++
+ /* check refcount - disable on 0 */
+ if (atomic_dec_return(&drvdata->config.enable_req_count) > 0)
+ goto cti_not_disabled;
+@@ -171,12 +178,12 @@ static int cti_disable_hw(struct cti_drvdata *drvdata)
+ coresight_disclaim_device_unlocked(csdev);
+ CS_LOCK(drvdata->base);
+ spin_unlock(&drvdata->spinlock);
+- return 0;
++ return ret;
+
+ /* not disabled this call */
+ cti_not_disabled:
+ spin_unlock(&drvdata->spinlock);
+- return 0;
++ return ret;
+ }
+
+ void cti_write_single_reg(struct cti_drvdata *drvdata, int offset, u32 value)
+--
+2.39.2
+
--- /dev/null
+From 4e25595ba3ae0b8eba3018e9db9e595bcefd2a85 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 14 Jan 2023 17:16:32 +0800
+Subject: coresight: etm4x: Fix accesses to TRCSEQRSTEVR and TRCSEQSTR
+
+From: Junhao He <hejunhao3@huawei.com>
+
+[ Upstream commit 589d928248b72f8377d45904a14bcf686aa8bbeb ]
+
+The TRCSEQRSTEVR and TRCSEQSTR registers are not implemented if the
+TRCIDR5.NUMSEQSTATE == 0. Skip accessing the registers in such cases.
+
+Fixes: 2e1cdfe184b5 ("coresight-etm4x: Adding CoreSight ETM4x driver")
+Signed-off-by: Junhao He <hejunhao3@huawei.com>
+Reviewed-by: Mike Leach <mike.leach@linaro.org>
+Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Link: https://lore.kernel.org/r/20230114091632.60095-1-hejunhao3@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../hwtracing/coresight/coresight-etm4x-core.c | 18 ++++++++++++------
+ 1 file changed, 12 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c
+index 1cc052979e016..77bca6932f017 100644
+--- a/drivers/hwtracing/coresight/coresight-etm4x-core.c
++++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c
+@@ -427,8 +427,10 @@ static int etm4_enable_hw(struct etmv4_drvdata *drvdata)
+ etm4x_relaxed_write32(csa, config->vipcssctlr, TRCVIPCSSCTLR);
+ for (i = 0; i < drvdata->nrseqstate - 1; i++)
+ etm4x_relaxed_write32(csa, config->seq_ctrl[i], TRCSEQEVRn(i));
+- etm4x_relaxed_write32(csa, config->seq_rst, TRCSEQRSTEVR);
+- etm4x_relaxed_write32(csa, config->seq_state, TRCSEQSTR);
++ if (drvdata->nrseqstate) {
++ etm4x_relaxed_write32(csa, config->seq_rst, TRCSEQRSTEVR);
++ etm4x_relaxed_write32(csa, config->seq_state, TRCSEQSTR);
++ }
+ etm4x_relaxed_write32(csa, config->ext_inp, TRCEXTINSELR);
+ for (i = 0; i < drvdata->nr_cntr; i++) {
+ etm4x_relaxed_write32(csa, config->cntrldvr[i], TRCCNTRLDVRn(i));
+@@ -1634,8 +1636,10 @@ static int __etm4_cpu_save(struct etmv4_drvdata *drvdata)
+ for (i = 0; i < drvdata->nrseqstate - 1; i++)
+ state->trcseqevr[i] = etm4x_read32(csa, TRCSEQEVRn(i));
+
+- state->trcseqrstevr = etm4x_read32(csa, TRCSEQRSTEVR);
+- state->trcseqstr = etm4x_read32(csa, TRCSEQSTR);
++ if (drvdata->nrseqstate) {
++ state->trcseqrstevr = etm4x_read32(csa, TRCSEQRSTEVR);
++ state->trcseqstr = etm4x_read32(csa, TRCSEQSTR);
++ }
+ state->trcextinselr = etm4x_read32(csa, TRCEXTINSELR);
+
+ for (i = 0; i < drvdata->nr_cntr; i++) {
+@@ -1763,8 +1767,10 @@ static void __etm4_cpu_restore(struct etmv4_drvdata *drvdata)
+ for (i = 0; i < drvdata->nrseqstate - 1; i++)
+ etm4x_relaxed_write32(csa, state->trcseqevr[i], TRCSEQEVRn(i));
+
+- etm4x_relaxed_write32(csa, state->trcseqrstevr, TRCSEQRSTEVR);
+- etm4x_relaxed_write32(csa, state->trcseqstr, TRCSEQSTR);
++ if (drvdata->nrseqstate) {
++ etm4x_relaxed_write32(csa, state->trcseqrstevr, TRCSEQRSTEVR);
++ etm4x_relaxed_write32(csa, state->trcseqstr, TRCSEQSTR);
++ }
+ etm4x_relaxed_write32(csa, state->trcextinselr, TRCEXTINSELR);
+
+ for (i = 0; i < drvdata->nr_cntr; i++) {
+--
+2.39.2
+
--- /dev/null
+From 7d6aba9bfda786b822f6de431e2cd8e46c663606 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Feb 2023 10:26:54 +0100
+Subject: cpufreq: davinci: Fix clk use after free
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit 5d8f384a9b4fc50f6a18405f1c08e5a87a77b5b3 ]
+
+The remove function first frees the clks and only then calls
+cpufreq_unregister_driver(). If one of the cpufreq callbacks is called
+just before cpufreq_unregister_driver() is run, the freed clks might be
+used.
+
+Fixes: 6601b8030de3 ("davinci: add generic CPUFreq driver for DaVinci")
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/davinci-cpufreq.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/cpufreq/davinci-cpufreq.c b/drivers/cpufreq/davinci-cpufreq.c
+index 9e97f60f81996..ebb3a81026816 100644
+--- a/drivers/cpufreq/davinci-cpufreq.c
++++ b/drivers/cpufreq/davinci-cpufreq.c
+@@ -133,12 +133,14 @@ static int __init davinci_cpufreq_probe(struct platform_device *pdev)
+
+ static int __exit davinci_cpufreq_remove(struct platform_device *pdev)
+ {
++ cpufreq_unregister_driver(&davinci_driver);
++
+ clk_put(cpufreq.armclk);
+
+ if (cpufreq.asyncclk)
+ clk_put(cpufreq.asyncclk);
+
+- return cpufreq_unregister_driver(&davinci_driver);
++ return 0;
+ }
+
+ static struct platform_driver davinci_cpufreq_driver = {
+--
+2.39.2
+
--- /dev/null
+From c4329e5235e077c4e0cbf7fbc45d9d090c03cb4d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Jan 2023 16:08:30 +0100
+Subject: cpuidle: drivers: firmware: psci: Dont instrument suspend code
+
+From: Mark Rutland <mark.rutland@arm.com>
+
+[ Upstream commit 393e2ea30aec634b37004d401863428e120d5e1b ]
+
+The PSCI suspend code is currently instrumentable, which is not safe as
+instrumentation (e.g. ftrace) may try to make use of RCU during idle
+periods when RCU is not watching.
+
+To fix this we need to ensure that psci_suspend_finisher() and anything
+it calls are not instrumented. We can do this fairly simply by marking
+psci_suspend_finisher() and the psci*_cpu_suspend() functions as
+noinstr, and the underlying helper functions as __always_inline.
+
+When CONFIG_DEBUG_VIRTUAL=y, __pa_symbol() can expand to an out-of-line
+instrumented function, so we must use __pa_symbol_nodebug() within
+psci_suspend_finisher().
+
+The raw SMCCC invocation functions are written in assembly, and are not
+subject to compiler instrumentation.
+
+Signed-off-by: Mark Rutland <mark.rutland@arm.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Link: https://lore.kernel.org/r/20230126151323.349423061@infradead.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/psci/psci.c | 31 +++++++++++++++++++------------
+ 1 file changed, 19 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/firmware/psci/psci.c b/drivers/firmware/psci/psci.c
+index 447ee4ea5c903..f78249fe2512a 100644
+--- a/drivers/firmware/psci/psci.c
++++ b/drivers/firmware/psci/psci.c
+@@ -108,9 +108,10 @@ bool psci_power_state_is_valid(u32 state)
+ return !(state & ~valid_mask);
+ }
+
+-static unsigned long __invoke_psci_fn_hvc(unsigned long function_id,
+- unsigned long arg0, unsigned long arg1,
+- unsigned long arg2)
++static __always_inline unsigned long
++__invoke_psci_fn_hvc(unsigned long function_id,
++ unsigned long arg0, unsigned long arg1,
++ unsigned long arg2)
+ {
+ struct arm_smccc_res res;
+
+@@ -118,9 +119,10 @@ static unsigned long __invoke_psci_fn_hvc(unsigned long function_id,
+ return res.a0;
+ }
+
+-static unsigned long __invoke_psci_fn_smc(unsigned long function_id,
+- unsigned long arg0, unsigned long arg1,
+- unsigned long arg2)
++static __always_inline unsigned long
++__invoke_psci_fn_smc(unsigned long function_id,
++ unsigned long arg0, unsigned long arg1,
++ unsigned long arg2)
+ {
+ struct arm_smccc_res res;
+
+@@ -128,7 +130,7 @@ static unsigned long __invoke_psci_fn_smc(unsigned long function_id,
+ return res.a0;
+ }
+
+-static int psci_to_linux_errno(int errno)
++static __always_inline int psci_to_linux_errno(int errno)
+ {
+ switch (errno) {
+ case PSCI_RET_SUCCESS:
+@@ -169,7 +171,8 @@ int psci_set_osi_mode(bool enable)
+ return psci_to_linux_errno(err);
+ }
+
+-static int __psci_cpu_suspend(u32 fn, u32 state, unsigned long entry_point)
++static __always_inline int
++__psci_cpu_suspend(u32 fn, u32 state, unsigned long entry_point)
+ {
+ int err;
+
+@@ -177,13 +180,15 @@ static int __psci_cpu_suspend(u32 fn, u32 state, unsigned long entry_point)
+ return psci_to_linux_errno(err);
+ }
+
+-static int psci_0_1_cpu_suspend(u32 state, unsigned long entry_point)
++static __always_inline int
++psci_0_1_cpu_suspend(u32 state, unsigned long entry_point)
+ {
+ return __psci_cpu_suspend(psci_0_1_function_ids.cpu_suspend,
+ state, entry_point);
+ }
+
+-static int psci_0_2_cpu_suspend(u32 state, unsigned long entry_point)
++static __always_inline int
++psci_0_2_cpu_suspend(u32 state, unsigned long entry_point)
+ {
+ return __psci_cpu_suspend(PSCI_FN_NATIVE(0_2, CPU_SUSPEND),
+ state, entry_point);
+@@ -450,10 +455,12 @@ late_initcall(psci_debugfs_init)
+ #endif
+
+ #ifdef CONFIG_CPU_IDLE
+-static int psci_suspend_finisher(unsigned long state)
++static noinstr int psci_suspend_finisher(unsigned long state)
+ {
+ u32 power_state = state;
+- phys_addr_t pa_cpu_resume = __pa_symbol(cpu_resume);
++ phys_addr_t pa_cpu_resume;
++
++ pa_cpu_resume = __pa_symbol_nodebug((unsigned long)cpu_resume);
+
+ return psci_ops.cpu_suspend(power_state, pa_cpu_resume);
+ }
+--
+2.39.2
+
--- /dev/null
+From 0558144d79b9f95146517a0e61cc2787ed81509a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Jan 2023 20:43:33 +0100
+Subject: cpuidle, intel_idle: Fix CPUIDLE_FLAG_INIT_XSTATE
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+[ Upstream commit 821ad23d0eaff73ef599ece39ecc77482df20a8c ]
+
+Fix instrumentation bugs objtool found:
+
+ vmlinux.o: warning: objtool: intel_idle_s2idle+0xd5: call to fpu_idle_fpregs() leaves .noinstr.text section
+ vmlinux.o: warning: objtool: intel_idle_xstate+0x11: call to fpu_idle_fpregs() leaves .noinstr.text section
+ vmlinux.o: warning: objtool: fpu_idle_fpregs+0x9: call to xfeatures_in_use() leaves .noinstr.text section
+
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Tested-by: Tony Lindgren <tony@atomide.com>
+Tested-by: Ulf Hansson <ulf.hansson@linaro.org>
+Acked-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Acked-by: Frederic Weisbecker <frederic@kernel.org>
+Link: https://lore.kernel.org/r/20230112195540.494977795@infradead.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/include/asm/fpu/xcr.h | 4 ++--
+ arch/x86/include/asm/special_insns.h | 2 +-
+ arch/x86/kernel/fpu/core.c | 4 ++--
+ 3 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/arch/x86/include/asm/fpu/xcr.h b/arch/x86/include/asm/fpu/xcr.h
+index 9656a5bc6feae..9a710c0604457 100644
+--- a/arch/x86/include/asm/fpu/xcr.h
++++ b/arch/x86/include/asm/fpu/xcr.h
+@@ -5,7 +5,7 @@
+ #define XCR_XFEATURE_ENABLED_MASK 0x00000000
+ #define XCR_XFEATURE_IN_USE_MASK 0x00000001
+
+-static inline u64 xgetbv(u32 index)
++static __always_inline u64 xgetbv(u32 index)
+ {
+ u32 eax, edx;
+
+@@ -27,7 +27,7 @@ static inline void xsetbv(u32 index, u64 value)
+ *
+ * Callers should check X86_FEATURE_XGETBV1.
+ */
+-static inline u64 xfeatures_in_use(void)
++static __always_inline u64 xfeatures_in_use(void)
+ {
+ return xgetbv(XCR_XFEATURE_IN_USE_MASK);
+ }
+diff --git a/arch/x86/include/asm/special_insns.h b/arch/x86/include/asm/special_insns.h
+index 35f709f619fb4..c2e322189f853 100644
+--- a/arch/x86/include/asm/special_insns.h
++++ b/arch/x86/include/asm/special_insns.h
+@@ -295,7 +295,7 @@ static inline int enqcmds(void __iomem *dst, const void *src)
+ return 0;
+ }
+
+-static inline void tile_release(void)
++static __always_inline void tile_release(void)
+ {
+ /*
+ * Instruction opcode for TILERELEASE; supported in binutils
+diff --git a/arch/x86/kernel/fpu/core.c b/arch/x86/kernel/fpu/core.c
+index 9baa89a8877d0..dccce58201b7c 100644
+--- a/arch/x86/kernel/fpu/core.c
++++ b/arch/x86/kernel/fpu/core.c
+@@ -853,12 +853,12 @@ int fpu__exception_code(struct fpu *fpu, int trap_nr)
+ * Initialize register state that may prevent from entering low-power idle.
+ * This function will be invoked from the cpuidle driver only when needed.
+ */
+-void fpu_idle_fpregs(void)
++noinstr void fpu_idle_fpregs(void)
+ {
+ /* Note: AMX_TILE being enabled implies XGETBV1 support */
+ if (cpu_feature_enabled(X86_FEATURE_AMX_TILE) &&
+ (xfeatures_in_use() & XFEATURE_MASK_XTILE)) {
+ tile_release();
+- fpregs_deactivate(¤t->thread.fpu);
++ __this_cpu_write(fpu_fpregs_owner_ctx, NULL);
+ }
+ }
+--
+2.39.2
+
--- /dev/null
+From 893c0fa8f592adbddb6fd286a0c6384ec909fadb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Jan 2023 20:43:32 +0100
+Subject: cpuidle, intel_idle: Fix CPUIDLE_FLAG_IRQ_ENABLE *again*
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+[ Upstream commit 6d9c7f51b1d9179bf7c3542267c656a934e8af23 ]
+
+So objtool found this bug:
+
+ vmlinux.o: warning: objtool: intel_idle_irq+0x10c: call to trace_hardirqs_off() leaves .noinstr.text section
+
+As per commit 32d4fd5751ea ("cpuidle,intel_idle: Fix CPUIDLE_FLAG_IRQ_ENABLE"):
+
+ "must not have tracing in idle functions"
+
+Clearly people can't read and tinker along until splat dissapears.
+This straight up reverts commit d295ad34f236 ("intel_idle: Fix false
+positive RCU splats due to incorrect hardirqs state").
+
+It doesn't re-introduce the problem because preceding patches fixed it
+properly.
+
+Fixes: d295ad34f236 ("intel_idle: Fix false positive RCU splats due to incorrect hardirqs state")
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Tested-by: Tony Lindgren <tony@atomide.com>
+Tested-by: Ulf Hansson <ulf.hansson@linaro.org>
+Acked-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Acked-by: Frederic Weisbecker <frederic@kernel.org>
+Link: https://lore.kernel.org/r/20230112195540.434302128@infradead.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/idle/intel_idle.c | 8 +-------
+ 1 file changed, 1 insertion(+), 7 deletions(-)
+
+diff --git a/drivers/idle/intel_idle.c b/drivers/idle/intel_idle.c
+index cfeb24d40d378..f060ac7376e69 100644
+--- a/drivers/idle/intel_idle.c
++++ b/drivers/idle/intel_idle.c
+@@ -168,13 +168,7 @@ static __cpuidle int intel_idle_irq(struct cpuidle_device *dev,
+
+ raw_local_irq_enable();
+ ret = __intel_idle(dev, drv, index);
+-
+- /*
+- * The lockdep hardirqs state may be changed to 'on' with timer
+- * tick interrupt followed by __do_softirq(). Use local_irq_disable()
+- * to keep the hardirqs state correct.
+- */
+- local_irq_disable();
++ raw_local_irq_disable();
+
+ return ret;
+ }
+--
+2.39.2
+
--- /dev/null
+From 071b37492dbeed97af3084199237e83b8c92abe3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Jan 2023 16:08:31 +0100
+Subject: cpuidle: lib/bug: Disable rcu_is_watching() during WARN/BUG
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+[ Upstream commit 5a5d7e9badd2cb8065db171961bd30bd3595e4b6 ]
+
+In order to avoid WARN/BUG from generating nested or even recursive
+warnings, force rcu_is_watching() true during
+WARN/lockdep_rcu_suspicious().
+
+Notably things like unwinding the stack can trigger rcu_dereference()
+warnings, which then triggers more unwinding which then triggers more
+warnings etc..
+
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Link: https://lore.kernel.org/r/20230126151323.408156109@infradead.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/context_tracking.h | 27 +++++++++++++++++++++++++++
+ kernel/locking/lockdep.c | 3 +++
+ kernel/panic.c | 5 +++++
+ lib/bug.c | 15 ++++++++++++++-
+ 4 files changed, 49 insertions(+), 1 deletion(-)
+
+diff --git a/include/linux/context_tracking.h b/include/linux/context_tracking.h
+index dcef4a9e4d63e..d4afa8508a806 100644
+--- a/include/linux/context_tracking.h
++++ b/include/linux/context_tracking.h
+@@ -130,9 +130,36 @@ static __always_inline unsigned long ct_state_inc(int incby)
+ return arch_atomic_add_return(incby, this_cpu_ptr(&context_tracking.state));
+ }
+
++static __always_inline bool warn_rcu_enter(void)
++{
++ bool ret = false;
++
++ /*
++ * Horrible hack to shut up recursive RCU isn't watching fail since
++ * lots of the actual reporting also relies on RCU.
++ */
++ preempt_disable_notrace();
++ if (rcu_dynticks_curr_cpu_in_eqs()) {
++ ret = true;
++ ct_state_inc(RCU_DYNTICKS_IDX);
++ }
++
++ return ret;
++}
++
++static __always_inline void warn_rcu_exit(bool rcu)
++{
++ if (rcu)
++ ct_state_inc(RCU_DYNTICKS_IDX);
++ preempt_enable_notrace();
++}
++
+ #else
+ static inline void ct_idle_enter(void) { }
+ static inline void ct_idle_exit(void) { }
++
++static __always_inline bool warn_rcu_enter(void) { return false; }
++static __always_inline void warn_rcu_exit(bool rcu) { }
+ #endif /* !CONFIG_CONTEXT_TRACKING_IDLE */
+
+ #endif
+diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c
+index e3375bc40dadc..50d4863974e7a 100644
+--- a/kernel/locking/lockdep.c
++++ b/kernel/locking/lockdep.c
+@@ -55,6 +55,7 @@
+ #include <linux/rcupdate.h>
+ #include <linux/kprobes.h>
+ #include <linux/lockdep.h>
++#include <linux/context_tracking.h>
+
+ #include <asm/sections.h>
+
+@@ -6555,6 +6556,7 @@ void lockdep_rcu_suspicious(const char *file, const int line, const char *s)
+ {
+ struct task_struct *curr = current;
+ int dl = READ_ONCE(debug_locks);
++ bool rcu = warn_rcu_enter();
+
+ /* Note: the following can be executed concurrently, so be careful. */
+ pr_warn("\n");
+@@ -6595,5 +6597,6 @@ void lockdep_rcu_suspicious(const char *file, const int line, const char *s)
+ lockdep_print_held_locks(curr);
+ pr_warn("\nstack backtrace:\n");
+ dump_stack();
++ warn_rcu_exit(rcu);
+ }
+ EXPORT_SYMBOL_GPL(lockdep_rcu_suspicious);
+diff --git a/kernel/panic.c b/kernel/panic.c
+index 463c9295bc28a..487f5b03bf835 100644
+--- a/kernel/panic.c
++++ b/kernel/panic.c
+@@ -34,6 +34,7 @@
+ #include <linux/ratelimit.h>
+ #include <linux/debugfs.h>
+ #include <linux/sysfs.h>
++#include <linux/context_tracking.h>
+ #include <trace/events/error_report.h>
+ #include <asm/sections.h>
+
+@@ -679,6 +680,7 @@ void __warn(const char *file, int line, void *caller, unsigned taint,
+ void warn_slowpath_fmt(const char *file, int line, unsigned taint,
+ const char *fmt, ...)
+ {
++ bool rcu = warn_rcu_enter();
+ struct warn_args args;
+
+ pr_warn(CUT_HERE);
+@@ -693,11 +695,13 @@ void warn_slowpath_fmt(const char *file, int line, unsigned taint,
+ va_start(args.args, fmt);
+ __warn(file, line, __builtin_return_address(0), taint, NULL, &args);
+ va_end(args.args);
++ warn_rcu_exit(rcu);
+ }
+ EXPORT_SYMBOL(warn_slowpath_fmt);
+ #else
+ void __warn_printk(const char *fmt, ...)
+ {
++ bool rcu = warn_rcu_enter();
+ va_list args;
+
+ pr_warn(CUT_HERE);
+@@ -705,6 +709,7 @@ void __warn_printk(const char *fmt, ...)
+ va_start(args, fmt);
+ vprintk(fmt, args);
+ va_end(args);
++ warn_rcu_exit(rcu);
+ }
+ EXPORT_SYMBOL(__warn_printk);
+ #endif
+diff --git a/lib/bug.c b/lib/bug.c
+index c223a2575b721..e0ff219899902 100644
+--- a/lib/bug.c
++++ b/lib/bug.c
+@@ -47,6 +47,7 @@
+ #include <linux/sched.h>
+ #include <linux/rculist.h>
+ #include <linux/ftrace.h>
++#include <linux/context_tracking.h>
+
+ extern struct bug_entry __start___bug_table[], __stop___bug_table[];
+
+@@ -153,7 +154,7 @@ struct bug_entry *find_bug(unsigned long bugaddr)
+ return module_find_bug(bugaddr);
+ }
+
+-enum bug_trap_type report_bug(unsigned long bugaddr, struct pt_regs *regs)
++static enum bug_trap_type __report_bug(unsigned long bugaddr, struct pt_regs *regs)
+ {
+ struct bug_entry *bug;
+ const char *file;
+@@ -209,6 +210,18 @@ enum bug_trap_type report_bug(unsigned long bugaddr, struct pt_regs *regs)
+ return BUG_TRAP_TYPE_BUG;
+ }
+
++enum bug_trap_type report_bug(unsigned long bugaddr, struct pt_regs *regs)
++{
++ enum bug_trap_type ret;
++ bool rcu = false;
++
++ rcu = warn_rcu_enter();
++ ret = __report_bug(bugaddr, regs);
++ warn_rcu_exit(rcu);
++
++ return ret;
++}
++
+ static void clear_once_table(struct bug_entry *start, struct bug_entry *end)
+ {
+ struct bug_entry *bug;
+--
+2.39.2
+
--- /dev/null
+From 8215a7736e6ddc3661b1807490c11542514df595 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Dec 2022 14:18:46 -0800
+Subject: crypto: ccp - Avoid page allocation failure warning for SEV_GET_ID2
+
+From: David Rientjes <rientjes@google.com>
+
+[ Upstream commit 91dfd98216d817ec5f1c55890bacb7b4fe9b068a ]
+
+For SEV_GET_ID2, the user provided length does not have a specified
+limitation because the length of the ID may change in the future. The
+kernel memory allocation, however, is implicitly limited to 4MB on x86 by
+the page allocator, otherwise the kzalloc() will fail.
+
+When this happens, it is best not to spam the kernel log with the warning.
+Simply fail the allocation and return ENOMEM to the user.
+
+Fixes: d6112ea0cb34 ("crypto: ccp - introduce SEV_GET_ID2 command")
+Reported-by: Andy Nguyen <theflow@google.com>
+Reported-by: Peter Gonda <pgonda@google.com>
+Suggested-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: David Rientjes <rientjes@google.com>
+Acked-by: Tom Lendacky <thomas.lendacky@amd.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/ccp/sev-dev.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/crypto/ccp/sev-dev.c b/drivers/crypto/ccp/sev-dev.c
+index 06fc7156c04f3..56998bc579d67 100644
+--- a/drivers/crypto/ccp/sev-dev.c
++++ b/drivers/crypto/ccp/sev-dev.c
+@@ -881,7 +881,14 @@ static int sev_ioctl_do_get_id2(struct sev_issue_cmd *argp)
+ input_address = (void __user *)input.address;
+
+ if (input.address && input.length) {
+- id_blob = kzalloc(input.length, GFP_KERNEL);
++ /*
++ * The length of the ID shouldn't be assumed by software since
++ * it may change in the future. The allocation size is limited
++ * to 1 << (PAGE_SHIFT + MAX_ORDER - 1) by the page allocator.
++ * If the allocation fails, simply return ENOMEM rather than
++ * warning in the kernel log.
++ */
++ id_blob = kzalloc(input.length, GFP_KERNEL | __GFP_NOWARN);
+ if (!id_blob)
+ return -ENOMEM;
+
+--
+2.39.2
+
--- /dev/null
+From 7fdc2caf6c3838340345bbc1ec30baa05ccbb481 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Jan 2023 10:15:02 +0800
+Subject: crypto: ccp - Failure on re-initialization due to duplicate sysfs
+ filename
+
+From: Koba Ko <koba.taiwan@gmail.com>
+
+[ Upstream commit 299bf602b3f92f1456aef59c6413591fb02e762a ]
+
+The following warning appears during the CCP module re-initialization:
+
+[ 140.965403] sysfs: cannot create duplicate filename
+'/devices/pci0000:00/0000:00:07.1/0000:03:00.2/dma/dma0chan0'
+[ 140.975736] CPU: 0 PID: 388 Comm: kworker/0:2 Kdump: loaded Not
+tainted 6.2.0-0.rc2.18.eln124.x86_64 #1
+[ 140.985185] Hardware name: HPE ProLiant DL325 Gen10/ProLiant DL325
+Gen10, BIOS A41 07/17/2020
+[ 140.993761] Workqueue: events work_for_cpu_fn
+[ 140.998151] Call Trace:
+[ 141.000613] <TASK>
+[ 141.002726] dump_stack_lvl+0x33/0x46
+[ 141.006415] sysfs_warn_dup.cold+0x17/0x23
+[ 141.010542] sysfs_create_dir_ns+0xba/0xd0
+[ 141.014670] kobject_add_internal+0xba/0x260
+[ 141.018970] kobject_add+0x81/0xb0
+[ 141.022395] device_add+0xdc/0x7e0
+[ 141.025822] ? complete_all+0x20/0x90
+[ 141.029510] __dma_async_device_channel_register+0xc9/0x130
+[ 141.035119] dma_async_device_register+0x19e/0x3b0
+[ 141.039943] ccp_dmaengine_register+0x334/0x3f0 [ccp]
+[ 141.045042] ccp5_init+0x662/0x6a0 [ccp]
+[ 141.049000] ? devm_kmalloc+0x40/0xd0
+[ 141.052688] ccp_dev_init+0xbb/0xf0 [ccp]
+[ 141.056732] ? __pci_set_master+0x56/0xd0
+[ 141.060768] sp_init+0x70/0x90 [ccp]
+[ 141.064377] sp_pci_probe+0x186/0x1b0 [ccp]
+[ 141.068596] local_pci_probe+0x41/0x80
+[ 141.072374] work_for_cpu_fn+0x16/0x20
+[ 141.076145] process_one_work+0x1c8/0x380
+[ 141.080181] worker_thread+0x1ab/0x380
+[ 141.083953] ? __pfx_worker_thread+0x10/0x10
+[ 141.088250] kthread+0xda/0x100
+[ 141.091413] ? __pfx_kthread+0x10/0x10
+[ 141.095185] ret_from_fork+0x2c/0x50
+[ 141.098788] </TASK>
+[ 141.100996] kobject_add_internal failed for dma0chan0 with -EEXIST,
+don't try to register things with the same name in the same directory.
+[ 141.113703] ccp 0000:03:00.2: ccp initialization failed
+
+The /dma/dma0chan0 sysfs file is not removed since dma_chan object
+has been released in ccp_dma_release() before releasing dma device.
+A correct procedure would be: release dma channels first => unregister
+dma device => release ccp dma object.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=216888
+Fixes: 68dbe80f5b51 ("crypto: ccp - Release dma channels before dmaengine unrgister")
+Tested-by: Vladis Dronov <vdronov@redhat.com>
+Signed-off-by: Koba Ko <koba.ko@canonical.com>
+Reviewed-by: Vladis Dronov <vdronov@redhat.com>
+Acked-by: Tom Lendacky <thomas.lendacky@amd.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/ccp/ccp-dmaengine.c | 21 +++++++++++++++++----
+ 1 file changed, 17 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/crypto/ccp/ccp-dmaengine.c b/drivers/crypto/ccp/ccp-dmaengine.c
+index 9f753cb4f5f18..b386a7063818b 100644
+--- a/drivers/crypto/ccp/ccp-dmaengine.c
++++ b/drivers/crypto/ccp/ccp-dmaengine.c
+@@ -642,14 +642,26 @@ static void ccp_dma_release(struct ccp_device *ccp)
+ chan = ccp->ccp_dma_chan + i;
+ dma_chan = &chan->dma_chan;
+
+- if (dma_chan->client_count)
+- dma_release_channel(dma_chan);
+-
+ tasklet_kill(&chan->cleanup_tasklet);
+ list_del_rcu(&dma_chan->device_node);
+ }
+ }
+
++static void ccp_dma_release_channels(struct ccp_device *ccp)
++{
++ struct ccp_dma_chan *chan;
++ struct dma_chan *dma_chan;
++ unsigned int i;
++
++ for (i = 0; i < ccp->cmd_q_count; i++) {
++ chan = ccp->ccp_dma_chan + i;
++ dma_chan = &chan->dma_chan;
++
++ if (dma_chan->client_count)
++ dma_release_channel(dma_chan);
++ }
++}
++
+ int ccp_dmaengine_register(struct ccp_device *ccp)
+ {
+ struct ccp_dma_chan *chan;
+@@ -770,8 +782,9 @@ void ccp_dmaengine_unregister(struct ccp_device *ccp)
+ if (!dmaengine)
+ return;
+
+- ccp_dma_release(ccp);
++ ccp_dma_release_channels(ccp);
+ dma_async_device_unregister(dma_dev);
++ ccp_dma_release(ccp);
+
+ kmem_cache_destroy(ccp->dma_desc_cache);
+ kmem_cache_destroy(ccp->dma_cmd_cache);
+--
+2.39.2
+
--- /dev/null
+From a7d3173fe0ab77c97b23a8e10e4f222b5d346ead Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Jan 2023 16:53:08 -0600
+Subject: crypto: ccp - Flush the SEV-ES TMR memory before giving it to
+ firmware
+
+From: Tom Lendacky <thomas.lendacky@amd.com>
+
+[ Upstream commit 46a334a98f585ef78d51d8f5736596887bdd7f54 ]
+
+Perform a cache flush on the SEV-ES TMR memory after allocation to prevent
+any possibility of the firmware encountering an error should dirty cache
+lines be present. Use clflush_cache_range() to flush the SEV-ES TMR memory.
+
+Fixes: 97f9ac3db661 ("crypto: ccp - Add support for SEV-ES to the PSP driver")
+Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/ccp/sev-dev.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/crypto/ccp/sev-dev.c b/drivers/crypto/ccp/sev-dev.c
+index 56998bc579d67..3e583f0324874 100644
+--- a/drivers/crypto/ccp/sev-dev.c
++++ b/drivers/crypto/ccp/sev-dev.c
+@@ -26,6 +26,7 @@
+ #include <linux/fs_struct.h>
+
+ #include <asm/smp.h>
++#include <asm/cacheflush.h>
+
+ #include "psp-dev.h"
+ #include "sev-dev.h"
+@@ -1334,7 +1335,10 @@ void sev_pci_init(void)
+
+ /* Obtain the TMR memory area for SEV-ES use */
+ sev_es_tmr = sev_fw_alloc(SEV_ES_TMR_SIZE);
+- if (!sev_es_tmr)
++ if (sev_es_tmr)
++ /* Must flush the cache before giving it to the firmware */
++ clflush_cache_range(sev_es_tmr, SEV_ES_TMR_SIZE);
++ else
+ dev_warn(sev->dev,
+ "SEV: TMR allocation failed, SEV-ES support unavailable\n");
+
+--
+2.39.2
+
--- /dev/null
+From fce6af9b87130b5b432b886ef6597a45ff4b9b74 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Feb 2023 14:01:53 +0800
+Subject: crypto: crypto4xx - Call dma_unmap_page when done
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+[ Upstream commit bcdda4301bdc4955d45f7e1ffefb6207967b067e ]
+
+In crypto4xx_cipher_done, we should be unmapping the dst page, not
+mapping it.
+
+This was flagged by a sparse warning about the unused addr variable.
+While we're at it, also fix a sparse warning regarding the unused
+ctx variable in crypto4xx_ahash_done (by actually using it).
+
+Fixes: 049359d65527 ("crypto: amcc - Add crypt4xx driver")
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Tested-by: Christian Lamparter <chunkeey@gmail.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/amcc/crypto4xx_core.c | 10 ++++------
+ 1 file changed, 4 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/crypto/amcc/crypto4xx_core.c b/drivers/crypto/amcc/crypto4xx_core.c
+index 280f4b0e71334..50dc783821b69 100644
+--- a/drivers/crypto/amcc/crypto4xx_core.c
++++ b/drivers/crypto/amcc/crypto4xx_core.c
+@@ -522,7 +522,6 @@ static void crypto4xx_cipher_done(struct crypto4xx_device *dev,
+ {
+ struct skcipher_request *req;
+ struct scatterlist *dst;
+- dma_addr_t addr;
+
+ req = skcipher_request_cast(pd_uinfo->async_req);
+
+@@ -531,8 +530,8 @@ static void crypto4xx_cipher_done(struct crypto4xx_device *dev,
+ req->cryptlen, req->dst);
+ } else {
+ dst = pd_uinfo->dest_va;
+- addr = dma_map_page(dev->core_dev->device, sg_page(dst),
+- dst->offset, dst->length, DMA_FROM_DEVICE);
++ dma_unmap_page(dev->core_dev->device, pd->dest, dst->length,
++ DMA_FROM_DEVICE);
+ }
+
+ if (pd_uinfo->sa_va->sa_command_0.bf.save_iv == SA_SAVE_IV) {
+@@ -557,10 +556,9 @@ static void crypto4xx_ahash_done(struct crypto4xx_device *dev,
+ struct ahash_request *ahash_req;
+
+ ahash_req = ahash_request_cast(pd_uinfo->async_req);
+- ctx = crypto_tfm_ctx(ahash_req->base.tfm);
++ ctx = crypto_ahash_ctx(crypto_ahash_reqtfm(ahash_req));
+
+- crypto4xx_copy_digest_to_dst(ahash_req->result, pd_uinfo,
+- crypto_tfm_ctx(ahash_req->base.tfm));
++ crypto4xx_copy_digest_to_dst(ahash_req->result, pd_uinfo, ctx);
+ crypto4xx_ret_sg_desc(dev, pd_uinfo);
+
+ if (pd_uinfo->state & PD_ENTRY_BUSY)
+--
+2.39.2
+
--- /dev/null
+From 300b14a4a412c607117c6d49a86d148913b9c678 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Jan 2023 18:24:09 +0800
+Subject: crypto: essiv - Handle EBUSY correctly
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+[ Upstream commit b5a772adf45a32c68bef28e60621f12617161556 ]
+
+As it is essiv only handles the special return value of EINPROGERSS,
+which means that in all other cases it will free data related to the
+request.
+
+However, as the caller of essiv may specify MAY_BACKLOG, we also need
+to expect EBUSY and treat it in the same way. Otherwise backlogged
+requests will trigger a use-after-free.
+
+Fixes: be1eb7f78aa8 ("crypto: essiv - create wrapper template...")
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Acked-by: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/essiv.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/crypto/essiv.c b/crypto/essiv.c
+index e33369df90344..307eba74b901e 100644
+--- a/crypto/essiv.c
++++ b/crypto/essiv.c
+@@ -171,7 +171,12 @@ static void essiv_aead_done(struct crypto_async_request *areq, int err)
+ struct aead_request *req = areq->data;
+ struct essiv_aead_request_ctx *rctx = aead_request_ctx(req);
+
++ if (err == -EINPROGRESS)
++ goto out;
++
+ kfree(rctx->assoc);
++
++out:
+ aead_request_complete(req, err);
+ }
+
+@@ -247,7 +252,7 @@ static int essiv_aead_crypt(struct aead_request *req, bool enc)
+ err = enc ? crypto_aead_encrypt(subreq) :
+ crypto_aead_decrypt(subreq);
+
+- if (rctx->assoc && err != -EINPROGRESS)
++ if (rctx->assoc && err != -EINPROGRESS && err != -EBUSY)
+ kfree(rctx->assoc);
+ return err;
+ }
+--
+2.39.2
+
--- /dev/null
+From 547bc7e3370ad6857835a684d0c45ad33d8af1eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Jan 2023 20:19:48 -0800
+Subject: crypto: hisilicon: Wipe entire pool on error
+
+From: Kees Cook <keescook@chromium.org>
+
+[ Upstream commit aa85923a954e7704bc9d3847dabeb8540aa98d13 ]
+
+To work around a Clang __builtin_object_size bug that shows up under
+CONFIG_FORTIFY_SOURCE and UBSAN_BOUNDS, move the per-loop-iteration
+mem_block wipe into a single wipe of the entire pool structure after
+the loop.
+
+Reported-by: Nathan Chancellor <nathan@kernel.org>
+Link: https://github.com/ClangBuiltLinux/linux/issues/1780
+Cc: Weili Qian <qianweili@huawei.com>
+Cc: Zhou Wang <wangzhou1@hisilicon.com>
+Cc: Herbert Xu <herbert@gondor.apana.org.au>
+Cc: "David S. Miller" <davem@davemloft.net>
+Cc: linux-crypto@vger.kernel.org
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Tested-by: Nathan Chancellor <nathan@kernel.org> # build
+Link: https://lore.kernel.org/r/20230106041945.never.831-kees@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/hisilicon/sgl.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/crypto/hisilicon/sgl.c b/drivers/crypto/hisilicon/sgl.c
+index 2b6f2281cfd6c..0974b00414050 100644
+--- a/drivers/crypto/hisilicon/sgl.c
++++ b/drivers/crypto/hisilicon/sgl.c
+@@ -124,9 +124,8 @@ struct hisi_acc_sgl_pool *hisi_acc_create_sgl_pool(struct device *dev,
+ for (j = 0; j < i; j++) {
+ dma_free_coherent(dev, block_size, block[j].sgl,
+ block[j].sgl_dma);
+- memset(block + j, 0, sizeof(*block));
+ }
+- kfree(pool);
++ kfree_sensitive(pool);
+ return ERR_PTR(-ENOMEM);
+ }
+ EXPORT_SYMBOL_GPL(hisi_acc_create_sgl_pool);
+--
+2.39.2
+
--- /dev/null
+From 4b7f0a504277be4d0d542830a004173be208bf57 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Feb 2023 13:18:50 +0800
+Subject: crypto: octeontx2 - Fix objects shared between several modules
+
+From: Alexander Lobakin <alobakin@pm.me>
+
+[ Upstream commit 72bc4e71dbeedee0a446bcbc37c9bb25449072b7 ]
+
+cn10k_cpt.o, otx2_cptlf.o and otx2_cpt_mbox_common.o are linked
+into both rvu_cptpf and rvu_cptvf modules:
+
+> scripts/Makefile.build:252: ./drivers/crypto/marvell/octeontx2/Makefile:
+> cn10k_cpt.o is added to multiple modules: rvu_cptpf rvu_cptvf
+> scripts/Makefile.build:252: ./drivers/crypto/marvell/octeontx2/Makefile:
+> otx2_cptlf.o is added to multiple modules: rvu_cptpf rvu_cptvf
+> scripts/Makefile.build:252: ./drivers/crypto/marvell/octeontx2/Makefile:
+> otx2_cpt_mbox_common.o is added to multiple modules: rvu_cptpf rvu_cptvf
+
+Despite they're build under the same Kconfig option
+(CONFIG_CRYPTO_DEV_OCTEONTX2_CPT), it's better do link the common
+code into a standalone module and export the shared functions. Under
+certain circumstances, this can lead to the same situation as fixed
+by commit 637a642f5ca5 ("zstd: Fixing mixed module-builtin objects").
+Plus, those three common object files are relatively big to duplicate
+them several times.
+
+Introduce the new module, rvu_cptcommon, to provide the common
+functions to both modules.
+
+Fixes: 19d8e8c7be15 ("crypto: octeontx2 - add virtual function driver support")
+Suggested-by: Masahiro Yamada <masahiroy@kernel.org>
+Signed-off-by: Alexander Lobakin <alobakin@pm.me>
+Reviewed-by: Masahiro Yamada <masahiroy@kernel.org>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/marvell/octeontx2/Makefile | 11 +++++------
+ drivers/crypto/marvell/octeontx2/cn10k_cpt.c | 9 +++++++--
+ drivers/crypto/marvell/octeontx2/cn10k_cpt.h | 2 --
+ drivers/crypto/marvell/octeontx2/otx2_cpt_common.h | 2 --
+ .../marvell/octeontx2/otx2_cpt_mbox_common.c | 14 ++++++++++++--
+ drivers/crypto/marvell/octeontx2/otx2_cptlf.c | 11 +++++++++++
+ drivers/crypto/marvell/octeontx2/otx2_cptpf_main.c | 2 ++
+ drivers/crypto/marvell/octeontx2/otx2_cptvf_main.c | 2 ++
+ 8 files changed, 39 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/crypto/marvell/octeontx2/Makefile b/drivers/crypto/marvell/octeontx2/Makefile
+index 965297e969546..f0f2942c1d278 100644
+--- a/drivers/crypto/marvell/octeontx2/Makefile
++++ b/drivers/crypto/marvell/octeontx2/Makefile
+@@ -1,11 +1,10 @@
+ # SPDX-License-Identifier: GPL-2.0-only
+-obj-$(CONFIG_CRYPTO_DEV_OCTEONTX2_CPT) += rvu_cptpf.o rvu_cptvf.o
++obj-$(CONFIG_CRYPTO_DEV_OCTEONTX2_CPT) += rvu_cptcommon.o rvu_cptpf.o rvu_cptvf.o
+
++rvu_cptcommon-objs := cn10k_cpt.o otx2_cptlf.o otx2_cpt_mbox_common.o
+ rvu_cptpf-objs := otx2_cptpf_main.o otx2_cptpf_mbox.o \
+- otx2_cpt_mbox_common.o otx2_cptpf_ucode.o otx2_cptlf.o \
+- cn10k_cpt.o otx2_cpt_devlink.o
+-rvu_cptvf-objs := otx2_cptvf_main.o otx2_cptvf_mbox.o otx2_cptlf.o \
+- otx2_cpt_mbox_common.o otx2_cptvf_reqmgr.o \
+- otx2_cptvf_algs.o cn10k_cpt.o
++ otx2_cptpf_ucode.o otx2_cpt_devlink.o
++rvu_cptvf-objs := otx2_cptvf_main.o otx2_cptvf_mbox.o \
++ otx2_cptvf_reqmgr.o otx2_cptvf_algs.o
+
+ ccflags-y += -I$(srctree)/drivers/net/ethernet/marvell/octeontx2/af
+diff --git a/drivers/crypto/marvell/octeontx2/cn10k_cpt.c b/drivers/crypto/marvell/octeontx2/cn10k_cpt.c
+index 1499ef75b5c22..93d22b3289919 100644
+--- a/drivers/crypto/marvell/octeontx2/cn10k_cpt.c
++++ b/drivers/crypto/marvell/octeontx2/cn10k_cpt.c
+@@ -7,6 +7,9 @@
+ #include "otx2_cptlf.h"
+ #include "cn10k_cpt.h"
+
++static void cn10k_cpt_send_cmd(union otx2_cpt_inst_s *cptinst, u32 insts_num,
++ struct otx2_cptlf_info *lf);
++
+ static struct cpt_hw_ops otx2_hw_ops = {
+ .send_cmd = otx2_cpt_send_cmd,
+ .cpt_get_compcode = otx2_cpt_get_compcode,
+@@ -19,8 +22,8 @@ static struct cpt_hw_ops cn10k_hw_ops = {
+ .cpt_get_uc_compcode = cn10k_cpt_get_uc_compcode,
+ };
+
+-void cn10k_cpt_send_cmd(union otx2_cpt_inst_s *cptinst, u32 insts_num,
+- struct otx2_cptlf_info *lf)
++static void cn10k_cpt_send_cmd(union otx2_cpt_inst_s *cptinst, u32 insts_num,
++ struct otx2_cptlf_info *lf)
+ {
+ void __iomem *lmtline = lf->lmtline;
+ u64 val = (lf->slot & 0x7FF);
+@@ -68,6 +71,7 @@ int cn10k_cptpf_lmtst_init(struct otx2_cptpf_dev *cptpf)
+
+ return 0;
+ }
++EXPORT_SYMBOL_NS_GPL(cn10k_cptpf_lmtst_init, CRYPTO_DEV_OCTEONTX2_CPT);
+
+ int cn10k_cptvf_lmtst_init(struct otx2_cptvf_dev *cptvf)
+ {
+@@ -91,3 +95,4 @@ int cn10k_cptvf_lmtst_init(struct otx2_cptvf_dev *cptvf)
+
+ return 0;
+ }
++EXPORT_SYMBOL_NS_GPL(cn10k_cptvf_lmtst_init, CRYPTO_DEV_OCTEONTX2_CPT);
+diff --git a/drivers/crypto/marvell/octeontx2/cn10k_cpt.h b/drivers/crypto/marvell/octeontx2/cn10k_cpt.h
+index c091392b47e0f..aaefc7e38e060 100644
+--- a/drivers/crypto/marvell/octeontx2/cn10k_cpt.h
++++ b/drivers/crypto/marvell/octeontx2/cn10k_cpt.h
+@@ -28,8 +28,6 @@ static inline u8 otx2_cpt_get_uc_compcode(union otx2_cpt_res_s *result)
+ return ((struct cn9k_cpt_res_s *)result)->uc_compcode;
+ }
+
+-void cn10k_cpt_send_cmd(union otx2_cpt_inst_s *cptinst, u32 insts_num,
+- struct otx2_cptlf_info *lf);
+ int cn10k_cptpf_lmtst_init(struct otx2_cptpf_dev *cptpf);
+ int cn10k_cptvf_lmtst_init(struct otx2_cptvf_dev *cptvf);
+
+diff --git a/drivers/crypto/marvell/octeontx2/otx2_cpt_common.h b/drivers/crypto/marvell/octeontx2/otx2_cpt_common.h
+index 5012b7e669f07..6019066a6451a 100644
+--- a/drivers/crypto/marvell/octeontx2/otx2_cpt_common.h
++++ b/drivers/crypto/marvell/octeontx2/otx2_cpt_common.h
+@@ -145,8 +145,6 @@ int otx2_cpt_send_mbox_msg(struct otx2_mbox *mbox, struct pci_dev *pdev);
+
+ int otx2_cpt_send_af_reg_requests(struct otx2_mbox *mbox,
+ struct pci_dev *pdev);
+-int otx2_cpt_add_read_af_reg(struct otx2_mbox *mbox, struct pci_dev *pdev,
+- u64 reg, u64 *val, int blkaddr);
+ int otx2_cpt_add_write_af_reg(struct otx2_mbox *mbox, struct pci_dev *pdev,
+ u64 reg, u64 val, int blkaddr);
+ int otx2_cpt_read_af_reg(struct otx2_mbox *mbox, struct pci_dev *pdev,
+diff --git a/drivers/crypto/marvell/octeontx2/otx2_cpt_mbox_common.c b/drivers/crypto/marvell/octeontx2/otx2_cpt_mbox_common.c
+index a317319696eff..115997475beb3 100644
+--- a/drivers/crypto/marvell/octeontx2/otx2_cpt_mbox_common.c
++++ b/drivers/crypto/marvell/octeontx2/otx2_cpt_mbox_common.c
+@@ -19,6 +19,7 @@ int otx2_cpt_send_mbox_msg(struct otx2_mbox *mbox, struct pci_dev *pdev)
+ }
+ return ret;
+ }
++EXPORT_SYMBOL_NS_GPL(otx2_cpt_send_mbox_msg, CRYPTO_DEV_OCTEONTX2_CPT);
+
+ int otx2_cpt_send_ready_msg(struct otx2_mbox *mbox, struct pci_dev *pdev)
+ {
+@@ -36,14 +37,17 @@ int otx2_cpt_send_ready_msg(struct otx2_mbox *mbox, struct pci_dev *pdev)
+
+ return otx2_cpt_send_mbox_msg(mbox, pdev);
+ }
++EXPORT_SYMBOL_NS_GPL(otx2_cpt_send_ready_msg, CRYPTO_DEV_OCTEONTX2_CPT);
+
+ int otx2_cpt_send_af_reg_requests(struct otx2_mbox *mbox, struct pci_dev *pdev)
+ {
+ return otx2_cpt_send_mbox_msg(mbox, pdev);
+ }
++EXPORT_SYMBOL_NS_GPL(otx2_cpt_send_af_reg_requests, CRYPTO_DEV_OCTEONTX2_CPT);
+
+-int otx2_cpt_add_read_af_reg(struct otx2_mbox *mbox, struct pci_dev *pdev,
+- u64 reg, u64 *val, int blkaddr)
++static int otx2_cpt_add_read_af_reg(struct otx2_mbox *mbox,
++ struct pci_dev *pdev, u64 reg,
++ u64 *val, int blkaddr)
+ {
+ struct cpt_rd_wr_reg_msg *reg_msg;
+
+@@ -91,6 +95,7 @@ int otx2_cpt_add_write_af_reg(struct otx2_mbox *mbox, struct pci_dev *pdev,
+
+ return 0;
+ }
++EXPORT_SYMBOL_NS_GPL(otx2_cpt_add_write_af_reg, CRYPTO_DEV_OCTEONTX2_CPT);
+
+ int otx2_cpt_read_af_reg(struct otx2_mbox *mbox, struct pci_dev *pdev,
+ u64 reg, u64 *val, int blkaddr)
+@@ -103,6 +108,7 @@ int otx2_cpt_read_af_reg(struct otx2_mbox *mbox, struct pci_dev *pdev,
+
+ return otx2_cpt_send_mbox_msg(mbox, pdev);
+ }
++EXPORT_SYMBOL_NS_GPL(otx2_cpt_read_af_reg, CRYPTO_DEV_OCTEONTX2_CPT);
+
+ int otx2_cpt_write_af_reg(struct otx2_mbox *mbox, struct pci_dev *pdev,
+ u64 reg, u64 val, int blkaddr)
+@@ -115,6 +121,7 @@ int otx2_cpt_write_af_reg(struct otx2_mbox *mbox, struct pci_dev *pdev,
+
+ return otx2_cpt_send_mbox_msg(mbox, pdev);
+ }
++EXPORT_SYMBOL_NS_GPL(otx2_cpt_write_af_reg, CRYPTO_DEV_OCTEONTX2_CPT);
+
+ int otx2_cpt_attach_rscrs_msg(struct otx2_cptlfs_info *lfs)
+ {
+@@ -170,6 +177,7 @@ int otx2_cpt_detach_rsrcs_msg(struct otx2_cptlfs_info *lfs)
+
+ return ret;
+ }
++EXPORT_SYMBOL_NS_GPL(otx2_cpt_detach_rsrcs_msg, CRYPTO_DEV_OCTEONTX2_CPT);
+
+ int otx2_cpt_msix_offset_msg(struct otx2_cptlfs_info *lfs)
+ {
+@@ -202,6 +210,7 @@ int otx2_cpt_msix_offset_msg(struct otx2_cptlfs_info *lfs)
+ }
+ return ret;
+ }
++EXPORT_SYMBOL_NS_GPL(otx2_cpt_msix_offset_msg, CRYPTO_DEV_OCTEONTX2_CPT);
+
+ int otx2_cpt_sync_mbox_msg(struct otx2_mbox *mbox)
+ {
+@@ -216,3 +225,4 @@ int otx2_cpt_sync_mbox_msg(struct otx2_mbox *mbox)
+
+ return otx2_mbox_check_rsp_msgs(mbox, 0);
+ }
++EXPORT_SYMBOL_NS_GPL(otx2_cpt_sync_mbox_msg, CRYPTO_DEV_OCTEONTX2_CPT);
+diff --git a/drivers/crypto/marvell/octeontx2/otx2_cptlf.c b/drivers/crypto/marvell/octeontx2/otx2_cptlf.c
+index c8350fcd60fab..71e5f79431afa 100644
+--- a/drivers/crypto/marvell/octeontx2/otx2_cptlf.c
++++ b/drivers/crypto/marvell/octeontx2/otx2_cptlf.c
+@@ -274,6 +274,8 @@ void otx2_cptlf_unregister_interrupts(struct otx2_cptlfs_info *lfs)
+ }
+ cptlf_disable_intrs(lfs);
+ }
++EXPORT_SYMBOL_NS_GPL(otx2_cptlf_unregister_interrupts,
++ CRYPTO_DEV_OCTEONTX2_CPT);
+
+ static int cptlf_do_register_interrrupts(struct otx2_cptlfs_info *lfs,
+ int lf_num, int irq_offset,
+@@ -321,6 +323,7 @@ int otx2_cptlf_register_interrupts(struct otx2_cptlfs_info *lfs)
+ otx2_cptlf_unregister_interrupts(lfs);
+ return ret;
+ }
++EXPORT_SYMBOL_NS_GPL(otx2_cptlf_register_interrupts, CRYPTO_DEV_OCTEONTX2_CPT);
+
+ void otx2_cptlf_free_irqs_affinity(struct otx2_cptlfs_info *lfs)
+ {
+@@ -334,6 +337,7 @@ void otx2_cptlf_free_irqs_affinity(struct otx2_cptlfs_info *lfs)
+ free_cpumask_var(lfs->lf[slot].affinity_mask);
+ }
+ }
++EXPORT_SYMBOL_NS_GPL(otx2_cptlf_free_irqs_affinity, CRYPTO_DEV_OCTEONTX2_CPT);
+
+ int otx2_cptlf_set_irqs_affinity(struct otx2_cptlfs_info *lfs)
+ {
+@@ -366,6 +370,7 @@ int otx2_cptlf_set_irqs_affinity(struct otx2_cptlfs_info *lfs)
+ otx2_cptlf_free_irqs_affinity(lfs);
+ return ret;
+ }
++EXPORT_SYMBOL_NS_GPL(otx2_cptlf_set_irqs_affinity, CRYPTO_DEV_OCTEONTX2_CPT);
+
+ int otx2_cptlf_init(struct otx2_cptlfs_info *lfs, u8 eng_grp_mask, int pri,
+ int lfs_num)
+@@ -422,6 +427,7 @@ int otx2_cptlf_init(struct otx2_cptlfs_info *lfs, u8 eng_grp_mask, int pri,
+ lfs->lfs_num = 0;
+ return ret;
+ }
++EXPORT_SYMBOL_NS_GPL(otx2_cptlf_init, CRYPTO_DEV_OCTEONTX2_CPT);
+
+ void otx2_cptlf_shutdown(struct otx2_cptlfs_info *lfs)
+ {
+@@ -431,3 +437,8 @@ void otx2_cptlf_shutdown(struct otx2_cptlfs_info *lfs)
+ /* Send request to detach LFs */
+ otx2_cpt_detach_rsrcs_msg(lfs);
+ }
++EXPORT_SYMBOL_NS_GPL(otx2_cptlf_shutdown, CRYPTO_DEV_OCTEONTX2_CPT);
++
++MODULE_AUTHOR("Marvell");
++MODULE_DESCRIPTION("Marvell RVU CPT Common module");
++MODULE_LICENSE("GPL");
+diff --git a/drivers/crypto/marvell/octeontx2/otx2_cptpf_main.c b/drivers/crypto/marvell/octeontx2/otx2_cptpf_main.c
+index a402ccfac5577..ddf6e913c1c45 100644
+--- a/drivers/crypto/marvell/octeontx2/otx2_cptpf_main.c
++++ b/drivers/crypto/marvell/octeontx2/otx2_cptpf_main.c
+@@ -831,6 +831,8 @@ static struct pci_driver otx2_cpt_pci_driver = {
+
+ module_pci_driver(otx2_cpt_pci_driver);
+
++MODULE_IMPORT_NS(CRYPTO_DEV_OCTEONTX2_CPT);
++
+ MODULE_AUTHOR("Marvell");
+ MODULE_DESCRIPTION(OTX2_CPT_DRV_STRING);
+ MODULE_LICENSE("GPL v2");
+diff --git a/drivers/crypto/marvell/octeontx2/otx2_cptvf_main.c b/drivers/crypto/marvell/octeontx2/otx2_cptvf_main.c
+index 3411e664cf50c..392e9fee05e81 100644
+--- a/drivers/crypto/marvell/octeontx2/otx2_cptvf_main.c
++++ b/drivers/crypto/marvell/octeontx2/otx2_cptvf_main.c
+@@ -429,6 +429,8 @@ static struct pci_driver otx2_cptvf_pci_driver = {
+
+ module_pci_driver(otx2_cptvf_pci_driver);
+
++MODULE_IMPORT_NS(CRYPTO_DEV_OCTEONTX2_CPT);
++
+ MODULE_AUTHOR("Marvell");
+ MODULE_DESCRIPTION("Marvell RVU CPT Virtual Function Driver");
+ MODULE_LICENSE("GPL v2");
+--
+2.39.2
+
--- /dev/null
+From d6be4630457c5df43738ca47ec85861596535a9f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Jan 2023 16:02:04 +0800
+Subject: crypto: rsa-pkcs1pad - Use akcipher_request_complete
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+[ Upstream commit 564cabc0ca0bdfa8f0fc1ae74b24d0a7554522c5 ]
+
+Use the akcipher_request_complete helper instead of calling the
+completion function directly. In fact the previous code was buggy
+in that EINPROGRESS was never passed back to the original caller.
+
+Fixes: 3d5b1ecdea6f ("crypto: rsa - RSA padding algorithm")
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/rsa-pkcs1pad.c | 34 +++++++++++++++-------------------
+ 1 file changed, 15 insertions(+), 19 deletions(-)
+
+diff --git a/crypto/rsa-pkcs1pad.c b/crypto/rsa-pkcs1pad.c
+index 6ee5b8a060c06..4e9d2244ee317 100644
+--- a/crypto/rsa-pkcs1pad.c
++++ b/crypto/rsa-pkcs1pad.c
+@@ -214,16 +214,14 @@ static void pkcs1pad_encrypt_sign_complete_cb(
+ struct crypto_async_request *child_async_req, int err)
+ {
+ struct akcipher_request *req = child_async_req->data;
+- struct crypto_async_request async_req;
+
+ if (err == -EINPROGRESS)
+- return;
++ goto out;
++
++ err = pkcs1pad_encrypt_sign_complete(req, err);
+
+- async_req.data = req->base.data;
+- async_req.tfm = crypto_akcipher_tfm(crypto_akcipher_reqtfm(req));
+- async_req.flags = child_async_req->flags;
+- req->base.complete(&async_req,
+- pkcs1pad_encrypt_sign_complete(req, err));
++out:
++ akcipher_request_complete(req, err);
+ }
+
+ static int pkcs1pad_encrypt(struct akcipher_request *req)
+@@ -332,15 +330,14 @@ static void pkcs1pad_decrypt_complete_cb(
+ struct crypto_async_request *child_async_req, int err)
+ {
+ struct akcipher_request *req = child_async_req->data;
+- struct crypto_async_request async_req;
+
+ if (err == -EINPROGRESS)
+- return;
++ goto out;
++
++ err = pkcs1pad_decrypt_complete(req, err);
+
+- async_req.data = req->base.data;
+- async_req.tfm = crypto_akcipher_tfm(crypto_akcipher_reqtfm(req));
+- async_req.flags = child_async_req->flags;
+- req->base.complete(&async_req, pkcs1pad_decrypt_complete(req, err));
++out:
++ akcipher_request_complete(req, err);
+ }
+
+ static int pkcs1pad_decrypt(struct akcipher_request *req)
+@@ -513,15 +510,14 @@ static void pkcs1pad_verify_complete_cb(
+ struct crypto_async_request *child_async_req, int err)
+ {
+ struct akcipher_request *req = child_async_req->data;
+- struct crypto_async_request async_req;
+
+ if (err == -EINPROGRESS)
+- return;
++ goto out;
+
+- async_req.data = req->base.data;
+- async_req.tfm = crypto_akcipher_tfm(crypto_akcipher_reqtfm(req));
+- async_req.flags = child_async_req->flags;
+- req->base.complete(&async_req, pkcs1pad_verify_complete(req, err));
++ err = pkcs1pad_verify_complete(req, err);
++
++out:
++ akcipher_request_complete(req, err);
+ }
+
+ /*
+--
+2.39.2
+
--- /dev/null
+From 3012e5fe0c059647081c48b9ce7cacade58e0e17 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Jan 2023 18:27:51 +0800
+Subject: crypto: seqiv - Handle EBUSY correctly
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+[ Upstream commit 32e62025e5e52fbe4812ef044759de7010b15dbc ]
+
+As it is seqiv only handles the special return value of EINPROGERSS,
+which means that in all other cases it will free data related to the
+request.
+
+However, as the caller of seqiv may specify MAY_BACKLOG, we also need
+to expect EBUSY and treat it in the same way. Otherwise backlogged
+requests will trigger a use-after-free.
+
+Fixes: 0a270321dbf9 ("[CRYPTO] seqiv: Add Sequence Number IV Generator")
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/seqiv.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/crypto/seqiv.c b/crypto/seqiv.c
+index 0899d527c2845..b1bcfe537daf1 100644
+--- a/crypto/seqiv.c
++++ b/crypto/seqiv.c
+@@ -23,7 +23,7 @@ static void seqiv_aead_encrypt_complete2(struct aead_request *req, int err)
+ struct aead_request *subreq = aead_request_ctx(req);
+ struct crypto_aead *geniv;
+
+- if (err == -EINPROGRESS)
++ if (err == -EINPROGRESS || err == -EBUSY)
+ return;
+
+ if (err)
+--
+2.39.2
+
--- /dev/null
+From 03afccce286a8de8f1c0038dc3df797664a4d2f3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Dec 2022 09:05:36 +0100
+Subject: crypto: ux500 - update debug config after ux500 cryp driver removal
+
+From: Lukas Bulwahn <lukas.bulwahn@gmail.com>
+
+[ Upstream commit 49bc6a7786b7d03eab6912a88d09a7991a32174e ]
+
+Commit 453de3eb08c4 ("crypto: ux500/cryp - delete driver") removes the
+config CRYPTO_DEV_UX500_CRYP, but leaves an obsolete reference in the
+dependencies of config CRYPTO_DEV_UX500_DEBUG.
+
+Remove that obsolete reference, and adjust the description while at it.
+
+Fixes: 453de3eb08c4 ("crypto: ux500/cryp - delete driver")
+Signed-off-by: Lukas Bulwahn <lukas.bulwahn@gmail.com>
+Acked-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/ux500/Kconfig | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/crypto/ux500/Kconfig b/drivers/crypto/ux500/Kconfig
+index dcbd7404768f1..ac89cd2de12a1 100644
+--- a/drivers/crypto/ux500/Kconfig
++++ b/drivers/crypto/ux500/Kconfig
+@@ -15,8 +15,7 @@ config CRYPTO_DEV_UX500_HASH
+ Depends on UX500/STM DMA if running in DMA mode.
+
+ config CRYPTO_DEV_UX500_DEBUG
+- bool "Activate ux500 platform debug-mode for crypto and hash block"
+- depends on CRYPTO_DEV_UX500_CRYP || CRYPTO_DEV_UX500_HASH
++ bool "Activate debug-mode for UX500 crypto driver for HASH block"
++ depends on CRYPTO_DEV_UX500_HASH
+ help
+- Say Y if you want to add debug prints to ux500_hash and
+- ux500_cryp devices.
++ Say Y if you want to add debug prints to ux500_hash devices.
+--
+2.39.2
+
--- /dev/null
+From 60283cce5be376cdad5e67472d991a143167adb9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Dec 2022 21:40:40 -0800
+Subject: crypto: x86/ghash - fix unaligned access in ghash_setkey()
+
+From: Eric Biggers <ebiggers@google.com>
+
+[ Upstream commit 116db2704c193fff6d73ea6c2219625f0c9bdfc8 ]
+
+The key can be unaligned, so use the unaligned memory access helpers.
+
+Fixes: 8ceee72808d1 ("crypto: ghash-clmulni-intel - use C implementation for setkey()")
+Signed-off-by: Eric Biggers <ebiggers@google.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/crypto/ghash-clmulni-intel_glue.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/x86/crypto/ghash-clmulni-intel_glue.c b/arch/x86/crypto/ghash-clmulni-intel_glue.c
+index 1f1a95f3dd0ca..c0ab0ff4af655 100644
+--- a/arch/x86/crypto/ghash-clmulni-intel_glue.c
++++ b/arch/x86/crypto/ghash-clmulni-intel_glue.c
+@@ -19,6 +19,7 @@
+ #include <crypto/internal/simd.h>
+ #include <asm/cpu_device_id.h>
+ #include <asm/simd.h>
++#include <asm/unaligned.h>
+
+ #define GHASH_BLOCK_SIZE 16
+ #define GHASH_DIGEST_SIZE 16
+@@ -54,15 +55,14 @@ static int ghash_setkey(struct crypto_shash *tfm,
+ const u8 *key, unsigned int keylen)
+ {
+ struct ghash_ctx *ctx = crypto_shash_ctx(tfm);
+- be128 *x = (be128 *)key;
+ u64 a, b;
+
+ if (keylen != GHASH_BLOCK_SIZE)
+ return -EINVAL;
+
+ /* perform multiplication by 'x' in GF(2^128) */
+- a = be64_to_cpu(x->a);
+- b = be64_to_cpu(x->b);
++ a = get_unaligned_be64(key);
++ b = get_unaligned_be64(key + 8);
+
+ ctx->shash.a = (b << 1) | (a >> 63);
+ ctx->shash.b = (a << 1) | (b >> 63);
+--
+2.39.2
+
--- /dev/null
+From 857d6f6d60325116ad76689e4f081b8a2186b75b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 22 Jan 2023 16:07:37 +0800
+Subject: crypto: xts - Handle EBUSY correctly
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+[ Upstream commit 51c082514c2dedf2711c99d93c196cc4eedceb40 ]
+
+As it is xts only handles the special return value of EINPROGRESS,
+which means that in all other cases it will free data related to the
+request.
+
+However, as the caller of xts may specify MAY_BACKLOG, we also need
+to expect EBUSY and treat it in the same way. Otherwise backlogged
+requests will trigger a use-after-free.
+
+Fixes: 8083b1bf8163 ("crypto: xts - add support for ciphertext stealing")
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Acked-by: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/xts.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/crypto/xts.c b/crypto/xts.c
+index 63c85b9e64e08..de6cbcf69bbd6 100644
+--- a/crypto/xts.c
++++ b/crypto/xts.c
+@@ -203,12 +203,12 @@ static void xts_encrypt_done(struct crypto_async_request *areq, int err)
+ if (!err) {
+ struct xts_request_ctx *rctx = skcipher_request_ctx(req);
+
+- rctx->subreq.base.flags &= ~CRYPTO_TFM_REQ_MAY_SLEEP;
++ rctx->subreq.base.flags &= CRYPTO_TFM_REQ_MAY_BACKLOG;
+ err = xts_xor_tweak_post(req, true);
+
+ if (!err && unlikely(req->cryptlen % XTS_BLOCK_SIZE)) {
+ err = xts_cts_final(req, crypto_skcipher_encrypt);
+- if (err == -EINPROGRESS)
++ if (err == -EINPROGRESS || err == -EBUSY)
+ return;
+ }
+ }
+@@ -223,12 +223,12 @@ static void xts_decrypt_done(struct crypto_async_request *areq, int err)
+ if (!err) {
+ struct xts_request_ctx *rctx = skcipher_request_ctx(req);
+
+- rctx->subreq.base.flags &= ~CRYPTO_TFM_REQ_MAY_SLEEP;
++ rctx->subreq.base.flags &= CRYPTO_TFM_REQ_MAY_BACKLOG;
+ err = xts_xor_tweak_post(req, false);
+
+ if (!err && unlikely(req->cryptlen % XTS_BLOCK_SIZE)) {
+ err = xts_cts_final(req, crypto_skcipher_decrypt);
+- if (err == -EINPROGRESS)
++ if (err == -EINPROGRESS || err == -EBUSY)
+ return;
+ }
+ }
+--
+2.39.2
+
--- /dev/null
+From 1b97ab6ad2566d72d7fb0909466de523f1565d51 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Feb 2023 18:38:06 +0200
+Subject: devlink: Fix TP_STRUCT_entry in trace of devlink health report
+
+From: Moshe Shemesh <moshe@nvidia.com>
+
+[ Upstream commit d0ab772c1f1558af84f3293a52e9e886e08e0754 ]
+
+Fix a bug in trace point definition for devlink health report, as
+TP_STRUCT_entry of reporter_name should get reporter_name and not msg.
+
+Note no fixes tag as this is a harmless bug as both reporter_name and
+msg are strings and TP_fast_assign for this entry is correct.
+
+Signed-off-by: Moshe Shemesh <moshe@nvidia.com>
+Reviewed-by: Jiri Pirko <jiri@nvidia.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/trace/events/devlink.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/trace/events/devlink.h b/include/trace/events/devlink.h
+index 24969184c5348..77ff7cfc6049a 100644
+--- a/include/trace/events/devlink.h
++++ b/include/trace/events/devlink.h
+@@ -88,7 +88,7 @@ TRACE_EVENT(devlink_health_report,
+ __string(bus_name, devlink_to_dev(devlink)->bus->name)
+ __string(dev_name, dev_name(devlink_to_dev(devlink)))
+ __string(driver_name, devlink_to_dev(devlink)->driver->name)
+- __string(reporter_name, msg)
++ __string(reporter_name, reporter_name)
+ __string(msg, msg)
+ ),
+
+--
+2.39.2
+
--- /dev/null
+From b5cd6f897c186e3f124c6517a1983662dd225ffc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Feb 2023 15:31:08 -0500
+Subject: dm cache: add cond_resched() to various workqueue loops
+
+From: Mike Snitzer <snitzer@kernel.org>
+
+[ Upstream commit 76227f6dc805e9e960128bcc6276647361e0827c ]
+
+Otherwise on resource constrained systems these workqueues may be too
+greedy.
+
+Signed-off-by: Mike Snitzer <snitzer@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/dm-cache-target.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c
+index 5e92fac90b675..17fde3e5a1f7b 100644
+--- a/drivers/md/dm-cache-target.c
++++ b/drivers/md/dm-cache-target.c
+@@ -1805,6 +1805,7 @@ static void process_deferred_bios(struct work_struct *ws)
+
+ else
+ commit_needed = process_bio(cache, bio) || commit_needed;
++ cond_resched();
+ }
+
+ if (commit_needed)
+@@ -1827,6 +1828,7 @@ static void requeue_deferred_bios(struct cache *cache)
+ while ((bio = bio_list_pop(&bios))) {
+ bio->bi_status = BLK_STS_DM_REQUEUE;
+ bio_endio(bio);
++ cond_resched();
+ }
+ }
+
+@@ -1867,6 +1869,8 @@ static void check_migrations(struct work_struct *ws)
+ r = mg_start(cache, op, NULL);
+ if (r)
+ break;
++
++ cond_resched();
+ }
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 532b9a20ec187359497de3abd95b061e18ce0b68 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Jan 2023 13:01:46 -0500
+Subject: dm: improve shrinker debug names
+
+From: Mike Snitzer <snitzer@kernel.org>
+
+[ Upstream commit c87791bcc455a91e51ca9800faaacc21c8d67785 ]
+
+Commit e33c267ab70d ("mm: shrinkers: provide shrinkers with names")
+chose some fairly bad names for DM's shrinkers.
+
+Fixes: e33c267ab70d ("mm: shrinkers: provide shrinkers with names")
+Signed-off-by : Mike Snitzer <snitzer@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/dm-bufio.c | 2 +-
+ drivers/md/dm-zoned-metadata.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c
+index bb786c39545ec..19caaf684ee34 100644
+--- a/drivers/md/dm-bufio.c
++++ b/drivers/md/dm-bufio.c
+@@ -1833,7 +1833,7 @@ struct dm_bufio_client *dm_bufio_client_create(struct block_device *bdev, unsign
+ c->shrinker.scan_objects = dm_bufio_shrink_scan;
+ c->shrinker.seeks = 1;
+ c->shrinker.batch = 0;
+- r = register_shrinker(&c->shrinker, "md-%s:(%u:%u)", slab_name,
++ r = register_shrinker(&c->shrinker, "dm-bufio:(%u:%u)",
+ MAJOR(bdev->bd_dev), MINOR(bdev->bd_dev));
+ if (r)
+ goto bad;
+diff --git a/drivers/md/dm-zoned-metadata.c b/drivers/md/dm-zoned-metadata.c
+index 0278482fac94a..c795ea7da7917 100644
+--- a/drivers/md/dm-zoned-metadata.c
++++ b/drivers/md/dm-zoned-metadata.c
+@@ -2945,7 +2945,7 @@ int dmz_ctr_metadata(struct dmz_dev *dev, int num_dev,
+ zmd->mblk_shrinker.seeks = DEFAULT_SEEKS;
+
+ /* Metadata cache shrinker */
+- ret = register_shrinker(&zmd->mblk_shrinker, "md-meta:(%u:%u)",
++ ret = register_shrinker(&zmd->mblk_shrinker, "dm-zoned-meta:(%u:%u)",
+ MAJOR(dev->bdev->bd_dev),
+ MINOR(dev->bdev->bd_dev));
+ if (ret) {
+--
+2.39.2
+
--- /dev/null
+From f30ccd148db854f9a1534c1e05e83ddb20a71f8e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Feb 2023 13:06:05 -0500
+Subject: dm: remove flush_scheduled_work() during local_exit()
+
+From: Mike Snitzer <snitzer@kernel.org>
+
+[ Upstream commit 0b22ff5360f5c4e11050b89206370fdf7dc0a226 ]
+
+Commit acfe0ad74d2e1 ("dm: allocate a special workqueue for deferred
+device removal") switched from using system workqueue to a single
+workqueue local to DM. But it didn't eliminate the call to
+flush_scheduled_work() that was introduced purely for the benefit of
+deferred device removal with commit 2c140a246dc ("dm: allow remove to
+be deferred").
+
+Since DM core uses its own workqueue (and queue_work) there is no need
+to call flush_scheduled_work() from local_exit(). local_exit()'s
+destroy_workqueue(deferred_remove_workqueue) handles flushing work
+started with queue_work().
+
+Fixes: acfe0ad74d2e1 ("dm: allocate a special workqueue for deferred device removal")
+Signed-off-by: Mike Snitzer <snitzer@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/dm.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/md/dm.c b/drivers/md/dm.c
+index b424a6ee27baf..eba9bc06856bf 100644
+--- a/drivers/md/dm.c
++++ b/drivers/md/dm.c
+@@ -231,7 +231,6 @@ static int __init local_init(void)
+
+ static void local_exit(void)
+ {
+- flush_scheduled_work();
+ destroy_workqueue(deferred_remove_workqueue);
+
+ unregister_blkdev(_major, _name);
+--
+2.39.2
+
--- /dev/null
+From 98df263b7d5002009490d9f77cc7218a90a371ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Feb 2023 15:29:44 -0500
+Subject: dm thin: add cond_resched() to various workqueue loops
+
+From: Mike Snitzer <snitzer@kernel.org>
+
+[ Upstream commit e4f80303c2353952e6e980b23914e4214487f2a6 ]
+
+Otherwise on resource constrained systems these workqueues may be too
+greedy.
+
+Signed-off-by: Mike Snitzer <snitzer@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/dm-thin.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
+index 64cfcf46881dc..e4c1a8a21bbd0 100644
+--- a/drivers/md/dm-thin.c
++++ b/drivers/md/dm-thin.c
+@@ -2207,6 +2207,7 @@ static void process_thin_deferred_bios(struct thin_c *tc)
+ throttle_work_update(&pool->throttle);
+ dm_pool_issue_prefetches(pool->pmd);
+ }
++ cond_resched();
+ }
+ blk_finish_plug(&plug);
+ }
+@@ -2289,6 +2290,7 @@ static void process_thin_deferred_cells(struct thin_c *tc)
+ else
+ pool->process_cell(tc, cell);
+ }
++ cond_resched();
+ } while (!list_empty(&cells));
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 2c8c5c5dfb89c1feae09a45e9d8e2eff26ecfb2a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Jan 2023 14:36:27 -0800
+Subject: dmaengine: dw-axi-dmac: Do not dereference NULL structure
+
+From: Kees Cook <keescook@chromium.org>
+
+[ Upstream commit be4d46edeee4b2459d2f53f37ada88bbfb634b6c ]
+
+If "vdesc" is NULL, it cannot be used with vd_to_axi_desc(). Leave
+"bytes" unchanged at 0. Seen under GCC 13 with -Warray-bounds:
+
+../drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c: In function 'dma_chan_tx_status':
+../drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c:329:46: warning: array subscript 0 is outside array bounds of 'struct
+virt_dma_desc[46116860184273879]' [-Warray-bounds=]
+ 329 | bytes = vd_to_axi_desc(vdesc)->length;
+ | ^~
+
+Fixes: 8e55444da65c ("dmaengine: dw-axi-dmac: Support burst residue granularity")
+Cc: Eugeniy Paltsev <Eugeniy.Paltsev@synopsys.com>
+Cc: Vinod Koul <vkoul@kernel.org>
+Cc: dmaengine@vger.kernel.org
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://lore.kernel.org/r/20230127223623.never.507-kees@kernel.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c b/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
+index bf85aa0979ecb..152c5d98524d7 100644
+--- a/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
++++ b/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
+@@ -325,8 +325,6 @@ dma_chan_tx_status(struct dma_chan *dchan, dma_cookie_t cookie,
+ len = vd_to_axi_desc(vdesc)->hw_desc[0].len;
+ completed_length = completed_blocks * len;
+ bytes = length - completed_length;
+- } else {
+- bytes = vd_to_axi_desc(vdesc)->length;
+ }
+
+ spin_unlock_irqrestore(&chan->vc.lock, flags);
+--
+2.39.2
+
--- /dev/null
+From 3327b6e785a6363a15a4d45eed5cda2a181384ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Jan 2023 20:13:46 +0300
+Subject: dmaengine: dw-edma: Fix missing src/dst address of interleaved xfers
+
+From: Serge Semin <Sergey.Semin@baikalelectronics.ru>
+
+[ Upstream commit 13b6299cf66165a442089fa895a7f70250703584 ]
+
+Interleaved DMA transfer support was added by 85e7518f42c8 ("dmaengine:
+dw-edma: Add device_prep_interleave_dma() support"), but depending on the
+selected channel, either source or destination address are left
+uninitialized which was obviously wrong.
+
+Initialize the destination address of the eDMA burst descriptors for
+DEV_TO_MEM interleaved operations and the source address for MEM_TO_DEV
+operations.
+
+Link: https://lore.kernel.org/r/20230113171409.30470-5-Sergey.Semin@baikalelectronics.ru
+Fixes: 85e7518f42c8 ("dmaengine: dw-edma: Add device_prep_interleave_dma() support")
+Tested-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Signed-off-by: Serge Semin <Sergey.Semin@baikalelectronics.ru>
+Signed-off-by: Lorenzo Pieralisi <lpieralisi@kernel.org>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Acked-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/dw-edma/dw-edma-core.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/dma/dw-edma/dw-edma-core.c b/drivers/dma/dw-edma/dw-edma-core.c
+index c54b24ff5206a..52bdf04aff511 100644
+--- a/drivers/dma/dw-edma/dw-edma-core.c
++++ b/drivers/dma/dw-edma/dw-edma-core.c
+@@ -455,6 +455,8 @@ dw_edma_device_transfer(struct dw_edma_transfer *xfer)
+ * and destination addresses are increased
+ * by the same portion (data length)
+ */
++ } else if (xfer->type == EDMA_XFER_INTERLEAVED) {
++ burst->dar = dst_addr;
+ }
+ } else {
+ burst->dar = dst_addr;
+@@ -470,6 +472,8 @@ dw_edma_device_transfer(struct dw_edma_transfer *xfer)
+ * and destination addresses are increased
+ * by the same portion (data length)
+ */
++ } else if (xfer->type == EDMA_XFER_INTERLEAVED) {
++ burst->sar = src_addr;
+ }
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 00b2519e32b4fd6b4c164b3a9300279194b5a1e9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Jan 2023 18:19:00 +0300
+Subject: dmaengine: dw-edma: Fix readq_ch() return value truncation
+
+From: Serge Semin <Sergey.Semin@baikalelectronics.ru>
+
+[ Upstream commit 5fdca4a995bcd4cf61bda40af154a730589dc524 ]
+
+Previously, readq_ch() did a 64-bit readq(), but truncated the result by
+storing it in the u32 "value". Change "value" to u64 to avoid the
+truncation.
+
+Note: the method is currently unused, so the bug hasn't caused any problem
+so far.
+
+Fixes: 04e0a39fc10f ("dmaengine: dw-edma: Add writeq() and readq() for 64 bits architectures")
+Signed-off-by: Serge Semin <Sergey.Semin@baikalelectronics.ru>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/dw-edma/dw-edma-v0-core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/dma/dw-edma/dw-edma-v0-core.c b/drivers/dma/dw-edma/dw-edma-v0-core.c
+index 77e6cfe52e0a3..a3816ba632851 100644
+--- a/drivers/dma/dw-edma/dw-edma-v0-core.c
++++ b/drivers/dma/dw-edma/dw-edma-v0-core.c
+@@ -192,7 +192,7 @@ static inline void writeq_ch(struct dw_edma *dw, enum dw_edma_dir dir, u16 ch,
+ static inline u64 readq_ch(struct dw_edma *dw, enum dw_edma_dir dir, u16 ch,
+ const void __iomem *addr)
+ {
+- u32 value;
++ u64 value;
+
+ if (dw->chip->mf == EDMA_MF_EDMA_LEGACY) {
+ u32 viewport_sel;
+--
+2.39.2
+
--- /dev/null
+From 13ef55f6037b30e6f8602f150d735d265e828145 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Nov 2022 16:23:53 +0100
+Subject: dmaengine: HISI_DMA should depend on ARCH_HISI
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit dcca9d045c0852584ad092123c7f6e6526a633b1 ]
+
+The HiSilicon DMA Engine is only present on HiSilicon SoCs. Hence add a
+dependency on ARCH_HISI, to prevent asking the user about this driver
+when configuring a kernel without HiSilicon SoC support.
+
+Fixes: e9f08b65250d73ab ("dmaengine: hisilicon: Add Kunpeng DMA engine support")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/363a1816d36cd3cf604d88ec90f97c75f604de64.1669044190.git.geert+renesas@glider.be
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/dma/Kconfig b/drivers/dma/Kconfig
+index b6d48d54f42fc..7b95f07c6f1af 100644
+--- a/drivers/dma/Kconfig
++++ b/drivers/dma/Kconfig
+@@ -245,7 +245,7 @@ config FSL_RAID
+
+ config HISI_DMA
+ tristate "HiSilicon DMA Engine support"
+- depends on ARM64 || COMPILE_TEST
++ depends on ARCH_HISI || COMPILE_TEST
+ depends on PCI_MSI
+ select DMA_ENGINE
+ select DMA_VIRTUAL_CHANNELS
+--
+2.39.2
+
--- /dev/null
+From a902de39a2379fb235f157228c88f74e79a67ee1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Dec 2022 09:21:41 -0800
+Subject: dmaengine: idxd: Set traffic class values in GRPCFG on DSA 2.0
+
+From: Fenghua Yu <fenghua.yu@intel.com>
+
+[ Upstream commit 9735bde36487da43d3c3fc910df49639f72decbf ]
+
+On DSA/IAX 1.0, TC-A and TC-B in GRPCFG are set as 1 to have best
+performance and cannot be changed through sysfs knobs unless override
+option is given.
+
+The same values should be set on DSA 2.0 as well.
+
+Fixes: ea7c8f598c32 ("dmaengine: idxd: restore traffic class defaults after wq reset")
+Fixes: ade8a86b512c ("dmaengine: idxd: Set defaults for GRPCFG traffic class")
+Signed-off-by: Fenghua Yu <fenghua.yu@intel.com>
+Reviewed-by: Dave Jiang <dave.jiang@intel.com>
+Link: https://lore.kernel.org/r/20221209172141.562648-1-fenghua.yu@intel.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/idxd/device.c | 2 +-
+ drivers/dma/idxd/init.c | 2 +-
+ drivers/dma/idxd/sysfs.c | 4 ++--
+ 3 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/dma/idxd/device.c b/drivers/dma/idxd/device.c
+index 29dbb0f52e186..8b4573dc7ecc5 100644
+--- a/drivers/dma/idxd/device.c
++++ b/drivers/dma/idxd/device.c
+@@ -701,7 +701,7 @@ static void idxd_groups_clear_state(struct idxd_device *idxd)
+ group->use_rdbuf_limit = false;
+ group->rdbufs_allowed = 0;
+ group->rdbufs_reserved = 0;
+- if (idxd->hw.version < DEVICE_VERSION_2 && !tc_override) {
++ if (idxd->hw.version <= DEVICE_VERSION_2 && !tc_override) {
+ group->tc_a = 1;
+ group->tc_b = 1;
+ } else {
+diff --git a/drivers/dma/idxd/init.c b/drivers/dma/idxd/init.c
+index 529ea09c90940..e63b0c674d883 100644
+--- a/drivers/dma/idxd/init.c
++++ b/drivers/dma/idxd/init.c
+@@ -295,7 +295,7 @@ static int idxd_setup_groups(struct idxd_device *idxd)
+ }
+
+ idxd->groups[i] = group;
+- if (idxd->hw.version < DEVICE_VERSION_2 && !tc_override) {
++ if (idxd->hw.version <= DEVICE_VERSION_2 && !tc_override) {
+ group->tc_a = 1;
+ group->tc_b = 1;
+ } else {
+diff --git a/drivers/dma/idxd/sysfs.c b/drivers/dma/idxd/sysfs.c
+index 3229dfc786507..18cd8151dee02 100644
+--- a/drivers/dma/idxd/sysfs.c
++++ b/drivers/dma/idxd/sysfs.c
+@@ -387,7 +387,7 @@ static ssize_t group_traffic_class_a_store(struct device *dev,
+ if (idxd->state == IDXD_DEV_ENABLED)
+ return -EPERM;
+
+- if (idxd->hw.version < DEVICE_VERSION_2 && !tc_override)
++ if (idxd->hw.version <= DEVICE_VERSION_2 && !tc_override)
+ return -EPERM;
+
+ if (val < 0 || val > 7)
+@@ -429,7 +429,7 @@ static ssize_t group_traffic_class_b_store(struct device *dev,
+ if (idxd->state == IDXD_DEV_ENABLED)
+ return -EPERM;
+
+- if (idxd->hw.version < DEVICE_VERSION_2 && !tc_override)
++ if (idxd->hw.version <= DEVICE_VERSION_2 && !tc_override)
+ return -EPERM;
+
+ if (val < 0 || val > 7)
+--
+2.39.2
+
--- /dev/null
+From fcac1fadf17ac3d4c196de2c726930a61131f39e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Feb 2023 23:51:43 -0800
+Subject: dmaengine: ptdma: check for null desc before calling pt_cmd_callback
+
+From: Eric Pilmore <epilmore@gigaio.com>
+
+[ Upstream commit 928469986171a6f763b34b039427f5667ba3fd50 ]
+
+Resolves a panic that can occur on AMD systems, typically during host
+shutdown, after the PTDMA driver had been exercised. The issue was
+the pt_issue_pending() function is mistakenly assuming that there will
+be at least one descriptor in the Submitted queue when the function
+is called. However, it is possible that both the Submitted and Issued
+queues could be empty, which could result in pt_cmd_callback() being
+mistakenly called with a NULL pointer.
+Ref: Bugzilla Bug 216856.
+
+Fixes: 6fa7e0e836e2 ("dmaengine: ptdma: fix concurrency issue with multiple dma transfer")
+Signed-off-by: Eric Pilmore <epilmore@gigaio.com>
+Link: https://lore.kernel.org/r/20230210075142.58253-1-epilmore@gigaio.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/ptdma/ptdma-dmaengine.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/dma/ptdma/ptdma-dmaengine.c b/drivers/dma/ptdma/ptdma-dmaengine.c
+index cc22d162ce250..1aa65e5de0f3a 100644
+--- a/drivers/dma/ptdma/ptdma-dmaengine.c
++++ b/drivers/dma/ptdma/ptdma-dmaengine.c
+@@ -254,7 +254,7 @@ static void pt_issue_pending(struct dma_chan *dma_chan)
+ spin_unlock_irqrestore(&chan->vc.lock, flags);
+
+ /* If there was nothing active, start processing */
+- if (engine_is_idle)
++ if (engine_is_idle && desc)
+ pt_cmd_callback(desc, 0);
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 1f7a26b205375405d29a90fd1e3d2a731d0ed43c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Jan 2023 15:36:23 +0530
+Subject: dmaengine: sf-pdma: pdma_desc memory leak fix
+
+From: Shravan Chippa <shravan.chippa@microchip.com>
+
+[ Upstream commit b02e07015a5ac7bbc029da931ae17914b8ae0339 ]
+
+Commit b2cc5c465c2c ("dmaengine: sf-pdma: Add multithread support for a
+DMA channel") changed sf_pdma_prep_dma_memcpy() to unconditionally
+allocate a new sf_pdma_desc each time it is called.
+
+The driver previously recycled descs, by checking the in_use flag, only
+allocating additional descs if the existing one was in use. This logic
+was removed in commit b2cc5c465c2c ("dmaengine: sf-pdma: Add multithread
+support for a DMA channel"), but sf_pdma_free_desc() was not changed to
+handle the new behaviour.
+
+As a result, each time sf_pdma_prep_dma_memcpy() is called, the previous
+descriptor is leaked, over time leading to memory starvation:
+
+ unreferenced object 0xffffffe008447300 (size 192):
+ comm "irq/39-mchp_dsc", pid 343, jiffies 4294906910 (age 981.200s)
+ hex dump (first 32 bytes):
+ 00 00 00 ff 00 00 00 00 b8 c1 00 00 00 00 00 00 ................
+ 00 00 70 08 10 00 00 00 00 00 00 c0 00 00 00 00 ..p.............
+ backtrace:
+ [<00000000064a04f4>] kmemleak_alloc+0x1e/0x28
+ [<00000000018927a7>] kmem_cache_alloc+0x11e/0x178
+ [<000000002aea8d16>] sf_pdma_prep_dma_memcpy+0x40/0x112
+
+Add the missing kfree() to sf_pdma_free_desc(), and remove the redundant
+in_use flag.
+
+Fixes: b2cc5c465c2c ("dmaengine: sf-pdma: Add multithread support for a DMA channel")
+Signed-off-by: Shravan Chippa <shravan.chippa@microchip.com>
+Reviewed-by: Conor Dooley <conor.dooley@microchip.com>
+Link: https://lore.kernel.org/r/20230120100623.3530634-1-shravan.chippa@microchip.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/sf-pdma/sf-pdma.c | 3 +--
+ drivers/dma/sf-pdma/sf-pdma.h | 1 -
+ 2 files changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/dma/sf-pdma/sf-pdma.c b/drivers/dma/sf-pdma/sf-pdma.c
+index 6b524eb6bcf3a..e578ad5569494 100644
+--- a/drivers/dma/sf-pdma/sf-pdma.c
++++ b/drivers/dma/sf-pdma/sf-pdma.c
+@@ -96,7 +96,6 @@ sf_pdma_prep_dma_memcpy(struct dma_chan *dchan, dma_addr_t dest, dma_addr_t src,
+ if (!desc)
+ return NULL;
+
+- desc->in_use = true;
+ desc->dirn = DMA_MEM_TO_MEM;
+ desc->async_tx = vchan_tx_prep(&chan->vchan, &desc->vdesc, flags);
+
+@@ -290,7 +289,7 @@ static void sf_pdma_free_desc(struct virt_dma_desc *vdesc)
+ struct sf_pdma_desc *desc;
+
+ desc = to_sf_pdma_desc(vdesc);
+- desc->in_use = false;
++ kfree(desc);
+ }
+
+ static void sf_pdma_donebh_tasklet(struct tasklet_struct *t)
+diff --git a/drivers/dma/sf-pdma/sf-pdma.h b/drivers/dma/sf-pdma/sf-pdma.h
+index dcb3687bd5da2..5c398a83b491a 100644
+--- a/drivers/dma/sf-pdma/sf-pdma.h
++++ b/drivers/dma/sf-pdma/sf-pdma.h
+@@ -78,7 +78,6 @@ struct sf_pdma_desc {
+ u64 src_addr;
+ struct virt_dma_desc vdesc;
+ struct sf_pdma_chan *chan;
+- bool in_use;
+ enum dma_transfer_direction dirn;
+ struct dma_async_tx_descriptor *async_tx;
+ };
+--
+2.39.2
+
--- /dev/null
+From 8dea7e5e451c62f66ae571d1cf09d65885f46a19 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Jan 2023 00:23:20 +0100
+Subject: docs/scripts/gdb: add necessary make scripts_gdb step
+
+From: Jakob Koschel <jkl820.git@gmail.com>
+
+[ Upstream commit 6b219431037bf98c9efd49716aea9b68440477a3 ]
+
+In order to debug the kernel successfully with gdb you need to run
+'make scripts_gdb' nowadays.
+
+This was changed with the following commit:
+
+Commit 67274c083438340ad16c ("scripts/gdb: delay generation of gdb
+constants.py")
+
+In order to have a complete guide for beginners this remark
+should be added to the offial documentation.
+
+Signed-off-by: Jakob Koschel <jkl820.git@gmail.com>
+Link: https://lore.kernel.org/r/20230112-documentation-gdb-v2-1-292785c43dc9@gmail.com
+Signed-off-by: Jonathan Corbet <corbet@lwn.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/dev-tools/gdb-kernel-debugging.rst | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/Documentation/dev-tools/gdb-kernel-debugging.rst b/Documentation/dev-tools/gdb-kernel-debugging.rst
+index 8e0f1fe8d17ad..895285c037c72 100644
+--- a/Documentation/dev-tools/gdb-kernel-debugging.rst
++++ b/Documentation/dev-tools/gdb-kernel-debugging.rst
+@@ -39,6 +39,10 @@ Setup
+ this mode. In this case, you should build the kernel with
+ CONFIG_RANDOMIZE_BASE disabled if the architecture supports KASLR.
+
++- Build the gdb scripts (required on kernels v5.1 and above)::
++
++ make scripts_gdb
++
+ - Enable the gdb stub of QEMU/KVM, either
+
+ - at VM startup time by appending "-s" to the QEMU command line
+--
+2.39.2
+
--- /dev/null
+From c117c40435daf5ee0f7bed01840e2f8b6838c3b2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Dec 2022 11:49:04 +0800
+Subject: driver core: fix potential null-ptr-deref in device_add()
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit f6837f34a34973ef6600c08195ed300e24e97317 ]
+
+I got the following null-ptr-deref report while doing fault injection test:
+
+BUG: kernel NULL pointer dereference, address: 0000000000000058
+CPU: 2 PID: 278 Comm: 37-i2c-ds2482 Tainted: G B W N 6.1.0-rc3+
+RIP: 0010:klist_put+0x2d/0xd0
+Call Trace:
+ <TASK>
+ klist_remove+0xf1/0x1c0
+ device_release_driver_internal+0x196/0x210
+ bus_remove_device+0x1bd/0x240
+ device_add+0xd3d/0x1100
+ w1_add_master_device+0x476/0x490 [wire]
+ ds2482_probe+0x303/0x3e0 [ds2482]
+
+This is how it happened:
+
+w1_alloc_dev()
+ // The dev->driver is set to w1_master_driver.
+ memcpy(&dev->dev, device, sizeof(struct device));
+ device_add()
+ bus_add_device()
+ dpm_sysfs_add() // It fails, calls bus_remove_device.
+
+ // error path
+ bus_remove_device()
+ // The dev->driver is not null, but driver is not bound.
+ __device_release_driver()
+ klist_remove(&dev->p->knode_driver) <-- It causes null-ptr-deref.
+
+ // normal path
+ bus_probe_device() // It's not called yet.
+ device_bind_driver()
+
+If dev->driver is set, in the error path after calling bus_add_device()
+in device_add(), bus_remove_device() is called, then the device will be
+detached from driver. But device_bind_driver() is not called yet, so it
+causes null-ptr-deref while access the 'knode_driver'. To fix this, set
+dev->driver to null in the error path before calling bus_remove_device().
+
+Fixes: 57eee3d23e88 ("Driver core: Call device_pm_add() after bus_add_device() in device_add()")
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Link: https://lore.kernel.org/r/20221205034904.2077765-1-yangyingliang@huawei.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/base/core.c b/drivers/base/core.c
+index a3e14143ec0cf..506289e6b04dd 100644
+--- a/drivers/base/core.c
++++ b/drivers/base/core.c
+@@ -3513,6 +3513,7 @@ int device_add(struct device *dev)
+ device_pm_remove(dev);
+ dpm_sysfs_remove(dev);
+ DPMError:
++ dev->driver = NULL;
+ bus_remove_device(dev);
+ BusError:
+ device_remove_attrs(dev);
+--
+2.39.2
+
--- /dev/null
+From b42df569bddbf1271ad0e3a9b8263c772b83fb1a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Nov 2022 09:20:42 +0800
+Subject: driver core: fix resource leak in device_add()
+
+From: Zhengchao Shao <shaozhengchao@huawei.com>
+
+[ Upstream commit 6977b1a5d67097eaa4d02b0c126c04cc6e8917c0 ]
+
+When calling kobject_add() failed in device_add(), it will call
+cleanup_glue_dir() to free resource. But in kobject_add(),
+dev->kobj.parent has been set to NULL. This will cause resource leak.
+
+The process is as follows:
+device_add()
+ get_device_parent()
+ class_dir_create_and_add()
+ kobject_add() //kobject_get()
+ ...
+ dev->kobj.parent = kobj;
+ ...
+ kobject_add() //failed, but set dev->kobj.parent = NULL
+ ...
+ glue_dir = get_glue_dir(dev) //glue_dir = NULL, and goto
+ //"Error" label
+ ...
+ cleanup_glue_dir() //becaues glue_dir is NULL, not call
+ //kobject_put()
+
+The preceding problem may cause insmod mac80211_hwsim.ko to failed.
+sysfs: cannot create duplicate filename '/devices/virtual/mac80211_hwsim'
+Call Trace:
+<TASK>
+dump_stack_lvl+0x8e/0xd1
+sysfs_warn_dup.cold+0x1c/0x29
+sysfs_create_dir_ns+0x224/0x280
+kobject_add_internal+0x2aa/0x880
+kobject_add+0x135/0x1a0
+get_device_parent+0x3d7/0x590
+device_add+0x2aa/0x1cb0
+device_create_groups_vargs+0x1eb/0x260
+device_create+0xdc/0x110
+mac80211_hwsim_new_radio+0x31e/0x4790 [mac80211_hwsim]
+init_mac80211_hwsim+0x48d/0x1000 [mac80211_hwsim]
+do_one_initcall+0x10f/0x630
+do_init_module+0x19f/0x5e0
+load_module+0x64b7/0x6eb0
+__do_sys_finit_module+0x140/0x200
+do_syscall_64+0x35/0x80
+entry_SYSCALL_64_after_hwframe+0x46/0xb0
+</TASK>
+kobject_add_internal failed for mac80211_hwsim with -EEXIST, don't try to
+register things with the same name in the same directory.
+
+Fixes: cebf8fd16900 ("driver core: fix race between creating/querying glue dir and its cleanup")
+Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com>
+Link: https://lore.kernel.org/r/20221123012042.335252-1-shaozhengchao@huawei.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/base/core.c b/drivers/base/core.c
+index 506289e6b04dd..9fccf7b4e7ea3 100644
+--- a/drivers/base/core.c
++++ b/drivers/base/core.c
+@@ -3413,7 +3413,7 @@ int device_add(struct device *dev)
+ /* we require the name to be set before, and pass NULL */
+ error = kobject_add(&dev->kobj, dev->kobj.parent, NULL);
+ if (error) {
+- glue_dir = get_glue_dir(dev);
++ glue_dir = kobj;
+ goto Error;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 5b4755dcbce37c154847c71784c6d7067b7d7bb4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Feb 2023 17:41:57 -0800
+Subject: driver core: fw_devlink: Add DL_FLAG_CYCLE support to device links
+
+From: Saravana Kannan <saravanak@google.com>
+
+[ Upstream commit 67cad5c67019c38126b749621665b6723d3ae7e6 ]
+
+fw_devlink uses DL_FLAG_SYNC_STATE_ONLY device link flag for two
+purposes:
+
+1. To allow a parent device to proxy its child device's dependency on a
+ supplier so that the supplier doesn't get its sync_state() callback
+ before the child device/consumer can be added and probed. In this
+ usage scenario, we need to ignore cycles for ensure correctness of
+ sync_state() callbacks.
+
+2. When there are dependency cycles in firmware, we don't know which of
+ those dependencies are valid. So, we have to ignore them all wrt
+ probe ordering while still making sure the sync_state() callbacks
+ come correctly.
+
+However, when detecting dependency cycles, there can be multiple
+dependency cycles between two devices that we need to detect. For
+example:
+
+A -> B -> A and A -> C -> B -> A.
+
+To detect multiple cycles correct, we need to be able to differentiate
+DL_FLAG_SYNC_STATE_ONLY device links used for (1) vs (2) above.
+
+To allow this differentiation, add a DL_FLAG_CYCLE that can be use to
+mark use case (2). We can then use the DL_FLAG_CYCLE to decide which
+DL_FLAG_SYNC_STATE_ONLY device links to follow when looking for
+dependency cycles.
+
+Fixes: 2de9d8e0d2fe ("driver core: fw_devlink: Improve handling of cyclic dependencies")
+Signed-off-by: Saravana Kannan <saravanak@google.com>
+Tested-by: Colin Foster <colin.foster@in-advantage.com>
+Tested-by: Sudeep Holla <sudeep.holla@arm.com>
+Tested-by: Douglas Anderson <dianders@chromium.org>
+Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Tested-by: Luca Weiss <luca.weiss@fairphone.com> # qcom/sm7225-fairphone-fp4
+Link: https://lore.kernel.org/r/20230207014207.1678715-6-saravanak@google.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/core.c | 28 ++++++++++++++++++----------
+ include/linux/device.h | 1 +
+ 2 files changed, 19 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/base/core.c b/drivers/base/core.c
+index 9fccf7b4e7ea3..609d1b04ee75a 100644
+--- a/drivers/base/core.c
++++ b/drivers/base/core.c
+@@ -272,6 +272,12 @@ static bool device_is_ancestor(struct device *dev, struct device *target)
+ return false;
+ }
+
++static inline bool device_link_flag_is_sync_state_only(u32 flags)
++{
++ return (flags & ~(DL_FLAG_INFERRED | DL_FLAG_CYCLE)) ==
++ (DL_FLAG_SYNC_STATE_ONLY | DL_FLAG_MANAGED);
++}
++
+ /**
+ * device_is_dependent - Check if one device depends on another one
+ * @dev: Device to check dependencies for.
+@@ -298,8 +304,7 @@ int device_is_dependent(struct device *dev, void *target)
+ return ret;
+
+ list_for_each_entry(link, &dev->links.consumers, s_node) {
+- if ((link->flags & ~DL_FLAG_INFERRED) ==
+- (DL_FLAG_SYNC_STATE_ONLY | DL_FLAG_MANAGED))
++ if (device_link_flag_is_sync_state_only(link->flags))
+ continue;
+
+ if (link->consumer == target)
+@@ -372,8 +377,7 @@ static int device_reorder_to_tail(struct device *dev, void *not_used)
+
+ device_for_each_child(dev, NULL, device_reorder_to_tail);
+ list_for_each_entry(link, &dev->links.consumers, s_node) {
+- if ((link->flags & ~DL_FLAG_INFERRED) ==
+- (DL_FLAG_SYNC_STATE_ONLY | DL_FLAG_MANAGED))
++ if (device_link_flag_is_sync_state_only(link->flags))
+ continue;
+ device_reorder_to_tail(link->consumer, NULL);
+ }
+@@ -634,7 +638,8 @@ postcore_initcall(devlink_class_init);
+ DL_FLAG_AUTOREMOVE_SUPPLIER | \
+ DL_FLAG_AUTOPROBE_CONSUMER | \
+ DL_FLAG_SYNC_STATE_ONLY | \
+- DL_FLAG_INFERRED)
++ DL_FLAG_INFERRED | \
++ DL_FLAG_CYCLE)
+
+ #define DL_ADD_VALID_FLAGS (DL_MANAGED_LINK_FLAGS | DL_FLAG_STATELESS | \
+ DL_FLAG_PM_RUNTIME | DL_FLAG_RPM_ACTIVE)
+@@ -703,8 +708,6 @@ struct device_link *device_link_add(struct device *consumer,
+ if (!consumer || !supplier || consumer == supplier ||
+ flags & ~DL_ADD_VALID_FLAGS ||
+ (flags & DL_FLAG_STATELESS && flags & DL_MANAGED_LINK_FLAGS) ||
+- (flags & DL_FLAG_SYNC_STATE_ONLY &&
+- (flags & ~DL_FLAG_INFERRED) != DL_FLAG_SYNC_STATE_ONLY) ||
+ (flags & DL_FLAG_AUTOPROBE_CONSUMER &&
+ flags & (DL_FLAG_AUTOREMOVE_CONSUMER |
+ DL_FLAG_AUTOREMOVE_SUPPLIER)))
+@@ -720,6 +723,10 @@ struct device_link *device_link_add(struct device *consumer,
+ if (!(flags & DL_FLAG_STATELESS))
+ flags |= DL_FLAG_MANAGED;
+
++ if (flags & DL_FLAG_SYNC_STATE_ONLY &&
++ !device_link_flag_is_sync_state_only(flags))
++ return NULL;
++
+ device_links_write_lock();
+ device_pm_lock();
+
+@@ -1672,7 +1679,7 @@ static void fw_devlink_relax_link(struct device_link *link)
+ if (!(link->flags & DL_FLAG_INFERRED))
+ return;
+
+- if (link->flags == (DL_FLAG_MANAGED | FW_DEVLINK_FLAGS_PERMISSIVE))
++ if (device_link_flag_is_sync_state_only(link->flags))
+ return;
+
+ pm_runtime_drop_link(link);
+@@ -1796,8 +1803,8 @@ static int fw_devlink_relax_cycle(struct device *con, void *sup)
+ return ret;
+
+ list_for_each_entry(link, &con->links.consumers, s_node) {
+- if ((link->flags & ~DL_FLAG_INFERRED) ==
+- (DL_FLAG_SYNC_STATE_ONLY | DL_FLAG_MANAGED))
++ if (!(link->flags & DL_FLAG_CYCLE) &&
++ device_link_flag_is_sync_state_only(link->flags))
+ continue;
+
+ if (!fw_devlink_relax_cycle(link->consumer, sup))
+@@ -1806,6 +1813,7 @@ static int fw_devlink_relax_cycle(struct device *con, void *sup)
+ ret = 1;
+
+ fw_devlink_relax_link(link);
++ link->flags |= DL_FLAG_CYCLE;
+ }
+ return ret;
+ }
+diff --git a/include/linux/device.h b/include/linux/device.h
+index 44e3acae7b36e..f4d20655d2d7e 100644
+--- a/include/linux/device.h
++++ b/include/linux/device.h
+@@ -328,6 +328,7 @@ enum device_link_state {
+ #define DL_FLAG_MANAGED BIT(6)
+ #define DL_FLAG_SYNC_STATE_ONLY BIT(7)
+ #define DL_FLAG_INFERRED BIT(8)
++#define DL_FLAG_CYCLE BIT(9)
+
+ /**
+ * enum dl_dev_state - Device driver presence tracking information.
+--
+2.39.2
+
--- /dev/null
+From 4ef903c8d8a56fd8a6c1963b7517b0aff400bb02 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Feb 2023 17:41:58 -0800
+Subject: driver core: fw_devlink: Allow marking a fwnode link as being part of
+ a cycle
+
+From: Saravana Kannan <saravanak@google.com>
+
+[ Upstream commit 6a6dfdf8b3ff337be5a447e9f4e71969f18370ad ]
+
+To improve detection and handling of dependency cycles, we need to be
+able to mark fwnode links as being part of cycles. fwnode links marked
+as being part of a cycle should not block their consumers from probing.
+
+Fixes: 2de9d8e0d2fe ("driver core: fw_devlink: Improve handling of cyclic dependencies")
+Signed-off-by: Saravana Kannan <saravanak@google.com>
+Tested-by: Colin Foster <colin.foster@in-advantage.com>
+Tested-by: Sudeep Holla <sudeep.holla@arm.com>
+Tested-by: Douglas Anderson <dianders@chromium.org>
+Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Tested-by: Luca Weiss <luca.weiss@fairphone.com> # qcom/sm7225-fairphone-fp4
+Link: https://lore.kernel.org/r/20230207014207.1678715-7-saravanak@google.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/core.c | 50 +++++++++++++++++++++++++++++++++---------
+ include/linux/fwnode.h | 11 +++++++++-
+ 2 files changed, 50 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/base/core.c b/drivers/base/core.c
+index b29c483e9ca7b..bd8ae74e5cdcb 100644
+--- a/drivers/base/core.c
++++ b/drivers/base/core.c
+@@ -76,13 +76,15 @@ static bool fw_devlink_best_effort;
+ * are ignored and there is no reference counting.
+ */
+ static int __fwnode_link_add(struct fwnode_handle *con,
+- struct fwnode_handle *sup)
++ struct fwnode_handle *sup, u8 flags)
+ {
+ struct fwnode_link *link;
+
+ list_for_each_entry(link, &sup->consumers, s_hook)
+- if (link->consumer == con)
++ if (link->consumer == con) {
++ link->flags |= flags;
+ return 0;
++ }
+
+ link = kzalloc(sizeof(*link), GFP_KERNEL);
+ if (!link)
+@@ -92,6 +94,7 @@ static int __fwnode_link_add(struct fwnode_handle *con,
+ INIT_LIST_HEAD(&link->s_hook);
+ link->consumer = con;
+ INIT_LIST_HEAD(&link->c_hook);
++ link->flags = flags;
+
+ list_add(&link->s_hook, &sup->consumers);
+ list_add(&link->c_hook, &con->suppliers);
+@@ -106,7 +109,7 @@ int fwnode_link_add(struct fwnode_handle *con, struct fwnode_handle *sup)
+ int ret;
+
+ mutex_lock(&fwnode_link_lock);
+- ret = __fwnode_link_add(con, sup);
++ ret = __fwnode_link_add(con, sup, 0);
+ mutex_unlock(&fwnode_link_lock);
+ return ret;
+ }
+@@ -126,6 +129,19 @@ static void __fwnode_link_del(struct fwnode_link *link)
+ kfree(link);
+ }
+
++/**
++ * __fwnode_link_cycle - Mark a fwnode link as being part of a cycle.
++ * @link: the fwnode_link to be marked
++ *
++ * The fwnode_link_lock needs to be held when this function is called.
++ */
++static void __fwnode_link_cycle(struct fwnode_link *link)
++{
++ pr_debug("%pfwf: Relaxing link with %pfwf\n",
++ link->consumer, link->supplier);
++ link->flags |= FWLINK_FLAG_CYCLE;
++}
++
+ /**
+ * fwnode_links_purge_suppliers - Delete all supplier links of fwnode_handle.
+ * @fwnode: fwnode whose supplier links need to be deleted
+@@ -199,7 +215,7 @@ static void __fwnode_links_move_consumers(struct fwnode_handle *from,
+ struct fwnode_link *link, *tmp;
+
+ list_for_each_entry_safe(link, tmp, &from->consumers, s_hook) {
+- __fwnode_link_add(link->consumer, to);
++ __fwnode_link_add(link->consumer, to, link->flags);
+ __fwnode_link_del(link);
+ }
+ }
+@@ -1041,6 +1057,21 @@ static bool dev_is_best_effort(struct device *dev)
+ (dev->fwnode && (dev->fwnode->flags & FWNODE_FLAG_BEST_EFFORT));
+ }
+
++static struct fwnode_handle *fwnode_links_check_suppliers(
++ struct fwnode_handle *fwnode)
++{
++ struct fwnode_link *link;
++
++ if (!fwnode || fw_devlink_is_permissive())
++ return NULL;
++
++ list_for_each_entry(link, &fwnode->suppliers, c_hook)
++ if (!(link->flags & FWLINK_FLAG_CYCLE))
++ return link->supplier;
++
++ return NULL;
++}
++
+ /**
+ * device_links_check_suppliers - Check presence of supplier drivers.
+ * @dev: Consumer device.
+@@ -1068,11 +1099,8 @@ int device_links_check_suppliers(struct device *dev)
+ * probe.
+ */
+ mutex_lock(&fwnode_link_lock);
+- if (dev->fwnode && !list_empty(&dev->fwnode->suppliers) &&
+- !fw_devlink_is_permissive()) {
+- sup_fw = list_first_entry(&dev->fwnode->suppliers,
+- struct fwnode_link,
+- c_hook)->supplier;
++ sup_fw = fwnode_links_check_suppliers(dev->fwnode);
++ if (sup_fw) {
+ if (!dev_is_best_effort(dev)) {
+ fwnode_ret = -EPROBE_DEFER;
+ dev_err_probe(dev, -EPROBE_DEFER,
+@@ -1261,7 +1289,9 @@ static ssize_t waiting_for_supplier_show(struct device *dev,
+ bool val;
+
+ device_lock(dev);
+- val = !list_empty(&dev->fwnode->suppliers);
++ mutex_lock(&fwnode_link_lock);
++ val = !!fwnode_links_check_suppliers(dev->fwnode);
++ mutex_unlock(&fwnode_link_lock);
+ device_unlock(dev);
+ return sysfs_emit(buf, "%u\n", val);
+ }
+diff --git a/include/linux/fwnode.h b/include/linux/fwnode.h
+index 89b9bdfca925c..fdf2ee0285b7a 100644
+--- a/include/linux/fwnode.h
++++ b/include/linux/fwnode.h
+@@ -18,7 +18,7 @@ struct fwnode_operations;
+ struct device;
+
+ /*
+- * fwnode link flags
++ * fwnode flags
+ *
+ * LINKS_ADDED: The fwnode has already be parsed to add fwnode links.
+ * NOT_DEVICE: The fwnode will never be populated as a struct device.
+@@ -36,6 +36,7 @@ struct device;
+ #define FWNODE_FLAG_INITIALIZED BIT(2)
+ #define FWNODE_FLAG_NEEDS_CHILD_BOUND_ON_ADD BIT(3)
+ #define FWNODE_FLAG_BEST_EFFORT BIT(4)
++#define FWNODE_FLAG_VISITED BIT(5)
+
+ struct fwnode_handle {
+ struct fwnode_handle *secondary;
+@@ -46,11 +47,19 @@ struct fwnode_handle {
+ u8 flags;
+ };
+
++/*
++ * fwnode link flags
++ *
++ * CYCLE: The fwnode link is part of a cycle. Don't defer probe.
++ */
++#define FWLINK_FLAG_CYCLE BIT(0)
++
+ struct fwnode_link {
+ struct fwnode_handle *supplier;
+ struct list_head s_hook;
+ struct fwnode_handle *consumer;
+ struct list_head c_hook;
++ u8 flags;
+ };
+
+ /**
+--
+2.39.2
+
--- /dev/null
+From cd2ef3b86f37b724539ffab99692d98c87c366a7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Feb 2023 22:41:47 -0800
+Subject: driver core: fw_devlink: Avoid spurious error message
+
+From: Saravana Kannan <saravanak@google.com>
+
+[ Upstream commit 6309872413f14f3d58c13ae4dc85b1a7004b4193 ]
+
+fw_devlink can sometimes try to create a device link with the consumer
+and supplier as the same device. These attempts will fail (correctly),
+but are harmless. So, avoid printing an error for these cases. Also, add
+more detail to the error message.
+
+Fixes: 3fb16866b51d ("driver core: fw_devlink: Make cycle detection more robust")
+Reported-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Reported-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Saravana Kannan <saravanak@google.com>
+Link: https://lore.kernel.org/r/20230225064148.274376-1-saravanak@google.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/core.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/base/core.c b/drivers/base/core.c
+index 126b10c8e0ce9..6ed21587be287 100644
+--- a/drivers/base/core.c
++++ b/drivers/base/core.c
+@@ -2088,9 +2088,9 @@ static int fw_devlink_create_devlink(struct device *con,
+ goto out;
+ }
+
+- if (!device_link_add(con, sup_dev, flags)) {
+- dev_err(con, "Failed to create device link with %s\n",
+- dev_name(sup_dev));
++ if (con != sup_dev && !device_link_add(con, sup_dev, flags)) {
++ dev_err(con, "Failed to create device link (0x%x) with %s\n",
++ flags, dev_name(sup_dev));
+ ret = -EINVAL;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 53acec3b29070ec548a468a641db2b0a3ccee5f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Feb 2023 17:41:59 -0800
+Subject: driver core: fw_devlink: Consolidate device link flag computation
+
+From: Saravana Kannan <saravanak@google.com>
+
+[ Upstream commit cd115c0409f283edde94bd5a9a42dc42bee0aba8 ]
+
+Consolidate the code that computes the flags to be used when creating a
+device link from a fwnode link.
+
+Fixes: 2de9d8e0d2fe ("driver core: fw_devlink: Improve handling of cyclic dependencies")
+Signed-off-by: Saravana Kannan <saravanak@google.com>
+Tested-by: Colin Foster <colin.foster@in-advantage.com>
+Tested-by: Sudeep Holla <sudeep.holla@arm.com>
+Tested-by: Douglas Anderson <dianders@chromium.org>
+Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Tested-by: Luca Weiss <luca.weiss@fairphone.com> # qcom/sm7225-fairphone-fp4
+Link: https://lore.kernel.org/r/20230207014207.1678715-8-saravanak@google.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/core.c | 28 +++++++++++++++-------------
+ include/linux/fwnode.h | 1 -
+ 2 files changed, 15 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/base/core.c b/drivers/base/core.c
+index bd8ae74e5cdcb..05c3e9a09b323 100644
+--- a/drivers/base/core.c
++++ b/drivers/base/core.c
+@@ -1727,8 +1727,11 @@ static int __init fw_devlink_strict_setup(char *arg)
+ }
+ early_param("fw_devlink.strict", fw_devlink_strict_setup);
+
+-u32 fw_devlink_get_flags(void)
++static inline u32 fw_devlink_get_flags(u8 fwlink_flags)
+ {
++ if (fwlink_flags & FWLINK_FLAG_CYCLE)
++ return FW_DEVLINK_FLAGS_PERMISSIVE | DL_FLAG_CYCLE;
++
+ return fw_devlink_flags;
+ }
+
+@@ -1909,7 +1912,7 @@ static int fw_devlink_relax_cycle(struct device *con, void *sup)
+ * fw_devlink_create_devlink - Create a device link from a consumer to fwnode
+ * @con: consumer device for the device link
+ * @sup_handle: fwnode handle of supplier
+- * @flags: devlink flags
++ * @link: fwnode link that's being converted to a device link
+ *
+ * This function will try to create a device link between the consumer device
+ * @con and the supplier device represented by @sup_handle.
+@@ -1926,10 +1929,17 @@ static int fw_devlink_relax_cycle(struct device *con, void *sup)
+ * possible to do that in the future
+ */
+ static int fw_devlink_create_devlink(struct device *con,
+- struct fwnode_handle *sup_handle, u32 flags)
++ struct fwnode_handle *sup_handle,
++ struct fwnode_link *link)
+ {
+ struct device *sup_dev;
+ int ret = 0;
++ u32 flags;
++
++ if (con->fwnode == link->consumer)
++ flags = fw_devlink_get_flags(link->flags);
++ else
++ flags = FW_DEVLINK_FLAGS_PERMISSIVE;
+
+ /*
+ * In some cases, a device P might also be a supplier to its child node
+@@ -2055,7 +2065,6 @@ static void __fw_devlink_link_to_consumers(struct device *dev)
+ struct fwnode_link *link, *tmp;
+
+ list_for_each_entry_safe(link, tmp, &fwnode->consumers, s_hook) {
+- u32 dl_flags = fw_devlink_get_flags();
+ struct device *con_dev;
+ bool own_link = true;
+ int ret;
+@@ -2085,14 +2094,13 @@ static void __fw_devlink_link_to_consumers(struct device *dev)
+ con_dev = NULL;
+ } else {
+ own_link = false;
+- dl_flags = FW_DEVLINK_FLAGS_PERMISSIVE;
+ }
+ }
+
+ if (!con_dev)
+ continue;
+
+- ret = fw_devlink_create_devlink(con_dev, fwnode, dl_flags);
++ ret = fw_devlink_create_devlink(con_dev, fwnode, link);
+ put_device(con_dev);
+ if (!own_link || ret == -EAGAIN)
+ continue;
+@@ -2133,19 +2141,13 @@ static void __fw_devlink_link_to_suppliers(struct device *dev,
+ bool own_link = (dev->fwnode == fwnode);
+ struct fwnode_link *link, *tmp;
+ struct fwnode_handle *child = NULL;
+- u32 dl_flags;
+-
+- if (own_link)
+- dl_flags = fw_devlink_get_flags();
+- else
+- dl_flags = FW_DEVLINK_FLAGS_PERMISSIVE;
+
+ list_for_each_entry_safe(link, tmp, &fwnode->suppliers, c_hook) {
+ int ret;
+ struct device *sup_dev;
+ struct fwnode_handle *sup = link->supplier;
+
+- ret = fw_devlink_create_devlink(dev, sup, dl_flags);
++ ret = fw_devlink_create_devlink(dev, sup, link);
+ if (!own_link || ret == -EAGAIN)
+ continue;
+
+diff --git a/include/linux/fwnode.h b/include/linux/fwnode.h
+index fdf2ee0285b7a..5700451b300fb 100644
+--- a/include/linux/fwnode.h
++++ b/include/linux/fwnode.h
+@@ -207,7 +207,6 @@ static inline void fwnode_dev_initialized(struct fwnode_handle *fwnode,
+ fwnode->flags &= ~FWNODE_FLAG_INITIALIZED;
+ }
+
+-extern u32 fw_devlink_get_flags(void);
+ extern bool fw_devlink_is_strict(void);
+ int fwnode_link_add(struct fwnode_handle *con, struct fwnode_handle *sup);
+ void fwnode_links_purge(struct fwnode_handle *fwnode);
+--
+2.39.2
+
--- /dev/null
+From 29d4870f1d14632bfa25e03f8069af506c7e41e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Feb 2023 17:41:53 -0800
+Subject: driver core: fw_devlink: Don't purge child fwnode's consumer links
+
+From: Saravana Kannan <saravanak@google.com>
+
+[ Upstream commit 3a2dbc510c437ca392516b0105bad8e7970e6614 ]
+
+When a device X is bound successfully to a driver, if it has a child
+firmware node Y that doesn't have a struct device created by then, we
+delete fwnode links where the child firmware node Y is the supplier. We
+did this to avoid blocking the consumers of the child firmware node Y
+from deferring probe indefinitely.
+
+While that a step in the right direction, it's better to make the
+consumers of the child firmware node Y to be consumers of the device X
+because device X is probably implementing whatever functionality is
+represented by child firmware node Y. By doing this, we capture the
+device dependencies more accurately and ensure better
+probe/suspend/resume ordering.
+
+Signed-off-by: Saravana Kannan <saravanak@google.com>
+Tested-by: Colin Foster <colin.foster@in-advantage.com>
+Tested-by: Sudeep Holla <sudeep.holla@arm.com>
+Tested-by: Douglas Anderson <dianders@chromium.org>
+Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Tested-by: Luca Weiss <luca.weiss@fairphone.com> # qcom/sm7225-fairphone-fp4
+Link: https://lore.kernel.org/r/20230207014207.1678715-2-saravanak@google.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Stable-dep-of: 6a6dfdf8b3ff ("driver core: fw_devlink: Allow marking a fwnode link as being part of a cycle")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/core.c | 97 ++++++++++++++++++++++++++++++++++++---------
+ 1 file changed, 79 insertions(+), 18 deletions(-)
+
+diff --git a/drivers/base/core.c b/drivers/base/core.c
+index 609d1b04ee75a..b29c483e9ca7b 100644
+--- a/drivers/base/core.c
++++ b/drivers/base/core.c
+@@ -54,11 +54,12 @@ static LIST_HEAD(deferred_sync);
+ static unsigned int defer_sync_state_count = 1;
+ static DEFINE_MUTEX(fwnode_link_lock);
+ static bool fw_devlink_is_permissive(void);
++static void __fw_devlink_link_to_consumers(struct device *dev);
+ static bool fw_devlink_drv_reg_done;
+ static bool fw_devlink_best_effort;
+
+ /**
+- * fwnode_link_add - Create a link between two fwnode_handles.
++ * __fwnode_link_add - Create a link between two fwnode_handles.
+ * @con: Consumer end of the link.
+ * @sup: Supplier end of the link.
+ *
+@@ -74,22 +75,18 @@ static bool fw_devlink_best_effort;
+ * Attempts to create duplicate links between the same pair of fwnode handles
+ * are ignored and there is no reference counting.
+ */
+-int fwnode_link_add(struct fwnode_handle *con, struct fwnode_handle *sup)
++static int __fwnode_link_add(struct fwnode_handle *con,
++ struct fwnode_handle *sup)
+ {
+ struct fwnode_link *link;
+- int ret = 0;
+-
+- mutex_lock(&fwnode_link_lock);
+
+ list_for_each_entry(link, &sup->consumers, s_hook)
+ if (link->consumer == con)
+- goto out;
++ return 0;
+
+ link = kzalloc(sizeof(*link), GFP_KERNEL);
+- if (!link) {
+- ret = -ENOMEM;
+- goto out;
+- }
++ if (!link)
++ return -ENOMEM;
+
+ link->supplier = sup;
+ INIT_LIST_HEAD(&link->s_hook);
+@@ -100,9 +97,17 @@ int fwnode_link_add(struct fwnode_handle *con, struct fwnode_handle *sup)
+ list_add(&link->c_hook, &con->suppliers);
+ pr_debug("%pfwP Linked as a fwnode consumer to %pfwP\n",
+ con, sup);
+-out:
+- mutex_unlock(&fwnode_link_lock);
+
++ return 0;
++}
++
++int fwnode_link_add(struct fwnode_handle *con, struct fwnode_handle *sup)
++{
++ int ret;
++
++ mutex_lock(&fwnode_link_lock);
++ ret = __fwnode_link_add(con, sup);
++ mutex_unlock(&fwnode_link_lock);
+ return ret;
+ }
+
+@@ -181,6 +186,51 @@ void fw_devlink_purge_absent_suppliers(struct fwnode_handle *fwnode)
+ }
+ EXPORT_SYMBOL_GPL(fw_devlink_purge_absent_suppliers);
+
++/**
++ * __fwnode_links_move_consumers - Move consumer from @from to @to fwnode_handle
++ * @from: move consumers away from this fwnode
++ * @to: move consumers to this fwnode
++ *
++ * Move all consumer links from @from fwnode to @to fwnode.
++ */
++static void __fwnode_links_move_consumers(struct fwnode_handle *from,
++ struct fwnode_handle *to)
++{
++ struct fwnode_link *link, *tmp;
++
++ list_for_each_entry_safe(link, tmp, &from->consumers, s_hook) {
++ __fwnode_link_add(link->consumer, to);
++ __fwnode_link_del(link);
++ }
++}
++
++/**
++ * __fw_devlink_pickup_dangling_consumers - Pick up dangling consumers
++ * @fwnode: fwnode from which to pick up dangling consumers
++ * @new_sup: fwnode of new supplier
++ *
++ * If the @fwnode has a corresponding struct device and the device supports
++ * probing (that is, added to a bus), then we want to let fw_devlink create
++ * MANAGED device links to this device, so leave @fwnode and its descendant's
++ * fwnode links alone.
++ *
++ * Otherwise, move its consumers to the new supplier @new_sup.
++ */
++static void __fw_devlink_pickup_dangling_consumers(struct fwnode_handle *fwnode,
++ struct fwnode_handle *new_sup)
++{
++ struct fwnode_handle *child;
++
++ if (fwnode->dev && fwnode->dev->bus)
++ return;
++
++ fwnode->flags |= FWNODE_FLAG_NOT_DEVICE;
++ __fwnode_links_move_consumers(fwnode, new_sup);
++
++ fwnode_for_each_available_child_node(fwnode, child)
++ __fw_devlink_pickup_dangling_consumers(child, new_sup);
++}
++
+ #ifdef CONFIG_SRCU
+ static DEFINE_MUTEX(device_links_lock);
+ DEFINE_STATIC_SRCU(device_links_srcu);
+@@ -1274,16 +1324,23 @@ void device_links_driver_bound(struct device *dev)
+ * them. So, fw_devlink no longer needs to create device links to any
+ * of the device's suppliers.
+ *
+- * Also, if a child firmware node of this bound device is not added as
+- * a device by now, assume it is never going to be added and make sure
+- * other devices don't defer probe indefinitely by waiting for such a
+- * child device.
++ * Also, if a child firmware node of this bound device is not added as a
++ * device by now, assume it is never going to be added. Make this bound
++ * device the fallback supplier to the dangling consumers of the child
++ * firmware node because this bound device is probably implementing the
++ * child firmware node functionality and we don't want the dangling
++ * consumers to defer probe indefinitely waiting for a device for the
++ * child firmware node.
+ */
+ if (dev->fwnode && dev->fwnode->dev == dev) {
+ struct fwnode_handle *child;
+ fwnode_links_purge_suppliers(dev->fwnode);
++ mutex_lock(&fwnode_link_lock);
+ fwnode_for_each_available_child_node(dev->fwnode, child)
+- fw_devlink_purge_absent_suppliers(child);
++ __fw_devlink_pickup_dangling_consumers(child,
++ dev->fwnode);
++ __fw_devlink_link_to_consumers(dev);
++ mutex_unlock(&fwnode_link_lock);
+ }
+ device_remove_file(dev, &dev_attr_waiting_for_supplier);
+
+@@ -1863,7 +1920,11 @@ static int fw_devlink_create_devlink(struct device *con,
+ fwnode_is_ancestor_of(sup_handle, con->fwnode))
+ return -EINVAL;
+
+- sup_dev = get_dev_from_fwnode(sup_handle);
++ if (sup_handle->flags & FWNODE_FLAG_NOT_DEVICE)
++ sup_dev = fwnode_get_next_parent_dev(sup_handle);
++ else
++ sup_dev = get_dev_from_fwnode(sup_handle);
++
+ if (sup_dev) {
+ /*
+ * If it's one of those drivers that don't actually bind to
+--
+2.39.2
+
--- /dev/null
+From 107a2c776dbbfcd6ac7ad1468eb78abb4564d774 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Feb 2023 17:41:54 -0800
+Subject: driver core: fw_devlink: Improve check for fwnode with no
+ device/driver
+
+From: Saravana Kannan <saravanak@google.com>
+
+[ Upstream commit 411c0d58ca6faa9bc4b9f5382118a31c7bb92a6f ]
+
+fw_devlink shouldn't defer the probe of a device to wait on a supplier
+that'll never have a struct device or will never be probed by a driver.
+We currently check if a supplier falls into this category, but don't
+check its ancestors. We need to check the ancestors too because if the
+ancestor will never probe, then the supplier will never probe either.
+
+Signed-off-by: Saravana Kannan <saravanak@google.com>
+Tested-by: Colin Foster <colin.foster@in-advantage.com>
+Tested-by: Sudeep Holla <sudeep.holla@arm.com>
+Tested-by: Douglas Anderson <dianders@chromium.org>
+Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Tested-by: Luca Weiss <luca.weiss@fairphone.com> # qcom/sm7225-fairphone-fp4
+Link: https://lore.kernel.org/r/20230207014207.1678715-3-saravanak@google.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Stable-dep-of: 3fb16866b51d ("driver core: fw_devlink: Make cycle detection more robust")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/core.c | 40 ++++++++++++++++++++++++++++++++++++++--
+ 1 file changed, 38 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/base/core.c b/drivers/base/core.c
+index 05c3e9a09b323..8f32e2cbcc63a 100644
+--- a/drivers/base/core.c
++++ b/drivers/base/core.c
+@@ -1908,6 +1908,35 @@ static int fw_devlink_relax_cycle(struct device *con, void *sup)
+ return ret;
+ }
+
++static bool fwnode_init_without_drv(struct fwnode_handle *fwnode)
++{
++ struct device *dev;
++ bool ret;
++
++ if (!(fwnode->flags & FWNODE_FLAG_INITIALIZED))
++ return false;
++
++ dev = get_dev_from_fwnode(fwnode);
++ ret = !dev || dev->links.status == DL_DEV_NO_DRIVER;
++ put_device(dev);
++
++ return ret;
++}
++
++static bool fwnode_ancestor_init_without_drv(struct fwnode_handle *fwnode)
++{
++ struct fwnode_handle *parent;
++
++ fwnode_for_each_parent_node(fwnode, parent) {
++ if (fwnode_init_without_drv(parent)) {
++ fwnode_handle_put(parent);
++ return true;
++ }
++ }
++
++ return false;
++}
++
+ /**
+ * fw_devlink_create_devlink - Create a device link from a consumer to fwnode
+ * @con: consumer device for the device link
+@@ -1996,9 +2025,16 @@ static int fw_devlink_create_devlink(struct device *con,
+ goto out;
+ }
+
+- /* Supplier that's already initialized without a struct device. */
+- if (sup_handle->flags & FWNODE_FLAG_INITIALIZED)
++ /*
++ * Supplier or supplier's ancestor already initialized without a struct
++ * device or being probed by a driver.
++ */
++ if (fwnode_init_without_drv(sup_handle) ||
++ fwnode_ancestor_init_without_drv(sup_handle)) {
++ dev_dbg(con, "Not linking %pfwP - Might never probe\n",
++ sup_handle);
+ return -EINVAL;
++ }
+
+ /*
+ * DL_FLAG_SYNC_STATE_ONLY doesn't block probing and supports
+--
+2.39.2
+
--- /dev/null
+From 900b5fbc6497d44f877c175e3d7079256972b802 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Feb 2023 17:42:00 -0800
+Subject: driver core: fw_devlink: Make cycle detection more robust
+
+From: Saravana Kannan <saravanak@google.com>
+
+[ Upstream commit 3fb16866b51ded6c016b664caad53f8d4fd9dc56 ]
+
+fw_devlink could only detect a single and simple cycle because it relied
+mainly on device link cycle detection code that only checked for cycles
+between devices. The expectation was that the firmware wouldn't have
+complicated cycles and multiple cycles between devices. That expectation
+has been proven to be wrong.
+
+For example, fw_devlink could handle:
+
++-+ +-+
+|A+------> |B+
++-+ +++
+ ^ |
+ | |
+ +----------+
+
+But it couldn't handle even something as "simple" as:
+
+ +---------------------+
+ | |
+ v |
++-+ +-+ +++
+|A+------> |B+------> |C|
++-+ +++ +-+
+ ^ |
+ | |
+ +----------+
+
+But firmware has even more complicated cycles like:
+
+ +---------------------+
+ | |
+ v |
+ +-+ +---+ +++
++--+A+------>| B +-----> |C|<--+
+| +-+ ++--+ +++ |
+| ^ | ^ | |
+| | | | | |
+| +---------+ +---------+ |
+| |
++------------------------------+
+
+And this is without including parent child dependencies or nodes in the
+cycle that are just firmware nodes that'll never have a struct device
+created for them.
+
+The proper way to treat these devices it to not force any probe ordering
+between them, while still enforce dependencies between node in the
+cycles (A, B and C) and their consumers.
+
+So this patch goes all out and just deals with all types of cycles. It
+does this by:
+
+1. Following dependencies across device links, parent-child and fwnode
+ links.
+2. When it find cycles, it mark the device links and fwnode links as
+ such instead of just deleting them or making the indistinguishable
+ from proxy SYNC_STATE_ONLY device links.
+
+This way, when new nodes get added, we can immediately find and mark any
+new cycles whether the new node is a device or firmware node.
+
+Fixes: 2de9d8e0d2fe ("driver core: fw_devlink: Improve handling of cyclic dependencies")
+Signed-off-by: Saravana Kannan <saravanak@google.com>
+Tested-by: Colin Foster <colin.foster@in-advantage.com>
+Tested-by: Sudeep Holla <sudeep.holla@arm.com>
+Tested-by: Douglas Anderson <dianders@chromium.org>
+Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Tested-by: Luca Weiss <luca.weiss@fairphone.com> # qcom/sm7225-fairphone-fp4
+Link: https://lore.kernel.org/r/20230207014207.1678715-9-saravanak@google.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/core.c | 248 +++++++++++++++++++++++---------------------
+ 1 file changed, 129 insertions(+), 119 deletions(-)
+
+diff --git a/drivers/base/core.c b/drivers/base/core.c
+index 8f32e2cbcc63a..126b10c8e0ce9 100644
+--- a/drivers/base/core.c
++++ b/drivers/base/core.c
+@@ -1866,47 +1866,6 @@ static void fw_devlink_unblock_consumers(struct device *dev)
+ device_links_write_unlock();
+ }
+
+-/**
+- * fw_devlink_relax_cycle - Convert cyclic links to SYNC_STATE_ONLY links
+- * @con: Device to check dependencies for.
+- * @sup: Device to check against.
+- *
+- * Check if @sup depends on @con or any device dependent on it (its child or
+- * its consumer etc). When such a cyclic dependency is found, convert all
+- * device links created solely by fw_devlink into SYNC_STATE_ONLY device links.
+- * This is the equivalent of doing fw_devlink=permissive just between the
+- * devices in the cycle. We need to do this because, at this point, fw_devlink
+- * can't tell which of these dependencies is not a real dependency.
+- *
+- * Return 1 if a cycle is found. Otherwise, return 0.
+- */
+-static int fw_devlink_relax_cycle(struct device *con, void *sup)
+-{
+- struct device_link *link;
+- int ret;
+-
+- if (con == sup)
+- return 1;
+-
+- ret = device_for_each_child(con, sup, fw_devlink_relax_cycle);
+- if (ret)
+- return ret;
+-
+- list_for_each_entry(link, &con->links.consumers, s_node) {
+- if (!(link->flags & DL_FLAG_CYCLE) &&
+- device_link_flag_is_sync_state_only(link->flags))
+- continue;
+-
+- if (!fw_devlink_relax_cycle(link->consumer, sup))
+- continue;
+-
+- ret = 1;
+-
+- fw_devlink_relax_link(link);
+- link->flags |= DL_FLAG_CYCLE;
+- }
+- return ret;
+-}
+
+ static bool fwnode_init_without_drv(struct fwnode_handle *fwnode)
+ {
+@@ -1937,6 +1896,111 @@ static bool fwnode_ancestor_init_without_drv(struct fwnode_handle *fwnode)
+ return false;
+ }
+
++/**
++ * __fw_devlink_relax_cycles - Relax and mark dependency cycles.
++ * @con: Potential consumer device.
++ * @sup_handle: Potential supplier's fwnode.
++ *
++ * Needs to be called with fwnode_lock and device link lock held.
++ *
++ * Check if @sup_handle or any of its ancestors or suppliers direct/indirectly
++ * depend on @con. This function can detect multiple cyles between @sup_handle
++ * and @con. When such dependency cycles are found, convert all device links
++ * created solely by fw_devlink into SYNC_STATE_ONLY device links. Also, mark
++ * all fwnode links in the cycle with FWLINK_FLAG_CYCLE so that when they are
++ * converted into a device link in the future, they are created as
++ * SYNC_STATE_ONLY device links. This is the equivalent of doing
++ * fw_devlink=permissive just between the devices in the cycle. We need to do
++ * this because, at this point, fw_devlink can't tell which of these
++ * dependencies is not a real dependency.
++ *
++ * Return true if one or more cycles were found. Otherwise, return false.
++ */
++static bool __fw_devlink_relax_cycles(struct device *con,
++ struct fwnode_handle *sup_handle)
++{
++ struct device *sup_dev = NULL, *par_dev = NULL;
++ struct fwnode_link *link;
++ struct device_link *dev_link;
++ bool ret = false;
++
++ if (!sup_handle)
++ return false;
++
++ /*
++ * We aren't trying to find all cycles. Just a cycle between con and
++ * sup_handle.
++ */
++ if (sup_handle->flags & FWNODE_FLAG_VISITED)
++ return false;
++
++ sup_handle->flags |= FWNODE_FLAG_VISITED;
++
++ sup_dev = get_dev_from_fwnode(sup_handle);
++
++ /* Termination condition. */
++ if (sup_dev == con) {
++ ret = true;
++ goto out;
++ }
++
++ /*
++ * If sup_dev is bound to a driver and @con hasn't started binding to a
++ * driver, sup_dev can't be a consumer of @con. So, no need to check
++ * further.
++ */
++ if (sup_dev && sup_dev->links.status == DL_DEV_DRIVER_BOUND &&
++ con->links.status == DL_DEV_NO_DRIVER) {
++ ret = false;
++ goto out;
++ }
++
++ list_for_each_entry(link, &sup_handle->suppliers, c_hook) {
++ if (__fw_devlink_relax_cycles(con, link->supplier)) {
++ __fwnode_link_cycle(link);
++ ret = true;
++ }
++ }
++
++ /*
++ * Give priority to device parent over fwnode parent to account for any
++ * quirks in how fwnodes are converted to devices.
++ */
++ if (sup_dev)
++ par_dev = get_device(sup_dev->parent);
++ else
++ par_dev = fwnode_get_next_parent_dev(sup_handle);
++
++ if (par_dev && __fw_devlink_relax_cycles(con, par_dev->fwnode))
++ ret = true;
++
++ if (!sup_dev)
++ goto out;
++
++ list_for_each_entry(dev_link, &sup_dev->links.suppliers, c_node) {
++ /*
++ * Ignore a SYNC_STATE_ONLY flag only if it wasn't marked as
++ * such due to a cycle.
++ */
++ if (device_link_flag_is_sync_state_only(dev_link->flags) &&
++ !(dev_link->flags & DL_FLAG_CYCLE))
++ continue;
++
++ if (__fw_devlink_relax_cycles(con,
++ dev_link->supplier->fwnode)) {
++ fw_devlink_relax_link(dev_link);
++ dev_link->flags |= DL_FLAG_CYCLE;
++ ret = true;
++ }
++ }
++
++out:
++ sup_handle->flags &= ~FWNODE_FLAG_VISITED;
++ put_device(sup_dev);
++ put_device(par_dev);
++ return ret;
++}
++
+ /**
+ * fw_devlink_create_devlink - Create a device link from a consumer to fwnode
+ * @con: consumer device for the device link
+@@ -1989,6 +2053,21 @@ static int fw_devlink_create_devlink(struct device *con,
+ fwnode_is_ancestor_of(sup_handle, con->fwnode))
+ return -EINVAL;
+
++ /*
++ * SYNC_STATE_ONLY device links don't block probing and supports cycles.
++ * So cycle detection isn't necessary and shouldn't be done.
++ */
++ if (!(flags & DL_FLAG_SYNC_STATE_ONLY)) {
++ device_links_write_lock();
++ if (__fw_devlink_relax_cycles(con, sup_handle)) {
++ __fwnode_link_cycle(link);
++ flags = fw_devlink_get_flags(link->flags);
++ dev_info(con, "Fixed dependency cycle(s) with %pfwf\n",
++ sup_handle);
++ }
++ device_links_write_unlock();
++ }
++
+ if (sup_handle->flags & FWNODE_FLAG_NOT_DEVICE)
+ sup_dev = fwnode_get_next_parent_dev(sup_handle);
+ else
+@@ -2002,23 +2081,16 @@ static int fw_devlink_create_devlink(struct device *con,
+ */
+ if (sup_dev->links.status == DL_DEV_NO_DRIVER &&
+ sup_handle->flags & FWNODE_FLAG_INITIALIZED) {
++ dev_dbg(con,
++ "Not linking %pfwf - dev might never probe\n",
++ sup_handle);
+ ret = -EINVAL;
+ goto out;
+ }
+
+- /*
+- * If this fails, it is due to cycles in device links. Just
+- * give up on this link and treat it as invalid.
+- */
+- if (!device_link_add(con, sup_dev, flags) &&
+- !(flags & DL_FLAG_SYNC_STATE_ONLY)) {
+- dev_info(con, "Fixing up cyclic dependency with %s\n",
+- dev_name(sup_dev));
+- device_links_write_lock();
+- fw_devlink_relax_cycle(con, sup_dev);
+- device_links_write_unlock();
+- device_link_add(con, sup_dev,
+- FW_DEVLINK_FLAGS_PERMISSIVE);
++ if (!device_link_add(con, sup_dev, flags)) {
++ dev_err(con, "Failed to create device link with %s\n",
++ dev_name(sup_dev));
+ ret = -EINVAL;
+ }
+
+@@ -2031,49 +2103,12 @@ static int fw_devlink_create_devlink(struct device *con,
+ */
+ if (fwnode_init_without_drv(sup_handle) ||
+ fwnode_ancestor_init_without_drv(sup_handle)) {
+- dev_dbg(con, "Not linking %pfwP - Might never probe\n",
++ dev_dbg(con, "Not linking %pfwf - might never become dev\n",
+ sup_handle);
+ return -EINVAL;
+ }
+
+- /*
+- * DL_FLAG_SYNC_STATE_ONLY doesn't block probing and supports
+- * cycles. So cycle detection isn't necessary and shouldn't be
+- * done.
+- */
+- if (flags & DL_FLAG_SYNC_STATE_ONLY)
+- return -EAGAIN;
+-
+- /*
+- * If we can't find the supplier device from its fwnode, it might be
+- * due to a cyclic dependency between fwnodes. Some of these cycles can
+- * be broken by applying logic. Check for these types of cycles and
+- * break them so that devices in the cycle probe properly.
+- *
+- * If the supplier's parent is dependent on the consumer, then the
+- * consumer and supplier have a cyclic dependency. Since fw_devlink
+- * can't tell which of the inferred dependencies are incorrect, don't
+- * enforce probe ordering between any of the devices in this cyclic
+- * dependency. Do this by relaxing all the fw_devlink device links in
+- * this cycle and by treating the fwnode link between the consumer and
+- * the supplier as an invalid dependency.
+- */
+- sup_dev = fwnode_get_next_parent_dev(sup_handle);
+- if (sup_dev && device_is_dependent(con, sup_dev)) {
+- dev_info(con, "Fixing up cyclic dependency with %pfwP (%s)\n",
+- sup_handle, dev_name(sup_dev));
+- device_links_write_lock();
+- fw_devlink_relax_cycle(con, sup_dev);
+- device_links_write_unlock();
+- ret = -EINVAL;
+- } else {
+- /*
+- * Can't check for cycles or no cycles. So let's try
+- * again later.
+- */
+- ret = -EAGAIN;
+- }
+-
++ ret = -EAGAIN;
+ out:
+ put_device(sup_dev);
+ return ret;
+@@ -2156,10 +2191,7 @@ static void __fw_devlink_link_to_consumers(struct device *dev)
+ *
+ * The function creates normal (non-SYNC_STATE_ONLY) device links between @dev
+ * and the real suppliers of @dev. Once these device links are created, the
+- * fwnode links are deleted. When such device links are successfully created,
+- * this function is called recursively on those supplier devices. This is
+- * needed to detect and break some invalid cycles in fwnode links. See
+- * fw_devlink_create_devlink() for more details.
++ * fwnode links are deleted.
+ *
+ * In addition, it also looks at all the suppliers of the entire fwnode tree
+ * because some of the child devices of @dev that have not been added yet
+@@ -2180,7 +2212,6 @@ static void __fw_devlink_link_to_suppliers(struct device *dev,
+
+ list_for_each_entry_safe(link, tmp, &fwnode->suppliers, c_hook) {
+ int ret;
+- struct device *sup_dev;
+ struct fwnode_handle *sup = link->supplier;
+
+ ret = fw_devlink_create_devlink(dev, sup, link);
+@@ -2188,27 +2219,6 @@ static void __fw_devlink_link_to_suppliers(struct device *dev,
+ continue;
+
+ __fwnode_link_del(link);
+-
+- /* If no device link was created, nothing more to do. */
+- if (ret)
+- continue;
+-
+- /*
+- * If a device link was successfully created to a supplier, we
+- * now need to try and link the supplier to all its suppliers.
+- *
+- * This is needed to detect and delete false dependencies in
+- * fwnode links that haven't been converted to a device link
+- * yet. See comments in fw_devlink_create_devlink() for more
+- * details on the false dependency.
+- *
+- * Without deleting these false dependencies, some devices will
+- * never probe because they'll keep waiting for their false
+- * dependency fwnode links to be converted to device links.
+- */
+- sup_dev = get_dev_from_fwnode(sup);
+- __fw_devlink_link_to_suppliers(sup_dev, sup_dev->fwnode);
+- put_device(sup_dev);
+ }
+
+ /*
+--
+2.39.2
+
--- /dev/null
+From 026230c5cff165a21d7b2430018ed70c4784af20 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Nov 2022 15:37:28 +0800
+Subject: driver core: location: Free struct acpi_pld_info *pld before return
+ false
+
+From: Hanjun Guo <guohanjun@huawei.com>
+
+[ Upstream commit 0d150f967e8410e1e6712484543eec709356a65d ]
+
+struct acpi_pld_info *pld should be freed before the return of allocation
+failure, to prevent memory leak, add the ACPI_FREE() to fix it.
+
+Fixes: bc443c31def5 ("driver core: location: Check for allocations failure")
+Signed-off-by: Hanjun Guo <guohanjun@huawei.com>
+Link: https://lore.kernel.org/r/1669102648-11517-1-git-send-email-guohanjun@huawei.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/physical_location.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/base/physical_location.c b/drivers/base/physical_location.c
+index 87af641cfe1a3..951819e71b4ad 100644
+--- a/drivers/base/physical_location.c
++++ b/drivers/base/physical_location.c
+@@ -24,8 +24,11 @@ bool dev_add_physical_location(struct device *dev)
+
+ dev->physical_location =
+ kzalloc(sizeof(*dev->physical_location), GFP_KERNEL);
+- if (!dev->physical_location)
++ if (!dev->physical_location) {
++ ACPI_FREE(pld);
+ return false;
++ }
++
+ dev->physical_location->panel = pld->panel;
+ dev->physical_location->vertical_position = pld->vertical_position;
+ dev->physical_location->horizontal_position = pld->horizontal_position;
+--
+2.39.2
+
--- /dev/null
+From 425dcf2b6c315f179decda4188e21e1585a42937 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Nov 2022 18:23:07 +0800
+Subject: drivers: base: transport_class: fix possible memory leak
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit a86367803838b369fe5486ac18771d14723c258c ]
+
+Current some drivers(like iscsi) call transport_register_device()
+failed, they don't call transport_destroy_device() to release the
+memory allocated in transport_setup_device(), because they don't
+know what was done, it should be internal thing to release the
+resource in register function. So fix this leak by calling destroy
+function inside register function.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Link: https://lore.kernel.org/r/20221110102307.3492557-1-yangyingliang@huawei.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/transport_class.h | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/include/linux/transport_class.h b/include/linux/transport_class.h
+index 63076fb835e34..2efc271a96fa6 100644
+--- a/include/linux/transport_class.h
++++ b/include/linux/transport_class.h
+@@ -70,8 +70,14 @@ void transport_destroy_device(struct device *);
+ static inline int
+ transport_register_device(struct device *dev)
+ {
++ int ret;
++
+ transport_setup_device(dev);
+- return transport_add_device(dev);
++ ret = transport_add_device(dev);
++ if (ret)
++ transport_destroy_device(dev);
++
++ return ret;
+ }
+
+ static inline void
+--
+2.39.2
+
--- /dev/null
+From eed7a600ab3fcb088c0de28c2dbec6e7497d778d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Nov 2022 11:16:38 +0800
+Subject: drivers: base: transport_class: fix resource leak when
+ transport_add_device() fails
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit e5da06b27ff5a148e42265c8e306670a9d913969 ]
+
+The normal call sequence of using transport class is:
+
+Add path:
+transport_setup_device()
+ transport_setup_classdev() // call sas_host_setup() here
+transport_add_device() // if fails, need call transport_destroy_device()
+transport_configure_device()
+
+Remove path:
+transport_remove_device()
+ transport_remove_classdev // call sas_host_remove() here
+transport_destroy_device()
+
+If transport_add_device() fails, need call transport_destroy_device()
+to free memory, but in this case, ->remove() is not called, and the
+resources allocated in ->setup() are leaked. So fix these leaks by
+calling ->remove() in transport_add_class_device() if it returns error.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Link: https://lore.kernel.org/r/20221115031638.3816551-1-yangyingliang@huawei.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/transport_class.c | 17 ++++++++++++++++-
+ 1 file changed, 16 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/base/transport_class.c b/drivers/base/transport_class.c
+index ccc86206e5087..09ee2a1e35bbd 100644
+--- a/drivers/base/transport_class.c
++++ b/drivers/base/transport_class.c
+@@ -155,12 +155,27 @@ static int transport_add_class_device(struct attribute_container *cont,
+ struct device *dev,
+ struct device *classdev)
+ {
++ struct transport_class *tclass = class_to_transport_class(cont->class);
+ int error = attribute_container_add_class_device(classdev);
+ struct transport_container *tcont =
+ attribute_container_to_transport_container(cont);
+
+- if (!error && tcont->statistics)
++ if (error)
++ goto err_remove;
++
++ if (tcont->statistics) {
+ error = sysfs_create_group(&classdev->kobj, tcont->statistics);
++ if (error)
++ goto err_del;
++ }
++
++ return 0;
++
++err_del:
++ attribute_container_class_device_del(classdev);
++err_remove:
++ if (tclass->remove)
++ tclass->remove(tcont, dev, classdev);
+
+ return error;
+ }
+--
+2.39.2
+
--- /dev/null
+From 602fe1fc6e4343e51d2812292c8d7b236bead297 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Jan 2023 15:52:31 -0600
+Subject: drm/amd: Avoid ASSERT for some message failures
+
+From: Mario Limonciello <mario.limonciello@amd.com>
+
+[ Upstream commit 3e5019ee67760cd61b2a5fd605e1289c2f92d983 ]
+
+On DCN314 when resuming from s0i3 an ASSERT is shown indicating that
+`VBIOSSMC_MSG_SetHardMinDcfclkByFreq` returned `VBIOSSMC_Result_Failed`.
+
+This isn't a driver bug; it's a BIOS/configuration bug. To make this
+easier to triage, add an explicit warning when this issue happens.
+
+This matches the behavior utilized for failures with
+`VBIOSSMC_MSG_TransferTableDram2Smu` configuration.
+
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Reviewed-by: Harry Wentland <harry.wentland@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/clk_mgr/dcn314/dcn314_smu.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn314/dcn314_smu.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn314/dcn314_smu.c
+index f47cfe6b42bd2..0765334f08259 100644
+--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn314/dcn314_smu.c
++++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn314/dcn314_smu.c
+@@ -146,6 +146,9 @@ static int dcn314_smu_send_msg_with_param(struct clk_mgr_internal *clk_mgr,
+ if (msg_id == VBIOSSMC_MSG_TransferTableDram2Smu &&
+ param == TABLE_WATERMARKS)
+ DC_LOG_WARNING("Watermarks table not configured properly by SMU");
++ else if (msg_id == VBIOSSMC_MSG_SetHardMinDcfclkByFreq ||
++ msg_id == VBIOSSMC_MSG_SetMinDeepSleepDcfclk)
++ DC_LOG_WARNING("DCFCLK_DPM is not enabled by BIOS");
+ else
+ ASSERT(0);
+ REG_WRITE(MP1_SMN_C2PMSG_91, VBIOSSMC_Result_OK);
+--
+2.39.2
+
--- /dev/null
+From c0af4dd36269c66e22b59776fa654dbd1bc1fc28 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Jan 2023 16:03:41 -0600
+Subject: drm/amd: Avoid BUG() for case of SRIOV missing IP version
+
+From: Mario Limonciello <mario.limonciello@amd.com>
+
+[ Upstream commit 93fec4f8c158584065134b4d45e875499bf517c8 ]
+
+No need to crash the kernel. AMDGPU will now fail to probe.
+
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Reviewed-by: Lijo Lazar <lijo.lazar@amd.com>
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+index 7a2fc920739bb..ba092072308fa 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+@@ -380,7 +380,7 @@ static int psp_init_sriov_microcode(struct psp_context *psp)
+ adev->virt.autoload_ucode_id = AMDGPU_UCODE_ID_CP_MES1_DATA;
+ break;
+ default:
+- BUG();
++ ret = -EINVAL;
+ break;
+ }
+ return ret;
+--
+2.39.2
+
--- /dev/null
+From 8a6a56bbc5fad07459e83775001a3bcd7fae5b6e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Dec 2022 16:10:22 -0500
+Subject: drm/amd/display: Defer DIG FIFO disable after VID stream enable
+
+From: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+
+[ Upstream commit 2d90a1c054831338d57b39aec4d273cf3e867590 ]
+
+[Why]
+On some monitors we see a brief flash of corruption during the
+monitor disable sequence caused by FIFO being disabled in the middle
+of an active DP stream.
+
+[How]
+Wait until DP vid stream is disabled before turning off the FIFO.
+
+The FIFO reset on DP unblank should take care of clearing any FIFO
+error, if any.
+
+Acked-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
+Signed-off-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+Reviewed-by: Syed Hassan <Syed.Hassan@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../drm/amd/display/dc/dcn314/dcn314_dio_stream_encoder.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_dio_stream_encoder.c b/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_dio_stream_encoder.c
+index 38842f938bed0..0926db0183383 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_dio_stream_encoder.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_dio_stream_encoder.c
+@@ -278,10 +278,10 @@ static void enc314_stream_encoder_dp_blank(
+ struct dc_link *link,
+ struct stream_encoder *enc)
+ {
+- /* New to DCN314 - disable the FIFO before VID stream disable. */
+- enc314_disable_fifo(enc);
+-
+ enc1_stream_encoder_dp_blank(link, enc);
++
++ /* Disable FIFO after the DP vid stream is disabled to avoid corruption. */
++ enc314_disable_fifo(enc);
+ }
+
+ static void enc314_stream_encoder_dp_unblank(
+--
+2.39.2
+
--- /dev/null
+From f66f6b8ae89ce5e349f3b3242112bceac22dffb9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Feb 2023 15:15:51 -0500
+Subject: drm/amd/display: Disable HUBP/DPP PG on DCN314 for now
+
+From: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+
+[ Upstream commit b7c67f72408b11b922f23f06c7df0f6743a2e89d ]
+
+[Why]
+The DMCUB implementation required to workaround corruption is
+not currently stable and may cause intermittent corruption or hangs.
+
+[How]
+Disable PG until the sequence is stable.
+
+Reviewed-by: Hansen Dsouza <hansen.dsouza@amd.com>
+Acked-by: Qingqing Zhuo <qingqing.zhuo@amd.com>
+Signed-off-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dcn314/dcn314_resource.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_resource.c b/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_resource.c
+index bc7f2b735327e..73f519dbdb531 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_resource.c
+@@ -892,6 +892,8 @@ static const struct dc_debug_options debug_defaults_drv = {
+ .force_abm_enable = false,
+ .timing_trace = false,
+ .clock_trace = true,
++ .disable_dpp_power_gate = true,
++ .disable_hubp_power_gate = true,
+ .disable_pplib_clock_request = false,
+ .pipe_split_policy = MPC_SPLIT_DYNAMIC,
+ .force_single_disp_pipe_split = false,
+--
+2.39.2
+
--- /dev/null
+From 75b1a7fc14bdc59280e7e5253324224beef3e663 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Feb 2023 12:51:20 -0500
+Subject: drm/amd/display: disable SubVP + DRR to prevent underflow
+
+From: Aurabindo Pillai <aurabindo.pillai@amd.com>
+
+[ Upstream commit 80c6d6804f31451848a3956a70c2bcb1f07cfcb0 ]
+
+[Why&How]
+Temporarily disable SubVP+DRR since Xorg has an architectural limitation
+where freesync will not work in a multi monitor configuration. SubVP+DRR
+requires that freesync be working.
+
+Whether OS has variable refresh setting enabled or not, the state on
+the crtc remains same unless an application requests VRR. Due to this,
+there is no way to know whether freesync will actually work or not
+while we are on the desktop from the kernel's perspective.
+
+If userspace does not have a limitation with multi-display freesync (for
+example wayland), then this feature can be enabled by adding a
+dcfeaturemask option to amdgpu on the kernel cmdline like:
+
+amdgpu.dcfeaturemask=0x200
+
+Signed-off-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
+Reviewed-by: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 5 +++++
+ drivers/gpu/drm/amd/display/dc/dc.h | 2 +-
+ drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c | 4 ++++
+ drivers/gpu/drm/amd/include/amd_shared.h | 1 +
+ 4 files changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index 027ffa5ccda46..1ba8a2905f824 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -1551,6 +1551,11 @@ static int amdgpu_dm_init(struct amdgpu_device *adev)
+ if (amdgpu_dc_feature_mask & DC_DISABLE_LTTPR_DP2_0)
+ init_data.flags.allow_lttpr_non_transparent_mode.bits.DP2_0 = true;
+
++ /* Disable SubVP + DRR config by default */
++ init_data.flags.disable_subvp_drr = true;
++ if (amdgpu_dc_feature_mask & DC_ENABLE_SUBVP_DRR)
++ init_data.flags.disable_subvp_drr = false;
++
+ init_data.flags.seamless_boot_edp_requested = false;
+
+ if (check_seamless_boot_capability(adev)) {
+diff --git a/drivers/gpu/drm/amd/display/dc/dc.h b/drivers/gpu/drm/amd/display/dc/dc.h
+index 85ebeaa2de186..37998dc0fc144 100644
+--- a/drivers/gpu/drm/amd/display/dc/dc.h
++++ b/drivers/gpu/drm/amd/display/dc/dc.h
+@@ -410,7 +410,7 @@ struct dc_config {
+ bool force_bios_enable_lttpr;
+ uint8_t force_bios_fixed_vs;
+ int sdpif_request_limit_words_per_umc;
+-
++ bool disable_subvp_drr;
+ };
+
+ enum visual_confirm {
+diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c b/drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c
+index 8450f59c26186..69e205ac58b25 100644
+--- a/drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c
++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c
+@@ -877,6 +877,10 @@ static bool subvp_drr_schedulable(struct dc *dc, struct dc_state *context, struc
+ int16_t stretched_drr_us = 0;
+ int16_t drr_stretched_vblank_us = 0;
+ int16_t max_vblank_mallregion = 0;
++ const struct dc_config *config = &dc->config;
++
++ if (config->disable_subvp_drr)
++ return false;
+
+ // Find SubVP pipe
+ for (i = 0; i < dc->res_pool->pipe_count; i++) {
+diff --git a/drivers/gpu/drm/amd/include/amd_shared.h b/drivers/gpu/drm/amd/include/amd_shared.h
+index f175e65b853a0..e4a22c68517d1 100644
+--- a/drivers/gpu/drm/amd/include/amd_shared.h
++++ b/drivers/gpu/drm/amd/include/amd_shared.h
+@@ -240,6 +240,7 @@ enum DC_FEATURE_MASK {
+ DC_DISABLE_LTTPR_DP2_0 = (1 << 6), //0x40, disabled by default
+ DC_PSR_ALLOW_SMU_OPT = (1 << 7), //0x80, disabled by default
+ DC_PSR_ALLOW_MULTI_DISP_OPT = (1 << 8), //0x100, disabled by default
++ DC_ENABLE_SUBVP_DRR = (1 << 9), // 0x200, disabled by default
+ };
+
+ enum DC_DEBUG_MASK {
+--
+2.39.2
+
--- /dev/null
+From ce0d96cb690866b492be782c9f399e3d6840271a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Nov 2022 15:19:22 -0400
+Subject: drm/amd/display: Do not commit pipe when updating DRR
+
+From: Wesley Chalmers <Wesley.Chalmers@amd.com>
+
+[ Upstream commit 8f0d304d21b351d65e8c434c5399a40231876ba1 ]
+
+[WHY]
+DRR and Pipe cannot be updated on
+the same frame, or else underflow will
+occur.
+
+Reviewed-by: Jun Lei <Jun.Lei@amd.com>
+Acked-by: Qingqing Zhuo <qingqing.zhuo@amd.com>
+Signed-off-by: Wesley Chalmers <Wesley.Chalmers@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/core/dc.c | 15 +++++++++++++++
+ drivers/gpu/drm/amd/display/dc/dcn10/dcn10_optc.h | 3 ++-
+ drivers/gpu/drm/amd/display/dc/dcn30/dcn30_optc.c | 9 +++++++++
+ drivers/gpu/drm/amd/display/dc/dcn30/dcn30_optc.h | 2 ++
+ .../drm/amd/display/dc/inc/hw/timing_generator.h | 1 +
+ 5 files changed, 29 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c
+index c03e86e49fea3..698ef50e83f3f 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc.c
+@@ -3335,6 +3335,21 @@ static void commit_planes_for_stream(struct dc *dc,
+
+ dc_z10_restore(dc);
+
++ if (update_type == UPDATE_TYPE_FULL) {
++ /* wait for all double-buffer activity to clear on all pipes */
++ int pipe_idx;
++
++ for (pipe_idx = 0; pipe_idx < dc->res_pool->pipe_count; pipe_idx++) {
++ struct pipe_ctx *pipe_ctx = &context->res_ctx.pipe_ctx[pipe_idx];
++
++ if (!pipe_ctx->stream)
++ continue;
++
++ if (pipe_ctx->stream_res.tg->funcs->wait_drr_doublebuffer_pending_clear)
++ pipe_ctx->stream_res.tg->funcs->wait_drr_doublebuffer_pending_clear(pipe_ctx->stream_res.tg);
++ }
++ }
++
+ if (get_seamless_boot_stream_count(context) > 0 && surface_count > 0) {
+ /* Optimize seamless boot flag keeps clocks and watermarks high until
+ * first flip. After first flip, optimization is required to lower
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_optc.h b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_optc.h
+index 88ac5f6f4c96c..0b37bb0e184b2 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_optc.h
++++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_optc.h
+@@ -519,7 +519,8 @@ struct dcn_optc_registers {
+ type OTG_CRC_DATA_STREAM_COMBINE_MODE;\
+ type OTG_CRC_DATA_STREAM_SPLIT_MODE;\
+ type OTG_CRC_DATA_FORMAT;\
+- type OTG_V_TOTAL_LAST_USED_BY_DRR;
++ type OTG_V_TOTAL_LAST_USED_BY_DRR;\
++ type OTG_DRR_TIMING_DBUF_UPDATE_PENDING;
+
+ #define TG_REG_FIELD_LIST_DCN3_2(type) \
+ type OTG_H_TIMING_DIV_MODE_MANUAL;
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_optc.c b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_optc.c
+index 867d60151aebb..08b92715e2e64 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_optc.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_optc.c
+@@ -291,6 +291,14 @@ static void optc3_set_timing_double_buffer(struct timing_generator *optc, bool e
+ OTG_DRR_TIMING_DBUF_UPDATE_MODE, mode);
+ }
+
++void optc3_wait_drr_doublebuffer_pending_clear(struct timing_generator *optc)
++{
++ struct optc *optc1 = DCN10TG_FROM_TG(optc);
++
++ REG_WAIT(OTG_DOUBLE_BUFFER_CONTROL, OTG_DRR_TIMING_DBUF_UPDATE_PENDING, 0, 2, 100000); /* 1 vupdate at 5hz */
++
++}
++
+ void optc3_set_vtotal_min_max(struct timing_generator *optc, int vtotal_min, int vtotal_max)
+ {
+ optc1_set_vtotal_min_max(optc, vtotal_min, vtotal_max);
+@@ -360,6 +368,7 @@ static struct timing_generator_funcs dcn30_tg_funcs = {
+ .program_manual_trigger = optc2_program_manual_trigger,
+ .setup_manual_trigger = optc2_setup_manual_trigger,
+ .get_hw_timing = optc1_get_hw_timing,
++ .wait_drr_doublebuffer_pending_clear = optc3_wait_drr_doublebuffer_pending_clear,
+ };
+
+ void dcn30_timing_generator_init(struct optc *optc1)
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_optc.h b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_optc.h
+index dd45a5499b078..fb06dc9a48937 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_optc.h
++++ b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_optc.h
+@@ -279,6 +279,7 @@
+ SF(OTG0_OTG_DRR_TRIGGER_WINDOW, OTG_DRR_TRIGGER_WINDOW_END_X, mask_sh),\
+ SF(OTG0_OTG_DRR_V_TOTAL_CHANGE, OTG_DRR_V_TOTAL_CHANGE_LIMIT, mask_sh),\
+ SF(OTG0_OTG_H_TIMING_CNTL, OTG_H_TIMING_DIV_BY2, mask_sh),\
++ SF(OTG0_OTG_DOUBLE_BUFFER_CONTROL, OTG_DRR_TIMING_DBUF_UPDATE_PENDING, mask_sh),\
+ SF(OTG0_OTG_DOUBLE_BUFFER_CONTROL, OTG_DRR_TIMING_DBUF_UPDATE_MODE, mask_sh),\
+ SF(OTG0_OTG_DOUBLE_BUFFER_CONTROL, OTG_BLANK_DATA_DOUBLE_BUFFER_EN, mask_sh)
+
+@@ -317,6 +318,7 @@
+ SF(OTG0_OTG_DRR_TRIGGER_WINDOW, OTG_DRR_TRIGGER_WINDOW_END_X, mask_sh),\
+ SF(OTG0_OTG_DRR_V_TOTAL_CHANGE, OTG_DRR_V_TOTAL_CHANGE_LIMIT, mask_sh),\
+ SF(OTG0_OTG_H_TIMING_CNTL, OTG_H_TIMING_DIV_MODE, mask_sh),\
++ SF(OTG0_OTG_DOUBLE_BUFFER_CONTROL, OTG_DRR_TIMING_DBUF_UPDATE_PENDING, mask_sh),\
+ SF(OTG0_OTG_DOUBLE_BUFFER_CONTROL, OTG_DRR_TIMING_DBUF_UPDATE_MODE, mask_sh)
+
+ void dcn30_timing_generator_init(struct optc *optc1);
+diff --git a/drivers/gpu/drm/amd/display/dc/inc/hw/timing_generator.h b/drivers/gpu/drm/amd/display/dc/inc/hw/timing_generator.h
+index 0e42e721dd15a..1d9f9c53d2bd6 100644
+--- a/drivers/gpu/drm/amd/display/dc/inc/hw/timing_generator.h
++++ b/drivers/gpu/drm/amd/display/dc/inc/hw/timing_generator.h
+@@ -331,6 +331,7 @@ struct timing_generator_funcs {
+ uint32_t vtotal_change_limit);
+
+ void (*init_odm)(struct timing_generator *tg);
++ void (*wait_drr_doublebuffer_pending_clear)(struct timing_generator *tg);
+ };
+
+ #endif
+--
+2.39.2
+
--- /dev/null
+From 5a2565ad515ab2a8a400a626601e7e2122f5d7ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Feb 2023 13:25:49 -0500
+Subject: drm/amd/display: don't call dc_interrupt_set() for disabled crtcs
+
+From: Hamza Mahfooz <hamza.mahfooz@amd.com>
+
+[ Upstream commit 4936458bf989d168f5a89015dd81067c4c2bdc64 ]
+
+As made mention of in commit 4ea7fc09539b ("drm/amd/display: Do not
+program interrupt status on disabled crtc"), we shouldn't program
+disabled crtcs. So, filter out disabled crtcs in dm_set_vupdate_irq()
+and dm_set_vblank().
+
+Reviewed-by: Harry Wentland <harry.wentland@amd.com>
+Fixes: 589d2739332d ("drm/amd/display: Use crtc enable/disable_vblank hooks")
+Fixes: d2574c33bb71 ("drm/amd/display: In VRR mode, do DRM core vblank handling at end of vblank. (v2)")
+Signed-off-by: Hamza Mahfooz <hamza.mahfooz@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c
+index 22125daf9dcfe..78c2ed59e87d2 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c
+@@ -77,6 +77,9 @@ int dm_set_vupdate_irq(struct drm_crtc *crtc, bool enable)
+ struct amdgpu_device *adev = drm_to_adev(crtc->dev);
+ int rc;
+
++ if (acrtc->otg_inst == -1)
++ return 0;
++
+ irq_source = IRQ_TYPE_VUPDATE + acrtc->otg_inst;
+
+ rc = dc_interrupt_set(adev->dm.dc, irq_source, enable) ? 0 : -EBUSY;
+@@ -152,6 +155,9 @@ static inline int dm_set_vblank(struct drm_crtc *crtc, bool enable)
+ struct vblank_control_work *work;
+ int rc = 0;
+
++ if (acrtc->otg_inst == -1)
++ goto skip;
++
+ if (enable) {
+ /* vblank irq on -> Only need vupdate irq in vrr mode */
+ if (amdgpu_dm_vrr_active(acrtc_state))
+@@ -169,6 +175,7 @@ static inline int dm_set_vblank(struct drm_crtc *crtc, bool enable)
+ if (!dc_interrupt_set(adev->dm.dc, irq_source, enable))
+ return -EBUSY;
+
++skip:
+ if (amdgpu_in_reset(adev))
+ return 0;
+
+--
+2.39.2
+
--- /dev/null
+From 9d3065e9fd69dbf8bc6427d968fc8cd50ebe54df Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Jan 2023 10:03:45 -0500
+Subject: drm/amd/display: Enable P-state validation checks for DCN314
+
+From: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+
+[ Upstream commit 37d184b548db0f64d4a878960b2c6988b38a3e7e ]
+
+[Why]
+To align with DCN31 behavior. This helps avoid p-state hangs in
+the case where underflow does occur.
+
+[How]
+Flip the bit to true.
+
+Reviewed-by: Hansen Dsouza <hansen.dsouza@amd.com>
+Acked-by: Qingqing Zhuo <qingqing.zhuo@amd.com>
+Signed-off-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dcn314/dcn314_resource.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_resource.c b/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_resource.c
+index 79850a68f62ab..bc7f2b735327e 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_resource.c
+@@ -901,7 +901,7 @@ static const struct dc_debug_options debug_defaults_drv = {
+ .max_downscale_src_width = 4096,/*upto true 4k*/
+ .disable_pplib_wm_range = false,
+ .scl_reset_length10 = true,
+- .sanity_checks = false,
++ .sanity_checks = true,
+ .underflow_assert_delay_us = 0xFFFFFFFF,
+ .dwb_fi_phase = -1, // -1 = disable,
+ .dmub_command_table = true,
+--
+2.39.2
+
--- /dev/null
+From 945a263332bdf052232dc85d0ae761ae2f9a4513 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Jan 2023 14:14:42 -0500
+Subject: drm/amd/display: fix FCLK pstate change underflow
+
+From: Vladimir Stempen <vladimir.stempen@amd.com>
+
+[ Upstream commit 972243f973eb0821084e5833d5f7f4ed025f42da ]
+
+[Why]
+Currently we set FCLK p-state change
+watermark calculated based on dummy
+p-state latency when UCLK p-state is
+not supported
+
+[How]
+Calculate FCLK p-state change watermark
+based on on FCLK pstate change latency
+in case UCLK p-state is not supported
+
+Reviewed-by: Nevenko Stupar <Nevenko.Stupar@amd.com>
+Acked-by: Alex Hung <alex.hung@amd.com>
+Signed-off-by: Vladimir Stempen <vladimir.stempen@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c b/drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c
+index f94abd124021e..8450f59c26186 100644
+--- a/drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c
++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c
+@@ -2038,6 +2038,10 @@ void dcn32_calculate_wm_and_dlg_fpu(struct dc *dc, struct dc_state *context,
+ */
+ context->bw_ctx.bw.dcn.watermarks.a = context->bw_ctx.bw.dcn.watermarks.c;
+ context->bw_ctx.bw.dcn.watermarks.a.cstate_pstate.pstate_change_ns = 0;
++ /* Calculate FCLK p-state change watermark based on FCLK pstate change latency in case
++ * UCLK p-state is not supported, to avoid underflow in case FCLK pstate is supported
++ */
++ context->bw_ctx.bw.dcn.watermarks.a.cstate_pstate.fclk_pstate_change_ns = get_fclk_watermark(&context->bw_ctx.dml, pipes, pipe_cnt) * 1000;
+ } else {
+ /* Set A:
+ * All clocks min.
+--
+2.39.2
+
--- /dev/null
+From c520350c421f86945bf97f2ce5be27535d853ccf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Dec 2022 16:43:37 +0800
+Subject: drm/amd/display: fix mapping to non-allocated address
+
+From: Brandon Syu <Brandon.Syu@amd.com>
+
+[ Upstream commit 9190d4a263264eabf715f5fc1827da45e3fdc247 ]
+
+[Why]
+There is an issue mapping non-allocated location of memory.
+It would allocate gpio registers from an array out of bounds.
+
+[How]
+Patch correct numbers of bounds for using.
+
+Tested-by: Daniel Wheeler <Daniel.Wheeler@amd.com>
+Reviewed-by: Martin Leung <Martin.Leung@amd.com>
+Acked-by: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
+Signed-off-by: Brandon Syu <Brandon.Syu@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/amd/display/dc/gpio/dcn20/hw_factory_dcn20.c | 6 ++++--
+ .../gpu/drm/amd/display/dc/gpio/dcn30/hw_factory_dcn30.c | 6 ++++--
+ .../gpu/drm/amd/display/dc/gpio/dcn32/hw_factory_dcn32.c | 6 ++++--
+ drivers/gpu/drm/amd/display/dc/gpio/ddc_regs.h | 7 +++++++
+ 4 files changed, 19 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/gpio/dcn20/hw_factory_dcn20.c b/drivers/gpu/drm/amd/display/dc/gpio/dcn20/hw_factory_dcn20.c
+index 9b63c6c0cc844..e0bd0c722e006 100644
+--- a/drivers/gpu/drm/amd/display/dc/gpio/dcn20/hw_factory_dcn20.c
++++ b/drivers/gpu/drm/amd/display/dc/gpio/dcn20/hw_factory_dcn20.c
+@@ -138,7 +138,8 @@ static const struct ddc_sh_mask ddc_shift[] = {
+ DDC_MASK_SH_LIST_DCN2(__SHIFT, 3),
+ DDC_MASK_SH_LIST_DCN2(__SHIFT, 4),
+ DDC_MASK_SH_LIST_DCN2(__SHIFT, 5),
+- DDC_MASK_SH_LIST_DCN2(__SHIFT, 6)
++ DDC_MASK_SH_LIST_DCN2(__SHIFT, 6),
++ DDC_MASK_SH_LIST_DCN2_VGA(__SHIFT)
+ };
+
+ static const struct ddc_sh_mask ddc_mask[] = {
+@@ -147,7 +148,8 @@ static const struct ddc_sh_mask ddc_mask[] = {
+ DDC_MASK_SH_LIST_DCN2(_MASK, 3),
+ DDC_MASK_SH_LIST_DCN2(_MASK, 4),
+ DDC_MASK_SH_LIST_DCN2(_MASK, 5),
+- DDC_MASK_SH_LIST_DCN2(_MASK, 6)
++ DDC_MASK_SH_LIST_DCN2(_MASK, 6),
++ DDC_MASK_SH_LIST_DCN2_VGA(_MASK)
+ };
+
+ #include "../generic_regs.h"
+diff --git a/drivers/gpu/drm/amd/display/dc/gpio/dcn30/hw_factory_dcn30.c b/drivers/gpu/drm/amd/display/dc/gpio/dcn30/hw_factory_dcn30.c
+index 687d4f128480e..36a5736c58c92 100644
+--- a/drivers/gpu/drm/amd/display/dc/gpio/dcn30/hw_factory_dcn30.c
++++ b/drivers/gpu/drm/amd/display/dc/gpio/dcn30/hw_factory_dcn30.c
+@@ -145,7 +145,8 @@ static const struct ddc_sh_mask ddc_shift[] = {
+ DDC_MASK_SH_LIST_DCN2(__SHIFT, 3),
+ DDC_MASK_SH_LIST_DCN2(__SHIFT, 4),
+ DDC_MASK_SH_LIST_DCN2(__SHIFT, 5),
+- DDC_MASK_SH_LIST_DCN2(__SHIFT, 6)
++ DDC_MASK_SH_LIST_DCN2(__SHIFT, 6),
++ DDC_MASK_SH_LIST_DCN2_VGA(__SHIFT)
+ };
+
+ static const struct ddc_sh_mask ddc_mask[] = {
+@@ -154,7 +155,8 @@ static const struct ddc_sh_mask ddc_mask[] = {
+ DDC_MASK_SH_LIST_DCN2(_MASK, 3),
+ DDC_MASK_SH_LIST_DCN2(_MASK, 4),
+ DDC_MASK_SH_LIST_DCN2(_MASK, 5),
+- DDC_MASK_SH_LIST_DCN2(_MASK, 6)
++ DDC_MASK_SH_LIST_DCN2(_MASK, 6),
++ DDC_MASK_SH_LIST_DCN2_VGA(_MASK)
+ };
+
+ #include "../generic_regs.h"
+diff --git a/drivers/gpu/drm/amd/display/dc/gpio/dcn32/hw_factory_dcn32.c b/drivers/gpu/drm/amd/display/dc/gpio/dcn32/hw_factory_dcn32.c
+index 9fd8b269dd79c..985f10b397509 100644
+--- a/drivers/gpu/drm/amd/display/dc/gpio/dcn32/hw_factory_dcn32.c
++++ b/drivers/gpu/drm/amd/display/dc/gpio/dcn32/hw_factory_dcn32.c
+@@ -149,7 +149,8 @@ static const struct ddc_sh_mask ddc_shift[] = {
+ DDC_MASK_SH_LIST_DCN2(__SHIFT, 3),
+ DDC_MASK_SH_LIST_DCN2(__SHIFT, 4),
+ DDC_MASK_SH_LIST_DCN2(__SHIFT, 5),
+- DDC_MASK_SH_LIST_DCN2(__SHIFT, 6)
++ DDC_MASK_SH_LIST_DCN2(__SHIFT, 6),
++ DDC_MASK_SH_LIST_DCN2_VGA(__SHIFT)
+ };
+
+ static const struct ddc_sh_mask ddc_mask[] = {
+@@ -158,7 +159,8 @@ static const struct ddc_sh_mask ddc_mask[] = {
+ DDC_MASK_SH_LIST_DCN2(_MASK, 3),
+ DDC_MASK_SH_LIST_DCN2(_MASK, 4),
+ DDC_MASK_SH_LIST_DCN2(_MASK, 5),
+- DDC_MASK_SH_LIST_DCN2(_MASK, 6)
++ DDC_MASK_SH_LIST_DCN2(_MASK, 6),
++ DDC_MASK_SH_LIST_DCN2_VGA(_MASK)
+ };
+
+ #include "../generic_regs.h"
+diff --git a/drivers/gpu/drm/amd/display/dc/gpio/ddc_regs.h b/drivers/gpu/drm/amd/display/dc/gpio/ddc_regs.h
+index 308a543178a56..59884ef651b39 100644
+--- a/drivers/gpu/drm/amd/display/dc/gpio/ddc_regs.h
++++ b/drivers/gpu/drm/amd/display/dc/gpio/ddc_regs.h
+@@ -113,6 +113,13 @@
+ (PHY_AUX_CNTL__AUX## cd ##_PAD_RXSEL## mask_sh),\
+ (DC_GPIO_AUX_CTRL_5__DDC_PAD## cd ##_I2CMODE## mask_sh)}
+
++#define DDC_MASK_SH_LIST_DCN2_VGA(mask_sh) \
++ {DDC_MASK_SH_LIST_COMMON(mask_sh),\
++ 0,\
++ 0,\
++ 0,\
++ 0}
++
+ struct ddc_registers {
+ struct gpio_registers gpio;
+ uint32_t ddc_setup;
+--
+2.39.2
+
--- /dev/null
+From cce9283606c409c782712c8b4d24e55fff4f19ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Nov 2022 10:50:46 +0800
+Subject: drm: amd: display: Fix memory leakage
+
+From: Konstantin Meskhidze <konstantin.meskhidze@huawei.com>
+
+[ Upstream commit 6b8701be1f66064ca72733c5f6e13748cdbf8397 ]
+
+This commit fixes memory leakage in dc_construct_ctx() function.
+
+Signed-off-by: Konstantin Meskhidze <konstantin.meskhidze@huawei.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/core/dc.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c
+index 0cb8d1f934d12..c03e86e49fea3 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc.c
+@@ -862,6 +862,7 @@ static bool dc_construct_ctx(struct dc *dc,
+
+ dc_ctx->perf_trace = dc_perf_trace_create();
+ if (!dc_ctx->perf_trace) {
++ kfree(dc_ctx);
+ ASSERT_CRITICAL(false);
+ return false;
+ }
+--
+2.39.2
+
--- /dev/null
+From 15b162d320b7e46df36381cd24ab97571959707b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Dec 2022 09:06:42 -0500
+Subject: drm/amd/display: Fix potential null-deref in dm_resume
+
+From: Roman Li <roman.li@amd.com>
+
+[ Upstream commit 7a7175a2cd84b7874bebbf8e59f134557a34161b ]
+
+[Why]
+Fixing smatch error:
+dm_resume() error: we previously assumed 'aconnector->dc_link' could be null
+
+[How]
+Check if dc_link null at the beginning of the loop,
+so further checks can be dropped.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+
+Reviewed-by: Wayne Lin <Wayne.Lin@amd.com>
+Acked-by: Jasdeep Dhillon <jdhillon@amd.com>
+Signed-off-by: Roman Li <roman.li@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index af16d6bb974b7..69f0ccc18aa82 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -2747,12 +2747,14 @@ static int dm_resume(void *handle)
+ drm_for_each_connector_iter(connector, &iter) {
+ aconnector = to_amdgpu_dm_connector(connector);
+
++ if (!aconnector->dc_link)
++ continue;
++
+ /*
+ * this is the case when traversing through already created
+ * MST connectors, should be skipped
+ */
+- if (aconnector->dc_link &&
+- aconnector->dc_link->type == dc_connection_mst_branch)
++ if (aconnector->dc_link->type == dc_connection_mst_branch)
+ continue;
+
+ mutex_lock(&aconnector->hpd_lock);
+--
+2.39.2
+
--- /dev/null
+From 7efb193e1285578a9b8de4e6b2a93f7b613e3fbb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Dec 2022 22:56:57 -0500
+Subject: drm/amd/display: Reduce expected sdp bandwidth for dcn321
+
+From: Dillon Varone <Dillon.Varone@amd.com>
+
+[ Upstream commit 6b81090d6d4cc0fd818c9ec9dbb6906f921ad396 ]
+
+[Description]
+Modify soc BB to reduce expected sdp bandwidth and align with measurements to
+fix underflow issues.
+
+Reviewed-by: Jun Lei <Jun.Lei@amd.com>
+Acked-by: Jasdeep Dhillon <jdhillon@amd.com>
+Signed-off-by: Dillon Varone <Dillon.Varone@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dml/dcn321/dcn321_fpu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn321/dcn321_fpu.c b/drivers/gpu/drm/amd/display/dc/dml/dcn321/dcn321_fpu.c
+index f4b176599be7a..0ea406145c1d7 100644
+--- a/drivers/gpu/drm/amd/display/dc/dml/dcn321/dcn321_fpu.c
++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn321/dcn321_fpu.c
+@@ -136,7 +136,7 @@ struct _vcs_dpi_soc_bounding_box_st dcn3_21_soc = {
+ .urgent_out_of_order_return_per_channel_pixel_only_bytes = 4096,
+ .urgent_out_of_order_return_per_channel_pixel_and_vm_bytes = 4096,
+ .urgent_out_of_order_return_per_channel_vm_only_bytes = 4096,
+- .pct_ideal_sdp_bw_after_urgent = 100.0,
++ .pct_ideal_sdp_bw_after_urgent = 90.0,
+ .pct_ideal_fabric_bw_after_urgent = 67.0,
+ .pct_ideal_dram_sdp_bw_after_urgent_pixel_only = 20.0,
+ .pct_ideal_dram_sdp_bw_after_urgent_pixel_and_vm = 60.0, // N/A, for now keep as is until DML implemented
+--
+2.39.2
+
--- /dev/null
+From c0b091ba64c04a76af3962ebb255756f779df7a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Nov 2022 16:17:34 +0800
+Subject: drm/amd/display: Revert Reduce delay when sink device not able to ACK
+ 00340h write
+
+From: Ian Chen <ian.chen@amd.com>
+
+[ Upstream commit 639f6ad6df7f47db48b59956b469a6917a136afb ]
+
+[WHY]
+It causes regression AMD source will not write DPCD 340.
+
+Reviewed-by: Wayne Lin <Wayne.Lin@amd.com>
+Acked-by: Jasdeep Dhillon <jdhillon@amd.com>
+Signed-off-by: Ian Chen <ian.chen@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/core/dc_link.c | 6 ------
+ drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c | 14 +++-----------
+ drivers/gpu/drm/amd/display/dc/dc_dp_types.h | 1 -
+ 3 files changed, 3 insertions(+), 18 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+index c88f044666fee..754fc86341494 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+@@ -1916,12 +1916,6 @@ struct dc_link *link_create(const struct link_init_data *init_params)
+ if (false == dc_link_construct(link, init_params))
+ goto construct_fail;
+
+- /*
+- * Must use preferred_link_setting, not reported_link_cap or verified_link_cap,
+- * since struct preferred_link_setting won't be reset after S3.
+- */
+- link->preferred_link_setting.dpcd_source_device_specific_field_support = true;
+-
+ return link;
+
+ construct_fail:
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
+index dedd1246ce588..475ad3eed002d 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
+@@ -6554,18 +6554,10 @@ void dpcd_set_source_specific_data(struct dc_link *link)
+
+ uint8_t hblank_size = (uint8_t)link->dc->caps.min_horizontal_blanking_period;
+
+- if (link->preferred_link_setting.dpcd_source_device_specific_field_support) {
+- result_write_min_hblank = core_link_write_dpcd(link,
+- DP_SOURCE_MINIMUM_HBLANK_SUPPORTED, (uint8_t *)(&hblank_size),
+- sizeof(hblank_size));
+-
+- if (result_write_min_hblank == DC_ERROR_UNEXPECTED)
+- link->preferred_link_setting.dpcd_source_device_specific_field_support = false;
+- } else {
+- DC_LOG_DC("Sink device does not support 00340h DPCD write. Skipping on purpose.\n");
+- }
++ result_write_min_hblank = core_link_write_dpcd(link,
++ DP_SOURCE_MINIMUM_HBLANK_SUPPORTED, (uint8_t *)(&hblank_size),
++ sizeof(hblank_size));
+ }
+-
+ DC_TRACE_LEVEL_MESSAGE(DAL_TRACE_LEVEL_INFORMATION,
+ WPP_BIT_FLAG_DC_DETECTION_DP_CAPS,
+ "result=%u link_index=%u enum dce_version=%d DPCD=0x%04X min_hblank=%u branch_dev_id=0x%x branch_dev_name='%c%c%c%c%c%c'",
+diff --git a/drivers/gpu/drm/amd/display/dc/dc_dp_types.h b/drivers/gpu/drm/amd/display/dc/dc_dp_types.h
+index 2c54b6e0498bf..296793d8b2bf2 100644
+--- a/drivers/gpu/drm/amd/display/dc/dc_dp_types.h
++++ b/drivers/gpu/drm/amd/display/dc/dc_dp_types.h
+@@ -149,7 +149,6 @@ struct dc_link_settings {
+ enum dc_link_spread link_spread;
+ bool use_link_rate_set;
+ uint8_t link_rate_set;
+- bool dpcd_source_device_specific_field_support;
+ };
+
+ union dc_dp_ffe_preset {
+--
+2.39.2
+
--- /dev/null
+From da95023c92c3c036f0c0119c8e8c0093d719119b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Jan 2023 17:44:10 -0500
+Subject: drm/amd/display: Set hvm_enabled flag for S/G mode
+
+From: Roman Li <roman.li@amd.com>
+
+[ Upstream commit 40e9f3f067bc6fb47b878f8ba0a9cc7b93abbf49 ]
+
+[Why]
+After enabling S/G on dcn314 a screen corruption may be observed.
+HostVM flag should be set in S/G mode to be included in DML calculations.
+
+[How]
+In S/G mode gpu_vm_support flag is set.
+Use its value to init is_hvm_enabled.
+
+Reviewed-by: Nicholas Kazlauskas <Nicholas.Kazlauskas@amd.com>
+Acked-by: Alan Liu <HaoPing.Liu@amd.com>
+Signed-off-by: Roman Li <roman.li@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index 69f0ccc18aa82..027ffa5ccda46 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -1239,7 +1239,7 @@ static void mmhub_read_system_context(struct amdgpu_device *adev, struct dc_phy_
+ pa_config->gart_config.page_table_end_addr = page_table_end.quad_part << 12;
+ pa_config->gart_config.page_table_base_addr = page_table_base.quad_part;
+
+- pa_config->is_hvm_enabled = 0;
++ pa_config->is_hvm_enabled = adev->mode_info.gpu_vm_support;
+
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 21111e8e748f84aab1a37662c6f46b74dbfff9f3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Feb 2023 20:36:02 +0100
+Subject: drm/amdgpu: fix enum odm_combine_mode mismatch
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 087bad7eb1f6945f8232f132953ecc2bda8bd38d ]
+
+A conversion from 'bool' to 'enum odm_combine_mode' was incomplete,
+and gcc warns about this with many instances of
+
+display/dc/dml/dcn20/display_mode_vba_20.c:3899:44: warning: implicit conversion from 'enum <anonymous>' to 'enum
+odm_combine_mode' [-Wenum-conversion]
+ 3899 | locals->ODMCombineEnablePerState[i][k] = false;
+
+Change the ones that we get a warning for, using the same numerical
+values to leave the behavior unchanged.
+
+Fixes: 5fc11598166d ("drm/amd/display: expand dml structs")
+Link: https://lore.kernel.org/all/20201026210039.3884312-3-arnd@kernel.org/
+Link: https://lore.kernel.org/all/20210927100659.1431744-1-arnd@kernel.org/
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../amd/display/dc/dml/dcn20/display_mode_vba_20.c | 8 ++++----
+ .../amd/display/dc/dml/dcn20/display_mode_vba_20v2.c | 10 +++++-----
+ .../amd/display/dc/dml/dcn21/display_mode_vba_21.c | 12 ++++++------
+ 3 files changed, 15 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_mode_vba_20.c b/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_mode_vba_20.c
+index d3b5b6fedf042..6266b0788387e 100644
+--- a/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_mode_vba_20.c
++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_mode_vba_20.c
+@@ -3897,14 +3897,14 @@ void dml20_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode_l
+ mode_lib->vba.PlaneRequiredDISPCLKWithODMCombine = mode_lib->vba.PixelClock[k] / 2
+ * (1 + mode_lib->vba.DISPCLKDPPCLKDSCCLKDownSpreading / 100.0);
+
+- locals->ODMCombineEnablePerState[i][k] = false;
++ locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_disabled;
+ mode_lib->vba.PlaneRequiredDISPCLK = mode_lib->vba.PlaneRequiredDISPCLKWithoutODMCombine;
+ if (mode_lib->vba.ODMCapability) {
+ if (locals->PlaneRequiredDISPCLKWithoutODMCombine > mode_lib->vba.MaxDispclkRoundedDownToDFSGranularity) {
+- locals->ODMCombineEnablePerState[i][k] = true;
++ locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_2to1;
+ mode_lib->vba.PlaneRequiredDISPCLK = mode_lib->vba.PlaneRequiredDISPCLKWithODMCombine;
+ } else if (locals->HActive[k] > DCN20_MAX_420_IMAGE_WIDTH && locals->OutputFormat[k] == dm_420) {
+- locals->ODMCombineEnablePerState[i][k] = true;
++ locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_2to1;
+ mode_lib->vba.PlaneRequiredDISPCLK = mode_lib->vba.PlaneRequiredDISPCLKWithODMCombine;
+ }
+ }
+@@ -3957,7 +3957,7 @@ void dml20_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode_l
+ locals->RequiredDISPCLK[i][j] = 0.0;
+ locals->DISPCLK_DPPCLK_Support[i][j] = true;
+ for (k = 0; k <= mode_lib->vba.NumberOfActivePlanes - 1; k++) {
+- locals->ODMCombineEnablePerState[i][k] = false;
++ locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_disabled;
+ if (locals->SwathWidthYSingleDPP[k] <= locals->MaximumSwathWidth[k]) {
+ locals->NoOfDPP[i][j][k] = 1;
+ locals->RequiredDPPCLK[i][j][k] = locals->MinDPPCLKUsingSingleDPP[k]
+diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_mode_vba_20v2.c b/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_mode_vba_20v2.c
+index edd098c7eb927..989d83ee38421 100644
+--- a/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_mode_vba_20v2.c
++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_mode_vba_20v2.c
+@@ -4008,17 +4008,17 @@ void dml20v2_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode
+ mode_lib->vba.PlaneRequiredDISPCLKWithODMCombine = mode_lib->vba.PixelClock[k] / 2
+ * (1 + mode_lib->vba.DISPCLKDPPCLKDSCCLKDownSpreading / 100.0);
+
+- locals->ODMCombineEnablePerState[i][k] = false;
++ locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_disabled;
+ mode_lib->vba.PlaneRequiredDISPCLK = mode_lib->vba.PlaneRequiredDISPCLKWithoutODMCombine;
+ if (mode_lib->vba.ODMCapability) {
+ if (locals->PlaneRequiredDISPCLKWithoutODMCombine > MaxMaxDispclkRoundedDown) {
+- locals->ODMCombineEnablePerState[i][k] = true;
++ locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_2to1;
+ mode_lib->vba.PlaneRequiredDISPCLK = mode_lib->vba.PlaneRequiredDISPCLKWithODMCombine;
+ } else if (locals->DSCEnabled[k] && (locals->HActive[k] > DCN20_MAX_DSC_IMAGE_WIDTH)) {
+- locals->ODMCombineEnablePerState[i][k] = true;
++ locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_2to1;
+ mode_lib->vba.PlaneRequiredDISPCLK = mode_lib->vba.PlaneRequiredDISPCLKWithODMCombine;
+ } else if (locals->HActive[k] > DCN20_MAX_420_IMAGE_WIDTH && locals->OutputFormat[k] == dm_420) {
+- locals->ODMCombineEnablePerState[i][k] = true;
++ locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_2to1;
+ mode_lib->vba.PlaneRequiredDISPCLK = mode_lib->vba.PlaneRequiredDISPCLKWithODMCombine;
+ }
+ }
+@@ -4071,7 +4071,7 @@ void dml20v2_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode
+ locals->RequiredDISPCLK[i][j] = 0.0;
+ locals->DISPCLK_DPPCLK_Support[i][j] = true;
+ for (k = 0; k <= mode_lib->vba.NumberOfActivePlanes - 1; k++) {
+- locals->ODMCombineEnablePerState[i][k] = false;
++ locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_disabled;
+ if (locals->SwathWidthYSingleDPP[k] <= locals->MaximumSwathWidth[k]) {
+ locals->NoOfDPP[i][j][k] = 1;
+ locals->RequiredDPPCLK[i][j][k] = locals->MinDPPCLKUsingSingleDPP[k]
+diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn21/display_mode_vba_21.c b/drivers/gpu/drm/amd/display/dc/dml/dcn21/display_mode_vba_21.c
+index 1d84ae50311d9..b7c2844d0cbee 100644
+--- a/drivers/gpu/drm/amd/display/dc/dml/dcn21/display_mode_vba_21.c
++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn21/display_mode_vba_21.c
+@@ -4102,17 +4102,17 @@ void dml21_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode_l
+ mode_lib->vba.PlaneRequiredDISPCLKWithODMCombine = mode_lib->vba.PixelClock[k] / 2
+ * (1 + mode_lib->vba.DISPCLKDPPCLKDSCCLKDownSpreading / 100.0);
+
+- locals->ODMCombineEnablePerState[i][k] = false;
++ locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_disabled;
+ mode_lib->vba.PlaneRequiredDISPCLK = mode_lib->vba.PlaneRequiredDISPCLKWithoutODMCombine;
+ if (mode_lib->vba.ODMCapability) {
+ if (locals->PlaneRequiredDISPCLKWithoutODMCombine > MaxMaxDispclkRoundedDown) {
+- locals->ODMCombineEnablePerState[i][k] = true;
++ locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_2to1;
+ mode_lib->vba.PlaneRequiredDISPCLK = mode_lib->vba.PlaneRequiredDISPCLKWithODMCombine;
+ } else if (locals->DSCEnabled[k] && (locals->HActive[k] > DCN21_MAX_DSC_IMAGE_WIDTH)) {
+- locals->ODMCombineEnablePerState[i][k] = true;
++ locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_2to1;
+ mode_lib->vba.PlaneRequiredDISPCLK = mode_lib->vba.PlaneRequiredDISPCLKWithODMCombine;
+ } else if (locals->HActive[k] > DCN21_MAX_420_IMAGE_WIDTH && locals->OutputFormat[k] == dm_420) {
+- locals->ODMCombineEnablePerState[i][k] = true;
++ locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_2to1;
+ mode_lib->vba.PlaneRequiredDISPCLK = mode_lib->vba.PlaneRequiredDISPCLKWithODMCombine;
+ }
+ }
+@@ -4165,7 +4165,7 @@ void dml21_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode_l
+ locals->RequiredDISPCLK[i][j] = 0.0;
+ locals->DISPCLK_DPPCLK_Support[i][j] = true;
+ for (k = 0; k <= mode_lib->vba.NumberOfActivePlanes - 1; k++) {
+- locals->ODMCombineEnablePerState[i][k] = false;
++ locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_disabled;
+ if (locals->SwathWidthYSingleDPP[k] <= locals->MaximumSwathWidth[k]) {
+ locals->NoOfDPP[i][j][k] = 1;
+ locals->RequiredDPPCLK[i][j][k] = locals->MinDPPCLKUsingSingleDPP[k]
+@@ -5230,7 +5230,7 @@ void dml21_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode_l
+ mode_lib->vba.ODMCombineEnabled[k] =
+ locals->ODMCombineEnablePerState[mode_lib->vba.VoltageLevel][k];
+ } else {
+- mode_lib->vba.ODMCombineEnabled[k] = false;
++ mode_lib->vba.ODMCombineEnabled[k] = dm_odm_combine_mode_disabled;
+ }
+ mode_lib->vba.DSCEnabled[k] =
+ locals->RequiresDSC[mode_lib->vba.VoltageLevel][k];
+--
+2.39.2
+
--- /dev/null
+From 8bb8c6aa4c95ee868c1f92abff813c3b08e32c8a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Jan 2023 09:55:57 -0500
+Subject: drm/amdgpu: Use the sched from entity for amdgpu_cs trace
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Leo Liu <leo.liu@amd.com>
+
+[ Upstream commit cf22ef78f22ce4df4757472c5dbd33c430c5b659 ]
+
+The problem is that base sched hasn't been assigned yet at this moment,
+causing something like "ring=0" all the time from trace.
+
+mpv:cs0-3473 [002] ..... 129.047431: amdgpu_cs: ring=0, dw=48, fences=0
+mpv:cs0-3473 [002] ..... 129.089125: amdgpu_cs: ring=0, dw=48, fences=0
+mpv:cs0-3473 [002] ..... 129.130987: amdgpu_cs: ring=0, dw=48, fences=0
+mpv:cs0-3473 [002] ..... 129.172478: amdgpu_cs: ring=0, dw=48, fences=0
+
+Fixes: 4624459c84d7 ("drm/amdgpu: add gang submit frontend v6")
+Signed-off-by: Leo Liu <leo.liu@amd.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_trace.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_trace.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_trace.h
+index 677ad2016976d..98d91ebf5c26b 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_trace.h
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_trace.h
+@@ -153,10 +153,10 @@ TRACE_EVENT(amdgpu_cs,
+
+ TP_fast_assign(
+ __entry->bo_list = p->bo_list;
+- __entry->ring = to_amdgpu_ring(job->base.sched)->idx;
++ __entry->ring = to_amdgpu_ring(job->base.entity->rq->sched)->idx;
+ __entry->dw = ib->length_dw;
+ __entry->fences = amdgpu_fence_count_emitted(
+- to_amdgpu_ring(job->base.sched));
++ to_amdgpu_ring(job->base.entity->rq->sched));
+ ),
+ TP_printk("bo_list=%p, ring=%u, dw=%u, fences=%u",
+ __entry->bo_list, __entry->ring, __entry->dw,
+--
+2.39.2
+
--- /dev/null
+From af484eb860f5969f0acd5688313dceef2adaf7f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Jan 2023 18:08:17 -0500
+Subject: drm/amdkfd: Page aligned memory reserve size
+
+From: Philip Yang <Philip.Yang@amd.com>
+
+[ Upstream commit 0c2dece8fb541ab07b68c3312a1065fa9c927a81 ]
+
+Use page aligned size to reserve memory usage because page aligned TTM
+BO size is used to unreserve memory usage, otherwise no page aligned
+size causes memory usage accounting unbalanced.
+
+Change vram_used definition type to int64_t to be able to trigger
+WARN_ONCE(adev && adev->kfd.vram_used < 0, "..."), to help debug the
+accounting issue with warning and backtrace.
+
+Signed-off-by: Philip Yang <Philip.Yang@amd.com>
+Reviewed-by: Felix Kuehling <Felix.Kuehling@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h | 2 +-
+ drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 12 +++++++-----
+ drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 9 +++++++--
+ 3 files changed, 15 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h
+index 0040deaf8a83a..90a5254ec1387 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h
+@@ -97,7 +97,7 @@ struct amdgpu_amdkfd_fence {
+
+ struct amdgpu_kfd_dev {
+ struct kfd_dev *dev;
+- uint64_t vram_used;
++ int64_t vram_used;
+ uint64_t vram_used_aligned;
+ bool init_complete;
+ struct work_struct reset_work;
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
+index 3b5c53712d319..05b884fe0a927 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
+@@ -1612,6 +1612,7 @@ int amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu(
+ struct amdgpu_bo *bo;
+ struct drm_gem_object *gobj = NULL;
+ u32 domain, alloc_domain;
++ uint64_t aligned_size;
+ u64 alloc_flags;
+ int ret;
+
+@@ -1667,22 +1668,23 @@ int amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu(
+ * the memory.
+ */
+ if ((*mem)->aql_queue)
+- size = size >> 1;
++ size >>= 1;
++ aligned_size = PAGE_ALIGN(size);
+
+ (*mem)->alloc_flags = flags;
+
+ amdgpu_sync_create(&(*mem)->sync);
+
+- ret = amdgpu_amdkfd_reserve_mem_limit(adev, size, flags);
++ ret = amdgpu_amdkfd_reserve_mem_limit(adev, aligned_size, flags);
+ if (ret) {
+ pr_debug("Insufficient memory\n");
+ goto err_reserve_limit;
+ }
+
+ pr_debug("\tcreate BO VA 0x%llx size 0x%llx domain %s\n",
+- va, size, domain_string(alloc_domain));
++ va, (*mem)->aql_queue ? size << 1 : size, domain_string(alloc_domain));
+
+- ret = amdgpu_gem_object_create(adev, size, 1, alloc_domain, alloc_flags,
++ ret = amdgpu_gem_object_create(adev, aligned_size, 1, alloc_domain, alloc_flags,
+ bo_type, NULL, &gobj);
+ if (ret) {
+ pr_debug("Failed to create BO on domain %s. ret %d\n",
+@@ -1739,7 +1741,7 @@ int amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu(
+ /* Don't unreserve system mem limit twice */
+ goto err_reserve_limit;
+ err_bo_create:
+- amdgpu_amdkfd_unreserve_mem_limit(adev, size, flags);
++ amdgpu_amdkfd_unreserve_mem_limit(adev, aligned_size, flags);
+ err_reserve_limit:
+ mutex_destroy(&(*mem)->lock);
+ if (gobj)
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+index 6d291aa6386bd..f79b8e964140e 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+@@ -1127,8 +1127,13 @@ static int kfd_ioctl_alloc_memory_of_gpu(struct file *filep,
+ }
+
+ /* Update the VRAM usage count */
+- if (flags & KFD_IOC_ALLOC_MEM_FLAGS_VRAM)
+- WRITE_ONCE(pdd->vram_usage, pdd->vram_usage + args->size);
++ if (flags & KFD_IOC_ALLOC_MEM_FLAGS_VRAM) {
++ uint64_t size = args->size;
++
++ if (flags & KFD_IOC_ALLOC_MEM_FLAGS_AQL_QUEUE_MEM)
++ size >>= 1;
++ WRITE_ONCE(pdd->vram_usage, pdd->vram_usage + PAGE_ALIGN(size));
++ }
+
+ mutex_unlock(&p->mutex);
+
+--
+2.39.2
+
--- /dev/null
+From b2a17e82bac4c09bfd0c1c42bb4eb6f145eb12fc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Dec 2022 20:30:05 +0100
+Subject: drm/ast: Init iosys_map pointer as I/O memory for damage handling
+
+From: Thomas Zimmermann <tzimmermann@suse.de>
+
+[ Upstream commit b1def7fadfa544bd2467581ce40b659583eb7e79 ]
+
+Ast hardware scans out the primary plane from video memory, which
+is in I/O-memory space. Hence init the damage handler's iosys_map
+pointer as I/O memory.
+
+Not all platforms support accessing I/O memory as system memory,
+although it's usually not a problem in ast's x86-based systems.
+
+The error report is at [1].
+
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
+Reviewed-by: Jocelyn Falempe <jfalempe@redhat.com>
+Fixes: f2fa5a99ca81 ("drm/ast: Convert ast to SHMEM")
+Cc: Thomas Zimmermann <tzimmermann@suse.de>
+Cc: Jocelyn Falempe <jfalempe@redhat.com>
+Cc: Dave Airlie <airlied@redhat.com>
+Cc: dri-devel@lists.freedesktop.org
+Link: https://lore.kernel.org/lkml/202212170111.eInM0unS-lkp@intel.com/T/#u # 1
+Link: https://patchwork.freedesktop.org/patch/msgid/20221216193005.30280-1-tzimmermann@suse.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/ast/ast_mode.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/ast/ast_mode.c b/drivers/gpu/drm/ast/ast_mode.c
+index 66a4a41c3fe94..d314b9e7c05f9 100644
+--- a/drivers/gpu/drm/ast/ast_mode.c
++++ b/drivers/gpu/drm/ast/ast_mode.c
+@@ -636,7 +636,7 @@ static void ast_handle_damage(struct ast_plane *ast_plane, struct iosys_map *src
+ struct drm_framebuffer *fb,
+ const struct drm_rect *clip)
+ {
+- struct iosys_map dst = IOSYS_MAP_INIT_VADDR(ast_plane->vaddr);
++ struct iosys_map dst = IOSYS_MAP_INIT_VADDR_IOMEM(ast_plane->vaddr);
+
+ iosys_map_incr(&dst, drm_fb_clip_offset(fb->pitches[0], fb->format, clip));
+ drm_fb_memcpy(&dst, fb->pitches, src, fb, clip);
+--
+2.39.2
+
--- /dev/null
+From 9137f879d3f7e67133ddff7b6b822ed8b6fcd690 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Nov 2022 17:52:27 +0800
+Subject: drm/bridge: it6505: Guard bridge power in IRQ handler
+
+From: Pin-yen Lin <treapking@chromium.org>
+
+[ Upstream commit 5eb9a4314053bda7642643f70f49a2b415920812 ]
+
+Add a pair of pm_runtime_get_if_in_use and pm_runtime_put_sync in the
+interrupt handler to make sure the bridge won't be powered off during
+the interrupt handlings. Also remove the irq_lock mutex because it's not
+guarding anything now.
+
+Fixes: ab28896f1a83 ("drm/bridge: it6505: Improve synchronization between extcon subsystem")
+Signed-off-by: Pin-yen Lin <treapking@chromium.org>
+Reviewed-by: Robert Foss <robert.foss@linaro.org>
+Signed-off-by: Robert Foss <robert.foss@linaro.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20221109095227.3320919-1-treapking@chromium.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/ite-it6505.c | 22 ++++++++--------------
+ 1 file changed, 8 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/ite-it6505.c b/drivers/gpu/drm/bridge/ite-it6505.c
+index 21a9b8422bda5..e7f7d0ce13805 100644
+--- a/drivers/gpu/drm/bridge/ite-it6505.c
++++ b/drivers/gpu/drm/bridge/ite-it6505.c
+@@ -412,7 +412,6 @@ struct it6505 {
+ * Mutex protects extcon and interrupt functions from interfering
+ * each other.
+ */
+- struct mutex irq_lock;
+ struct mutex extcon_lock;
+ struct mutex mode_lock; /* used to bridge_detect */
+ struct mutex aux_lock; /* used to aux data transfers */
+@@ -2494,10 +2493,8 @@ static irqreturn_t it6505_int_threaded_handler(int unused, void *data)
+ };
+ int int_status[3], i;
+
+- mutex_lock(&it6505->irq_lock);
+-
+- if (it6505->enable_drv_hold || !it6505->powered)
+- goto unlock;
++ if (it6505->enable_drv_hold || pm_runtime_get_if_in_use(dev) <= 0)
++ return IRQ_HANDLED;
+
+ int_status[0] = it6505_read(it6505, INT_STATUS_01);
+ int_status[1] = it6505_read(it6505, INT_STATUS_02);
+@@ -2515,16 +2512,14 @@ static irqreturn_t it6505_int_threaded_handler(int unused, void *data)
+ if (it6505_test_bit(irq_vec[0].bit, (unsigned int *)int_status))
+ irq_vec[0].handler(it6505);
+
+- if (!it6505->hpd_state)
+- goto unlock;
+-
+- for (i = 1; i < ARRAY_SIZE(irq_vec); i++) {
+- if (it6505_test_bit(irq_vec[i].bit, (unsigned int *)int_status))
+- irq_vec[i].handler(it6505);
++ if (it6505->hpd_state) {
++ for (i = 1; i < ARRAY_SIZE(irq_vec); i++) {
++ if (it6505_test_bit(irq_vec[i].bit, (unsigned int *)int_status))
++ irq_vec[i].handler(it6505);
++ }
+ }
+
+-unlock:
+- mutex_unlock(&it6505->irq_lock);
++ pm_runtime_put_sync(dev);
+
+ return IRQ_HANDLED;
+ }
+@@ -3277,7 +3272,6 @@ static int it6505_i2c_probe(struct i2c_client *client,
+ if (!it6505)
+ return -ENOMEM;
+
+- mutex_init(&it6505->irq_lock);
+ mutex_init(&it6505->extcon_lock);
+ mutex_init(&it6505->mode_lock);
+ mutex_init(&it6505->aux_lock);
+--
+2.39.2
+
--- /dev/null
+From d7cae5dc7acb79a1aeadc50f72f8d39c74b90758 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Jan 2023 10:16:50 +0200
+Subject: drm/bridge: lt9611: fix clock calculation
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit 2576eb26494eb0509dd9ceb0cd27771a7a5e3674 ]
+
+Instead of having several fixed values for the pcr register, calculate
+it before programming. This allows the bridge to support most of the
+display modes.
+
+Fixes: 23278bf54afe ("drm/bridge: Introduce LT9611 DSI to HDMI bridge")
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230118081658.2198520-6-dmitry.baryshkov@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/lontium-lt9611.c | 32 +++++++++++--------------
+ 1 file changed, 14 insertions(+), 18 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/lontium-lt9611.c b/drivers/gpu/drm/bridge/lontium-lt9611.c
+index f377052a45a44..e2799a0df8f8b 100644
+--- a/drivers/gpu/drm/bridge/lontium-lt9611.c
++++ b/drivers/gpu/drm/bridge/lontium-lt9611.c
+@@ -192,8 +192,9 @@ static void lt9611_mipi_video_setup(struct lt9611 *lt9611,
+ regmap_write(lt9611->regmap, 0x831b, (u8)(hsync_porch % 256));
+ }
+
+-static void lt9611_pcr_setup(struct lt9611 *lt9611, const struct drm_display_mode *mode)
++static void lt9611_pcr_setup(struct lt9611 *lt9611, const struct drm_display_mode *mode, unsigned int postdiv)
+ {
++ unsigned int pcr_m = mode->clock * 5 * postdiv / 27000;
+ const struct reg_sequence reg_cfg[] = {
+ { 0x830b, 0x01 },
+ { 0x830c, 0x10 },
+@@ -236,24 +237,14 @@ static void lt9611_pcr_setup(struct lt9611 *lt9611, const struct drm_display_mod
+ else
+ regmap_multi_reg_write(lt9611->regmap, reg_cfg, ARRAY_SIZE(reg_cfg));
+
+- switch (mode->hdisplay) {
+- case 640:
+- regmap_write(lt9611->regmap, 0x8326, 0x14);
+- break;
+- case 1920:
+- regmap_write(lt9611->regmap, 0x8326, 0x37);
+- break;
+- case 3840:
+- regmap_write(lt9611->regmap, 0x8326, 0x37);
+- break;
+- }
++ regmap_write(lt9611->regmap, 0x8326, pcr_m);
+
+ /* pcr rst */
+ regmap_write(lt9611->regmap, 0x8011, 0x5a);
+ regmap_write(lt9611->regmap, 0x8011, 0xfa);
+ }
+
+-static int lt9611_pll_setup(struct lt9611 *lt9611, const struct drm_display_mode *mode)
++static int lt9611_pll_setup(struct lt9611 *lt9611, const struct drm_display_mode *mode, unsigned int *postdiv)
+ {
+ unsigned int pclk = mode->clock;
+ const struct reg_sequence reg_cfg[] = {
+@@ -271,12 +262,16 @@ static int lt9611_pll_setup(struct lt9611 *lt9611, const struct drm_display_mode
+
+ regmap_multi_reg_write(lt9611->regmap, reg_cfg, ARRAY_SIZE(reg_cfg));
+
+- if (pclk > 150000)
++ if (pclk > 150000) {
+ regmap_write(lt9611->regmap, 0x812d, 0x88);
+- else if (pclk > 70000)
++ *postdiv = 1;
++ } else if (pclk > 70000) {
+ regmap_write(lt9611->regmap, 0x812d, 0x99);
+- else
++ *postdiv = 2;
++ } else {
+ regmap_write(lt9611->regmap, 0x812d, 0xaa);
++ *postdiv = 4;
++ }
+
+ /*
+ * first divide pclk by 2 first
+@@ -895,14 +890,15 @@ static void lt9611_bridge_mode_set(struct drm_bridge *bridge,
+ {
+ struct lt9611 *lt9611 = bridge_to_lt9611(bridge);
+ struct hdmi_avi_infoframe avi_frame;
++ unsigned int postdiv;
+ int ret;
+
+ lt9611_bridge_pre_enable(bridge);
+
+ lt9611_mipi_input_digital(lt9611, mode);
+- lt9611_pll_setup(lt9611, mode);
++ lt9611_pll_setup(lt9611, mode, &postdiv);
+ lt9611_mipi_video_setup(lt9611, mode);
+- lt9611_pcr_setup(lt9611, mode);
++ lt9611_pcr_setup(lt9611, mode, postdiv);
+
+ ret = drm_hdmi_avi_infoframe_from_display_mode(&avi_frame,
+ <9611->connector,
+--
+2.39.2
+
--- /dev/null
+From 4395dfde7af21d921ef18a878c2d1ebc33e20977 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Jan 2023 10:16:47 +0200
+Subject: drm/bridge: lt9611: fix HPD reenablement
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit a7790f6bd38f3642b60ae3504a2c749135b89451 ]
+
+The driver will reset the bridge in the atomic_pre_enable(). However
+this will also drop the HPD interrupt state. Instead of resetting the
+bridge, properly wake it up. This fixes the HPD interrupt delivery after
+the disable/enable cycle.
+
+Fixes: 23278bf54afe ("drm/bridge: Introduce LT9611 DSI to HDMI bridge")
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230118081658.2198520-3-dmitry.baryshkov@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/lontium-lt9611.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/lontium-lt9611.c b/drivers/gpu/drm/bridge/lontium-lt9611.c
+index 2714184cc53f4..58f39b2792179 100644
+--- a/drivers/gpu/drm/bridge/lontium-lt9611.c
++++ b/drivers/gpu/drm/bridge/lontium-lt9611.c
+@@ -856,12 +856,18 @@ static enum drm_mode_status lt9611_bridge_mode_valid(struct drm_bridge *bridge,
+ static void lt9611_bridge_pre_enable(struct drm_bridge *bridge)
+ {
+ struct lt9611 *lt9611 = bridge_to_lt9611(bridge);
++ static const struct reg_sequence reg_cfg[] = {
++ { 0x8102, 0x12 },
++ { 0x8123, 0x40 },
++ { 0x8130, 0xea },
++ { 0x8011, 0xfa },
++ };
+
+ if (!lt9611->sleep)
+ return;
+
+- lt9611_reset(lt9611);
+- regmap_write(lt9611->regmap, 0x80ee, 0x01);
++ regmap_multi_reg_write(lt9611->regmap,
++ reg_cfg, ARRAY_SIZE(reg_cfg));
+
+ lt9611->sleep = false;
+ }
+--
+2.39.2
+
--- /dev/null
+From 8df766bbdfa3a73c61ada12fd45de6c154c90139 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Jan 2023 10:16:48 +0200
+Subject: drm/bridge: lt9611: fix polarity programming
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit 0b157efa384ea417304b1da284ee2f603c607fc3 ]
+
+Fix programming of hsync and vsync polarities
+
+Fixes: 23278bf54afe ("drm/bridge: Introduce LT9611 DSI to HDMI bridge")
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230118081658.2198520-4-dmitry.baryshkov@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/lontium-lt9611.c | 17 ++++++++++++-----
+ 1 file changed, 12 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/lontium-lt9611.c b/drivers/gpu/drm/bridge/lontium-lt9611.c
+index 58f39b2792179..deb503ca956af 100644
+--- a/drivers/gpu/drm/bridge/lontium-lt9611.c
++++ b/drivers/gpu/drm/bridge/lontium-lt9611.c
+@@ -207,7 +207,6 @@ static void lt9611_pcr_setup(struct lt9611 *lt9611, const struct drm_display_mod
+
+ /* stage 2 */
+ { 0x834a, 0x40 },
+- { 0x831d, 0x10 },
+
+ /* MK limit */
+ { 0x832d, 0x38 },
+@@ -222,11 +221,19 @@ static void lt9611_pcr_setup(struct lt9611 *lt9611, const struct drm_display_mod
+ { 0x8325, 0x00 },
+ { 0x832a, 0x01 },
+ { 0x834a, 0x10 },
+- { 0x831d, 0x10 },
+- { 0x8326, 0x37 },
+ };
++ u8 pol = 0x10;
+
+- regmap_multi_reg_write(lt9611->regmap, reg_cfg, ARRAY_SIZE(reg_cfg));
++ if (mode->flags & DRM_MODE_FLAG_NHSYNC)
++ pol |= 0x2;
++ if (mode->flags & DRM_MODE_FLAG_NVSYNC)
++ pol |= 0x1;
++ regmap_write(lt9611->regmap, 0x831d, pol);
++
++ if (mode->hdisplay == 3840)
++ regmap_multi_reg_write(lt9611->regmap, reg_cfg2, ARRAY_SIZE(reg_cfg2));
++ else
++ regmap_multi_reg_write(lt9611->regmap, reg_cfg, ARRAY_SIZE(reg_cfg));
+
+ switch (mode->hdisplay) {
+ case 640:
+@@ -236,7 +243,7 @@ static void lt9611_pcr_setup(struct lt9611 *lt9611, const struct drm_display_mod
+ regmap_write(lt9611->regmap, 0x8326, 0x37);
+ break;
+ case 3840:
+- regmap_multi_reg_write(lt9611->regmap, reg_cfg2, ARRAY_SIZE(reg_cfg2));
++ regmap_write(lt9611->regmap, 0x8326, 0x37);
+ break;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 5b6dfc44709ea68db9ca9f8a8e56681834a56a9f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Jan 2023 10:16:49 +0200
+Subject: drm/bridge: lt9611: fix programming of video modes
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit ad188aa47edaa033a270e1a3efae43836ff47569 ]
+
+Program the upper part of the hfront_porch into the proper register.
+
+Fixes: 23278bf54afe ("drm/bridge: Introduce LT9611 DSI to HDMI bridge")
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230118081658.2198520-5-dmitry.baryshkov@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/lontium-lt9611.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/bridge/lontium-lt9611.c b/drivers/gpu/drm/bridge/lontium-lt9611.c
+index deb503ca956af..f377052a45a44 100644
+--- a/drivers/gpu/drm/bridge/lontium-lt9611.c
++++ b/drivers/gpu/drm/bridge/lontium-lt9611.c
+@@ -187,7 +187,8 @@ static void lt9611_mipi_video_setup(struct lt9611 *lt9611,
+
+ regmap_write(lt9611->regmap, 0x8319, (u8)(hfront_porch % 256));
+
+- regmap_write(lt9611->regmap, 0x831a, (u8)(hsync_porch / 256));
++ regmap_write(lt9611->regmap, 0x831a, (u8)(hsync_porch / 256) |
++ ((hfront_porch / 256) << 4));
+ regmap_write(lt9611->regmap, 0x831b, (u8)(hsync_porch % 256));
+ }
+
+--
+2.39.2
+
--- /dev/null
+From f32e16e3e323de2dd8025a971d77b7f0a46c5278 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Jan 2023 10:16:46 +0200
+Subject: drm/bridge: lt9611: fix sleep mode setup
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit ae2d329f104b75a0a78dcaded29fe6283289cdf9 ]
+
+On atomic_post_disable the bridge goes to the low power state. However
+the code disables too much of the chip, so the HPD event is not being
+detected and delivered to the host. Reduce the power saving in order to
+get the HPD event.
+
+Fixes: 23278bf54afe ("drm/bridge: Introduce LT9611 DSI to HDMI bridge")
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230118081658.2198520-2-dmitry.baryshkov@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/lontium-lt9611.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/lontium-lt9611.c b/drivers/gpu/drm/bridge/lontium-lt9611.c
+index 7c0a99173b39f..2714184cc53f4 100644
+--- a/drivers/gpu/drm/bridge/lontium-lt9611.c
++++ b/drivers/gpu/drm/bridge/lontium-lt9611.c
+@@ -448,12 +448,11 @@ static void lt9611_sleep_setup(struct lt9611 *lt9611)
+ { 0x8023, 0x01 },
+ { 0x8157, 0x03 }, /* set addr pin as output */
+ { 0x8149, 0x0b },
+- { 0x8151, 0x30 }, /* disable IRQ */
++
+ { 0x8102, 0x48 }, /* MIPI Rx power down */
+ { 0x8123, 0x80 },
+ { 0x8130, 0x00 },
+- { 0x8100, 0x01 }, /* bandgap power down */
+- { 0x8101, 0x00 }, /* system clk power down */
++ { 0x8011, 0x0a },
+ };
+
+ regmap_multi_reg_write(lt9611->regmap,
+--
+2.39.2
+
--- /dev/null
+From eb0dd810ae8230cee4a24b78f2c370368a79bc81 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Jan 2023 10:16:51 +0200
+Subject: drm/bridge: lt9611: pass a pointer to the of node
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit b0a7f8736789935f62d6df32d441cdf05a5c05d2 ]
+
+Pass a pointer to the OF node while registering lt9611 MIPI device.
+
+Fixes: 23278bf54afe ("drm/bridge: Introduce LT9611 DSI to HDMI bridge")
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230118081658.2198520-7-dmitry.baryshkov@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/lontium-lt9611.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/bridge/lontium-lt9611.c b/drivers/gpu/drm/bridge/lontium-lt9611.c
+index e2799a0df8f8b..3b77238ca4aff 100644
+--- a/drivers/gpu/drm/bridge/lontium-lt9611.c
++++ b/drivers/gpu/drm/bridge/lontium-lt9611.c
+@@ -769,7 +769,7 @@ static const struct drm_connector_funcs lt9611_bridge_connector_funcs = {
+ static struct mipi_dsi_device *lt9611_attach_dsi(struct lt9611 *lt9611,
+ struct device_node *dsi_node)
+ {
+- const struct mipi_dsi_device_info info = { "lt9611", 0, NULL };
++ const struct mipi_dsi_device_info info = { "lt9611", 0, lt9611->dev->of_node};
+ struct mipi_dsi_device *dsi;
+ struct mipi_dsi_host *host;
+ struct device *dev = lt9611->dev;
+--
+2.39.2
+
--- /dev/null
+From 6271c0f8231eec204682dded78df7199bbcb3a28 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Nov 2022 09:12:26 +0000
+Subject: drm/bridge: megachips: Fix error handling in i2c_register_driver()
+
+From: Yuan Can <yuancan@huawei.com>
+
+[ Upstream commit 4ecff954c370b82bce45bdca2846c5c5563e8a8a ]
+
+A problem about insmod megachips-stdpxxxx-ge-b850v3-fw.ko failed is
+triggered with the following log given:
+
+[ 4497.981497] Error: Driver 'stdp4028-ge-b850v3-fw' is already registered, aborting...
+insmod: ERROR: could not insert module megachips-stdpxxxx-ge-b850v3-fw.ko: Device or resource busy
+
+The reason is that stdpxxxx_ge_b850v3_init() returns i2c_add_driver()
+directly without checking its return value, if i2c_add_driver() failed,
+it returns without calling i2c_del_driver() on the previous i2c driver,
+resulting the megachips-stdpxxxx-ge-b850v3-fw can never be installed
+later.
+A simple call graph is shown as below:
+
+ stdpxxxx_ge_b850v3_init()
+ i2c_add_driver(&stdp4028_ge_b850v3_fw_driver)
+ i2c_add_driver(&stdp2690_ge_b850v3_fw_driver)
+ i2c_register_driver()
+ driver_register()
+ bus_add_driver()
+ priv = kzalloc(...) # OOM happened
+ # return without delete stdp4028_ge_b850v3_fw_driver
+
+Fix by calling i2c_del_driver() on stdp4028_ge_b850v3_fw_driver when
+i2c_add_driver() returns error.
+
+Fixes: fcfa0ddc18ed ("drm/bridge: Drivers for megachips-stdpxxxx-ge-b850v3-fw (LVDS-DP++)")
+Signed-off-by: Yuan Can <yuancan@huawei.com>
+Reviewed-by: Andrzej Hajda <andrzej.hajda@intel.com>
+Tested-by: Ian Ray <ian.ray@ge.com>
+Signed-off-by: Robert Foss <robert.foss@linaro.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20221108091226.114524-1-yuancan@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c b/drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c
+index 97359f807bfc3..cbfa05a6767b5 100644
+--- a/drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c
++++ b/drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c
+@@ -440,7 +440,11 @@ static int __init stdpxxxx_ge_b850v3_init(void)
+ if (ret)
+ return ret;
+
+- return i2c_add_driver(&stdp2690_ge_b850v3_fw_driver);
++ ret = i2c_add_driver(&stdp2690_ge_b850v3_fw_driver);
++ if (ret)
++ i2c_del_driver(&stdp4028_ge_b850v3_fw_driver);
++
++ return ret;
+ }
+ module_init(stdpxxxx_ge_b850v3_init);
+
+--
+2.39.2
+
--- /dev/null
+From a40ccf488a7822f9d94a8d7f146c7db7f0fa8302 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 16 Oct 2022 02:35:56 +0200
+Subject: drm/bridge: tc358767: Set default CLRSIPO count
+
+From: Marek Vasut <marex@denx.de>
+
+[ Upstream commit 01338bb82fed40a6a234c2b36a92367c8671adf0 ]
+
+The current CLRSIPO count is still marginal and does not work with high
+DSI clock rates in burst mode. Increase it further to allow the DSI link
+to work at up to 1Gbps lane speed. This returns the counts to defaults
+as provided by datasheet.
+
+Fixes: ea6490b02240b ("drm/bridge: tc358767: increase CLRSIPO count")
+Signed-off-by: Marek Vasut <marex@denx.de>
+Acked-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://patchwork.freedesktop.org/patch/msgid/20221016003556.406441-1-marex@denx.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/tc358767.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/tc358767.c b/drivers/gpu/drm/bridge/tc358767.c
+index 2a58eb271f701..b9b681086fc49 100644
+--- a/drivers/gpu/drm/bridge/tc358767.c
++++ b/drivers/gpu/drm/bridge/tc358767.c
+@@ -1264,10 +1264,10 @@ static int tc_dsi_rx_enable(struct tc_data *tc)
+ u32 value;
+ int ret;
+
+- regmap_write(tc->regmap, PPI_D0S_CLRSIPOCOUNT, 5);
+- regmap_write(tc->regmap, PPI_D1S_CLRSIPOCOUNT, 5);
+- regmap_write(tc->regmap, PPI_D2S_CLRSIPOCOUNT, 5);
+- regmap_write(tc->regmap, PPI_D3S_CLRSIPOCOUNT, 5);
++ regmap_write(tc->regmap, PPI_D0S_CLRSIPOCOUNT, 25);
++ regmap_write(tc->regmap, PPI_D1S_CLRSIPOCOUNT, 25);
++ regmap_write(tc->regmap, PPI_D2S_CLRSIPOCOUNT, 25);
++ regmap_write(tc->regmap, PPI_D3S_CLRSIPOCOUNT, 25);
+ regmap_write(tc->regmap, PPI_D0S_ATMR, 0);
+ regmap_write(tc->regmap, PPI_D1S_ATMR, 0);
+ regmap_write(tc->regmap, PPI_TX_RX_TA, TTA_GET | TTA_SURE);
+--
+2.39.2
+
--- /dev/null
+From aa089526cfc2a0fe80c3968180a03949731dabfa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Nov 2022 09:12:18 +0100
+Subject: drm/bridge: ti-sn65dsi83: Fix delay after reset deassert to match
+ spec
+
+From: Frieder Schrempf <frieder.schrempf@kontron.de>
+
+[ Upstream commit 4b03d5e0d3e86ee492d54254927d020dc0fe8acf ]
+
+The datasheet specifies a delay of 10 milliseconds, but the current
+driver only waits for 1 ms. Fix this to make sure the initialization
+sequence meets the spec.
+
+Fixes: ceb515ba29ba ("drm/bridge: ti-sn65dsi83: Add TI SN65DSI83 and SN65DSI84 driver")
+Signed-off-by: Frieder Schrempf <frieder.schrempf@kontron.de>
+Reviewed-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Signed-off-by: Robert Foss <robert.foss@linaro.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20221122081219.20143-1-frieder@fris.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/ti-sn65dsi83.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/bridge/ti-sn65dsi83.c b/drivers/gpu/drm/bridge/ti-sn65dsi83.c
+index 7ba9467fff129..047c14ddbbf11 100644
+--- a/drivers/gpu/drm/bridge/ti-sn65dsi83.c
++++ b/drivers/gpu/drm/bridge/ti-sn65dsi83.c
+@@ -346,7 +346,7 @@ static void sn65dsi83_atomic_enable(struct drm_bridge *bridge,
+
+ /* Deassert reset */
+ gpiod_set_value_cansleep(ctx->enable_gpio, 1);
+- usleep_range(1000, 1100);
++ usleep_range(10000, 11000);
+
+ /* Get the LVDS format from the bridge state. */
+ bridge_state = drm_atomic_get_new_bridge_state(state, bridge);
+--
+2.39.2
+
--- /dev/null
+From 06e7f9c5415a8a6c3cef1fdbc82a7198175cefa2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Jan 2023 21:04:06 +0100
+Subject: drm/client: Test for connectors before sending hotplug event
+
+From: Thomas Zimmermann <tzimmermann@suse.de>
+
+[ Upstream commit c2bb3be64eb7182285846123219230375af61abd ]
+
+Test for connectors in the client code and remove a similar test
+from the generic fbdev emulation. Do nothing if the test fails.
+Not having connectors indicates a driver bug.
+
+Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
+Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230125200415.14123-2-tzimmermann@suse.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_client.c | 5 +++++
+ drivers/gpu/drm/drm_fbdev_generic.c | 5 -----
+ 2 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_client.c b/drivers/gpu/drm/drm_client.c
+index 056ab9d5f313b..313cbabb12b2d 100644
+--- a/drivers/gpu/drm/drm_client.c
++++ b/drivers/gpu/drm/drm_client.c
+@@ -198,6 +198,11 @@ void drm_client_dev_hotplug(struct drm_device *dev)
+ if (!drm_core_check_feature(dev, DRIVER_MODESET))
+ return;
+
++ if (!dev->mode_config.num_connector) {
++ drm_dbg_kms(dev, "No connectors found, will not send hotplug events!\n");
++ return;
++ }
++
+ mutex_lock(&dev->clientlist_mutex);
+ list_for_each_entry(client, &dev->clientlist, list) {
+ if (!client->funcs || !client->funcs->hotplug)
+diff --git a/drivers/gpu/drm/drm_fbdev_generic.c b/drivers/gpu/drm/drm_fbdev_generic.c
+index 593aa3283792b..215fe16ff1fb4 100644
+--- a/drivers/gpu/drm/drm_fbdev_generic.c
++++ b/drivers/gpu/drm/drm_fbdev_generic.c
+@@ -390,11 +390,6 @@ static int drm_fbdev_client_hotplug(struct drm_client_dev *client)
+ if (dev->fb_helper)
+ return drm_fb_helper_hotplug_event(dev->fb_helper);
+
+- if (!dev->mode_config.num_connector) {
+- drm_dbg_kms(dev, "No connectors found, will not create framebuffer!\n");
+- return 0;
+- }
+-
+ drm_fb_helper_prepare(dev, fb_helper, &drm_fb_helper_generic_funcs);
+
+ ret = drm_fb_helper_init(dev, fb_helper);
+--
+2.39.2
+
--- /dev/null
+From f537fb0e1ab58f27cee7e86751a2a61fe350ec87 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Dec 2022 09:57:02 +0800
+Subject: drm/drm_print: correct format problem
+
+From: Wayne Lin <Wayne.Lin@amd.com>
+
+[ Upstream commit d987150b539271b0394f24c1c648d2846662adb4 ]
+
+[why & how]
+__drm_dbg() parameter set format is wrong and not aligned with the
+format under CONFIG_DRM_USE_DYNAMIC_DEBUG is on. Fix it.
+
+Signed-off-by: Wayne Lin <Wayne.Lin@amd.com>
+Signed-off-by: Harry Wentland <harry.wentland@amd.com>
+Acked-by: Harry Wentland <harry.wentland@amd.com>
+Reviewed-by: Lyude Paul <lyude@redhat.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/drm/drm_print.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/drm/drm_print.h b/include/drm/drm_print.h
+index a44fb7ef257f6..094ded23534c7 100644
+--- a/include/drm/drm_print.h
++++ b/include/drm/drm_print.h
+@@ -521,7 +521,7 @@ __printf(1, 2)
+ void __drm_err(const char *format, ...);
+
+ #if !defined(CONFIG_DRM_USE_DYNAMIC_DEBUG)
+-#define __drm_dbg(fmt, ...) ___drm_dbg(NULL, fmt, ##__VA_ARGS__)
++#define __drm_dbg(cat, fmt, ...) ___drm_dbg(NULL, cat, fmt, ##__VA_ARGS__)
+ #else
+ #define __drm_dbg(cat, fmt, ...) \
+ _dynamic_func_call_cls(cat, fmt, ___drm_dbg, \
+--
+2.39.2
+
--- /dev/null
+From f0bd5f428cacd1e1c3b809251f8110397aca400b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Dec 2022 20:27:44 +0530
+Subject: drm: exynos: dsi: Fix MIPI_DSI*_NO_* mode flags
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jagan Teki <jagan@amarulasolutions.com>
+
+[ Upstream commit 996e1defca34485dd2bd70b173f069aab5f21a65 ]
+
+HFP/HBP/HSA/EOT_PACKET modes in Exynos DSI host specifies
+0 = Enable and 1 = Disable.
+
+The logic for checking these mode flags was correct before
+the MIPI_DSI*_NO_* mode flag conversion.
+
+This patch is trying to fix this MIPI_DSI*_NO_* mode flags handling
+Exynos DSI host and update the mode_flags in relevant panel drivers.
+
+Fixes: 0f3b68b66a6d ("drm/dsi: Add _NO_ to MIPI_DSI_* flags disabling features")
+Reviewed-by: Marek Vasut <marex@denx.de>
+Reviewed-by: Nicolas Boichat <drinkcat@chromium.org>
+Reported-by: Sébastien Szymanski <sebastien.szymanski@armadeus.com>
+Signed-off-by: Jagan Teki <jagan@amarulasolutions.com>
+Reviewed-by: Frieder Schrempf <frieder.schrempf@kontron.de>
+Signed-off-by: Marek Vasut <marex@denx.de>
+Link: https://patchwork.freedesktop.org/patch/msgid/20221212145745.15387-1-jagan@amarulasolutions.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/exynos/exynos_drm_dsi.c | 8 ++++----
+ drivers/gpu/drm/panel/panel-samsung-s6e3ha2.c | 4 +++-
+ drivers/gpu/drm/panel/panel-samsung-s6e63j0x03.c | 3 ++-
+ drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c | 2 --
+ 4 files changed, 9 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/gpu/drm/exynos/exynos_drm_dsi.c b/drivers/gpu/drm/exynos/exynos_drm_dsi.c
+index ec673223d6b7a..b5305b145ddbd 100644
+--- a/drivers/gpu/drm/exynos/exynos_drm_dsi.c
++++ b/drivers/gpu/drm/exynos/exynos_drm_dsi.c
+@@ -805,15 +805,15 @@ static int exynos_dsi_init_link(struct exynos_dsi *dsi)
+ reg |= DSIM_AUTO_MODE;
+ if (dsi->mode_flags & MIPI_DSI_MODE_VIDEO_HSE)
+ reg |= DSIM_HSE_MODE;
+- if (!(dsi->mode_flags & MIPI_DSI_MODE_VIDEO_NO_HFP))
++ if (dsi->mode_flags & MIPI_DSI_MODE_VIDEO_NO_HFP)
+ reg |= DSIM_HFP_MODE;
+- if (!(dsi->mode_flags & MIPI_DSI_MODE_VIDEO_NO_HBP))
++ if (dsi->mode_flags & MIPI_DSI_MODE_VIDEO_NO_HBP)
+ reg |= DSIM_HBP_MODE;
+- if (!(dsi->mode_flags & MIPI_DSI_MODE_VIDEO_NO_HSA))
++ if (dsi->mode_flags & MIPI_DSI_MODE_VIDEO_NO_HSA)
+ reg |= DSIM_HSA_MODE;
+ }
+
+- if (!(dsi->mode_flags & MIPI_DSI_MODE_NO_EOT_PACKET))
++ if (dsi->mode_flags & MIPI_DSI_MODE_NO_EOT_PACKET)
+ reg |= DSIM_EOT_DISABLE;
+
+ switch (dsi->format) {
+diff --git a/drivers/gpu/drm/panel/panel-samsung-s6e3ha2.c b/drivers/gpu/drm/panel/panel-samsung-s6e3ha2.c
+index 5c621b15e84c2..439ef30735128 100644
+--- a/drivers/gpu/drm/panel/panel-samsung-s6e3ha2.c
++++ b/drivers/gpu/drm/panel/panel-samsung-s6e3ha2.c
+@@ -692,7 +692,9 @@ static int s6e3ha2_probe(struct mipi_dsi_device *dsi)
+
+ dsi->lanes = 4;
+ dsi->format = MIPI_DSI_FMT_RGB888;
+- dsi->mode_flags = MIPI_DSI_CLOCK_NON_CONTINUOUS;
++ dsi->mode_flags = MIPI_DSI_CLOCK_NON_CONTINUOUS |
++ MIPI_DSI_MODE_VIDEO_NO_HFP | MIPI_DSI_MODE_VIDEO_NO_HBP |
++ MIPI_DSI_MODE_VIDEO_NO_HSA | MIPI_DSI_MODE_NO_EOT_PACKET;
+
+ ctx->supplies[0].supply = "vdd3";
+ ctx->supplies[1].supply = "vci";
+diff --git a/drivers/gpu/drm/panel/panel-samsung-s6e63j0x03.c b/drivers/gpu/drm/panel/panel-samsung-s6e63j0x03.c
+index e06fd35de814b..9c3e76171759a 100644
+--- a/drivers/gpu/drm/panel/panel-samsung-s6e63j0x03.c
++++ b/drivers/gpu/drm/panel/panel-samsung-s6e63j0x03.c
+@@ -446,7 +446,8 @@ static int s6e63j0x03_probe(struct mipi_dsi_device *dsi)
+
+ dsi->lanes = 1;
+ dsi->format = MIPI_DSI_FMT_RGB888;
+- dsi->mode_flags = MIPI_DSI_MODE_NO_EOT_PACKET;
++ dsi->mode_flags = MIPI_DSI_MODE_VIDEO_NO_HFP |
++ MIPI_DSI_MODE_VIDEO_NO_HBP | MIPI_DSI_MODE_VIDEO_NO_HSA;
+
+ ctx->supplies[0].supply = "vdd3";
+ ctx->supplies[1].supply = "vci";
+diff --git a/drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c b/drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c
+index 54213beafaf5e..ebf4c2d39ea88 100644
+--- a/drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c
++++ b/drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c
+@@ -990,8 +990,6 @@ static int s6e8aa0_probe(struct mipi_dsi_device *dsi)
+ dsi->lanes = 4;
+ dsi->format = MIPI_DSI_FMT_RGB888;
+ dsi->mode_flags = MIPI_DSI_MODE_VIDEO | MIPI_DSI_MODE_VIDEO_BURST
+- | MIPI_DSI_MODE_VIDEO_NO_HFP | MIPI_DSI_MODE_VIDEO_NO_HBP
+- | MIPI_DSI_MODE_VIDEO_NO_HSA | MIPI_DSI_MODE_NO_EOT_PACKET
+ | MIPI_DSI_MODE_VSYNC_FLUSH | MIPI_DSI_MODE_VIDEO_AUTO_VERT;
+
+ ret = s6e8aa0_parse_dt(ctx);
+--
+2.39.2
+
--- /dev/null
+From 4fbf22e2b716e9083fd2547ae2695e587417b0cf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Nov 2022 10:16:51 +0800
+Subject: drm: Fix potential null-ptr-deref due to drmm_mode_config_init()
+
+From: Shang XiaoJing <shangxiaojing@huawei.com>
+
+[ Upstream commit 834c23e4f798dcdc8af251b3c428ceef94741991 ]
+
+drmm_mode_config_init() will call drm_mode_create_standard_properties()
+and won't check the ret value. When drm_mode_create_standard_properties()
+failed due to alloc, property will be a NULL pointer and may causes the
+null-ptr-deref. Fix the null-ptr-deref by adding the ret value check.
+
+Found null-ptr-deref while testing insert module bochs:
+general protection fault, probably for non-canonical address
+ 0xdffffc000000000c: 0000 [#1] SMP KASAN PTI
+KASAN: null-ptr-deref in range [0x0000000000000060-0x0000000000000067]
+CPU: 3 PID: 249 Comm: modprobe Not tainted 6.1.0-rc1+ #364
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
+rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014
+RIP: 0010:drm_object_attach_property+0x73/0x3c0 [drm]
+Call Trace:
+ <TASK>
+ __drm_connector_init+0xb6c/0x1100 [drm]
+ bochs_pci_probe.cold.11+0x4cb/0x7fe [bochs]
+ pci_device_probe+0x17d/0x340
+ really_probe+0x1db/0x5d0
+ __driver_probe_device+0x1e7/0x250
+ driver_probe_device+0x4a/0x120
+ __driver_attach+0xcd/0x2c0
+ bus_for_each_dev+0x11a/0x1b0
+ bus_add_driver+0x3d7/0x500
+ driver_register+0x18e/0x320
+ do_one_initcall+0xc4/0x3e0
+ do_init_module+0x1b4/0x630
+ load_module+0x5dca/0x7230
+ __do_sys_finit_module+0x100/0x170
+ do_syscall_64+0x3f/0x90
+ entry_SYSCALL_64_after_hwframe+0x63/0xcd
+RIP: 0033:0x7ff65af9f839
+
+Fixes: 6b4959f43a04 ("drm/atomic: atomic plane properties")
+Signed-off-by: Shang XiaoJing <shangxiaojing@huawei.com>
+Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
+Link: https://patchwork.freedesktop.org/patch/msgid/20221118021651.2460-1-shangxiaojing@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_mode_config.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/drm_mode_config.c b/drivers/gpu/drm/drm_mode_config.c
+index 688c8afe0bf17..8525ef8515406 100644
+--- a/drivers/gpu/drm/drm_mode_config.c
++++ b/drivers/gpu/drm/drm_mode_config.c
+@@ -399,6 +399,8 @@ static void drm_mode_config_init_release(struct drm_device *dev, void *ptr)
+ */
+ int drmm_mode_config_init(struct drm_device *dev)
+ {
++ int ret;
++
+ mutex_init(&dev->mode_config.mutex);
+ drm_modeset_lock_init(&dev->mode_config.connection_mutex);
+ mutex_init(&dev->mode_config.idr_mutex);
+@@ -420,7 +422,11 @@ int drmm_mode_config_init(struct drm_device *dev)
+ init_llist_head(&dev->mode_config.connector_free_list);
+ INIT_WORK(&dev->mode_config.connector_free_work, drm_connector_free_work_fn);
+
+- drm_mode_create_standard_properties(dev);
++ ret = drm_mode_create_standard_properties(dev);
++ if (ret) {
++ drm_mode_config_cleanup(dev);
++ return ret;
++ }
+
+ /* Just to be sure */
+ dev->mode_config.num_fb = 0;
+--
+2.39.2
+
--- /dev/null
+From bc55c3b61d6e7aa3732e4042183c7f401a5519f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Nov 2022 17:43:10 +0100
+Subject: drm/fourcc: Add missing big-endian XRGB1555 and RGB565 formats
+
+From: Geert Uytterhoeven <geert@linux-m68k.org>
+
+[ Upstream commit 6fb6c979ca628583d4d0c59a0f8ff977e581ecc0 ]
+
+As of commit eae06120f1974e1a ("drm: refuse ADDFB2 ioctl for broken
+bigendian drivers"), drivers must set the
+quirk_addfb_prefer_host_byte_order quirk to make the drm_mode_addfb()
+compat code work correctly on big-endian machines.
+
+While that works fine for big-endian XRGB8888 and ARGB8888, which are
+mapped to the existing little-endian BGRX8888 and BGRA8888 formats, it
+does not work for big-endian XRGB1555 and RGB565, as the latter are not
+listed in the format database.
+
+Fix this by adding the missing formats. Limit this to big-endian
+platforms, as there is currently no need to support these formats on
+little-endian platforms.
+
+Fixes: 6960e6da9cec3f66 ("drm: fix drm_mode_addfb() on big endian machines.")
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: https://patchwork.freedesktop.org/patch/msgid/3ee1f8144feb96c28742b22384189f1f83bcfc1a.1669221671.git.geert@linux-m68k.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_fourcc.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/gpu/drm/drm_fourcc.c b/drivers/gpu/drm/drm_fourcc.c
+index 6242dfbe92402..0f17dfa8702b4 100644
+--- a/drivers/gpu/drm/drm_fourcc.c
++++ b/drivers/gpu/drm/drm_fourcc.c
+@@ -190,6 +190,10 @@ const struct drm_format_info *__drm_format_info(u32 format)
+ { .format = DRM_FORMAT_BGRA5551, .depth = 15, .num_planes = 1, .cpp = { 2, 0, 0 }, .hsub = 1, .vsub = 1, .has_alpha = true },
+ { .format = DRM_FORMAT_RGB565, .depth = 16, .num_planes = 1, .cpp = { 2, 0, 0 }, .hsub = 1, .vsub = 1 },
+ { .format = DRM_FORMAT_BGR565, .depth = 16, .num_planes = 1, .cpp = { 2, 0, 0 }, .hsub = 1, .vsub = 1 },
++#ifdef __BIG_ENDIAN
++ { .format = DRM_FORMAT_XRGB1555 | DRM_FORMAT_BIG_ENDIAN, .depth = 15, .num_planes = 1, .cpp = { 2, 0, 0 }, .hsub = 1, .vsub = 1 },
++ { .format = DRM_FORMAT_RGB565 | DRM_FORMAT_BIG_ENDIAN, .depth = 16, .num_planes = 1, .cpp = { 2, 0, 0 }, .hsub = 1, .vsub = 1 },
++#endif
+ { .format = DRM_FORMAT_RGB888, .depth = 24, .num_planes = 1, .cpp = { 3, 0, 0 }, .hsub = 1, .vsub = 1 },
+ { .format = DRM_FORMAT_BGR888, .depth = 24, .num_planes = 1, .cpp = { 3, 0, 0 }, .hsub = 1, .vsub = 1 },
+ { .format = DRM_FORMAT_XRGB8888, .depth = 24, .num_planes = 1, .cpp = { 4, 0, 0 }, .hsub = 1, .vsub = 1 },
+--
+2.39.2
+
--- /dev/null
+From 984c50da3a51e5941e278cfe54e9d08b56f6a343 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Feb 2023 08:54:09 -0800
+Subject: drm/i915: Fix GEN8_MISCCPCTL
+
+From: Lucas De Marchi <lucas.demarchi@intel.com>
+
+[ Upstream commit 6a8b2e4984f73f8d00c8c16b87a8b115d34088e4 ]
+
+Register 0x9424 is not replicated on any platform, so it shouldn't be
+declared with REG_MCR(). Declaring it with _MMIO() is basically
+duplicate of the GEN7 version, so just remove the GEN8 and change all
+the callers to use the right functions.
+
+Old versions of the gen8 bspec page used to contain a table with MCR
+registers, apparently implying 0x9400 - 0x94ff registers were
+replicated. However that table went away and there is no information
+related to the ranges for gen8 anymore. Moreover the current behavior of
+the driver wouldn't do anything special for 0x9424 since there is no
+equivalent table in intel_gt_mcr.c: the driver would just fallback to
+intel_uncore_{read,write}(). Therefore, do not care about the possible
+special case for gen8 and just use the register as non-MCR for all the
+platforms.
+
+One place doing read + write is also converted to intel_uncore_rmw().
+
+v2: Reword commit message adding the justification wrt gen8
+
+Fixes: a9e69428b1b4 ("drm/i915: Define MCR registers explicitly")
+Cc: Balasubramani Vivekanandan <balasubramani.vivekanandan@intel.com>
+Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Cc: Gustavo Sousa <gustavo.sousa@intel.com>
+Cc: Matt Atwood <matthew.s.atwood@intel.com>
+Cc: Ashutosh Dixit <ashutosh.dixit@intel.com>
+Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
+Reviewed-by: Matt Roper <matthew.d.roper@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230206165410.3056073-1-lucas.demarchi@intel.com
+(cherry picked from commit 869bace73ae2b4227e57ee3fd994bfa7d4808938)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/gt/intel_gt_regs.h | 5 +----
+ drivers/gpu/drm/i915/gt/intel_workarounds.c | 4 ++--
+ drivers/gpu/drm/i915/gt/uc/intel_guc_fw.c | 5 ++---
+ drivers/gpu/drm/i915/intel_pm.c | 10 +++++-----
+ 4 files changed, 10 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/gt/intel_gt_regs.h b/drivers/gpu/drm/i915/gt/intel_gt_regs.h
+index 0d47c930956e0..3b6ef0eb47e76 100644
+--- a/drivers/gpu/drm/i915/gt/intel_gt_regs.h
++++ b/drivers/gpu/drm/i915/gt/intel_gt_regs.h
+@@ -681,10 +681,7 @@
+ #define GEN6_RSTCTL _MMIO(0x9420)
+
+ #define GEN7_MISCCPCTL _MMIO(0x9424)
+-#define GEN7_DOP_CLOCK_GATE_ENABLE (1 << 0)
+-
+-#define GEN8_MISCCPCTL MCR_REG(0x9424)
+-#define GEN8_DOP_CLOCK_GATE_ENABLE REG_BIT(0)
++#define GEN7_DOP_CLOCK_GATE_ENABLE REG_BIT(0)
+ #define GEN12_DOP_CLOCK_GATE_RENDER_ENABLE REG_BIT(1)
+ #define GEN8_DOP_CLOCK_GATE_CFCLK_ENABLE (1 << 2)
+ #define GEN8_DOP_CLOCK_GATE_GUC_ENABLE (1 << 4)
+diff --git a/drivers/gpu/drm/i915/gt/intel_workarounds.c b/drivers/gpu/drm/i915/gt/intel_workarounds.c
+index 80b0e9a56330c..d92b006d4cd2e 100644
+--- a/drivers/gpu/drm/i915/gt/intel_workarounds.c
++++ b/drivers/gpu/drm/i915/gt/intel_workarounds.c
+@@ -1673,7 +1673,7 @@ dg2_gt_workarounds_init(struct intel_gt *gt, struct i915_wa_list *wal)
+ wa_mcr_write_or(wal, XEHP_SQCM, EN_32B_ACCESS);
+
+ /* Wa_14015795083 */
+- wa_mcr_write_clr(wal, GEN8_MISCCPCTL, GEN12_DOP_CLOCK_GATE_RENDER_ENABLE);
++ wa_write_clr(wal, GEN7_MISCCPCTL, GEN12_DOP_CLOCK_GATE_RENDER_ENABLE);
+
+ /* Wa_18018781329 */
+ wa_mcr_write_or(wal, RENDER_MOD_CTRL, FORCE_MISS_FTLB);
+@@ -1692,7 +1692,7 @@ pvc_gt_workarounds_init(struct intel_gt *gt, struct i915_wa_list *wal)
+ pvc_init_mcr(gt, wal);
+
+ /* Wa_14015795083 */
+- wa_mcr_write_clr(wal, GEN8_MISCCPCTL, GEN12_DOP_CLOCK_GATE_RENDER_ENABLE);
++ wa_write_clr(wal, GEN7_MISCCPCTL, GEN12_DOP_CLOCK_GATE_RENDER_ENABLE);
+
+ /* Wa_18018781329 */
+ wa_mcr_write_or(wal, RENDER_MOD_CTRL, FORCE_MISS_FTLB);
+diff --git a/drivers/gpu/drm/i915/gt/uc/intel_guc_fw.c b/drivers/gpu/drm/i915/gt/uc/intel_guc_fw.c
+index 5b86b2e286e07..42c5d9d2e2182 100644
+--- a/drivers/gpu/drm/i915/gt/uc/intel_guc_fw.c
++++ b/drivers/gpu/drm/i915/gt/uc/intel_guc_fw.c
+@@ -38,9 +38,8 @@ static void guc_prepare_xfer(struct intel_gt *gt)
+
+ if (GRAPHICS_VER(uncore->i915) == 9) {
+ /* DOP Clock Gating Enable for GuC clocks */
+- intel_gt_mcr_multicast_write(gt, GEN8_MISCCPCTL,
+- GEN8_DOP_CLOCK_GATE_GUC_ENABLE |
+- intel_gt_mcr_read_any(gt, GEN8_MISCCPCTL));
++ intel_uncore_rmw(uncore, GEN7_MISCCPCTL, 0,
++ GEN8_DOP_CLOCK_GATE_GUC_ENABLE);
+
+ /* allows for 5us (in 10ns units) before GT can go to RC6 */
+ intel_uncore_write(uncore, GUC_ARAT_C6DIS, 0x1FF);
+diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
+index 73c88b1c9545c..ac61df46d02c5 100644
+--- a/drivers/gpu/drm/i915/intel_pm.c
++++ b/drivers/gpu/drm/i915/intel_pm.c
+@@ -4299,8 +4299,8 @@ static void gen8_set_l3sqc_credits(struct drm_i915_private *dev_priv,
+ u32 val;
+
+ /* WaTempDisableDOPClkGating:bdw */
+- misccpctl = intel_gt_mcr_multicast_rmw(to_gt(dev_priv), GEN8_MISCCPCTL,
+- GEN8_DOP_CLOCK_GATE_ENABLE, 0);
++ misccpctl = intel_uncore_rmw(&dev_priv->uncore, GEN7_MISCCPCTL,
++ GEN7_DOP_CLOCK_GATE_ENABLE, 0);
+
+ val = intel_gt_mcr_read_any(to_gt(dev_priv), GEN8_L3SQCREG1);
+ val &= ~L3_PRIO_CREDITS_MASK;
+@@ -4314,7 +4314,7 @@ static void gen8_set_l3sqc_credits(struct drm_i915_private *dev_priv,
+ */
+ intel_gt_mcr_read_any(to_gt(dev_priv), GEN8_L3SQCREG1);
+ udelay(1);
+- intel_gt_mcr_multicast_write(to_gt(dev_priv), GEN8_MISCCPCTL, misccpctl);
++ intel_uncore_write(&dev_priv->uncore, GEN7_MISCCPCTL, misccpctl);
+ }
+
+ static void icl_init_clock_gating(struct drm_i915_private *dev_priv)
+@@ -4465,8 +4465,8 @@ static void skl_init_clock_gating(struct drm_i915_private *dev_priv)
+ gen9_init_clock_gating(dev_priv);
+
+ /* WaDisableDopClockGating:skl */
+- intel_gt_mcr_multicast_rmw(to_gt(dev_priv), GEN8_MISCCPCTL,
+- GEN8_DOP_CLOCK_GATE_ENABLE, 0);
++ intel_uncore_rmw(&dev_priv->uncore, GEN7_MISCCPCTL,
++ GEN7_DOP_CLOCK_GATE_ENABLE, 0);
+
+ /* WAC6entrylatency:skl */
+ intel_uncore_rmw(&dev_priv->uncore, FBC_LLC_READ_CTRL, 0, FBC_LLC_FULLY_OPEN);
+--
+2.39.2
+
--- /dev/null
+From bc5a723788dc95f34d167e22c079bbb2c7ee0dac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Jan 2023 15:44:08 -0800
+Subject: drm/i915/mtl: Add initial gt workarounds
+
+From: Matt Roper <matthew.d.roper@intel.com>
+
+[ Upstream commit 41bb543f5598fb44e0e8dbd723f5821be83b466b ]
+
+This patch introduces initial gt workarounds for the MTL platform.
+
+v2: drop redundant/stale comments specifying wa platforms affected
+(Lucas).
+v3: drop additional redundant stale comments (MattR)
+
+Bspec: 66622
+
+Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
+Signed-off-by: Matt Atwood <matthew.s.atwood@intel.com>
+Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Radhakrishna Sripada <radhakrishna.sripada@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230105234408.277750-1-matthew.s.atwood@intel.com
+Stable-dep-of: 49cbda6386ef ("drm/i915/xehp: GAM registers don't need to be re-applied on engine resets")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/gt/intel_engine_cs.c | 6 +-
+ .../drm/i915/gt/intel_execlists_submission.c | 6 +-
+ drivers/gpu/drm/i915/gt/intel_gt_mcr.c | 11 +-
+ drivers/gpu/drm/i915/gt/intel_gt_regs.h | 4 +
+ drivers/gpu/drm/i915/gt/intel_workarounds.c | 115 +++++++++++++-----
+ drivers/gpu/drm/i915/gt/uc/intel_guc.c | 9 +-
+ .../gpu/drm/i915/gt/uc/intel_guc_submission.c | 8 +-
+ drivers/gpu/drm/i915/intel_device_info.c | 6 +
+ 8 files changed, 123 insertions(+), 42 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/gt/intel_engine_cs.c b/drivers/gpu/drm/i915/gt/intel_engine_cs.c
+index d37931e16fd9b..34b0a9dadce4f 100644
+--- a/drivers/gpu/drm/i915/gt/intel_engine_cs.c
++++ b/drivers/gpu/drm/i915/gt/intel_engine_cs.c
+@@ -1476,10 +1476,12 @@ static int __intel_engine_stop_cs(struct intel_engine_cs *engine,
+ intel_uncore_write_fw(uncore, mode, _MASKED_BIT_ENABLE(STOP_RING));
+
+ /*
+- * Wa_22011802037 : gen11, gen12, Prior to doing a reset, ensure CS is
++ * Wa_22011802037: Prior to doing a reset, ensure CS is
+ * stopped, set ring stop bit and prefetch disable bit to halt CS
+ */
+- if (IS_GRAPHICS_VER(engine->i915, 11, 12))
++ if (IS_MTL_GRAPHICS_STEP(engine->i915, M, STEP_A0, STEP_B0) ||
++ (GRAPHICS_VER(engine->i915) >= 11 &&
++ GRAPHICS_VER_FULL(engine->i915) < IP_VER(12, 70)))
+ intel_uncore_write_fw(uncore, RING_MODE_GEN7(engine->mmio_base),
+ _MASKED_BIT_ENABLE(GEN12_GFX_PREFETCH_DISABLE));
+
+diff --git a/drivers/gpu/drm/i915/gt/intel_execlists_submission.c b/drivers/gpu/drm/i915/gt/intel_execlists_submission.c
+index 21cb5b69d82eb..3c573d41d4046 100644
+--- a/drivers/gpu/drm/i915/gt/intel_execlists_submission.c
++++ b/drivers/gpu/drm/i915/gt/intel_execlists_submission.c
+@@ -2989,10 +2989,12 @@ static void execlists_reset_prepare(struct intel_engine_cs *engine)
+ intel_engine_stop_cs(engine);
+
+ /*
+- * Wa_22011802037:gen11/gen12: In addition to stopping the cs, we need
++ * Wa_22011802037: In addition to stopping the cs, we need
+ * to wait for any pending mi force wakeups
+ */
+- if (IS_GRAPHICS_VER(engine->i915, 11, 12))
++ if (IS_MTL_GRAPHICS_STEP(engine->i915, M, STEP_A0, STEP_B0) ||
++ (GRAPHICS_VER(engine->i915) >= 11 &&
++ GRAPHICS_VER_FULL(engine->i915) < IP_VER(12, 70)))
+ intel_engine_wait_for_pending_mi_fw(engine);
+
+ engine->execlists.reset_ccid = active_ccid(engine);
+diff --git a/drivers/gpu/drm/i915/gt/intel_gt_mcr.c b/drivers/gpu/drm/i915/gt/intel_gt_mcr.c
+index ea86c1ab5dc56..58ea3325bbdaa 100644
+--- a/drivers/gpu/drm/i915/gt/intel_gt_mcr.c
++++ b/drivers/gpu/drm/i915/gt/intel_gt_mcr.c
+@@ -162,8 +162,15 @@ void intel_gt_mcr_init(struct intel_gt *gt)
+ if (MEDIA_VER(i915) >= 13 && gt->type == GT_MEDIA) {
+ gt->steering_table[OADDRM] = xelpmp_oaddrm_steering_table;
+ } else if (GRAPHICS_VER_FULL(i915) >= IP_VER(12, 70)) {
+- fuse = REG_FIELD_GET(GT_L3_EXC_MASK,
+- intel_uncore_read(gt->uncore, XEHP_FUSE4));
++ /* Wa_14016747170 */
++ if (IS_MTL_GRAPHICS_STEP(i915, M, STEP_A0, STEP_B0) ||
++ IS_MTL_GRAPHICS_STEP(i915, P, STEP_A0, STEP_B0))
++ fuse = REG_FIELD_GET(MTL_GT_L3_EXC_MASK,
++ intel_uncore_read(gt->uncore,
++ MTL_GT_ACTIVITY_FACTOR));
++ else
++ fuse = REG_FIELD_GET(GT_L3_EXC_MASK,
++ intel_uncore_read(gt->uncore, XEHP_FUSE4));
+
+ /*
+ * Despite the register field being named "exclude mask" the
+diff --git a/drivers/gpu/drm/i915/gt/intel_gt_regs.h b/drivers/gpu/drm/i915/gt/intel_gt_regs.h
+index a5454af2a9cfd..c525fc07a9bcb 100644
+--- a/drivers/gpu/drm/i915/gt/intel_gt_regs.h
++++ b/drivers/gpu/drm/i915/gt/intel_gt_regs.h
+@@ -413,6 +413,7 @@
+ #define TBIMR_FAST_CLIP REG_BIT(5)
+
+ #define VFLSKPD MCR_REG(0x62a8)
++#define VF_PREFETCH_TLB_DIS REG_BIT(5)
+ #define DIS_OVER_FETCH_CACHE REG_BIT(1)
+ #define DIS_MULT_MISS_RD_SQUASH REG_BIT(0)
+
+@@ -1528,6 +1529,9 @@
+
+ #define MTL_MEDIA_MC6 _MMIO(0x138048)
+
++#define MTL_GT_ACTIVITY_FACTOR _MMIO(0x138010)
++#define MTL_GT_L3_EXC_MASK REG_GENMASK(5, 3)
++
+ #define GEN6_GT_THREAD_STATUS_REG _MMIO(0x13805c)
+ #define GEN6_GT_THREAD_STATUS_CORE_MASK 0x7
+
+diff --git a/drivers/gpu/drm/i915/gt/intel_workarounds.c b/drivers/gpu/drm/i915/gt/intel_workarounds.c
+index a0740308555d8..09d533f6b962c 100644
+--- a/drivers/gpu/drm/i915/gt/intel_workarounds.c
++++ b/drivers/gpu/drm/i915/gt/intel_workarounds.c
+@@ -786,6 +786,32 @@ static void dg2_ctx_workarounds_init(struct intel_engine_cs *engine,
+ wa_masked_en(wal, CACHE_MODE_1, MSAA_OPTIMIZATION_REDUC_DISABLE);
+ }
+
++static void mtl_ctx_workarounds_init(struct intel_engine_cs *engine,
++ struct i915_wa_list *wal)
++{
++ struct drm_i915_private *i915 = engine->i915;
++
++ if (IS_MTL_GRAPHICS_STEP(i915, M, STEP_A0, STEP_B0) ||
++ IS_MTL_GRAPHICS_STEP(i915, P, STEP_A0, STEP_B0)) {
++ /* Wa_14014947963 */
++ wa_masked_field_set(wal, VF_PREEMPTION,
++ PREEMPTION_VERTEX_COUNT, 0x4000);
++
++ /* Wa_16013271637 */
++ wa_mcr_masked_en(wal, XEHP_SLICE_COMMON_ECO_CHICKEN1,
++ MSC_MSAA_REODER_BUF_BYPASS_DISABLE);
++
++ /* Wa_18019627453 */
++ wa_mcr_masked_en(wal, VFLSKPD, VF_PREFETCH_TLB_DIS);
++
++ /* Wa_18018764978 */
++ wa_masked_en(wal, PSS_MODE2, SCOREBOARD_STALL_FLUSH_CONTROL);
++ }
++
++ /* Wa_18019271663 */
++ wa_masked_en(wal, CACHE_MODE_1, MSAA_OPTIMIZATION_REDUC_DISABLE);
++}
++
+ static void fakewa_disable_nestedbb_mode(struct intel_engine_cs *engine,
+ struct i915_wa_list *wal)
+ {
+@@ -872,7 +898,9 @@ __intel_engine_init_ctx_wa(struct intel_engine_cs *engine,
+ if (engine->class != RENDER_CLASS)
+ goto done;
+
+- if (IS_PONTEVECCHIO(i915))
++ if (IS_METEORLAKE(i915))
++ mtl_ctx_workarounds_init(engine, wal);
++ else if (IS_PONTEVECCHIO(i915))
+ ; /* noop; none at this time */
+ else if (IS_DG2(i915))
+ dg2_ctx_workarounds_init(engine, wal);
+@@ -1635,7 +1663,10 @@ pvc_gt_workarounds_init(struct intel_gt *gt, struct i915_wa_list *wal)
+ static void
+ xelpg_gt_workarounds_init(struct intel_gt *gt, struct i915_wa_list *wal)
+ {
+- /* FIXME: Actual workarounds will be added in future patch(es) */
++ /* Wa_14014830051 */
++ if (IS_MTL_GRAPHICS_STEP(gt->i915, M, STEP_A0, STEP_B0) ||
++ IS_MTL_GRAPHICS_STEP(gt->i915, P, STEP_A0, STEP_B0))
++ wa_mcr_write_clr(wal, SARB_CHICKEN1, COMP_CKN_IN);
+
+ /*
+ * Unlike older platforms, we no longer setup implicit steering here;
+@@ -2171,7 +2202,9 @@ void intel_engine_init_whitelist(struct intel_engine_cs *engine)
+
+ wa_init_start(w, engine->gt, "whitelist", engine->name);
+
+- if (IS_PONTEVECCHIO(i915))
++ if (IS_METEORLAKE(i915))
++ ; /* noop; none at this time */
++ else if (IS_PONTEVECCHIO(i915))
+ pvc_whitelist_build(engine);
+ else if (IS_DG2(i915))
+ dg2_whitelist_build(engine);
+@@ -2281,6 +2314,34 @@ rcs_engine_wa_init(struct intel_engine_cs *engine, struct i915_wa_list *wal)
+ {
+ struct drm_i915_private *i915 = engine->i915;
+
++ if (IS_MTL_GRAPHICS_STEP(i915, M, STEP_A0, STEP_B0) ||
++ IS_MTL_GRAPHICS_STEP(i915, P, STEP_A0, STEP_B0)) {
++ /* Wa_22014600077 */
++ wa_mcr_masked_en(wal, GEN10_CACHE_MODE_SS,
++ ENABLE_EU_COUNT_FOR_TDL_FLUSH);
++ }
++
++ if (IS_MTL_GRAPHICS_STEP(i915, M, STEP_A0, STEP_B0) ||
++ IS_MTL_GRAPHICS_STEP(i915, P, STEP_A0, STEP_B0) ||
++ IS_DG2_GRAPHICS_STEP(i915, G10, STEP_B0, STEP_FOREVER) ||
++ IS_DG2_G11(i915) || IS_DG2_G12(i915)) {
++ /* Wa_1509727124 */
++ wa_mcr_masked_en(wal, GEN10_SAMPLER_MODE,
++ SC_DISABLE_POWER_OPTIMIZATION_EBB);
++
++ /* Wa_22013037850 */
++ wa_mcr_write_or(wal, LSC_CHICKEN_BIT_0_UDW,
++ DISABLE_128B_EVICTION_COMMAND_UDW);
++ }
++
++ if (IS_DG2_GRAPHICS_STEP(i915, G10, STEP_B0, STEP_FOREVER) ||
++ IS_DG2_G11(i915) || IS_DG2_G12(i915) ||
++ IS_MTL_GRAPHICS_STEP(i915, M, STEP_A0, STEP_B0)) {
++ /* Wa_22012856258 */
++ wa_mcr_masked_en(wal, GEN8_ROW_CHICKEN2,
++ GEN12_DISABLE_READ_SUPPRESSION);
++ }
++
+ if (IS_DG2(i915)) {
+ /* Wa_1509235366:dg2 */
+ wa_write_or(wal, GEN12_GAMCNTRL_CTRL, INVALIDATION_BROADCAST_MODE_DIS |
+@@ -2292,13 +2353,6 @@ rcs_engine_wa_init(struct intel_engine_cs *engine, struct i915_wa_list *wal)
+ wa_mcr_masked_en(wal, GEN8_ROW_CHICKEN2, GEN12_ENABLE_LARGE_GRF_MODE);
+ }
+
+- if (IS_DG2_GRAPHICS_STEP(i915, G10, STEP_B0, STEP_FOREVER) ||
+- IS_DG2_G11(i915) || IS_DG2_G12(i915)) {
+- /* Wa_1509727124:dg2 */
+- wa_mcr_masked_en(wal, GEN10_SAMPLER_MODE,
+- SC_DISABLE_POWER_OPTIMIZATION_EBB);
+- }
+-
+ if (IS_DG2_GRAPHICS_STEP(i915, G10, STEP_A0, STEP_B0) ||
+ IS_DG2_GRAPHICS_STEP(i915, G11, STEP_A0, STEP_B0)) {
+ /* Wa_14012419201:dg2 */
+@@ -2330,14 +2384,6 @@ rcs_engine_wa_init(struct intel_engine_cs *engine, struct i915_wa_list *wal)
+
+ if (IS_DG2_GRAPHICS_STEP(i915, G10, STEP_B0, STEP_FOREVER) ||
+ IS_DG2_G11(i915) || IS_DG2_G12(i915)) {
+- /* Wa_22013037850:dg2 */
+- wa_mcr_write_or(wal, LSC_CHICKEN_BIT_0_UDW,
+- DISABLE_128B_EVICTION_COMMAND_UDW);
+-
+- /* Wa_22012856258:dg2 */
+- wa_mcr_masked_en(wal, GEN8_ROW_CHICKEN2,
+- GEN12_DISABLE_READ_SUPPRESSION);
+-
+ /*
+ * Wa_22010960976:dg2
+ * Wa_14013347512:dg2
+@@ -2950,6 +2996,27 @@ general_render_compute_wa_init(struct intel_engine_cs *engine, struct i915_wa_li
+
+ add_render_compute_tuning_settings(i915, wal);
+
++ if (IS_MTL_GRAPHICS_STEP(i915, M, STEP_A0, STEP_B0) ||
++ IS_MTL_GRAPHICS_STEP(i915, P, STEP_A0, STEP_B0) ||
++ IS_PONTEVECCHIO(i915) ||
++ IS_DG2(i915)) {
++ /* Wa_18018781329 */
++ wa_mcr_write_or(wal, RENDER_MOD_CTRL, FORCE_MISS_FTLB);
++ wa_mcr_write_or(wal, COMP_MOD_CTRL, FORCE_MISS_FTLB);
++ wa_mcr_write_or(wal, VDBX_MOD_CTRL, FORCE_MISS_FTLB);
++ wa_mcr_write_or(wal, VEBX_MOD_CTRL, FORCE_MISS_FTLB);
++
++ /* Wa_22014226127 */
++ wa_mcr_write_or(wal, LSC_CHICKEN_BIT_0, DISABLE_D8_D16_COASLESCE);
++ }
++
++ if (IS_MTL_GRAPHICS_STEP(i915, M, STEP_A0, STEP_B0) ||
++ IS_MTL_GRAPHICS_STEP(i915, P, STEP_A0, STEP_B0) ||
++ IS_DG2(i915)) {
++ /* Wa_18017747507 */
++ wa_masked_en(wal, VFG_PREEMPTION_CHICKEN, POLYGON_TRIFAN_LINELOOP_DISABLE);
++ }
++
+ if (IS_PONTEVECCHIO(i915)) {
+ /* Wa_16016694945 */
+ wa_masked_en(wal, XEHPC_LNCFMISCCFGREG0, XEHPC_OVRLSCCC);
+@@ -2991,17 +3058,8 @@ general_render_compute_wa_init(struct intel_engine_cs *engine, struct i915_wa_li
+ /* Wa_14015227452:dg2,pvc */
+ wa_mcr_masked_en(wal, GEN9_ROW_CHICKEN4, XEHP_DIS_BBL_SYSPIPE);
+
+- /* Wa_22014226127:dg2,pvc */
+- wa_mcr_write_or(wal, LSC_CHICKEN_BIT_0, DISABLE_D8_D16_COASLESCE);
+-
+ /* Wa_16015675438:dg2,pvc */
+ wa_masked_en(wal, FF_SLICE_CS_CHICKEN2, GEN12_PERF_FIX_BALANCING_CFE_DISABLE);
+-
+- /* Wa_18018781329:dg2,pvc */
+- wa_mcr_write_or(wal, RENDER_MOD_CTRL, FORCE_MISS_FTLB);
+- wa_mcr_write_or(wal, COMP_MOD_CTRL, FORCE_MISS_FTLB);
+- wa_mcr_write_or(wal, VDBX_MOD_CTRL, FORCE_MISS_FTLB);
+- wa_mcr_write_or(wal, VEBX_MOD_CTRL, FORCE_MISS_FTLB);
+ }
+
+ if (IS_DG2(i915)) {
+@@ -3010,9 +3068,6 @@ general_render_compute_wa_init(struct intel_engine_cs *engine, struct i915_wa_li
+ * Wa_22015475538:dg2
+ */
+ wa_mcr_write_or(wal, LSC_CHICKEN_BIT_0_UDW, DIS_CHAIN_2XSIMD8);
+-
+- /* Wa_18017747507:dg2 */
+- wa_masked_en(wal, VFG_PREEMPTION_CHICKEN, POLYGON_TRIFAN_LINELOOP_DISABLE);
+ }
+ }
+
+diff --git a/drivers/gpu/drm/i915/gt/uc/intel_guc.c b/drivers/gpu/drm/i915/gt/uc/intel_guc.c
+index 52aede324788e..ca940a00e84a3 100644
+--- a/drivers/gpu/drm/i915/gt/uc/intel_guc.c
++++ b/drivers/gpu/drm/i915/gt/uc/intel_guc.c
+@@ -274,8 +274,9 @@ static u32 guc_ctl_wa_flags(struct intel_guc *guc)
+ if (IS_DG2_GRAPHICS_STEP(gt->i915, G10, STEP_A0, STEP_B0))
+ flags |= GUC_WA_GAM_CREDITS;
+
+- /* Wa_14014475959:dg2 */
+- if (IS_DG2(gt->i915))
++ /* Wa_14014475959 */
++ if (IS_MTL_GRAPHICS_STEP(gt->i915, M, STEP_A0, STEP_B0) ||
++ IS_DG2(gt->i915))
+ flags |= GUC_WA_HOLD_CCS_SWITCHOUT;
+
+ /*
+@@ -289,7 +290,9 @@ static u32 guc_ctl_wa_flags(struct intel_guc *guc)
+ flags |= GUC_WA_DUAL_QUEUE;
+
+ /* Wa_22011802037: graphics version 11/12 */
+- if (IS_GRAPHICS_VER(gt->i915, 11, 12))
++ if (IS_MTL_GRAPHICS_STEP(gt->i915, M, STEP_A0, STEP_B0) ||
++ (GRAPHICS_VER(gt->i915) >= 11 &&
++ GRAPHICS_VER_FULL(gt->i915) < IP_VER(12, 70)))
+ flags |= GUC_WA_PRE_PARSER;
+
+ /* Wa_16011777198:dg2 */
+diff --git a/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c b/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c
+index c10977cb06b97..ddf071865adc5 100644
+--- a/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c
++++ b/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c
+@@ -1621,7 +1621,7 @@ static void guc_engine_reset_prepare(struct intel_engine_cs *engine)
+ intel_engine_stop_cs(engine);
+
+ /*
+- * Wa_22011802037:gen11/gen12: In addition to stopping the cs, we need
++ * Wa_22011802037: In addition to stopping the cs, we need
+ * to wait for any pending mi force wakeups
+ */
+ intel_engine_wait_for_pending_mi_fw(engine);
+@@ -4203,8 +4203,10 @@ static void guc_default_vfuncs(struct intel_engine_cs *engine)
+ engine->flags |= I915_ENGINE_HAS_TIMESLICES;
+
+ /* Wa_14014475959:dg2 */
+- if (IS_DG2(engine->i915) && engine->class == COMPUTE_CLASS)
+- engine->flags |= I915_ENGINE_USES_WA_HOLD_CCS_SWITCHOUT;
++ if (engine->class == COMPUTE_CLASS)
++ if (IS_MTL_GRAPHICS_STEP(engine->i915, M, STEP_A0, STEP_B0) ||
++ IS_DG2(engine->i915))
++ engine->flags |= I915_ENGINE_USES_WA_HOLD_CCS_SWITCHOUT;
+
+ /*
+ * TODO: GuC supports timeslicing and semaphores as well, but they're
+diff --git a/drivers/gpu/drm/i915/intel_device_info.c b/drivers/gpu/drm/i915/intel_device_info.c
+index 849baf6c3b3c6..05e90d09b2081 100644
+--- a/drivers/gpu/drm/i915/intel_device_info.c
++++ b/drivers/gpu/drm/i915/intel_device_info.c
+@@ -343,6 +343,12 @@ static void intel_ipver_early_init(struct drm_i915_private *i915)
+
+ ip_ver_read(i915, i915_mmio_reg_offset(GMD_ID_GRAPHICS),
+ &runtime->graphics.ip);
++ /* Wa_22012778468 */
++ if (runtime->graphics.ip.ver == 0x0 &&
++ INTEL_INFO(i915)->platform == INTEL_METEORLAKE) {
++ RUNTIME_INFO(i915)->graphics.ip.ver = 12;
++ RUNTIME_INFO(i915)->graphics.ip.rel = 70;
++ }
+ ip_ver_read(i915, i915_mmio_reg_offset(GMD_ID_DISPLAY),
+ &runtime->display.ip);
+ ip_ver_read(i915, i915_mmio_reg_offset(GMD_ID_MEDIA),
+--
+2.39.2
+
--- /dev/null
+From e27405bdc71eca7e0fa943654cd78c04e747cab7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Jan 2023 15:41:58 -0800
+Subject: drm/i915/mtl: Correct implementation of Wa_18018781329
+
+From: Matt Roper <matthew.d.roper@intel.com>
+
+[ Upstream commit eda94a6e6a4f2d3d1574ff4f2bd4b9f844504f71 ]
+
+Workaround Wa_18018781329 has applied to several recent Xe_HP-based
+platforms. However there are some extra gotchas to implementing this
+properly for MTL that we need to take into account:
+
+ * Due to the separation of media and render/compute into separate GTs,
+ this workaround needs to be implemented on each GT, not just the
+ primary GT. Since each class of register only exists on one of the
+ two GTs, we should program the appropriate registers on each GT.
+
+ * As with past Xe_HP platforms, the registers on the primary GT (Xe_LPG
+ IP) are multicast/replicated registers and should be handled with the
+ MCR-aware functions. However the registers on the media GT (Xe_LPM+
+ IP) are regular singleton registers and should _not_ use MCR
+ handling. We need to create separate register definitions for the
+ Xe_HP multicast form and the Xe_LPM+ singleton form and use each in
+ the appropriate place.
+
+ * Starting with MTL, workarounds documented by the hardware teams are
+ technically associated with IP versions/steppings rather than
+ top-level platforms. That means we should take care to check the
+ media IP version rather than the graphics IP version when deciding
+ whether the workaround is needed on the Xe_LPM+ media GT (in this
+ case the workaround applies to both IPs and the stepping bounds are
+ identical, but we should still write the code appropriately to set a
+ proper precedent for future workaround implementations).
+
+ * It's worth noting that the GSC register and the CCS register are
+ defined with the same MMIO offset (0xCF30). Since the CCS is only
+ relevant to the primary GT and the GSC is only relevant to the media
+ GT there isn't actually a clash here (the media GT automatically adds
+ the additional 0x380000 GSI offset). However there's currently a
+ glitch in the bspec where the CCS register doesn't show up at all and
+ the GSC register is listed as existing on both GTs. That's a known
+ documentation problem for several registers with shared GSC/CCS
+ offsets; rest assured that the CCS register really does still exist.
+
+Cc: Gustavo Sousa <gustavo.sousa@intel.com>
+Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
+Fixes: 41bb543f5598 ("drm/i915/mtl: Add initial gt workarounds")
+Reviewed-by: Gustavo Sousa <gustavo.sousa@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230125234159.3015385-2-matthew.d.roper@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/gt/intel_gt_regs.h | 7 +++++--
+ drivers/gpu/drm/i915/gt/intel_workarounds.c | 22 ++++++++++++++-------
+ drivers/gpu/drm/i915/i915_drv.h | 4 ++++
+ 3 files changed, 24 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/gt/intel_gt_regs.h b/drivers/gpu/drm/i915/gt/intel_gt_regs.h
+index 3b6ef0eb47e76..9758b0b635601 100644
+--- a/drivers/gpu/drm/i915/gt/intel_gt_regs.h
++++ b/drivers/gpu/drm/i915/gt/intel_gt_regs.h
+@@ -1087,8 +1087,11 @@
+ #define XEHP_MERT_MOD_CTRL MCR_REG(0xcf28)
+ #define RENDER_MOD_CTRL MCR_REG(0xcf2c)
+ #define COMP_MOD_CTRL MCR_REG(0xcf30)
+-#define VDBX_MOD_CTRL MCR_REG(0xcf34)
+-#define VEBX_MOD_CTRL MCR_REG(0xcf38)
++#define XELPMP_GSC_MOD_CTRL _MMIO(0xcf30) /* media GT only */
++#define XEHP_VDBX_MOD_CTRL MCR_REG(0xcf34)
++#define XELPMP_VDBX_MOD_CTRL _MMIO(0xcf34)
++#define XEHP_VEBX_MOD_CTRL MCR_REG(0xcf38)
++#define XELPMP_VEBX_MOD_CTRL _MMIO(0xcf38)
+ #define FORCE_MISS_FTLB REG_BIT(3)
+
+ #define XEHP_GAMSTLB_CTRL MCR_REG(0xcf4c)
+diff --git a/drivers/gpu/drm/i915/gt/intel_workarounds.c b/drivers/gpu/drm/i915/gt/intel_workarounds.c
+index d92b006d4cd2e..e13052c5dae19 100644
+--- a/drivers/gpu/drm/i915/gt/intel_workarounds.c
++++ b/drivers/gpu/drm/i915/gt/intel_workarounds.c
+@@ -1678,8 +1678,8 @@ dg2_gt_workarounds_init(struct intel_gt *gt, struct i915_wa_list *wal)
+ /* Wa_18018781329 */
+ wa_mcr_write_or(wal, RENDER_MOD_CTRL, FORCE_MISS_FTLB);
+ wa_mcr_write_or(wal, COMP_MOD_CTRL, FORCE_MISS_FTLB);
+- wa_mcr_write_or(wal, VDBX_MOD_CTRL, FORCE_MISS_FTLB);
+- wa_mcr_write_or(wal, VEBX_MOD_CTRL, FORCE_MISS_FTLB);
++ wa_mcr_write_or(wal, XEHP_VDBX_MOD_CTRL, FORCE_MISS_FTLB);
++ wa_mcr_write_or(wal, XEHP_VEBX_MOD_CTRL, FORCE_MISS_FTLB);
+
+ /* Wa_1509235366:dg2 */
+ wa_mcr_write_or(wal, XEHP_GAMCNTRL_CTRL,
+@@ -1697,8 +1697,8 @@ pvc_gt_workarounds_init(struct intel_gt *gt, struct i915_wa_list *wal)
+ /* Wa_18018781329 */
+ wa_mcr_write_or(wal, RENDER_MOD_CTRL, FORCE_MISS_FTLB);
+ wa_mcr_write_or(wal, COMP_MOD_CTRL, FORCE_MISS_FTLB);
+- wa_mcr_write_or(wal, VDBX_MOD_CTRL, FORCE_MISS_FTLB);
+- wa_mcr_write_or(wal, VEBX_MOD_CTRL, FORCE_MISS_FTLB);
++ wa_mcr_write_or(wal, XEHP_VDBX_MOD_CTRL, FORCE_MISS_FTLB);
++ wa_mcr_write_or(wal, XEHP_VEBX_MOD_CTRL, FORCE_MISS_FTLB);
+ }
+
+ static void
+@@ -1712,8 +1712,6 @@ xelpg_gt_workarounds_init(struct intel_gt *gt, struct i915_wa_list *wal)
+ /* Wa_18018781329 */
+ wa_mcr_write_or(wal, RENDER_MOD_CTRL, FORCE_MISS_FTLB);
+ wa_mcr_write_or(wal, COMP_MOD_CTRL, FORCE_MISS_FTLB);
+- wa_mcr_write_or(wal, VDBX_MOD_CTRL, FORCE_MISS_FTLB);
+- wa_mcr_write_or(wal, VEBX_MOD_CTRL, FORCE_MISS_FTLB);
+ }
+
+ /*
+@@ -1726,7 +1724,17 @@ xelpg_gt_workarounds_init(struct intel_gt *gt, struct i915_wa_list *wal)
+ static void
+ xelpmp_gt_workarounds_init(struct intel_gt *gt, struct i915_wa_list *wal)
+ {
+- /* FIXME: Actual workarounds will be added in future patch(es) */
++ if (IS_MTL_MEDIA_STEP(gt->i915, STEP_A0, STEP_B0)) {
++ /*
++ * Wa_18018781329
++ *
++ * Note that although these registers are MCR on the primary
++ * GT, the media GT's versions are regular singleton registers.
++ */
++ wa_write_or(wal, XELPMP_GSC_MOD_CTRL, FORCE_MISS_FTLB);
++ wa_write_or(wal, XELPMP_VDBX_MOD_CTRL, FORCE_MISS_FTLB);
++ wa_write_or(wal, XELPMP_VEBX_MOD_CTRL, FORCE_MISS_FTLB);
++ }
+
+ debug_dump_steering(gt);
+ }
+diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
+index a380db36d52c4..03c3a59d0939b 100644
+--- a/drivers/gpu/drm/i915/i915_drv.h
++++ b/drivers/gpu/drm/i915/i915_drv.h
+@@ -726,6 +726,10 @@ IS_SUBPLATFORM(const struct drm_i915_private *i915,
+ (IS_SUBPLATFORM(__i915, INTEL_METEORLAKE, INTEL_SUBPLATFORM_##variant) && \
+ IS_GRAPHICS_STEP(__i915, since, until))
+
++#define IS_MTL_MEDIA_STEP(__i915, since, until) \
++ (IS_METEORLAKE(__i915) && \
++ IS_MEDIA_STEP(__i915, since, until))
++
+ /*
+ * DG2 hardware steppings are a bit unusual. The hardware design was forked to
+ * create three variants (G10, G11, and G12) which each have distinct
+--
+2.39.2
+
--- /dev/null
+From 221bf95c4a51ab37d0f6f6c97093d3e11aff9176 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Feb 2023 14:28:28 -0800
+Subject: drm/i915/pvc: Annotate two more workaround/tuning registers as MCR
+
+From: Matt Roper <matthew.d.roper@intel.com>
+
+[ Upstream commit effc0905d741b4138806747407baf8de98390c72 ]
+
+XEHPC_LNCFMISCCFGREG0 and XEHPC_L3SCRUB are both in MCR register ranges
+on PVC (with HALFBSLICE and L3BANK replication respectively), so they
+should be explicitly declared as MCR registers and use MCR-aware
+workaround handlers.
+
+The workarounds/tuning settings should still be applied properly on PVC
+even without the MCR annotation, but readback verification on
+CONFIG_DRM_I915_DEBUG_GEM builds could potentitally give false positive
+"workaround lost on load" warnings on parts fused such that a unicast
+read targets a terminated register instance.
+
+Fixes: a9e69428b1b4 ("drm/i915: Define MCR registers explicitly")
+Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
+Reviewed-by: Gustavo Sousa <gustavo.sousa@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230201222831.608281-1-matthew.d.roper@intel.com
+(cherry picked from commit 4039e44237e8ebb06f0e4af549fbedf7c41df9db)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/gt/intel_gt_regs.h | 4 ++--
+ drivers/gpu/drm/i915/gt/intel_workarounds.c | 14 ++++++++++----
+ 2 files changed, 12 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/gt/intel_gt_regs.h b/drivers/gpu/drm/i915/gt/intel_gt_regs.h
+index 838f73165ebbc..0d47c930956e0 100644
+--- a/drivers/gpu/drm/i915/gt/intel_gt_regs.h
++++ b/drivers/gpu/drm/i915/gt/intel_gt_regs.h
+@@ -969,7 +969,7 @@
+ #define GEN7_WA_FOR_GEN7_L3_CONTROL 0x3C47FF8C
+ #define GEN7_L3AGDIS (1 << 19)
+
+-#define XEHPC_LNCFMISCCFGREG0 _MMIO(0xb01c)
++#define XEHPC_LNCFMISCCFGREG0 MCR_REG(0xb01c)
+ #define XEHPC_HOSTCACHEEN REG_BIT(1)
+ #define XEHPC_OVRLSCCC REG_BIT(0)
+
+@@ -1032,7 +1032,7 @@
+ #define XEHP_L3SCQREG7 MCR_REG(0xb188)
+ #define BLEND_FILL_CACHING_OPT_DIS REG_BIT(3)
+
+-#define XEHPC_L3SCRUB _MMIO(0xb18c)
++#define XEHPC_L3SCRUB MCR_REG(0xb18c)
+ #define SCRUB_CL_DWNGRADE_SHARED REG_BIT(12)
+ #define SCRUB_RATE_PER_BANK_MASK REG_GENMASK(2, 0)
+ #define SCRUB_RATE_4B_PER_CLK REG_FIELD_PREP(SCRUB_RATE_PER_BANK_MASK, 0x6)
+diff --git a/drivers/gpu/drm/i915/gt/intel_workarounds.c b/drivers/gpu/drm/i915/gt/intel_workarounds.c
+index c2d9d07af7ee9..80b0e9a56330c 100644
+--- a/drivers/gpu/drm/i915/gt/intel_workarounds.c
++++ b/drivers/gpu/drm/i915/gt/intel_workarounds.c
+@@ -224,6 +224,12 @@ wa_write(struct i915_wa_list *wal, i915_reg_t reg, u32 set)
+ wa_write_clr_set(wal, reg, ~0, set);
+ }
+
++static void
++wa_mcr_write(struct i915_wa_list *wal, i915_mcr_reg_t reg, u32 set)
++{
++ wa_mcr_write_clr_set(wal, reg, ~0, set);
++}
++
+ static void
+ wa_write_or(struct i915_wa_list *wal, i915_reg_t reg, u32 set)
+ {
+@@ -2971,9 +2977,9 @@ add_render_compute_tuning_settings(struct drm_i915_private *i915,
+ struct i915_wa_list *wal)
+ {
+ if (IS_PONTEVECCHIO(i915)) {
+- wa_write(wal, XEHPC_L3SCRUB,
+- SCRUB_CL_DWNGRADE_SHARED | SCRUB_RATE_4B_PER_CLK);
+- wa_masked_en(wal, XEHPC_LNCFMISCCFGREG0, XEHPC_HOSTCACHEEN);
++ wa_mcr_write(wal, XEHPC_L3SCRUB,
++ SCRUB_CL_DWNGRADE_SHARED | SCRUB_RATE_4B_PER_CLK);
++ wa_mcr_masked_en(wal, XEHPC_LNCFMISCCFGREG0, XEHPC_HOSTCACHEEN);
+ }
+
+ if (IS_DG2(i915)) {
+@@ -3038,7 +3044,7 @@ general_render_compute_wa_init(struct intel_engine_cs *engine, struct i915_wa_li
+
+ if (IS_PONTEVECCHIO(i915)) {
+ /* Wa_16016694945 */
+- wa_masked_en(wal, XEHPC_LNCFMISCCFGREG0, XEHPC_OVRLSCCC);
++ wa_mcr_masked_en(wal, XEHPC_LNCFMISCCFGREG0, XEHPC_OVRLSCCC);
+ }
+
+ if (IS_XEHPSDV(i915)) {
+--
+2.39.2
+
--- /dev/null
+From f596c110c166a9f3de4ce7d991e63063c9a8355a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Nov 2022 09:07:23 -0800
+Subject: drm/i915/pvc: Implement recommended caching policy
+
+From: Wayne Boyer <wayne.boyer@intel.com>
+
+[ Upstream commit e3995e08a39a41691742b380023a0d480247afb0 ]
+
+As per the performance tuning guide, set the HOSTCACHEEN bit to
+implement the recommended caching policy on PVC.
+
+Signed-off-by: Wayne Boyer <wayne.boyer@intel.com>
+Reviewed-by: Matt Roper <matthew.d.roper@intel.com>
+Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20221130170723.2460014-1-wayne.boyer@intel.com
+Stable-dep-of: effc0905d741 ("drm/i915/pvc: Annotate two more workaround/tuning registers as MCR")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/gt/intel_gt_regs.h | 1 +
+ drivers/gpu/drm/i915/gt/intel_workarounds.c | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/i915/gt/intel_gt_regs.h b/drivers/gpu/drm/i915/gt/intel_gt_regs.h
+index 0c7e7972cc1c4..838f73165ebbc 100644
+--- a/drivers/gpu/drm/i915/gt/intel_gt_regs.h
++++ b/drivers/gpu/drm/i915/gt/intel_gt_regs.h
+@@ -970,6 +970,7 @@
+ #define GEN7_L3AGDIS (1 << 19)
+
+ #define XEHPC_LNCFMISCCFGREG0 _MMIO(0xb01c)
++#define XEHPC_HOSTCACHEEN REG_BIT(1)
+ #define XEHPC_OVRLSCCC REG_BIT(0)
+
+ #define GEN7_L3CNTLREG2 _MMIO(0xb020)
+diff --git a/drivers/gpu/drm/i915/gt/intel_workarounds.c b/drivers/gpu/drm/i915/gt/intel_workarounds.c
+index dcc694b8bc8c7..c2d9d07af7ee9 100644
+--- a/drivers/gpu/drm/i915/gt/intel_workarounds.c
++++ b/drivers/gpu/drm/i915/gt/intel_workarounds.c
+@@ -2973,6 +2973,7 @@ add_render_compute_tuning_settings(struct drm_i915_private *i915,
+ if (IS_PONTEVECCHIO(i915)) {
+ wa_write(wal, XEHPC_L3SCRUB,
+ SCRUB_CL_DWNGRADE_SHARED | SCRUB_RATE_4B_PER_CLK);
++ wa_masked_en(wal, XEHPC_LNCFMISCCFGREG0, XEHPC_HOSTCACHEEN);
+ }
+
+ if (IS_DG2(i915)) {
+--
+2.39.2
+
--- /dev/null
+From 34209355b5c887f532ef476848304ca15c9ac69b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Jan 2023 15:41:59 -0800
+Subject: drm/i915/xehp: Annotate a couple more workaround registers as MCR
+
+From: Matt Roper <matthew.d.roper@intel.com>
+
+[ Upstream commit 7649a5d1f263b8cc5c2827ef0443ead9bee9ae0e ]
+
+GAMSTLB_CTRL and GAMCNTRL_CTRL became multicast/replicated registers on
+Xe_HP. They should be defined accordingly and use MCR-aware operations.
+
+These registers have only been used for some dg2/xehpsdv workarounds, so
+this fix is mostly just for consistency/future-proofing; even lacking
+the MCR annotation, workarounds will always be properly applied in a
+multicast manner on these platforms.
+
+Cc: Gustavo Sousa <gustavo.sousa@intel.com>
+Fixes: 58bc2453ab8a ("drm/i915: Define multicast registers as a new type")
+Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
+Reviewed-by: Gustavo Sousa <gustavo.sousa@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230125234159.3015385-3-matthew.d.roper@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/gt/intel_gt_regs.h | 4 ++--
+ drivers/gpu/drm/i915/gt/intel_workarounds.c | 16 ++++++++--------
+ 2 files changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/gt/intel_gt_regs.h b/drivers/gpu/drm/i915/gt/intel_gt_regs.h
+index c525fc07a9bcb..0c7e7972cc1c4 100644
+--- a/drivers/gpu/drm/i915/gt/intel_gt_regs.h
++++ b/drivers/gpu/drm/i915/gt/intel_gt_regs.h
+@@ -1093,12 +1093,12 @@
+ #define VEBX_MOD_CTRL MCR_REG(0xcf38)
+ #define FORCE_MISS_FTLB REG_BIT(3)
+
+-#define GEN12_GAMSTLB_CTRL _MMIO(0xcf4c)
++#define XEHP_GAMSTLB_CTRL MCR_REG(0xcf4c)
+ #define CONTROL_BLOCK_CLKGATE_DIS REG_BIT(12)
+ #define EGRESS_BLOCK_CLKGATE_DIS REG_BIT(11)
+ #define TAG_BLOCK_CLKGATE_DIS REG_BIT(7)
+
+-#define GEN12_GAMCNTRL_CTRL _MMIO(0xcf54)
++#define XEHP_GAMCNTRL_CTRL MCR_REG(0xcf54)
+ #define INVALIDATION_BROADCAST_MODE_DIS REG_BIT(12)
+ #define GLOBAL_INVALIDATION_MODE REG_BIT(2)
+
+diff --git a/drivers/gpu/drm/i915/gt/intel_workarounds.c b/drivers/gpu/drm/i915/gt/intel_workarounds.c
+index 9932d748b9d7b..dcc694b8bc8c7 100644
+--- a/drivers/gpu/drm/i915/gt/intel_workarounds.c
++++ b/drivers/gpu/drm/i915/gt/intel_workarounds.c
+@@ -1555,8 +1555,8 @@ xehpsdv_gt_workarounds_init(struct intel_gt *gt, struct i915_wa_list *wal)
+ wa_mcr_write_or(wal, XEHP_MERT_MOD_CTRL, FORCE_MISS_FTLB);
+
+ /* Wa_14014368820:xehpsdv */
+- wa_write_or(wal, GEN12_GAMCNTRL_CTRL,
+- INVALIDATION_BROADCAST_MODE_DIS | GLOBAL_INVALIDATION_MODE);
++ wa_mcr_write_or(wal, XEHP_GAMCNTRL_CTRL,
++ INVALIDATION_BROADCAST_MODE_DIS | GLOBAL_INVALIDATION_MODE);
+ }
+
+ static void
+@@ -1650,10 +1650,10 @@ dg2_gt_workarounds_init(struct intel_gt *gt, struct i915_wa_list *wal)
+ wa_mcr_write_or(wal, SSMCGCTL9530, RTFUNIT_CLKGATE_DIS);
+
+ /* Wa_14010680813:dg2_g10 */
+- wa_write_or(wal, GEN12_GAMSTLB_CTRL,
+- CONTROL_BLOCK_CLKGATE_DIS |
+- EGRESS_BLOCK_CLKGATE_DIS |
+- TAG_BLOCK_CLKGATE_DIS);
++ wa_mcr_write_or(wal, XEHP_GAMSTLB_CTRL,
++ CONTROL_BLOCK_CLKGATE_DIS |
++ EGRESS_BLOCK_CLKGATE_DIS |
++ TAG_BLOCK_CLKGATE_DIS);
+ }
+
+ /* Wa_14014830051:dg2 */
+@@ -1676,8 +1676,8 @@ dg2_gt_workarounds_init(struct intel_gt *gt, struct i915_wa_list *wal)
+ wa_mcr_write_or(wal, VEBX_MOD_CTRL, FORCE_MISS_FTLB);
+
+ /* Wa_1509235366:dg2 */
+- wa_write_or(wal, GEN12_GAMCNTRL_CTRL,
+- INVALIDATION_BROADCAST_MODE_DIS | GLOBAL_INVALIDATION_MODE);
++ wa_mcr_write_or(wal, XEHP_GAMCNTRL_CTRL,
++ INVALIDATION_BROADCAST_MODE_DIS | GLOBAL_INVALIDATION_MODE);
+ }
+
+ static void
+--
+2.39.2
+
--- /dev/null
+From cfdaadeaa707a475cc2561167af48b8ab26e3833 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Jan 2023 15:41:57 -0800
+Subject: drm/i915/xehp: GAM registers don't need to be re-applied on engine
+ resets
+
+From: Matt Roper <matthew.d.roper@intel.com>
+
+[ Upstream commit 49cbda6386efc5f023f396dca087aaba5d4f885e ]
+
+Register reset characteristics (i.e., whether the register maintains or
+loses its value on engine reset) is an important factor that determines
+which wa_list we want to add workarounds to. We recently found out that
+the bspec documentation for the Xe_HP's "GAM" registers in the 0xC800 -
+0xCFFF range was misleading; these registers do not actually lose their
+value on engine resets as the documentation implied. This means there's
+no need to re-apply workarounds touching these registers after a reset,
+and the corresponding workarounds should be moved from the 'engine'
+lists back to the 'gt' list.
+
+v2:
+ - Don't add Wa_18018781329 to xehpsdv; the original condition didn't
+ include that platform. (Gustavo)
+ - Move the MTL code to the GT function as-is for now; we'll take care
+ of the additional fixes needed in a follow-up patch.
+
+Cc: Gustavo Sousa <gustavo.sousa@intel.com>
+Fixes: edf176f48d87 ("drm/i915/dg2: Move misplaced 'ctx' & 'gt' wa's to engine wa list")
+Fixes: b2006061ae28 ("drm/i915/xehpsdv: Move render/compute engine reset domains related workarounds")
+Fixes: 41bb543f5598 ("drm/i915/mtl: Add initial gt workarounds")
+Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
+Reviewed-by: Gustavo Sousa <gustavo.sousa@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230125234159.3015385-1-matthew.d.roper@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/gt/intel_workarounds.c | 77 ++++++++++++---------
+ 1 file changed, 44 insertions(+), 33 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/gt/intel_workarounds.c b/drivers/gpu/drm/i915/gt/intel_workarounds.c
+index 09d533f6b962c..9932d748b9d7b 100644
+--- a/drivers/gpu/drm/i915/gt/intel_workarounds.c
++++ b/drivers/gpu/drm/i915/gt/intel_workarounds.c
+@@ -1550,6 +1550,13 @@ xehpsdv_gt_workarounds_init(struct intel_gt *gt, struct i915_wa_list *wal)
+
+ /* Wa_14011060649:xehpsdv */
+ wa_14011060649(gt, wal);
++
++ /* Wa_14012362059:xehpsdv */
++ wa_mcr_write_or(wal, XEHP_MERT_MOD_CTRL, FORCE_MISS_FTLB);
++
++ /* Wa_14014368820:xehpsdv */
++ wa_write_or(wal, GEN12_GAMCNTRL_CTRL,
++ INVALIDATION_BROADCAST_MODE_DIS | GLOBAL_INVALIDATION_MODE);
+ }
+
+ static void
+@@ -1590,6 +1597,12 @@ dg2_gt_workarounds_init(struct intel_gt *gt, struct i915_wa_list *wal)
+ DSS_ROUTER_CLKGATE_DIS);
+ }
+
++ if (IS_DG2_GRAPHICS_STEP(gt->i915, G10, STEP_A0, STEP_B0) ||
++ IS_DG2_GRAPHICS_STEP(gt->i915, G11, STEP_A0, STEP_B0)) {
++ /* Wa_14012362059:dg2 */
++ wa_mcr_write_or(wal, XEHP_MERT_MOD_CTRL, FORCE_MISS_FTLB);
++ }
++
+ if (IS_DG2_GRAPHICS_STEP(gt->i915, G10, STEP_A0, STEP_B0)) {
+ /* Wa_14010948348:dg2_g10 */
+ wa_write_or(wal, UNSLCGCTL9430, MSQDUNIT_CLKGATE_DIS);
+@@ -1635,6 +1648,12 @@ dg2_gt_workarounds_init(struct intel_gt *gt, struct i915_wa_list *wal)
+
+ /* Wa_14011028019:dg2_g10 */
+ wa_mcr_write_or(wal, SSMCGCTL9530, RTFUNIT_CLKGATE_DIS);
++
++ /* Wa_14010680813:dg2_g10 */
++ wa_write_or(wal, GEN12_GAMSTLB_CTRL,
++ CONTROL_BLOCK_CLKGATE_DIS |
++ EGRESS_BLOCK_CLKGATE_DIS |
++ TAG_BLOCK_CLKGATE_DIS);
+ }
+
+ /* Wa_14014830051:dg2 */
+@@ -1649,6 +1668,16 @@ dg2_gt_workarounds_init(struct intel_gt *gt, struct i915_wa_list *wal)
+
+ /* Wa_14015795083 */
+ wa_mcr_write_clr(wal, GEN8_MISCCPCTL, GEN12_DOP_CLOCK_GATE_RENDER_ENABLE);
++
++ /* Wa_18018781329 */
++ wa_mcr_write_or(wal, RENDER_MOD_CTRL, FORCE_MISS_FTLB);
++ wa_mcr_write_or(wal, COMP_MOD_CTRL, FORCE_MISS_FTLB);
++ wa_mcr_write_or(wal, VDBX_MOD_CTRL, FORCE_MISS_FTLB);
++ wa_mcr_write_or(wal, VEBX_MOD_CTRL, FORCE_MISS_FTLB);
++
++ /* Wa_1509235366:dg2 */
++ wa_write_or(wal, GEN12_GAMCNTRL_CTRL,
++ INVALIDATION_BROADCAST_MODE_DIS | GLOBAL_INVALIDATION_MODE);
+ }
+
+ static void
+@@ -1658,16 +1687,29 @@ pvc_gt_workarounds_init(struct intel_gt *gt, struct i915_wa_list *wal)
+
+ /* Wa_14015795083 */
+ wa_mcr_write_clr(wal, GEN8_MISCCPCTL, GEN12_DOP_CLOCK_GATE_RENDER_ENABLE);
++
++ /* Wa_18018781329 */
++ wa_mcr_write_or(wal, RENDER_MOD_CTRL, FORCE_MISS_FTLB);
++ wa_mcr_write_or(wal, COMP_MOD_CTRL, FORCE_MISS_FTLB);
++ wa_mcr_write_or(wal, VDBX_MOD_CTRL, FORCE_MISS_FTLB);
++ wa_mcr_write_or(wal, VEBX_MOD_CTRL, FORCE_MISS_FTLB);
+ }
+
+ static void
+ xelpg_gt_workarounds_init(struct intel_gt *gt, struct i915_wa_list *wal)
+ {
+- /* Wa_14014830051 */
+ if (IS_MTL_GRAPHICS_STEP(gt->i915, M, STEP_A0, STEP_B0) ||
+- IS_MTL_GRAPHICS_STEP(gt->i915, P, STEP_A0, STEP_B0))
++ IS_MTL_GRAPHICS_STEP(gt->i915, P, STEP_A0, STEP_B0)) {
++ /* Wa_14014830051 */
+ wa_mcr_write_clr(wal, SARB_CHICKEN1, COMP_CKN_IN);
+
++ /* Wa_18018781329 */
++ wa_mcr_write_or(wal, RENDER_MOD_CTRL, FORCE_MISS_FTLB);
++ wa_mcr_write_or(wal, COMP_MOD_CTRL, FORCE_MISS_FTLB);
++ wa_mcr_write_or(wal, VDBX_MOD_CTRL, FORCE_MISS_FTLB);
++ wa_mcr_write_or(wal, VEBX_MOD_CTRL, FORCE_MISS_FTLB);
++ }
++
+ /*
+ * Unlike older platforms, we no longer setup implicit steering here;
+ * all MCR accesses are explicitly steered.
+@@ -2342,12 +2384,6 @@ rcs_engine_wa_init(struct intel_engine_cs *engine, struct i915_wa_list *wal)
+ GEN12_DISABLE_READ_SUPPRESSION);
+ }
+
+- if (IS_DG2(i915)) {
+- /* Wa_1509235366:dg2 */
+- wa_write_or(wal, GEN12_GAMCNTRL_CTRL, INVALIDATION_BROADCAST_MODE_DIS |
+- GLOBAL_INVALIDATION_MODE);
+- }
+-
+ if (IS_DG2_GRAPHICS_STEP(i915, G11, STEP_A0, STEP_B0)) {
+ /* Wa_14013392000:dg2_g11 */
+ wa_mcr_masked_en(wal, GEN8_ROW_CHICKEN2, GEN12_ENABLE_LARGE_GRF_MODE);
+@@ -2432,18 +2468,6 @@ rcs_engine_wa_init(struct intel_engine_cs *engine, struct i915_wa_list *wal)
+ wa_mcr_masked_en(wal, GEN9_HALF_SLICE_CHICKEN7,
+ DG2_DISABLE_ROUND_ENABLE_ALLOW_FOR_SSLA);
+
+- if (IS_DG2_GRAPHICS_STEP(engine->i915, G10, STEP_A0, STEP_B0)) {
+- /* Wa_14010680813:dg2_g10 */
+- wa_write_or(wal, GEN12_GAMSTLB_CTRL, CONTROL_BLOCK_CLKGATE_DIS |
+- EGRESS_BLOCK_CLKGATE_DIS | TAG_BLOCK_CLKGATE_DIS);
+- }
+-
+- if (IS_DG2_GRAPHICS_STEP(engine->i915, G10, STEP_A0, STEP_B0) ||
+- IS_DG2_GRAPHICS_STEP(engine->i915, G11, STEP_A0, STEP_B0)) {
+- /* Wa_14012362059:dg2 */
+- wa_mcr_write_or(wal, XEHP_MERT_MOD_CTRL, FORCE_MISS_FTLB);
+- }
+-
+ if (IS_DG2_GRAPHICS_STEP(i915, G11, STEP_B0, STEP_FOREVER) ||
+ IS_DG2_G10(i915)) {
+ /* Wa_22014600077:dg2 */
+@@ -3000,12 +3024,6 @@ general_render_compute_wa_init(struct intel_engine_cs *engine, struct i915_wa_li
+ IS_MTL_GRAPHICS_STEP(i915, P, STEP_A0, STEP_B0) ||
+ IS_PONTEVECCHIO(i915) ||
+ IS_DG2(i915)) {
+- /* Wa_18018781329 */
+- wa_mcr_write_or(wal, RENDER_MOD_CTRL, FORCE_MISS_FTLB);
+- wa_mcr_write_or(wal, COMP_MOD_CTRL, FORCE_MISS_FTLB);
+- wa_mcr_write_or(wal, VDBX_MOD_CTRL, FORCE_MISS_FTLB);
+- wa_mcr_write_or(wal, VEBX_MOD_CTRL, FORCE_MISS_FTLB);
+-
+ /* Wa_22014226127 */
+ wa_mcr_write_or(wal, LSC_CHICKEN_BIT_0, DISABLE_D8_D16_COASLESCE);
+ }
+@@ -3045,13 +3063,6 @@ general_render_compute_wa_init(struct intel_engine_cs *engine, struct i915_wa_li
+ wa_mcr_masked_dis(wal, MLTICTXCTL, TDONRENDER);
+ wa_mcr_write_or(wal, L3SQCREG1_CCS0, FLUSHALLNONCOH);
+ }
+-
+- /* Wa_14012362059:xehpsdv */
+- wa_mcr_write_or(wal, XEHP_MERT_MOD_CTRL, FORCE_MISS_FTLB);
+-
+- /* Wa_14014368820:xehpsdv */
+- wa_write_or(wal, GEN12_GAMCNTRL_CTRL, INVALIDATION_BROADCAST_MODE_DIS |
+- GLOBAL_INVALIDATION_MODE);
+ }
+
+ if (IS_DG2(i915) || IS_PONTEVECCHIO(i915)) {
+--
+2.39.2
+
--- /dev/null
+From ba4151225f8fec1c4bde84a026a6ff25ee7de7c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Nov 2022 09:39:49 -0500
+Subject: drm/mediatek: Clean dangling pointer on bind error path
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: NÃcolas F. R. A. Prado <nfraprado@collabora.com>
+
+[ Upstream commit 36aa8c61af55675ed967900fbe5deb32d776f051 ]
+
+mtk_drm_bind() can fail, in which case drm_dev_put() is called,
+destroying the drm_device object. However a pointer to it was still
+being held in the private object, and that pointer would be passed along
+to DRM in mtk_drm_sys_prepare() if a suspend were triggered at that
+point, resulting in a panic. Clean the pointer when destroying the
+object in the error path to prevent this from happening.
+
+Fixes: 119f5173628a ("drm/mediatek: Add DRM Driver for Mediatek SoC MT8173.")
+Signed-off-by: NÃcolas F. R. A. Prado <nfraprado@collabora.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20221122143949.3493104-1-nfraprado@collabora.com/
+Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/mediatek/mtk_drm_drv.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
+index cd5b18ef79512..d3e57dd79f5f5 100644
+--- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c
++++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
+@@ -520,6 +520,7 @@ static int mtk_drm_bind(struct device *dev)
+ err_deinit:
+ mtk_drm_kms_deinit(drm);
+ err_free:
++ private->drm = NULL;
+ drm_dev_put(drm);
+ return ret;
+ }
+--
+2.39.2
+
--- /dev/null
+From bc363a54bbdb0302edec03c4b32db6ed8f1c0305 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Jan 2023 15:12:55 -0800
+Subject: drm/mediatek: Drop unbalanced obj unref
+
+From: Rob Clark <robdclark@chromium.org>
+
+[ Upstream commit 4deef811828e87e26a978d5d6433b261d4713849 ]
+
+In the error path, mtk_drm_gem_object_mmap() is dropping an obj
+reference that it doesn't own.
+
+Fixes: 119f5173628a ("drm/mediatek: Add DRM Driver for Mediatek SoC MT8173.")
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20230119231255.2883365-1-robdclark@gmail.com/
+Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/mediatek/mtk_drm_gem.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/mediatek/mtk_drm_gem.c b/drivers/gpu/drm/mediatek/mtk_drm_gem.c
+index 06aadd5e7f5ba..6c204ccfb9ece 100644
+--- a/drivers/gpu/drm/mediatek/mtk_drm_gem.c
++++ b/drivers/gpu/drm/mediatek/mtk_drm_gem.c
+@@ -164,8 +164,6 @@ static int mtk_drm_gem_object_mmap(struct drm_gem_object *obj,
+
+ ret = dma_mmap_attrs(priv->dma_dev, vma, mtk_gem->cookie,
+ mtk_gem->dma_addr, obj->size, mtk_gem->dma_attrs);
+- if (ret)
+- drm_gem_vm_close(vma);
+
+ return ret;
+ }
+--
+2.39.2
+
--- /dev/null
+From f2e861e5dde47d878059eced079f73b921168156 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Jan 2023 13:54:51 +0800
+Subject: drm/mediatek: dsi: Reduce the time of dsi from LP11 to sending cmd
+
+From: Xinlei Lee <xinlei.lee@mediatek.com>
+
+[ Upstream commit 91aeaed2c1147e3b1157dc084d23f190856a6c23 ]
+
+According to Figure 16 Turnaround Procedure on page 36 in [1], you
+can see the status of LP-00 -> LP10 -> LP11. This state can correspond
+to the state of DSI from LP00 -> LP11 in mtk_dsi_lane_ready function
+in mtk_dsi.c.
+
+LP-00 -> LP10 -> LP11 takes about 2*TLPX time (refer to [1] page 51
+to see that TLPX is 50ns)
+
+The delay at the end of the mtk_dsi_lane_ready function should be
+greater than the 2*TLPX specified by the DSI spec, and less than
+the time specified by the DSI_RX (generally 6ms to 40ms), to avoid
+problems caused by the RX specification
+
+[1]:mipi_D-PHY_specification_v1-1
+
+Fixes: 39e8d062b03c ("drm/mediatek: Keep dsi as LP00 before dcs cmds transfer")
+Signed-off-by: Xinlei Lee <xinlei.lee@mediatek.com>
+Acked-by: Sam Ravnborg <sam@ravnborg.org>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://patchwork.kernel.org/project/linux-mediatek/patch/1673330093-6771-2-git-send-email-xinlei.lee@mediatek.com/
+Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/mediatek/mtk_dsi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/mediatek/mtk_dsi.c b/drivers/gpu/drm/mediatek/mtk_dsi.c
+index 3b7d13028fb6b..9e1363c9fcdb4 100644
+--- a/drivers/gpu/drm/mediatek/mtk_dsi.c
++++ b/drivers/gpu/drm/mediatek/mtk_dsi.c
+@@ -721,7 +721,7 @@ static void mtk_dsi_lane_ready(struct mtk_dsi *dsi)
+ mtk_dsi_clk_ulp_mode_leave(dsi);
+ mtk_dsi_lane0_ulp_mode_leave(dsi);
+ mtk_dsi_clk_hs_mode(dsi, 0);
+- msleep(20);
++ usleep_range(1000, 3000);
+ /* The reaction time after pulling up the mipi signal for dsi_rx */
+ }
+ }
+--
+2.39.2
+
--- /dev/null
+From a3b75ea896b8d84e60a4319d4fa3b8c5462ec8a1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Dec 2022 17:51:15 +0800
+Subject: drm/mediatek: mtk_drm_crtc: Add checks for devm_kcalloc
+
+From: ruanjinjie <ruanjinjie@huawei.com>
+
+[ Upstream commit 5bf1e3bd7da625ccf9a22c8cb7d65271e6e47f4c ]
+
+As the devm_kcalloc may return NULL, the return value needs to be checked
+to avoid NULL poineter dereference.
+
+Fixes: 31c5558dae05 ("drm/mediatek: Refactor plane init")
+Signed-off-by: ruanjinjie <ruanjinjie@huawei.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20221205095115.2905090-1-ruanjinjie@huawei.com/
+Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/mediatek/mtk_drm_crtc.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
+index 112615817dcbe..5071f1263216b 100644
+--- a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
++++ b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
+@@ -945,6 +945,8 @@ int mtk_drm_crtc_create(struct drm_device *drm_dev,
+
+ mtk_crtc->planes = devm_kcalloc(dev, num_comp_planes,
+ sizeof(struct drm_plane), GFP_KERNEL);
++ if (!mtk_crtc->planes)
++ return -ENOMEM;
+
+ for (i = 0; i < mtk_crtc->ddp_comp_nr; i++) {
+ ret = mtk_drm_crtc_init_comp_planes(drm_dev, mtk_crtc, i,
+--
+2.39.2
+
--- /dev/null
+From 265a3021914846fb70a999551d2d2953281ce557 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Jan 2023 10:44:41 +0800
+Subject: drm/mediatek: Use NULL instead of 0 for NULL pointer
+
+From: Miles Chen <miles.chen@mediatek.com>
+
+[ Upstream commit 4744cde06f57dd6fbaac468663b1fe2f653eaa16 ]
+
+Use NULL for NULL pointer to fix the following sparse warning:
+drivers/gpu/drm/mediatek/mtk_drm_gem.c:265:27: sparse: warning: Using plain integer as NULL pointer
+
+Fixes: 3df64d7b0a4f ("drm/mediatek: Implement gem prime vmap/vunmap function")
+Signed-off-by: Miles Chen <miles.chen@mediatek.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20230111024443.24559-1-miles.chen@mediatek.com/
+Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/mediatek/mtk_drm_gem.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/mediatek/mtk_drm_gem.c b/drivers/gpu/drm/mediatek/mtk_drm_gem.c
+index 47e96b0289f98..06aadd5e7f5ba 100644
+--- a/drivers/gpu/drm/mediatek/mtk_drm_gem.c
++++ b/drivers/gpu/drm/mediatek/mtk_drm_gem.c
+@@ -262,6 +262,6 @@ void mtk_drm_gem_prime_vunmap(struct drm_gem_object *obj,
+ return;
+
+ vunmap(vaddr);
+- mtk_gem->kvaddr = 0;
++ mtk_gem->kvaddr = NULL;
+ kfree(mtk_gem->pages);
+ }
+--
+2.39.2
+
--- /dev/null
+From a714e98ab755813828cb08202f56ea059efff11d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Jan 2023 17:49:07 -0500
+Subject: drm/mipi-dsi: Fix byte order of 16-bit DCS set/get brightness
+
+From: Daniel Mentz <danielmentz@google.com>
+
+[ Upstream commit c9d27c6be518b4ef2966d9564654ef99292ea1b3 ]
+
+The MIPI DCS specification demands that brightness values are sent in
+big endian byte order. It also states that one parameter (i.e. one byte)
+shall be sent/received for 8 bit wide values, and two parameters shall
+be used for values that are between 9 and 16 bits wide.
+
+Add new functions to properly handle 16-bit brightness in big endian,
+since the two 8- and 16-bit cases are distinct from each other.
+
+[richard: use separate functions instead of switch/case]
+[richard: split into 16-bit component]
+
+Fixes: 1a9d759331b8 ("drm/dsi: Implement DCS set/get display brightness")
+Signed-off-by: Daniel Mentz <danielmentz@google.com>
+Link: https://android.googlesource.com/kernel/msm/+/754affd62d0ee268c686c53169b1dbb7deac8550
+[richard: fix 16-bit brightness_get]
+Signed-off-by: Richard Acayan <mailingradian@gmail.com>
+Tested-by: Caleb Connolly <caleb@connolly.tech>
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Reviewed-by: Sam Ravnborg <sam@ravnborg.org>
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230116224909.23884-2-mailingradian@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_mipi_dsi.c | 52 ++++++++++++++++++++++++++++++++++
+ include/drm/drm_mipi_dsi.h | 4 +++
+ 2 files changed, 56 insertions(+)
+
+diff --git a/drivers/gpu/drm/drm_mipi_dsi.c b/drivers/gpu/drm/drm_mipi_dsi.c
+index 497ef4b6a90a4..4bc15fbd009d8 100644
+--- a/drivers/gpu/drm/drm_mipi_dsi.c
++++ b/drivers/gpu/drm/drm_mipi_dsi.c
+@@ -1224,6 +1224,58 @@ int mipi_dsi_dcs_get_display_brightness(struct mipi_dsi_device *dsi,
+ }
+ EXPORT_SYMBOL(mipi_dsi_dcs_get_display_brightness);
+
++/**
++ * mipi_dsi_dcs_set_display_brightness_large() - sets the 16-bit brightness value
++ * of the display
++ * @dsi: DSI peripheral device
++ * @brightness: brightness value
++ *
++ * Return: 0 on success or a negative error code on failure.
++ */
++int mipi_dsi_dcs_set_display_brightness_large(struct mipi_dsi_device *dsi,
++ u16 brightness)
++{
++ u8 payload[2] = { brightness >> 8, brightness & 0xff };
++ ssize_t err;
++
++ err = mipi_dsi_dcs_write(dsi, MIPI_DCS_SET_DISPLAY_BRIGHTNESS,
++ payload, sizeof(payload));
++ if (err < 0)
++ return err;
++
++ return 0;
++}
++EXPORT_SYMBOL(mipi_dsi_dcs_set_display_brightness_large);
++
++/**
++ * mipi_dsi_dcs_get_display_brightness_large() - gets the current 16-bit
++ * brightness value of the display
++ * @dsi: DSI peripheral device
++ * @brightness: brightness value
++ *
++ * Return: 0 on success or a negative error code on failure.
++ */
++int mipi_dsi_dcs_get_display_brightness_large(struct mipi_dsi_device *dsi,
++ u16 *brightness)
++{
++ u8 brightness_be[2];
++ ssize_t err;
++
++ err = mipi_dsi_dcs_read(dsi, MIPI_DCS_GET_DISPLAY_BRIGHTNESS,
++ brightness_be, sizeof(brightness_be));
++ if (err <= 0) {
++ if (err == 0)
++ err = -ENODATA;
++
++ return err;
++ }
++
++ *brightness = (brightness_be[0] << 8) | brightness_be[1];
++
++ return 0;
++}
++EXPORT_SYMBOL(mipi_dsi_dcs_get_display_brightness_large);
++
+ static int mipi_dsi_drv_probe(struct device *dev)
+ {
+ struct mipi_dsi_driver *drv = to_mipi_dsi_driver(dev->driver);
+diff --git a/include/drm/drm_mipi_dsi.h b/include/drm/drm_mipi_dsi.h
+index 20b21b577deaa..9054a5185e1a9 100644
+--- a/include/drm/drm_mipi_dsi.h
++++ b/include/drm/drm_mipi_dsi.h
+@@ -296,6 +296,10 @@ int mipi_dsi_dcs_set_display_brightness(struct mipi_dsi_device *dsi,
+ u16 brightness);
+ int mipi_dsi_dcs_get_display_brightness(struct mipi_dsi_device *dsi,
+ u16 *brightness);
++int mipi_dsi_dcs_set_display_brightness_large(struct mipi_dsi_device *dsi,
++ u16 brightness);
++int mipi_dsi_dcs_get_display_brightness_large(struct mipi_dsi_device *dsi,
++ u16 *brightness);
+
+ /**
+ * mipi_dsi_dcs_write_seq - transmit a DCS command with payload
+--
+2.39.2
+
--- /dev/null
+From d011a7ff10bf1b219d9026a350c3b2ea7f7afcf6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Nov 2022 09:19:37 +0100
+Subject: drm/modes: Use strscpy() to copy command-line mode name
+
+From: Maxime Ripard <maxime@cerno.tech>
+
+[ Upstream commit 0f9aa074c92dd9274b811c1c3fa93736814a4b0d ]
+
+The mode name in struct drm_cmdline_mode can hold 32 characters at most,
+which can easily get overrun. Switch to strscpy() to prevent such a
+thing.
+
+Reported-by: coverity-bot <keescook+coverity-bot@chromium.org>
+Addresses-Coverity-ID: 1527354 ("Security best practices violations")
+Fixes: a7ab155397dd ("drm/modes: Switch to named mode descriptors")
+Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
+Link: https://lore.kernel.org/r/20221128081938.742410-2-maxime@cerno.tech
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_modes.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/drm_modes.c b/drivers/gpu/drm/drm_modes.c
+index 3c8034a8c27bd..951afe8279da8 100644
+--- a/drivers/gpu/drm/drm_modes.c
++++ b/drivers/gpu/drm/drm_modes.c
+@@ -1809,7 +1809,7 @@ static int drm_mode_parse_cmdline_named_mode(const char *name,
+ if (ret != name_end)
+ continue;
+
+- strcpy(cmdline_mode->name, mode->name);
++ strscpy(cmdline_mode->name, mode->name, sizeof(cmdline_mode->name));
+ cmdline_mode->pixel_clock = mode->pixel_clock_khz;
+ cmdline_mode->xres = mode->xres;
+ cmdline_mode->yres = mode->yres;
+--
+2.39.2
+
--- /dev/null
+From 180a6e9d3ca5e2a717c059d107b970bec01ee55f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Dec 2022 20:39:56 +0530
+Subject: drm/msm/adreno: Fix null ptr access in adreno_gpu_cleanup()
+
+From: Akhil P Oommen <quic_akhilpo@quicinc.com>
+
+[ Upstream commit dbeedbcb268d055d8895aceca427f897e12c2b50 ]
+
+Fix the below kernel panic due to null pointer access:
+[ 18.504431] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000048
+[ 18.513464] Mem abort info:
+[ 18.516346] ESR = 0x0000000096000005
+[ 18.520204] EC = 0x25: DABT (current EL), IL = 32 bits
+[ 18.525706] SET = 0, FnV = 0
+[ 18.528878] EA = 0, S1PTW = 0
+[ 18.532117] FSC = 0x05: level 1 translation fault
+[ 18.537138] Data abort info:
+[ 18.540110] ISV = 0, ISS = 0x00000005
+[ 18.544060] CM = 0, WnR = 0
+[ 18.547109] user pgtable: 4k pages, 39-bit VAs, pgdp=0000000112826000
+[ 18.553738] [0000000000000048] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000
+[ 18.562690] Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP
+**Snip**
+[ 18.696758] Call trace:
+[ 18.699278] adreno_gpu_cleanup+0x30/0x88
+[ 18.703396] a6xx_destroy+0xc0/0x130
+[ 18.707066] a6xx_gpu_init+0x308/0x424
+[ 18.710921] adreno_bind+0x178/0x288
+[ 18.714590] component_bind_all+0xe0/0x214
+[ 18.718797] msm_drm_bind+0x1d4/0x614
+[ 18.722566] try_to_bring_up_aggregate_device+0x16c/0x1b8
+[ 18.728105] __component_add+0xa0/0x158
+[ 18.732048] component_add+0x20/0x2c
+[ 18.735719] adreno_probe+0x40/0xc0
+[ 18.739300] platform_probe+0xb4/0xd4
+[ 18.743068] really_probe+0xfc/0x284
+[ 18.746738] __driver_probe_device+0xc0/0xec
+[ 18.751129] driver_probe_device+0x48/0x110
+[ 18.755421] __device_attach_driver+0xa8/0xd0
+[ 18.759900] bus_for_each_drv+0x90/0xdc
+[ 18.763843] __device_attach+0xfc/0x174
+[ 18.767786] device_initial_probe+0x20/0x2c
+[ 18.772090] bus_probe_device+0x40/0xa0
+[ 18.776032] deferred_probe_work_func+0x94/0xd0
+[ 18.780686] process_one_work+0x190/0x3d0
+[ 18.784805] worker_thread+0x280/0x3d4
+[ 18.788659] kthread+0x104/0x1c0
+[ 18.791981] ret_from_fork+0x10/0x20
+[ 18.795654] Code: f9400408 aa0003f3 aa1f03f4 91142015 (f9402516)
+[ 18.801913] ---[ end trace 0000000000000000 ]---
+[ 18.809039] Kernel panic - not syncing: Oops: Fatal exception
+
+Fixes: 17e822f7591f ("drm/msm: fix unbalanced pm_runtime_enable in adreno_gpu_{init, cleanup}")
+Signed-off-by: Akhil P Oommen <quic_akhilpo@quicinc.com>
+Patchwork: https://patchwork.freedesktop.org/patch/515605/
+Link: https://lore.kernel.org/r/20221221203925.v2.1.Ib978de92c4bd000b515486aad72e96c2481f84d0@changeid
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/adreno/adreno_gpu.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/adreno/adreno_gpu.c b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
+index 3605f095b2de2..8175997663299 100644
+--- a/drivers/gpu/drm/msm/adreno/adreno_gpu.c
++++ b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
+@@ -1083,13 +1083,13 @@ int adreno_gpu_init(struct drm_device *drm, struct platform_device *pdev,
+ void adreno_gpu_cleanup(struct adreno_gpu *adreno_gpu)
+ {
+ struct msm_gpu *gpu = &adreno_gpu->base;
+- struct msm_drm_private *priv = gpu->dev->dev_private;
++ struct msm_drm_private *priv = gpu->dev ? gpu->dev->dev_private : NULL;
+ unsigned int i;
+
+ for (i = 0; i < ARRAY_SIZE(adreno_gpu->info->fw); i++)
+ release_firmware(adreno_gpu->fw[i]);
+
+- if (pm_runtime_enabled(&priv->gpu_pdev->dev))
++ if (priv && pm_runtime_enabled(&priv->gpu_pdev->dev))
+ pm_runtime_disable(&priv->gpu_pdev->dev);
+
+ msm_gpu_cleanup(&adreno_gpu->base);
+--
+2.39.2
+
--- /dev/null
+From b59bee1705985a137554b0d12c411171544c9956 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 18 Jun 2022 02:33:25 +0300
+Subject: drm/msm: clean event_thread->worker in case of an error
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit c79bb6b92defdcb834ceeeed9c1cf591beb1b71a ]
+
+If worker creation fails, nullify the event_thread->worker, so that
+msm_drm_uninit() doesn't try accessing invalid memory location. While we
+are at it, remove duplicate assignment to the ret variable.
+
+Fixes: 1041dee2178f ("drm/msm: use kthread_create_worker instead of kthread_run")
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Reviewed-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
+Patchwork: https://patchwork.freedesktop.org/patch/490106/
+Link: https://lore.kernel.org/r/20220617233328.1143665-2-dmitry.baryshkov@linaro.org
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/msm_drv.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c
+index 45e81eb148a8d..ee2f60b6f09b3 100644
+--- a/drivers/gpu/drm/msm/msm_drv.c
++++ b/drivers/gpu/drm/msm/msm_drv.c
+@@ -491,7 +491,7 @@ static int msm_drm_init(struct device *dev, const struct drm_driver *drv)
+ if (IS_ERR(priv->event_thread[i].worker)) {
+ ret = PTR_ERR(priv->event_thread[i].worker);
+ DRM_DEV_ERROR(dev, "failed to create crtc_event kthread\n");
+- ret = PTR_ERR(priv->event_thread[i].worker);
++ priv->event_thread[i].worker = NULL;
+ goto err_msm_uninit;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 1488fc7279e7bd87537fc382631090abfcc8dafb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Dec 2022 16:05:17 +0800
+Subject: drm/msm/dpu: Add check for cstate
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit c96988b7d99327bb08bd9efd29a203b22cd88ace ]
+
+As kzalloc may fail and return NULL pointer,
+it should be better to check cstate
+in order to avoid the NULL pointer dereference
+in __drm_atomic_helper_crtc_reset.
+
+Fixes: 1cff7440a86e ("drm/msm: Convert to using __drm_atomic_helper_crtc_reset() for reset.")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Reviewed-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Patchwork: https://patchwork.freedesktop.org/patch/514163/
+Link: https://lore.kernel.org/r/20221206080517.43786-1-jiasheng@iscas.ac.cn
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
+index 13ce321283ff9..22c2787b7b381 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
+@@ -968,7 +968,10 @@ static void dpu_crtc_reset(struct drm_crtc *crtc)
+ if (crtc->state)
+ dpu_crtc_destroy_state(crtc, crtc->state);
+
+- __drm_atomic_helper_crtc_reset(crtc, &cstate->base);
++ if (cstate)
++ __drm_atomic_helper_crtc_reset(crtc, &cstate->base);
++ else
++ __drm_atomic_helper_crtc_reset(crtc, NULL);
+ }
+
+ /**
+--
+2.39.2
+
--- /dev/null
+From da24812a5a41cff3c493dccbde4a336ffc95f153 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Dec 2022 16:02:36 +0800
+Subject: drm/msm/dpu: Add check for pstates
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit 93340e10b9c5fc86730d149636e0aa8b47bb5a34 ]
+
+As kzalloc may fail and return NULL pointer,
+it should be better to check pstates
+in order to avoid the NULL pointer dereference.
+
+Fixes: 25fdd5933e4c ("drm/msm: Add SDM845 DPU support")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Reviewed-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
+Patchwork: https://patchwork.freedesktop.org/patch/514160/
+Link: https://lore.kernel.org/r/20221206080236.43687-1-jiasheng@iscas.ac.cn
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
+index 22c2787b7b381..c9d1c412628e9 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
+@@ -1153,6 +1153,8 @@ static int dpu_crtc_atomic_check(struct drm_crtc *crtc,
+ bool needs_dirtyfb = dpu_crtc_needs_dirtyfb(crtc_state);
+
+ pstates = kzalloc(sizeof(*pstates) * DPU_STAGE_MAX * 4, GFP_KERNEL);
++ if (!pstates)
++ return -ENOMEM;
+
+ if (!crtc_state->enable || !crtc_state->active) {
+ DRM_DEBUG_ATOMIC("crtc%d -> enable %d, active %d, skip atomic_check\n",
+--
+2.39.2
+
--- /dev/null
+From d24b72627e2d0860ec06dd7ef160336a40f01eb9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Jan 2023 11:14:11 +0100
+Subject: drm/msm/dpu: Add DSC hardware blocks to register snapshot
+
+From: Marijn Suijten <marijn.suijten@somainline.org>
+
+[ Upstream commit a7efe60e36b9c0e966d7f82ac90a89b591d984e9 ]
+
+Add missing DSC hardware block register ranges to the snapshot utility
+to include them in dmesg (on MSM_DISP_SNAPSHOT_DUMP_IN_CONSOLE) and the
+kms debugfs file.
+
+Signed-off-by: Marijn Suijten <marijn.suijten@somainline.org>
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Reviewed-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
+Patchwork: https://patchwork.freedesktop.org/patch/520175/
+Link: https://lore.kernel.org/r/20230125101412.216924-1-marijn.suijten@somainline.org
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c
+index b71199511a52d..09757166a064a 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c
+@@ -930,6 +930,11 @@ static void dpu_kms_mdp_snapshot(struct msm_disp_state *disp_state, struct msm_k
+ msm_disp_snapshot_add_block(disp_state, cat->mdp[0].len,
+ dpu_kms->mmio + cat->mdp[0].base, "top");
+
++ /* dump DSC sub-blocks HW regs info */
++ for (i = 0; i < cat->dsc_count; i++)
++ msm_disp_snapshot_add_block(disp_state, cat->dsc[i].len,
++ dpu_kms->mmio + cat->dsc[i].base, "dsc_%d", i);
++
+ pm_runtime_put_sync(&dpu_kms->pdev->dev);
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 37b9100fe529f9678d4bcf0e4cb208d84bce57bd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 19 Nov 2022 13:55:18 +0800
+Subject: drm/msm/dpu: check for null return of devm_kzalloc() in
+ dpu_writeback_init()
+
+From: Hui Tang <tanghui20@huawei.com>
+
+[ Upstream commit 21e9a838f505178e109ccb3bf19d7808eb0326f4 ]
+
+Because of the possilble failure of devm_kzalloc(), dpu_wb_conn might
+be NULL and will cause null pointer dereference later.
+
+Therefore, it might be better to check it and directly return -ENOMEM.
+
+Fixes: 77b001acdcfe ("drm/msm/dpu: add the writeback connector layer")
+Signed-off-by: Hui Tang <tanghui20@huawei.com>
+Reviewed-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
+Patchwork: https://patchwork.freedesktop.org/patch/512277/
+Link: https://lore.kernel.org/r/20221119055518.179937-1-tanghui20@huawei.com
+[DB: fixed typo in commit message]
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/disp/dpu1/dpu_writeback.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_writeback.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_writeback.c
+index 088ec990a2f26..2a5a68366582b 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_writeback.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_writeback.c
+@@ -70,6 +70,8 @@ int dpu_writeback_init(struct drm_device *dev, struct drm_encoder *enc,
+ int rc = 0;
+
+ dpu_wb_conn = devm_kzalloc(dev->dev, sizeof(*dpu_wb_conn), GFP_KERNEL);
++ if (!dpu_wb_conn)
++ return -ENOMEM;
+
+ drm_connector_helper_add(&dpu_wb_conn->base.base, &dpu_wb_conn_helper_funcs);
+
+--
+2.39.2
+
--- /dev/null
+From 98897151cec4c50728b86f90091216ac7ec5d328 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Jan 2023 00:15:55 +0100
+Subject: drm/msm/dpu: Disallow unallocated resources to be returned
+
+From: Marijn Suijten <marijn.suijten@somainline.org>
+
+[ Upstream commit abc40122d9a69f56c04efb5a7485795f5ac799d1 ]
+
+In the event that the topology requests resources that have not been
+created by the system (because they are typically not represented in
+dpu_mdss_cfg ^1), the resource(s) in global_state (in this case DSC
+blocks, until their allocation/assignment is being sanity-checked in
+"drm/msm/dpu: Reject topologies for which no DSC blocks are available")
+remain NULL but will still be returned out of
+dpu_rm_get_assigned_resources, where the caller expects to get an array
+containing num_blks valid pointers (but instead gets these NULLs).
+
+To prevent this from happening, where null-pointer dereferences
+typically result in a hard-to-debug platform lockup, num_blks shouldn't
+increase past NULL blocks and will print an error and break instead.
+After all, max_blks represents the static size of the maximum number of
+blocks whereas the actual amount varies per platform.
+
+^1: which can happen after a git rebase ended up moving additions to
+_dpu_cfg to a different struct which has the same patch context.
+
+Fixes: bb00a452d6f7 ("drm/msm/dpu: Refactor resource manager")
+Signed-off-by: Marijn Suijten <marijn.suijten@somainline.org>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Patchwork: https://patchwork.freedesktop.org/patch/517636/
+Link: https://lore.kernel.org/r/20230109231556.344977-1-marijn.suijten@somainline.org
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/disp/dpu1/dpu_rm.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_rm.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_rm.c
+index 73b3442e74679..7ada957adbbb8 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_rm.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_rm.c
+@@ -660,6 +660,11 @@ int dpu_rm_get_assigned_resources(struct dpu_rm *rm,
+ blks_size, enc_id);
+ break;
+ }
++ if (!hw_blks[i]) {
++ DPU_ERROR("Allocated resource %d unavailable to assign to enc %d\n",
++ type, enc_id);
++ break;
++ }
+ blks[num_blks++] = hw_blks[i];
+ }
+
+--
+2.39.2
+
--- /dev/null
+From d9a8e90726d008856cae16162145621d830ce475 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Jan 2023 12:30:55 +0200
+Subject: drm/msm/dpu: sc7180: add missing WB2 clock control
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit 255f056181ac69278dcd8778f0be32a21b2d2a6a ]
+
+Add missing DPU_CLK_CTRL_WB2 to sc7180_mdp clocks array.
+
+Fixes: 51e4d60e6ba5 ("drm/msm/dpu: add writeback support for sc7180")
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Reviewed-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
+Tested-by: Jessica Zhang <quic_jesszhan@quicinc.com> # Trogdor (sc7180)
+Patchwork: https://patchwork.freedesktop.org/patch/518504/
+Link: https://lore.kernel.org/r/20230116103055.780767-1-dmitry.baryshkov@linaro.org
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c
+index 2196e205efa5e..83f1dd2c22bd7 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c
+@@ -459,6 +459,8 @@ static const struct dpu_mdp_cfg sc7180_mdp[] = {
+ .reg_off = 0x2B4, .bit_off = 8},
+ .clk_ctrls[DPU_CLK_CTRL_CURSOR1] = {
+ .reg_off = 0x2C4, .bit_off = 8},
++ .clk_ctrls[DPU_CLK_CTRL_WB2] = {
++ .reg_off = 0x3B8, .bit_off = 24},
+ },
+ };
+
+--
+2.39.2
+
--- /dev/null
+From 404ceb1c3f234795d83758d6719cafbcc44a7a26 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Dec 2022 21:18:30 +0200
+Subject: drm/msm/dpu: set pdpu->is_rt_pipe early in
+ dpu_plane_sspp_atomic_update()
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit 1d233b1cb149ec78c20fac58331b27bb460f9558 ]
+
+The function dpu_plane_sspp_atomic_update() updates pdpu->is_rt_pipe
+flag, but after the commit 854f6f1c653b ("drm/msm/dpu: update the qos
+remap only if the client type changes") it sets the flag late, after all
+the qos functions have updated QoS programming. Move the flag update
+back to the place where it happened before the mentioned commit to let
+the pipe be programmed according to its current RT/non-RT state.
+
+Fixes: 854f6f1c653b ("drm/msm/dpu: update the qos remap only if the client type changes")
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Reviewed-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
+Patchwork: https://patchwork.freedesktop.org/patch/516239/
+Link: https://lore.kernel.org/r/20221229191856.3508092-2-dmitry.baryshkov@linaro.org
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c | 15 ++++++---------
+ 1 file changed, 6 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c
+index 86719020afe20..bfd5be89e8b8d 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c
+@@ -1126,7 +1126,7 @@ static void dpu_plane_sspp_atomic_update(struct drm_plane *plane)
+ struct dpu_plane_state *pstate = to_dpu_plane_state(state);
+ struct drm_crtc *crtc = state->crtc;
+ struct drm_framebuffer *fb = state->fb;
+- bool is_rt_pipe, update_qos_remap;
++ bool is_rt_pipe;
+ const struct dpu_format *fmt =
+ to_dpu_format(msm_framebuffer_format(fb));
+ struct dpu_hw_pipe_cfg pipe_cfg;
+@@ -1138,6 +1138,9 @@ static void dpu_plane_sspp_atomic_update(struct drm_plane *plane)
+ pstate->pending = true;
+
+ is_rt_pipe = (dpu_crtc_get_client_type(crtc) != NRT_CLIENT);
++ pstate->needs_qos_remap |= (is_rt_pipe != pdpu->is_rt_pipe);
++ pdpu->is_rt_pipe = is_rt_pipe;
++
+ _dpu_plane_set_qos_ctrl(plane, false, DPU_PLANE_QOS_PANIC_CTRL);
+
+ DPU_DEBUG_PLANE(pdpu, "FB[%u] " DRM_RECT_FP_FMT "->crtc%u " DRM_RECT_FMT
+@@ -1219,14 +1222,8 @@ static void dpu_plane_sspp_atomic_update(struct drm_plane *plane)
+ _dpu_plane_set_ot_limit(plane, crtc, &pipe_cfg);
+ }
+
+- update_qos_remap = (is_rt_pipe != pdpu->is_rt_pipe) ||
+- pstate->needs_qos_remap;
+-
+- if (update_qos_remap) {
+- if (is_rt_pipe != pdpu->is_rt_pipe)
+- pdpu->is_rt_pipe = is_rt_pipe;
+- else if (pstate->needs_qos_remap)
+- pstate->needs_qos_remap = false;
++ if (pstate->needs_qos_remap) {
++ pstate->needs_qos_remap = false;
+ _dpu_plane_set_qos_remap(plane);
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 3fb2f632e5259292de471a2959b688f70c97b3fc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Jan 2023 10:16:51 +0800
+Subject: drm/msm/dsi: Add missing check for alloc_ordered_workqueue
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit 115906ca7b535afb1fe7b5406c566ccd3873f82b ]
+
+Add check for the return value of alloc_ordered_workqueue as it may return
+NULL pointer and cause NULL pointer dereference.
+
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Reviewed-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
+Patchwork: https://patchwork.freedesktop.org/patch/517646/
+Link: https://lore.kernel.org/r/20230110021651.12770-1-jiasheng@iscas.ac.cn
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/dsi/dsi_host.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/gpu/drm/msm/dsi/dsi_host.c b/drivers/gpu/drm/msm/dsi/dsi_host.c
+index 89aadd3b3202b..f167a45f1fbdd 100644
+--- a/drivers/gpu/drm/msm/dsi/dsi_host.c
++++ b/drivers/gpu/drm/msm/dsi/dsi_host.c
+@@ -1977,6 +1977,9 @@ int msm_dsi_host_init(struct msm_dsi *msm_dsi)
+
+ /* setup workqueue */
+ msm_host->workqueue = alloc_ordered_workqueue("dsi_drm_work", 0);
++ if (!msm_host->workqueue)
++ return -ENOMEM;
++
+ INIT_WORK(&msm_host->err_work, dsi_err_worker);
+
+ msm_dsi->id = msm_host->id;
+--
+2.39.2
+
--- /dev/null
+From b9b1e2e0bdde336b79423880315f696a9695d8c4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Jan 2023 22:00:53 +0100
+Subject: drm/msm/dsi: Allow 2 CTRLs on v2.5.0
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit 1ae654ded7c5a19dc13f57a4fe4434fef879b6f9 ]
+
+v2.5.0 support was originally added for SC7280, but this hw is also
+present on SM8350, which has one more DSI host. Bump up the dsi count
+and fill in the register of the secondary host to allow it to probe.
+
+This should not have any adverse effects on SC7280, as the secondary
+CTRL will only be touched if it's defined, anyway.
+
+Fixes: 65c391b31994 ("drm/msm/dsi: Add DSI support for SC7280")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Patchwork: https://patchwork.freedesktop.org/patch/519513/
+Link: https://lore.kernel.org/r/20230120210101.2146852-1-konrad.dybcio@linaro.org
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/dsi/dsi_cfg.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/dsi/dsi_cfg.c b/drivers/gpu/drm/msm/dsi/dsi_cfg.c
+index 7e97c239ed489..e0bd452a9f1e6 100644
+--- a/drivers/gpu/drm/msm/dsi/dsi_cfg.c
++++ b/drivers/gpu/drm/msm/dsi/dsi_cfg.c
+@@ -209,8 +209,8 @@ static const struct msm_dsi_config sc7280_dsi_cfg = {
+ .num_regulators = ARRAY_SIZE(sc7280_dsi_regulators),
+ .bus_clk_names = dsi_sc7280_bus_clk_names,
+ .num_bus_clks = ARRAY_SIZE(dsi_sc7280_bus_clk_names),
+- .io_start = { 0xae94000 },
+- .num_dsi = 1,
++ .io_start = { 0xae94000, 0xae96000 },
++ .num_dsi = 2,
+ };
+
+ static const char * const dsi_qcm2290_bus_clk_names[] = {
+--
+2.39.2
+
--- /dev/null
+From 69136ba0df94b8b0871e47f1b13d9c95b42fd80e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Dec 2022 17:11:17 +0800
+Subject: drm/msm/gem: Add check for kmalloc
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit d839f0811a31322c087a859c2b181e2383daa7be ]
+
+Add the check for the return value of kmalloc in order to avoid
+NULL pointer dereference in copy_from_user.
+
+Fixes: 20224d715a88 ("drm/msm/submit: Move copy_from_user ahead of locking bos")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Patchwork: https://patchwork.freedesktop.org/patch/514678/
+Link: https://lore.kernel.org/r/20221212091117.43511-1-jiasheng@iscas.ac.cn
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/msm_gem_submit.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/gpu/drm/msm/msm_gem_submit.c b/drivers/gpu/drm/msm/msm_gem_submit.c
+index 73a2ca122c570..1c4be193fd23f 100644
+--- a/drivers/gpu/drm/msm/msm_gem_submit.c
++++ b/drivers/gpu/drm/msm/msm_gem_submit.c
+@@ -209,6 +209,10 @@ static int submit_lookup_cmds(struct msm_gem_submit *submit,
+ goto out;
+ }
+ submit->cmd[i].relocs = kmalloc(sz, GFP_KERNEL);
++ if (!submit->cmd[i].relocs) {
++ ret = -ENOMEM;
++ goto out;
++ }
+ ret = copy_from_user(submit->cmd[i].relocs, userptr, sz);
+ if (ret) {
+ ret = -EFAULT;
+--
+2.39.2
+
--- /dev/null
+From 0bb4f25b2ab13cb571a7e0ad997e4c0c72e317ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Jan 2023 10:30:11 +0800
+Subject: drm/msm/hdmi: Add missing check for alloc_ordered_workqueue
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit afe4cb96153a0d8003e4e4ebd91b5c543e10df84 ]
+
+Add check for the return value of alloc_ordered_workqueue as it may return
+NULL pointer and cause NULL pointer dereference in `hdmi_hdcp.c` and
+`hdmi_hpd.c`.
+
+Fixes: c6a57a50ad56 ("drm/msm/hdmi: add hdmi hdcp support (V3)")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Patchwork: https://patchwork.freedesktop.org/patch/517211/
+Link: https://lore.kernel.org/r/20230106023011.3985-1-jiasheng@iscas.ac.cn
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/hdmi/hdmi.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/gpu/drm/msm/hdmi/hdmi.c b/drivers/gpu/drm/msm/hdmi/hdmi.c
+index 97372bb241d89..4ad36bc8fe5ed 100644
+--- a/drivers/gpu/drm/msm/hdmi/hdmi.c
++++ b/drivers/gpu/drm/msm/hdmi/hdmi.c
+@@ -120,6 +120,10 @@ static int msm_hdmi_init(struct hdmi *hdmi)
+ int ret;
+
+ hdmi->workq = alloc_ordered_workqueue("msm_hdmi", 0);
++ if (!hdmi->workq) {
++ ret = -ENOMEM;
++ goto fail;
++ }
+
+ hdmi->i2c = msm_hdmi_i2c_init(hdmi);
+ if (IS_ERR(hdmi->i2c)) {
+--
+2.39.2
+
--- /dev/null
+From 9fa613752dddaac45fd8e816d8a84b10c54209f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Dec 2022 15:48:19 +0800
+Subject: drm/msm/mdp5: Add check for kzalloc
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit 13fcfcb2a9a4787fe4e49841d728f6f2e9fa6911 ]
+
+As kzalloc may fail and return NULL pointer,
+it should be better to check the return value
+in order to avoid the NULL pointer dereference.
+
+Fixes: 1cff7440a86e ("drm/msm: Convert to using __drm_atomic_helper_crtc_reset() for reset.")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Patchwork: https://patchwork.freedesktop.org/patch/514154/
+Link: https://lore.kernel.org/r/20221206074819.18134-1-jiasheng@iscas.ac.cn
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c
+index e86421c69bd1f..86036dd4e1e82 100644
+--- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c
++++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c
+@@ -1139,7 +1139,10 @@ static void mdp5_crtc_reset(struct drm_crtc *crtc)
+ if (crtc->state)
+ mdp5_crtc_destroy_state(crtc, crtc->state);
+
+- __drm_atomic_helper_crtc_reset(crtc, &mdp5_cstate->base);
++ if (mdp5_cstate)
++ __drm_atomic_helper_crtc_reset(crtc, &mdp5_cstate->base);
++ else
++ __drm_atomic_helper_crtc_reset(crtc, NULL);
+ }
+
+ static const struct drm_crtc_funcs mdp5_crtc_no_lm_cursor_funcs = {
+--
+2.39.2
+
--- /dev/null
+From 23ef414fc17a63b38c279e720cbf3f2e03ac5797 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Jan 2023 04:01:52 +0200
+Subject: drm/msm: use strscpy instead of strncpy
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit d7fd8634f48d76aa799ed57beb7d87dab91bde80 ]
+
+Using strncpy can result in non-NULL-terminated destination string. Use
+strscpy instead. This fixes following warning:
+
+drivers/gpu/drm/msm/msm_fence.c: In function ‘msm_fence_context_alloc’:
+drivers/gpu/drm/msm/msm_fence.c:25:9: warning: ‘strncpy’ specified bound 32 equals destination size [-Wstringop-truncation]
+ 25 | strncpy(fctx->name, name, sizeof(fctx->name));
+ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Fixes: f97decac5f4c ("drm/msm: Support multiple ringbuffers")
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Reviewed-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
+Patchwork: https://patchwork.freedesktop.org/patch/518787/
+Link: https://lore.kernel.org/r/20230118020152.1689213-1-dmitry.baryshkov@linaro.org
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/msm_fence.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/msm_fence.c b/drivers/gpu/drm/msm/msm_fence.c
+index a47e5837c528f..56641408ea742 100644
+--- a/drivers/gpu/drm/msm/msm_fence.c
++++ b/drivers/gpu/drm/msm/msm_fence.c
+@@ -22,7 +22,7 @@ msm_fence_context_alloc(struct drm_device *dev, volatile uint32_t *fenceptr,
+ return ERR_PTR(-ENOMEM);
+
+ fctx->dev = dev;
+- strncpy(fctx->name, name, sizeof(fctx->name));
++ strscpy(fctx->name, name, sizeof(fctx->name));
+ fctx->context = dma_fence_context_alloc(1);
+ fctx->index = index++;
+ fctx->fenceptr = fenceptr;
+--
+2.39.2
+
--- /dev/null
+From 2e1813b57a23af962e796b84c2aaf6c2d1177cfa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Nov 2022 17:00:48 +0100
+Subject: drm: mxsfb: DRM_IMX_LCDIF should depend on ARCH_MXC
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 10ef5f2992006720318b9886961820155b3750fd ]
+
+The Freescale/NXP i.MX LCDIFv3 LCD controller is only present on
+Freescale/NXP i.MX SoCs. Hence add a dependency on ARCH_MXC, to prevent
+asking the user about this driver when configuring a kernel without
+Freescale/NXP i.MX support.
+
+Fixes: 9db35bb349a0ef32 ("drm: lcdif: Add support for i.MX8MP LCDIF variant")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Marek Vasut <marex@denx.de>
+Signed-off-by: Marek Vasut <marex@denx.de>
+Link: https://patchwork.freedesktop.org/patch/msgid/6103c1aa65a7888c12d351ae63f29850f29f42b9.1669046403.git.geert+renesas@glider.be
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/mxsfb/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/mxsfb/Kconfig b/drivers/gpu/drm/mxsfb/Kconfig
+index 116f8168bda4a..aa4b0eb2a562b 100644
+--- a/drivers/gpu/drm/mxsfb/Kconfig
++++ b/drivers/gpu/drm/mxsfb/Kconfig
+@@ -24,6 +24,7 @@ config DRM_IMX_LCDIF
+ tristate "i.MX LCDIFv3 LCD controller"
+ depends on DRM && OF
+ depends on COMMON_CLK
++ depends on ARCH_MXC || COMPILE_TEST
+ select DRM_MXS
+ select DRM_KMS_HELPER
+ select DRM_GEM_DMA_HELPER
+--
+2.39.2
+
--- /dev/null
+From cb995574ea672b900d4c902c923ec422fbffd736 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Nov 2022 16:59:55 +0100
+Subject: drm: mxsfb: DRM_MXSFB should depend on ARCH_MXS || ARCH_MXC
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 7783cc67862f9166c901bfa0f80b717aa8d354dd ]
+
+Freescale/NXP i.MX LCDIF and eLCDIF LCD controllers are only present on
+Freescale/NXP i.MX SoCs. Hence add a dependency on ARCH_MXS ||
+ARCH_MXC, to prevent asking the user about this driver when configuring
+a kernel without Freescale/NXP i.MX support.
+
+Fixes: 45d59d704080cc0c ("drm: Add new driver for MXSFB controller")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Marek Vasut <marex@denx.de>
+Signed-off-by: Marek Vasut <marex@denx.de>
+Link: https://patchwork.freedesktop.org/patch/msgid/98e74779ca2bc575d91afff03369e86b080c01ac.1669046358.git.geert+renesas@glider.be
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/mxsfb/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/mxsfb/Kconfig b/drivers/gpu/drm/mxsfb/Kconfig
+index aa4b0eb2a562b..518b533453548 100644
+--- a/drivers/gpu/drm/mxsfb/Kconfig
++++ b/drivers/gpu/drm/mxsfb/Kconfig
+@@ -8,6 +8,7 @@ config DRM_MXSFB
+ tristate "i.MX (e)LCDIF LCD controller"
+ depends on DRM && OF
+ depends on COMMON_CLK
++ depends on ARCH_MXS || ARCH_MXC || COMPILE_TEST
+ select DRM_MXS
+ select DRM_KMS_HELPER
+ select DRM_GEM_DMA_HELPER
+--
+2.39.2
+
--- /dev/null
+From d063b2f9e9c69250ff87b4724da47c12ea56015a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 27 Nov 2022 10:30:41 -0800
+Subject: drm/nouveau/disp: Fix nvif_outp_acquire_dp() argument size
+
+From: Kees Cook <keescook@chromium.org>
+
+[ Upstream commit 4076ea2419cf15bc1e1580f8b24ddf675fbdb02c ]
+
+Both Coverity and GCC with -Wstringop-overflow noticed that
+nvif_outp_acquire_dp() accidentally defined its second argument with 1
+additional element:
+
+drivers/gpu/drm/nouveau/dispnv50/disp.c: In function 'nv50_pior_atomic_enable':
+drivers/gpu/drm/nouveau/dispnv50/disp.c:1813:17: error: 'nvif_outp_acquire_dp' accessing 16 bytes in a region of size 15 [-Werror=stringop-overflow=]
+ 1813 | nvif_outp_acquire_dp(&nv_encoder->outp, nv_encoder->dp.dpcd, 0, 0, false, false);
+ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+drivers/gpu/drm/nouveau/dispnv50/disp.c:1813:17: note: referencing argument 2 of type 'u8[16]' {aka 'unsigned char[16]'}
+drivers/gpu/drm/nouveau/include/nvif/outp.h:24:5: note: in a call to function 'nvif_outp_acquire_dp'
+ 24 | int nvif_outp_acquire_dp(struct nvif_outp *, u8 dpcd[16],
+ | ^~~~~~~~~~~~~~~~~~~~
+
+Avoid these warnings by defining the argument size using the matching
+define (DP_RECEIVER_CAP_SIZE, 15) instead of having it be a literal
+(and incorrect) value (16).
+
+Reported-by: coverity-bot <keescook+coverity-bot@chromium.org>
+Addresses-Coverity-ID: 1527269 ("Memory - corruptions")
+Addresses-Coverity-ID: 1527268 ("Memory - corruptions")
+Link: https://lore.kernel.org/lkml/202211100848.FFBA2432@keescook/
+Link: https://lore.kernel.org/lkml/202211100848.F4C2819BB@keescook/
+Fixes: 813443721331 ("drm/nouveau/disp: move DP link config into acquire")
+Reviewed-by: Lyude Paul <lyude@redhat.com>
+Cc: Ben Skeggs <bskeggs@redhat.com>
+Cc: Karol Herbst <kherbst@redhat.com>
+Cc: David Airlie <airlied@gmail.com>
+Cc: Daniel Vetter <daniel@ffwll.ch>
+Cc: Dave Airlie <airlied@redhat.com>
+Cc: "Gustavo A. R. Silva" <gustavo@embeddedor.com>
+Cc: dri-devel@lists.freedesktop.org
+Cc: nouveau@lists.freedesktop.org
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Link: https://lore.kernel.org/r/20221127183036.never.139-kees@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/nouveau/include/nvif/outp.h | 3 ++-
+ drivers/gpu/drm/nouveau/nvif/outp.c | 2 +-
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/nouveau/include/nvif/outp.h b/drivers/gpu/drm/nouveau/include/nvif/outp.h
+index 45daadec3c0c7..fa76a7b5e4b37 100644
+--- a/drivers/gpu/drm/nouveau/include/nvif/outp.h
++++ b/drivers/gpu/drm/nouveau/include/nvif/outp.h
+@@ -3,6 +3,7 @@
+ #define __NVIF_OUTP_H__
+ #include <nvif/object.h>
+ #include <nvif/if0012.h>
++#include <drm/display/drm_dp.h>
+ struct nvif_disp;
+
+ struct nvif_outp {
+@@ -21,7 +22,7 @@ int nvif_outp_acquire_rgb_crt(struct nvif_outp *);
+ int nvif_outp_acquire_tmds(struct nvif_outp *, int head,
+ bool hdmi, u8 max_ac_packet, u8 rekey, u8 scdc, bool hda);
+ int nvif_outp_acquire_lvds(struct nvif_outp *, bool dual, bool bpc8);
+-int nvif_outp_acquire_dp(struct nvif_outp *, u8 dpcd[16],
++int nvif_outp_acquire_dp(struct nvif_outp *outp, u8 dpcd[DP_RECEIVER_CAP_SIZE],
+ int link_nr, int link_bw, bool hda, bool mst);
+ void nvif_outp_release(struct nvif_outp *);
+ int nvif_outp_infoframe(struct nvif_outp *, u8 type, struct nvif_outp_infoframe_v0 *, u32 size);
+diff --git a/drivers/gpu/drm/nouveau/nvif/outp.c b/drivers/gpu/drm/nouveau/nvif/outp.c
+index 7da39f1eae9fb..c24bc5eae3ecf 100644
+--- a/drivers/gpu/drm/nouveau/nvif/outp.c
++++ b/drivers/gpu/drm/nouveau/nvif/outp.c
+@@ -127,7 +127,7 @@ nvif_outp_acquire(struct nvif_outp *outp, u8 proto, struct nvif_outp_acquire_v0
+ }
+
+ int
+-nvif_outp_acquire_dp(struct nvif_outp *outp, u8 dpcd[16],
++nvif_outp_acquire_dp(struct nvif_outp *outp, u8 dpcd[DP_RECEIVER_CAP_SIZE],
+ int link_nr, int link_bw, bool hda, bool mst)
+ {
+ struct nvif_outp_acquire_v0 args;
+--
+2.39.2
+
--- /dev/null
+From e1318970be75423b845f3d5a2bcdec7b37338880 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Sep 2022 11:22:05 +0300
+Subject: drm/omap: dsi: Fix excessive stack usage
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+[ Upstream commit cfca78971b9233aef0891507a98fba62046d4542 ]
+
+dsi_dump_dsi_irqs(), a function used for debugfs prints, has a large
+struct in its frame, which can result in:
+
+drivers/gpu/drm/omapdrm/dss/dsi.c:1126:1: warning: the frame size of 1060 bytes is larger than 1024 bytes [-Wframe-larger-than=]
+
+As the performance of the function is of no concern, let's allocate the
+struct with kmalloc instead.
+
+Compile-tested only.
+
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Reported-by: kernel test robot <lkp@intel.com>
+Reviewed-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://patchwork.freedesktop.org/patch/msgid/20220916082206.167427-1-tomi.valkeinen@ideasonboard.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/omapdrm/dss/dsi.c | 26 ++++++++++++++++----------
+ 1 file changed, 16 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/gpu/drm/omapdrm/dss/dsi.c b/drivers/gpu/drm/omapdrm/dss/dsi.c
+index a6845856cbce4..4c1084eb01759 100644
+--- a/drivers/gpu/drm/omapdrm/dss/dsi.c
++++ b/drivers/gpu/drm/omapdrm/dss/dsi.c
+@@ -1039,22 +1039,26 @@ static int dsi_dump_dsi_irqs(struct seq_file *s, void *p)
+ {
+ struct dsi_data *dsi = s->private;
+ unsigned long flags;
+- struct dsi_irq_stats stats;
++ struct dsi_irq_stats *stats;
++
++ stats = kmalloc(sizeof(*stats), GFP_KERNEL);
++ if (!stats)
++ return -ENOMEM;
+
+ spin_lock_irqsave(&dsi->irq_stats_lock, flags);
+
+- stats = dsi->irq_stats;
++ *stats = dsi->irq_stats;
+ memset(&dsi->irq_stats, 0, sizeof(dsi->irq_stats));
+ dsi->irq_stats.last_reset = jiffies;
+
+ spin_unlock_irqrestore(&dsi->irq_stats_lock, flags);
+
+ seq_printf(s, "period %u ms\n",
+- jiffies_to_msecs(jiffies - stats.last_reset));
++ jiffies_to_msecs(jiffies - stats->last_reset));
+
+- seq_printf(s, "irqs %d\n", stats.irq_count);
++ seq_printf(s, "irqs %d\n", stats->irq_count);
+ #define PIS(x) \
+- seq_printf(s, "%-20s %10d\n", #x, stats.dsi_irqs[ffs(DSI_IRQ_##x)-1]);
++ seq_printf(s, "%-20s %10d\n", #x, stats->dsi_irqs[ffs(DSI_IRQ_##x)-1]);
+
+ seq_printf(s, "-- DSI%d interrupts --\n", dsi->module_id + 1);
+ PIS(VC0);
+@@ -1078,10 +1082,10 @@ static int dsi_dump_dsi_irqs(struct seq_file *s, void *p)
+
+ #define PIS(x) \
+ seq_printf(s, "%-20s %10d %10d %10d %10d\n", #x, \
+- stats.vc_irqs[0][ffs(DSI_VC_IRQ_##x)-1], \
+- stats.vc_irqs[1][ffs(DSI_VC_IRQ_##x)-1], \
+- stats.vc_irqs[2][ffs(DSI_VC_IRQ_##x)-1], \
+- stats.vc_irqs[3][ffs(DSI_VC_IRQ_##x)-1]);
++ stats->vc_irqs[0][ffs(DSI_VC_IRQ_##x)-1], \
++ stats->vc_irqs[1][ffs(DSI_VC_IRQ_##x)-1], \
++ stats->vc_irqs[2][ffs(DSI_VC_IRQ_##x)-1], \
++ stats->vc_irqs[3][ffs(DSI_VC_IRQ_##x)-1]);
+
+ seq_printf(s, "-- VC interrupts --\n");
+ PIS(CS);
+@@ -1097,7 +1101,7 @@ static int dsi_dump_dsi_irqs(struct seq_file *s, void *p)
+
+ #define PIS(x) \
+ seq_printf(s, "%-20s %10d\n", #x, \
+- stats.cio_irqs[ffs(DSI_CIO_IRQ_##x)-1]);
++ stats->cio_irqs[ffs(DSI_CIO_IRQ_##x)-1]);
+
+ seq_printf(s, "-- CIO interrupts --\n");
+ PIS(ERRSYNCESC1);
+@@ -1122,6 +1126,8 @@ static int dsi_dump_dsi_irqs(struct seq_file *s, void *p)
+ PIS(ULPSACTIVENOT_ALL1);
+ #undef PIS
+
++ kfree(stats);
++
+ return 0;
+ }
+ #endif
+--
+2.39.2
+
--- /dev/null
+From 890ef0d4b1b74c40d7fb2d89fb34e7a5f1a45248 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 31 Dec 2022 16:27:20 +0200
+Subject: drm/panel-edp: fix name for IVO product id 854b
+
+From: Abel Vesa <abel.vesa@linaro.org>
+
+[ Upstream commit 9cce08cadc6ce8670280d0a042cf0b6d2987d9f9 ]
+
+The actual name is R133NW4K-R0.
+
+Fixes: 0f9fa5f58c78 ("drm/panel-edp: add IVO M133NW4J-R3 panel entry")
+Signed-off-by: Abel Vesa <abel.vesa@linaro.org>
+Reviewed-by: Johan Hovold <johan+linaro@kernel.org>
+Tested-by: Steev Klimaszewski <steev@kali.org>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20221231142721.338643-1-abel.vesa@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panel/panel-edp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/panel/panel-edp.c b/drivers/gpu/drm/panel/panel-edp.c
+index 5cb8dc2ebe184..ef70928c3ccbc 100644
+--- a/drivers/gpu/drm/panel/panel-edp.c
++++ b/drivers/gpu/drm/panel/panel-edp.c
+@@ -1891,7 +1891,7 @@ static const struct edp_panel_entry edp_panels[] = {
+ EDP_PANEL_ENTRY('C', 'M', 'N', 0x1247, &delay_200_500_e80_d50, "N120ACA-EA1"),
+
+ EDP_PANEL_ENTRY('I', 'V', 'O', 0x057d, &delay_200_500_e200, "R140NWF5 RH"),
+- EDP_PANEL_ENTRY('I', 'V', 'O', 0x854b, &delay_200_500_p2e100, "M133NW4J-R3"),
++ EDP_PANEL_ENTRY('I', 'V', 'O', 0x854b, &delay_200_500_p2e100, "R133NW4K-R0"),
+
+ EDP_PANEL_ENTRY('K', 'D', 'B', 0x0624, &kingdisplay_kd116n21_30nv_a010.delay, "116N21-30NV-A010"),
+ EDP_PANEL_ENTRY('K', 'D', 'B', 0x1120, &delay_200_500_e80_d50, "116N29-30NK-C007"),
+--
+2.39.2
+
--- /dev/null
+From 3452c21ff73d377c88402acc8ba869b7a5882329 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Nov 2022 17:08:22 +0000
+Subject: drm: panel-orientation-quirks: Add quirk for DynaBook K50
+
+From: Allen Ballway <ballway@chromium.org>
+
+[ Upstream commit a3caf7ea0c3d5872ed0f2c51f5476aee0c47a73a ]
+
+Like the ASUS T100HAN for which there is already a quirk,
+the DynaBook K50 has a 800x1280 portrait screen mounted
+in the tablet part of a landscape oriented 2-in-1.
+Update the quirk to be more generic and apply to this device.
+
+Signed-off-by: Allen Ballway <ballway@chromium.org>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20221130170811.1.Iee9a494547541dade9eeee9521cc8b811e76a8a0@changeid
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/drm_panel_orientation_quirks.c | 20 ++++++++++++-------
+ 1 file changed, 13 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c
+index 23d63a4d42d9c..b409fe256fd0a 100644
+--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c
++++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c
+@@ -30,12 +30,6 @@ struct drm_dmi_panel_orientation_data {
+ int orientation;
+ };
+
+-static const struct drm_dmi_panel_orientation_data asus_t100ha = {
+- .width = 800,
+- .height = 1280,
+- .orientation = DRM_MODE_PANEL_ORIENTATION_LEFT_UP,
+-};
+-
+ static const struct drm_dmi_panel_orientation_data gpd_micropc = {
+ .width = 720,
+ .height = 1280,
+@@ -97,6 +91,12 @@ static const struct drm_dmi_panel_orientation_data lcd720x1280_rightside_up = {
+ .orientation = DRM_MODE_PANEL_ORIENTATION_RIGHT_UP,
+ };
+
++static const struct drm_dmi_panel_orientation_data lcd800x1280_leftside_up = {
++ .width = 800,
++ .height = 1280,
++ .orientation = DRM_MODE_PANEL_ORIENTATION_LEFT_UP,
++};
++
+ static const struct drm_dmi_panel_orientation_data lcd800x1280_rightside_up = {
+ .width = 800,
+ .height = 1280,
+@@ -157,7 +157,7 @@ static const struct dmi_system_id orientation_data[] = {
+ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "T100HAN"),
+ },
+- .driver_data = (void *)&asus_t100ha,
++ .driver_data = (void *)&lcd800x1280_leftside_up,
+ }, { /* Asus T101HA */
+ .matches = {
+ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+@@ -202,6 +202,12 @@ static const struct dmi_system_id orientation_data[] = {
+ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Hi10 pro tablet"),
+ },
+ .driver_data = (void *)&lcd1200x1920_rightside_up,
++ }, { /* Dynabook K50 */
++ .matches = {
++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Dynabook Inc."),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "dynabook K50/FR"),
++ },
++ .driver_data = (void *)&lcd800x1280_leftside_up,
+ }, { /* GPD MicroPC (generic strings, also match on bios date) */
+ .matches = {
+ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Default string"),
+--
+2.39.2
+
--- /dev/null
+From 99ca582ebe3de6439ab7cee7a17701d627d64799 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Feb 2023 16:46:59 +0000
+Subject: drm: panel-orientation-quirks: Add quirk for Lenovo IdeaPad Duet 3
+ 10IGL5
+
+From: Darrell Kavanagh <darrell.kavanagh@gmail.com>
+
+[ Upstream commit 38b2d8efd03d2e56431b611e3523f0158306451d ]
+
+Another Lenovo convertable where the panel is installed landscape but is
+reported to the kernel as portrait.
+
+Signed-off-by: Darrell Kavanagh <darrell.kavanagh@gmail.com>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230214164659.3583-1-darrell.kavanagh@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_panel_orientation_quirks.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c
+index b409fe256fd0a..5522d610c5cfd 100644
+--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c
++++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c
+@@ -322,6 +322,12 @@ static const struct dmi_system_id orientation_data[] = {
+ DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, "Lenovo ideapad D330-10IGL"),
+ },
+ .driver_data = (void *)&lcd800x1280_rightside_up,
++ }, { /* Lenovo IdeaPad Duet 3 10IGL5 */
++ .matches = {
++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, "IdeaPad Duet 3 10IGL5"),
++ },
++ .driver_data = (void *)&lcd1200x1920_rightside_up,
+ }, { /* Lenovo Yoga Book X90F / X91F / X91L */
+ .matches = {
+ /* Non exact match to match all versions */
+--
+2.39.2
+
--- /dev/null
+From 818a1eb239c0254905bbfcc9d8340506161b5b4c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 27 Nov 2022 19:15:39 +0100
+Subject: drm: panel-orientation-quirks: Add quirk for Lenovo Yoga Tab 3 X90F
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 8a238d7f7eea7592e0764bc3b9e79e7c6354b04c ]
+
+The Lenovo Yoga Tab 3 X90F has a portrait 1600x2560 LCD used in
+landscape mode, add a quirk for this.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20221127181539.104223-1-hdegoede@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_panel_orientation_quirks.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c
+index 3659f0465a724..23d63a4d42d9c 100644
+--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c
++++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c
+@@ -127,6 +127,12 @@ static const struct drm_dmi_panel_orientation_data lcd1600x2560_leftside_up = {
+ .orientation = DRM_MODE_PANEL_ORIENTATION_LEFT_UP,
+ };
+
++static const struct drm_dmi_panel_orientation_data lcd1600x2560_rightside_up = {
++ .width = 1600,
++ .height = 2560,
++ .orientation = DRM_MODE_PANEL_ORIENTATION_RIGHT_UP,
++};
++
+ static const struct dmi_system_id orientation_data[] = {
+ { /* Acer One 10 (S1003) */
+ .matches = {
+@@ -331,6 +337,13 @@ static const struct dmi_system_id orientation_data[] = {
+ DMI_MATCH(DMI_BIOS_VERSION, "BLADE_21"),
+ },
+ .driver_data = (void *)&lcd1200x1920_rightside_up,
++ }, { /* Lenovo Yoga Tab 3 X90F */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Intel Corporation"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "CHERRYVIEW D1 PLATFORM"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "Blade3-10A-001"),
++ },
++ .driver_data = (void *)&lcd1600x2560_rightside_up,
+ }, { /* Nanote UMPC-01 */
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "RWC CO.,LTD"),
+--
+2.39.2
+
--- /dev/null
+From 10db5e159b1ad6340940b7e97f5252914e94a512 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Jan 2023 17:47:29 +0800
+Subject: drm/radeon: free iio for atombios when driver shutdown
+
+From: Liwei Song <liwei.song@windriver.com>
+
+[ Upstream commit 4773fadedca918faec443daaca5e4ea1c0ced144 ]
+
+Fix below kmemleak when unload radeon driver:
+
+unreferenced object 0xffff9f8608ede200 (size 512):
+ comm "systemd-udevd", pid 326, jiffies 4294682822 (age 716.338s)
+ hex dump (first 32 bytes):
+ 00 00 00 00 c4 aa ec aa 14 ab 00 00 00 00 00 00 ................
+ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
+ backtrace:
+ [<0000000062fadebe>] kmem_cache_alloc_trace+0x2f1/0x500
+ [<00000000b6883cea>] atom_parse+0x117/0x230 [radeon]
+ [<00000000158c23fd>] radeon_atombios_init+0xab/0x170 [radeon]
+ [<00000000683f672e>] si_init+0x57/0x750 [radeon]
+ [<00000000566cc31f>] radeon_device_init+0x559/0x9c0 [radeon]
+ [<0000000046efabb3>] radeon_driver_load_kms+0xc1/0x1a0 [radeon]
+ [<00000000b5155064>] drm_dev_register+0xdd/0x1d0
+ [<0000000045fec835>] radeon_pci_probe+0xbd/0x100 [radeon]
+ [<00000000e69ecca3>] pci_device_probe+0xe1/0x160
+ [<0000000019484b76>] really_probe.part.0+0xc1/0x2c0
+ [<000000003f2649da>] __driver_probe_device+0x96/0x130
+ [<00000000231c5bb1>] driver_probe_device+0x24/0xf0
+ [<0000000000a42377>] __driver_attach+0x77/0x190
+ [<00000000d7574da6>] bus_for_each_dev+0x7f/0xd0
+ [<00000000633166d2>] driver_attach+0x1e/0x30
+ [<00000000313b05b8>] bus_add_driver+0x12c/0x1e0
+
+iio was allocated in atom_index_iio() called by atom_parse(),
+but it doesn't got released when the dirver is shutdown.
+Fix this kmemleak by free it in radeon_atombios_fini().
+
+Signed-off-by: Liwei Song <liwei.song@windriver.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/radeon/radeon_device.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
+index 6344454a77217..4f9729b4a8119 100644
+--- a/drivers/gpu/drm/radeon/radeon_device.c
++++ b/drivers/gpu/drm/radeon/radeon_device.c
+@@ -1023,6 +1023,7 @@ void radeon_atombios_fini(struct radeon_device *rdev)
+ {
+ if (rdev->mode_info.atom_context) {
+ kfree(rdev->mode_info.atom_context->scratch);
++ kfree(rdev->mode_info.atom_context->iio);
+ }
+ kfree(rdev->mode_info.atom_context);
+ rdev->mode_info.atom_context = NULL;
+--
+2.39.2
+
--- /dev/null
+From 079b25ad305478eb7166decb355c4a11b385789d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Jan 2023 12:47:40 +0200
+Subject: drm: rcar-du: Add quirk for H3 ES1.x pclk workaround
+
+From: Tomi Valkeinen <tomi.valkeinen+renesas@ideasonboard.com>
+
+[ Upstream commit 4f548bc48a2b4c4e54eecfddb6f7d24aa1b98768 ]
+
+rcar_du_crtc.c does a soc_device_match() in
+rcar_du_crtc_set_display_timing() to find out if the SoC is H3 ES1.x, and
+if so, apply a workaround.
+
+We will need another H3 ES1.x check in the following patch, so rather than
+adding more soc_device_match() calls, let's add a rcar_du_device_info
+entry for the ES1, and a quirk flag,
+RCAR_DU_QUIRK_H3_ES1_PCLK_STABILITY, for the workaround.
+
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen+renesas@ideasonboard.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/rcar-du/rcar_du_crtc.c | 8 +----
+ drivers/gpu/drm/rcar-du/rcar_du_drv.c | 48 ++++++++++++++++++++++++++
+ drivers/gpu/drm/rcar-du/rcar_du_drv.h | 1 +
+ 3 files changed, 50 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/gpu/drm/rcar-du/rcar_du_crtc.c b/drivers/gpu/drm/rcar-du/rcar_du_crtc.c
+index 3619e1ddeb620..f2d3266509cc1 100644
+--- a/drivers/gpu/drm/rcar-du/rcar_du_crtc.c
++++ b/drivers/gpu/drm/rcar-du/rcar_du_crtc.c
+@@ -10,7 +10,6 @@
+ #include <linux/clk.h>
+ #include <linux/mutex.h>
+ #include <linux/platform_device.h>
+-#include <linux/sys_soc.h>
+
+ #include <drm/drm_atomic.h>
+ #include <drm/drm_atomic_helper.h>
+@@ -204,11 +203,6 @@ static void rcar_du_escr_divider(struct clk *clk, unsigned long target,
+ }
+ }
+
+-static const struct soc_device_attribute rcar_du_r8a7795_es1[] = {
+- { .soc_id = "r8a7795", .revision = "ES1.*" },
+- { /* sentinel */ }
+-};
+-
+ static void rcar_du_crtc_set_display_timing(struct rcar_du_crtc *rcrtc)
+ {
+ const struct drm_display_mode *mode = &rcrtc->crtc.state->adjusted_mode;
+@@ -238,7 +232,7 @@ static void rcar_du_crtc_set_display_timing(struct rcar_du_crtc *rcrtc)
+ * no post-divider when a display PLL is present (as shown by
+ * the workaround breaking HDMI output on M3-W during testing).
+ */
+- if (soc_device_match(rcar_du_r8a7795_es1)) {
++ if (rcdu->info->quirks & RCAR_DU_QUIRK_H3_ES1_PCLK_STABILITY) {
+ target *= 2;
+ div = 1;
+ }
+diff --git a/drivers/gpu/drm/rcar-du/rcar_du_drv.c b/drivers/gpu/drm/rcar-du/rcar_du_drv.c
+index d003e8d9e7a26..c479996f8e91e 100644
+--- a/drivers/gpu/drm/rcar-du/rcar_du_drv.c
++++ b/drivers/gpu/drm/rcar-du/rcar_du_drv.c
+@@ -16,6 +16,7 @@
+ #include <linux/platform_device.h>
+ #include <linux/pm.h>
+ #include <linux/slab.h>
++#include <linux/sys_soc.h>
+ #include <linux/wait.h>
+
+ #include <drm/drm_atomic_helper.h>
+@@ -386,6 +387,42 @@ static const struct rcar_du_device_info rcar_du_r8a7795_info = {
+ .dpll_mask = BIT(2) | BIT(1),
+ };
+
++static const struct rcar_du_device_info rcar_du_r8a7795_es1_info = {
++ .gen = 3,
++ .features = RCAR_DU_FEATURE_CRTC_IRQ
++ | RCAR_DU_FEATURE_CRTC_CLOCK
++ | RCAR_DU_FEATURE_VSP1_SOURCE
++ | RCAR_DU_FEATURE_INTERLACED
++ | RCAR_DU_FEATURE_TVM_SYNC,
++ .quirks = RCAR_DU_QUIRK_H3_ES1_PCLK_STABILITY,
++ .channels_mask = BIT(3) | BIT(2) | BIT(1) | BIT(0),
++ .routes = {
++ /*
++ * R8A7795 has one RGB output, two HDMI outputs and one
++ * LVDS output.
++ */
++ [RCAR_DU_OUTPUT_DPAD0] = {
++ .possible_crtcs = BIT(3),
++ .port = 0,
++ },
++ [RCAR_DU_OUTPUT_HDMI0] = {
++ .possible_crtcs = BIT(1),
++ .port = 1,
++ },
++ [RCAR_DU_OUTPUT_HDMI1] = {
++ .possible_crtcs = BIT(2),
++ .port = 2,
++ },
++ [RCAR_DU_OUTPUT_LVDS0] = {
++ .possible_crtcs = BIT(0),
++ .port = 3,
++ },
++ },
++ .num_lvds = 1,
++ .num_rpf = 5,
++ .dpll_mask = BIT(2) | BIT(1),
++};
++
+ static const struct rcar_du_device_info rcar_du_r8a7796_info = {
+ .gen = 3,
+ .features = RCAR_DU_FEATURE_CRTC_IRQ
+@@ -554,6 +591,11 @@ static const struct of_device_id rcar_du_of_table[] = {
+
+ MODULE_DEVICE_TABLE(of, rcar_du_of_table);
+
++static const struct soc_device_attribute rcar_du_soc_table[] = {
++ { .soc_id = "r8a7795", .revision = "ES1.*", .data = &rcar_du_r8a7795_es1_info },
++ { /* sentinel */ }
++};
++
+ const char *rcar_du_output_name(enum rcar_du_output output)
+ {
+ static const char * const names[] = {
+@@ -645,6 +687,7 @@ static void rcar_du_shutdown(struct platform_device *pdev)
+
+ static int rcar_du_probe(struct platform_device *pdev)
+ {
++ const struct soc_device_attribute *soc_attr;
+ struct rcar_du_device *rcdu;
+ unsigned int mask;
+ int ret;
+@@ -659,8 +702,13 @@ static int rcar_du_probe(struct platform_device *pdev)
+ return PTR_ERR(rcdu);
+
+ rcdu->dev = &pdev->dev;
++
+ rcdu->info = of_device_get_match_data(rcdu->dev);
+
++ soc_attr = soc_device_match(rcar_du_soc_table);
++ if (soc_attr)
++ rcdu->info = soc_attr->data;
++
+ platform_set_drvdata(pdev, rcdu);
+
+ /* I/O resources */
+diff --git a/drivers/gpu/drm/rcar-du/rcar_du_drv.h b/drivers/gpu/drm/rcar-du/rcar_du_drv.h
+index 5cfa2bb7ad93d..df87ccab146f4 100644
+--- a/drivers/gpu/drm/rcar-du/rcar_du_drv.h
++++ b/drivers/gpu/drm/rcar-du/rcar_du_drv.h
+@@ -34,6 +34,7 @@ struct rcar_du_device;
+ #define RCAR_DU_FEATURE_NO_BLENDING BIT(5) /* PnMR.SPIM does not have ALP nor EOR bits */
+
+ #define RCAR_DU_QUIRK_ALIGN_128B BIT(0) /* Align pitches to 128 bytes */
++#define RCAR_DU_QUIRK_H3_ES1_PCLK_STABILITY BIT(1) /* H3 ES1 has pclk stability issue */
+
+ enum rcar_du_output {
+ RCAR_DU_OUTPUT_DPAD0,
+--
+2.39.2
+
--- /dev/null
+From a2a7e8195fd2535bea355f1e730169ea3477114e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Jan 2023 12:47:41 +0200
+Subject: drm: rcar-du: Fix setting a reserved bit in DPLLCR
+
+From: Tomi Valkeinen <tomi.valkeinen+renesas@ideasonboard.com>
+
+[ Upstream commit 5fbc2f3b91d27e12b614947048764099570cbb55 ]
+
+On H3 ES1.x two bits in DPLLCR are used to select the DU input dot clock
+source. These are bits 20 and 21 for DU2, and bits 22 and 23 for DU1. On
+non-ES1.x, only the higher bits are used (bits 21 and 23), and the lower
+bits are reserved and should be set to 0.
+
+The current code always sets the lower bits, even on non-ES1.x.
+
+For both DU1 and DU2, on all SoC versions, when writing zeroes to those
+bits the input clock is DCLKIN, and thus there's no difference between
+ES1.x and non-ES1.x.
+
+For DU1, writing 0b10 to the bits (or only writing the higher bit)
+results in using PLL0 as the input clock, so in this case there's also
+no difference between ES1.x and non-ES1.x.
+
+However, for DU2, writing 0b10 to the bits results in using PLL0 as the
+input clock on ES1.x, whereas on non-ES1.x it results in using PLL1. On
+ES1.x you need to write 0b11 to select PLL1.
+
+The current code always writes 0b11 to PLCS0 field to select PLL1 on all
+SoC versions, which works but causes an illegal (in the sense of not
+allowed by the documentation) write to a reserved bit field.
+
+To remove the illegal bit write on PLSC0 we need to handle the input dot
+clock selection differently for ES1.x and non-ES1.x.
+
+Add a new quirk, RCAR_DU_QUIRK_H3_ES1_PLL, for this. This way we can
+always set the bit 21 on PLSC0 when choosing the PLL as the source
+clock, and additionally set the bit 20 when on ES1.x.
+
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen+renesas@ideasonboard.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/rcar-du/rcar_du_crtc.c | 23 ++++++++++++++++++++---
+ drivers/gpu/drm/rcar-du/rcar_du_drv.c | 3 ++-
+ drivers/gpu/drm/rcar-du/rcar_du_drv.h | 1 +
+ drivers/gpu/drm/rcar-du/rcar_du_regs.h | 8 ++------
+ 4 files changed, 25 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/gpu/drm/rcar-du/rcar_du_crtc.c b/drivers/gpu/drm/rcar-du/rcar_du_crtc.c
+index f2d3266509cc1..b7dd59fe119e6 100644
+--- a/drivers/gpu/drm/rcar-du/rcar_du_crtc.c
++++ b/drivers/gpu/drm/rcar-du/rcar_du_crtc.c
+@@ -245,13 +245,30 @@ static void rcar_du_crtc_set_display_timing(struct rcar_du_crtc *rcrtc)
+ | DPLLCR_N(dpll.n) | DPLLCR_M(dpll.m)
+ | DPLLCR_STBY;
+
+- if (rcrtc->index == 1)
++ if (rcrtc->index == 1) {
+ dpllcr |= DPLLCR_PLCS1
+ | DPLLCR_INCS_DOTCLKIN1;
+- else
+- dpllcr |= DPLLCR_PLCS0
++ } else {
++ dpllcr |= DPLLCR_PLCS0_PLL
+ | DPLLCR_INCS_DOTCLKIN0;
+
++ /*
++ * On ES2.x we have a single mux controlled via bit 21,
++ * which selects between DCLKIN source (bit 21 = 0) and
++ * a PLL source (bit 21 = 1), where the PLL is always
++ * PLL1.
++ *
++ * On ES1.x we have an additional mux, controlled
++ * via bit 20, for choosing between PLL0 (bit 20 = 0)
++ * and PLL1 (bit 20 = 1). We always want to use PLL1,
++ * so on ES1.x, in addition to setting bit 21, we need
++ * to set the bit 20.
++ */
++
++ if (rcdu->info->quirks & RCAR_DU_QUIRK_H3_ES1_PLL)
++ dpllcr |= DPLLCR_PLCS0_H3ES1X_PLL1;
++ }
++
+ rcar_du_group_write(rcrtc->group, DPLLCR, dpllcr);
+
+ escr = ESCR_DCLKSEL_DCLKIN | div;
+diff --git a/drivers/gpu/drm/rcar-du/rcar_du_drv.c b/drivers/gpu/drm/rcar-du/rcar_du_drv.c
+index c479996f8e91e..53c9669a3851c 100644
+--- a/drivers/gpu/drm/rcar-du/rcar_du_drv.c
++++ b/drivers/gpu/drm/rcar-du/rcar_du_drv.c
+@@ -394,7 +394,8 @@ static const struct rcar_du_device_info rcar_du_r8a7795_es1_info = {
+ | RCAR_DU_FEATURE_VSP1_SOURCE
+ | RCAR_DU_FEATURE_INTERLACED
+ | RCAR_DU_FEATURE_TVM_SYNC,
+- .quirks = RCAR_DU_QUIRK_H3_ES1_PCLK_STABILITY,
++ .quirks = RCAR_DU_QUIRK_H3_ES1_PCLK_STABILITY
++ | RCAR_DU_QUIRK_H3_ES1_PLL,
+ .channels_mask = BIT(3) | BIT(2) | BIT(1) | BIT(0),
+ .routes = {
+ /*
+diff --git a/drivers/gpu/drm/rcar-du/rcar_du_drv.h b/drivers/gpu/drm/rcar-du/rcar_du_drv.h
+index df87ccab146f4..acc3673fefe18 100644
+--- a/drivers/gpu/drm/rcar-du/rcar_du_drv.h
++++ b/drivers/gpu/drm/rcar-du/rcar_du_drv.h
+@@ -35,6 +35,7 @@ struct rcar_du_device;
+
+ #define RCAR_DU_QUIRK_ALIGN_128B BIT(0) /* Align pitches to 128 bytes */
+ #define RCAR_DU_QUIRK_H3_ES1_PCLK_STABILITY BIT(1) /* H3 ES1 has pclk stability issue */
++#define RCAR_DU_QUIRK_H3_ES1_PLL BIT(2) /* H3 ES1 PLL setup differs from non-ES1 */
+
+ enum rcar_du_output {
+ RCAR_DU_OUTPUT_DPAD0,
+diff --git a/drivers/gpu/drm/rcar-du/rcar_du_regs.h b/drivers/gpu/drm/rcar-du/rcar_du_regs.h
+index c1bcb0e8b5b4e..789ae9285108e 100644
+--- a/drivers/gpu/drm/rcar-du/rcar_du_regs.h
++++ b/drivers/gpu/drm/rcar-du/rcar_du_regs.h
+@@ -283,12 +283,8 @@
+ #define DPLLCR 0x20044
+ #define DPLLCR_CODE (0x95 << 24)
+ #define DPLLCR_PLCS1 (1 << 23)
+-/*
+- * PLCS0 is bit 21, but H3 ES1.x requires bit 20 to be set as well. As bit 20
+- * isn't implemented by other SoC in the Gen3 family it can safely be set
+- * unconditionally.
+- */
+-#define DPLLCR_PLCS0 (3 << 20)
++#define DPLLCR_PLCS0_PLL (1 << 21)
++#define DPLLCR_PLCS0_H3ES1X_PLL1 (1 << 20)
+ #define DPLLCR_CLKE (1 << 18)
+ #define DPLLCR_FDPLL(n) ((n) << 12)
+ #define DPLLCR_N(n) ((n) << 5)
+--
+2.39.2
+
--- /dev/null
+From 4dc46ce9d7d1e034959b5352910e2d19b09d149a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 5 Feb 2023 21:51:24 +0900
+Subject: drm/shmem-helper: Fix locking for drm_gem_shmem_get_pages_sgt()
+
+From: Asahi Lina <lina@asahilina.net>
+
+[ Upstream commit ddddedaa0db99481c5e5abe628ad54f65e8765bc ]
+
+Other functions touching shmem->sgt take the pages lock, so do that here
+too. drm_gem_shmem_get_pages() & co take the same lock, so move to the
+_locked() variants to avoid recursive locking.
+
+Discovered while auditing locking to write the Rust abstractions.
+
+Fixes: 2194a63a818d ("drm: Add library for shmem backed GEM objects")
+Fixes: 4fa3d66f132b ("drm/shmem: Do dma_unmap_sg before purging pages")
+Signed-off-by: Asahi Lina <lina@asahilina.net>
+Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
+Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230205125124.2260-1-lina@asahilina.net
+(cherry picked from commit aa8c85affe3facd3842c8912186623415931cc72)
+Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_gem_shmem_helper.c | 54 ++++++++++++++++----------
+ 1 file changed, 34 insertions(+), 20 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_gem_shmem_helper.c b/drivers/gpu/drm/drm_gem_shmem_helper.c
+index b602cd72a1205..2c559b310cad3 100644
+--- a/drivers/gpu/drm/drm_gem_shmem_helper.c
++++ b/drivers/gpu/drm/drm_gem_shmem_helper.c
+@@ -681,23 +681,7 @@ struct sg_table *drm_gem_shmem_get_sg_table(struct drm_gem_shmem_object *shmem)
+ }
+ EXPORT_SYMBOL_GPL(drm_gem_shmem_get_sg_table);
+
+-/**
+- * drm_gem_shmem_get_pages_sgt - Pin pages, dma map them, and return a
+- * scatter/gather table for a shmem GEM object.
+- * @shmem: shmem GEM object
+- *
+- * This function returns a scatter/gather table suitable for driver usage. If
+- * the sg table doesn't exist, the pages are pinned, dma-mapped, and a sg
+- * table created.
+- *
+- * This is the main function for drivers to get at backing storage, and it hides
+- * and difference between dma-buf imported and natively allocated objects.
+- * drm_gem_shmem_get_sg_table() should not be directly called by drivers.
+- *
+- * Returns:
+- * A pointer to the scatter/gather table of pinned pages or errno on failure.
+- */
+-struct sg_table *drm_gem_shmem_get_pages_sgt(struct drm_gem_shmem_object *shmem)
++static struct sg_table *drm_gem_shmem_get_pages_sgt_locked(struct drm_gem_shmem_object *shmem)
+ {
+ struct drm_gem_object *obj = &shmem->base;
+ int ret;
+@@ -708,7 +692,7 @@ struct sg_table *drm_gem_shmem_get_pages_sgt(struct drm_gem_shmem_object *shmem)
+
+ WARN_ON(obj->import_attach);
+
+- ret = drm_gem_shmem_get_pages(shmem);
++ ret = drm_gem_shmem_get_pages_locked(shmem);
+ if (ret)
+ return ERR_PTR(ret);
+
+@@ -730,10 +714,40 @@ struct sg_table *drm_gem_shmem_get_pages_sgt(struct drm_gem_shmem_object *shmem)
+ sg_free_table(sgt);
+ kfree(sgt);
+ err_put_pages:
+- drm_gem_shmem_put_pages(shmem);
++ drm_gem_shmem_put_pages_locked(shmem);
+ return ERR_PTR(ret);
+ }
+-EXPORT_SYMBOL_GPL(drm_gem_shmem_get_pages_sgt);
++
++/**
++ * drm_gem_shmem_get_pages_sgt - Pin pages, dma map them, and return a
++ * scatter/gather table for a shmem GEM object.
++ * @shmem: shmem GEM object
++ *
++ * This function returns a scatter/gather table suitable for driver usage. If
++ * the sg table doesn't exist, the pages are pinned, dma-mapped, and a sg
++ * table created.
++ *
++ * This is the main function for drivers to get at backing storage, and it hides
++ * and difference between dma-buf imported and natively allocated objects.
++ * drm_gem_shmem_get_sg_table() should not be directly called by drivers.
++ *
++ * Returns:
++ * A pointer to the scatter/gather table of pinned pages or errno on failure.
++ */
++struct sg_table *drm_gem_shmem_get_pages_sgt(struct drm_gem_shmem_object *shmem)
++{
++ int ret;
++ struct sg_table *sgt;
++
++ ret = mutex_lock_interruptible(&shmem->pages_lock);
++ if (ret)
++ return ERR_PTR(ret);
++ sgt = drm_gem_shmem_get_pages_sgt_locked(shmem);
++ mutex_unlock(&shmem->pages_lock);
++
++ return sgt;
++}
++EXPORT_SYMBOL(drm_gem_shmem_get_pages_sgt);
+
+ /**
+ * drm_gem_shmem_prime_import_sg_table - Produce a shmem GEM object from
+--
+2.39.2
+
--- /dev/null
+From 67cfcd445484df6427872dc7fad868461c0b2dbe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Feb 2023 18:04:21 +0900
+Subject: drm/shmem-helper: Revert accidental non-GPL export
+
+From: Asahi Lina <lina@asahilina.net>
+
+[ Upstream commit 047a754558d640eaa080fce3b22ca9f3d4e04626 ]
+
+The referenced commit added a wrapper for drm_gem_shmem_get_pages_sgt(),
+but in the process it accidentally changed the export type from GPL to
+non-GPL. Switch it back to GPL.
+
+Reported-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
+Fixes: ddddedaa0db9 ("drm/shmem-helper: Fix locking for drm_gem_shmem_get_pages_sgt()")
+Signed-off-by: Asahi Lina <lina@asahilina.net>
+Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230227-shmem-export-fix-v1-1-8880b2c25e81@asahilina.net
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_gem_shmem_helper.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/drm_gem_shmem_helper.c b/drivers/gpu/drm/drm_gem_shmem_helper.c
+index 2c559b310cad3..7af9da886d4e5 100644
+--- a/drivers/gpu/drm/drm_gem_shmem_helper.c
++++ b/drivers/gpu/drm/drm_gem_shmem_helper.c
+@@ -747,7 +747,7 @@ struct sg_table *drm_gem_shmem_get_pages_sgt(struct drm_gem_shmem_object *shmem)
+
+ return sgt;
+ }
+-EXPORT_SYMBOL(drm_gem_shmem_get_pages_sgt);
++EXPORT_SYMBOL_GPL(drm_gem_shmem_get_pages_sgt);
+
+ /**
+ * drm_gem_shmem_prime_import_sg_table - Produce a shmem GEM object from
+--
+2.39.2
+
--- /dev/null
+From 9ebe35c7038a700e6b9150e0351a4eafe6fb527d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Jan 2023 15:39:01 +0200
+Subject: drm/tegra: firewall: Check for is_addr_reg existence in IMM check
+
+From: Mikko Perttunen <mperttunen@nvidia.com>
+
+[ Upstream commit 1b5c09de25e8c08655c270a70e5e74e93b6bad1f ]
+
+In the IMM opcode check, don't call is_addr_reg if it's not set.
+
+Fixes: 8cc95f3fd35e ("drm/tegra: Add job firewall")
+Signed-off-by: Mikko Perttunen <mperttunen@nvidia.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/tegra/firewall.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/gpu/drm/tegra/firewall.c b/drivers/gpu/drm/tegra/firewall.c
+index 1824d2db0e2ce..d53f890fa6893 100644
+--- a/drivers/gpu/drm/tegra/firewall.c
++++ b/drivers/gpu/drm/tegra/firewall.c
+@@ -97,6 +97,9 @@ static int fw_check_regs_imm(struct tegra_drm_firewall *fw, u32 offset)
+ {
+ bool is_addr;
+
++ if (!fw->client->ops->is_addr_reg)
++ return 0;
++
+ is_addr = fw->client->ops->is_addr_reg(fw->client->base.dev, fw->class,
+ offset);
+ if (is_addr)
+--
+2.39.2
+
--- /dev/null
+From 39b2feeb61bf551ead48ef86a7b1b30cc508cdc5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Dec 2022 18:18:03 -0600
+Subject: drm: tidss: Fix pixel format definition
+
+From: Randolph Sapp <rs@ti.com>
+
+[ Upstream commit 2df0433b18f2735a49d2c3a968b40fa2881137c0 ]
+
+There was a long-standing bug from a typo that created 2 ARGB1555 and
+ABGR1555 pixel format entries. Weston 10 has a sanity check that alerted
+me to this issue.
+
+According to the Supported Pixel Data formats table we have the later
+entries should have been for Alpha-X instead.
+
+Signed-off-by: Randolph Sapp <rs@ti.com>
+Fixes: 32a1795f57eecc ("drm/tidss: New driver for TI Keystone platform Display SubSystem")
+Reviewed-by: Aradhya Bhatia <a-bhatia1@ti.com>
+Acked-by: Andrew Davis <afd@ti.com>
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20221202001803.1765805-1-rs@ti.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/tidss/tidss_dispc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/tidss/tidss_dispc.c b/drivers/gpu/drm/tidss/tidss_dispc.c
+index ad93acc9abd2a..16301bdfead12 100644
+--- a/drivers/gpu/drm/tidss/tidss_dispc.c
++++ b/drivers/gpu/drm/tidss/tidss_dispc.c
+@@ -1858,8 +1858,8 @@ static const struct {
+ { DRM_FORMAT_XBGR4444, 0x21, },
+ { DRM_FORMAT_RGBX4444, 0x22, },
+
+- { DRM_FORMAT_ARGB1555, 0x25, },
+- { DRM_FORMAT_ABGR1555, 0x26, },
++ { DRM_FORMAT_XRGB1555, 0x25, },
++ { DRM_FORMAT_XBGR1555, 0x26, },
+
+ { DRM_FORMAT_XRGB8888, 0x27, },
+ { DRM_FORMAT_XBGR8888, 0x28, },
+--
+2.39.2
+
--- /dev/null
+From 46bbf53028f88519801b892b621514d4ffab8977 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Dec 2022 10:02:38 +0100
+Subject: drm/tiny: ili9486: Do not assume 8-bit only SPI controllers
+
+From: Carlo Caione <ccaione@baylibre.com>
+
+[ Upstream commit 77772e607522daa61f3af74df018559db75c43d6 ]
+
+The pixel data for the ILI9486 is always 16-bits wide and it must be
+sent over the SPI bus. When the controller is only able to deal with
+8-bit transfers, this 16-bits data needs to be swapped before the
+sending to account for the big endian bus, this is on the contrary not
+needed when the SPI controller already supports 16-bits transfers.
+
+The decision about swapping the pixel data or not is taken in the MIPI
+DBI code by probing the controller capabilities: if the controller only
+suppors 8-bit transfers the data is swapped, otherwise it is not.
+
+This swapping/non-swapping is relying on the assumption that when the
+controller does support 16-bit transactions then the data is sent
+unswapped in 16-bits-per-word over SPI.
+
+The problem with the ILI9486 driver is that it is forcing 8-bit
+transactions also for controllers supporting 16-bits, violating the
+assumption and corrupting the pixel data.
+
+Align the driver to what is done in the MIPI DBI code by adjusting the
+transfer size to the maximum allowed by the SPI controller.
+
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Carlo Caione <ccaione@baylibre.com>
+Reviewed-by: Kamlesh Gurudasani <kamlesh.gurudasani@gmail.com>
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20221116-s905x_spi_ili9486-v4-2-f86b4463b9e4@baylibre.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/tiny/ili9486.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/tiny/ili9486.c b/drivers/gpu/drm/tiny/ili9486.c
+index 1bb847466b107..a63b15817f112 100644
+--- a/drivers/gpu/drm/tiny/ili9486.c
++++ b/drivers/gpu/drm/tiny/ili9486.c
+@@ -43,6 +43,7 @@ static int waveshare_command(struct mipi_dbi *mipi, u8 *cmd, u8 *par,
+ size_t num)
+ {
+ struct spi_device *spi = mipi->spi;
++ unsigned int bpw = 8;
+ void *data = par;
+ u32 speed_hz;
+ int i, ret;
+@@ -56,8 +57,6 @@ static int waveshare_command(struct mipi_dbi *mipi, u8 *cmd, u8 *par,
+ * The displays are Raspberry Pi HATs and connected to the 8-bit only
+ * SPI controller, so 16-bit command and parameters need byte swapping
+ * before being transferred as 8-bit on the big endian SPI bus.
+- * Pixel data bytes have already been swapped before this function is
+- * called.
+ */
+ buf[0] = cpu_to_be16(*cmd);
+ gpiod_set_value_cansleep(mipi->dc, 0);
+@@ -71,12 +70,18 @@ static int waveshare_command(struct mipi_dbi *mipi, u8 *cmd, u8 *par,
+ for (i = 0; i < num; i++)
+ buf[i] = cpu_to_be16(par[i]);
+ num *= 2;
+- speed_hz = mipi_dbi_spi_cmd_max_speed(spi, num);
+ data = buf;
+ }
+
++ /*
++ * Check whether pixel data bytes needs to be swapped or not
++ */
++ if (*cmd == MIPI_DCS_WRITE_MEMORY_START && !mipi->swap_bytes)
++ bpw = 16;
++
+ gpiod_set_value_cansleep(mipi->dc, 1);
+- ret = mipi_dbi_spi_transfer(spi, speed_hz, 8, data, num);
++ speed_hz = mipi_dbi_spi_cmd_max_speed(spi, num);
++ ret = mipi_dbi_spi_transfer(spi, speed_hz, bpw, data, num);
+ free:
+ kfree(buf);
+
+--
+2.39.2
+
--- /dev/null
+From 55bf3dbb123879342f07db2e38bc1a8a9a36893c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Dec 2022 09:42:52 +0100
+Subject: drm/vc4: dpi: Fix format mapping for RGB565
+
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+[ Upstream commit 0870d86eac8a9abd89a0be1b719d5dc5bac936f0 ]
+
+The mapping is incorrect for RGB565_1X16 as it should be
+DPI_FORMAT_18BIT_666_RGB_1 instead of DPI_FORMAT_18BIT_666_RGB_3.
+
+Fixes: 08302c35b59d ("drm/vc4: Add DPI driver")
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Link: https://lore.kernel.org/r/20221013-rpi-dpi-improvements-v3-7-eb76e26a772d@cerno.tech
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vc4/vc4_dpi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/vc4/vc4_dpi.c b/drivers/gpu/drm/vc4/vc4_dpi.c
+index 1f8f44b7b5a5f..61ef7d232a12c 100644
+--- a/drivers/gpu/drm/vc4/vc4_dpi.c
++++ b/drivers/gpu/drm/vc4/vc4_dpi.c
+@@ -179,7 +179,7 @@ static void vc4_dpi_encoder_enable(struct drm_encoder *encoder)
+ DPI_FORMAT);
+ break;
+ case MEDIA_BUS_FMT_RGB565_1X16:
+- dpi_c |= VC4_SET_FIELD(DPI_FORMAT_16BIT_565_RGB_3,
++ dpi_c |= VC4_SET_FIELD(DPI_FORMAT_16BIT_565_RGB_1,
+ DPI_FORMAT);
+ break;
+ default:
+--
+2.39.2
+
--- /dev/null
+From 258a4425f0149f34bf585dd2a11fb409dab6f5ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Dec 2022 16:46:38 -0300
+Subject: drm/vc4: drop all currently held locks if deadlock happens
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: MaÃra Canal <mcanal@igalia.com>
+
+[ Upstream commit 479d4f0be4237ba33bc9432787aeb62c90e30f95 ]
+
+If vc4_hdmi_reset_link() returns -EDEADLK, it means that a deadlock
+happened in the locking context. This situation should be addressed by
+dropping all currently held locks and block until the contended lock
+becomes available. Currently, vc4 is not dealing with the deadlock
+properly, producing the following output when PROVE_LOCKING is enabled:
+
+[ 825.612809] ------------[ cut here ]------------
+[ 825.612852] WARNING: CPU: 1 PID: 116 at drivers/gpu/drm/drm_modeset_lock.c:276 drm_modeset_drop_locks+0x60/0x68 [drm]
+[ 825.613458] Modules linked in: 8021q mrp garp stp llc
+raspberrypi_cpufreq brcmfmac brcmutil crct10dif_ce hci_uart cfg80211
+btqca btbcm bluetooth vc4 raspberrypi_hwmon snd_soc_hdmi_codec cec
+clk_raspberrypi ecdh_generic drm_display_helper ecc rfkill
+drm_dma_helper drm_kms_helper pwm_bcm2835 bcm2835_thermal bcm2835_rng
+rng_core i2c_bcm2835 drm fuse ip_tables x_tables ipv6
+[ 825.613735] CPU: 1 PID: 116 Comm: kworker/1:2 Tainted: G W 6.1.0-rc6-01399-g941aae326315 #3
+[ 825.613759] Hardware name: Raspberry Pi 3 Model B Rev 1.2 (DT)
+[ 825.613777] Workqueue: events output_poll_execute [drm_kms_helper]
+[ 825.614038] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+[ 825.614063] pc : drm_modeset_drop_locks+0x60/0x68 [drm]
+[ 825.614603] lr : drm_helper_probe_detect+0x120/0x1b4 [drm_kms_helper]
+[ 825.614829] sp : ffff800008313bf0
+[ 825.614844] x29: ffff800008313bf0 x28: ffffcd7778b8b000 x27: 0000000000000000
+[ 825.614883] x26: 0000000000000001 x25: 0000000000000001 x24: ffff677cc35c2758
+[ 825.614920] x23: ffffcd7707d01430 x22: ffffcd7707c3edc7 x21: 0000000000000001
+[ 825.614958] x20: 0000000000000000 x19: ffff800008313c10 x18: 000000000000b6d3
+[ 825.614995] x17: ffffcd777835e214 x16: ffffcd7777cef870 x15: fffff81000000000
+[ 825.615033] x14: 0000000000000000 x13: 0000000000000099 x12: 0000000000000002
+[ 825.615070] x11: 72917988020af800 x10: 72917988020af800 x9 : 72917988020af800
+[ 825.615108] x8 : ffff677cc665e0a8 x7 : d00a8c180000110c x6 : ffffcd77774c0054
+[ 825.615145] x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000000
+[ 825.615181] x2 : ffff677cc55e1880 x1 : ffffcd7777cef8ec x0 : ffff800008313c10
+[ 825.615219] Call trace:
+[ 825.615232] drm_modeset_drop_locks+0x60/0x68 [drm]
+[ 825.615773] drm_helper_probe_detect+0x120/0x1b4 [drm_kms_helper]
+[ 825.616003] output_poll_execute+0xe4/0x224 [drm_kms_helper]
+[ 825.616233] process_one_work+0x2b4/0x618
+[ 825.616264] worker_thread+0x24c/0x464
+[ 825.616288] kthread+0xec/0x110
+[ 825.616310] ret_from_fork+0x10/0x20
+[ 825.616335] irq event stamp: 7634
+[ 825.616349] hardirqs last enabled at (7633): [<ffffcd777831ee90>] _raw_spin_unlock_irq+0x3c/0x78
+[ 825.616384] hardirqs last disabled at (7634): [<ffffcd7778315a78>] __schedule+0x134/0x9f0
+[ 825.616411] softirqs last enabled at (7630): [<ffffcd7707aacea0>] local_bh_enable+0x4/0x30 [ipv6]
+[ 825.617019] softirqs last disabled at (7618): [<ffffcd7707aace70>] local_bh_disable+0x4/0x30 [ipv6]
+[ 825.617586] ---[ end trace 0000000000000000 ]---
+
+Therefore, deal with the deadlock as suggested by [1], using the
+function drm_modeset_backoff().
+
+[1] https://docs.kernel.org/gpu/drm-kms.html?highlight=kms#kms-locking
+
+Fixes: 6bed2ea3cb38 ("drm/vc4: hdmi: Reset link on hotplug")
+Reported-by: Stefan Wahren <stefan.wahren@i2se.com>
+Signed-off-by: MaÃra Canal <mcanal@igalia.com>
+Tested-by: Stefan Wahren <stefan.wahren@i2se.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://patchwork.freedesktop.org/patch/msgid/20221229194638.178712-1-mcanal@igalia.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vc4/vc4_hdmi.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c
+index 7546103f14997..21338e6a95056 100644
+--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
++++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
+@@ -406,6 +406,7 @@ static void vc4_hdmi_handle_hotplug(struct vc4_hdmi *vc4_hdmi,
+ {
+ struct drm_connector *connector = &vc4_hdmi->connector;
+ struct edid *edid;
++ int ret;
+
+ /*
+ * NOTE: This function should really be called with
+@@ -434,7 +435,15 @@ static void vc4_hdmi_handle_hotplug(struct vc4_hdmi *vc4_hdmi,
+ cec_s_phys_addr_from_edid(vc4_hdmi->cec_adap, edid);
+ kfree(edid);
+
+- vc4_hdmi_reset_link(connector, ctx);
++ for (;;) {
++ ret = vc4_hdmi_reset_link(connector, ctx);
++ if (ret == -EDEADLK) {
++ drm_modeset_backoff(ctx);
++ continue;
++ }
++
++ break;
++ }
+ }
+
+ static int vc4_hdmi_connector_detect_ctx(struct drm_connector *connector,
+--
+2.39.2
+
--- /dev/null
+From e505b9ac9d9164fda10143429e8e4dcac66723a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Dec 2022 12:53:25 +0100
+Subject: drm/vc4: hdmi: Correct interlaced timings again
+
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+[ Upstream commit 771d6539f27bd55f43d8a95d53a7eeaaffa2681c ]
+
+The back porch timings were correct, only the sync offset was wrong.
+Correct timing is now reported for 1080i and 576i, but the h offset is
+incorrect for 480i for non-obvious reasons.
+
+Fixes: fb10dc451c0f ("drm/vc4: hdmi: Correct HDMI timing registers for interlaced modes")
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Link: https://lore.kernel.org/r/20221207-rpi-hvs-crtc-misc-v1-14-1f8e0770798b@cerno.tech
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vc4/vc4_hdmi.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c
+index 21338e6a95056..3f3f94e7b8339 100644
+--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
++++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
+@@ -1311,11 +1311,12 @@ static void vc5_hdmi_set_timings(struct vc4_hdmi *vc4_hdmi,
+ VC4_SET_FIELD(mode->crtc_vdisplay, VC5_HDMI_VERTA_VAL));
+ u32 vertb = (VC4_SET_FIELD(mode->htotal >> (2 - pixel_rep),
+ VC5_HDMI_VERTB_VSPO) |
+- VC4_SET_FIELD(mode->crtc_vtotal - mode->crtc_vsync_end,
++ VC4_SET_FIELD(mode->crtc_vtotal - mode->crtc_vsync_end +
++ interlaced,
+ VC4_HDMI_VERTB_VBP));
+ u32 vertb_even = (VC4_SET_FIELD(0, VC5_HDMI_VERTB_VSPO) |
+ VC4_SET_FIELD(mode->crtc_vtotal -
+- mode->crtc_vsync_end - interlaced,
++ mode->crtc_vsync_end,
+ VC4_HDMI_VERTB_VBP));
+ unsigned long flags;
+ unsigned char gcp;
+--
+2.39.2
+
--- /dev/null
+From 089be1de0444830717ddf52517b078356854f651 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Dec 2022 12:53:12 +0100
+Subject: drm/vc4: hvs: Configure the HVS COB allocations
+
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+[ Upstream commit 1284365e3e8cc33849f90cae20bca36fd7544e24 ]
+
+The HVS Composite Output Buffer (COB) is the memory used to
+generate the output pixel data.
+Until now the vc4 driver has been relying on the firmware to
+have set these to sensible values.
+
+In testing triple screen support it has been noted that only
+1 line was being assigned to HVS channel 2. Whilst that is fine
+for the transposer (TXP), and indeed needed as only some pixels
+have an alpha channel, it is insufficient to run a live display.
+
+Split the COB more evenly between the 3 HVS channels.
+
+Fixes: c54619b0bfb3 ("drm/vc4: Add support for the BCM2711 HVS5")
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Link: https://lore.kernel.org/r/20221207-rpi-hvs-crtc-misc-v1-1-1f8e0770798b@cerno.tech
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vc4/vc4_hvs.c | 56 ++++++++++++++++++++++++++++++++++-
+ 1 file changed, 55 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/vc4/vc4_hvs.c b/drivers/gpu/drm/vc4/vc4_hvs.c
+index c4453a5ae163a..d615ba7db9209 100644
+--- a/drivers/gpu/drm/vc4/vc4_hvs.c
++++ b/drivers/gpu/drm/vc4/vc4_hvs.c
+@@ -776,7 +776,7 @@ static int vc4_hvs_bind(struct device *dev, struct device *master, void *data)
+ struct vc4_hvs *hvs = NULL;
+ int ret;
+ u32 dispctrl;
+- u32 reg;
++ u32 reg, top;
+
+ hvs = drmm_kzalloc(drm, sizeof(*hvs), GFP_KERNEL);
+ if (!hvs)
+@@ -912,6 +912,60 @@ static int vc4_hvs_bind(struct device *dev, struct device *master, void *data)
+
+ HVS_WRITE(SCALER_DISPCTRL, dispctrl);
+
++ /* Recompute Composite Output Buffer (COB) allocations for the displays
++ */
++ if (!vc4->is_vc5) {
++ /* The COB is 20736 pixels, or just over 10 lines at 2048 wide.
++ * The bottom 2048 pixels are full 32bpp RGBA (intended for the
++ * TXP composing RGBA to memory), whilst the remainder are only
++ * 24bpp RGB.
++ *
++ * Assign 3 lines to channels 1 & 2, and just over 4 lines to
++ * channel 0.
++ */
++ #define VC4_COB_SIZE 20736
++ #define VC4_COB_LINE_WIDTH 2048
++ #define VC4_COB_NUM_LINES 3
++ reg = 0;
++ top = VC4_COB_LINE_WIDTH * VC4_COB_NUM_LINES;
++ reg |= (top - 1) << 16;
++ HVS_WRITE(SCALER_DISPBASE2, reg);
++ reg = top;
++ top += VC4_COB_LINE_WIDTH * VC4_COB_NUM_LINES;
++ reg |= (top - 1) << 16;
++ HVS_WRITE(SCALER_DISPBASE1, reg);
++ reg = top;
++ top = VC4_COB_SIZE;
++ reg |= (top - 1) << 16;
++ HVS_WRITE(SCALER_DISPBASE0, reg);
++ } else {
++ /* The COB is 44416 pixels, or 10.8 lines at 4096 wide.
++ * The bottom 4096 pixels are full RGBA (intended for the TXP
++ * composing RGBA to memory), whilst the remainder are only
++ * RGB. Addressing is always pixel wide.
++ *
++ * Assign 3 lines of 4096 to channels 1 & 2, and just over 4
++ * lines. to channel 0.
++ */
++ #define VC5_COB_SIZE 44416
++ #define VC5_COB_LINE_WIDTH 4096
++ #define VC5_COB_NUM_LINES 3
++ reg = 0;
++ top = VC5_COB_LINE_WIDTH * VC5_COB_NUM_LINES;
++ reg |= top << 16;
++ HVS_WRITE(SCALER_DISPBASE2, reg);
++ top += 16;
++ reg = top;
++ top += VC5_COB_LINE_WIDTH * VC5_COB_NUM_LINES;
++ reg |= top << 16;
++ HVS_WRITE(SCALER_DISPBASE1, reg);
++ top += 16;
++ reg = top;
++ top = VC5_COB_SIZE;
++ reg |= top << 16;
++ HVS_WRITE(SCALER_DISPBASE0, reg);
++ }
++
+ ret = devm_request_irq(dev, platform_get_irq(pdev, 0),
+ vc4_hvs_irq_handler, 0, "vc4 hvs", drm);
+ if (ret)
+--
+2.39.2
+
--- /dev/null
+From e15b97702c688f29422939ef63e731f42fb49e4d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Dec 2022 12:53:15 +0100
+Subject: drm/vc4: hvs: Correct interrupt masking bit assignment for HVS5
+
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+[ Upstream commit 87551ec650bb87d35f1b29bba6a2430896e08da0 ]
+
+HVS5 has moved the interrupt enable bits around within the
+DISPCTRL register, therefore the configuration has to be updated
+to account for this.
+
+Fixes: c54619b0bfb3 ("drm/vc4: Add support for the BCM2711 HVS5")
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Link: https://lore.kernel.org/r/20221207-rpi-hvs-crtc-misc-v1-4-1f8e0770798b@cerno.tech
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vc4/vc4_hvs.c | 52 +++++++++++++++++++++++-----------
+ drivers/gpu/drm/vc4/vc4_regs.h | 10 +++++--
+ 2 files changed, 44 insertions(+), 18 deletions(-)
+
+diff --git a/drivers/gpu/drm/vc4/vc4_hvs.c b/drivers/gpu/drm/vc4/vc4_hvs.c
+index 57d99e7199ee5..d9fc0d03023b0 100644
+--- a/drivers/gpu/drm/vc4/vc4_hvs.c
++++ b/drivers/gpu/drm/vc4/vc4_hvs.c
+@@ -660,7 +660,8 @@ void vc4_hvs_mask_underrun(struct vc4_hvs *hvs, int channel)
+ return;
+
+ dispctrl = HVS_READ(SCALER_DISPCTRL);
+- dispctrl &= ~SCALER_DISPCTRL_DSPEISLUR(channel);
++ dispctrl &= ~(hvs->vc4->is_vc5 ? SCALER5_DISPCTRL_DSPEISLUR(channel) :
++ SCALER_DISPCTRL_DSPEISLUR(channel));
+
+ HVS_WRITE(SCALER_DISPCTRL, dispctrl);
+
+@@ -677,7 +678,8 @@ void vc4_hvs_unmask_underrun(struct vc4_hvs *hvs, int channel)
+ return;
+
+ dispctrl = HVS_READ(SCALER_DISPCTRL);
+- dispctrl |= SCALER_DISPCTRL_DSPEISLUR(channel);
++ dispctrl |= (hvs->vc4->is_vc5 ? SCALER5_DISPCTRL_DSPEISLUR(channel) :
++ SCALER_DISPCTRL_DSPEISLUR(channel));
+
+ HVS_WRITE(SCALER_DISPSTAT,
+ SCALER_DISPSTAT_EUFLOW(channel));
+@@ -703,6 +705,7 @@ static irqreturn_t vc4_hvs_irq_handler(int irq, void *data)
+ int channel;
+ u32 control;
+ u32 status;
++ u32 dspeislur;
+
+ /*
+ * NOTE: We don't need to protect the register access using
+@@ -719,9 +722,11 @@ static irqreturn_t vc4_hvs_irq_handler(int irq, void *data)
+ control = HVS_READ(SCALER_DISPCTRL);
+
+ for (channel = 0; channel < SCALER_CHANNELS_COUNT; channel++) {
++ dspeislur = vc4->is_vc5 ? SCALER5_DISPCTRL_DSPEISLUR(channel) :
++ SCALER_DISPCTRL_DSPEISLUR(channel);
+ /* Interrupt masking is not always honored, so check it here. */
+ if (status & SCALER_DISPSTAT_EUFLOW(channel) &&
+- control & SCALER_DISPCTRL_DSPEISLUR(channel)) {
++ control & dspeislur) {
+ vc4_hvs_mask_underrun(hvs, channel);
+ vc4_hvs_report_underrun(dev);
+
+@@ -898,19 +903,34 @@ static int vc4_hvs_bind(struct device *dev, struct device *master, void *data)
+ SCALER_DISPCTRL_DISPEIRQ(1) |
+ SCALER_DISPCTRL_DISPEIRQ(2);
+
+- dispctrl &= ~(SCALER_DISPCTRL_DMAEIRQ |
+- SCALER_DISPCTRL_SLVWREIRQ |
+- SCALER_DISPCTRL_SLVRDEIRQ |
+- SCALER_DISPCTRL_DSPEIEOF(0) |
+- SCALER_DISPCTRL_DSPEIEOF(1) |
+- SCALER_DISPCTRL_DSPEIEOF(2) |
+- SCALER_DISPCTRL_DSPEIEOLN(0) |
+- SCALER_DISPCTRL_DSPEIEOLN(1) |
+- SCALER_DISPCTRL_DSPEIEOLN(2) |
+- SCALER_DISPCTRL_DSPEISLUR(0) |
+- SCALER_DISPCTRL_DSPEISLUR(1) |
+- SCALER_DISPCTRL_DSPEISLUR(2) |
+- SCALER_DISPCTRL_SCLEIRQ);
++ if (!vc4->is_vc5)
++ dispctrl &= ~(SCALER_DISPCTRL_DMAEIRQ |
++ SCALER_DISPCTRL_SLVWREIRQ |
++ SCALER_DISPCTRL_SLVRDEIRQ |
++ SCALER_DISPCTRL_DSPEIEOF(0) |
++ SCALER_DISPCTRL_DSPEIEOF(1) |
++ SCALER_DISPCTRL_DSPEIEOF(2) |
++ SCALER_DISPCTRL_DSPEIEOLN(0) |
++ SCALER_DISPCTRL_DSPEIEOLN(1) |
++ SCALER_DISPCTRL_DSPEIEOLN(2) |
++ SCALER_DISPCTRL_DSPEISLUR(0) |
++ SCALER_DISPCTRL_DSPEISLUR(1) |
++ SCALER_DISPCTRL_DSPEISLUR(2) |
++ SCALER_DISPCTRL_SCLEIRQ);
++ else
++ dispctrl &= ~(SCALER_DISPCTRL_DMAEIRQ |
++ SCALER5_DISPCTRL_SLVEIRQ |
++ SCALER5_DISPCTRL_DSPEIEOF(0) |
++ SCALER5_DISPCTRL_DSPEIEOF(1) |
++ SCALER5_DISPCTRL_DSPEIEOF(2) |
++ SCALER5_DISPCTRL_DSPEIEOLN(0) |
++ SCALER5_DISPCTRL_DSPEIEOLN(1) |
++ SCALER5_DISPCTRL_DSPEIEOLN(2) |
++ SCALER5_DISPCTRL_DSPEISLUR(0) |
++ SCALER5_DISPCTRL_DSPEISLUR(1) |
++ SCALER5_DISPCTRL_DSPEISLUR(2) |
++ SCALER_DISPCTRL_SCLEIRQ);
++
+
+ /* Set AXI panic mode.
+ * VC4 panics when < 2 lines in FIFO.
+diff --git a/drivers/gpu/drm/vc4/vc4_regs.h b/drivers/gpu/drm/vc4/vc4_regs.h
+index 95deacdc31e77..1256f0877ff66 100644
+--- a/drivers/gpu/drm/vc4/vc4_regs.h
++++ b/drivers/gpu/drm/vc4/vc4_regs.h
+@@ -234,15 +234,21 @@
+ * always enabled.
+ */
+ # define SCALER_DISPCTRL_DSPEISLUR(x) BIT(13 + (x))
++# define SCALER5_DISPCTRL_DSPEISLUR(x) BIT(9 + ((x) * 4))
+ /* Enables Display 0 end-of-line-N contribution to
+ * SCALER_DISPSTAT_IRQDISP0
+ */
+ # define SCALER_DISPCTRL_DSPEIEOLN(x) BIT(8 + ((x) * 2))
++# define SCALER5_DISPCTRL_DSPEIEOLN(x) BIT(8 + ((x) * 4))
+ /* Enables Display 0 EOF contribution to SCALER_DISPSTAT_IRQDISP0 */
+ # define SCALER_DISPCTRL_DSPEIEOF(x) BIT(7 + ((x) * 2))
++# define SCALER5_DISPCTRL_DSPEIEOF(x) BIT(7 + ((x) * 4))
+
+-# define SCALER_DISPCTRL_SLVRDEIRQ BIT(6)
+-# define SCALER_DISPCTRL_SLVWREIRQ BIT(5)
++# define SCALER5_DISPCTRL_DSPEIVST(x) BIT(6 + ((x) * 4))
++
++# define SCALER_DISPCTRL_SLVRDEIRQ BIT(6) /* HVS4 only */
++# define SCALER_DISPCTRL_SLVWREIRQ BIT(5) /* HVS4 only */
++# define SCALER5_DISPCTRL_SLVEIRQ BIT(5)
+ # define SCALER_DISPCTRL_DMAEIRQ BIT(4)
+ /* Enables interrupt generation on the enabled EOF/EOLN/EISLUR
+ * bits and short frames..
+--
+2.39.2
+
--- /dev/null
+From ee37fda7235ed18641288d2cb0607e902f3a4bb9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Dec 2022 12:53:17 +0100
+Subject: drm/vc4: hvs: Fix colour order for xRGB1555 on HVS5
+
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+[ Upstream commit 902973dc1a049c0d7bf0c222b8f2b3876f01b4a2 ]
+
+Same as the xRGB8888 formats, HVS5 has managed to swap the colour
+channels for the xRGB1555 formats as well. Add the relevant
+config for pixel_order_hvs5.
+
+Fixes: c54619b0bfb3 ("drm/vc4: Add support for the BCM2711 HVS5")
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Link: https://lore.kernel.org/r/20221207-rpi-hvs-crtc-misc-v1-6-1f8e0770798b@cerno.tech
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vc4/vc4_plane.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/vc4/vc4_plane.c b/drivers/gpu/drm/vc4/vc4_plane.c
+index bd5acc4a86876..eb08020154f30 100644
+--- a/drivers/gpu/drm/vc4/vc4_plane.c
++++ b/drivers/gpu/drm/vc4/vc4_plane.c
+@@ -75,11 +75,13 @@ static const struct hvs_format {
+ .drm = DRM_FORMAT_ARGB1555,
+ .hvs = HVS_PIXEL_FORMAT_RGBA5551,
+ .pixel_order = HVS_PIXEL_ORDER_ABGR,
++ .pixel_order_hvs5 = HVS_PIXEL_ORDER_ARGB,
+ },
+ {
+ .drm = DRM_FORMAT_XRGB1555,
+ .hvs = HVS_PIXEL_FORMAT_RGBA5551,
+ .pixel_order = HVS_PIXEL_ORDER_ABGR,
++ .pixel_order_hvs5 = HVS_PIXEL_ORDER_ARGB,
+ },
+ {
+ .drm = DRM_FORMAT_RGB888,
+--
+2.39.2
+
--- /dev/null
+From 5e97d122fa0e046c075d68636ebf1edc5b0856cf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Dec 2022 12:53:14 +0100
+Subject: drm/vc4: hvs: SCALER_DISPBKGND_AUTOHS is only valid on HVS4
+
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+[ Upstream commit 982ee94486863a41c6af9f2ab3f6681f72bc5c48 ]
+
+The bit used for SCALER_DISPBKGND_AUTOHS in SCALER_DISPBKGNDX
+has been repurposed on HVS5 to configure whether a display can
+win back-to-back arbitration wins for the COB.
+
+This is not desirable, therefore only select this bit on HVS4,
+and explicitly clear it on HVS5.
+
+Fixes: c54619b0bfb3 ("drm/vc4: Add support for the BCM2711 HVS5")
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Link: https://lore.kernel.org/r/20221207-rpi-hvs-crtc-misc-v1-3-1f8e0770798b@cerno.tech
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vc4/vc4_hvs.c | 10 ++++++----
+ drivers/gpu/drm/vc4/vc4_regs.h | 1 +
+ 2 files changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/vc4/vc4_hvs.c b/drivers/gpu/drm/vc4/vc4_hvs.c
+index b335815eac6a5..57d99e7199ee5 100644
+--- a/drivers/gpu/drm/vc4/vc4_hvs.c
++++ b/drivers/gpu/drm/vc4/vc4_hvs.c
+@@ -370,28 +370,30 @@ static int vc4_hvs_init_channel(struct vc4_hvs *hvs, struct drm_crtc *crtc,
+ * mode.
+ */
+ dispctrl = SCALER_DISPCTRLX_ENABLE;
++ dispbkgndx = HVS_READ(SCALER_DISPBKGNDX(chan));
+
+- if (!vc4->is_vc5)
++ if (!vc4->is_vc5) {
+ dispctrl |= VC4_SET_FIELD(mode->hdisplay,
+ SCALER_DISPCTRLX_WIDTH) |
+ VC4_SET_FIELD(mode->vdisplay,
+ SCALER_DISPCTRLX_HEIGHT) |
+ (oneshot ? SCALER_DISPCTRLX_ONESHOT : 0);
+- else
++ dispbkgndx |= SCALER_DISPBKGND_AUTOHS;
++ } else {
+ dispctrl |= VC4_SET_FIELD(mode->hdisplay,
+ SCALER5_DISPCTRLX_WIDTH) |
+ VC4_SET_FIELD(mode->vdisplay,
+ SCALER5_DISPCTRLX_HEIGHT) |
+ (oneshot ? SCALER5_DISPCTRLX_ONESHOT : 0);
++ dispbkgndx &= ~SCALER5_DISPBKGND_BCK2BCK;
++ }
+
+ HVS_WRITE(SCALER_DISPCTRLX(chan), dispctrl);
+
+- dispbkgndx = HVS_READ(SCALER_DISPBKGNDX(chan));
+ dispbkgndx &= ~SCALER_DISPBKGND_GAMMA;
+ dispbkgndx &= ~SCALER_DISPBKGND_INTERLACE;
+
+ HVS_WRITE(SCALER_DISPBKGNDX(chan), dispbkgndx |
+- SCALER_DISPBKGND_AUTOHS |
+ ((!vc4->is_vc5) ? SCALER_DISPBKGND_GAMMA : 0) |
+ (interlace ? SCALER_DISPBKGND_INTERLACE : 0));
+
+diff --git a/drivers/gpu/drm/vc4/vc4_regs.h b/drivers/gpu/drm/vc4/vc4_regs.h
+index f121905c404d1..95deacdc31e77 100644
+--- a/drivers/gpu/drm/vc4/vc4_regs.h
++++ b/drivers/gpu/drm/vc4/vc4_regs.h
+@@ -366,6 +366,7 @@
+
+ #define SCALER_DISPBKGND0 0x00000044
+ # define SCALER_DISPBKGND_AUTOHS BIT(31)
++# define SCALER5_DISPBKGND_BCK2BCK BIT(31)
+ # define SCALER_DISPBKGND_INTERLACE BIT(30)
+ # define SCALER_DISPBKGND_GAMMA BIT(29)
+ # define SCALER_DISPBKGND_TESTMODE_MASK VC4_MASK(28, 25)
+--
+2.39.2
+
--- /dev/null
+From d7e3bb01f719bf4bc09f170d740265a1e82da88f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Dec 2022 12:53:13 +0100
+Subject: drm/vc4: hvs: Set AXI panic modes
+
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+[ Upstream commit df993fced230daa8452892406f3180c93ebf7e7b ]
+
+The HVS can change AXI request mode based on how full the COB
+FIFOs are.
+Until now the vc4 driver has been relying on the firmware to
+have set these to sensible values.
+
+With HVS channel 2 now being used for live video, change the
+panic mode for all channels to be explicitly set by the driver,
+and the same for all channels.
+
+Fixes: c54619b0bfb3 ("drm/vc4: Add support for the BCM2711 HVS5")
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Link: https://lore.kernel.org/r/20221207-rpi-hvs-crtc-misc-v1-2-1f8e0770798b@cerno.tech
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vc4/vc4_hvs.c | 11 +++++++++++
+ drivers/gpu/drm/vc4/vc4_regs.h | 6 ++++++
+ 2 files changed, 17 insertions(+)
+
+diff --git a/drivers/gpu/drm/vc4/vc4_hvs.c b/drivers/gpu/drm/vc4/vc4_hvs.c
+index d615ba7db9209..b335815eac6a5 100644
+--- a/drivers/gpu/drm/vc4/vc4_hvs.c
++++ b/drivers/gpu/drm/vc4/vc4_hvs.c
+@@ -910,6 +910,17 @@ static int vc4_hvs_bind(struct device *dev, struct device *master, void *data)
+ SCALER_DISPCTRL_DSPEISLUR(2) |
+ SCALER_DISPCTRL_SCLEIRQ);
+
++ /* Set AXI panic mode.
++ * VC4 panics when < 2 lines in FIFO.
++ * VC5 panics when less than 1 line in the FIFO.
++ */
++ dispctrl &= ~(SCALER_DISPCTRL_PANIC0_MASK |
++ SCALER_DISPCTRL_PANIC1_MASK |
++ SCALER_DISPCTRL_PANIC2_MASK);
++ dispctrl |= VC4_SET_FIELD(2, SCALER_DISPCTRL_PANIC0);
++ dispctrl |= VC4_SET_FIELD(2, SCALER_DISPCTRL_PANIC1);
++ dispctrl |= VC4_SET_FIELD(2, SCALER_DISPCTRL_PANIC2);
++
+ HVS_WRITE(SCALER_DISPCTRL, dispctrl);
+
+ /* Recompute Composite Output Buffer (COB) allocations for the displays
+diff --git a/drivers/gpu/drm/vc4/vc4_regs.h b/drivers/gpu/drm/vc4/vc4_regs.h
+index f0290fad991de..f121905c404d1 100644
+--- a/drivers/gpu/drm/vc4/vc4_regs.h
++++ b/drivers/gpu/drm/vc4/vc4_regs.h
+@@ -220,6 +220,12 @@
+ #define SCALER_DISPCTRL 0x00000000
+ /* Global register for clock gating the HVS */
+ # define SCALER_DISPCTRL_ENABLE BIT(31)
++# define SCALER_DISPCTRL_PANIC0_MASK VC4_MASK(25, 24)
++# define SCALER_DISPCTRL_PANIC0_SHIFT 24
++# define SCALER_DISPCTRL_PANIC1_MASK VC4_MASK(27, 26)
++# define SCALER_DISPCTRL_PANIC1_SHIFT 26
++# define SCALER_DISPCTRL_PANIC2_MASK VC4_MASK(29, 28)
++# define SCALER_DISPCTRL_PANIC2_SHIFT 28
+ # define SCALER_DISPCTRL_DSP3_MUX_MASK VC4_MASK(19, 18)
+ # define SCALER_DISPCTRL_DSP3_MUX_SHIFT 18
+
+--
+2.39.2
+
--- /dev/null
+From 3802af62b1bda9654ee49bde3c49e49967b1f124 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Nov 2022 16:25:52 +0100
+Subject: drm/vc4: kms: Sort the CRTCs by output before assigning them
+
+From: Maxime Ripard <maxime@cerno.tech>
+
+[ Upstream commit e3479398bcf4f92c1ee513a277f5d3732a90e9f1 ]
+
+On the vc4 devices (and later), the blending is done by a single device
+called the HVS. The HVS has three FIFO that can operate in parallel, and
+route their output to 6 CRTCs and 7 encoders on the BCM2711.
+
+Each of these CRTCs and encoders have some constraints on which FIFO
+they can feed from, so we need some code to take all those constraints
+into account and assign FIFOs to CRTCs.
+
+The problem can be simplified by assigning those FIFOs to CRTCs by
+ascending output index number. We had a comment mentioning it already,
+but we were never actually enforcing it.
+
+It was working still in most situations because the probe order is
+roughly equivalent, except for the (optional, and fairly rarely used on
+the Pi4) VEC which was last in the probe order sequence, but one of the
+earliest device to assign.
+
+This resulted in configurations that were rejected by our code but were
+still valid with a different assignment.
+
+We can fix this by making sure we assign CRTCs to FIFOs by ordering
+them by ascending HVS output index.
+
+Fixes: 87ebcd42fb7b ("drm/vc4: crtc: Assign output to channel automatically")
+Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://patchwork.freedesktop.org/patch/msgid/20221123-rpi-kunit-tests-v1-10-051a0bb60a16@cerno.tech
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vc4/vc4_kms.c | 109 ++++++++++++++++++++++++----------
+ 1 file changed, 76 insertions(+), 33 deletions(-)
+
+diff --git a/drivers/gpu/drm/vc4/vc4_kms.c b/drivers/gpu/drm/vc4/vc4_kms.c
+index 8fbeecdf2ec4f..e38c0882abdae 100644
+--- a/drivers/gpu/drm/vc4/vc4_kms.c
++++ b/drivers/gpu/drm/vc4/vc4_kms.c
+@@ -12,6 +12,7 @@
+ */
+
+ #include <linux/clk.h>
++#include <linux/sort.h>
+
+ #include <drm/drm_atomic.h>
+ #include <drm/drm_atomic_helper.h>
+@@ -776,6 +777,20 @@ static int vc4_hvs_channels_obj_init(struct vc4_dev *vc4)
+ return drmm_add_action_or_reset(&vc4->base, vc4_hvs_channels_obj_fini, NULL);
+ }
+
++static int cmp_vc4_crtc_hvs_output(const void *a, const void *b)
++{
++ const struct vc4_crtc *crtc_a =
++ to_vc4_crtc(*(const struct drm_crtc **)a);
++ const struct vc4_crtc_data *data_a =
++ vc4_crtc_to_vc4_crtc_data(crtc_a);
++ const struct vc4_crtc *crtc_b =
++ to_vc4_crtc(*(const struct drm_crtc **)b);
++ const struct vc4_crtc_data *data_b =
++ vc4_crtc_to_vc4_crtc_data(crtc_b);
++
++ return data_a->hvs_output - data_b->hvs_output;
++}
++
+ /*
+ * The BCM2711 HVS has up to 7 outputs connected to the pixelvalves and
+ * the TXP (and therefore all the CRTCs found on that platform).
+@@ -810,10 +825,11 @@ static int vc4_pv_muxing_atomic_check(struct drm_device *dev,
+ struct drm_atomic_state *state)
+ {
+ struct vc4_hvs_state *hvs_new_state;
+- struct drm_crtc_state *old_crtc_state, *new_crtc_state;
++ struct drm_crtc **sorted_crtcs;
+ struct drm_crtc *crtc;
+ unsigned int unassigned_channels = 0;
+ unsigned int i;
++ int ret;
+
+ hvs_new_state = vc4_hvs_get_global_state(state);
+ if (IS_ERR(hvs_new_state))
+@@ -823,15 +839,59 @@ static int vc4_pv_muxing_atomic_check(struct drm_device *dev,
+ if (!hvs_new_state->fifo_state[i].in_use)
+ unassigned_channels |= BIT(i);
+
+- for_each_oldnew_crtc_in_state(state, crtc, old_crtc_state, new_crtc_state, i) {
+- struct vc4_crtc_state *old_vc4_crtc_state =
+- to_vc4_crtc_state(old_crtc_state);
+- struct vc4_crtc_state *new_vc4_crtc_state =
+- to_vc4_crtc_state(new_crtc_state);
+- struct vc4_crtc *vc4_crtc = to_vc4_crtc(crtc);
++ /*
++ * The problem we have to solve here is that we have up to 7
++ * encoders, connected to up to 6 CRTCs.
++ *
++ * Those CRTCs, depending on the instance, can be routed to 1, 2
++ * or 3 HVS FIFOs, and we need to set the muxing between FIFOs and
++ * outputs in the HVS accordingly.
++ *
++ * It would be pretty hard to come up with an algorithm that
++ * would generically solve this. However, the current routing
++ * trees we support allow us to simplify a bit the problem.
++ *
++ * Indeed, with the current supported layouts, if we try to
++ * assign in the ascending crtc index order the FIFOs, we can't
++ * fall into the situation where an earlier CRTC that had
++ * multiple routes is assigned one that was the only option for
++ * a later CRTC.
++ *
++ * If the layout changes and doesn't give us that in the future,
++ * we will need to have something smarter, but it works so far.
++ */
++ sorted_crtcs = kmalloc_array(dev->num_crtcs, sizeof(*sorted_crtcs), GFP_KERNEL);
++ if (!sorted_crtcs)
++ return -ENOMEM;
++
++ i = 0;
++ drm_for_each_crtc(crtc, dev)
++ sorted_crtcs[i++] = crtc;
++
++ sort(sorted_crtcs, i, sizeof(*sorted_crtcs), cmp_vc4_crtc_hvs_output, NULL);
++
++ for (i = 0; i < dev->num_crtcs; i++) {
++ struct vc4_crtc_state *old_vc4_crtc_state, *new_vc4_crtc_state;
++ struct drm_crtc_state *old_crtc_state, *new_crtc_state;
++ struct vc4_crtc *vc4_crtc;
+ unsigned int matching_channels;
+ unsigned int channel;
+
++ crtc = sorted_crtcs[i];
++ if (!crtc)
++ continue;
++ vc4_crtc = to_vc4_crtc(crtc);
++
++ old_crtc_state = drm_atomic_get_old_crtc_state(state, crtc);
++ if (!old_crtc_state)
++ continue;
++ old_vc4_crtc_state = to_vc4_crtc_state(old_crtc_state);
++
++ new_crtc_state = drm_atomic_get_new_crtc_state(state, crtc);
++ if (!new_crtc_state)
++ continue;
++ new_vc4_crtc_state = to_vc4_crtc_state(new_crtc_state);
++
+ drm_dbg(dev, "%s: Trying to find a channel.\n", crtc->name);
+
+ /* Nothing to do here, let's skip it */
+@@ -860,33 +920,11 @@ static int vc4_pv_muxing_atomic_check(struct drm_device *dev,
+ continue;
+ }
+
+- /*
+- * The problem we have to solve here is that we have
+- * up to 7 encoders, connected to up to 6 CRTCs.
+- *
+- * Those CRTCs, depending on the instance, can be
+- * routed to 1, 2 or 3 HVS FIFOs, and we need to set
+- * the change the muxing between FIFOs and outputs in
+- * the HVS accordingly.
+- *
+- * It would be pretty hard to come up with an
+- * algorithm that would generically solve
+- * this. However, the current routing trees we support
+- * allow us to simplify a bit the problem.
+- *
+- * Indeed, with the current supported layouts, if we
+- * try to assign in the ascending crtc index order the
+- * FIFOs, we can't fall into the situation where an
+- * earlier CRTC that had multiple routes is assigned
+- * one that was the only option for a later CRTC.
+- *
+- * If the layout changes and doesn't give us that in
+- * the future, we will need to have something smarter,
+- * but it works so far.
+- */
+ matching_channels = unassigned_channels & vc4_crtc->data->hvs_available_channels;
+- if (!matching_channels)
+- return -EINVAL;
++ if (!matching_channels) {
++ ret = -EINVAL;
++ goto err_free_crtc_array;
++ }
+
+ channel = ffs(matching_channels) - 1;
+
+@@ -896,7 +934,12 @@ static int vc4_pv_muxing_atomic_check(struct drm_device *dev,
+ hvs_new_state->fifo_state[channel].in_use = true;
+ }
+
++ kfree(sorted_crtcs);
+ return 0;
++
++err_free_crtc_array:
++ kfree(sorted_crtcs);
++ return ret;
+ }
+
+ static int
+--
+2.39.2
+
--- /dev/null
+From 78dea9e518efa76c955f1f07d9c149ea9d5d9bfb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Nov 2022 06:51:55 +0000
+Subject: drm/vkms: Fix memory leak in vkms_init()
+
+From: Yuan Can <yuancan@huawei.com>
+
+[ Upstream commit 0d0b368b9d104b437e1f4850ae94bdb9a3601e89 ]
+
+A memory leak was reported after the vkms module install failed.
+
+unreferenced object 0xffff88810bc28520 (size 16):
+ comm "modprobe", pid 9662, jiffies 4298009455 (age 42.590s)
+ hex dump (first 16 bytes):
+ 01 01 00 64 81 88 ff ff 00 00 dc 0a 81 88 ff ff ...d............
+ backtrace:
+ [<00000000e7561ff8>] kmalloc_trace+0x27/0x60
+ [<000000000b1954a0>] 0xffffffffc45200a9
+ [<00000000abbf1da0>] do_one_initcall+0xd0/0x4f0
+ [<000000001505ee87>] do_init_module+0x1a4/0x680
+ [<00000000958079ad>] load_module+0x6249/0x7110
+ [<00000000117e4696>] __do_sys_finit_module+0x140/0x200
+ [<00000000f74b12d2>] do_syscall_64+0x35/0x80
+ [<000000008fc6fcde>] entry_SYSCALL_64_after_hwframe+0x46/0xb0
+
+The reason is that the vkms_init() returns without checking the return
+value of vkms_create(), and if the vkms_create() failed, the config
+allocated at the beginning of vkms_init() is leaked.
+
+ vkms_init()
+ config = kmalloc(...) # config allocated
+ ...
+ return vkms_create() # vkms_create failed and config is leaked
+
+Fix this problem by checking return value of vkms_create() and free the
+config if error happened.
+
+Fixes: 2df7af93fdad ("drm/vkms: Add vkms_config type")
+Signed-off-by: Yuan Can <yuancan@huawei.com>
+Reviewed-by: Melissa Wen <mwen@igalia.com>
+Signed-off-by: Melissa Wen <melissa.srw@gmail.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20221101065156.41584-2-yuancan@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vkms/vkms_drv.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/vkms/vkms_drv.c b/drivers/gpu/drm/vkms/vkms_drv.c
+index 293dbca50c316..8a74f37d59123 100644
+--- a/drivers/gpu/drm/vkms/vkms_drv.c
++++ b/drivers/gpu/drm/vkms/vkms_drv.c
+@@ -218,6 +218,7 @@ static int vkms_create(struct vkms_config *config)
+
+ static int __init vkms_init(void)
+ {
++ int ret;
+ struct vkms_config *config;
+
+ config = kmalloc(sizeof(*config), GFP_KERNEL);
+@@ -230,7 +231,11 @@ static int __init vkms_init(void)
+ config->writeback = enable_writeback;
+ config->overlay = enable_overlay;
+
+- return vkms_create(config);
++ ret = vkms_create(config);
++ if (ret)
++ kfree(config);
++
++ return ret;
+ }
+
+ static void vkms_destroy(struct vkms_config *config)
+--
+2.39.2
+
--- /dev/null
+From e10f92ed3430aa73d00d9893b1cec404885fca0e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Nov 2022 06:51:56 +0000
+Subject: drm/vkms: Fix null-ptr-deref in vkms_release()
+
+From: Yuan Can <yuancan@huawei.com>
+
+[ Upstream commit 2fe2a8f40c21161ffe7653cc234e7934db5b7cc5 ]
+
+A null-ptr-deref is triggered when it tries to destroy the workqueue in
+vkms->output.composer_workq in vkms_release().
+
+ KASAN: null-ptr-deref in range [0x0000000000000118-0x000000000000011f]
+ CPU: 5 PID: 17193 Comm: modprobe Not tainted 6.0.0-11331-gd465bff130bf #24
+ RIP: 0010:destroy_workqueue+0x2f/0x710
+ ...
+ Call Trace:
+ <TASK>
+ ? vkms_config_debugfs_init+0x50/0x50 [vkms]
+ __devm_drm_dev_alloc+0x15a/0x1c0 [drm]
+ vkms_init+0x245/0x1000 [vkms]
+ do_one_initcall+0xd0/0x4f0
+ do_init_module+0x1a4/0x680
+ load_module+0x6249/0x7110
+ __do_sys_finit_module+0x140/0x200
+ do_syscall_64+0x35/0x80
+ entry_SYSCALL_64_after_hwframe+0x46/0xb0
+
+The reason is that an OOM happened which triggers the destroy of the
+workqueue, however, the workqueue is alloced in the later process,
+thus a null-ptr-deref happened. A simple call graph is shown as below:
+
+ vkms_init()
+ vkms_create()
+ devm_drm_dev_alloc()
+ __devm_drm_dev_alloc()
+ devm_drm_dev_init()
+ devm_add_action_or_reset()
+ devm_add_action() # an error happened
+ devm_drm_dev_init_release()
+ drm_dev_put()
+ kref_put()
+ drm_dev_release()
+ vkms_release()
+ destroy_workqueue() # null-ptr-deref happened
+ vkms_modeset_init()
+ vkms_output_init()
+ vkms_crtc_init() # where the workqueue get allocated
+
+Fix this by checking if composer_workq is NULL before passing it to
+the destroy_workqueue() in vkms_release().
+
+Fixes: 6c234fe37c57 ("drm/vkms: Implement CRC debugfs API")
+Signed-off-by: Yuan Can <yuancan@huawei.com>
+Reviewed-by: Melissa Wen <mwen@igalia.com>
+Signed-off-by: Melissa Wen <melissa.srw@gmail.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20221101065156.41584-3-yuancan@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vkms/vkms_drv.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/vkms/vkms_drv.c b/drivers/gpu/drm/vkms/vkms_drv.c
+index 8a74f37d59123..69346906ec813 100644
+--- a/drivers/gpu/drm/vkms/vkms_drv.c
++++ b/drivers/gpu/drm/vkms/vkms_drv.c
+@@ -57,7 +57,8 @@ static void vkms_release(struct drm_device *dev)
+ {
+ struct vkms_device *vkms = drm_device_to_vkms_device(dev);
+
+- destroy_workqueue(vkms->output.composer_workq);
++ if (vkms->output.composer_workq)
++ destroy_workqueue(vkms->output.composer_workq);
+ }
+
+ static void vkms_atomic_commit_tail(struct drm_atomic_state *old_state)
+--
+2.39.2
+
--- /dev/null
+From f1bb7b41e0b550de64727a375736bcc3366084c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Jan 2023 17:18:28 +0800
+Subject: dt-bindings: display: mediatek: Fix the fallback for
+ mediatek,mt8186-disp-ccorr
+
+From: Allen-KH Cheng <allen-kh.cheng@mediatek.com>
+
+[ Upstream commit 137272ef1b0f17a1815fec00d583515a0163f85e ]
+
+The mt8186-disp-ccorr is not fully compatible with the mt8183-disp-ccorr
+implementation. It causes a crash when system resumes if it binds to the
+device.
+
+We should use mt8192-disp-ccorr as fallback of mt8186-disp-ccorr.
+
+Fixes: 8a26ea19d4dc ("dt-bindings: display: mediatek: add MT8186 SoC binding")
+Signed-off-by: Allen-KH Cheng <allen-kh.cheng@mediatek.com>
+Reviewed-by: Rob Herring <robh@kernel.org>
+Reviewed-by: Matthias Brugger <matthias.bgg@gmail.com>
+Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20230118091829.755-10-allen-kh.cheng@mediatek.com/
+Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../devicetree/bindings/display/mediatek/mediatek,ccorr.yaml | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Documentation/devicetree/bindings/display/mediatek/mediatek,ccorr.yaml b/Documentation/devicetree/bindings/display/mediatek/mediatek,ccorr.yaml
+index 63fb02014a56a..117e3db43f84a 100644
+--- a/Documentation/devicetree/bindings/display/mediatek/mediatek,ccorr.yaml
++++ b/Documentation/devicetree/bindings/display/mediatek/mediatek,ccorr.yaml
+@@ -32,7 +32,7 @@ properties:
+ - items:
+ - enum:
+ - mediatek,mt8186-disp-ccorr
+- - const: mediatek,mt8183-disp-ccorr
++ - const: mediatek,mt8192-disp-ccorr
+
+ reg:
+ maxItems: 1
+--
+2.39.2
+
--- /dev/null
+From d72492ebc957103bccd611905c9437380c3b4fe4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Nov 2022 02:00:30 +0000
+Subject: eeprom: idt_89hpesx: Fix error handling in idt_init()
+
+From: Yuan Can <yuancan@huawei.com>
+
+[ Upstream commit d717a3ab282f51ec45142f911f7ef8a55c057de5 ]
+
+A problem about idt_89hpesx create debugfs failed is triggered with the
+following log given:
+
+ [ 4973.269647] debugfs: Directory 'idt_csr' with parent '/' already present!
+
+The reason is that idt_init() returns i2c_add_driver() directly without
+checking its return value, if i2c_add_driver() failed, it returns without
+destroy the newly created debugfs, resulting the debugfs of idt_csr can
+never be created later.
+
+ idt_init()
+ debugfs_create_dir() # create debugfs directory
+ i2c_add_driver()
+ driver_register()
+ bus_add_driver()
+ priv = kzalloc(...) # OOM happened
+ # return without destroy debugfs directory
+
+Fix by removing debugfs when i2c_add_driver() returns error.
+
+Fixes: cfad6425382e ("eeprom: Add IDT 89HPESx EEPROM/CSR driver")
+Signed-off-by: Yuan Can <yuancan@huawei.com>
+Acked-by: Serge Semin <fancer.lancer@gmail.com>
+Link: https://lore.kernel.org/r/20221110020030.47711-1-yuancan@huawei.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/eeprom/idt_89hpesx.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/misc/eeprom/idt_89hpesx.c b/drivers/misc/eeprom/idt_89hpesx.c
+index 4e07ee9cb500e..7075d0b378811 100644
+--- a/drivers/misc/eeprom/idt_89hpesx.c
++++ b/drivers/misc/eeprom/idt_89hpesx.c
+@@ -1566,12 +1566,20 @@ static struct i2c_driver idt_driver = {
+ */
+ static int __init idt_init(void)
+ {
++ int ret;
++
+ /* Create Debugfs directory first */
+ if (debugfs_initialized())
+ csr_dbgdir = debugfs_create_dir("idt_csr", NULL);
+
+ /* Add new i2c-device driver */
+- return i2c_add_driver(&idt_driver);
++ ret = i2c_add_driver(&idt_driver);
++ if (ret) {
++ debugfs_remove_recursive(csr_dbgdir);
++ return ret;
++ }
++
++ return 0;
+ }
+ module_init(idt_init);
+
+--
+2.39.2
+
--- /dev/null
+From abeee5c83ccc185a2ed4fa294e4d78c1e7ced3e3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Feb 2023 14:39:12 +0800
+Subject: erofs: relinquish volume with mutex held
+
+From: Jingbo Xu <jefflexu@linux.alibaba.com>
+
+[ Upstream commit 7032809a44d752b9e2275833787e0aa88a7540af ]
+
+Relinquish fscache volume with mutex held. Otherwise if a new domain is
+registered when the old domain with the same name gets removed from the
+list but not relinquished yet, fscache may complain the collision.
+
+Fixes: 8b7adf1dff3d ("erofs: introduce fscache-based domain")
+Signed-off-by: Jingbo Xu <jefflexu@linux.alibaba.com>
+Reviewed-by: Jia Zhu <zhujia.zj@bytedance.com>
+Link: https://lore.kernel.org/r/20230209063913.46341-4-jefflexu@linux.alibaba.com
+Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/erofs/fscache.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/erofs/fscache.c b/fs/erofs/fscache.c
+index 014e209623762..a7923d6661301 100644
+--- a/fs/erofs/fscache.c
++++ b/fs/erofs/fscache.c
+@@ -337,8 +337,8 @@ static void erofs_fscache_domain_put(struct erofs_domain *domain)
+ kern_unmount(erofs_pseudo_mnt);
+ erofs_pseudo_mnt = NULL;
+ }
+- mutex_unlock(&erofs_domain_list_lock);
+ fscache_relinquish_volume(domain->volume, NULL, false);
++ mutex_unlock(&erofs_domain_list_lock);
+ kfree(domain->domain_id);
+ kfree(domain);
+ return;
+--
+2.39.2
+
--- /dev/null
+From e20bf6b614a3bd5600e192bfeabe90b58561f42f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Jan 2023 11:18:20 +1000
+Subject: exit: Detect and fix irq disabled state in oops
+
+From: Nicholas Piggin <npiggin@gmail.com>
+
+[ Upstream commit 001c28e57187570e4b5aa4492c7a957fb6d65d7b ]
+
+If a task oopses with irqs disabled, this can cause various cascading
+problems in the oops path such as sleep-from-invalid warnings, and
+potentially worse.
+
+Since commit 0258b5fd7c712 ("coredump: Limit coredumps to a single
+thread group"), the unconditional irq enable in coredump_task_exit()
+will "fix" the irq state to be enabled early in do_exit(), so currently
+this may not be triggerable, but that is coincidental and fragile.
+
+Detect and fix the irqs_disabled() condition in the oops path before
+calling do_exit(), similarly to the way in_atomic() is handled.
+
+Reported-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Acked-by: "Eric W. Biederman" <ebiederm@xmission.com>
+Link: https://lore.kernel.org/lkml/20221004094401.708299-1-npiggin@gmail.com/
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/exit.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/kernel/exit.c b/kernel/exit.c
+index 15dc2ec80c467..bccfa4218356e 100644
+--- a/kernel/exit.c
++++ b/kernel/exit.c
+@@ -807,6 +807,8 @@ void __noreturn do_exit(long code)
+ struct task_struct *tsk = current;
+ int group_dead;
+
++ WARN_ON(irqs_disabled());
++
+ synchronize_group_exit(tsk, code);
+
+ WARN_ON(tsk->plug);
+@@ -938,6 +940,11 @@ void __noreturn make_task_dead(int signr)
+ if (unlikely(!tsk->pid))
+ panic("Attempted to kill the idle task!");
+
++ if (unlikely(irqs_disabled())) {
++ pr_info("note: %s[%d] exited with irqs disabled\n",
++ current->comm, task_pid_nr(current));
++ local_irq_enable();
++ }
+ if (unlikely(in_atomic())) {
+ pr_info("note: %s[%d] exited with preempt_count %d\n",
+ current->comm, task_pid_nr(current),
+--
+2.39.2
+
--- /dev/null
+From e6cd056e0158e18cd4065ea31abb4e728351f0c1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Nov 2022 09:53:26 +0800
+Subject: firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle
+
+From: Chen Zhongjin <chenzhongjin@huawei.com>
+
+[ Upstream commit 18e126e97c961f7a93823795c879d7c085fe5098 ]
+
+KASAN reported a null-ptr-deref error:
+
+KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
+CPU: 0 PID: 1373 Comm: modprobe
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)
+RIP: 0010:dmi_sysfs_entry_release
+...
+Call Trace:
+ <TASK>
+ kobject_put
+ dmi_sysfs_register_handle (drivers/firmware/dmi-sysfs.c:540) dmi_sysfs
+ dmi_decode_table (drivers/firmware/dmi_scan.c:133)
+ dmi_walk (drivers/firmware/dmi_scan.c:1115)
+ dmi_sysfs_init (drivers/firmware/dmi-sysfs.c:149) dmi_sysfs
+ do_one_initcall (init/main.c:1296)
+ ...
+Kernel panic - not syncing: Fatal exception
+Kernel Offset: 0x4000000 from 0xffffffff81000000
+---[ end Kernel panic - not syncing: Fatal exception ]---
+
+It is because previous patch added kobject_put() to release the memory
+which will call dmi_sysfs_entry_release() and list_del().
+
+However, list_add_tail(entry->list) is called after the error block,
+so the list_head is uninitialized and cannot be deleted.
+
+Move error handling to after list_add_tail to fix this.
+
+Fixes: 660ba678f999 ("firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle")
+Signed-off-by: Chen Zhongjin <chenzhongjin@huawei.com>
+Link: https://lore.kernel.org/r/20221111015326.251650-2-chenzhongjin@huawei.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/dmi-sysfs.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/firmware/dmi-sysfs.c b/drivers/firmware/dmi-sysfs.c
+index 66727ad3361b9..402217c570333 100644
+--- a/drivers/firmware/dmi-sysfs.c
++++ b/drivers/firmware/dmi-sysfs.c
+@@ -603,16 +603,16 @@ static void __init dmi_sysfs_register_handle(const struct dmi_header *dh,
+ *ret = kobject_init_and_add(&entry->kobj, &dmi_sysfs_entry_ktype, NULL,
+ "%d-%d", dh->type, entry->instance);
+
+- if (*ret) {
+- kobject_put(&entry->kobj);
+- return;
+- }
+-
+ /* Thread on the global list for cleanup */
+ spin_lock(&entry_list_lock);
+ list_add_tail(&entry->list, &entry_list);
+ spin_unlock(&entry_list_lock);
+
++ if (*ret) {
++ kobject_put(&entry->kobj);
++ return;
++ }
++
+ /* Handle specializations by type */
+ switch (dh->type) {
+ case DMI_ENTRY_SYSTEM_EVENT_LOG:
+--
+2.39.2
+
--- /dev/null
+From bd25f7579f87614dfb72d4c08d7e75c2c81b7088 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Nov 2022 10:36:01 -0600
+Subject: firmware: stratix10-svc: add missing gen_pool_destroy() in
+ stratix10_svc_drv_probe()
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit 9175ee1a99d57ec07d66ff572e1d5a724477ab37 ]
+
+In error path in stratix10_svc_drv_probe(), gen_pool_destroy() should be called
+to destroy the memory pool that created by svc_create_memory_pool().
+
+Fixes: 7ca5ce896524 ("firmware: add Intel Stratix10 service layer driver")
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
+Link: https://lore.kernel.org/r/20221129163602.462369-1-dinguyen@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/stratix10-svc.c | 16 +++++++++++-----
+ 1 file changed, 11 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/firmware/stratix10-svc.c b/drivers/firmware/stratix10-svc.c
+index b4081f4d88a37..1a5640b3ab422 100644
+--- a/drivers/firmware/stratix10-svc.c
++++ b/drivers/firmware/stratix10-svc.c
+@@ -1138,13 +1138,17 @@ static int stratix10_svc_drv_probe(struct platform_device *pdev)
+
+ /* allocate service controller and supporting channel */
+ controller = devm_kzalloc(dev, sizeof(*controller), GFP_KERNEL);
+- if (!controller)
+- return -ENOMEM;
++ if (!controller) {
++ ret = -ENOMEM;
++ goto err_destroy_pool;
++ }
+
+ chans = devm_kmalloc_array(dev, SVC_NUM_CHANNEL,
+ sizeof(*chans), GFP_KERNEL | __GFP_ZERO);
+- if (!chans)
+- return -ENOMEM;
++ if (!chans) {
++ ret = -ENOMEM;
++ goto err_destroy_pool;
++ }
+
+ controller->dev = dev;
+ controller->num_chans = SVC_NUM_CHANNEL;
+@@ -1159,7 +1163,7 @@ static int stratix10_svc_drv_probe(struct platform_device *pdev)
+ ret = kfifo_alloc(&controller->svc_fifo, fifo_size, GFP_KERNEL);
+ if (ret) {
+ dev_err(dev, "failed to allocate FIFO\n");
+- return ret;
++ goto err_destroy_pool;
+ }
+ spin_lock_init(&controller->svc_fifo_lock);
+
+@@ -1221,6 +1225,8 @@ static int stratix10_svc_drv_probe(struct platform_device *pdev)
+
+ err_free_kfifo:
+ kfifo_free(&controller->svc_fifo);
++err_destroy_pool:
++ gen_pool_destroy(genpool);
+ return ret;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 6f2982cbc2e2a617f1b56756179d1f93d1cdb917 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Nov 2022 10:36:02 -0600
+Subject: firmware: stratix10-svc: fix error handle while alloc/add device
+ failed
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit d66a4c20ae55ac88136b4a3befd944c093ffa677 ]
+
+If add device "stratix10-rsu" failed in stratix10_svc_drv_probe(),
+the 'svc_fifo' and 'genpool' need be freed in the error path.
+
+If allocate or add device "intel-fcs" failed in stratix10_svc_drv_probe(),
+the device "stratix10-rsu" need be unregistered in the error path.
+
+Fixes: e6281c26674e ("firmware: stratix10-svc: Add support for FCS")
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
+Link: https://lore.kernel.org/r/20221129163602.462369-2-dinguyen@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/stratix10-svc.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/firmware/stratix10-svc.c b/drivers/firmware/stratix10-svc.c
+index 1a5640b3ab422..bde1f543f5298 100644
+--- a/drivers/firmware/stratix10-svc.c
++++ b/drivers/firmware/stratix10-svc.c
+@@ -1202,19 +1202,20 @@ static int stratix10_svc_drv_probe(struct platform_device *pdev)
+ ret = platform_device_add(svc->stratix10_svc_rsu);
+ if (ret) {
+ platform_device_put(svc->stratix10_svc_rsu);
+- return ret;
++ goto err_free_kfifo;
+ }
+
+ svc->intel_svc_fcs = platform_device_alloc(INTEL_FCS, 1);
+ if (!svc->intel_svc_fcs) {
+ dev_err(dev, "failed to allocate %s device\n", INTEL_FCS);
+- return -ENOMEM;
++ ret = -ENOMEM;
++ goto err_unregister_dev;
+ }
+
+ ret = platform_device_add(svc->intel_svc_fcs);
+ if (ret) {
+ platform_device_put(svc->intel_svc_fcs);
+- return ret;
++ goto err_unregister_dev;
+ }
+
+ dev_set_drvdata(dev, svc);
+@@ -1223,6 +1224,8 @@ static int stratix10_svc_drv_probe(struct platform_device *pdev)
+
+ return 0;
+
++err_unregister_dev:
++ platform_device_unregister(svc->stratix10_svc_rsu);
+ err_free_kfifo:
+ kfifo_free(&controller->svc_fifo);
+ err_destroy_pool:
+--
+2.39.2
+
--- /dev/null
+From 9fd1a71ac63c632c26317c03a7329f452ec9ff9d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Jan 2023 08:35:06 +0100
+Subject: fotg210-udc: Add missing completion handler
+
+From: Fabian Vogt <fabian@ritter-vogt.de>
+
+[ Upstream commit e55f67391fa986f7357edba0ca59e668d99c3a5f ]
+
+This is used when responding to GET_STATUS requests. Without this, it
+crashes on completion.
+
+Fixes: b84a8dee23fd ("usb: gadget: add Faraday fotg210_udc driver")
+Signed-off-by: Fabian Vogt <fabian@ritter-vogt.de>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Link: https://lore.kernel.org/r/20230123073508.2350402-2-linus.walleij@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/fotg210/fotg210-udc.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+diff --git a/drivers/usb/fotg210/fotg210-udc.c b/drivers/usb/fotg210/fotg210-udc.c
+index eb076746f0320..7ba7fb52ddaac 100644
+--- a/drivers/usb/fotg210/fotg210-udc.c
++++ b/drivers/usb/fotg210/fotg210-udc.c
+@@ -710,6 +710,20 @@ static int fotg210_is_epnstall(struct fotg210_ep *ep)
+ return value & INOUTEPMPSR_STL_EP ? 1 : 0;
+ }
+
++/* For EP0 requests triggered by this driver (currently GET_STATUS response) */
++static void fotg210_ep0_complete(struct usb_ep *_ep, struct usb_request *req)
++{
++ struct fotg210_ep *ep;
++ struct fotg210_udc *fotg210;
++
++ ep = container_of(_ep, struct fotg210_ep, ep);
++ fotg210 = ep->fotg210;
++
++ if (req->status || req->actual != req->length) {
++ dev_warn(&fotg210->gadget.dev, "EP0 request failed: %d\n", req->status);
++ }
++}
++
+ static void fotg210_get_status(struct fotg210_udc *fotg210,
+ struct usb_ctrlrequest *ctrl)
+ {
+@@ -1261,6 +1275,8 @@ int fotg210_udc_probe(struct platform_device *pdev)
+ if (fotg210->ep0_req == NULL)
+ goto err_map;
+
++ fotg210->ep0_req->complete = fotg210_ep0_complete;
++
+ fotg210_init(fotg210);
+
+ fotg210_disable_unplug(fotg210);
+--
+2.39.2
+
--- /dev/null
+From 5144cc741eea71c86fa50d96ba5902c8ae1cf0f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Dec 2022 12:29:20 +0300
+Subject: fpga: microchip-spi: move SPI I/O buffers out of stack
+
+From: Ivan Bornyakov <i.bornyakov@metrotek.ru>
+
+[ Upstream commit 1da53d23a41c5f77963984d8da5623ed56918ada ]
+
+As spi-summary doc says:
+ > I/O buffers use the usual Linux rules, and must be DMA-safe.
+ > You'd normally allocate them from the heap or free page pool.
+ > Don't use the stack, or anything that's declared "static".
+
+Replace spi_write() with spi_write_then_read(), which is dma-safe for
+on-stack buffers. Use cacheline aligned buffers for transfers used in
+spi_sync_transfer().
+
+Although everything works OK with stack-located I/O buffers, better
+follow the doc to be safe.
+
+Fixes: 5f8d4a900830 ("fpga: microchip-spi: add Microchip MPF FPGA manager")
+Signed-off-by: Ivan Bornyakov <i.bornyakov@metrotek.ru>
+Acked-by: Conor Dooley <conor.dooley@microchip.com>
+Acked-by: Xu Yilun <yilun.xu@intel.com>
+Link: https://lore.kernel.org/r/20221230092922.18822-2-i.bornyakov@metrotek.ru
+Signed-off-by: Xu Yilun <yilun.xu@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/fpga/microchip-spi.c | 93 ++++++++++++++++++------------------
+ 1 file changed, 47 insertions(+), 46 deletions(-)
+
+diff --git a/drivers/fpga/microchip-spi.c b/drivers/fpga/microchip-spi.c
+index 7436976ea9048..bb69f5beefe78 100644
+--- a/drivers/fpga/microchip-spi.c
++++ b/drivers/fpga/microchip-spi.c
+@@ -42,46 +42,55 @@
+ struct mpf_priv {
+ struct spi_device *spi;
+ bool program_mode;
++ u8 tx __aligned(ARCH_KMALLOC_MINALIGN);
++ u8 rx;
+ };
+
+-static int mpf_read_status(struct spi_device *spi)
++static int mpf_read_status(struct mpf_priv *priv)
+ {
+- u8 status = 0, status_command = MPF_SPI_READ_STATUS;
+- struct spi_transfer xfers[2] = { 0 };
+- int ret;
+-
+ /*
+ * HW status is returned on MISO in the first byte after CS went
+ * active. However, first reading can be inadequate, so we submit
+ * two identical SPI transfers and use result of the later one.
+ */
+- xfers[0].tx_buf = &status_command;
+- xfers[1].tx_buf = &status_command;
+- xfers[0].rx_buf = &status;
+- xfers[1].rx_buf = &status;
+- xfers[0].len = 1;
+- xfers[1].len = 1;
+- xfers[0].cs_change = 1;
++ struct spi_transfer xfers[2] = {
++ {
++ .tx_buf = &priv->tx,
++ .rx_buf = &priv->rx,
++ .len = 1,
++ .cs_change = 1,
++ }, {
++ .tx_buf = &priv->tx,
++ .rx_buf = &priv->rx,
++ .len = 1,
++ },
++ };
++ u8 status;
++ int ret;
++
++ priv->tx = MPF_SPI_READ_STATUS;
++
++ ret = spi_sync_transfer(priv->spi, xfers, 2);
++ if (ret)
++ return ret;
+
+- ret = spi_sync_transfer(spi, xfers, 2);
++ status = priv->rx;
+
+ if ((status & MPF_STATUS_SPI_VIOLATION) ||
+ (status & MPF_STATUS_SPI_ERROR))
+- ret = -EIO;
++ return -EIO;
+
+- return ret ? : status;
++ return status;
+ }
+
+ static enum fpga_mgr_states mpf_ops_state(struct fpga_manager *mgr)
+ {
+ struct mpf_priv *priv = mgr->priv;
+- struct spi_device *spi;
+ bool program_mode;
+ int status;
+
+- spi = priv->spi;
+ program_mode = priv->program_mode;
+- status = mpf_read_status(spi);
++ status = mpf_read_status(priv);
+
+ if (!program_mode && !status)
+ return FPGA_MGR_STATE_OPERATING;
+@@ -186,12 +195,12 @@ static int mpf_ops_parse_header(struct fpga_manager *mgr,
+ }
+
+ /* Poll HW status until busy bit is cleared and mask bits are set. */
+-static int mpf_poll_status(struct spi_device *spi, u8 mask)
++static int mpf_poll_status(struct mpf_priv *priv, u8 mask)
+ {
+ int status, retries = MPF_STATUS_POLL_RETRIES;
+
+ while (retries--) {
+- status = mpf_read_status(spi);
++ status = mpf_read_status(priv);
+ if (status < 0)
+ return status;
+
+@@ -205,32 +214,32 @@ static int mpf_poll_status(struct spi_device *spi, u8 mask)
+ return -EBUSY;
+ }
+
+-static int mpf_spi_write(struct spi_device *spi, const void *buf, size_t buf_size)
++static int mpf_spi_write(struct mpf_priv *priv, const void *buf, size_t buf_size)
+ {
+- int status = mpf_poll_status(spi, 0);
++ int status = mpf_poll_status(priv, 0);
+
+ if (status < 0)
+ return status;
+
+- return spi_write(spi, buf, buf_size);
++ return spi_write_then_read(priv->spi, buf, buf_size, NULL, 0);
+ }
+
+-static int mpf_spi_write_then_read(struct spi_device *spi,
++static int mpf_spi_write_then_read(struct mpf_priv *priv,
+ const void *txbuf, size_t txbuf_size,
+ void *rxbuf, size_t rxbuf_size)
+ {
+ const u8 read_command[] = { MPF_SPI_READ_DATA };
+ int ret;
+
+- ret = mpf_spi_write(spi, txbuf, txbuf_size);
++ ret = mpf_spi_write(priv, txbuf, txbuf_size);
+ if (ret)
+ return ret;
+
+- ret = mpf_poll_status(spi, MPF_STATUS_READY);
++ ret = mpf_poll_status(priv, MPF_STATUS_READY);
+ if (ret < 0)
+ return ret;
+
+- return spi_write_then_read(spi, read_command, sizeof(read_command),
++ return spi_write_then_read(priv->spi, read_command, sizeof(read_command),
+ rxbuf, rxbuf_size);
+ }
+
+@@ -242,7 +251,6 @@ static int mpf_ops_write_init(struct fpga_manager *mgr,
+ const u8 isc_en_command[] = { MPF_SPI_ISC_ENABLE };
+ struct mpf_priv *priv = mgr->priv;
+ struct device *dev = &mgr->dev;
+- struct spi_device *spi;
+ u32 isc_ret = 0;
+ int ret;
+
+@@ -251,9 +259,7 @@ static int mpf_ops_write_init(struct fpga_manager *mgr,
+ return -EOPNOTSUPP;
+ }
+
+- spi = priv->spi;
+-
+- ret = mpf_spi_write_then_read(spi, isc_en_command, sizeof(isc_en_command),
++ ret = mpf_spi_write_then_read(priv, isc_en_command, sizeof(isc_en_command),
+ &isc_ret, sizeof(isc_ret));
+ if (ret || isc_ret) {
+ dev_err(dev, "Failed to enable ISC: spi_ret %d, isc_ret %u\n",
+@@ -261,7 +267,7 @@ static int mpf_ops_write_init(struct fpga_manager *mgr,
+ return -EFAULT;
+ }
+
+- ret = mpf_spi_write(spi, program_mode, sizeof(program_mode));
++ ret = mpf_spi_write(priv, program_mode, sizeof(program_mode));
+ if (ret) {
+ dev_err(dev, "Failed to enter program mode: %d\n", ret);
+ return ret;
+@@ -274,11 +280,9 @@ static int mpf_ops_write_init(struct fpga_manager *mgr,
+
+ static int mpf_ops_write(struct fpga_manager *mgr, const char *buf, size_t count)
+ {
+- u8 spi_frame_command[] = { MPF_SPI_FRAME };
+ struct spi_transfer xfers[2] = { 0 };
+ struct mpf_priv *priv = mgr->priv;
+ struct device *dev = &mgr->dev;
+- struct spi_device *spi;
+ int ret, i;
+
+ if (count % MPF_SPI_FRAME_SIZE) {
+@@ -287,18 +291,18 @@ static int mpf_ops_write(struct fpga_manager *mgr, const char *buf, size_t count
+ return -EINVAL;
+ }
+
+- spi = priv->spi;
+-
+- xfers[0].tx_buf = spi_frame_command;
+- xfers[0].len = sizeof(spi_frame_command);
++ xfers[0].tx_buf = &priv->tx;
++ xfers[0].len = 1;
+
+ for (i = 0; i < count / MPF_SPI_FRAME_SIZE; i++) {
+ xfers[1].tx_buf = buf + i * MPF_SPI_FRAME_SIZE;
+ xfers[1].len = MPF_SPI_FRAME_SIZE;
+
+- ret = mpf_poll_status(spi, 0);
+- if (ret >= 0)
+- ret = spi_sync_transfer(spi, xfers, ARRAY_SIZE(xfers));
++ ret = mpf_poll_status(priv, 0);
++ if (ret >= 0) {
++ priv->tx = MPF_SPI_FRAME;
++ ret = spi_sync_transfer(priv->spi, xfers, ARRAY_SIZE(xfers));
++ }
+
+ if (ret) {
+ dev_err(dev, "Failed to write bitstream frame %d/%zu\n",
+@@ -317,12 +321,9 @@ static int mpf_ops_write_complete(struct fpga_manager *mgr,
+ const u8 release_command[] = { MPF_SPI_RELEASE };
+ struct mpf_priv *priv = mgr->priv;
+ struct device *dev = &mgr->dev;
+- struct spi_device *spi;
+ int ret;
+
+- spi = priv->spi;
+-
+- ret = mpf_spi_write(spi, isc_dis_command, sizeof(isc_dis_command));
++ ret = mpf_spi_write(priv, isc_dis_command, sizeof(isc_dis_command));
+ if (ret) {
+ dev_err(dev, "Failed to disable ISC: %d\n", ret);
+ return ret;
+@@ -330,7 +331,7 @@ static int mpf_ops_write_complete(struct fpga_manager *mgr,
+
+ usleep_range(1000, 2000);
+
+- ret = mpf_spi_write(spi, release_command, sizeof(release_command));
++ ret = mpf_spi_write(priv, release_command, sizeof(release_command));
+ if (ret) {
+ dev_err(dev, "Failed to exit program mode: %d\n", ret);
+ return ret;
+--
+2.39.2
+
--- /dev/null
+From 0a01d23ea3d5cfdbc5f3a5ae2326897836e06e90 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Dec 2022 12:29:21 +0300
+Subject: fpga: microchip-spi: rewrite status polling in a time measurable way
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ivan Bornyakov <i.bornyakov@metrotek.ru>
+
+[ Upstream commit 88e705697e801299a13ecaf2ba54599964fe711c ]
+
+Original busy loop with retries count in mpf_poll_status() is not too
+reliable, as it takes different times on different systems. Replace it
+with read_poll_timeout() macro.
+
+While at it, fix polling stop condition to met function's original
+intention declared in the comment. The issue with original polling stop
+condition is that it stops if any of mask bits is set, while intention
+was to stop if all mask bits is set. This was not noticible because only
+MPF_STATUS_READY is passed as mask argument and it is BIT(1).
+
+Fixes: 5f8d4a900830 ("fpga: microchip-spi: add Microchip MPF FPGA manager")
+Signed-off-by: Ivan Bornyakov <i.bornyakov@metrotek.ru>
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Acked-by: Conor Dooley <conor.dooley@microchip.com>
+Acked-by: Xu Yilun <yilun.xu@intel.com>
+Link: https://lore.kernel.org/r/20221230092922.18822-3-i.bornyakov@metrotek.ru
+Signed-off-by: Xu Yilun <yilun.xu@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/fpga/microchip-spi.c | 32 +++++++++++++++++---------------
+ 1 file changed, 17 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/fpga/microchip-spi.c b/drivers/fpga/microchip-spi.c
+index bb69f5beefe78..137fafdf57a6f 100644
+--- a/drivers/fpga/microchip-spi.c
++++ b/drivers/fpga/microchip-spi.c
+@@ -6,6 +6,7 @@
+ #include <asm/unaligned.h>
+ #include <linux/delay.h>
+ #include <linux/fpga/fpga-mgr.h>
++#include <linux/iopoll.h>
+ #include <linux/module.h>
+ #include <linux/of_device.h>
+ #include <linux/spi/spi.h>
+@@ -33,7 +34,7 @@
+
+ #define MPF_BITS_PER_COMPONENT_SIZE 22
+
+-#define MPF_STATUS_POLL_RETRIES 10000
++#define MPF_STATUS_POLL_TIMEOUT (2 * USEC_PER_SEC)
+ #define MPF_STATUS_BUSY BIT(0)
+ #define MPF_STATUS_READY BIT(1)
+ #define MPF_STATUS_SPI_VIOLATION BIT(2)
+@@ -194,24 +195,25 @@ static int mpf_ops_parse_header(struct fpga_manager *mgr,
+ return 0;
+ }
+
+-/* Poll HW status until busy bit is cleared and mask bits are set. */
+ static int mpf_poll_status(struct mpf_priv *priv, u8 mask)
+ {
+- int status, retries = MPF_STATUS_POLL_RETRIES;
++ int ret, status;
+
+- while (retries--) {
+- status = mpf_read_status(priv);
+- if (status < 0)
+- return status;
+-
+- if (status & MPF_STATUS_BUSY)
+- continue;
+-
+- if (!mask || (status & mask))
+- return status;
+- }
++ /*
++ * Busy poll HW status. Polling stops if any of the following
++ * conditions are met:
++ * - timeout is reached
++ * - mpf_read_status() returns an error
++ * - busy bit is cleared AND mask bits are set
++ */
++ ret = read_poll_timeout(mpf_read_status, status,
++ (status < 0) ||
++ ((status & (MPF_STATUS_BUSY | mask)) == mask),
++ 0, MPF_STATUS_POLL_TIMEOUT, false, priv);
++ if (ret < 0)
++ return ret;
+
+- return -EBUSY;
++ return status;
+ }
+
+ static int mpf_spi_write(struct mpf_priv *priv, const void *buf, size_t buf_size)
+--
+2.39.2
+
--- /dev/null
+From 215d29de6da1368ac59b1ccba322664e28f779c6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Jan 2023 19:37:49 +0800
+Subject: fs: dlm: fix return value check in dlm_memory_init()
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit 8113aa91360a013ebe00763bb0823b5a41b11c4d ]
+
+It should check 'cb_cache', after calling kmem_cache_create("dlm_cb").
+
+Fixes: 61bed0baa4db ("fs: dlm: use a non-static queue for callbacks")
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Signed-off-by: David Teigland <teigland@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/dlm/memory.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/dlm/memory.c b/fs/dlm/memory.c
+index eb7a08641fcf5..cdbaa452fc05a 100644
+--- a/fs/dlm/memory.c
++++ b/fs/dlm/memory.c
+@@ -51,7 +51,7 @@ int __init dlm_memory_init(void)
+ cb_cache = kmem_cache_create("dlm_cb", sizeof(struct dlm_callback),
+ __alignof__(struct dlm_callback), 0,
+ NULL);
+- if (!rsb_cache)
++ if (!cb_cache)
+ goto cb;
+
+ return 0;
+--
+2.39.2
+
--- /dev/null
+From 9a130f704610edcbc6a140df733a27c01ad92719 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Jan 2023 20:14:25 +0100
+Subject: fs: Use CHECK_DATA_CORRUPTION() when kernel bugs are detected
+
+From: Jann Horn <jannh@google.com>
+
+[ Upstream commit 47d586913f2abec4d240bae33417f537fda987ec ]
+
+Currently, filp_close() and generic_shutdown_super() use printk() to log
+messages when bugs are detected. This is problematic because infrastructure
+like syzkaller has no idea that this message indicates a bug.
+In addition, some people explicitly want their kernels to BUG() when kernel
+data corruption has been detected (CONFIG_BUG_ON_DATA_CORRUPTION).
+And finally, when generic_shutdown_super() detects remaining inodes on a
+system without CONFIG_BUG_ON_DATA_CORRUPTION, it would be nice if later
+accesses to a busy inode would at least crash somewhat cleanly rather than
+walking through freed memory.
+
+To address all three, use CHECK_DATA_CORRUPTION() when kernel bugs are
+detected.
+
+Signed-off-by: Jann Horn <jannh@google.com>
+Reviewed-by: Christian Brauner (Microsoft) <brauner@kernel.org>
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Christian Brauner (Microsoft) <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/open.c | 5 +++--
+ fs/super.c | 21 +++++++++++++++++----
+ include/linux/poison.h | 3 +++
+ 3 files changed, 23 insertions(+), 6 deletions(-)
+
+diff --git a/fs/open.c b/fs/open.c
+index 82c1a28b33089..ceb88ac0ca3b2 100644
+--- a/fs/open.c
++++ b/fs/open.c
+@@ -1411,8 +1411,9 @@ int filp_close(struct file *filp, fl_owner_t id)
+ {
+ int retval = 0;
+
+- if (!file_count(filp)) {
+- printk(KERN_ERR "VFS: Close: file count is 0\n");
++ if (CHECK_DATA_CORRUPTION(file_count(filp) == 0,
++ "VFS: Close: file count is 0 (f_op=%ps)",
++ filp->f_op)) {
+ return 0;
+ }
+
+diff --git a/fs/super.c b/fs/super.c
+index 12c08cb20405d..cf737ec2bd05c 100644
+--- a/fs/super.c
++++ b/fs/super.c
+@@ -491,10 +491,23 @@ void generic_shutdown_super(struct super_block *sb)
+ if (sop->put_super)
+ sop->put_super(sb);
+
+- if (!list_empty(&sb->s_inodes)) {
+- printk("VFS: Busy inodes after unmount of %s. "
+- "Self-destruct in 5 seconds. Have a nice day...\n",
+- sb->s_id);
++ if (CHECK_DATA_CORRUPTION(!list_empty(&sb->s_inodes),
++ "VFS: Busy inodes after unmount of %s (%s)",
++ sb->s_id, sb->s_type->name)) {
++ /*
++ * Adding a proper bailout path here would be hard, but
++ * we can at least make it more likely that a later
++ * iput_final() or such crashes cleanly.
++ */
++ struct inode *inode;
++
++ spin_lock(&sb->s_inode_list_lock);
++ list_for_each_entry(inode, &sb->s_inodes, i_sb_list) {
++ inode->i_op = VFS_PTR_POISON;
++ inode->i_sb = VFS_PTR_POISON;
++ inode->i_mapping = VFS_PTR_POISON;
++ }
++ spin_unlock(&sb->s_inode_list_lock);
+ }
+ }
+ spin_lock(&sb_lock);
+diff --git a/include/linux/poison.h b/include/linux/poison.h
+index 2d3249eb0e62d..0e8a1f2ceb2f1 100644
+--- a/include/linux/poison.h
++++ b/include/linux/poison.h
+@@ -84,4 +84,7 @@
+ /********** kernel/bpf/ **********/
+ #define BPF_PTR_POISON ((void *)(0xeB9FUL + POISON_POINTER_DELTA))
+
++/********** VFS **********/
++#define VFS_PTR_POISON ((void *)(0xF5 + POISON_POINTER_DELTA))
++
+ #endif
+--
+2.39.2
+
--- /dev/null
+From 30b1f3a7760bb2cd45c1195c6656f853e38b806c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Feb 2023 23:00:09 +0000
+Subject: gcc-plugins: drop -std=gnu++11 to fix GCC 13 build
+
+From: Sam James <sam@gentoo.org>
+
+[ Upstream commit 5a6b64adc18d9adfb497a529ff004d59b6df151f ]
+
+The latest GCC 13 snapshot (13.0.1 20230129) gives the following:
+```
+cc1: error: cannot load plugin ./scripts/gcc-plugins/randomize_layout_plugin.so
+ :./scripts/gcc-plugins/randomize_layout_plugin.so: undefined symbol: tree_code_type
+```
+
+This ends up being because of https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=b0241ce6e37031
+upstream in GCC which changes the visibility of some types used by the kernel's
+plugin infrastructure like tree_code_type.
+
+After discussion with the GCC folks, we found that the kernel needs to be building
+plugins with the same flags used to build GCC - and GCC defaults to gnu++17
+right now. The minimum GCC version needed to build the kernel is GCC 5.1
+and GCC 5.1 already defaults to gnu++14 anyway, so just drop the flag, as
+all GCCs that could be used to build GCC already default to an acceptable
+version which was >= the version we forced via flags until now.
+
+Bug: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108634
+Signed-off-by: Sam James <sam@gentoo.org>
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Link: https://lore.kernel.org/r/20230201230009.2252783-1-sam@gentoo.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/gcc-plugins/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/scripts/gcc-plugins/Makefile b/scripts/gcc-plugins/Makefile
+index b34d11e226366..320afd3cf8e82 100644
+--- a/scripts/gcc-plugins/Makefile
++++ b/scripts/gcc-plugins/Makefile
+@@ -29,7 +29,7 @@ GCC_PLUGINS_DIR = $(shell $(CC) -print-file-name=plugin)
+ plugin_cxxflags = -Wp,-MMD,$(depfile) $(KBUILD_HOSTCXXFLAGS) -fPIC \
+ -include $(srctree)/include/linux/compiler-version.h \
+ -DPLUGIN_VERSION=$(call stringify,$(KERNELVERSION)) \
+- -I $(GCC_PLUGINS_DIR)/include -I $(obj) -std=gnu++11 \
++ -I $(GCC_PLUGINS_DIR)/include -I $(obj) \
+ -fno-rtti -fno-exceptions -fasynchronous-unwind-tables \
+ -ggdb -Wno-narrowing -Wno-unused-variable \
+ -Wno-format-diag
+--
+2.39.2
+
--- /dev/null
+From 16f6e0ec7ad2d7b11f5ec48c281bb9a8936dfdb5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 19 Nov 2022 17:25:03 +0800
+Subject: genirq: Fix the return type of kstat_cpu_irqs_sum()
+
+From: Zhen Lei <thunder.leizhen@huawei.com>
+
+[ Upstream commit 47904aed898a08f028572b9b5a5cc101ddfb2d82 ]
+
+The type of member ->irqs_sum is unsigned long, but kstat_cpu_irqs_sum()
+returns int, which can result in truncation. Therefore, change the
+kstat_cpu_irqs_sum() function's return value to unsigned long to avoid
+truncation.
+
+Fixes: f2c66cd8eedd ("/proc/stat: scalability of irq num per cpu")
+Reported-by: Elliott, Robert (Servers) <elliott@hpe.com>
+Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
+Cc: Tejun Heo <tj@kernel.org>
+Cc: "Peter Zijlstra (Intel)" <peterz@infradead.org>
+Cc: Josh Don <joshdon@google.com>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Reviewed-by: Frederic Weisbecker <frederic@kernel.org>
+Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/kernel_stat.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/kernel_stat.h b/include/linux/kernel_stat.h
+index ddb5a358fd829..90e2fdc17d79f 100644
+--- a/include/linux/kernel_stat.h
++++ b/include/linux/kernel_stat.h
+@@ -75,7 +75,7 @@ extern unsigned int kstat_irqs_usr(unsigned int irq);
+ /*
+ * Number of interrupts per cpu, since bootup
+ */
+-static inline unsigned int kstat_cpu_irqs_sum(unsigned int cpu)
++static inline unsigned long kstat_cpu_irqs_sum(unsigned int cpu)
+ {
+ return kstat_cpu(cpu).irqs_sum;
+ }
+--
+2.39.2
+
--- /dev/null
+From f9e6bf3f2042a5211e727cc4777ef962058ff455 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Jan 2023 15:06:53 +0100
+Subject: gfs2: Improve gfs2_make_fs_rw error handling
+
+From: Andreas Gruenbacher <agruenba@redhat.com>
+
+[ Upstream commit b66f723bb552ad59c2acb5d45ea45c890f84498b ]
+
+In gfs2_make_fs_rw(), make sure to call gfs2_consist() to report an
+inconsistency and mark the filesystem as withdrawn when
+gfs2_find_jhead() fails.
+
+At the end of gfs2_make_fs_rw(), when we discover that the filesystem
+has been withdrawn, make sure we report an error. This also replaces
+the gfs2_withdrawn() check after gfs2_find_jhead().
+
+Reported-by: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
+Cc: syzbot+f51cb4b9afbd87ec06f2@syzkaller.appspotmail.com
+Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/gfs2/super.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c
+index 999cc146d7083..a07cf31f58ec3 100644
+--- a/fs/gfs2/super.c
++++ b/fs/gfs2/super.c
+@@ -138,8 +138,10 @@ int gfs2_make_fs_rw(struct gfs2_sbd *sdp)
+ return -EIO;
+
+ error = gfs2_find_jhead(sdp->sd_jdesc, &head, false);
+- if (error || gfs2_withdrawn(sdp))
++ if (error) {
++ gfs2_consist(sdp);
+ return error;
++ }
+
+ if (!(head.lh_flags & GFS2_LOG_HEAD_UNMOUNT)) {
+ gfs2_consist(sdp);
+@@ -151,7 +153,9 @@ int gfs2_make_fs_rw(struct gfs2_sbd *sdp)
+ gfs2_log_pointers_init(sdp, head.lh_blkno);
+
+ error = gfs2_quota_init(sdp);
+- if (!error && !gfs2_withdrawn(sdp))
++ if (!error && gfs2_withdrawn(sdp))
++ error = -EIO;
++ if (!error)
+ set_bit(SDF_JOURNAL_LIVE, &sdp->sd_flags);
+ return error;
+ }
+--
+2.39.2
+
--- /dev/null
+From 85cfb8b17c1d2a04c6f48d7e0a63ee95af5c5288 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Feb 2023 15:08:50 +0100
+Subject: gfs2: jdata writepage fix
+
+From: Andreas Gruenbacher <agruenba@redhat.com>
+
+[ Upstream commit cbb60951ce18c9b6e91d2eb97deb41d8ff616622 ]
+
+The ->writepage() and ->writepages() operations are supposed to write
+entire pages. However, on filesystems with a block size smaller than
+PAGE_SIZE, __gfs2_jdata_writepage() only adds the first block to the
+current transaction instead of adding the entire page. Fix that.
+
+Fixes: 18ec7d5c3f43 ("[GFS2] Make journaled data files identical to normal files on disk")
+Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/gfs2/aops.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/fs/gfs2/aops.c b/fs/gfs2/aops.c
+index e782b4f1d1043..2f04c0ff7470b 100644
+--- a/fs/gfs2/aops.c
++++ b/fs/gfs2/aops.c
+@@ -127,7 +127,6 @@ static int __gfs2_jdata_writepage(struct page *page, struct writeback_control *w
+ {
+ struct inode *inode = page->mapping->host;
+ struct gfs2_inode *ip = GFS2_I(inode);
+- struct gfs2_sbd *sdp = GFS2_SB(inode);
+
+ if (PageChecked(page)) {
+ ClearPageChecked(page);
+@@ -135,7 +134,7 @@ static int __gfs2_jdata_writepage(struct page *page, struct writeback_control *w
+ create_empty_buffers(page, inode->i_sb->s_blocksize,
+ BIT(BH_Dirty)|BIT(BH_Uptodate));
+ }
+- gfs2_page_add_databufs(ip, page, 0, sdp->sd_vfs->s_blocksize);
++ gfs2_page_add_databufs(ip, page, 0, PAGE_SIZE);
+ }
+ return gfs2_write_jdata_page(page, wbc);
+ }
+--
+2.39.2
+
--- /dev/null
+From 2658e8cfeecdec77fc2fe0fd4f4a10cff1d4c5a4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Dec 2022 11:00:44 +0100
+Subject: gpio: pca9570: rename platform_data to chip_data
+
+From: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+
+[ Upstream commit a3f7c1d6ddcbd487964c58ff246506a781e5be8f ]
+
+By convention platform_data refers to structures passed to drivers by
+code that registers devices. When talking about model-specific data
+structures associated with OF compatibles, we usually call them chip_data.
+
+In order to avoid confusion rename all mentions of platform_data to
+chip_data.
+
+Fixes: fbb19fe17eae ("gpio: pca9570: add slg7xl45106 support")
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-pca9570.c | 24 ++++++++++++------------
+ 1 file changed, 12 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/gpio/gpio-pca9570.c b/drivers/gpio/gpio-pca9570.c
+index 6c07a8811a7a5..6a5a8e593ed55 100644
+--- a/drivers/gpio/gpio-pca9570.c
++++ b/drivers/gpio/gpio-pca9570.c
+@@ -18,11 +18,11 @@
+ #define SLG7XL45106_GPO_REG 0xDB
+
+ /**
+- * struct pca9570_platform_data - GPIO platformdata
++ * struct pca9570_chip_data - GPIO platformdata
+ * @ngpio: no of gpios
+ * @command: Command to be sent
+ */
+-struct pca9570_platform_data {
++struct pca9570_chip_data {
+ u16 ngpio;
+ u32 command;
+ };
+@@ -36,7 +36,7 @@ struct pca9570_platform_data {
+ */
+ struct pca9570 {
+ struct gpio_chip chip;
+- const struct pca9570_platform_data *p_data;
++ const struct pca9570_chip_data *chip_data;
+ struct mutex lock;
+ u8 out;
+ };
+@@ -46,8 +46,8 @@ static int pca9570_read(struct pca9570 *gpio, u8 *value)
+ struct i2c_client *client = to_i2c_client(gpio->chip.parent);
+ int ret;
+
+- if (gpio->p_data->command != 0)
+- ret = i2c_smbus_read_byte_data(client, gpio->p_data->command);
++ if (gpio->chip_data->command != 0)
++ ret = i2c_smbus_read_byte_data(client, gpio->chip_data->command);
+ else
+ ret = i2c_smbus_read_byte(client);
+
+@@ -62,8 +62,8 @@ static int pca9570_write(struct pca9570 *gpio, u8 value)
+ {
+ struct i2c_client *client = to_i2c_client(gpio->chip.parent);
+
+- if (gpio->p_data->command != 0)
+- return i2c_smbus_write_byte_data(client, gpio->p_data->command, value);
++ if (gpio->chip_data->command != 0)
++ return i2c_smbus_write_byte_data(client, gpio->chip_data->command, value);
+
+ return i2c_smbus_write_byte(client, value);
+ }
+@@ -127,8 +127,8 @@ static int pca9570_probe(struct i2c_client *client)
+ gpio->chip.get = pca9570_get;
+ gpio->chip.set = pca9570_set;
+ gpio->chip.base = -1;
+- gpio->p_data = device_get_match_data(&client->dev);
+- gpio->chip.ngpio = gpio->p_data->ngpio;
++ gpio->chip_data = device_get_match_data(&client->dev);
++ gpio->chip.ngpio = gpio->chip_data->ngpio;
+ gpio->chip.can_sleep = true;
+
+ mutex_init(&gpio->lock);
+@@ -141,15 +141,15 @@ static int pca9570_probe(struct i2c_client *client)
+ return devm_gpiochip_add_data(&client->dev, &gpio->chip, gpio);
+ }
+
+-static const struct pca9570_platform_data pca9570_gpio = {
++static const struct pca9570_chip_data pca9570_gpio = {
+ .ngpio = 4,
+ };
+
+-static const struct pca9570_platform_data pca9571_gpio = {
++static const struct pca9570_chip_data pca9571_gpio = {
+ .ngpio = 8,
+ };
+
+-static const struct pca9570_platform_data slg7xl45106_gpio = {
++static const struct pca9570_chip_data slg7xl45106_gpio = {
+ .ngpio = 8,
+ .command = SLG7XL45106_GPO_REG,
+ };
+--
+2.39.2
+
--- /dev/null
+From 5daa19d5a1201aa5046deae05f9d29e65f50fe4b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Dec 2022 17:02:47 +0800
+Subject: gpio: vf610: connect GPIO label to dev name
+
+From: Haibo Chen <haibo.chen@nxp.com>
+
+[ Upstream commit 6f8ecb7f85f441eb7d78ba2a4df45ee8a821934e ]
+
+Current GPIO label is fixed, so can't distinguish different GPIO
+controllers through labels. Use dev name instead.
+
+Fixes: 7f2691a19627 ("gpio: vf610: add gpiolib/IRQ chip driver for Vybrid")
+Signed-off-by: Clark Wang <xiaoning.wang@nxp.com>
+Signed-off-by: Haibo Chen <haibo.chen@nxp.com>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-vf610.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpio/gpio-vf610.c b/drivers/gpio/gpio-vf610.c
+index 9033db00c360d..d3f3a69d49077 100644
+--- a/drivers/gpio/gpio-vf610.c
++++ b/drivers/gpio/gpio-vf610.c
+@@ -317,7 +317,7 @@ static int vf610_gpio_probe(struct platform_device *pdev)
+
+ gc = &port->gc;
+ gc->parent = dev;
+- gc->label = "vf610-gpio";
++ gc->label = dev_name(dev);
+ gc->ngpio = VF610_GPIO_PER_PORT;
+ gc->base = of_alias_get_id(np, "gpio") * VF610_GPIO_PER_PORT;
+
+--
+2.39.2
+
--- /dev/null
+From b7f736a687f57621f9d40ea8710b173f2d5f2fe9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Jan 2023 15:39:00 +0200
+Subject: gpu: host1x: Don't skip assigning syncpoints to channels
+
+From: Mikko Perttunen <mperttunen@nvidia.com>
+
+[ Upstream commit eb258cc1fd458e584082be987dbc6ec42668c05e ]
+
+The code to write the syncpoint channel assignment register
+incorrectly skips the write if hypervisor registers are not available.
+
+The register, however, is within the guest aperture so remove the
+check and assign syncpoints properly even on virtualized systems.
+
+Fixes: c3f52220f276 ("gpu: host1x: Enable Tegra186 syncpoint protection")
+Signed-off-by: Mikko Perttunen <mperttunen@nvidia.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/host1x/hw/syncpt_hw.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/drivers/gpu/host1x/hw/syncpt_hw.c b/drivers/gpu/host1x/hw/syncpt_hw.c
+index dd39d67ccec36..8cf35b2eff3db 100644
+--- a/drivers/gpu/host1x/hw/syncpt_hw.c
++++ b/drivers/gpu/host1x/hw/syncpt_hw.c
+@@ -106,9 +106,6 @@ static void syncpt_assign_to_channel(struct host1x_syncpt *sp,
+ #if HOST1X_HW >= 6
+ struct host1x *host = sp->host;
+
+- if (!host->hv_regs)
+- return;
+-
+ host1x_sync_writel(host,
+ HOST1X_SYNC_SYNCPT_CH_APP_CH(ch ? ch->id : 0xff),
+ HOST1X_SYNC_SYNCPT_CH_APP(sp->id));
+--
+2.39.2
+
--- /dev/null
+From 67e583ef7365be9bd9217c93ef5eab0ff6b89d2e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Jan 2023 15:38:59 +0200
+Subject: gpu: host1x: Fix mask for syncpoint increment register
+
+From: Mikko Perttunen <mperttunen@nvidia.com>
+
+[ Upstream commit 79aad29c7d2d2cd64790115d3a6ebac28c00a8ec ]
+
+On Tegra186+, the syncpoint ID has 10 bits of space. To allow
+using more than 256 syncpoints, fix the mask.
+
+Fixes: 9abdd497cd0a ("gpu: host1x: Tegra234 device data and headers")
+Signed-off-by: Mikko Perttunen <mperttunen@nvidia.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/host1x/hw/hw_host1x06_uclass.h | 2 +-
+ drivers/gpu/host1x/hw/hw_host1x07_uclass.h | 2 +-
+ drivers/gpu/host1x/hw/hw_host1x08_uclass.h | 2 +-
+ 3 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/host1x/hw/hw_host1x06_uclass.h b/drivers/gpu/host1x/hw/hw_host1x06_uclass.h
+index 5f831438d19bb..50c32de452fb1 100644
+--- a/drivers/gpu/host1x/hw/hw_host1x06_uclass.h
++++ b/drivers/gpu/host1x/hw/hw_host1x06_uclass.h
+@@ -53,7 +53,7 @@ static inline u32 host1x_uclass_incr_syncpt_cond_f(u32 v)
+ host1x_uclass_incr_syncpt_cond_f(v)
+ static inline u32 host1x_uclass_incr_syncpt_indx_f(u32 v)
+ {
+- return (v & 0xff) << 0;
++ return (v & 0x3ff) << 0;
+ }
+ #define HOST1X_UCLASS_INCR_SYNCPT_INDX_F(v) \
+ host1x_uclass_incr_syncpt_indx_f(v)
+diff --git a/drivers/gpu/host1x/hw/hw_host1x07_uclass.h b/drivers/gpu/host1x/hw/hw_host1x07_uclass.h
+index 8cd2ef087d5d0..887b878f92f79 100644
+--- a/drivers/gpu/host1x/hw/hw_host1x07_uclass.h
++++ b/drivers/gpu/host1x/hw/hw_host1x07_uclass.h
+@@ -53,7 +53,7 @@ static inline u32 host1x_uclass_incr_syncpt_cond_f(u32 v)
+ host1x_uclass_incr_syncpt_cond_f(v)
+ static inline u32 host1x_uclass_incr_syncpt_indx_f(u32 v)
+ {
+- return (v & 0xff) << 0;
++ return (v & 0x3ff) << 0;
+ }
+ #define HOST1X_UCLASS_INCR_SYNCPT_INDX_F(v) \
+ host1x_uclass_incr_syncpt_indx_f(v)
+diff --git a/drivers/gpu/host1x/hw/hw_host1x08_uclass.h b/drivers/gpu/host1x/hw/hw_host1x08_uclass.h
+index 724cccd71aa1a..4fb1d090edae5 100644
+--- a/drivers/gpu/host1x/hw/hw_host1x08_uclass.h
++++ b/drivers/gpu/host1x/hw/hw_host1x08_uclass.h
+@@ -53,7 +53,7 @@ static inline u32 host1x_uclass_incr_syncpt_cond_f(u32 v)
+ host1x_uclass_incr_syncpt_cond_f(v)
+ static inline u32 host1x_uclass_incr_syncpt_indx_f(u32 v)
+ {
+- return (v & 0xff) << 0;
++ return (v & 0x3ff) << 0;
+ }
+ #define HOST1X_UCLASS_INCR_SYNCPT_INDX_F(v) \
+ host1x_uclass_incr_syncpt_indx_f(v)
+--
+2.39.2
+
--- /dev/null
+From f38e00f44ed4da791dd29cb4c8a580e88f844f69 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Jul 2022 23:22:27 +0800
+Subject: gpu: ipu-v3: common: Add of_node_put() for reference returned by
+ of_graph_get_port_by_id()
+
+From: Liang He <windhl@126.com>
+
+[ Upstream commit 9afdf98cfdfa2ba8ec068cf08c5fcdc1ed8daf3f ]
+
+In ipu_add_client_devices(), we need to call of_node_put() for
+reference returned by of_graph_get_port_by_id() in fail path.
+
+Fixes: 17e052175039 ("gpu: ipu-v3: Do not bail out on missing optional port nodes")
+Signed-off-by: Liang He <windhl@126.com>
+Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
+Link: https://lore.kernel.org/r/20220720152227.1288413-1-windhl@126.com
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+Link: https://patchwork.freedesktop.org/patch/msgid/20220720152227.1288413-1-windhl@126.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/ipu-v3/ipu-common.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/ipu-v3/ipu-common.c b/drivers/gpu/ipu-v3/ipu-common.c
+index 118318513e2d2..c35eac1116f5f 100644
+--- a/drivers/gpu/ipu-v3/ipu-common.c
++++ b/drivers/gpu/ipu-v3/ipu-common.c
+@@ -1165,6 +1165,7 @@ static int ipu_add_client_devices(struct ipu_soc *ipu, unsigned long ipu_base)
+ pdev = platform_device_alloc(reg->name, id++);
+ if (!pdev) {
+ ret = -ENOMEM;
++ of_node_put(of_node);
+ goto err_register;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 42b25510d076a96d8346859a738c269915b815cf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 8 Jan 2023 17:33:44 +0200
+Subject: habanalabs: bugs fixes in timestamps buff alloc
+
+From: farah kassabri <fkassabri@habana.ai>
+
+[ Upstream commit 1693fef9e95dbe8ab767d208a02328fff13fbb94 ]
+
+use argument instead of fixed GFP value for allocation
+in Timestamps buffers alloc function.
+change data type of size to size_t.
+
+Fixes: 9158bf69e74f ("habanalabs: Timestamps buffers registration")
+Signed-off-by: farah kassabri <fkassabri@habana.ai>
+Reviewed-by: Oded Gabbay <ogabbay@kernel.org>
+Signed-off-by: Oded Gabbay <ogabbay@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/habanalabs/common/memory.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/misc/habanalabs/common/memory.c b/drivers/misc/habanalabs/common/memory.c
+index 5e9ae7600d75e..047306e33baad 100644
+--- a/drivers/misc/habanalabs/common/memory.c
++++ b/drivers/misc/habanalabs/common/memory.c
+@@ -2089,12 +2089,13 @@ static int hl_ts_mmap(struct hl_mmap_mem_buf *buf, struct vm_area_struct *vma, v
+ static int hl_ts_alloc_buf(struct hl_mmap_mem_buf *buf, gfp_t gfp, void *args)
+ {
+ struct hl_ts_buff *ts_buff = NULL;
+- u32 size, num_elements;
++ u32 num_elements;
++ size_t size;
+ void *p;
+
+ num_elements = *(u32 *)args;
+
+- ts_buff = kzalloc(sizeof(*ts_buff), GFP_KERNEL);
++ ts_buff = kzalloc(sizeof(*ts_buff), gfp);
+ if (!ts_buff)
+ return -ENOMEM;
+
+--
+2.39.2
+
--- /dev/null
+From ce9d5eb70aafb9df40946fe147045a0f4f0ec387 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Dec 2022 12:44:09 +0200
+Subject: habanalabs: extend fatal messages to contain PCI info
+
+From: Moti Haimovski <mhaimovski@habana.ai>
+
+[ Upstream commit 2a0a839b6a28f7c4c528bb75b740c7f38ef79a37 ]
+
+This commit attaches the PCI device address to driver fatal messages
+in order to ease debugging in multi-device setups.
+
+Signed-off-by: Moti Haimovski <mhaimovski@habana.ai>
+Reviewed-by: Oded Gabbay <ogabbay@kernel.org>
+Signed-off-by: Oded Gabbay <ogabbay@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/habanalabs/common/device.c | 38 ++++++++++++++++---------
+ 1 file changed, 25 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/misc/habanalabs/common/device.c b/drivers/misc/habanalabs/common/device.c
+index 87ab329e65d49..f7b9c3871518b 100644
+--- a/drivers/misc/habanalabs/common/device.c
++++ b/drivers/misc/habanalabs/common/device.c
+@@ -1566,7 +1566,8 @@ int hl_device_reset(struct hl_device *hdev, u32 flags)
+ if (rc == -EBUSY) {
+ if (hdev->device_fini_pending) {
+ dev_crit(hdev->dev,
+- "Failed to kill all open processes, stopping hard reset\n");
++ "%s Failed to kill all open processes, stopping hard reset\n",
++ dev_name(&(hdev)->pdev->dev));
+ goto out_err;
+ }
+
+@@ -1576,7 +1577,8 @@ int hl_device_reset(struct hl_device *hdev, u32 flags)
+
+ if (rc) {
+ dev_crit(hdev->dev,
+- "Failed to kill all open processes, stopping hard reset\n");
++ "%s Failed to kill all open processes, stopping hard reset\n",
++ dev_name(&(hdev)->pdev->dev));
+ goto out_err;
+ }
+
+@@ -1627,14 +1629,16 @@ int hl_device_reset(struct hl_device *hdev, u32 flags)
+ * ensure driver puts the driver in a unusable state
+ */
+ dev_crit(hdev->dev,
+- "Consecutive FW fatal errors received, stopping hard reset\n");
++ "%s Consecutive FW fatal errors received, stopping hard reset\n",
++ dev_name(&(hdev)->pdev->dev));
+ rc = -EIO;
+ goto out_err;
+ }
+
+ if (hdev->kernel_ctx) {
+ dev_crit(hdev->dev,
+- "kernel ctx was alive during hard reset, something is terribly wrong\n");
++ "%s kernel ctx was alive during hard reset, something is terribly wrong\n",
++ dev_name(&(hdev)->pdev->dev));
+ rc = -EBUSY;
+ goto out_err;
+ }
+@@ -1752,9 +1756,13 @@ int hl_device_reset(struct hl_device *hdev, u32 flags)
+ hdev->reset_info.needs_reset = false;
+
+ if (hard_reset)
+- dev_info(hdev->dev, "Successfully finished resetting the device\n");
++ dev_info(hdev->dev,
++ "Successfully finished resetting the %s device\n",
++ dev_name(&(hdev)->pdev->dev));
+ else
+- dev_dbg(hdev->dev, "Successfully finished resetting the device\n");
++ dev_dbg(hdev->dev,
++ "Successfully finished resetting the %s device\n",
++ dev_name(&(hdev)->pdev->dev));
+
+ if (hard_reset) {
+ hdev->reset_info.hard_reset_cnt++;
+@@ -1789,7 +1797,9 @@ int hl_device_reset(struct hl_device *hdev, u32 flags)
+ hdev->reset_info.in_compute_reset = 0;
+
+ if (hard_reset) {
+- dev_err(hdev->dev, "Failed to reset! Device is NOT usable\n");
++ dev_err(hdev->dev,
++ "%s Failed to reset! Device is NOT usable\n",
++ dev_name(&(hdev)->pdev->dev));
+ hdev->reset_info.hard_reset_cnt++;
+ } else if (reset_upon_device_release) {
+ spin_unlock(&hdev->reset_info.lock);
+@@ -2186,7 +2196,8 @@ int hl_device_init(struct hl_device *hdev, struct class *hclass)
+ }
+
+ dev_notice(hdev->dev,
+- "Successfully added device to habanalabs driver\n");
++ "Successfully added device %s to habanalabs driver\n",
++ dev_name(&(hdev)->pdev->dev));
+
+ hdev->init_done = true;
+
+@@ -2235,11 +2246,11 @@ int hl_device_init(struct hl_device *hdev, struct class *hclass)
+ device_cdev_sysfs_add(hdev);
+ if (hdev->pdev)
+ dev_err(&hdev->pdev->dev,
+- "Failed to initialize hl%d. Device is NOT usable !\n",
+- hdev->cdev_idx);
++ "Failed to initialize hl%d. Device %s is NOT usable !\n",
++ hdev->cdev_idx, dev_name(&(hdev)->pdev->dev));
+ else
+- pr_err("Failed to initialize hl%d. Device is NOT usable !\n",
+- hdev->cdev_idx);
++ pr_err("Failed to initialize hl%d. Device %s is NOT usable !\n",
++ hdev->cdev_idx, dev_name(&(hdev)->pdev->dev));
+
+ return rc;
+ }
+@@ -2295,7 +2306,8 @@ void hl_device_fini(struct hl_device *hdev)
+
+ if (ktime_compare(ktime_get(), timeout) > 0) {
+ dev_crit(hdev->dev,
+- "Failed to remove device because reset function did not finish\n");
++ "%s Failed to remove device because reset function did not finish\n",
++ dev_name(&(hdev)->pdev->dev));
+ return;
+ }
+ }
+--
+2.39.2
+
--- /dev/null
+From e5c367ceb26ea4e37c0157b7f3e1433e4e84cae8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Jan 2023 12:29:55 +0200
+Subject: habanalabs: fix bug in timestamps registration code
+
+From: farah kassabri <fkassabri@habana.ai>
+
+[ Upstream commit ac5af9900f82b7034de7c9eb1d70d030ba325607 ]
+
+Protect re-using the same timestamp buffer record before actually
+adding it to the to interrupt wait list.
+Mark ts buff offset as in use in the spinlock protection area of the
+interrupt wait list to avoid getting in the re-use section in
+ts_buff_get_kernel_ts_record before adding the node to the list.
+this scenario might happen when multiple threads are racing on
+same offset and one thread could set data in the ts buff in
+ts_buff_get_kernel_ts_record then the other thread takes over
+and get to ts_buff_get_kernel_ts_record and we will try
+to re-use the same ts buff offset then we will try to
+delete a non existing node from the list.
+
+Signed-off-by: farah kassabri <fkassabri@habana.ai>
+Reviewed-by: Oded Gabbay <ogabbay@kernel.org>
+Signed-off-by: Oded Gabbay <ogabbay@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../habanalabs/common/command_submission.c | 33 ++++++++++++-------
+ 1 file changed, 22 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/misc/habanalabs/common/command_submission.c b/drivers/misc/habanalabs/common/command_submission.c
+index ea0e5101c10ed..6367cbea4ca2a 100644
+--- a/drivers/misc/habanalabs/common/command_submission.c
++++ b/drivers/misc/habanalabs/common/command_submission.c
+@@ -3119,19 +3119,18 @@ static int ts_buff_get_kernel_ts_record(struct hl_mmap_mem_buf *buf,
+ goto start_over;
+ }
+ } else {
++ /* Fill up the new registration node info */
++ requested_offset_record->ts_reg_info.buf = buf;
++ requested_offset_record->ts_reg_info.cq_cb = cq_cb;
++ requested_offset_record->ts_reg_info.timestamp_kernel_addr =
++ (u64 *) ts_buff->user_buff_address + ts_offset;
++ requested_offset_record->cq_kernel_addr =
++ (u64 *) cq_cb->kernel_address + cq_offset;
++ requested_offset_record->cq_target_value = target_value;
++
+ spin_unlock_irqrestore(wait_list_lock, flags);
+ }
+
+- /* Fill up the new registration node info */
+- requested_offset_record->ts_reg_info.in_use = 1;
+- requested_offset_record->ts_reg_info.buf = buf;
+- requested_offset_record->ts_reg_info.cq_cb = cq_cb;
+- requested_offset_record->ts_reg_info.timestamp_kernel_addr =
+- (u64 *) ts_buff->user_buff_address + ts_offset;
+- requested_offset_record->cq_kernel_addr =
+- (u64 *) cq_cb->kernel_address + cq_offset;
+- requested_offset_record->cq_target_value = target_value;
+-
+ *pend = requested_offset_record;
+
+ dev_dbg(buf->mmg->dev, "Found available node in TS kernel CB %p\n",
+@@ -3179,7 +3178,7 @@ static int _hl_interrupt_wait_ioctl(struct hl_device *hdev, struct hl_ctx *ctx,
+ goto put_cq_cb;
+ }
+
+- /* Find first available record */
++ /* get ts buffer record */
+ rc = ts_buff_get_kernel_ts_record(buf, cq_cb, ts_offset,
+ cq_counters_offset, target_value,
+ &interrupt->wait_list_lock, &pend);
+@@ -3227,7 +3226,19 @@ static int _hl_interrupt_wait_ioctl(struct hl_device *hdev, struct hl_ctx *ctx,
+ * Note that we cannot have sorted list by target value,
+ * in order to shorten the list pass loop, since
+ * same list could have nodes for different cq counter handle.
++ * Note:
++ * Mark ts buff offset as in use here in the spinlock protection area
++ * to avoid getting in the re-use section in ts_buff_get_kernel_ts_record
++ * before adding the node to the list. this scenario might happen when
++ * multiple threads are racing on same offset and one thread could
++ * set the ts buff in ts_buff_get_kernel_ts_record then the other thread
++ * takes over and get to ts_buff_get_kernel_ts_record and then we will try
++ * to re-use the same ts buff offset, and will try to delete a non existing
++ * node from the list.
+ */
++ if (register_ts_record)
++ pend->ts_reg_info.in_use = 1;
++
+ list_add_tail(&pend->wait_list_node, &interrupt->wait_list_head);
+ spin_unlock_irqrestore(&interrupt->wait_list_lock, flags);
+
+--
+2.39.2
+
--- /dev/null
+From fa90104a383af45541b8f4faa4d733f5bfb4d5b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Dec 2022 22:53:30 +0000
+Subject: HID: Add Mapping for System Microphone Mute
+
+From: Jingyuan Liang <jingyliang@chromium.org>
+
+[ Upstream commit 2d60f9f4f26785a00273cb81fe60eff129ebd449 ]
+
+HUTRR110 added a new usage code for a key that is supposed to
+mute/unmute microphone system-wide.
+
+Map the new usage code(0x01 0xa9) to keycode KEY_MICMUTE.
+Additionally hid-debug is adjusted to recognize this keycode as well.
+
+Signed-off-by: Jingyuan Liang <jingyliang@chromium.org>
+Reviewed-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-debug.c | 1 +
+ drivers/hid/hid-input.c | 8 ++++++++
+ 2 files changed, 9 insertions(+)
+
+diff --git a/drivers/hid/hid-debug.c b/drivers/hid/hid-debug.c
+index e213bdde543af..e7ef1ea107c9e 100644
+--- a/drivers/hid/hid-debug.c
++++ b/drivers/hid/hid-debug.c
+@@ -975,6 +975,7 @@ static const char *keys[KEY_MAX + 1] = {
+ [KEY_CAMERA_ACCESS_DISABLE] = "CameraAccessDisable",
+ [KEY_CAMERA_ACCESS_TOGGLE] = "CameraAccessToggle",
+ [KEY_DICTATE] = "Dictate",
++ [KEY_MICMUTE] = "MicrophoneMute",
+ [KEY_BRIGHTNESS_MIN] = "BrightnessMin",
+ [KEY_BRIGHTNESS_MAX] = "BrightnessMax",
+ [KEY_BRIGHTNESS_AUTO] = "BrightnessAuto",
+diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
+index 77c8c49852b5c..bd0cfccfb7a25 100644
+--- a/drivers/hid/hid-input.c
++++ b/drivers/hid/hid-input.c
+@@ -793,6 +793,14 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel
+ break;
+ }
+
++ if ((usage->hid & 0xf0) == 0xa0) { /* SystemControl */
++ switch (usage->hid & 0xf) {
++ case 0x9: map_key_clear(KEY_MICMUTE); break;
++ default: goto ignore;
++ }
++ break;
++ }
++
+ if ((usage->hid & 0xf0) == 0xb0) { /* SC - Display */
+ switch (usage->hid & 0xf) {
+ case 0x05: map_key_clear(KEY_SWITCHVIDEOMODE); break;
+--
+2.39.2
+
--- /dev/null
+From 522524da912a883e36651f7bec6d6dd8387f893c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 12 Feb 2023 18:59:59 +0000
+Subject: HID: bigben: use spinlock to protect concurrent accesses
+
+From: Pietro Borrello <borrello@diag.uniroma1.it>
+
+[ Upstream commit 9fefb6201c4f8dd9f58c581b2a66e5cde2895ea2 ]
+
+bigben driver has a worker that may access data concurrently.
+Proct the accesses using a spinlock.
+
+Fixes: 256a90ed9e46 ("HID: hid-bigbenff: driver for BigBen Interactive PS3OFMINIPAD gamepad")
+Signed-off-by: Pietro Borrello <borrello@diag.uniroma1.it>
+Link: https://lore.kernel.org/r/20230125-hid-unregister-leds-v4-1-7860c5763c38@diag.uniroma1.it
+Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-bigbenff.c | 52 ++++++++++++++++++++++++++++++++++++--
+ 1 file changed, 50 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/hid/hid-bigbenff.c b/drivers/hid/hid-bigbenff.c
+index e8b16665860d6..ed3d2d7bc1dd4 100644
+--- a/drivers/hid/hid-bigbenff.c
++++ b/drivers/hid/hid-bigbenff.c
+@@ -174,6 +174,7 @@ static __u8 pid0902_rdesc_fixed[] = {
+ struct bigben_device {
+ struct hid_device *hid;
+ struct hid_report *report;
++ spinlock_t lock;
+ bool removed;
+ u8 led_state; /* LED1 = 1 .. LED4 = 8 */
+ u8 right_motor_on; /* right motor off/on 0/1 */
+@@ -190,12 +191,27 @@ static void bigben_worker(struct work_struct *work)
+ struct bigben_device *bigben = container_of(work,
+ struct bigben_device, worker);
+ struct hid_field *report_field = bigben->report->field[0];
++ bool do_work_led = false;
++ bool do_work_ff = false;
++ u8 *buf;
++ u32 len;
++ unsigned long flags;
+
+ if (bigben->removed || !report_field)
+ return;
+
++ buf = hid_alloc_report_buf(bigben->report, GFP_KERNEL);
++ if (!buf)
++ return;
++
++ len = hid_report_len(bigben->report);
++
++ /* LED work */
++ spin_lock_irqsave(&bigben->lock, flags);
++
+ if (bigben->work_led) {
+ bigben->work_led = false;
++ do_work_led = true;
+ report_field->value[0] = 0x01; /* 1 = led message */
+ report_field->value[1] = 0x08; /* reserved value, always 8 */
+ report_field->value[2] = bigben->led_state;
+@@ -204,11 +220,22 @@ static void bigben_worker(struct work_struct *work)
+ report_field->value[5] = 0x00; /* padding */
+ report_field->value[6] = 0x00; /* padding */
+ report_field->value[7] = 0x00; /* padding */
+- hid_hw_request(bigben->hid, bigben->report, HID_REQ_SET_REPORT);
++ hid_output_report(bigben->report, buf);
++ }
++
++ spin_unlock_irqrestore(&bigben->lock, flags);
++
++ if (do_work_led) {
++ hid_hw_raw_request(bigben->hid, bigben->report->id, buf, len,
++ bigben->report->type, HID_REQ_SET_REPORT);
+ }
+
++ /* FF work */
++ spin_lock_irqsave(&bigben->lock, flags);
++
+ if (bigben->work_ff) {
+ bigben->work_ff = false;
++ do_work_ff = true;
+ report_field->value[0] = 0x02; /* 2 = rumble effect message */
+ report_field->value[1] = 0x08; /* reserved value, always 8 */
+ report_field->value[2] = bigben->right_motor_on;
+@@ -217,8 +244,17 @@ static void bigben_worker(struct work_struct *work)
+ report_field->value[5] = 0x00; /* padding */
+ report_field->value[6] = 0x00; /* padding */
+ report_field->value[7] = 0x00; /* padding */
+- hid_hw_request(bigben->hid, bigben->report, HID_REQ_SET_REPORT);
++ hid_output_report(bigben->report, buf);
++ }
++
++ spin_unlock_irqrestore(&bigben->lock, flags);
++
++ if (do_work_ff) {
++ hid_hw_raw_request(bigben->hid, bigben->report->id, buf, len,
++ bigben->report->type, HID_REQ_SET_REPORT);
+ }
++
++ kfree(buf);
+ }
+
+ static int hid_bigben_play_effect(struct input_dev *dev, void *data,
+@@ -228,6 +264,7 @@ static int hid_bigben_play_effect(struct input_dev *dev, void *data,
+ struct bigben_device *bigben = hid_get_drvdata(hid);
+ u8 right_motor_on;
+ u8 left_motor_force;
++ unsigned long flags;
+
+ if (!bigben) {
+ hid_err(hid, "no device data\n");
+@@ -242,9 +279,12 @@ static int hid_bigben_play_effect(struct input_dev *dev, void *data,
+
+ if (right_motor_on != bigben->right_motor_on ||
+ left_motor_force != bigben->left_motor_force) {
++ spin_lock_irqsave(&bigben->lock, flags);
+ bigben->right_motor_on = right_motor_on;
+ bigben->left_motor_force = left_motor_force;
+ bigben->work_ff = true;
++ spin_unlock_irqrestore(&bigben->lock, flags);
++
+ schedule_work(&bigben->worker);
+ }
+
+@@ -259,6 +299,7 @@ static void bigben_set_led(struct led_classdev *led,
+ struct bigben_device *bigben = hid_get_drvdata(hid);
+ int n;
+ bool work;
++ unsigned long flags;
+
+ if (!bigben) {
+ hid_err(hid, "no device data\n");
+@@ -267,6 +308,7 @@ static void bigben_set_led(struct led_classdev *led,
+
+ for (n = 0; n < NUM_LEDS; n++) {
+ if (led == bigben->leds[n]) {
++ spin_lock_irqsave(&bigben->lock, flags);
+ if (value == LED_OFF) {
+ work = (bigben->led_state & BIT(n));
+ bigben->led_state &= ~BIT(n);
+@@ -274,6 +316,7 @@ static void bigben_set_led(struct led_classdev *led,
+ work = !(bigben->led_state & BIT(n));
+ bigben->led_state |= BIT(n);
+ }
++ spin_unlock_irqrestore(&bigben->lock, flags);
+
+ if (work) {
+ bigben->work_led = true;
+@@ -307,8 +350,12 @@ static enum led_brightness bigben_get_led(struct led_classdev *led)
+ static void bigben_remove(struct hid_device *hid)
+ {
+ struct bigben_device *bigben = hid_get_drvdata(hid);
++ unsigned long flags;
+
++ spin_lock_irqsave(&bigben->lock, flags);
+ bigben->removed = true;
++ spin_unlock_irqrestore(&bigben->lock, flags);
++
+ cancel_work_sync(&bigben->worker);
+ hid_hw_stop(hid);
+ }
+@@ -362,6 +409,7 @@ static int bigben_probe(struct hid_device *hid,
+ set_bit(FF_RUMBLE, hidinput->input->ffbit);
+
+ INIT_WORK(&bigben->worker, bigben_worker);
++ spin_lock_init(&bigben->lock);
+
+ error = input_ff_create_memless(hidinput->input, NULL,
+ hid_bigben_play_effect);
+--
+2.39.2
+
--- /dev/null
+From a84612e0dc75c6b741ae65227b6a4c84dd5d18c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 12 Feb 2023 19:00:01 +0000
+Subject: HID: bigben: use spinlock to safely schedule workers
+
+From: Pietro Borrello <borrello@diag.uniroma1.it>
+
+[ Upstream commit 76ca8da989c7d97a7f76c75d475fe95a584439d7 ]
+
+Use spinlocks to deal with workers introducing a wrapper
+bigben_schedule_work(), and several spinlock checks.
+Otherwise, bigben_set_led() may schedule bigben->worker after the
+structure has been freed, causing a use-after-free.
+
+Fixes: 4eb1b01de5b9 ("HID: hid-bigbenff: fix race condition for scheduled work during removal")
+Signed-off-by: Pietro Borrello <borrello@diag.uniroma1.it>
+Link: https://lore.kernel.org/r/20230125-hid-unregister-leds-v4-3-7860c5763c38@diag.uniroma1.it
+Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-bigbenff.c | 18 ++++++++++++------
+ 1 file changed, 12 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/hid/hid-bigbenff.c b/drivers/hid/hid-bigbenff.c
+index b98c5f31c184b..9d6560db762b1 100644
+--- a/drivers/hid/hid-bigbenff.c
++++ b/drivers/hid/hid-bigbenff.c
+@@ -185,6 +185,15 @@ struct bigben_device {
+ struct work_struct worker;
+ };
+
++static inline void bigben_schedule_work(struct bigben_device *bigben)
++{
++ unsigned long flags;
++
++ spin_lock_irqsave(&bigben->lock, flags);
++ if (!bigben->removed)
++ schedule_work(&bigben->worker);
++ spin_unlock_irqrestore(&bigben->lock, flags);
++}
+
+ static void bigben_worker(struct work_struct *work)
+ {
+@@ -197,9 +206,6 @@ static void bigben_worker(struct work_struct *work)
+ u32 len;
+ unsigned long flags;
+
+- if (bigben->removed)
+- return;
+-
+ buf = hid_alloc_report_buf(bigben->report, GFP_KERNEL);
+ if (!buf)
+ return;
+@@ -285,7 +291,7 @@ static int hid_bigben_play_effect(struct input_dev *dev, void *data,
+ bigben->work_ff = true;
+ spin_unlock_irqrestore(&bigben->lock, flags);
+
+- schedule_work(&bigben->worker);
++ bigben_schedule_work(bigben);
+ }
+
+ return 0;
+@@ -320,7 +326,7 @@ static void bigben_set_led(struct led_classdev *led,
+
+ if (work) {
+ bigben->work_led = true;
+- schedule_work(&bigben->worker);
++ bigben_schedule_work(bigben);
+ }
+ return;
+ }
+@@ -450,7 +456,7 @@ static int bigben_probe(struct hid_device *hid,
+ bigben->left_motor_force = 0;
+ bigben->work_led = true;
+ bigben->work_ff = true;
+- schedule_work(&bigben->worker);
++ bigben_schedule_work(bigben);
+
+ hid_info(hid, "LED and force feedback support for BigBen gamepad\n");
+
+--
+2.39.2
+
--- /dev/null
+From 308ea60d75ebb76b1227957582fadb8e51e8b34e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 12 Feb 2023 00:01:44 +0000
+Subject: hid: bigben_probe(): validate report count
+
+From: Pietro Borrello <borrello@diag.uniroma1.it>
+
+[ Upstream commit b94335f899542a0da5fafc38af8edcaf90195843 ]
+
+bigben_probe() does not validate that the output report has the
+needed report values in the first field.
+A malicious device registering a report with one field and a single
+value causes an head OOB write in bigben_worker() when
+accessing report_field->value[1] to report_field->value[7].
+Use hid_validate_values() which takes care of all the needed checks.
+
+Fixes: 256a90ed9e46 ("HID: hid-bigbenff: driver for BigBen Interactive PS3OFMINIPAD gamepad")
+Signed-off-by: Pietro Borrello <borrello@diag.uniroma1.it>
+Link: https://lore.kernel.org/r/20230211-bigben-oob-v1-1-d2849688594c@diag.uniroma1.it
+Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-bigbenff.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/hid/hid-bigbenff.c b/drivers/hid/hid-bigbenff.c
+index 9d6560db762b1..a02cb517b4c47 100644
+--- a/drivers/hid/hid-bigbenff.c
++++ b/drivers/hid/hid-bigbenff.c
+@@ -371,7 +371,6 @@ static int bigben_probe(struct hid_device *hid,
+ {
+ struct bigben_device *bigben;
+ struct hid_input *hidinput;
+- struct list_head *report_list;
+ struct led_classdev *led;
+ char *name;
+ size_t name_sz;
+@@ -396,14 +395,12 @@ static int bigben_probe(struct hid_device *hid,
+ return error;
+ }
+
+- report_list = &hid->report_enum[HID_OUTPUT_REPORT].report_list;
+- if (list_empty(report_list)) {
++ bigben->report = hid_validate_values(hid, HID_OUTPUT_REPORT, 0, 0, 8);
++ if (!bigben->report) {
+ hid_err(hid, "no output report found\n");
+ error = -ENODEV;
+ goto error_hw_stop;
+ }
+- bigben->report = list_entry(report_list->next,
+- struct hid_report, list);
+
+ if (list_empty(&hid->inputs)) {
+ hid_err(hid, "no inputs found\n");
+--
+2.39.2
+
--- /dev/null
+From 0277a3f5ab37f8ca76cc27cfaf1b6aead7ffc224 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 12 Feb 2023 19:00:00 +0000
+Subject: HID: bigben_worker() remove unneeded check on report_field
+
+From: Pietro Borrello <borrello@diag.uniroma1.it>
+
+[ Upstream commit 27d2a2fd844ec7da70d19fabb482304fd1e0595b ]
+
+bigben_worker() checks report_field to be non-NULL.
+The check has been added in commit
+918aa1ef104d ("HID: bigbenff: prevent null pointer dereference")
+to prevent a NULL pointer crash.
+However, the true root cause was a missing check for output
+reports, patched in commit
+c7bf714f8755 ("HID: check empty report_list in bigben_probe()"),
+where the type-confused report list_entry was overlapping with
+a NULL pointer, which was then causing the crash.
+
+Fixes: 918aa1ef104d ("HID: bigbenff: prevent null pointer dereference")
+Signed-off-by: Pietro Borrello <borrello@diag.uniroma1.it>
+Link: https://lore.kernel.org/r/20230125-hid-unregister-leds-v4-2-7860c5763c38@diag.uniroma1.it
+Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-bigbenff.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hid/hid-bigbenff.c b/drivers/hid/hid-bigbenff.c
+index ed3d2d7bc1dd4..b98c5f31c184b 100644
+--- a/drivers/hid/hid-bigbenff.c
++++ b/drivers/hid/hid-bigbenff.c
+@@ -197,7 +197,7 @@ static void bigben_worker(struct work_struct *work)
+ u32 len;
+ unsigned long flags;
+
+- if (bigben->removed || !report_field)
++ if (bigben->removed)
+ return;
+
+ buf = hid_alloc_report_buf(bigben->report, GFP_KERNEL);
+--
+2.39.2
+
--- /dev/null
+From 87de06d5cd57a44ddbfd2559ab36dff7d99fe7ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Jan 2023 13:17:22 +0100
+Subject: HID: logitech-hidpp: Don't restart communication if not necessary
+
+From: Bastien Nocera <hadess@hadess.net>
+
+[ Upstream commit 498ba20690357691103de0f766960355247c78be ]
+
+Don't stop and restart communication with the device unless we need to
+modify the connect flags used because of a device quirk.
+
+Signed-off-by: Bastien Nocera <hadess@hadess.net>
+Link: https://lore.kernel.org/r/20230125121723.3122-1-hadess@hadess.net
+Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-logitech-hidpp.c | 32 ++++++++++++++++++++------------
+ 1 file changed, 20 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
+index 0c024ec1452cd..5efc591a02a03 100644
+--- a/drivers/hid/hid-logitech-hidpp.c
++++ b/drivers/hid/hid-logitech-hidpp.c
+@@ -4102,6 +4102,7 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id)
+ bool connected;
+ unsigned int connect_mask = HID_CONNECT_DEFAULT;
+ struct hidpp_ff_private_data data;
++ bool will_restart = false;
+
+ /* report_fixup needs drvdata to be set before we call hid_parse */
+ hidpp = devm_kzalloc(&hdev->dev, sizeof(*hidpp), GFP_KERNEL);
+@@ -4157,6 +4158,10 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id)
+ return ret;
+ }
+
++ if (hidpp->quirks & HIDPP_QUIRK_DELAYED_INIT ||
++ hidpp->quirks & HIDPP_QUIRK_UNIFYING)
++ will_restart = true;
++
+ INIT_WORK(&hidpp->work, delayed_work_cb);
+ mutex_init(&hidpp->send_mutex);
+ init_waitqueue_head(&hidpp->wait);
+@@ -4171,7 +4176,7 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id)
+ * Plain USB connections need to actually call start and open
+ * on the transport driver to allow incoming data.
+ */
+- ret = hid_hw_start(hdev, 0);
++ ret = hid_hw_start(hdev, will_restart ? 0 : connect_mask);
+ if (ret) {
+ hid_err(hdev, "hw start failed\n");
+ goto hid_hw_start_fail;
+@@ -4208,6 +4213,7 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id)
+ hidpp->wireless_feature_index = 0;
+ else if (ret)
+ goto hid_hw_init_fail;
++ ret = 0;
+ }
+
+ if (connected && (hidpp->quirks & HIDPP_QUIRK_CLASS_WTP)) {
+@@ -4222,19 +4228,21 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id)
+
+ hidpp_connect_event(hidpp);
+
+- /* Reset the HID node state */
+- hid_device_io_stop(hdev);
+- hid_hw_close(hdev);
+- hid_hw_stop(hdev);
++ if (will_restart) {
++ /* Reset the HID node state */
++ hid_device_io_stop(hdev);
++ hid_hw_close(hdev);
++ hid_hw_stop(hdev);
+
+- if (hidpp->quirks & HIDPP_QUIRK_NO_HIDINPUT)
+- connect_mask &= ~HID_CONNECT_HIDINPUT;
++ if (hidpp->quirks & HIDPP_QUIRK_NO_HIDINPUT)
++ connect_mask &= ~HID_CONNECT_HIDINPUT;
+
+- /* Now export the actual inputs and hidraw nodes to the world */
+- ret = hid_hw_start(hdev, connect_mask);
+- if (ret) {
+- hid_err(hdev, "%s:hid_hw_start returned error\n", __func__);
+- goto hid_hw_start_fail;
++ /* Now export the actual inputs and hidraw nodes to the world */
++ ret = hid_hw_start(hdev, connect_mask);
++ if (ret) {
++ hid_err(hdev, "%s:hid_hw_start returned error\n", __func__);
++ goto hid_hw_start_fail;
++ }
+ }
+
+ if (hidpp->quirks & HIDPP_QUIRK_CLASS_G920) {
+--
+2.39.2
+
--- /dev/null
+From fd7f46b605712425a5d071b67c20de3b68c807df Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Jan 2023 14:09:37 +0100
+Subject: HID: logitech-hidpp: Hard-code HID++ 1.0 fast scroll support
+
+From: Bastien Nocera <hadess@hadess.net>
+
+[ Upstream commit 719acb4d3b7accc9cfbaf21c1c2d51dc7384aee2 ]
+
+HID++ 1.0 devices only export whether Fast Scrolling is enabled, not
+whether they are capable of it. Reinstate the original quirks for the 3
+supported mice so fast scrolling works again on those devices.
+
+Fixes: 908d325e1665 ("HID: logitech-hidpp: Detect hi-res scrolling support")
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=216903
+Signed-off-by: Bastien Nocera <hadess@hadess.net>
+Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Link: https://lore.kernel.org/r/20230116130937.391441-1-hadess@hadess.net
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-logitech-hidpp.c | 17 +++++++++--------
+ 1 file changed, 9 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
+index 9c1ee8e91e0ca..0c024ec1452cd 100644
+--- a/drivers/hid/hid-logitech-hidpp.c
++++ b/drivers/hid/hid-logitech-hidpp.c
+@@ -77,6 +77,7 @@ MODULE_PARM_DESC(disable_tap_to_click,
+ #define HIDPP_QUIRK_HIDPP_WHEELS BIT(26)
+ #define HIDPP_QUIRK_HIDPP_EXTRA_MOUSE_BTNS BIT(27)
+ #define HIDPP_QUIRK_HIDPP_CONSUMER_VENDOR_KEYS BIT(28)
++#define HIDPP_QUIRK_HI_RES_SCROLL_1P0 BIT(29)
+
+ /* These are just aliases for now */
+ #define HIDPP_QUIRK_KBD_SCROLL_WHEEL HIDPP_QUIRK_HIDPP_WHEELS
+@@ -3472,14 +3473,8 @@ static int hidpp_initialize_hires_scroll(struct hidpp_device *hidpp)
+ hid_dbg(hidpp->hid_dev, "Detected HID++ 2.0 hi-res scrolling\n");
+ }
+ } else {
+- struct hidpp_report response;
+-
+- ret = hidpp_send_rap_command_sync(hidpp,
+- REPORT_ID_HIDPP_SHORT,
+- HIDPP_GET_REGISTER,
+- HIDPP_ENABLE_FAST_SCROLL,
+- NULL, 0, &response);
+- if (!ret) {
++ /* We cannot detect fast scrolling support on HID++ 1.0 devices */
++ if (hidpp->quirks & HIDPP_QUIRK_HI_RES_SCROLL_1P0) {
+ hidpp->capabilities |= HIDPP_CAPABILITY_HIDPP10_FAST_SCROLL;
+ hid_dbg(hidpp->hid_dev, "Detected HID++ 1.0 fast scroll\n");
+ }
+@@ -4297,9 +4292,15 @@ static const struct hid_device_id hidpp_devices[] = {
+ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH,
+ USB_DEVICE_ID_LOGITECH_T651),
+ .driver_data = HIDPP_QUIRK_CLASS_WTP },
++ { /* Mouse Logitech Anywhere MX */
++ LDJ_DEVICE(0x1017), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_1P0 },
+ { /* Mouse logitech M560 */
+ LDJ_DEVICE(0x402d),
+ .driver_data = HIDPP_QUIRK_DELAYED_INIT | HIDPP_QUIRK_CLASS_M560 },
++ { /* Mouse Logitech M705 (firmware RQM17) */
++ LDJ_DEVICE(0x101b), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_1P0 },
++ { /* Mouse Logitech Performance MX */
++ LDJ_DEVICE(0x101a), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_1P0 },
+ { /* Keyboard logitech K400 */
+ LDJ_DEVICE(0x4024),
+ .driver_data = HIDPP_QUIRK_CLASS_K400 },
+--
+2.39.2
+
--- /dev/null
+From 00f7c8b013dc54059a21788349d562198b65f5fd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Jan 2023 20:25:50 +0000
+Subject: HID: multitouch: Add quirks for flipped axes
+
+From: Allen Ballway <ballway@chromium.org>
+
+[ Upstream commit a2f416bf062a38bb76cccd526d2d286b8e4db4d9 ]
+
+Certain touchscreen devices, such as the ELAN9034, are oriented
+incorrectly and report touches on opposite points on the X and Y axes.
+For example, a 100x200 screen touched at (10,20) would report (90, 180)
+and vice versa.
+
+This is fixed by adding device quirks to transform the touch points
+into the correct spaces, from X -> MAX(X) - X, and Y -> MAX(Y) - Y.
+
+Signed-off-by: Allen Ballway <ballway@chromium.org>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Stable-dep-of: 03a86105556e ("HID: retain initial quirks set up when creating HID devices")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-multitouch.c | 39 ++++++++++++++++++---
+ drivers/hid/hid-quirks.c | 6 ++++
+ drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c | 43 ++++++++++++++++++++++++
+ drivers/hid/i2c-hid/i2c-hid.h | 3 ++
+ 4 files changed, 87 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
+index 372cbdd223e09..e31be0cb8b850 100644
+--- a/drivers/hid/hid-multitouch.c
++++ b/drivers/hid/hid-multitouch.c
+@@ -71,6 +71,7 @@ MODULE_LICENSE("GPL");
+ #define MT_QUIRK_SEPARATE_APP_REPORT BIT(19)
+ #define MT_QUIRK_FORCE_MULTI_INPUT BIT(20)
+ #define MT_QUIRK_DISABLE_WAKEUP BIT(21)
++#define MT_QUIRK_ORIENTATION_INVERT BIT(22)
+
+ #define MT_INPUTMODE_TOUCHSCREEN 0x02
+ #define MT_INPUTMODE_TOUCHPAD 0x03
+@@ -1009,6 +1010,7 @@ static int mt_process_slot(struct mt_device *td, struct input_dev *input,
+ struct mt_usages *slot)
+ {
+ struct input_mt *mt = input->mt;
++ struct hid_device *hdev = td->hdev;
+ __s32 quirks = app->quirks;
+ bool valid = true;
+ bool confidence_state = true;
+@@ -1086,6 +1088,10 @@ static int mt_process_slot(struct mt_device *td, struct input_dev *input,
+ int orientation = wide;
+ int max_azimuth;
+ int azimuth;
++ int x;
++ int y;
++ int cx;
++ int cy;
+
+ if (slot->a != DEFAULT_ZERO) {
+ /*
+@@ -1104,6 +1110,9 @@ static int mt_process_slot(struct mt_device *td, struct input_dev *input,
+ if (azimuth > max_azimuth * 2)
+ azimuth -= max_azimuth * 4;
+ orientation = -azimuth;
++ if (quirks & MT_QUIRK_ORIENTATION_INVERT)
++ orientation = -orientation;
++
+ }
+
+ if (quirks & MT_QUIRK_TOUCH_SIZE_SCALING) {
+@@ -1115,10 +1124,23 @@ static int mt_process_slot(struct mt_device *td, struct input_dev *input,
+ minor = minor >> 1;
+ }
+
+- input_event(input, EV_ABS, ABS_MT_POSITION_X, *slot->x);
+- input_event(input, EV_ABS, ABS_MT_POSITION_Y, *slot->y);
+- input_event(input, EV_ABS, ABS_MT_TOOL_X, *slot->cx);
+- input_event(input, EV_ABS, ABS_MT_TOOL_Y, *slot->cy);
++ x = hdev->quirks & HID_QUIRK_X_INVERT ?
++ input_abs_get_max(input, ABS_MT_POSITION_X) - *slot->x :
++ *slot->x;
++ y = hdev->quirks & HID_QUIRK_Y_INVERT ?
++ input_abs_get_max(input, ABS_MT_POSITION_Y) - *slot->y :
++ *slot->y;
++ cx = hdev->quirks & HID_QUIRK_X_INVERT ?
++ input_abs_get_max(input, ABS_MT_POSITION_X) - *slot->cx :
++ *slot->cx;
++ cy = hdev->quirks & HID_QUIRK_Y_INVERT ?
++ input_abs_get_max(input, ABS_MT_POSITION_Y) - *slot->cy :
++ *slot->cy;
++
++ input_event(input, EV_ABS, ABS_MT_POSITION_X, x);
++ input_event(input, EV_ABS, ABS_MT_POSITION_Y, y);
++ input_event(input, EV_ABS, ABS_MT_TOOL_X, cx);
++ input_event(input, EV_ABS, ABS_MT_TOOL_Y, cy);
+ input_event(input, EV_ABS, ABS_MT_DISTANCE, !*slot->tip_state);
+ input_event(input, EV_ABS, ABS_MT_ORIENTATION, orientation);
+ input_event(input, EV_ABS, ABS_MT_PRESSURE, *slot->p);
+@@ -1735,6 +1757,15 @@ static int mt_probe(struct hid_device *hdev, const struct hid_device_id *id)
+ if (id->vendor == HID_ANY_ID && id->product == HID_ANY_ID)
+ td->serial_maybe = true;
+
++
++ /* Orientation is inverted if the X or Y axes are
++ * flipped, but normalized if both are inverted.
++ */
++ if (hdev->quirks & (HID_QUIRK_X_INVERT | HID_QUIRK_Y_INVERT) &&
++ !((hdev->quirks & HID_QUIRK_X_INVERT)
++ && (hdev->quirks & HID_QUIRK_Y_INVERT)))
++ td->mtclass.quirks = MT_QUIRK_ORIENTATION_INVERT;
++
+ /* This allows the driver to correctly support devices
+ * that emit events over several HID messages.
+ */
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index 5bc91f68b3747..30e35f79def47 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -19,6 +19,7 @@
+ #include <linux/input/elan-i2c-ids.h>
+
+ #include "hid-ids.h"
++#include "i2c-hid/i2c-hid.h"
+
+ /*
+ * Alphabetically sorted by vendor then product.
+@@ -1298,6 +1299,11 @@ unsigned long hid_lookup_quirk(const struct hid_device *hdev)
+ quirks = hid_gets_squirk(hdev);
+ mutex_unlock(&dquirks_lock);
+
++ /* Get quirks specific to I2C devices */
++ if (IS_ENABLED(CONFIG_I2C_DMI_CORE) && IS_ENABLED(CONFIG_DMI) &&
++ hdev->bus == BUS_I2C)
++ quirks |= i2c_hid_get_dmi_quirks(hdev->vendor, hdev->product);
++
+ return quirks;
+ }
+ EXPORT_SYMBOL_GPL(hid_lookup_quirk);
+diff --git a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c
+index 8e0f67455c098..554a7dc285365 100644
+--- a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c
++++ b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c
+@@ -10,8 +10,10 @@
+ #include <linux/types.h>
+ #include <linux/dmi.h>
+ #include <linux/mod_devicetable.h>
++#include <linux/hid.h>
+
+ #include "i2c-hid.h"
++#include "../hid-ids.h"
+
+
+ struct i2c_hid_desc_override {
+@@ -416,6 +418,28 @@ static const struct dmi_system_id i2c_hid_dmi_desc_override_table[] = {
+ { } /* Terminate list */
+ };
+
++static const struct hid_device_id i2c_hid_elan_flipped_quirks = {
++ HID_DEVICE(BUS_I2C, HID_GROUP_MULTITOUCH_WIN_8, USB_VENDOR_ID_ELAN, 0x2dcd),
++ HID_QUIRK_X_INVERT | HID_QUIRK_Y_INVERT
++};
++
++/*
++ * This list contains devices which have specific issues based on the system
++ * they're on and not just the device itself. The driver_data will have a
++ * specific hid device to match against.
++ */
++static const struct dmi_system_id i2c_hid_dmi_quirk_table[] = {
++ {
++ .ident = "DynaBook K50/FR",
++ .matches = {
++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Dynabook Inc."),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "dynabook K50/FR"),
++ },
++ .driver_data = (void *)&i2c_hid_elan_flipped_quirks,
++ },
++ { } /* Terminate list */
++};
++
+
+ struct i2c_hid_desc *i2c_hid_get_dmi_i2c_hid_desc_override(uint8_t *i2c_name)
+ {
+@@ -450,3 +474,22 @@ char *i2c_hid_get_dmi_hid_report_desc_override(uint8_t *i2c_name,
+ *size = override->hid_report_desc_size;
+ return override->hid_report_desc;
+ }
++
++u32 i2c_hid_get_dmi_quirks(const u16 vendor, const u16 product)
++{
++ u32 quirks = 0;
++ const struct dmi_system_id *system_id =
++ dmi_first_match(i2c_hid_dmi_quirk_table);
++
++ if (system_id) {
++ const struct hid_device_id *device_id =
++ (struct hid_device_id *)(system_id->driver_data);
++
++ if (device_id && device_id->vendor == vendor &&
++ device_id->product == product)
++ quirks = device_id->driver_data;
++ }
++
++ return quirks;
++}
++EXPORT_SYMBOL_GPL(i2c_hid_get_dmi_quirks);
+diff --git a/drivers/hid/i2c-hid/i2c-hid.h b/drivers/hid/i2c-hid/i2c-hid.h
+index 96c75510ad3f1..2c7b66d5caa0f 100644
+--- a/drivers/hid/i2c-hid/i2c-hid.h
++++ b/drivers/hid/i2c-hid/i2c-hid.h
+@@ -9,6 +9,7 @@
+ struct i2c_hid_desc *i2c_hid_get_dmi_i2c_hid_desc_override(uint8_t *i2c_name);
+ char *i2c_hid_get_dmi_hid_report_desc_override(uint8_t *i2c_name,
+ unsigned int *size);
++u32 i2c_hid_get_dmi_quirks(const u16 vendor, const u16 product);
+ #else
+ static inline struct i2c_hid_desc
+ *i2c_hid_get_dmi_i2c_hid_desc_override(uint8_t *i2c_name)
+@@ -16,6 +17,8 @@ static inline struct i2c_hid_desc
+ static inline char *i2c_hid_get_dmi_hid_report_desc_override(uint8_t *i2c_name,
+ unsigned int *size)
+ { return NULL; }
++static inline u32 i2c_hid_get_dmi_quirks(const u16 vendor, const u16 product)
++{ return 0; }
+ #endif
+
+ /**
+--
+2.39.2
+
--- /dev/null
+From be19d2d345e0e93f59e932a1371ff21ad0bab7be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Feb 2023 15:03:30 -0800
+Subject: HID: retain initial quirks set up when creating HID devices
+
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+
+[ Upstream commit 03a86105556e23650e4470c09f91cf7c360d5e28 ]
+
+In certain circumstances, such as when creating I2C-connected HID
+devices, we want to pass and retain some quirks (axis inversion, etc).
+The source of such quirks may be device tree, or DMI data, or something
+else not readily available to the HID core itself and therefore cannot
+be reconstructed easily. To allow this, introduce "initial_quirks" field
+in hid_device structure and use it when determining the final set of
+quirks.
+
+This fixes the problem with i2c-hid setting up device-tree sourced
+quirks too late and losing them on device rebind, and also allows to
+sever the tie between hid-code and i2c-hid when applying DMI-based
+quirks.
+
+Fixes: b60d3c803d76 ("HID: i2c-hid-of: Expose the touchscreen-inverted properties")
+Fixes: a2f416bf062a ("HID: multitouch: Add quirks for flipped axes")
+Reviewed-by: Guenter Roeck <groeck@chromium.org>
+Tested-by: Allen Ballway <ballway@chromium.org>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Reviewed-by: Alistair Francis <alistair@alistair23.me>
+Link: https://lore.kernel.org/r/Y+LYwu3Zs13hdVDy@google.com
+Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-quirks.c | 8 +-------
+ drivers/hid/i2c-hid/i2c-hid-core.c | 6 ++++--
+ drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c | 1 -
+ include/linux/hid.h | 1 +
+ 4 files changed, 6 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index 30e35f79def47..66e64350f1386 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -19,7 +19,6 @@
+ #include <linux/input/elan-i2c-ids.h>
+
+ #include "hid-ids.h"
+-#include "i2c-hid/i2c-hid.h"
+
+ /*
+ * Alphabetically sorted by vendor then product.
+@@ -1238,7 +1237,7 @@ EXPORT_SYMBOL_GPL(hid_quirks_exit);
+ static unsigned long hid_gets_squirk(const struct hid_device *hdev)
+ {
+ const struct hid_device_id *bl_entry;
+- unsigned long quirks = 0;
++ unsigned long quirks = hdev->initial_quirks;
+
+ if (hid_match_id(hdev, hid_ignore_list))
+ quirks |= HID_QUIRK_IGNORE;
+@@ -1299,11 +1298,6 @@ unsigned long hid_lookup_quirk(const struct hid_device *hdev)
+ quirks = hid_gets_squirk(hdev);
+ mutex_unlock(&dquirks_lock);
+
+- /* Get quirks specific to I2C devices */
+- if (IS_ENABLED(CONFIG_I2C_DMI_CORE) && IS_ENABLED(CONFIG_DMI) &&
+- hdev->bus == BUS_I2C)
+- quirks |= i2c_hid_get_dmi_quirks(hdev->vendor, hdev->product);
+-
+ return quirks;
+ }
+ EXPORT_SYMBOL_GPL(hid_lookup_quirk);
+diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c
+index b86b62f971080..72f2c379812c7 100644
+--- a/drivers/hid/i2c-hid/i2c-hid-core.c
++++ b/drivers/hid/i2c-hid/i2c-hid-core.c
+@@ -1035,6 +1035,10 @@ int i2c_hid_core_probe(struct i2c_client *client, struct i2chid_ops *ops,
+ hid->vendor = le16_to_cpu(ihid->hdesc.wVendorID);
+ hid->product = le16_to_cpu(ihid->hdesc.wProductID);
+
++ hid->initial_quirks = quirks;
++ hid->initial_quirks |= i2c_hid_get_dmi_quirks(hid->vendor,
++ hid->product);
++
+ snprintf(hid->name, sizeof(hid->name), "%s %04X:%04X",
+ client->name, (u16)hid->vendor, (u16)hid->product);
+ strscpy(hid->phys, dev_name(&client->dev), sizeof(hid->phys));
+@@ -1048,8 +1052,6 @@ int i2c_hid_core_probe(struct i2c_client *client, struct i2chid_ops *ops,
+ goto err_mem_free;
+ }
+
+- hid->quirks |= quirks;
+-
+ return 0;
+
+ err_mem_free:
+diff --git a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c
+index 554a7dc285365..210f17c3a0be0 100644
+--- a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c
++++ b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c
+@@ -492,4 +492,3 @@ u32 i2c_hid_get_dmi_quirks(const u16 vendor, const u16 product)
+
+ return quirks;
+ }
+-EXPORT_SYMBOL_GPL(i2c_hid_get_dmi_quirks);
+diff --git a/include/linux/hid.h b/include/linux/hid.h
+index 8677ae38599e4..48563dc09e171 100644
+--- a/include/linux/hid.h
++++ b/include/linux/hid.h
+@@ -619,6 +619,7 @@ struct hid_device { /* device report descriptor */
+ unsigned long status; /* see STAT flags above */
+ unsigned claimed; /* Claimed by hidinput, hiddev? */
+ unsigned quirks; /* Various quirks the device can pull on us */
++ unsigned initial_quirks; /* Initial set of quirks supplied when creating device */
+ bool io_started; /* If IO has started */
+
+ struct list_head inputs; /* The list of inputs */
+--
+2.39.2
+
--- /dev/null
+From 7c25695ec211e40588d971b587e8891fa82cfe10 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Dec 2022 13:54:50 +0100
+Subject: HID: uclogic: Add battery quirk
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: José Expósito <jose.exposito89@gmail.com>
+
+[ Upstream commit f60c377f52de37f8705c5fc6d57737fdaf309ff9 ]
+
+Some UGEE v2 tablets have a wireless version with an internal battery
+and their firmware is able to report their battery level.
+
+However, there was not found a field on their descriptor indicating
+whether the tablet has battery or not, making it mandatory to classify
+such devices through the UCLOGIC_BATTERY_QUIRK quirk.
+
+Tested-by: Mia Kanashi <chad@redpilled.dev>
+Tested-by: Andreas Grosse <andig.mail@t-online.de>
+Signed-off-by: José Expósito <jose.exposito89@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-uclogic-params.c | 5 +++++
+ drivers/hid/hid-uclogic-params.h | 1 +
+ 2 files changed, 6 insertions(+)
+
+diff --git a/drivers/hid/hid-uclogic-params.c b/drivers/hid/hid-uclogic-params.c
+index e052538a62fb3..23624d5b07b5a 100644
+--- a/drivers/hid/hid-uclogic-params.c
++++ b/drivers/hid/hid-uclogic-params.c
+@@ -1222,6 +1222,11 @@ static int uclogic_params_ugee_v2_init_frame_mouse(struct uclogic_params *p)
+ */
+ static bool uclogic_params_ugee_v2_has_battery(struct hid_device *hdev)
+ {
++ struct uclogic_drvdata *drvdata = hid_get_drvdata(hdev);
++
++ if (drvdata->quirks & UCLOGIC_BATTERY_QUIRK)
++ return true;
++
+ /* The XP-PEN Deco LW vendor, product and version are identical to the
+ * Deco L. The only difference reported by their firmware is the product
+ * name. Add a quirk to support battery reporting on the wireless
+diff --git a/drivers/hid/hid-uclogic-params.h b/drivers/hid/hid-uclogic-params.h
+index 10a05c7fd9398..b0e7f3807939b 100644
+--- a/drivers/hid/hid-uclogic-params.h
++++ b/drivers/hid/hid-uclogic-params.h
+@@ -20,6 +20,7 @@
+ #include <linux/hid.h>
+
+ #define UCLOGIC_MOUSE_FRAME_QUIRK BIT(0)
++#define UCLOGIC_BATTERY_QUIRK BIT(1)
+
+ /* Types of pen in-range reporting */
+ enum uclogic_params_pen_inrange {
+--
+2.39.2
+
--- /dev/null
+From 14d70f2693f25b4e26a43461da9b7715aa180b76 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Dec 2022 13:54:49 +0100
+Subject: HID: uclogic: Add frame type quirk
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: José Expósito <jose.exposito89@gmail.com>
+
+[ Upstream commit 14b71e6ad8ca59dd734c7fa9676f3d60bddee2a9 ]
+
+The report descriptor used to get information about UGEE v2 devices is
+incorrect in the XP-PEN Deco Pro SW. It indicates that the device frame
+is of type UCLOGIC_PARAMS_FRAME_BUTTONS but the device has a frame of
+type UCLOGIC_PARAMS_FRAME_MOUSE.
+
+Here is the original report descriptor:
+
+ 0x0e 0x03 0xc8 0xb3 0x34 0x65 0x08 0x00 0xff 0x1f 0xd8 0x13 0x00 0x00
+ ^ This byte should be 2
+
+Add a quirk to be able to fix the reported frame type.
+
+Tested-by: Mia Kanashi <chad@redpilled.dev>
+Tested-by: Andreas Grosse <andig.mail@t-online.de>
+Signed-off-by: José Expósito <jose.exposito89@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-uclogic-core.c | 20 +-------------------
+ drivers/hid/hid-uclogic-params.c | 5 +++++
+ drivers/hid/hid-uclogic-params.h | 23 +++++++++++++++++++++++
+ 3 files changed, 29 insertions(+), 19 deletions(-)
+
+diff --git a/drivers/hid/hid-uclogic-core.c b/drivers/hid/hid-uclogic-core.c
+index cfbbc39807a69..739984b8fa1b8 100644
+--- a/drivers/hid/hid-uclogic-core.c
++++ b/drivers/hid/hid-uclogic-core.c
+@@ -22,25 +22,6 @@
+
+ #include "hid-ids.h"
+
+-/* Driver data */
+-struct uclogic_drvdata {
+- /* Interface parameters */
+- struct uclogic_params params;
+- /* Pointer to the replacement report descriptor. NULL if none. */
+- __u8 *desc_ptr;
+- /*
+- * Size of the replacement report descriptor.
+- * Only valid if desc_ptr is not NULL
+- */
+- unsigned int desc_size;
+- /* Pen input device */
+- struct input_dev *pen_input;
+- /* In-range timer */
+- struct timer_list inrange_timer;
+- /* Last rotary encoder state, or U8_MAX for none */
+- u8 re_state;
+-};
+-
+ /**
+ * uclogic_inrange_timeout - handle pen in-range state timeout.
+ * Emulate input events normally generated when pen goes out of range for
+@@ -202,6 +183,7 @@ static int uclogic_probe(struct hid_device *hdev,
+ }
+ timer_setup(&drvdata->inrange_timer, uclogic_inrange_timeout, 0);
+ drvdata->re_state = U8_MAX;
++ drvdata->quirks = id->driver_data;
+ hid_set_drvdata(hdev, drvdata);
+
+ /* Initialize the device and retrieve interface parameters */
+diff --git a/drivers/hid/hid-uclogic-params.c b/drivers/hid/hid-uclogic-params.c
+index 3c5eea3df3288..e052538a62fb3 100644
+--- a/drivers/hid/hid-uclogic-params.c
++++ b/drivers/hid/hid-uclogic-params.c
+@@ -1298,6 +1298,7 @@ static int uclogic_params_ugee_v2_init(struct uclogic_params *params,
+ struct hid_device *hdev)
+ {
+ int rc = 0;
++ struct uclogic_drvdata *drvdata;
+ struct usb_interface *iface;
+ __u8 bInterfaceNumber;
+ const int str_desc_len = 12;
+@@ -1316,6 +1317,7 @@ static int uclogic_params_ugee_v2_init(struct uclogic_params *params,
+ goto cleanup;
+ }
+
++ drvdata = hid_get_drvdata(hdev);
+ iface = to_usb_interface(hdev->dev.parent);
+ bInterfaceNumber = iface->cur_altsetting->desc.bInterfaceNumber;
+
+@@ -1382,6 +1384,9 @@ static int uclogic_params_ugee_v2_init(struct uclogic_params *params,
+ p.pen.subreport_list[0].id = UCLOGIC_RDESC_V1_FRAME_ID;
+
+ /* Initialize the frame interface */
++ if (drvdata->quirks & UCLOGIC_MOUSE_FRAME_QUIRK)
++ frame_type = UCLOGIC_PARAMS_FRAME_MOUSE;
++
+ switch (frame_type) {
+ case UCLOGIC_PARAMS_FRAME_DIAL:
+ case UCLOGIC_PARAMS_FRAME_MOUSE:
+diff --git a/drivers/hid/hid-uclogic-params.h b/drivers/hid/hid-uclogic-params.h
+index a97477c02ff82..10a05c7fd9398 100644
+--- a/drivers/hid/hid-uclogic-params.h
++++ b/drivers/hid/hid-uclogic-params.h
+@@ -19,6 +19,8 @@
+ #include <linux/usb.h>
+ #include <linux/hid.h>
+
++#define UCLOGIC_MOUSE_FRAME_QUIRK BIT(0)
++
+ /* Types of pen in-range reporting */
+ enum uclogic_params_pen_inrange {
+ /* Normal reports: zero - out of proximity, one - in proximity */
+@@ -215,6 +217,27 @@ struct uclogic_params {
+ struct uclogic_params_frame frame_list[3];
+ };
+
++/* Driver data */
++struct uclogic_drvdata {
++ /* Interface parameters */
++ struct uclogic_params params;
++ /* Pointer to the replacement report descriptor. NULL if none. */
++ __u8 *desc_ptr;
++ /*
++ * Size of the replacement report descriptor.
++ * Only valid if desc_ptr is not NULL
++ */
++ unsigned int desc_size;
++ /* Pen input device */
++ struct input_dev *pen_input;
++ /* In-range timer */
++ struct timer_list inrange_timer;
++ /* Last rotary encoder state, or U8_MAX for none */
++ u8 re_state;
++ /* Device quirks */
++ unsigned long quirks;
++};
++
+ /* Initialize a tablet interface and discover its parameters */
+ extern int uclogic_params_init(struct uclogic_params *params,
+ struct hid_device *hdev);
+--
+2.39.2
+
--- /dev/null
+From 1ce4509f7740b8a22bb8dc1c9a1dd091fcd0ae81 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Dec 2022 13:54:54 +0100
+Subject: HID: uclogic: Add support for XP-PEN Deco Pro MW
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: José Expósito <jose.exposito89@gmail.com>
+
+[ Upstream commit 9266a88156d1fbb8e50d6eeff7bac44ad4eaecc2 ]
+
+The XP-PEN Deco Pro MW is a UGEE v2 device with a frame with 8 buttons,
+a bitmap dial and a mouse. Its pen has 2 buttons, supports tilt and
+pressure.
+
+It can be connected using a USB cable or, to use it in wireless mode,
+using a USB Bluetooth dongle. When it is connected in wireless mode the
+device battery is used to power it.
+
+All the pieces to support it are already in place. Add its ID and
+quirks in order to support the device.
+
+Link: https://github.com/DIGImend/digimend-kernel-drivers/issues/622
+Tested-by: Andreas Grosse <andig.mail@t-online.de>
+Signed-off-by: José Expósito <jose.exposito89@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-ids.h | 1 +
+ drivers/hid/hid-input.c | 2 ++
+ drivers/hid/hid-uclogic-core.c | 3 +++
+ drivers/hid/hid-uclogic-params.c | 2 ++
+ 4 files changed, 8 insertions(+)
+
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index c662994d73381..2235d78784b1b 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -1299,6 +1299,7 @@
+ #define USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO01 0x0042
+ #define USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO01_V2 0x0905
+ #define USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_L 0x0935
++#define USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_PRO_MW 0x0934
+ #define USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_PRO_S 0x0909
+ #define USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_PRO_SW 0x0933
+ #define USB_DEVICE_ID_UGEE_XPPEN_TABLET_STAR06 0x0078
+diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
+index 0f8a5152e48b1..c3c7d0abb01ad 100644
+--- a/drivers/hid/hid-input.c
++++ b/drivers/hid/hid-input.c
+@@ -378,6 +378,8 @@ static const struct hid_device_id hid_battery_quirks[] = {
+ HID_BATTERY_QUIRK_IGNORE },
+ { HID_USB_DEVICE(USB_VENDOR_ID_UGEE, USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_L),
+ HID_BATTERY_QUIRK_AVOID_QUERY },
++ { HID_USB_DEVICE(USB_VENDOR_ID_UGEE, USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_PRO_MW),
++ HID_BATTERY_QUIRK_AVOID_QUERY },
+ { HID_USB_DEVICE(USB_VENDOR_ID_UGEE, USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_PRO_SW),
+ HID_BATTERY_QUIRK_AVOID_QUERY },
+ { HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_HP_ENVY_X360_15),
+diff --git a/drivers/hid/hid-uclogic-core.c b/drivers/hid/hid-uclogic-core.c
+index 7c05d38d3afad..bfbb51f8b5beb 100644
+--- a/drivers/hid/hid-uclogic-core.c
++++ b/drivers/hid/hid-uclogic-core.c
+@@ -511,6 +511,9 @@ static const struct hid_device_id uclogic_devices[] = {
+ USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO01_V2) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_UGEE,
+ USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_L) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_UGEE,
++ USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_PRO_MW),
++ .driver_data = UCLOGIC_MOUSE_FRAME_QUIRK | UCLOGIC_BATTERY_QUIRK },
+ { HID_USB_DEVICE(USB_VENDOR_ID_UGEE,
+ USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_PRO_S) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_UGEE,
+diff --git a/drivers/hid/hid-uclogic-params.c b/drivers/hid/hid-uclogic-params.c
+index 492a30f83575a..0cc03c11ecc22 100644
+--- a/drivers/hid/hid-uclogic-params.c
++++ b/drivers/hid/hid-uclogic-params.c
+@@ -1669,6 +1669,8 @@ int uclogic_params_init(struct uclogic_params *params,
+ USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO01_V2):
+ case VID_PID(USB_VENDOR_ID_UGEE,
+ USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_L):
++ case VID_PID(USB_VENDOR_ID_UGEE,
++ USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_PRO_MW):
+ case VID_PID(USB_VENDOR_ID_UGEE,
+ USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_PRO_S):
+ case VID_PID(USB_VENDOR_ID_UGEE,
+--
+2.39.2
+
--- /dev/null
+From 1a7e93b1b067caf3eacb840799b1fcf6812fc649 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Dec 2022 13:54:53 +0100
+Subject: HID: uclogic: Add support for XP-PEN Deco Pro SW
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: José Expósito <jose.exposito89@gmail.com>
+
+[ Upstream commit 7744ca571af55b794595cff2da9d51a26904998f ]
+
+The XP-PEN Deco Pro SW is a UGEE v2 device with a frame with 8 buttons,
+a bitmap dial and a mouse; however, the UCLOGIC_MOUSE_FRAME_QUIRK is
+required because it reports an incorrect frame type. Its pen has 2
+buttons, supports tilt and pressure.
+
+It can be connected using a USB cable or, to use it in wireless mode,
+using a USB Bluetooth dongle. When it is connected in wireless mode the
+device battery is used to power it.
+
+All the pieces to support it are already in place. Add its ID and
+quirks in order to support the device.
+
+Signed-off-by: José Expósito <jose.exposito89@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-ids.h | 1 +
+ drivers/hid/hid-input.c | 2 ++
+ drivers/hid/hid-uclogic-core.c | 3 +++
+ drivers/hid/hid-uclogic-params.c | 2 ++
+ 4 files changed, 8 insertions(+)
+
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 9e36b4cd905ee..c662994d73381 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -1300,6 +1300,7 @@
+ #define USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO01_V2 0x0905
+ #define USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_L 0x0935
+ #define USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_PRO_S 0x0909
++#define USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_PRO_SW 0x0933
+ #define USB_DEVICE_ID_UGEE_XPPEN_TABLET_STAR06 0x0078
+ #define USB_DEVICE_ID_UGEE_TABLET_G5 0x0074
+ #define USB_DEVICE_ID_UGEE_TABLET_EX07S 0x0071
+diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
+index bd0cfccfb7a25..0f8a5152e48b1 100644
+--- a/drivers/hid/hid-input.c
++++ b/drivers/hid/hid-input.c
+@@ -378,6 +378,8 @@ static const struct hid_device_id hid_battery_quirks[] = {
+ HID_BATTERY_QUIRK_IGNORE },
+ { HID_USB_DEVICE(USB_VENDOR_ID_UGEE, USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_L),
+ HID_BATTERY_QUIRK_AVOID_QUERY },
++ { HID_USB_DEVICE(USB_VENDOR_ID_UGEE, USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_PRO_SW),
++ HID_BATTERY_QUIRK_AVOID_QUERY },
+ { HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_HP_ENVY_X360_15),
+ HID_BATTERY_QUIRK_IGNORE },
+ { HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_HP_ENVY_X360_15T_DR100),
+diff --git a/drivers/hid/hid-uclogic-core.c b/drivers/hid/hid-uclogic-core.c
+index 739984b8fa1b8..7c05d38d3afad 100644
+--- a/drivers/hid/hid-uclogic-core.c
++++ b/drivers/hid/hid-uclogic-core.c
+@@ -513,6 +513,9 @@ static const struct hid_device_id uclogic_devices[] = {
+ USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_L) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_UGEE,
+ USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_PRO_S) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_UGEE,
++ USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_PRO_SW),
++ .driver_data = UCLOGIC_MOUSE_FRAME_QUIRK | UCLOGIC_BATTERY_QUIRK },
+ { HID_USB_DEVICE(USB_VENDOR_ID_UGEE,
+ USB_DEVICE_ID_UGEE_XPPEN_TABLET_STAR06) },
+ { }
+diff --git a/drivers/hid/hid-uclogic-params.c b/drivers/hid/hid-uclogic-params.c
+index 23624d5b07b5a..492a30f83575a 100644
+--- a/drivers/hid/hid-uclogic-params.c
++++ b/drivers/hid/hid-uclogic-params.c
+@@ -1671,6 +1671,8 @@ int uclogic_params_init(struct uclogic_params *params,
+ USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_L):
+ case VID_PID(USB_VENDOR_ID_UGEE,
+ USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_PRO_S):
++ case VID_PID(USB_VENDOR_ID_UGEE,
++ USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_PRO_SW):
+ rc = uclogic_params_ugee_v2_init(&p, hdev);
+ if (rc != 0)
+ goto cleanup;
+--
+2.39.2
+
--- /dev/null
+From e76f4036d142b9227dde65de61eaa275ee1bda41 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 12 Feb 2023 21:08:01 -0800
+Subject: hv_netvsc: Check status in SEND_RNDIS_PKT completion message
+
+From: Michael Kelley <mikelley@microsoft.com>
+
+[ Upstream commit dca5161f9bd052e9e73be90716ffd57e8762c697 ]
+
+Completion responses to SEND_RNDIS_PKT messages are currently processed
+regardless of the status in the response, so that resources associated
+with the request are freed. While this is appropriate, code bugs that
+cause sending a malformed message, or errors on the Hyper-V host, go
+undetected. Fix this by checking the status and outputting a rate-limited
+message if there is an error.
+
+Signed-off-by: Michael Kelley <mikelley@microsoft.com>
+Reviewed-by: Haiyang Zhang <haiyangz@microsoft.com>
+Link: https://lore.kernel.org/r/1676264881-48928-1-git-send-email-mikelley@microsoft.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/hyperv/netvsc.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c
+index 79f4e13620a46..da737d959e81c 100644
+--- a/drivers/net/hyperv/netvsc.c
++++ b/drivers/net/hyperv/netvsc.c
+@@ -851,6 +851,7 @@ static void netvsc_send_completion(struct net_device *ndev,
+ u32 msglen = hv_pkt_datalen(desc);
+ struct nvsp_message *pkt_rqst;
+ u64 cmd_rqst;
++ u32 status;
+
+ /* First check if this is a VMBUS completion without data payload */
+ if (!msglen) {
+@@ -922,6 +923,23 @@ static void netvsc_send_completion(struct net_device *ndev,
+ break;
+
+ case NVSP_MSG1_TYPE_SEND_RNDIS_PKT_COMPLETE:
++ if (msglen < sizeof(struct nvsp_message_header) +
++ sizeof(struct nvsp_1_message_send_rndis_packet_complete)) {
++ if (net_ratelimit())
++ netdev_err(ndev, "nvsp_rndis_pkt_complete length too small: %u\n",
++ msglen);
++ return;
++ }
++
++ /* If status indicates an error, output a message so we know
++ * there's a problem. But process the completion anyway so the
++ * resources are released.
++ */
++ status = nvsp_packet->msg.v1_msg.send_rndis_pkt_complete.status;
++ if (status != NVSP_STAT_SUCCESS && net_ratelimit())
++ netdev_err(ndev, "nvsp_rndis_pkt_complete error status: %x\n",
++ status);
++
+ netvsc_send_tx_complete(ndev, net_device, incoming_channel,
+ desc, budget);
+ break;
+--
+2.39.2
+
--- /dev/null
+From 2843300e7eadc9e049cc6cad52d6c76003575867 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 21 Jan 2023 12:17:28 +0100
+Subject: hwmon: (asus-ec-sensors) add missing mutex path
+
+From: Eugene Shalygin <eugene.shalygin@gmail.com>
+
+[ Upstream commit e2de0e6abd91b05411cb1f0953115dbbbe9b11ce ]
+
+Add missing mutex path for ProArt X570-CREATOR WIFI.
+
+Fixes: de8fbac5e59e (hwmon: (asus-ec-sensors) implement locking via the ACPI global lock)
+Signed-off-by: Eugene Shalygin <eugene.shalygin@gmail.com>
+Link: https://lore.kernel.org/r/20230121111728.168514-2-eugene.shalygin@gmail.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/asus-ec-sensors.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/hwmon/asus-ec-sensors.c b/drivers/hwmon/asus-ec-sensors.c
+index a901e4e33d81d..b4d65916b3c00 100644
+--- a/drivers/hwmon/asus-ec-sensors.c
++++ b/drivers/hwmon/asus-ec-sensors.c
+@@ -299,6 +299,7 @@ static const struct ec_board_info board_info_pro_art_x570_creator_wifi = {
+ .sensors = SENSOR_SET_TEMP_CHIPSET_CPU_MB | SENSOR_TEMP_VRM |
+ SENSOR_TEMP_T_SENSOR | SENSOR_FAN_CPU_OPT |
+ SENSOR_CURR_CPU | SENSOR_IN_CPU_CORE,
++ .mutex_path = ASUS_HW_ACCESS_MUTEX_ASMX,
+ .family = family_amd_500_series,
+ };
+
+--
+2.39.2
+
--- /dev/null
+From d22aac475aac1ca6b5b53ba31414ac754c08e2b0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Jan 2023 12:46:20 +0100
+Subject: hwmon: (coretemp) Simplify platform device handling
+
+From: Robin Murphy <robin.murphy@arm.com>
+
+[ Upstream commit 6d03bbff456befeccdd4d663177c4d6c75d0c4ff ]
+
+Coretemp's platform driver is unconventional. All the real work is done
+globally by the initcall and CPU hotplug notifiers, while the "driver"
+effectively just wraps an allocation and the registration of the hwmon
+interface in a long-winded round-trip through the driver core. The whole
+logic of dynamically creating and destroying platform devices to bring
+the interfaces up and down is error prone, since it assumes
+platform_device_add() will synchronously bind the driver and set drvdata
+before it returns, thus results in a NULL dereference if drivers_autoprobe
+is turned off for the platform bus. Furthermore, the unusual approach of
+doing that from within a CPU hotplug notifier, already commented in the
+code that it deadlocks suspend, also causes lockdep issues for other
+drivers or subsystems which may want to legitimately register a CPU
+hotplug notifier from a platform bus notifier.
+
+All of these issues can be solved by ripping this unusual behaviour out
+completely, simply tying the platform devices to the lifetime of the
+module itself, and directly managing the hwmon interfaces from the
+hotplug notifiers. There is a slight user-visible change in that
+/sys/bus/platform/drivers/coretemp will no longer appear, and
+/sys/devices/platform/coretemp.n will remain present if package n is
+hotplugged off, but hwmon users should really only be looking for the
+presence of the hwmon interfaces, whose behaviour remains unchanged.
+
+Link: https://lore.kernel.org/lkml/20220922101036.87457-1-janusz.krzysztofik@linux.intel.com/
+Link: https://gitlab.freedesktop.org/drm/intel/issues/6641
+Signed-off-by: Robin Murphy <robin.murphy@arm.com>
+Signed-off-by: Janusz Krzysztofik <janusz.krzysztofik@linux.intel.com>
+Link: https://lore.kernel.org/r/20230103114620.15319-1-janusz.krzysztofik@linux.intel.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/coretemp.c | 128 ++++++++++++++++++---------------------
+ 1 file changed, 58 insertions(+), 70 deletions(-)
+
+diff --git a/drivers/hwmon/coretemp.c b/drivers/hwmon/coretemp.c
+index ca7a9b373bbd6..3e440ebe2508c 100644
+--- a/drivers/hwmon/coretemp.c
++++ b/drivers/hwmon/coretemp.c
+@@ -588,66 +588,49 @@ static void coretemp_remove_core(struct platform_data *pdata, int indx)
+ ida_free(&pdata->ida, indx - BASE_SYSFS_ATTR_NO);
+ }
+
+-static int coretemp_probe(struct platform_device *pdev)
++static int coretemp_device_add(int zoneid)
+ {
+- struct device *dev = &pdev->dev;
++ struct platform_device *pdev;
+ struct platform_data *pdata;
++ int err;
+
+ /* Initialize the per-zone data structures */
+- pdata = devm_kzalloc(dev, sizeof(struct platform_data), GFP_KERNEL);
++ pdata = kzalloc(sizeof(*pdata), GFP_KERNEL);
+ if (!pdata)
+ return -ENOMEM;
+
+- pdata->pkg_id = pdev->id;
++ pdata->pkg_id = zoneid;
+ ida_init(&pdata->ida);
+- platform_set_drvdata(pdev, pdata);
+
+- pdata->hwmon_dev = devm_hwmon_device_register_with_groups(dev, DRVNAME,
+- pdata, NULL);
+- return PTR_ERR_OR_ZERO(pdata->hwmon_dev);
+-}
+-
+-static int coretemp_remove(struct platform_device *pdev)
+-{
+- struct platform_data *pdata = platform_get_drvdata(pdev);
+- int i;
++ pdev = platform_device_alloc(DRVNAME, zoneid);
++ if (!pdev) {
++ err = -ENOMEM;
++ goto err_free_pdata;
++ }
+
+- for (i = MAX_CORE_DATA - 1; i >= 0; --i)
+- if (pdata->core_data[i])
+- coretemp_remove_core(pdata, i);
++ err = platform_device_add(pdev);
++ if (err)
++ goto err_put_dev;
+
+- ida_destroy(&pdata->ida);
++ platform_set_drvdata(pdev, pdata);
++ zone_devices[zoneid] = pdev;
+ return 0;
+-}
+
+-static struct platform_driver coretemp_driver = {
+- .driver = {
+- .name = DRVNAME,
+- },
+- .probe = coretemp_probe,
+- .remove = coretemp_remove,
+-};
++err_put_dev:
++ platform_device_put(pdev);
++err_free_pdata:
++ kfree(pdata);
++ return err;
++}
+
+-static struct platform_device *coretemp_device_add(unsigned int cpu)
++static void coretemp_device_remove(int zoneid)
+ {
+- int err, zoneid = topology_logical_die_id(cpu);
+- struct platform_device *pdev;
+-
+- if (zoneid < 0)
+- return ERR_PTR(-ENOMEM);
+-
+- pdev = platform_device_alloc(DRVNAME, zoneid);
+- if (!pdev)
+- return ERR_PTR(-ENOMEM);
+-
+- err = platform_device_add(pdev);
+- if (err) {
+- platform_device_put(pdev);
+- return ERR_PTR(err);
+- }
++ struct platform_device *pdev = zone_devices[zoneid];
++ struct platform_data *pdata = platform_get_drvdata(pdev);
+
+- zone_devices[zoneid] = pdev;
+- return pdev;
++ ida_destroy(&pdata->ida);
++ kfree(pdata);
++ platform_device_unregister(pdev);
+ }
+
+ static int coretemp_cpu_online(unsigned int cpu)
+@@ -671,7 +654,10 @@ static int coretemp_cpu_online(unsigned int cpu)
+ if (!cpu_has(c, X86_FEATURE_DTHERM))
+ return -ENODEV;
+
+- if (!pdev) {
++ pdata = platform_get_drvdata(pdev);
++ if (!pdata->hwmon_dev) {
++ struct device *hwmon;
++
+ /* Check the microcode version of the CPU */
+ if (chk_ucode_version(cpu))
+ return -EINVAL;
+@@ -682,9 +668,11 @@ static int coretemp_cpu_online(unsigned int cpu)
+ * online. So, initialize per-pkg data structures and
+ * then bring this core online.
+ */
+- pdev = coretemp_device_add(cpu);
+- if (IS_ERR(pdev))
+- return PTR_ERR(pdev);
++ hwmon = hwmon_device_register_with_groups(&pdev->dev, DRVNAME,
++ pdata, NULL);
++ if (IS_ERR(hwmon))
++ return PTR_ERR(hwmon);
++ pdata->hwmon_dev = hwmon;
+
+ /*
+ * Check whether pkgtemp support is available.
+@@ -694,7 +682,6 @@ static int coretemp_cpu_online(unsigned int cpu)
+ coretemp_add_core(pdev, cpu, 1);
+ }
+
+- pdata = platform_get_drvdata(pdev);
+ /*
+ * Check whether a thread sibling is already online. If not add the
+ * interface for this CPU core.
+@@ -713,18 +700,14 @@ static int coretemp_cpu_offline(unsigned int cpu)
+ struct temp_data *tdata;
+ int i, indx = -1, target;
+
+- /*
+- * Don't execute this on suspend as the device remove locks
+- * up the machine.
+- */
++ /* No need to tear down any interfaces for suspend */
+ if (cpuhp_tasks_frozen)
+ return 0;
+
+ /* If the physical CPU device does not exist, just return */
+- if (!pdev)
+- return 0;
+-
+ pd = platform_get_drvdata(pdev);
++ if (!pd->hwmon_dev)
++ return 0;
+
+ for (i = 0; i < NUM_REAL_CORES; i++) {
+ if (pd->cpu_map[i] == topology_core_id(cpu)) {
+@@ -756,13 +739,14 @@ static int coretemp_cpu_offline(unsigned int cpu)
+ }
+
+ /*
+- * If all cores in this pkg are offline, remove the device. This
+- * will invoke the platform driver remove function, which cleans up
+- * the rest.
++ * If all cores in this pkg are offline, remove the interface.
+ */
++ tdata = pd->core_data[PKG_SYSFS_ATTR_NO];
+ if (cpumask_empty(&pd->cpumask)) {
+- zone_devices[topology_logical_die_id(cpu)] = NULL;
+- platform_device_unregister(pdev);
++ if (tdata)
++ coretemp_remove_core(pd, PKG_SYSFS_ATTR_NO);
++ hwmon_device_unregister(pd->hwmon_dev);
++ pd->hwmon_dev = NULL;
+ return 0;
+ }
+
+@@ -770,7 +754,6 @@ static int coretemp_cpu_offline(unsigned int cpu)
+ * Check whether this core is the target for the package
+ * interface. We need to assign it to some other cpu.
+ */
+- tdata = pd->core_data[PKG_SYSFS_ATTR_NO];
+ if (tdata && tdata->cpu == cpu) {
+ target = cpumask_first(&pd->cpumask);
+ mutex_lock(&tdata->update_lock);
+@@ -789,7 +772,7 @@ static enum cpuhp_state coretemp_hp_online;
+
+ static int __init coretemp_init(void)
+ {
+- int err;
++ int i, err;
+
+ /*
+ * CPUID.06H.EAX[0] indicates whether the CPU has thermal
+@@ -805,20 +788,22 @@ static int __init coretemp_init(void)
+ if (!zone_devices)
+ return -ENOMEM;
+
+- err = platform_driver_register(&coretemp_driver);
+- if (err)
+- goto outzone;
++ for (i = 0; i < max_zones; i++) {
++ err = coretemp_device_add(i);
++ if (err)
++ goto outzone;
++ }
+
+ err = cpuhp_setup_state(CPUHP_AP_ONLINE_DYN, "hwmon/coretemp:online",
+ coretemp_cpu_online, coretemp_cpu_offline);
+ if (err < 0)
+- goto outdrv;
++ goto outzone;
+ coretemp_hp_online = err;
+ return 0;
+
+-outdrv:
+- platform_driver_unregister(&coretemp_driver);
+ outzone:
++ while (i--)
++ coretemp_device_remove(i);
+ kfree(zone_devices);
+ return err;
+ }
+@@ -826,8 +811,11 @@ module_init(coretemp_init)
+
+ static void __exit coretemp_exit(void)
+ {
++ int i;
++
+ cpuhp_remove_state(coretemp_hp_online);
+- platform_driver_unregister(&coretemp_driver);
++ for (i = 0; i < max_zones; i++)
++ coretemp_device_remove(i);
+ kfree(zone_devices);
+ }
+ module_exit(coretemp_exit)
+--
+2.39.2
+
--- /dev/null
+From 2cfa8c06071761399e12fdc570c5453d00949f00 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 24 Dec 2022 05:18:53 +0100
+Subject: hwmon: (ftsteutates) Fix scaling of measurements
+
+From: Armin Wolf <W_Armin@gmx.de>
+
+[ Upstream commit ca8fd8c16a8b77dfcf7f6ce52d2c863220693a78 ]
+
+A user complained that the ftsteutates driver was displaying
+bogus values since its introduction. This happens because the
+sensor measurements need to be scaled in order to produce
+meaningful results:
+- the fan speed needs to be multiplied by 60 since its in RPS
+- the temperature is in degrees celsius and needs an offset of 64
+- the voltage is in 1/256 of 3.3V
+
+The offical datasheet says the voltage needs to be divided by 256,
+but this is likely an off-by-one-error, since even the BIOS
+devides by 255 (otherwise 3.3V could not be measured).
+
+The voltage channels additionally need a board-specific multiplier,
+however this can be done by the driver since its board-specific.
+
+The reason the missing scaling of measurements is the way Fujitsu
+used this driver when it was still out-of-tree. Back then, all
+scaling was done in userspace by libsensors, even the generic one.
+
+Tested on a Fujitsu DS3401-B1.
+
+Fixes: 08426eda58e0 ("hwmon: Add driver for FTS BMC chip "Teutates"")
+Signed-off-by: Armin Wolf <W_Armin@gmx.de>
+Link: https://lore.kernel.org/r/20221224041855.83981-2-W_Armin@gmx.de
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/hwmon/ftsteutates.rst | 4 ++++
+ drivers/hwmon/ftsteutates.c | 19 +++++++++++++------
+ 2 files changed, 17 insertions(+), 6 deletions(-)
+
+diff --git a/Documentation/hwmon/ftsteutates.rst b/Documentation/hwmon/ftsteutates.rst
+index 58a2483d8d0da..198fa8e2819da 100644
+--- a/Documentation/hwmon/ftsteutates.rst
++++ b/Documentation/hwmon/ftsteutates.rst
+@@ -22,6 +22,10 @@ enhancements. It can monitor up to 4 voltages, 16 temperatures and
+ 8 fans. It also contains an integrated watchdog which is currently
+ implemented in this driver.
+
++The 4 voltages require a board-specific multiplier, since the BMC can
++only measure voltages up to 3.3V and thus relies on voltage dividers.
++Consult your motherboard manual for details.
++
+ To clear a temperature or fan alarm, execute the following command with the
+ correct path to the alarm file::
+
+diff --git a/drivers/hwmon/ftsteutates.c b/drivers/hwmon/ftsteutates.c
+index f5b8e724a8ca1..ffa0bb3648775 100644
+--- a/drivers/hwmon/ftsteutates.c
++++ b/drivers/hwmon/ftsteutates.c
+@@ -12,6 +12,7 @@
+ #include <linux/i2c.h>
+ #include <linux/init.h>
+ #include <linux/jiffies.h>
++#include <linux/math.h>
+ #include <linux/module.h>
+ #include <linux/mutex.h>
+ #include <linux/slab.h>
+@@ -347,13 +348,15 @@ static ssize_t in_value_show(struct device *dev,
+ {
+ struct fts_data *data = dev_get_drvdata(dev);
+ int index = to_sensor_dev_attr(devattr)->index;
+- int err;
++ int value, err;
+
+ err = fts_update_device(data);
+ if (err < 0)
+ return err;
+
+- return sprintf(buf, "%u\n", data->volt[index]);
++ value = DIV_ROUND_CLOSEST(data->volt[index] * 3300, 255);
++
++ return sprintf(buf, "%d\n", value);
+ }
+
+ static ssize_t temp_value_show(struct device *dev,
+@@ -361,13 +364,15 @@ static ssize_t temp_value_show(struct device *dev,
+ {
+ struct fts_data *data = dev_get_drvdata(dev);
+ int index = to_sensor_dev_attr(devattr)->index;
+- int err;
++ int value, err;
+
+ err = fts_update_device(data);
+ if (err < 0)
+ return err;
+
+- return sprintf(buf, "%u\n", data->temp_input[index]);
++ value = (data->temp_input[index] - 64) * 1000;
++
++ return sprintf(buf, "%d\n", value);
+ }
+
+ static ssize_t temp_fault_show(struct device *dev,
+@@ -436,13 +441,15 @@ static ssize_t fan_value_show(struct device *dev,
+ {
+ struct fts_data *data = dev_get_drvdata(dev);
+ int index = to_sensor_dev_attr(devattr)->index;
+- int err;
++ int value, err;
+
+ err = fts_update_device(data);
+ if (err < 0)
+ return err;
+
+- return sprintf(buf, "%u\n", data->fan_input[index]);
++ value = data->fan_input[index] * 60;
++
++ return sprintf(buf, "%d\n", value);
+ }
+
+ static ssize_t fan_source_show(struct device *dev,
+--
+2.39.2
+
--- /dev/null
+From de26e5e650610a9d0298b70bc3a1f3bbadee4ba0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Jan 2023 17:32:25 -0500
+Subject: hwmon: (ltc2945) Handle error case in ltc2945_value_store
+
+From: Jonathan Cormier <jcormier@criticallink.com>
+
+[ Upstream commit 178b01eccfb0b8149682f61388400bd3d903dddc ]
+
+ltc2945_val_to_reg errors were not being handled
+which would have resulted in register being set to
+0 (clamped) instead of being left alone.
+
+Fixes: 6700ce035f83 ("hwmon: Driver for Linear Technologies LTC2945")
+
+Signed-off-by: Jonathan Cormier <jcormier@criticallink.com>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/ltc2945.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/hwmon/ltc2945.c b/drivers/hwmon/ltc2945.c
+index 9adebb59f6042..c06ab7317431f 100644
+--- a/drivers/hwmon/ltc2945.c
++++ b/drivers/hwmon/ltc2945.c
+@@ -248,6 +248,8 @@ static ssize_t ltc2945_value_store(struct device *dev,
+
+ /* convert to register value, then clamp and write result */
+ regval = ltc2945_val_to_reg(dev, reg, val);
++ if (regval < 0)
++ return regval;
+ if (is_power_reg(reg)) {
+ regval = clamp_val(regval, 0, 0xffffff);
+ regbuf[0] = regval >> 16;
+--
+2.39.2
+
--- /dev/null
+From d3f461123be13a4915957d6474857731476da1bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 12 Feb 2023 16:57:30 +0200
+Subject: hwmon: (mlxreg-fan) Return zero speed for broken fan
+
+From: Vadim Pasternak <vadimp@nvidia.com>
+
+[ Upstream commit a1ffd3c46267ee5c807acd780e15df9bb692223f ]
+
+Currently for broken fan driver returns value calculated based on error
+code (0xFF) in related fan speed register.
+Thus, for such fan user gets fan{n}_fault to 1 and fan{n}_input with
+misleading value.
+
+Add check for fan fault prior return speed value and return zero if
+fault is detected.
+
+Fixes: 65afb4c8e7e4 ("hwmon: (mlxreg-fan) Add support for Mellanox FAN driver")
+Signed-off-by: Vadim Pasternak <vadimp@nvidia.com>
+Link: https://lore.kernel.org/r/20230212145730.24247-1-vadimp@nvidia.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/mlxreg-fan.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/hwmon/mlxreg-fan.c b/drivers/hwmon/mlxreg-fan.c
+index b48bd7c961d66..96017cc8da7ec 100644
+--- a/drivers/hwmon/mlxreg-fan.c
++++ b/drivers/hwmon/mlxreg-fan.c
+@@ -155,6 +155,12 @@ mlxreg_fan_read(struct device *dev, enum hwmon_sensor_types type, u32 attr,
+ if (err)
+ return err;
+
++ if (MLXREG_FAN_GET_FAULT(regval, tacho->mask)) {
++ /* FAN is broken - return zero for FAN speed. */
++ *val = 0;
++ return 0;
++ }
++
+ *val = MLXREG_FAN_GET_RPM(regval, fan->divider,
+ fan->samples);
+ break;
+--
+2.39.2
+
--- /dev/null
+From 32d306f5098fca6848bcf0b87100305725edb32b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Jan 2023 23:22:41 +0200
+Subject: hwmon: (nct6775) B650/B660/X670 ASUS boards support
+
+From: Denis Pauk <pauk.denis@gmail.com>
+
+[ Upstream commit e2e09989ccc21ad428d6393450add78584b143bd ]
+
+Boards such as:
+ "EX-B660M-V5 PRO D4",
+ "PRIME B650-PLUS",
+ "PRIME B650M-A",
+ "PRIME B650M-A AX",
+ "PRIME B650M-A II",
+ "PRIME B650M-A WIFI",
+ "PRIME B650M-A WIFI II",
+ "PRIME B660M-A D4",
+ "PRIME B660M-A WIFI D4",
+ "PRIME X670-P",
+ "PRIME X670-P WIFI",
+ "PRIME X670E-PRO WIFI",
+ "Pro B660M-C-D4",
+ "ProArt B660-CREATOR D4",
+ "ProArt X670E-CREATOR WIFI",
+ "ROG CROSSHAIR X670E EXTREME",
+ "ROG CROSSHAIR X670E GENE",
+ "ROG CROSSHAIR X670E HERO",
+ "ROG MAXIMUS XIII EXTREME GLACIAL",
+ "ROG MAXIMUS Z690 EXTREME",
+ "ROG MAXIMUS Z690 EXTREME GLACIAL",
+ "ROG STRIX B650-A GAMING WIFI",
+ "ROG STRIX B650E-E GAMING WIFI",
+ "ROG STRIX B650E-F GAMING WIFI",
+ "ROG STRIX B650E-I GAMING WIFI",
+ "ROG STRIX B660-A GAMING WIFI D4",
+ "ROG STRIX B660-F GAMING WIFI",
+ "ROG STRIX B660-G GAMING WIFI",
+ "ROG STRIX B660-I GAMING WIFI",
+ "ROG STRIX X670E-A GAMING WIFI",
+ "ROG STRIX X670E-E GAMING WIFI",
+ "ROG STRIX X670E-F GAMING WIFI",
+ "ROG STRIX X670E-I GAMING WIFI",
+ "ROG STRIX Z590-A GAMING WIFI II",
+ "ROG STRIX Z690-A GAMING WIFI D4",
+ "TUF GAMING B650-PLUS",
+ "TUF GAMING B650-PLUS WIFI",
+ "TUF GAMING B650M-PLUS",
+ "TUF GAMING B650M-PLUS WIFI",
+ "TUF GAMING B660M-PLUS WIFI",
+ "TUF GAMING X670E-PLUS",
+ "TUF GAMING X670E-PLUS WIFI",
+ "TUF GAMING Z590-PLUS WIFI",
+have got a NCT6799D chip, but by default there's no use of it
+because of resource conflict with WMI method.
+
+This commit adds such boards to the monitoring list with new ACPI device
+UID.
+
+BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=204807
+Signed-off-by: Denis Pauk <pauk.denis@gmail.com>
+Co-developed-by: Ahmad Khalifa <ahmad@khalifa.ws>
+Signed-off-by: Ahmad Khalifa <ahmad@khalifa.ws>
+Tested-by: Jeroen Beerstra <jeroen@beerstra.org>
+Tested-by: Slawomir Stepien <sst@poczta.fm>
+Link: https://lore.kernel.org/r/20230111212241.7456-2-pauk.denis@gmail.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/nct6775-platform.c | 52 ++++++++++++++++++++++++++++++++
+ 1 file changed, 52 insertions(+)
+
+diff --git a/drivers/hwmon/nct6775-platform.c b/drivers/hwmon/nct6775-platform.c
+index e5d4a79cd5f7d..76c6b564d7fc4 100644
+--- a/drivers/hwmon/nct6775-platform.c
++++ b/drivers/hwmon/nct6775-platform.c
+@@ -114,6 +114,7 @@ struct nct6775_sio_data {
+ #define ASUSWMI_UNSUPPORTED_METHOD 0xFFFFFFFE
+ #define ASUSWMI_DEVICE_HID "PNP0C14"
+ #define ASUSWMI_DEVICE_UID "ASUSWMI"
++#define ASUSMSI_DEVICE_UID "AsusMbSwInterface"
+
+ #if IS_ENABLED(CONFIG_ACPI)
+ /*
+@@ -1108,6 +1109,52 @@ static const char * const asus_wmi_boards[] = {
+ "TUF GAMING Z490-PLUS (WI-FI)",
+ };
+
++static const char * const asus_msi_boards[] = {
++ "EX-B660M-V5 PRO D4",
++ "PRIME B650-PLUS",
++ "PRIME B650M-A",
++ "PRIME B650M-A AX",
++ "PRIME B650M-A II",
++ "PRIME B650M-A WIFI",
++ "PRIME B650M-A WIFI II",
++ "PRIME B660M-A D4",
++ "PRIME B660M-A WIFI D4",
++ "PRIME X670-P",
++ "PRIME X670-P WIFI",
++ "PRIME X670E-PRO WIFI",
++ "Pro B660M-C-D4",
++ "ProArt B660-CREATOR D4",
++ "ProArt X670E-CREATOR WIFI",
++ "ROG CROSSHAIR X670E EXTREME",
++ "ROG CROSSHAIR X670E GENE",
++ "ROG CROSSHAIR X670E HERO",
++ "ROG MAXIMUS XIII EXTREME GLACIAL",
++ "ROG MAXIMUS Z690 EXTREME",
++ "ROG MAXIMUS Z690 EXTREME GLACIAL",
++ "ROG STRIX B650-A GAMING WIFI",
++ "ROG STRIX B650E-E GAMING WIFI",
++ "ROG STRIX B650E-F GAMING WIFI",
++ "ROG STRIX B650E-I GAMING WIFI",
++ "ROG STRIX B660-A GAMING WIFI D4",
++ "ROG STRIX B660-F GAMING WIFI",
++ "ROG STRIX B660-G GAMING WIFI",
++ "ROG STRIX B660-I GAMING WIFI",
++ "ROG STRIX X670E-A GAMING WIFI",
++ "ROG STRIX X670E-E GAMING WIFI",
++ "ROG STRIX X670E-F GAMING WIFI",
++ "ROG STRIX X670E-I GAMING WIFI",
++ "ROG STRIX Z590-A GAMING WIFI II",
++ "ROG STRIX Z690-A GAMING WIFI D4",
++ "TUF GAMING B650-PLUS",
++ "TUF GAMING B650-PLUS WIFI",
++ "TUF GAMING B650M-PLUS",
++ "TUF GAMING B650M-PLUS WIFI",
++ "TUF GAMING B660M-PLUS WIFI",
++ "TUF GAMING X670E-PLUS",
++ "TUF GAMING X670E-PLUS WIFI",
++ "TUF GAMING Z590-PLUS WIFI",
++};
++
+ #if IS_ENABLED(CONFIG_ACPI)
+ /*
+ * Callback for acpi_bus_for_each_dev() to find the right device
+@@ -1171,6 +1218,11 @@ static int __init sensors_nct6775_platform_init(void)
+ board_name);
+ if (err >= 0)
+ access = nct6775_determine_access(ASUSWMI_DEVICE_UID);
++
++ err = match_string(asus_msi_boards, ARRAY_SIZE(asus_msi_boards),
++ board_name);
++ if (err >= 0)
++ access = nct6775_determine_access(ASUSMSI_DEVICE_UID);
+ }
+
+ /*
+--
+2.39.2
+
--- /dev/null
+From b85daff20c4af17fb103b4369917bf8c1f4d9d07 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Jan 2023 23:22:40 +0200
+Subject: hwmon: (nct6775) Directly call ASUS ACPI WMI method
+
+From: Denis Pauk <pauk.denis@gmail.com>
+
+[ Upstream commit c3b3747d02f571da2543e719066a50dd966989d8 ]
+
+New ASUS B650/B660/X670 boards firmware have not exposed WMI monitoring
+GUID and entrypoint method WMBD could be implemented for different device
+UID.
+
+Implement the direct call to entrypoint method for monitoring the device
+UID of B550/X570 boards.
+
+BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=204807
+Signed-off-by: Denis Pauk <pauk.denis@gmail.com>
+Co-developed-by: Ahmad Khalifa <ahmad@khalifa.ws>
+Signed-off-by: Ahmad Khalifa <ahmad@khalifa.ws>
+Link: https://lore.kernel.org/r/20230111212241.7456-1-pauk.denis@gmail.com
+[groeck: Fix multi-line formatting]
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/Kconfig | 2 +-
+ drivers/hwmon/nct6775-platform.c | 98 ++++++++++++++++++++++----------
+ 2 files changed, 70 insertions(+), 30 deletions(-)
+
+diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig
+index 3176c33af6c69..300ce8115ce4f 100644
+--- a/drivers/hwmon/Kconfig
++++ b/drivers/hwmon/Kconfig
+@@ -1516,7 +1516,7 @@ config SENSORS_NCT6775_CORE
+ config SENSORS_NCT6775
+ tristate "Platform driver for Nuvoton NCT6775F and compatibles"
+ depends on !PPC
+- depends on ACPI_WMI || ACPI_WMI=n
++ depends on ACPI || ACPI=n
+ select HWMON_VID
+ select SENSORS_NCT6775_CORE
+ help
+diff --git a/drivers/hwmon/nct6775-platform.c b/drivers/hwmon/nct6775-platform.c
+index bf43f73dc835f..e5d4a79cd5f7d 100644
+--- a/drivers/hwmon/nct6775-platform.c
++++ b/drivers/hwmon/nct6775-platform.c
+@@ -17,7 +17,6 @@
+ #include <linux/module.h>
+ #include <linux/platform_device.h>
+ #include <linux/regmap.h>
+-#include <linux/wmi.h>
+
+ #include "nct6775.h"
+
+@@ -107,40 +106,50 @@ struct nct6775_sio_data {
+ void (*sio_exit)(struct nct6775_sio_data *sio_data);
+ };
+
+-#define ASUSWMI_MONITORING_GUID "466747A0-70EC-11DE-8A39-0800200C9A66"
++#define ASUSWMI_METHOD "WMBD"
+ #define ASUSWMI_METHODID_RSIO 0x5253494F
+ #define ASUSWMI_METHODID_WSIO 0x5753494F
+ #define ASUSWMI_METHODID_RHWM 0x5248574D
+ #define ASUSWMI_METHODID_WHWM 0x5748574D
+ #define ASUSWMI_UNSUPPORTED_METHOD 0xFFFFFFFE
++#define ASUSWMI_DEVICE_HID "PNP0C14"
++#define ASUSWMI_DEVICE_UID "ASUSWMI"
++
++#if IS_ENABLED(CONFIG_ACPI)
++/*
++ * ASUS boards have only one device with WMI "WMBD" method and have provided
++ * access to only one SuperIO chip at 0x0290.
++ */
++static struct acpi_device *asus_acpi_dev;
++#endif
+
+ static int nct6775_asuswmi_evaluate_method(u32 method_id, u8 bank, u8 reg, u8 val, u32 *retval)
+ {
+-#if IS_ENABLED(CONFIG_ACPI_WMI)
++#if IS_ENABLED(CONFIG_ACPI)
++ acpi_handle handle = acpi_device_handle(asus_acpi_dev);
+ u32 args = bank | (reg << 8) | (val << 16);
+- struct acpi_buffer input = { (acpi_size) sizeof(args), &args };
+- struct acpi_buffer output = { ACPI_ALLOCATE_BUFFER, NULL };
++ struct acpi_object_list input;
++ union acpi_object params[3];
++ unsigned long long result;
+ acpi_status status;
+- union acpi_object *obj;
+- u32 tmp = ASUSWMI_UNSUPPORTED_METHOD;
+-
+- status = wmi_evaluate_method(ASUSWMI_MONITORING_GUID, 0,
+- method_id, &input, &output);
+
++ params[0].type = ACPI_TYPE_INTEGER;
++ params[0].integer.value = 0;
++ params[1].type = ACPI_TYPE_INTEGER;
++ params[1].integer.value = method_id;
++ params[2].type = ACPI_TYPE_BUFFER;
++ params[2].buffer.length = sizeof(args);
++ params[2].buffer.pointer = (void *)&args;
++ input.count = 3;
++ input.pointer = params;
++
++ status = acpi_evaluate_integer(handle, ASUSWMI_METHOD, &input, &result);
+ if (ACPI_FAILURE(status))
+ return -EIO;
+
+- obj = output.pointer;
+- if (obj && obj->type == ACPI_TYPE_INTEGER)
+- tmp = obj->integer.value;
+-
+ if (retval)
+- *retval = tmp;
++ *retval = (u32)result & 0xFFFFFFFF;
+
+- kfree(obj);
+-
+- if (tmp == ASUSWMI_UNSUPPORTED_METHOD)
+- return -ENODEV;
+ return 0;
+ #else
+ return -EOPNOTSUPP;
+@@ -1099,6 +1108,45 @@ static const char * const asus_wmi_boards[] = {
+ "TUF GAMING Z490-PLUS (WI-FI)",
+ };
+
++#if IS_ENABLED(CONFIG_ACPI)
++/*
++ * Callback for acpi_bus_for_each_dev() to find the right device
++ * by _UID and _HID and return 1 to stop iteration.
++ */
++static int nct6775_asuswmi_device_match(struct device *dev, void *data)
++{
++ struct acpi_device *adev = to_acpi_device(dev);
++ const char *uid = acpi_device_uid(adev);
++ const char *hid = acpi_device_hid(adev);
++
++ if (hid && !strcmp(hid, ASUSWMI_DEVICE_HID) && uid && !strcmp(uid, data)) {
++ asus_acpi_dev = adev;
++ return 1;
++ }
++
++ return 0;
++}
++#endif
++
++static enum sensor_access nct6775_determine_access(const char *device_uid)
++{
++#if IS_ENABLED(CONFIG_ACPI)
++ u8 tmp;
++
++ acpi_bus_for_each_dev(nct6775_asuswmi_device_match, (void *)device_uid);
++ if (!asus_acpi_dev)
++ return access_direct;
++
++ /* if reading chip id via ACPI succeeds, use WMI "WMBD" method for access */
++ if (!nct6775_asuswmi_read(0, NCT6775_PORT_CHIPID, &tmp) && tmp) {
++ pr_debug("Using Asus WMBD method of %s to access %#x chip.\n", device_uid, tmp);
++ return access_asuswmi;
++ }
++#endif
++
++ return access_direct;
++}
++
+ static int __init sensors_nct6775_platform_init(void)
+ {
+ int i, err;
+@@ -1109,7 +1157,6 @@ static int __init sensors_nct6775_platform_init(void)
+ int sioaddr[2] = { 0x2e, 0x4e };
+ enum sensor_access access = access_direct;
+ const char *board_vendor, *board_name;
+- u8 tmp;
+
+ err = platform_driver_register(&nct6775_driver);
+ if (err)
+@@ -1122,15 +1169,8 @@ static int __init sensors_nct6775_platform_init(void)
+ !strcmp(board_vendor, "ASUSTeK COMPUTER INC.")) {
+ err = match_string(asus_wmi_boards, ARRAY_SIZE(asus_wmi_boards),
+ board_name);
+- if (err >= 0) {
+- /* if reading chip id via WMI succeeds, use WMI */
+- if (!nct6775_asuswmi_read(0, NCT6775_PORT_CHIPID, &tmp) && tmp) {
+- pr_info("Using Asus WMI to access %#x chip.\n", tmp);
+- access = access_asuswmi;
+- } else {
+- pr_err("Can't read ChipID by Asus WMI.\n");
+- }
+- }
++ if (err >= 0)
++ access = nct6775_determine_access(ASUSWMI_DEVICE_UID);
+ }
+
+ /*
+--
+2.39.2
+
--- /dev/null
+From abbba67f92205c5a939e1164050eab2d870fec4b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Jan 2023 19:22:00 +0800
+Subject: hwtracing: hisi_ptt: Only add the supported devices to the filters
+ list
+
+From: Yicong Yang <yangyicong@hisilicon.com>
+
+[ Upstream commit b8d976c7d41a28c0fccf22c7113be9a29dc07e5c ]
+
+The PTT device can only support the devices on the same PCIe core,
+within BDF range [lower_bdf, upper_bdf]. It's not correct to assume
+the devices on the root bus are from the same PCIe core, there are
+cases that root ports from different PCIe core are sharing the same
+bus. So check when initializing the filters list.
+
+Fixes: ff0de066b463 ("hwtracing: hisi_ptt: Add trace function support for HiSilicon PCIe Tune and Trace device")
+Signed-off-by: Yicong Yang <yangyicong@hisilicon.com>
+Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Link: https://lore.kernel.org/r/20230112112201.16283-1-yangyicong@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/ptt/hisi_ptt.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/hwtracing/ptt/hisi_ptt.c b/drivers/hwtracing/ptt/hisi_ptt.c
+index 5d5526aa60c40..30f1525639b57 100644
+--- a/drivers/hwtracing/ptt/hisi_ptt.c
++++ b/drivers/hwtracing/ptt/hisi_ptt.c
+@@ -356,8 +356,18 @@ static int hisi_ptt_register_irq(struct hisi_ptt *hisi_ptt)
+
+ static int hisi_ptt_init_filters(struct pci_dev *pdev, void *data)
+ {
++ struct pci_dev *root_port = pcie_find_root_port(pdev);
+ struct hisi_ptt_filter_desc *filter;
+ struct hisi_ptt *hisi_ptt = data;
++ u32 port_devid;
++
++ if (!root_port)
++ return 0;
++
++ port_devid = PCI_DEVID(root_port->bus->number, root_port->devfn);
++ if (port_devid < hisi_ptt->lower_bdf ||
++ port_devid > hisi_ptt->upper_bdf)
++ return 0;
+
+ /*
+ * We won't fail the probe if filter allocation failed here. The filters
+--
+2.39.2
+
--- /dev/null
+From bba8d316b624da841dc0638610f86e92c780f9ab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Dec 2022 17:23:45 +0000
+Subject: i2c: designware: fix i2c_dw_clk_rate() return size to be u32
+
+From: Hanna Hawa <hhhawa@amazon.com>
+
+[ Upstream commit f2e1fa99550dd7a882229e2c2cd9ecab4ce773d0 ]
+
+Make i2c_dw_clk_rate() to return u32 instead of unsigned long, as the
+function return the value of get_clk_rate_khz() which returns u32.
+
+Fixes: b33af11de236 ("i2c: designware: Do not require clock when SSCN and FFCN are provided")
+Signed-off-by: Hanna Hawa <hhhawa@amazon.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Acked-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-designware-common.c | 2 +-
+ drivers/i2c/busses/i2c-designware-core.h | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-designware-common.c b/drivers/i2c/busses/i2c-designware-common.c
+index 581e02cc979a0..2f2e99882b011 100644
+--- a/drivers/i2c/busses/i2c-designware-common.c
++++ b/drivers/i2c/busses/i2c-designware-common.c
+@@ -465,7 +465,7 @@ void __i2c_dw_disable(struct dw_i2c_dev *dev)
+ dev_warn(dev->dev, "timeout in disabling adapter\n");
+ }
+
+-unsigned long i2c_dw_clk_rate(struct dw_i2c_dev *dev)
++u32 i2c_dw_clk_rate(struct dw_i2c_dev *dev)
+ {
+ /*
+ * Clock is not necessary if we got LCNT/HCNT values directly from
+diff --git a/drivers/i2c/busses/i2c-designware-core.h b/drivers/i2c/busses/i2c-designware-core.h
+index 95ebc5eaa5d12..6bc2edec14f2f 100644
+--- a/drivers/i2c/busses/i2c-designware-core.h
++++ b/drivers/i2c/busses/i2c-designware-core.h
+@@ -320,7 +320,7 @@ int i2c_dw_init_regmap(struct dw_i2c_dev *dev);
+ u32 i2c_dw_scl_hcnt(u32 ic_clk, u32 tSYMBOL, u32 tf, int cond, int offset);
+ u32 i2c_dw_scl_lcnt(u32 ic_clk, u32 tLOW, u32 tf, int offset);
+ int i2c_dw_set_sda_hold(struct dw_i2c_dev *dev);
+-unsigned long i2c_dw_clk_rate(struct dw_i2c_dev *dev);
++u32 i2c_dw_clk_rate(struct dw_i2c_dev *dev);
+ int i2c_dw_prepare_clk(struct dw_i2c_dev *dev, bool prepare);
+ int i2c_dw_acquire_lock(struct dw_i2c_dev *dev);
+ void i2c_dw_release_lock(struct dw_i2c_dev *dev);
+--
+2.39.2
+
--- /dev/null
+From 6b5aba77fd66b883d40e22bb588244266f0aa6e6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Dec 2022 17:34:02 +0800
+Subject: i2c: qcom-geni: change i2c_master_hub to static
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit 597688792c4d9939e1900f5840ca18804e9d4290 ]
+
+i2c_master_hub is only used in i2c-qcom-geni.c now,
+change it to static.
+
+Fixes: cacd9643eca7 ("i2c: qcom-geni: add support for I2C Master Hub variant")
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Reviewed-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-qcom-geni.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/i2c/busses/i2c-qcom-geni.c b/drivers/i2c/busses/i2c-qcom-geni.c
+index fd70794bfceec..a378f679b499d 100644
+--- a/drivers/i2c/busses/i2c-qcom-geni.c
++++ b/drivers/i2c/busses/i2c-qcom-geni.c
+@@ -1025,7 +1025,7 @@ static const struct dev_pm_ops geni_i2c_pm_ops = {
+ NULL)
+ };
+
+-const struct geni_i2c_desc i2c_master_hub = {
++static const struct geni_i2c_desc i2c_master_hub = {
+ .has_core_clk = true,
+ .icc_ddr = NULL,
+ .no_dma_support = true,
+--
+2.39.2
+
--- /dev/null
+From 33ac6878dc0f285388c477db44138745a2228eaf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Feb 2023 11:56:23 -0500
+Subject: IB/hfi1: Fix math bugs in hfi1_can_pin_pages()
+
+From: Patrick Kelsey <pat.kelsey@cornelisnetworks.com>
+
+[ Upstream commit a0d198f79a8d033bd46605b779859193649f1f99 ]
+
+Fix arithmetic and logic errors in hfi1_can_pin_pages() that would allow
+hfi1 to attempt pinning pages in cases where it should not because of
+resource limits or lack of required capability.
+
+Fixes: 2c97ce4f3c29 ("IB/hfi1: Add pin query function")
+Link: https://lore.kernel.org/r/167656658362.2223096.10954762619837718026.stgit@awfm-02.cornelisnetworks.com
+Signed-off-by: Brendan Cunningham <bcunningham@cornelisnetworks.com>
+Signed-off-by: Patrick Kelsey <pat.kelsey@cornelisnetworks.com>
+Signed-off-by: Dennis Dalessandro <dennis.dalessandro@cornelisnetworks.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hfi1/user_pages.c | 61 ++++++++++++++++---------
+ 1 file changed, 40 insertions(+), 21 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hfi1/user_pages.c b/drivers/infiniband/hw/hfi1/user_pages.c
+index 7bce963e2ae69..36aaedc651456 100644
+--- a/drivers/infiniband/hw/hfi1/user_pages.c
++++ b/drivers/infiniband/hw/hfi1/user_pages.c
+@@ -29,33 +29,52 @@ MODULE_PARM_DESC(cache_size, "Send and receive side cache size limit (in MB)");
+ bool hfi1_can_pin_pages(struct hfi1_devdata *dd, struct mm_struct *mm,
+ u32 nlocked, u32 npages)
+ {
+- unsigned long ulimit = rlimit(RLIMIT_MEMLOCK), pinned, cache_limit,
+- size = (cache_size * (1UL << 20)); /* convert to bytes */
+- unsigned int usr_ctxts =
+- dd->num_rcv_contexts - dd->first_dyn_alloc_ctxt;
+- bool can_lock = capable(CAP_IPC_LOCK);
++ unsigned long ulimit_pages;
++ unsigned long cache_limit_pages;
++ unsigned int usr_ctxts;
+
+ /*
+- * Calculate per-cache size. The calculation below uses only a quarter
+- * of the available per-context limit. This leaves space for other
+- * pinning. Should we worry about shared ctxts?
++ * Perform RLIMIT_MEMLOCK based checks unless CAP_IPC_LOCK is present.
+ */
+- cache_limit = (ulimit / usr_ctxts) / 4;
+-
+- /* If ulimit isn't set to "unlimited" and is smaller than cache_size. */
+- if (ulimit != (-1UL) && size > cache_limit)
+- size = cache_limit;
+-
+- /* Convert to number of pages */
+- size = DIV_ROUND_UP(size, PAGE_SIZE);
+-
+- pinned = atomic64_read(&mm->pinned_vm);
++ if (!capable(CAP_IPC_LOCK)) {
++ ulimit_pages =
++ DIV_ROUND_DOWN_ULL(rlimit(RLIMIT_MEMLOCK), PAGE_SIZE);
++
++ /*
++ * Pinning these pages would exceed this process's locked memory
++ * limit.
++ */
++ if (atomic64_read(&mm->pinned_vm) + npages > ulimit_pages)
++ return false;
++
++ /*
++ * Only allow 1/4 of the user's RLIMIT_MEMLOCK to be used for HFI
++ * caches. This fraction is then equally distributed among all
++ * existing user contexts. Note that if RLIMIT_MEMLOCK is
++ * 'unlimited' (-1), the value of this limit will be > 2^42 pages
++ * (2^64 / 2^12 / 2^8 / 2^2).
++ *
++ * The effectiveness of this check may be reduced if I/O occurs on
++ * some user contexts before all user contexts are created. This
++ * check assumes that this process is the only one using this
++ * context (e.g., the corresponding fd was not passed to another
++ * process for concurrent access) as there is no per-context,
++ * per-process tracking of pinned pages. It also assumes that each
++ * user context has only one cache to limit.
++ */
++ usr_ctxts = dd->num_rcv_contexts - dd->first_dyn_alloc_ctxt;
++ if (nlocked + npages > (ulimit_pages / usr_ctxts / 4))
++ return false;
++ }
+
+- /* First, check the absolute limit against all pinned pages. */
+- if (pinned + npages >= ulimit && !can_lock)
++ /*
++ * Pinning these pages would exceed the size limit for this cache.
++ */
++ cache_limit_pages = cache_size * (1024 * 1024) / PAGE_SIZE;
++ if (nlocked + npages > cache_limit_pages)
+ return false;
+
+- return ((nlocked + npages) <= size) || can_lock;
++ return true;
+ }
+
+ int hfi1_acquire_user_pages(struct mm_struct *mm, unsigned long vaddr, size_t npages,
+--
+2.39.2
+
--- /dev/null
+From 4e164dd6a1919dd21123e64988775309ef26c3fd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Feb 2023 11:56:28 -0500
+Subject: IB/hfi1: Fix sdma.h tx->num_descs off-by-one errors
+
+From: Patrick Kelsey <pat.kelsey@cornelisnetworks.com>
+
+[ Upstream commit fd8958efe8779d3db19c9124fce593ce681ac709 ]
+
+Fix three sources of error involving struct sdma_txreq.num_descs.
+
+When _extend_sdma_tx_descs() extends the descriptor array, it uses the
+value of tx->num_descs to determine how many existing entries from the
+tx's original, internal descriptor array to copy to the newly allocated
+one. As this value was incremented before the call, the copy loop will
+access one entry past the internal descriptor array, copying its contents
+into the corresponding slot in the new array.
+
+If the call to _extend_sdma_tx_descs() fails, _pad_smda_tx_descs() then
+invokes __sdma_tx_clean() which uses the value of tx->num_desc to drive a
+loop that unmaps all descriptor entries in use. As this value was
+incremented before the call, the unmap loop will invoke sdma_unmap_desc()
+on a descriptor entry whose contents consist of whatever random data was
+copied into it during (1), leading to cascading further calls into the
+kernel and driver using arbitrary data.
+
+_sdma_close_tx() was using tx->num_descs instead of tx->num_descs - 1.
+
+Fix all of the above by:
+- Only increment .num_descs after .descp is extended.
+- Use .num_descs - 1 instead of .num_descs for last .descp entry.
+
+Fixes: f4d26d81ad7f ("staging/rdma/hfi1: Add coalescing support for SDMA TX descriptors")
+Link: https://lore.kernel.org/r/167656658879.2223096.10026561343022570690.stgit@awfm-02.cornelisnetworks.com
+Signed-off-by: Brendan Cunningham <bcunningham@cornelisnetworks.com>
+Signed-off-by: Patrick Kelsey <pat.kelsey@cornelisnetworks.com>
+Signed-off-by: Dennis Dalessandro <dennis.dalessandro@cornelisnetworks.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hfi1/sdma.c | 4 ++--
+ drivers/infiniband/hw/hfi1/sdma.h | 15 +++++++--------
+ 2 files changed, 9 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hfi1/sdma.c b/drivers/infiniband/hw/hfi1/sdma.c
+index a95b654f52540..8ed20392e9f0d 100644
+--- a/drivers/infiniband/hw/hfi1/sdma.c
++++ b/drivers/infiniband/hw/hfi1/sdma.c
+@@ -3160,8 +3160,7 @@ int _pad_sdma_tx_descs(struct hfi1_devdata *dd, struct sdma_txreq *tx)
+ {
+ int rval = 0;
+
+- tx->num_desc++;
+- if ((unlikely(tx->num_desc == tx->desc_limit))) {
++ if ((unlikely(tx->num_desc + 1 == tx->desc_limit))) {
+ rval = _extend_sdma_tx_descs(dd, tx);
+ if (rval) {
+ __sdma_txclean(dd, tx);
+@@ -3174,6 +3173,7 @@ int _pad_sdma_tx_descs(struct hfi1_devdata *dd, struct sdma_txreq *tx)
+ SDMA_MAP_NONE,
+ dd->sdma_pad_phys,
+ sizeof(u32) - (tx->packet_len & (sizeof(u32) - 1)));
++ tx->num_desc++;
+ _sdma_close_tx(dd, tx);
+ return rval;
+ }
+diff --git a/drivers/infiniband/hw/hfi1/sdma.h b/drivers/infiniband/hw/hfi1/sdma.h
+index d8170fcbfbdd5..b023fc461bd51 100644
+--- a/drivers/infiniband/hw/hfi1/sdma.h
++++ b/drivers/infiniband/hw/hfi1/sdma.h
+@@ -631,14 +631,13 @@ static inline void sdma_txclean(struct hfi1_devdata *dd, struct sdma_txreq *tx)
+ static inline void _sdma_close_tx(struct hfi1_devdata *dd,
+ struct sdma_txreq *tx)
+ {
+- tx->descp[tx->num_desc].qw[0] |=
+- SDMA_DESC0_LAST_DESC_FLAG;
+- tx->descp[tx->num_desc].qw[1] |=
+- dd->default_desc1;
++ u16 last_desc = tx->num_desc - 1;
++
++ tx->descp[last_desc].qw[0] |= SDMA_DESC0_LAST_DESC_FLAG;
++ tx->descp[last_desc].qw[1] |= dd->default_desc1;
+ if (tx->flags & SDMA_TXREQ_F_URGENT)
+- tx->descp[tx->num_desc].qw[1] |=
+- (SDMA_DESC1_HEAD_TO_HOST_FLAG |
+- SDMA_DESC1_INT_REQ_FLAG);
++ tx->descp[last_desc].qw[1] |= (SDMA_DESC1_HEAD_TO_HOST_FLAG |
++ SDMA_DESC1_INT_REQ_FLAG);
+ }
+
+ static inline int _sdma_txadd_daddr(
+@@ -655,6 +654,7 @@ static inline int _sdma_txadd_daddr(
+ type,
+ addr, len);
+ WARN_ON(len > tx->tlen);
++ tx->num_desc++;
+ tx->tlen -= len;
+ /* special cases for last */
+ if (!tx->tlen) {
+@@ -666,7 +666,6 @@ static inline int _sdma_txadd_daddr(
+ _sdma_close_tx(dd, tx);
+ }
+ }
+- tx->num_desc++;
+ return rval;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From bed9a8d96fe11818b60aa24e04c1033f0f88b816 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Dec 2022 16:01:31 -0800
+Subject: ice: add missing checks for PF vsi type
+
+From: Jesse Brandeburg <jesse.brandeburg@intel.com>
+
+[ Upstream commit 6a8d013e904ad9a66706fcc926ec9993bed7d190 ]
+
+There were a few places we had missed checking the VSI type to make sure
+it was definitely a PF VSI, before calling setup functions intended only
+for the PF VSI.
+
+This doesn't fix any explicit bugs but cleans up the code in a few
+places and removes one explicit != vsi->type check that can be
+superseded by this code (it's a super set)
+
+Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
+Tested-by: Gurucharan G <gurucharanx.g@intel.com> (A Contingent worker at Intel)
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ice/ice_main.c | 17 ++++++++---------
+ 1 file changed, 8 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c
+index 8ec24f6cf6beb..3811462824390 100644
+--- a/drivers/net/ethernet/intel/ice/ice_main.c
++++ b/drivers/net/ethernet/intel/ice/ice_main.c
+@@ -6182,15 +6182,12 @@ int ice_vsi_cfg(struct ice_vsi *vsi)
+ {
+ int err;
+
+- if (vsi->netdev) {
++ if (vsi->netdev && vsi->type == ICE_VSI_PF) {
+ ice_set_rx_mode(vsi->netdev);
+
+- if (vsi->type != ICE_VSI_LB) {
+- err = ice_vsi_vlan_setup(vsi);
+-
+- if (err)
+- return err;
+- }
++ err = ice_vsi_vlan_setup(vsi);
++ if (err)
++ return err;
+ }
+ ice_vsi_cfg_dcb_rings(vsi);
+
+@@ -6371,7 +6368,7 @@ static int ice_up_complete(struct ice_vsi *vsi)
+
+ if (vsi->port_info &&
+ (vsi->port_info->phy.link_info.link_info & ICE_AQ_LINK_UP) &&
+- vsi->netdev) {
++ vsi->netdev && vsi->type == ICE_VSI_PF) {
+ ice_print_link_msg(vsi, true);
+ netif_tx_start_all_queues(vsi->netdev);
+ netif_carrier_on(vsi->netdev);
+@@ -6382,7 +6379,9 @@ static int ice_up_complete(struct ice_vsi *vsi)
+ * set the baseline so counters are ready when interface is up
+ */
+ ice_update_eth_stats(vsi);
+- ice_service_task_schedule(pf);
++
++ if (vsi->type == ICE_VSI_PF)
++ ice_service_task_schedule(pf);
+
+ return 0;
+ }
+--
+2.39.2
+
--- /dev/null
+From 521d74b3537814aa8571e93a3d681002580c56d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Nov 2022 15:11:35 +0530
+Subject: ice: restrict PTP HW clock freq adjustments to 100, 000, 000 PPB
+
+From: Siddaraju DH <siddaraju.dh@intel.com>
+
+[ Upstream commit 8aa4318c3a122b8670bc09af142de3872ca63b88 ]
+
+The PHY provides only 39b timestamp. With current timing
+implementation, we discard lower 7b, leaving 32b timestamp.
+The driver reconstructs the full 64b timestamp by correlating the
+32b timestamp with cached_time for performance. The reconstruction
+algorithm does both forward & backward interpolation.
+
+The 32b timeval has overflow duration of 2^32 counts ~= 4.23 second.
+Due to interpolation in both direction, its now ~= 2.125 second
+IIRC, going with at least half a duration, the cached_time is updated
+with periodic thread of 1 second (worst-case) periodicity.
+
+But the 1 second periodicity is based on System-timer.
+With PPB adjustments, if the 1588 timers increments at say
+double the rate, (2s in-place of 1s), the Nyquist rate/half duration
+sampling/update of cached_time with 1 second periodic thread will
+lead to incorrect interpolations.
+
+Hence we should restrict the PPB adjustments to at least half duration
+of cached_time update which translates to 500,000,000 PPB.
+
+Since the periodicity of the cached-time system thread can vary,
+it is good to have some buffer time and considering practicality of
+PPB adjustments, limiting the max_adj to 100,000,000.
+
+Signed-off-by: Siddaraju DH <siddaraju.dh@intel.com>
+Tested-by: Gurucharan G <gurucharanx.g@intel.com> (A Contingent worker at Intel)
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ice/ice_ptp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice_ptp.c b/drivers/net/ethernet/intel/ice/ice_ptp.c
+index d63161d73eb16..3abc8db1d0659 100644
+--- a/drivers/net/ethernet/intel/ice/ice_ptp.c
++++ b/drivers/net/ethernet/intel/ice/ice_ptp.c
+@@ -2269,7 +2269,7 @@ static void ice_ptp_set_caps(struct ice_pf *pf)
+ snprintf(info->name, sizeof(info->name) - 1, "%s-%s-clk",
+ dev_driver_string(dev), dev_name(dev));
+ info->owner = THIS_MODULE;
+- info->max_adj = 999999999;
++ info->max_adj = 100000000;
+ info->adjtime = ice_ptp_adjtime;
+ info->adjfine = ice_ptp_adjfine;
+ info->gettimex64 = ice_ptp_gettimex64;
+--
+2.39.2
+
--- /dev/null
+From fba067e9291e6bbeff25a9b186cc6071704b656f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Dec 2022 21:03:38 +0200
+Subject: iio: light: tsl2563: Do not hardcode interrupt trigger type
+
+From: Ferry Toth <ftoth@exalondelft.nl>
+
+[ Upstream commit 027641b52fe37b64af61025298ce160c8b9b7a73 ]
+
+Instead of hardcoding IRQ trigger type to IRQF_TRIGGER_RAISING,
+let's respect the settings specified in the firmware description.
+To be compatible with the older firmware descriptions, if trigger
+type is not set up there, we'll set it to default (raising edge).
+
+Fixes: 388be4883952 ("staging:iio: tsl2563 abi fixes and interrupt handling")
+Fixes: bdab1001738f ("staging:iio:light:tsl2563 remove old style event registration.")
+Signed-off-by: Ferry Toth <ftoth@exalondelft.nl>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://lore.kernel.org/r/20221207190348.9347-1-andriy.shevchenko@linux.intel.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/light/tsl2563.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/iio/light/tsl2563.c b/drivers/iio/light/tsl2563.c
+index d0e42b73203a6..71302ae864d99 100644
+--- a/drivers/iio/light/tsl2563.c
++++ b/drivers/iio/light/tsl2563.c
+@@ -704,6 +704,7 @@ static int tsl2563_probe(struct i2c_client *client)
+ struct iio_dev *indio_dev;
+ struct tsl2563_chip *chip;
+ struct tsl2563_platform_data *pdata = client->dev.platform_data;
++ unsigned long irq_flags;
+ int err = 0;
+ u8 id = 0;
+
+@@ -759,10 +760,15 @@ static int tsl2563_probe(struct i2c_client *client)
+ indio_dev->info = &tsl2563_info_no_irq;
+
+ if (client->irq) {
++ irq_flags = irq_get_trigger_type(client->irq);
++ if (irq_flags == IRQF_TRIGGER_NONE)
++ irq_flags = IRQF_TRIGGER_RISING;
++ irq_flags |= IRQF_ONESHOT;
++
+ err = devm_request_threaded_irq(&client->dev, client->irq,
+ NULL,
+ &tsl2563_event_handler,
+- IRQF_TRIGGER_RISING | IRQF_ONESHOT,
++ irq_flags,
+ "tsl2563_event",
+ indio_dev);
+ if (err) {
+--
+2.39.2
+
--- /dev/null
+From 28860ca06d8b55ded013e307ffcf07bfcab41e21 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 14 Jan 2023 13:11:41 +0000
+Subject: inet: fix fast path in __inet_hash_connect()
+
+From: Pietro Borrello <borrello@diag.uniroma1.it>
+
+[ Upstream commit 21cbd90a6fab7123905386985e3e4a80236b8714 ]
+
+__inet_hash_connect() has a fast path taken if sk_head(&tb->owners) is
+equal to the sk parameter.
+sk_head() returns the hlist_entry() with respect to the sk_node field.
+However entries in the tb->owners list are inserted with respect to the
+sk_bind_node field with sk_add_bind_node().
+Thus the check would never pass and the fast path never execute.
+
+This fast path has never been executed or tested as this bug seems
+to be present since commit 1da177e4c3f4 ("Linux-2.6.12-rc2"), thus
+remove it to reduce code complexity.
+
+Signed-off-by: Pietro Borrello <borrello@diag.uniroma1.it>
+Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Link: https://lore.kernel.org/r/20230112-inet_hash_connect_bind_head-v3-1-b591fd212b93@diag.uniroma1.it
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/inet_hashtables.c | 12 +-----------
+ 1 file changed, 1 insertion(+), 11 deletions(-)
+
+diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
+index f58d73888638b..7a13dd7f546b6 100644
+--- a/net/ipv4/inet_hashtables.c
++++ b/net/ipv4/inet_hashtables.c
+@@ -1008,17 +1008,7 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row,
+ u32 index;
+
+ if (port) {
+- head = &hinfo->bhash[inet_bhashfn(net, port,
+- hinfo->bhash_size)];
+- tb = inet_csk(sk)->icsk_bind_hash;
+- spin_lock_bh(&head->lock);
+- if (sk_head(&tb->owners) == sk && !sk->sk_bind_node.next) {
+- inet_ehash_nolisten(sk, NULL, NULL);
+- spin_unlock_bh(&head->lock);
+- return 0;
+- }
+- spin_unlock(&head->lock);
+- /* No definite answer... Walk to established hash table */
++ local_bh_disable();
+ ret = check_established(death_row, sk, port, NULL);
+ local_bh_enable();
+ return ret;
+--
+2.39.2
+
--- /dev/null
+From d2d5e84502755a4ba10a290f564bd1eef071c8f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Feb 2023 15:33:33 -0500
+Subject: io_uring,audit: don't log IORING_OP_MADVISE
+
+From: Richard Guy Briggs <rgb@redhat.com>
+
+[ Upstream commit fbe870a72fd1ddc5e08c23764e23e5766f54aa87 ]
+
+fadvise and madvise both provide hints for caching or access pattern for
+file and memory respectively. Skip them.
+
+Fixes: 5bd2182d58e9 ("audit,io_uring,io-wq: add some basic audit support to io_uring")
+Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
+Link: https://lore.kernel.org/r/b5dfdcd541115c86dbc774aa9dd502c964849c5f.1675282642.git.rgb@redhat.com
+Acked-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ io_uring/opdef.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/io_uring/opdef.c b/io_uring/opdef.c
+index 3aa0d65c50e34..be45b76649a08 100644
+--- a/io_uring/opdef.c
++++ b/io_uring/opdef.c
+@@ -313,6 +313,7 @@ const struct io_op_def io_op_defs[] = {
+ },
+ [IORING_OP_MADVISE] = {
+ .name = "MADVISE",
++ .audit_skip = 1,
+ .prep = io_madvise_prep,
+ .issue = io_madvise,
+ },
+--
+2.39.2
+
--- /dev/null
+From a4acdb70eb52cf9cc963089df1bf04470af5897c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Feb 2023 09:17:52 +0000
+Subject: iommu/amd: Do not identity map v2 capable device when snp is enabled
+
+From: Vasant Hegde <vasant.hegde@amd.com>
+
+[ Upstream commit 18792e99ea2fea27c72eb1ecca1879e5e6be304d ]
+
+Flow:
+ - Booted system with SNP enabled, memory encryption off and
+ IOMMU DMA translation mode
+ - AMD driver detects v2 capable device and amd_iommu_def_domain_type()
+ returns identity mode
+ - amd_iommu_domain_alloc() returns NULL an SNP is enabled
+ - System will fail to register device
+
+On SNP enabled system, passthrough mode is not supported. IOMMU default
+domain is set to translation mode. We need to return zero from
+amd_iommu_def_domain_type() so that it allocates translation domain.
+
+Fixes: fb2accadaa94 ("iommu/amd: Introduce function to check and enable SNP")
+CC: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
+Signed-off-by: Vasant Hegde <vasant.hegde@amd.com>
+Link: https://lore.kernel.org/r/20230207091752.7656-1-vasant.hegde@amd.com
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/amd/iommu.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/iommu/amd/iommu.c b/drivers/iommu/amd/iommu.c
+index 9dc41c48c29d6..ff4f3d4da3402 100644
+--- a/drivers/iommu/amd/iommu.c
++++ b/drivers/iommu/amd/iommu.c
+@@ -2405,12 +2405,17 @@ static int amd_iommu_def_domain_type(struct device *dev)
+ return 0;
+
+ /*
+- * Do not identity map IOMMUv2 capable devices when memory encryption is
+- * active, because some of those devices (AMD GPUs) don't have the
+- * encryption bit in their DMA-mask and require remapping.
++ * Do not identity map IOMMUv2 capable devices when:
++ * - memory encryption is active, because some of those devices
++ * (AMD GPUs) don't have the encryption bit in their DMA-mask
++ * and require remapping.
++ * - SNP is enabled, because it prohibits DTE[Mode]=0.
+ */
+- if (!cc_platform_has(CC_ATTR_MEM_ENCRYPT) && dev_data->iommu_v2)
++ if (dev_data->iommu_v2 &&
++ !cc_platform_has(CC_ATTR_MEM_ENCRYPT) &&
++ !amd_iommu_snp_en) {
+ return IOMMU_DOMAIN_IDENTITY;
++ }
+
+ return 0;
+ }
+--
+2.39.2
+
--- /dev/null
+From 38f1411ca580b947b1fe0c457075aa59672849c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Jan 2023 17:57:02 +0800
+Subject: iommu/exynos: Fix error handling in exynos_iommu_init()
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit 53719876e064643a6e58b5e6067a149a0fd191ec ]
+
+If platform_driver_register() fails, it don't need unregister and call
+kmem_cache_free() to free the memory allocated before calling register.
+
+Fixes: bbc4d205d93f ("iommu/exynos: Fix driver initialization sequence")
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Reviewed-by: Sam Protsenko <semen.protsenko@linaro.org>
+Link: https://lore.kernel.org/r/20230104095702.2591122-1-yangyingliang@huawei.com
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/exynos-iommu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/iommu/exynos-iommu.c b/drivers/iommu/exynos-iommu.c
+index b0cde22119875..c1d579c24740b 100644
+--- a/drivers/iommu/exynos-iommu.c
++++ b/drivers/iommu/exynos-iommu.c
+@@ -1446,7 +1446,7 @@ static int __init exynos_iommu_init(void)
+
+ return 0;
+ err_reg_driver:
+- platform_driver_unregister(&exynos_sysmmu_driver);
++ kmem_cache_free(lv2table_kmem_cache, zero_lv2_table);
+ err_zero_lv2:
+ kmem_cache_destroy(lv2table_kmem_cache);
+ return ret;
+--
+2.39.2
+
--- /dev/null
+From ca805f2f7485fa755cf1dbae9bc431a1dde661b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Feb 2023 21:21:16 -0400
+Subject: iommu: Fix error unwind in iommu_group_alloc()
+
+From: Jason Gunthorpe <jgg@nvidia.com>
+
+[ Upstream commit 4daa861174d56023c2068ddb03de0752f07fa199 ]
+
+If either iommu_group_grate_file() fails then the
+iommu_group is leaked.
+
+Destroy it on these error paths.
+
+Found by kselftest/iommu/iommufd_fail_nth
+
+Fixes: bc7d12b91bd3 ("iommu: Implement reserved_regions iommu-group sysfs file")
+Fixes: c52c72d3dee8 ("iommu: Add sysfs attribyte for domain type")
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Reviewed-by: Lu Baolu <baolu.lu@linux.intel.com>
+Link: https://lore.kernel.org/r/0-v1-8f616bee028d+8b-iommu_group_alloc_leak_jgg@nvidia.com
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/iommu.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
+index 9ff8cda2de7c6..50d858f36a81b 100644
+--- a/drivers/iommu/iommu.c
++++ b/drivers/iommu/iommu.c
+@@ -774,12 +774,16 @@ struct iommu_group *iommu_group_alloc(void)
+
+ ret = iommu_group_create_file(group,
+ &iommu_group_attr_reserved_regions);
+- if (ret)
++ if (ret) {
++ kobject_put(group->devices_kobj);
+ return ERR_PTR(ret);
++ }
+
+ ret = iommu_group_create_file(group, &iommu_group_attr_type);
+- if (ret)
++ if (ret) {
++ kobject_put(group->devices_kobj);
+ return ERR_PTR(ret);
++ }
+
+ pr_debug("Allocated group %d\n", group->id);
+
+--
+2.39.2
+
--- /dev/null
+From 6b1249d0ec54a6eadb28e825aeca743715e6a85d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Feb 2023 21:08:16 +0800
+Subject: iommu/vt-d: Allow to use flush-queue when first level is default
+
+From: Tina Zhang <tina.zhang@intel.com>
+
+[ Upstream commit 257ec290741924f8df678927d0dfecb1deebb9c5 ]
+
+Commit 29b32839725f ("iommu/vt-d: Do not use flush-queue when caching-mode
+is on") forced default domains to be strict mode as long as IOMMU
+caching-mode is flagged. The reason for doing this is that when vIOMMU
+uses VT-d caching mode to synchronize shadowing page tables, the strict
+mode shows better performance.
+
+However, this optimization is orthogonal to the first-level page table
+because the Intel VT-d architecture does not define the caching mode of
+the first-level page table. Refer to VT-d spec, section 6.1, "When the
+CM field is reported as Set, any software updates to remapping
+structures other than first-stage mapping (including updates to not-
+present entries or present entries whose programming resulted in
+translation faults) requires explicit invalidation of the caches."
+Exclude the first-level page table from this optimization.
+
+Generally using first-stage translation in vIOMMU implies nested
+translation enabled in the physical IOMMU. In this case the first-stage
+page table is wholly captured by the guest. The vIOMMU only needs to
+transfer the cache invalidations on vIOMMU to the physical IOMMU.
+Forcing the default domain to strict mode will cause more frequent
+cache invalidations, resulting in performance degradation. In a real
+performance benchmark test measured by iperf receive, the performance
+result on Sapphire Rapids 100Gb NIC shows:
+w/ this fix ~51 Gbits/s, w/o this fix ~39.3 Gbits/s.
+
+Theoretically a first-stage IOMMU page table can still be shadowed
+in absence of the caching mode, e.g. with host write-protecting guest
+IOMMU page table to synchronize changed PTEs with the physical
+IOMMU page table. In this case the shadowing overhead is decoupled
+from emulating IOTLB invalidation then the overhead of the latter part
+is solely decided by the frequency of IOTLB invalidations. Hence
+allowing guest default dma domain to be lazy can also benefit the
+overall performance by reducing the total VM-exit numbers.
+
+Fixes: 29b32839725f ("iommu/vt-d: Do not use flush-queue when caching-mode is on")
+Reported-by: Sanjay Kumar <sanjay.k.kumar@intel.com>
+Suggested-by: Sanjay Kumar <sanjay.k.kumar@intel.com>
+Signed-off-by: Tina Zhang <tina.zhang@intel.com>
+Reviewed-by: Kevin Tian <kevin.tian@intel.com>
+Link: https://lore.kernel.org/r/20230214025618.2292889-1-tina.zhang@intel.com
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/intel/iommu.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c
+index 994dffa1db57a..b40ef352b0efc 100644
+--- a/drivers/iommu/intel/iommu.c
++++ b/drivers/iommu/intel/iommu.c
+@@ -4005,7 +4005,8 @@ int __init intel_iommu_init(void)
+ * is likely to be much lower than the overhead of synchronizing
+ * the virtual and physical IOMMU page-tables.
+ */
+- if (cap_caching_mode(iommu->cap)) {
++ if (cap_caching_mode(iommu->cap) &&
++ !first_level_by_default(IOMMU_DOMAIN_DMA)) {
+ pr_info_once("IOMMU batching disallowed due to virtualization\n");
+ iommu_set_dma_strict();
+ }
+--
+2.39.2
+
--- /dev/null
+From d5ffdc28c8763aa6fac03537d1bde4da63dd2e43 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Feb 2023 21:08:13 +0800
+Subject: iommu/vt-d: Fix error handling in sva enable/disable paths
+
+From: Lu Baolu <baolu.lu@linux.intel.com>
+
+[ Upstream commit 60b1daa3b168fbc648ae2ad28a84759223e49e18 ]
+
+Roll back all previous actions in error paths of intel_iommu_enable_sva()
+and intel_iommu_disable_sva().
+
+Fixes: d5b9e4bfe0d8 ("iommu/vt-d: Report prq to io-pgfault framework")
+Reviewed-by: Kevin Tian <kevin.tian@intel.com>
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Link: https://lore.kernel.org/r/20230208051559.700109-1-baolu.lu@linux.intel.com
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/intel/iommu.c | 16 ++++++++++++----
+ 1 file changed, 12 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c
+index 59df7e42fd533..994dffa1db57a 100644
+--- a/drivers/iommu/intel/iommu.c
++++ b/drivers/iommu/intel/iommu.c
+@@ -4642,8 +4642,12 @@ static int intel_iommu_enable_sva(struct device *dev)
+ return -EINVAL;
+
+ ret = iopf_queue_add_device(iommu->iopf_queue, dev);
+- if (!ret)
+- ret = iommu_register_device_fault_handler(dev, iommu_queue_iopf, dev);
++ if (ret)
++ return ret;
++
++ ret = iommu_register_device_fault_handler(dev, iommu_queue_iopf, dev);
++ if (ret)
++ iopf_queue_remove_device(iommu->iopf_queue, dev);
+
+ return ret;
+ }
+@@ -4655,8 +4659,12 @@ static int intel_iommu_disable_sva(struct device *dev)
+ int ret;
+
+ ret = iommu_unregister_device_fault_handler(dev);
+- if (!ret)
+- ret = iopf_queue_remove_device(iommu->iopf_queue, dev);
++ if (ret)
++ return ret;
++
++ ret = iopf_queue_remove_device(iommu->iopf_queue, dev);
++ if (ret)
++ iommu_register_device_fault_handler(dev, iommu_queue_iopf, dev);
+
+ return ret;
+ }
+--
+2.39.2
+
--- /dev/null
+From c22d992370b557bc99dd7c772cce125aa5cad2d2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Jan 2023 15:37:33 +0800
+Subject: iommu/vt-d: Set No Execute Enable bit in PASID table entry
+
+From: Lu Baolu <baolu.lu@linux.intel.com>
+
+[ Upstream commit e06d24435596c8afcaa81c0c498f5b0ec4ee2b7c ]
+
+Setup No Execute Enable bit (Bit 133) of a scalable mode PASID entry.
+This is to allow the use of XD bit of the first level page table.
+
+Fixes: ddf09b6d43ec ("iommu/vt-d: Setup pasid entries for iova over first level")
+Signed-off-by: Ashok Raj <ashok.raj@intel.com>
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Reviewed-by: Kevin Tian <kevin.tian@intel.com>
+Link: https://lore.kernel.org/r/20230126095438.354205-1-baolu.lu@linux.intel.com
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/intel/pasid.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/drivers/iommu/intel/pasid.c b/drivers/iommu/intel/pasid.c
+index fb3c7020028d0..ec964ac7d7972 100644
+--- a/drivers/iommu/intel/pasid.c
++++ b/drivers/iommu/intel/pasid.c
+@@ -364,6 +364,16 @@ static inline void pasid_set_page_snoop(struct pasid_entry *pe, bool value)
+ pasid_set_bits(&pe->val[1], 1 << 23, value << 23);
+ }
+
++/*
++ * Setup No Execute Enable bit (Bit 133) of a scalable mode PASID
++ * entry. It is required when XD bit of the first level page table
++ * entry is about to be set.
++ */
++static inline void pasid_set_nxe(struct pasid_entry *pe)
++{
++ pasid_set_bits(&pe->val[2], 1 << 5, 1 << 5);
++}
++
+ /*
+ * Setup the Page Snoop (PGSNP) field (Bit 88) of a scalable mode
+ * PASID entry.
+@@ -557,6 +567,7 @@ int intel_pasid_setup_first_level(struct intel_iommu *iommu,
+ pasid_set_domain_id(pte, did);
+ pasid_set_address_width(pte, iommu->agaw);
+ pasid_set_page_snoop(pte, !!ecap_smpwc(iommu->ecap));
++ pasid_set_nxe(pte);
+
+ /* Setup Present and PASID Granular Transfer Type: */
+ pasid_set_translation_type(pte, PASID_ENTRY_PGTT_FL_ONLY);
+--
+2.39.2
+
--- /dev/null
+From 64ac12655c20077d424ba04947898027aa9542f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Jan 2023 04:20:40 -0800
+Subject: iommufd: Add three missing structures in ucmd_buffer
+
+From: Yi Liu <yi.l.liu@intel.com>
+
+[ Upstream commit 84798f2849942bb5e8817417adfdfa6241df2835 ]
+
+struct iommu_ioas_copy, struct iommu_option and struct iommu_vfio_ioas are
+missed in ucmd_buffer. Although they are smaller than the size of
+ucmd_buffer, it is safer to list them in ucmd_buffer explicitly.
+
+Fixes: aad37e71d5c4 ("iommufd: IOCTLs for the io_pagetable")
+Fixes: d624d6652a65 ("iommufd: vfio container FD ioctl compatibility")
+Link: https://lore.kernel.org/r/20230120122040.280219-1-yi.l.liu@intel.com
+Signed-off-by: Yi Liu <yi.l.liu@intel.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/iommufd/main.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/iommu/iommufd/main.c b/drivers/iommu/iommufd/main.c
+index 083e6fcbe10ad..3fbe636c3d8a6 100644
+--- a/drivers/iommu/iommufd/main.c
++++ b/drivers/iommu/iommufd/main.c
+@@ -252,9 +252,12 @@ union ucmd_buffer {
+ struct iommu_destroy destroy;
+ struct iommu_ioas_alloc alloc;
+ struct iommu_ioas_allow_iovas allow_iovas;
++ struct iommu_ioas_copy ioas_copy;
+ struct iommu_ioas_iova_ranges iova_ranges;
+ struct iommu_ioas_map map;
+ struct iommu_ioas_unmap unmap;
++ struct iommu_option option;
++ struct iommu_vfio_ioas vfio_ioas;
+ #ifdef CONFIG_IOMMUFD_TEST
+ struct iommu_test_cmd test;
+ #endif
+--
+2.39.2
+
--- /dev/null
+From 67f27e698c1f5fbc9997517b079ad40db96fd2d5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Jan 2023 12:28:10 +0400
+Subject: irqchip/alpine-msi: Fix refcount leak in alpine_msix_init_domains
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit 071d068b89e95d1b078aa6bbcb9d0961b77d6aa1 ]
+
+of_irq_find_parent() returns a node pointer with refcount incremented,
+We should use of_node_put() on it when not needed anymore.
+Add missing of_node_put() to avoid refcount leak.
+
+Fixes: e6b78f2c3e14 ("irqchip: Add the Alpine MSIX interrupt controller")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/r/20230102082811.3947760-1-linmq006@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-alpine-msi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/irqchip/irq-alpine-msi.c b/drivers/irqchip/irq-alpine-msi.c
+index 5ddb8e578ac6a..fc1ef7de37973 100644
+--- a/drivers/irqchip/irq-alpine-msi.c
++++ b/drivers/irqchip/irq-alpine-msi.c
+@@ -199,6 +199,7 @@ static int alpine_msix_init_domains(struct alpine_msix_data *priv,
+ }
+
+ gic_domain = irq_find_host(gic_node);
++ of_node_put(gic_node);
+ if (!gic_domain) {
+ pr_err("Failed to find the GIC domain\n");
+ return -ENXIO;
+--
+2.39.2
+
--- /dev/null
+From 8f5b4cace2e9c5c7ac2b0f6d0683289668c0ce53 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Jan 2023 16:13:18 +0400
+Subject: irqchip: Fix refcount leak in platform_irqchip_probe
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit 6caa5a2b78f5f53c433d3a3781e53325da22f0ac ]
+
+of_irq_find_parent() returns a node pointer with refcount incremented,
+We should use of_node_put() on it when not needed anymore.
+Add missing of_node_put() to avoid refcount leak.
+
+Fixes: f8410e626569 ("irqchip: Add IRQCHIP_PLATFORM_DRIVER_BEGIN/END and IRQCHIP_MATCH helper macros")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/r/20230102121318.3990586-1-linmq006@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irqchip.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/irqchip/irqchip.c b/drivers/irqchip/irqchip.c
+index 3570f0a588c4b..7899607fbee8d 100644
+--- a/drivers/irqchip/irqchip.c
++++ b/drivers/irqchip/irqchip.c
+@@ -38,8 +38,10 @@ int platform_irqchip_probe(struct platform_device *pdev)
+ struct device_node *par_np = of_irq_find_parent(np);
+ of_irq_init_cb_t irq_init_cb = of_device_get_match_data(&pdev->dev);
+
+- if (!irq_init_cb)
++ if (!irq_init_cb) {
++ of_node_put(par_np);
+ return -EINVAL;
++ }
+
+ if (par_np == np)
+ par_np = NULL;
+@@ -52,8 +54,10 @@ int platform_irqchip_probe(struct platform_device *pdev)
+ * interrupt controller. The actual initialization callback of this
+ * interrupt controller can check for specific domains as necessary.
+ */
+- if (par_np && !irq_find_matching_host(par_np, DOMAIN_BUS_ANY))
++ if (par_np && !irq_find_matching_host(par_np, DOMAIN_BUS_ANY)) {
++ of_node_put(par_np);
+ return -EPROBE_DEFER;
++ }
+
+ return irq_init_cb(np, par_np);
+ }
+--
+2.39.2
+
--- /dev/null
+From 4aa6463d2a55ec99b13bff6499a06c25f04cf555 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Dec 2022 15:09:34 -0800
+Subject: irqchip/irq-bcm7120-l2: Set IRQ_LEVEL for level triggered interrupts
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit 13a157b38ca5b4f9eed81442b8821db293755961 ]
+
+When support for the interrupt controller was added with a5042de2688d,
+we forgot to update the flags to be set to contain IRQ_LEVEL. While the
+flow handler is correct, the output from /proc/interrupts does not show
+such interrupts as being level triggered when they are, correct that.
+
+Fixes: a5042de2688d ("irqchip: bcm7120-l2: Add Broadcom BCM7120-style Level 2 interrupt controller")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/r/20221216230934.2478345-3-f.fainelli@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-bcm7120-l2.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/irqchip/irq-bcm7120-l2.c b/drivers/irqchip/irq-bcm7120-l2.c
+index bb6609cebdbce..1e9dab6e0d86f 100644
+--- a/drivers/irqchip/irq-bcm7120-l2.c
++++ b/drivers/irqchip/irq-bcm7120-l2.c
+@@ -279,7 +279,8 @@ static int __init bcm7120_l2_intc_probe(struct device_node *dn,
+ flags |= IRQ_GC_BE_IO;
+
+ ret = irq_alloc_domain_generic_chips(data->domain, IRQS_PER_WORD, 1,
+- dn->full_name, handle_level_irq, clr, 0, flags);
++ dn->full_name, handle_level_irq, clr,
++ IRQ_LEVEL, flags);
+ if (ret) {
+ pr_err("failed to allocate generic irq chip\n");
+ goto out_free_domain;
+--
+2.39.2
+
--- /dev/null
+From 38e77277275a8124aa839572d723e06309fea1e3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Dec 2022 15:09:33 -0800
+Subject: irqchip/irq-brcmstb-l2: Set IRQ_LEVEL for level triggered interrupts
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit 94debe03e8afa1267f95a9001786a6aa506b9ff3 ]
+
+When support for the level triggered interrupt controller flavor was
+added with c0ca7262088e, we forgot to update the flags to be set to
+contain IRQ_LEVEL. While the flow handler is correct, the output from
+/proc/interrupts does not show such interrupts as being level triggered
+when they are, correct that.
+
+Fixes: c0ca7262088e ("irqchip/brcmstb-l2: Add support for the BCM7271 L2 controller")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/r/20221216230934.2478345-2-f.fainelli@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-brcmstb-l2.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/irqchip/irq-brcmstb-l2.c b/drivers/irqchip/irq-brcmstb-l2.c
+index e4efc08ac5948..091b0fe7e3242 100644
+--- a/drivers/irqchip/irq-brcmstb-l2.c
++++ b/drivers/irqchip/irq-brcmstb-l2.c
+@@ -161,6 +161,7 @@ static int __init brcmstb_l2_intc_of_init(struct device_node *np,
+ *init_params)
+ {
+ unsigned int clr = IRQ_NOREQUEST | IRQ_NOPROBE | IRQ_NOAUTOEN;
++ unsigned int set = 0;
+ struct brcmstb_l2_intc_data *data;
+ struct irq_chip_type *ct;
+ int ret;
+@@ -208,9 +209,12 @@ static int __init brcmstb_l2_intc_of_init(struct device_node *np,
+ if (IS_ENABLED(CONFIG_MIPS) && IS_ENABLED(CONFIG_CPU_BIG_ENDIAN))
+ flags |= IRQ_GC_BE_IO;
+
++ if (init_params->handler == handle_level_irq)
++ set |= IRQ_LEVEL;
++
+ /* Allocate a single Generic IRQ chip for this node */
+ ret = irq_alloc_domain_generic_chips(data->domain, 32, 1,
+- np->full_name, init_params->handler, clr, 0, flags);
++ np->full_name, init_params->handler, clr, set, flags);
+ if (ret) {
+ pr_err("failed to allocate generic irq chip\n");
+ goto out_free_domain;
+--
+2.39.2
+
--- /dev/null
+From c76666f452c4b763f64ff9411868bda144102218 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Jan 2023 12:42:08 +0400
+Subject: irqchip/irq-mvebu-gicp: Fix refcount leak in mvebu_gicp_probe
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit 9419e700021a393f67be36abd0c4f3acc6139041 ]
+
+of_irq_find_parent() returns a node pointer with refcount incremented,
+We should use of_node_put() on it when not needed anymore.
+Add missing of_node_put() to avoid refcount leak.
+
+Fixes: a68a63cb4dfc ("irqchip/irq-mvebu-gicp: Add new driver for Marvell GICP")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/r/20230102084208.3951758-1-linmq006@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-mvebu-gicp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/irqchip/irq-mvebu-gicp.c b/drivers/irqchip/irq-mvebu-gicp.c
+index fe88a782173dd..c43a345061d53 100644
+--- a/drivers/irqchip/irq-mvebu-gicp.c
++++ b/drivers/irqchip/irq-mvebu-gicp.c
+@@ -221,6 +221,7 @@ static int mvebu_gicp_probe(struct platform_device *pdev)
+ }
+
+ parent_domain = irq_find_host(irq_parent_dn);
++ of_node_put(irq_parent_dn);
+ if (!parent_domain) {
+ dev_err(&pdev->dev, "failed to find parent IRQ domain\n");
+ return -ENODEV;
+--
+2.39.2
+
--- /dev/null
+From ba6e08a4cc1ebdeb843fb6f76c94766c72cc1e38 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Jan 2023 12:56:10 +0400
+Subject: irqchip/ti-sci: Fix refcount leak in ti_sci_intr_irq_domain_probe
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit 02298b7bae12936ca313975b02e7f98b06670d37 ]
+
+of_irq_find_parent() returns a node pointer with refcount incremented,
+We should use of_node_put() on it when not needed anymore.
+Add missing of_node_put() to avoid refcount leak.
+
+Fixes: cd844b0715ce ("irqchip/ti-sci-intr: Add support for Interrupt Router driver")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/r/20230102085611.3955984-1-linmq006@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-ti-sci-intr.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/irqchip/irq-ti-sci-intr.c b/drivers/irqchip/irq-ti-sci-intr.c
+index fe8fad22bcf96..020ddf29efb80 100644
+--- a/drivers/irqchip/irq-ti-sci-intr.c
++++ b/drivers/irqchip/irq-ti-sci-intr.c
+@@ -236,6 +236,7 @@ static int ti_sci_intr_irq_domain_probe(struct platform_device *pdev)
+ }
+
+ parent_domain = irq_find_host(parent_node);
++ of_node_put(parent_node);
+ if (!parent_domain) {
+ dev_err(dev, "Failed to find IRQ parent domain\n");
+ return -ENODEV;
+--
+2.39.2
+
--- /dev/null
+From 93bf11160fb41f6ed7fc18f42df7048635983a7f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Feb 2023 18:43:38 +0300
+Subject: iw_cxgb4: Fix potential NULL dereference in
+ c4iw_fill_res_cm_id_entry()
+
+From: Dan Carpenter <error27@gmail.com>
+
+[ Upstream commit 4ca446b127c568b59cb8d9748b6f70499624bb18 ]
+
+This condition needs to match the previous "if (epcp->state == LISTEN) {"
+exactly to avoid a NULL dereference of either "listen_ep" or "ep". The
+problem is that "epcp" has been re-assigned so just testing
+"if (epcp->state == LISTEN) {" a second time is not sufficient.
+
+Fixes: 116aeb887371 ("iw_cxgb4: provide detailed provider-specific CM_ID information")
+Signed-off-by: Dan Carpenter <error27@gmail.com>
+Link: https://lore.kernel.org/r/Y+usKuWIKr4dimZh@kili
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/cxgb4/restrack.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/cxgb4/restrack.c b/drivers/infiniband/hw/cxgb4/restrack.c
+index ff645b955a082..fd22c85d35f4f 100644
+--- a/drivers/infiniband/hw/cxgb4/restrack.c
++++ b/drivers/infiniband/hw/cxgb4/restrack.c
+@@ -238,7 +238,7 @@ int c4iw_fill_res_cm_id_entry(struct sk_buff *msg,
+ if (rdma_nl_put_driver_u64_hex(msg, "history", epcp->history))
+ goto err_cancel_table;
+
+- if (epcp->state == LISTEN) {
++ if (listen_ep) {
+ if (rdma_nl_put_driver_u32(msg, "stid", listen_ep->stid))
+ goto err_cancel_table;
+ if (rdma_nl_put_driver_u32(msg, "backlog", listen_ep->backlog))
+--
+2.39.2
+
--- /dev/null
+From 0f4cab2c958df52d4659f59174e454674e81f81e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Aug 2022 09:51:19 -0500
+Subject: KEYS: asymmetric: Fix ECDSA use via keyctl uapi
+
+From: Denis Kenzior <denkenz@gmail.com>
+
+[ Upstream commit 10de7b54293995368c52d9aa153f3e7a359f04a1 ]
+
+When support for ECDSA keys was added, constraints for data & signature
+sizes were never updated. This makes it impossible to use such keys via
+keyctl API from userspace.
+
+Update constraint on max_data_size to 64 bytes in order to support
+SHA512-based signatures. Also update the signature length constraints
+per ECDSA signature encoding described in RFC 5480.
+
+Fixes: 299f561a6693 ("x509: Add support for parsing x509 certs with ECDSA keys")
+Signed-off-by: Denis Kenzior <denkenz@gmail.com>
+Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>
+Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
+Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/asymmetric_keys/public_key.c | 24 ++++++++++++++++++++++--
+ 1 file changed, 22 insertions(+), 2 deletions(-)
+
+diff --git a/crypto/asymmetric_keys/public_key.c b/crypto/asymmetric_keys/public_key.c
+index 2f8352e888602..eca5671ad3f22 100644
+--- a/crypto/asymmetric_keys/public_key.c
++++ b/crypto/asymmetric_keys/public_key.c
+@@ -186,8 +186,28 @@ static int software_key_query(const struct kernel_pkey_params *params,
+
+ len = crypto_akcipher_maxsize(tfm);
+ info->key_size = len * 8;
+- info->max_data_size = len;
+- info->max_sig_size = len;
++
++ if (strncmp(pkey->pkey_algo, "ecdsa", 5) == 0) {
++ /*
++ * ECDSA key sizes are much smaller than RSA, and thus could
++ * operate on (hashed) inputs that are larger than key size.
++ * For example SHA384-hashed input used with secp256r1
++ * based keys. Set max_data_size to be at least as large as
++ * the largest supported hash size (SHA512)
++ */
++ info->max_data_size = 64;
++
++ /*
++ * Verify takes ECDSA-Sig (described in RFC 5480) as input,
++ * which is actually 2 'key_size'-bit integers encoded in
++ * ASN.1. Account for the ASN.1 encoding overhead here.
++ */
++ info->max_sig_size = 2 * (len + 3) + 2;
++ } else {
++ info->max_data_size = len;
++ info->max_sig_size = len;
++ }
++
+ info->max_enc_size = len;
+ info->max_dec_size = len;
+ info->supported_ops = (KEYCTL_SUPPORTS_ENCRYPT |
+--
+2.39.2
+
--- /dev/null
+From 92fb8791e7a39f75252319c8bef79e0888d0365c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Dec 2022 09:21:43 +0800
+Subject: kobject: Fix slab-out-of-bounds in fill_kobj_path()
+
+From: Wang Hai <wanghai38@huawei.com>
+
+[ Upstream commit 3bb2a01caa813d3a1845d378bbe4169ef280d394 ]
+
+In kobject_get_path(), if kobj->name is changed between calls
+get_kobj_path_length() and fill_kobj_path() and the length becomes
+longer, then fill_kobj_path() will have an out-of-bounds bug.
+
+The actual current problem occurs when the ixgbe probe.
+
+In ixgbe_mii_bus_init(), if the length of netdev->dev.kobj.name
+length becomes longer, out-of-bounds will occur.
+
+cpu0 cpu1
+ixgbe_probe
+ register_netdev(netdev)
+ netdev_register_kobject
+ device_add
+ kobject_uevent // Sending ADD events
+ systemd-udevd // rename netdev
+ dev_change_name
+ device_rename
+ kobject_rename
+ ixgbe_mii_bus_init |
+ mdiobus_register |
+ __mdiobus_register |
+ device_register |
+ device_add |
+ kobject_uevent |
+ kobject_get_path |
+ len = get_kobj_path_length // old name |
+ path = kzalloc(len, gfp_mask); |
+ kobj->name = name;
+ /* name length becomes
+ * longer
+ */
+ fill_kobj_path /* kobj path length is
+ * longer than path,
+ * resulting in out of
+ * bounds when filling path
+ */
+
+This is the kasan report:
+
+==================================================================
+BUG: KASAN: slab-out-of-bounds in fill_kobj_path+0x50/0xc0
+Write of size 7 at addr ff1100090573d1fd by task kworker/28:1/673
+
+ Workqueue: events work_for_cpu_fn
+ Call Trace:
+ <TASK>
+ dump_stack_lvl+0x34/0x48
+ print_address_description.constprop.0+0x86/0x1e7
+ print_report+0x36/0x4f
+ kasan_report+0xad/0x130
+ kasan_check_range+0x35/0x1c0
+ memcpy+0x39/0x60
+ fill_kobj_path+0x50/0xc0
+ kobject_get_path+0x5a/0xc0
+ kobject_uevent_env+0x140/0x460
+ device_add+0x5c7/0x910
+ __mdiobus_register+0x14e/0x490
+ ixgbe_probe.cold+0x441/0x574 [ixgbe]
+ local_pci_probe+0x78/0xc0
+ work_for_cpu_fn+0x26/0x40
+ process_one_work+0x3b6/0x6a0
+ worker_thread+0x368/0x520
+ kthread+0x165/0x1a0
+ ret_from_fork+0x1f/0x30
+
+This reproducer triggers that bug:
+
+while:
+do
+ rmmod ixgbe
+ sleep 0.5
+ modprobe ixgbe
+ sleep 0.5
+
+When calling fill_kobj_path() to fill path, if the name length of
+kobj becomes longer, return failure and retry. This fixes the problem.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Wang Hai <wanghai38@huawei.com>
+Link: https://lore.kernel.org/r/20221220012143.52141-1-wanghai38@huawei.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/kobject.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/lib/kobject.c b/lib/kobject.c
+index 985ee1c4f2c60..d20ce15eec2d0 100644
+--- a/lib/kobject.c
++++ b/lib/kobject.c
+@@ -112,7 +112,7 @@ static int get_kobj_path_length(const struct kobject *kobj)
+ return length;
+ }
+
+-static void fill_kobj_path(const struct kobject *kobj, char *path, int length)
++static int fill_kobj_path(const struct kobject *kobj, char *path, int length)
+ {
+ const struct kobject *parent;
+
+@@ -121,12 +121,16 @@ static void fill_kobj_path(const struct kobject *kobj, char *path, int length)
+ int cur = strlen(kobject_name(parent));
+ /* back up enough to print this name with '/' */
+ length -= cur;
++ if (length <= 0)
++ return -EINVAL;
+ memcpy(path + length, kobject_name(parent), cur);
+ *(path + --length) = '/';
+ }
+
+ pr_debug("kobject: '%s' (%p): %s: path = '%s'\n", kobject_name(kobj),
+ kobj, __func__, path);
++
++ return 0;
+ }
+
+ /**
+@@ -141,13 +145,17 @@ char *kobject_get_path(const struct kobject *kobj, gfp_t gfp_mask)
+ char *path;
+ int len;
+
++retry:
+ len = get_kobj_path_length(kobj);
+ if (len == 0)
+ return NULL;
+ path = kzalloc(len, gfp_mask);
+ if (!path)
+ return NULL;
+- fill_kobj_path(kobj, path, len);
++ if (fill_kobj_path(kobj, path, len)) {
++ kfree(path);
++ goto retry;
++ }
+
+ return path;
+ }
+--
+2.39.2
+
--- /dev/null
+From 3274e40059515dd44cc5f6e457151c85ced22005 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Jan 2023 22:56:34 +0000
+Subject: kselftest/arm64: Fix enumeration of systems without 128 bit SME
+
+From: Mark Brown <broonie@kernel.org>
+
+[ Upstream commit 5f389238534ac8ca4ee3ab12eeb89d3984d303a1 ]
+
+The current signal handling tests for SME do not account for the fact that
+unlike SVE all SME vector lengths are optional so we can't guarantee that
+we will encounter the minimum possible VL, they will hang enumerating VLs
+on such systems. Abort enumeration when we find the lowest VL.
+
+Fixes: 4963aeb35a9e ("kselftest/arm64: signal: Add SME signal handling tests")
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Link: https://lore.kernel.org/r/20230131-arm64-kselftest-sig-sme-no-128-v1-1-d47c13dc8e1e@kernel.org
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/arm64/signal/testcases/ssve_regs.c | 4 ++++
+ tools/testing/selftests/arm64/signal/testcases/za_regs.c | 4 ++++
+ 2 files changed, 8 insertions(+)
+
+diff --git a/tools/testing/selftests/arm64/signal/testcases/ssve_regs.c b/tools/testing/selftests/arm64/signal/testcases/ssve_regs.c
+index d0a178945b1a8..c6b17c47cac4c 100644
+--- a/tools/testing/selftests/arm64/signal/testcases/ssve_regs.c
++++ b/tools/testing/selftests/arm64/signal/testcases/ssve_regs.c
+@@ -34,6 +34,10 @@ static bool sme_get_vls(struct tdescr *td)
+
+ vl &= PR_SME_VL_LEN_MASK;
+
++ /* Did we find the lowest supported VL? */
++ if (vq < sve_vq_from_vl(vl))
++ break;
++
+ /* Skip missing VLs */
+ vq = sve_vq_from_vl(vl);
+
+diff --git a/tools/testing/selftests/arm64/signal/testcases/za_regs.c b/tools/testing/selftests/arm64/signal/testcases/za_regs.c
+index ea45acb115d5b..174ad66566964 100644
+--- a/tools/testing/selftests/arm64/signal/testcases/za_regs.c
++++ b/tools/testing/selftests/arm64/signal/testcases/za_regs.c
+@@ -34,6 +34,10 @@ static bool sme_get_vls(struct tdescr *td)
+
+ vl &= PR_SME_VL_LEN_MASK;
+
++ /* Did we find the lowest supported VL? */
++ if (vq < sve_vq_from_vl(vl))
++ break;
++
+ /* Skip missing VLs */
+ vq = sve_vq_from_vl(vl);
+
+--
+2.39.2
+
--- /dev/null
+From fb6959a1ba6659e8fe0de386522fa1f1c024cae9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Dec 2022 13:06:35 +0000
+Subject: kselftest/arm64: Fix syscall-abi for systems without 128 bit SME
+
+From: Mark Brown <broonie@kernel.org>
+
+[ Upstream commit 97ec597b26df774a257e3f8e97353fd1b4471615 ]
+
+SME does not mandate any specific VL so we may not have 128 bit SME but
+the algorithm used for enumerating VLs assumes that we will. Add the
+required check to ensure that the algorithm terminates.
+
+Fixes: 43e3f85523e4 ("kselftest/arm64: Add SME support to syscall ABI test")
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Link: https://lore.kernel.org/r/20221223-arm64-syscall-abi-sme-only-v1-1-4fabfbd62087@kernel.org
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/arm64/abi/syscall-abi.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/tools/testing/selftests/arm64/abi/syscall-abi.c b/tools/testing/selftests/arm64/abi/syscall-abi.c
+index dd7ebe536d05f..ffe719b50c215 100644
+--- a/tools/testing/selftests/arm64/abi/syscall-abi.c
++++ b/tools/testing/selftests/arm64/abi/syscall-abi.c
+@@ -390,6 +390,10 @@ static void test_one_syscall(struct syscall_cfg *cfg)
+
+ sme_vl &= PR_SME_VL_LEN_MASK;
+
++ /* Found lowest VL */
++ if (sve_vq_from_vl(sme_vl) > sme_vq)
++ break;
++
+ if (sme_vq != sve_vq_from_vl(sme_vl))
+ sme_vq = sve_vq_from_vl(sme_vl);
+
+@@ -461,6 +465,10 @@ int sme_count_vls(void)
+
+ vl &= PR_SME_VL_LEN_MASK;
+
++ /* Found lowest VL */
++ if (sve_vq_from_vl(vl) > vq)
++ break;
++
+ if (vq != sve_vq_from_vl(vl))
+ vq = sve_vq_from_vl(vl);
+
+--
+2.39.2
+
--- /dev/null
+From 85a35600677058a1a4cd1e968b934e235886d8e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Feb 2023 01:37:10 +0900
+Subject: l2tp: Avoid possible recursive deadlock in l2tp_tunnel_register()
+
+From: Shigeru Yoshida <syoshida@redhat.com>
+
+[ Upstream commit 9ca5e7ecab064f1f47da07f7c1ddf40e4bc0e5ac ]
+
+When a file descriptor of pppol2tp socket is passed as file descriptor
+of UDP socket, a recursive deadlock occurs in l2tp_tunnel_register().
+This situation is reproduced by the following program:
+
+int main(void)
+{
+ int sock;
+ struct sockaddr_pppol2tp addr;
+
+ sock = socket(AF_PPPOX, SOCK_DGRAM, PX_PROTO_OL2TP);
+ if (sock < 0) {
+ perror("socket");
+ return 1;
+ }
+
+ addr.sa_family = AF_PPPOX;
+ addr.sa_protocol = PX_PROTO_OL2TP;
+ addr.pppol2tp.pid = 0;
+ addr.pppol2tp.fd = sock;
+ addr.pppol2tp.addr.sin_family = PF_INET;
+ addr.pppol2tp.addr.sin_port = htons(0);
+ addr.pppol2tp.addr.sin_addr.s_addr = inet_addr("192.168.0.1");
+ addr.pppol2tp.s_tunnel = 1;
+ addr.pppol2tp.s_session = 0;
+ addr.pppol2tp.d_tunnel = 0;
+ addr.pppol2tp.d_session = 0;
+
+ if (connect(sock, (const struct sockaddr *)&addr, sizeof(addr)) < 0) {
+ perror("connect");
+ return 1;
+ }
+
+ return 0;
+}
+
+This program causes the following lockdep warning:
+
+ ============================================
+ WARNING: possible recursive locking detected
+ 6.2.0-rc5-00205-gc96618275234 #56 Not tainted
+ --------------------------------------------
+ repro/8607 is trying to acquire lock:
+ ffff8880213c8130 (sk_lock-AF_PPPOX){+.+.}-{0:0}, at: l2tp_tunnel_register+0x2b7/0x11c0
+
+ but task is already holding lock:
+ ffff8880213c8130 (sk_lock-AF_PPPOX){+.+.}-{0:0}, at: pppol2tp_connect+0xa82/0x1a30
+
+ other info that might help us debug this:
+ Possible unsafe locking scenario:
+
+ CPU0
+ ----
+ lock(sk_lock-AF_PPPOX);
+ lock(sk_lock-AF_PPPOX);
+
+ *** DEADLOCK ***
+
+ May be due to missing lock nesting notation
+
+ 1 lock held by repro/8607:
+ #0: ffff8880213c8130 (sk_lock-AF_PPPOX){+.+.}-{0:0}, at: pppol2tp_connect+0xa82/0x1a30
+
+ stack backtrace:
+ CPU: 0 PID: 8607 Comm: repro Not tainted 6.2.0-rc5-00205-gc96618275234 #56
+ Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014
+ Call Trace:
+ <TASK>
+ dump_stack_lvl+0x100/0x178
+ __lock_acquire.cold+0x119/0x3b9
+ ? lockdep_hardirqs_on_prepare+0x410/0x410
+ lock_acquire+0x1e0/0x610
+ ? l2tp_tunnel_register+0x2b7/0x11c0
+ ? lock_downgrade+0x710/0x710
+ ? __fget_files+0x283/0x3e0
+ lock_sock_nested+0x3a/0xf0
+ ? l2tp_tunnel_register+0x2b7/0x11c0
+ l2tp_tunnel_register+0x2b7/0x11c0
+ ? sprintf+0xc4/0x100
+ ? l2tp_tunnel_del_work+0x6b0/0x6b0
+ ? debug_object_deactivate+0x320/0x320
+ ? lockdep_init_map_type+0x16d/0x7a0
+ ? lockdep_init_map_type+0x16d/0x7a0
+ ? l2tp_tunnel_create+0x2bf/0x4b0
+ ? l2tp_tunnel_create+0x3c6/0x4b0
+ pppol2tp_connect+0x14e1/0x1a30
+ ? pppol2tp_put_sk+0xd0/0xd0
+ ? aa_sk_perm+0x2b7/0xa80
+ ? aa_af_perm+0x260/0x260
+ ? bpf_lsm_socket_connect+0x9/0x10
+ ? pppol2tp_put_sk+0xd0/0xd0
+ __sys_connect_file+0x14f/0x190
+ __sys_connect+0x133/0x160
+ ? __sys_connect_file+0x190/0x190
+ ? lockdep_hardirqs_on+0x7d/0x100
+ ? ktime_get_coarse_real_ts64+0x1b7/0x200
+ ? ktime_get_coarse_real_ts64+0x147/0x200
+ ? __audit_syscall_entry+0x396/0x500
+ __x64_sys_connect+0x72/0xb0
+ do_syscall_64+0x38/0xb0
+ entry_SYSCALL_64_after_hwframe+0x63/0xcd
+
+This patch fixes the issue by getting/creating the tunnel before
+locking the pppol2tp socket.
+
+Fixes: 0b2c59720e65 ("l2tp: close all race conditions in l2tp_tunnel_register()")
+Cc: Cong Wang <cong.wang@bytedance.com>
+Signed-off-by: Shigeru Yoshida <syoshida@redhat.com>
+Reviewed-by: Guillaume Nault <gnault@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/l2tp/l2tp_ppp.c | 125 ++++++++++++++++++++++++--------------------
+ 1 file changed, 67 insertions(+), 58 deletions(-)
+
+diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
+index db2e584c625e5..f011af6601c9c 100644
+--- a/net/l2tp/l2tp_ppp.c
++++ b/net/l2tp/l2tp_ppp.c
+@@ -650,54 +650,22 @@ static int pppol2tp_tunnel_mtu(const struct l2tp_tunnel *tunnel)
+ return mtu - PPPOL2TP_HEADER_OVERHEAD;
+ }
+
+-/* connect() handler. Attach a PPPoX socket to a tunnel UDP socket
+- */
+-static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
+- int sockaddr_len, int flags)
++static struct l2tp_tunnel *pppol2tp_tunnel_get(struct net *net,
++ const struct l2tp_connect_info *info,
++ bool *new_tunnel)
+ {
+- struct sock *sk = sock->sk;
+- struct pppox_sock *po = pppox_sk(sk);
+- struct l2tp_session *session = NULL;
+- struct l2tp_connect_info info;
+ struct l2tp_tunnel *tunnel;
+- struct pppol2tp_session *ps;
+- struct l2tp_session_cfg cfg = { 0, };
+- bool drop_refcnt = false;
+- bool drop_tunnel = false;
+- bool new_session = false;
+- bool new_tunnel = false;
+ int error;
+
+- error = pppol2tp_sockaddr_get_info(uservaddr, sockaddr_len, &info);
+- if (error < 0)
+- return error;
++ *new_tunnel = false;
+
+- lock_sock(sk);
+-
+- /* Check for already bound sockets */
+- error = -EBUSY;
+- if (sk->sk_state & PPPOX_CONNECTED)
+- goto end;
+-
+- /* We don't supporting rebinding anyway */
+- error = -EALREADY;
+- if (sk->sk_user_data)
+- goto end; /* socket is already attached */
+-
+- /* Don't bind if tunnel_id is 0 */
+- error = -EINVAL;
+- if (!info.tunnel_id)
+- goto end;
+-
+- tunnel = l2tp_tunnel_get(sock_net(sk), info.tunnel_id);
+- if (tunnel)
+- drop_tunnel = true;
++ tunnel = l2tp_tunnel_get(net, info->tunnel_id);
+
+ /* Special case: create tunnel context if session_id and
+ * peer_session_id is 0. Otherwise look up tunnel using supplied
+ * tunnel id.
+ */
+- if (!info.session_id && !info.peer_session_id) {
++ if (!info->session_id && !info->peer_session_id) {
+ if (!tunnel) {
+ struct l2tp_tunnel_cfg tcfg = {
+ .encap = L2TP_ENCAPTYPE_UDP,
+@@ -706,40 +674,82 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
+ /* Prevent l2tp_tunnel_register() from trying to set up
+ * a kernel socket.
+ */
+- if (info.fd < 0) {
+- error = -EBADF;
+- goto end;
+- }
++ if (info->fd < 0)
++ return ERR_PTR(-EBADF);
+
+- error = l2tp_tunnel_create(info.fd,
+- info.version,
+- info.tunnel_id,
+- info.peer_tunnel_id, &tcfg,
++ error = l2tp_tunnel_create(info->fd,
++ info->version,
++ info->tunnel_id,
++ info->peer_tunnel_id, &tcfg,
+ &tunnel);
+ if (error < 0)
+- goto end;
++ return ERR_PTR(error);
+
+ l2tp_tunnel_inc_refcount(tunnel);
+- error = l2tp_tunnel_register(tunnel, sock_net(sk),
+- &tcfg);
++ error = l2tp_tunnel_register(tunnel, net, &tcfg);
+ if (error < 0) {
+ kfree(tunnel);
+- goto end;
++ return ERR_PTR(error);
+ }
+- drop_tunnel = true;
+- new_tunnel = true;
++
++ *new_tunnel = true;
+ }
+ } else {
+ /* Error if we can't find the tunnel */
+- error = -ENOENT;
+ if (!tunnel)
+- goto end;
++ return ERR_PTR(-ENOENT);
+
+ /* Error if socket is not prepped */
+- if (!tunnel->sock)
+- goto end;
++ if (!tunnel->sock) {
++ l2tp_tunnel_dec_refcount(tunnel);
++ return ERR_PTR(-ENOENT);
++ }
+ }
+
++ return tunnel;
++}
++
++/* connect() handler. Attach a PPPoX socket to a tunnel UDP socket
++ */
++static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
++ int sockaddr_len, int flags)
++{
++ struct sock *sk = sock->sk;
++ struct pppox_sock *po = pppox_sk(sk);
++ struct l2tp_session *session = NULL;
++ struct l2tp_connect_info info;
++ struct l2tp_tunnel *tunnel;
++ struct pppol2tp_session *ps;
++ struct l2tp_session_cfg cfg = { 0, };
++ bool drop_refcnt = false;
++ bool new_session = false;
++ bool new_tunnel = false;
++ int error;
++
++ error = pppol2tp_sockaddr_get_info(uservaddr, sockaddr_len, &info);
++ if (error < 0)
++ return error;
++
++ /* Don't bind if tunnel_id is 0 */
++ if (!info.tunnel_id)
++ return -EINVAL;
++
++ tunnel = pppol2tp_tunnel_get(sock_net(sk), &info, &new_tunnel);
++ if (IS_ERR(tunnel))
++ return PTR_ERR(tunnel);
++
++ lock_sock(sk);
++
++ /* Check for already bound sockets */
++ error = -EBUSY;
++ if (sk->sk_state & PPPOX_CONNECTED)
++ goto end;
++
++ /* We don't supporting rebinding anyway */
++ error = -EALREADY;
++ if (sk->sk_user_data)
++ goto end; /* socket is already attached */
++
+ if (tunnel->peer_tunnel_id == 0)
+ tunnel->peer_tunnel_id = info.peer_tunnel_id;
+
+@@ -840,8 +850,7 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
+ }
+ if (drop_refcnt)
+ l2tp_session_dec_refcount(session);
+- if (drop_tunnel)
+- l2tp_tunnel_dec_refcount(tunnel);
++ l2tp_tunnel_dec_refcount(tunnel);
+ release_sock(sk);
+
+ return error;
+--
+2.39.2
+
--- /dev/null
+From d26e51b38d6002a0c3564b40ed19ccf83159acfb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Dec 2022 11:32:38 +0200
+Subject: leds: is31fl319x: Wrap mutex_destroy() for devm_add_action_or_rest()
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit a82c7cf803d98751cd3ddb35828faad925d71982 ]
+
+Clang complains that devm_add_action() takes a parameter with a wrong type:
+
+warning: cast from 'void (*)(struct mutex *)' to 'void (*)(void *)' converts to incompatible function type [-Wcast-function-type-strict]
+ err = devm_add_action(dev, (void (*)(void *))mutex_destroy, &is31->lock);
+ ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ 1 warning generated.
+
+It appears that the commit e1af5c815586 ("leds: is31fl319x: Fix devm vs.
+non-devm ordering") missed two things:
+
+- whilst the commit mentions devm_add_action_or_reset() the actual change
+ utilised devm_add_action() call by mistake
+- strictly speaking the parameter is not compatible by type
+
+Fix both issues by switching to devm_add_action_or_reset() and adding a
+wrapper for mutex_destroy() call.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Fixes: e1af5c815586 ("leds: is31fl319x: Fix devm vs. non-devm ordering")
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Tested-by: Vincent Knecht <vincent.knecht@mailoo.org>
+Signed-off-by: Lee Jones <lee@kernel.org>
+Link: https://lore.kernel.org/r/20221228093238.82713-1-andriy.shevchenko@linux.intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/leds/leds-is31fl319x.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/leds/leds-is31fl319x.c b/drivers/leds/leds-is31fl319x.c
+index b2f4c4ec7c567..7c908414ac7e0 100644
+--- a/drivers/leds/leds-is31fl319x.c
++++ b/drivers/leds/leds-is31fl319x.c
+@@ -495,6 +495,11 @@ static inline int is31fl3196_db_to_gain(u32 dezibel)
+ return dezibel / IS31FL3196_AUDIO_GAIN_DB_STEP;
+ }
+
++static void is31f1319x_mutex_destroy(void *lock)
++{
++ mutex_destroy(lock);
++}
++
+ static int is31fl319x_probe(struct i2c_client *client)
+ {
+ struct is31fl319x_chip *is31;
+@@ -511,7 +516,7 @@ static int is31fl319x_probe(struct i2c_client *client)
+ return -ENOMEM;
+
+ mutex_init(&is31->lock);
+- err = devm_add_action(dev, (void (*)(void *))mutex_destroy, &is31->lock);
++ err = devm_add_action_or_reset(dev, is31f1319x_mutex_destroy, &is31->lock);
+ if (err)
+ return err;
+
+--
+2.39.2
+
--- /dev/null
+From 95dc566ec8274c30acc807be93de8a0cf3fe454d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Jan 2023 12:45:14 +0100
+Subject: leds: led-class: Add missing put_device() to led_put()
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 445110941eb94709216363f9d807d2508e64abd7 ]
+
+led_put() is used to "undo" a successful of_led_get() call,
+of_led_get() uses class_find_device_by_of_node() which returns
+a reference to the device which must be free-ed with put_device()
+when the caller is done with it.
+
+Add a put_device() call to led_put() to free the reference returned
+by class_find_device_by_of_node().
+
+And also add a put_device() in the error-exit case of try_module_get()
+failing.
+
+Fixes: 699a8c7c4bd3 ("leds: Add of_led_get() and led_put()")
+Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Lee Jones <lee@kernel.org>
+Link: https://lore.kernel.org/r/20230120114524.408368-2-hdegoede@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/leds/led-class.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/leds/led-class.c b/drivers/leds/led-class.c
+index 6a8ea94834fa3..7391d2cf1370a 100644
+--- a/drivers/leds/led-class.c
++++ b/drivers/leds/led-class.c
+@@ -241,8 +241,10 @@ struct led_classdev *of_led_get(struct device_node *np, int index)
+
+ led_cdev = dev_get_drvdata(led_dev);
+
+- if (!try_module_get(led_cdev->dev->parent->driver->owner))
++ if (!try_module_get(led_cdev->dev->parent->driver->owner)) {
++ put_device(led_cdev->dev);
+ return ERR_PTR(-ENODEV);
++ }
+
+ return led_cdev;
+ }
+@@ -255,6 +257,7 @@ EXPORT_SYMBOL_GPL(of_led_get);
+ void led_put(struct led_classdev *led_cdev)
+ {
+ module_put(led_cdev->dev->parent->driver->owner);
++ put_device(led_cdev->dev);
+ }
+ EXPORT_SYMBOL_GPL(led_put);
+
+--
+2.39.2
+
--- /dev/null
+From 1fe38f11de949b47d6f40deb6773c3c2600acd95 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Dec 2022 16:18:07 +0400
+Subject: leds: led-core: Fix refcount leak in of_led_get()
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit da1afe8e6099980fe1e2fd7436dca284af9d3f29 ]
+
+class_find_device_by_of_node() calls class_find_device(), it will take
+the reference, use the put_device() to drop the reference when not need
+anymore.
+
+Fixes: 699a8c7c4bd3 ("leds: Add of_led_get() and led_put()")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Signed-off-by: Lee Jones <lee@kernel.org>
+Link: https://lore.kernel.org/r/20221220121807.1543790-1-linmq006@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/leds/led-class.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/leds/led-class.c b/drivers/leds/led-class.c
+index 7391d2cf1370a..aa39b2a48fdff 100644
+--- a/drivers/leds/led-class.c
++++ b/drivers/leds/led-class.c
+@@ -235,6 +235,7 @@ struct led_classdev *of_led_get(struct device_node *np, int index)
+
+ led_dev = class_find_device_by_of_node(leds_class, led_node);
+ of_node_put(led_node);
++ put_device(led_dev);
+
+ if (!led_dev)
+ return ERR_PTR(-EPROBE_DEFER);
+--
+2.39.2
+
--- /dev/null
+From 5af8492e5c6e8f8a654daa96b76390e70b66e908 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Oct 2022 17:33:23 +0200
+Subject: leds: simatic-ipc-leds-gpio: Make sure we have the GPIO providing
+ driver
+
+From: Henning Schild <henning.schild@siemens.com>
+
+[ Upstream commit c64964ebee2a415384385205950ee7a05f78451e ]
+
+If we register a "leds-gpio" platform device for GPIO pins that do not
+exist we get a -EPROBE_DEFER and the probe will be tried again later.
+If there is no driver to provide that pin we will poll forever and also
+create a lot of log messages.
+
+So check if that GPIO driver is configured, if so it will come up
+eventually. If not, we exit our probe function early and do not even
+bother registering the "leds-gpio". This method was chosen over "Kconfig
+depends" since this way we can add support for more devices and GPIO
+backends more easily without "depends":ing on all GPIO backends.
+
+Fixes: a6c80bec3c93 ("leds: simatic-ipc-leds-gpio: Add GPIO version of Siemens driver")
+Signed-off-by: Henning Schild <henning.schild@siemens.com>
+Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Signed-off-by: Lee Jones <lee@kernel.org>
+Link: https://lore.kernel.org/r/20221007153323.1326-1-henning.schild@siemens.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/leds/simple/simatic-ipc-leds-gpio.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/leds/simple/simatic-ipc-leds-gpio.c b/drivers/leds/simple/simatic-ipc-leds-gpio.c
+index 07f0d79d604d4..e8d329b5a68c3 100644
+--- a/drivers/leds/simple/simatic-ipc-leds-gpio.c
++++ b/drivers/leds/simple/simatic-ipc-leds-gpio.c
+@@ -77,6 +77,8 @@ static int simatic_ipc_leds_gpio_probe(struct platform_device *pdev)
+
+ switch (plat->devmode) {
+ case SIMATIC_IPC_DEVICE_127E:
++ if (!IS_ENABLED(CONFIG_PINCTRL_BROXTON))
++ return -ENODEV;
+ simatic_ipc_led_gpio_table = &simatic_ipc_led_gpio_table_127e;
+ break;
+ case SIMATIC_IPC_DEVICE_227G:
+--
+2.39.2
+
--- /dev/null
+From 7ce807b8afa8efb644127de01890d13060384ded Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Dec 2022 15:27:39 +0100
+Subject: lib/mpi: Fix buffer overrun when SG is too long
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+[ Upstream commit 7361d1bc307b926cbca214ab67b641123c2d6357 ]
+
+The helper mpi_read_raw_from_sgl sets the number of entries in
+the SG list according to nbytes. However, if the last entry
+in the SG list contains more data than nbytes, then it may overrun
+the buffer because it only allocates enough memory for nbytes.
+
+Fixes: 2d4d1eea540b ("lib/mpi: Add mpi sgl helpers")
+Reported-by: Roberto Sassu <roberto.sassu@huaweicloud.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Reviewed-by: Eric Biggers <ebiggers@google.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/mpi/mpicoder.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/lib/mpi/mpicoder.c b/lib/mpi/mpicoder.c
+index 39c4c67310946..3cb6bd148fa9e 100644
+--- a/lib/mpi/mpicoder.c
++++ b/lib/mpi/mpicoder.c
+@@ -504,7 +504,8 @@ MPI mpi_read_raw_from_sgl(struct scatterlist *sgl, unsigned int nbytes)
+
+ while (sg_miter_next(&miter)) {
+ buff = miter.addr;
+- len = miter.length;
++ len = min_t(unsigned, miter.length, nbytes);
++ nbytes -= len;
+
+ for (x = 0; x < len; x++) {
+ a <<= 8;
+--
+2.39.2
+
--- /dev/null
+From aafb505e436bbaea96347bffc5fa4991425022a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Feb 2023 01:12:01 +0100
+Subject: libbpf: Fix alen calculation in libbpf_nla_dump_errormsg()
+
+From: Ilya Leoshkevich <iii@linux.ibm.com>
+
+[ Upstream commit 17bcd27a08a21397698edf143084d7c87ce17946 ]
+
+The code assumes that everything that comes after nlmsgerr are nlattrs.
+When calculating their size, it does not account for the initial
+nlmsghdr. This may lead to accessing uninitialized memory.
+
+Fixes: bbf48c18ee0c ("libbpf: add error reporting in XDP")
+Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20230210001210.395194-8-iii@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/nlattr.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/lib/bpf/nlattr.c b/tools/lib/bpf/nlattr.c
+index 3900d052ed19e..975e265eab3bf 100644
+--- a/tools/lib/bpf/nlattr.c
++++ b/tools/lib/bpf/nlattr.c
+@@ -178,7 +178,7 @@ int libbpf_nla_dump_errormsg(struct nlmsghdr *nlh)
+ hlen += nlmsg_len(&err->msg);
+
+ attr = (struct nlattr *) ((void *) err + hlen);
+- alen = nlh->nlmsg_len - hlen;
++ alen = (void *)nlh + nlh->nlmsg_len - (void *)attr;
+
+ if (libbpf_nla_parse(tb, NLMSGERR_ATTR_MAX, attr, alen,
+ extack_policy) != 0) {
+--
+2.39.2
+
--- /dev/null
+From 20c21fb8707f0884bf29f7a04f13c9b7ee9c2e51 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Dec 2022 13:15:03 -0800
+Subject: libbpf: Fix btf__align_of() by taking into account field offsets
+
+From: Andrii Nakryiko <andrii@kernel.org>
+
+[ Upstream commit 25a4481b4136af7794e1df2d6c90ed2f354d60ce ]
+
+btf__align_of() is supposed to be return alignment requirement of
+a requested BTF type. For STRUCT/UNION it doesn't always return correct
+value, because it calculates alignment only based on field types. But
+for packed structs this is not enough, we need to also check field
+offsets and struct size. If field offset isn't aligned according to
+field type's natural alignment, then struct must be packed. Similarly,
+if struct size is not a multiple of struct's natural alignment, then
+struct must be packed as well.
+
+This patch fixes this issue precisely by additionally checking these
+conditions.
+
+Fixes: 3d208f4ca111 ("libbpf: Expose btf__align_of() API")
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/20221212211505.558851-5-andrii@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/btf.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/tools/lib/bpf/btf.c b/tools/lib/bpf/btf.c
+index 71e165b09ed59..8cbcef959456d 100644
+--- a/tools/lib/bpf/btf.c
++++ b/tools/lib/bpf/btf.c
+@@ -688,8 +688,21 @@ int btf__align_of(const struct btf *btf, __u32 id)
+ if (align <= 0)
+ return libbpf_err(align);
+ max_align = max(max_align, align);
++
++ /* if field offset isn't aligned according to field
++ * type's alignment, then struct must be packed
++ */
++ if (btf_member_bitfield_size(t, i) == 0 &&
++ (m->offset % (8 * align)) != 0)
++ return 1;
+ }
+
++ /* if struct/union size isn't a multiple of its alignment,
++ * then struct must be packed
++ */
++ if ((t->size % max_align) != 0)
++ return 1;
++
+ return max_align;
+ }
+ default:
+--
+2.39.2
+
--- /dev/null
+From 85e329d85d5480054a9a5d8fdefbbe25abb41874 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 24 Dec 2022 16:15:27 +0900
+Subject: libbpf: Fix invalid return address register in s390
+
+From: Daniel T. Lee <danieltimlee@gmail.com>
+
+[ Upstream commit 7244eb669397f309c3d014264823cdc9cb3f8e6b ]
+
+There is currently an invalid register mapping in the s390 return
+address register. As the manual[1] states, the return address can be
+found at r14. In bpf_tracing.h, the s390 registers were named
+gprs(general purpose registers). This commit fixes the problem by
+correcting the mistyped mapping.
+
+[1]: https://uclibc.org/docs/psABI-s390x.pdf#page=14
+
+Fixes: 3cc31d794097 ("libbpf: Normalize PT_REGS_xxx() macro definitions")
+Signed-off-by: Daniel T. Lee <danieltimlee@gmail.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20221224071527.2292-7-danieltimlee@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/bpf_tracing.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/lib/bpf/bpf_tracing.h b/tools/lib/bpf/bpf_tracing.h
+index 2972dc25ff722..9c1b1689068d1 100644
+--- a/tools/lib/bpf/bpf_tracing.h
++++ b/tools/lib/bpf/bpf_tracing.h
+@@ -137,7 +137,7 @@ struct pt_regs___s390 {
+ #define __PT_PARM3_REG gprs[4]
+ #define __PT_PARM4_REG gprs[5]
+ #define __PT_PARM5_REG gprs[6]
+-#define __PT_RET_REG grps[14]
++#define __PT_RET_REG gprs[14]
+ #define __PT_FP_REG gprs[11] /* Works only with CONFIG_FRAME_POINTER */
+ #define __PT_RC_REG gprs[2]
+ #define __PT_SP_REG gprs[15]
+--
+2.39.2
+
--- /dev/null
+From adc98355c8d66baecd201342d4a85ebfbc2adf14 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 8 Jan 2023 19:20:18 +0100
+Subject: libbpf: Fix map creation flags sanitization
+
+From: Ludovic L'Hours <ludovic.lhours@gmail.com>
+
+[ Upstream commit 6920b08661e3ad829206078b5c9879b24aea8dfc ]
+
+As BPF_F_MMAPABLE flag is now conditionnaly set (by map_is_mmapable),
+it should not be toggled but disabled if not supported by kernel.
+
+Fixes: 4fcac46c7e10 ("libbpf: only add BPF_F_MMAPABLE flag for data maps with global vars")
+Signed-off-by: Ludovic L'Hours <ludovic.lhours@gmail.com>
+Acked-by: Jiri Olsa <jolsa@kernel.org>
+Link: https://lore.kernel.org/r/20230108182018.24433-1-ludovic.lhours@gmail.com
+Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/libbpf.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
+index 2a82f49ce16f3..adf818da35dda 100644
+--- a/tools/lib/bpf/libbpf.c
++++ b/tools/lib/bpf/libbpf.c
+@@ -7355,7 +7355,7 @@ static int bpf_object__sanitize_maps(struct bpf_object *obj)
+ if (!bpf_map__is_internal(m))
+ continue;
+ if (!kernel_supports(obj, FEAT_ARRAY_MMAP))
+- m->def.map_flags ^= BPF_F_MMAPABLE;
++ m->def.map_flags &= ~BPF_F_MMAPABLE;
+ }
+
+ return 0;
+--
+2.39.2
+
--- /dev/null
+From 08a512e513568d3a5cba93a1f6b4978c66f92dfd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Dec 2022 13:15:00 -0800
+Subject: libbpf: Fix single-line struct definition output in btf_dump
+
+From: Andrii Nakryiko <andrii@kernel.org>
+
+[ Upstream commit 872aec4b5f635d94111d48ec3c57fbe078d64e7d ]
+
+btf_dump APIs emit unnecessary tabs when emitting struct/union
+definition that fits on the single line. Before this patch we'd get:
+
+struct blah {<tab>};
+
+This patch fixes this and makes sure that we get more natural:
+
+struct blah {};
+
+Fixes: 44a726c3f23c ("bpftool: Print newline before '}' for struct with padding only fields")
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/20221212211505.558851-2-andrii@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/btf_dump.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/tools/lib/bpf/btf_dump.c b/tools/lib/bpf/btf_dump.c
+index deb2bc9a0a7b0..69e80ee5f70e2 100644
+--- a/tools/lib/bpf/btf_dump.c
++++ b/tools/lib/bpf/btf_dump.c
+@@ -959,9 +959,12 @@ static void btf_dump_emit_struct_def(struct btf_dump *d,
+ * Keep `struct empty {}` on a single line,
+ * only print newline when there are regular or padding fields.
+ */
+- if (vlen || t->size)
++ if (vlen || t->size) {
+ btf_dump_printf(d, "\n");
+- btf_dump_printf(d, "%s}", pfx(lvl));
++ btf_dump_printf(d, "%s}", pfx(lvl));
++ } else {
++ btf_dump_printf(d, "}");
++ }
+ if (packed)
+ btf_dump_printf(d, " __attribute__((packed))");
+ }
+--
+2.39.2
+
--- /dev/null
+From cb06623a57abd43cec9162188b3458dc02afcb1d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Jan 2023 19:36:26 -0500
+Subject: locking/rwsem: Disable preemption in all down_read*() and up_read()
+ code paths
+
+From: Waiman Long <longman@redhat.com>
+
+[ Upstream commit 3f5245538a1964ae186ab7e1636020a41aa63143 ]
+
+Commit:
+
+ 91d2a812dfb9 ("locking/rwsem: Make handoff writer optimistically spin on owner")
+
+... assumes that when the owner field is changed to NULL, the lock will
+become free soon. But commit:
+
+ 48dfb5d2560d ("locking/rwsem: Disable preemption while trying for rwsem lock")
+
+... disabled preemption when acquiring rwsem for write.
+
+However, preemption has not yet been disabled when acquiring a read lock
+on a rwsem. So a reader can add a RWSEM_READER_BIAS to count without
+setting owner to signal a reader, got preempted out by a RT task which
+then spins in the writer slowpath as owner remains NULL leading to live lock.
+
+One easy way to fix this problem is to disable preemption at all the
+down_read*() and up_read() code paths as implemented in this patch.
+
+Fixes: 91d2a812dfb9 ("locking/rwsem: Make handoff writer optimistically spin on owner")
+Reported-by: Mukesh Ojha <quic_mojha@quicinc.com>
+Suggested-by: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Waiman Long <longman@redhat.com>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Link: https://lore.kernel.org/r/20230126003628.365092-3-longman@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/locking/rwsem.c | 30 ++++++++++++++++++++++++------
+ 1 file changed, 24 insertions(+), 6 deletions(-)
+
+diff --git a/kernel/locking/rwsem.c b/kernel/locking/rwsem.c
+index 44873594de031..324fc370b6a68 100644
+--- a/kernel/locking/rwsem.c
++++ b/kernel/locking/rwsem.c
+@@ -1092,7 +1092,7 @@ rwsem_down_read_slowpath(struct rw_semaphore *sem, long count, unsigned int stat
+ /* Ordered by sem->wait_lock against rwsem_mark_wake(). */
+ break;
+ }
+- schedule();
++ schedule_preempt_disabled();
+ lockevent_inc(rwsem_sleep_reader);
+ }
+
+@@ -1254,14 +1254,20 @@ static struct rw_semaphore *rwsem_downgrade_wake(struct rw_semaphore *sem)
+ */
+ static inline int __down_read_common(struct rw_semaphore *sem, int state)
+ {
++ int ret = 0;
+ long count;
+
++ preempt_disable();
+ if (!rwsem_read_trylock(sem, &count)) {
+- if (IS_ERR(rwsem_down_read_slowpath(sem, count, state)))
+- return -EINTR;
++ if (IS_ERR(rwsem_down_read_slowpath(sem, count, state))) {
++ ret = -EINTR;
++ goto out;
++ }
+ DEBUG_RWSEMS_WARN_ON(!is_rwsem_reader_owned(sem), sem);
+ }
+- return 0;
++out:
++ preempt_enable();
++ return ret;
+ }
+
+ static inline void __down_read(struct rw_semaphore *sem)
+@@ -1281,19 +1287,23 @@ static inline int __down_read_killable(struct rw_semaphore *sem)
+
+ static inline int __down_read_trylock(struct rw_semaphore *sem)
+ {
++ int ret = 0;
+ long tmp;
+
+ DEBUG_RWSEMS_WARN_ON(sem->magic != sem, sem);
+
++ preempt_disable();
+ tmp = atomic_long_read(&sem->count);
+ while (!(tmp & RWSEM_READ_FAILED_MASK)) {
+ if (atomic_long_try_cmpxchg_acquire(&sem->count, &tmp,
+ tmp + RWSEM_READER_BIAS)) {
+ rwsem_set_reader_owned(sem);
+- return 1;
++ ret = 1;
++ break;
+ }
+ }
+- return 0;
++ preempt_enable();
++ return ret;
+ }
+
+ /*
+@@ -1335,6 +1345,7 @@ static inline void __up_read(struct rw_semaphore *sem)
+ DEBUG_RWSEMS_WARN_ON(sem->magic != sem, sem);
+ DEBUG_RWSEMS_WARN_ON(!is_rwsem_reader_owned(sem), sem);
+
++ preempt_disable();
+ rwsem_clear_reader_owned(sem);
+ tmp = atomic_long_add_return_release(-RWSEM_READER_BIAS, &sem->count);
+ DEBUG_RWSEMS_WARN_ON(tmp < 0, sem);
+@@ -1343,6 +1354,7 @@ static inline void __up_read(struct rw_semaphore *sem)
+ clear_nonspinnable(sem);
+ rwsem_wake(sem);
+ }
++ preempt_enable();
+ }
+
+ /*
+@@ -1662,6 +1674,12 @@ void down_read_non_owner(struct rw_semaphore *sem)
+ {
+ might_sleep();
+ __down_read(sem);
++ /*
++ * The owner value for a reader-owned lock is mostly for debugging
++ * purpose only and is not critical to the correct functioning of
++ * rwsem. So it is perfectly fine to set it in a preempt-enabled
++ * context here.
++ */
+ __rwsem_set_reader_owned(sem, NULL);
+ }
+ EXPORT_SYMBOL(down_read_non_owner);
+--
+2.39.2
+
--- /dev/null
+From 566b6a0c03b0d725233c305f31e9aa9157519904 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Feb 2023 15:26:33 +0000
+Subject: LoongArch, bpf: Use 4 instructions for function address in JIT
+
+From: Hengqi Chen <hengqi.chen@gmail.com>
+
+[ Upstream commit 64f50f6575721ef03d001e907455cbe3baa2a5b1 ]
+
+This patch fixes the following issue of function calls in JIT, like:
+
+ [ 29.346981] multi-func JIT bug 105 != 103
+
+The issus can be reproduced by running the "inline simple bpf_loop call"
+verifier test.
+
+This is because we are emiting 2-4 instructions for 64-bit immediate moves.
+During the first pass of JIT, the placeholder address is zero, emiting two
+instructions for it. In the extra pass, the function address is in XKVRANGE,
+emiting four instructions for it. This change the instruction index in
+JIT context. Let's always use 4 instructions for function address in JIT.
+So that the instruction sequences don't change between the first pass and
+the extra pass for function calls.
+
+Fixes: 5dc615520c4d ("LoongArch: Add BPF JIT support")
+Signed-off-by: Hengqi Chen <hengqi.chen@gmail.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Tested-by: Tiezhu Yang <yangtiezhu@loongson.cn>
+Link: https://lore.kernel.org/bpf/20230214152633.2265699-1-hengqi.chen@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/loongarch/net/bpf_jit.c | 2 +-
+ arch/loongarch/net/bpf_jit.h | 21 +++++++++++++++++++++
+ 2 files changed, 22 insertions(+), 1 deletion(-)
+
+diff --git a/arch/loongarch/net/bpf_jit.c b/arch/loongarch/net/bpf_jit.c
+index c4b1947ebf768..288003a9f0cae 100644
+--- a/arch/loongarch/net/bpf_jit.c
++++ b/arch/loongarch/net/bpf_jit.c
+@@ -841,7 +841,7 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx, bool ext
+ if (ret < 0)
+ return ret;
+
+- move_imm(ctx, t1, func_addr, is32);
++ move_addr(ctx, t1, func_addr);
+ emit_insn(ctx, jirl, t1, LOONGARCH_GPR_RA, 0);
+ move_reg(ctx, regmap[BPF_REG_0], LOONGARCH_GPR_A0);
+ break;
+diff --git a/arch/loongarch/net/bpf_jit.h b/arch/loongarch/net/bpf_jit.h
+index ca708024fdd3e..c335dc4eed370 100644
+--- a/arch/loongarch/net/bpf_jit.h
++++ b/arch/loongarch/net/bpf_jit.h
+@@ -82,6 +82,27 @@ static inline void emit_sext_32(struct jit_ctx *ctx, enum loongarch_gpr reg, boo
+ emit_insn(ctx, addiw, reg, reg, 0);
+ }
+
++static inline void move_addr(struct jit_ctx *ctx, enum loongarch_gpr rd, u64 addr)
++{
++ u64 imm_11_0, imm_31_12, imm_51_32, imm_63_52;
++
++ /* lu12iw rd, imm_31_12 */
++ imm_31_12 = (addr >> 12) & 0xfffff;
++ emit_insn(ctx, lu12iw, rd, imm_31_12);
++
++ /* ori rd, rd, imm_11_0 */
++ imm_11_0 = addr & 0xfff;
++ emit_insn(ctx, ori, rd, rd, imm_11_0);
++
++ /* lu32id rd, imm_51_32 */
++ imm_51_32 = (addr >> 32) & 0xfffff;
++ emit_insn(ctx, lu32id, rd, imm_51_32);
++
++ /* lu52id rd, rd, imm_63_52 */
++ imm_63_52 = (addr >> 52) & 0xfff;
++ emit_insn(ctx, lu52id, rd, rd, imm_63_52);
++}
++
+ static inline void move_imm(struct jit_ctx *ctx, enum loongarch_gpr rd, long imm, bool is32)
+ {
+ long imm_11_0, imm_31_12, imm_51_32, imm_63_52, imm_51_0, imm_51_31;
+--
+2.39.2
+
--- /dev/null
+From 3baa6386255dcf1e4e24cebe5d0cb9aac5dd7220 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Jan 2023 16:55:27 +1300
+Subject: m68k: Check syscall_trace_enter() return code
+
+From: Michael Schmitz <schmitzmic@gmail.com>
+
+[ Upstream commit 2ca8a1de4437f21562e57f9ac123914747a8e7a1 ]
+
+Check return code of syscall_trace_enter(), and skip syscall
+if -1. Return code will be left at what had been set by
+ptrace or seccomp (in regs->d0).
+
+No regression seen in testing with strace on ARAnyM.
+
+Signed-off-by: Michael Schmitz <schmitzmic@gmail.com>
+Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Link: https://lore.kernel.org/r/20230112035529.13521-2-schmitzmic@gmail.com
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/m68k/68000/entry.S | 2 ++
+ arch/m68k/coldfire/entry.S | 2 ++
+ arch/m68k/kernel/entry.S | 3 +++
+ 3 files changed, 7 insertions(+)
+
+diff --git a/arch/m68k/68000/entry.S b/arch/m68k/68000/entry.S
+index 997b549330156..7d63e2f1555a0 100644
+--- a/arch/m68k/68000/entry.S
++++ b/arch/m68k/68000/entry.S
+@@ -45,6 +45,8 @@ do_trace:
+ jbsr syscall_trace_enter
+ RESTORE_SWITCH_STACK
+ addql #4,%sp
++ addql #1,%d0
++ jeq ret_from_exception
+ movel %sp@(PT_OFF_ORIG_D0),%d1
+ movel #-ENOSYS,%d0
+ cmpl #NR_syscalls,%d1
+diff --git a/arch/m68k/coldfire/entry.S b/arch/m68k/coldfire/entry.S
+index 9f337c70243a3..35104c5417ff4 100644
+--- a/arch/m68k/coldfire/entry.S
++++ b/arch/m68k/coldfire/entry.S
+@@ -90,6 +90,8 @@ ENTRY(system_call)
+ jbsr syscall_trace_enter
+ RESTORE_SWITCH_STACK
+ addql #4,%sp
++ addql #1,%d0
++ jeq ret_from_exception
+ movel %d3,%a0
+ jbsr %a0@
+ movel %d0,%sp@(PT_OFF_D0) /* save the return value */
+diff --git a/arch/m68k/kernel/entry.S b/arch/m68k/kernel/entry.S
+index 18f278bdbd218..42879e6eb651d 100644
+--- a/arch/m68k/kernel/entry.S
++++ b/arch/m68k/kernel/entry.S
+@@ -184,9 +184,12 @@ do_trace_entry:
+ jbsr syscall_trace_enter
+ RESTORE_SWITCH_STACK
+ addql #4,%sp
++ addql #1,%d0 | optimization for cmpil #-1,%d0
++ jeq ret_from_syscall
+ movel %sp@(PT_OFF_ORIG_D0),%d0
+ cmpl #NR_syscalls,%d0
+ jcs syscall
++ jra ret_from_syscall
+ badsys:
+ movel #-ENOSYS,%sp@(PT_OFF_D0)
+ jra ret_from_syscall
+--
+2.39.2
+
--- /dev/null
+From fb53fd6d49092f9291d4d358cac5e49ac4bea939 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Feb 2023 17:08:25 -0800
+Subject: m68k: /proc/hardware should depend on PROC_FS
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 1e5b5df65af99013b4d31607ddb3ca5731dbe44d ]
+
+When CONFIG_PROC_FS is not set, there is a build error for an unused
+function. Make PROC_HARDWARE depend on PROC_FS to prevent this error.
+
+In file included from ../arch/m68k/kernel/setup.c:3:
+../arch/m68k/kernel/setup_mm.c:477:12: error: 'hardware_proc_show' defined but not used [-Werror=unused-function]
+ 477 | static int hardware_proc_show(struct seq_file *m, void *v)
+ | ^~~~~~~~~~~~~~~~~~
+
+Fixes: 66d857b08b8c ("m68k: merge m68k and m68knommu arch directories") # v3.0
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Link: https://lore.kernel.org/r/20230209010825.24136-1-rdunlap@infradead.org
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/m68k/Kconfig.devices | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/m68k/Kconfig.devices b/arch/m68k/Kconfig.devices
+index 6a87b4a5fcac2..e6e3efac18407 100644
+--- a/arch/m68k/Kconfig.devices
++++ b/arch/m68k/Kconfig.devices
+@@ -19,6 +19,7 @@ config HEARTBEAT
+ # We have a dedicated heartbeat LED. :-)
+ config PROC_HARDWARE
+ bool "/proc/hardware support"
++ depends on PROC_FS
+ help
+ Say Y here to support the /proc/hardware file, which gives you
+ access to information about the machine you're running on,
+--
+2.39.2
+
--- /dev/null
+From b24fca08b64ff4e1c43f2362894a7c0c2fb62668 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Jan 2023 06:25:51 +0100
+Subject: media: amphion: correct the unspecified color space
+
+From: Ming Qian <ming.qian@nxp.com>
+
+[ Upstream commit 809060c8a357e020010dd8f797a5efd3c5432b13 ]
+
+in the E.2.1 of Rec. ITU-T H.264 (06/2019),
+0 of colour primaries is reserved, and 2 is unspecified.
+driver can map V4L2_COLORSPACE_LAST to 0,
+and map V4L2_COLORSPACE_DEFAULT to 2.
+
+v4l2_xfer_func and v4l2_ycbcr_encoding are similar case.
+
+Fixes: 3cd084519c6f ("media: amphion: add vpu v4l2 m2m support")
+Signed-off-by: Ming Qian <ming.qian@nxp.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/amphion/vpu_color.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/media/platform/amphion/vpu_color.c b/drivers/media/platform/amphion/vpu_color.c
+index 80b9a53fd1c14..4ae435cbc5cda 100644
+--- a/drivers/media/platform/amphion/vpu_color.c
++++ b/drivers/media/platform/amphion/vpu_color.c
+@@ -17,7 +17,7 @@
+ #include "vpu_helpers.h"
+
+ static const u8 colorprimaries[] = {
+- 0,
++ V4L2_COLORSPACE_LAST,
+ V4L2_COLORSPACE_REC709, /*Rec. ITU-R BT.709-6*/
+ 0,
+ 0,
+@@ -31,7 +31,7 @@ static const u8 colorprimaries[] = {
+ };
+
+ static const u8 colortransfers[] = {
+- 0,
++ V4L2_XFER_FUNC_LAST,
+ V4L2_XFER_FUNC_709, /*Rec. ITU-R BT.709-6*/
+ 0,
+ 0,
+@@ -53,7 +53,7 @@ static const u8 colortransfers[] = {
+ };
+
+ static const u8 colormatrixcoefs[] = {
+- 0,
++ V4L2_YCBCR_ENC_LAST,
+ V4L2_YCBCR_ENC_709, /*Rec. ITU-R BT.709-6*/
+ 0,
+ 0,
+--
+2.39.2
+
--- /dev/null
+From e572f7f7435d8b02fdbd27df634176b10d252837 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Jan 2023 09:21:36 +0100
+Subject: media: atomisp: fix videobuf2 Kconfig depenendency
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit be94be1b7fc7e51f9ccef20a0ef76583587275f3 ]
+
+The recent conversion missed the Kconfig bit, so it can now
+end up in a link error on randconfig builds:
+
+ld.lld: error: undefined symbol: vb2_vmalloc_memops
+>>> referenced by atomisp_fops.c
+>>> drivers/staging/media/atomisp/pci/atomisp_fops.o:(atomisp_open) in archive vmlinux.a
+
+Link: https://lore.kernel.org/r/20230104082212.3770415-1-arnd@kernel.org
+
+Fixes: cb48ae89be3b ("media: atomisp: Convert to videobuf2")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Tested-by: Andy Shevchenko <andy@kernel.org>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/atomisp/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/staging/media/atomisp/Kconfig b/drivers/staging/media/atomisp/Kconfig
+index 2c8d7fdcc5f7a..c9bff98e5309a 100644
+--- a/drivers/staging/media/atomisp/Kconfig
++++ b/drivers/staging/media/atomisp/Kconfig
+@@ -14,7 +14,7 @@ config VIDEO_ATOMISP
+ depends on VIDEO_DEV && INTEL_ATOMISP
+ depends on PMIC_OPREGION
+ select IOSF_MBI
+- select VIDEOBUF_VMALLOC
++ select VIDEOBUF2_VMALLOC
+ select VIDEO_V4L2_SUBDEV_API
+ help
+ Say Y here if your platform supports Intel Atom SoC
+--
+2.39.2
+
--- /dev/null
+From 0a8464aec3198afccae97c7e328d411fe2acf71b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Dec 2022 23:11:47 +0100
+Subject: media: atomisp: Only set default_run_mode on first open of a
+ stream/asd
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 60ec70a71a9f9975a5d2dd4a7d97c20da0e41976 ]
+
+Calling v4l2_ctrl_s_ctrl(asd->run_mode, pipe->default_run_mode) when
+the stream is already active (through another /dev/video# node) causes
+the stream to stop.
+
+Move the call to set the default run-mode so that it is only done
+on the first open of one of the 4 /dev/video# nodes of one of
+the 2 streams (atomisp-sub-devices / asd-s).
+
+Fixes: 2c45e343c581 ("media: atomisp: set per-device's default mode")
+Reviewed-by: Andy Shevchenko <andy@kernel.org>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/atomisp/pci/atomisp_fops.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/staging/media/atomisp/pci/atomisp_fops.c b/drivers/staging/media/atomisp/pci/atomisp_fops.c
+index acea7492847d8..9b9d50d7166a0 100644
+--- a/drivers/staging/media/atomisp/pci/atomisp_fops.c
++++ b/drivers/staging/media/atomisp/pci/atomisp_fops.c
+@@ -821,13 +821,13 @@ static int atomisp_open(struct file *file)
+ goto done;
+
+ atomisp_subdev_init_struct(asd);
++ /* Ensure that a mode is set */
++ v4l2_ctrl_s_ctrl(asd->run_mode, pipe->default_run_mode);
+
+ done:
+ pipe->users++;
+ mutex_unlock(&isp->mutex);
+
+- /* Ensure that a mode is set */
+- v4l2_ctrl_s_ctrl(asd->run_mode, pipe->default_run_mode);
+
+ return 0;
+
+--
+2.39.2
+
--- /dev/null
+From b780922c0c903b4a77bfaea12777961516bfc488 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Dec 2022 17:28:46 +0100
+Subject: media: camss: csiphy-3ph: avoid undefined behavior
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 05fb9ace34b8645cb76f7e3a21b5c7b754329cae ]
+
+Marking a case of the switch statement as unreachable means the
+compiler treats it as undefined behavior, which is then caught by
+an objtool warning:
+
+drivers/media/platform/qcom/camss/camss-csiphy-3ph-1-0.o: warning: objtool: csiphy_lanes_enable() falls through to next function csiphy_lanes_disable()
+
+Instead of simply continuing execution at a random place of the
+driver, print a warning and return from to the caller, which
+makes it possible to understand what happens and avoids the
+warning.
+
+Fixes: 53655d2a0ff2 ("media: camss: csiphy-3ph: add support for SM8250 CSI DPHY")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Robert Foss <robert.foss@linaro.org>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/qcom/camss/camss-csiphy-3ph-1-0.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/qcom/camss/camss-csiphy-3ph-1-0.c b/drivers/media/platform/qcom/camss/camss-csiphy-3ph-1-0.c
+index 451a4c9b3d30d..04baa80494c66 100644
+--- a/drivers/media/platform/qcom/camss/camss-csiphy-3ph-1-0.c
++++ b/drivers/media/platform/qcom/camss/camss-csiphy-3ph-1-0.c
+@@ -429,7 +429,8 @@ static void csiphy_gen2_config_lanes(struct csiphy_device *csiphy,
+ array_size = ARRAY_SIZE(lane_regs_sm8250[0]);
+ break;
+ default:
+- unreachable();
++ WARN(1, "unknown cspi version\n");
++ return;
+ }
+
+ for (l = 0; l < 5; l++) {
+--
+2.39.2
+
--- /dev/null
+From 6b1589cf5a6112bcf17d854b920437300babf02a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Dec 2022 03:36:25 +0100
+Subject: media: drivers/media/v4l2-core/v4l2-h264 : add detection of null
+ pointers
+
+From: Dong Chuanjian <chuanjian@nfschina.com>
+
+[ Upstream commit be3ae7cf4326e95bb1d5413b63baabc26f4a1324 ]
+
+When the pointer variable is judged to be null, null is returned
+directly.
+
+[hverkuil: fix two checkpatch warnings]
+
+Signed-off-by: Dong Chuanjian <chuanjian@nfschina.com>
+Acked-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Fixes: d3f756ad629b ("media: v4l2: Trace calculated p/b0/b1 initial reflist")
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/v4l2-core/v4l2-h264.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/media/v4l2-core/v4l2-h264.c b/drivers/media/v4l2-core/v4l2-h264.c
+index 72bd64f651981..c00197d095e75 100644
+--- a/drivers/media/v4l2-core/v4l2-h264.c
++++ b/drivers/media/v4l2-core/v4l2-h264.c
+@@ -305,6 +305,8 @@ static const char *format_ref_list_p(const struct v4l2_h264_reflist_builder *bui
+ int n = 0, i;
+
+ *out_str = kmalloc(tmp_str_size, GFP_KERNEL);
++ if (!(*out_str))
++ return NULL;
+
+ n += snprintf(*out_str + n, tmp_str_size - n, "|");
+
+@@ -343,6 +345,8 @@ static const char *format_ref_list_b(const struct v4l2_h264_reflist_builder *bui
+ int n = 0, i;
+
+ *out_str = kmalloc(tmp_str_size, GFP_KERNEL);
++ if (!(*out_str))
++ return NULL;
+
+ n += snprintf(*out_str + n, tmp_str_size - n, "|");
+
+--
+2.39.2
+
--- /dev/null
+From 9603dcc463c3a77d2420808520fa622daed7634d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Dec 2022 19:16:47 +0100
+Subject: media: hantro: Fix JPEG encoder ENUM_FRMSIZE on RK3399
+
+From: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+
+[ Upstream commit 29bd426764dee14a09e37700406f4a5920825fcc ]
+
+Since 79c987de8b354, enumerating framesize on format set with "MODE_NONE"
+(any raw formats) is reporting an invalid frmsize.
+
+ Size: Stepwise 0x0 - 0x0 with step 0/0
+
+Before this change, the driver would return EINVAL, which is also invalid
+but worked in GStreamer. The original intent was not to implement it, hence
+the -ENOTTY return in this change. While drivers should implement
+ENUM_FRMSIZE for all formats and queues, this change is limited in scope to
+fix the regression.
+
+This fixes taking picture in Gnome Cheese software, or any software using
+GSteamer to encode JPEG with hardware acceleration.
+
+Fixes: 79c987de8b35 ("media: hantro: Use post processor scaling capacities")
+Reported-by: Robert Mader <robert.mader@collabora.com>
+Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Reviewed-by: Benjamin Gaignard <benjamin.gaignard@collabora.com>
+Reviewed-by: Ezequiel Garcia <ezequiel@vanguardiasur.com.ar>
+Tested-by: Robert Mader <robert.mader@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/verisilicon/hantro_v4l2.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/platform/verisilicon/hantro_v4l2.c b/drivers/media/platform/verisilicon/hantro_v4l2.c
+index 2c7a805289e7b..30e650edaea8a 100644
+--- a/drivers/media/platform/verisilicon/hantro_v4l2.c
++++ b/drivers/media/platform/verisilicon/hantro_v4l2.c
+@@ -161,8 +161,11 @@ static int vidioc_enum_framesizes(struct file *file, void *priv,
+ }
+
+ /* For non-coded formats check if postprocessing scaling is possible */
+- if (fmt->codec_mode == HANTRO_MODE_NONE && hantro_needs_postproc(ctx, fmt)) {
+- return hanto_postproc_enum_framesizes(ctx, fsize);
++ if (fmt->codec_mode == HANTRO_MODE_NONE) {
++ if (hantro_needs_postproc(ctx, fmt))
++ return hanto_postproc_enum_framesizes(ctx, fsize);
++ else
++ return -ENOTTY;
+ } else if (fsize->index != 0) {
+ vpu_debug(0, "invalid frame size index (expected 0, got %d)\n",
+ fsize->index);
+--
+2.39.2
+
--- /dev/null
+From 4c2c75c697405812704d63cca1a0d0266e2e604b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Jan 2023 09:16:23 +0100
+Subject: media: i2c: imx219: Fix binning for RAW8 capture
+
+From: Jai Luthra <j-luthra@ti.com>
+
+[ Upstream commit ef86447e775fb1f2ced00d4c7fff2c0a1c63f165 ]
+
+2x2 binning works fine for RAW10 capture, but for RAW8 1232p mode it
+leads to corrupted frames [1][2].
+
+Using the special 2x2 analog binning mode fixes the issue, but causes
+artefacts for RAW10 1232p capture. So here we choose the binning mode
+depending upon the frame format selected.
+
+As both binning modes work fine for 480p RAW8 and RAW10 capture, it can
+share the same code path as 1232p for selecting binning mode.
+
+[1] https://forums.raspberrypi.com/viewtopic.php?t=332103
+[2] https://github.com/raspberrypi/libcamera-apps/issues/281
+
+Fixes: 22da1d56e982 ("media: i2c: imx219: Add support for RAW8 bit bayer format")
+Signed-off-by: Jai Luthra <j-luthra@ti.com>
+Reviewed-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/imx219.c | 57 ++++++++++++++++++++++++++++++++------
+ 1 file changed, 49 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/media/i2c/imx219.c b/drivers/media/i2c/imx219.c
+index 7f44d62047b67..7a14688f8c228 100644
+--- a/drivers/media/i2c/imx219.c
++++ b/drivers/media/i2c/imx219.c
+@@ -89,6 +89,12 @@
+
+ #define IMX219_REG_ORIENTATION 0x0172
+
++/* Binning Mode */
++#define IMX219_REG_BINNING_MODE 0x0174
++#define IMX219_BINNING_NONE 0x0000
++#define IMX219_BINNING_2X2 0x0101
++#define IMX219_BINNING_2X2_ANALOG 0x0303
++
+ /* Test Pattern Control */
+ #define IMX219_REG_TEST_PATTERN 0x0600
+ #define IMX219_TEST_PATTERN_DISABLE 0
+@@ -143,6 +149,9 @@ struct imx219_mode {
+
+ /* Default register values */
+ struct imx219_reg_list reg_list;
++
++ /* 2x2 binning is used */
++ bool binning;
+ };
+
+ static const struct imx219_reg imx219_common_regs[] = {
+@@ -212,8 +221,6 @@ static const struct imx219_reg mode_3280x2464_regs[] = {
+ {0x016d, 0xd0},
+ {0x016e, 0x09},
+ {0x016f, 0xa0},
+- {0x0174, 0x00}, /* No-Binning */
+- {0x0175, 0x00},
+ {0x0624, 0x0c},
+ {0x0625, 0xd0},
+ {0x0626, 0x09},
+@@ -233,8 +240,6 @@ static const struct imx219_reg mode_1920_1080_regs[] = {
+ {0x016d, 0x80},
+ {0x016e, 0x04},
+ {0x016f, 0x38},
+- {0x0174, 0x00}, /* No-Binning */
+- {0x0175, 0x00},
+ {0x0624, 0x07},
+ {0x0625, 0x80},
+ {0x0626, 0x04},
+@@ -254,8 +259,6 @@ static const struct imx219_reg mode_1640_1232_regs[] = {
+ {0x016d, 0x68},
+ {0x016e, 0x04},
+ {0x016f, 0xd0},
+- {0x0174, 0x01}, /* x2-Binning */
+- {0x0175, 0x01},
+ {0x0624, 0x06},
+ {0x0625, 0x68},
+ {0x0626, 0x04},
+@@ -275,8 +278,6 @@ static const struct imx219_reg mode_640_480_regs[] = {
+ {0x016d, 0x80},
+ {0x016e, 0x01},
+ {0x016f, 0xe0},
+- {0x0174, 0x03}, /* x2-analog binning */
+- {0x0175, 0x03},
+ {0x0624, 0x06},
+ {0x0625, 0x68},
+ {0x0626, 0x04},
+@@ -390,6 +391,7 @@ static const struct imx219_mode supported_modes[] = {
+ .num_of_regs = ARRAY_SIZE(mode_3280x2464_regs),
+ .regs = mode_3280x2464_regs,
+ },
++ .binning = false,
+ },
+ {
+ /* 1080P 30fps cropped */
+@@ -406,6 +408,7 @@ static const struct imx219_mode supported_modes[] = {
+ .num_of_regs = ARRAY_SIZE(mode_1920_1080_regs),
+ .regs = mode_1920_1080_regs,
+ },
++ .binning = false,
+ },
+ {
+ /* 2x2 binned 30fps mode */
+@@ -422,6 +425,7 @@ static const struct imx219_mode supported_modes[] = {
+ .num_of_regs = ARRAY_SIZE(mode_1640_1232_regs),
+ .regs = mode_1640_1232_regs,
+ },
++ .binning = true,
+ },
+ {
+ /* 640x480 30fps mode */
+@@ -438,6 +442,7 @@ static const struct imx219_mode supported_modes[] = {
+ .num_of_regs = ARRAY_SIZE(mode_640_480_regs),
+ .regs = mode_640_480_regs,
+ },
++ .binning = true,
+ },
+ };
+
+@@ -884,6 +889,35 @@ static int imx219_set_framefmt(struct imx219 *imx219)
+ return -EINVAL;
+ }
+
++static int imx219_set_binning(struct imx219 *imx219)
++{
++ if (!imx219->mode->binning) {
++ return imx219_write_reg(imx219, IMX219_REG_BINNING_MODE,
++ IMX219_REG_VALUE_16BIT,
++ IMX219_BINNING_NONE);
++ }
++
++ switch (imx219->fmt.code) {
++ case MEDIA_BUS_FMT_SRGGB8_1X8:
++ case MEDIA_BUS_FMT_SGRBG8_1X8:
++ case MEDIA_BUS_FMT_SGBRG8_1X8:
++ case MEDIA_BUS_FMT_SBGGR8_1X8:
++ return imx219_write_reg(imx219, IMX219_REG_BINNING_MODE,
++ IMX219_REG_VALUE_16BIT,
++ IMX219_BINNING_2X2_ANALOG);
++
++ case MEDIA_BUS_FMT_SRGGB10_1X10:
++ case MEDIA_BUS_FMT_SGRBG10_1X10:
++ case MEDIA_BUS_FMT_SGBRG10_1X10:
++ case MEDIA_BUS_FMT_SBGGR10_1X10:
++ return imx219_write_reg(imx219, IMX219_REG_BINNING_MODE,
++ IMX219_REG_VALUE_16BIT,
++ IMX219_BINNING_2X2);
++ }
++
++ return -EINVAL;
++}
++
+ static const struct v4l2_rect *
+ __imx219_get_pad_crop(struct imx219 *imx219,
+ struct v4l2_subdev_state *sd_state,
+@@ -968,6 +1002,13 @@ static int imx219_start_streaming(struct imx219 *imx219)
+ goto err_rpm_put;
+ }
+
++ ret = imx219_set_binning(imx219);
++ if (ret) {
++ dev_err(&client->dev, "%s failed to set binning: %d\n",
++ __func__, ret);
++ goto err_rpm_put;
++ }
++
+ /* Apply customized values from user */
+ ret = __v4l2_ctrl_handler_setup(imx219->sd.ctrl_handler);
+ if (ret)
+--
+2.39.2
+
--- /dev/null
+From 1f698a0920a4cc8df2ba30acdc5fe58e15d902d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Dec 2022 13:07:53 +0100
+Subject: media: i2c: imx219: Split common registers from mode tables
+
+From: Adam Ford <aford173@gmail.com>
+
+[ Upstream commit 8508455961d5a9e8907bcfd8dcd58f19d9b6ce47 ]
+
+There are four modes, and each mode has a table of registers.
+Some of the registers are common to all modes, so create new
+tables for these common registers to reduce duplicate code.
+
+Signed-off-by: Adam Ford <aford173@gmail.com>
+Reviewed-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Stable-dep-of: ef86447e775f ("media: i2c: imx219: Fix binning for RAW8 capture")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/imx219.c | 206 +++++++++++--------------------------
+ 1 file changed, 59 insertions(+), 147 deletions(-)
+
+diff --git a/drivers/media/i2c/imx219.c b/drivers/media/i2c/imx219.c
+index 77bd79a5954ed..7f44d62047b67 100644
+--- a/drivers/media/i2c/imx219.c
++++ b/drivers/media/i2c/imx219.c
+@@ -145,23 +145,61 @@ struct imx219_mode {
+ struct imx219_reg_list reg_list;
+ };
+
+-/*
+- * Register sets lifted off the i2C interface from the Raspberry Pi firmware
+- * driver.
+- * 3280x2464 = mode 2, 1920x1080 = mode 1, 1640x1232 = mode 4, 640x480 = mode 7.
+- */
+-static const struct imx219_reg mode_3280x2464_regs[] = {
+- {0x0100, 0x00},
++static const struct imx219_reg imx219_common_regs[] = {
++ {0x0100, 0x00}, /* Mode Select */
++
++ /* To Access Addresses 3000-5fff, send the following commands */
+ {0x30eb, 0x0c},
+ {0x30eb, 0x05},
+ {0x300a, 0xff},
+ {0x300b, 0xff},
+ {0x30eb, 0x05},
+ {0x30eb, 0x09},
+- {0x0114, 0x01},
+- {0x0128, 0x00},
+- {0x012a, 0x18},
++
++ /* PLL Clock Table */
++ {0x0301, 0x05}, /* VTPXCK_DIV */
++ {0x0303, 0x01}, /* VTSYSCK_DIV */
++ {0x0304, 0x03}, /* PREPLLCK_VT_DIV 0x03 = AUTO set */
++ {0x0305, 0x03}, /* PREPLLCK_OP_DIV 0x03 = AUTO set */
++ {0x0306, 0x00}, /* PLL_VT_MPY */
++ {0x0307, 0x39},
++ {0x030b, 0x01}, /* OP_SYS_CLK_DIV */
++ {0x030c, 0x00}, /* PLL_OP_MPY */
++ {0x030d, 0x72},
++
++ /* Undocumented registers */
++ {0x455e, 0x00},
++ {0x471e, 0x4b},
++ {0x4767, 0x0f},
++ {0x4750, 0x14},
++ {0x4540, 0x00},
++ {0x47b4, 0x14},
++ {0x4713, 0x30},
++ {0x478b, 0x10},
++ {0x478f, 0x10},
++ {0x4793, 0x10},
++ {0x4797, 0x0e},
++ {0x479b, 0x0e},
++
++ /* Frame Bank Register Group "A" */
++ {0x0162, 0x0d}, /* Line_Length_A */
++ {0x0163, 0x78},
++ {0x0170, 0x01}, /* X_ODD_INC_A */
++ {0x0171, 0x01}, /* Y_ODD_INC_A */
++
++ /* Output setup registers */
++ {0x0114, 0x01}, /* CSI 2-Lane Mode */
++ {0x0128, 0x00}, /* DPHY Auto Mode */
++ {0x012a, 0x18}, /* EXCK_Freq */
+ {0x012b, 0x00},
++};
++
++/*
++ * Register sets lifted off the i2C interface from the Raspberry Pi firmware
++ * driver.
++ * 3280x2464 = mode 2, 1920x1080 = mode 1, 1640x1232 = mode 4, 640x480 = mode 7.
++ */
++static const struct imx219_reg mode_3280x2464_regs[] = {
+ {0x0164, 0x00},
+ {0x0165, 0x00},
+ {0x0166, 0x0c},
+@@ -174,53 +212,15 @@ static const struct imx219_reg mode_3280x2464_regs[] = {
+ {0x016d, 0xd0},
+ {0x016e, 0x09},
+ {0x016f, 0xa0},
+- {0x0170, 0x01},
+- {0x0171, 0x01},
+- {0x0174, 0x00},
++ {0x0174, 0x00}, /* No-Binning */
+ {0x0175, 0x00},
+- {0x0301, 0x05},
+- {0x0303, 0x01},
+- {0x0304, 0x03},
+- {0x0305, 0x03},
+- {0x0306, 0x00},
+- {0x0307, 0x39},
+- {0x030b, 0x01},
+- {0x030c, 0x00},
+- {0x030d, 0x72},
+ {0x0624, 0x0c},
+ {0x0625, 0xd0},
+ {0x0626, 0x09},
+ {0x0627, 0xa0},
+- {0x455e, 0x00},
+- {0x471e, 0x4b},
+- {0x4767, 0x0f},
+- {0x4750, 0x14},
+- {0x4540, 0x00},
+- {0x47b4, 0x14},
+- {0x4713, 0x30},
+- {0x478b, 0x10},
+- {0x478f, 0x10},
+- {0x4793, 0x10},
+- {0x4797, 0x0e},
+- {0x479b, 0x0e},
+- {0x0162, 0x0d},
+- {0x0163, 0x78},
+ };
+
+ static const struct imx219_reg mode_1920_1080_regs[] = {
+- {0x0100, 0x00},
+- {0x30eb, 0x05},
+- {0x30eb, 0x0c},
+- {0x300a, 0xff},
+- {0x300b, 0xff},
+- {0x30eb, 0x05},
+- {0x30eb, 0x09},
+- {0x0114, 0x01},
+- {0x0128, 0x00},
+- {0x012a, 0x18},
+- {0x012b, 0x00},
+- {0x0162, 0x0d},
+- {0x0163, 0x78},
+ {0x0164, 0x02},
+ {0x0165, 0xa8},
+ {0x0166, 0x0a},
+@@ -233,49 +233,15 @@ static const struct imx219_reg mode_1920_1080_regs[] = {
+ {0x016d, 0x80},
+ {0x016e, 0x04},
+ {0x016f, 0x38},
+- {0x0170, 0x01},
+- {0x0171, 0x01},
+- {0x0174, 0x00},
++ {0x0174, 0x00}, /* No-Binning */
+ {0x0175, 0x00},
+- {0x0301, 0x05},
+- {0x0303, 0x01},
+- {0x0304, 0x03},
+- {0x0305, 0x03},
+- {0x0306, 0x00},
+- {0x0307, 0x39},
+- {0x030b, 0x01},
+- {0x030c, 0x00},
+- {0x030d, 0x72},
+ {0x0624, 0x07},
+ {0x0625, 0x80},
+ {0x0626, 0x04},
+ {0x0627, 0x38},
+- {0x455e, 0x00},
+- {0x471e, 0x4b},
+- {0x4767, 0x0f},
+- {0x4750, 0x14},
+- {0x4540, 0x00},
+- {0x47b4, 0x14},
+- {0x4713, 0x30},
+- {0x478b, 0x10},
+- {0x478f, 0x10},
+- {0x4793, 0x10},
+- {0x4797, 0x0e},
+- {0x479b, 0x0e},
+ };
+
+ static const struct imx219_reg mode_1640_1232_regs[] = {
+- {0x0100, 0x00},
+- {0x30eb, 0x0c},
+- {0x30eb, 0x05},
+- {0x300a, 0xff},
+- {0x300b, 0xff},
+- {0x30eb, 0x05},
+- {0x30eb, 0x09},
+- {0x0114, 0x01},
+- {0x0128, 0x00},
+- {0x012a, 0x18},
+- {0x012b, 0x00},
+ {0x0164, 0x00},
+ {0x0165, 0x00},
+ {0x0166, 0x0c},
+@@ -288,53 +254,15 @@ static const struct imx219_reg mode_1640_1232_regs[] = {
+ {0x016d, 0x68},
+ {0x016e, 0x04},
+ {0x016f, 0xd0},
+- {0x0170, 0x01},
+- {0x0171, 0x01},
+- {0x0174, 0x01},
++ {0x0174, 0x01}, /* x2-Binning */
+ {0x0175, 0x01},
+- {0x0301, 0x05},
+- {0x0303, 0x01},
+- {0x0304, 0x03},
+- {0x0305, 0x03},
+- {0x0306, 0x00},
+- {0x0307, 0x39},
+- {0x030b, 0x01},
+- {0x030c, 0x00},
+- {0x030d, 0x72},
+ {0x0624, 0x06},
+ {0x0625, 0x68},
+ {0x0626, 0x04},
+ {0x0627, 0xd0},
+- {0x455e, 0x00},
+- {0x471e, 0x4b},
+- {0x4767, 0x0f},
+- {0x4750, 0x14},
+- {0x4540, 0x00},
+- {0x47b4, 0x14},
+- {0x4713, 0x30},
+- {0x478b, 0x10},
+- {0x478f, 0x10},
+- {0x4793, 0x10},
+- {0x4797, 0x0e},
+- {0x479b, 0x0e},
+- {0x0162, 0x0d},
+- {0x0163, 0x78},
+ };
+
+ static const struct imx219_reg mode_640_480_regs[] = {
+- {0x0100, 0x00},
+- {0x30eb, 0x05},
+- {0x30eb, 0x0c},
+- {0x300a, 0xff},
+- {0x300b, 0xff},
+- {0x30eb, 0x05},
+- {0x30eb, 0x09},
+- {0x0114, 0x01},
+- {0x0128, 0x00},
+- {0x012a, 0x18},
+- {0x012b, 0x00},
+- {0x0162, 0x0d},
+- {0x0163, 0x78},
+ {0x0164, 0x03},
+ {0x0165, 0xe8},
+ {0x0166, 0x08},
+@@ -347,35 +275,12 @@ static const struct imx219_reg mode_640_480_regs[] = {
+ {0x016d, 0x80},
+ {0x016e, 0x01},
+ {0x016f, 0xe0},
+- {0x0170, 0x01},
+- {0x0171, 0x01},
+- {0x0174, 0x03},
++ {0x0174, 0x03}, /* x2-analog binning */
+ {0x0175, 0x03},
+- {0x0301, 0x05},
+- {0x0303, 0x01},
+- {0x0304, 0x03},
+- {0x0305, 0x03},
+- {0x0306, 0x00},
+- {0x0307, 0x39},
+- {0x030b, 0x01},
+- {0x030c, 0x00},
+- {0x030d, 0x72},
+ {0x0624, 0x06},
+ {0x0625, 0x68},
+ {0x0626, 0x04},
+ {0x0627, 0xd0},
+- {0x455e, 0x00},
+- {0x471e, 0x4b},
+- {0x4767, 0x0f},
+- {0x4750, 0x14},
+- {0x4540, 0x00},
+- {0x47b4, 0x14},
+- {0x4713, 0x30},
+- {0x478b, 0x10},
+- {0x478f, 0x10},
+- {0x4793, 0x10},
+- {0x4797, 0x0e},
+- {0x479b, 0x0e},
+ };
+
+ static const struct imx219_reg raw8_framefmt_regs[] = {
+@@ -1041,6 +946,13 @@ static int imx219_start_streaming(struct imx219 *imx219)
+ if (ret < 0)
+ return ret;
+
++ /* Send all registers that are common to all modes */
++ ret = imx219_write_regs(imx219, imx219_common_regs, ARRAY_SIZE(imx219_common_regs));
++ if (ret) {
++ dev_err(&client->dev, "%s failed to send mfg header\n", __func__);
++ goto err_rpm_put;
++ }
++
+ /* Apply default values of current mode */
+ reg_list = &imx219->mode->reg_list;
+ ret = imx219_write_regs(imx219, reg_list->regs, reg_list->num_of_regs);
+--
+2.39.2
+
--- /dev/null
+From 6a6d687e5a8824612829d78d251af72608ca5fbc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Jan 2023 14:03:51 +0100
+Subject: media: i2c: ov7670: 0 instead of -EINVAL was returned
+
+From: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+
+[ Upstream commit 6a4c664539e6de9b32b65ddcf767ec1bcc1d7f8a ]
+
+If the media bus is unsupported, then return -EINVAL. Instead it
+returned 'ret' which happened to be 0.
+
+This fixes a smatch warning:
+
+ov7670.c:1843 ov7670_parse_dt() warn: missing error code? 'ret'
+
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Fixes: 01b8444828fc ("media: v4l2: i2c: ov7670: Implement OF mbus configuration")
+Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/ov7670.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/i2c/ov7670.c b/drivers/media/i2c/ov7670.c
+index 11d3bef65d43c..6e423cbcdc462 100644
+--- a/drivers/media/i2c/ov7670.c
++++ b/drivers/media/i2c/ov7670.c
+@@ -1840,7 +1840,7 @@ static int ov7670_parse_dt(struct device *dev,
+
+ if (bus_cfg.bus_type != V4L2_MBUS_PARALLEL) {
+ dev_err(dev, "Unsupported media bus type\n");
+- return ret;
++ return -EINVAL;
+ }
+ info->mbus_config = bus_cfg.bus.parallel.flags;
+
+--
+2.39.2
+
--- /dev/null
+From 128e37ff02125528a2a30fcee84b7e5275d41064 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Dec 2022 09:06:25 +0100
+Subject: media: i2c: ov772x: Fix memleak in ov772x_probe()
+
+From: Yuan Can <yuancan@huawei.com>
+
+[ Upstream commit 7485edb2b6ca5960205c0a49bedfd09bba30e521 ]
+
+A memory leak was reported when testing ov772x with bpf mock device:
+
+AssertionError: unreferenced object 0xffff888109afa7a8 (size 8):
+ comm "python3", pid 279, jiffies 4294805921 (age 20.681s)
+ hex dump (first 8 bytes):
+ 80 22 88 15 81 88 ff ff ."......
+ backtrace:
+ [<000000009990b438>] __kmalloc_node+0x44/0x1b0
+ [<000000009e32f7d7>] kvmalloc_node+0x34/0x180
+ [<00000000faf48134>] v4l2_ctrl_handler_init_class+0x11d/0x180 [videodev]
+ [<00000000da376937>] ov772x_probe+0x1c3/0x68c [ov772x]
+ [<000000003f0d225e>] i2c_device_probe+0x28d/0x680
+ [<00000000e0b6db89>] really_probe+0x17c/0x3f0
+ [<000000001b19fcee>] __driver_probe_device+0xe3/0x170
+ [<0000000048370519>] driver_probe_device+0x49/0x120
+ [<000000005ead07a0>] __device_attach_driver+0xf7/0x150
+ [<0000000043f452b8>] bus_for_each_drv+0x114/0x180
+ [<00000000358e5596>] __device_attach+0x1e5/0x2d0
+ [<0000000043f83c5d>] bus_probe_device+0x126/0x140
+ [<00000000ee0f3046>] device_add+0x810/0x1130
+ [<00000000e0278184>] i2c_new_client_device+0x359/0x4f0
+ [<0000000070baf34f>] of_i2c_register_device+0xf1/0x110
+ [<00000000a9f2159d>] of_i2c_notify+0x100/0x160
+unreferenced object 0xffff888119825c00 (size 256):
+ comm "python3", pid 279, jiffies 4294805921 (age 20.681s)
+ hex dump (first 32 bytes):
+ 00 b4 a5 17 81 88 ff ff 00 5e 82 19 81 88 ff ff .........^......
+ 10 5c 82 19 81 88 ff ff 10 5c 82 19 81 88 ff ff .\.......\......
+ backtrace:
+ [<000000009990b438>] __kmalloc_node+0x44/0x1b0
+ [<000000009e32f7d7>] kvmalloc_node+0x34/0x180
+ [<0000000073d88e0b>] v4l2_ctrl_new.cold+0x19b/0x86f [videodev]
+ [<00000000b1f576fb>] v4l2_ctrl_new_std+0x16f/0x210 [videodev]
+ [<00000000caf7ac99>] ov772x_probe+0x1fa/0x68c [ov772x]
+ [<000000003f0d225e>] i2c_device_probe+0x28d/0x680
+ [<00000000e0b6db89>] really_probe+0x17c/0x3f0
+ [<000000001b19fcee>] __driver_probe_device+0xe3/0x170
+ [<0000000048370519>] driver_probe_device+0x49/0x120
+ [<000000005ead07a0>] __device_attach_driver+0xf7/0x150
+ [<0000000043f452b8>] bus_for_each_drv+0x114/0x180
+ [<00000000358e5596>] __device_attach+0x1e5/0x2d0
+ [<0000000043f83c5d>] bus_probe_device+0x126/0x140
+ [<00000000ee0f3046>] device_add+0x810/0x1130
+ [<00000000e0278184>] i2c_new_client_device+0x359/0x4f0
+ [<0000000070baf34f>] of_i2c_register_device+0xf1/0x110
+
+The reason is that if priv->hdl.error is set, ov772x_probe() jumps to the
+error_mutex_destroy without doing v4l2_ctrl_handler_free(), and all
+resources allocated in v4l2_ctrl_handler_init() and v4l2_ctrl_new_std()
+are leaked.
+
+Fixes: 1112babde214 ("media: i2c: Copy ov772x soc_camera sensor driver")
+Signed-off-by: Yuan Can <yuancan@huawei.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/ov772x.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/media/i2c/ov772x.c b/drivers/media/i2c/ov772x.c
+index 4189e3fc3d535..a238e63425f8c 100644
+--- a/drivers/media/i2c/ov772x.c
++++ b/drivers/media/i2c/ov772x.c
+@@ -1462,7 +1462,7 @@ static int ov772x_probe(struct i2c_client *client)
+ priv->subdev.ctrl_handler = &priv->hdl;
+ if (priv->hdl.error) {
+ ret = priv->hdl.error;
+- goto error_mutex_destroy;
++ goto error_ctrl_free;
+ }
+
+ priv->clk = clk_get(&client->dev, NULL);
+@@ -1515,7 +1515,6 @@ static int ov772x_probe(struct i2c_client *client)
+ clk_put(priv->clk);
+ error_ctrl_free:
+ v4l2_ctrl_handler_free(&priv->hdl);
+-error_mutex_destroy:
+ mutex_destroy(&priv->lock);
+
+ return ret;
+--
+2.39.2
+
--- /dev/null
+From c11b817129e67935033c6596bbebcaddf0f9036c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Dec 2022 11:35:44 +0100
+Subject: media: i2c: tc358746: fix ignoring read error in g_register callback
+
+From: Marco Felsch <m.felsch@pengutronix.de>
+
+[ Upstream commit 9d33802c8bcf96c4099ffea4f392afa52897e556 ]
+
+Currently we ignore the return value of tc358746_read() and return
+alawys return 0 which is wrong. Fix this by returning the actual return
+value of the read operation which is either 0 on success or an error
+value.
+
+Addresses-Coverity-ID: 1527254 ("Error handling issues")
+
+Reported-by: coverity-bot <keescook+coverity-bot@chromium.org>
+Fixes: 80a21da36051 ("media: tc358746: add Toshiba TC358746 Parallel to CSI-2 bridge driver")
+Signed-off-by: Marco Felsch <m.felsch@pengutronix.de>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/tc358746.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/i2c/tc358746.c b/drivers/media/i2c/tc358746.c
+index e7f27cbb57907..c5a0df300a06d 100644
+--- a/drivers/media/i2c/tc358746.c
++++ b/drivers/media/i2c/tc358746.c
+@@ -988,6 +988,7 @@ static int __maybe_unused
+ tc358746_g_register(struct v4l2_subdev *sd, struct v4l2_dbg_register *reg)
+ {
+ struct tc358746 *tc358746 = to_tc358746(sd);
++ int err;
+
+ /* 32-bit registers starting from CLW_DPHYCONTTX */
+ reg->size = reg->reg < CLW_DPHYCONTTX_REG ? 2 : 4;
+@@ -995,12 +996,12 @@ tc358746_g_register(struct v4l2_subdev *sd, struct v4l2_dbg_register *reg)
+ if (!pm_runtime_get_if_in_use(sd->dev))
+ return 0;
+
+- tc358746_read(tc358746, reg->reg, (u32 *)®->val);
++ err = tc358746_read(tc358746, reg->reg, (u32 *)®->val);
+
+ pm_runtime_mark_last_busy(sd->dev);
+ pm_runtime_put_sync_autosuspend(sd->dev);
+
+- return 0;
++ return err;
+ }
+
+ static int __maybe_unused
+--
+2.39.2
+
--- /dev/null
+From 89b5556c200a4e49c88cef45ed4ab268c61db263 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Dec 2022 11:35:43 +0100
+Subject: media: i2c: tc358746: fix missing return assignment
+
+From: Marco Felsch <m.felsch@pengutronix.de>
+
+[ Upstream commit 0605081142070a41de8f1deb8fdaeb8677e97741 ]
+
+It was intended to return an error if tc358746_update_bits() call fail.
+Fix this by storing the return code.
+
+Addresses-Coverity-ID: 1527252 ("Control flow issues")
+
+Reported-by: coverity-bot <keescook+coverity-bot@chromium.org>
+Fixes: 80a21da36051 ("media: tc358746: add Toshiba TC358746 Parallel to CSI-2 bridge driver")
+Signed-off-by: Marco Felsch <m.felsch@pengutronix.de>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/tc358746.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/i2c/tc358746.c b/drivers/media/i2c/tc358746.c
+index d1f552bd81d42..e7f27cbb57907 100644
+--- a/drivers/media/i2c/tc358746.c
++++ b/drivers/media/i2c/tc358746.c
+@@ -406,7 +406,7 @@ tc358746_apply_pll_config(struct tc358746 *tc358746)
+
+ val = PLL_FRS(ilog2(post)) | RESETB | PLL_EN;
+ mask = PLL_FRS_MASK | RESETB | PLL_EN;
+- tc358746_update_bits(tc358746, PLLCTL1_REG, mask, val);
++ err = tc358746_update_bits(tc358746, PLLCTL1_REG, mask, val);
+ if (err)
+ return err;
+
+--
+2.39.2
+
--- /dev/null
+From 4658e2f80c9550e0659ac6236399a9908dd50ddf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Dec 2022 11:35:45 +0100
+Subject: media: i2c: tc358746: fix possible endianness issue
+
+From: Marco Felsch <m.felsch@pengutronix.de>
+
+[ Upstream commit 5ad2e46030ad97de7fdbdaf63bb1af45c7caf3dd ]
+
+Using the u64 v4l2_dbg_register.val directly can lead to unexpected
+results depending on machine endianness. Fix this by using a local
+variable which is assigned afterwards. Since tc358746_read() will init
+the val variable to 0 we can assing it without checking the return value
+first.
+
+Addresses-Coverity-ID: 1527256 ("Integer handling issues")
+
+Reported-by: coverity-bot <keescook+coverity-bot@chromium.org>
+Fixes: 80a21da36051 ("media: tc358746: add Toshiba TC358746 Parallel to CSI-2 bridge driver")
+Signed-off-by: Marco Felsch <m.felsch@pengutronix.de>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/tc358746.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/i2c/tc358746.c b/drivers/media/i2c/tc358746.c
+index c5a0df300a06d..4063754a67320 100644
+--- a/drivers/media/i2c/tc358746.c
++++ b/drivers/media/i2c/tc358746.c
+@@ -988,6 +988,7 @@ static int __maybe_unused
+ tc358746_g_register(struct v4l2_subdev *sd, struct v4l2_dbg_register *reg)
+ {
+ struct tc358746 *tc358746 = to_tc358746(sd);
++ u32 val;
+ int err;
+
+ /* 32-bit registers starting from CLW_DPHYCONTTX */
+@@ -996,7 +997,8 @@ tc358746_g_register(struct v4l2_subdev *sd, struct v4l2_dbg_register *reg)
+ if (!pm_runtime_get_if_in_use(sd->dev))
+ return 0;
+
+- err = tc358746_read(tc358746, reg->reg, (u32 *)®->val);
++ err = tc358746_read(tc358746, reg->reg, &val);
++ reg->val = val;
+
+ pm_runtime_mark_last_busy(sd->dev);
+ pm_runtime_put_sync_autosuspend(sd->dev);
+--
+2.39.2
+
--- /dev/null
+From 3825b2e68e7bac8677c4c8bb3fac88c7b99ae704 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Jan 2023 10:39:21 +0100
+Subject: media: imx: imx7-media-csi: fix missing clk_disable_unprepare() in
+ imx7_csi_init()
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit cea606d9e996a77eed57fc60709e0728341450e3 ]
+
+Add missing clk_disable_unprepare(), if imx7_csi_dma_setup() fails
+in imx7_csi_init().
+
+Fixes: ff43ca911978 ("media: imx: imx7-media-csi: Move CSI configuration before source start")
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Reviewed-by: Rui Miguel Silva <rmfrfs@gmail.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/nxp/imx7-media-csi.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/nxp/imx7-media-csi.c b/drivers/media/platform/nxp/imx7-media-csi.c
+index 886374d3a6ff1..1ef92c8c0098c 100644
+--- a/drivers/media/platform/nxp/imx7-media-csi.c
++++ b/drivers/media/platform/nxp/imx7-media-csi.c
+@@ -638,8 +638,10 @@ static int imx7_csi_init(struct imx7_csi *csi)
+ imx7_csi_configure(csi);
+
+ ret = imx7_csi_dma_setup(csi);
+- if (ret < 0)
++ if (ret < 0) {
++ clk_disable_unprepare(csi->mclk);
+ return ret;
++ }
+
+ return 0;
+ }
+--
+2.39.2
+
--- /dev/null
+From 554791ecb84d3ec9c4e8b2e15e0f857c9b56a0d2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Jan 2023 10:47:02 +0100
+Subject: media: imx-jpeg: Apply clk_bulk api instead of operating specific clk
+
+From: Ming Qian <ming.qian@nxp.com>
+
+[ Upstream commit 61fe43dc9f454bc3caa99dbdd8f5fa3ba813981a ]
+
+using the api of clk_bulk can simplify the code.
+and the clock of the jpeg codec may be changed,
+the clk_bulk api can be compatible with the future change.
+
+Fixes: 4c2e5156d9fa ("media: imx-jpeg: Add pm-runtime support for imx-jpeg")
+Signed-off-by: Ming Qian <ming.qian@nxp.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../media/platform/nxp/imx-jpeg/mxc-jpeg.c | 35 +++++--------------
+ .../media/platform/nxp/imx-jpeg/mxc-jpeg.h | 4 +--
+ 2 files changed, 10 insertions(+), 29 deletions(-)
+
+diff --git a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c
+index 6cd015a35f7c4..f085f14d676ad 100644
+--- a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c
++++ b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c
+@@ -2472,19 +2472,12 @@ static int mxc_jpeg_probe(struct platform_device *pdev)
+ jpeg->mode = mode;
+
+ /* Get clocks */
+- jpeg->clk_ipg = devm_clk_get(dev, "ipg");
+- if (IS_ERR(jpeg->clk_ipg)) {
+- dev_err(dev, "failed to get clock: ipg\n");
+- ret = PTR_ERR(jpeg->clk_ipg);
+- goto err_clk;
+- }
+-
+- jpeg->clk_per = devm_clk_get(dev, "per");
+- if (IS_ERR(jpeg->clk_per)) {
+- dev_err(dev, "failed to get clock: per\n");
+- ret = PTR_ERR(jpeg->clk_per);
++ ret = devm_clk_bulk_get_all(&pdev->dev, &jpeg->clks);
++ if (ret < 0) {
++ dev_err(dev, "failed to get clock\n");
+ goto err_clk;
+ }
++ jpeg->num_clks = ret;
+
+ ret = mxc_jpeg_attach_pm_domains(jpeg);
+ if (ret < 0) {
+@@ -2581,32 +2574,20 @@ static int mxc_jpeg_runtime_resume(struct device *dev)
+ struct mxc_jpeg_dev *jpeg = dev_get_drvdata(dev);
+ int ret;
+
+- ret = clk_prepare_enable(jpeg->clk_ipg);
+- if (ret < 0) {
+- dev_err(dev, "failed to enable clock: ipg\n");
+- goto err_ipg;
+- }
+-
+- ret = clk_prepare_enable(jpeg->clk_per);
++ ret = clk_bulk_prepare_enable(jpeg->num_clks, jpeg->clks);
+ if (ret < 0) {
+- dev_err(dev, "failed to enable clock: per\n");
+- goto err_per;
++ dev_err(dev, "failed to enable clock\n");
++ return ret;
+ }
+
+ return 0;
+-
+-err_per:
+- clk_disable_unprepare(jpeg->clk_ipg);
+-err_ipg:
+- return ret;
+ }
+
+ static int mxc_jpeg_runtime_suspend(struct device *dev)
+ {
+ struct mxc_jpeg_dev *jpeg = dev_get_drvdata(dev);
+
+- clk_disable_unprepare(jpeg->clk_ipg);
+- clk_disable_unprepare(jpeg->clk_per);
++ clk_bulk_disable_unprepare(jpeg->num_clks, jpeg->clks);
+
+ return 0;
+ }
+diff --git a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.h b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.h
+index 8fa8c0aec5a2d..87157db780826 100644
+--- a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.h
++++ b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.h
+@@ -120,8 +120,8 @@ struct mxc_jpeg_dev {
+ spinlock_t hw_lock; /* hardware access lock */
+ unsigned int mode;
+ struct mutex lock; /* v4l2 ioctls serialization */
+- struct clk *clk_ipg;
+- struct clk *clk_per;
++ struct clk_bulk_data *clks;
++ int num_clks;
+ struct platform_device *pdev;
+ struct device *dev;
+ void __iomem *base_reg;
+--
+2.39.2
+
--- /dev/null
+From 94ae2b644cba00927916efbd55d2726a3539e4a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Dec 2022 14:05:55 +0100
+Subject: media: max9286: Fix memleak in max9286_v4l2_register()
+
+From: Shang XiaoJing <shangxiaojing@huawei.com>
+
+[ Upstream commit 8636c5fc7658c7c6299fb8b352d24ea4b9ba99e2 ]
+
+There is a kmemleak when testing the media/i2c/max9286.c with bpf mock
+device:
+
+kmemleak: 5 new suspected memory leaks (see /sys/kernel/debug/kmemleak)
+
+unreferenced object 0xffff88810defc400 (size 256):
+ comm "python3", pid 278, jiffies 4294737563 (age 31.978s)
+ hex dump (first 32 bytes):
+ 28 06 a7 0a 81 88 ff ff 00 fe 22 12 81 88 ff ff (.........".....
+ 10 c4 ef 0d 81 88 ff ff 10 c4 ef 0d 81 88 ff ff ................
+ backtrace:
+ [<00000000191de6a7>] __kmalloc_node+0x44/0x1b0
+ [<000000002f4912b7>] kvmalloc_node+0x34/0x180
+ [<0000000057dc4cae>] v4l2_ctrl_new+0x325/0x10f0 [videodev]
+ [<0000000026030272>] v4l2_ctrl_new_std+0x16f/0x210 [videodev]
+ [<00000000f0d9ea2f>] max9286_probe+0x76e/0xbff [max9286]
+ [<00000000ea8f6455>] i2c_device_probe+0x28d/0x680
+ [<0000000087529af3>] really_probe+0x17c/0x3f0
+ [<00000000b08be526>] __driver_probe_device+0xe3/0x170
+ [<000000004382edea>] driver_probe_device+0x49/0x120
+ [<000000007bde528a>] __device_attach_driver+0xf7/0x150
+ [<000000009f9c6ab4>] bus_for_each_drv+0x114/0x180
+ [<00000000c8aaf588>] __device_attach+0x1e5/0x2d0
+ [<0000000041cc06b9>] bus_probe_device+0x126/0x140
+ [<000000002309860d>] device_add+0x810/0x1130
+ [<000000002827bf98>] i2c_new_client_device+0x359/0x4f0
+ [<00000000593bdc85>] of_i2c_register_device+0xf1/0x110
+
+max9286_v4l2_register() calls v4l2_ctrl_new_std(), but won't free the
+created v412_ctrl when fwnode_graph_get_endpoint_by_id() failed, which
+causes the memleak. Call v4l2_ctrl_handler_free() to free the v412_ctrl.
+
+Fixes: 66d8c9d2422d ("media: i2c: Add MAX9286 driver")
+Signed-off-by: Shang XiaoJing <shangxiaojing@huawei.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/max9286.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/media/i2c/max9286.c b/drivers/media/i2c/max9286.c
+index 9c083cf142319..d034a67042e35 100644
+--- a/drivers/media/i2c/max9286.c
++++ b/drivers/media/i2c/max9286.c
+@@ -932,6 +932,7 @@ static int max9286_v4l2_register(struct max9286_priv *priv)
+ err_put_node:
+ fwnode_handle_put(ep);
+ err_async:
++ v4l2_ctrl_handler_free(&priv->ctrls);
+ max9286_v4l2_notifier_unregister(priv);
+
+ return ret;
+--
+2.39.2
+
--- /dev/null
+From e72452b77df9380f8c666b11897d219c486f3fa5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Dec 2022 14:25:04 +0100
+Subject: media: mc: Get media_device directly from pad
+
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+
+[ Upstream commit a967a3a788028f541e4db54beabcebc3648997db ]
+
+Various functions access the media_device from a pad by going through
+the entity the pad belongs to. Remove the level of indirection and get
+the media_device from the pad directly.
+
+Fixes: 9e3576a1ae2b ("media: mc: convert pipeline funcs to take media_pad")
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Reviewed-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/mc/mc-entity.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/media/mc/mc-entity.c b/drivers/media/mc/mc-entity.c
+index b8bcbc734eaf4..f268cf66053e1 100644
+--- a/drivers/media/mc/mc-entity.c
++++ b/drivers/media/mc/mc-entity.c
+@@ -703,7 +703,7 @@ static int media_pipeline_populate(struct media_pipeline *pipe,
+ __must_check int __media_pipeline_start(struct media_pad *pad,
+ struct media_pipeline *pipe)
+ {
+- struct media_device *mdev = pad->entity->graph_obj.mdev;
++ struct media_device *mdev = pad->graph_obj.mdev;
+ struct media_pipeline_pad *err_ppad;
+ struct media_pipeline_pad *ppad;
+ int ret;
+@@ -851,7 +851,7 @@ EXPORT_SYMBOL_GPL(__media_pipeline_start);
+ __must_check int media_pipeline_start(struct media_pad *pad,
+ struct media_pipeline *pipe)
+ {
+- struct media_device *mdev = pad->entity->graph_obj.mdev;
++ struct media_device *mdev = pad->graph_obj.mdev;
+ int ret;
+
+ mutex_lock(&mdev->graph_mutex);
+@@ -888,7 +888,7 @@ EXPORT_SYMBOL_GPL(__media_pipeline_stop);
+
+ void media_pipeline_stop(struct media_pad *pad)
+ {
+- struct media_device *mdev = pad->entity->graph_obj.mdev;
++ struct media_device *mdev = pad->graph_obj.mdev;
+
+ mutex_lock(&mdev->graph_mutex);
+ __media_pipeline_stop(pad);
+@@ -898,7 +898,7 @@ EXPORT_SYMBOL_GPL(media_pipeline_stop);
+
+ __must_check int media_pipeline_alloc_start(struct media_pad *pad)
+ {
+- struct media_device *mdev = pad->entity->graph_obj.mdev;
++ struct media_device *mdev = pad->graph_obj.mdev;
+ struct media_pipeline *new_pipe = NULL;
+ struct media_pipeline *pipe;
+ int ret;
+--
+2.39.2
+
--- /dev/null
+From 08613e7a83494bdf163fa454b12775e49bcbcb7e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Dec 2022 08:59:37 +0100
+Subject: media: ov2740: Fix memleak in ov2740_init_controls()
+
+From: Shang XiaoJing <shangxiaojing@huawei.com>
+
+[ Upstream commit 2d899592ed7829d0d5140853bac4d58742a6b8af ]
+
+There is a kmemleak when testing the media/i2c/ov2740.c with bpf mock
+device:
+
+unreferenced object 0xffff8881090e19e0 (size 16):
+ comm "51-i2c-ov2740", pid 278, jiffies 4294781584 (age 23.613s)
+ hex dump (first 16 bytes):
+ 00 f3 7c 0b 81 88 ff ff 80 75 6a 09 81 88 ff ff ..|......uj.....
+ backtrace:
+ [<000000004e9fad8f>] __kmalloc_node+0x44/0x1b0
+ [<0000000039c802f4>] kvmalloc_node+0x34/0x180
+ [<000000009b8b5c63>] v4l2_ctrl_handler_init_class+0x11d/0x180
+[videodev]
+ [<0000000038644056>] ov2740_probe+0x37d/0x84f [ov2740]
+ [<0000000092489f59>] i2c_device_probe+0x28d/0x680
+ [<000000001038babe>] really_probe+0x17c/0x3f0
+ [<0000000098c7af1c>] __driver_probe_device+0xe3/0x170
+ [<00000000e1b3dc24>] device_driver_attach+0x34/0x80
+ [<000000005a04a34d>] bind_store+0x10b/0x1a0
+ [<00000000ce25d4f2>] drv_attr_store+0x49/0x70
+ [<000000007d9f4e9a>] sysfs_kf_write+0x8c/0xb0
+ [<00000000be6cff0f>] kernfs_fop_write_iter+0x216/0x2e0
+ [<0000000031ddb40a>] vfs_write+0x658/0x810
+ [<0000000041beecdd>] ksys_write+0xd6/0x1b0
+ [<0000000023755840>] do_syscall_64+0x38/0x90
+ [<00000000b2cc2da2>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
+
+ov2740_init_controls() won't clean all the allocated resources in fail
+path, which may causes the memleaks. Add v4l2_ctrl_handler_free() to
+prevent memleak.
+
+Fixes: 866edc895171 ("media: i2c: Add ov2740 image sensor driver")
+Signed-off-by: Shang XiaoJing <shangxiaojing@huawei.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/ov2740.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/i2c/ov2740.c b/drivers/media/i2c/ov2740.c
+index f3731f932a946..89d126240c345 100644
+--- a/drivers/media/i2c/ov2740.c
++++ b/drivers/media/i2c/ov2740.c
+@@ -629,8 +629,10 @@ static int ov2740_init_controls(struct ov2740 *ov2740)
+ V4L2_CID_TEST_PATTERN,
+ ARRAY_SIZE(ov2740_test_pattern_menu) - 1,
+ 0, 0, ov2740_test_pattern_menu);
+- if (ctrl_hdlr->error)
++ if (ctrl_hdlr->error) {
++ v4l2_ctrl_handler_free(ctrl_hdlr);
+ return ctrl_hdlr->error;
++ }
+
+ ov2740->sd.ctrl_handler = ctrl_hdlr;
+
+--
+2.39.2
+
--- /dev/null
+From 6af61702cae6032480572164115c42c31cdcf7f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Jan 2023 13:27:35 +0100
+Subject: media: ov5640: Fix soft reset sequence and timings
+
+From: Jai Luthra <j-luthra@ti.com>
+
+[ Upstream commit decea0a98b7ac04536c7d659f74783e8d67a06c0 ]
+
+Move the register-based reset out of the init_setting[] and into the
+powerup_sequence function. The sensor is power cycled and reset using
+the gpio pins so the soft reset is not always necessary.
+
+This also ensures that soft reset honors the timing sequence
+from the datasheet [1].
+
+[1] https://cdn.sparkfun.com/datasheets/Sensors/LightImaging/OV5640_datasheet.pdf
+
+Fixes: 19a81c1426c1 ("[media] add Omnivision OV5640 sensor driver")
+Reported-by: Nishanth Menon <nm@ti.com>
+Suggested-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
+Signed-off-by: Jai Luthra <j-luthra@ti.com>
+Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonaboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/ov5640.c | 34 ++++++++++++++++++++++++----------
+ 1 file changed, 24 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/media/i2c/ov5640.c b/drivers/media/i2c/ov5640.c
+index e0f908af581b8..75dada60298b5 100644
+--- a/drivers/media/i2c/ov5640.c
++++ b/drivers/media/i2c/ov5640.c
+@@ -50,6 +50,7 @@
+ #define OV5640_REG_SYS_CTRL0 0x3008
+ #define OV5640_REG_SYS_CTRL0_SW_PWDN 0x42
+ #define OV5640_REG_SYS_CTRL0_SW_PWUP 0x02
++#define OV5640_REG_SYS_CTRL0_SW_RST 0x82
+ #define OV5640_REG_CHIP_ID 0x300a
+ #define OV5640_REG_IO_MIPI_CTRL00 0x300e
+ #define OV5640_REG_PAD_OUTPUT_ENABLE01 0x3017
+@@ -532,7 +533,7 @@ static const struct v4l2_mbus_framefmt ov5640_default_fmt = {
+ };
+
+ static const struct reg_value ov5640_init_setting[] = {
+- {0x3103, 0x11, 0, 0}, {0x3008, 0x82, 0, 5}, {0x3008, 0x42, 0, 0},
++ {0x3103, 0x11, 0, 0},
+ {0x3103, 0x03, 0, 0}, {0x3630, 0x36, 0, 0},
+ {0x3631, 0x0e, 0, 0}, {0x3632, 0xe2, 0, 0}, {0x3633, 0x12, 0, 0},
+ {0x3621, 0xe0, 0, 0}, {0x3704, 0xa0, 0, 0}, {0x3703, 0x5a, 0, 0},
+@@ -2429,19 +2430,32 @@ static void ov5640_reset(struct ov5640_dev *sensor)
+ if (!sensor->reset_gpio)
+ return;
+
+- gpiod_set_value_cansleep(sensor->reset_gpio, 0);
++ if (sensor->pwdn_gpio) {
++ gpiod_set_value_cansleep(sensor->reset_gpio, 0);
+
+- /* camera power cycle */
+- ov5640_power(sensor, false);
+- usleep_range(5000, 10000);
+- ov5640_power(sensor, true);
+- usleep_range(5000, 10000);
++ /* camera power cycle */
++ ov5640_power(sensor, false);
++ usleep_range(5000, 10000);
++ ov5640_power(sensor, true);
++ usleep_range(5000, 10000);
+
+- gpiod_set_value_cansleep(sensor->reset_gpio, 1);
+- usleep_range(1000, 2000);
++ gpiod_set_value_cansleep(sensor->reset_gpio, 1);
++ usleep_range(1000, 2000);
+
+- gpiod_set_value_cansleep(sensor->reset_gpio, 0);
++ gpiod_set_value_cansleep(sensor->reset_gpio, 0);
++ } else {
++ /* software reset */
++ ov5640_write_reg(sensor, OV5640_REG_SYS_CTRL0,
++ OV5640_REG_SYS_CTRL0_SW_RST);
++ }
+ usleep_range(20000, 25000);
++
++ /*
++ * software standby: allows registers programming;
++ * exit at restore_mode() for CSI, s_stream(1) for DVP
++ */
++ ov5640_write_reg(sensor, OV5640_REG_SYS_CTRL0,
++ OV5640_REG_SYS_CTRL0_SW_PWDN);
+ }
+
+ static int ov5640_set_power_on(struct ov5640_dev *sensor)
+--
+2.39.2
+
--- /dev/null
+From 55323675cddacbababf3214e28c05af6d5cdc2dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Jan 2023 13:27:36 +0100
+Subject: media: ov5640: Handle delays when no reset_gpio set
+
+From: Jai Luthra <j-luthra@ti.com>
+
+[ Upstream commit d7ff69139908842adf824be4f50c7e9ac5886c04 ]
+
+Some module manufacturers [1][2] don't expose the RESETB and PWDN pins
+of the sensor directly through the 15-pin FFC connector. Instead wiring
+~PWDN gpio to the sensor pins with appropriate delays.
+
+In such cases, reset_gpio will not be available to the driver, but it
+will still be toggled when the sensor is powered on, and thus we should
+still honor the wait time of >= 5ms + 1ms + 20ms (see figure 2-3 in [3])
+before attempting any i/o operations over SCCB.
+
+Also, rename the function to ov5640_powerup_sequence to better match the
+datasheet (section 2.7).
+
+[1] https://digilent.com/reference/_media/reference/add-ons/pcam-5c/pcam_5c_sch.pdf
+[2] https://www.alinx.com/public/upload/file/AN5641_User_Manual.pdf
+[3] https://cdn.sparkfun.com/datasheets/Sensors/LightImaging/OV5640_datasheet.pdf
+
+Fixes: 19a81c1426c1 ("[media] add Omnivision OV5640 sensor driver")
+Reported-by: Nishanth Menon <nm@ti.com>
+Signed-off-by: Jai Luthra <j-luthra@ti.com>
+Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/ov5640.c | 22 ++++++++++++++++------
+ 1 file changed, 16 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/media/i2c/ov5640.c b/drivers/media/i2c/ov5640.c
+index 75dada60298b5..c159f297ab92a 100644
+--- a/drivers/media/i2c/ov5640.c
++++ b/drivers/media/i2c/ov5640.c
+@@ -2425,11 +2425,22 @@ static void ov5640_power(struct ov5640_dev *sensor, bool enable)
+ gpiod_set_value_cansleep(sensor->pwdn_gpio, enable ? 0 : 1);
+ }
+
+-static void ov5640_reset(struct ov5640_dev *sensor)
++/*
++ * From section 2.7 power up sequence:
++ * t0 + t1 + t2 >= 5ms Delay from DOVDD stable to PWDN pull down
++ * t3 >= 1ms Delay from PWDN pull down to RESETB pull up
++ * t4 >= 20ms Delay from RESETB pull up to SCCB (i2c) stable
++ *
++ * Some modules don't expose RESETB/PWDN pins directly, instead providing a
++ * "PWUP" GPIO which is wired through appropriate delays and inverters to the
++ * pins.
++ *
++ * In such cases, this gpio should be mapped to pwdn_gpio in the driver, and we
++ * should still toggle the pwdn_gpio below with the appropriate delays, while
++ * the calls to reset_gpio will be ignored.
++ */
++static void ov5640_powerup_sequence(struct ov5640_dev *sensor)
+ {
+- if (!sensor->reset_gpio)
+- return;
+-
+ if (sensor->pwdn_gpio) {
+ gpiod_set_value_cansleep(sensor->reset_gpio, 0);
+
+@@ -2478,8 +2489,7 @@ static int ov5640_set_power_on(struct ov5640_dev *sensor)
+ goto xclk_off;
+ }
+
+- ov5640_reset(sensor);
+- ov5640_power(sensor, true);
++ ov5640_powerup_sequence(sensor);
+
+ ret = ov5640_init_slave_id(sensor);
+ if (ret)
+--
+2.39.2
+
--- /dev/null
+From 65b0e008f18f068b55e35db3b6f96ec627235568 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Dec 2022 08:59:38 +0100
+Subject: media: ov5675: Fix memleak in ov5675_init_controls()
+
+From: Shang XiaoJing <shangxiaojing@huawei.com>
+
+[ Upstream commit dd74ed6c213003533e3abf4c204374ef01d86978 ]
+
+There is a kmemleak when testing the media/i2c/ov5675.c with bpf mock
+device:
+
+AssertionError: unreferenced object 0xffff888107362160 (size 16):
+ comm "python3", pid 277, jiffies 4294832798 (age 20.722s)
+ hex dump (first 16 bytes):
+ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
+ backtrace:
+ [<00000000abe7d67c>] __kmalloc_node+0x44/0x1b0
+ [<000000008a725aac>] kvmalloc_node+0x34/0x180
+ [<000000009a53cd11>] v4l2_ctrl_handler_init_class+0x11d/0x180
+[videodev]
+ [<0000000055b46db0>] ov5675_probe+0x38b/0x897 [ov5675]
+ [<00000000153d886c>] i2c_device_probe+0x28d/0x680
+ [<000000004afb7e8f>] really_probe+0x17c/0x3f0
+ [<00000000ff2f18e4>] __driver_probe_device+0xe3/0x170
+ [<000000000a001029>] driver_probe_device+0x49/0x120
+ [<00000000e39743c7>] __device_attach_driver+0xf7/0x150
+ [<00000000d32fd070>] bus_for_each_drv+0x114/0x180
+ [<000000009083ac41>] __device_attach+0x1e5/0x2d0
+ [<0000000015b4a830>] bus_probe_device+0x126/0x140
+ [<000000007813deaf>] device_add+0x810/0x1130
+ [<000000007becb867>] i2c_new_client_device+0x386/0x540
+ [<000000007f9cf4b4>] of_i2c_register_device+0xf1/0x110
+ [<00000000ebfdd032>] of_i2c_notify+0xfc/0x1f0
+
+ov5675_init_controls() won't clean all the allocated resources in fail
+path, which may causes the memleaks. Add v4l2_ctrl_handler_free() to
+prevent memleak.
+
+Fixes: bf27502b1f3b ("media: ov5675: Add support for OV5675 sensor")
+Signed-off-by: Shang XiaoJing <shangxiaojing@huawei.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/ov5675.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/i2c/ov5675.c b/drivers/media/i2c/ov5675.c
+index 94dc8cb7a7c00..a6e6b367d1283 100644
+--- a/drivers/media/i2c/ov5675.c
++++ b/drivers/media/i2c/ov5675.c
+@@ -820,8 +820,10 @@ static int ov5675_init_controls(struct ov5675 *ov5675)
+ v4l2_ctrl_new_std(ctrl_hdlr, &ov5675_ctrl_ops,
+ V4L2_CID_VFLIP, 0, 1, 1, 0);
+
+- if (ctrl_hdlr->error)
++ if (ctrl_hdlr->error) {
++ v4l2_ctrl_handler_free(ctrl_hdlr);
+ return ctrl_hdlr->error;
++ }
+
+ ov5675->sd.ctrl_handler = ctrl_hdlr;
+
+--
+2.39.2
+
--- /dev/null
+From cac6934c5e81bc8563f02a80f8e9fe0474277fd2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Dec 2022 17:40:08 +0100
+Subject: media: platform: mtk-mdp3: fix Kconfig dependencies
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit e3f7feb6d89311f369dd4ad903ea62e45328cdbe ]
+
+The new mdp3 driver uses 'select' to force-enable a couple of drivers
+it depends on. This is error-prone and likely to cause dependency
+loops as well as warnings like:
+
+WARNING: unmet direct dependencies detected for VIDEO_MEDIATEK_VPU
+ Depends on [n]: MEDIA_SUPPORT [=m] && MEDIA_PLATFORM_SUPPORT [=y] && MEDIA_PLATFORM_DRIVERS [=y] && V4L_MEM2MEM_DRIVERS [=n] && VIDEO_DEV [=m] && (ARCH_MEDIATEK [=y] || COMPILE_TEST [=y])
+ Selected by [m]:
+ - VIDEO_MEDIATEK_MDP3 [=m] && MEDIA_SUPPORT [=m] && MEDIA_PLATFORM_SUPPORT [=y] && MEDIA_PLATFORM_DRIVERS [=y] && (MTK_IOMMU [=m] || COMPILE_TEST [=y]) && VIDEO_DEV [=m] && (ARCH_MEDIATEK [=y] || COMPILE_TEST [=y]) && HAS_DMA [=y] && REMOTEPROC [=y]
+
+This specific warning was already addressed in a previous patch,
+but there are similar unnecessary 'select' statements, so turn those
+into 'depends on'. This also means the dependency on ARCH_MEDIATEK
+is redundant and can be dropped.
+
+Fixes: 61890ccaefaf ("media: platform: mtk-mdp3: add MediaTek MDP3 driver")
+Fixes: 9195a860ef0a ("media: platform: mtk-mdp3: remove unused VIDEO_MEDIATEK_VPU config")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/mediatek/mdp3/Kconfig | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/media/platform/mediatek/mdp3/Kconfig b/drivers/media/platform/mediatek/mdp3/Kconfig
+index 846e759a8f6a9..602329c447501 100644
+--- a/drivers/media/platform/mediatek/mdp3/Kconfig
++++ b/drivers/media/platform/mediatek/mdp3/Kconfig
+@@ -3,14 +3,13 @@ config VIDEO_MEDIATEK_MDP3
+ tristate "MediaTek MDP v3 driver"
+ depends on MTK_IOMMU || COMPILE_TEST
+ depends on VIDEO_DEV
+- depends on ARCH_MEDIATEK || COMPILE_TEST
+ depends on HAS_DMA
+ depends on REMOTEPROC
++ depends on MTK_MMSYS
++ depends on MTK_CMDQ
++ depends on MTK_SCP
+ select VIDEOBUF2_DMA_CONTIG
+ select V4L2_MEM2MEM_DEV
+- select MTK_MMSYS
+- select MTK_CMDQ
+- select MTK_SCP
+ default n
+ help
+ It is a v4l2 driver and present in MediaTek MT8183 SoC.
+--
+2.39.2
+
--- /dev/null
+From 39f4ddff206836bea87631bbb8e3c7a4667b122a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Dec 2022 11:18:36 +0100
+Subject: media: platform: mtk-mdp3: Fix return value check in mdp_probe()
+
+From: Qiheng Lin <linqiheng@huawei.com>
+
+[ Upstream commit 1963689bed4d500236938d90c91cdd5e63c1eb28 ]
+
+In case of error, the function mtk_mutex_get()
+returns ERR_PTR() and never returns NULL. The NULL test in the
+return value check should be replaced with IS_ERR().
+And also fix the err_free_mutex case.
+
+Fixes: 61890ccaefaf ("media: platform: mtk-mdp3: add MediaTek MDP3 driver")
+Signed-off-by: Qiheng Lin <linqiheng@huawei.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/mediatek/mdp3/mtk-mdp3-core.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/media/platform/mediatek/mdp3/mtk-mdp3-core.c b/drivers/media/platform/mediatek/mdp3/mtk-mdp3-core.c
+index 2d1f6ae9f0802..97edcd9d1c817 100644
+--- a/drivers/media/platform/mediatek/mdp3/mtk-mdp3-core.c
++++ b/drivers/media/platform/mediatek/mdp3/mtk-mdp3-core.c
+@@ -207,8 +207,8 @@ static int mdp_probe(struct platform_device *pdev)
+ }
+ for (i = 0; i < MDP_PIPE_MAX; i++) {
+ mdp->mdp_mutex[i] = mtk_mutex_get(&mm_pdev->dev);
+- if (!mdp->mdp_mutex[i]) {
+- ret = -ENODEV;
++ if (IS_ERR(mdp->mdp_mutex[i])) {
++ ret = PTR_ERR(mdp->mdp_mutex[i]);
+ goto err_free_mutex;
+ }
+ }
+@@ -289,7 +289,8 @@ static int mdp_probe(struct platform_device *pdev)
+ mdp_comp_destroy(mdp);
+ err_free_mutex:
+ for (i = 0; i < MDP_PIPE_MAX; i++)
+- mtk_mutex_put(mdp->mdp_mutex[i]);
++ if (!IS_ERR_OR_NULL(mdp->mdp_mutex[i]))
++ mtk_mutex_put(mdp->mdp_mutex[i]);
+ err_destroy_device:
+ kfree(mdp);
+ err_return:
+--
+2.39.2
+
--- /dev/null
+From f81284ea60249f87196e6971aa8da4b76bb1ea18 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Jan 2023 09:55:37 +0100
+Subject: media: platform: ti: Add missing check for devm_regulator_get
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit da8e05f84a11c3cc3b0ba0a3c62d20e358002d99 ]
+
+Add check for the return value of devm_regulator_get since it may return
+error pointer.
+
+Fixes: 448de7e7850b ("[media] omap3isp: OMAP3 ISP core")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/ti/omap3isp/isp.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/media/platform/ti/omap3isp/isp.c b/drivers/media/platform/ti/omap3isp/isp.c
+index 1d40bb59ff814..e7327e38482de 100644
+--- a/drivers/media/platform/ti/omap3isp/isp.c
++++ b/drivers/media/platform/ti/omap3isp/isp.c
+@@ -2307,7 +2307,16 @@ static int isp_probe(struct platform_device *pdev)
+
+ /* Regulators */
+ isp->isp_csiphy1.vdd = devm_regulator_get(&pdev->dev, "vdd-csiphy1");
++ if (IS_ERR(isp->isp_csiphy1.vdd)) {
++ ret = PTR_ERR(isp->isp_csiphy1.vdd);
++ goto error;
++ }
++
+ isp->isp_csiphy2.vdd = devm_regulator_get(&pdev->dev, "vdd-csiphy2");
++ if (IS_ERR(isp->isp_csiphy2.vdd)) {
++ ret = PTR_ERR(isp->isp_csiphy2.vdd);
++ goto error;
++ }
+
+ /* Clocks
+ *
+--
+2.39.2
+
--- /dev/null
+From c4d473dfa1f8fd5fa2a64d6b05c92e07f26c5cc7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Jan 2023 08:55:33 +0100
+Subject: media: rc: Fix use-after-free bugs caused by ene_tx_irqsim()
+
+From: Duoming Zhou <duoming@zju.edu.cn>
+
+[ Upstream commit 29b0589a865b6f66d141d79b2dd1373e4e50fe17 ]
+
+When the ene device is detaching, function ene_remove() will
+be called. But there is no function to cancel tx_sim_timer
+in ene_remove(), the timer handler ene_tx_irqsim() could race
+with ene_remove(). As a result, the UAF bugs could happen,
+the process is shown below.
+
+ (cleanup routine) | (timer routine)
+ | mod_timer(&dev->tx_sim_timer, ..)
+ene_remove() | (wait a time)
+ | ene_tx_irqsim()
+ | dev->hw_lock //USE
+ | ene_tx_sample(dev) //USE
+
+Fix by adding del_timer_sync(&dev->tx_sim_timer) in ene_remove(),
+The tx_sim_timer could stop before ene device is deallocated.
+
+What's more, The rc_unregister_device() and del_timer_sync()
+should be called first in ene_remove() and the deallocated
+functions such as free_irq(), release_region() and so on
+should be called behind them. Because the rc_unregister_device()
+is well synchronized. Otherwise, race conditions may happen. The
+situations that may lead to race conditions are shown below.
+
+Firstly, the rx receiver is disabled with ene_rx_disable()
+before rc_unregister_device() in ene_remove(), which means it
+can be enabled again if a process opens /dev/lirc0 between
+ene_rx_disable() and rc_unregister_device().
+
+Secondly, the irqaction descriptor is freed by free_irq()
+before the rc device is unregistered, which means irqaction
+descriptor may be accessed again after it is deallocated.
+
+Thirdly, the timer can call ene_tx_sample() that can write
+to the io ports, which means the io ports could be accessed
+again after they are deallocated by release_region().
+
+Therefore, the rc_unregister_device() and del_timer_sync()
+should be called first in ene_remove().
+
+Suggested by: Sean Young <sean@mess.org>
+
+Fixes: 9ea53b74df9c ("V4L/DVB: STAGING: remove lirc_ene0100 driver")
+Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/rc/ene_ir.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/rc/ene_ir.c b/drivers/media/rc/ene_ir.c
+index e09270916fbca..11ee21a7db8f0 100644
+--- a/drivers/media/rc/ene_ir.c
++++ b/drivers/media/rc/ene_ir.c
+@@ -1106,6 +1106,8 @@ static void ene_remove(struct pnp_dev *pnp_dev)
+ struct ene_device *dev = pnp_get_drvdata(pnp_dev);
+ unsigned long flags;
+
++ rc_unregister_device(dev->rdev);
++ del_timer_sync(&dev->tx_sim_timer);
+ spin_lock_irqsave(&dev->hw_lock, flags);
+ ene_rx_disable(dev);
+ ene_rx_restore_hw_buffer(dev);
+@@ -1113,7 +1115,6 @@ static void ene_remove(struct pnp_dev *pnp_dev)
+
+ free_irq(dev->irq, dev);
+ release_region(dev->hw_io, ENE_IO_SIZE);
+- rc_unregister_device(dev->rdev);
+ kfree(dev);
+ }
+
+--
+2.39.2
+
--- /dev/null
+From c84b749b4eaa039a55db76ba367ae0366aea515f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Jan 2023 12:00:59 +0100
+Subject: media: saa7134: Use video_unregister_device for radio_dev
+
+From: Tasos Sahanidis <tasos@tasossah.com>
+
+[ Upstream commit bc7635c6435c77a0c168e2cc6535740adfaff4e4 ]
+
+The radio device doesn't use vb2, thus calling vb2_video_unregister_device()
+which results in the following warning being printed on module unload.
+
+WARNING: CPU: 1 PID: 215963 at drivers/media/common/videobuf2/videobuf2-v4l2.c:1236 vb2_video_unregister_device+0xc6/0xe0 [videobuf2_v4l2]
+
+Fixes: 11788d9b7e91 ("media: media/pci: use vb2_video_unregister_device()")
+Signed-off-by: Tasos Sahanidis <tasos@tasossah.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/saa7134/saa7134-core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/pci/saa7134/saa7134-core.c b/drivers/media/pci/saa7134/saa7134-core.c
+index 96328b0af1641..cf2871306987c 100644
+--- a/drivers/media/pci/saa7134/saa7134-core.c
++++ b/drivers/media/pci/saa7134/saa7134-core.c
+@@ -978,7 +978,7 @@ static void saa7134_unregister_video(struct saa7134_dev *dev)
+ }
+ if (dev->radio_dev) {
+ if (video_is_registered(dev->radio_dev))
+- vb2_video_unregister_device(dev->radio_dev);
++ video_unregister_device(dev->radio_dev);
+ else
+ video_device_release(dev->radio_dev);
+ dev->radio_dev = NULL;
+--
+2.39.2
+
--- /dev/null
+From 71993c082cb7409b4721eeacf91ea51c0eb8fe61 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Nov 2022 12:01:59 +0100
+Subject: media: ti: cal: fix possible memory leak in cal_ctx_create()
+
+From: Gaosheng Cui <cuigaosheng1@huawei.com>
+
+[ Upstream commit 7acd650a0484d92985a0d6d867d980c6dd019885 ]
+
+The memory of ctx is allocated in cal_ctx_create(), but it will
+not be freed when cal_ctx_v4l2_init() fails, so add kfree() when
+cal_ctx_v4l2_init() fails to fix it.
+
+Fixes: d68a94e98a89 ("media: ti-vpe: cal: Split video device initialization and registration")
+Signed-off-by: Gaosheng Cui <cuigaosheng1@huawei.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/ti/cal/cal.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/ti/cal/cal.c b/drivers/media/platform/ti/cal/cal.c
+index 56b61c0583cf8..1236215ec70eb 100644
+--- a/drivers/media/platform/ti/cal/cal.c
++++ b/drivers/media/platform/ti/cal/cal.c
+@@ -1050,8 +1050,10 @@ static struct cal_ctx *cal_ctx_create(struct cal_dev *cal, int inst)
+ ctx->cport = inst;
+
+ ret = cal_ctx_v4l2_init(ctx);
+- if (ret)
++ if (ret) {
++ kfree(ctx);
+ return NULL;
++ }
+
+ return ctx;
+ }
+--
+2.39.2
+
--- /dev/null
+From 0c2b46b0e275c18437bc617b317e1a90b634c953 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Jan 2023 03:04:38 +0100
+Subject: media: usb: siano: Fix use after free bugs caused by do_submit_urb
+
+From: Duoming Zhou <duoming@zju.edu.cn>
+
+[ Upstream commit ebad8e731c1c06adf04621d6fd327b860c0861b5 ]
+
+There are UAF bugs caused by do_submit_urb(). One of the KASan reports
+is shown below:
+
+[ 36.403605] BUG: KASAN: use-after-free in worker_thread+0x4a2/0x890
+[ 36.406105] Read of size 8 at addr ffff8880059600e8 by task kworker/0:2/49
+[ 36.408316]
+[ 36.408867] CPU: 0 PID: 49 Comm: kworker/0:2 Not tainted 6.2.0-rc3-15798-g5a41237ad1d4-dir8
+[ 36.411696] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g15584
+[ 36.416157] Workqueue: 0x0 (events)
+[ 36.417654] Call Trace:
+[ 36.418546] <TASK>
+[ 36.419320] dump_stack_lvl+0x96/0xd0
+[ 36.420522] print_address_description+0x75/0x350
+[ 36.421992] print_report+0x11b/0x250
+[ 36.423174] ? _raw_spin_lock_irqsave+0x87/0xd0
+[ 36.424806] ? __virt_addr_valid+0xcf/0x170
+[ 36.426069] ? worker_thread+0x4a2/0x890
+[ 36.427355] kasan_report+0x131/0x160
+[ 36.428556] ? worker_thread+0x4a2/0x890
+[ 36.430053] worker_thread+0x4a2/0x890
+[ 36.431297] ? worker_clr_flags+0x90/0x90
+[ 36.432479] kthread+0x166/0x190
+[ 36.433493] ? kthread_blkcg+0x50/0x50
+[ 36.434669] ret_from_fork+0x22/0x30
+[ 36.435923] </TASK>
+[ 36.436684]
+[ 36.437215] Allocated by task 24:
+[ 36.438289] kasan_set_track+0x50/0x80
+[ 36.439436] __kasan_kmalloc+0x89/0xa0
+[ 36.440566] smsusb_probe+0x374/0xc90
+[ 36.441920] usb_probe_interface+0x2d1/0x4c0
+[ 36.443253] really_probe+0x1d5/0x580
+[ 36.444539] __driver_probe_device+0xe3/0x130
+[ 36.446085] driver_probe_device+0x49/0x220
+[ 36.447423] __device_attach_driver+0x19e/0x1b0
+[ 36.448931] bus_for_each_drv+0xcb/0x110
+[ 36.450217] __device_attach+0x132/0x1f0
+[ 36.451470] bus_probe_device+0x59/0xf0
+[ 36.452563] device_add+0x4ec/0x7b0
+[ 36.453830] usb_set_configuration+0xc63/0xe10
+[ 36.455230] usb_generic_driver_probe+0x3b/0x80
+[ 36.456166] printk: console [ttyGS0] disabled
+[ 36.456569] usb_probe_device+0x90/0x110
+[ 36.459523] really_probe+0x1d5/0x580
+[ 36.461027] __driver_probe_device+0xe3/0x130
+[ 36.462465] driver_probe_device+0x49/0x220
+[ 36.463847] __device_attach_driver+0x19e/0x1b0
+[ 36.465229] bus_for_each_drv+0xcb/0x110
+[ 36.466466] __device_attach+0x132/0x1f0
+[ 36.467799] bus_probe_device+0x59/0xf0
+[ 36.469010] device_add+0x4ec/0x7b0
+[ 36.470125] usb_new_device+0x863/0xa00
+[ 36.471374] hub_event+0x18c7/0x2220
+[ 36.472746] process_one_work+0x34c/0x5b0
+[ 36.474041] worker_thread+0x4b7/0x890
+[ 36.475216] kthread+0x166/0x190
+[ 36.476267] ret_from_fork+0x22/0x30
+[ 36.477447]
+[ 36.478160] Freed by task 24:
+[ 36.479239] kasan_set_track+0x50/0x80
+[ 36.480512] kasan_save_free_info+0x2b/0x40
+[ 36.481808] ____kasan_slab_free+0x122/0x1a0
+[ 36.483173] __kmem_cache_free+0xc4/0x200
+[ 36.484563] smsusb_term_device+0xcd/0xf0
+[ 36.485896] smsusb_probe+0xc85/0xc90
+[ 36.486976] usb_probe_interface+0x2d1/0x4c0
+[ 36.488303] really_probe+0x1d5/0x580
+[ 36.489498] __driver_probe_device+0xe3/0x130
+[ 36.491140] driver_probe_device+0x49/0x220
+[ 36.492475] __device_attach_driver+0x19e/0x1b0
+[ 36.493988] bus_for_each_drv+0xcb/0x110
+[ 36.495171] __device_attach+0x132/0x1f0
+[ 36.496617] bus_probe_device+0x59/0xf0
+[ 36.497875] device_add+0x4ec/0x7b0
+[ 36.498972] usb_set_configuration+0xc63/0xe10
+[ 36.500264] usb_generic_driver_probe+0x3b/0x80
+[ 36.501740] usb_probe_device+0x90/0x110
+[ 36.503084] really_probe+0x1d5/0x580
+[ 36.504241] __driver_probe_device+0xe3/0x130
+[ 36.505548] driver_probe_device+0x49/0x220
+[ 36.506766] __device_attach_driver+0x19e/0x1b0
+[ 36.508368] bus_for_each_drv+0xcb/0x110
+[ 36.509646] __device_attach+0x132/0x1f0
+[ 36.510911] bus_probe_device+0x59/0xf0
+[ 36.512103] device_add+0x4ec/0x7b0
+[ 36.513215] usb_new_device+0x863/0xa00
+[ 36.514736] hub_event+0x18c7/0x2220
+[ 36.516130] process_one_work+0x34c/0x5b0
+[ 36.517396] worker_thread+0x4b7/0x890
+[ 36.518591] kthread+0x166/0x190
+[ 36.519599] ret_from_fork+0x22/0x30
+[ 36.520851]
+[ 36.521405] Last potentially related work creation:
+[ 36.523143] kasan_save_stack+0x3f/0x60
+[ 36.524275] kasan_record_aux_stack_noalloc+0x9d/0xb0
+[ 36.525831] insert_work+0x25/0x130
+[ 36.527039] __queue_work+0x4d4/0x620
+[ 36.528236] queue_work_on+0x72/0xb0
+[ 36.529344] __usb_hcd_giveback_urb+0x13f/0x1b0
+[ 36.530819] dummy_timer+0x350/0x1a40
+[ 36.532149] call_timer_fn+0x2c/0x190
+[ 36.533567] expire_timers+0x69/0x1f0
+[ 36.534736] __run_timers+0x289/0x2d0
+[ 36.535841] run_timer_softirq+0x2d/0x60
+[ 36.537110] __do_softirq+0x116/0x380
+[ 36.538377]
+[ 36.538950] Second to last potentially related work creation:
+[ 36.540855] kasan_save_stack+0x3f/0x60
+[ 36.542084] kasan_record_aux_stack_noalloc+0x9d/0xb0
+[ 36.543592] insert_work+0x25/0x130
+[ 36.544891] __queue_work+0x4d4/0x620
+[ 36.546168] queue_work_on+0x72/0xb0
+[ 36.547328] __usb_hcd_giveback_urb+0x13f/0x1b0
+[ 36.548805] dummy_timer+0x350/0x1a40
+[ 36.550116] call_timer_fn+0x2c/0x190
+[ 36.551570] expire_timers+0x69/0x1f0
+[ 36.552762] __run_timers+0x289/0x2d0
+[ 36.553916] run_timer_softirq+0x2d/0x60
+[ 36.555118] __do_softirq+0x116/0x380
+[ 36.556239]
+[ 36.556807] The buggy address belongs to the object at ffff888005960000
+[ 36.556807] which belongs to the cache kmalloc-4k of size 4096
+[ 36.560652] The buggy address is located 232 bytes inside of
+[ 36.560652] 4096-byte region [ffff888005960000, ffff888005961000)
+[ 36.564791]
+[ 36.565355] The buggy address belongs to the physical page:
+[ 36.567212] page:000000004f0a0731 refcount:1 mapcount:0 mapping:0000000000000000 index:0x00
+[ 36.570534] head:000000004f0a0731 order:3 compound_mapcount:0 subpages_mapcount:0 compound0
+[ 36.573717] flags: 0x100000000010200(slab|head|node=0|zone=1)
+[ 36.575481] raw: 0100000000010200 ffff888001042140 dead000000000122 0000000000000000
+[ 36.577842] raw: 0000000000000000 0000000000040004 00000001ffffffff 0000000000000000
+[ 36.580175] page dumped because: kasan: bad access detected
+[ 36.581994]
+[ 36.582548] Memory state around the buggy address:
+[ 36.583983] ffff88800595ff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
+[ 36.586240] ffff888005960000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+[ 36.588884] >ffff888005960080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+[ 36.591071] ^
+[ 36.593295] ffff888005960100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+[ 36.595705] ffff888005960180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+[ 36.598026] ==================================================================
+[ 36.600224] Disabling lock debugging due to kernel taint
+[ 36.602681] general protection fault, probably for non-canonical address 0x43600a000000060I
+[ 36.607129] CPU: 0 PID: 49 Comm: kworker/0:2 Tainted: G B 6.2.0-rc3-15798-8
+[ 36.611115] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g15584
+[ 36.615026] Workqueue: events do_submit_urb
+[ 36.616290] RIP: 0010:_raw_spin_lock_irqsave+0x8a/0xd0
+[ 36.618107] Code: 24 00 00 00 00 48 89 df be 04 00 00 00 e8 9e b5 c6 fe 48 89 ef be 04 00 5
+[ 36.623522] RSP: 0018:ffff888004b6fcf0 EFLAGS: 00010046
+[ 36.625072] RAX: 0000000000000000 RBX: 043600a000000060 RCX: ffffffff9fc0e0d7
+[ 36.627206] RDX: 0000000000000000 RSI: dffffc0000000000 RDI: ffff888004b6fcf0
+[ 36.629813] RBP: ffff888004b6fcf0 R08: dffffc0000000000 R09: ffffed100096df9f
+[ 36.631974] R10: dfffe9100096dfa0 R11: 1ffff1100096df9e R12: ffff888005960020
+[ 36.634285] R13: ffff8880059600f0 R14: 0000000000000246 R15: 0000000000000001
+[ 36.636438] FS: 0000000000000000(0000) GS:ffff88806d600000(0000) knlGS:0000000000000000
+[ 36.639092] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 36.640951] CR2: 00007f07476819a3 CR3: 0000000004a34000 CR4: 00000000000006f0
+[ 36.643411] Call Trace:
+[ 36.644215] <TASK>
+[ 36.644902] smscore_getbuffer+0x3e/0x1e0
+[ 36.646147] do_submit_urb+0x4f/0x190
+[ 36.647449] process_one_work+0x34c/0x5b0
+[ 36.648777] worker_thread+0x4b7/0x890
+[ 36.649984] ? worker_clr_flags+0x90/0x90
+[ 36.651166] kthread+0x166/0x190
+[ 36.652151] ? kthread_blkcg+0x50/0x50
+[ 36.653547] ret_from_fork+0x22/0x30
+[ 36.655051] </TASK>
+[ 36.655733] Modules linked in:
+[ 36.656787] ---[ end trace 0000000000000000 ]---
+[ 36.658328] RIP: 0010:_raw_spin_lock_irqsave+0x8a/0xd0
+[ 36.660045] Code: 24 00 00 00 00 48 89 df be 04 00 00 00 e8 9e b5 c6 fe 48 89 ef be 04 00 5
+[ 36.665730] RSP: 0018:ffff888004b6fcf0 EFLAGS: 00010046
+[ 36.667448] RAX: 0000000000000000 RBX: 043600a000000060 RCX: ffffffff9fc0e0d7
+[ 36.669675] RDX: 0000000000000000 RSI: dffffc0000000000 RDI: ffff888004b6fcf0
+[ 36.672645] RBP: ffff888004b6fcf0 R08: dffffc0000000000 R09: ffffed100096df9f
+[ 36.674921] R10: dfffe9100096dfa0 R11: 1ffff1100096df9e R12: ffff888005960020
+[ 36.677034] R13: ffff8880059600f0 R14: 0000000000000246 R15: 0000000000000001
+[ 36.679184] FS: 0000000000000000(0000) GS:ffff88806d600000(0000) knlGS:0000000000000000
+[ 36.681655] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 36.683383] CR2: 00007f07476819a3 CR3: 0000000004a34000 CR4: 00000000000006f0
+[ 36.685733] Kernel panic - not syncing: Fatal exception
+[ 36.688585] Kernel Offset: 0x1d400000 from 0xffffffff81000000 (relocation range: 0xfffffff)
+[ 36.692199] ---[ end Kernel panic - not syncing: Fatal exception ]---
+
+When the siano device is plugged in, it may call the following functions
+to initialize the device.
+
+smsusb_probe()-->smsusb_init_device()-->smscore_start_device().
+
+When smscore_start_device() gets failed, the function smsusb_term_device()
+will be called and smsusb_device_t will be deallocated. Although we use
+usb_kill_urb() in smsusb_stop_streaming() to cancel transfer requests
+and wait for them to finish, the worker threads that are scheduled by
+smsusb_onresponse() may be still running. As a result, the UAF bugs
+could happen.
+
+We add cancel_work_sync() in smsusb_stop_streaming() in order that the
+worker threads could finish before the smsusb_device_t is deallocated.
+
+Fixes: dd47fbd40e6e ("[media] smsusb: don't sleep while atomic")
+Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/siano/smsusb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/media/usb/siano/smsusb.c b/drivers/media/usb/siano/smsusb.c
+index fe9c7b3a950e8..6f443c542c6da 100644
+--- a/drivers/media/usb/siano/smsusb.c
++++ b/drivers/media/usb/siano/smsusb.c
+@@ -179,6 +179,7 @@ static void smsusb_stop_streaming(struct smsusb_device_t *dev)
+
+ for (i = 0; i < MAX_URBS; i++) {
+ usb_kill_urb(&dev->surbs[i].urb);
++ cancel_work_sync(&dev->surbs[i].wq);
+
+ if (dev->surbs[i].cb) {
+ smscore_putbuffer(dev->coredev, dev->surbs[i].cb);
+--
+2.39.2
+
--- /dev/null
+From d13ad44e5f0184b86fc5e9bb7c55e0c8d60b51ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Jan 2023 15:36:19 +0100
+Subject: media: uvcvideo: Check for INACTIVE in uvc_ctrl_is_accessible()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+
+[ Upstream commit 9f582f0418ed1c18f92c9e4628075d6ec9a7d9fb ]
+
+Check for inactive controls in uvc_ctrl_is_accessible().
+
+Use the new value for the master_id controls if present, otherwise
+use the existing value to determine if it is OK to set the control.
+Doing this here avoids attempting to set an inactive control, which
+will return an error from the USB device, which returns an invalid
+errorcode.
+
+This fixes:
+ warn: v4l2-test-controls.cpp(483): s_ctrl returned EIO
+Â warn: v4l2-test-controls.cpp(483): s_ctrl returned EIO
+test VIDIOC_G/S_CTRL: OK
+Â warn: v4l2-test-controls.cpp(739): s_ext_ctrls returned EIO
+Â warn: v4l2-test-controls.cpp(739): s_ext_ctrls returned EIO
+Â warn: v4l2-test-controls.cpp(816): s_ext_ctrls returned EIO
+test VIDIOC_G/S/TRY_EXT_CTRLS: OK
+
+Tested with:
+v4l2-ctl -c auto_exposure=1
+OK
+v4l2-ctl -c exposure_time_absolute=251
+OK
+v4l2-ctl -c auto_exposure=3
+OK
+v4l2-ctl -c exposure_time_absolute=251
+VIDIOC_S_EXT_CTRLS: failed: Input/output error
+exposure_time_absolute: Input/output error
+ERROR
+v4l2-ctl -c auto_exposure=3,exposure_time_absolute=251,auto_exposure=1
+v4l2-ctl -C auto_exposure,exposure_time_absolute Â
+auto_exposure: 1
+exposure_time_absolute: 251
+
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Reviewed-by: Ricardo Ribalda <ribalda@chromium.org>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/uvc/uvc_ctrl.c | 42 +++++++++++++++++++++++++++++++-
+ drivers/media/usb/uvc/uvc_v4l2.c | 3 +--
+ drivers/media/usb/uvc/uvcvideo.h | 3 ++-
+ 3 files changed, 44 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c
+index c95a2229f4fa9..6f5aaaf09ee01 100644
+--- a/drivers/media/usb/uvc/uvc_ctrl.c
++++ b/drivers/media/usb/uvc/uvc_ctrl.c
+@@ -1085,11 +1085,28 @@ static int uvc_query_v4l2_class(struct uvc_video_chain *chain, u32 req_id,
+ return 0;
+ }
+
++/*
++ * Check if control @v4l2_id can be accessed by the given control @ioctl
++ * (VIDIOC_G_EXT_CTRLS, VIDIOC_TRY_EXT_CTRLS or VIDIOC_S_EXT_CTRLS).
++ *
++ * For set operations on slave controls, check if the master's value is set to
++ * manual, either in the others controls set in the same ioctl call, or from
++ * the master's current value. This catches VIDIOC_S_EXT_CTRLS calls that set
++ * both the master and slave control, such as for instance setting
++ * auto_exposure=1, exposure_time_absolute=251.
++ */
+ int uvc_ctrl_is_accessible(struct uvc_video_chain *chain, u32 v4l2_id,
+- bool read)
++ const struct v4l2_ext_controls *ctrls,
++ unsigned long ioctl)
+ {
++ struct uvc_control_mapping *master_map = NULL;
++ struct uvc_control *master_ctrl = NULL;
+ struct uvc_control_mapping *mapping;
+ struct uvc_control *ctrl;
++ bool read = ioctl == VIDIOC_G_EXT_CTRLS;
++ s32 val;
++ int ret;
++ int i;
+
+ if (__uvc_query_v4l2_class(chain, v4l2_id, 0) >= 0)
+ return -EACCES;
+@@ -1104,6 +1121,29 @@ int uvc_ctrl_is_accessible(struct uvc_video_chain *chain, u32 v4l2_id,
+ if (!(ctrl->info.flags & UVC_CTRL_FLAG_SET_CUR) && !read)
+ return -EACCES;
+
++ if (ioctl != VIDIOC_S_EXT_CTRLS || !mapping->master_id)
++ return 0;
++
++ /*
++ * Iterate backwards in cases where the master control is accessed
++ * multiple times in the same ioctl. We want the last value.
++ */
++ for (i = ctrls->count - 1; i >= 0; i--) {
++ if (ctrls->controls[i].id == mapping->master_id)
++ return ctrls->controls[i].value ==
++ mapping->master_manual ? 0 : -EACCES;
++ }
++
++ __uvc_find_control(ctrl->entity, mapping->master_id, &master_map,
++ &master_ctrl, 0);
++
++ if (!master_ctrl || !(master_ctrl->info.flags & UVC_CTRL_FLAG_GET_CUR))
++ return 0;
++
++ ret = __uvc_ctrl_get(chain, master_ctrl, master_map, &val);
++ if (ret >= 0 && val != mapping->master_manual)
++ return -EACCES;
++
+ return 0;
+ }
+
+diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c
+index f4d4c33b6dfbd..3edb54c086b24 100644
+--- a/drivers/media/usb/uvc/uvc_v4l2.c
++++ b/drivers/media/usb/uvc/uvc_v4l2.c
+@@ -1020,8 +1020,7 @@ static int uvc_ctrl_check_access(struct uvc_video_chain *chain,
+ int ret = 0;
+
+ for (i = 0; i < ctrls->count; ++ctrl, ++i) {
+- ret = uvc_ctrl_is_accessible(chain, ctrl->id,
+- ioctl == VIDIOC_G_EXT_CTRLS);
++ ret = uvc_ctrl_is_accessible(chain, ctrl->id, ctrls, ioctl);
+ if (ret)
+ break;
+ }
+diff --git a/drivers/media/usb/uvc/uvcvideo.h b/drivers/media/usb/uvc/uvcvideo.h
+index df93db259312e..a151f583cd156 100644
+--- a/drivers/media/usb/uvc/uvcvideo.h
++++ b/drivers/media/usb/uvc/uvcvideo.h
+@@ -761,7 +761,8 @@ static inline int uvc_ctrl_rollback(struct uvc_fh *handle)
+ int uvc_ctrl_get(struct uvc_video_chain *chain, struct v4l2_ext_control *xctrl);
+ int uvc_ctrl_set(struct uvc_fh *handle, struct v4l2_ext_control *xctrl);
+ int uvc_ctrl_is_accessible(struct uvc_video_chain *chain, u32 v4l2_id,
+- bool read);
++ const struct v4l2_ext_controls *ctrls,
++ unsigned long ioctl);
+
+ int uvc_xu_ctrl_query(struct uvc_video_chain *chain,
+ struct uvc_xu_control_query *xqry);
+--
+2.39.2
+
--- /dev/null
+From 6c2133e195a33904e5b6e08d9c1ef2e5ada792b3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Jan 2023 14:52:54 +0100
+Subject: media: uvcvideo: Implement mask for V4L2_CTRL_TYPE_MENU
+
+From: Ricardo Ribalda <ribalda@chromium.org>
+
+[ Upstream commit 40140eda661ea4be219ef194a4f43b7b5e3bbd27 ]
+
+Replace the count with a mask field that lets us choose not only the max
+value, but also the minimum value and what values are valid in between.
+
+Suggested-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Stable-dep-of: 3aa8628eb78a ("media: uvcvideo: Refactor power_line_frequency_controls_limited")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/uvc/uvc_ctrl.c | 33 +++++++++++++++++++++---------
+ drivers/media/usb/uvc/uvc_driver.c | 4 +++-
+ drivers/media/usb/uvc/uvc_v4l2.c | 3 ++-
+ drivers/media/usb/uvc/uvcvideo.h | 2 +-
+ 4 files changed, 29 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c
+index 6f5aaaf09ee01..32c182987d52c 100644
+--- a/drivers/media/usb/uvc/uvc_ctrl.c
++++ b/drivers/media/usb/uvc/uvc_ctrl.c
+@@ -6,6 +6,7 @@
+ * Laurent Pinchart (laurent.pinchart@ideasonboard.com)
+ */
+
++#include <linux/bitops.h>
+ #include <linux/kernel.h>
+ #include <linux/list.h>
+ #include <linux/module.h>
+@@ -525,7 +526,8 @@ static const struct uvc_control_mapping uvc_ctrl_mappings[] = {
+ .v4l2_type = V4L2_CTRL_TYPE_MENU,
+ .data_type = UVC_CTRL_DATA_TYPE_BITMASK,
+ .menu_info = exposure_auto_controls,
+- .menu_count = ARRAY_SIZE(exposure_auto_controls),
++ .menu_mask = GENMASK(V4L2_EXPOSURE_APERTURE_PRIORITY,
++ V4L2_EXPOSURE_AUTO),
+ .slave_ids = { V4L2_CID_EXPOSURE_ABSOLUTE, },
+ },
+ {
+@@ -731,7 +733,8 @@ static const struct uvc_control_mapping uvc_ctrl_mappings_uvc11[] = {
+ .v4l2_type = V4L2_CTRL_TYPE_MENU,
+ .data_type = UVC_CTRL_DATA_TYPE_ENUM,
+ .menu_info = power_line_frequency_controls,
+- .menu_count = ARRAY_SIZE(power_line_frequency_controls) - 1,
++ .menu_mask = GENMASK(V4L2_CID_POWER_LINE_FREQUENCY_60HZ,
++ V4L2_CID_POWER_LINE_FREQUENCY_DISABLED),
+ },
+ };
+
+@@ -745,7 +748,8 @@ static const struct uvc_control_mapping uvc_ctrl_mappings_uvc15[] = {
+ .v4l2_type = V4L2_CTRL_TYPE_MENU,
+ .data_type = UVC_CTRL_DATA_TYPE_ENUM,
+ .menu_info = power_line_frequency_controls,
+- .menu_count = ARRAY_SIZE(power_line_frequency_controls),
++ .menu_mask = GENMASK(V4L2_CID_POWER_LINE_FREQUENCY_AUTO,
++ V4L2_CID_POWER_LINE_FREQUENCY_DISABLED),
+ },
+ };
+
+@@ -975,7 +979,9 @@ static s32 __uvc_ctrl_get_value(struct uvc_control_mapping *mapping,
+ const struct uvc_menu_info *menu = mapping->menu_info;
+ unsigned int i;
+
+- for (i = 0; i < mapping->menu_count; ++i, ++menu) {
++ for (i = 0; BIT(i) <= mapping->menu_mask; ++i, ++menu) {
++ if (!test_bit(i, &mapping->menu_mask))
++ continue;
+ if (menu->value == value) {
+ value = i;
+ break;
+@@ -1209,12 +1215,14 @@ static int __uvc_query_v4l2_ctrl(struct uvc_video_chain *chain,
+
+ switch (mapping->v4l2_type) {
+ case V4L2_CTRL_TYPE_MENU:
+- v4l2_ctrl->minimum = 0;
+- v4l2_ctrl->maximum = mapping->menu_count - 1;
++ v4l2_ctrl->minimum = ffs(mapping->menu_mask) - 1;
++ v4l2_ctrl->maximum = fls(mapping->menu_mask) - 1;
+ v4l2_ctrl->step = 1;
+
+ menu = mapping->menu_info;
+- for (i = 0; i < mapping->menu_count; ++i, ++menu) {
++ for (i = 0; BIT(i) <= mapping->menu_mask; ++i, ++menu) {
++ if (!test_bit(i, &mapping->menu_mask))
++ continue;
+ if (menu->value == v4l2_ctrl->default_value) {
+ v4l2_ctrl->default_value = i;
+ break;
+@@ -1329,7 +1337,7 @@ int uvc_query_v4l2_menu(struct uvc_video_chain *chain,
+ goto done;
+ }
+
+- if (query_menu->index >= mapping->menu_count) {
++ if (!test_bit(query_menu->index, &mapping->menu_mask)) {
+ ret = -EINVAL;
+ goto done;
+ }
+@@ -1837,8 +1845,13 @@ int uvc_ctrl_set(struct uvc_fh *handle,
+ break;
+
+ case V4L2_CTRL_TYPE_MENU:
+- if (xctrl->value < 0 || xctrl->value >= mapping->menu_count)
++ if (xctrl->value < (ffs(mapping->menu_mask) - 1) ||
++ xctrl->value > (fls(mapping->menu_mask) - 1))
+ return -ERANGE;
++
++ if (!test_bit(xctrl->value, &mapping->menu_mask))
++ return -EINVAL;
++
+ value = mapping->menu_info[xctrl->value].value;
+
+ /*
+@@ -2277,7 +2290,7 @@ static int __uvc_ctrl_add_mapping(struct uvc_video_chain *chain,
+
+ INIT_LIST_HEAD(&map->ev_subs);
+
+- size = sizeof(*mapping->menu_info) * mapping->menu_count;
++ size = sizeof(*mapping->menu_info) * fls(mapping->menu_mask);
+ map->menu_info = kmemdup(mapping->menu_info, size, GFP_KERNEL);
+ if (map->menu_info == NULL) {
+ kfree(map->name);
+diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c
+index e4bcb50113607..1c8d936ef4799 100644
+--- a/drivers/media/usb/uvc/uvc_driver.c
++++ b/drivers/media/usb/uvc/uvc_driver.c
+@@ -7,6 +7,7 @@
+ */
+
+ #include <linux/atomic.h>
++#include <linux/bits.h>
+ #include <linux/gpio/consumer.h>
+ #include <linux/kernel.h>
+ #include <linux/list.h>
+@@ -2384,7 +2385,8 @@ static const struct uvc_control_mapping uvc_ctrl_power_line_mapping_limited = {
+ .v4l2_type = V4L2_CTRL_TYPE_MENU,
+ .data_type = UVC_CTRL_DATA_TYPE_ENUM,
+ .menu_info = power_line_frequency_controls_limited,
+- .menu_count = ARRAY_SIZE(power_line_frequency_controls_limited),
++ .menu_mask =
++ GENMASK(ARRAY_SIZE(power_line_frequency_controls_limited) - 1, 0),
+ };
+
+ static const struct uvc_device_info uvc_ctrl_power_line_limited = {
+diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c
+index 3edb54c086b24..0774a11360c03 100644
+--- a/drivers/media/usb/uvc/uvc_v4l2.c
++++ b/drivers/media/usb/uvc/uvc_v4l2.c
+@@ -6,6 +6,7 @@
+ * Laurent Pinchart (laurent.pinchart@ideasonboard.com)
+ */
+
++#include <linux/bits.h>
+ #include <linux/compat.h>
+ #include <linux/kernel.h>
+ #include <linux/list.h>
+@@ -80,7 +81,7 @@ static int uvc_ioctl_ctrl_map(struct uvc_video_chain *chain,
+ goto free_map;
+ }
+
+- map->menu_count = xmap->menu_count;
++ map->menu_mask = GENMASK(xmap->menu_count - 1, 0);
+ break;
+
+ default:
+diff --git a/drivers/media/usb/uvc/uvcvideo.h b/drivers/media/usb/uvc/uvcvideo.h
+index a151f583cd156..f75e5864bbf72 100644
+--- a/drivers/media/usb/uvc/uvcvideo.h
++++ b/drivers/media/usb/uvc/uvcvideo.h
+@@ -117,7 +117,7 @@ struct uvc_control_mapping {
+ u32 data_type;
+
+ const struct uvc_menu_info *menu_info;
+- u32 menu_count;
++ unsigned long menu_mask;
+
+ u32 master_id;
+ s32 master_manual;
+--
+2.39.2
+
--- /dev/null
+From 1fdf546de137b0aecea106d62825b15f7c4ed274 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Jan 2023 14:52:56 +0100
+Subject: media: uvcvideo: Refactor power_line_frequency_controls_limited
+
+From: Ricardo Ribalda <ribalda@chromium.org>
+
+[ Upstream commit 3aa8628eb78a63d0bf93e159846e9c92bccc8f69 ]
+
+Move the control mapping to uvc_ctrl.c. This way we do not have
+references to UVC controls or V4L2 controls in uvc_driver.c.
+
+This also fixes a bug introduced in commit 382075604a68 ("media:
+uvcvideo: Limit power line control for Quanta UVC Webcam"). The
+offending commit caused the power line control menu entries to have
+incorrect indices compared to the V4L2_CID_POWER_LINE_FREQUENCY_*
+enumeration. Now that the limited mapping reuses the correct menu_info
+array, the indices correctly map to the V4L2 control specification.
+
+Fixes: 382075604a68 ("media: uvcvideo: Limit power line control for Quanta UVC Webcam")
+Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/uvc/uvc_ctrl.c | 13 +++++++++++++
+ drivers/media/usb/uvc/uvc_driver.c | 18 ------------------
+ drivers/media/usb/uvc/uvcvideo.h | 1 +
+ 3 files changed, 14 insertions(+), 18 deletions(-)
+
+diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c
+index 3c46c33b9e571..44b0cfb8ee1c7 100644
+--- a/drivers/media/usb/uvc/uvc_ctrl.c
++++ b/drivers/media/usb/uvc/uvc_ctrl.c
+@@ -723,6 +723,19 @@ static const struct uvc_control_mapping uvc_ctrl_mappings[] = {
+ },
+ };
+
++const struct uvc_control_mapping uvc_ctrl_power_line_mapping_limited = {
++ .id = V4L2_CID_POWER_LINE_FREQUENCY,
++ .entity = UVC_GUID_UVC_PROCESSING,
++ .selector = UVC_PU_POWER_LINE_FREQUENCY_CONTROL,
++ .size = 2,
++ .offset = 0,
++ .v4l2_type = V4L2_CTRL_TYPE_MENU,
++ .data_type = UVC_CTRL_DATA_TYPE_ENUM,
++ .menu_info = power_line_frequency_controls,
++ .menu_mask = GENMASK(V4L2_CID_POWER_LINE_FREQUENCY_60HZ,
++ V4L2_CID_POWER_LINE_FREQUENCY_50HZ),
++};
++
+ static const struct uvc_control_mapping uvc_ctrl_power_line_mapping_uvc11 = {
+ .id = V4L2_CID_POWER_LINE_FREQUENCY,
+ .entity = UVC_GUID_UVC_PROCESSING,
+diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c
+index 1c8d936ef4799..d5ff8df20f18a 100644
+--- a/drivers/media/usb/uvc/uvc_driver.c
++++ b/drivers/media/usb/uvc/uvc_driver.c
+@@ -2371,24 +2371,6 @@ MODULE_PARM_DESC(timeout, "Streaming control requests timeout");
+ * Driver initialization and cleanup
+ */
+
+-static const struct uvc_menu_info power_line_frequency_controls_limited[] = {
+- { 1, "50 Hz" },
+- { 2, "60 Hz" },
+-};
+-
+-static const struct uvc_control_mapping uvc_ctrl_power_line_mapping_limited = {
+- .id = V4L2_CID_POWER_LINE_FREQUENCY,
+- .entity = UVC_GUID_UVC_PROCESSING,
+- .selector = UVC_PU_POWER_LINE_FREQUENCY_CONTROL,
+- .size = 2,
+- .offset = 0,
+- .v4l2_type = V4L2_CTRL_TYPE_MENU,
+- .data_type = UVC_CTRL_DATA_TYPE_ENUM,
+- .menu_info = power_line_frequency_controls_limited,
+- .menu_mask =
+- GENMASK(ARRAY_SIZE(power_line_frequency_controls_limited) - 1, 0),
+-};
+-
+ static const struct uvc_device_info uvc_ctrl_power_line_limited = {
+ .mappings = (const struct uvc_control_mapping *[]) {
+ &uvc_ctrl_power_line_mapping_limited,
+diff --git a/drivers/media/usb/uvc/uvcvideo.h b/drivers/media/usb/uvc/uvcvideo.h
+index f75e5864bbf72..1227ae63f85b7 100644
+--- a/drivers/media/usb/uvc/uvcvideo.h
++++ b/drivers/media/usb/uvc/uvcvideo.h
+@@ -728,6 +728,7 @@ int uvc_status_start(struct uvc_device *dev, gfp_t flags);
+ void uvc_status_stop(struct uvc_device *dev);
+
+ /* Controls */
++extern const struct uvc_control_mapping uvc_ctrl_power_line_mapping_limited;
+ extern const struct v4l2_subscribed_event_ops uvc_ctrl_sub_ev_ops;
+
+ int uvc_query_v4l2_ctrl(struct uvc_video_chain *chain,
+--
+2.39.2
+
--- /dev/null
+From 769659f0e34e774f6a4318ce44e45eab38bd59f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Jan 2023 14:52:55 +0100
+Subject: media: uvcvideo: Refactor uvc_ctrl_mappings_uvcXX
+
+From: Ricardo Ribalda <ribalda@chromium.org>
+
+[ Upstream commit 96a160b068e09b4ed5a32e2179e5219fc3545eca ]
+
+Convert the array of structs into an array of pointers, that way the
+mappings can be reused.
+
+Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Stable-dep-of: 3aa8628eb78a ("media: uvcvideo: Refactor power_line_frequency_controls_limited")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/uvc/uvc_ctrl.c | 74 ++++++++++++++++----------------
+ 1 file changed, 37 insertions(+), 37 deletions(-)
+
+diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c
+index 32c182987d52c..3c46c33b9e571 100644
+--- a/drivers/media/usb/uvc/uvc_ctrl.c
++++ b/drivers/media/usb/uvc/uvc_ctrl.c
+@@ -723,34 +723,40 @@ static const struct uvc_control_mapping uvc_ctrl_mappings[] = {
+ },
+ };
+
+-static const struct uvc_control_mapping uvc_ctrl_mappings_uvc11[] = {
+- {
+- .id = V4L2_CID_POWER_LINE_FREQUENCY,
+- .entity = UVC_GUID_UVC_PROCESSING,
+- .selector = UVC_PU_POWER_LINE_FREQUENCY_CONTROL,
+- .size = 2,
+- .offset = 0,
+- .v4l2_type = V4L2_CTRL_TYPE_MENU,
+- .data_type = UVC_CTRL_DATA_TYPE_ENUM,
+- .menu_info = power_line_frequency_controls,
+- .menu_mask = GENMASK(V4L2_CID_POWER_LINE_FREQUENCY_60HZ,
+- V4L2_CID_POWER_LINE_FREQUENCY_DISABLED),
+- },
++static const struct uvc_control_mapping uvc_ctrl_power_line_mapping_uvc11 = {
++ .id = V4L2_CID_POWER_LINE_FREQUENCY,
++ .entity = UVC_GUID_UVC_PROCESSING,
++ .selector = UVC_PU_POWER_LINE_FREQUENCY_CONTROL,
++ .size = 2,
++ .offset = 0,
++ .v4l2_type = V4L2_CTRL_TYPE_MENU,
++ .data_type = UVC_CTRL_DATA_TYPE_ENUM,
++ .menu_info = power_line_frequency_controls,
++ .menu_mask = GENMASK(V4L2_CID_POWER_LINE_FREQUENCY_60HZ,
++ V4L2_CID_POWER_LINE_FREQUENCY_DISABLED),
+ };
+
+-static const struct uvc_control_mapping uvc_ctrl_mappings_uvc15[] = {
+- {
+- .id = V4L2_CID_POWER_LINE_FREQUENCY,
+- .entity = UVC_GUID_UVC_PROCESSING,
+- .selector = UVC_PU_POWER_LINE_FREQUENCY_CONTROL,
+- .size = 2,
+- .offset = 0,
+- .v4l2_type = V4L2_CTRL_TYPE_MENU,
+- .data_type = UVC_CTRL_DATA_TYPE_ENUM,
+- .menu_info = power_line_frequency_controls,
+- .menu_mask = GENMASK(V4L2_CID_POWER_LINE_FREQUENCY_AUTO,
+- V4L2_CID_POWER_LINE_FREQUENCY_DISABLED),
+- },
++static const struct uvc_control_mapping *uvc_ctrl_mappings_uvc11[] = {
++ &uvc_ctrl_power_line_mapping_uvc11,
++ NULL, /* Sentinel */
++};
++
++static const struct uvc_control_mapping uvc_ctrl_power_line_mapping_uvc15 = {
++ .id = V4L2_CID_POWER_LINE_FREQUENCY,
++ .entity = UVC_GUID_UVC_PROCESSING,
++ .selector = UVC_PU_POWER_LINE_FREQUENCY_CONTROL,
++ .size = 2,
++ .offset = 0,
++ .v4l2_type = V4L2_CTRL_TYPE_MENU,
++ .data_type = UVC_CTRL_DATA_TYPE_ENUM,
++ .menu_info = power_line_frequency_controls,
++ .menu_mask = GENMASK(V4L2_CID_POWER_LINE_FREQUENCY_AUTO,
++ V4L2_CID_POWER_LINE_FREQUENCY_DISABLED),
++};
++
++static const struct uvc_control_mapping *uvc_ctrl_mappings_uvc15[] = {
++ &uvc_ctrl_power_line_mapping_uvc15,
++ NULL, /* Sentinel */
+ };
+
+ /* ------------------------------------------------------------------------
+@@ -2474,8 +2480,7 @@ static void uvc_ctrl_prune_entity(struct uvc_device *dev,
+ static void uvc_ctrl_init_ctrl(struct uvc_video_chain *chain,
+ struct uvc_control *ctrl)
+ {
+- const struct uvc_control_mapping *mappings;
+- unsigned int num_mappings;
++ const struct uvc_control_mapping **mappings;
+ unsigned int i;
+
+ /*
+@@ -2542,16 +2547,11 @@ static void uvc_ctrl_init_ctrl(struct uvc_video_chain *chain,
+ }
+
+ /* Finally process version-specific mappings. */
+- if (chain->dev->uvc_version < 0x0150) {
+- mappings = uvc_ctrl_mappings_uvc11;
+- num_mappings = ARRAY_SIZE(uvc_ctrl_mappings_uvc11);
+- } else {
+- mappings = uvc_ctrl_mappings_uvc15;
+- num_mappings = ARRAY_SIZE(uvc_ctrl_mappings_uvc15);
+- }
++ mappings = chain->dev->uvc_version < 0x0150
++ ? uvc_ctrl_mappings_uvc11 : uvc_ctrl_mappings_uvc15;
+
+- for (i = 0; i < num_mappings; ++i) {
+- const struct uvc_control_mapping *mapping = &mappings[i];
++ for (i = 0; mappings[i]; ++i) {
++ const struct uvc_control_mapping *mapping = mappings[i];
+
+ if (uvc_entity_match_guid(ctrl->entity, mapping->entity) &&
+ ctrl->info.selector == mapping->selector)
+--
+2.39.2
+
--- /dev/null
+From 361c5555678f24aa16c70c20f43b7300c6651fac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Dec 2022 09:30:33 +0100
+Subject: media: v4l2-jpeg: correct the skip count in jpeg_parse_app14_data
+
+From: Ming Qian <ming.qian@nxp.com>
+
+[ Upstream commit 41959c4f973b837a12061b84d3a436fc64c73a30 ]
+
+The curr pointer has advanced 14 bytes in jpeg_parse_app14_data.
+1. jpeg_get_word_be(stream), it goes forward 2 bytes.
+2. jpeg_skip(stream, 11), it goes forward 11 bytes.
+3. jpeg_get_byte(stream), it goes forward 1 bytes.
+
+so the remain bytes of this segment should be (lp - 2 - 11 - 1),
+but not (lp - 2 - 11).
+
+if driver skip 1 extra bytes, the following parsing may go wrong.
+
+Fixes: b8035f7988a8 ("media: Add parsing for APP14 data segment in jpeg helpers")
+Signed-off-by: Ming Qian <ming.qian@nxp.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/v4l2-core/v4l2-jpeg.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/v4l2-core/v4l2-jpeg.c b/drivers/media/v4l2-core/v4l2-jpeg.c
+index c2513b775f6a7..75c2af763d55e 100644
+--- a/drivers/media/v4l2-core/v4l2-jpeg.c
++++ b/drivers/media/v4l2-core/v4l2-jpeg.c
+@@ -474,7 +474,7 @@ static int jpeg_parse_app14_data(struct jpeg_stream *stream,
+ *tf = ret;
+
+ /* skip the rest of the segment, this ensures at least it is complete */
+- skip = lp - 2 - 11;
++ skip = lp - 2 - 11 - 1;
+ return jpeg_skip(stream, skip);
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 7cfa3abb7bd53d3946a77e5a1be9adecf262c294 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Dec 2022 10:08:44 +0100
+Subject: media: v4l2-jpeg: ignore the unknown APP14 marker
+
+From: Ming Qian <ming.qian@nxp.com>
+
+[ Upstream commit 251c0ea6efd3c3ea0f8a55fdd96c749a98639bd3 ]
+
+The legal identifier of APP14 is "Adobe\0",
+but sometimes it may be
+"This is an unknown APP marker . Compliant decoders must ignore it."
+In this case, just ignore it.
+It won't affect the decode result.
+
+Fixes: b8035f7988a8 ("media: Add parsing for APP14 data segment in jpeg helpers")
+Signed-off-by: Ming Qian <ming.qian@nxp.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/v4l2-core/v4l2-jpeg.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/v4l2-core/v4l2-jpeg.c b/drivers/media/v4l2-core/v4l2-jpeg.c
+index 75c2af763d55e..94435a7b68169 100644
+--- a/drivers/media/v4l2-core/v4l2-jpeg.c
++++ b/drivers/media/v4l2-core/v4l2-jpeg.c
+@@ -460,7 +460,7 @@ static int jpeg_parse_app14_data(struct jpeg_stream *stream,
+ /* Check for "Adobe\0" in Ap1..6 */
+ if (stream->curr + 6 > stream->end ||
+ strncmp(stream->curr, "Adobe\0", 6))
+- return -EINVAL;
++ return jpeg_skip(stream, lp - 2);
+
+ /* get to Ap12 */
+ ret = jpeg_skip(stream, 11);
+--
+2.39.2
+
--- /dev/null
+From 125cd54d1ce1fb0e8950726ef8cbd3fda7a0c70b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Dec 2022 18:05:58 +0200
+Subject: mei: pxp: Use correct macros to initialize uuid_le
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 503b676dde2780330c90a10b37a844686601a784 ]
+
+GUID_INIT() is for internal guid_t type and shouldn't be used
+for the uuid_le. I.o.w. relying on the implementation details
+is layering violation. Use correct macros to initialize uuid_le.
+
+Fixes: c2004ce99ed7 ("mei: pxp: export pavp client to me client bus")
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Acked-by: Tomas Winkler <tomas.winkler@intel.com>
+Link: https://lore.kernel.org/r/20221228160558.21311-1-andriy.shevchenko@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/mei/pxp/mei_pxp.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/misc/mei/pxp/mei_pxp.c b/drivers/misc/mei/pxp/mei_pxp.c
+index 8dd09b1722ebd..7ee1fa7b1cb31 100644
+--- a/drivers/misc/mei/pxp/mei_pxp.c
++++ b/drivers/misc/mei/pxp/mei_pxp.c
+@@ -238,8 +238,8 @@ static void mei_pxp_remove(struct mei_cl_device *cldev)
+ }
+
+ /* fbf6fcf1-96cf-4e2e-a6a6-1bab8cbe36b1 : PAVP GUID*/
+-#define MEI_GUID_PXP GUID_INIT(0xfbf6fcf1, 0x96cf, 0x4e2e, 0xA6, \
+- 0xa6, 0x1b, 0xab, 0x8c, 0xbe, 0x36, 0xb1)
++#define MEI_GUID_PXP UUID_LE(0xfbf6fcf1, 0x96cf, 0x4e2e, 0xA6, \
++ 0xa6, 0x1b, 0xab, 0x8c, 0xbe, 0x36, 0xb1)
+
+ static struct mei_cl_device_id mei_pxp_tbl[] = {
+ { .uuid = MEI_GUID_PXP, .version = MEI_CL_VERSION_ANY },
+--
+2.39.2
+
--- /dev/null
+From 54a98f1df9a8ee54f959628652085384911a602e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Nov 2022 17:25:41 -0800
+Subject: mfd: cs5535: Don't build on UML
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 5ec32a3e4053c1a726b45381d56aa9e39eaf3911 ]
+
+The cs5535-mfd driver uses CPU-specific data that is not available
+for ARCH=um builds, so don't allow it to be built for UML.
+
+Prevents these build errors:
+
+In file included from ../arch/x86/include/asm/olpc.h:7,
+ from ../drivers/mfd/cs5535-mfd.c:17:
+../arch/x86/include/asm/geode.h: In function ‘is_geode_gx’:
+../arch/x86/include/asm/geode.h:16:31: error: ‘struct cpuinfo_um’ has no member named ‘x86_vendor’
+ 16 | return ((boot_cpu_data.x86_vendor == X86_VENDOR_NSC) &&
+../arch/x86/include/asm/geode.h:16:46: error: ‘X86_VENDOR_NSC’ undeclared (first use in this function); did you mean ‘X86_VENDOR_ANY’?
+ 16 | return ((boot_cpu_data.x86_vendor == X86_VENDOR_NSC) &&
+../arch/x86/include/asm/geode.h:17:31: error: ‘struct cpuinfo_um’ has no member named ‘x86’
+ 17 | (boot_cpu_data.x86 == 5) &&
+../arch/x86/include/asm/geode.h:18:31: error: ‘struct cpuinfo_um’ has no member named ‘x86_model’
+ 18 | (boot_cpu_data.x86_model == 5));
+../arch/x86/include/asm/geode.h: In function ‘is_geode_lx’:
+../arch/x86/include/asm/geode.h:23:31: error: ‘struct cpuinfo_um’ has no member named ‘x86_vendor’
+ 23 | return ((boot_cpu_data.x86_vendor == X86_VENDOR_AMD) &&
+../arch/x86/include/asm/geode.h:23:46: error: ‘X86_VENDOR_AMD’ undeclared (first use in this function); did you mean ‘X86_VENDOR_ANY’?
+ 23 | return ((boot_cpu_data.x86_vendor == X86_VENDOR_AMD) &&
+../arch/x86/include/asm/geode.h:24:31: error: ‘struct cpuinfo_um’ has no member named ‘x86’
+ 24 | (boot_cpu_data.x86 == 5) &&
+../arch/x86/include/asm/geode.h:25:31: error: ‘struct cpuinfo_um’ has no member named ‘x86_model’
+ 25 | (boot_cpu_data.x86_model == 10));
+
+Fixes: 68f5d3f3b654 ("um: add PCI over virtio emulation driver")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Signed-off-by: Lee Jones <lee@kernel.org>
+Link: https://lore.kernel.org/r/20221201012541.11809-1-rdunlap@infradead.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/mfd/Kconfig b/drivers/mfd/Kconfig
+index 30db49f318668..7ed31fbd8c7fa 100644
+--- a/drivers/mfd/Kconfig
++++ b/drivers/mfd/Kconfig
+@@ -15,6 +15,7 @@ config MFD_CS5535
+ tristate "AMD CS5535 and CS5536 southbridge core functions"
+ select MFD_CORE
+ depends on PCI && (X86_32 || (X86 && COMPILE_TEST))
++ depends on !UML
+ help
+ This is the core driver for CS5535/CS5536 MFD functions. This is
+ necessary for using the board's GPIO and MFGPT functionality.
+--
+2.39.2
+
--- /dev/null
+From 41b184fab97efbb9934076792389031569958b57 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Dec 2022 14:15:55 +0800
+Subject: mfd: pcf50633-adc: Fix potential memleak in pcf50633_adc_async_read()
+
+From: Qiheng Lin <linqiheng@huawei.com>
+
+[ Upstream commit 8b450dcff23aa254844492831a8e2b508a9d522d ]
+
+`req` is allocated in pcf50633_adc_async_read(), but
+adc_enqueue_request() could fail to insert the `req` into queue.
+We need to check the return value and free it in the case of failure.
+
+Fixes: 08c3e06a5eb2 ("mfd: PCF50633 adc driver")
+Signed-off-by: Qiheng Lin <linqiheng@huawei.com>
+Signed-off-by: Lee Jones <lee@kernel.org>
+Link: https://lore.kernel.org/r/20221208061555.8776-1-linqiheng@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/pcf50633-adc.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/mfd/pcf50633-adc.c b/drivers/mfd/pcf50633-adc.c
+index 5cd653e615125..191b1bc6141c2 100644
+--- a/drivers/mfd/pcf50633-adc.c
++++ b/drivers/mfd/pcf50633-adc.c
+@@ -136,6 +136,7 @@ int pcf50633_adc_async_read(struct pcf50633 *pcf, int mux, int avg,
+ void *callback_param)
+ {
+ struct pcf50633_adc_request *req;
++ int ret;
+
+ /* req is freed when the result is ready, in interrupt handler */
+ req = kmalloc(sizeof(*req), GFP_KERNEL);
+@@ -147,7 +148,11 @@ int pcf50633_adc_async_read(struct pcf50633 *pcf, int mux, int avg,
+ req->callback = callback;
+ req->callback_param = callback_param;
+
+- return adc_enqueue_request(pcf, req);
++ ret = adc_enqueue_request(pcf, req);
++ if (ret)
++ kfree(req);
++
++ return ret;
+ }
+ EXPORT_SYMBOL_GPL(pcf50633_adc_async_read);
+
+--
+2.39.2
+
--- /dev/null
+From 71fa5c1c5dcace67ee7a4c953ef045fd759e4bc2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Jan 2023 22:11:47 +1100
+Subject: mfd: rk808: Re-add rk808-clkout to RK818
+
+From: Tom Fitzhenry <tom@tom-fitzhenry.me.uk>
+
+[ Upstream commit 5d69b181cd0db10dc8327d28ce837b3623cd531a ]
+
+Fixes RK818 (e.g. on Pinephone Pro) to register its clock, without which
+dependent devices (e.g. wifi/BT, via sdio-wifi-pwrseq) fail to probe.
+
+This line was removed in commit 3633daacea2e
+("mfd: rk808: Permit having multiple PMIC instances"), but only from RK818.
+
+Fixes: 3633daacea2e ("mfd: rk808: Permit having multiple PMIC instances")
+Signed-off-by: Tom Fitzhenry <tom@tom-fitzhenry.me.uk>
+Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
+Acked-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Lee Jones <lee@kernel.org>
+Link: https://lore.kernel.org/r/20230102111147.2580861-1-tom@tom-fitzhenry.me.uk
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/rk808.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/mfd/rk808.c b/drivers/mfd/rk808.c
+index f44fc3f080a8e..0f22ef61e8170 100644
+--- a/drivers/mfd/rk808.c
++++ b/drivers/mfd/rk808.c
+@@ -189,6 +189,7 @@ static const struct mfd_cell rk817s[] = {
+ };
+
+ static const struct mfd_cell rk818s[] = {
++ { .name = "rk808-clkout", .id = PLATFORM_DEVID_NONE, },
+ { .name = "rk808-regulator", .id = PLATFORM_DEVID_NONE, },
+ {
+ .name = "rk808-rtc",
+--
+2.39.2
+
--- /dev/null
+From 799ed01505b6f264666d0c1dd17b3bfdbc2c7c3d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Nov 2022 18:45:02 +0100
+Subject: misc: fastrpc: Fix an error handling path in fastrpc_rpmsg_probe()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 11819ed2b70da94acc41fec34178a011c4d3d25d ]
+
+If of_platform_populate() fails, some resources need to be freed as already
+done in the other error handling paths.
+
+Fixes: 278d56f970ae ("misc: fastrpc: Reference count channel context")
+Fixes: 3abe3ab3cdab ("misc: fastrpc: add secure domain support")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Link: https://lore.kernel.org/r/b909d2f3273b794ea0f1f78d14bc24affb08ea5f.1669398274.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/fastrpc.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c
+index 5310606113fe5..7ccaca1b7cb8b 100644
+--- a/drivers/misc/fastrpc.c
++++ b/drivers/misc/fastrpc.c
+@@ -2315,7 +2315,18 @@ static int fastrpc_rpmsg_probe(struct rpmsg_device *rpdev)
+ data->domain_id = domain_id;
+ data->rpdev = rpdev;
+
+- return of_platform_populate(rdev->of_node, NULL, NULL, rdev);
++ err = of_platform_populate(rdev->of_node, NULL, NULL, rdev);
++ if (err)
++ goto populate_error;
++
++ return 0;
++
++populate_error:
++ if (data->fdevice)
++ misc_deregister(&data->fdevice->miscdev);
++ if (data->secure_fdevice)
++ misc_deregister(&data->secure_fdevice->miscdev);
++
+ fdev_error:
+ kfree(data);
+ return err;
+--
+2.39.2
+
--- /dev/null
+From 875ff72447cbae7e0bb166ecdb6976bbd4452f01 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Dec 2022 18:05:00 +0200
+Subject: misc/mei/hdcp: Use correct macros to initialize uuid_le
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 512ba04d8211dd1a54dd36adc3ecc527a28069c5 ]
+
+GUID_INIT() is for internal guid_t type and shouldn't be used
+for the uuid_le. I.o.w. relying on the implementation details
+is layering violation. Use correct macros to initialize uuid_le.
+
+Fixes: 64e9bbdd9588 ("misc/mei/hdcp: Client driver for HDCP application")
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Acked-by: Tomas Winkler <tomas.winkler@intel.com>
+Link: https://lore.kernel.org/r/20221228160500.21220-1-andriy.shevchenko@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/mei/hdcp/mei_hdcp.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/misc/mei/hdcp/mei_hdcp.c b/drivers/misc/mei/hdcp/mei_hdcp.c
+index e889a8bd7ac88..e0dcd5c114db1 100644
+--- a/drivers/misc/mei/hdcp/mei_hdcp.c
++++ b/drivers/misc/mei/hdcp/mei_hdcp.c
+@@ -859,8 +859,8 @@ static void mei_hdcp_remove(struct mei_cl_device *cldev)
+ dev_warn(&cldev->dev, "mei_cldev_disable() failed\n");
+ }
+
+-#define MEI_UUID_HDCP GUID_INIT(0xB638AB7E, 0x94E2, 0x4EA2, 0xA5, \
+- 0x52, 0xD1, 0xC5, 0x4B, 0x62, 0x7F, 0x04)
++#define MEI_UUID_HDCP UUID_LE(0xB638AB7E, 0x94E2, 0x4EA2, 0xA5, \
++ 0x52, 0xD1, 0xC5, 0x4B, 0x62, 0x7F, 0x04)
+
+ static const struct mei_cl_device_id mei_hdcp_tbl[] = {
+ { .uuid = MEI_UUID_HDCP, .version = MEI_CL_VERSION_ANY },
+--
+2.39.2
+
--- /dev/null
+From 8636295d1d5e8e887a1f28ad8eb28e19e2d93bbf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Feb 2023 17:42:04 -0800
+Subject: mtd: mtdpart: Don't create platform device that'll never probe
+
+From: Saravana Kannan <saravanak@google.com>
+
+[ Upstream commit fb42378dcc7f247df56f0ecddfdae85487495fbc ]
+
+These "nvmem-cells" platform devices never get probed because there's no
+platform driver for it and it's never used anywhere else. So it's a
+waste of memory. These devices also cause fw_devlink to block nvmem
+consumers of "nvmem-cells" partition from probing because the supplier
+device never probes.
+
+So stop creating platform devices for nvmem-cells partitions to avoid
+wasting memory and to avoid blocking probing of consumers.
+
+Reported-by: Maxim Kiselev <bigunclemax@gmail.com>
+Fixes: bcdf0315a61a ("mtd: call of_platform_populate() for MTD partitions")
+Signed-off-by: Saravana Kannan <saravanak@google.com>
+Tested-by: Maksim Kiselev <bigunclemax@gmail.com>
+Tested-by: Douglas Anderson <dianders@chromium.org>
+Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Tested-by: Luca Weiss <luca.weiss@fairphone.com> # qcom/sm7225-fairphone-fp4
+Link: https://lore.kernel.org/r/20230207014207.1678715-13-saravanak@google.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/mtdpart.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/mtd/mtdpart.c b/drivers/mtd/mtdpart.c
+index d442fa94c8720..85f5ee6f06fc6 100644
+--- a/drivers/mtd/mtdpart.c
++++ b/drivers/mtd/mtdpart.c
+@@ -577,6 +577,7 @@ static int mtd_part_of_parse(struct mtd_info *master,
+ {
+ struct mtd_part_parser *parser;
+ struct device_node *np;
++ struct device_node *child;
+ struct property *prop;
+ struct device *dev;
+ const char *compat;
+@@ -594,6 +595,15 @@ static int mtd_part_of_parse(struct mtd_info *master,
+ else
+ np = of_get_child_by_name(np, "partitions");
+
++ /*
++ * Don't create devices that are added to a bus but will never get
++ * probed. That'll cause fw_devlink to block probing of consumers of
++ * this partition until the partition device is probed.
++ */
++ for_each_child_of_node(np, child)
++ if (of_device_is_compatible(child, "nvmem-cells"))
++ of_node_set_flag(child, OF_POPULATED);
++
+ of_property_for_each_string(np, "compatible", prop, compat) {
+ parser = mtd_part_get_compatible_parser(compat);
+ if (!parser)
+--
+2.39.2
+
--- /dev/null
+From e3a69c1594027fa9fa9bbaab43f7cd8ca13f0d39 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 4 Feb 2023 17:39:20 +0000
+Subject: net: add sock_init_data_uid()
+
+From: Pietro Borrello <borrello@diag.uniroma1.it>
+
+[ Upstream commit 584f3742890e966d2f0a1f3c418c9ead70b2d99e ]
+
+Add sock_init_data_uid() to explicitly initialize the socket uid.
+To initialise the socket uid, sock_init_data() assumes a the struct
+socket* sock is always embedded in a struct socket_alloc, used to
+access the corresponding inode uid. This may not be true.
+Examples are sockets created in tun_chr_open() and tap_open().
+
+Fixes: 86741ec25462 ("net: core: Add a UID field to struct sock.")
+Signed-off-by: Pietro Borrello <borrello@diag.uniroma1.it>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/sock.h | 7 ++++++-
+ net/core/sock.c | 15 ++++++++++++---
+ 2 files changed, 18 insertions(+), 4 deletions(-)
+
+diff --git a/include/net/sock.h b/include/net/sock.h
+index 5562097276336..c6584a3524638 100644
+--- a/include/net/sock.h
++++ b/include/net/sock.h
+@@ -1956,7 +1956,12 @@ void sk_common_release(struct sock *sk);
+ * Default socket callbacks and setup code
+ */
+
+-/* Initialise core socket variables */
++/* Initialise core socket variables using an explicit uid. */
++void sock_init_data_uid(struct socket *sock, struct sock *sk, kuid_t uid);
++
++/* Initialise core socket variables.
++ * Assumes struct socket *sock is embedded in a struct socket_alloc.
++ */
+ void sock_init_data(struct socket *sock, struct sock *sk);
+
+ /*
+diff --git a/net/core/sock.c b/net/core/sock.c
+index 6f27c24016fee..63680f999bf6d 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -3381,7 +3381,7 @@ void sk_stop_timer_sync(struct sock *sk, struct timer_list *timer)
+ }
+ EXPORT_SYMBOL(sk_stop_timer_sync);
+
+-void sock_init_data(struct socket *sock, struct sock *sk)
++void sock_init_data_uid(struct socket *sock, struct sock *sk, kuid_t uid)
+ {
+ sk_init_common(sk);
+ sk->sk_send_head = NULL;
+@@ -3401,11 +3401,10 @@ void sock_init_data(struct socket *sock, struct sock *sk)
+ sk->sk_type = sock->type;
+ RCU_INIT_POINTER(sk->sk_wq, &sock->wq);
+ sock->sk = sk;
+- sk->sk_uid = SOCK_INODE(sock)->i_uid;
+ } else {
+ RCU_INIT_POINTER(sk->sk_wq, NULL);
+- sk->sk_uid = make_kuid(sock_net(sk)->user_ns, 0);
+ }
++ sk->sk_uid = uid;
+
+ rwlock_init(&sk->sk_callback_lock);
+ if (sk->sk_kern_sock)
+@@ -3463,6 +3462,16 @@ void sock_init_data(struct socket *sock, struct sock *sk)
+ refcount_set(&sk->sk_refcnt, 1);
+ atomic_set(&sk->sk_drops, 0);
+ }
++EXPORT_SYMBOL(sock_init_data_uid);
++
++void sock_init_data(struct socket *sock, struct sock *sk)
++{
++ kuid_t uid = sock ?
++ SOCK_INODE(sock)->i_uid :
++ make_kuid(sock_net(sk)->user_ns, 0);
++
++ sock_init_data_uid(sock, sk, uid);
++}
+ EXPORT_SYMBOL(sock_init_data);
+
+ void lock_sock_nested(struct sock *sk, int subclass)
+--
+2.39.2
+
--- /dev/null
+From a481327de450444180984fc5b47d85be25fc4b98 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Jan 2023 16:08:19 -0800
+Subject: net: bcmgenet: Add a check for oversized packets
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit 5c0862c2c962052ed5055220a00ac1cefb92fbcd ]
+
+Occasionnaly we may get oversized packets from the hardware which
+exceed the nomimal 2KiB buffer size we allocate SKBs with. Add an early
+check which drops the packet to avoid invoking skb_over_panic() and move
+on to processing the next packet.
+
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/genet/bcmgenet.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+index 21973046b12b4..d937daa8ee883 100644
+--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+@@ -2316,6 +2316,14 @@ static unsigned int bcmgenet_desc_rx(struct bcmgenet_rx_ring *ring,
+ __func__, p_index, ring->c_index,
+ ring->read_ptr, dma_length_status);
+
++ if (unlikely(len > RX_BUF_LENGTH)) {
++ netif_err(priv, rx_status, dev, "oversized packet\n");
++ dev->stats.rx_length_errors++;
++ dev->stats.rx_errors++;
++ dev_kfree_skb_any(skb);
++ goto next;
++ }
++
+ if (unlikely(!(dma_flag & DMA_EOP) || !(dma_flag & DMA_SOP))) {
+ netif_err(priv, rx_status, dev,
+ "dropping fragmented packet!\n");
+--
+2.39.2
+
--- /dev/null
+From 705262e007be47fb67cc33db1b7300a8f8f63db4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Feb 2023 11:41:28 -0800
+Subject: net: bcmgenet: fix MoCA LED control
+
+From: Doug Berger <opendmb@gmail.com>
+
+[ Upstream commit a7515af9fb8f0890fe540b108def4a86b9e8330a ]
+
+When the bcmgenet_mii_config() code was refactored it was missed
+that the LED control for the MoCA interface got overwritten by
+the port_ctrl value. Its previous programming is restored here.
+
+Fixes: 4f8d81b77e66 ("net: bcmgenet: Refactor register access in bcmgenet_mii_config")
+Signed-off-by: Doug Berger <opendmb@gmail.com>
+Acked-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/genet/bcmmii.c | 11 ++---------
+ 1 file changed, 2 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/genet/bcmmii.c b/drivers/net/ethernet/broadcom/genet/bcmmii.c
+index b615176338b26..be042905ada2a 100644
+--- a/drivers/net/ethernet/broadcom/genet/bcmmii.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmmii.c
+@@ -176,15 +176,6 @@ void bcmgenet_phy_power_set(struct net_device *dev, bool enable)
+
+ static void bcmgenet_moca_phy_setup(struct bcmgenet_priv *priv)
+ {
+- u32 reg;
+-
+- if (!GENET_IS_V5(priv)) {
+- /* Speed settings are set in bcmgenet_mii_setup() */
+- reg = bcmgenet_sys_readl(priv, SYS_PORT_CTRL);
+- reg |= LED_ACT_SOURCE_MAC;
+- bcmgenet_sys_writel(priv, reg, SYS_PORT_CTRL);
+- }
+-
+ if (priv->hw_params->flags & GENET_HAS_MOCA_LINK_DET)
+ fixed_phy_set_link_update(priv->dev->phydev,
+ bcmgenet_fixed_phy_link_update);
+@@ -217,6 +208,8 @@ int bcmgenet_mii_config(struct net_device *dev, bool init)
+
+ if (!phy_name) {
+ phy_name = "MoCA";
++ if (!GENET_IS_V5(priv))
++ port_ctrl |= LED_ACT_SOURCE_MAC;
+ bcmgenet_moca_phy_setup(priv);
+ }
+ break;
+--
+2.39.2
+
--- /dev/null
+From 997c7f4a343ada1c3adf51ee9b72268294cd8369 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Jan 2023 12:37:31 +0530
+Subject: net: ethernet: ti: am65-cpsw/cpts: Fix CPTS release action
+
+From: Siddharth Vadapalli <s-vadapalli@ti.com>
+
+[ Upstream commit 4ad8766cd3982744e53f107f378d2c65b76ff9a8 ]
+
+The am65_cpts_release() function is registered as a devm_action in the
+am65_cpts_create() function in am65-cpts driver. When the am65-cpsw driver
+invokes am65_cpts_create(), am65_cpts_release() is added in the set of devm
+actions associated with the am65-cpsw driver's device.
+
+In the event of probe failure or probe deferral, the platform_drv_probe()
+function invokes dev_pm_domain_detach() which powers off the CPSW and the
+CPSW's CPTS hardware, both of which share the same power domain. Since the
+am65_cpts_disable() function invoked by the am65_cpts_release() function
+attempts to reset the CPTS hardware by writing to its registers, the CPTS
+hardware is assumed to be powered on at this point. However, the hardware
+is powered off before the devm actions are executed.
+
+Fix this by getting rid of the devm action for am65_cpts_release() and
+invoking it directly on the cleanup and exit paths.
+
+Fixes: f6bd59526ca5 ("net: ethernet: ti: introduce am654 common platform time sync driver")
+Signed-off-by: Siddharth Vadapalli <s-vadapalli@ti.com>
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Reviewed-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Reviewed-by: Roger Quadros <rogerq@kernel.org>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/ti/am65-cpsw-nuss.c | 2 ++
+ drivers/net/ethernet/ti/am65-cpts.c | 15 +++++----------
+ drivers/net/ethernet/ti/am65-cpts.h | 5 +++++
+ 3 files changed, 12 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/net/ethernet/ti/am65-cpsw-nuss.c b/drivers/net/ethernet/ti/am65-cpsw-nuss.c
+index 6cda4b7c10cb6..3e17152798554 100644
+--- a/drivers/net/ethernet/ti/am65-cpsw-nuss.c
++++ b/drivers/net/ethernet/ti/am65-cpsw-nuss.c
+@@ -2852,6 +2852,7 @@ static int am65_cpsw_nuss_probe(struct platform_device *pdev)
+
+ err_free_phylink:
+ am65_cpsw_nuss_phylink_cleanup(common);
++ am65_cpts_release(common->cpts);
+ err_of_clear:
+ of_platform_device_destroy(common->mdio_dev, NULL);
+ err_pm_clear:
+@@ -2880,6 +2881,7 @@ static int am65_cpsw_nuss_remove(struct platform_device *pdev)
+ */
+ am65_cpsw_nuss_cleanup_ndev(common);
+ am65_cpsw_nuss_phylink_cleanup(common);
++ am65_cpts_release(common->cpts);
+
+ of_platform_device_destroy(common->mdio_dev, NULL);
+
+diff --git a/drivers/net/ethernet/ti/am65-cpts.c b/drivers/net/ethernet/ti/am65-cpts.c
+index 9535396b28cd9..a297890152d92 100644
+--- a/drivers/net/ethernet/ti/am65-cpts.c
++++ b/drivers/net/ethernet/ti/am65-cpts.c
+@@ -929,14 +929,13 @@ static int am65_cpts_of_parse(struct am65_cpts *cpts, struct device_node *node)
+ return cpts_of_mux_clk_setup(cpts, node);
+ }
+
+-static void am65_cpts_release(void *data)
++void am65_cpts_release(struct am65_cpts *cpts)
+ {
+- struct am65_cpts *cpts = data;
+-
+ ptp_clock_unregister(cpts->ptp_clock);
+ am65_cpts_disable(cpts);
+ clk_disable_unprepare(cpts->refclk);
+ }
++EXPORT_SYMBOL_GPL(am65_cpts_release);
+
+ struct am65_cpts *am65_cpts_create(struct device *dev, void __iomem *regs,
+ struct device_node *node)
+@@ -1014,18 +1013,12 @@ struct am65_cpts *am65_cpts_create(struct device *dev, void __iomem *regs,
+ }
+ cpts->phc_index = ptp_clock_index(cpts->ptp_clock);
+
+- ret = devm_add_action_or_reset(dev, am65_cpts_release, cpts);
+- if (ret) {
+- dev_err(dev, "failed to add ptpclk reset action %d", ret);
+- return ERR_PTR(ret);
+- }
+-
+ ret = devm_request_threaded_irq(dev, cpts->irq, NULL,
+ am65_cpts_interrupt,
+ IRQF_ONESHOT, dev_name(dev), cpts);
+ if (ret < 0) {
+ dev_err(cpts->dev, "error attaching irq %d\n", ret);
+- return ERR_PTR(ret);
++ goto reset_ptpclk;
+ }
+
+ dev_info(dev, "CPTS ver 0x%08x, freq:%u, add_val:%u\n",
+@@ -1034,6 +1027,8 @@ struct am65_cpts *am65_cpts_create(struct device *dev, void __iomem *regs,
+
+ return cpts;
+
++reset_ptpclk:
++ am65_cpts_release(cpts);
+ refclk_disable:
+ clk_disable_unprepare(cpts->refclk);
+ return ERR_PTR(ret);
+diff --git a/drivers/net/ethernet/ti/am65-cpts.h b/drivers/net/ethernet/ti/am65-cpts.h
+index bd08f4b2edd2d..6e14df0be1137 100644
+--- a/drivers/net/ethernet/ti/am65-cpts.h
++++ b/drivers/net/ethernet/ti/am65-cpts.h
+@@ -18,6 +18,7 @@ struct am65_cpts_estf_cfg {
+ };
+
+ #if IS_ENABLED(CONFIG_TI_K3_AM65_CPTS)
++void am65_cpts_release(struct am65_cpts *cpts);
+ struct am65_cpts *am65_cpts_create(struct device *dev, void __iomem *regs,
+ struct device_node *node);
+ int am65_cpts_phc_index(struct am65_cpts *cpts);
+@@ -31,6 +32,10 @@ void am65_cpts_estf_disable(struct am65_cpts *cpts, int idx);
+ void am65_cpts_suspend(struct am65_cpts *cpts);
+ void am65_cpts_resume(struct am65_cpts *cpts);
+ #else
++static inline void am65_cpts_release(struct am65_cpts *cpts)
++{
++}
++
+ static inline struct am65_cpts *am65_cpts_create(struct device *dev,
+ void __iomem *regs,
+ struct device_node *node)
+--
+2.39.2
+
--- /dev/null
+From 36963ad9ab55e2c0ee18b9a1c2fcb8087338bcaa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Feb 2023 14:56:45 -0600
+Subject: net: ipa: generic command param fix
+
+From: Alex Elder <elder@linaro.org>
+
+[ Upstream commit 2df181f09c961377a55510a864216d48d787fe49 ]
+
+Starting at IPA v4.11, the GSI_GENERIC_COMMAND GSI register got a
+new PARAMS field. The code that encodes a value into that field
+sets it unconditionally, which is wrong.
+
+We currently only provide 0 as the field's value, so this error has
+no real effect. Still, it's a bug, so let's fix it.
+
+Fix an (unrelated) incorrect comment as well. Fields in the
+ERROR_LOG GSI register actually *are* defined for IPA versions
+prior to v3.5.1.
+
+Fixes: fe68c43ce388 ("net: ipa: support enhanced channel flow control")
+Signed-off-by: Alex Elder <elder@linaro.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ipa/gsi.c | 3 ++-
+ drivers/net/ipa/gsi_reg.h | 1 -
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ipa/gsi.c b/drivers/net/ipa/gsi.c
+index bea2da1c4c51d..f1a3938294866 100644
+--- a/drivers/net/ipa/gsi.c
++++ b/drivers/net/ipa/gsi.c
+@@ -1666,7 +1666,8 @@ static int gsi_generic_command(struct gsi *gsi, u32 channel_id,
+ val = u32_encode_bits(opcode, GENERIC_OPCODE_FMASK);
+ val |= u32_encode_bits(channel_id, GENERIC_CHID_FMASK);
+ val |= u32_encode_bits(GSI_EE_MODEM, GENERIC_EE_FMASK);
+- val |= u32_encode_bits(params, GENERIC_PARAMS_FMASK);
++ if (gsi->version >= IPA_VERSION_4_11)
++ val |= u32_encode_bits(params, GENERIC_PARAMS_FMASK);
+
+ timeout = !gsi_command(gsi, GSI_GENERIC_CMD_OFFSET, val);
+
+diff --git a/drivers/net/ipa/gsi_reg.h b/drivers/net/ipa/gsi_reg.h
+index 3763359f208f7..e65f2f055cfff 100644
+--- a/drivers/net/ipa/gsi_reg.h
++++ b/drivers/net/ipa/gsi_reg.h
+@@ -372,7 +372,6 @@ enum gsi_general_id {
+ #define GSI_ERROR_LOG_OFFSET \
+ (0x0001f200 + 0x4000 * GSI_EE_AP)
+
+-/* Fields below are present for IPA v3.5.1 and above */
+ #define ERR_ARG3_FMASK GENMASK(3, 0)
+ #define ERR_ARG2_FMASK GENMASK(7, 4)
+ #define ERR_ARG1_FMASK GENMASK(11, 8)
+--
+2.39.2
+
--- /dev/null
+From 5a24e0dd8161eabbdf3e50dc47d05e7dbf9e3c34 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Feb 2023 22:09:17 +0100
+Subject: net: lan966x: Fix possible deadlock inside PTP
+
+From: Horatiu Vultur <horatiu.vultur@microchip.com>
+
+[ Upstream commit 3a70e0d4c9d74cb00f7c0ec022f5599f9f7ba07d ]
+
+When doing timestamping in lan966x and having PROVE_LOCKING
+enabled the following warning is shown.
+
+========================================================
+WARNING: possible irq lock inversion dependency detected
+6.2.0-rc7-01749-gc54e1f7f7e36 #2786 Tainted: G N
+--------------------------------------------------------
+swapper/0/0 just changed the state of lock:
+c2609f50 (_xmit_ETHER#2){+.-.}-{2:2}, at: sch_direct_xmit+0x16c/0x2e8
+but this lock took another, SOFTIRQ-unsafe lock in the past:
+ (&lan966x->ptp_ts_id_lock){+.+.}-{2:2}
+
+and interrupts could create inverse lock ordering between them.
+
+other info that might help us debug this:
+ Possible interrupt unsafe locking scenario:
+
+ CPU0 CPU1
+ ---- ----
+ lock(&lan966x->ptp_ts_id_lock);
+ local_irq_disable();
+ lock(_xmit_ETHER#2);
+ lock(&lan966x->ptp_ts_id_lock);
+ <Interrupt>
+ lock(_xmit_ETHER#2);
+
+ *** DEADLOCK ***
+
+5 locks held by swapper/0/0:
+ #0: c1001e18 ((&ndev->rs_timer)){+.-.}-{0:0}, at: call_timer_fn+0x0/0x33c
+ #1: c105e7c4 (rcu_read_lock){....}-{1:2}, at: ndisc_send_skb+0x134/0x81c
+ #2: c105e7d8 (rcu_read_lock_bh){....}-{1:2}, at: ip6_finish_output2+0x17c/0xc64
+ #3: c105e7d8 (rcu_read_lock_bh){....}-{1:2}, at: __dev_queue_xmit+0x4c/0x1224
+ #4: c3056174 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock){+...}-{2:2}, at: __dev_queue_xmit+0x354/0x1224
+
+the shortest dependencies between 2nd lock and 1st lock:
+ -> (&lan966x->ptp_ts_id_lock){+.+.}-{2:2} {
+ HARDIRQ-ON-W at:
+ lock_acquire.part.0+0xb0/0x248
+ _raw_spin_lock+0x38/0x48
+ lan966x_ptp_irq_handler+0x164/0x2a8
+ irq_thread_fn+0x1c/0x78
+ irq_thread+0x130/0x278
+ kthread+0xec/0x110
+ ret_from_fork+0x14/0x28
+ SOFTIRQ-ON-W at:
+ lock_acquire.part.0+0xb0/0x248
+ _raw_spin_lock+0x38/0x48
+ lan966x_ptp_irq_handler+0x164/0x2a8
+ irq_thread_fn+0x1c/0x78
+ irq_thread+0x130/0x278
+ kthread+0xec/0x110
+ ret_from_fork+0x14/0x28
+ INITIAL USE at:
+ lock_acquire.part.0+0xb0/0x248
+ _raw_spin_lock_irqsave+0x4c/0x68
+ lan966x_ptp_txtstamp_request+0x128/0x1cc
+ lan966x_port_xmit+0x224/0x43c
+ dev_hard_start_xmit+0xa8/0x2f0
+ sch_direct_xmit+0x108/0x2e8
+ __dev_queue_xmit+0x41c/0x1224
+ packet_sendmsg+0xdb4/0x134c
+ __sys_sendto+0xd0/0x154
+ sys_send+0x18/0x20
+ ret_fast_syscall+0x0/0x1c
+ }
+ ... key at: [<c174ba0c>] __key.2+0x0/0x8
+ ... acquired at:
+ _raw_spin_lock_irqsave+0x4c/0x68
+ lan966x_ptp_txtstamp_request+0x128/0x1cc
+ lan966x_port_xmit+0x224/0x43c
+ dev_hard_start_xmit+0xa8/0x2f0
+ sch_direct_xmit+0x108/0x2e8
+ __dev_queue_xmit+0x41c/0x1224
+ packet_sendmsg+0xdb4/0x134c
+ __sys_sendto+0xd0/0x154
+ sys_send+0x18/0x20
+ ret_fast_syscall+0x0/0x1c
+
+-> (_xmit_ETHER#2){+.-.}-{2:2} {
+ HARDIRQ-ON-W at:
+ lock_acquire.part.0+0xb0/0x248
+ _raw_spin_lock+0x38/0x48
+ netif_freeze_queues+0x38/0x68
+ dev_deactivate_many+0xac/0x388
+ dev_deactivate+0x38/0x6c
+ linkwatch_do_dev+0x70/0x8c
+ __linkwatch_run_queue+0xd4/0x1e8
+ linkwatch_event+0x24/0x34
+ process_one_work+0x284/0x744
+ worker_thread+0x28/0x4bc
+ kthread+0xec/0x110
+ ret_from_fork+0x14/0x28
+ IN-SOFTIRQ-W at:
+ lock_acquire.part.0+0xb0/0x248
+ _raw_spin_lock+0x38/0x48
+ sch_direct_xmit+0x16c/0x2e8
+ __dev_queue_xmit+0x41c/0x1224
+ ip6_finish_output2+0x5f4/0xc64
+ ndisc_send_skb+0x4cc/0x81c
+ addrconf_rs_timer+0xb0/0x2f8
+ call_timer_fn+0xb4/0x33c
+ expire_timers+0xb4/0x10c
+ run_timer_softirq+0xf8/0x2a8
+ __do_softirq+0xd4/0x5fc
+ __irq_exit_rcu+0x138/0x17c
+ irq_exit+0x8/0x28
+ __irq_svc+0x90/0xbc
+ arch_cpu_idle+0x30/0x3c
+ default_idle_call+0x44/0xac
+ do_idle+0xc8/0x138
+ cpu_startup_entry+0x18/0x1c
+ rest_init+0xcc/0x168
+ arch_post_acpi_subsys_init+0x0/0x8
+ INITIAL USE at:
+ lock_acquire.part.0+0xb0/0x248
+ _raw_spin_lock+0x38/0x48
+ netif_freeze_queues+0x38/0x68
+ dev_deactivate_many+0xac/0x388
+ dev_deactivate+0x38/0x6c
+ linkwatch_do_dev+0x70/0x8c
+ __linkwatch_run_queue+0xd4/0x1e8
+ linkwatch_event+0x24/0x34
+ process_one_work+0x284/0x744
+ worker_thread+0x28/0x4bc
+ kthread+0xec/0x110
+ ret_from_fork+0x14/0x28
+ }
+ ... key at: [<c175974c>] netdev_xmit_lock_key+0x8/0x1c8
+ ... acquired at:
+ __lock_acquire+0x978/0x2978
+ lock_acquire.part.0+0xb0/0x248
+ _raw_spin_lock+0x38/0x48
+ sch_direct_xmit+0x16c/0x2e8
+ __dev_queue_xmit+0x41c/0x1224
+ ip6_finish_output2+0x5f4/0xc64
+ ndisc_send_skb+0x4cc/0x81c
+ addrconf_rs_timer+0xb0/0x2f8
+ call_timer_fn+0xb4/0x33c
+ expire_timers+0xb4/0x10c
+ run_timer_softirq+0xf8/0x2a8
+ __do_softirq+0xd4/0x5fc
+ __irq_exit_rcu+0x138/0x17c
+ irq_exit+0x8/0x28
+ __irq_svc+0x90/0xbc
+ arch_cpu_idle+0x30/0x3c
+ default_idle_call+0x44/0xac
+ do_idle+0xc8/0x138
+ cpu_startup_entry+0x18/0x1c
+ rest_init+0xcc/0x168
+ arch_post_acpi_subsys_init+0x0/0x8
+
+stack backtrace:
+CPU: 0 PID: 0 Comm: swapper/0 Tainted: G N 6.2.0-rc7-01749-gc54e1f7f7e36 #2786
+Hardware name: Generic DT based system
+ unwind_backtrace from show_stack+0x10/0x14
+ show_stack from dump_stack_lvl+0x58/0x70
+ dump_stack_lvl from mark_lock.part.0+0x59c/0x93c
+ mark_lock.part.0 from __lock_acquire+0x978/0x2978
+ __lock_acquire from lock_acquire.part.0+0xb0/0x248
+ lock_acquire.part.0 from _raw_spin_lock+0x38/0x48
+ _raw_spin_lock from sch_direct_xmit+0x16c/0x2e8
+ sch_direct_xmit from __dev_queue_xmit+0x41c/0x1224
+ __dev_queue_xmit from ip6_finish_output2+0x5f4/0xc64
+ ip6_finish_output2 from ndisc_send_skb+0x4cc/0x81c
+ ndisc_send_skb from addrconf_rs_timer+0xb0/0x2f8
+ addrconf_rs_timer from call_timer_fn+0xb4/0x33c
+ call_timer_fn from expire_timers+0xb4/0x10c
+ expire_timers from run_timer_softirq+0xf8/0x2a8
+ run_timer_softirq from __do_softirq+0xd4/0x5fc
+ __do_softirq from __irq_exit_rcu+0x138/0x17c
+ __irq_exit_rcu from irq_exit+0x8/0x28
+ irq_exit from __irq_svc+0x90/0xbc
+Exception stack(0xc1001f20 to 0xc1001f68)
+1f20: ffffffff ffffffff 00000001 c011f840 c100e000 c100e000 c1009314 c1009370
+1f40: c10f0c1a c0d5e564 c0f5da8c 00000000 00000000 c1001f70 c010f0bc c010f0c0
+1f60: 600f0013 ffffffff
+ __irq_svc from arch_cpu_idle+0x30/0x3c
+ arch_cpu_idle from default_idle_call+0x44/0xac
+ default_idle_call from do_idle+0xc8/0x138
+ do_idle from cpu_startup_entry+0x18/0x1c
+ cpu_startup_entry from rest_init+0xcc/0x168
+ rest_init from arch_post_acpi_subsys_init+0x0/0x8
+
+Fix this by using spin_lock_irqsave/spin_lock_irqrestore also
+inside lan966x_ptp_irq_handler.
+
+Fixes: e85a96e48e33 ("net: lan966x: Add support for ptp interrupts")
+Signed-off-by: Horatiu Vultur <horatiu.vultur@microchip.com>
+Link: https://lore.kernel.org/r/20230217210917.2649365-1-horatiu.vultur@microchip.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/microchip/lan966x/lan966x_ptp.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/microchip/lan966x/lan966x_ptp.c b/drivers/net/ethernet/microchip/lan966x/lan966x_ptp.c
+index a8348437dd87f..61fbabf5bebc3 100644
+--- a/drivers/net/ethernet/microchip/lan966x/lan966x_ptp.c
++++ b/drivers/net/ethernet/microchip/lan966x/lan966x_ptp.c
+@@ -524,9 +524,9 @@ irqreturn_t lan966x_ptp_irq_handler(int irq, void *args)
+ if (WARN_ON(!skb_match))
+ continue;
+
+- spin_lock(&lan966x->ptp_ts_id_lock);
++ spin_lock_irqsave(&lan966x->ptp_ts_id_lock, flags);
+ lan966x->ptp_skbs--;
+- spin_unlock(&lan966x->ptp_ts_id_lock);
++ spin_unlock_irqrestore(&lan966x->ptp_ts_id_lock, flags);
+
+ /* Get the h/w timestamp */
+ lan966x_get_hwtimestamp(lan966x, &ts, delay);
+--
+2.39.2
+
--- /dev/null
+From 6bf59a3bd623a3c91322cd835b10586acac2ac91 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 18 Feb 2023 10:38:50 -0800
+Subject: net/mlx4_en: Introduce flexible array to silence overflow warning
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Kees Cook <keescook@chromium.org>
+
+[ Upstream commit f8f185e39b4de91bc5235e5be0d829bea69d9b06 ]
+
+The call "skb_copy_from_linear_data(skb, inl + 1, spc)" triggers a FORTIFY
+memcpy() warning on ppc64 platform:
+
+In function ‘fortify_memcpy_chk’,
+ inlined from ‘skb_copy_from_linear_data’ at ./include/linux/skbuff.h:4029:2,
+ inlined from ‘build_inline_wqe’ at drivers/net/ethernet/mellanox/mlx4/en_tx.c:722:4,
+ inlined from ‘mlx4_en_xmit’ at drivers/net/ethernet/mellanox/mlx4/en_tx.c:1066:3:
+./include/linux/fortify-string.h:513:25: error: call to ‘__write_overflow_field’ declared with
+attribute warning: detected write beyond size of field (1st parameter); maybe use struct_group()?
+[-Werror=attribute-warning]
+ 513 | __write_overflow_field(p_size_field, size);
+ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Same behaviour on x86 you can get if you use "__always_inline" instead of
+"inline" for skb_copy_from_linear_data() in skbuff.h
+
+The call here copies data into inlined tx destricptor, which has 104
+bytes (MAX_INLINE) space for data payload. In this case "spc" is known
+in compile-time but the destination is used with hidden knowledge
+(real structure of destination is different from that the compiler
+can see). That cause the fortify warning because compiler can check
+bounds, but the real bounds are different. "spc" can't be bigger than
+64 bytes (MLX4_INLINE_ALIGN), so the data can always fit into inlined
+tx descriptor. The fact that "inl" points into inlined tx descriptor is
+determined earlier in mlx4_en_xmit().
+
+Avoid confusing the compiler with "inl + 1" constructions to get to past
+the inl header by introducing a flexible array "data" to the struct so
+that the compiler can see that we are not dealing with an array of inl
+structs, but rather, arbitrary data following the structure. There are
+no changes to the structure layout reported by pahole, and the resulting
+machine code is actually smaller.
+
+Reported-by: Josef Oskera <joskera@redhat.com>
+Link: https://lore.kernel.org/lkml/20230217094541.2362873-1-joskera@redhat.com
+Fixes: f68f2ff91512 ("fortify: Detect struct member overflows in memcpy() at compile-time")
+Cc: Yishai Hadas <yishaih@nvidia.com>
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
+Link: https://lore.kernel.org/r/20230218183842.never.954-kees@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx4/en_tx.c | 22 +++++++++++-----------
+ include/linux/mlx4/qp.h | 1 +
+ 2 files changed, 12 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx4/en_tx.c b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
+index c5758637b7bed..2f79378fbf6ec 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/en_tx.c
++++ b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
+@@ -699,32 +699,32 @@ static void build_inline_wqe(struct mlx4_en_tx_desc *tx_desc,
+ inl->byte_count = cpu_to_be32(1 << 31 | skb->len);
+ } else {
+ inl->byte_count = cpu_to_be32(1 << 31 | MIN_PKT_LEN);
+- memset(((void *)(inl + 1)) + skb->len, 0,
++ memset(inl->data + skb->len, 0,
+ MIN_PKT_LEN - skb->len);
+ }
+- skb_copy_from_linear_data(skb, inl + 1, hlen);
++ skb_copy_from_linear_data(skb, inl->data, hlen);
+ if (shinfo->nr_frags)
+- memcpy(((void *)(inl + 1)) + hlen, fragptr,
++ memcpy(inl->data + hlen, fragptr,
+ skb_frag_size(&shinfo->frags[0]));
+
+ } else {
+ inl->byte_count = cpu_to_be32(1 << 31 | spc);
+ if (hlen <= spc) {
+- skb_copy_from_linear_data(skb, inl + 1, hlen);
++ skb_copy_from_linear_data(skb, inl->data, hlen);
+ if (hlen < spc) {
+- memcpy(((void *)(inl + 1)) + hlen,
++ memcpy(inl->data + hlen,
+ fragptr, spc - hlen);
+ fragptr += spc - hlen;
+ }
+- inl = (void *) (inl + 1) + spc;
+- memcpy(((void *)(inl + 1)), fragptr, skb->len - spc);
++ inl = (void *)inl->data + spc;
++ memcpy(inl->data, fragptr, skb->len - spc);
+ } else {
+- skb_copy_from_linear_data(skb, inl + 1, spc);
+- inl = (void *) (inl + 1) + spc;
+- skb_copy_from_linear_data_offset(skb, spc, inl + 1,
++ skb_copy_from_linear_data(skb, inl->data, spc);
++ inl = (void *)inl->data + spc;
++ skb_copy_from_linear_data_offset(skb, spc, inl->data,
+ hlen - spc);
+ if (shinfo->nr_frags)
+- memcpy(((void *)(inl + 1)) + hlen - spc,
++ memcpy(inl->data + hlen - spc,
+ fragptr,
+ skb_frag_size(&shinfo->frags[0]));
+ }
+diff --git a/include/linux/mlx4/qp.h b/include/linux/mlx4/qp.h
+index 9db93e487496a..b6b626157b03a 100644
+--- a/include/linux/mlx4/qp.h
++++ b/include/linux/mlx4/qp.h
+@@ -446,6 +446,7 @@ enum {
+
+ struct mlx4_wqe_inline_seg {
+ __be32 byte_count;
++ __u8 data[];
+ };
+
+ enum mlx4_update_qp_attr {
+--
+2.39.2
+
--- /dev/null
+From b5cab1630376279f406c213da0fb0941ac83064c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Jan 2023 19:57:04 +0200
+Subject: net/mlx5: Enhance debug print in page allocation failure
+
+From: Jack Morgenstein <jackm@nvidia.com>
+
+[ Upstream commit 7eef93003e5d20e1a6a6e59e12d914b5431cbda2 ]
+
+Provide more details to aid debugging.
+
+Fixes: bf0bf77f6519 ("mlx5: Support communicating arbitrary host page size to firmware")
+Signed-off-by: Eran Ben Elisha <eranbe@nvidia.com>
+Signed-off-by: Majd Dibbiny <majd@nvidia.com>
+Signed-off-by: Jack Morgenstein <jackm@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
+index 0eb50be175cc4..64d4e7125e9bb 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
+@@ -219,7 +219,8 @@ static int alloc_4k(struct mlx5_core_dev *dev, u64 *addr, u32 function)
+
+ n = find_first_bit(&fp->bitmask, 8 * sizeof(fp->bitmask));
+ if (n >= MLX5_NUM_4K_IN_PAGE) {
+- mlx5_core_warn(dev, "alloc 4k bug\n");
++ mlx5_core_warn(dev, "alloc 4k bug: fw page = 0x%llx, n = %u, bitmask: %lu, max num of 4K pages: %d\n",
++ fp->addr, n, fp->bitmask, MLX5_NUM_4K_IN_PAGE);
+ return -ENOENT;
+ }
+ clear_bit(n, &fp->bitmask);
+--
+2.39.2
+
--- /dev/null
+From 210a1d2be09d43770c6909382c39825096f8604e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Jan 2023 13:34:02 +0200
+Subject: net/mlx5: fw_tracer: Fix debug print
+
+From: Shay Drory <shayd@nvidia.com>
+
+[ Upstream commit 988c2352273997a242f15c4fc3711773515006a2 ]
+
+The debug message specify tdsn, but takes as an argument the
+tmsn. The correct argument is tmsn, hence, fix the print.
+
+Signed-off-by: Shay Drory <shayd@nvidia.com>
+Reviewed-by: Moshe Shemesh <moshe@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c b/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c
+index 5b05b884b5fb3..d7b2ee5de1158 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c
+@@ -603,7 +603,7 @@ static int mlx5_tracer_handle_string_trace(struct mlx5_fw_tracer *tracer,
+ } else {
+ cur_string = mlx5_tracer_message_get(tracer, tracer_event);
+ if (!cur_string) {
+- pr_debug("%s Got string event for unknown string tdsm: %d\n",
++ pr_debug("%s Got string event for unknown string tmsn: %d\n",
+ __func__, tracer_event->string_event.tmsn);
+ return -1;
+ }
+--
+2.39.2
+
--- /dev/null
+From 350f219a3f88d0616bbb6627f09dfd2b404da230 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 19 Feb 2023 11:09:10 +0200
+Subject: net/mlx5e: Align IPsec ASO result memory to be as required by
+ hardware
+
+From: Leon Romanovsky <leonro@nvidia.com>
+
+[ Upstream commit f2b6cfda76d2119871e10fa01ecdc7178401ef22 ]
+
+Hardware requires an alignment to 64 bytes to return ASO data. Missing
+this alignment caused to unpredictable results while ASO events were
+generated.
+
+Fixes: 8518d05b8f9a ("net/mlx5e: Create Advanced Steering Operation object for IPsec")
+Reported-by: Emeel Hakim <ehakim@nvidia.com>
+Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
+Link: https://lore.kernel.org/r/de0302c572b90c9224a72868d4e0d657b6313c4b.1676797613.git.leon@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h
+index 8bed9c3610754..d739d77d68986 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h
+@@ -119,7 +119,7 @@ struct mlx5e_ipsec_work {
+ };
+
+ struct mlx5e_ipsec_aso {
+- u8 ctx[MLX5_ST_SZ_BYTES(ipsec_aso)];
++ u8 __aligned(64) ctx[MLX5_ST_SZ_BYTES(ipsec_aso)];
+ dma_addr_t dma_addr;
+ struct mlx5_aso *aso;
+ /* Protect ASO WQ access, as it is global to whole IPsec */
+--
+2.39.2
+
--- /dev/null
+From 3e9ccb85196844d42f469d483f258fc9061039f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Feb 2023 14:39:05 +0800
+Subject: net/smc: fix application data exception
+
+From: D. Wythe <alibuda@linux.alibaba.com>
+
+[ Upstream commit 475f9ff63ee8c296aa46c6e9e9ad9bdd301c6bdf ]
+
+There is a certain probability that following
+exceptions will occur in the wrk benchmark test:
+
+Running 10s test @ http://11.213.45.6:80
+ 8 threads and 64 connections
+ Thread Stats Avg Stdev Max +/- Stdev
+ Latency 3.72ms 13.94ms 245.33ms 94.17%
+ Req/Sec 1.96k 713.67 5.41k 75.16%
+ 155262 requests in 10.10s, 23.10MB read
+Non-2xx or 3xx responses: 3
+
+We will find that the error is HTTP 400 error, which is a serious
+exception in our test, which means the application data was
+corrupted.
+
+Consider the following scenarios:
+
+CPU0 CPU1
+
+buf_desc->used = 0;
+ cmpxchg(buf_desc->used, 0, 1)
+ deal_with(buf_desc)
+
+memset(buf_desc->cpu_addr,0);
+
+This will cause the data received by a victim connection to be cleared,
+thus triggering an HTTP 400 error in the server.
+
+This patch exchange the order between clear used and memset, add
+barrier to ensure memory consistency.
+
+Fixes: 1c5526968e27 ("net/smc: Clear memory when release and reuse buffer")
+Signed-off-by: D. Wythe <alibuda@linux.alibaba.com>
+Reviewed-by: Wenjia Zhang <wenjia@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/smc/smc_core.c | 17 ++++++++---------
+ 1 file changed, 8 insertions(+), 9 deletions(-)
+
+diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c
+index c305d8dd23f80..c19d4b7c1f28a 100644
+--- a/net/smc/smc_core.c
++++ b/net/smc/smc_core.c
+@@ -1120,8 +1120,9 @@ static void smcr_buf_unuse(struct smc_buf_desc *buf_desc, bool is_rmb,
+
+ smc_buf_free(lgr, is_rmb, buf_desc);
+ } else {
+- buf_desc->used = 0;
+- memset(buf_desc->cpu_addr, 0, buf_desc->len);
++ /* memzero_explicit provides potential memory barrier semantics */
++ memzero_explicit(buf_desc->cpu_addr, buf_desc->len);
++ WRITE_ONCE(buf_desc->used, 0);
+ }
+ }
+
+@@ -1132,19 +1133,17 @@ static void smc_buf_unuse(struct smc_connection *conn,
+ if (!lgr->is_smcd && conn->sndbuf_desc->is_vm) {
+ smcr_buf_unuse(conn->sndbuf_desc, false, lgr);
+ } else {
+- conn->sndbuf_desc->used = 0;
+- memset(conn->sndbuf_desc->cpu_addr, 0,
+- conn->sndbuf_desc->len);
++ memzero_explicit(conn->sndbuf_desc->cpu_addr, conn->sndbuf_desc->len);
++ WRITE_ONCE(conn->sndbuf_desc->used, 0);
+ }
+ }
+ if (conn->rmb_desc) {
+ if (!lgr->is_smcd) {
+ smcr_buf_unuse(conn->rmb_desc, true, lgr);
+ } else {
+- conn->rmb_desc->used = 0;
+- memset(conn->rmb_desc->cpu_addr, 0,
+- conn->rmb_desc->len +
+- sizeof(struct smcd_cdc_msg));
++ memzero_explicit(conn->rmb_desc->cpu_addr,
++ conn->rmb_desc->len + sizeof(struct smcd_cdc_msg));
++ WRITE_ONCE(conn->rmb_desc->used, 0);
+ }
+ }
+ }
+--
+2.39.2
+
--- /dev/null
+From bf665239f4fd4b2466a0f2f0fdb0cf1772740dfe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Feb 2023 14:37:36 +0800
+Subject: net/smc: fix potential panic dues to unprotected
+ smc_llc_srv_add_link()
+
+From: D. Wythe <alibuda@linux.alibaba.com>
+
+[ Upstream commit e40b801b3603a8f90b46acbacdea3505c27f01c0 ]
+
+There is a certain chance to trigger the following panic:
+
+PID: 5900 TASK: ffff88c1c8af4100 CPU: 1 COMMAND: "kworker/1:48"
+ #0 [ffff9456c1cc79a0] machine_kexec at ffffffff870665b7
+ #1 [ffff9456c1cc79f0] __crash_kexec at ffffffff871b4c7a
+ #2 [ffff9456c1cc7ab0] crash_kexec at ffffffff871b5b60
+ #3 [ffff9456c1cc7ac0] oops_end at ffffffff87026ce7
+ #4 [ffff9456c1cc7ae0] page_fault_oops at ffffffff87075715
+ #5 [ffff9456c1cc7b58] exc_page_fault at ffffffff87ad0654
+ #6 [ffff9456c1cc7b80] asm_exc_page_fault at ffffffff87c00b62
+ [exception RIP: ib_alloc_mr+19]
+ RIP: ffffffffc0c9cce3 RSP: ffff9456c1cc7c38 RFLAGS: 00010202
+ RAX: 0000000000000000 RBX: 0000000000000002 RCX: 0000000000000004
+ RDX: 0000000000000010 RSI: 0000000000000000 RDI: 0000000000000000
+ RBP: ffff88c1ea281d00 R8: 000000020a34ffff R9: ffff88c1350bbb20
+ R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000
+ R13: 0000000000000010 R14: ffff88c1ab040a50 R15: ffff88c1ea281d00
+ ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018
+ #7 [ffff9456c1cc7c60] smc_ib_get_memory_region at ffffffffc0aff6df [smc]
+ #8 [ffff9456c1cc7c88] smcr_buf_map_link at ffffffffc0b0278c [smc]
+ #9 [ffff9456c1cc7ce0] __smc_buf_create at ffffffffc0b03586 [smc]
+
+The reason here is that when the server tries to create a second link,
+smc_llc_srv_add_link() has no protection and may add a new link to
+link group. This breaks the security environment protected by
+llc_conf_mutex.
+
+Fixes: 2d2209f20189 ("net/smc: first part of add link processing as SMC server")
+Signed-off-by: D. Wythe <alibuda@linux.alibaba.com>
+Reviewed-by: Larysa Zaremba <larysa.zaremba@intel.com>
+Reviewed-by: Wenjia Zhang <wenjia@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/smc/af_smc.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
+index e12d4fa5aece6..d9413d43b1045 100644
+--- a/net/smc/af_smc.c
++++ b/net/smc/af_smc.c
+@@ -1826,8 +1826,10 @@ static int smcr_serv_conf_first_link(struct smc_sock *smc)
+ smc_llc_link_active(link);
+ smcr_lgr_set_type(link->lgr, SMC_LGR_SINGLE);
+
++ mutex_lock(&link->lgr->llc_conf_mutex);
+ /* initial contact - try to establish second link */
+ smc_llc_srv_add_link(link, NULL);
++ mutex_unlock(&link->lgr->llc_conf_mutex);
+ return 0;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 6ba3a56a318c7f60bd078198663c60dc98938a93 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Jan 2023 07:45:49 -0800
+Subject: netfilter: nf_tables: NULL pointer dereference in nf_tables_updobj()
+
+From: Alok Tiwari <alok.a.tiwari@oracle.com>
+
+[ Upstream commit dac7f50a45216d652887fb92d6cd3b7ca7f006ea ]
+
+static analyzer detect null pointer dereference case for 'type'
+function __nft_obj_type_get() can return NULL value which require to handle
+if type is NULL pointer return -ENOENT.
+
+This is a theoretical issue, since an existing object has a type, but
+better add this failsafe check.
+
+Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_tables_api.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index 8c09e4d12ac1e..fc8256b00b320 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -6999,6 +6999,9 @@ static int nf_tables_newobj(struct sk_buff *skb, const struct nfnl_info *info,
+ return -EOPNOTSUPP;
+
+ type = __nft_obj_type_get(objtype);
++ if (WARN_ON_ONCE(!type))
++ return -ENOENT;
++
+ nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla);
+
+ return nf_tables_updobj(&ctx, type, nla[NFTA_OBJ_DATA], obj);
+--
+2.39.2
+
--- /dev/null
+From 697b3e35d61fbdf81985f863e3c167181bf21c5e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Feb 2023 15:45:38 +1100
+Subject: NFS: fix disabling of swap
+
+From: NeilBrown <neilb@suse.de>
+
+[ Upstream commit 5bab56fff53ce161ed859d9559a10361d4f79578 ]
+
+When swap is activated to a file on an NFSv4 mount we arrange that the
+state manager thread is always present as starting a new thread requires
+memory allocations that might block waiting for swap.
+
+Unfortunately the code for allowing the state manager thread to exit when
+swap is disabled was not tested properly and does not work.
+This can be seen by examining /proc/fs/nfsfs/servers after disabling swap
+and unmounting the filesystem. The servers file will still list one
+entry. Also a "ps" listing will show the state manager thread is still
+present.
+
+There are two problems.
+ 1/ rpc_clnt_swap_deactivate() doesn't walk up the ->cl_parent list to
+ find the primary client on which the state manager runs.
+
+ 2/ The thread is not woken up properly and it immediately goes back to
+ sleep without checking whether it is really needed. Using
+ nfs4_schedule_state_manager() ensures a proper wake-up.
+
+Reported-by: Olga Kornievskaia <aglo@umich.edu>
+Fixes: 4dc73c679114 ("NFSv4: keep state manager thread active if swap is enabled")
+Signed-off-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4proc.c | 4 +++-
+ net/sunrpc/clnt.c | 2 ++
+ 2 files changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 40d749f29ed3f..4214286e01450 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -10604,7 +10604,9 @@ static void nfs4_disable_swap(struct inode *inode)
+ /* The state manager thread will now exit once it is
+ * woken.
+ */
+- wake_up_var(&NFS_SERVER(inode)->nfs_client->cl_state);
++ struct nfs_client *clp = NFS_SERVER(inode)->nfs_client;
++
++ nfs4_schedule_state_manager(clp);
+ }
+
+ static const struct inode_operations nfs4_dir_inode_operations = {
+diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
+index 0b0b9f1eed469..fd7e1c630493e 100644
+--- a/net/sunrpc/clnt.c
++++ b/net/sunrpc/clnt.c
+@@ -3350,6 +3350,8 @@ rpc_clnt_swap_deactivate_callback(struct rpc_clnt *clnt,
+ void
+ rpc_clnt_swap_deactivate(struct rpc_clnt *clnt)
+ {
++ while (clnt != clnt->cl_parent)
++ clnt = clnt->cl_parent;
+ if (atomic_dec_if_positive(&clnt->cl_swapper) == 0)
+ rpc_clnt_iterate_for_each_xprt(clnt,
+ rpc_clnt_swap_deactivate_callback, NULL);
+--
+2.39.2
+
--- /dev/null
+From 528001b6d68335debd0b690b03560d795f62514b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Feb 2023 08:18:23 -0500
+Subject: nfs4trace: fix state manager flag printing
+
+From: Benjamin Coddington <bcodding@redhat.com>
+
+[ Upstream commit b46d80bd2d6e7e063c625a20de54248afe8d4889 ]
+
+__print_flags wants a mask, not the enum value. Add two more flags.
+
+Fixes: 511ba52e4c01 ("NFS4: Trace state recovery operation")
+Signed-off-by: Benjamin Coddington <bcodding@redhat.com>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4trace.h | 42 ++++++++++++++++++++++--------------------
+ 1 file changed, 22 insertions(+), 20 deletions(-)
+
+diff --git a/fs/nfs/nfs4trace.h b/fs/nfs/nfs4trace.h
+index 214bc56f92d2b..d27919d7241d3 100644
+--- a/fs/nfs/nfs4trace.h
++++ b/fs/nfs/nfs4trace.h
+@@ -292,32 +292,34 @@ TRACE_DEFINE_ENUM(NFS4CLNT_MOVED);
+ TRACE_DEFINE_ENUM(NFS4CLNT_LEASE_MOVED);
+ TRACE_DEFINE_ENUM(NFS4CLNT_DELEGATION_EXPIRED);
+ TRACE_DEFINE_ENUM(NFS4CLNT_RUN_MANAGER);
++TRACE_DEFINE_ENUM(NFS4CLNT_MANAGER_AVAILABLE);
+ TRACE_DEFINE_ENUM(NFS4CLNT_RECALL_RUNNING);
+ TRACE_DEFINE_ENUM(NFS4CLNT_RECALL_ANY_LAYOUT_READ);
+ TRACE_DEFINE_ENUM(NFS4CLNT_RECALL_ANY_LAYOUT_RW);
++TRACE_DEFINE_ENUM(NFS4CLNT_DELEGRETURN_DELAYED);
+
+ #define show_nfs4_clp_state(state) \
+ __print_flags(state, "|", \
+- { NFS4CLNT_MANAGER_RUNNING, "MANAGER_RUNNING" }, \
+- { NFS4CLNT_CHECK_LEASE, "CHECK_LEASE" }, \
+- { NFS4CLNT_LEASE_EXPIRED, "LEASE_EXPIRED" }, \
+- { NFS4CLNT_RECLAIM_REBOOT, "RECLAIM_REBOOT" }, \
+- { NFS4CLNT_RECLAIM_NOGRACE, "RECLAIM_NOGRACE" }, \
+- { NFS4CLNT_DELEGRETURN, "DELEGRETURN" }, \
+- { NFS4CLNT_SESSION_RESET, "SESSION_RESET" }, \
+- { NFS4CLNT_LEASE_CONFIRM, "LEASE_CONFIRM" }, \
+- { NFS4CLNT_SERVER_SCOPE_MISMATCH, \
+- "SERVER_SCOPE_MISMATCH" }, \
+- { NFS4CLNT_PURGE_STATE, "PURGE_STATE" }, \
+- { NFS4CLNT_BIND_CONN_TO_SESSION, \
+- "BIND_CONN_TO_SESSION" }, \
+- { NFS4CLNT_MOVED, "MOVED" }, \
+- { NFS4CLNT_LEASE_MOVED, "LEASE_MOVED" }, \
+- { NFS4CLNT_DELEGATION_EXPIRED, "DELEGATION_EXPIRED" }, \
+- { NFS4CLNT_RUN_MANAGER, "RUN_MANAGER" }, \
+- { NFS4CLNT_RECALL_RUNNING, "RECALL_RUNNING" }, \
+- { NFS4CLNT_RECALL_ANY_LAYOUT_READ, "RECALL_ANY_LAYOUT_READ" }, \
+- { NFS4CLNT_RECALL_ANY_LAYOUT_RW, "RECALL_ANY_LAYOUT_RW" })
++ { BIT(NFS4CLNT_MANAGER_RUNNING), "MANAGER_RUNNING" }, \
++ { BIT(NFS4CLNT_CHECK_LEASE), "CHECK_LEASE" }, \
++ { BIT(NFS4CLNT_LEASE_EXPIRED), "LEASE_EXPIRED" }, \
++ { BIT(NFS4CLNT_RECLAIM_REBOOT), "RECLAIM_REBOOT" }, \
++ { BIT(NFS4CLNT_RECLAIM_NOGRACE), "RECLAIM_NOGRACE" }, \
++ { BIT(NFS4CLNT_DELEGRETURN), "DELEGRETURN" }, \
++ { BIT(NFS4CLNT_SESSION_RESET), "SESSION_RESET" }, \
++ { BIT(NFS4CLNT_LEASE_CONFIRM), "LEASE_CONFIRM" }, \
++ { BIT(NFS4CLNT_SERVER_SCOPE_MISMATCH), "SERVER_SCOPE_MISMATCH" }, \
++ { BIT(NFS4CLNT_PURGE_STATE), "PURGE_STATE" }, \
++ { BIT(NFS4CLNT_BIND_CONN_TO_SESSION), "BIND_CONN_TO_SESSION" }, \
++ { BIT(NFS4CLNT_MOVED), "MOVED" }, \
++ { BIT(NFS4CLNT_LEASE_MOVED), "LEASE_MOVED" }, \
++ { BIT(NFS4CLNT_DELEGATION_EXPIRED), "DELEGATION_EXPIRED" }, \
++ { BIT(NFS4CLNT_RUN_MANAGER), "RUN_MANAGER" }, \
++ { BIT(NFS4CLNT_MANAGER_AVAILABLE), "MANAGER_AVAILABLE" }, \
++ { BIT(NFS4CLNT_RECALL_RUNNING), "RECALL_RUNNING" }, \
++ { BIT(NFS4CLNT_RECALL_ANY_LAYOUT_READ), "RECALL_ANY_LAYOUT_READ" }, \
++ { BIT(NFS4CLNT_RECALL_ANY_LAYOUT_RW), "RECALL_ANY_LAYOUT_RW" }, \
++ { BIT(NFS4CLNT_DELEGRETURN_DELAYED), "DELERETURN_DELAYED" })
+
+ TRACE_EVENT(nfs4_state_mgr,
+ TP_PROTO(
+--
+2.39.2
+
--- /dev/null
+From 35a942b0a32d9fc30ff34a3b9e4ddde82e8101f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Jan 2023 14:38:31 -0500
+Subject: nfsd: clean up potential nfsd_file refcount leaks in COPY codepath
+
+From: Jeff Layton <jlayton@kernel.org>
+
+[ Upstream commit 6ba434cb1a8d403ea9aad1b667c3ea3ad8b3191f ]
+
+There are two different flavors of the nfsd4_copy struct. One is
+embedded in the compound and is used directly in synchronous copies. The
+other is dynamically allocated, refcounted and tracked in the client
+struture. For the embedded one, the cleanup just involves releasing any
+nfsd_files held on its behalf. For the async one, the cleanup is a bit
+more involved, and we need to dequeue it from lists, unhash it, etc.
+
+There is at least one potential refcount leak in this code now. If the
+kthread_create call fails, then both the src and dst nfsd_files in the
+original nfsd4_copy object are leaked.
+
+The cleanup in this codepath is also sort of weird. In the async copy
+case, we'll have up to four nfsd_file references (src and dst for both
+flavors of copy structure). They are both put at the end of
+nfsd4_do_async_copy, even though the ones held on behalf of the embedded
+one outlive that structure.
+
+Change it so that we always clean up the nfsd_file refs held by the
+embedded copy structure before nfsd4_copy returns. Rework
+cleanup_async_copy to handle both inter and intra copies. Eliminate
+nfsd4_cleanup_intra_ssc since it now becomes a no-op.
+
+Signed-off-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Stable-dep-of: 81e722978ad2 ("NFSD: fix problems with cleanup on errors in nfsd4_copy")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfsd/nfs4proc.c | 23 ++++++++++-------------
+ 1 file changed, 10 insertions(+), 13 deletions(-)
+
+diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
+index e2dde8a1837be..b74cbc9a0e7f3 100644
+--- a/fs/nfsd/nfs4proc.c
++++ b/fs/nfsd/nfs4proc.c
+@@ -1510,7 +1510,6 @@ nfsd4_cleanup_inter_ssc(struct nfsd4_ssc_umount_item *nsui, struct file *filp,
+ long timeout = msecs_to_jiffies(nfsd4_ssc_umount_timeout);
+
+ nfs42_ssc_close(filp);
+- nfsd_file_put(dst);
+ fput(filp);
+
+ spin_lock(&nn->nfsd_ssc_lock);
+@@ -1560,13 +1559,6 @@ nfsd4_setup_intra_ssc(struct svc_rqst *rqstp,
+ ©->nf_dst);
+ }
+
+-static void
+-nfsd4_cleanup_intra_ssc(struct nfsd_file *src, struct nfsd_file *dst)
+-{
+- nfsd_file_put(src);
+- nfsd_file_put(dst);
+-}
+-
+ static void nfsd4_cb_offload_release(struct nfsd4_callback *cb)
+ {
+ struct nfsd4_cb_offload *cbo =
+@@ -1681,12 +1673,18 @@ static void dup_copy_fields(struct nfsd4_copy *src, struct nfsd4_copy *dst)
+ dst->ss_nsui = src->ss_nsui;
+ }
+
++static void release_copy_files(struct nfsd4_copy *copy)
++{
++ if (copy->nf_src)
++ nfsd_file_put(copy->nf_src);
++ if (copy->nf_dst)
++ nfsd_file_put(copy->nf_dst);
++}
++
+ static void cleanup_async_copy(struct nfsd4_copy *copy)
+ {
+ nfs4_free_copy_state(copy);
+- nfsd_file_put(copy->nf_dst);
+- if (!nfsd4_ssc_is_inter(copy))
+- nfsd_file_put(copy->nf_src);
++ release_copy_files(copy);
+ spin_lock(©->cp_clp->async_lock);
+ list_del(©->copies);
+ spin_unlock(©->cp_clp->async_lock);
+@@ -1746,7 +1744,6 @@ static int nfsd4_do_async_copy(void *data)
+ } else {
+ nfserr = nfsd4_do_copy(copy, copy->nf_src->nf_file,
+ copy->nf_dst->nf_file, false);
+- nfsd4_cleanup_intra_ssc(copy->nf_src, copy->nf_dst);
+ }
+
+ do_callback:
+@@ -1809,9 +1806,9 @@ nfsd4_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
+ } else {
+ status = nfsd4_do_copy(copy, copy->nf_src->nf_file,
+ copy->nf_dst->nf_file, true);
+- nfsd4_cleanup_intra_ssc(copy->nf_src, copy->nf_dst);
+ }
+ out:
++ release_copy_files(copy);
+ return status;
+ out_err:
+ if (nfsd4_ssc_is_inter(copy)) {
+--
+2.39.2
+
--- /dev/null
+From 844baea1f8bc194ad28acc1336f3f7e9f52a4c04 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Feb 2023 10:07:59 -0500
+Subject: NFSD: copy the whole verifier in nfsd_copy_write_verifier
+
+From: Chuck Lever <chuck.lever@oracle.com>
+
+[ Upstream commit 90d2175572470ba7f55da8447c72ddd4942923c4 ]
+
+Currently, we're only memcpy'ing the first __be32. Ensure we copy into
+both words.
+
+Fixes: 91d2e9b56cf5 ("NFSD: Clean up the nfsd_net::nfssvc_boot field")
+Reported-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfsd/nfssvc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/nfsd/nfssvc.c b/fs/nfsd/nfssvc.c
+index 325d3d3f12110..a0ecec54d3d7d 100644
+--- a/fs/nfsd/nfssvc.c
++++ b/fs/nfsd/nfssvc.c
+@@ -363,7 +363,7 @@ void nfsd_copy_write_verifier(__be32 verf[2], struct nfsd_net *nn)
+
+ do {
+ read_seqbegin_or_lock(&nn->writeverf_lock, &seq);
+- memcpy(verf, nn->writeverf, sizeof(*verf));
++ memcpy(verf, nn->writeverf, sizeof(nn->writeverf));
+ } while (need_seqretry(&nn->writeverf_lock, seq));
+ done_seqretry(&nn->writeverf_lock, seq);
+ }
+--
+2.39.2
+
--- /dev/null
+From 7dbe04de7d340d652168e77902b096150c6bc860 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Feb 2023 12:02:46 -0500
+Subject: nfsd: don't fsync nfsd_files on last close
+
+From: Jeff Layton <jlayton@kernel.org>
+
+[ Upstream commit 4c475eee02375ade6e864f1db16976ba0d96a0a2 ]
+
+Most of the time, NFSv4 clients issue a COMMIT before the final CLOSE of
+an open stateid, so with NFSv4, the fsync in the nfsd_file_free path is
+usually a no-op and doesn't block.
+
+We have a customer running knfsd over very slow storage (XFS over Ceph
+RBD). They were using the "async" export option because performance was
+more important than data integrity for this application. That export
+option turns NFSv4 COMMIT calls into no-ops. Due to the fsync in this
+codepath however, their final CLOSE calls would still stall (since a
+CLOSE effectively became a COMMIT).
+
+I think this fsync is not strictly necessary. We only use that result to
+reset the write verifier. Instead of fsync'ing all of the data when we
+free an nfsd_file, we can just check for writeback errors when one is
+acquired and when it is freed.
+
+If the client never comes back, then it'll never see the error anyway
+and there is no point in resetting it. If an error occurs after the
+nfsd_file is removed from the cache but before the inode is evicted,
+then it will reset the write verifier on the next nfsd_file_acquire,
+(since there will be an unseen error).
+
+The only exception here is if something else opens and fsyncs the file
+during that window. Given that local applications work with this
+limitation today, I don't see that as an issue.
+
+Link: https://bugzilla.redhat.com/show_bug.cgi?id=2166658
+Fixes: ac3a2585f018 ("nfsd: rework refcounting in filecache")
+Reported-and-tested-by: Pierguido Lambri <plambri@redhat.com>
+Signed-off-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfsd/filecache.c | 44 ++++++++++++--------------------------------
+ fs/nfsd/trace.h | 31 -------------------------------
+ 2 files changed, 12 insertions(+), 63 deletions(-)
+
+diff --git a/fs/nfsd/filecache.c b/fs/nfsd/filecache.c
+index c0950edb26b0d..697acf5c3c681 100644
+--- a/fs/nfsd/filecache.c
++++ b/fs/nfsd/filecache.c
+@@ -331,37 +331,27 @@ nfsd_file_alloc(struct nfsd_file_lookup_key *key, unsigned int may)
+ return nf;
+ }
+
++/**
++ * nfsd_file_check_write_error - check for writeback errors on a file
++ * @nf: nfsd_file to check for writeback errors
++ *
++ * Check whether a nfsd_file has an unseen error. Reset the write
++ * verifier if so.
++ */
+ static void
+-nfsd_file_fsync(struct nfsd_file *nf)
+-{
+- struct file *file = nf->nf_file;
+- int ret;
+-
+- if (!file || !(file->f_mode & FMODE_WRITE))
+- return;
+- ret = vfs_fsync(file, 1);
+- trace_nfsd_file_fsync(nf, ret);
+- if (ret)
+- nfsd_reset_write_verifier(net_generic(nf->nf_net, nfsd_net_id));
+-}
+-
+-static int
+ nfsd_file_check_write_error(struct nfsd_file *nf)
+ {
+ struct file *file = nf->nf_file;
+
+- if (!file || !(file->f_mode & FMODE_WRITE))
+- return 0;
+- return filemap_check_wb_err(file->f_mapping, READ_ONCE(file->f_wb_err));
++ if ((file->f_mode & FMODE_WRITE) &&
++ filemap_check_wb_err(file->f_mapping, READ_ONCE(file->f_wb_err)))
++ nfsd_reset_write_verifier(net_generic(nf->nf_net, nfsd_net_id));
+ }
+
+ static void
+ nfsd_file_hash_remove(struct nfsd_file *nf)
+ {
+ trace_nfsd_file_unhash(nf);
+-
+- if (nfsd_file_check_write_error(nf))
+- nfsd_reset_write_verifier(net_generic(nf->nf_net, nfsd_net_id));
+ rhashtable_remove_fast(&nfsd_file_rhash_tbl, &nf->nf_rhash,
+ nfsd_file_rhash_params);
+ }
+@@ -387,23 +377,12 @@ nfsd_file_free(struct nfsd_file *nf)
+ this_cpu_add(nfsd_file_total_age, age);
+
+ nfsd_file_unhash(nf);
+-
+- /*
+- * We call fsync here in order to catch writeback errors. It's not
+- * strictly required by the protocol, but an nfsd_file could get
+- * evicted from the cache before a COMMIT comes in. If another
+- * task were to open that file in the interim and scrape the error,
+- * then the client may never see it. By calling fsync here, we ensure
+- * that writeback happens before the entry is freed, and that any
+- * errors reported result in the write verifier changing.
+- */
+- nfsd_file_fsync(nf);
+-
+ if (nf->nf_mark)
+ nfsd_file_mark_put(nf->nf_mark);
+ if (nf->nf_file) {
+ get_file(nf->nf_file);
+ filp_close(nf->nf_file, NULL);
++ nfsd_file_check_write_error(nf);
+ fput(nf->nf_file);
+ }
+
+@@ -1159,6 +1138,7 @@ nfsd_file_do_acquire(struct svc_rqst *rqstp, struct svc_fh *fhp,
+ out:
+ if (status == nfs_ok) {
+ this_cpu_inc(nfsd_file_acquisitions);
++ nfsd_file_check_write_error(nf);
+ *pnf = nf;
+ } else {
+ if (refcount_dec_and_test(&nf->nf_ref))
+diff --git a/fs/nfsd/trace.h b/fs/nfsd/trace.h
+index 8f9c82d9e075b..4183819ea0829 100644
+--- a/fs/nfsd/trace.h
++++ b/fs/nfsd/trace.h
+@@ -1202,37 +1202,6 @@ TRACE_EVENT(nfsd_file_close,
+ )
+ );
+
+-TRACE_EVENT(nfsd_file_fsync,
+- TP_PROTO(
+- const struct nfsd_file *nf,
+- int ret
+- ),
+- TP_ARGS(nf, ret),
+- TP_STRUCT__entry(
+- __field(void *, nf_inode)
+- __field(int, nf_ref)
+- __field(int, ret)
+- __field(unsigned long, nf_flags)
+- __field(unsigned char, nf_may)
+- __field(struct file *, nf_file)
+- ),
+- TP_fast_assign(
+- __entry->nf_inode = nf->nf_inode;
+- __entry->nf_ref = refcount_read(&nf->nf_ref);
+- __entry->ret = ret;
+- __entry->nf_flags = nf->nf_flags;
+- __entry->nf_may = nf->nf_may;
+- __entry->nf_file = nf->nf_file;
+- ),
+- TP_printk("inode=%p ref=%d flags=%s may=%s nf_file=%p ret=%d",
+- __entry->nf_inode,
+- __entry->nf_ref,
+- show_nf_flags(__entry->nf_flags),
+- show_nfsd_may_flags(__entry->nf_may),
+- __entry->nf_file, __entry->ret
+- )
+-);
+-
+ #include "cache.h"
+
+ TRACE_DEFINE_ENUM(RC_DROPIT);
+--
+2.39.2
+
--- /dev/null
+From f26af2db4fa28d413a883294b5ba4c0dd9496412 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Jan 2023 07:09:33 -0500
+Subject: nfsd: don't hand out delegation on setuid files being opened for
+ write
+
+From: Jeff Layton <jlayton@kernel.org>
+
+[ Upstream commit 826b67e6376c2a788e3a62c4860dcd79500a27d5 ]
+
+We had a bug report that xfstest generic/355 was failing on NFSv4.0.
+This test sets various combinations of setuid/setgid modes and tests
+whether DIO writes will cause them to be stripped.
+
+What I found was that the server did properly strip those bits, but
+the client didn't notice because it held a delegation that was not
+recalled. The recall didn't occur because the client itself was the
+one generating the activity and we avoid recalls in that case.
+
+Clearing setuid bits is an "implicit" activity. The client didn't
+specifically request that we do that, so we need the server to issue a
+CB_RECALL, or avoid the situation entirely by not issuing a delegation.
+
+The easiest fix here is to simply not give out a delegation if the file
+is being opened for write, and the mode has the setuid and/or setgid bit
+set. Note that there is a potential race between the mode and lease
+being set, so we test for this condition both before and after setting
+the lease.
+
+This patch fixes generic/355, generic/683 and generic/684 for me. (Note
+that 355 fails only on v4.0, and 683 and 684 require NFSv4.2 to run and
+fail).
+
+Reported-by: Boyang Xue <bxue@redhat.com>
+Signed-off-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfsd/nfs4state.c | 27 +++++++++++++++++++++++++++
+ 1 file changed, 27 insertions(+)
+
+diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
+index 104c258255d62..8852a05126926 100644
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -5440,6 +5440,23 @@ nfsd4_verify_deleg_dentry(struct nfsd4_open *open, struct nfs4_file *fp,
+ return 0;
+ }
+
++/*
++ * We avoid breaking delegations held by a client due to its own activity, but
++ * clearing setuid/setgid bits on a write is an implicit activity and the client
++ * may not notice and continue using the old mode. Avoid giving out a delegation
++ * on setuid/setgid files when the client is requesting an open for write.
++ */
++static int
++nfsd4_verify_setuid_write(struct nfsd4_open *open, struct nfsd_file *nf)
++{
++ struct inode *inode = file_inode(nf->nf_file);
++
++ if ((open->op_share_access & NFS4_SHARE_ACCESS_WRITE) &&
++ (inode->i_mode & (S_ISUID|S_ISGID)))
++ return -EAGAIN;
++ return 0;
++}
++
+ static struct nfs4_delegation *
+ nfs4_set_delegation(struct nfsd4_open *open, struct nfs4_ol_stateid *stp,
+ struct svc_fh *parent)
+@@ -5473,6 +5490,8 @@ nfs4_set_delegation(struct nfsd4_open *open, struct nfs4_ol_stateid *stp,
+ spin_lock(&fp->fi_lock);
+ if (nfs4_delegation_exists(clp, fp))
+ status = -EAGAIN;
++ else if (nfsd4_verify_setuid_write(open, nf))
++ status = -EAGAIN;
+ else if (!fp->fi_deleg_file) {
+ fp->fi_deleg_file = nf;
+ /* increment early to prevent fi_deleg_file from being
+@@ -5513,6 +5532,14 @@ nfs4_set_delegation(struct nfsd4_open *open, struct nfs4_ol_stateid *stp,
+ if (status)
+ goto out_unlock;
+
++ /*
++ * Now that the deleg is set, check again to ensure that nothing
++ * raced in and changed the mode while we weren't lookng.
++ */
++ status = nfsd4_verify_setuid_write(open, fp->fi_deleg_file);
++ if (status)
++ goto out_unlock;
++
+ spin_lock(&state_lock);
+ spin_lock(&fp->fi_lock);
+ if (fp->fi_had_conflict)
+--
+2.39.2
+
--- /dev/null
+From 3afbf6ddaea4438b40d0c13210edcb6eaacfde24 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 18 Dec 2022 16:55:53 -0800
+Subject: NFSD: enhance inter-server copy cleanup
+
+From: Dai Ngo <dai.ngo@oracle.com>
+
+[ Upstream commit df24ac7a2e3a9d0bc68f1756a880e50bfe4b4522 ]
+
+Currently nfsd4_setup_inter_ssc returns the vfsmount of the source
+server's export when the mount completes. After the copy is done
+nfsd4_cleanup_inter_ssc is called with the vfsmount of the source
+server and it searches nfsd_ssc_mount_list for a matching entry
+to do the clean up.
+
+The problems with this approach are (1) the need to search the
+nfsd_ssc_mount_list and (2) the code has to handle the case where
+the matching entry is not found which looks ugly.
+
+The enhancement is instead of nfsd4_setup_inter_ssc returning the
+vfsmount, it returns the nfsd4_ssc_umount_item which has the
+vfsmount embedded in it. When nfsd4_cleanup_inter_ssc is called
+it's passed with the nfsd4_ssc_umount_item directly to do the
+clean up so no searching is needed and there is no need to handle
+the 'not found' case.
+
+Signed-off-by: Dai Ngo <dai.ngo@oracle.com>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+[ cel: adjusted whitespace and variable/function names ]
+Reviewed-by: Olga Kornievskaia <kolga@netapp.com>
+Stable-dep-of: 34e8f9ec4c9a ("NFSD: fix leaked reference count of nfsd4_ssc_umount_item")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfsd/nfs4proc.c | 111 ++++++++++++++++------------------------
+ fs/nfsd/xdr4.h | 2 +-
+ include/linux/nfs_ssc.h | 2 +-
+ 3 files changed, 46 insertions(+), 69 deletions(-)
+
+diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
+index f189ba7995f5a..dbaf33398c827 100644
+--- a/fs/nfsd/nfs4proc.c
++++ b/fs/nfsd/nfs4proc.c
+@@ -1293,15 +1293,15 @@ extern void nfs_sb_deactive(struct super_block *sb);
+ * setup a work entry in the ssc delayed unmount list.
+ */
+ static __be32 nfsd4_ssc_setup_dul(struct nfsd_net *nn, char *ipaddr,
+- struct nfsd4_ssc_umount_item **retwork, struct vfsmount **ss_mnt)
++ struct nfsd4_ssc_umount_item **nsui)
+ {
+ struct nfsd4_ssc_umount_item *ni = NULL;
+ struct nfsd4_ssc_umount_item *work = NULL;
+ struct nfsd4_ssc_umount_item *tmp;
+ DEFINE_WAIT(wait);
++ __be32 status = 0;
+
+- *ss_mnt = NULL;
+- *retwork = NULL;
++ *nsui = NULL;
+ work = kzalloc(sizeof(*work), GFP_KERNEL);
+ try_again:
+ spin_lock(&nn->nfsd_ssc_lock);
+@@ -1325,12 +1325,12 @@ static __be32 nfsd4_ssc_setup_dul(struct nfsd_net *nn, char *ipaddr,
+ finish_wait(&nn->nfsd_ssc_waitq, &wait);
+ goto try_again;
+ }
+- *ss_mnt = ni->nsui_vfsmount;
++ *nsui = ni;
+ refcount_inc(&ni->nsui_refcnt);
+ spin_unlock(&nn->nfsd_ssc_lock);
+ kfree(work);
+
+- /* return vfsmount in ss_mnt */
++ /* return vfsmount in (*nsui)->nsui_vfsmount */
+ return 0;
+ }
+ if (work) {
+@@ -1338,31 +1338,32 @@ static __be32 nfsd4_ssc_setup_dul(struct nfsd_net *nn, char *ipaddr,
+ refcount_set(&work->nsui_refcnt, 2);
+ work->nsui_busy = true;
+ list_add_tail(&work->nsui_list, &nn->nfsd_ssc_mount_list);
+- *retwork = work;
+- }
++ *nsui = work;
++ } else
++ status = nfserr_resource;
+ spin_unlock(&nn->nfsd_ssc_lock);
+- return 0;
++ return status;
+ }
+
+-static void nfsd4_ssc_update_dul_work(struct nfsd_net *nn,
+- struct nfsd4_ssc_umount_item *work, struct vfsmount *ss_mnt)
++static void nfsd4_ssc_update_dul(struct nfsd_net *nn,
++ struct nfsd4_ssc_umount_item *nsui,
++ struct vfsmount *ss_mnt)
+ {
+- /* set nsui_vfsmount, clear busy flag and wakeup waiters */
+ spin_lock(&nn->nfsd_ssc_lock);
+- work->nsui_vfsmount = ss_mnt;
+- work->nsui_busy = false;
++ nsui->nsui_vfsmount = ss_mnt;
++ nsui->nsui_busy = false;
+ wake_up_all(&nn->nfsd_ssc_waitq);
+ spin_unlock(&nn->nfsd_ssc_lock);
+ }
+
+-static void nfsd4_ssc_cancel_dul_work(struct nfsd_net *nn,
+- struct nfsd4_ssc_umount_item *work)
++static void nfsd4_ssc_cancel_dul(struct nfsd_net *nn,
++ struct nfsd4_ssc_umount_item *nsui)
+ {
+ spin_lock(&nn->nfsd_ssc_lock);
+- list_del(&work->nsui_list);
++ list_del(&nsui->nsui_list);
+ wake_up_all(&nn->nfsd_ssc_waitq);
+ spin_unlock(&nn->nfsd_ssc_lock);
+- kfree(work);
++ kfree(nsui);
+ }
+
+ /*
+@@ -1370,7 +1371,7 @@ static void nfsd4_ssc_cancel_dul_work(struct nfsd_net *nn,
+ */
+ static __be32
+ nfsd4_interssc_connect(struct nl4_server *nss, struct svc_rqst *rqstp,
+- struct vfsmount **mount)
++ struct nfsd4_ssc_umount_item **nsui)
+ {
+ struct file_system_type *type;
+ struct vfsmount *ss_mnt;
+@@ -1381,7 +1382,6 @@ nfsd4_interssc_connect(struct nl4_server *nss, struct svc_rqst *rqstp,
+ char *ipaddr, *dev_name, *raw_data;
+ int len, raw_len;
+ __be32 status = nfserr_inval;
+- struct nfsd4_ssc_umount_item *work = NULL;
+ struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
+
+ naddr = &nss->u.nl4_addr;
+@@ -1389,6 +1389,7 @@ nfsd4_interssc_connect(struct nl4_server *nss, struct svc_rqst *rqstp,
+ naddr->addr_len,
+ (struct sockaddr *)&tmp_addr,
+ sizeof(tmp_addr));
++ *nsui = NULL;
+ if (tmp_addrlen == 0)
+ goto out_err;
+
+@@ -1431,10 +1432,10 @@ nfsd4_interssc_connect(struct nl4_server *nss, struct svc_rqst *rqstp,
+ goto out_free_rawdata;
+ snprintf(dev_name, len + 5, "%s%s%s:/", startsep, ipaddr, endsep);
+
+- status = nfsd4_ssc_setup_dul(nn, ipaddr, &work, &ss_mnt);
++ status = nfsd4_ssc_setup_dul(nn, ipaddr, nsui);
+ if (status)
+ goto out_free_devname;
+- if (ss_mnt)
++ if ((*nsui)->nsui_vfsmount)
+ goto out_done;
+
+ /* Use an 'internal' mount: SB_KERNMOUNT -> MNT_INTERNAL */
+@@ -1442,15 +1443,12 @@ nfsd4_interssc_connect(struct nl4_server *nss, struct svc_rqst *rqstp,
+ module_put(type->owner);
+ if (IS_ERR(ss_mnt)) {
+ status = nfserr_nodev;
+- if (work)
+- nfsd4_ssc_cancel_dul_work(nn, work);
++ nfsd4_ssc_cancel_dul(nn, *nsui);
+ goto out_free_devname;
+ }
+- if (work)
+- nfsd4_ssc_update_dul_work(nn, work, ss_mnt);
++ nfsd4_ssc_update_dul(nn, *nsui, ss_mnt);
+ out_done:
+ status = 0;
+- *mount = ss_mnt;
+
+ out_free_devname:
+ kfree(dev_name);
+@@ -1474,7 +1472,7 @@ nfsd4_interssc_connect(struct nl4_server *nss, struct svc_rqst *rqstp,
+ static __be32
+ nfsd4_setup_inter_ssc(struct svc_rqst *rqstp,
+ struct nfsd4_compound_state *cstate,
+- struct nfsd4_copy *copy, struct vfsmount **mount)
++ struct nfsd4_copy *copy)
+ {
+ struct svc_fh *s_fh = NULL;
+ stateid_t *s_stid = ©->cp_src_stateid;
+@@ -1487,7 +1485,7 @@ nfsd4_setup_inter_ssc(struct svc_rqst *rqstp,
+ if (status)
+ goto out;
+
+- status = nfsd4_interssc_connect(copy->cp_src, rqstp, mount);
++ status = nfsd4_interssc_connect(copy->cp_src, rqstp, ©->ss_nsui);
+ if (status)
+ goto out;
+
+@@ -1505,45 +1503,27 @@ nfsd4_setup_inter_ssc(struct svc_rqst *rqstp,
+ }
+
+ static void
+-nfsd4_cleanup_inter_ssc(struct vfsmount *ss_mnt, struct file *filp,
++nfsd4_cleanup_inter_ssc(struct nfsd4_ssc_umount_item *nsui, struct file *filp,
+ struct nfsd_file *dst)
+ {
+- bool found = false;
+- long timeout;
+- struct nfsd4_ssc_umount_item *tmp;
+- struct nfsd4_ssc_umount_item *ni = NULL;
+ struct nfsd_net *nn = net_generic(dst->nf_net, nfsd_net_id);
++ long timeout = msecs_to_jiffies(nfsd4_ssc_umount_timeout);
+
+ nfs42_ssc_close(filp);
+ nfsd_file_put(dst);
+ fput(filp);
+
+- if (!nn) {
+- mntput(ss_mnt);
+- return;
+- }
+ spin_lock(&nn->nfsd_ssc_lock);
+- timeout = msecs_to_jiffies(nfsd4_ssc_umount_timeout);
+- list_for_each_entry_safe(ni, tmp, &nn->nfsd_ssc_mount_list, nsui_list) {
+- if (ni->nsui_vfsmount->mnt_sb == ss_mnt->mnt_sb) {
+- list_del(&ni->nsui_list);
+- /*
+- * vfsmount can be shared by multiple exports,
+- * decrement refcnt. If the count drops to 1 it
+- * will be unmounted when nsui_expire expires.
+- */
+- refcount_dec(&ni->nsui_refcnt);
+- ni->nsui_expire = jiffies + timeout;
+- list_add_tail(&ni->nsui_list, &nn->nfsd_ssc_mount_list);
+- found = true;
+- break;
+- }
+- }
++ list_del(&nsui->nsui_list);
++ /*
++ * vfsmount can be shared by multiple exports,
++ * decrement refcnt. If the count drops to 1 it
++ * will be unmounted when nsui_expire expires.
++ */
++ refcount_dec(&nsui->nsui_refcnt);
++ nsui->nsui_expire = jiffies + timeout;
++ list_add_tail(&nsui->nsui_list, &nn->nfsd_ssc_mount_list);
+ spin_unlock(&nn->nfsd_ssc_lock);
+- if (!found) {
+- mntput(ss_mnt);
+- return;
+- }
+ }
+
+ #else /* CONFIG_NFSD_V4_2_INTER_SSC */
+@@ -1551,15 +1531,13 @@ nfsd4_cleanup_inter_ssc(struct vfsmount *ss_mnt, struct file *filp,
+ static __be32
+ nfsd4_setup_inter_ssc(struct svc_rqst *rqstp,
+ struct nfsd4_compound_state *cstate,
+- struct nfsd4_copy *copy,
+- struct vfsmount **mount)
++ struct nfsd4_copy *copy)
+ {
+- *mount = NULL;
+ return nfserr_inval;
+ }
+
+ static void
+-nfsd4_cleanup_inter_ssc(struct vfsmount *ss_mnt, struct file *filp,
++nfsd4_cleanup_inter_ssc(struct nfsd4_ssc_umount_item *nsui, struct file *filp,
+ struct nfsd_file *dst)
+ {
+ }
+@@ -1700,7 +1678,7 @@ static void dup_copy_fields(struct nfsd4_copy *src, struct nfsd4_copy *dst)
+ memcpy(dst->cp_src, src->cp_src, sizeof(struct nl4_server));
+ memcpy(&dst->stateid, &src->stateid, sizeof(src->stateid));
+ memcpy(&dst->c_fh, &src->c_fh, sizeof(src->c_fh));
+- dst->ss_mnt = src->ss_mnt;
++ dst->ss_nsui = src->ss_nsui;
+ }
+
+ static void cleanup_async_copy(struct nfsd4_copy *copy)
+@@ -1749,8 +1727,8 @@ static int nfsd4_do_async_copy(void *data)
+ if (nfsd4_ssc_is_inter(copy)) {
+ struct file *filp;
+
+- filp = nfs42_ssc_open(copy->ss_mnt, ©->c_fh,
+- ©->stateid);
++ filp = nfs42_ssc_open(copy->ss_nsui->nsui_vfsmount,
++ ©->c_fh, ©->stateid);
+ if (IS_ERR(filp)) {
+ switch (PTR_ERR(filp)) {
+ case -EBADF:
+@@ -1764,7 +1742,7 @@ static int nfsd4_do_async_copy(void *data)
+ }
+ nfserr = nfsd4_do_copy(copy, filp, copy->nf_dst->nf_file,
+ false);
+- nfsd4_cleanup_inter_ssc(copy->ss_mnt, filp, copy->nf_dst);
++ nfsd4_cleanup_inter_ssc(copy->ss_nsui, filp, copy->nf_dst);
+ } else {
+ nfserr = nfsd4_do_copy(copy, copy->nf_src->nf_file,
+ copy->nf_dst->nf_file, false);
+@@ -1790,8 +1768,7 @@ nfsd4_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
+ status = nfserr_notsupp;
+ goto out;
+ }
+- status = nfsd4_setup_inter_ssc(rqstp, cstate, copy,
+- ©->ss_mnt);
++ status = nfsd4_setup_inter_ssc(rqstp, cstate, copy);
+ if (status)
+ return nfserr_offload_denied;
+ } else {
+diff --git a/fs/nfsd/xdr4.h b/fs/nfsd/xdr4.h
+index 4fd2cf6d1d2dc..510978e602da6 100644
+--- a/fs/nfsd/xdr4.h
++++ b/fs/nfsd/xdr4.h
+@@ -571,7 +571,7 @@ struct nfsd4_copy {
+ struct task_struct *copy_task;
+ refcount_t refcount;
+
+- struct vfsmount *ss_mnt;
++ struct nfsd4_ssc_umount_item *ss_nsui;
+ struct nfs_fh c_fh;
+ nfs4_stateid stateid;
+ };
+diff --git a/include/linux/nfs_ssc.h b/include/linux/nfs_ssc.h
+index 75843c00f326a..22265b1ff0800 100644
+--- a/include/linux/nfs_ssc.h
++++ b/include/linux/nfs_ssc.h
+@@ -53,6 +53,7 @@ static inline void nfs42_ssc_close(struct file *filep)
+ if (nfs_ssc_client_tbl.ssc_nfs4_ops)
+ (*nfs_ssc_client_tbl.ssc_nfs4_ops->sco_close)(filep);
+ }
++#endif
+
+ struct nfsd4_ssc_umount_item {
+ struct list_head nsui_list;
+@@ -66,7 +67,6 @@ struct nfsd4_ssc_umount_item {
+ struct vfsmount *nsui_vfsmount;
+ char nsui_ipaddr[RPC_MAX_ADDRBUFLEN + 1];
+ };
+-#endif
+
+ /*
+ * NFS_FS
+--
+2.39.2
+
--- /dev/null
+From 2b06bd05d64e2884e8a4d1927ac1d8a0be017841 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Feb 2023 13:18:34 -0500
+Subject: nfsd: fix courtesy client with deny mode handling in
+ nfs4_upgrade_open
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jeff Layton <jlayton@kernel.org>
+
+[ Upstream commit dcd779dc46540e174a6ac8d52fbed23593407317 ]
+
+The nested if statements here make no sense, as you can never reach
+"else" branch in the nested statement. Fix the error handling for
+when there is a courtesy client that holds a conflicting deny mode.
+
+Fixes: 3d6942715180 ("NFSD: add support for share reservation conflict to courteous server")
+Reported-by: 張智諺 <cc85nod@gmail.com>
+Signed-off-by: Jeff Layton <jlayton@kernel.org>
+Reviewed-by: Dai Ngo <dai.ngo@oracle.com>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfsd/nfs4state.c | 21 +++++++++++----------
+ 1 file changed, 11 insertions(+), 10 deletions(-)
+
+diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
+index 529de327d6f93..104c258255d62 100644
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -5299,16 +5299,17 @@ nfs4_upgrade_open(struct svc_rqst *rqstp, struct nfs4_file *fp,
+ /* test and set deny mode */
+ spin_lock(&fp->fi_lock);
+ status = nfs4_file_check_deny(fp, open->op_share_deny);
+- if (status == nfs_ok) {
+- if (status != nfserr_share_denied) {
+- set_deny(open->op_share_deny, stp);
+- fp->fi_share_deny |=
+- (open->op_share_deny & NFS4_SHARE_DENY_BOTH);
+- } else {
+- if (nfs4_resolve_deny_conflicts_locked(fp, false,
+- stp, open->op_share_deny, false))
+- status = nfserr_jukebox;
+- }
++ switch (status) {
++ case nfs_ok:
++ set_deny(open->op_share_deny, stp);
++ fp->fi_share_deny |=
++ (open->op_share_deny & NFS4_SHARE_DENY_BOTH);
++ break;
++ case nfserr_share_denied:
++ if (nfs4_resolve_deny_conflicts_locked(fp, false,
++ stp, open->op_share_deny, false))
++ status = nfserr_jukebox;
++ break;
+ }
+ spin_unlock(&fp->fi_lock);
+
+--
+2.39.2
+
--- /dev/null
+From 83ce43f47c61a50f5304dddd43247511bd395065 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Jan 2023 21:34:13 -0800
+Subject: NFSD: fix leaked reference count of nfsd4_ssc_umount_item
+
+From: Dai Ngo <dai.ngo@oracle.com>
+
+[ Upstream commit 34e8f9ec4c9ac235f917747b23a200a5e0ec857b ]
+
+The reference count of nfsd4_ssc_umount_item is not decremented
+on error conditions. This prevents the laundromat from unmounting
+the vfsmount of the source file.
+
+This patch decrements the reference count of nfsd4_ssc_umount_item
+on error.
+
+Fixes: f4e44b393389 ("NFSD: delay unmount source's export after inter-server copy completed.")
+Signed-off-by: Dai Ngo <dai.ngo@oracle.com>
+Reviewed-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfsd/nfs4proc.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
+index dbaf33398c827..e2dde8a1837be 100644
+--- a/fs/nfsd/nfs4proc.c
++++ b/fs/nfsd/nfs4proc.c
+@@ -1814,13 +1814,17 @@ nfsd4_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
+ out:
+ return status;
+ out_err:
++ if (nfsd4_ssc_is_inter(copy)) {
++ /*
++ * Source's vfsmount of inter-copy will be unmounted
++ * by the laundromat. Use copy instead of async_copy
++ * since async_copy->ss_nsui might not be set yet.
++ */
++ refcount_dec(©->ss_nsui->nsui_refcnt);
++ }
+ if (async_copy)
+ cleanup_async_copy(async_copy);
+ status = nfserrno(-ENOMEM);
+- /*
+- * source's vfsmount of inter-copy will be unmounted
+- * by the laundromat
+- */
+ goto out;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From c758400507492d618845711e6afc0f76936933e1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Jan 2023 11:12:29 -0800
+Subject: NFSD: fix problems with cleanup on errors in nfsd4_copy
+
+From: Dai Ngo <dai.ngo@oracle.com>
+
+[ Upstream commit 81e722978ad21072470b73d8f6a50ad62c7d5b7d ]
+
+When nfsd4_copy fails to allocate memory for async_copy->cp_src, or
+nfs4_init_copy_state fails, it calls cleanup_async_copy to do the
+cleanup for the async_copy which causes page fault since async_copy
+is not yet initialized.
+
+This patche rearranges the order of initializing the fields in
+async_copy and adds checks in cleanup_async_copy to skip un-initialized
+fields.
+
+Fixes: ce0887ac96d3 ("NFSD add nfs4 inter ssc to nfsd4_copy")
+Fixes: 87689df69491 ("NFSD: Shrink size of struct nfsd4_copy")
+Signed-off-by: Dai Ngo <dai.ngo@oracle.com>
+Reviewed-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfsd/nfs4proc.c | 12 ++++++++----
+ fs/nfsd/nfs4state.c | 5 +++--
+ 2 files changed, 11 insertions(+), 6 deletions(-)
+
+diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
+index b74cbc9a0e7f3..92674077fc88e 100644
+--- a/fs/nfsd/nfs4proc.c
++++ b/fs/nfsd/nfs4proc.c
+@@ -1685,9 +1685,12 @@ static void cleanup_async_copy(struct nfsd4_copy *copy)
+ {
+ nfs4_free_copy_state(copy);
+ release_copy_files(copy);
+- spin_lock(©->cp_clp->async_lock);
+- list_del(©->copies);
+- spin_unlock(©->cp_clp->async_lock);
++ if (copy->cp_clp) {
++ spin_lock(©->cp_clp->async_lock);
++ if (!list_empty(©->copies))
++ list_del_init(©->copies);
++ spin_unlock(©->cp_clp->async_lock);
++ }
+ nfs4_put_copy(copy);
+ }
+
+@@ -1784,12 +1787,13 @@ nfsd4_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
+ async_copy = kzalloc(sizeof(struct nfsd4_copy), GFP_KERNEL);
+ if (!async_copy)
+ goto out_err;
++ INIT_LIST_HEAD(&async_copy->copies);
++ refcount_set(&async_copy->refcount, 1);
+ async_copy->cp_src = kmalloc(sizeof(*async_copy->cp_src), GFP_KERNEL);
+ if (!async_copy->cp_src)
+ goto out_err;
+ if (!nfs4_init_copy_state(nn, copy))
+ goto out_err;
+- refcount_set(&async_copy->refcount, 1);
+ memcpy(©->cp_res.cb_stateid, ©->cp_stateid.cs_stid,
+ sizeof(copy->cp_res.cb_stateid));
+ dup_copy_fields(copy, async_copy);
+diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
+index c69f27d3adb79..529de327d6f93 100644
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -992,7 +992,6 @@ static int nfs4_init_cp_state(struct nfsd_net *nn, copy_stateid_t *stid,
+
+ stid->cs_stid.si_opaque.so_clid.cl_boot = (u32)nn->boot_time;
+ stid->cs_stid.si_opaque.so_clid.cl_id = nn->s2s_cp_cl_id;
+- stid->cs_type = cs_type;
+
+ idr_preload(GFP_KERNEL);
+ spin_lock(&nn->s2s_cp_lock);
+@@ -1003,6 +1002,7 @@ static int nfs4_init_cp_state(struct nfsd_net *nn, copy_stateid_t *stid,
+ idr_preload_end();
+ if (new_id < 0)
+ return 0;
++ stid->cs_type = cs_type;
+ return 1;
+ }
+
+@@ -1036,7 +1036,8 @@ void nfs4_free_copy_state(struct nfsd4_copy *copy)
+ {
+ struct nfsd_net *nn;
+
+- WARN_ON_ONCE(copy->cp_stateid.cs_type != NFS4_COPY_STID);
++ if (copy->cp_stateid.cs_type != NFS4_COPY_STID)
++ return;
+ nn = net_generic(copy->cp_clp->net, nfsd_net_id);
+ spin_lock(&nn->s2s_cp_lock);
+ idr_remove(&nn->s2s_cp_stateids,
+--
+2.39.2
+
--- /dev/null
+From 815c98cf177a9f93aff21ec8f75b890b83b30cc3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Jan 2023 11:18:56 -0500
+Subject: nfsd: fix race to check ls_layouts
+
+From: Benjamin Coddington <bcodding@redhat.com>
+
+[ Upstream commit fb610c4dbc996415d57d7090957ecddd4fd64fb6 ]
+
+Its possible for __break_lease to find the layout's lease before we've
+added the layout to the owner's ls_layouts list. In that case, setting
+ls_recalled = true without actually recalling the layout will cause the
+server to never send a recall callback.
+
+Move the check for ls_layouts before setting ls_recalled.
+
+Fixes: c5c707f96fc9 ("nfsd: implement pNFS layout recalls")
+Signed-off-by: Benjamin Coddington <bcodding@redhat.com>
+Reviewed-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfsd/nfs4layouts.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/nfsd/nfs4layouts.c b/fs/nfsd/nfs4layouts.c
+index 3564d1c6f6104..e8a80052cb1ba 100644
+--- a/fs/nfsd/nfs4layouts.c
++++ b/fs/nfsd/nfs4layouts.c
+@@ -323,11 +323,11 @@ nfsd4_recall_file_layout(struct nfs4_layout_stateid *ls)
+ if (ls->ls_recalled)
+ goto out_unlock;
+
+- ls->ls_recalled = true;
+- atomic_inc(&ls->ls_stid.sc_file->fi_lo_recalls);
+ if (list_empty(&ls->ls_layouts))
+ goto out_unlock;
+
++ ls->ls_recalled = true;
++ atomic_inc(&ls->ls_stid.sc_file->fi_lo_recalls);
+ trace_nfsd_layout_recall(&ls->ls_stid.sc_stateid);
+
+ refcount_inc(&ls->ls_stid.sc_count);
+--
+2.39.2
+
--- /dev/null
+From 6af4d339b74c79e307c537172663314b9087e931 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Jan 2023 14:38:30 -0500
+Subject: nfsd: zero out pointers after putting nfsd_files on COPY setup error
+
+From: Jeff Layton <jlayton@kernel.org>
+
+[ Upstream commit 1f0001d43d0c0ac2a19a34a914f6595ad97cbc1d ]
+
+At first, I thought this might be a source of nfsd_file overputs, but
+the current callers seem to avoid an extra put when nfsd4_verify_copy
+returns an error.
+
+Still, it's "bad form" to leave the pointers filled out when we don't
+have a reference to them anymore, and that might lead to bugs later.
+Zero them out as a defensive coding measure.
+
+Signed-off-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfsd/nfs4proc.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
+index 92674077fc88e..e02ff76fad82c 100644
+--- a/fs/nfsd/nfs4proc.c
++++ b/fs/nfsd/nfs4proc.c
+@@ -1214,8 +1214,10 @@ nfsd4_verify_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
+ return status;
+ out_put_dst:
+ nfsd_file_put(*dst);
++ *dst = NULL;
+ out_put_src:
+ nfsd_file_put(*src);
++ *src = NULL;
+ goto out;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From fac17019b7f355d2e5e8bbcf398149649b7bb8a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Feb 2023 14:00:58 +0100
+Subject: objtool: add UACCESS exceptions for __tsan_volatile_read/write
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit d5d469247264e56960705dc5ae7e1d014861fe40 ]
+
+A lot of the tsan helpers are already excempt from the UACCESS warnings,
+but some more functions were added that need the same thing:
+
+kernel/kcsan/core.o: warning: objtool: __tsan_volatile_read16+0x0: call to __tsan_unaligned_read16() with UACCESS enabled
+kernel/kcsan/core.o: warning: objtool: __tsan_volatile_write16+0x0: call to __tsan_unaligned_write16() with UACCESS enabled
+vmlinux.o: warning: objtool: __tsan_unaligned_volatile_read16+0x4: call to __tsan_unaligned_read16() with UACCESS enabled
+vmlinux.o: warning: objtool: __tsan_unaligned_volatile_write16+0x4: call to __tsan_unaligned_write16() with UACCESS enabled
+
+As Marco points out, these functions don't even call each other
+explicitly but instead gcc (but not clang) notices the functions
+being identical and turns one symbol into a direct branch to the
+other.
+
+Link: https://lkml.kernel.org/r/20230215130058.3836177-4-arnd@kernel.org
+Fixes: 75d75b7a4d54 ("kcsan: Support distinguishing volatile accesses")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Acked-by: Marco Elver <elver@google.com>
+Cc: Alexander Potapenko <glider@google.com>
+Cc: Andrey Konovalov <andreyknvl@gmail.com>
+Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
+Cc: Dmitry Vyukov <dvyukov@google.com>
+Cc: Josh Poimboeuf <jpoimboe@kernel.org>
+Cc: Kuan-Ying Lee <Kuan-Ying.Lee@mediatek.com>
+Cc: Peter Zijlstra (Intel) <peterz@infradead.org>
+Cc: Vincenzo Frascino <vincenzo.frascino@arm.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/objtool/check.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/tools/objtool/check.c b/tools/objtool/check.c
+index 4b7c8b33069e5..b1a5f658673f0 100644
+--- a/tools/objtool/check.c
++++ b/tools/objtool/check.c
+@@ -1186,6 +1186,8 @@ static const char *uaccess_safe_builtin[] = {
+ "__tsan_atomic64_compare_exchange_val",
+ "__tsan_atomic_thread_fence",
+ "__tsan_atomic_signal_fence",
++ "__tsan_unaligned_read16",
++ "__tsan_unaligned_write16",
+ /* KCOV */
+ "write_comp_data",
+ "check_kcov_mode",
+--
+2.39.2
+
--- /dev/null
+From da0900bc0a63cd3981a3029d402f0888381673d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Feb 2023 12:00:37 +0800
+Subject: OPP: fix error checking in opp_migrate_dentry()
+
+From: Qi Zheng <zhengqi.arch@bytedance.com>
+
+[ Upstream commit eca4c0eea53432ec4b711b2a8ad282cbad231b4f ]
+
+Since commit ff9fb72bc077 ("debugfs: return error values,
+not NULL") changed return value of debugfs_rename() in
+error cases from %NULL to %ERR_PTR(-ERROR), we should
+also check error values instead of NULL.
+
+Fixes: ff9fb72bc077 ("debugfs: return error values, not NULL")
+Signed-off-by: Qi Zheng <zhengqi.arch@bytedance.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/opp/debugfs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/opp/debugfs.c b/drivers/opp/debugfs.c
+index 96a30a032c5f9..2c7fb683441ef 100644
+--- a/drivers/opp/debugfs.c
++++ b/drivers/opp/debugfs.c
+@@ -235,7 +235,7 @@ static void opp_migrate_dentry(struct opp_device *opp_dev,
+
+ dentry = debugfs_rename(rootdir, opp_dev->dentry, rootdir,
+ opp_table->dentry_name);
+- if (!dentry) {
++ if (IS_ERR(dentry)) {
+ dev_err(dev, "%s: Failed to rename link from: %s to %s\n",
+ __func__, dev_name(opp_dev->dev), dev_name(dev));
+ return;
+--
+2.39.2
+
--- /dev/null
+From a48aae1b25cd3f1ad31c3979e8cb3b729eb9e77b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Jan 2023 10:49:07 +0800
+Subject: PCI: endpoint: pci-epf-vntb: Add epf_ntb_mw_bar_clear() num_mws
+ kernel-doc
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit fd858402c6d0a80e0b543886b9f7865c6d76d5d6 ]
+
+8e4bfbe644a6 ("PCI: endpoint: pci-epf-vntb: fix error handle in
+epf_ntb_mw_bar_init()") added a "num_mws" parameter to
+epf_ntb_mw_bar_clear() but failed to add kernel-doc for num_mws.
+
+Add kernel-doc for num_mws on epf_ntb_mw_bar_clear().
+
+Fixes: 8e4bfbe644a6 ("PCI: endpoint: pci-epf-vntb: fix error handle in epf_ntb_mw_bar_init()")
+Link: https://lore.kernel.org/r/20230103024907.293853-1-yangyingliang@huawei.com
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/endpoint/functions/pci-epf-vntb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/pci/endpoint/functions/pci-epf-vntb.c b/drivers/pci/endpoint/functions/pci-epf-vntb.c
+index 04698e7995a54..b7c7a8af99f4f 100644
+--- a/drivers/pci/endpoint/functions/pci-epf-vntb.c
++++ b/drivers/pci/endpoint/functions/pci-epf-vntb.c
+@@ -652,6 +652,7 @@ static int epf_ntb_mw_bar_init(struct epf_ntb *ntb)
+ /**
+ * epf_ntb_mw_bar_clear() - Clear Memory window BARs
+ * @ntb: NTB device that facilitates communication between HOST and VHOST
++ * @num_mws: the number of Memory window BARs that to be cleared
+ */
+ static void epf_ntb_mw_bar_clear(struct epf_ntb *ntb, int num_mws)
+ {
+--
+2.39.2
+
--- /dev/null
+From 05b286d27438731517be1f428fb647ab5dd35d15 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Feb 2023 14:46:39 +0100
+Subject: PCI: Fix dropping valid root bus resources with .end = zero
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 9d8ba74a181b1c81def21168795ed96cbe6f05ed ]
+
+On r8a7791/koelsch:
+
+ kmemleak: 1 new suspected memory leaks (see /sys/kernel/debug/kmemleak)
+ # cat /sys/kernel/debug/kmemleak
+ unreferenced object 0xc3a34e00 (size 64):
+ comm "swapper/0", pid 1, jiffies 4294937460 (age 199.080s)
+ hex dump (first 32 bytes):
+ b4 5d 81 f0 b4 5d 81 f0 c0 b0 a2 c3 00 00 00 00 .]...]..........
+ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
+ backtrace:
+ [<fe3aa979>] __kmalloc+0xf0/0x140
+ [<34bd6bc0>] resource_list_create_entry+0x18/0x38
+ [<767046bc>] pci_add_resource_offset+0x20/0x68
+ [<b3f3edf2>] devm_of_pci_get_host_bridge_resources.constprop.0+0xb0/0x390
+
+When coalescing two resources for a contiguous aperture, the second
+resource is enlarged to cover the full contiguous range, while the first
+resource is marked invalid. This invalidation is done by clearing the
+flags, start, and end members.
+
+When adding the initial resources to the bus later, invalid resources are
+skipped. Unfortunately, the check for an invalid resource considers only
+the end member, causing false positives.
+
+E.g. on r8a7791/koelsch, root bus resource 0 ("bus 00") is skipped, and no
+longer registered with pci_bus_insert_busn_res() (causing the memory leak),
+nor printed:
+
+ pci-rcar-gen2 ee090000.pci: host bridge /soc/pci@ee090000 ranges:
+ pci-rcar-gen2 ee090000.pci: MEM 0x00ee080000..0x00ee08ffff -> 0x00ee080000
+ pci-rcar-gen2 ee090000.pci: PCI: revision 11
+ pci-rcar-gen2 ee090000.pci: PCI host bridge to bus 0000:00
+ -pci_bus 0000:00: root bus resource [bus 00]
+ pci_bus 0000:00: root bus resource [mem 0xee080000-0xee08ffff]
+
+Fix this by only skipping resources where all of the flags, start, and end
+members are zero.
+
+Fixes: 7c3855c423b17f6c ("PCI: Coalesce host bridge contiguous apertures")
+Link: https://lore.kernel.org/r/da0fcd5e86c74239be79c7cb03651c0fce31b515.1676036673.git.geert+renesas@glider.be
+Tested-by: Niklas Schnelle <schnelle@linux.ibm.com>
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Acked-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/probe.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
+index 1779582fb5007..5988584825482 100644
+--- a/drivers/pci/probe.c
++++ b/drivers/pci/probe.c
+@@ -996,7 +996,7 @@ static int pci_register_host_bridge(struct pci_host_bridge *bridge)
+ resource_list_for_each_entry_safe(window, n, &resources) {
+ offset = window->offset;
+ res = window->res;
+- if (!res->end)
++ if (!res->flags && !res->start && !res->end)
+ continue;
+
+ list_move_tail(&window->node, &bridge->windows);
+--
+2.39.2
+
--- /dev/null
+From dc6ff5b2b7093958a533e192c23b12a7bc051954 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 18 Dec 2022 06:33:47 +0300
+Subject: PCI/IOV: Enlarge virtfn sysfs name buffer
+
+From: Alexey V. Vissarionov <gremlin@altlinux.org>
+
+[ Upstream commit ea0b5aa5f184cf8293c93163f0fb00505190d431 ]
+
+The sysfs link name "virtfn%u" constructed by pci_iov_sysfs_link() requires
+17 bytes to contain the longest possible string. Increase VIRTFN_ID_LEN to
+accommodate that.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+[bhelgaas: commit log, comment at #define]
+Fixes: dd7cc44d0bce ("PCI: add SR-IOV API for Physical Function driver")
+Link: https://lore.kernel.org/r/20221218033347.23743-1-gremlin@altlinux.org
+Signed-off-by: Alexey V. Vissarionov <gremlin@altlinux.org>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/iov.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pci/iov.c b/drivers/pci/iov.c
+index 952217572113c..b2e8322755c17 100644
+--- a/drivers/pci/iov.c
++++ b/drivers/pci/iov.c
+@@ -14,7 +14,7 @@
+ #include <linux/delay.h>
+ #include "pci.h"
+
+-#define VIRTFN_ID_LEN 16
++#define VIRTFN_ID_LEN 17 /* "virtfn%u\0" for 2^32 - 1 */
+
+ int pci_iov_virtfn_bus(struct pci_dev *dev, int vf_id)
+ {
+--
+2.39.2
+
--- /dev/null
+From ff9ba7b4e6f7c80327cad693ad71b6928246c8d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 31 Dec 2022 08:40:41 +0100
+Subject: PCI: mt7621: Delay phy ports initialization
+
+From: Sergio Paracuellos <sergio.paracuellos@gmail.com>
+
+[ Upstream commit 0cb2a8f3456ff1cc51d571e287a48e8fddc98ec2 ]
+
+Some devices like ZBT WE1326 and ZBT WF3526-P and some Netgear models need
+to delay phy port initialization after calling the mt7621_pcie_init_port()
+driver function to get into reliable boots for both warm and hard resets.
+
+The delay required to detect the ports seems to be in the range [75-100]
+milliseconds.
+
+If the ports are not detected the controller is not functional.
+
+There is no datasheet or something similar to really understand why this
+extra delay is needed only for these devices and it is not for most of
+the boards that are built on mt7621 SoC.
+
+This issue has been reported by openWRT community and the complete
+discussion is in [0]. The 100 milliseconds delay has been tested in all
+devices to validate it.
+
+Add the extra 100 milliseconds delay to fix the issue.
+
+[0]: https://github.com/openwrt/openwrt/pull/11220
+
+Link: https://lore.kernel.org/r/20221231074041.264738-1-sergio.paracuellos@gmail.com
+Fixes: 2bdd5238e756 ("PCI: mt7621: Add MediaTek MT7621 PCIe host controller driver")
+Signed-off-by: Sergio Paracuellos <sergio.paracuellos@gmail.com>
+Signed-off-by: Lorenzo Pieralisi <lpieralisi@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/pcie-mt7621.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/pci/controller/pcie-mt7621.c b/drivers/pci/controller/pcie-mt7621.c
+index ee7aad09d6277..63a5f4463a9f6 100644
+--- a/drivers/pci/controller/pcie-mt7621.c
++++ b/drivers/pci/controller/pcie-mt7621.c
+@@ -60,6 +60,7 @@
+ #define PCIE_PORT_LINKUP BIT(0)
+ #define PCIE_PORT_CNT 3
+
++#define INIT_PORTS_DELAY_MS 100
+ #define PERST_DELAY_MS 100
+
+ /**
+@@ -369,6 +370,7 @@ static int mt7621_pcie_init_ports(struct mt7621_pcie *pcie)
+ }
+ }
+
++ msleep(INIT_PORTS_DELAY_MS);
+ mt7621_pcie_reset_ep_deassert(pcie);
+
+ tmp = NULL;
+--
+2.39.2
+
--- /dev/null
+From 92752157825dc6ce95bb0b603fbaee26cf5aa0a8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Oct 2022 13:47:04 +0200
+Subject: PCI: qcom: Fix host-init error handling
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+[ Upstream commit 997e010de9134474dbfde52be03efd7d1bce902d ]
+
+Implement the new host_deinit() callback so that the PHY is powered off
+and regulators and clocks are disabled also on late host-init errors.
+
+Link: https://lore.kernel.org/r/20221017114705.8277-2-johan+linaro@kernel.org
+Fixes: 82a823833f4e ("PCI: qcom: Add Qualcomm PCIe controller driver")
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Signed-off-by: Lorenzo Pieralisi <lpieralisi@kernel.org>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Manivannan Sadhasivam <mani@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/dwc/pcie-qcom.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pci/controller/dwc/pcie-qcom.c b/drivers/pci/controller/dwc/pcie-qcom.c
+index 77e5dc7b88ad4..7e23c74fb4230 100644
+--- a/drivers/pci/controller/dwc/pcie-qcom.c
++++ b/drivers/pci/controller/dwc/pcie-qcom.c
+@@ -1534,8 +1534,19 @@ static int qcom_pcie_host_init(struct dw_pcie_rp *pp)
+ return ret;
+ }
+
++static void qcom_pcie_host_deinit(struct dw_pcie_rp *pp)
++{
++ struct dw_pcie *pci = to_dw_pcie_from_pp(pp);
++ struct qcom_pcie *pcie = to_qcom_pcie(pci);
++
++ qcom_ep_reset_assert(pcie);
++ phy_power_off(pcie->phy);
++ pcie->cfg->ops->deinit(pcie);
++}
++
+ static const struct dw_pcie_host_ops qcom_pcie_dw_ops = {
+- .host_init = qcom_pcie_host_init,
++ .host_init = qcom_pcie_host_init,
++ .host_deinit = qcom_pcie_host_deinit,
+ };
+
+ /* Qcom IP rev.: 2.1.0 Synopsys IP rev.: 4.01a */
+--
+2.39.2
+
--- /dev/null
+From f9d651203fad43f55762c0e5e28210c81a361056 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Dec 2022 10:21:26 -0600
+Subject: PCI: switchtec: Return -EFAULT for copy_to_user() errors
+
+From: Bjorn Helgaas <bhelgaas@google.com>
+
+[ Upstream commit ddc10938e08cd7aac63d8385f7305f7889df5179 ]
+
+switchtec_dev_read() didn't handle copy_to_user() errors correctly: it
+assigned "rc = -EFAULT", but actually returned either "size", -ENXIO, or
+-EBADMSG instead.
+
+Update the failure cases to unlock mrpc_mutex and return -EFAULT directly.
+
+Link: https://lore.kernel.org/r/20221216162126.207863-3-helgaas@kernel.org
+Fixes: 080b47def5e5 ("MicroSemi Switchtec management interface driver")
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Logan Gunthorpe <logang@deltatee.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/switch/switchtec.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/pci/switch/switchtec.c b/drivers/pci/switch/switchtec.c
+index 75be4fe225090..0c1faa6c1973a 100644
+--- a/drivers/pci/switch/switchtec.c
++++ b/drivers/pci/switch/switchtec.c
+@@ -606,21 +606,20 @@ static ssize_t switchtec_dev_read(struct file *filp, char __user *data,
+ rc = copy_to_user(data, &stuser->return_code,
+ sizeof(stuser->return_code));
+ if (rc) {
+- rc = -EFAULT;
+- goto out;
++ mutex_unlock(&stdev->mrpc_mutex);
++ return -EFAULT;
+ }
+
+ data += sizeof(stuser->return_code);
+ rc = copy_to_user(data, &stuser->data,
+ size - sizeof(stuser->return_code));
+ if (rc) {
+- rc = -EFAULT;
+- goto out;
++ mutex_unlock(&stdev->mrpc_mutex);
++ return -EFAULT;
+ }
+
+ stuser_set_state(stuser, MRPC_IDLE);
+
+-out:
+ mutex_unlock(&stdev->mrpc_mutex);
+
+ if (stuser->status == SWITCHTEC_MRPC_STATUS_DONE ||
+--
+2.39.2
+
--- /dev/null
+From 5ea53bd193e861ab41c8320f02625031ff939a9e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Jan 2023 18:33:47 -0800
+Subject: perf inject: Use perf_data__read() for auxtrace
+
+From: Namhyung Kim <namhyung@kernel.org>
+
+[ Upstream commit 1746212daeba95e9ae1639227dc0c3591d41deeb ]
+
+In copy_bytes(), it reads the data from the (input) fd and writes it to
+the output file. But it does with the read(2) unconditionally which
+caused a problem of mixing buffered vs unbuffered I/O together.
+
+You can see the problem when using pipes.
+
+ $ perf record -e intel_pt// -o- true | perf inject -b > /dev/null
+ [ perf record: Woken up 1 times to write data ]
+ [ perf record: Captured and wrote 0.000 MB - ]
+ 0x45c0 [0x30]: failed to process type: 71
+
+It should use perf_data__read() to honor the 'use_stdio' setting.
+
+Fixes: 601366678c93618f ("perf data: Allow to use stdio functions for pipe mode")
+Reviewed-by: Adrian Hunter <adrian.hunter@intel.com>
+Reviewed-by: James Clark <james.clark@arm.com>
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Ingo Molnar <mingo@kernel.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Leo Yan <leo.yan@linaro.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Stephane Eranian <eranian@google.com>
+Link: https://lore.kernel.org/r/20230131023350.1903992-2-namhyung@kernel.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/builtin-inject.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/tools/perf/builtin-inject.c b/tools/perf/builtin-inject.c
+index 3f4e4dd5abf31..f8182417b7341 100644
+--- a/tools/perf/builtin-inject.c
++++ b/tools/perf/builtin-inject.c
+@@ -215,14 +215,14 @@ static int perf_event__repipe_event_update(struct perf_tool *tool,
+
+ #ifdef HAVE_AUXTRACE_SUPPORT
+
+-static int copy_bytes(struct perf_inject *inject, int fd, off_t size)
++static int copy_bytes(struct perf_inject *inject, struct perf_data *data, off_t size)
+ {
+ char buf[4096];
+ ssize_t ssz;
+ int ret;
+
+ while (size > 0) {
+- ssz = read(fd, buf, min(size, (off_t)sizeof(buf)));
++ ssz = perf_data__read(data, buf, min(size, (off_t)sizeof(buf)));
+ if (ssz < 0)
+ return -errno;
+ ret = output_bytes(inject, buf, ssz);
+@@ -260,7 +260,7 @@ static s64 perf_event__repipe_auxtrace(struct perf_session *session,
+ ret = output_bytes(inject, event, event->header.size);
+ if (ret < 0)
+ return ret;
+- ret = copy_bytes(inject, perf_data__fd(session->data),
++ ret = copy_bytes(inject, session->data,
+ event->auxtrace.size);
+ } else {
+ ret = output_bytes(inject, event,
+--
+2.39.2
+
--- /dev/null
+From 1c6371170f1d04c4874851ebf639187f1fb717e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Jan 2023 18:33:48 -0800
+Subject: perf intel-pt: Do not try to queue auxtrace data on pipe
+
+From: Namhyung Kim <namhyung@kernel.org>
+
+[ Upstream commit aeb802f872a7c42e4381f36041e77d1745908255 ]
+
+When it processes AUXTRACE_INFO, it calls to auxtrace_queue_data() to
+collect AUXTRACE data first. That won't work with pipe since it needs
+lseek() to read the scattered aux data.
+
+ $ perf record -o- -e intel_pt// true | perf report -i- --itrace=i100
+ # To display the perf.data header info, please use --header/--header-only options.
+ #
+ 0x4118 [0xa0]: failed to process type: 70
+ Error:
+ failed to process sample
+
+For the pipe mode, it can handle the aux data as it gets. But there's
+no guarantee it can get the aux data in time. So the following warning
+will be shown at the beginning:
+
+ WARNING: Intel PT with pipe mode is not recommended.
+ The output cannot relied upon. In particular,
+ time stamps and the order of events may be incorrect.
+
+Fixes: dbd134322e74f19d ("perf intel-pt: Add support for decoding AUX area samples")
+Reviewed-by: Adrian Hunter <adrian.hunter@intel.com>
+Reviewed-by: James Clark <james.clark@arm.com>
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Ingo Molnar <mingo@kernel.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Leo Yan <leo.yan@linaro.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Stephane Eranian <eranian@google.com>
+Link: https://lore.kernel.org/r/20230131023350.1903992-3-namhyung@kernel.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/Documentation/perf-intel-pt.txt | 30 ++++++++++++++++++++++
+ tools/perf/util/auxtrace.c | 3 +++
+ tools/perf/util/intel-pt.c | 6 +++++
+ 3 files changed, 39 insertions(+)
+
+diff --git a/tools/perf/Documentation/perf-intel-pt.txt b/tools/perf/Documentation/perf-intel-pt.txt
+index 7b6ccd2fa3bf1..9d485a9cdb198 100644
+--- a/tools/perf/Documentation/perf-intel-pt.txt
++++ b/tools/perf/Documentation/perf-intel-pt.txt
+@@ -1821,6 +1821,36 @@ Can be compiled and traced:
+ $
+
+
++Pipe mode
++---------
++Pipe mode is a problem for Intel PT and possibly other auxtrace users.
++It's not recommended to use a pipe as data output with Intel PT because
++of the following reason.
++
++Essentially the auxtrace buffers do not behave like the regular perf
++event buffers. That is because the head and tail are updated by
++software, but in the auxtrace case the data is written by hardware.
++So the head and tail do not get updated as data is written.
++
++In the Intel PT case, the head and tail are updated only when the trace
++is disabled by software, for example:
++ - full-trace, system wide : when buffer passes watermark
++ - full-trace, not system-wide : when buffer passes watermark or
++ context switches
++ - snapshot mode : as above but also when a snapshot is made
++ - sample mode : as above but also when a sample is made
++
++That means finished-round ordering doesn't work. An auxtrace buffer
++can turn up that has data that extends back in time, possibly to the
++very beginning of tracing.
++
++For a perf.data file, that problem is solved by going through the trace
++and queuing up the auxtrace buffers in advance.
++
++For pipe mode, the order of events and timestamps can presumably
++be messed up.
++
++
+ EXAMPLE
+ -------
+
+diff --git a/tools/perf/util/auxtrace.c b/tools/perf/util/auxtrace.c
+index c2e323cd7d496..d4b04fa07a119 100644
+--- a/tools/perf/util/auxtrace.c
++++ b/tools/perf/util/auxtrace.c
+@@ -1133,6 +1133,9 @@ int auxtrace_queue_data(struct perf_session *session, bool samples, bool events)
+ if (auxtrace__dont_decode(session))
+ return 0;
+
++ if (perf_data__is_pipe(session->data))
++ return 0;
++
+ if (!session->auxtrace || !session->auxtrace->queue_data)
+ return -EINVAL;
+
+diff --git a/tools/perf/util/intel-pt.c b/tools/perf/util/intel-pt.c
+index 6d3921627e332..b8b29756fbf13 100644
+--- a/tools/perf/util/intel-pt.c
++++ b/tools/perf/util/intel-pt.c
+@@ -4379,6 +4379,12 @@ int intel_pt_process_auxtrace_info(union perf_event *event,
+
+ intel_pt_setup_pebs_events(pt);
+
++ if (perf_data__is_pipe(session->data)) {
++ pr_warning("WARNING: Intel PT with pipe mode is not recommended.\n"
++ " The output cannot relied upon. In particular,\n"
++ " timestamps and the order of events may be incorrect.\n");
++ }
++
+ if (pt->sampling_mode || list_empty(&session->auxtrace_index))
+ err = auxtrace_queue_data(session, true, true);
+ else
+--
+2.39.2
+
--- /dev/null
+From 1b813a4e98f7a1828c7ec650329627604ba1ceae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Jan 2023 15:36:43 -0800
+Subject: perf jevents: Correct bad character encoding
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit d2e3dc829e389d686194d06f0a64adda4158faae ]
+
+A character encoding issue added a "3D" character that breaks the
+metrics test.
+
+Fixes: 40769665b63d8c84 ("perf jevents: Parse metrics during conversion")
+Reviewed-by: Kajol Jain <kjain@linux.ibm.com>
+Signed-off-by: Ian Rogers <irogers@google.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Caleb Biggers <caleb.biggers@intel.com>
+Cc: Florian Fischer <florian.fischer@muhq.space>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: James Clark <james.clark@arm.com>
+Cc: Jing Zhang <renyu.zj@linux.alibaba.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: John Garry <john.g.garry@oracle.com>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Kang Minchul <tegongkang@gmail.com>
+Cc: Kim Phillips <kim.phillips@amd.com>
+Cc: Leo Yan <leo.yan@linaro.org>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Mike Leach <mike.leach@linaro.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Perry Taylor <perry.taylor@intel.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Ravi Bangoria <ravi.bangoria@amd.com>
+Cc: Rob Herring <robh@kernel.org>
+Cc: Sandipan Das <sandipan.das@amd.com>
+Cc: Stephane Eranian <eranian@google.com>
+Cc: Will Deacon <will@kernel.org>
+Cc: Xing Zhengjun <zhengjun.xing@linux.intel.com>
+Cc: linux-arm-kernel@lists.infradead.org
+Cc: linuxppc-dev@lists.ozlabs.org
+Link: https://lore.kernel.org/r/20230126233645.200509-14-irogers@google.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/pmu-events/metric_test.py | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/perf/pmu-events/metric_test.py b/tools/perf/pmu-events/metric_test.py
+index 15315d0f716ca..6980f452df0ad 100644
+--- a/tools/perf/pmu-events/metric_test.py
++++ b/tools/perf/pmu-events/metric_test.py
+@@ -87,8 +87,8 @@ class TestMetricExpressions(unittest.TestCase):
+ after = r'min((a + b if c > 1 else c + d), e + f)'
+ self.assertEqual(ParsePerfJson(before).ToPerfJson(), after)
+
+- before =3D r'a if b else c if d else e'
+- after =3D r'(a if b else (c if d else e))'
++ before = r'a if b else c if d else e'
++ after = r'(a if b else (c if d else e))'
+ self.assertEqual(ParsePerfJson(before).ToPerfJson(), after)
+
+ def test_ToPython(self):
+--
+2.39.2
+
--- /dev/null
+From 41da7d3c816471c51c1618a1aab4413481251305 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Jan 2023 00:26:09 -0800
+Subject: perf llvm: Fix inadvertent file creation
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit 9f19aab47ced012eddef1e2bc96007efc7713b61 ]
+
+The LLVM template is first echo-ed into command_out and then
+command_out executed. The echo surrounds the template with double
+quotes, however, the template itself may contain quotes. This is
+generally innocuous but in tools/perf/tests/bpf-script-test-prologue.c
+we see:
+...
+SEC("func=null_lseek file->f_mode offset orig")
+...
+where the first double quote ends the double quote of the echo, then
+the > redirects output into a file called f_mode.
+
+To avoid this inadvertent behavior substitute redirects and similar
+characters to be ASCII control codes, then substitute the output in
+the echo back again.
+
+Fixes: 5eab5a7ee032acaa ("perf llvm: Display eBPF compiling command in debug output")
+Signed-off-by: Ian Rogers <irogers@google.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Andrii Nakryiko <andrii@kernel.org>
+Cc: bpf@vger.kernel.org
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: llvm@lists.linux.dev
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Nathan Chancellor <nathan@kernel.org>
+Cc: Nick Desaulniers <ndesaulniers@google.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Tom Rix <trix@redhat.com>
+Link: https://lore.kernel.org/r/20230105082609.344538-1-irogers@google.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/llvm-utils.c | 25 ++++++++++++++++++++++++-
+ 1 file changed, 24 insertions(+), 1 deletion(-)
+
+diff --git a/tools/perf/util/llvm-utils.c b/tools/perf/util/llvm-utils.c
+index 650ffe336f3aa..4e8e243a6e4bd 100644
+--- a/tools/perf/util/llvm-utils.c
++++ b/tools/perf/util/llvm-utils.c
+@@ -531,14 +531,37 @@ int llvm__compile_bpf(const char *path, void **p_obj_buf,
+
+ pr_debug("llvm compiling command template: %s\n", template);
+
++ /*
++ * Below, substitute control characters for values that can cause the
++ * echo to misbehave, then substitute the values back.
++ */
+ err = -ENOMEM;
+- if (asprintf(&command_echo, "echo -n \"%s\"", template) < 0)
++ if (asprintf(&command_echo, "echo -n \a%s\a", template) < 0)
+ goto errout;
+
++#define SWAP_CHAR(a, b) do { if (*p == a) *p = b; } while (0)
++ for (char *p = command_echo; *p; p++) {
++ SWAP_CHAR('<', '\001');
++ SWAP_CHAR('>', '\002');
++ SWAP_CHAR('"', '\003');
++ SWAP_CHAR('\'', '\004');
++ SWAP_CHAR('|', '\005');
++ SWAP_CHAR('&', '\006');
++ SWAP_CHAR('\a', '"');
++ }
+ err = read_from_pipe(command_echo, (void **) &command_out, NULL);
+ if (err)
+ goto errout;
+
++ for (char *p = command_out; *p; p++) {
++ SWAP_CHAR('\001', '<');
++ SWAP_CHAR('\002', '>');
++ SWAP_CHAR('\003', '"');
++ SWAP_CHAR('\004', '\'');
++ SWAP_CHAR('\005', '|');
++ SWAP_CHAR('\006', '&');
++ }
++#undef SWAP_CHAR
+ pr_debug("llvm compiling command : %s\n", command_out);
+
+ err = read_from_pipe(template, &obj_buf, &obj_buf_sz);
+--
+2.39.2
+
--- /dev/null
+From a6887ba3e105c1f9952d7676075593b41eeeca10 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Feb 2023 12:23:24 +0000
+Subject: perf record: Fix segfault with --overwrite and --max-size
+
+From: Yang Jihong <yangjihong1@huawei.com>
+
+[ Upstream commit 91621be65d6812cd74b2ea09573ff9ee0cbf5666 ]
+
+When --overwrite and --max-size options of perf record are used
+together, a segmentation fault occurs. The following is an example:
+
+ # perf record -e sched:sched* --overwrite --max-size 1K -a -- sleep 1
+ [ perf record: Woken up 1 times to write data ]
+ perf: Segmentation fault
+ Obtained 12 stack frames.
+ ./perf/perf(+0x197673) [0x55f99710b673]
+ /lib/x86_64-linux-gnu/libc.so.6(+0x3ef0f) [0x7fa45f3cff0f]
+ ./perf/perf(+0x8eb40) [0x55f997002b40]
+ ./perf/perf(+0x1f6882) [0x55f99716a882]
+ ./perf/perf(+0x794c2) [0x55f996fed4c2]
+ ./perf/perf(+0x7b7c7) [0x55f996fef7c7]
+ ./perf/perf(+0x9074b) [0x55f99700474b]
+ ./perf/perf(+0x12e23c) [0x55f9970a223c]
+ ./perf/perf(+0x12e54a) [0x55f9970a254a]
+ ./perf/perf(+0x7db60) [0x55f996ff1b60]
+ /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xe6) [0x7fa45f3b2c86]
+ ./perf/perf(+0x7dfe9) [0x55f996ff1fe9]
+ Segmentation fault (core dumped)
+
+backtrace of the core file is as follows:
+
+ (gdb) bt
+ #0 record__bytes_written (rec=0x55f99755a200 <record>) at builtin-record.c:234
+ #1 record__output_max_size_exceeded (rec=0x55f99755a200 <record>) at builtin-record.c:242
+ #2 record__write (map=0x0, size=12816, bf=0x55f9978da2e0, rec=0x55f99755a200 <record>) at builtin-record.c:263
+ #3 process_synthesized_event (tool=tool@entry=0x55f99755a200 <record>, event=event@entry=0x55f9978da2e0, sample=sample@entry=0x0, machine=machine@entry=0x55f997893658) at builtin-record.c:618
+ #4 0x000055f99716a883 in __perf_event__synthesize_id_index (tool=tool@entry=0x55f99755a200 <record>, process=process@entry=0x55f997002aa0 <process_synthesized_event>, evlist=0x55f9978928b0, machine=machine@entry=0x55f997893658,
+ from=from@entry=0) at util/synthetic-events.c:1895
+ #5 0x000055f99716a91f in perf_event__synthesize_id_index (tool=tool@entry=0x55f99755a200 <record>, process=process@entry=0x55f997002aa0 <process_synthesized_event>, evlist=<optimized out>, machine=machine@entry=0x55f997893658)
+ at util/synthetic-events.c:1905
+ #6 0x000055f996fed4c3 in record__synthesize (tail=tail@entry=true, rec=0x55f99755a200 <record>) at builtin-record.c:1997
+ #7 0x000055f996fef7c8 in __cmd_record (argc=argc@entry=2, argv=argv@entry=0x7ffc67551260, rec=0x55f99755a200 <record>) at builtin-record.c:2802
+ #8 0x000055f99700474c in cmd_record (argc=<optimized out>, argv=0x7ffc67551260) at builtin-record.c:4258
+ #9 0x000055f9970a223d in run_builtin (p=0x55f997564d88 <commands+264>, argc=10, argv=0x7ffc67551260) at perf.c:330
+ #10 0x000055f9970a254b in handle_internal_command (argc=10, argv=0x7ffc67551260) at perf.c:384
+ #11 0x000055f996ff1b61 in run_argv (argcp=<synthetic pointer>, argv=<synthetic pointer>) at perf.c:428
+ #12 main (argc=<optimized out>, argv=0x7ffc67551260) at perf.c:562
+
+The reason is that record__bytes_written accesses the freed memory rec->thread_data,
+The process is as follows:
+ __cmd_record
+ -> record__free_thread_data
+ -> zfree(&rec->thread_data) // free rec->thread_data
+ -> record__synthesize
+ -> perf_event__synthesize_id_index
+ -> process_synthesized_event
+ -> record__write
+ -> record__bytes_written // access rec->thread_data
+
+We add a member variable "thread_bytes_written" in the struct "record"
+to save the data size written by the threads.
+
+Fixes: 6d57581659f72299 ("perf record: Add support for limit perf output file size")
+Signed-off-by: Yang Jihong <yangjihong1@huawei.com>
+Acked-by: Namhyung Kim <namhyung@kernel.org>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Jiwei Sun <jiwei.sun@windriver.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Link: https://lore.kernel.org/r/CAM9d7ci_TRrqBQVQNW8=GwakUr7SsZpYxaaty-S4bxF8zJWyqw@mail.gmail.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/builtin-record.c | 16 ++++++----------
+ 1 file changed, 6 insertions(+), 10 deletions(-)
+
+diff --git a/tools/perf/builtin-record.c b/tools/perf/builtin-record.c
+index 29dcd454b8e21..8374117e66f6e 100644
+--- a/tools/perf/builtin-record.c
++++ b/tools/perf/builtin-record.c
+@@ -154,6 +154,7 @@ struct record {
+ struct perf_tool tool;
+ struct record_opts opts;
+ u64 bytes_written;
++ u64 thread_bytes_written;
+ struct perf_data data;
+ struct auxtrace_record *itr;
+ struct evlist *evlist;
+@@ -226,14 +227,7 @@ static bool switch_output_time(struct record *rec)
+
+ static u64 record__bytes_written(struct record *rec)
+ {
+- int t;
+- u64 bytes_written = rec->bytes_written;
+- struct record_thread *thread_data = rec->thread_data;
+-
+- for (t = 0; t < rec->nr_threads; t++)
+- bytes_written += thread_data[t].bytes_written;
+-
+- return bytes_written;
++ return rec->bytes_written + rec->thread_bytes_written;
+ }
+
+ static bool record__output_max_size_exceeded(struct record *rec)
+@@ -255,10 +249,12 @@ static int record__write(struct record *rec, struct mmap *map __maybe_unused,
+ return -1;
+ }
+
+- if (map && map->file)
++ if (map && map->file) {
+ thread->bytes_written += size;
+- else
++ rec->thread_bytes_written += size;
++ } else {
+ rec->bytes_written += size;
++ }
+
+ if (record__output_max_size_exceeded(rec) && !done) {
+ fprintf(stderr, "[ perf record: perf size limit reached (%" PRIu64 " KB),"
+--
+2.39.2
+
--- /dev/null
+From 3aaa350ca1f93282545e116db397adea7992781c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Feb 2023 22:44:47 -0800
+Subject: perf stat: Avoid merging/aggregating metric counts twice
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit 37f322cd58d81a9d46456531281c908de9ef6e42 ]
+
+The added perf_stat_merge_counters combines uncore counters. When
+metrics are enabled, the counts are merged into a metric_leader via the
+stat-shadow saved_value logic. As the leader now is passed an aggregated
+count, it leads to all counters being added together twice and counts
+appearing approximately doubled in metrics.
+
+This change disables the saved_value merging of counts for evsels that
+are merged. It is recommended that later changes remove the saved_value
+entirely as the two layers of aggregation in the code is confusing.
+
+Fixes: 942c5593393d9418 ("perf stat: Add perf_stat_merge_counters()")
+Reported-by: Perry Taylor <perry.taylor@intel.com>
+Signed-off-by: Ian Rogers <irogers@google.com>
+Acked-by: Namhyung Kim <namhyung@kernel.org>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Eduard Zingerman <eddyz87@gmail.com>
+Cc: Florian Fischer <florian.fischer@muhq.space>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: James Clark <james.clark@arm.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Stephane Eranian <eranian@google.com>
+Cc: Xing Zhengjun <zhengjun.xing@linux.intel.com>
+Link: https://lore.kernel.org/r/20230209064447.83733-1-irogers@google.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/stat-shadow.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/util/stat-shadow.c b/tools/perf/util/stat-shadow.c
+index cadb2df23c878..4cd05d9205e3b 100644
+--- a/tools/perf/util/stat-shadow.c
++++ b/tools/perf/util/stat-shadow.c
+@@ -311,7 +311,7 @@ void perf_stat__update_shadow_stats(struct evsel *counter, u64 count,
+ update_stats(&v->stats, count);
+ if (counter->metric_leader)
+ v->metric_total += count;
+- } else if (counter->metric_leader) {
++ } else if (counter->metric_leader && !counter->merged_stat) {
+ v = saved_value_lookup(counter->metric_leader,
+ map_idx, true, STAT_NONE, 0, st, rsd.cgrp);
+ v->metric_total += count;
+--
+2.39.2
+
--- /dev/null
+From fc99d2c1b10ec62268dac2c4c6bb4e93b8c57f3f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Jan 2023 11:24:31 -0800
+Subject: perf stat: Hide invalid uncore event output for aggr mode
+
+From: Namhyung Kim <namhyung@kernel.org>
+
+[ Upstream commit dd15480a3d67b9cf04a1f6f5d60f1c0dc018e22f ]
+
+The current display code for perf stat iterates given cpus and build the
+aggr map to collect the event data for the aggregation mode.
+
+But uncore events have their own cpu maps and it won't guarantee that
+it'd match to the aggr map. For example, per-package uncore events
+would generate a single value for each socket. When user asks per-core
+aggregation mode, the output would contain 0 values for other cores.
+
+Thus it needs to check the uncore PMU's cpumask and if it matches to the
+current aggregation id.
+
+Before:
+ $ sudo ./perf stat -a --per-core -e power/energy-pkg/ sleep 1
+
+ Performance counter stats for 'system wide':
+
+ S0-D0-C0 1 3.73 Joules power/energy-pkg/
+ S0-D0-C1 0 <not counted> Joules power/energy-pkg/
+ S0-D0-C2 0 <not counted> Joules power/energy-pkg/
+ S0-D0-C3 0 <not counted> Joules power/energy-pkg/
+
+ 1.001404046 seconds time elapsed
+
+ Some events weren't counted. Try disabling the NMI watchdog:
+ echo 0 > /proc/sys/kernel/nmi_watchdog
+ perf stat ...
+ echo 1 > /proc/sys/kernel/nmi_watchdog
+
+The core 1, 2 and 3 should not be printed because the event is handled
+in a cpu in the core 0 only. With this change, the output becomes like
+below.
+
+After:
+ $ sudo ./perf stat -a --per-core -e power/energy-pkg/ sleep 1
+
+ Performance counter stats for 'system wide':
+
+ S0-D0-C0 1 2.09 Joules power/energy-pkg/
+
+Fixes: b897613510890d6e ("perf stat: Update event skip condition for system-wide per-thread mode and merged uncore and hybrid events")
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Tested-by: Ian Rogers <irogers@google.com>
+Acked-by: Ian Rogers <irogers@google.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
+Cc: Ingo Molnar <mingo@kernel.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Michael Petlan <mpetlan@redhat.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Link: https://lore.kernel.org/r/20230125192431.2929677-1-namhyung@kernel.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/stat-display.c | 51 ++++++++++++++++++++++++++++++----
+ 1 file changed, 46 insertions(+), 5 deletions(-)
+
+diff --git a/tools/perf/util/stat-display.c b/tools/perf/util/stat-display.c
+index 8bd8b0142630c..1b5cb20efd237 100644
+--- a/tools/perf/util/stat-display.c
++++ b/tools/perf/util/stat-display.c
+@@ -787,6 +787,51 @@ static void uniquify_counter(struct perf_stat_config *config, struct evsel *coun
+ uniquify_event_name(counter);
+ }
+
++/**
++ * should_skip_zero_count() - Check if the event should print 0 values.
++ * @config: The perf stat configuration (including aggregation mode).
++ * @counter: The evsel with its associated cpumap.
++ * @id: The aggregation id that is being queried.
++ *
++ * Due to mismatch between the event cpumap or thread-map and the
++ * aggregation mode, sometimes it'd iterate the counter with the map
++ * which does not contain any values.
++ *
++ * For example, uncore events have dedicated CPUs to manage them,
++ * result for other CPUs should be zero and skipped.
++ *
++ * Return: %true if the value should NOT be printed, %false if the value
++ * needs to be printed like "<not counted>" or "<not supported>".
++ */
++static bool should_skip_zero_counter(struct perf_stat_config *config,
++ struct evsel *counter,
++ const struct aggr_cpu_id *id)
++{
++ struct perf_cpu cpu;
++ int idx;
++
++ /*
++ * Skip value 0 when enabling --per-thread globally,
++ * otherwise it will have too many 0 output.
++ */
++ if (config->aggr_mode == AGGR_THREAD && config->system_wide)
++ return true;
++ /*
++ * Skip value 0 when it's an uncore event and the given aggr id
++ * does not belong to the PMU cpumask.
++ */
++ if (!counter->pmu || !counter->pmu->is_uncore)
++ return false;
++
++ perf_cpu_map__for_each_cpu(cpu, idx, counter->pmu->cpus) {
++ struct aggr_cpu_id own_id = config->aggr_get_id(config, cpu);
++
++ if (aggr_cpu_id__equal(id, &own_id))
++ return false;
++ }
++ return true;
++}
++
+ static void print_counter_aggrdata(struct perf_stat_config *config,
+ struct evsel *counter, int s,
+ struct outstate *os)
+@@ -814,11 +859,7 @@ static void print_counter_aggrdata(struct perf_stat_config *config,
+ ena = aggr->counts.ena;
+ run = aggr->counts.run;
+
+- /*
+- * Skip value 0 when enabling --per-thread globally, otherwise it will
+- * have too many 0 output.
+- */
+- if (val == 0 && config->aggr_mode == AGGR_THREAD && config->system_wide)
++ if (val == 0 && should_skip_zero_counter(config, counter, &id))
+ return;
+
+ if (!metric_only) {
+--
+2.39.2
+
--- /dev/null
+From f8c18173615dc0e65a9adb85a498307af8c432bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Jan 2023 17:47:42 +0530
+Subject: perf test bpf: Skip test if kernel-debuginfo is not present
+
+From: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
+
+[ Upstream commit 34266f904abd45731bdade2e92d0536c092ee9bc ]
+
+Perf BPF filter test fails in environment where "kernel-debuginfo"
+is not installed.
+
+Test failure logs:
+
+ <<>>
+ 42: BPF filter :
+ 42.1: Basic BPF filtering : Ok
+ 42.2: BPF pinning : Ok
+ 42.3: BPF prologue generation : FAILED!
+ <<>>
+
+Enabling verbose option provided debug logs, which says debuginfo
+needs to be installed. Snippet of verbose logs:
+
+ <<>>
+ 42.3: BPF prologue generation :
+ --- start ---
+ test child forked, pid 28218
+ <<>>
+ Rebuild with CONFIG_DEBUG_INFO=y, or install an appropriate debuginfo
+ package.
+ bpf_probe: failed to convert perf probe events
+ Failed to add events selected by BPF
+ test child finished with -1
+ ---- end ----
+ BPF filter subtest 3: FAILED!
+ <<>>
+
+Here the subtest "BPF prologue generation" failed and logs shows
+debuginfo is needed. After installing kernel-debuginfo package, testcase
+passes.
+
+The "BPF prologue generation" subtest failed because, the do_test()
+returns TEST_FAIL without checking the error type returned by
+parse_events_load_bpf_obj().
+
+parse_events_load_bpf_obj() can also return error of type -ENODATA
+incase kernel-debuginfo package is not installed. Fix this by adding
+check for -ENODATA error.
+
+Test result after the patch changes:
+
+Test failure logs:
+
+ <<>>
+ 42: BPF filter :
+ 42.1: Basic BPF filtering : Ok
+ 42.2: BPF pinning : Ok
+ 42.3: BPF prologue generation : Skip (clang/debuginfo isn't installed or environment missing BPF support)
+ <<>>
+
+Fixes: ba1fae431e74bb42 ("perf test: Add 'perf test BPF'")
+Signed-off-by: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Disha Goel <disgoel@linux.ibm.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: James Clark <james.clark@arm.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kajol Jain <kjain@linux.ibm.com>
+Cc: Madhavan Srinivasan <maddy@linux.vnet.ibm.com>
+Cc: Michael Ellerman <mpe@ellerman.id.au>
+Cc: Nageswara R Sastry <rnsastry@linux.ibm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Wang Nan <wangnan0@huawei.com>
+Cc: linuxppc-dev@lists.ozlabs.org
+Link: http://lore.kernel.org/linux-perf-users/Y7bIk77mdE4j8Jyi@kernel.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/tests/bpf.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/tools/perf/tests/bpf.c b/tools/perf/tests/bpf.c
+index 17c023823713d..6a4235a9cf57e 100644
+--- a/tools/perf/tests/bpf.c
++++ b/tools/perf/tests/bpf.c
+@@ -126,6 +126,10 @@ static int do_test(struct bpf_object *obj, int (*func)(void),
+
+ err = parse_events_load_bpf_obj(&parse_state, &parse_state.list, obj, NULL);
+ parse_events_error__exit(&parse_error);
++ if (err == -ENODATA) {
++ pr_debug("Failed to add events selected by BPF, debuginfo package not installed\n");
++ return TEST_SKIP;
++ }
+ if (err || list_empty(&parse_state.list)) {
+ pr_debug("Failed to add events selected by BPF\n");
+ return TEST_FAIL;
+@@ -368,7 +372,7 @@ static struct test_case bpf_tests[] = {
+ "clang isn't installed or environment missing BPF support"),
+ #ifdef HAVE_BPF_PROLOGUE
+ TEST_CASE_REASON("BPF prologue generation", bpf_prologue_test,
+- "clang isn't installed or environment missing BPF support"),
++ "clang/debuginfo isn't installed or environment missing BPF support"),
+ #else
+ TEST_CASE_REASON("BPF prologue generation", bpf_prologue_test, "not compiled in"),
+ #endif
+--
+2.39.2
+
--- /dev/null
+From b03c4dc46316472c023f2da83799b58b8ebaad0e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Feb 2023 15:08:27 +0530
+Subject: perf tests stat_all_metrics: Change true workload to sleep workload
+ for system wide check
+
+From: Kajol Jain <kjain@linux.ibm.com>
+
+[ Upstream commit f9fa0778ee7349a9aa3d2ea10e9f2ab843a0b44e ]
+
+Testcase stat_all_metrics.sh fails in powerpc:
+
+98: perf all metrics test : FAILED!
+
+Logs with verbose:
+
+ [command]# ./perf test 98 -vv
+ 98: perf all metrics test :
+ --- start ---
+ test child forked, pid 13262
+ Testing BRU_STALL_CPI
+ Testing COMPLETION_STALL_CPI
+ ----
+ Testing TOTAL_LOCAL_NODE_PUMPS_P23
+ Metric 'TOTAL_LOCAL_NODE_PUMPS_P23' not printed in:
+ Error:
+ Invalid event (hv_24x7/PM_PB_LNS_PUMP23,chip=3/) in per-thread mode, enable system wide with '-a'.
+ Testing TOTAL_LOCAL_NODE_PUMPS_RETRIES_P01
+ Metric 'TOTAL_LOCAL_NODE_PUMPS_RETRIES_P01' not printed in:
+ Error:
+ Invalid event (hv_24x7/PM_PB_RTY_LNS_PUMP01,chip=3/) in per-thread mode, enable system wide with '-a'.
+ ----
+
+Based on above logs, we could see some of the hv-24x7 metric events
+fails, and logs suggest to run the metric event with -a option. This
+change happened after the commit a4b8cfcabb1d90ec ("perf stat: Delay
+metric parsing"), which delayed the metric parsing phase and now before
+metric parsing phase perf tool identifies, whether target is system-wide
+or not. With this change, perf_event_open will fails with workload
+monitoring for uncore events as expected.
+
+The perf all metric test case fails as some of the hv-24x7 metric events
+may need bigger workload with system wide monitoring to get the data.
+Fix this issue by changing current system wide check from true workload
+to sleep 0.01 workload.
+
+Result with the patch changes in powerpc:
+
+ 98: perf all metrics test : Ok
+
+Fixes: a4b8cfcabb1d90ec ("perf stat: Delay metric parsing")
+Suggested-by: Ian Rogers <irogers@google.com>
+Reviewed-by: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
+Signed-off-by: Kajol Jain <kjain@linux.ibm.com>
+Tested-by: Disha Goel <disgoel@linux.ibm.com>
+Tested-by: Ian Rogers <irogers@google.com>
+Cc: Madhavan Srinivasan <maddy@linux.ibm.com>
+Cc: Nageswara R Sastry <rnsastry@linux.ibm.com>
+Cc: linuxppc-dev@lists.ozlabs.org
+Link: https://lore.kernel.org/r/20230215093827.124921-1-kjain@linux.ibm.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/tests/shell/stat_all_metrics.sh | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/tests/shell/stat_all_metrics.sh b/tools/perf/tests/shell/stat_all_metrics.sh
+index 6e79349e42bef..22e9cb294b40e 100755
+--- a/tools/perf/tests/shell/stat_all_metrics.sh
++++ b/tools/perf/tests/shell/stat_all_metrics.sh
+@@ -11,7 +11,7 @@ for m in $(perf list --raw-dump metrics); do
+ continue
+ fi
+ # Failed so try system wide.
+- result=$(perf stat -M "$m" -a true 2>&1)
++ result=$(perf stat -M "$m" -a sleep 0.01 2>&1)
+ if [[ "$result" =~ "${m:0:50}" ]]
+ then
+ continue
+--
+2.39.2
+
--- /dev/null
+From a5f6d89a6cf6c0a487c66c21b4672dd427a4295a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Feb 2023 11:50:57 +0800
+Subject: perf tools: Fix auto-complete on aarch64
+
+From: Yicong Yang <yangyicong@hisilicon.com>
+
+[ Upstream commit ffd1240e8f0814262ceb957dbe961f6e0aef1e7a ]
+
+On aarch64 CPU related events are not under event_source/devices/cpu/events,
+they're under event_source/devices/armv8_pmuv3_0/events on my machine.
+Using current auto-complete script will generate below error:
+
+ [root@localhost bin]# perf stat -e
+ ls: cannot access '/sys/bus/event_source/devices/cpu/events': No such file or directory
+
+Fix this by not testing /sys/bus/event_source/devices/cpu/events on
+aarch64 machine.
+
+Fixes: 74cd5815d9af6e6c ("perf tool: Improve bash command line auto-complete for multiple events with comma")
+Reviewed-by: James Clark <james.clark@arm.com>
+Signed-off-by: Yicong Yang <yangyicong@hisilicon.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jin Yao <yao.jin@linux.intel.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: linux-arm-kernel@lists.infradead.org
+Cc: linuxarm@huawei.com
+Cc: prime.zeng@hisilicon.com
+Link: https://lore.kernel.org/r/20230207035057.43394-1-yangyicong@huawei.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/perf-completion.sh | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/tools/perf/perf-completion.sh b/tools/perf/perf-completion.sh
+index fdf75d45efff7..978249d7868c2 100644
+--- a/tools/perf/perf-completion.sh
++++ b/tools/perf/perf-completion.sh
+@@ -165,7 +165,12 @@ __perf_main ()
+
+ local cur1=${COMP_WORDS[COMP_CWORD]}
+ local raw_evts=$($cmd list --raw-dump)
+- local arr s tmp result
++ local arr s tmp result cpu_evts
++
++ # aarch64 doesn't have /sys/bus/event_source/devices/cpu/events
++ if [[ `uname -m` != aarch64 ]]; then
++ cpu_evts=$(ls /sys/bus/event_source/devices/cpu/events)
++ fi
+
+ if [[ "$cur1" == */* && ${cur1#*/} =~ ^[A-Z] ]]; then
+ OLD_IFS="$IFS"
+@@ -183,9 +188,9 @@ __perf_main ()
+ fi
+ done
+
+- evts=${result}" "$(ls /sys/bus/event_source/devices/cpu/events)
++ evts=${result}" "${cpu_evts}
+ else
+- evts=${raw_evts}" "$(ls /sys/bus/event_source/devices/cpu/events)
++ evts=${raw_evts}" "${cpu_evts}
+ fi
+
+ if [[ "$cur1" == , ]]; then
+--
+2.39.2
+
--- /dev/null
+From 6ac7d2184e381df10246a5bd6fa6c80d63d66ec6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Jan 2023 12:49:25 -0800
+Subject: perf/x86/intel/ds: Fix the conversion from TSC to perf time
+
+From: Kan Liang <kan.liang@linux.intel.com>
+
+[ Upstream commit 89e97eb8cec0f1af5ebf2380308913256ca7915a ]
+
+The time order is incorrect when the TSC in a PEBS record is used.
+
+ $perf record -e cycles:upp dd if=/dev/zero of=/dev/null
+ count=10000
+ $ perf script --show-task-events
+ perf-exec 0 0.000000: PERF_RECORD_COMM: perf-exec:915/915
+ dd 915 106.479872: PERF_RECORD_COMM exec: dd:915/915
+ dd 915 106.483270: PERF_RECORD_EXIT(915:915):(914:914)
+ dd 915 106.512429: 1 cycles:upp:
+ ffffffff96c011b7 [unknown] ([unknown])
+ ... ...
+
+The perf time is from sched_clock_cpu(). The current PEBS code
+unconditionally convert the TSC to native_sched_clock(). There is a
+shift between the two clocks. If the TSC is stable, the shift is
+consistent, __sched_clock_offset. If the TSC is unstable, the shift has
+to be calculated at runtime.
+
+This patch doesn't support the conversion when the TSC is unstable. The
+TSC unstable case is a corner case and very unlikely to happen. If it
+happens, the TSC in a PEBS record will be dropped and fall back to
+perf_event_clock().
+
+Fixes: 47a3aeb39e8d ("perf/x86/intel/pebs: Fix PEBS timestamps overwritten")
+Reported-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Kan Liang <kan.liang@linux.intel.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://lore.kernel.org/all/CAM9d7cgWDVAq8-11RbJ2uGfwkKD6fA-OMwOKDrNUrU_=8MgEjg@mail.gmail.com/
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/events/intel/ds.c | 35 ++++++++++++++++++++++++++---------
+ 1 file changed, 26 insertions(+), 9 deletions(-)
+
+diff --git a/arch/x86/events/intel/ds.c b/arch/x86/events/intel/ds.c
+index 88e58b6ee73c0..91b214231e03c 100644
+--- a/arch/x86/events/intel/ds.c
++++ b/arch/x86/events/intel/ds.c
+@@ -2,12 +2,14 @@
+ #include <linux/bitops.h>
+ #include <linux/types.h>
+ #include <linux/slab.h>
++#include <linux/sched/clock.h>
+
+ #include <asm/cpu_entry_area.h>
+ #include <asm/perf_event.h>
+ #include <asm/tlbflush.h>
+ #include <asm/insn.h>
+ #include <asm/io.h>
++#include <asm/timer.h>
+
+ #include "../perf_event.h"
+
+@@ -1519,6 +1521,27 @@ static u64 get_data_src(struct perf_event *event, u64 aux)
+ return val;
+ }
+
++static void setup_pebs_time(struct perf_event *event,
++ struct perf_sample_data *data,
++ u64 tsc)
++{
++ /* Converting to a user-defined clock is not supported yet. */
++ if (event->attr.use_clockid != 0)
++ return;
++
++ /*
++ * Doesn't support the conversion when the TSC is unstable.
++ * The TSC unstable case is a corner case and very unlikely to
++ * happen. If it happens, the TSC in a PEBS record will be
++ * dropped and fall back to perf_event_clock().
++ */
++ if (!using_native_sched_clock() || !sched_clock_stable())
++ return;
++
++ data->time = native_sched_clock_from_tsc(tsc) + __sched_clock_offset;
++ data->sample_flags |= PERF_SAMPLE_TIME;
++}
++
+ #define PERF_SAMPLE_ADDR_TYPE (PERF_SAMPLE_ADDR | \
+ PERF_SAMPLE_PHYS_ADDR | \
+ PERF_SAMPLE_DATA_PAGE_SIZE)
+@@ -1668,11 +1691,8 @@ static void setup_pebs_fixed_sample_data(struct perf_event *event,
+ *
+ * We can only do this for the default trace clock.
+ */
+- if (x86_pmu.intel_cap.pebs_format >= 3 &&
+- event->attr.use_clockid == 0) {
+- data->time = native_sched_clock_from_tsc(pebs->tsc);
+- data->sample_flags |= PERF_SAMPLE_TIME;
+- }
++ if (x86_pmu.intel_cap.pebs_format >= 3)
++ setup_pebs_time(event, data, pebs->tsc);
+
+ if (has_branch_stack(event)) {
+ data->br_stack = &cpuc->lbr_stack;
+@@ -1735,10 +1755,7 @@ static void setup_pebs_adaptive_sample_data(struct perf_event *event,
+ perf_sample_data_init(data, 0, event->hw.last_period);
+ data->period = event->hw.last_period;
+
+- if (event->attr.use_clockid == 0) {
+- data->time = native_sched_clock_from_tsc(basic->tsc);
+- data->sample_flags |= PERF_SAMPLE_TIME;
+- }
++ setup_pebs_time(event, data, basic->tsc);
+
+ /*
+ * We must however always use iregs for the unwinder to stay sane; the
+--
+2.39.2
+
--- /dev/null
+From 3a3c9f21324b7686949b1e4b518aec6a259b4cc5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Feb 2023 11:02:38 -0800
+Subject: perf/x86/intel/uncore: Add Meteor Lake support
+
+From: Kan Liang <kan.liang@linux.intel.com>
+
+[ Upstream commit c828441f21ddc819a28b5723a72e3c840e9de1c6 ]
+
+The uncore subsystem for Meteor Lake is similar to the previous Alder
+Lake. The main difference is that MTL provides PMU support for different
+tiles, while ADL only provides PMU support for the whole package. On
+ADL, there are CBOX, ARB, and clockbox uncore PMON units. On MTL, they
+are split into CBOX/HAC_CBOX, ARB/HAC_ARB, and cncu/sncu which provides
+a fixed counter for clockticks. Also, new MSR addresses are introduced
+on MTL.
+
+The IMC uncore PMON is the same as Alder Lake. Add new PCIIDs of IMC for
+Meteor Lake.
+
+Signed-off-by: Kan Liang <kan.liang@linux.intel.com>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Link: https://lore.kernel.org/r/20230210190238.1726237-1-kan.liang@linux.intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/events/intel/uncore.c | 7 ++
+ arch/x86/events/intel/uncore.h | 1 +
+ arch/x86/events/intel/uncore_snb.c | 161 +++++++++++++++++++++++++++++
+ 3 files changed, 169 insertions(+)
+
+diff --git a/arch/x86/events/intel/uncore.c b/arch/x86/events/intel/uncore.c
+index 459b1aafd4d4a..27b34f5b87600 100644
+--- a/arch/x86/events/intel/uncore.c
++++ b/arch/x86/events/intel/uncore.c
+@@ -1765,6 +1765,11 @@ static const struct intel_uncore_init_fun adl_uncore_init __initconst = {
+ .mmio_init = adl_uncore_mmio_init,
+ };
+
++static const struct intel_uncore_init_fun mtl_uncore_init __initconst = {
++ .cpu_init = mtl_uncore_cpu_init,
++ .mmio_init = adl_uncore_mmio_init,
++};
++
+ static const struct intel_uncore_init_fun icx_uncore_init __initconst = {
+ .cpu_init = icx_uncore_cpu_init,
+ .pci_init = icx_uncore_pci_init,
+@@ -1832,6 +1837,8 @@ static const struct x86_cpu_id intel_uncore_match[] __initconst = {
+ X86_MATCH_INTEL_FAM6_MODEL(RAPTORLAKE, &adl_uncore_init),
+ X86_MATCH_INTEL_FAM6_MODEL(RAPTORLAKE_P, &adl_uncore_init),
+ X86_MATCH_INTEL_FAM6_MODEL(RAPTORLAKE_S, &adl_uncore_init),
++ X86_MATCH_INTEL_FAM6_MODEL(METEORLAKE, &mtl_uncore_init),
++ X86_MATCH_INTEL_FAM6_MODEL(METEORLAKE_L, &mtl_uncore_init),
+ X86_MATCH_INTEL_FAM6_MODEL(SAPPHIRERAPIDS_X, &spr_uncore_init),
+ X86_MATCH_INTEL_FAM6_MODEL(EMERALDRAPIDS_X, &spr_uncore_init),
+ X86_MATCH_INTEL_FAM6_MODEL(ATOM_TREMONT_D, &snr_uncore_init),
+diff --git a/arch/x86/events/intel/uncore.h b/arch/x86/events/intel/uncore.h
+index e278e2e7c051a..305a54d88beee 100644
+--- a/arch/x86/events/intel/uncore.h
++++ b/arch/x86/events/intel/uncore.h
+@@ -602,6 +602,7 @@ void skl_uncore_cpu_init(void);
+ void icl_uncore_cpu_init(void);
+ void tgl_uncore_cpu_init(void);
+ void adl_uncore_cpu_init(void);
++void mtl_uncore_cpu_init(void);
+ void tgl_uncore_mmio_init(void);
+ void tgl_l_uncore_mmio_init(void);
+ void adl_uncore_mmio_init(void);
+diff --git a/arch/x86/events/intel/uncore_snb.c b/arch/x86/events/intel/uncore_snb.c
+index 1f4869227efb9..7fd4334e12a17 100644
+--- a/arch/x86/events/intel/uncore_snb.c
++++ b/arch/x86/events/intel/uncore_snb.c
+@@ -109,6 +109,19 @@
+ #define PCI_DEVICE_ID_INTEL_RPL_23_IMC 0xA728
+ #define PCI_DEVICE_ID_INTEL_RPL_24_IMC 0xA729
+ #define PCI_DEVICE_ID_INTEL_RPL_25_IMC 0xA72A
++#define PCI_DEVICE_ID_INTEL_MTL_1_IMC 0x7d00
++#define PCI_DEVICE_ID_INTEL_MTL_2_IMC 0x7d01
++#define PCI_DEVICE_ID_INTEL_MTL_3_IMC 0x7d02
++#define PCI_DEVICE_ID_INTEL_MTL_4_IMC 0x7d05
++#define PCI_DEVICE_ID_INTEL_MTL_5_IMC 0x7d10
++#define PCI_DEVICE_ID_INTEL_MTL_6_IMC 0x7d14
++#define PCI_DEVICE_ID_INTEL_MTL_7_IMC 0x7d15
++#define PCI_DEVICE_ID_INTEL_MTL_8_IMC 0x7d16
++#define PCI_DEVICE_ID_INTEL_MTL_9_IMC 0x7d21
++#define PCI_DEVICE_ID_INTEL_MTL_10_IMC 0x7d22
++#define PCI_DEVICE_ID_INTEL_MTL_11_IMC 0x7d23
++#define PCI_DEVICE_ID_INTEL_MTL_12_IMC 0x7d24
++#define PCI_DEVICE_ID_INTEL_MTL_13_IMC 0x7d28
+
+
+ #define IMC_UNCORE_DEV(a) \
+@@ -205,6 +218,32 @@
+ #define ADL_UNC_ARB_PERFEVTSEL0 0x2FD0
+ #define ADL_UNC_ARB_MSR_OFFSET 0x8
+
++/* MTL Cbo register */
++#define MTL_UNC_CBO_0_PER_CTR0 0x2448
++#define MTL_UNC_CBO_0_PERFEVTSEL0 0x2442
++
++/* MTL HAC_ARB register */
++#define MTL_UNC_HAC_ARB_CTR 0x2018
++#define MTL_UNC_HAC_ARB_CTRL 0x2012
++
++/* MTL ARB register */
++#define MTL_UNC_ARB_CTR 0x2418
++#define MTL_UNC_ARB_CTRL 0x2412
++
++/* MTL cNCU register */
++#define MTL_UNC_CNCU_FIXED_CTR 0x2408
++#define MTL_UNC_CNCU_FIXED_CTRL 0x2402
++#define MTL_UNC_CNCU_BOX_CTL 0x240e
++
++/* MTL sNCU register */
++#define MTL_UNC_SNCU_FIXED_CTR 0x2008
++#define MTL_UNC_SNCU_FIXED_CTRL 0x2002
++#define MTL_UNC_SNCU_BOX_CTL 0x200e
++
++/* MTL HAC_CBO register */
++#define MTL_UNC_HBO_CTR 0x2048
++#define MTL_UNC_HBO_CTRL 0x2042
++
+ DEFINE_UNCORE_FORMAT_ATTR(event, event, "config:0-7");
+ DEFINE_UNCORE_FORMAT_ATTR(umask, umask, "config:8-15");
+ DEFINE_UNCORE_FORMAT_ATTR(chmask, chmask, "config:8-11");
+@@ -598,6 +637,115 @@ void adl_uncore_cpu_init(void)
+ uncore_msr_uncores = adl_msr_uncores;
+ }
+
++static struct intel_uncore_type mtl_uncore_cbox = {
++ .name = "cbox",
++ .num_counters = 2,
++ .perf_ctr_bits = 48,
++ .perf_ctr = MTL_UNC_CBO_0_PER_CTR0,
++ .event_ctl = MTL_UNC_CBO_0_PERFEVTSEL0,
++ .event_mask = ADL_UNC_RAW_EVENT_MASK,
++ .msr_offset = SNB_UNC_CBO_MSR_OFFSET,
++ .ops = &icl_uncore_msr_ops,
++ .format_group = &adl_uncore_format_group,
++};
++
++static struct intel_uncore_type mtl_uncore_hac_arb = {
++ .name = "hac_arb",
++ .num_counters = 2,
++ .num_boxes = 2,
++ .perf_ctr_bits = 48,
++ .perf_ctr = MTL_UNC_HAC_ARB_CTR,
++ .event_ctl = MTL_UNC_HAC_ARB_CTRL,
++ .event_mask = ADL_UNC_RAW_EVENT_MASK,
++ .msr_offset = SNB_UNC_CBO_MSR_OFFSET,
++ .ops = &icl_uncore_msr_ops,
++ .format_group = &adl_uncore_format_group,
++};
++
++static struct intel_uncore_type mtl_uncore_arb = {
++ .name = "arb",
++ .num_counters = 2,
++ .num_boxes = 2,
++ .perf_ctr_bits = 48,
++ .perf_ctr = MTL_UNC_ARB_CTR,
++ .event_ctl = MTL_UNC_ARB_CTRL,
++ .event_mask = ADL_UNC_RAW_EVENT_MASK,
++ .msr_offset = SNB_UNC_CBO_MSR_OFFSET,
++ .ops = &icl_uncore_msr_ops,
++ .format_group = &adl_uncore_format_group,
++};
++
++static struct intel_uncore_type mtl_uncore_hac_cbox = {
++ .name = "hac_cbox",
++ .num_counters = 2,
++ .num_boxes = 2,
++ .perf_ctr_bits = 48,
++ .perf_ctr = MTL_UNC_HBO_CTR,
++ .event_ctl = MTL_UNC_HBO_CTRL,
++ .event_mask = ADL_UNC_RAW_EVENT_MASK,
++ .msr_offset = SNB_UNC_CBO_MSR_OFFSET,
++ .ops = &icl_uncore_msr_ops,
++ .format_group = &adl_uncore_format_group,
++};
++
++static void mtl_uncore_msr_init_box(struct intel_uncore_box *box)
++{
++ wrmsrl(uncore_msr_box_ctl(box), SNB_UNC_GLOBAL_CTL_EN);
++}
++
++static struct intel_uncore_ops mtl_uncore_msr_ops = {
++ .init_box = mtl_uncore_msr_init_box,
++ .disable_event = snb_uncore_msr_disable_event,
++ .enable_event = snb_uncore_msr_enable_event,
++ .read_counter = uncore_msr_read_counter,
++};
++
++static struct intel_uncore_type mtl_uncore_cncu = {
++ .name = "cncu",
++ .num_counters = 1,
++ .num_boxes = 1,
++ .box_ctl = MTL_UNC_CNCU_BOX_CTL,
++ .fixed_ctr_bits = 48,
++ .fixed_ctr = MTL_UNC_CNCU_FIXED_CTR,
++ .fixed_ctl = MTL_UNC_CNCU_FIXED_CTRL,
++ .single_fixed = 1,
++ .event_mask = SNB_UNC_CTL_EV_SEL_MASK,
++ .format_group = &icl_uncore_clock_format_group,
++ .ops = &mtl_uncore_msr_ops,
++ .event_descs = icl_uncore_events,
++};
++
++static struct intel_uncore_type mtl_uncore_sncu = {
++ .name = "sncu",
++ .num_counters = 1,
++ .num_boxes = 1,
++ .box_ctl = MTL_UNC_SNCU_BOX_CTL,
++ .fixed_ctr_bits = 48,
++ .fixed_ctr = MTL_UNC_SNCU_FIXED_CTR,
++ .fixed_ctl = MTL_UNC_SNCU_FIXED_CTRL,
++ .single_fixed = 1,
++ .event_mask = SNB_UNC_CTL_EV_SEL_MASK,
++ .format_group = &icl_uncore_clock_format_group,
++ .ops = &mtl_uncore_msr_ops,
++ .event_descs = icl_uncore_events,
++};
++
++static struct intel_uncore_type *mtl_msr_uncores[] = {
++ &mtl_uncore_cbox,
++ &mtl_uncore_hac_arb,
++ &mtl_uncore_arb,
++ &mtl_uncore_hac_cbox,
++ &mtl_uncore_cncu,
++ &mtl_uncore_sncu,
++ NULL
++};
++
++void mtl_uncore_cpu_init(void)
++{
++ mtl_uncore_cbox.num_boxes = icl_get_cbox_num();
++ uncore_msr_uncores = mtl_msr_uncores;
++}
++
+ enum {
+ SNB_PCI_UNCORE_IMC,
+ };
+@@ -1264,6 +1412,19 @@ static const struct pci_device_id tgl_uncore_pci_ids[] = {
+ IMC_UNCORE_DEV(RPL_23),
+ IMC_UNCORE_DEV(RPL_24),
+ IMC_UNCORE_DEV(RPL_25),
++ IMC_UNCORE_DEV(MTL_1),
++ IMC_UNCORE_DEV(MTL_2),
++ IMC_UNCORE_DEV(MTL_3),
++ IMC_UNCORE_DEV(MTL_4),
++ IMC_UNCORE_DEV(MTL_5),
++ IMC_UNCORE_DEV(MTL_6),
++ IMC_UNCORE_DEV(MTL_7),
++ IMC_UNCORE_DEV(MTL_8),
++ IMC_UNCORE_DEV(MTL_9),
++ IMC_UNCORE_DEV(MTL_10),
++ IMC_UNCORE_DEV(MTL_11),
++ IMC_UNCORE_DEV(MTL_12),
++ IMC_UNCORE_DEV(MTL_13),
+ { /* end: all zeroes */ }
+ };
+
+--
+2.39.2
+
--- /dev/null
+From b53b22a153f7231eb2c2de2733cd1b36c87a38a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Jan 2023 16:43:41 +0800
+Subject: phy: mediatek: remove temporary variable @mask_
+
+From: Chunfeng Yun <chunfeng.yun@mediatek.com>
+
+[ Upstream commit 49094d928618309877c50e589f23e639a3b0c453 ]
+
+Remove the temporary @mask_, this may cause build warning when use clang
+compiler for powerpc, but can't reproduce it when compile for arm64.
+the build warning is caused by:
+
+"warning: result of comparison of constant 18446744073709551615 with
+expression of type (aka 'unsigned long') is always false
+[-Wtautological-constant-out-of-range-compare]"
+
+More information provided in below lore link.
+
+After removing @mask_, there is a "CHECK:MACRO_ARG_REUSE" when run
+checkpatch.pl, but due to @mask is constant, no reuse problem will happen.
+
+Link: https://lore.kernel.org/lkml/202212160357.jJuesD8n-lkp@intel.com/t/
+Fixes: 84513eccd678 ("phy: mediatek: fix build warning of FIELD_PREP()")
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Chunfeng Yun <chunfeng.yun@mediatek.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20230118084343.26913-1-chunfeng.yun@mediatek.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/mediatek/phy-mtk-io.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/phy/mediatek/phy-mtk-io.h b/drivers/phy/mediatek/phy-mtk-io.h
+index d20ad5e5be814..58f06db822cb0 100644
+--- a/drivers/phy/mediatek/phy-mtk-io.h
++++ b/drivers/phy/mediatek/phy-mtk-io.h
+@@ -39,8 +39,8 @@ static inline void mtk_phy_update_bits(void __iomem *reg, u32 mask, u32 val)
+ /* field @mask shall be constant and continuous */
+ #define mtk_phy_update_field(reg, mask, val) \
+ ({ \
+- typeof(mask) mask_ = (mask); \
+- mtk_phy_update_bits(reg, mask_, FIELD_PREP(mask_, val)); \
++ BUILD_BUG_ON_MSG(!__builtin_constant_p(mask), "mask is not constant"); \
++ mtk_phy_update_bits(reg, mask, FIELD_PREP(mask, val)); \
+ })
+
+ #endif
+--
+2.39.2
+
--- /dev/null
+From fc384c88b952a3e1ea91be5c15f92a466bafe18b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Jan 2023 00:10:12 +0000
+Subject: phy: rockchip-typec: fix tcphy_get_mode error case
+
+From: Neill Kapron <nkapron@google.com>
+
+[ Upstream commit 4ca651df07183e29cdad7272255e23aec0169a1b ]
+
+The existing logic in tcphy_get_mode() can cause the phy to be
+incorrectly configured to USB UFP or DisplayPort mode when
+extcon_get_state returns an error code.
+
+extcon_get_state() can return 0, 1, or a negative error code.
+
+It is possible to get into the failing state with an extcon driver
+which does not support the extcon connector id specified as the
+second argument to extcon_get_state().
+
+tcphy_get_mode()
+->extcon_get_state()
+-->find_cable_index_by_id()
+--->return -EINVAL;
+
+Fixes: e96be45cb84e ("phy: Add USB Type-C PHY driver for rk3399")
+Signed-off-by: Neill Kapron <nkapron@google.com>
+Reviewed-by: Lee Jones <lee@kernel.org>
+Link: https://lore.kernel.org/r/20230126001013.3707873-1-nkapron@google.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/rockchip/phy-rockchip-typec.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/phy/rockchip/phy-rockchip-typec.c b/drivers/phy/rockchip/phy-rockchip-typec.c
+index d76440ae10ff4..6aea512e5d4ee 100644
+--- a/drivers/phy/rockchip/phy-rockchip-typec.c
++++ b/drivers/phy/rockchip/phy-rockchip-typec.c
+@@ -821,10 +821,10 @@ static int tcphy_get_mode(struct rockchip_typec_phy *tcphy)
+ mode = MODE_DFP_USB;
+ id = EXTCON_USB_HOST;
+
+- if (ufp) {
++ if (ufp > 0) {
+ mode = MODE_UFP_USB;
+ id = EXTCON_USB;
+- } else if (dp) {
++ } else if (dp > 0) {
+ mode = MODE_DFP_DP;
+ id = EXTCON_DISP_DP;
+
+--
+2.39.2
+
--- /dev/null
+From 80d0997e784f692805900fe94d49bab55bb25e57 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Feb 2023 15:27:14 +0200
+Subject: pinctrl: at91: use devm_kasprintf() to avoid potential leaks
+
+From: Claudiu Beznea <claudiu.beznea@microchip.com>
+
+[ Upstream commit 1c4e5c470a56f7f7c649c0c70e603abc1eab15c4 ]
+
+Use devm_kasprintf() instead of kasprintf() to avoid any potential
+leaks. At the moment drivers have no remove functionality thus
+there is no need for fixes tag.
+
+Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Link: https://lore.kernel.org/r/20230203132714.1931596-1-claudiu.beznea@microchip.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/pinctrl-at91-pio4.c | 4 ++--
+ drivers/pinctrl/pinctrl-at91.c | 2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/pinctrl/pinctrl-at91-pio4.c b/drivers/pinctrl/pinctrl-at91-pio4.c
+index 39b233f73e132..373eed8bc4be9 100644
+--- a/drivers/pinctrl/pinctrl-at91-pio4.c
++++ b/drivers/pinctrl/pinctrl-at91-pio4.c
+@@ -1149,8 +1149,8 @@ static int atmel_pinctrl_probe(struct platform_device *pdev)
+
+ pin_desc[i].number = i;
+ /* Pin naming convention: P(bank_name)(bank_pin_number). */
+- pin_desc[i].name = kasprintf(GFP_KERNEL, "P%c%d",
+- bank + 'A', line);
++ pin_desc[i].name = devm_kasprintf(&pdev->dev, GFP_KERNEL, "P%c%d",
++ bank + 'A', line);
+
+ group->name = group_names[i] = pin_desc[i].name;
+ group->pin = pin_desc[i].number;
+diff --git a/drivers/pinctrl/pinctrl-at91.c b/drivers/pinctrl/pinctrl-at91.c
+index 1e1813d7c5508..c405296e49896 100644
+--- a/drivers/pinctrl/pinctrl-at91.c
++++ b/drivers/pinctrl/pinctrl-at91.c
+@@ -1885,7 +1885,7 @@ static int at91_gpio_probe(struct platform_device *pdev)
+ }
+
+ for (i = 0; i < chip->ngpio; i++)
+- names[i] = kasprintf(GFP_KERNEL, "pio%c%d", alias_idx + 'A', i);
++ names[i] = devm_kasprintf(&pdev->dev, GFP_KERNEL, "pio%c%d", alias_idx + 'A', i);
+
+ chip->names = (const char *const *)names;
+
+--
+2.39.2
+
--- /dev/null
+From 63968f9fd441b9d56185970ea3945c89187ed694 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Jan 2023 23:53:50 +0200
+Subject: pinctrl: bcm2835: Remove of_node_put() in
+ bcm2835_of_gpio_ranges_fallback()
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 2d578dd27871372f7159dd3206149ec616700d87 ]
+
+Remove wrong of_node_put() in bcm2835_of_gpio_ranges_fallback(),
+there is no counterpart of_node_get() for it.
+
+Fixes: d2b67744fd99 ("pinctrl: bcm2835: implement hook for missing gpio-ranges")
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Reviewed-by: Stefan Wahren <stefan.wahren@i2se.com>
+Tested-by: Stefan Wahren <stefan.wahren@i2se.com>
+Tested-by: Florian Fainelli <f.fainelli@gmail.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Acked-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Link: https://lore.kernel.org/r/20230113215352.44272-3-andriy.shevchenko@linux.intel.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/bcm/pinctrl-bcm2835.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/pinctrl/bcm/pinctrl-bcm2835.c b/drivers/pinctrl/bcm/pinctrl-bcm2835.c
+index 7857e612a1008..c7cdccdb4332a 100644
+--- a/drivers/pinctrl/bcm/pinctrl-bcm2835.c
++++ b/drivers/pinctrl/bcm/pinctrl-bcm2835.c
+@@ -363,8 +363,6 @@ static int bcm2835_of_gpio_ranges_fallback(struct gpio_chip *gc,
+ {
+ struct pinctrl_dev *pctldev = of_pinctrl_get(np);
+
+- of_node_put(np);
+-
+ if (!pctldev)
+ return 0;
+
+--
+2.39.2
+
--- /dev/null
+From d664f87ab322718ae9f0b3aaa956d48172575523 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Jan 2023 14:20:36 +0800
+Subject: pinctrl: mediatek: Initialize variable *buf to zero
+
+From: Guodong Liu <Guodong.Liu@mediatek.com>
+
+[ Upstream commit 2e34f82ba214134ecf590fbe0cdbd87401645a8a ]
+
+Coverity spotted that *buf is not initialized to zero in
+mtk_pctrl_dbg_show. Using uninitialized variable *buf as argument to %s
+when calling seq_printf. Fix this coverity by initializing *buf as zero.
+
+Fixes: 184d8e13f9b1 ("pinctrl: mediatek: Add support for pin configuration dump via debugfs.")
+Signed-off-by: Guodong Liu <Guodong.Liu@mediatek.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20230118062036.26258-3-Guodong.Liu@mediatek.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/mediatek/pinctrl-paris.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/mediatek/pinctrl-paris.c b/drivers/pinctrl/mediatek/pinctrl-paris.c
+index 3330f0ce9bd1d..37761a8e7a18f 100644
+--- a/drivers/pinctrl/mediatek/pinctrl-paris.c
++++ b/drivers/pinctrl/mediatek/pinctrl-paris.c
+@@ -717,7 +717,7 @@ static void mtk_pctrl_dbg_show(struct pinctrl_dev *pctldev, struct seq_file *s,
+ unsigned int gpio)
+ {
+ struct mtk_pinctrl *hw = pinctrl_dev_get_drvdata(pctldev);
+- char buf[PIN_DBG_BUF_SZ];
++ char buf[PIN_DBG_BUF_SZ] = { 0 };
+
+ (void)mtk_pctrl_show_one_pin(hw, gpio, buf, PIN_DBG_BUF_SZ);
+
+--
+2.39.2
+
--- /dev/null
+From 0847890c00592963fd562752497564b1a7dff50e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Jan 2023 14:20:35 +0800
+Subject: pinctrl: mediatek: Initialize variable pullen and pullup to zero
+
+From: Guodong Liu <Guodong.Liu@mediatek.com>
+
+[ Upstream commit a298c70a10c604a6b3df5a0aa56597b705ba0f6b ]
+
+Coverity spotted that pullen and pullup is not initialized to zero in
+mtk_pctrl_show_one_pin. The uninitialized variable pullen is used in
+assignment statement "rsel = pullen;" in mtk_pctrl_show_one_pin, and
+Uninitialized variable pullup is used when calling scnprintf. Fix this
+coverity by initializing pullen and pullup as zero.
+
+Fixes: 184d8e13f9b1 ("pinctrl: mediatek: Add support for pin configuration dump via debugfs.")
+Signed-off-by: Guodong Liu <Guodong.Liu@mediatek.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20230118062036.26258-2-Guodong.Liu@mediatek.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/mediatek/pinctrl-paris.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/mediatek/pinctrl-paris.c b/drivers/pinctrl/mediatek/pinctrl-paris.c
+index 475f4172d5085..3330f0ce9bd1d 100644
+--- a/drivers/pinctrl/mediatek/pinctrl-paris.c
++++ b/drivers/pinctrl/mediatek/pinctrl-paris.c
+@@ -640,7 +640,7 @@ static int mtk_hw_get_value_wrap(struct mtk_pinctrl *hw, unsigned int gpio, int
+ ssize_t mtk_pctrl_show_one_pin(struct mtk_pinctrl *hw,
+ unsigned int gpio, char *buf, unsigned int buf_len)
+ {
+- int pinmux, pullup, pullen, len = 0, r1 = -1, r0 = -1, rsel = -1;
++ int pinmux, pullup = 0, pullen = 0, len = 0, r1 = -1, r0 = -1, rsel = -1;
+ const struct mtk_pin_desc *desc;
+ u32 try_all_type = 0;
+
+--
+2.39.2
+
--- /dev/null
+From a72040c971d143729e11676ba1ebf6ad3307cf6b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 31 Dec 2022 17:42:50 +0100
+Subject: pinctrl: qcom: pinctrl-msm8976: Correct function names for wcss pins
+
+From: Adam Skladowski <a39.skl@gmail.com>
+
+[ Upstream commit a7cc0e2685082a0d79baec02df184dfa83cbfac3 ]
+
+Adjust names of function for wcss pins, also fix third gpio in bt group.
+
+Fixes: bcd11493f0ab ("pinctrl: qcom: Add a pinctrl driver for MSM8976 and 8956")
+Signed-off-by: Adam Skladowski <a39.skl@gmail.com>
+Reviewed-by: Marijn Suijten <marijn.suijten@somainline.org>
+Link: https://lore.kernel.org/r/20221231164250.74550-1-a39.skl@gmail.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/qcom/pinctrl-msm8976.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/pinctrl/qcom/pinctrl-msm8976.c b/drivers/pinctrl/qcom/pinctrl-msm8976.c
+index ec43edf9b660a..e11d845847190 100644
+--- a/drivers/pinctrl/qcom/pinctrl-msm8976.c
++++ b/drivers/pinctrl/qcom/pinctrl-msm8976.c
+@@ -733,7 +733,7 @@ static const char * const codec_int2_groups[] = {
+ "gpio74",
+ };
+ static const char * const wcss_bt_groups[] = {
+- "gpio39", "gpio47", "gpio88",
++ "gpio39", "gpio47", "gpio48",
+ };
+ static const char * const sdc3_groups[] = {
+ "gpio39", "gpio40", "gpio41",
+@@ -958,9 +958,9 @@ static const struct msm_pingroup msm8976_groups[] = {
+ PINGROUP(37, NA, NA, NA, qdss_tracedata_b, NA, NA, NA, NA, NA),
+ PINGROUP(38, NA, NA, NA, NA, NA, NA, NA, qdss_tracedata_b, NA),
+ PINGROUP(39, wcss_bt, sdc3, NA, qdss_tracedata_a, NA, NA, NA, NA, NA),
+- PINGROUP(40, wcss_wlan, sdc3, NA, qdss_tracedata_a, NA, NA, NA, NA, NA),
+- PINGROUP(41, wcss_wlan, sdc3, NA, qdss_tracedata_a, NA, NA, NA, NA, NA),
+- PINGROUP(42, wcss_wlan, sdc3, NA, qdss_tracedata_a, NA, NA, NA, NA, NA),
++ PINGROUP(40, wcss_wlan2, sdc3, NA, qdss_tracedata_a, NA, NA, NA, NA, NA),
++ PINGROUP(41, wcss_wlan1, sdc3, NA, qdss_tracedata_a, NA, NA, NA, NA, NA),
++ PINGROUP(42, wcss_wlan0, sdc3, NA, qdss_tracedata_a, NA, NA, NA, NA, NA),
+ PINGROUP(43, wcss_wlan, sdc3, NA, NA, qdss_tracedata_a, NA, NA, NA, NA),
+ PINGROUP(44, wcss_wlan, sdc3, NA, NA, NA, NA, NA, NA, NA),
+ PINGROUP(45, wcss_fm, NA, qdss_tracectl_a, NA, NA, NA, NA, NA, NA),
+--
+2.39.2
+
--- /dev/null
+From 2fe1b2c5cc46a694fe47c1c122ccb35023c058a0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Jan 2023 22:18:11 +0000
+Subject: pinctrl: renesas: rzg2l: Fix configuring the GPIO pins as interrupts
+
+From: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
+
+[ Upstream commit 00dfe29887761405ccd23cc0aa07cb86623bb2b7 ]
+
+On the RZ/G2UL SoC we have less number of pins compared to RZ/G2L and also
+the pin configs are completely different. This patch makes sure we use the
+appropriate pin configs for each SoC (which is passed as part of the OF
+data) while configuring the GPIO pin as interrupts instead of using
+rzg2l_gpio_configs[] for all the SoCs.
+
+Fixes: bfc69bdbaad1 ("pinctrl: renesas: rzg2l: Add RZ/G2UL support")
+Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Acked-by: Linus Walleij <linus.walleij@linaro.org>
+Link: https://lore.kernel.org/r/20230102221815.273719-3-prabhakar.mahadev-lad.rj@bp.renesas.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/renesas/pinctrl-rzg2l.c | 17 ++++++++++-------
+ 1 file changed, 10 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/pinctrl/renesas/pinctrl-rzg2l.c b/drivers/pinctrl/renesas/pinctrl-rzg2l.c
+index 5aa3836dbc226..6f762097557af 100644
+--- a/drivers/pinctrl/renesas/pinctrl-rzg2l.c
++++ b/drivers/pinctrl/renesas/pinctrl-rzg2l.c
+@@ -130,6 +130,7 @@ struct rzg2l_dedicated_configs {
+ struct rzg2l_pinctrl_data {
+ const char * const *port_pins;
+ const u32 *port_pin_configs;
++ unsigned int n_ports;
+ struct rzg2l_dedicated_configs *dedicated_pins;
+ unsigned int n_port_pins;
+ unsigned int n_dedicated_pins;
+@@ -1124,7 +1125,7 @@ static struct {
+ }
+ };
+
+-static int rzg2l_gpio_get_gpioint(unsigned int virq)
++static int rzg2l_gpio_get_gpioint(unsigned int virq, const struct rzg2l_pinctrl_data *data)
+ {
+ unsigned int gpioint;
+ unsigned int i;
+@@ -1133,13 +1134,13 @@ static int rzg2l_gpio_get_gpioint(unsigned int virq)
+ port = virq / 8;
+ bit = virq % 8;
+
+- if (port >= ARRAY_SIZE(rzg2l_gpio_configs) ||
+- bit >= RZG2L_GPIO_PORT_GET_PINCNT(rzg2l_gpio_configs[port]))
++ if (port >= data->n_ports ||
++ bit >= RZG2L_GPIO_PORT_GET_PINCNT(data->port_pin_configs[port]))
+ return -EINVAL;
+
+ gpioint = bit;
+ for (i = 0; i < port; i++)
+- gpioint += RZG2L_GPIO_PORT_GET_PINCNT(rzg2l_gpio_configs[i]);
++ gpioint += RZG2L_GPIO_PORT_GET_PINCNT(data->port_pin_configs[i]);
+
+ return gpioint;
+ }
+@@ -1239,7 +1240,7 @@ static int rzg2l_gpio_child_to_parent_hwirq(struct gpio_chip *gc,
+ unsigned long flags;
+ int gpioint, irq;
+
+- gpioint = rzg2l_gpio_get_gpioint(child);
++ gpioint = rzg2l_gpio_get_gpioint(child, pctrl->data);
+ if (gpioint < 0)
+ return gpioint;
+
+@@ -1313,8 +1314,8 @@ static void rzg2l_init_irq_valid_mask(struct gpio_chip *gc,
+ port = offset / 8;
+ bit = offset % 8;
+
+- if (port >= ARRAY_SIZE(rzg2l_gpio_configs) ||
+- bit >= RZG2L_GPIO_PORT_GET_PINCNT(rzg2l_gpio_configs[port]))
++ if (port >= pctrl->data->n_ports ||
++ bit >= RZG2L_GPIO_PORT_GET_PINCNT(pctrl->data->port_pin_configs[port]))
+ clear_bit(offset, valid_mask);
+ }
+ }
+@@ -1519,6 +1520,7 @@ static int rzg2l_pinctrl_probe(struct platform_device *pdev)
+ static struct rzg2l_pinctrl_data r9a07g043_data = {
+ .port_pins = rzg2l_gpio_names,
+ .port_pin_configs = r9a07g043_gpio_configs,
++ .n_ports = ARRAY_SIZE(r9a07g043_gpio_configs),
+ .dedicated_pins = rzg2l_dedicated_pins.common,
+ .n_port_pins = ARRAY_SIZE(r9a07g043_gpio_configs) * RZG2L_PINS_PER_PORT,
+ .n_dedicated_pins = ARRAY_SIZE(rzg2l_dedicated_pins.common),
+@@ -1527,6 +1529,7 @@ static struct rzg2l_pinctrl_data r9a07g043_data = {
+ static struct rzg2l_pinctrl_data r9a07g044_data = {
+ .port_pins = rzg2l_gpio_names,
+ .port_pin_configs = rzg2l_gpio_configs,
++ .n_ports = ARRAY_SIZE(rzg2l_gpio_configs),
+ .dedicated_pins = rzg2l_dedicated_pins.common,
+ .n_port_pins = ARRAY_SIZE(rzg2l_gpio_names),
+ .n_dedicated_pins = ARRAY_SIZE(rzg2l_dedicated_pins.common) +
+--
+2.39.2
+
--- /dev/null
+From 9e704e9cdf93313f66059ac89174d5e1baf49692 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Jan 2023 15:28:45 +0400
+Subject: pinctrl: rockchip: Fix refcount leak in rockchip_pinctrl_parse_groups
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit c818ae563bf99457f02e8170aabd6b174f629f65 ]
+
+of_find_node_by_phandle() returns a node pointer with refcount incremented,
+We should use of_node_put() on it when not needed anymore.
+Add missing of_node_put() to avoid refcount leak.
+
+Fixes: d3e5116119bd ("pinctrl: add pinctrl driver for Rockchip SoCs")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Link: https://lore.kernel.org/r/20230102112845.3982407-1-linmq006@gmail.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/pinctrl-rockchip.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/pinctrl/pinctrl-rockchip.c b/drivers/pinctrl/pinctrl-rockchip.c
+index 5eeac92f610a0..0276b52f37168 100644
+--- a/drivers/pinctrl/pinctrl-rockchip.c
++++ b/drivers/pinctrl/pinctrl-rockchip.c
+@@ -3045,6 +3045,7 @@ static int rockchip_pinctrl_parse_groups(struct device_node *np,
+ np_config = of_find_node_by_phandle(be32_to_cpup(phandle));
+ ret = pinconf_generic_parse_dt_config(np_config, NULL,
+ &grp->data[j].configs, &grp->data[j].nconfigs);
++ of_node_put(np_config);
+ if (ret)
+ return ret;
+ }
+--
+2.39.2
+
--- /dev/null
+From 59a9fcdec847b069a90434835903e60fdafcd4bb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Jan 2023 12:24:56 +0400
+Subject: pinctrl: stm32: Fix refcount leak in stm32_pctrl_get_irq_domain
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit dcef18c8ac40aa85bb339f64c1dd31dd458b06fb ]
+
+of_irq_find_parent() returns a node pointer with refcount incremented,
+We should use of_node_put() on it when not needed anymore.
+Add missing of_node_put() to avoid refcount leak.
+
+Fixes: d86f4d71e42a ("pinctrl: stm32: check irq controller availability at probe")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Link: https://lore.kernel.org/r/20230102082503.3944927-1-linmq006@gmail.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/stm32/pinctrl-stm32.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/pinctrl/stm32/pinctrl-stm32.c b/drivers/pinctrl/stm32/pinctrl-stm32.c
+index 1cddca506ad7e..cb33a23ab0c11 100644
+--- a/drivers/pinctrl/stm32/pinctrl-stm32.c
++++ b/drivers/pinctrl/stm32/pinctrl-stm32.c
+@@ -1382,6 +1382,7 @@ static struct irq_domain *stm32_pctrl_get_irq_domain(struct platform_device *pde
+ return ERR_PTR(-ENXIO);
+
+ domain = irq_find_host(parent);
++ of_node_put(parent);
+ if (!domain)
+ /* domain not registered yet */
+ return ERR_PTR(-EPROBE_DEFER);
+--
+2.39.2
+
--- /dev/null
+From 096e7562366dd4bcf466d7f78e228aaf98a58bbc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Dec 2022 00:45:08 +0000
+Subject: platform/chrome: cros_ec_typec: Update port DP VDO
+
+From: Prashant Malani <pmalani@chromium.org>
+
+[ Upstream commit 8d2b28df6c3dc1581d856f52d9f78059ef2a568f ]
+
+The port advertising DP support is a Type-C receptacle. Fix the port's
+DisplayPort VDO to reflect this.
+
+Fixes: 1903adae0464 ("platform/chrome: cros_ec_typec: Add bit offset for DP VDO")
+Signed-off-by: Prashant Malani <pmalani@chromium.org>
+Reviewed-by: Benson Leung <bleung@chromium.org>
+Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Link: https://lore.kernel.org/r/20221228004648.793339-6-pmalani@chromium.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/chrome/cros_ec_typec.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/platform/chrome/cros_ec_typec.c b/drivers/platform/chrome/cros_ec_typec.c
+index 001b0de95a46e..d1714b5d085be 100644
+--- a/drivers/platform/chrome/cros_ec_typec.c
++++ b/drivers/platform/chrome/cros_ec_typec.c
+@@ -27,7 +27,7 @@
+ #define DRV_NAME "cros-ec-typec"
+
+ #define DP_PORT_VDO (DP_CONF_SET_PIN_ASSIGN(BIT(DP_PIN_ASSIGN_C) | BIT(DP_PIN_ASSIGN_D)) | \
+- DP_CAP_DFP_D)
++ DP_CAP_DFP_D | DP_CAP_RECEPTACLE)
+
+ /* Supported alt modes. */
+ enum {
+--
+2.39.2
+
--- /dev/null
+From ea4dcb6ad7e3d55e0a7d838c55740e1f00b103eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Jan 2023 20:40:17 +0100
+Subject: platform/x86: dell-ddv: Add support for interface version 3
+
+From: Armin Wolf <W_Armin@gmx.de>
+
+[ Upstream commit 3e899fec5dfce37701d49d656954a825275bf867 ]
+
+While trying to solve a bugreport on bugzilla, i learned that
+some devices (for example the Dell XPS 17 9710) provide a more
+recent DDV WMI interface (version 3).
+Since the new interface version just adds an additional method,
+no code changes are necessary apart from whitelisting the version.
+
+Signed-off-by: Armin Wolf <W_Armin@gmx.de>
+Link: https://lore.kernel.org/r/20230126194021.381092-2-W_Armin@gmx.de
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/dell/dell-wmi-ddv.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/platform/x86/dell/dell-wmi-ddv.c b/drivers/platform/x86/dell/dell-wmi-ddv.c
+index 2bb449845d143..9cb6ae42dbdc8 100644
+--- a/drivers/platform/x86/dell/dell-wmi-ddv.c
++++ b/drivers/platform/x86/dell/dell-wmi-ddv.c
+@@ -26,7 +26,8 @@
+
+ #define DRIVER_NAME "dell-wmi-ddv"
+
+-#define DELL_DDV_SUPPORTED_INTERFACE 2
++#define DELL_DDV_SUPPORTED_VERSION_MIN 2
++#define DELL_DDV_SUPPORTED_VERSION_MAX 3
+ #define DELL_DDV_GUID "8A42EA14-4F2A-FD45-6422-0087F7A7E608"
+
+ #define DELL_EPPID_LENGTH 20
+@@ -49,6 +50,7 @@ enum dell_ddv_method {
+ DELL_DDV_BATTERY_RAW_ANALYTICS_START = 0x0E,
+ DELL_DDV_BATTERY_RAW_ANALYTICS = 0x0F,
+ DELL_DDV_BATTERY_DESIGN_VOLTAGE = 0x10,
++ DELL_DDV_BATTERY_RAW_ANALYTICS_A_BLOCK = 0x11, /* version 3 */
+
+ DELL_DDV_INTERFACE_VERSION = 0x12,
+
+@@ -340,7 +342,7 @@ static int dell_wmi_ddv_probe(struct wmi_device *wdev, const void *context)
+ return ret;
+
+ dev_dbg(&wdev->dev, "WMI interface version: %d\n", version);
+- if (version != DELL_DDV_SUPPORTED_INTERFACE)
++ if (version < DELL_DDV_SUPPORTED_VERSION_MIN || version > DELL_DDV_SUPPORTED_VERSION_MAX)
+ return -ENODEV;
+
+ data = devm_kzalloc(&wdev->dev, sizeof(*data), GFP_KERNEL);
+--
+2.39.2
+
--- /dev/null
+From 86b08de1c5d7af0e3382d8d3b03150df93e57b34 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Feb 2023 15:15:45 +0100
+Subject: PM: domains: fix memory leak with using debugfs_lookup()
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+[ Upstream commit 0b6200e1e9f53dabdc30d0f6c51af9a5f664d32b ]
+
+When calling debugfs_lookup() the result must have dput() called on it,
+otherwise the memory will leak over time. To make things simpler, just
+call debugfs_lookup_and_remove() instead which handles all of the logic
+at once.
+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/power/domain.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/drivers/base/power/domain.c b/drivers/base/power/domain.c
+index 967bcf9d415ea..6097644ebdc51 100644
+--- a/drivers/base/power/domain.c
++++ b/drivers/base/power/domain.c
+@@ -220,13 +220,10 @@ static void genpd_debug_add(struct generic_pm_domain *genpd);
+
+ static void genpd_debug_remove(struct generic_pm_domain *genpd)
+ {
+- struct dentry *d;
+-
+ if (!genpd_debugfs_dir)
+ return;
+
+- d = debugfs_lookup(genpd->name, genpd_debugfs_dir);
+- debugfs_remove(d);
++ debugfs_lookup_and_remove(genpd->name, genpd_debugfs_dir);
+ }
+
+ static void genpd_update_accounting(struct generic_pm_domain *genpd)
+--
+2.39.2
+
--- /dev/null
+From 9edcd0320b8704c698cd61d20adf0e6f08db127d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Feb 2023 16:15:15 +0100
+Subject: PM: EM: fix memory leak with using debugfs_lookup()
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+[ Upstream commit a0e8c13ccd6a9a636d27353da62c2410c4eca337 ]
+
+When calling debugfs_lookup() the result must have dput() called on it,
+otherwise the memory will leak over time. To make things simpler, just
+call debugfs_lookup_and_remove() instead which handles all of the logic
+at once.
+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/power/energy_model.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/kernel/power/energy_model.c b/kernel/power/energy_model.c
+index f82111837b8d1..7b44f5b89fa15 100644
+--- a/kernel/power/energy_model.c
++++ b/kernel/power/energy_model.c
+@@ -87,10 +87,7 @@ static void em_debug_create_pd(struct device *dev)
+
+ static void em_debug_remove_pd(struct device *dev)
+ {
+- struct dentry *debug_dir;
+-
+- debug_dir = debugfs_lookup(dev_name(dev), rootdir);
+- debugfs_remove_recursive(debug_dir);
++ debugfs_lookup_and_remove(dev_name(dev), rootdir);
+ }
+
+ static int __init em_debug_init(void)
+--
+2.39.2
+
--- /dev/null
+From c9a85ccff2c13ffaa6f5cab535e57b4e99ca4d81 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 21 Jan 2023 12:16:21 +0100
+Subject: power: supply: remove faulty cooling logic
+
+From: Andreas Kemnade <andreas@kemnade.info>
+
+[ Upstream commit c85c191694cb1cf290b11059b3d2de8a2732ffd0 ]
+
+The rn5t618 power driver fails to register
+a cooling device because POWER_SUPPLY_PROP_CHARGE_CONTROL_LIMIT_MAX
+is missing but availability is not checked before registering
+cooling device. After improved error checking in the thermal
+code, the registration of the power supply fails entirely.
+
+Checking for availability of _MAX before registering cooling device
+fixes the rn5t618 problem. But the whole logic feels questionable.
+
+First, the logic is inverted here:
+the code tells: max_current = max_cooling but
+0 = max_cooling, so there needs to be some inversion
+in the code which cannot be found. Comparing with other
+cooling devices, it can be found that value for fan speed is not
+inverted, value for cpufreq cooling is inverted (similar situation
+as here lowest frequency = max cooling)
+
+Second, analyzing usage of _MAX: it is seems that maximum capabilities
+of charging controller are specified and not of the battery. Probably
+there is not too much mismatch in the drivers actually implementing
+that. So nothing has exploded yet. So there is no easy and safe way
+to specifify a max cooling value now.
+
+Conclusion for now (as a regression fix) just remove the cooling device
+registration and do it properly later on.
+
+Fixes: e49a1e1ee078 ("thermal/core: fix error code in __thermal_cooling_device_register()")
+Fixes: 952aeeb3ee28 ("power_supply: Register power supply for thermal cooling device")
+Signed-off-by: Andreas Kemnade <andreas@kemnade.info>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/power_supply_core.c | 93 ------------------------
+ 1 file changed, 93 deletions(-)
+
+diff --git a/drivers/power/supply/power_supply_core.c b/drivers/power/supply/power_supply_core.c
+index 7c790c41e2fe3..cc5b2e22b42ac 100644
+--- a/drivers/power/supply/power_supply_core.c
++++ b/drivers/power/supply/power_supply_core.c
+@@ -1186,83 +1186,6 @@ static void psy_unregister_thermal(struct power_supply *psy)
+ thermal_zone_device_unregister(psy->tzd);
+ }
+
+-/* thermal cooling device callbacks */
+-static int ps_get_max_charge_cntl_limit(struct thermal_cooling_device *tcd,
+- unsigned long *state)
+-{
+- struct power_supply *psy;
+- union power_supply_propval val;
+- int ret;
+-
+- psy = tcd->devdata;
+- ret = power_supply_get_property(psy,
+- POWER_SUPPLY_PROP_CHARGE_CONTROL_LIMIT_MAX, &val);
+- if (ret)
+- return ret;
+-
+- *state = val.intval;
+-
+- return ret;
+-}
+-
+-static int ps_get_cur_charge_cntl_limit(struct thermal_cooling_device *tcd,
+- unsigned long *state)
+-{
+- struct power_supply *psy;
+- union power_supply_propval val;
+- int ret;
+-
+- psy = tcd->devdata;
+- ret = power_supply_get_property(psy,
+- POWER_SUPPLY_PROP_CHARGE_CONTROL_LIMIT, &val);
+- if (ret)
+- return ret;
+-
+- *state = val.intval;
+-
+- return ret;
+-}
+-
+-static int ps_set_cur_charge_cntl_limit(struct thermal_cooling_device *tcd,
+- unsigned long state)
+-{
+- struct power_supply *psy;
+- union power_supply_propval val;
+- int ret;
+-
+- psy = tcd->devdata;
+- val.intval = state;
+- ret = psy->desc->set_property(psy,
+- POWER_SUPPLY_PROP_CHARGE_CONTROL_LIMIT, &val);
+-
+- return ret;
+-}
+-
+-static const struct thermal_cooling_device_ops psy_tcd_ops = {
+- .get_max_state = ps_get_max_charge_cntl_limit,
+- .get_cur_state = ps_get_cur_charge_cntl_limit,
+- .set_cur_state = ps_set_cur_charge_cntl_limit,
+-};
+-
+-static int psy_register_cooler(struct power_supply *psy)
+-{
+- /* Register for cooling device if psy can control charging */
+- if (psy_has_property(psy->desc, POWER_SUPPLY_PROP_CHARGE_CONTROL_LIMIT)) {
+- psy->tcd = thermal_cooling_device_register(
+- (char *)psy->desc->name,
+- psy, &psy_tcd_ops);
+- return PTR_ERR_OR_ZERO(psy->tcd);
+- }
+-
+- return 0;
+-}
+-
+-static void psy_unregister_cooler(struct power_supply *psy)
+-{
+- if (IS_ERR_OR_NULL(psy->tcd))
+- return;
+- thermal_cooling_device_unregister(psy->tcd);
+-}
+ #else
+ static int psy_register_thermal(struct power_supply *psy)
+ {
+@@ -1272,15 +1195,6 @@ static int psy_register_thermal(struct power_supply *psy)
+ static void psy_unregister_thermal(struct power_supply *psy)
+ {
+ }
+-
+-static int psy_register_cooler(struct power_supply *psy)
+-{
+- return 0;
+-}
+-
+-static void psy_unregister_cooler(struct power_supply *psy)
+-{
+-}
+ #endif
+
+ static struct power_supply *__must_check
+@@ -1354,10 +1268,6 @@ __power_supply_register(struct device *parent,
+ if (rc)
+ goto register_thermal_failed;
+
+- rc = psy_register_cooler(psy);
+- if (rc)
+- goto register_cooler_failed;
+-
+ rc = power_supply_create_triggers(psy);
+ if (rc)
+ goto create_triggers_failed;
+@@ -1387,8 +1297,6 @@ __power_supply_register(struct device *parent,
+ add_hwmon_sysfs_failed:
+ power_supply_remove_triggers(psy);
+ create_triggers_failed:
+- psy_unregister_cooler(psy);
+-register_cooler_failed:
+ psy_unregister_thermal(psy);
+ register_thermal_failed:
+ wakeup_init_failed:
+@@ -1540,7 +1448,6 @@ void power_supply_unregister(struct power_supply *psy)
+ sysfs_remove_link(&psy->dev.kobj, "powers");
+ power_supply_remove_hwmon_sysfs(psy);
+ power_supply_remove_triggers(psy);
+- psy_unregister_cooler(psy);
+ psy_unregister_thermal(psy);
+ device_init_wakeup(&psy->dev, false);
+ device_unregister(&psy->dev);
+--
+2.39.2
+
--- /dev/null
+From 7e4c0e04d33862c3a1363a825778ace3b546916a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Jan 2023 20:57:26 +0800
+Subject: powercap: fix possible name leak in powercap_register_zone()
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit 1b6599f741a4525ca761ecde46e5885ff1e6ba58 ]
+
+In the error path after calling dev_set_name(), the device
+name is leaked. To fix this, calling dev_set_name() before
+device_register(), and call put_device() if it returns error.
+
+All the resources is released in powercap_release(), so it
+can return from powercap_register_zone() directly.
+
+Fixes: 75d2364ea0ca ("PowerCap: Add class driver")
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/powercap/powercap_sys.c | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/powercap/powercap_sys.c b/drivers/powercap/powercap_sys.c
+index 1f968353d4799..e180dee0f83d0 100644
+--- a/drivers/powercap/powercap_sys.c
++++ b/drivers/powercap/powercap_sys.c
+@@ -530,9 +530,6 @@ struct powercap_zone *powercap_register_zone(
+ power_zone->name = kstrdup(name, GFP_KERNEL);
+ if (!power_zone->name)
+ goto err_name_alloc;
+- dev_set_name(&power_zone->dev, "%s:%x",
+- dev_name(power_zone->dev.parent),
+- power_zone->id);
+ power_zone->constraints = kcalloc(nr_constraints,
+ sizeof(*power_zone->constraints),
+ GFP_KERNEL);
+@@ -555,9 +552,16 @@ struct powercap_zone *powercap_register_zone(
+ power_zone->dev_attr_groups[0] = &power_zone->dev_zone_attr_group;
+ power_zone->dev_attr_groups[1] = NULL;
+ power_zone->dev.groups = power_zone->dev_attr_groups;
++ dev_set_name(&power_zone->dev, "%s:%x",
++ dev_name(power_zone->dev.parent),
++ power_zone->id);
+ result = device_register(&power_zone->dev);
+- if (result)
+- goto err_dev_ret;
++ if (result) {
++ put_device(&power_zone->dev);
++ mutex_unlock(&control_type->lock);
++
++ return ERR_PTR(result);
++ }
+
+ control_type->nr_zones++;
+ mutex_unlock(&control_type->lock);
+--
+2.39.2
+
--- /dev/null
+From 5944ae36c40cd8c380403dd951340bb0e57bf9d2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Jan 2023 20:05:02 -0700
+Subject: powerpc: Remove linker flag from KBUILD_AFLAGS
+
+From: Nathan Chancellor <nathan@kernel.org>
+
+[ Upstream commit 31f48f16264bc70962fb3e7ec62da64d0a2ba04a ]
+
+When clang's -Qunused-arguments is dropped from KBUILD_CPPFLAGS, it
+points out that KBUILD_AFLAGS contains a linker flag, which will be
+unused:
+
+ clang: error: -Wl,-a32: 'linker' input unused [-Werror,-Wunused-command-line-argument]
+
+This was likely supposed to be '-Wa,-a$(BITS)'. However, this change is
+unnecessary, as all supported versions of clang and gcc will pass '-a64'
+or '-a32' to GNU as based on the value of '-m'; the behavior of the
+latest stable release of the oldest supported major version of each
+compiler is shown below and each compiler's latest release exhibits the
+same behavior (GCC 12.2.0 and Clang 15.0.6).
+
+ $ powerpc64-linux-gcc --version | head -1
+ powerpc64-linux-gcc (GCC) 5.5.0
+
+ $ powerpc64-linux-gcc -m64 -### -x assembler-with-cpp -c -o /dev/null /dev/null &| grep 'as '
+ .../as -a64 -mppc64 -many -mbig -o /dev/null /tmp/cctwuBzZ.s
+
+ $ powerpc64-linux-gcc -m32 -### -x assembler-with-cpp -c -o /dev/null /dev/null &| grep 'as '
+ .../as -a32 -mppc -many -mbig -o /dev/null /tmp/ccaZP4mF.sg
+
+ $ clang --version | head -1
+ Ubuntu clang version 11.1.0-++20211011094159+1fdec59bffc1-1~exp1~20211011214622.5
+
+ $ clang --target=powerpc64-linux-gnu -fno-integrated-as -m64 -### \
+ -x assembler-with-cpp -c -o /dev/null /dev/null &| grep gnu-as
+ "/usr/bin/powerpc64-linux-gnu-as" "-a64" "-mppc64" "-many" "-o" "/dev/null" "/tmp/null-80267c.s"
+
+ $ clang --target=powerpc64-linux-gnu -fno-integrated-as -m64 -### \
+ -x assembler-with-cpp -c -o /dev/null /dev/null &| grep gnu-as
+ "/usr/bin/powerpc64-linux-gnu-as" "-a32" "-mppc" "-many" "-o" "/dev/null" "/tmp/null-ab8f8d.s"
+
+Remove this flag altogether to avoid future issues.
+
+Fixes: 1421dc6d4829 ("powerpc/kbuild: Use flags variables rather than overriding LD/CC/AS")
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
+Tested-by: Anders Roxell <anders.roxell@linaro.org>
+Acked-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile
+index dc4cbf0a5ca95..4fd630efe39d3 100644
+--- a/arch/powerpc/Makefile
++++ b/arch/powerpc/Makefile
+@@ -90,7 +90,7 @@ aflags-$(CONFIG_CPU_LITTLE_ENDIAN) += -mlittle-endian
+
+ ifeq ($(HAS_BIARCH),y)
+ KBUILD_CFLAGS += -m$(BITS)
+-KBUILD_AFLAGS += -m$(BITS) -Wl,-a$(BITS)
++KBUILD_AFLAGS += -m$(BITS)
+ KBUILD_LDFLAGS += -m elf$(BITS)$(LDEMULATION)
+ endif
+
+--
+2.39.2
+
--- /dev/null
+From a236849cd5e004673b407dd156e6b4fb5e35c6bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Feb 2023 20:40:57 +0100
+Subject: printf: fix errname.c list
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 0c2baf6509af1d11310ae4c1c839481a6e9a4bc4 ]
+
+On most architectures, gcc -Wextra warns about the list of error
+numbers containing both EDEADLK and EDEADLOCK:
+
+lib/errname.c:15:67: warning: initialized field overwritten [-Woverride-init]
+ 15 | #define E(err) [err + BUILD_BUG_ON_ZERO(err <= 0 || err > 300)] = "-" #err
+ | ^~~
+lib/errname.c:172:2: note: in expansion of macro 'E'
+ 172 | E(EDEADLK), /* EDEADLOCK */
+ | ^
+
+On parisc, a similar error happens with -ECANCELLED, which is an
+alias for ECANCELED.
+
+Make the EDEADLK printing conditional on the number being distinct
+from EDEADLOCK, and remove the -ECANCELLED bit completely as it
+can never be hit.
+
+To ensure these are correct, add static_assert lines that verify
+all the remaining aliases are in fact identical to the canonical
+name.
+
+Fixes: 57f5677e535b ("printf: add support for printing symbolic error names")
+Cc: Petr Mladek <pmladek@suse.com>
+Suggested-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
+Acked-by: Uwe Kleine-König <uwe@kleine-koenig.org>
+Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Link: https://lore.kernel.org/all/20210514213456.745039-1-arnd@kernel.org/
+Link: https://lore.kernel.org/all/20210927123409.1109737-1-arnd@kernel.org/
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Sergey Senozhatsky <senozhatsky@chromium.org>
+Acked-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
+Reviewed-by: Petr Mladek <pmladek@suse.com>
+Signed-off-by: Petr Mladek <pmladek@suse.com>
+Link: https://lore.kernel.org/r/20230206194126.380350-1-arnd@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/errname.c | 22 ++++++++++++++--------
+ 1 file changed, 14 insertions(+), 8 deletions(-)
+
+diff --git a/lib/errname.c b/lib/errname.c
+index 05cbf731545f0..67739b174a8cc 100644
+--- a/lib/errname.c
++++ b/lib/errname.c
+@@ -21,6 +21,7 @@ static const char *names_0[] = {
+ E(EADDRNOTAVAIL),
+ E(EADV),
+ E(EAFNOSUPPORT),
++ E(EAGAIN), /* EWOULDBLOCK */
+ E(EALREADY),
+ E(EBADE),
+ E(EBADF),
+@@ -31,15 +32,17 @@ static const char *names_0[] = {
+ E(EBADSLT),
+ E(EBFONT),
+ E(EBUSY),
+-#ifdef ECANCELLED
+- E(ECANCELLED),
+-#endif
++ E(ECANCELED), /* ECANCELLED */
+ E(ECHILD),
+ E(ECHRNG),
+ E(ECOMM),
+ E(ECONNABORTED),
++ E(ECONNREFUSED), /* EREFUSED */
+ E(ECONNRESET),
++ E(EDEADLK), /* EDEADLOCK */
++#if EDEADLK != EDEADLOCK /* mips, sparc, powerpc */
+ E(EDEADLOCK),
++#endif
+ E(EDESTADDRREQ),
+ E(EDOM),
+ E(EDOTDOT),
+@@ -166,14 +169,17 @@ static const char *names_0[] = {
+ E(EUSERS),
+ E(EXDEV),
+ E(EXFULL),
+-
+- E(ECANCELED), /* ECANCELLED */
+- E(EAGAIN), /* EWOULDBLOCK */
+- E(ECONNREFUSED), /* EREFUSED */
+- E(EDEADLK), /* EDEADLOCK */
+ };
+ #undef E
+
++#ifdef EREFUSED /* parisc */
++static_assert(EREFUSED == ECONNREFUSED);
++#endif
++#ifdef ECANCELLED /* parisc */
++static_assert(ECANCELLED == ECANCELED);
++#endif
++static_assert(EAGAIN == EWOULDBLOCK); /* everywhere */
++
+ #define E(err) [err - 512 + BUILD_BUG_ON_ZERO(err < 512 || err > 550)] = "-" #err
+ static const char *names_512[] = {
+ E(ERESTARTSYS),
+--
+2.39.2
+
--- /dev/null
+From 5bf2b42f3a8a4a8f7e78638c75d7e826a0de1b91 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Dec 2022 11:41:44 -0800
+Subject: rcu: Make RCU_LOCKDEP_WARN() avoid early lockdep checks
+
+From: Paul E. McKenney <paulmck@kernel.org>
+
+[ Upstream commit 0cae5ded535c3a80aed94f119bbd4ee3ae284a65 ]
+
+Currently, RCU_LOCKDEP_WARN() checks the condition before checking
+to see if lockdep is still enabled. This is necessary to avoid the
+false-positive splats fixed by commit 3066820034b5dd ("rcu: Reject
+RCU_LOCKDEP_WARN() false positives"). However, the current state can
+result in false-positive splats during early boot before lockdep is fully
+initialized. This commit therefore checks debug_lockdep_rcu_enabled()
+both before and after checking the condition, thus avoiding both sets
+of false-positive error reports.
+
+Reported-by: Steven Rostedt <rostedt@goodmis.org>
+Reported-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+Reported-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
+Reviewed-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+Cc: Boqun Feng <boqun.feng@gmail.com>
+Cc: Matthew Wilcox <willy@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/rcupdate.h | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/include/linux/rcupdate.h b/include/linux/rcupdate.h
+index c0c79beac3fe6..8d4bf695e7666 100644
+--- a/include/linux/rcupdate.h
++++ b/include/linux/rcupdate.h
+@@ -376,11 +376,18 @@ static inline int debug_lockdep_rcu_enabled(void)
+ * RCU_LOCKDEP_WARN - emit lockdep splat if specified condition is met
+ * @c: condition to check
+ * @s: informative message
++ *
++ * This checks debug_lockdep_rcu_enabled() before checking (c) to
++ * prevent early boot splats due to lockdep not yet being initialized,
++ * and rechecks it after checking (c) to prevent false-positive splats
++ * due to races with lockdep being disabled. See commit 3066820034b5dd
++ * ("rcu: Reject RCU_LOCKDEP_WARN() false positives") for more detail.
+ */
+ #define RCU_LOCKDEP_WARN(c, s) \
+ do { \
+ static bool __section(".data.unlikely") __warned; \
+- if ((c) && debug_lockdep_rcu_enabled() && !__warned) { \
++ if (debug_lockdep_rcu_enabled() && (c) && \
++ debug_lockdep_rcu_enabled() && !__warned) { \
+ __warned = true; \
+ lockdep_rcu_suspicious(__FILE__, __LINE__, s); \
+ } \
+--
+2.39.2
+
--- /dev/null
+From a15b30e1c9552254bdca10bfd536cf5f9db0274b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Dec 2022 15:55:48 -0800
+Subject: rcu: Suppress smp_processor_id() complaint in
+ synchronize_rcu_expedited_wait()
+
+From: Paul E. McKenney <paulmck@kernel.org>
+
+[ Upstream commit 2d7f00b2f01301d6e41fd4a28030dab0442265be ]
+
+The normal grace period's RCU CPU stall warnings are invoked from the
+scheduling-clock interrupt handler, and can thus invoke smp_processor_id()
+with impunity, which allows them to directly invoke dump_cpu_task().
+In contrast, the expedited grace period's RCU CPU stall warnings are
+invoked from process context, which causes the dump_cpu_task() function's
+calls to smp_processor_id() to complain bitterly in debug kernels.
+
+This commit therefore causes synchronize_rcu_expedited_wait() to disable
+preemption around its call to dump_cpu_task().
+
+Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/rcu/tree_exp.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/kernel/rcu/tree_exp.h b/kernel/rcu/tree_exp.h
+index ed6c3cce28f23..927abaf6c822e 100644
+--- a/kernel/rcu/tree_exp.h
++++ b/kernel/rcu/tree_exp.h
+@@ -667,7 +667,9 @@ static void synchronize_rcu_expedited_wait(void)
+ mask = leaf_node_cpu_bit(rnp, cpu);
+ if (!(READ_ONCE(rnp->expmask) & mask))
+ continue;
++ preempt_disable(); // For smp_processor_id() in dump_cpu_task().
+ dump_cpu_task(cpu);
++ preempt_enable();
+ }
+ }
+ jiffies_stall = 3 * rcu_exp_jiffies_till_stall_check() + 3;
+--
+2.39.2
+
--- /dev/null
+From a7a5a9f4d65b1b468acb9c46013be8cd1cfa8b5d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Nov 2022 14:55:00 +0100
+Subject: rcu-tasks: Fix synchronize_rcu_tasks() VS zap_pid_ns_processes()
+
+From: Frederic Weisbecker <frederic@kernel.org>
+
+[ Upstream commit 28319d6dc5e2ffefa452c2377dd0f71621b5bff0 ]
+
+RCU Tasks and PID-namespace unshare can interact in do_exit() in a
+complicated circular dependency:
+
+1) TASK A calls unshare(CLONE_NEWPID), this creates a new PID namespace
+ that every subsequent child of TASK A will belong to. But TASK A
+ doesn't itself belong to that new PID namespace.
+
+2) TASK A forks() and creates TASK B. TASK A stays attached to its PID
+ namespace (let's say PID_NS1) and TASK B is the first task belonging
+ to the new PID namespace created by unshare() (let's call it PID_NS2).
+
+3) Since TASK B is the first task attached to PID_NS2, it becomes the
+ PID_NS2 child reaper.
+
+4) TASK A forks() again and creates TASK C which get attached to PID_NS2.
+ Note how TASK C has TASK A as a parent (belonging to PID_NS1) but has
+ TASK B (belonging to PID_NS2) as a pid_namespace child_reaper.
+
+5) TASK B exits and since it is the child reaper for PID_NS2, it has to
+ kill all other tasks attached to PID_NS2, and wait for all of them to
+ die before getting reaped itself (zap_pid_ns_process()).
+
+6) TASK A calls synchronize_rcu_tasks() which leads to
+ synchronize_srcu(&tasks_rcu_exit_srcu).
+
+7) TASK B is waiting for TASK C to get reaped. But TASK B is under a
+ tasks_rcu_exit_srcu SRCU critical section (exit_notify() is between
+ exit_tasks_rcu_start() and exit_tasks_rcu_finish()), blocking TASK A.
+
+8) TASK C exits and since TASK A is its parent, it waits for it to reap
+ TASK C, but it can't because TASK A waits for TASK B that waits for
+ TASK C.
+
+Pid_namespace semantics can hardly be changed at this point. But the
+coverage of tasks_rcu_exit_srcu can be reduced instead.
+
+The current task is assumed not to be concurrently reapable at this
+stage of exit_notify() and therefore tasks_rcu_exit_srcu can be
+temporarily relaxed without breaking its constraints, providing a way
+out of the deadlock scenario.
+
+[ paulmck: Fix build failure by adding additional declaration. ]
+
+Fixes: 3f95aa81d265 ("rcu: Make TASKS_RCU handle tasks that are almost done exiting")
+Reported-by: Pengfei Xu <pengfei.xu@intel.com>
+Suggested-by: Boqun Feng <boqun.feng@gmail.com>
+Suggested-by: Neeraj Upadhyay <quic_neeraju@quicinc.com>
+Suggested-by: Paul E. McKenney <paulmck@kernel.org>
+Cc: Oleg Nesterov <oleg@redhat.com>
+Cc: Lai Jiangshan <jiangshanlai@gmail.com>
+Cc: Eric W . Biederman <ebiederm@xmission.com>
+Signed-off-by: Frederic Weisbecker <frederic@kernel.org>
+Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/rcupdate.h | 2 ++
+ kernel/pid_namespace.c | 17 +++++++++++++++++
+ kernel/rcu/tasks.h | 15 +++++++++++++--
+ 3 files changed, 32 insertions(+), 2 deletions(-)
+
+diff --git a/include/linux/rcupdate.h b/include/linux/rcupdate.h
+index 03abf883a281b..c0c79beac3fe6 100644
+--- a/include/linux/rcupdate.h
++++ b/include/linux/rcupdate.h
+@@ -238,6 +238,7 @@ void synchronize_rcu_tasks_rude(void);
+
+ #define rcu_note_voluntary_context_switch(t) rcu_tasks_qs(t, false)
+ void exit_tasks_rcu_start(void);
++void exit_tasks_rcu_stop(void);
+ void exit_tasks_rcu_finish(void);
+ #else /* #ifdef CONFIG_TASKS_RCU_GENERIC */
+ #define rcu_tasks_classic_qs(t, preempt) do { } while (0)
+@@ -246,6 +247,7 @@ void exit_tasks_rcu_finish(void);
+ #define call_rcu_tasks call_rcu
+ #define synchronize_rcu_tasks synchronize_rcu
+ static inline void exit_tasks_rcu_start(void) { }
++static inline void exit_tasks_rcu_stop(void) { }
+ static inline void exit_tasks_rcu_finish(void) { }
+ #endif /* #else #ifdef CONFIG_TASKS_RCU_GENERIC */
+
+diff --git a/kernel/pid_namespace.c b/kernel/pid_namespace.c
+index f4f8cb0435b45..fc21c5d5fd5de 100644
+--- a/kernel/pid_namespace.c
++++ b/kernel/pid_namespace.c
+@@ -244,7 +244,24 @@ void zap_pid_ns_processes(struct pid_namespace *pid_ns)
+ set_current_state(TASK_INTERRUPTIBLE);
+ if (pid_ns->pid_allocated == init_pids)
+ break;
++ /*
++ * Release tasks_rcu_exit_srcu to avoid following deadlock:
++ *
++ * 1) TASK A unshare(CLONE_NEWPID)
++ * 2) TASK A fork() twice -> TASK B (child reaper for new ns)
++ * and TASK C
++ * 3) TASK B exits, kills TASK C, waits for TASK A to reap it
++ * 4) TASK A calls synchronize_rcu_tasks()
++ * -> synchronize_srcu(tasks_rcu_exit_srcu)
++ * 5) *DEADLOCK*
++ *
++ * It is considered safe to release tasks_rcu_exit_srcu here
++ * because we assume the current task can not be concurrently
++ * reaped at this point.
++ */
++ exit_tasks_rcu_stop();
+ schedule();
++ exit_tasks_rcu_start();
+ }
+ __set_current_state(TASK_RUNNING);
+
+diff --git a/kernel/rcu/tasks.h b/kernel/rcu/tasks.h
+index 20617a2d04ed9..03388e2e29df0 100644
+--- a/kernel/rcu/tasks.h
++++ b/kernel/rcu/tasks.h
+@@ -1016,16 +1016,27 @@ void exit_tasks_rcu_start(void) __acquires(&tasks_rcu_exit_srcu)
+ * task is exiting and may be removed from the tasklist. See
+ * corresponding synchronize_srcu() for further details.
+ */
+-void exit_tasks_rcu_finish(void) __releases(&tasks_rcu_exit_srcu)
++void exit_tasks_rcu_stop(void) __releases(&tasks_rcu_exit_srcu)
+ {
+ struct task_struct *t = current;
+
+ __srcu_read_unlock(&tasks_rcu_exit_srcu, t->rcu_tasks_idx);
+- exit_tasks_rcu_finish_trace(t);
++}
++
++/*
++ * Contribute to protect against tasklist scan blind spot while the
++ * task is exiting and may be removed from the tasklist. See
++ * corresponding synchronize_srcu() for further details.
++ */
++void exit_tasks_rcu_finish(void)
++{
++ exit_tasks_rcu_stop();
++ exit_tasks_rcu_finish_trace(current);
+ }
+
+ #else /* #ifdef CONFIG_TASKS_RCU */
+ void exit_tasks_rcu_start(void) { }
++void exit_tasks_rcu_stop(void) { }
+ void exit_tasks_rcu_finish(void) { exit_tasks_rcu_finish_trace(current); }
+ #endif /* #else #ifdef CONFIG_TASKS_RCU */
+
+--
+2.39.2
+
--- /dev/null
+From ea3a622d3a8805bc97ba3fcf861ac7ae181eefac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 3 Dec 2022 10:25:03 +0800
+Subject: rcu-tasks: Handle queue-shrink/callback-enqueue race condition
+
+From: Zqiang <qiang1.zhang@intel.com>
+
+[ Upstream commit a4fcfbee8f6274f9b3f9a71dd5b03e6772ce33f3 ]
+
+The rcu_tasks_need_gpcb() determines whether or not: (1) There are
+callbacks needing another grace period, (2) There are callbacks ready
+to be invoked, and (3) It would be a good time to shrink back down to a
+single-CPU callback list. This third case is interesting because some
+other CPU might be adding new callbacks, which might suddenly make this
+a very bad time to be shrinking.
+
+This is currently handled by requiring call_rcu_tasks_generic() to
+enqueue callbacks under the protection of rcu_read_lock() and requiring
+rcu_tasks_need_gpcb() to wait for an RCU grace period to elapse before
+finalizing the transition. This works well in practice.
+
+Unfortunately, the current code assumes that a grace period whose end is
+detected by the poll_state_synchronize_rcu() in the second "if" condition
+actually ended before the earlier code counted the callbacks queued on
+CPUs other than CPU 0 (local variable "ncbsnz"). Given the current code,
+it is possible that a long-delayed call_rcu_tasks_generic() invocation
+will queue a callback on a non-zero CPU after these CPUs have had their
+callbacks counted and zero has been stored to ncbsnz. Such a callback
+would trigger the WARN_ON_ONCE() in the second "if" statement.
+
+To see this, consider the following sequence of events:
+
+o CPU 0 invokes rcu_tasks_one_gp(), and counts fewer than
+ rcu_task_collapse_lim callbacks. It sees at least one
+ callback queued on some other CPU, thus setting ncbsnz
+ to a non-zero value.
+
+o CPU 1 invokes call_rcu_tasks_generic() and loads 42 from
+ ->percpu_enqueue_lim. It therefore decides to enqueue its
+ callback onto CPU 1's callback list, but is delayed.
+
+o CPU 0 sees the rcu_task_cb_adjust is non-zero and that the number
+ of callbacks does not exceed rcu_task_collapse_lim. It therefore
+ checks percpu_enqueue_lim, and sees that its value is greater
+ than the value one. CPU 0 therefore starts the shift back
+ to a single callback list. It sets ->percpu_enqueue_lim to 1,
+ but CPU 1 has already read the old value of 42. It also gets
+ a grace-period state value from get_state_synchronize_rcu().
+
+o CPU 0 sees that ncbsnz is non-zero in its second "if" statement,
+ so it declines to finalize the shrink operation.
+
+o CPU 0 again invokes rcu_tasks_one_gp(), and counts fewer than
+ rcu_task_collapse_lim callbacks. It also sees that there are
+ no callback queued on any other CPU, and thus sets ncbsnz to zero.
+
+o CPU 1 resumes execution and enqueues its callback onto its own
+ list. This invalidates the value of ncbsnz.
+
+o CPU 0 sees the rcu_task_cb_adjust is non-zero and that the number
+ of callbacks does not exceed rcu_task_collapse_lim. It therefore
+ checks percpu_enqueue_lim, but sees that its value is already
+ unity. It therefore does not get a new grace-period state value.
+
+o CPU 0 sees that rcu_task_cb_adjust is non-zero, ncbsnz is zero,
+ and that poll_state_synchronize_rcu() says that the grace period
+ has completed. it therefore finalizes the shrink operation,
+ setting ->percpu_dequeue_lim to the value one.
+
+o CPU 0 does a debug check, scanning the other CPUs' callback lists.
+ It sees that CPU 1's list has a callback, so it (rightly)
+ triggers the WARN_ON_ONCE(). After all, the new value of
+ ->percpu_dequeue_lim says to not bother looking at CPU 1's
+ callback list, which means that this callback will never be
+ invoked. This can result in hangs and maybe even OOMs.
+
+Based on long experience with rcutorture, this is an extremely
+low-probability race condition, but it really can happen, especially in
+preemptible kernels or within guest OSes.
+
+This commit therefore checks for completion of the grace period
+before counting callbacks. With this change, in the above failure
+scenario CPU 0 would know not to prematurely end the shrink operation
+because the grace period would not have completed before the count
+operation started.
+
+[ paulmck: Adjust grace-period end rather than adding RCU reader. ]
+[ paulmck: Avoid spurious WARN_ON_ONCE() with ->percpu_dequeue_lim check. ]
+
+Signed-off-by: Zqiang <qiang1.zhang@intel.com>
+Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/rcu/tasks.h | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/kernel/rcu/tasks.h b/kernel/rcu/tasks.h
+index 947d0318b4a2d..d5a4a129a85e9 100644
+--- a/kernel/rcu/tasks.h
++++ b/kernel/rcu/tasks.h
+@@ -384,6 +384,7 @@ static int rcu_tasks_need_gpcb(struct rcu_tasks *rtp)
+ {
+ int cpu;
+ unsigned long flags;
++ bool gpdone = poll_state_synchronize_rcu(rtp->percpu_dequeue_gpseq);
+ long n;
+ long ncbs = 0;
+ long ncbsnz = 0;
+@@ -425,21 +426,23 @@ static int rcu_tasks_need_gpcb(struct rcu_tasks *rtp)
+ WRITE_ONCE(rtp->percpu_enqueue_shift, order_base_2(nr_cpu_ids));
+ smp_store_release(&rtp->percpu_enqueue_lim, 1);
+ rtp->percpu_dequeue_gpseq = get_state_synchronize_rcu();
++ gpdone = false;
+ pr_info("Starting switch %s to CPU-0 callback queuing.\n", rtp->name);
+ }
+ raw_spin_unlock_irqrestore(&rtp->cbs_gbl_lock, flags);
+ }
+- if (rcu_task_cb_adjust && !ncbsnz &&
+- poll_state_synchronize_rcu(rtp->percpu_dequeue_gpseq)) {
++ if (rcu_task_cb_adjust && !ncbsnz && gpdone) {
+ raw_spin_lock_irqsave(&rtp->cbs_gbl_lock, flags);
+ if (rtp->percpu_enqueue_lim < rtp->percpu_dequeue_lim) {
+ WRITE_ONCE(rtp->percpu_dequeue_lim, 1);
+ pr_info("Completing switch %s to CPU-0 callback queuing.\n", rtp->name);
+ }
+- for (cpu = rtp->percpu_dequeue_lim; cpu < nr_cpu_ids; cpu++) {
+- struct rcu_tasks_percpu *rtpcp = per_cpu_ptr(rtp->rtpcpu, cpu);
++ if (rtp->percpu_dequeue_lim == 1) {
++ for (cpu = rtp->percpu_dequeue_lim; cpu < nr_cpu_ids; cpu++) {
++ struct rcu_tasks_percpu *rtpcp = per_cpu_ptr(rtp->rtpcpu, cpu);
+
+- WARN_ON_ONCE(rcu_segcblist_n_cbs(&rtpcp->cblist));
++ WARN_ON_ONCE(rcu_segcblist_n_cbs(&rtpcp->cblist));
++ }
+ }
+ raw_spin_unlock_irqrestore(&rtp->cbs_gbl_lock, flags);
+ }
+--
+2.39.2
+
--- /dev/null
+From ba794aa04da7d379cacd8e1aff0fe006c411efcd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Nov 2022 14:54:58 +0100
+Subject: rcu-tasks: Improve comments explaining tasks_rcu_exit_srcu purpose
+
+From: Frederic Weisbecker <frederic@kernel.org>
+
+[ Upstream commit e4e1e8089c5fd948da12cb9f4adc93821036945f ]
+
+Make sure we don't need to look again into the depths of git blame in
+order not to miss a subtle part about how rcu-tasks is dealing with
+exiting tasks.
+
+Suggested-by: Boqun Feng <boqun.feng@gmail.com>
+Suggested-by: Neeraj Upadhyay <quic_neeraju@quicinc.com>
+Suggested-by: Paul E. McKenney <paulmck@kernel.org>
+Cc: Oleg Nesterov <oleg@redhat.com>
+Cc: Lai Jiangshan <jiangshanlai@gmail.com>
+Cc: Eric W. Biederman <ebiederm@xmission.com>
+Signed-off-by: Frederic Weisbecker <frederic@kernel.org>
+Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
+Stable-dep-of: 28319d6dc5e2 ("rcu-tasks: Fix synchronize_rcu_tasks() VS zap_pid_ns_processes()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/rcu/tasks.h | 37 +++++++++++++++++++++++++++++--------
+ 1 file changed, 29 insertions(+), 8 deletions(-)
+
+diff --git a/kernel/rcu/tasks.h b/kernel/rcu/tasks.h
+index fe9840d90e960..488ba8adf132c 100644
+--- a/kernel/rcu/tasks.h
++++ b/kernel/rcu/tasks.h
+@@ -827,11 +827,21 @@ static void rcu_tasks_pertask(struct task_struct *t, struct list_head *hop)
+ static void rcu_tasks_postscan(struct list_head *hop)
+ {
+ /*
+- * Wait for tasks that are in the process of exiting. This
+- * does only part of the job, ensuring that all tasks that were
+- * previously exiting reach the point where they have disabled
+- * preemption, allowing the later synchronize_rcu() to finish
+- * the job.
++ * Exiting tasks may escape the tasklist scan. Those are vulnerable
++ * until their final schedule() with TASK_DEAD state. To cope with
++ * this, divide the fragile exit path part in two intersecting
++ * read side critical sections:
++ *
++ * 1) An _SRCU_ read side starting before calling exit_notify(),
++ * which may remove the task from the tasklist, and ending after
++ * the final preempt_disable() call in do_exit().
++ *
++ * 2) An _RCU_ read side starting with the final preempt_disable()
++ * call in do_exit() and ending with the final call to schedule()
++ * with TASK_DEAD state.
++ *
++ * This handles the part 1). And postgp will handle part 2) with a
++ * call to synchronize_rcu().
+ */
+ synchronize_srcu(&tasks_rcu_exit_srcu);
+ }
+@@ -898,7 +908,10 @@ static void rcu_tasks_postgp(struct rcu_tasks *rtp)
+ *
+ * In addition, this synchronize_rcu() waits for exiting tasks
+ * to complete their final preempt_disable() region of execution,
+- * cleaning up after the synchronize_srcu() above.
++ * cleaning up after synchronize_srcu(&tasks_rcu_exit_srcu),
++ * enforcing the whole region before tasklist removal until
++ * the final schedule() with TASK_DEAD state to be an RCU TASKS
++ * read side critical section.
+ */
+ synchronize_rcu();
+ }
+@@ -988,7 +1001,11 @@ void show_rcu_tasks_classic_gp_kthread(void)
+ EXPORT_SYMBOL_GPL(show_rcu_tasks_classic_gp_kthread);
+ #endif // !defined(CONFIG_TINY_RCU)
+
+-/* Do the srcu_read_lock() for the above synchronize_srcu(). */
++/*
++ * Contribute to protect against tasklist scan blind spot while the
++ * task is exiting and may be removed from the tasklist. See
++ * corresponding synchronize_srcu() for further details.
++ */
+ void exit_tasks_rcu_start(void) __acquires(&tasks_rcu_exit_srcu)
+ {
+ preempt_disable();
+@@ -996,7 +1013,11 @@ void exit_tasks_rcu_start(void) __acquires(&tasks_rcu_exit_srcu)
+ preempt_enable();
+ }
+
+-/* Do the srcu_read_unlock() for the above synchronize_srcu(). */
++/*
++ * Contribute to protect against tasklist scan blind spot while the
++ * task is exiting and may be removed from the tasklist. See
++ * corresponding synchronize_srcu() for further details.
++ */
+ void exit_tasks_rcu_finish(void) __releases(&tasks_rcu_exit_srcu)
+ {
+ struct task_struct *t = current;
+--
+2.39.2
+
--- /dev/null
+From 0701ab7bb2ca7102372c05d68f4ce95732203833 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Dec 2022 07:45:33 +0800
+Subject: rcu-tasks: Make rude RCU-Tasks work well with CPU hotplug
+
+From: Zqiang <qiang1.zhang@intel.com>
+
+[ Upstream commit ea5c8987fef20a8cca07e428aa28bc64649c5104 ]
+
+The synchronize_rcu_tasks_rude() function invokes rcu_tasks_rude_wait_gp()
+to wait one rude RCU-tasks grace period. The rcu_tasks_rude_wait_gp()
+function in turn checks if there is only a single online CPU. If so, it
+will immediately return, because a call to synchronize_rcu_tasks_rude()
+is by definition a grace period on a single-CPU system. (We could
+have blocked!)
+
+Unfortunately, this check uses num_online_cpus() without synchronization,
+which can result in too-short grace periods. To see this, consider the
+following scenario:
+
+ CPU0 CPU1 (going offline)
+ migration/1 task:
+ cpu_stopper_thread
+ -> take_cpu_down
+ -> _cpu_disable
+ (dec __num_online_cpus)
+ ->cpuhp_invoke_callback
+ preempt_disable
+ access old_data0
+ task1
+ del old_data0 .....
+ synchronize_rcu_tasks_rude()
+ task1 schedule out
+ ....
+ task2 schedule in
+ rcu_tasks_rude_wait_gp()
+ ->__num_online_cpus == 1
+ ->return
+ ....
+ task1 schedule in
+ ->free old_data0
+ preempt_enable
+
+When CPU1 decrements __num_online_cpus, its value becomes 1. However,
+CPU1 has not finished going offline, and will take one last trip through
+the scheduler and the idle loop before it actually stops executing
+instructions. Because synchronize_rcu_tasks_rude() is mostly used for
+tracing, and because both the scheduler and the idle loop can be traced,
+this means that CPU0's prematurely ended grace period might disrupt the
+tracing on CPU1. Given that this disruption might include CPU1 executing
+instructions in memory that was just now freed (and maybe reallocated),
+this is a matter of some concern.
+
+This commit therefore removes that problematic single-CPU check from the
+rcu_tasks_rude_wait_gp() function. This dispenses with the single-CPU
+optimization, but there is no evidence indicating that this optimization
+is important. In addition, synchronize_rcu_tasks_generic() contains a
+similar optimization (albeit only for early boot), which also splats.
+(As in exactly why are you invoking synchronize_rcu_tasks_rude() so
+early in boot, anyway???)
+
+It is OK for the synchronize_rcu_tasks_rude() function's check to be
+unsynchronized because the only times that this check can evaluate to
+true is when there is only a single CPU running with preemption
+disabled.
+
+While in the area, this commit also fixes a minor bug in which a
+call to synchronize_rcu_tasks_rude() would instead be attributed to
+synchronize_rcu_tasks().
+
+[ paulmck: Add "synchronize_" prefix and "()" suffix. ]
+
+Signed-off-by: Zqiang <qiang1.zhang@intel.com>
+Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/rcu/tasks.h | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+diff --git a/kernel/rcu/tasks.h b/kernel/rcu/tasks.h
+index 03388e2e29df0..947d0318b4a2d 100644
+--- a/kernel/rcu/tasks.h
++++ b/kernel/rcu/tasks.h
+@@ -560,8 +560,9 @@ static int __noreturn rcu_tasks_kthread(void *arg)
+ static void synchronize_rcu_tasks_generic(struct rcu_tasks *rtp)
+ {
+ /* Complain if the scheduler has not started. */
+- WARN_ONCE(rcu_scheduler_active == RCU_SCHEDULER_INACTIVE,
+- "synchronize_rcu_tasks called too soon");
++ if (WARN_ONCE(rcu_scheduler_active == RCU_SCHEDULER_INACTIVE,
++ "synchronize_%s() called too soon", rtp->name))
++ return;
+
+ // If the grace-period kthread is running, use it.
+ if (READ_ONCE(rtp->kthread_ptr)) {
+@@ -1064,9 +1065,6 @@ static void rcu_tasks_be_rude(struct work_struct *work)
+ // Wait for one rude RCU-tasks grace period.
+ static void rcu_tasks_rude_wait_gp(struct rcu_tasks *rtp)
+ {
+- if (num_online_cpus() <= 1)
+- return; // Fastpath for only one CPU.
+-
+ rtp->n_ipis += cpumask_weight(cpu_online_mask);
+ schedule_on_each_cpu(rcu_tasks_be_rude);
+ }
+--
+2.39.2
+
--- /dev/null
+From 82ce300a934f189ffdb86576b9755ef6033d553c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Nov 2022 14:54:59 +0100
+Subject: rcu-tasks: Remove preemption disablement around srcu_read_[un]lock()
+ calls
+
+From: Frederic Weisbecker <frederic@kernel.org>
+
+[ Upstream commit 44757092958bdd749775022f915b7ac974384c2a ]
+
+Ever since the following commit:
+
+ 5a41344a3d83 ("srcu: Simplify __srcu_read_unlock() via this_cpu_dec()")
+
+SRCU doesn't rely anymore on preemption to be disabled in order to
+modify the per-CPU counter. And even then it used to be done from the API
+itself.
+
+Therefore and after checking further, it appears to be safe to remove
+the preemption disablement around __srcu_read_[un]lock() in
+exit_tasks_rcu_start() and exit_tasks_rcu_finish()
+
+Suggested-by: Boqun Feng <boqun.feng@gmail.com>
+Suggested-by: Paul E. McKenney <paulmck@kernel.org>
+Suggested-by: Neeraj Upadhyay <quic_neeraju@quicinc.com>
+Cc: Lai Jiangshan <jiangshanlai@gmail.com>
+Signed-off-by: Frederic Weisbecker <frederic@kernel.org>
+Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
+Stable-dep-of: 28319d6dc5e2 ("rcu-tasks: Fix synchronize_rcu_tasks() VS zap_pid_ns_processes()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/rcu/tasks.h | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/kernel/rcu/tasks.h b/kernel/rcu/tasks.h
+index 488ba8adf132c..20617a2d04ed9 100644
+--- a/kernel/rcu/tasks.h
++++ b/kernel/rcu/tasks.h
+@@ -1008,9 +1008,7 @@ EXPORT_SYMBOL_GPL(show_rcu_tasks_classic_gp_kthread);
+ */
+ void exit_tasks_rcu_start(void) __acquires(&tasks_rcu_exit_srcu)
+ {
+- preempt_disable();
+ current->rcu_tasks_idx = __srcu_read_lock(&tasks_rcu_exit_srcu);
+- preempt_enable();
+ }
+
+ /*
+@@ -1022,9 +1020,7 @@ void exit_tasks_rcu_finish(void) __releases(&tasks_rcu_exit_srcu)
+ {
+ struct task_struct *t = current;
+
+- preempt_disable();
+ __srcu_read_unlock(&tasks_rcu_exit_srcu, t->rcu_tasks_idx);
+- preempt_enable();
+ exit_tasks_rcu_finish_trace(t);
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 488c30ed8d893b0269abb8ad1ddd714048210a66 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Feb 2023 09:21:03 -0800
+Subject: RDMA/cxgb4: add null-ptr-check after ip_dev_find()
+
+From: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
+
+[ Upstream commit ef42520240aacfc0d46c8d780c051d135a8dc9b7 ]
+
+ip_dev_find() may return NULL and assign it to pdev which is
+dereferenced later.
+Fix this by checking the return value of ip_dev_find() for NULL
+similar to the way it is done with other instances of said function.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: 1cab775c3e75 ("RDMA/cxgb4: Fix LE hash collision bug for passive open connection")
+Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
+Link: https://lore.kernel.org/r/20230201172103.17261-1-n.zhandarovich@fintech.ru
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/cxgb4/cm.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
+index 499a425a33791..ea3ddf0d24114 100644
+--- a/drivers/infiniband/hw/cxgb4/cm.c
++++ b/drivers/infiniband/hw/cxgb4/cm.c
+@@ -4144,6 +4144,10 @@ static int rx_pkt(struct c4iw_dev *dev, struct sk_buff *skb)
+
+ if (neigh->dev->flags & IFF_LOOPBACK) {
+ pdev = ip_dev_find(&init_net, iph->daddr);
++ if (!pdev) {
++ pr_err("%s - failed to find device!\n", __func__);
++ goto free_dst;
++ }
+ e = cxgb4_l2t_get(dev->rdev.lldi.l2t, neigh,
+ pdev, 0);
+ pi = (struct port_info *)netdev_priv(pdev);
+--
+2.39.2
+
--- /dev/null
+From 1c066f53c4a4a677b0b823d6f4f0985d1be73ca2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Feb 2023 10:48:50 -0800
+Subject: RDMA/cxgb4: Fix potential null-ptr-deref in pass_establish()
+
+From: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
+
+[ Upstream commit 283861a4c52c1ea4df3dd1b6fc75a50796ce3524 ]
+
+If get_ep_from_tid() fails to lookup non-NULL value for ep, ep is
+dereferenced later regardless of whether it is empty.
+This patch adds a simple sanity check to fix the issue.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: 944661dd97f4 ("RDMA/iw_cxgb4: atomically lookup ep and get a reference")
+Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
+Link: https://lore.kernel.org/r/20230202184850.29882-1-n.zhandarovich@fintech.ru
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/cxgb4/cm.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
+index ea3ddf0d24114..ced615b5ea096 100644
+--- a/drivers/infiniband/hw/cxgb4/cm.c
++++ b/drivers/infiniband/hw/cxgb4/cm.c
+@@ -2676,6 +2676,9 @@ static int pass_establish(struct c4iw_dev *dev, struct sk_buff *skb)
+ u16 tcp_opt = ntohs(req->tcp_opt);
+
+ ep = get_ep_from_tid(dev, tid);
++ if (!ep)
++ return 0;
++
+ pr_debug("ep %p tid %u\n", ep, ep->hwtid);
+ ep->snd_seq = be32_to_cpu(req->snd_isn);
+ ep->rcv_seq = be32_to_cpu(req->rcv_isn);
+--
+2.39.2
+
--- /dev/null
+From 27ca48823a1433ca4ff61bced2a5005f046fe1c2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Dec 2022 16:11:39 +0400
+Subject: RDMA/erdma: Fix refcount leak in erdma_mmap
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit ee84146c05ad2316b9a7222d0ec4413e0bf30eeb ]
+
+rdma_user_mmap_entry_get() take reference, we should release it when not
+need anymore, add the missing rdma_user_mmap_entry_put() in the error
+path to fix it.
+
+Fixes: 155055771704 ("RDMA/erdma: Add verbs implementation")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Link: https://lore.kernel.org/r/20221220121139.1540564-1-linmq006@gmail.com
+Acked-by: Cheng Xu <chengyou@linux.alibaba.com>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/erdma/erdma_verbs.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/erdma/erdma_verbs.c b/drivers/infiniband/hw/erdma/erdma_verbs.c
+index 5dab1e87975ba..9c30d78730aa1 100644
+--- a/drivers/infiniband/hw/erdma/erdma_verbs.c
++++ b/drivers/infiniband/hw/erdma/erdma_verbs.c
+@@ -1110,12 +1110,14 @@ int erdma_mmap(struct ib_ucontext *ctx, struct vm_area_struct *vma)
+ prot = pgprot_device(vma->vm_page_prot);
+ break;
+ default:
+- return -EINVAL;
++ err = -EINVAL;
++ goto put_entry;
+ }
+
+ err = rdma_user_mmap_io(ctx, vma, PFN_DOWN(entry->address), PAGE_SIZE,
+ prot, rdma_entry);
+
++put_entry:
+ rdma_user_mmap_entry_put(rdma_entry);
+ return err;
+ }
+--
+2.39.2
+
--- /dev/null
+From c37f01536c7037813b5654015469e7172de41a9a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Dec 2022 11:29:00 +0400
+Subject: RDMA/hns: Fix refcount leak in hns_roce_mmap
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit cf6a05c8494a8ae7fec8e5f1229b45ca5b4bcd30 ]
+
+rdma_user_mmap_entry_get_pgoff() takes the reference.
+Add missing rdma_user_mmap_entry_put() to release the reference.
+
+Fixes: 0045e0d3f42e ("RDMA/hns: Support direct wqe of userspace")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Acked-by Haoyue Xu <xuhaoyue1@hisilicon.com>
+Link: https://lore.kernel.org/r/20221223072900.802728-1-linmq006@gmail.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_main.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_main.c b/drivers/infiniband/hw/hns/hns_roce_main.c
+index 8ba68ac12388d..946ba1109e878 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_main.c
++++ b/drivers/infiniband/hw/hns/hns_roce_main.c
+@@ -443,14 +443,15 @@ static int hns_roce_mmap(struct ib_ucontext *uctx, struct vm_area_struct *vma)
+ prot = pgprot_device(vma->vm_page_prot);
+ break;
+ default:
+- return -EINVAL;
++ ret = -EINVAL;
++ goto out;
+ }
+
+ ret = rdma_user_mmap_io(uctx, vma, pfn, rdma_entry->npages * PAGE_SIZE,
+ prot, rdma_entry);
+
++out:
+ rdma_user_mmap_entry_put(rdma_entry);
+-
+ return ret;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From d39d8644e703e57a350bd2ed3e50870865cd4124 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Feb 2023 14:19:38 -0600
+Subject: RDMA/irdma: Cap MSIX used to online CPUs + 1
+
+From: Mustafa Ismail <mustafa.ismail@intel.com>
+
+[ Upstream commit 9cd9842c46996ef62173c36619c746f57416bcb0 ]
+
+The irdma driver can use a maximum number of msix vectors equal
+to num_online_cpus() + 1 and the kernel warning stack below is shown
+if that number is exceeded.
+
+The kernel throws a warning as the driver tries to update the affinity
+hint with a CPU mask greater than the max CPU IDs. Fix this by capping
+the MSIX vectors to num_online_cpus() + 1.
+
+ WARNING: CPU: 7 PID: 23655 at include/linux/cpumask.h:106 irdma_cfg_ceq_vector+0x34c/0x3f0 [irdma]
+ RIP: 0010:irdma_cfg_ceq_vector+0x34c/0x3f0 [irdma]
+ Call Trace:
+ irdma_rt_init_hw+0xa62/0x1290 [irdma]
+ ? irdma_alloc_local_mac_entry+0x1a0/0x1a0 [irdma]
+ ? __is_kernel_percpu_address+0x63/0x310
+ ? rcu_read_lock_held_common+0xe/0xb0
+ ? irdma_lan_unregister_qset+0x280/0x280 [irdma]
+ ? irdma_request_reset+0x80/0x80 [irdma]
+ ? ice_get_qos_params+0x84/0x390 [ice]
+ irdma_probe+0xa40/0xfc0 [irdma]
+ ? rcu_read_lock_bh_held+0xd0/0xd0
+ ? irdma_remove+0x140/0x140 [irdma]
+ ? rcu_read_lock_sched_held+0x62/0xe0
+ ? down_write+0x187/0x3d0
+ ? auxiliary_match_id+0xf0/0x1a0
+ ? irdma_remove+0x140/0x140 [irdma]
+ auxiliary_bus_probe+0xa6/0x100
+ __driver_probe_device+0x4a4/0xd50
+ ? __device_attach_driver+0x2c0/0x2c0
+ driver_probe_device+0x4a/0x110
+ __driver_attach+0x1aa/0x350
+ bus_for_each_dev+0x11d/0x1b0
+ ? subsys_dev_iter_init+0xe0/0xe0
+ bus_add_driver+0x3b1/0x610
+ driver_register+0x18e/0x410
+ ? 0xffffffffc0b88000
+ irdma_init_module+0x50/0xaa [irdma]
+ do_one_initcall+0x103/0x5f0
+ ? perf_trace_initcall_level+0x420/0x420
+ ? do_init_module+0x4e/0x700
+ ? __kasan_kmalloc+0x7d/0xa0
+ ? kmem_cache_alloc_trace+0x188/0x2b0
+ ? kasan_unpoison+0x21/0x50
+ do_init_module+0x1d1/0x700
+ load_module+0x3867/0x5260
+ ? layout_and_allocate+0x3990/0x3990
+ ? rcu_read_lock_held_common+0xe/0xb0
+ ? rcu_read_lock_sched_held+0x62/0xe0
+ ? rcu_read_lock_bh_held+0xd0/0xd0
+ ? __vmalloc_node_range+0x46b/0x890
+ ? lock_release+0x5c8/0xba0
+ ? alloc_vm_area+0x120/0x120
+ ? selinux_kernel_module_from_file+0x2a5/0x300
+ ? __inode_security_revalidate+0xf0/0xf0
+ ? __do_sys_init_module+0x1db/0x260
+ __do_sys_init_module+0x1db/0x260
+ ? load_module+0x5260/0x5260
+ ? do_syscall_64+0x22/0x450
+ do_syscall_64+0xa5/0x450
+ entry_SYSCALL_64_after_hwframe+0x66/0xdb
+
+Fixes: 44d9e52977a1 ("RDMA/irdma: Implement device initialization definitions")
+Signed-off-by: Mustafa Ismail <mustafa.ismail@intel.com>
+Signed-off-by: Shiraz Saleem <shiraz.saleem@intel.com>
+Signed-off-by: Sindhu Devale <sindhu.devale@intel.com>
+Link: https://lore.kernel.org/r/20230207201938.1329-1-sindhu.devale@intel.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/irdma/hw.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/infiniband/hw/irdma/hw.c b/drivers/infiniband/hw/irdma/hw.c
+index ab246447520bd..2e1e2bad04011 100644
+--- a/drivers/infiniband/hw/irdma/hw.c
++++ b/drivers/infiniband/hw/irdma/hw.c
+@@ -483,6 +483,8 @@ static int irdma_save_msix_info(struct irdma_pci_f *rf)
+ iw_qvlist->num_vectors = rf->msix_count;
+ if (rf->msix_count <= num_online_cpus())
+ rf->msix_shared = true;
++ else if (rf->msix_count > num_online_cpus() + 1)
++ rf->msix_count = num_online_cpus() + 1;
+
+ pmsix = rf->msix_entries;
+ for (i = 0, ceq_idx = 0; i < rf->msix_count; i++, iw_qvinfo++) {
+--
+2.39.2
+
--- /dev/null
+From c77a920ffdaf5bb23b8e5c619c820319cabf725c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Feb 2023 16:32:02 -0800
+Subject: RDMA/mana_ib: Fix a bug when the PF indicates more entries for
+ registering memory on first packet
+
+From: Long Li <longli@microsoft.com>
+
+[ Upstream commit 89d42b8c85b4c67d310c5ccaf491acbf71a260c3 ]
+
+When registering memory in a large chunk that doesn't fit into a single PF
+message, the PF may return GDMA_STATUS_MORE_ENTRIES on the first message if
+there are more messages needed for registering more chunks.
+
+Fix the VF to make it process the correct return code.
+
+Fixes: 0266a177631d ("RDMA/mana_ib: Add a driver for Microsoft Azure Network Adapter")
+Link: https://lore.kernel.org/r/1676507522-21018-1-git-send-email-longli@linuxonhyperv.com
+Signed-off-by: Long Li <longli@microsoft.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mana/main.c | 22 ++++++++++++----------
+ 1 file changed, 12 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/infiniband/hw/mana/main.c b/drivers/infiniband/hw/mana/main.c
+index 8b3bc302d6f3a..7be4c3adb4e2b 100644
+--- a/drivers/infiniband/hw/mana/main.c
++++ b/drivers/infiniband/hw/mana/main.c
+@@ -249,7 +249,8 @@ static int
+ mana_ib_gd_first_dma_region(struct mana_ib_dev *dev,
+ struct gdma_context *gc,
+ struct gdma_create_dma_region_req *create_req,
+- size_t num_pages, mana_handle_t *gdma_region)
++ size_t num_pages, mana_handle_t *gdma_region,
++ u32 expected_status)
+ {
+ struct gdma_create_dma_region_resp create_resp = {};
+ unsigned int create_req_msg_size;
+@@ -261,7 +262,7 @@ mana_ib_gd_first_dma_region(struct mana_ib_dev *dev,
+
+ err = mana_gd_send_request(gc, create_req_msg_size, create_req,
+ sizeof(create_resp), &create_resp);
+- if (err || create_resp.hdr.status) {
++ if (err || create_resp.hdr.status != expected_status) {
+ ibdev_dbg(&dev->ib_dev,
+ "Failed to create DMA region: %d, 0x%x\n",
+ err, create_resp.hdr.status);
+@@ -372,14 +373,21 @@ int mana_ib_gd_create_dma_region(struct mana_ib_dev *dev, struct ib_umem *umem,
+
+ page_addr_list = create_req->page_addr_list;
+ rdma_umem_for_each_dma_block(umem, &biter, page_sz) {
++ u32 expected_status = 0;
++
+ page_addr_list[tail++] = rdma_block_iter_dma_address(&biter);
+ if (tail < num_pages_to_handle)
+ continue;
+
++ if (num_pages_processed + num_pages_to_handle <
++ num_pages_total)
++ expected_status = GDMA_STATUS_MORE_ENTRIES;
++
+ if (!num_pages_processed) {
+ /* First create message */
+ err = mana_ib_gd_first_dma_region(dev, gc, create_req,
+- tail, gdma_region);
++ tail, gdma_region,
++ expected_status);
+ if (err)
+ goto out;
+
+@@ -392,14 +400,8 @@ int mana_ib_gd_create_dma_region(struct mana_ib_dev *dev, struct ib_umem *umem,
+ page_addr_list = add_req->page_addr_list;
+ } else {
+ /* Subsequent create messages */
+- u32 expected_s = 0;
+-
+- if (num_pages_processed + num_pages_to_handle <
+- num_pages_total)
+- expected_s = GDMA_STATUS_MORE_ENTRIES;
+-
+ err = mana_ib_gd_add_dma_region(dev, gc, add_req, tail,
+- expected_s);
++ expected_status);
+ if (err)
+ break;
+ }
+--
+2.39.2
+
--- /dev/null
+From 77b01d3dad5c2952bbeab20beda2718877648822 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Jan 2023 17:59:32 -0600
+Subject: RDMA/rxe: Cleanup mr_check_range
+
+From: Bob Pearson <rpearsonhpe@gmail.com>
+
+[ Upstream commit ade58da2a73de1b65616e4b1080dc078d1ce0b5d ]
+
+Remove blank lines and replace EFAULT by EINVAL when an invalid
+mr type is used.
+
+Link: https://lore.kernel.org/r/20230119235936.19728-2-rpearsonhpe@gmail.com
+Signed-off-by: Bob Pearson <rpearsonhpe@gmail.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Stable-dep-of: 5ff31dfcd6d2 ("Subject: RDMA/rxe: Handle zero length rdma")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe_mr.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_mr.c b/drivers/infiniband/sw/rxe/rxe_mr.c
+index 072eac4b65d29..632ee1e516a1a 100644
+--- a/drivers/infiniband/sw/rxe/rxe_mr.c
++++ b/drivers/infiniband/sw/rxe/rxe_mr.c
+@@ -26,8 +26,6 @@ u8 rxe_get_next_key(u32 last_key)
+
+ int mr_check_range(struct rxe_mr *mr, u64 iova, size_t length)
+ {
+-
+-
+ switch (mr->ibmr.type) {
+ case IB_MR_TYPE_DMA:
+ return 0;
+@@ -41,7 +39,7 @@ int mr_check_range(struct rxe_mr *mr, u64 iova, size_t length)
+
+ default:
+ rxe_dbg_mr(mr, "type (%d) not supported\n", mr->ibmr.type);
+- return -EFAULT;
++ return -EINVAL;
+ }
+ }
+
+--
+2.39.2
+
--- /dev/null
+From b1a0941ee8abf2e7c034b8ec9f0db63a0a256a63 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Jan 2023 17:59:36 -0600
+Subject: RDMA/rxe: Cleanup page variables in rxe_mr.c
+
+From: Bob Pearson <rpearsonhpe@gmail.com>
+
+[ Upstream commit 325a7eb85199ec9c5b5a7af812f43ea16b735569 ]
+
+Cleanup usage of mr->page_shift and mr->page_mask and introduce
+an extractor for mr->ibmr.page_size. Normal usage in the kernel
+has page_mask masking out offset in page rather than masking out
+the page number. The rxe driver had reversed that which was confusing.
+Implicitly there can be a per mr page_size which was not uniformly
+supported.
+
+Link: https://lore.kernel.org/r/20230119235936.19728-6-rpearsonhpe@gmail.com
+Signed-off-by: Bob Pearson <rpearsonhpe@gmail.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Stable-dep-of: 5ff31dfcd6d2 ("Subject: RDMA/rxe: Handle zero length rdma")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe_mr.c | 31 ++++++++++++---------------
+ drivers/infiniband/sw/rxe/rxe_verbs.h | 11 +++++++---
+ 2 files changed, 22 insertions(+), 20 deletions(-)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_mr.c b/drivers/infiniband/sw/rxe/rxe_mr.c
+index 5c4ce43914fa2..2181165ea40d7 100644
+--- a/drivers/infiniband/sw/rxe/rxe_mr.c
++++ b/drivers/infiniband/sw/rxe/rxe_mr.c
+@@ -62,6 +62,9 @@ static void rxe_mr_init(int access, struct rxe_mr *mr)
+ mr->lkey = mr->ibmr.lkey = lkey;
+ mr->rkey = mr->ibmr.rkey = rkey;
+
++ mr->ibmr.page_size = PAGE_SIZE;
++ mr->page_mask = PAGE_MASK;
++ mr->page_shift = PAGE_SHIFT;
+ mr->state = RXE_MR_STATE_INVALID;
+ }
+
+@@ -151,9 +154,6 @@ int rxe_mr_init_user(struct rxe_dev *rxe, u64 start, u64 length, u64 iova,
+ goto err_release_umem;
+ }
+
+- mr->page_shift = PAGE_SHIFT;
+- mr->page_mask = PAGE_SIZE - 1;
+-
+ num_buf = 0;
+ map = mr->map;
+ if (length > 0) {
+@@ -182,7 +182,7 @@ int rxe_mr_init_user(struct rxe_dev *rxe, u64 start, u64 length, u64 iova,
+ goto err_release_umem;
+ }
+ buf->addr = (uintptr_t)vaddr;
+- buf->size = PAGE_SIZE;
++ buf->size = mr_page_size(mr);
+ num_buf++;
+ buf++;
+
+@@ -191,10 +191,9 @@ int rxe_mr_init_user(struct rxe_dev *rxe, u64 start, u64 length, u64 iova,
+
+ mr->umem = umem;
+ mr->access = access;
+- mr->offset = ib_umem_offset(umem);
++ mr->page_offset = ib_umem_offset(umem);
+ mr->state = RXE_MR_STATE_VALID;
+ mr->ibmr.type = IB_MR_TYPE_USER;
+- mr->ibmr.page_size = PAGE_SIZE;
+
+ return 0;
+
+@@ -248,29 +247,27 @@ int rxe_map_mr_sg(struct ib_mr *ibmr, struct scatterlist *sg,
+ int sg_nents, unsigned int *sg_offset)
+ {
+ struct rxe_mr *mr = to_rmr(ibmr);
+- int n;
+-
+- mr->nbuf = 0;
++ unsigned int page_size = mr_page_size(mr);
+
+- n = ib_sg_to_pages(ibmr, sg, sg_nents, sg_offset, rxe_set_page);
++ mr->page_shift = ilog2(page_size);
++ mr->page_mask = ~((u64)page_size - 1);
++ mr->page_offset = ibmr->iova & (page_size - 1);
+
+- mr->page_shift = ilog2(ibmr->page_size);
+- mr->page_mask = ibmr->page_size - 1;
+- mr->offset = ibmr->iova & mr->page_mask;
++ mr->nbuf = 0;
+
+- return n;
++ return ib_sg_to_pages(ibmr, sg, sg_nents, sg_offset, rxe_set_page);
+ }
+
+ static void lookup_iova(struct rxe_mr *mr, u64 iova, int *m_out, int *n_out,
+ size_t *offset_out)
+ {
+- size_t offset = iova - mr->ibmr.iova + mr->offset;
++ size_t offset = iova - mr->ibmr.iova + mr->page_offset;
+ int map_index;
+ int buf_index;
+ u64 length;
+
+ if (likely(mr->page_shift)) {
+- *offset_out = offset & mr->page_mask;
++ *offset_out = offset & (mr_page_size(mr) - 1);
+ offset >>= mr->page_shift;
+ *n_out = offset & mr->map_mask;
+ *m_out = offset >> mr->map_shift;
+@@ -329,7 +326,7 @@ int rxe_flush_pmem_iova(struct rxe_mr *mr, u64 iova, int length)
+ if (mr->ibmr.type == IB_MR_TYPE_DMA)
+ return -EFAULT;
+
+- offset = (iova - mr->ibmr.iova + mr->offset) & mr->page_mask;
++ offset = (iova - mr->ibmr.iova + mr->page_offset) & mr->page_mask;
+ while (length > 0) {
+ u8 *va;
+ int bytes;
+diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.h b/drivers/infiniband/sw/rxe/rxe_verbs.h
+index 19ddfa8904803..bfc94caaeec57 100644
+--- a/drivers/infiniband/sw/rxe/rxe_verbs.h
++++ b/drivers/infiniband/sw/rxe/rxe_verbs.h
+@@ -310,11 +310,11 @@ struct rxe_mr {
+ u32 lkey;
+ u32 rkey;
+ enum rxe_mr_state state;
+- u32 offset;
+ int access;
+
+- int page_shift;
+- int page_mask;
++ unsigned int page_offset;
++ unsigned int page_shift;
++ u64 page_mask;
+ int map_shift;
+ int map_mask;
+
+@@ -329,6 +329,11 @@ struct rxe_mr {
+ struct rxe_map **map;
+ };
+
++static inline unsigned int mr_page_size(struct rxe_mr *mr)
++{
++ return mr ? mr->ibmr.page_size : PAGE_SIZE;
++}
++
+ enum rxe_mw_state {
+ RXE_MW_STATE_INVALID = RXE_MR_STATE_INVALID,
+ RXE_MW_STATE_FREE = RXE_MR_STATE_FREE,
+--
+2.39.2
+
--- /dev/null
+From 8bb76a03ea331b180d3b42c6082fd0a758ada637 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Feb 2023 01:10:54 -0600
+Subject: RDMA/rxe: Fix missing memory barriers in rxe_queue.h
+
+From: Bob Pearson <rpearsonhpe@gmail.com>
+
+[ Upstream commit a77a52385e9a761f896a88a4162e69fb7ccafe3f ]
+
+An earlier patch which introduced smp_load_acquire/smp_store_release
+into rxe_queue.h incorrectly assumed that surrounding spin-locks in
+rxe_verbs.c around queue updates for kernel ulps was sufficient to
+protect the passing of data through the queues between the ulp and
+the rxe tasklets. But this was incorrect. The typical sequence was
+
+ ulp rxe requester tasklet
+ ------------------------ ---------------------
+ spin_lock_irqsave() wqe = queue_head(queue)
+ if (!queue_full(q)) { if (!wqe)
+ spin_unlock_irqrestore return;
+ return -ENOMEM
+ } <process wqe>
+ wqe = queue_producer_addr(q)
+ <fill in wqe> queue_advance_consumer(queue)
+ queue_advance_producer(q)
+ spin_unlock_irqrestore()
+
+queue_head() calls queue_empty() which calls smp_load_acquire()
+For user space apps queue_advance_producer() calls smp_store_release()
+so that there is a memory barrier between the producer and the
+consumer but for kernel ulps queue_advance_produce() just incremented
+the producer index because the lock function is a release function.
+But to work the barrier has to come between filling in the wqe and
+updating the producer index. This patch adds the missing barriers.
+It also changes the enum names for the ulp queue types to
+ QUEUE_TYPE_FROM/TO_ULP instead of QUEUE_TYPE_TO/FROM_DRIVER
+which is very ambiguous. This bug is suspected as the cause of very
+rare lockups in a very high scale storage application. It is a bug
+in any case and should be corrected.
+
+Fixes: 0a67c46d2e99 ("RDMA/rxe: Protect user space index loads/stores")
+Link: https://lore.kernel.org/r/20230214071053.5395-1-rpearsonhpe@gmail.com
+Signed-off-by: Bob Pearson <rpearsonhpe@gmail.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe_queue.h | 108 ++++++++++++++++----------
+ drivers/infiniband/sw/rxe/rxe_verbs.c | 20 ++---
+ 2 files changed, 76 insertions(+), 52 deletions(-)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_queue.h b/drivers/infiniband/sw/rxe/rxe_queue.h
+index ed44042782fa7..c711cb98b9496 100644
+--- a/drivers/infiniband/sw/rxe/rxe_queue.h
++++ b/drivers/infiniband/sw/rxe/rxe_queue.h
+@@ -35,19 +35,26 @@
+ /**
+ * enum queue_type - type of queue
+ * @QUEUE_TYPE_TO_CLIENT: Queue is written by rxe driver and
+- * read by client. Used by rxe driver only.
++ * read by client which may be a user space
++ * application or a kernel ulp.
++ * Used by rxe internals only.
+ * @QUEUE_TYPE_FROM_CLIENT: Queue is written by client and
+- * read by rxe driver. Used by rxe driver only.
+- * @QUEUE_TYPE_TO_DRIVER: Queue is written by client and
+- * read by rxe driver. Used by kernel client only.
+- * @QUEUE_TYPE_FROM_DRIVER: Queue is written by rxe driver and
+- * read by client. Used by kernel client only.
++ * read by rxe driver.
++ * Used by rxe internals only.
++ * @QUEUE_TYPE_FROM_ULP: Queue is written by kernel ulp and
++ * read by rxe driver.
++ * Used by kernel verbs APIs only on
++ * behalf of ulps.
++ * @QUEUE_TYPE_TO_ULP: Queue is written by rxe driver and
++ * read by kernel ulp.
++ * Used by kernel verbs APIs only on
++ * behalf of ulps.
+ */
+ enum queue_type {
+ QUEUE_TYPE_TO_CLIENT,
+ QUEUE_TYPE_FROM_CLIENT,
+- QUEUE_TYPE_TO_DRIVER,
+- QUEUE_TYPE_FROM_DRIVER,
++ QUEUE_TYPE_FROM_ULP,
++ QUEUE_TYPE_TO_ULP,
+ };
+
+ struct rxe_queue_buf;
+@@ -62,9 +69,9 @@ struct rxe_queue {
+ u32 index_mask;
+ enum queue_type type;
+ /* private copy of index for shared queues between
+- * kernel space and user space. Kernel reads and writes
++ * driver and clients. Driver reads and writes
+ * this copy and then replicates to rxe_queue_buf
+- * for read access by user space.
++ * for read access by clients.
+ */
+ u32 index;
+ };
+@@ -97,19 +104,21 @@ static inline u32 queue_get_producer(const struct rxe_queue *q,
+
+ switch (type) {
+ case QUEUE_TYPE_FROM_CLIENT:
+- /* protect user index */
++ /* used by rxe, client owns the index */
+ prod = smp_load_acquire(&q->buf->producer_index);
+ break;
+ case QUEUE_TYPE_TO_CLIENT:
++ /* used by rxe which owns the index */
+ prod = q->index;
+ break;
+- case QUEUE_TYPE_FROM_DRIVER:
+- /* protect driver index */
+- prod = smp_load_acquire(&q->buf->producer_index);
+- break;
+- case QUEUE_TYPE_TO_DRIVER:
++ case QUEUE_TYPE_FROM_ULP:
++ /* used by ulp which owns the index */
+ prod = q->buf->producer_index;
+ break;
++ case QUEUE_TYPE_TO_ULP:
++ /* used by ulp, rxe owns the index */
++ prod = smp_load_acquire(&q->buf->producer_index);
++ break;
+ }
+
+ return prod;
+@@ -122,19 +131,21 @@ static inline u32 queue_get_consumer(const struct rxe_queue *q,
+
+ switch (type) {
+ case QUEUE_TYPE_FROM_CLIENT:
++ /* used by rxe which owns the index */
+ cons = q->index;
+ break;
+ case QUEUE_TYPE_TO_CLIENT:
+- /* protect user index */
++ /* used by rxe, client owns the index */
+ cons = smp_load_acquire(&q->buf->consumer_index);
+ break;
+- case QUEUE_TYPE_FROM_DRIVER:
+- cons = q->buf->consumer_index;
+- break;
+- case QUEUE_TYPE_TO_DRIVER:
+- /* protect driver index */
++ case QUEUE_TYPE_FROM_ULP:
++ /* used by ulp, rxe owns the index */
+ cons = smp_load_acquire(&q->buf->consumer_index);
+ break;
++ case QUEUE_TYPE_TO_ULP:
++ /* used by ulp which owns the index */
++ cons = q->buf->consumer_index;
++ break;
+ }
+
+ return cons;
+@@ -172,24 +183,31 @@ static inline void queue_advance_producer(struct rxe_queue *q,
+
+ switch (type) {
+ case QUEUE_TYPE_FROM_CLIENT:
+- pr_warn("%s: attempt to advance client index\n",
+- __func__);
++ /* used by rxe, client owns the index */
++ if (WARN_ON(1))
++ pr_warn("%s: attempt to advance client index\n",
++ __func__);
+ break;
+ case QUEUE_TYPE_TO_CLIENT:
++ /* used by rxe which owns the index */
+ prod = q->index;
+ prod = (prod + 1) & q->index_mask;
+ q->index = prod;
+- /* protect user index */
++ /* release so client can read it safely */
+ smp_store_release(&q->buf->producer_index, prod);
+ break;
+- case QUEUE_TYPE_FROM_DRIVER:
+- pr_warn("%s: attempt to advance driver index\n",
+- __func__);
+- break;
+- case QUEUE_TYPE_TO_DRIVER:
++ case QUEUE_TYPE_FROM_ULP:
++ /* used by ulp which owns the index */
+ prod = q->buf->producer_index;
+ prod = (prod + 1) & q->index_mask;
+- q->buf->producer_index = prod;
++ /* release so rxe can read it safely */
++ smp_store_release(&q->buf->producer_index, prod);
++ break;
++ case QUEUE_TYPE_TO_ULP:
++ /* used by ulp, rxe owns the index */
++ if (WARN_ON(1))
++ pr_warn("%s: attempt to advance driver index\n",
++ __func__);
+ break;
+ }
+ }
+@@ -201,24 +219,30 @@ static inline void queue_advance_consumer(struct rxe_queue *q,
+
+ switch (type) {
+ case QUEUE_TYPE_FROM_CLIENT:
+- cons = q->index;
+- cons = (cons + 1) & q->index_mask;
++ /* used by rxe which owns the index */
++ cons = (q->index + 1) & q->index_mask;
+ q->index = cons;
+- /* protect user index */
++ /* release so client can read it safely */
+ smp_store_release(&q->buf->consumer_index, cons);
+ break;
+ case QUEUE_TYPE_TO_CLIENT:
+- pr_warn("%s: attempt to advance client index\n",
+- __func__);
++ /* used by rxe, client owns the index */
++ if (WARN_ON(1))
++ pr_warn("%s: attempt to advance client index\n",
++ __func__);
++ break;
++ case QUEUE_TYPE_FROM_ULP:
++ /* used by ulp, rxe owns the index */
++ if (WARN_ON(1))
++ pr_warn("%s: attempt to advance driver index\n",
++ __func__);
+ break;
+- case QUEUE_TYPE_FROM_DRIVER:
++ case QUEUE_TYPE_TO_ULP:
++ /* used by ulp which owns the index */
+ cons = q->buf->consumer_index;
+ cons = (cons + 1) & q->index_mask;
+- q->buf->consumer_index = cons;
+- break;
+- case QUEUE_TYPE_TO_DRIVER:
+- pr_warn("%s: attempt to advance driver index\n",
+- __func__);
++ /* release so rxe can read it safely */
++ smp_store_release(&q->buf->consumer_index, cons);
+ break;
+ }
+ }
+diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.c b/drivers/infiniband/sw/rxe/rxe_verbs.c
+index 7a902e0a0607d..a3aee247aa157 100644
+--- a/drivers/infiniband/sw/rxe/rxe_verbs.c
++++ b/drivers/infiniband/sw/rxe/rxe_verbs.c
+@@ -245,7 +245,7 @@ static int post_one_recv(struct rxe_rq *rq, const struct ib_recv_wr *ibwr)
+ int num_sge = ibwr->num_sge;
+ int full;
+
+- full = queue_full(rq->queue, QUEUE_TYPE_TO_DRIVER);
++ full = queue_full(rq->queue, QUEUE_TYPE_FROM_ULP);
+ if (unlikely(full))
+ return -ENOMEM;
+
+@@ -256,7 +256,7 @@ static int post_one_recv(struct rxe_rq *rq, const struct ib_recv_wr *ibwr)
+ for (i = 0; i < num_sge; i++)
+ length += ibwr->sg_list[i].length;
+
+- recv_wqe = queue_producer_addr(rq->queue, QUEUE_TYPE_TO_DRIVER);
++ recv_wqe = queue_producer_addr(rq->queue, QUEUE_TYPE_FROM_ULP);
+ recv_wqe->wr_id = ibwr->wr_id;
+
+ memcpy(recv_wqe->dma.sge, ibwr->sg_list,
+@@ -268,7 +268,7 @@ static int post_one_recv(struct rxe_rq *rq, const struct ib_recv_wr *ibwr)
+ recv_wqe->dma.cur_sge = 0;
+ recv_wqe->dma.sge_offset = 0;
+
+- queue_advance_producer(rq->queue, QUEUE_TYPE_TO_DRIVER);
++ queue_advance_producer(rq->queue, QUEUE_TYPE_FROM_ULP);
+
+ return 0;
+ }
+@@ -623,17 +623,17 @@ static int post_one_send(struct rxe_qp *qp, const struct ib_send_wr *ibwr,
+
+ spin_lock_irqsave(&qp->sq.sq_lock, flags);
+
+- full = queue_full(sq->queue, QUEUE_TYPE_TO_DRIVER);
++ full = queue_full(sq->queue, QUEUE_TYPE_FROM_ULP);
+
+ if (unlikely(full)) {
+ spin_unlock_irqrestore(&qp->sq.sq_lock, flags);
+ return -ENOMEM;
+ }
+
+- send_wqe = queue_producer_addr(sq->queue, QUEUE_TYPE_TO_DRIVER);
++ send_wqe = queue_producer_addr(sq->queue, QUEUE_TYPE_FROM_ULP);
+ init_send_wqe(qp, ibwr, mask, length, send_wqe);
+
+- queue_advance_producer(sq->queue, QUEUE_TYPE_TO_DRIVER);
++ queue_advance_producer(sq->queue, QUEUE_TYPE_FROM_ULP);
+
+ spin_unlock_irqrestore(&qp->sq.sq_lock, flags);
+
+@@ -821,12 +821,12 @@ static int rxe_poll_cq(struct ib_cq *ibcq, int num_entries, struct ib_wc *wc)
+
+ spin_lock_irqsave(&cq->cq_lock, flags);
+ for (i = 0; i < num_entries; i++) {
+- cqe = queue_head(cq->queue, QUEUE_TYPE_FROM_DRIVER);
++ cqe = queue_head(cq->queue, QUEUE_TYPE_TO_ULP);
+ if (!cqe)
+ break;
+
+ memcpy(wc++, &cqe->ibwc, sizeof(*wc));
+- queue_advance_consumer(cq->queue, QUEUE_TYPE_FROM_DRIVER);
++ queue_advance_consumer(cq->queue, QUEUE_TYPE_TO_ULP);
+ }
+ spin_unlock_irqrestore(&cq->cq_lock, flags);
+
+@@ -838,7 +838,7 @@ static int rxe_peek_cq(struct ib_cq *ibcq, int wc_cnt)
+ struct rxe_cq *cq = to_rcq(ibcq);
+ int count;
+
+- count = queue_count(cq->queue, QUEUE_TYPE_FROM_DRIVER);
++ count = queue_count(cq->queue, QUEUE_TYPE_TO_ULP);
+
+ return (count > wc_cnt) ? wc_cnt : count;
+ }
+@@ -854,7 +854,7 @@ static int rxe_req_notify_cq(struct ib_cq *ibcq, enum ib_cq_notify_flags flags)
+ if (cq->notify != IB_CQ_NEXT_COMP)
+ cq->notify = flags & IB_CQ_SOLICITED_MASK;
+
+- empty = queue_empty(cq->queue, QUEUE_TYPE_FROM_DRIVER);
++ empty = queue_empty(cq->queue, QUEUE_TYPE_TO_ULP);
+
+ if ((flags & IB_CQ_REPORT_MISSED_EVENTS) && !empty)
+ ret = 1;
+--
+2.39.2
+
--- /dev/null
+From f163337bbe0b29d92f0667f454e96a2c85fc38bd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Jan 2023 17:59:34 -0600
+Subject: RDMA-rxe: Isolate mr code from atomic_reply()
+
+From: Bob Pearson <rpearsonhpe@gmail.com>
+
+[ Upstream commit f04d5b3d916c61752ac2c2adea5dfe78f8e12f78 ]
+
+Isolate mr specific code from atomic_reply() in rxe_resp.c into
+a subroutine rxe_mr_do_atomic_op() in rxe_mr.c.
+Minor cleanups to rxe_check_range() and iova_to_vaddr().
+Move enum resp_state to rxe.h
+
+Link: https://lore.kernel.org/r/20230119235936.19728-4-rpearsonhpe@gmail.com
+Signed-off-by: Bob Pearson <rpearsonhpe@gmail.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Stable-dep-of: 5ff31dfcd6d2 ("Subject: RDMA/rxe: Handle zero length rdma")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe.h | 38 +++++++++++++
+ drivers/infiniband/sw/rxe/rxe_loc.h | 2 +
+ drivers/infiniband/sw/rxe/rxe_mr.c | 83 ++++++++++++++++++----------
+ drivers/infiniband/sw/rxe/rxe_resp.c | 82 ++++-----------------------
+ 4 files changed, 105 insertions(+), 100 deletions(-)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe.h b/drivers/infiniband/sw/rxe/rxe.h
+index ab334900fcc3d..2415f3704f576 100644
+--- a/drivers/infiniband/sw/rxe/rxe.h
++++ b/drivers/infiniband/sw/rxe/rxe.h
+@@ -57,6 +57,44 @@
+ #define rxe_dbg_mw(mw, fmt, ...) ibdev_dbg((mw)->ibmw.device, \
+ "mw#%d %s: " fmt, (mw)->elem.index, __func__, ##__VA_ARGS__)
+
++/* responder states */
++enum resp_states {
++ RESPST_NONE,
++ RESPST_GET_REQ,
++ RESPST_CHK_PSN,
++ RESPST_CHK_OP_SEQ,
++ RESPST_CHK_OP_VALID,
++ RESPST_CHK_RESOURCE,
++ RESPST_CHK_LENGTH,
++ RESPST_CHK_RKEY,
++ RESPST_EXECUTE,
++ RESPST_READ_REPLY,
++ RESPST_ATOMIC_REPLY,
++ RESPST_ATOMIC_WRITE_REPLY,
++ RESPST_PROCESS_FLUSH,
++ RESPST_COMPLETE,
++ RESPST_ACKNOWLEDGE,
++ RESPST_CLEANUP,
++ RESPST_DUPLICATE_REQUEST,
++ RESPST_ERR_MALFORMED_WQE,
++ RESPST_ERR_UNSUPPORTED_OPCODE,
++ RESPST_ERR_MISALIGNED_ATOMIC,
++ RESPST_ERR_PSN_OUT_OF_SEQ,
++ RESPST_ERR_MISSING_OPCODE_FIRST,
++ RESPST_ERR_MISSING_OPCODE_LAST_C,
++ RESPST_ERR_MISSING_OPCODE_LAST_D1E,
++ RESPST_ERR_TOO_MANY_RDMA_ATM_REQ,
++ RESPST_ERR_RNR,
++ RESPST_ERR_RKEY_VIOLATION,
++ RESPST_ERR_INVALIDATE_RKEY,
++ RESPST_ERR_LENGTH,
++ RESPST_ERR_CQ_OVERFLOW,
++ RESPST_ERROR,
++ RESPST_RESET,
++ RESPST_DONE,
++ RESPST_EXIT,
++};
++
+ void rxe_set_mtu(struct rxe_dev *rxe, unsigned int dev_mtu);
+
+ int rxe_add(struct rxe_dev *rxe, unsigned int mtu, const char *ibdev_name);
+diff --git a/drivers/infiniband/sw/rxe/rxe_loc.h b/drivers/infiniband/sw/rxe/rxe_loc.h
+index 29b6c21430453..bcb1bbcf50dff 100644
+--- a/drivers/infiniband/sw/rxe/rxe_loc.h
++++ b/drivers/infiniband/sw/rxe/rxe_loc.h
+@@ -72,6 +72,8 @@ int copy_data(struct rxe_pd *pd, int access, struct rxe_dma_info *dma,
+ int rxe_map_mr_sg(struct ib_mr *ibmr, struct scatterlist *sg,
+ int sg_nents, unsigned int *sg_offset);
+ void *iova_to_vaddr(struct rxe_mr *mr, u64 iova, int length);
++int rxe_mr_do_atomic_op(struct rxe_mr *mr, u64 iova, int opcode,
++ u64 compare, u64 swap_add, u64 *orig_val);
+ struct rxe_mr *lookup_mr(struct rxe_pd *pd, int access, u32 key,
+ enum rxe_mr_lookup_type type);
+ int mr_check_range(struct rxe_mr *mr, u64 iova, size_t length);
+diff --git a/drivers/infiniband/sw/rxe/rxe_mr.c b/drivers/infiniband/sw/rxe/rxe_mr.c
+index 229c7259644cf..df9741474f1f0 100644
+--- a/drivers/infiniband/sw/rxe/rxe_mr.c
++++ b/drivers/infiniband/sw/rxe/rxe_mr.c
+@@ -32,13 +32,15 @@ int mr_check_range(struct rxe_mr *mr, u64 iova, size_t length)
+
+ case IB_MR_TYPE_USER:
+ case IB_MR_TYPE_MEM_REG:
+- if (iova < mr->ibmr.iova || length > mr->ibmr.length ||
+- iova > mr->ibmr.iova + mr->ibmr.length - length)
+- return -EFAULT;
++ if (iova < mr->ibmr.iova ||
++ iova + length > mr->ibmr.iova + mr->ibmr.length) {
++ rxe_dbg_mr(mr, "iova/length out of range");
++ return -EINVAL;
++ }
+ return 0;
+
+ default:
+- rxe_dbg_mr(mr, "type (%d) not supported\n", mr->ibmr.type);
++ rxe_dbg_mr(mr, "mr type not supported\n");
+ return -EINVAL;
+ }
+ }
+@@ -299,37 +301,22 @@ void *iova_to_vaddr(struct rxe_mr *mr, u64 iova, int length)
+ {
+ size_t offset;
+ int m, n;
+- void *addr;
+
+- if (mr->state != RXE_MR_STATE_VALID) {
+- rxe_dbg_mr(mr, "Not in valid state\n");
+- addr = NULL;
+- goto out;
+- }
++ if (mr->state != RXE_MR_STATE_VALID)
++ return NULL;
+
+- if (!mr->map) {
+- addr = (void *)(uintptr_t)iova;
+- goto out;
+- }
++ if (mr->ibmr.type == IB_MR_TYPE_DMA)
++ return (void *)(uintptr_t)iova;
+
+- if (mr_check_range(mr, iova, length)) {
+- rxe_dbg_mr(mr, "Range violation\n");
+- addr = NULL;
+- goto out;
+- }
++ if (mr_check_range(mr, iova, length))
++ return NULL;
+
+ lookup_iova(mr, iova, &m, &n, &offset);
+
+- if (offset + length > mr->map[m]->buf[n].size) {
+- rxe_dbg_mr(mr, "Crosses page boundary\n");
+- addr = NULL;
+- goto out;
+- }
+-
+- addr = (void *)(uintptr_t)mr->map[m]->buf[n].addr + offset;
++ if (offset + length > mr->map[m]->buf[n].size)
++ return NULL;
+
+-out:
+- return addr;
++ return (void *)(uintptr_t)mr->map[m]->buf[n].addr + offset;
+ }
+
+ int rxe_flush_pmem_iova(struct rxe_mr *mr, u64 iova, int length)
+@@ -538,6 +525,46 @@ int copy_data(
+ return err;
+ }
+
++/* Guarantee atomicity of atomic operations at the machine level. */
++static DEFINE_SPINLOCK(atomic_ops_lock);
++
++int rxe_mr_do_atomic_op(struct rxe_mr *mr, u64 iova, int opcode,
++ u64 compare, u64 swap_add, u64 *orig_val)
++{
++ u64 *va;
++ u64 value;
++
++ if (mr->state != RXE_MR_STATE_VALID) {
++ rxe_dbg_mr(mr, "mr not in valid state");
++ return RESPST_ERR_RKEY_VIOLATION;
++ }
++
++ va = iova_to_vaddr(mr, iova, sizeof(u64));
++ if (!va) {
++ rxe_dbg_mr(mr, "iova out of range");
++ return RESPST_ERR_RKEY_VIOLATION;
++ }
++
++ if ((uintptr_t)va & 0x7) {
++ rxe_dbg_mr(mr, "iova not aligned");
++ return RESPST_ERR_MISALIGNED_ATOMIC;
++ }
++
++ spin_lock_bh(&atomic_ops_lock);
++ value = *orig_val = *va;
++
++ if (opcode == IB_OPCODE_RC_COMPARE_SWAP) {
++ if (value == compare)
++ *va = swap_add;
++ } else {
++ value += swap_add;
++ *va = value;
++ }
++ spin_unlock_bh(&atomic_ops_lock);
++
++ return 0;
++}
++
+ int advance_dma_data(struct rxe_dma_info *dma, unsigned int length)
+ {
+ struct rxe_sge *sge = &dma->sge[dma->cur_sge];
+diff --git a/drivers/infiniband/sw/rxe/rxe_resp.c b/drivers/infiniband/sw/rxe/rxe_resp.c
+index c74972244f08f..9d4b4e9b42fc9 100644
+--- a/drivers/infiniband/sw/rxe/rxe_resp.c
++++ b/drivers/infiniband/sw/rxe/rxe_resp.c
+@@ -10,43 +10,6 @@
+ #include "rxe_loc.h"
+ #include "rxe_queue.h"
+
+-enum resp_states {
+- RESPST_NONE,
+- RESPST_GET_REQ,
+- RESPST_CHK_PSN,
+- RESPST_CHK_OP_SEQ,
+- RESPST_CHK_OP_VALID,
+- RESPST_CHK_RESOURCE,
+- RESPST_CHK_LENGTH,
+- RESPST_CHK_RKEY,
+- RESPST_EXECUTE,
+- RESPST_READ_REPLY,
+- RESPST_ATOMIC_REPLY,
+- RESPST_ATOMIC_WRITE_REPLY,
+- RESPST_PROCESS_FLUSH,
+- RESPST_COMPLETE,
+- RESPST_ACKNOWLEDGE,
+- RESPST_CLEANUP,
+- RESPST_DUPLICATE_REQUEST,
+- RESPST_ERR_MALFORMED_WQE,
+- RESPST_ERR_UNSUPPORTED_OPCODE,
+- RESPST_ERR_MISALIGNED_ATOMIC,
+- RESPST_ERR_PSN_OUT_OF_SEQ,
+- RESPST_ERR_MISSING_OPCODE_FIRST,
+- RESPST_ERR_MISSING_OPCODE_LAST_C,
+- RESPST_ERR_MISSING_OPCODE_LAST_D1E,
+- RESPST_ERR_TOO_MANY_RDMA_ATM_REQ,
+- RESPST_ERR_RNR,
+- RESPST_ERR_RKEY_VIOLATION,
+- RESPST_ERR_INVALIDATE_RKEY,
+- RESPST_ERR_LENGTH,
+- RESPST_ERR_CQ_OVERFLOW,
+- RESPST_ERROR,
+- RESPST_RESET,
+- RESPST_DONE,
+- RESPST_EXIT,
+-};
+-
+ static char *resp_state_name[] = {
+ [RESPST_NONE] = "NONE",
+ [RESPST_GET_REQ] = "GET_REQ",
+@@ -725,17 +688,12 @@ static enum resp_states process_flush(struct rxe_qp *qp,
+ return RESPST_ACKNOWLEDGE;
+ }
+
+-/* Guarantee atomicity of atomic operations at the machine level. */
+-static DEFINE_SPINLOCK(atomic_ops_lock);
+-
+ static enum resp_states atomic_reply(struct rxe_qp *qp,
+- struct rxe_pkt_info *pkt)
++ struct rxe_pkt_info *pkt)
+ {
+- u64 *vaddr;
+- enum resp_states ret;
+ struct rxe_mr *mr = qp->resp.mr;
+ struct resp_res *res = qp->resp.res;
+- u64 value;
++ int err;
+
+ if (!res) {
+ res = rxe_prepare_res(qp, pkt, RXE_ATOMIC_MASK);
+@@ -743,32 +701,14 @@ static enum resp_states atomic_reply(struct rxe_qp *qp,
+ }
+
+ if (!res->replay) {
+- if (mr->state != RXE_MR_STATE_VALID) {
+- ret = RESPST_ERR_RKEY_VIOLATION;
+- goto out;
+- }
+-
+- vaddr = iova_to_vaddr(mr, qp->resp.va + qp->resp.offset,
+- sizeof(u64));
+-
+- /* check vaddr is 8 bytes aligned. */
+- if (!vaddr || (uintptr_t)vaddr & 7) {
+- ret = RESPST_ERR_MISALIGNED_ATOMIC;
+- goto out;
+- }
+-
+- spin_lock_bh(&atomic_ops_lock);
+- res->atomic.orig_val = value = *vaddr;
+-
+- if (pkt->opcode == IB_OPCODE_RC_COMPARE_SWAP) {
+- if (value == atmeth_comp(pkt))
+- value = atmeth_swap_add(pkt);
+- } else {
+- value += atmeth_swap_add(pkt);
+- }
++ u64 iova = qp->resp.va + qp->resp.offset;
+
+- *vaddr = value;
+- spin_unlock_bh(&atomic_ops_lock);
++ err = rxe_mr_do_atomic_op(mr, iova, pkt->opcode,
++ atmeth_comp(pkt),
++ atmeth_swap_add(pkt),
++ &res->atomic.orig_val);
++ if (err)
++ return err;
+
+ qp->resp.msn++;
+
+@@ -780,9 +720,7 @@ static enum resp_states atomic_reply(struct rxe_qp *qp,
+ qp->resp.status = IB_WC_SUCCESS;
+ }
+
+- ret = RESPST_ACKNOWLEDGE;
+-out:
+- return ret;
++ return RESPST_ACKNOWLEDGE;
+ }
+
+ #ifdef CONFIG_64BIT
+--
+2.39.2
+
--- /dev/null
+From a83dc1b1cb5294bb4b44857670132072bd657e15 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Jan 2023 17:59:35 -0600
+Subject: RDMA-rxe: Isolate mr code from atomic_write_reply()
+
+From: Bob Pearson <rpearsonhpe@gmail.com>
+
+[ Upstream commit d8bdb0ebca086b5845d782e800ad2bf2a7eb4877 ]
+
+Isolate mr specific code from atomic_write_reply() in rxe_resp.c into
+a subroutine rxe_mr_do_atomic_write() in rxe_mr.c.
+Check length for atomic write operation.
+Make iova_to_vaddr() static.
+
+Link: https://lore.kernel.org/r/20230119235936.19728-5-rpearsonhpe@gmail.com
+Signed-off-by: Bob Pearson <rpearsonhpe@gmail.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Stable-dep-of: 5ff31dfcd6d2 ("Subject: RDMA/rxe: Handle zero length rdma")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe_loc.h | 2 +-
+ drivers/infiniband/sw/rxe/rxe_mr.c | 38 ++++++++++++++++-
+ drivers/infiniband/sw/rxe/rxe_resp.c | 61 ++++++++++------------------
+ 3 files changed, 59 insertions(+), 42 deletions(-)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_loc.h b/drivers/infiniband/sw/rxe/rxe_loc.h
+index bcb1bbcf50dff..ad8bd6bd728a4 100644
+--- a/drivers/infiniband/sw/rxe/rxe_loc.h
++++ b/drivers/infiniband/sw/rxe/rxe_loc.h
+@@ -71,9 +71,9 @@ int copy_data(struct rxe_pd *pd, int access, struct rxe_dma_info *dma,
+ void *addr, int length, enum rxe_mr_copy_dir dir);
+ int rxe_map_mr_sg(struct ib_mr *ibmr, struct scatterlist *sg,
+ int sg_nents, unsigned int *sg_offset);
+-void *iova_to_vaddr(struct rxe_mr *mr, u64 iova, int length);
+ int rxe_mr_do_atomic_op(struct rxe_mr *mr, u64 iova, int opcode,
+ u64 compare, u64 swap_add, u64 *orig_val);
++int rxe_mr_do_atomic_write(struct rxe_mr *mr, u64 iova, u64 value);
+ struct rxe_mr *lookup_mr(struct rxe_pd *pd, int access, u32 key,
+ enum rxe_mr_lookup_type type);
+ int mr_check_range(struct rxe_mr *mr, u64 iova, size_t length);
+diff --git a/drivers/infiniband/sw/rxe/rxe_mr.c b/drivers/infiniband/sw/rxe/rxe_mr.c
+index df9741474f1f0..5c4ce43914fa2 100644
+--- a/drivers/infiniband/sw/rxe/rxe_mr.c
++++ b/drivers/infiniband/sw/rxe/rxe_mr.c
+@@ -297,7 +297,7 @@ static void lookup_iova(struct rxe_mr *mr, u64 iova, int *m_out, int *n_out,
+ }
+ }
+
+-void *iova_to_vaddr(struct rxe_mr *mr, u64 iova, int length)
++static void *iova_to_vaddr(struct rxe_mr *mr, u64 iova, int length)
+ {
+ size_t offset;
+ int m, n;
+@@ -565,6 +565,42 @@ int rxe_mr_do_atomic_op(struct rxe_mr *mr, u64 iova, int opcode,
+ return 0;
+ }
+
++/* only implemented for 64 bit architectures */
++#if defined CONFIG_64BIT
++int rxe_mr_do_atomic_write(struct rxe_mr *mr, u64 iova, u64 value)
++{
++ u64 *va;
++
++ /* See IBA oA19-28 */
++ if (unlikely(mr->state != RXE_MR_STATE_VALID)) {
++ rxe_dbg_mr(mr, "mr not in valid state");
++ return RESPST_ERR_RKEY_VIOLATION;
++ }
++
++ va = iova_to_vaddr(mr, iova, sizeof(value));
++ if (unlikely(!va)) {
++ rxe_dbg_mr(mr, "iova out of range");
++ return RESPST_ERR_RKEY_VIOLATION;
++ }
++
++ /* See IBA A19.4.2 */
++ if (unlikely((uintptr_t)va & 0x7 || iova & 0x7)) {
++ rxe_dbg_mr(mr, "misaligned address");
++ return RESPST_ERR_MISALIGNED_ATOMIC;
++ }
++
++ /* Do atomic write after all prior operations have completed */
++ smp_store_release(va, value);
++
++ return 0;
++}
++#else
++int rxe_mr_do_atomic_write(struct rxe_mr *mr, u64 iova, u64 value)
++{
++ return RESPST_ERR_UNSUPPORTED_OPCODE;
++}
++#endif
++
+ int advance_dma_data(struct rxe_dma_info *dma, unsigned int length)
+ {
+ struct rxe_sge *sge = &dma->sge[dma->cur_sge];
+diff --git a/drivers/infiniband/sw/rxe/rxe_resp.c b/drivers/infiniband/sw/rxe/rxe_resp.c
+index 9d4b4e9b42fc9..cd2d88de287ca 100644
+--- a/drivers/infiniband/sw/rxe/rxe_resp.c
++++ b/drivers/infiniband/sw/rxe/rxe_resp.c
+@@ -723,30 +723,32 @@ static enum resp_states atomic_reply(struct rxe_qp *qp,
+ return RESPST_ACKNOWLEDGE;
+ }
+
+-#ifdef CONFIG_64BIT
+-static enum resp_states do_atomic_write(struct rxe_qp *qp,
+- struct rxe_pkt_info *pkt)
++static enum resp_states atomic_write_reply(struct rxe_qp *qp,
++ struct rxe_pkt_info *pkt)
+ {
+- struct rxe_mr *mr = qp->resp.mr;
+- int payload = payload_size(pkt);
+- u64 src, *dst;
+-
+- if (mr->state != RXE_MR_STATE_VALID)
+- return RESPST_ERR_RKEY_VIOLATION;
++ struct resp_res *res = qp->resp.res;
++ struct rxe_mr *mr;
++ u64 value;
++ u64 iova;
++ int err;
+
+- memcpy(&src, payload_addr(pkt), payload);
++ if (!res) {
++ res = rxe_prepare_res(qp, pkt, RXE_ATOMIC_WRITE_MASK);
++ qp->resp.res = res;
++ }
+
+- dst = iova_to_vaddr(mr, qp->resp.va + qp->resp.offset, payload);
+- /* check vaddr is 8 bytes aligned. */
+- if (!dst || (uintptr_t)dst & 7)
+- return RESPST_ERR_MISALIGNED_ATOMIC;
++ if (res->replay)
++ return RESPST_ACKNOWLEDGE;
+
+- /* Do atomic write after all prior operations have completed */
+- smp_store_release(dst, src);
++ mr = qp->resp.mr;
++ value = *(u64 *)payload_addr(pkt);
++ iova = qp->resp.va + qp->resp.offset;
+
+- /* decrease resp.resid to zero */
+- qp->resp.resid -= sizeof(payload);
++ err = rxe_mr_do_atomic_write(mr, iova, value);
++ if (err)
++ return err;
+
++ qp->resp.resid = 0;
+ qp->resp.msn++;
+
+ /* next expected psn, read handles this separately */
+@@ -755,29 +757,8 @@ static enum resp_states do_atomic_write(struct rxe_qp *qp,
+
+ qp->resp.opcode = pkt->opcode;
+ qp->resp.status = IB_WC_SUCCESS;
+- return RESPST_ACKNOWLEDGE;
+-}
+-#else
+-static enum resp_states do_atomic_write(struct rxe_qp *qp,
+- struct rxe_pkt_info *pkt)
+-{
+- return RESPST_ERR_UNSUPPORTED_OPCODE;
+-}
+-#endif /* CONFIG_64BIT */
+-
+-static enum resp_states atomic_write_reply(struct rxe_qp *qp,
+- struct rxe_pkt_info *pkt)
+-{
+- struct resp_res *res = qp->resp.res;
+
+- if (!res) {
+- res = rxe_prepare_res(qp, pkt, RXE_ATOMIC_WRITE_MASK);
+- qp->resp.res = res;
+- }
+-
+- if (res->replay)
+- return RESPST_ACKNOWLEDGE;
+- return do_atomic_write(qp, pkt);
++ return RESPST_ACKNOWLEDGE;
+ }
+
+ static struct sk_buff *prepare_ack_packet(struct rxe_qp *qp,
+--
+2.39.2
+
--- /dev/null
+From c0a658950e2945b9214a8e563a09ea093522fd52 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Jan 2023 17:59:33 -0600
+Subject: RDMA/rxe: Move rxe_map_mr_sg to rxe_mr.c
+
+From: Bob Pearson <rpearsonhpe@gmail.com>
+
+[ Upstream commit db4729a5251992ed535da09c0fcf9b590ac7fe6c ]
+
+Move rxe_map_mr_sg() to rxe_mr.c where it makes a little more sense.
+
+Link: https://lore.kernel.org/r/20230119235936.19728-3-rpearsonhpe@gmail.com
+Signed-off-by: Bob Pearson <rpearsonhpe@gmail.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Stable-dep-of: 5ff31dfcd6d2 ("Subject: RDMA/rxe: Handle zero length rdma")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe_loc.h | 2 ++
+ drivers/infiniband/sw/rxe/rxe_mr.c | 36 +++++++++++++++++++++++++++
+ drivers/infiniband/sw/rxe/rxe_verbs.c | 36 ---------------------------
+ 3 files changed, 38 insertions(+), 36 deletions(-)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_loc.h b/drivers/infiniband/sw/rxe/rxe_loc.h
+index 948ce4902b10f..29b6c21430453 100644
+--- a/drivers/infiniband/sw/rxe/rxe_loc.h
++++ b/drivers/infiniband/sw/rxe/rxe_loc.h
+@@ -69,6 +69,8 @@ int rxe_mr_copy(struct rxe_mr *mr, u64 iova, void *addr, int length,
+ enum rxe_mr_copy_dir dir);
+ int copy_data(struct rxe_pd *pd, int access, struct rxe_dma_info *dma,
+ void *addr, int length, enum rxe_mr_copy_dir dir);
++int rxe_map_mr_sg(struct ib_mr *ibmr, struct scatterlist *sg,
++ int sg_nents, unsigned int *sg_offset);
+ void *iova_to_vaddr(struct rxe_mr *mr, u64 iova, int length);
+ struct rxe_mr *lookup_mr(struct rxe_pd *pd, int access, u32 key,
+ enum rxe_mr_lookup_type type);
+diff --git a/drivers/infiniband/sw/rxe/rxe_mr.c b/drivers/infiniband/sw/rxe/rxe_mr.c
+index 632ee1e516a1a..229c7259644cf 100644
+--- a/drivers/infiniband/sw/rxe/rxe_mr.c
++++ b/drivers/infiniband/sw/rxe/rxe_mr.c
+@@ -223,6 +223,42 @@ int rxe_mr_init_fast(int max_pages, struct rxe_mr *mr)
+ return err;
+ }
+
++static int rxe_set_page(struct ib_mr *ibmr, u64 addr)
++{
++ struct rxe_mr *mr = to_rmr(ibmr);
++ struct rxe_map *map;
++ struct rxe_phys_buf *buf;
++
++ if (unlikely(mr->nbuf == mr->num_buf))
++ return -ENOMEM;
++
++ map = mr->map[mr->nbuf / RXE_BUF_PER_MAP];
++ buf = &map->buf[mr->nbuf % RXE_BUF_PER_MAP];
++
++ buf->addr = addr;
++ buf->size = ibmr->page_size;
++ mr->nbuf++;
++
++ return 0;
++}
++
++int rxe_map_mr_sg(struct ib_mr *ibmr, struct scatterlist *sg,
++ int sg_nents, unsigned int *sg_offset)
++{
++ struct rxe_mr *mr = to_rmr(ibmr);
++ int n;
++
++ mr->nbuf = 0;
++
++ n = ib_sg_to_pages(ibmr, sg, sg_nents, sg_offset, rxe_set_page);
++
++ mr->page_shift = ilog2(ibmr->page_size);
++ mr->page_mask = ibmr->page_size - 1;
++ mr->offset = ibmr->iova & mr->page_mask;
++
++ return n;
++}
++
+ static void lookup_iova(struct rxe_mr *mr, u64 iova, int *m_out, int *n_out,
+ size_t *offset_out)
+ {
+diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.c b/drivers/infiniband/sw/rxe/rxe_verbs.c
+index 025b35bf014e2..7a902e0a0607d 100644
+--- a/drivers/infiniband/sw/rxe/rxe_verbs.c
++++ b/drivers/infiniband/sw/rxe/rxe_verbs.c
+@@ -948,42 +948,6 @@ static struct ib_mr *rxe_alloc_mr(struct ib_pd *ibpd, enum ib_mr_type mr_type,
+ return ERR_PTR(err);
+ }
+
+-static int rxe_set_page(struct ib_mr *ibmr, u64 addr)
+-{
+- struct rxe_mr *mr = to_rmr(ibmr);
+- struct rxe_map *map;
+- struct rxe_phys_buf *buf;
+-
+- if (unlikely(mr->nbuf == mr->num_buf))
+- return -ENOMEM;
+-
+- map = mr->map[mr->nbuf / RXE_BUF_PER_MAP];
+- buf = &map->buf[mr->nbuf % RXE_BUF_PER_MAP];
+-
+- buf->addr = addr;
+- buf->size = ibmr->page_size;
+- mr->nbuf++;
+-
+- return 0;
+-}
+-
+-static int rxe_map_mr_sg(struct ib_mr *ibmr, struct scatterlist *sg,
+- int sg_nents, unsigned int *sg_offset)
+-{
+- struct rxe_mr *mr = to_rmr(ibmr);
+- int n;
+-
+- mr->nbuf = 0;
+-
+- n = ib_sg_to_pages(ibmr, sg, sg_nents, sg_offset, rxe_set_page);
+-
+- mr->page_shift = ilog2(ibmr->page_size);
+- mr->page_mask = ibmr->page_size - 1;
+- mr->offset = ibmr->iova & mr->page_mask;
+-
+- return n;
+-}
+-
+ static ssize_t parent_show(struct device *device,
+ struct device_attribute *attr, char *buf)
+ {
+--
+2.39.2
+
--- /dev/null
+From 81156aa541b929e6e5b5d1cfb073d5590f008438 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Jan 2023 17:59:37 -0600
+Subject: RDMA/rxe: Replace rxe_map and rxe_phys_buf by xarray
+
+From: Bob Pearson <rpearsonhpe@gmail.com>
+
+[ Upstream commit 592627ccbdff0ec6fff00fc761142a76db750dd4 ]
+
+Replace struct rxe-phys_buf and struct rxe_map by struct xarray
+in rxe_verbs.h. This allows using rcu locking on reads for
+the memory maps stored in each mr.
+
+This is based off of a sketch of a patch from Jason Gunthorpe in the
+link below. Some changes were needed to make this work. It applies
+cleanly to the current for-next and passes the pyverbs, perftest
+and the same blktests test cases which run today.
+
+Link: https://lore.kernel.org/r/20230119235936.19728-7-rpearsonhpe@gmail.com
+Link: https://lore.kernel.org/linux-rdma/Y3gvZr6%2FNCii9Avy@nvidia.com/
+Co-developed-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Bob Pearson <rpearsonhpe@gmail.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Stable-dep-of: 5ff31dfcd6d2 ("Subject: RDMA/rxe: Handle zero length rdma")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe_loc.h | 6 +-
+ drivers/infiniband/sw/rxe/rxe_mr.c | 529 ++++++++++++--------------
+ drivers/infiniband/sw/rxe/rxe_verbs.h | 21 +-
+ 3 files changed, 254 insertions(+), 302 deletions(-)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_loc.h b/drivers/infiniband/sw/rxe/rxe_loc.h
+index ad8bd6bd728a4..1bb0cb479eb12 100644
+--- a/drivers/infiniband/sw/rxe/rxe_loc.h
++++ b/drivers/infiniband/sw/rxe/rxe_loc.h
+@@ -64,9 +64,9 @@ void rxe_mr_init_dma(int access, struct rxe_mr *mr);
+ int rxe_mr_init_user(struct rxe_dev *rxe, u64 start, u64 length, u64 iova,
+ int access, struct rxe_mr *mr);
+ int rxe_mr_init_fast(int max_pages, struct rxe_mr *mr);
+-int rxe_flush_pmem_iova(struct rxe_mr *mr, u64 iova, int length);
+-int rxe_mr_copy(struct rxe_mr *mr, u64 iova, void *addr, int length,
+- enum rxe_mr_copy_dir dir);
++int rxe_flush_pmem_iova(struct rxe_mr *mr, u64 iova, unsigned int length);
++int rxe_mr_copy(struct rxe_mr *mr, u64 iova, void *addr,
++ unsigned int length, enum rxe_mr_copy_dir dir);
+ int copy_data(struct rxe_pd *pd, int access, struct rxe_dma_info *dma,
+ void *addr, int length, enum rxe_mr_copy_dir dir);
+ int rxe_map_mr_sg(struct ib_mr *ibmr, struct scatterlist *sg,
+diff --git a/drivers/infiniband/sw/rxe/rxe_mr.c b/drivers/infiniband/sw/rxe/rxe_mr.c
+index 2181165ea40d7..c80458634962c 100644
+--- a/drivers/infiniband/sw/rxe/rxe_mr.c
++++ b/drivers/infiniband/sw/rxe/rxe_mr.c
+@@ -62,60 +62,31 @@ static void rxe_mr_init(int access, struct rxe_mr *mr)
+ mr->lkey = mr->ibmr.lkey = lkey;
+ mr->rkey = mr->ibmr.rkey = rkey;
+
++ mr->access = access;
+ mr->ibmr.page_size = PAGE_SIZE;
+ mr->page_mask = PAGE_MASK;
+ mr->page_shift = PAGE_SHIFT;
+ mr->state = RXE_MR_STATE_INVALID;
+ }
+
+-static int rxe_mr_alloc(struct rxe_mr *mr, int num_buf)
+-{
+- int i;
+- int num_map;
+- struct rxe_map **map = mr->map;
+-
+- num_map = (num_buf + RXE_BUF_PER_MAP - 1) / RXE_BUF_PER_MAP;
+-
+- mr->map = kmalloc_array(num_map, sizeof(*map), GFP_KERNEL);
+- if (!mr->map)
+- goto err1;
+-
+- for (i = 0; i < num_map; i++) {
+- mr->map[i] = kmalloc(sizeof(**map), GFP_KERNEL);
+- if (!mr->map[i])
+- goto err2;
+- }
+-
+- BUILD_BUG_ON(!is_power_of_2(RXE_BUF_PER_MAP));
+-
+- mr->map_shift = ilog2(RXE_BUF_PER_MAP);
+- mr->map_mask = RXE_BUF_PER_MAP - 1;
+-
+- mr->num_buf = num_buf;
+- mr->num_map = num_map;
+- mr->max_buf = num_map * RXE_BUF_PER_MAP;
+-
+- return 0;
+-
+-err2:
+- for (i--; i >= 0; i--)
+- kfree(mr->map[i]);
+-
+- kfree(mr->map);
+- mr->map = NULL;
+-err1:
+- return -ENOMEM;
+-}
+-
+ void rxe_mr_init_dma(int access, struct rxe_mr *mr)
+ {
+ rxe_mr_init(access, mr);
+
+- mr->access = access;
+ mr->state = RXE_MR_STATE_VALID;
+ mr->ibmr.type = IB_MR_TYPE_DMA;
+ }
+
++static unsigned long rxe_mr_iova_to_index(struct rxe_mr *mr, u64 iova)
++{
++ return (iova >> mr->page_shift) - (mr->ibmr.iova >> mr->page_shift);
++}
++
++static unsigned long rxe_mr_iova_to_page_offset(struct rxe_mr *mr, u64 iova)
++{
++ return iova & (mr_page_size(mr) - 1);
++}
++
+ static bool is_pmem_page(struct page *pg)
+ {
+ unsigned long paddr = page_to_phys(pg);
+@@ -125,82 +96,98 @@ static bool is_pmem_page(struct page *pg)
+ IORES_DESC_PERSISTENT_MEMORY);
+ }
+
++static int rxe_mr_fill_pages_from_sgt(struct rxe_mr *mr, struct sg_table *sgt)
++{
++ XA_STATE(xas, &mr->page_list, 0);
++ struct sg_page_iter sg_iter;
++ struct page *page;
++ bool persistent = !!(mr->access & IB_ACCESS_FLUSH_PERSISTENT);
++
++ __sg_page_iter_start(&sg_iter, sgt->sgl, sgt->orig_nents, 0);
++ if (!__sg_page_iter_next(&sg_iter))
++ return 0;
++
++ do {
++ xas_lock(&xas);
++ while (true) {
++ page = sg_page_iter_page(&sg_iter);
++
++ if (persistent && !is_pmem_page(page)) {
++ rxe_dbg_mr(mr, "Page can't be persistent\n");
++ xas_set_err(&xas, -EINVAL);
++ break;
++ }
++
++ xas_store(&xas, page);
++ if (xas_error(&xas))
++ break;
++ xas_next(&xas);
++ if (!__sg_page_iter_next(&sg_iter))
++ break;
++ }
++ xas_unlock(&xas);
++ } while (xas_nomem(&xas, GFP_KERNEL));
++
++ return xas_error(&xas);
++}
++
+ int rxe_mr_init_user(struct rxe_dev *rxe, u64 start, u64 length, u64 iova,
+ int access, struct rxe_mr *mr)
+ {
+- struct rxe_map **map;
+- struct rxe_phys_buf *buf = NULL;
+- struct ib_umem *umem;
+- struct sg_page_iter sg_iter;
+- int num_buf;
+- void *vaddr;
++ struct ib_umem *umem;
+ int err;
+
++ rxe_mr_init(access, mr);
++
++ xa_init(&mr->page_list);
++
+ umem = ib_umem_get(&rxe->ib_dev, start, length, access);
+ if (IS_ERR(umem)) {
+ rxe_dbg_mr(mr, "Unable to pin memory region err = %d\n",
+ (int)PTR_ERR(umem));
+- err = PTR_ERR(umem);
+- goto err_out;
++ return PTR_ERR(umem);
+ }
+
+- num_buf = ib_umem_num_pages(umem);
+-
+- rxe_mr_init(access, mr);
+-
+- err = rxe_mr_alloc(mr, num_buf);
++ err = rxe_mr_fill_pages_from_sgt(mr, &umem->sgt_append.sgt);
+ if (err) {
+- rxe_dbg_mr(mr, "Unable to allocate memory for map\n");
+- goto err_release_umem;
++ ib_umem_release(umem);
++ return err;
+ }
+
+- num_buf = 0;
+- map = mr->map;
+- if (length > 0) {
+- bool persistent_access = access & IB_ACCESS_FLUSH_PERSISTENT;
+-
+- buf = map[0]->buf;
+- for_each_sgtable_page (&umem->sgt_append.sgt, &sg_iter, 0) {
+- struct page *pg = sg_page_iter_page(&sg_iter);
++ mr->umem = umem;
++ mr->ibmr.type = IB_MR_TYPE_USER;
++ mr->state = RXE_MR_STATE_VALID;
+
+- if (persistent_access && !is_pmem_page(pg)) {
+- rxe_dbg_mr(mr, "Unable to register persistent access to non-pmem device\n");
+- err = -EINVAL;
+- goto err_release_umem;
+- }
++ return 0;
++}
+
+- if (num_buf >= RXE_BUF_PER_MAP) {
+- map++;
+- buf = map[0]->buf;
+- num_buf = 0;
+- }
++static int rxe_mr_alloc(struct rxe_mr *mr, int num_buf)
++{
++ XA_STATE(xas, &mr->page_list, 0);
++ int i = 0;
++ int err;
+
+- vaddr = page_address(pg);
+- if (!vaddr) {
+- rxe_dbg_mr(mr, "Unable to get virtual address\n");
+- err = -ENOMEM;
+- goto err_release_umem;
+- }
+- buf->addr = (uintptr_t)vaddr;
+- buf->size = mr_page_size(mr);
+- num_buf++;
+- buf++;
++ xa_init(&mr->page_list);
+
++ do {
++ xas_lock(&xas);
++ while (i != num_buf) {
++ xas_store(&xas, XA_ZERO_ENTRY);
++ if (xas_error(&xas))
++ break;
++ xas_next(&xas);
++ i++;
+ }
+- }
++ xas_unlock(&xas);
++ } while (xas_nomem(&xas, GFP_KERNEL));
+
+- mr->umem = umem;
+- mr->access = access;
+- mr->page_offset = ib_umem_offset(umem);
+- mr->state = RXE_MR_STATE_VALID;
+- mr->ibmr.type = IB_MR_TYPE_USER;
++ err = xas_error(&xas);
++ if (err)
++ return err;
+
+- return 0;
++ mr->num_buf = num_buf;
+
+-err_release_umem:
+- ib_umem_release(umem);
+-err_out:
+- return err;
++ return 0;
+ }
+
+ int rxe_mr_init_fast(int max_pages, struct rxe_mr *mr)
+@@ -214,7 +201,6 @@ int rxe_mr_init_fast(int max_pages, struct rxe_mr *mr)
+ if (err)
+ goto err1;
+
+- mr->max_buf = max_pages;
+ mr->state = RXE_MR_STATE_FREE;
+ mr->ibmr.type = IB_MR_TYPE_MEM_REG;
+
+@@ -224,206 +210,122 @@ int rxe_mr_init_fast(int max_pages, struct rxe_mr *mr)
+ return err;
+ }
+
+-static int rxe_set_page(struct ib_mr *ibmr, u64 addr)
++static int rxe_set_page(struct ib_mr *ibmr, u64 iova)
+ {
+ struct rxe_mr *mr = to_rmr(ibmr);
+- struct rxe_map *map;
+- struct rxe_phys_buf *buf;
++ struct page *page = virt_to_page(iova & mr->page_mask);
++ bool persistent = !!(mr->access & IB_ACCESS_FLUSH_PERSISTENT);
++ int err;
++
++ if (persistent && !is_pmem_page(page)) {
++ rxe_dbg_mr(mr, "Page cannot be persistent\n");
++ return -EINVAL;
++ }
+
+ if (unlikely(mr->nbuf == mr->num_buf))
+ return -ENOMEM;
+
+- map = mr->map[mr->nbuf / RXE_BUF_PER_MAP];
+- buf = &map->buf[mr->nbuf % RXE_BUF_PER_MAP];
++ err = xa_err(xa_store(&mr->page_list, mr->nbuf, page, GFP_KERNEL));
++ if (err)
++ return err;
+
+- buf->addr = addr;
+- buf->size = ibmr->page_size;
+ mr->nbuf++;
+-
+ return 0;
+ }
+
+-int rxe_map_mr_sg(struct ib_mr *ibmr, struct scatterlist *sg,
++int rxe_map_mr_sg(struct ib_mr *ibmr, struct scatterlist *sgl,
+ int sg_nents, unsigned int *sg_offset)
+ {
+ struct rxe_mr *mr = to_rmr(ibmr);
+ unsigned int page_size = mr_page_size(mr);
+
++ mr->nbuf = 0;
+ mr->page_shift = ilog2(page_size);
+ mr->page_mask = ~((u64)page_size - 1);
+- mr->page_offset = ibmr->iova & (page_size - 1);
+-
+- mr->nbuf = 0;
++ mr->page_offset = mr->ibmr.iova & (page_size - 1);
+
+- return ib_sg_to_pages(ibmr, sg, sg_nents, sg_offset, rxe_set_page);
++ return ib_sg_to_pages(ibmr, sgl, sg_nents, sg_offset, rxe_set_page);
+ }
+
+-static void lookup_iova(struct rxe_mr *mr, u64 iova, int *m_out, int *n_out,
+- size_t *offset_out)
++static int rxe_mr_copy_xarray(struct rxe_mr *mr, u64 iova, void *addr,
++ unsigned int length, enum rxe_mr_copy_dir dir)
+ {
+- size_t offset = iova - mr->ibmr.iova + mr->page_offset;
+- int map_index;
+- int buf_index;
+- u64 length;
+-
+- if (likely(mr->page_shift)) {
+- *offset_out = offset & (mr_page_size(mr) - 1);
+- offset >>= mr->page_shift;
+- *n_out = offset & mr->map_mask;
+- *m_out = offset >> mr->map_shift;
+- } else {
+- map_index = 0;
+- buf_index = 0;
+-
+- length = mr->map[map_index]->buf[buf_index].size;
++ unsigned int page_offset = rxe_mr_iova_to_page_offset(mr, iova);
++ unsigned long index = rxe_mr_iova_to_index(mr, iova);
++ unsigned int bytes;
++ struct page *page;
++ void *va;
+
+- while (offset >= length) {
+- offset -= length;
+- buf_index++;
+-
+- if (buf_index == RXE_BUF_PER_MAP) {
+- map_index++;
+- buf_index = 0;
+- }
+- length = mr->map[map_index]->buf[buf_index].size;
+- }
++ while (length) {
++ page = xa_load(&mr->page_list, index);
++ if (!page)
++ return -EFAULT;
+
+- *m_out = map_index;
+- *n_out = buf_index;
+- *offset_out = offset;
++ bytes = min_t(unsigned int, length,
++ mr_page_size(mr) - page_offset);
++ va = kmap_local_page(page);
++ if (dir == RXE_FROM_MR_OBJ)
++ memcpy(addr, va + page_offset, bytes);
++ else
++ memcpy(va + page_offset, addr, bytes);
++ kunmap_local(va);
++
++ page_offset = 0;
++ addr += bytes;
++ length -= bytes;
++ index++;
+ }
+-}
+-
+-static void *iova_to_vaddr(struct rxe_mr *mr, u64 iova, int length)
+-{
+- size_t offset;
+- int m, n;
+
+- if (mr->state != RXE_MR_STATE_VALID)
+- return NULL;
+-
+- if (mr->ibmr.type == IB_MR_TYPE_DMA)
+- return (void *)(uintptr_t)iova;
+-
+- if (mr_check_range(mr, iova, length))
+- return NULL;
+-
+- lookup_iova(mr, iova, &m, &n, &offset);
+-
+- if (offset + length > mr->map[m]->buf[n].size)
+- return NULL;
+-
+- return (void *)(uintptr_t)mr->map[m]->buf[n].addr + offset;
++ return 0;
+ }
+
+-int rxe_flush_pmem_iova(struct rxe_mr *mr, u64 iova, int length)
++static void rxe_mr_copy_dma(struct rxe_mr *mr, u64 iova, void *addr,
++ unsigned int length, enum rxe_mr_copy_dir dir)
+ {
+- size_t offset;
+-
+- if (length == 0)
+- return 0;
+-
+- if (mr->ibmr.type == IB_MR_TYPE_DMA)
+- return -EFAULT;
+-
+- offset = (iova - mr->ibmr.iova + mr->page_offset) & mr->page_mask;
+- while (length > 0) {
+- u8 *va;
+- int bytes;
+-
+- bytes = mr->ibmr.page_size - offset;
+- if (bytes > length)
+- bytes = length;
+-
+- va = iova_to_vaddr(mr, iova, length);
+- if (!va)
+- return -EFAULT;
+-
+- arch_wb_cache_pmem(va, bytes);
++ unsigned int page_offset = iova & (PAGE_SIZE - 1);
++ unsigned int bytes;
++ struct page *page;
++ u8 *va;
+
+- length -= bytes;
++ while (length) {
++ page = virt_to_page(iova & mr->page_mask);
++ bytes = min_t(unsigned int, length,
++ PAGE_SIZE - page_offset);
++ va = kmap_local_page(page);
++
++ if (dir == RXE_TO_MR_OBJ)
++ memcpy(va + page_offset, addr, bytes);
++ else
++ memcpy(addr, va + page_offset, bytes);
++
++ kunmap_local(va);
++ page_offset = 0;
+ iova += bytes;
+- offset = 0;
++ addr += bytes;
++ length -= bytes;
+ }
+-
+- return 0;
+ }
+
+-/* copy data from a range (vaddr, vaddr+length-1) to or from
+- * a mr object starting at iova.
+- */
+-int rxe_mr_copy(struct rxe_mr *mr, u64 iova, void *addr, int length,
+- enum rxe_mr_copy_dir dir)
++int rxe_mr_copy(struct rxe_mr *mr, u64 iova, void *addr,
++ unsigned int length, enum rxe_mr_copy_dir dir)
+ {
+- int err;
+- int bytes;
+- u8 *va;
+- struct rxe_map **map;
+- struct rxe_phys_buf *buf;
+- int m;
+- int i;
+- size_t offset;
++ int err;
+
+ if (length == 0)
+ return 0;
+
+ if (mr->ibmr.type == IB_MR_TYPE_DMA) {
+- u8 *src, *dest;
+-
+- src = (dir == RXE_TO_MR_OBJ) ? addr : ((void *)(uintptr_t)iova);
+-
+- dest = (dir == RXE_TO_MR_OBJ) ? ((void *)(uintptr_t)iova) : addr;
+-
+- memcpy(dest, src, length);
+-
++ rxe_mr_copy_dma(mr, iova, addr, length, dir);
+ return 0;
+ }
+
+- WARN_ON_ONCE(!mr->map);
+-
+ err = mr_check_range(mr, iova, length);
+- if (err) {
+- err = -EFAULT;
+- goto err1;
+- }
+-
+- lookup_iova(mr, iova, &m, &i, &offset);
+-
+- map = mr->map + m;
+- buf = map[0]->buf + i;
+-
+- while (length > 0) {
+- u8 *src, *dest;
+-
+- va = (u8 *)(uintptr_t)buf->addr + offset;
+- src = (dir == RXE_TO_MR_OBJ) ? addr : va;
+- dest = (dir == RXE_TO_MR_OBJ) ? va : addr;
+-
+- bytes = buf->size - offset;
+-
+- if (bytes > length)
+- bytes = length;
+-
+- memcpy(dest, src, bytes);
+-
+- length -= bytes;
+- addr += bytes;
+-
+- offset = 0;
+- buf++;
+- i++;
+-
+- if (i == RXE_BUF_PER_MAP) {
+- i = 0;
+- map++;
+- buf = map[0]->buf;
+- }
++ if (unlikely(err)) {
++ rxe_dbg_mr(mr, "iova out of range");
++ return err;
+ }
+
+- return 0;
+-
+-err1:
+- return err;
++ return rxe_mr_copy_xarray(mr, iova, addr, length, dir);
+ }
+
+ /* copy data in or out of a wqe, i.e. sg list
+@@ -495,7 +397,6 @@ int copy_data(
+
+ if (bytes > 0) {
+ iova = sge->addr + offset;
+-
+ err = rxe_mr_copy(mr, iova, addr, bytes, dir);
+ if (err)
+ goto err2;
+@@ -522,50 +423,111 @@ int copy_data(
+ return err;
+ }
+
++int rxe_flush_pmem_iova(struct rxe_mr *mr, u64 iova, unsigned int length)
++{
++ unsigned int page_offset;
++ unsigned long index;
++ struct page *page;
++ unsigned int bytes;
++ int err;
++ u8 *va;
++
++ if (length == 0)
++ return 0;
++
++ if (mr->ibmr.type == IB_MR_TYPE_DMA)
++ return -EFAULT;
++
++ err = mr_check_range(mr, iova, length);
++ if (err)
++ return err;
++
++ while (length > 0) {
++ index = rxe_mr_iova_to_index(mr, iova);
++ page = xa_load(&mr->page_list, index);
++ page_offset = rxe_mr_iova_to_page_offset(mr, iova);
++ if (!page)
++ return -EFAULT;
++ bytes = min_t(unsigned int, length,
++ mr_page_size(mr) - page_offset);
++
++ va = kmap_local_page(page);
++ arch_wb_cache_pmem(va + page_offset, bytes);
++ kunmap_local(va);
++
++ length -= bytes;
++ iova += bytes;
++ page_offset = 0;
++ }
++
++ return 0;
++}
++
+ /* Guarantee atomicity of atomic operations at the machine level. */
+ static DEFINE_SPINLOCK(atomic_ops_lock);
+
+ int rxe_mr_do_atomic_op(struct rxe_mr *mr, u64 iova, int opcode,
+ u64 compare, u64 swap_add, u64 *orig_val)
+ {
+- u64 *va;
++ unsigned int page_offset;
++ struct page *page;
+ u64 value;
++ u64 *va;
+
+- if (mr->state != RXE_MR_STATE_VALID) {
++ if (unlikely(mr->state != RXE_MR_STATE_VALID)) {
+ rxe_dbg_mr(mr, "mr not in valid state");
+ return RESPST_ERR_RKEY_VIOLATION;
+ }
+
+- va = iova_to_vaddr(mr, iova, sizeof(u64));
+- if (!va) {
+- rxe_dbg_mr(mr, "iova out of range");
+- return RESPST_ERR_RKEY_VIOLATION;
++ if (mr->ibmr.type == IB_MR_TYPE_DMA) {
++ page_offset = iova & (PAGE_SIZE - 1);
++ page = virt_to_page(iova & PAGE_MASK);
++ } else {
++ unsigned long index;
++ int err;
++
++ err = mr_check_range(mr, iova, sizeof(value));
++ if (err) {
++ rxe_dbg_mr(mr, "iova out of range");
++ return RESPST_ERR_RKEY_VIOLATION;
++ }
++ page_offset = rxe_mr_iova_to_page_offset(mr, iova);
++ index = rxe_mr_iova_to_index(mr, iova);
++ page = xa_load(&mr->page_list, index);
++ if (!page)
++ return RESPST_ERR_RKEY_VIOLATION;
+ }
+
+- if ((uintptr_t)va & 0x7) {
++ if (unlikely(page_offset & 0x7)) {
+ rxe_dbg_mr(mr, "iova not aligned");
+ return RESPST_ERR_MISALIGNED_ATOMIC;
+ }
+
++ va = kmap_local_page(page);
++
+ spin_lock_bh(&atomic_ops_lock);
+- value = *orig_val = *va;
++ value = *orig_val = va[page_offset >> 3];
+
+ if (opcode == IB_OPCODE_RC_COMPARE_SWAP) {
+ if (value == compare)
+- *va = swap_add;
++ va[page_offset >> 3] = swap_add;
+ } else {
+ value += swap_add;
+- *va = value;
++ va[page_offset >> 3] = value;
+ }
+ spin_unlock_bh(&atomic_ops_lock);
+
++ kunmap_local(va);
++
+ return 0;
+ }
+
+-/* only implemented for 64 bit architectures */
+ #if defined CONFIG_64BIT
++/* only implemented or called for 64 bit architectures */
+ int rxe_mr_do_atomic_write(struct rxe_mr *mr, u64 iova, u64 value)
+ {
++ unsigned int page_offset;
++ struct page *page;
+ u64 *va;
+
+ /* See IBA oA19-28 */
+@@ -574,20 +536,38 @@ int rxe_mr_do_atomic_write(struct rxe_mr *mr, u64 iova, u64 value)
+ return RESPST_ERR_RKEY_VIOLATION;
+ }
+
+- va = iova_to_vaddr(mr, iova, sizeof(value));
+- if (unlikely(!va)) {
+- rxe_dbg_mr(mr, "iova out of range");
+- return RESPST_ERR_RKEY_VIOLATION;
++ if (mr->ibmr.type == IB_MR_TYPE_DMA) {
++ page_offset = iova & (PAGE_SIZE - 1);
++ page = virt_to_page(iova & PAGE_MASK);
++ } else {
++ unsigned long index;
++ int err;
++
++ /* See IBA oA19-28 */
++ err = mr_check_range(mr, iova, sizeof(value));
++ if (unlikely(err)) {
++ rxe_dbg_mr(mr, "iova out of range");
++ return RESPST_ERR_RKEY_VIOLATION;
++ }
++ page_offset = rxe_mr_iova_to_page_offset(mr, iova);
++ index = rxe_mr_iova_to_index(mr, iova);
++ page = xa_load(&mr->page_list, index);
++ if (!page)
++ return RESPST_ERR_RKEY_VIOLATION;
+ }
+
+ /* See IBA A19.4.2 */
+- if (unlikely((uintptr_t)va & 0x7 || iova & 0x7)) {
++ if (unlikely(page_offset & 0x7)) {
+ rxe_dbg_mr(mr, "misaligned address");
+ return RESPST_ERR_MISALIGNED_ATOMIC;
+ }
+
++ va = kmap_local_page(page);
++
+ /* Do atomic write after all prior operations have completed */
+- smp_store_release(va, value);
++ smp_store_release(&va[page_offset >> 3], value);
++
++ kunmap_local(va);
+
+ return 0;
+ }
+@@ -631,12 +611,6 @@ int advance_dma_data(struct rxe_dma_info *dma, unsigned int length)
+ return 0;
+ }
+
+-/* (1) find the mr corresponding to lkey/rkey
+- * depending on lookup_type
+- * (2) verify that the (qp) pd matches the mr pd
+- * (3) verify that the mr can support the requested access
+- * (4) verify that mr state is valid
+- */
+ struct rxe_mr *lookup_mr(struct rxe_pd *pd, int access, u32 key,
+ enum rxe_mr_lookup_type type)
+ {
+@@ -757,15 +731,10 @@ int rxe_dereg_mr(struct ib_mr *ibmr, struct ib_udata *udata)
+ void rxe_mr_cleanup(struct rxe_pool_elem *elem)
+ {
+ struct rxe_mr *mr = container_of(elem, typeof(*mr), elem);
+- int i;
+
+ rxe_put(mr_pd(mr));
+ ib_umem_release(mr->umem);
+
+- if (mr->map) {
+- for (i = 0; i < mr->num_map; i++)
+- kfree(mr->map[i]);
+-
+- kfree(mr->map);
+- }
++ if (mr->ibmr.type != IB_MR_TYPE_DMA)
++ xa_destroy(&mr->page_list);
+ }
+diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.h b/drivers/infiniband/sw/rxe/rxe_verbs.h
+index bfc94caaeec57..c269ae2a32243 100644
+--- a/drivers/infiniband/sw/rxe/rxe_verbs.h
++++ b/drivers/infiniband/sw/rxe/rxe_verbs.h
+@@ -283,17 +283,6 @@ enum rxe_mr_lookup_type {
+ RXE_LOOKUP_REMOTE,
+ };
+
+-#define RXE_BUF_PER_MAP (PAGE_SIZE / sizeof(struct rxe_phys_buf))
+-
+-struct rxe_phys_buf {
+- u64 addr;
+- u64 size;
+-};
+-
+-struct rxe_map {
+- struct rxe_phys_buf buf[RXE_BUF_PER_MAP];
+-};
+-
+ static inline int rkey_is_mw(u32 rkey)
+ {
+ u32 index = rkey >> 8;
+@@ -311,22 +300,16 @@ struct rxe_mr {
+ u32 rkey;
+ enum rxe_mr_state state;
+ int access;
++ atomic_t num_mw;
+
+ unsigned int page_offset;
+ unsigned int page_shift;
+ u64 page_mask;
+- int map_shift;
+- int map_mask;
+
+ u32 num_buf;
+ u32 nbuf;
+
+- u32 max_buf;
+- u32 num_map;
+-
+- atomic_t num_mw;
+-
+- struct rxe_map **map;
++ struct xarray page_list;
+ };
+
+ static inline unsigned int mr_page_size(struct rxe_mr *mr)
+--
+2.39.2
+
--- /dev/null
+From b0f4620a035c33b9c144772338de12cde84ebb6b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Feb 2023 11:10:00 +0100
+Subject: RDMA/siw: Fix user page pinning accounting
+
+From: Bernard Metzler <bmt@zurich.ibm.com>
+
+[ Upstream commit 65a8fc30fb6722fc25adec6d7dd5b53b0bb85820 ]
+
+To avoid racing with other user memory reservations, immediately
+account full amount of pages to be pinned.
+
+Fixes: 2251334dcac9 ("rdma/siw: application buffer management")
+Reported-by: Jason Gunthorpe <jgg@nvidia.com>
+Suggested-by: Alistair Popple <apopple@nvidia.com>
+Reviewed-by: Alistair Popple <apopple@nvidia.com>
+Signed-off-by: Bernard Metzler <bmt@zurich.ibm.com>
+Link: https://lore.kernel.org/r/20230202101000.402990-1-bmt@zurich.ibm.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/siw/siw_mem.c | 23 ++++++++++++-----------
+ 1 file changed, 12 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/infiniband/sw/siw/siw_mem.c b/drivers/infiniband/sw/siw/siw_mem.c
+index b2b33dd3b4fa1..f51ab2ccf1511 100644
+--- a/drivers/infiniband/sw/siw/siw_mem.c
++++ b/drivers/infiniband/sw/siw/siw_mem.c
+@@ -398,7 +398,7 @@ struct siw_umem *siw_umem_get(u64 start, u64 len, bool writable)
+
+ mlock_limit = rlimit(RLIMIT_MEMLOCK) >> PAGE_SHIFT;
+
+- if (num_pages + atomic64_read(&mm_s->pinned_vm) > mlock_limit) {
++ if (atomic64_add_return(num_pages, &mm_s->pinned_vm) > mlock_limit) {
+ rv = -ENOMEM;
+ goto out_sem_up;
+ }
+@@ -411,30 +411,27 @@ struct siw_umem *siw_umem_get(u64 start, u64 len, bool writable)
+ goto out_sem_up;
+ }
+ for (i = 0; num_pages; i++) {
+- int got, nents = min_t(int, num_pages, PAGES_PER_CHUNK);
+-
+- umem->page_chunk[i].plist =
++ int nents = min_t(int, num_pages, PAGES_PER_CHUNK);
++ struct page **plist =
+ kcalloc(nents, sizeof(struct page *), GFP_KERNEL);
+- if (!umem->page_chunk[i].plist) {
++
++ if (!plist) {
+ rv = -ENOMEM;
+ goto out_sem_up;
+ }
+- got = 0;
++ umem->page_chunk[i].plist = plist;
+ while (nents) {
+- struct page **plist = &umem->page_chunk[i].plist[got];
+-
+ rv = pin_user_pages(first_page_va, nents, foll_flags,
+ plist, NULL);
+ if (rv < 0)
+ goto out_sem_up;
+
+ umem->num_pages += rv;
+- atomic64_add(rv, &mm_s->pinned_vm);
+ first_page_va += rv * PAGE_SIZE;
++ plist += rv;
+ nents -= rv;
+- got += rv;
++ num_pages -= rv;
+ }
+- num_pages -= got;
+ }
+ out_sem_up:
+ mmap_read_unlock(mm_s);
+@@ -442,6 +439,10 @@ struct siw_umem *siw_umem_get(u64 start, u64 len, bool writable)
+ if (rv > 0)
+ return umem;
+
++ /* Adjust accounting for pages not pinned */
++ if (num_pages)
++ atomic64_sub(num_pages, &mm_s->pinned_vm);
++
+ siw_umem_release(umem, false);
+
+ return ERR_PTR(rv);
+--
+2.39.2
+
--- /dev/null
+From caa7e48fa6aa47e3a022f998fc0325f7cf51f548 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Feb 2023 12:26:23 +0000
+Subject: rds: rds_rm_zerocopy_callback() correct order for list_add_tail()
+
+From: Pietro Borrello <borrello@diag.uniroma1.it>
+
+[ Upstream commit 68762148d1b011d47bc2ceed7321739b5aea1e63 ]
+
+rds_rm_zerocopy_callback() uses list_add_tail() with swapped
+arguments. This links the list head with the new entry, losing
+the references to the remaining part of the list.
+
+Fixes: 9426bbc6de99 ("rds: use list structure to track information for zerocopy completion notification")
+Suggested-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Pietro Borrello <borrello@diag.uniroma1.it>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/rds/message.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/rds/message.c b/net/rds/message.c
+index c19c935612278..7af59d2443e5d 100644
+--- a/net/rds/message.c
++++ b/net/rds/message.c
+@@ -118,7 +118,7 @@ static void rds_rm_zerocopy_callback(struct rds_sock *rs,
+ ck = &info->zcookies;
+ memset(ck, 0, sizeof(*ck));
+ WARN_ON(!rds_zcookie_add(info, cookie));
+- list_add_tail(&q->zcookie_head, &info->rs_zcookie_next);
++ list_add_tail(&info->rs_zcookie_next, &q->zcookie_head);
+
+ spin_unlock_irqrestore(&q->lock, flags);
+ /* caller invokes rds_wake_sk_sleep() */
+--
+2.39.2
+
--- /dev/null
+From c48746d568126a1fef2103ae807be180ac61e208 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Jan 2023 02:04:57 +0000
+Subject: regmap: apply reg_base and reg_downshift for single register ops
+
+From: Daniel Golle <daniel@makrotopia.org>
+
+[ Upstream commit 697c3892d825fb78f42ec8e53bed065dd728db3e ]
+
+reg_base and reg_downshift currently don't have any effect if used with
+a regmap_bus or regmap_config which only offers single register
+operations (ie. reg_read, reg_write and optionally reg_update_bits).
+
+Fix that and take them into account also for regmap_bus with only
+reg_read and read_write operations by applying reg_base and
+reg_downshift in _regmap_bus_reg_write, _regmap_bus_reg_read.
+
+Also apply reg_base and reg_downshift in _regmap_update_bits, but only
+in case the operation is carried out with a reg_update_bits call
+defined in either regmap_bus or regmap_config.
+
+Fixes: 0074f3f2b1e43d ("regmap: allow a defined reg_base to be added to every address")
+Fixes: 86fc59ef818beb ("regmap: add configurable downshift for addresses")
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Tested-by: Colin Foster <colin.foster@in-advantage.com>
+Link: https://lore.kernel.org/r/Y9clyVS3tQEHlUhA@makrotopia.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/regmap/regmap.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
+index d12d669157f24..d2a54eb0efd9b 100644
+--- a/drivers/base/regmap/regmap.c
++++ b/drivers/base/regmap/regmap.c
+@@ -1942,6 +1942,8 @@ static int _regmap_bus_reg_write(void *context, unsigned int reg,
+ {
+ struct regmap *map = context;
+
++ reg += map->reg_base;
++ reg >>= map->format.reg_downshift;
+ return map->bus->reg_write(map->bus_context, reg, val);
+ }
+
+@@ -2840,6 +2842,8 @@ static int _regmap_bus_reg_read(void *context, unsigned int reg,
+ {
+ struct regmap *map = context;
+
++ reg += map->reg_base;
++ reg >>= map->format.reg_downshift;
+ return map->bus->reg_read(map->bus_context, reg, val);
+ }
+
+@@ -3231,6 +3235,8 @@ static int _regmap_update_bits(struct regmap *map, unsigned int reg,
+ *change = false;
+
+ if (regmap_volatile(map, reg) && map->reg_update_bits) {
++ reg += map->reg_base;
++ reg >>= map->format.reg_downshift;
+ ret = map->reg_update_bits(map->bus_context, reg, mask, val);
+ if (ret == 0 && change)
+ *change = true;
+--
+2.39.2
+
--- /dev/null
+From 6d5c2fa5944d81dc65fd3e59cdd52ae454553fc0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Jan 2023 14:52:07 -0800
+Subject: regulator: max77802: Bounds check regulator id against opmode
+
+From: Kees Cook <keescook@chromium.org>
+
+[ Upstream commit 4fd8bcec5fd7c0d586206fa2f42bd67b06cdaa7e ]
+
+Explicitly bounds-check the id before accessing the opmode array. Seen
+with GCC 13:
+
+../drivers/regulator/max77802-regulator.c: In function 'max77802_enable':
+../drivers/regulator/max77802-regulator.c:217:29: warning: array subscript [0, 41] is outside array bounds of 'unsigned int[42]' [-Warray-bounds=]
+ 217 | if (max77802->opmode[id] == MAX77802_OFF_PWRREQ)
+ | ~~~~~~~~~~~~~~~~^~~~
+../drivers/regulator/max77802-regulator.c:62:22: note: while referencing 'opmode'
+ 62 | unsigned int opmode[MAX77802_REG_MAX];
+ | ^~~~~~
+
+Cc: Javier Martinez Canillas <javier@dowhile0.org>
+Cc: Liam Girdwood <lgirdwood@gmail.com>
+Cc: Mark Brown <broonie@kernel.org>
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Acked-by: Javier Martinez Canillas <javierm@redhat.com>
+Link: https://lore.kernel.org/r/20230127225203.never.864-kees@kernel.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/max77802-regulator.c | 34 ++++++++++++++++++--------
+ 1 file changed, 24 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/regulator/max77802-regulator.c b/drivers/regulator/max77802-regulator.c
+index 21e0eb0f43f94..befe5f319819b 100644
+--- a/drivers/regulator/max77802-regulator.c
++++ b/drivers/regulator/max77802-regulator.c
+@@ -94,9 +94,11 @@ static int max77802_set_suspend_disable(struct regulator_dev *rdev)
+ {
+ unsigned int val = MAX77802_OFF_PWRREQ;
+ struct max77802_regulator_prv *max77802 = rdev_get_drvdata(rdev);
+- int id = rdev_get_id(rdev);
++ unsigned int id = rdev_get_id(rdev);
+ int shift = max77802_get_opmode_shift(id);
+
++ if (WARN_ON_ONCE(id >= ARRAY_SIZE(max77802->opmode)))
++ return -EINVAL;
+ max77802->opmode[id] = val;
+ return regmap_update_bits(rdev->regmap, rdev->desc->enable_reg,
+ rdev->desc->enable_mask, val << shift);
+@@ -110,7 +112,7 @@ static int max77802_set_suspend_disable(struct regulator_dev *rdev)
+ static int max77802_set_mode(struct regulator_dev *rdev, unsigned int mode)
+ {
+ struct max77802_regulator_prv *max77802 = rdev_get_drvdata(rdev);
+- int id = rdev_get_id(rdev);
++ unsigned int id = rdev_get_id(rdev);
+ unsigned int val;
+ int shift = max77802_get_opmode_shift(id);
+
+@@ -127,6 +129,9 @@ static int max77802_set_mode(struct regulator_dev *rdev, unsigned int mode)
+ return -EINVAL;
+ }
+
++ if (WARN_ON_ONCE(id >= ARRAY_SIZE(max77802->opmode)))
++ return -EINVAL;
++
+ max77802->opmode[id] = val;
+ return regmap_update_bits(rdev->regmap, rdev->desc->enable_reg,
+ rdev->desc->enable_mask, val << shift);
+@@ -135,8 +140,10 @@ static int max77802_set_mode(struct regulator_dev *rdev, unsigned int mode)
+ static unsigned max77802_get_mode(struct regulator_dev *rdev)
+ {
+ struct max77802_regulator_prv *max77802 = rdev_get_drvdata(rdev);
+- int id = rdev_get_id(rdev);
++ unsigned int id = rdev_get_id(rdev);
+
++ if (WARN_ON_ONCE(id >= ARRAY_SIZE(max77802->opmode)))
++ return -EINVAL;
+ return max77802_map_mode(max77802->opmode[id]);
+ }
+
+@@ -160,10 +167,13 @@ static int max77802_set_suspend_mode(struct regulator_dev *rdev,
+ unsigned int mode)
+ {
+ struct max77802_regulator_prv *max77802 = rdev_get_drvdata(rdev);
+- int id = rdev_get_id(rdev);
++ unsigned int id = rdev_get_id(rdev);
+ unsigned int val;
+ int shift = max77802_get_opmode_shift(id);
+
++ if (WARN_ON_ONCE(id >= ARRAY_SIZE(max77802->opmode)))
++ return -EINVAL;
++
+ /*
+ * If the regulator has been disabled for suspend
+ * then is invalid to try setting a suspend mode.
+@@ -209,9 +219,11 @@ static int max77802_set_suspend_mode(struct regulator_dev *rdev,
+ static int max77802_enable(struct regulator_dev *rdev)
+ {
+ struct max77802_regulator_prv *max77802 = rdev_get_drvdata(rdev);
+- int id = rdev_get_id(rdev);
++ unsigned int id = rdev_get_id(rdev);
+ int shift = max77802_get_opmode_shift(id);
+
++ if (WARN_ON_ONCE(id >= ARRAY_SIZE(max77802->opmode)))
++ return -EINVAL;
+ if (max77802->opmode[id] == MAX77802_OFF_PWRREQ)
+ max77802->opmode[id] = MAX77802_OPMODE_NORMAL;
+
+@@ -495,7 +507,7 @@ static int max77802_pmic_probe(struct platform_device *pdev)
+
+ for (i = 0; i < MAX77802_REG_MAX; i++) {
+ struct regulator_dev *rdev;
+- int id = regulators[i].id;
++ unsigned int id = regulators[i].id;
+ int shift = max77802_get_opmode_shift(id);
+ int ret;
+
+@@ -513,10 +525,12 @@ static int max77802_pmic_probe(struct platform_device *pdev)
+ * the hardware reports OFF as the regulator operating mode.
+ * Default to operating mode NORMAL in that case.
+ */
+- if (val == MAX77802_STATUS_OFF)
+- max77802->opmode[id] = MAX77802_OPMODE_NORMAL;
+- else
+- max77802->opmode[id] = val;
++ if (id < ARRAY_SIZE(max77802->opmode)) {
++ if (val == MAX77802_STATUS_OFF)
++ max77802->opmode[id] = MAX77802_OPMODE_NORMAL;
++ else
++ max77802->opmode[id] = val;
++ }
+
+ rdev = devm_regulator_register(&pdev->dev,
+ ®ulators[i], &config);
+--
+2.39.2
+
--- /dev/null
+From 119da17ef221a54adc919b6f3fe021f927a025c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Jan 2023 16:53:58 -0800
+Subject: regulator: s5m8767: Bounds check id indexing into arrays
+
+From: Kees Cook <keescook@chromium.org>
+
+[ Upstream commit e314e15a0b58f9d051c00b25951073bcdae61953 ]
+
+The compiler has no way to know if "id" is within the array bounds of
+the regulators array. Add a check for this and a build-time check that
+the regulators and reg_voltage_map arrays are sized the same. Seen with
+GCC 13:
+
+../drivers/regulator/s5m8767.c: In function 's5m8767_pmic_probe':
+../drivers/regulator/s5m8767.c:936:35: warning: array subscript [0, 36] is outside array bounds of 'struct regulator_desc[37]' [-Warray-bounds=]
+ 936 | regulators[id].vsel_reg =
+ | ~~~~~~~~~~^~~~
+
+Cc: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Cc: Liam Girdwood <lgirdwood@gmail.com>
+Cc: Mark Brown <broonie@kernel.org>
+Cc: linux-samsung-soc@vger.kernel.org
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Link: https://lore.kernel.org/r/20230128005358.never.313-kees@kernel.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/s5m8767.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/regulator/s5m8767.c b/drivers/regulator/s5m8767.c
+index 35269f9982105..754c6fcc6e642 100644
+--- a/drivers/regulator/s5m8767.c
++++ b/drivers/regulator/s5m8767.c
+@@ -923,10 +923,14 @@ static int s5m8767_pmic_probe(struct platform_device *pdev)
+
+ for (i = 0; i < pdata->num_regulators; i++) {
+ const struct sec_voltage_desc *desc;
+- int id = pdata->regulators[i].id;
++ unsigned int id = pdata->regulators[i].id;
+ int enable_reg, enable_val;
+ struct regulator_dev *rdev;
+
++ BUILD_BUG_ON(ARRAY_SIZE(regulators) != ARRAY_SIZE(reg_voltage_map));
++ if (WARN_ON_ONCE(id >= ARRAY_SIZE(regulators)))
++ continue;
++
+ desc = reg_voltage_map[id];
+ if (desc) {
+ regulators[id].n_voltages =
+--
+2.39.2
+
--- /dev/null
+From 4f9acae0d4f59e23f943c4ab95229f11a8ba2e94 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Feb 2023 15:01:19 +0100
+Subject: regulator: tps65219: use generic set_bypass()
+
+From: Jerome Neanne <jneanne@baylibre.com>
+
+[ Upstream commit 0365df81145a4cfaae5f4da896160de512256e6d ]
+
+Due to wrong interpretation of the specification,
+custom implementation was used instead of standard regmap helper.
+LINK: https://lore.kernel.org/all/c2014039-f1e8-6976-33d6-52e2dd4e7b66@baylibre.com/
+
+Fixes: c12ac5fc3e0a ("regulator: drivers: Add TI TPS65219 PMIC regulators support")
+
+Regulator does NOT require to be off to be switched to bypass mode.
+
+Signed-off-by: Jerome Neanne <jneanne@baylibre.com>
+Link: https://lore.kernel.org/r/20230203140119.13029-1-jneanne@baylibre.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/tps65219-regulator.c | 20 +-------------------
+ 1 file changed, 1 insertion(+), 19 deletions(-)
+
+diff --git a/drivers/regulator/tps65219-regulator.c b/drivers/regulator/tps65219-regulator.c
+index 070159cb5f094..58f6541b6417b 100644
+--- a/drivers/regulator/tps65219-regulator.c
++++ b/drivers/regulator/tps65219-regulator.c
+@@ -173,24 +173,6 @@ static unsigned int tps65219_get_mode(struct regulator_dev *dev)
+ return REGULATOR_MODE_NORMAL;
+ }
+
+-/*
+- * generic regulator_set_bypass_regmap does not fully match requirements
+- * TPS65219 Requires explicitly that regulator is disabled before switch
+- */
+-static int tps65219_set_bypass(struct regulator_dev *dev, bool enable)
+-{
+- struct tps65219 *tps = rdev_get_drvdata(dev);
+- unsigned int rid = rdev_get_id(dev);
+-
+- if (dev->desc->ops->is_enabled(dev)) {
+- dev_err(tps->dev,
+- "%s LDO%d enabled, must be shut down to set bypass ",
+- __func__, rid);
+- return -EBUSY;
+- }
+- return regulator_set_bypass_regmap(dev, enable);
+-}
+-
+ /* Operations permitted on BUCK1/2/3 */
+ static const struct regulator_ops tps65219_bucks_ops = {
+ .is_enabled = regulator_is_enabled_regmap,
+@@ -217,7 +199,7 @@ static const struct regulator_ops tps65219_ldos_1_2_ops = {
+ .set_voltage_sel = regulator_set_voltage_sel_regmap,
+ .list_voltage = regulator_list_voltage_linear_range,
+ .map_voltage = regulator_map_voltage_linear_range,
+- .set_bypass = tps65219_set_bypass,
++ .set_bypass = regulator_set_bypass_regmap,
+ .get_bypass = regulator_get_bypass_regmap,
+ };
+
+--
+2.39.2
+
--- /dev/null
+From d42c8cc4df51ed4745d8ba57d9d6dec49e026fb0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 14 Jan 2023 10:57:36 -0800
+Subject: regulator: tps65219: use IS_ERR() to detect an error pointer
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 2bbba115c3c9a647bcb3201b014fcc3728fe75c8 ]
+
+Fix pointer comparison to integer warning from gcc & sparse:
+
+GCC:
+../drivers/regulator/tps65219-regulator.c:370:26: warning: ordered comparison of pointer with integer zero [-Wextra]
+ 370 | if (rdev < 0) {
+ | ^
+
+sparse warning:
+drivers/regulator/tps65219-regulator.c:370:26: sparse: error: incompatible types for operation (<):
+drivers/regulator/tps65219-regulator.c:370:26: sparse: struct regulator_dev *[assigned] rdev
+drivers/regulator/tps65219-regulator.c:370:26: sparse: int
+
+Fixes: c12ac5fc3e0a ("regulator: drivers: Add TI TPS65219 PMIC regulators support")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Cc: Jerome Neanne <jneanne@baylibre.com>
+Cc: Tony Lindgren <tony@atomide.com>
+Cc: linux-omap@vger.kernel.org
+Cc: Liam Girdwood <lgirdwood@gmail.com>
+Cc: Mark Brown <broonie@kernel.org>
+Link: https://lore.kernel.org/r/20230114185736.2076-1-rdunlap@infradead.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/tps65219-regulator.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/regulator/tps65219-regulator.c b/drivers/regulator/tps65219-regulator.c
+index c484c943e4675..070159cb5f094 100644
+--- a/drivers/regulator/tps65219-regulator.c
++++ b/drivers/regulator/tps65219-regulator.c
+@@ -367,7 +367,7 @@ static int tps65219_regulator_probe(struct platform_device *pdev)
+ irq_data[i].type = irq_type;
+
+ tps65219_get_rdev_by_name(irq_type->regulator_name, rdevtbl, rdev);
+- if (rdev < 0) {
++ if (IS_ERR(rdev)) {
+ dev_err(tps->dev, "Failed to get rdev for %s\n",
+ irq_type->regulator_name);
+ return -EINVAL;
+--
+2.39.2
+
--- /dev/null
+From 46c0a141528fa90693e643f5c6870475b291c430 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Jan 2023 14:28:35 +0530
+Subject: remoteproc: qcom_q6v5_mss: Use a carveout to authenticate modem
+ headers
+
+From: Sibi Sankar <quic_sibis@quicinc.com>
+
+[ Upstream commit 57f72170a2b2a362c35bb9407fc844eac5afdec1 ]
+
+Any access to the dynamically allocated metadata region by the application
+processor after assigning it to the remote Q6 will result in a XPU
+violation. Fix this by replacing the dynamically allocated memory region
+with a no-map carveout and unmap the modem metadata memory region before
+passing control to the remote Q6.
+
+Reported-and-tested-by: Amit Pundir <amit.pundir@linaro.org>
+Fixes: 6c5a9dc2481b ("remoteproc: qcom: Make secure world call for mem ownership switch")
+Signed-off-by: Sibi Sankar <quic_sibis@quicinc.com>
+Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230117085840.32356-7-quic_sibis@quicinc.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/qcom_q6v5_mss.c | 59 +++++++++++++++++++++++++++---
+ 1 file changed, 53 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/remoteproc/qcom_q6v5_mss.c b/drivers/remoteproc/qcom_q6v5_mss.c
+index a8b141db4de63..7dbab5fcbe1e7 100644
+--- a/drivers/remoteproc/qcom_q6v5_mss.c
++++ b/drivers/remoteproc/qcom_q6v5_mss.c
+@@ -17,6 +17,7 @@
+ #include <linux/module.h>
+ #include <linux/of_address.h>
+ #include <linux/of_device.h>
++#include <linux/of_reserved_mem.h>
+ #include <linux/platform_device.h>
+ #include <linux/pm_domain.h>
+ #include <linux/pm_runtime.h>
+@@ -210,6 +211,9 @@ struct q6v5 {
+ size_t mba_size;
+ size_t dp_size;
+
++ phys_addr_t mdata_phys;
++ size_t mdata_size;
++
+ phys_addr_t mpss_phys;
+ phys_addr_t mpss_reloc;
+ size_t mpss_size;
+@@ -945,15 +949,35 @@ static int q6v5_mpss_init_image(struct q6v5 *qproc, const struct firmware *fw,
+ if (IS_ERR(metadata))
+ return PTR_ERR(metadata);
+
+- ptr = dma_alloc_attrs(qproc->dev, size, &phys, GFP_KERNEL, dma_attrs);
+- if (!ptr) {
+- kfree(metadata);
+- dev_err(qproc->dev, "failed to allocate mdt buffer\n");
+- return -ENOMEM;
++ if (qproc->mdata_phys) {
++ if (size > qproc->mdata_size) {
++ ret = -EINVAL;
++ dev_err(qproc->dev, "metadata size outside memory range\n");
++ goto free_metadata;
++ }
++
++ phys = qproc->mdata_phys;
++ ptr = memremap(qproc->mdata_phys, size, MEMREMAP_WC);
++ if (!ptr) {
++ ret = -EBUSY;
++ dev_err(qproc->dev, "unable to map memory region: %pa+%zx\n",
++ &qproc->mdata_phys, size);
++ goto free_metadata;
++ }
++ } else {
++ ptr = dma_alloc_attrs(qproc->dev, size, &phys, GFP_KERNEL, dma_attrs);
++ if (!ptr) {
++ ret = -ENOMEM;
++ dev_err(qproc->dev, "failed to allocate mdt buffer\n");
++ goto free_metadata;
++ }
+ }
+
+ memcpy(ptr, metadata, size);
+
++ if (qproc->mdata_phys)
++ memunmap(ptr);
++
+ /* Hypervisor mapping to access metadata by modem */
+ mdata_perm = BIT(QCOM_SCM_VMID_HLOS);
+ ret = q6v5_xfer_mem_ownership(qproc, &mdata_perm, false, true,
+@@ -982,7 +1006,9 @@ static int q6v5_mpss_init_image(struct q6v5 *qproc, const struct firmware *fw,
+ "mdt buffer not reclaimed system may become unstable\n");
+
+ free_dma_attrs:
+- dma_free_attrs(qproc->dev, size, ptr, phys, dma_attrs);
++ if (!qproc->mdata_phys)
++ dma_free_attrs(qproc->dev, size, ptr, phys, dma_attrs);
++free_metadata:
+ kfree(metadata);
+
+ return ret < 0 ? ret : 0;
+@@ -1810,6 +1836,7 @@ static int q6v5_init_reset(struct q6v5 *qproc)
+ static int q6v5_alloc_memory_region(struct q6v5 *qproc)
+ {
+ struct device_node *child;
++ struct reserved_mem *rmem;
+ struct device_node *node;
+ struct resource r;
+ int ret;
+@@ -1856,6 +1883,26 @@ static int q6v5_alloc_memory_region(struct q6v5 *qproc)
+ qproc->mpss_phys = qproc->mpss_reloc = r.start;
+ qproc->mpss_size = resource_size(&r);
+
++ if (!child) {
++ node = of_parse_phandle(qproc->dev->of_node, "memory-region", 2);
++ } else {
++ child = of_get_child_by_name(qproc->dev->of_node, "metadata");
++ node = of_parse_phandle(child, "memory-region", 0);
++ of_node_put(child);
++ }
++
++ if (!node)
++ return 0;
++
++ rmem = of_reserved_mem_lookup(node);
++ if (!rmem) {
++ dev_err(qproc->dev, "unable to resolve metadata region\n");
++ return -EINVAL;
++ }
++
++ qproc->mdata_phys = rmem->base;
++ qproc->mdata_size = rmem->size;
++
+ return 0;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From b5c20e1870cc3e3c0e4cbfd695627878c26e3d97 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Jan 2023 22:10:00 +0800
+Subject: Revert "char: pcmcia: cm4000_cs: Replace mdelay with usleep_range in
+ set_protocol"
+
+From: Duoming Zhou <duoming@zju.edu.cn>
+
+[ Upstream commit 70fae37a09268455b8ab4f64647086b61da6f39c ]
+
+This reverts commit be826ada52f1fcabed5b5217c94609ebf5967211.
+
+The function monitor_card() is a timer handler that runs in an
+atomic context, but it calls usleep_range() that can sleep.
+As a result, the sleep-in-atomic-context bugs will happen.
+The process is shown below:
+
+ (atomic context)
+monitor_card()
+ set_protocol()
+ usleep_range() //sleep
+
+The origin commit c1986ee9bea3 ("[PATCH] New Omnikey Cardman
+4000 driver") works fine.
+
+Fixes: be826ada52f1 ("char: pcmcia: cm4000_cs: Replace mdelay with usleep_range in set_protocol")
+Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
+Link: https://lore.kernel.org/r/20230118141000.5580-1-duoming@zju.edu.cn
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/pcmcia/cm4000_cs.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/char/pcmcia/cm4000_cs.c b/drivers/char/pcmcia/cm4000_cs.c
+index adaec8fd4b16c..e656f42a28ac2 100644
+--- a/drivers/char/pcmcia/cm4000_cs.c
++++ b/drivers/char/pcmcia/cm4000_cs.c
+@@ -529,7 +529,8 @@ static int set_protocol(struct cm4000_dev *dev, struct ptsreq *ptsreq)
+ DEBUGP(5, dev, "NumRecBytes is valid\n");
+ break;
+ }
+- usleep_range(10000, 11000);
++ /* can not sleep as this is in atomic context */
++ mdelay(10);
+ }
+ if (i == 100) {
+ DEBUGP(5, dev, "Timeout waiting for NumRecBytes getting "
+@@ -549,7 +550,8 @@ static int set_protocol(struct cm4000_dev *dev, struct ptsreq *ptsreq)
+ }
+ break;
+ }
+- usleep_range(10000, 11000);
++ /* can not sleep as this is in atomic context */
++ mdelay(10);
+ }
+
+ /* check whether it is a short PTS reply? */
+--
+2.39.2
+
--- /dev/null
+From cd79ae9013948fde54f36cc35e9a08c486b64f4e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Jan 2023 13:19:50 -0500
+Subject: Revert "drm/amdgpu: TA unload messages are not actually sent to psp
+ when amdgpu is uninstalled"
+
+From: Vitaly Prosyak <vitaly.prosyak@amd.com>
+
+[ Upstream commit 39934d3ed5725c5e3570ed1b67f612f1ea60ce03 ]
+
+This reverts commit fac53471d0ea9693d314aa2df08d62b2e7e3a0f8.
+The following change: move the drm_dev_unplug call after
+amdgpu_driver_unload_kms in amdgpu_pci_remove. The reason is
+the following: amdgpu_pci_remove calls drm_dev_unregister
+and it should be called first to ensure userspace can't access the
+device instance anymore. If we call drm_dev_unplug after
+amdgpu_driver_unload_kms then we observe IGT PCI software unplug
+test failure (kernel hung) for all ASICs. This is how this
+regression was found.
+
+After this revert, the following commands do work not, but it would
+be fixed in the next commit:
+ - sudo modprobe -r amdgpu
+ - sudo modprobe amdgpu
+
+Signed-off-by: Vitaly Prosyak <vitaly.prosyak@amd.com>
+Reviewed-by Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 3 ++-
+ drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 4 ++--
+ 2 files changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+index fbf2f24169eb5..d8e79de839d65 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+@@ -4022,7 +4022,8 @@ void amdgpu_device_fini_hw(struct amdgpu_device *adev)
+
+ amdgpu_gart_dummy_page_fini(adev);
+
+- amdgpu_device_unmap_mmio(adev);
++ if (drm_dev_is_unplugged(adev_to_drm(adev)))
++ amdgpu_device_unmap_mmio(adev);
+
+ }
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+index 3fe277bc233f4..7f598977d6942 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+@@ -2236,6 +2236,8 @@ amdgpu_pci_remove(struct pci_dev *pdev)
+ struct drm_device *dev = pci_get_drvdata(pdev);
+ struct amdgpu_device *adev = drm_to_adev(dev);
+
++ drm_dev_unplug(dev);
++
+ if (adev->pm.rpm_mode != AMDGPU_RUNPM_NONE) {
+ pm_runtime_get_sync(dev->dev);
+ pm_runtime_forbid(dev->dev);
+@@ -2275,8 +2277,6 @@ amdgpu_pci_remove(struct pci_dev *pdev)
+
+ amdgpu_driver_unload_kms(dev);
+
+- drm_dev_unplug(dev);
+-
+ /*
+ * Flush any in flight DMA operations from device.
+ * Clear the Bus Master Enable bit and then wait on the PCIe Device
+--
+2.39.2
+
--- /dev/null
+From 33ab1fd310c0e754e3e0e3a6963af5d2d56f1803 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Dec 2022 17:05:00 +0100
+Subject: Revert "fbcon: don't lose the console font across generic->chip
+ driver switch"
+
+From: Thomas Zimmermann <tzimmermann@suse.de>
+
+[ Upstream commit 12d5796d55f9fd9e4b621003127c99e176665064 ]
+
+This reverts commit ae1287865f5361fa138d4d3b1b6277908b54eac9.
+
+Always free the console font when deinitializing the framebuffer
+console. Subsequent framebuffer consoles will then use the default
+font. Rely on userspace to load any user-configured font for these
+consoles.
+
+Commit ae1287865f53 ("fbcon: don't lose the console font across
+generic->chip driver switch") was introduced to work around losing
+the font during graphics-device handover. [1][2] It kept a dangling
+pointer with the font data between loading the two consoles, which is
+fairly adventurous hack. It also never covered cases when the other
+consoles, such as VGA text mode, where involved.
+
+The problem has meanwhile been solved in userspace. Systemd comes
+with a udev rule that re-installs the configured font when a console
+comes up. [3] So the kernel workaround can be removed.
+
+This also removes one of the two special cases triggered by setting
+FBINFO_MISC_FIRMWARE in an fbdev driver.
+
+Tested during device handover from efifb and simpledrm to radeon. Udev
+reloads the configured console font for the new driver's terminal.
+
+Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
+Link: https://bugzilla.redhat.com/show_bug.cgi?id=892340 # 1
+Link: https://bugzilla.redhat.com/show_bug.cgi?id=1074624 # 2
+Link: https://cgit.freedesktop.org/systemd/systemd/tree/src/vconsole/90-vconsole.rules.in?h=v222 # 3
+Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20221219160516.23436-3-tzimmermann@suse.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/core/fbcon.c | 17 ++++++-----------
+ 1 file changed, 6 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
+index 1b14c21af2b74..2bc8baa90c0f2 100644
+--- a/drivers/video/fbdev/core/fbcon.c
++++ b/drivers/video/fbdev/core/fbcon.c
+@@ -958,7 +958,7 @@ static const char *fbcon_startup(void)
+ set_blitting_type(vc, info);
+
+ /* Setup default font */
+- if (!p->fontdata && !vc->vc_font.data) {
++ if (!p->fontdata) {
+ if (!fontname[0] || !(font = find_font(fontname)))
+ font = get_default_font(info->var.xres,
+ info->var.yres,
+@@ -968,8 +968,6 @@ static const char *fbcon_startup(void)
+ vc->vc_font.height = font->height;
+ vc->vc_font.data = (void *)(p->fontdata = font->data);
+ vc->vc_font.charcount = font->charcount;
+- } else {
+- p->fontdata = vc->vc_font.data;
+ }
+
+ cols = FBCON_SWAP(ops->rotate, info->var.xres, info->var.yres);
+@@ -1135,9 +1133,9 @@ static void fbcon_init(struct vc_data *vc, int init)
+ ops->p = &fb_display[fg_console];
+ }
+
+-static void fbcon_free_font(struct fbcon_display *p, bool freefont)
++static void fbcon_free_font(struct fbcon_display *p)
+ {
+- if (freefont && p->userfont && p->fontdata && (--REFCOUNT(p->fontdata) == 0))
++ if (p->userfont && p->fontdata && (--REFCOUNT(p->fontdata) == 0))
+ kfree(p->fontdata - FONT_EXTRA_WORDS * sizeof(int));
+ p->fontdata = NULL;
+ p->userfont = 0;
+@@ -1172,8 +1170,8 @@ static void fbcon_deinit(struct vc_data *vc)
+ struct fb_info *info;
+ struct fbcon_ops *ops;
+ int idx;
+- bool free_font = true;
+
++ fbcon_free_font(p);
+ idx = con2fb_map[vc->vc_num];
+
+ if (idx == -1)
+@@ -1184,8 +1182,6 @@ static void fbcon_deinit(struct vc_data *vc)
+ if (!info)
+ goto finished;
+
+- if (info->flags & FBINFO_MISC_FIRMWARE)
+- free_font = false;
+ ops = info->fbcon_par;
+
+ if (!ops)
+@@ -1197,9 +1193,8 @@ static void fbcon_deinit(struct vc_data *vc)
+ ops->initialized = false;
+ finished:
+
+- fbcon_free_font(p, free_font);
+- if (free_font)
+- vc->vc_font.data = NULL;
++ fbcon_free_font(p);
++ vc->vc_font.data = NULL;
+
+ if (vc->vc_hi_font_mask && vc->vc_screenbuf)
+ set_vc_hi_font(vc, false);
+--
+2.39.2
+
--- /dev/null
+From 5062459a552adb3772265d4837da5c1f86a7903c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Jan 2023 14:28:34 +0530
+Subject: Revert "remoteproc: qcom_q6v5_mss: map/unmap metadata region
+ before/after use"
+
+From: Christoph Hellwig <hch@lst.de>
+
+[ Upstream commit a899d542b687c9b04ccbd9eefabc829ba5fef791 ]
+
+This reverts commit fc156629b23a21181e473e60341e3a78af25a1d4.
+
+This commit manages to do three API violations at once:
+
+ - dereference the return value of dma_alloc_attrs with the
+ DMA_ATTR_NO_KERNEL_MAPPING mapping, which is clearly forbidden and
+ will do the wrong thing on various dma mapping implementations. The
+ fact that dma-direct uses a struct page as a cookie is an undocumented
+ implementation detail
+ - include dma-map-ops.h and use pgprot_dmacoherent despite a clear
+ comment documenting that this is not acceptable
+ - use of the VM_DMA_COHERENT for something that is not the dma-mapping
+ code
+ - use of VM_FLUSH_RESET_PERMS for vmap, while it is only supported for
+ vmalloc
+
+Acked-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sibi Sankar <quic_sibis@quicinc.com>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230117085840.32356-6-quic_sibis@quicinc.com
+Stable-dep-of: 57f72170a2b2 ("remoteproc: qcom_q6v5_mss: Use a carveout to authenticate modem headers")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/qcom_q6v5_mss.c | 38 +++++-------------------------
+ 1 file changed, 6 insertions(+), 32 deletions(-)
+
+diff --git a/drivers/remoteproc/qcom_q6v5_mss.c b/drivers/remoteproc/qcom_q6v5_mss.c
+index fddb63cffee07..a8b141db4de63 100644
+--- a/drivers/remoteproc/qcom_q6v5_mss.c
++++ b/drivers/remoteproc/qcom_q6v5_mss.c
+@@ -10,7 +10,6 @@
+ #include <linux/clk.h>
+ #include <linux/delay.h>
+ #include <linux/devcoredump.h>
+-#include <linux/dma-map-ops.h>
+ #include <linux/dma-mapping.h>
+ #include <linux/interrupt.h>
+ #include <linux/kernel.h>
+@@ -933,52 +932,27 @@ static void q6v5proc_halt_axi_port(struct q6v5 *qproc,
+ static int q6v5_mpss_init_image(struct q6v5 *qproc, const struct firmware *fw,
+ const char *fw_name)
+ {
+- unsigned long dma_attrs = DMA_ATTR_FORCE_CONTIGUOUS | DMA_ATTR_NO_KERNEL_MAPPING;
+- unsigned long flags = VM_DMA_COHERENT | VM_FLUSH_RESET_PERMS;
+- struct page **pages;
+- struct page *page;
++ unsigned long dma_attrs = DMA_ATTR_FORCE_CONTIGUOUS;
+ dma_addr_t phys;
+ void *metadata;
+ int mdata_perm;
+ int xferop_ret;
+ size_t size;
+- void *vaddr;
+- int count;
++ void *ptr;
+ int ret;
+- int i;
+
+ metadata = qcom_mdt_read_metadata(fw, &size, fw_name, qproc->dev);
+ if (IS_ERR(metadata))
+ return PTR_ERR(metadata);
+
+- page = dma_alloc_attrs(qproc->dev, size, &phys, GFP_KERNEL, dma_attrs);
+- if (!page) {
++ ptr = dma_alloc_attrs(qproc->dev, size, &phys, GFP_KERNEL, dma_attrs);
++ if (!ptr) {
+ kfree(metadata);
+ dev_err(qproc->dev, "failed to allocate mdt buffer\n");
+ return -ENOMEM;
+ }
+
+- count = PAGE_ALIGN(size) >> PAGE_SHIFT;
+- pages = kmalloc_array(count, sizeof(struct page *), GFP_KERNEL);
+- if (!pages) {
+- ret = -ENOMEM;
+- goto free_dma_attrs;
+- }
+-
+- for (i = 0; i < count; i++)
+- pages[i] = nth_page(page, i);
+-
+- vaddr = vmap(pages, count, flags, pgprot_dmacoherent(PAGE_KERNEL));
+- kfree(pages);
+- if (!vaddr) {
+- dev_err(qproc->dev, "unable to map memory region: %pa+%zx\n", &phys, size);
+- ret = -EBUSY;
+- goto free_dma_attrs;
+- }
+-
+- memcpy(vaddr, metadata, size);
+-
+- vunmap(vaddr);
++ memcpy(ptr, metadata, size);
+
+ /* Hypervisor mapping to access metadata by modem */
+ mdata_perm = BIT(QCOM_SCM_VMID_HLOS);
+@@ -1008,7 +982,7 @@ static int q6v5_mpss_init_image(struct q6v5 *qproc, const struct firmware *fw,
+ "mdt buffer not reclaimed system may become unstable\n");
+
+ free_dma_attrs:
+- dma_free_attrs(qproc->dev, size, page, phys, dma_attrs);
++ dma_free_attrs(qproc->dev, size, ptr, phys, dma_attrs);
+ kfree(metadata);
+
+ return ret < 0 ? ret : 0;
+--
+2.39.2
+
--- /dev/null
+From eb575fee6c9d473521ece722a1e8a05ecd752ad7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Jan 2023 19:41:00 +0530
+Subject: RISC-V: time: initialize hrtimer based broadcast clock event device
+
+From: Conor Dooley <conor.dooley@microchip.com>
+
+[ Upstream commit 8b3b8fbb4896984b5564789a42240e4b3caddb61 ]
+
+Similarly to commit 022eb8ae8b5e ("ARM: 8938/1: kernel: initialize
+broadcast hrtimer based clock event device"), RISC-V needs to initiate
+hrtimer based broadcast clock event device before C3STOP can be used.
+Otherwise, the introduction of C3STOP for the RISC-V arch timer in
+commit 232ccac1bd9b ("clocksource/drivers/riscv: Events are stopped
+during CPU suspend") leaves us without any broadcast timer registered.
+This prevents the kernel from entering oneshot mode, which breaks timer
+behaviour, for example clock_nanosleep().
+
+A test app that sleeps each cpu for 6, 5, 4, 3 ms respectively, HZ=250
+& C3STOP enabled, the sleep times are rounded up to the next jiffy:
+== CPU: 1 == == CPU: 2 == == CPU: 3 == == CPU: 4 ==
+Mean: 7.974992 Mean: 7.976534 Mean: 7.962591 Mean: 3.952179
+Std Dev: 0.154374 Std Dev: 0.156082 Std Dev: 0.171018 Std Dev: 0.076193
+Hi: 9.472000 Hi: 10.495000 Hi: 8.864000 Hi: 4.736000
+Lo: 6.087000 Lo: 6.380000 Lo: 4.872000 Lo: 3.403000
+Samples: 521 Samples: 521 Samples: 521 Samples: 521
+
+Link: https://lore.kernel.org/linux-riscv/YzYTNQRxLr7Q9JR0@spud/
+Fixes: 232ccac1bd9b ("clocksource/drivers/riscv: Events are stopped during CPU suspend")
+Suggested-by: Samuel Holland <samuel@sholland.org>
+Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
+Signed-off-by: Anup Patel <apatel@ventanamicro.com>
+Reviewed-by: Samuel Holland <samuel@sholland.org>
+Acked-by: Palmer Dabbelt <palmer@rivosinc.com>
+Link: https://lore.kernel.org/r/20230103141102.772228-2-apatel@ventanamicro.com
+Signed-off-by: Daniel Lezcano <daniel.lezcano@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kernel/time.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/riscv/kernel/time.c b/arch/riscv/kernel/time.c
+index 8217b0f67c6cb..1cf21db4fcc77 100644
+--- a/arch/riscv/kernel/time.c
++++ b/arch/riscv/kernel/time.c
+@@ -5,6 +5,7 @@
+ */
+
+ #include <linux/of_clk.h>
++#include <linux/clockchips.h>
+ #include <linux/clocksource.h>
+ #include <linux/delay.h>
+ #include <asm/sbi.h>
+@@ -29,6 +30,8 @@ void __init time_init(void)
+
+ of_clk_init(NULL);
+ timer_probe();
++
++ tick_setup_hrtimer_broadcast();
+ }
+
+ void clocksource_arch_init(struct clocksource *cs)
+--
+2.39.2
+
--- /dev/null
+From 518b1b3109e977cea538c0394439f0a183bd6795 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Feb 2023 15:42:31 -0800
+Subject: rpmsg: glink: Avoid infinite loop on intent for missing channel
+
+From: Bjorn Andersson <quic_bjorande@quicinc.com>
+
+[ Upstream commit 3e74ec2f39362bffbd42854acbb67c7f4cb808f9 ]
+
+In the event that an intent advertisement arrives on an unknown channel
+the fifo is not advanced, resulting in the same message being handled
+over and over.
+
+Fixes: dacbb35e930f ("rpmsg: glink: Receive and store the remote intent buffers")
+Signed-off-by: Bjorn Andersson <quic_bjorande@quicinc.com>
+Reviewed-by: Chris Lew <quic_clew@quicinc.com>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230214234231.2069751-1-quic_bjorande@quicinc.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rpmsg/qcom_glink_native.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/rpmsg/qcom_glink_native.c b/drivers/rpmsg/qcom_glink_native.c
+index 115c0a1eddb10..bb917746ad4bb 100644
+--- a/drivers/rpmsg/qcom_glink_native.c
++++ b/drivers/rpmsg/qcom_glink_native.c
+@@ -954,6 +954,7 @@ static void qcom_glink_handle_intent(struct qcom_glink *glink,
+ spin_unlock_irqrestore(&glink->idr_lock, flags);
+ if (!channel) {
+ dev_err(glink->dev, "intents for non-existing channel\n");
++ qcom_glink_rx_advance(glink, ALIGN(msglen, 8));
+ return;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From d3849a26223c76e669b96c4ef15aa2ebde38c50a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Jan 2023 14:39:31 -0800
+Subject: rpmsg: glink: Release driver_override
+
+From: Bjorn Andersson <quic_bjorande@quicinc.com>
+
+[ Upstream commit fb80ef67e8ff6a00d3faad4cb348dafdb8eccfd8 ]
+
+Upon termination of the rpmsg_device, driver_override needs to be freed
+to avoid leaking the potentially assigned string.
+
+Fixes: 42cd402b8fd4 ("rpmsg: Fix kfree() of static memory on setting driver_override")
+Fixes: 39e47767ec9b ("rpmsg: Add driver_override device attribute for rpmsg_device")
+Reviewed-by: Chris Lew <quic_clew@quicinc.com>
+Signed-off-by: Bjorn Andersson <quic_bjorande@quicinc.com>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230109223931.1706429-1-quic_bjorande@quicinc.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rpmsg/qcom_glink_native.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/rpmsg/qcom_glink_native.c b/drivers/rpmsg/qcom_glink_native.c
+index bb917746ad4bb..35df1b0a515bf 100644
+--- a/drivers/rpmsg/qcom_glink_native.c
++++ b/drivers/rpmsg/qcom_glink_native.c
+@@ -1447,6 +1447,7 @@ static void qcom_glink_rpdev_release(struct device *dev)
+ {
+ struct rpmsg_device *rpdev = to_rpmsg_device(dev);
+
++ kfree(rpdev->driver_override);
+ kfree(rpdev);
+ }
+
+@@ -1690,6 +1691,7 @@ static void qcom_glink_device_release(struct device *dev)
+
+ /* Release qcom_glink_alloc_channel() reference */
+ kref_put(&channel->refcount, qcom_glink_channel_release);
++ kfree(rpdev->driver_override);
+ kfree(rpdev);
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 52c087401c805f2ac8c72993d76c0b0ee847ecf7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Nov 2022 12:37:37 +0000
+Subject: rxrpc: Fix overwaking on call poking
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit a33395ab85b9b9cff83948a03a1d6d96347935d8 ]
+
+If an rxrpc call is given a poke, it will get woken up unconditionally,
+even if there's already a poke pending (for which there will have been a
+wake) or if the call refcount has gone to 0.
+
+Fix this by only waking the call if it is still referenced and if it
+doesn't already have a poke pending.
+
+Fixes: 15f661dc95da ("rxrpc: Implement a mechanism to send an event notification to a call")
+Signed-off-by: David Howells <dhowells@redhat.com>
+cc: Marc Dionne <marc.dionne@auristor.com>
+cc: linux-afs@lists.infradead.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/rxrpc/call_object.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/net/rxrpc/call_object.c b/net/rxrpc/call_object.c
+index f3c9f0201c156..7ce562f6dc8d5 100644
+--- a/net/rxrpc/call_object.c
++++ b/net/rxrpc/call_object.c
+@@ -54,12 +54,14 @@ void rxrpc_poke_call(struct rxrpc_call *call, enum rxrpc_call_poke_trace what)
+ spin_lock_bh(&local->lock);
+ busy = !list_empty(&call->attend_link);
+ trace_rxrpc_poke_call(call, busy, what);
++ if (!busy && !rxrpc_try_get_call(call, rxrpc_call_get_poke))
++ busy = true;
+ if (!busy) {
+- rxrpc_get_call(call, rxrpc_call_get_poke);
+ list_add_tail(&call->attend_link, &local->call_attend_q);
+ }
+ spin_unlock_bh(&local->lock);
+- rxrpc_wake_up_io_thread(local);
++ if (!busy)
++ rxrpc_wake_up_io_thread(local);
+ }
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 125d1616d49470913f09e8de3c51f3c9458faf03 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Feb 2023 00:00:23 +0100
+Subject: s390/ap: fix status returned by ap_aqic()
+
+From: Halil Pasic <pasic@linux.ibm.com>
+
+[ Upstream commit 394740d7645ea767795074287769dd26dbd4d782 ]
+
+There function ap_aqic() tries to grab the status from the
+wrong part of the register. Thus we always end up with
+zeros. Which is wrong, among others, because we detect
+failures via status.response_code.
+
+Signed-off-by: Halil Pasic <pasic@linux.ibm.com>
+Reported-by: Janosch Frank <frankja@linux.ibm.com>
+Fixes: 159491f3b509 ("s390/ap: rework assembler functions to use unions for in/out register variables")
+Reviewed-by: Harald Freudenberger <freude@linux.ibm.com>
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/include/asm/ap.h | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/arch/s390/include/asm/ap.h b/arch/s390/include/asm/ap.h
+index f508f5025e388..876afe46f316d 100644
+--- a/arch/s390/include/asm/ap.h
++++ b/arch/s390/include/asm/ap.h
+@@ -239,7 +239,10 @@ static inline struct ap_queue_status ap_aqic(ap_qid_t qid,
+ union {
+ unsigned long value;
+ struct ap_qirq_ctrl qirqctrl;
+- struct ap_queue_status status;
++ struct {
++ u32 _pad;
++ struct ap_queue_status status;
++ };
+ } reg1;
+ unsigned long reg2 = pa_ind;
+
+@@ -253,7 +256,7 @@ static inline struct ap_queue_status ap_aqic(ap_qid_t qid,
+ " lgr %[reg1],1\n" /* gr1 (status) into reg1 */
+ : [reg1] "+&d" (reg1)
+ : [reg0] "d" (reg0), [reg2] "d" (reg2)
+- : "cc", "0", "1", "2");
++ : "cc", "memory", "0", "1", "2");
+
+ return reg1.status;
+ }
+--
+2.39.2
+
--- /dev/null
+From f620aaacf30cc5baa9a901e7ef558ad910dfa249 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Feb 2023 00:00:24 +0100
+Subject: s390/ap: fix status returned by ap_qact()
+
+From: Halil Pasic <pasic@linux.ibm.com>
+
+[ Upstream commit a2522c80f074c35254974fec39fffe8b8d75befe ]
+
+Since commit 159491f3b509 ("s390/ap: rework assembler functions to use
+unions for in/out register variables") the function ap_qact() tries to
+grab the status from the wrong part of the register. Thus we always end
+up with zeros. Which is wrong, among others, because we detect failures
+via status.response_code.
+
+Signed-off-by: Halil Pasic <pasic@linux.ibm.com>
+Reported-by: Harald Freudenberger <freude@linux.ibm.com>
+Fixes: 159491f3b509 ("s390/ap: rework assembler functions to use unions for in/out register variables")
+Reviewed-by: Harald Freudenberger <freude@linux.ibm.com>
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/include/asm/ap.h | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/arch/s390/include/asm/ap.h b/arch/s390/include/asm/ap.h
+index 876afe46f316d..57a2d6518d272 100644
+--- a/arch/s390/include/asm/ap.h
++++ b/arch/s390/include/asm/ap.h
+@@ -293,7 +293,10 @@ static inline struct ap_queue_status ap_qact(ap_qid_t qid, int ifbit,
+ unsigned long reg0 = qid | (5UL << 24) | ((ifbit & 0x01) << 22);
+ union {
+ unsigned long value;
+- struct ap_queue_status status;
++ struct {
++ u32 _pad;
++ struct ap_queue_status status;
++ };
+ } reg1;
+ unsigned long reg2;
+
+--
+2.39.2
+
--- /dev/null
+From 11aae42603e4201b548a3e8448800850055e7177 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 May 2022 16:54:54 +0200
+Subject: s390/boot: cleanup decompressor header files
+
+From: Alexander Gordeev <agordeev@linux.ibm.com>
+
+[ Upstream commit 9c3205b2b062420c26b33924b910880889acf832 ]
+
+Move declarations to appropriate header files. Instead of cryptic
+casting directly assign struct vmlinux_info type to _vmlinux_info
+linker script variable - wich it actually is.
+
+Reviewed-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Stable-dep-of: 22476f47b6b7 ("s390/boot: fix mem_detect extended area allocation")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/boot/boot.h | 24 ++++++++++++++++++++++--
+ arch/s390/boot/decompressor.c | 1 +
+ arch/s390/boot/decompressor.h | 26 --------------------------
+ 3 files changed, 23 insertions(+), 28 deletions(-)
+
+diff --git a/arch/s390/boot/boot.h b/arch/s390/boot/boot.h
+index 70418389414d3..f6e82cf7851e2 100644
+--- a/arch/s390/boot/boot.h
++++ b/arch/s390/boot/boot.h
+@@ -8,10 +8,26 @@
+
+ #ifndef __ASSEMBLY__
+
++struct vmlinux_info {
++ unsigned long default_lma;
++ void (*entry)(void);
++ unsigned long image_size; /* does not include .bss */
++ unsigned long bss_size; /* uncompressed image .bss size */
++ unsigned long bootdata_off;
++ unsigned long bootdata_size;
++ unsigned long bootdata_preserved_off;
++ unsigned long bootdata_preserved_size;
++ unsigned long dynsym_start;
++ unsigned long rela_dyn_start;
++ unsigned long rela_dyn_end;
++ unsigned long amode31_size;
++};
++
+ void startup_kernel(void);
+ unsigned long detect_memory(void);
+ bool is_ipl_block_dump(void);
+ void store_ipl_parmblock(void);
++unsigned long read_ipl_report(unsigned long safe_offset);
+ void setup_boot_command_line(void);
+ void parse_boot_command_line(void);
+ void verify_facilities(void);
+@@ -20,6 +36,7 @@ void sclp_early_setup_buffer(void);
+ void print_pgm_check_info(void);
+ unsigned long get_random_base(unsigned long safe_addr);
+ void __printf(1, 2) decompressor_printk(const char *fmt, ...);
++void error(char *m);
+
+ /* Symbols defined by linker scripts */
+ extern const char kernel_version[];
+@@ -31,8 +48,11 @@ extern char __boot_data_start[], __boot_data_end[];
+ extern char __boot_data_preserved_start[], __boot_data_preserved_end[];
+ extern char _decompressor_syms_start[], _decompressor_syms_end[];
+ extern char _stack_start[], _stack_end[];
+-
+-unsigned long read_ipl_report(unsigned long safe_offset);
++extern char _end[];
++extern unsigned char _compressed_start[];
++extern unsigned char _compressed_end[];
++extern struct vmlinux_info _vmlinux_info;
++#define vmlinux _vmlinux_info
+
+ #endif /* __ASSEMBLY__ */
+ #endif /* BOOT_BOOT_H */
+diff --git a/arch/s390/boot/decompressor.c b/arch/s390/boot/decompressor.c
+index b519a1f045d8f..d762733a07530 100644
+--- a/arch/s390/boot/decompressor.c
++++ b/arch/s390/boot/decompressor.c
+@@ -11,6 +11,7 @@
+ #include <linux/string.h>
+ #include <asm/page.h>
+ #include "decompressor.h"
++#include "boot.h"
+
+ /*
+ * gzip declarations
+diff --git a/arch/s390/boot/decompressor.h b/arch/s390/boot/decompressor.h
+index f75cc31a77dd9..92b81d2ea35d6 100644
+--- a/arch/s390/boot/decompressor.h
++++ b/arch/s390/boot/decompressor.h
+@@ -2,37 +2,11 @@
+ #ifndef BOOT_COMPRESSED_DECOMPRESSOR_H
+ #define BOOT_COMPRESSED_DECOMPRESSOR_H
+
+-#include <linux/stddef.h>
+-
+ #ifdef CONFIG_KERNEL_UNCOMPRESSED
+ static inline void *decompress_kernel(void) { return NULL; }
+ #else
+ void *decompress_kernel(void);
+ #endif
+ unsigned long mem_safe_offset(void);
+-void error(char *m);
+-
+-struct vmlinux_info {
+- unsigned long default_lma;
+- void (*entry)(void);
+- unsigned long image_size; /* does not include .bss */
+- unsigned long bss_size; /* uncompressed image .bss size */
+- unsigned long bootdata_off;
+- unsigned long bootdata_size;
+- unsigned long bootdata_preserved_off;
+- unsigned long bootdata_preserved_size;
+- unsigned long dynsym_start;
+- unsigned long rela_dyn_start;
+- unsigned long rela_dyn_end;
+- unsigned long amode31_size;
+-};
+-
+-/* Symbols defined by linker scripts */
+-extern char _end[];
+-extern unsigned char _compressed_start[];
+-extern unsigned char _compressed_end[];
+-extern char _vmlinux_info[];
+-
+-#define vmlinux (*(struct vmlinux_info *)_vmlinux_info)
+
+ #endif /* BOOT_COMPRESSED_DECOMPRESSOR_H */
+--
+2.39.2
+
--- /dev/null
+From 729e2e7f77e377f4b5c6dd7670f5018979d07b66 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Jan 2023 12:49:47 +0100
+Subject: s390/boot: fix mem_detect extended area allocation
+
+From: Vasily Gorbik <gor@linux.ibm.com>
+
+[ Upstream commit 22476f47b6b7fb7d066c71f67ebc11892adb0849 ]
+
+Allocation of mem_detect extended area was not considered neither
+in commit 9641b8cc733f ("s390/ipl: read IPL report at early boot")
+nor in commit b2d24b97b2a9 ("s390/kernel: add support for kernel address
+space layout randomization (KASLR)"). As a result mem_detect extended
+theoretically may overlap with ipl report or randomized kernel image
+position. But as mem_detect code will allocate extended area only
+upon exceeding 255 online regions (which should alternate with offline
+memory regions) it is not seen in practice.
+
+To make sure mem_detect extended area does not overlap with ipl report
+or randomized kernel position extend usage of "safe_addr". Make initrd
+handling and mem_detect extended area allocation code move it further
+right and make KASLR takes in into consideration as well.
+
+Fixes: 9641b8cc733f ("s390/ipl: read IPL report at early boot")
+Fixes: b2d24b97b2a9 ("s390/kernel: add support for kernel address space layout randomization (KASLR)")
+Reviewed-by: Alexander Gordeev <agordeev@linux.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/boot/boot.h | 4 +--
+ arch/s390/boot/kaslr.c | 6 -----
+ arch/s390/boot/mem_detect.c | 52 ++++++++++++-------------------------
+ arch/s390/boot/startup.c | 21 ++++++++-------
+ 4 files changed, 31 insertions(+), 52 deletions(-)
+
+diff --git a/arch/s390/boot/boot.h b/arch/s390/boot/boot.h
+index f6e82cf7851e2..939a1b7806df2 100644
+--- a/arch/s390/boot/boot.h
++++ b/arch/s390/boot/boot.h
+@@ -24,10 +24,10 @@ struct vmlinux_info {
+ };
+
+ void startup_kernel(void);
+-unsigned long detect_memory(void);
++unsigned long detect_memory(unsigned long *safe_addr);
+ bool is_ipl_block_dump(void);
+ void store_ipl_parmblock(void);
+-unsigned long read_ipl_report(unsigned long safe_offset);
++unsigned long read_ipl_report(unsigned long safe_addr);
+ void setup_boot_command_line(void);
+ void parse_boot_command_line(void);
+ void verify_facilities(void);
+diff --git a/arch/s390/boot/kaslr.c b/arch/s390/boot/kaslr.c
+index e8d74d4f62aa5..58a8d8c8a1007 100644
+--- a/arch/s390/boot/kaslr.c
++++ b/arch/s390/boot/kaslr.c
+@@ -174,7 +174,6 @@ unsigned long get_random_base(unsigned long safe_addr)
+ {
+ unsigned long memory_limit = get_mem_detect_end();
+ unsigned long base_pos, max_pos, kernel_size;
+- unsigned long kasan_needs;
+ int i;
+
+ memory_limit = min(memory_limit, ident_map_size);
+@@ -186,12 +185,7 @@ unsigned long get_random_base(unsigned long safe_addr)
+ */
+ memory_limit -= kasan_estimate_memory_needs(memory_limit);
+
+- if (IS_ENABLED(CONFIG_BLK_DEV_INITRD) && initrd_data.start && initrd_data.size) {
+- if (safe_addr < initrd_data.start + initrd_data.size)
+- safe_addr = initrd_data.start + initrd_data.size;
+- }
+ safe_addr = ALIGN(safe_addr, THREAD_SIZE);
+-
+ kernel_size = vmlinux.image_size + vmlinux.bss_size;
+ if (safe_addr + kernel_size > memory_limit)
+ return 0;
+diff --git a/arch/s390/boot/mem_detect.c b/arch/s390/boot/mem_detect.c
+index 41792a3a5e364..daa1593171835 100644
+--- a/arch/s390/boot/mem_detect.c
++++ b/arch/s390/boot/mem_detect.c
+@@ -16,29 +16,10 @@ struct mem_detect_info __bootdata(mem_detect);
+ #define ENTRIES_EXTENDED_MAX \
+ (256 * (1020 / 2) * sizeof(struct mem_detect_block))
+
+-/*
+- * To avoid corrupting old kernel memory during dump, find lowest memory
+- * chunk possible either right after the kernel end (decompressed kernel) or
+- * after initrd (if it is present and there is no hole between the kernel end
+- * and initrd)
+- */
+-static void *mem_detect_alloc_extended(void)
+-{
+- unsigned long offset = ALIGN(mem_safe_offset(), sizeof(u64));
+-
+- if (IS_ENABLED(CONFIG_BLK_DEV_INITRD) && initrd_data.start && initrd_data.size &&
+- initrd_data.start < offset + ENTRIES_EXTENDED_MAX)
+- offset = ALIGN(initrd_data.start + initrd_data.size, sizeof(u64));
+-
+- return (void *)offset;
+-}
+-
+ static struct mem_detect_block *__get_mem_detect_block_ptr(u32 n)
+ {
+ if (n < MEM_INLINED_ENTRIES)
+ return &mem_detect.entries[n];
+- if (unlikely(!mem_detect.entries_extended))
+- mem_detect.entries_extended = mem_detect_alloc_extended();
+ return &mem_detect.entries_extended[n - MEM_INLINED_ENTRIES];
+ }
+
+@@ -147,7 +128,7 @@ static int tprot(unsigned long addr)
+ return rc;
+ }
+
+-static void search_mem_end(void)
++static unsigned long search_mem_end(void)
+ {
+ unsigned long range = 1 << (MAX_PHYSMEM_BITS - 20); /* in 1MB blocks */
+ unsigned long offset = 0;
+@@ -159,33 +140,34 @@ static void search_mem_end(void)
+ if (!tprot(pivot << 20))
+ offset = pivot;
+ }
+-
+- add_mem_detect_block(0, (offset + 1) << 20);
++ return (offset + 1) << 20;
+ }
+
+-unsigned long detect_memory(void)
++unsigned long detect_memory(unsigned long *safe_addr)
+ {
+ unsigned long max_physmem_end = 0;
+
+ sclp_early_get_memsize(&max_physmem_end);
++ mem_detect.entries_extended = (struct mem_detect_block *)ALIGN(*safe_addr, sizeof(u64));
+
+ if (!sclp_early_read_storage_info()) {
+ mem_detect.info_source = MEM_DETECT_SCLP_STOR_INFO;
+- return max_physmem_end;
+- }
+-
+- if (!diag260()) {
++ } else if (!diag260()) {
+ mem_detect.info_source = MEM_DETECT_DIAG260;
+- return max_physmem_end ?: get_mem_detect_end();
+- }
+-
+- if (max_physmem_end) {
++ max_physmem_end = max_physmem_end ?: get_mem_detect_end();
++ } else if (max_physmem_end) {
+ add_mem_detect_block(0, max_physmem_end);
+ mem_detect.info_source = MEM_DETECT_SCLP_READ_INFO;
+- return max_physmem_end;
++ } else {
++ max_physmem_end = search_mem_end();
++ add_mem_detect_block(0, max_physmem_end);
++ mem_detect.info_source = MEM_DETECT_BIN_SEARCH;
++ }
++
++ if (mem_detect.count > MEM_INLINED_ENTRIES) {
++ *safe_addr += (mem_detect.count - MEM_INLINED_ENTRIES) *
++ sizeof(struct mem_detect_block);
+ }
+
+- search_mem_end();
+- mem_detect.info_source = MEM_DETECT_BIN_SEARCH;
+- return get_mem_detect_end();
++ return max_physmem_end;
+ }
+diff --git a/arch/s390/boot/startup.c b/arch/s390/boot/startup.c
+index 47ca3264c0230..e0863d28759a5 100644
+--- a/arch/s390/boot/startup.c
++++ b/arch/s390/boot/startup.c
+@@ -57,16 +57,17 @@ unsigned long mem_safe_offset(void)
+ }
+ #endif
+
+-static void rescue_initrd(unsigned long addr)
++static unsigned long rescue_initrd(unsigned long safe_addr)
+ {
+ if (!IS_ENABLED(CONFIG_BLK_DEV_INITRD))
+- return;
++ return safe_addr;
+ if (!initrd_data.start || !initrd_data.size)
+- return;
+- if (addr <= initrd_data.start)
+- return;
+- memmove((void *)addr, (void *)initrd_data.start, initrd_data.size);
+- initrd_data.start = addr;
++ return safe_addr;
++ if (initrd_data.start < safe_addr) {
++ memmove((void *)safe_addr, (void *)initrd_data.start, initrd_data.size);
++ initrd_data.start = safe_addr;
++ }
++ return initrd_data.start + initrd_data.size;
+ }
+
+ static void copy_bootdata(void)
+@@ -250,6 +251,7 @@ static unsigned long reserve_amode31(unsigned long safe_addr)
+
+ void startup_kernel(void)
+ {
++ unsigned long max_physmem_end;
+ unsigned long random_lma;
+ unsigned long safe_addr;
+ void *img;
+@@ -265,12 +267,13 @@ void startup_kernel(void)
+ safe_addr = reserve_amode31(safe_addr);
+ safe_addr = read_ipl_report(safe_addr);
+ uv_query_info();
+- rescue_initrd(safe_addr);
++ safe_addr = rescue_initrd(safe_addr);
+ sclp_early_read_info();
+ setup_boot_command_line();
+ parse_boot_command_line();
+ sanitize_prot_virt_host();
+- setup_ident_map_size(detect_memory());
++ max_physmem_end = detect_memory(&safe_addr);
++ setup_ident_map_size(max_physmem_end);
+ setup_vmalloc_size();
+ setup_kernel_memory_layout();
+
+--
+2.39.2
+
--- /dev/null
+From 68fdb06dc0991bd2ae571ae5469291d0347d2218 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Jan 2023 20:04:55 +0100
+Subject: s390/bpf: Add expoline to tail calls
+
+From: Ilya Leoshkevich <iii@linux.ibm.com>
+
+[ Upstream commit bb4ef8fc3d193ed8d5583fb47cbeff5d8fb8302f ]
+
+All the indirect jumps in the eBPF JIT already use expolines, except
+for the tail call one.
+
+Fixes: de5cb6eb514e ("s390: use expoline thunks in the BPF JIT")
+Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
+Link: https://lore.kernel.org/r/20230129190501.1624747-3-iii@linux.ibm.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/net/bpf_jit_comp.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
+index af35052d06ed6..fbdba4c306bea 100644
+--- a/arch/s390/net/bpf_jit_comp.c
++++ b/arch/s390/net/bpf_jit_comp.c
+@@ -1393,8 +1393,16 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp,
+ /* lg %r1,bpf_func(%r1) */
+ EMIT6_DISP_LH(0xe3000000, 0x0004, REG_1, REG_1, REG_0,
+ offsetof(struct bpf_prog, bpf_func));
+- /* bc 0xf,tail_call_start(%r1) */
+- _EMIT4(0x47f01000 + jit->tail_call_start);
++ if (nospec_uses_trampoline()) {
++ jit->seen |= SEEN_FUNC;
++ /* aghi %r1,tail_call_start */
++ EMIT4_IMM(0xa70b0000, REG_1, jit->tail_call_start);
++ /* brcl 0xf,__s390_indirect_jump_r1 */
++ EMIT6_PCREL_RILC(0xc0040000, 0xf, jit->r1_thunk_ip);
++ } else {
++ /* bc 0xf,tail_call_start(%r1) */
++ _EMIT4(0x47f01000 + jit->tail_call_start);
++ }
+ /* out: */
+ if (jit->prg_buf) {
+ *(u16 *)(jit->prg_buf + patch_1_clrj + 2) =
+--
+2.39.2
+
--- /dev/null
+From 354d79fbeb9ca9f3f99bd627d5b66584cd659d48 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Feb 2023 01:02:53 +0100
+Subject: s390/dasd: Fix potential memleak in dasd_eckd_init()
+
+From: Qiheng Lin <linqiheng@huawei.com>
+
+[ Upstream commit 460e9bed82e49db1b823dcb4e421783854d86c40 ]
+
+`dasd_reserve_req` is allocated before `dasd_vol_info_req`, and it
+also needs to be freed before the error returns, just like the other
+cases in this function.
+
+Fixes: 9e12e54c7a8f ("s390/dasd: Handle out-of-space constraint")
+Signed-off-by: Qiheng Lin <linqiheng@huawei.com>
+Link: https://lore.kernel.org/r/20221208133809.16796-1-linqiheng@huawei.com
+Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
+Link: https://lore.kernel.org/r/20230210000253.1644903-3-sth@linux.ibm.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/block/dasd_eckd.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c
+index 5d0b9991e91a4..b20ce86b97b29 100644
+--- a/drivers/s390/block/dasd_eckd.c
++++ b/drivers/s390/block/dasd_eckd.c
+@@ -6956,8 +6956,10 @@ dasd_eckd_init(void)
+ return -ENOMEM;
+ dasd_vol_info_req = kmalloc(sizeof(*dasd_vol_info_req),
+ GFP_KERNEL | GFP_DMA);
+- if (!dasd_vol_info_req)
++ if (!dasd_vol_info_req) {
++ kfree(dasd_reserve_req);
+ return -ENOMEM;
++ }
+ pe_handler_worker = kmalloc(sizeof(*pe_handler_worker),
+ GFP_KERNEL | GFP_DMA);
+ if (!pe_handler_worker) {
+--
+2.39.2
+
--- /dev/null
+From 64f86d47e4394b9c7c241a03e7e9da91a4a28edf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Dec 2022 08:00:34 +0100
+Subject: s390/early: fix sclp_early_sccb variable lifetime
+
+From: Alexander Gordeev <agordeev@linux.ibm.com>
+
+[ Upstream commit 639886b71ddef085a0e7bb1f225b8ae3eda5c06f ]
+
+Commit ada1da31ce34 ("s390/sclp: sort out physical vs
+virtual pointers usage") fixed the notion of virtual
+address for sclp_early_sccb pointer. However, it did
+not take into account that kasan_early_init() can also
+output messages and sclp_early_sccb should be adjusted
+by the time kasan_early_init() is called.
+
+Currently it is not a problem, since virtual and physical
+addresses on s390 are the same. Nevertheless, should they
+ever differ, this would cause an invalid pointer access.
+
+Fixes: ada1da31ce34 ("s390/sclp: sort out physical vs virtual pointers usage")
+Reviewed-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/kernel/early.c | 1 -
+ arch/s390/kernel/head64.S | 1 +
+ drivers/s390/char/sclp_early.c | 2 +-
+ 3 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/s390/kernel/early.c b/arch/s390/kernel/early.c
+index 6030fdd6997bc..9693c8630e73f 100644
+--- a/arch/s390/kernel/early.c
++++ b/arch/s390/kernel/early.c
+@@ -288,7 +288,6 @@ static void __init sort_amode31_extable(void)
+
+ void __init startup_init(void)
+ {
+- sclp_early_adjust_va();
+ reset_tod_clock();
+ check_image_bootable();
+ time_early_init();
+diff --git a/arch/s390/kernel/head64.S b/arch/s390/kernel/head64.S
+index d7b8b6ad574dc..3b3bf8329e6c1 100644
+--- a/arch/s390/kernel/head64.S
++++ b/arch/s390/kernel/head64.S
+@@ -25,6 +25,7 @@ ENTRY(startup_continue)
+ larl %r14,init_task
+ stg %r14,__LC_CURRENT
+ larl %r15,init_thread_union+THREAD_SIZE-STACK_FRAME_OVERHEAD-__PT_SIZE
++ brasl %r14,sclp_early_adjust_va # allow sclp_early_printk
+ #ifdef CONFIG_KASAN
+ brasl %r14,kasan_early_init
+ #endif
+diff --git a/drivers/s390/char/sclp_early.c b/drivers/s390/char/sclp_early.c
+index c1c70a161c0e2..f480d6c7fd399 100644
+--- a/drivers/s390/char/sclp_early.c
++++ b/drivers/s390/char/sclp_early.c
+@@ -163,7 +163,7 @@ static void __init sclp_early_console_detect(struct init_sccb *sccb)
+ sclp.has_linemode = 1;
+ }
+
+-void __init sclp_early_adjust_va(void)
++void __init __no_sanitize_address sclp_early_adjust_va(void)
+ {
+ sclp_early_sccb = __va((unsigned long)sclp_early_sccb);
+ }
+--
+2.39.2
+
--- /dev/null
+From 376ab4585be636613d3edd1402e573711edce8d6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Feb 2023 14:49:40 +0100
+Subject: s390/idle: mark arch_cpu_idle() noinstr
+
+From: Heiko Carstens <hca@linux.ibm.com>
+
+[ Upstream commit a9cbc1b471d291c865907542394f1c483b93a811 ]
+
+linux-next commit ("cpuidle: tracing: Warn about !rcu_is_watching()")
+adds a new warning which hits on s390's arch_cpu_idle() function:
+
+RCU not on for: arch_cpu_idle+0x0/0x28
+WARNING: CPU: 2 PID: 0 at include/linux/trace_recursion.h:162 arch_ftrace_ops_list_func+0x24c/0x258
+Modules linked in:
+CPU: 2 PID: 0 Comm: swapper/2 Not tainted 6.2.0-rc6-next-20230202 #4
+Hardware name: IBM 8561 T01 703 (z/VM 7.3.0)
+Krnl PSW : 0404d00180000000 00000000002b55c0 (arch_ftrace_ops_list_func+0x250/0x258)
+ R:0 T:1 IO:0 EX:0 Key:0 M:1 W:0 P:0 AS:3 CC:1 PM:0 RI:0 EA:3
+Krnl GPRS: c0000000ffffbfff 0000000080000002 0000000000000026 0000000000000000
+ 0000037ffffe3a28 0000037ffffe3a20 0000000000000000 0000000000000000
+ 0000000000000000 0000000000f4acf6 00000000001044f0 0000037ffffe3cb0
+ 0000000000000000 0000000000000000 00000000002b55bc 0000037ffffe3bb8
+Krnl Code: 00000000002b55b0: c02000840051 larl %r2,0000000001335652
+ 00000000002b55b6: c0e5fff512d1 brasl %r14,0000000000157b58
+ #00000000002b55bc: af000000 mc 0,0
+ >00000000002b55c0: a7f4ffe7 brc 15,00000000002b558e
+ 00000000002b55c4: 0707 bcr 0,%r7
+ 00000000002b55c6: 0707 bcr 0,%r7
+ 00000000002b55c8: eb6ff0480024 stmg %r6,%r15,72(%r15)
+ 00000000002b55ce: b90400ef lgr %r14,%r15
+Call Trace:
+ [<00000000002b55c0>] arch_ftrace_ops_list_func+0x250/0x258
+([<00000000002b55bc>] arch_ftrace_ops_list_func+0x24c/0x258)
+ [<0000000000f5f0fc>] ftrace_common+0x1c/0x20
+ [<00000000001044f6>] arch_cpu_idle+0x6/0x28
+ [<0000000000f4acf6>] default_idle_call+0x76/0x128
+ [<00000000001cc374>] do_idle+0xf4/0x1b0
+ [<00000000001cc6ce>] cpu_startup_entry+0x36/0x40
+ [<0000000000119d00>] smp_start_secondary+0x140/0x150
+ [<0000000000f5d2ae>] restart_int_handler+0x6e/0x90
+
+Mark arch_cpu_idle() noinstr like all other architectures with
+CONFIG_ARCH_WANTS_NO_INSTR (should) have it to fix this.
+
+Reviewed-by: Sven Schnelle <svens@linux.ibm.com>
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/kernel/idle.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/s390/kernel/idle.c b/arch/s390/kernel/idle.c
+index 4bf1ee293f2b3..a0da049e73609 100644
+--- a/arch/s390/kernel/idle.c
++++ b/arch/s390/kernel/idle.c
+@@ -44,7 +44,7 @@ void account_idle_time_irq(void)
+ S390_lowcore.last_update_timer = idle->timer_idle_exit;
+ }
+
+-void arch_cpu_idle(void)
++void noinstr arch_cpu_idle(void)
+ {
+ struct s390_idle_data *idle = this_cpu_ptr(&s390_idle);
+ unsigned long idle_time;
+--
+2.39.2
+
--- /dev/null
+From afaf3538c88621d831aa15d854343fe59a54a945 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Feb 2023 19:38:58 +0100
+Subject: s390/kfence: fix page fault reporting
+
+From: Heiko Carstens <hca@linux.ibm.com>
+
+[ Upstream commit d9c2cf67b9cfd643ba85d51bc865a89a92e4f979 ]
+
+Baoquan He reported lots of KFENCE reports when /proc/kcore is read,
+e.g. with crash or even simpler with dd:
+
+ BUG: KFENCE: invalid read in copy_from_kernel_nofault+0x5e/0x120
+ Invalid read at 0x00000000f4f5149f:
+ copy_from_kernel_nofault+0x5e/0x120
+ read_kcore+0x6b2/0x870
+ proc_reg_read+0x9a/0xf0
+ vfs_read+0x94/0x270
+ ksys_read+0x70/0x100
+ __do_syscall+0x1d0/0x200
+ system_call+0x82/0xb0
+
+The reason for this is that read_kcore() simply reads memory that might
+have been unmapped by KFENCE with copy_from_kernel_nofault(). Any fault due
+to pages being unmapped by KFENCE would be handled gracefully by the fault
+handler (exception table fixup).
+
+However the s390 fault handler first reports the fault, and only afterwards
+would perform the exception table fixup. Most architectures have this in
+reversed order, which also avoids the false positive KFENCE reports when an
+unmapped page is accessed.
+
+Therefore change the s390 fault handler so it handles exception table
+fixups before KFENCE page faults are reported.
+
+Reported-by: Baoquan He <bhe@redhat.com>
+Tested-by: Baoquan He <bhe@redhat.com>
+Acked-by: Alexander Potapenko <glider@google.com>
+Link: https://lore.kernel.org/r/20230213183858.1473681-1-hca@linux.ibm.com
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/mm/fault.c | 49 +++++++++++++++++++++++++++++++-------------
+ 1 file changed, 35 insertions(+), 14 deletions(-)
+
+diff --git a/arch/s390/mm/fault.c b/arch/s390/mm/fault.c
+index 9649d9382e0ae..8e84ed2bb944e 100644
+--- a/arch/s390/mm/fault.c
++++ b/arch/s390/mm/fault.c
+@@ -96,6 +96,20 @@ static enum fault_type get_fault_type(struct pt_regs *regs)
+ return KERNEL_FAULT;
+ }
+
++static unsigned long get_fault_address(struct pt_regs *regs)
++{
++ unsigned long trans_exc_code = regs->int_parm_long;
++
++ return trans_exc_code & __FAIL_ADDR_MASK;
++}
++
++static bool fault_is_write(struct pt_regs *regs)
++{
++ unsigned long trans_exc_code = regs->int_parm_long;
++
++ return (trans_exc_code & store_indication) == 0x400;
++}
++
+ static int bad_address(void *p)
+ {
+ unsigned long dummy;
+@@ -228,15 +242,26 @@ static noinline void do_sigsegv(struct pt_regs *regs, int si_code)
+ (void __user *)(regs->int_parm_long & __FAIL_ADDR_MASK));
+ }
+
+-static noinline void do_no_context(struct pt_regs *regs)
++static noinline void do_no_context(struct pt_regs *regs, vm_fault_t fault)
+ {
++ enum fault_type fault_type;
++ unsigned long address;
++ bool is_write;
++
+ if (fixup_exception(regs))
+ return;
++ fault_type = get_fault_type(regs);
++ if ((fault_type == KERNEL_FAULT) && (fault == VM_FAULT_BADCONTEXT)) {
++ address = get_fault_address(regs);
++ is_write = fault_is_write(regs);
++ if (kfence_handle_page_fault(address, is_write, regs))
++ return;
++ }
+ /*
+ * Oops. The kernel tried to access some bad page. We'll have to
+ * terminate things with extreme prejudice.
+ */
+- if (get_fault_type(regs) == KERNEL_FAULT)
++ if (fault_type == KERNEL_FAULT)
+ printk(KERN_ALERT "Unable to handle kernel pointer dereference"
+ " in virtual kernel address space\n");
+ else
+@@ -255,7 +280,7 @@ static noinline void do_low_address(struct pt_regs *regs)
+ die (regs, "Low-address protection");
+ }
+
+- do_no_context(regs);
++ do_no_context(regs, VM_FAULT_BADACCESS);
+ }
+
+ static noinline void do_sigbus(struct pt_regs *regs)
+@@ -286,28 +311,28 @@ static noinline void do_fault_error(struct pt_regs *regs, vm_fault_t fault)
+ fallthrough;
+ case VM_FAULT_BADCONTEXT:
+ case VM_FAULT_PFAULT:
+- do_no_context(regs);
++ do_no_context(regs, fault);
+ break;
+ case VM_FAULT_SIGNAL:
+ if (!user_mode(regs))
+- do_no_context(regs);
++ do_no_context(regs, fault);
+ break;
+ default: /* fault & VM_FAULT_ERROR */
+ if (fault & VM_FAULT_OOM) {
+ if (!user_mode(regs))
+- do_no_context(regs);
++ do_no_context(regs, fault);
+ else
+ pagefault_out_of_memory();
+ } else if (fault & VM_FAULT_SIGSEGV) {
+ /* Kernel mode? Handle exceptions or die */
+ if (!user_mode(regs))
+- do_no_context(regs);
++ do_no_context(regs, fault);
+ else
+ do_sigsegv(regs, SEGV_MAPERR);
+ } else if (fault & VM_FAULT_SIGBUS) {
+ /* Kernel mode? Handle exceptions or die */
+ if (!user_mode(regs))
+- do_no_context(regs);
++ do_no_context(regs, fault);
+ else
+ do_sigbus(regs);
+ } else
+@@ -334,7 +359,6 @@ static inline vm_fault_t do_exception(struct pt_regs *regs, int access)
+ struct mm_struct *mm;
+ struct vm_area_struct *vma;
+ enum fault_type type;
+- unsigned long trans_exc_code;
+ unsigned long address;
+ unsigned int flags;
+ vm_fault_t fault;
+@@ -351,9 +375,8 @@ static inline vm_fault_t do_exception(struct pt_regs *regs, int access)
+ return 0;
+
+ mm = tsk->mm;
+- trans_exc_code = regs->int_parm_long;
+- address = trans_exc_code & __FAIL_ADDR_MASK;
+- is_write = (trans_exc_code & store_indication) == 0x400;
++ address = get_fault_address(regs);
++ is_write = fault_is_write(regs);
+
+ /*
+ * Verify that the fault happened in user space, that
+@@ -364,8 +387,6 @@ static inline vm_fault_t do_exception(struct pt_regs *regs, int access)
+ type = get_fault_type(regs);
+ switch (type) {
+ case KERNEL_FAULT:
+- if (kfence_handle_page_fault(address, is_write, regs))
+- return 0;
+ goto out;
+ case USER_FAULT:
+ case GMAP_FAULT:
+--
+2.39.2
+
--- /dev/null
+From 5463ef99c75ada97da928503404f86c23046cd6e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Jan 2023 14:03:07 +0100
+Subject: s390/mem_detect: fix detect_memory() error handling
+
+From: Vasily Gorbik <gor@linux.ibm.com>
+
+[ Upstream commit 3400c35a4090704e6c465449616ab7e67a9209e7 ]
+
+Currently if for some reason sclp_early_read_info() fails,
+sclp_early_get_memsize() will not set max_physmem_end and it
+will stay uninitialized. Any garbage value other than 0 will lead
+to detect_memory() taking wrong path or returning a garbage value
+as max_physmem_end. To avoid that simply initialize max_physmem_end.
+
+Fixes: 73045a08cf55 ("s390: unify identity mapping limits handling")
+Reported-by: Alexander Gordeev <agordeev@linux.ibm.com>
+Reviewed-by: Alexander Gordeev <agordeev@linux.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/boot/mem_detect.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/s390/boot/mem_detect.c b/arch/s390/boot/mem_detect.c
+index 7fa1a32ea0f3f..0a5821ef4f1fd 100644
+--- a/arch/s390/boot/mem_detect.c
++++ b/arch/s390/boot/mem_detect.c
+@@ -165,7 +165,7 @@ static void search_mem_end(void)
+
+ unsigned long detect_memory(void)
+ {
+- unsigned long max_physmem_end;
++ unsigned long max_physmem_end = 0;
+
+ sclp_early_get_memsize(&max_physmem_end);
+
+--
+2.39.2
+
--- /dev/null
+From 9f9c9ab4c99235feb352a1bd6b5d3fc82ebe9fb7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Jan 2023 14:57:43 +0100
+Subject: s390/mem_detect: rely on diag260() if sclp_early_get_memsize() fails
+
+From: Vasily Gorbik <gor@linux.ibm.com>
+
+[ Upstream commit eb33f9eb304a4c18beb5ba6362eaa5c4beaf40d8 ]
+
+In case sclp_early_get_memsize() fails but diag260() succeeds make sure
+some sane value is returned. This error scenario is highly unlikely,
+but this change makes system able to boot in such case.
+
+Suggested-by: Alexander Gordeev <agordeev@linux.ibm.com>
+Reviewed-by: Alexander Gordeev <agordeev@linux.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Stable-dep-of: 22476f47b6b7 ("s390/boot: fix mem_detect extended area allocation")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/boot/mem_detect.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/s390/boot/mem_detect.c b/arch/s390/boot/mem_detect.c
+index 0a5821ef4f1fd..41792a3a5e364 100644
+--- a/arch/s390/boot/mem_detect.c
++++ b/arch/s390/boot/mem_detect.c
+@@ -176,7 +176,7 @@ unsigned long detect_memory(void)
+
+ if (!diag260()) {
+ mem_detect.info_source = MEM_DETECT_DIAG260;
+- return max_physmem_end;
++ return max_physmem_end ?: get_mem_detect_end();
+ }
+
+ if (max_physmem_end) {
+--
+2.39.2
+
--- /dev/null
+From 520ea4ab4929be275ece02e93d53797197e5bddc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Jan 2023 18:08:38 +0100
+Subject: s390/mm,ptdump: avoid Kasan vs Memcpy Real markers swapping
+
+From: Vasily Gorbik <gor@linux.ibm.com>
+
+[ Upstream commit 05178996e1a77e2a4664536e6d101a086a905034 ]
+
+---[ Real Memory Copy Area Start ]---
+0x001bfffffffff000-0x001c000000000000 4K PTE I
+---[ Kasan Shadow Start ]---
+---[ Real Memory Copy Area End ]---
+0x001c000000000000-0x001c000200000000 8G PMD RW NX
+...
+---[ Kasan Shadow End ]---
+
+ptdump does a stable sort of markers. Move kasan markers after
+memcpy real to avoid swapping.
+
+Reviewed-by: Alexander Gordeev <agordeev@linux.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/mm/dump_pagetables.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/arch/s390/mm/dump_pagetables.c b/arch/s390/mm/dump_pagetables.c
+index 9953819d79596..ba5f802688781 100644
+--- a/arch/s390/mm/dump_pagetables.c
++++ b/arch/s390/mm/dump_pagetables.c
+@@ -33,10 +33,6 @@ enum address_markers_idx {
+ #endif
+ IDENTITY_AFTER_NR,
+ IDENTITY_AFTER_END_NR,
+-#ifdef CONFIG_KASAN
+- KASAN_SHADOW_START_NR,
+- KASAN_SHADOW_END_NR,
+-#endif
+ VMEMMAP_NR,
+ VMEMMAP_END_NR,
+ VMALLOC_NR,
+@@ -47,6 +43,10 @@ enum address_markers_idx {
+ ABS_LOWCORE_END_NR,
+ MEMCPY_REAL_NR,
+ MEMCPY_REAL_END_NR,
++#ifdef CONFIG_KASAN
++ KASAN_SHADOW_START_NR,
++ KASAN_SHADOW_END_NR,
++#endif
+ };
+
+ static struct addr_marker address_markers[] = {
+@@ -62,10 +62,6 @@ static struct addr_marker address_markers[] = {
+ #endif
+ [IDENTITY_AFTER_NR] = {(unsigned long)_end, "Identity Mapping Start"},
+ [IDENTITY_AFTER_END_NR] = {0, "Identity Mapping End"},
+-#ifdef CONFIG_KASAN
+- [KASAN_SHADOW_START_NR] = {KASAN_SHADOW_START, "Kasan Shadow Start"},
+- [KASAN_SHADOW_END_NR] = {KASAN_SHADOW_END, "Kasan Shadow End"},
+-#endif
+ [VMEMMAP_NR] = {0, "vmemmap Area Start"},
+ [VMEMMAP_END_NR] = {0, "vmemmap Area End"},
+ [VMALLOC_NR] = {0, "vmalloc Area Start"},
+@@ -76,6 +72,10 @@ static struct addr_marker address_markers[] = {
+ [ABS_LOWCORE_END_NR] = {0, "Lowcore Area End"},
+ [MEMCPY_REAL_NR] = {0, "Real Memory Copy Area Start"},
+ [MEMCPY_REAL_END_NR] = {0, "Real Memory Copy Area End"},
++#ifdef CONFIG_KASAN
++ [KASAN_SHADOW_START_NR] = {KASAN_SHADOW_START, "Kasan Shadow Start"},
++ [KASAN_SHADOW_END_NR] = {KASAN_SHADOW_END, "Kasan Shadow End"},
++#endif
+ { -1, NULL }
+ };
+
+--
+2.39.2
+
--- /dev/null
+From 9fc3f34d66685fe6d6c29a1b46a3373df985f82a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Jan 2023 20:05:07 -0700
+Subject: s390/vdso: Drop '-shared' from KBUILD_CFLAGS_64
+
+From: Nathan Chancellor <nathan@kernel.org>
+
+[ Upstream commit fd8589dce8107e2ce62e92f76089654462dd67b4 ]
+
+When clang's -Qunused-arguments is dropped from KBUILD_CPPFLAGS, it
+points out that there is a linking phase flag added to CFLAGS, which
+will only be used for compiling
+
+ clang-16: error: argument unused during compilation: '-shared' [-Werror,-Wunused-command-line-argument]
+
+'-shared' is already present in ldflags-y so it can just be dropped.
+
+Fixes: 2b2a25845d53 ("s390/vdso: Use $(LD) instead of $(CC) to link vDSO")
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Acked-by: Heiko Carstens <hca@linux.ibm.com>
+Reviewed-by: Sven Schnelle <svens@linux.ibm.com>
+Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
+Tested-by: Anders Roxell <anders.roxell@linaro.org>
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/kernel/vdso64/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/s390/kernel/vdso64/Makefile b/arch/s390/kernel/vdso64/Makefile
+index 9e2b95a222a98..1605ba45ac4c0 100644
+--- a/arch/s390/kernel/vdso64/Makefile
++++ b/arch/s390/kernel/vdso64/Makefile
+@@ -25,7 +25,7 @@ KBUILD_AFLAGS_64 := $(filter-out -m64,$(KBUILD_AFLAGS))
+ KBUILD_AFLAGS_64 += -m64 -s
+
+ KBUILD_CFLAGS_64 := $(filter-out -m64,$(KBUILD_CFLAGS))
+-KBUILD_CFLAGS_64 += -m64 -fPIC -shared -fno-common -fno-builtin
++KBUILD_CFLAGS_64 += -m64 -fPIC -fno-common -fno-builtin
+ ldflags-y := -fPIC -shared -soname=linux-vdso64.so.1 \
+ --hash-style=both --build-id=sha1 -T
+
+--
+2.39.2
+
--- /dev/null
+From a0f7644e4a12b29c9a0aa0e4cfe37cabff618820 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 31 Jul 2022 18:09:14 +0200
+Subject: s390/vfio-ap: fix an error handling path in
+ vfio_ap_mdev_probe_queue()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 08866d34c7099e981918d34aab5d6a437436628f ]
+
+The commit in Fixes: has switch the order of a sysfs_create_group() and a
+kzalloc().
+
+It correctly removed the now useless kfree() but forgot to add a
+sysfs_remove_group() in case of (unlikely) memory allocation failure.
+
+Add it now.
+
+Fixes: 260f3ea14138 ("s390/vfio-ap: move probe and remove callbacks to vfio_ap_ops.c")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
+Link: https://lore.kernel.org/r/d0c0a35eec4fa87cb7f3910d8ac4dc0f7dc9008a.1659283738.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/crypto/vfio_ap_ops.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/s390/crypto/vfio_ap_ops.c b/drivers/s390/crypto/vfio_ap_ops.c
+index 9c01957e56b3f..b0b25bc95985b 100644
+--- a/drivers/s390/crypto/vfio_ap_ops.c
++++ b/drivers/s390/crypto/vfio_ap_ops.c
+@@ -1857,8 +1857,10 @@ int vfio_ap_mdev_probe_queue(struct ap_device *apdev)
+ return ret;
+
+ q = kzalloc(sizeof(*q), GFP_KERNEL);
+- if (!q)
+- return -ENOMEM;
++ if (!q) {
++ ret = -ENOMEM;
++ goto err_remove_group;
++ }
+
+ q->apqn = to_ap_queue(&apdev->device)->qid;
+ q->saved_isc = VFIO_AP_ISC_INVALID;
+@@ -1876,6 +1878,10 @@ int vfio_ap_mdev_probe_queue(struct ap_device *apdev)
+ release_update_locks_for_mdev(matrix_mdev);
+
+ return 0;
++
++err_remove_group:
++ sysfs_remove_group(&apdev->device.kobj, &vfio_queue_attr_group);
++ return ret;
+ }
+
+ void vfio_ap_mdev_remove_queue(struct ap_device *apdev)
+--
+2.39.2
+
--- /dev/null
+From 1ac57c2174bb404c2dd12a277d25e1896dcf6c5d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Feb 2023 00:00:22 +0100
+Subject: s390: vfio-ap: tighten the NIB validity check
+
+From: Halil Pasic <pasic@linux.ibm.com>
+
+[ Upstream commit a64a6d23874c574d30a9816124b2dc37467f3811 ]
+
+The NIB is architecturally invalid if the address designates a
+storage location that is not installed or if it is zero.
+
+Signed-off-by: Halil Pasic <pasic@linux.ibm.com>
+Reported-by: Janosch Frank <frankja@linux.ibm.com>
+Fixes: ec89b55e3bce ("s390: ap: implement PAPQ AQIC interception in kernel")
+Reviewed-by: Tony Krowiak <akrowiak@linux.ibm.com>
+Reviewed-by: Pierre Morel <pmorel@linux.ibm.com>
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/crypto/vfio_ap_ops.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/s390/crypto/vfio_ap_ops.c b/drivers/s390/crypto/vfio_ap_ops.c
+index b0b25bc95985b..2bba5ed83dfcf 100644
+--- a/drivers/s390/crypto/vfio_ap_ops.c
++++ b/drivers/s390/crypto/vfio_ap_ops.c
+@@ -349,6 +349,8 @@ static int vfio_ap_validate_nib(struct kvm_vcpu *vcpu, dma_addr_t *nib)
+ {
+ *nib = vcpu->run->s.regs.gprs[2];
+
++ if (!*nib)
++ return -EINVAL;
+ if (kvm_is_error_hva(gfn_to_hva(vcpu->kvm, *nib >> PAGE_SHIFT)))
+ return -EINVAL;
+
+--
+2.39.2
+
--- /dev/null
+From 5ac4d435841c22254bb207b15eba6999e2f22404 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 28 Jan 2023 17:35:12 +0100
+Subject: s390/vmem: fix empty page tables cleanup under KASAN
+
+From: Vasily Gorbik <gor@linux.ibm.com>
+
+[ Upstream commit 108303b0a2d27cb14eed565e33e64ad9eefe5d7e ]
+
+Commit b9ff81003cf1 ("s390/vmem: cleanup empty page tables") introduced
+empty page tables cleanup in vmem code, but when the kernel is built
+with KASAN enabled the code has no effect due to wrong KASAN shadow
+memory intersection condition, which effectively ignores any memory
+range below KASAN shadow. Fix intersection condition to make code
+work as anticipated.
+
+Fixes: b9ff81003cf1 ("s390/vmem: cleanup empty page tables")
+Reviewed-by: Alexander Gordeev <agordeev@linux.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/mm/vmem.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/s390/mm/vmem.c b/arch/s390/mm/vmem.c
+index ee1a97078527b..9a0ce5315f36d 100644
+--- a/arch/s390/mm/vmem.c
++++ b/arch/s390/mm/vmem.c
+@@ -297,7 +297,7 @@ static void try_free_pmd_table(pud_t *pud, unsigned long start)
+ if (end > VMALLOC_START)
+ return;
+ #ifdef CONFIG_KASAN
+- if (start < KASAN_SHADOW_END && KASAN_SHADOW_START > end)
++ if (start < KASAN_SHADOW_END && end > KASAN_SHADOW_START)
+ return;
+ #endif
+ pmd = pmd_offset(pud, start);
+@@ -372,7 +372,7 @@ static void try_free_pud_table(p4d_t *p4d, unsigned long start)
+ if (end > VMALLOC_START)
+ return;
+ #ifdef CONFIG_KASAN
+- if (start < KASAN_SHADOW_END && KASAN_SHADOW_START > end)
++ if (start < KASAN_SHADOW_END && end > KASAN_SHADOW_START)
+ return;
+ #endif
+
+@@ -426,7 +426,7 @@ static void try_free_p4d_table(pgd_t *pgd, unsigned long start)
+ if (end > VMALLOC_START)
+ return;
+ #ifdef CONFIG_KASAN
+- if (start < KASAN_SHADOW_END && KASAN_SHADOW_START > end)
++ if (start < KASAN_SHADOW_END && end > KASAN_SHADOW_START)
+ return;
+ #endif
+
+--
+2.39.2
+
--- /dev/null
+From ac94872771fcf2e2e46197629dfbdbfd6e61e043 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Jan 2023 04:50:59 +0800
+Subject: sbitmap: correct wake_batch recalculation to avoid potential IO hung
+
+From: Kemeng Shi <shikemeng@huaweicloud.com>
+
+[ Upstream commit b5fcf7871acb7f9a3a8ed341a68bd86aba3e254a ]
+
+Commit 180dccb0dba4f ("blk-mq: fix tag_get wait task can't be awakened")
+mentioned that in case of shared tags, there could be just one real
+active hctx(queue) because of lazy detection of tag idle. Then driver tag
+allocation may wait forever on this real active hctx(queue) if wake_batch
+is > hctx_max_depth where hctx_max_depth is available tags depth for the
+actve hctx(queue). However, the condition wake_batch > hctx_max_depth is
+not strong enough to avoid IO hung as the sbitmap_queue_wake_up will only
+wake up one wait queue for each wake_batch even though there is only one
+waiter in the woken wait queue. After this, there is only one tag to free
+and wake_batch may not be reached anymore. Commit 180dccb0dba4f ("blk-mq:
+fix tag_get wait task can't be awakened") methioned that driver tag
+allocation may wait forever. Actually, the inactive hctx(queue) will be
+truely idle after at most 30 seconds and will call blk_mq_tag_wakeup_all
+to wake one waiter per wait queue to break the hung. But IO hung for 30
+seconds is also not acceptable. Set batch size to small enough that depth
+of the shared hctx(queue) is enough to wake up all of the queues like
+sbq_calc_wake_batch do to fix this potential IO hung.
+
+Although hctx_max_depth will be clamped to at least 4 while wake_batch
+recalculation does not do the clamp, the wake_batch will be always
+recalculated to 1 when hctx_max_depth <= 4.
+
+Fixes: 180dccb0dba4 ("blk-mq: fix tag_get wait task can't be awakened")
+Reviewed-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Kemeng Shi <shikemeng@huaweicloud.com>
+Link: https://lore.kernel.org/r/20230116205059.3821738-6-shikemeng@huaweicloud.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/sbitmap.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/lib/sbitmap.c b/lib/sbitmap.c
+index 2281fbb49d5c6..888c51235bd3c 100644
+--- a/lib/sbitmap.c
++++ b/lib/sbitmap.c
+@@ -464,13 +464,10 @@ void sbitmap_queue_recalculate_wake_batch(struct sbitmap_queue *sbq,
+ unsigned int users)
+ {
+ unsigned int wake_batch;
+- unsigned int min_batch;
+ unsigned int depth = (sbq->sb.depth + users - 1) / users;
+
+- min_batch = sbq->sb.depth >= (4 * SBQ_WAIT_QUEUES) ? 4 : 1;
+-
+ wake_batch = clamp_val(depth / SBQ_WAIT_QUEUES,
+- min_batch, SBQ_WAKE_BATCH);
++ 1, SBQ_WAKE_BATCH);
+
+ WRITE_ONCE(sbq->wake_batch, wake_batch);
+ }
+--
+2.39.2
+
--- /dev/null
+From d4bb13b086b923e1401276e1c4c54087d858b8a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Jan 2023 04:50:56 +0800
+Subject: sbitmap: remove redundant check in __sbitmap_queue_get_batch
+
+From: Kemeng Shi <shikemeng@huaweicloud.com>
+
+[ Upstream commit 903e86f3a64d9573352bbab2f211fdbbaa5772b7 ]
+
+Commit fbb564a557809 ("lib/sbitmap: Fix invalid loop in
+__sbitmap_queue_get_batch()") mentioned that "Checking free bits when
+setting the target bits. Otherwise, it may reuse the busying bits."
+This commit add check to make sure all masked bits in word before
+cmpxchg is zero. Then the existing check after cmpxchg to check any
+zero bit is existing in masked bits in word is redundant.
+
+Actually, old value of word before cmpxchg is stored in val and we
+will filter out busy bits in val by "(get_mask & ~val)" after cmpxchg.
+So we will not reuse busy bits methioned in commit fbb564a557809
+("lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch()"). Revert
+new-added check to remove redundant check.
+
+Fixes: fbb564a55780 ("lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch()")
+Reviewed-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Kemeng Shi <shikemeng@huaweicloud.com>
+Link: https://lore.kernel.org/r/20230116205059.3821738-3-shikemeng@huaweicloud.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/sbitmap.c | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+diff --git a/lib/sbitmap.c b/lib/sbitmap.c
+index 1fcede228fa25..2281fbb49d5c6 100644
+--- a/lib/sbitmap.c
++++ b/lib/sbitmap.c
+@@ -521,11 +521,9 @@ unsigned long __sbitmap_queue_get_batch(struct sbitmap_queue *sbq, int nr_tags,
+
+ get_mask = ((1UL << nr_tags) - 1) << nr;
+ val = READ_ONCE(map->word);
+- do {
+- if ((val & ~get_mask) != val)
+- goto next;
+- } while (!atomic_long_try_cmpxchg(ptr, &val,
+- get_mask | val));
++ while (!atomic_long_try_cmpxchg(ptr, &val,
++ get_mask | val))
++ ;
+ get_mask = (get_mask & ~val) >> nr;
+ if (get_mask) {
+ *offset = nr + (index << sb->shift);
+--
+2.39.2
+
--- /dev/null
+From 486bd7470ca8f8ab6fb1e6720bad3313d9c6d1d6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Jan 2023 13:22:16 +0100
+Subject: sched/fair: sanitize vruntime of entity being placed
+
+From: Zhang Qiao <zhangqiao22@huawei.com>
+
+[ Upstream commit 829c1651e9c4a6f78398d3e67651cef9bb6b42cc ]
+
+When a scheduling entity is placed onto cfs_rq, its vruntime is pulled
+to the base level (around cfs_rq->min_vruntime), so that the entity
+doesn't gain extra boost when placed backwards.
+
+However, if the entity being placed wasn't executed for a long time, its
+vruntime may get too far behind (e.g. while cfs_rq was executing a
+low-weight hog), which can inverse the vruntime comparison due to s64
+overflow. This results in the entity being placed with its original
+vruntime way forwards, so that it will effectively never get to the cpu.
+
+To prevent that, ignore the vruntime of the entity being placed if it
+didn't execute for much longer than the characteristic sheduler time
+scale.
+
+[rkagan: formatted, adjusted commit log, comments, cutoff value]
+Signed-off-by: Zhang Qiao <zhangqiao22@huawei.com>
+Co-developed-by: Roman Kagan <rkagan@amazon.de>
+Signed-off-by: Roman Kagan <rkagan@amazon.de>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://lkml.kernel.org/r/20230130122216.3555094-1-rkagan@amazon.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/fair.c | 15 +++++++++++++--
+ 1 file changed, 13 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index 0f87369914274..717c3ca970e15 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -4656,6 +4656,7 @@ static void
+ place_entity(struct cfs_rq *cfs_rq, struct sched_entity *se, int initial)
+ {
+ u64 vruntime = cfs_rq->min_vruntime;
++ u64 sleep_time;
+
+ /*
+ * The 'current' period is already promised to the current tasks,
+@@ -4685,8 +4686,18 @@ place_entity(struct cfs_rq *cfs_rq, struct sched_entity *se, int initial)
+ vruntime -= thresh;
+ }
+
+- /* ensure we never gain time by being placed backwards. */
+- se->vruntime = max_vruntime(se->vruntime, vruntime);
++ /*
++ * Pull vruntime of the entity being placed to the base level of
++ * cfs_rq, to prevent boosting it if placed backwards. If the entity
++ * slept for a long time, don't even try to compare its vruntime with
++ * the base as it may be too far off and the comparison may get
++ * inversed due to s64 overflow.
++ */
++ sleep_time = rq_clock_task(rq_of(cfs_rq)) - se->exec_start;
++ if ((s64)sleep_time > 60LL * NSEC_PER_SEC)
++ se->vruntime = vruntime;
++ else
++ se->vruntime = max_vruntime(se->vruntime, vruntime);
+ }
+
+ static void check_enqueue_throttle(struct cfs_rq *cfs_rq);
+--
+2.39.2
+
--- /dev/null
+From 2caf0a607ed5904845d766a764d8f5cb50660d79 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Feb 2023 22:33:54 +0000
+Subject: sched/rt: pick_next_rt_entity(): check list_entry
+
+From: Pietro Borrello <borrello@diag.uniroma1.it>
+
+[ Upstream commit 7c4a5b89a0b5a57a64b601775b296abf77a9fe97 ]
+
+Commit 326587b84078 ("sched: fix goto retry in pick_next_task_rt()")
+removed any path which could make pick_next_rt_entity() return NULL.
+However, BUG_ON(!rt_se) in _pick_next_task_rt() (the only caller of
+pick_next_rt_entity()) still checks the error condition, which can
+never happen, since list_entry() never returns NULL.
+Remove the BUG_ON check, and instead emit a warning in the only
+possible error condition here: the queue being empty which should
+never happen.
+
+Fixes: 326587b84078 ("sched: fix goto retry in pick_next_task_rt()")
+Signed-off-by: Pietro Borrello <borrello@diag.uniroma1.it>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Phil Auld <pauld@redhat.com>
+Reviewed-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Link: https://lore.kernel.org/r/20230128-list-entry-null-check-sched-v3-1-b1a71bd1ac6b@diag.uniroma1.it
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/rt.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c
+index ed2a47e4ddaec..0a11f44adee57 100644
+--- a/kernel/sched/rt.c
++++ b/kernel/sched/rt.c
+@@ -1777,6 +1777,8 @@ static struct sched_rt_entity *pick_next_rt_entity(struct rt_rq *rt_rq)
+ BUG_ON(idx >= MAX_RT_PRIO);
+
+ queue = array->queue + idx;
++ if (SCHED_WARN_ON(list_empty(queue)))
++ return NULL;
+ next = list_entry(queue->next, struct sched_rt_entity, run_list);
+
+ return next;
+@@ -1789,7 +1791,8 @@ static struct task_struct *_pick_next_task_rt(struct rq *rq)
+
+ do {
+ rt_se = pick_next_rt_entity(rt_rq);
+- BUG_ON(!rt_se);
++ if (unlikely(!rt_se))
++ return NULL;
+ rt_rq = group_rt_rq(rt_se);
+ } while (rt_rq);
+
+--
+2.39.2
+
--- /dev/null
+From 32d1c4c05418a69a822f673a5e93a186a785d6dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Feb 2023 18:24:54 +0000
+Subject: scm: add user copy checks to put_cmsg()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 5f1eb1ff58ea122e24adf0bc940f268ed2227462 ]
+
+This is a followup of commit 2558b8039d05 ("net: use a bounce
+buffer for copying skb->mark")
+
+x86 and powerpc define user_access_begin, meaning
+that they are not able to perform user copy checks
+when using user_write_access_begin() / unsafe_copy_to_user()
+and friends [1]
+
+Instead of waiting bugs to trigger on other arches,
+add a check_object_size() in put_cmsg() to make sure
+that new code tested on x86 with CONFIG_HARDENED_USERCOPY=y
+will perform more security checks.
+
+[1] We can not generically call check_object_size() from
+unsafe_copy_to_user() because UACCESS is enabled at this point.
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Kees Cook <keescook@chromium.org>
+Acked-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/scm.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/core/scm.c b/net/core/scm.c
+index 5c356f0dee30c..acb7d776fa6ec 100644
+--- a/net/core/scm.c
++++ b/net/core/scm.c
+@@ -229,6 +229,8 @@ int put_cmsg(struct msghdr * msg, int level, int type, int len, void *data)
+ if (msg->msg_control_is_user) {
+ struct cmsghdr __user *cm = msg->msg_control_user;
+
++ check_object_size(data, cmlen - sizeof(*cm), true);
++
+ if (!user_write_access_begin(cm, cmlen))
+ goto efault;
+
+--
+2.39.2
+
--- /dev/null
+From c42950efd9302fe984ead28cd7bd130eb677dcb6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 28 Jan 2023 19:08:32 +0800
+Subject: scsi: aic94xx: Add missing check for dma_map_single()
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit 32fe45274edb5926abc0fac7263d9f889d02d9cf ]
+
+Add check for dma_map_single() and return error if it fails in order to
+avoid invalid DMA address.
+
+Fixes: 2908d778ab3e ("[SCSI] aic94xx: new driver")
+Link: https://lore.kernel.org/r/20230128110832.6792-1-jiasheng@iscas.ac.cn
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Reviewed-by: Jason Yan <yanaijie@huawei.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/aic94xx/aic94xx_task.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/scsi/aic94xx/aic94xx_task.c b/drivers/scsi/aic94xx/aic94xx_task.c
+index ed119a3f6f2ed..7f02083001100 100644
+--- a/drivers/scsi/aic94xx/aic94xx_task.c
++++ b/drivers/scsi/aic94xx/aic94xx_task.c
+@@ -50,6 +50,9 @@ static int asd_map_scatterlist(struct sas_task *task,
+ dma_addr_t dma = dma_map_single(&asd_ha->pcidev->dev, p,
+ task->total_xfer_len,
+ task->data_dir);
++ if (dma_mapping_error(&asd_ha->pcidev->dev, dma))
++ return -ENOMEM;
++
+ sg_arr[0].bus_addr = cpu_to_le64((u64)dma);
+ sg_arr[0].size = cpu_to_le32(task->total_xfer_len);
+ sg_arr[0].flags |= ASD_SG_EL_LIST_EOL;
+--
+2.39.2
+
--- /dev/null
+From f96583cdb4523c2d356a1bba14baff3a980ca12d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Jan 2023 15:33:13 -0800
+Subject: scsi: lpfc: Fix use-after-free KFENCE violation during sysfs firmware
+ write
+
+From: Justin Tee <justin.tee@broadcom.com>
+
+[ Upstream commit 21681b81b9ae548c5dae7ae00d931197a27f480c ]
+
+During the sysfs firmware write process, a use-after-free read warning is
+logged from the lpfc_wr_object() routine:
+
+ BUG: KFENCE: use-after-free read in lpfc_wr_object+0x235/0x310 [lpfc]
+ Use-after-free read at 0x0000000000cf164d (in kfence-#111):
+ lpfc_wr_object+0x235/0x310 [lpfc]
+ lpfc_write_firmware.cold+0x206/0x30d [lpfc]
+ lpfc_sli4_request_firmware_update+0xa6/0x100 [lpfc]
+ lpfc_request_firmware_upgrade_store+0x66/0xb0 [lpfc]
+ kernfs_fop_write_iter+0x121/0x1b0
+ new_sync_write+0x11c/0x1b0
+ vfs_write+0x1ef/0x280
+ ksys_write+0x5f/0xe0
+ do_syscall_64+0x59/0x90
+ entry_SYSCALL_64_after_hwframe+0x63/0xcd
+
+The driver accessed wr_object pointer data, which was initialized into
+mailbox payload memory, after the mailbox object was released back to the
+mailbox pool.
+
+Fix by moving the mailbox free calls to the end of the routine ensuring
+that we don't reference internal mailbox memory after release.
+
+Signed-off-by: Justin Tee <justin.tee@broadcom.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_sli.c | 19 +++++++++++++------
+ 1 file changed, 13 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
+index 182aaae603868..55a0d4013439f 100644
+--- a/drivers/scsi/lpfc/lpfc_sli.c
++++ b/drivers/scsi/lpfc/lpfc_sli.c
+@@ -20819,6 +20819,7 @@ lpfc_wr_object(struct lpfc_hba *phba, struct list_head *dmabuf_list,
+ struct lpfc_mbx_wr_object *wr_object;
+ LPFC_MBOXQ_t *mbox;
+ int rc = 0, i = 0;
++ int mbox_status = 0;
+ uint32_t shdr_status, shdr_add_status, shdr_add_status_2;
+ uint32_t shdr_change_status = 0, shdr_csf = 0;
+ uint32_t mbox_tmo;
+@@ -20864,11 +20865,15 @@ lpfc_wr_object(struct lpfc_hba *phba, struct list_head *dmabuf_list,
+ wr_object->u.request.bde_count = i;
+ bf_set(lpfc_wr_object_write_length, &wr_object->u.request, written);
+ if (!phba->sli4_hba.intr_enable)
+- rc = lpfc_sli_issue_mbox(phba, mbox, MBX_POLL);
++ mbox_status = lpfc_sli_issue_mbox(phba, mbox, MBX_POLL);
+ else {
+ mbox_tmo = lpfc_mbox_tmo_val(phba, mbox);
+- rc = lpfc_sli_issue_mbox_wait(phba, mbox, mbox_tmo);
++ mbox_status = lpfc_sli_issue_mbox_wait(phba, mbox, mbox_tmo);
+ }
++
++ /* The mbox status needs to be maintained to detect MBOX_TIMEOUT. */
++ rc = mbox_status;
++
+ /* The IOCTL status is embedded in the mailbox subheader. */
+ shdr_status = bf_get(lpfc_mbox_hdr_status,
+ &wr_object->header.cfg_shdr.response);
+@@ -20883,10 +20888,6 @@ lpfc_wr_object(struct lpfc_hba *phba, struct list_head *dmabuf_list,
+ &wr_object->u.response);
+ }
+
+- if (!phba->sli4_hba.intr_enable)
+- mempool_free(mbox, phba->mbox_mem_pool);
+- else if (rc != MBX_TIMEOUT)
+- mempool_free(mbox, phba->mbox_mem_pool);
+ if (shdr_status || shdr_add_status || shdr_add_status_2 || rc) {
+ lpfc_printf_log(phba, KERN_ERR, LOG_TRACE_EVENT,
+ "3025 Write Object mailbox failed with "
+@@ -20904,6 +20905,12 @@ lpfc_wr_object(struct lpfc_hba *phba, struct list_head *dmabuf_list,
+ lpfc_log_fw_write_cmpl(phba, shdr_status, shdr_add_status,
+ shdr_add_status_2, shdr_change_status,
+ shdr_csf);
++
++ if (!phba->sli4_hba.intr_enable)
++ mempool_free(mbox, phba->mbox_mem_pool);
++ else if (mbox_status != MBX_TIMEOUT)
++ mempool_free(mbox, phba->mbox_mem_pool);
++
+ return rc;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From ce458f3991e1da3ac7bd7a0b86f3ecb13ffc2fe1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Feb 2023 16:21:59 +0100
+Subject: scsi: mpt3sas: Fix a memory leak
+
+From: Tomas Henzl <thenzl@redhat.com>
+
+[ Upstream commit 54dd96015e8d7a2a07359e2dfebf05b529d1780c ]
+
+Add a forgotten kfree().
+
+Fixes: dbec4c9040ed ("scsi: mpt3sas: lockless command submission")
+Link: https://lore.kernel.org/r/20230207152159.18627-1-thenzl@redhat.com
+Signed-off-by: Tomas Henzl <thenzl@redhat.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/mpt3sas/mpt3sas_base.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c
+index 69061545d9d2f..2ee9ea57554d7 100644
+--- a/drivers/scsi/mpt3sas/mpt3sas_base.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_base.c
+@@ -5849,6 +5849,9 @@ _base_release_memory_pools(struct MPT3SAS_ADAPTER *ioc)
+ }
+ dma_pool_destroy(ioc->pcie_sgl_dma_pool);
+ }
++ kfree(ioc->pcie_sg_lookup);
++ ioc->pcie_sg_lookup = NULL;
++
+ if (ioc->config_page) {
+ dexitprintk(ioc,
+ ioc_info(ioc, "config_page(0x%p): free\n",
+--
+2.39.2
+
--- /dev/null
+From ff2a64be237198d2331a8e58dcaf3d135180641b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Dec 2022 20:39:31 -0800
+Subject: scsi: qla2xxx: edif: Fix clang warning
+
+From: Quinn Tran <qutran@marvell.com>
+
+[ Upstream commit 2f5fab1b6c3a8efc93ba52c28539c45a8d0142ad ]
+
+clang warning:
+
+ drivers/scsi/qla2xxx/qla_edif_bsg.h:93:12: warning: field remote_pid
+ within 'struct app_pinfo_req' is less aligned than 'port_id_t' and is
+ usually due to 'struct app_pinfo_req' being packed, which can lead to
+ unaligned accesses [-Wunaligned-access]
+ port_id_t remote_pid;
+ ^
+ 2 warnings generated.
+
+Remove u32 field in remote_pid to silence warning.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Fixes: 7ebb336e45ef ("scsi: qla2xxx: edif: Add start + stop bsgs")
+Signed-off-by: Quinn Tran <qutran@marvell.com>
+Signed-off-by: Nilesh Javali <njavali@marvell.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_edif.c | 4 +++-
+ drivers/scsi/qla2xxx/qla_edif_bsg.h | 15 ++++++++++++++-
+ 2 files changed, 17 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_edif.c b/drivers/scsi/qla2xxx/qla_edif.c
+index 53186a1459629..38d5bda1f2748 100644
+--- a/drivers/scsi/qla2xxx/qla_edif.c
++++ b/drivers/scsi/qla2xxx/qla_edif.c
+@@ -925,7 +925,9 @@ qla_edif_app_getfcinfo(scsi_qla_host_t *vha, struct bsg_job *bsg_job)
+ if (!(fcport->flags & FCF_FCSP_DEVICE))
+ continue;
+
+- tdid = app_req.remote_pid;
++ tdid.b.domain = app_req.remote_pid.domain;
++ tdid.b.area = app_req.remote_pid.area;
++ tdid.b.al_pa = app_req.remote_pid.al_pa;
+
+ ql_dbg(ql_dbg_edif, vha, 0x2058,
+ "APP request entry - portid=%06x.\n", tdid.b24);
+diff --git a/drivers/scsi/qla2xxx/qla_edif_bsg.h b/drivers/scsi/qla2xxx/qla_edif_bsg.h
+index 0931f4e4e127a..514c265ba86e2 100644
+--- a/drivers/scsi/qla2xxx/qla_edif_bsg.h
++++ b/drivers/scsi/qla2xxx/qla_edif_bsg.h
+@@ -89,7 +89,20 @@ struct app_plogi_reply {
+ struct app_pinfo_req {
+ struct app_id app_info;
+ uint8_t num_ports;
+- port_id_t remote_pid;
++ struct {
++#ifdef __BIG_ENDIAN
++ uint8_t domain;
++ uint8_t area;
++ uint8_t al_pa;
++#elif defined(__LITTLE_ENDIAN)
++ uint8_t al_pa;
++ uint8_t area;
++ uint8_t domain;
++#else
++#error "__BIG_ENDIAN or __LITTLE_ENDIAN must be defined!"
++#endif
++ uint8_t rsvd_1;
++ } remote_pid;
+ uint8_t version;
+ uint8_t pad[VND_CMD_PAD_SIZE];
+ uint8_t reserved[VND_CMD_APP_RESERVED_SIZE];
+--
+2.39.2
+
--- /dev/null
+From 461bd953f3f66d25b52a5adc4da9a9c75021f400 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Dec 2022 03:07:42 -0800
+Subject: scsi: qla2xxx: Fix exchange oversubscription for management commands
+
+From: Quinn Tran <qutran@marvell.com>
+
+[ Upstream commit 5f63a163ed2f12c34dd4ae9b2757962ec7bb86e5 ]
+
+Add resource checking for management (non-I/O) commands.
+
+Fixes: 89c72f4245a8 ("scsi: qla2xxx: Add IOCB resource tracking")
+Signed-off-by: Quinn Tran <qutran@marvell.com>
+Signed-off-by: Nilesh Javali <njavali@marvell.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_dfs.c | 10 ++++-
+ drivers/scsi/qla2xxx/qla_inline.h | 5 ++-
+ drivers/scsi/qla2xxx/qla_iocb.c | 67 +++++++++++++++++++++++++++++++
+ drivers/scsi/qla2xxx/qla_isr.c | 1 +
+ 4 files changed, 80 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_dfs.c b/drivers/scsi/qla2xxx/qla_dfs.c
+index 777808af56347..1925cc6897b68 100644
+--- a/drivers/scsi/qla2xxx/qla_dfs.c
++++ b/drivers/scsi/qla2xxx/qla_dfs.c
+@@ -235,7 +235,7 @@ qla_dfs_fw_resource_cnt_show(struct seq_file *s, void *unused)
+ uint16_t mb[MAX_IOCB_MB_REG];
+ int rc;
+ struct qla_hw_data *ha = vha->hw;
+- u16 iocbs_used, i;
++ u16 iocbs_used, i, exch_used;
+
+ rc = qla24xx_res_count_wait(vha, mb, SIZEOF_IOCB_MB_REG);
+ if (rc != QLA_SUCCESS) {
+@@ -263,13 +263,19 @@ qla_dfs_fw_resource_cnt_show(struct seq_file *s, void *unused)
+ if (ql2xenforce_iocb_limit) {
+ /* lock is not require. It's an estimate. */
+ iocbs_used = ha->base_qpair->fwres.iocbs_used;
++ exch_used = ha->base_qpair->fwres.exch_used;
+ for (i = 0; i < ha->max_qpairs; i++) {
+- if (ha->queue_pair_map[i])
++ if (ha->queue_pair_map[i]) {
+ iocbs_used += ha->queue_pair_map[i]->fwres.iocbs_used;
++ exch_used += ha->queue_pair_map[i]->fwres.exch_used;
++ }
+ }
+
+ seq_printf(s, "Driver: estimate iocb used [%d] high water limit [%d]\n",
+ iocbs_used, ha->base_qpair->fwres.iocbs_limit);
++
++ seq_printf(s, "estimate exchange used[%d] high water limit [%d] n",
++ exch_used, ha->base_qpair->fwres.exch_limit);
+ }
+
+ return 0;
+diff --git a/drivers/scsi/qla2xxx/qla_inline.h b/drivers/scsi/qla2xxx/qla_inline.h
+index 2d5a275d8b000..b0ee307b5d4b9 100644
+--- a/drivers/scsi/qla2xxx/qla_inline.h
++++ b/drivers/scsi/qla2xxx/qla_inline.h
+@@ -380,7 +380,7 @@ qla2xxx_get_fc4_priority(struct scsi_qla_host *vha)
+
+ enum {
+ RESOURCE_NONE,
+- RESOURCE_IOCB = BIT_0,
++ RESOURCE_IOCB = BIT_0,
+ RESOURCE_EXCH = BIT_1, /* exchange */
+ RESOURCE_FORCE = BIT_2,
+ };
+@@ -396,6 +396,8 @@ qla_get_fw_resources(struct qla_qpair *qp, struct iocb_resource *iores)
+ iores->res_type = RESOURCE_NONE;
+ return 0;
+ }
++ if (iores->res_type & RESOURCE_FORCE)
++ goto force;
+
+ if ((iores->iocb_cnt + qp->fwres.iocbs_used) >= qp->fwres.iocbs_qp_limit) {
+ /* no need to acquire qpair lock. It's just rough calculation */
+@@ -423,6 +425,7 @@ qla_get_fw_resources(struct qla_qpair *qp, struct iocb_resource *iores)
+ return -ENOSPC;
+ }
+ }
++force:
+ qp->fwres.iocbs_used += iores->iocb_cnt;
+ qp->fwres.exch_used += iores->exch_cnt;
+ return 0;
+diff --git a/drivers/scsi/qla2xxx/qla_iocb.c b/drivers/scsi/qla2xxx/qla_iocb.c
+index 399ec8da2d73c..4f48f098ea5a6 100644
+--- a/drivers/scsi/qla2xxx/qla_iocb.c
++++ b/drivers/scsi/qla2xxx/qla_iocb.c
+@@ -3817,6 +3817,65 @@ qla24xx_prlo_iocb(srb_t *sp, struct logio_entry_24xx *logio)
+ logio->vp_index = sp->fcport->vha->vp_idx;
+ }
+
++int qla_get_iocbs_resource(struct srb *sp)
++{
++ bool get_exch;
++ bool push_it_through = false;
++
++ if (!ql2xenforce_iocb_limit) {
++ sp->iores.res_type = RESOURCE_NONE;
++ return 0;
++ }
++ sp->iores.res_type = RESOURCE_NONE;
++
++ switch (sp->type) {
++ case SRB_TM_CMD:
++ case SRB_PRLI_CMD:
++ case SRB_ADISC_CMD:
++ push_it_through = true;
++ fallthrough;
++ case SRB_LOGIN_CMD:
++ case SRB_ELS_CMD_RPT:
++ case SRB_ELS_CMD_HST:
++ case SRB_ELS_CMD_HST_NOLOGIN:
++ case SRB_CT_CMD:
++ case SRB_NVME_LS:
++ case SRB_ELS_DCMD:
++ get_exch = true;
++ break;
++
++ case SRB_FXIOCB_DCMD:
++ case SRB_FXIOCB_BCMD:
++ sp->iores.res_type = RESOURCE_NONE;
++ return 0;
++
++ case SRB_SA_UPDATE:
++ case SRB_SA_REPLACE:
++ case SRB_MB_IOCB:
++ case SRB_ABT_CMD:
++ case SRB_NACK_PLOGI:
++ case SRB_NACK_PRLI:
++ case SRB_NACK_LOGO:
++ case SRB_LOGOUT_CMD:
++ case SRB_CTRL_VP:
++ push_it_through = true;
++ fallthrough;
++ default:
++ get_exch = false;
++ }
++
++ sp->iores.res_type |= RESOURCE_IOCB;
++ sp->iores.iocb_cnt = 1;
++ if (get_exch) {
++ sp->iores.res_type |= RESOURCE_EXCH;
++ sp->iores.exch_cnt = 1;
++ }
++ if (push_it_through)
++ sp->iores.res_type |= RESOURCE_FORCE;
++
++ return qla_get_fw_resources(sp->qpair, &sp->iores);
++}
++
+ int
+ qla2x00_start_sp(srb_t *sp)
+ {
+@@ -3831,6 +3890,12 @@ qla2x00_start_sp(srb_t *sp)
+ return -EIO;
+
+ spin_lock_irqsave(qp->qp_lock_ptr, flags);
++ rval = qla_get_iocbs_resource(sp);
++ if (rval) {
++ spin_unlock_irqrestore(qp->qp_lock_ptr, flags);
++ return -EAGAIN;
++ }
++
+ pkt = __qla2x00_alloc_iocbs(sp->qpair, sp);
+ if (!pkt) {
+ rval = EAGAIN;
+@@ -3931,6 +3996,8 @@ qla2x00_start_sp(srb_t *sp)
+ wmb();
+ qla2x00_start_iocbs(vha, qp->req);
+ done:
++ if (rval)
++ qla_put_fw_resources(sp->qpair, &sp->iores);
+ spin_unlock_irqrestore(qp->qp_lock_ptr, flags);
+ return rval;
+ }
+diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
+index 42d3d2de3d31f..759bea69de120 100644
+--- a/drivers/scsi/qla2xxx/qla_isr.c
++++ b/drivers/scsi/qla2xxx/qla_isr.c
+@@ -3112,6 +3112,7 @@ qla25xx_process_bidir_status_iocb(scsi_qla_host_t *vha, void *pkt,
+ }
+ bsg_reply->reply_payload_rcv_len = 0;
+
++ qla_put_fw_resources(sp->qpair, &sp->iores);
+ done:
+ /* Return the vendor specific reply to API */
+ bsg_reply->reply_data.vendor_reply.vendor_rsp[0] = rval;
+--
+2.39.2
+
--- /dev/null
+From 6960d027a0bb193cc969d8fd810da1fa455bc302 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Dec 2022 03:07:41 -0800
+Subject: scsi: qla2xxx: Fix exchange oversubscription
+
+From: Quinn Tran <qutran@marvell.com>
+
+[ Upstream commit 41e5afe51f75f2858f5563145348f6c26d307b8f ]
+
+In large environment, it is possible to experience command timeout and
+escalation of path recovery. Currently the driver does not track the number
+of exchanges/commands sent to FW. If there is a delay for commands at the
+head of the queue, then this will create back pressure for commands at the
+back of the queue.
+
+Check for exchange availability before command submission.
+
+Fixes: 89c72f4245a8 ("scsi: qla2xxx: Add IOCB resource tracking")
+Signed-off-by: Quinn Tran <qutran@marvell.com>
+Signed-off-by: Nilesh Javali <njavali@marvell.com>
+Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_def.h | 6 +++-
+ drivers/scsi/qla2xxx/qla_edif.c | 7 +++--
+ drivers/scsi/qla2xxx/qla_init.c | 13 ++++++++
+ drivers/scsi/qla2xxx/qla_inline.h | 52 +++++++++++++++++++++----------
+ drivers/scsi/qla2xxx/qla_iocb.c | 28 ++++++++++-------
+ drivers/scsi/qla2xxx/qla_isr.c | 3 +-
+ drivers/scsi/qla2xxx/qla_nvme.c | 15 ++++++++-
+ 7 files changed, 88 insertions(+), 36 deletions(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
+index a26a373be9da3..cd4eb11b07079 100644
+--- a/drivers/scsi/qla2xxx/qla_def.h
++++ b/drivers/scsi/qla2xxx/qla_def.h
+@@ -660,7 +660,7 @@ enum {
+
+ struct iocb_resource {
+ u8 res_type;
+- u8 pad;
++ u8 exch_cnt;
+ u16 iocb_cnt;
+ };
+
+@@ -3721,6 +3721,10 @@ struct qla_fw_resources {
+ u16 iocbs_limit;
+ u16 iocbs_qp_limit;
+ u16 iocbs_used;
++ u16 exch_total;
++ u16 exch_limit;
++ u16 exch_used;
++ u16 pad;
+ };
+
+ #define QLA_IOCB_PCT_LIMIT 95
+diff --git a/drivers/scsi/qla2xxx/qla_edif.c b/drivers/scsi/qla2xxx/qla_edif.c
+index e4240aae5f9e3..53186a1459629 100644
+--- a/drivers/scsi/qla2xxx/qla_edif.c
++++ b/drivers/scsi/qla2xxx/qla_edif.c
+@@ -2989,9 +2989,10 @@ qla28xx_start_scsi_edif(srb_t *sp)
+ tot_dsds = nseg;
+ req_cnt = qla24xx_calc_iocbs(vha, tot_dsds);
+
+- sp->iores.res_type = RESOURCE_INI;
++ sp->iores.res_type = RESOURCE_IOCB | RESOURCE_EXCH;
++ sp->iores.exch_cnt = 1;
+ sp->iores.iocb_cnt = req_cnt;
+- if (qla_get_iocbs(sp->qpair, &sp->iores))
++ if (qla_get_fw_resources(sp->qpair, &sp->iores))
+ goto queuing_error;
+
+ if (req->cnt < (req_cnt + 2)) {
+@@ -3185,7 +3186,7 @@ qla28xx_start_scsi_edif(srb_t *sp)
+ mempool_free(sp->u.scmd.ct6_ctx, ha->ctx_mempool);
+ sp->u.scmd.ct6_ctx = NULL;
+ }
+- qla_put_iocbs(sp->qpair, &sp->iores);
++ qla_put_fw_resources(sp->qpair, &sp->iores);
+ spin_unlock_irqrestore(lock, flags);
+
+ return QLA_FUNCTION_FAILED;
+diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
+index 8d9ecabb1aac1..fd27fb5114796 100644
+--- a/drivers/scsi/qla2xxx/qla_init.c
++++ b/drivers/scsi/qla2xxx/qla_init.c
+@@ -128,12 +128,14 @@ static void qla24xx_abort_iocb_timeout(void *data)
+ sp->cmd_sp)) {
+ qpair->req->outstanding_cmds[handle] = NULL;
+ cmdsp_found = 1;
++ qla_put_fw_resources(qpair, &sp->cmd_sp->iores);
+ }
+
+ /* removing the abort */
+ if (qpair->req->outstanding_cmds[handle] == sp) {
+ qpair->req->outstanding_cmds[handle] = NULL;
+ sp_found = 1;
++ qla_put_fw_resources(qpair, &sp->iores);
+ break;
+ }
+ }
+@@ -2000,6 +2002,7 @@ qla2x00_tmf_iocb_timeout(void *data)
+ for (h = 1; h < sp->qpair->req->num_outstanding_cmds; h++) {
+ if (sp->qpair->req->outstanding_cmds[h] == sp) {
+ sp->qpair->req->outstanding_cmds[h] = NULL;
++ qla_put_fw_resources(sp->qpair, &sp->iores);
+ break;
+ }
+ }
+@@ -3943,6 +3946,12 @@ void qla_init_iocb_limit(scsi_qla_host_t *vha)
+ ha->base_qpair->fwres.iocbs_limit = limit;
+ ha->base_qpair->fwres.iocbs_qp_limit = limit / num_qps;
+ ha->base_qpair->fwres.iocbs_used = 0;
++
++ ha->base_qpair->fwres.exch_total = ha->orig_fw_xcb_count;
++ ha->base_qpair->fwres.exch_limit = (ha->orig_fw_xcb_count *
++ QLA_IOCB_PCT_LIMIT) / 100;
++ ha->base_qpair->fwres.exch_used = 0;
++
+ for (i = 0; i < ha->max_qpairs; i++) {
+ if (ha->queue_pair_map[i]) {
+ ha->queue_pair_map[i]->fwres.iocbs_total =
+@@ -3951,6 +3960,10 @@ void qla_init_iocb_limit(scsi_qla_host_t *vha)
+ ha->queue_pair_map[i]->fwres.iocbs_qp_limit =
+ limit / num_qps;
+ ha->queue_pair_map[i]->fwres.iocbs_used = 0;
++ ha->queue_pair_map[i]->fwres.exch_total = ha->orig_fw_xcb_count;
++ ha->queue_pair_map[i]->fwres.exch_limit =
++ (ha->orig_fw_xcb_count * QLA_IOCB_PCT_LIMIT) / 100;
++ ha->queue_pair_map[i]->fwres.exch_used = 0;
+ }
+ }
+ }
+diff --git a/drivers/scsi/qla2xxx/qla_inline.h b/drivers/scsi/qla2xxx/qla_inline.h
+index 5185dc5daf80d..2d5a275d8b000 100644
+--- a/drivers/scsi/qla2xxx/qla_inline.h
++++ b/drivers/scsi/qla2xxx/qla_inline.h
+@@ -380,13 +380,16 @@ qla2xxx_get_fc4_priority(struct scsi_qla_host *vha)
+
+ enum {
+ RESOURCE_NONE,
+- RESOURCE_INI,
++ RESOURCE_IOCB = BIT_0,
++ RESOURCE_EXCH = BIT_1, /* exchange */
++ RESOURCE_FORCE = BIT_2,
+ };
+
+ static inline int
+-qla_get_iocbs(struct qla_qpair *qp, struct iocb_resource *iores)
++qla_get_fw_resources(struct qla_qpair *qp, struct iocb_resource *iores)
+ {
+ u16 iocbs_used, i;
++ u16 exch_used;
+ struct qla_hw_data *ha = qp->vha->hw;
+
+ if (!ql2xenforce_iocb_limit) {
+@@ -394,10 +397,7 @@ qla_get_iocbs(struct qla_qpair *qp, struct iocb_resource *iores)
+ return 0;
+ }
+
+- if ((iores->iocb_cnt + qp->fwres.iocbs_used) < qp->fwres.iocbs_qp_limit) {
+- qp->fwres.iocbs_used += iores->iocb_cnt;
+- return 0;
+- } else {
++ if ((iores->iocb_cnt + qp->fwres.iocbs_used) >= qp->fwres.iocbs_qp_limit) {
+ /* no need to acquire qpair lock. It's just rough calculation */
+ iocbs_used = ha->base_qpair->fwres.iocbs_used;
+ for (i = 0; i < ha->max_qpairs; i++) {
+@@ -405,30 +405,48 @@ qla_get_iocbs(struct qla_qpair *qp, struct iocb_resource *iores)
+ iocbs_used += ha->queue_pair_map[i]->fwres.iocbs_used;
+ }
+
+- if ((iores->iocb_cnt + iocbs_used) < qp->fwres.iocbs_limit) {
+- qp->fwres.iocbs_used += iores->iocb_cnt;
+- return 0;
+- } else {
++ if ((iores->iocb_cnt + iocbs_used) >= qp->fwres.iocbs_limit) {
++ iores->res_type = RESOURCE_NONE;
++ return -ENOSPC;
++ }
++ }
++
++ if (iores->res_type & RESOURCE_EXCH) {
++ exch_used = ha->base_qpair->fwres.exch_used;
++ for (i = 0; i < ha->max_qpairs; i++) {
++ if (ha->queue_pair_map[i])
++ exch_used += ha->queue_pair_map[i]->fwres.exch_used;
++ }
++
++ if ((exch_used + iores->exch_cnt) >= qp->fwres.exch_limit) {
+ iores->res_type = RESOURCE_NONE;
+ return -ENOSPC;
+ }
+ }
++ qp->fwres.iocbs_used += iores->iocb_cnt;
++ qp->fwres.exch_used += iores->exch_cnt;
++ return 0;
+ }
+
+ static inline void
+-qla_put_iocbs(struct qla_qpair *qp, struct iocb_resource *iores)
++qla_put_fw_resources(struct qla_qpair *qp, struct iocb_resource *iores)
+ {
+- switch (iores->res_type) {
+- case RESOURCE_NONE:
+- break;
+- default:
++ if (iores->res_type & RESOURCE_IOCB) {
+ if (qp->fwres.iocbs_used >= iores->iocb_cnt) {
+ qp->fwres.iocbs_used -= iores->iocb_cnt;
+ } else {
+- // should not happen
++ /* should not happen */
+ qp->fwres.iocbs_used = 0;
+ }
+- break;
++ }
++
++ if (iores->res_type & RESOURCE_EXCH) {
++ if (qp->fwres.exch_used >= iores->exch_cnt) {
++ qp->fwres.exch_used -= iores->exch_cnt;
++ } else {
++ /* should not happen */
++ qp->fwres.exch_used = 0;
++ }
+ }
+ iores->res_type = RESOURCE_NONE;
+ }
+diff --git a/drivers/scsi/qla2xxx/qla_iocb.c b/drivers/scsi/qla2xxx/qla_iocb.c
+index 42ce4e1fe7441..399ec8da2d73c 100644
+--- a/drivers/scsi/qla2xxx/qla_iocb.c
++++ b/drivers/scsi/qla2xxx/qla_iocb.c
+@@ -1589,9 +1589,10 @@ qla24xx_start_scsi(srb_t *sp)
+ tot_dsds = nseg;
+ req_cnt = qla24xx_calc_iocbs(vha, tot_dsds);
+
+- sp->iores.res_type = RESOURCE_INI;
++ sp->iores.res_type = RESOURCE_IOCB | RESOURCE_EXCH;
++ sp->iores.exch_cnt = 1;
+ sp->iores.iocb_cnt = req_cnt;
+- if (qla_get_iocbs(sp->qpair, &sp->iores))
++ if (qla_get_fw_resources(sp->qpair, &sp->iores))
+ goto queuing_error;
+
+ if (req->cnt < (req_cnt + 2)) {
+@@ -1678,7 +1679,7 @@ qla24xx_start_scsi(srb_t *sp)
+ if (tot_dsds)
+ scsi_dma_unmap(cmd);
+
+- qla_put_iocbs(sp->qpair, &sp->iores);
++ qla_put_fw_resources(sp->qpair, &sp->iores);
+ spin_unlock_irqrestore(&ha->hardware_lock, flags);
+
+ return QLA_FUNCTION_FAILED;
+@@ -1793,9 +1794,10 @@ qla24xx_dif_start_scsi(srb_t *sp)
+ tot_prot_dsds = nseg;
+ tot_dsds += nseg;
+
+- sp->iores.res_type = RESOURCE_INI;
++ sp->iores.res_type = RESOURCE_IOCB | RESOURCE_EXCH;
++ sp->iores.exch_cnt = 1;
+ sp->iores.iocb_cnt = qla24xx_calc_iocbs(vha, tot_dsds);
+- if (qla_get_iocbs(sp->qpair, &sp->iores))
++ if (qla_get_fw_resources(sp->qpair, &sp->iores))
+ goto queuing_error;
+
+ if (req->cnt < (req_cnt + 2)) {
+@@ -1883,7 +1885,7 @@ qla24xx_dif_start_scsi(srb_t *sp)
+ }
+ /* Cleanup will be performed by the caller (queuecommand) */
+
+- qla_put_iocbs(sp->qpair, &sp->iores);
++ qla_put_fw_resources(sp->qpair, &sp->iores);
+ spin_unlock_irqrestore(&ha->hardware_lock, flags);
+
+ return QLA_FUNCTION_FAILED;
+@@ -1952,9 +1954,10 @@ qla2xxx_start_scsi_mq(srb_t *sp)
+ tot_dsds = nseg;
+ req_cnt = qla24xx_calc_iocbs(vha, tot_dsds);
+
+- sp->iores.res_type = RESOURCE_INI;
++ sp->iores.res_type = RESOURCE_IOCB | RESOURCE_EXCH;
++ sp->iores.exch_cnt = 1;
+ sp->iores.iocb_cnt = req_cnt;
+- if (qla_get_iocbs(sp->qpair, &sp->iores))
++ if (qla_get_fw_resources(sp->qpair, &sp->iores))
+ goto queuing_error;
+
+ if (req->cnt < (req_cnt + 2)) {
+@@ -2041,7 +2044,7 @@ qla2xxx_start_scsi_mq(srb_t *sp)
+ if (tot_dsds)
+ scsi_dma_unmap(cmd);
+
+- qla_put_iocbs(sp->qpair, &sp->iores);
++ qla_put_fw_resources(sp->qpair, &sp->iores);
+ spin_unlock_irqrestore(&qpair->qp_lock, flags);
+
+ return QLA_FUNCTION_FAILED;
+@@ -2171,9 +2174,10 @@ qla2xxx_dif_start_scsi_mq(srb_t *sp)
+ tot_prot_dsds = nseg;
+ tot_dsds += nseg;
+
+- sp->iores.res_type = RESOURCE_INI;
++ sp->iores.res_type = RESOURCE_IOCB | RESOURCE_EXCH;
++ sp->iores.exch_cnt = 1;
+ sp->iores.iocb_cnt = qla24xx_calc_iocbs(vha, tot_dsds);
+- if (qla_get_iocbs(sp->qpair, &sp->iores))
++ if (qla_get_fw_resources(sp->qpair, &sp->iores))
+ goto queuing_error;
+
+ if (req->cnt < (req_cnt + 2)) {
+@@ -2260,7 +2264,7 @@ qla2xxx_dif_start_scsi_mq(srb_t *sp)
+ }
+ /* Cleanup will be performed by the caller (queuecommand) */
+
+- qla_put_iocbs(sp->qpair, &sp->iores);
++ qla_put_fw_resources(sp->qpair, &sp->iores);
+ spin_unlock_irqrestore(&qpair->qp_lock, flags);
+
+ return QLA_FUNCTION_FAILED;
+diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
+index e19fde304e5c6..42d3d2de3d31f 100644
+--- a/drivers/scsi/qla2xxx/qla_isr.c
++++ b/drivers/scsi/qla2xxx/qla_isr.c
+@@ -3197,7 +3197,7 @@ qla2x00_status_entry(scsi_qla_host_t *vha, struct rsp_que *rsp, void *pkt)
+ }
+ return;
+ }
+- qla_put_iocbs(sp->qpair, &sp->iores);
++ qla_put_fw_resources(sp->qpair, &sp->iores);
+
+ if (sp->cmd_type != TYPE_SRB) {
+ req->outstanding_cmds[handle] = NULL;
+@@ -3618,7 +3618,6 @@ qla2x00_error_entry(scsi_qla_host_t *vha, struct rsp_que *rsp, sts_entry_t *pkt)
+ default:
+ sp = qla2x00_get_sp_from_handle(vha, func, req, pkt);
+ if (sp) {
+- qla_put_iocbs(sp->qpair, &sp->iores);
+ sp->done(sp, res);
+ return 0;
+ }
+diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c
+index 02fdeb0d31ec4..582d88dd59abe 100644
+--- a/drivers/scsi/qla2xxx/qla_nvme.c
++++ b/drivers/scsi/qla2xxx/qla_nvme.c
+@@ -445,13 +445,24 @@ static inline int qla2x00_start_nvme_mq(srb_t *sp)
+ goto queuing_error;
+ }
+ req_cnt = qla24xx_calc_iocbs(vha, tot_dsds);
++
++ sp->iores.res_type = RESOURCE_IOCB | RESOURCE_EXCH;
++ sp->iores.exch_cnt = 1;
++ sp->iores.iocb_cnt = req_cnt;
++ if (qla_get_fw_resources(sp->qpair, &sp->iores)) {
++ rval = -EBUSY;
++ goto queuing_error;
++ }
++
+ if (req->cnt < (req_cnt + 2)) {
+ if (IS_SHADOW_REG_CAPABLE(ha)) {
+ cnt = *req->out_ptr;
+ } else {
+ cnt = rd_reg_dword_relaxed(req->req_q_out);
+- if (qla2x00_check_reg16_for_disconnect(vha, cnt))
++ if (qla2x00_check_reg16_for_disconnect(vha, cnt)) {
++ rval = -EBUSY;
+ goto queuing_error;
++ }
+ }
+
+ if (req->ring_index < cnt)
+@@ -600,6 +611,8 @@ static inline int qla2x00_start_nvme_mq(srb_t *sp)
+ qla24xx_process_response_queue(vha, rsp);
+
+ queuing_error:
++ if (rval)
++ qla_put_fw_resources(sp->qpair, &sp->iores);
+ spin_unlock_irqrestore(&qpair->qp_lock, flags);
+
+ return rval;
+--
+2.39.2
+
--- /dev/null
+From 4578e681dacfb5489c9f3fee9e5a30798e5e33d9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Feb 2023 15:10:09 +0100
+Subject: scsi: snic: Fix memory leak with using debugfs_lookup()
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+[ Upstream commit ad0e4e2fab928477f74d742e6e77d79245d3d3e7 ]
+
+When calling debugfs_lookup() the result must have dput() called on it,
+otherwise the memory will leak over time. To make things simpler, just
+call debugfs_lookup_and_remove() instead which handles all of the logic at
+once.
+
+Link: https://lore.kernel.org/r/20230202141009.2290380-1-gregkh@linuxfoundation.org
+Cc: Karan Tilak Kumar <kartilak@cisco.com>
+Cc: Sesidhar Baddela <sebaddel@cisco.com>
+Cc: "James E.J. Bottomley" <jejb@linux.ibm.com>
+Cc: "Martin K. Petersen" <martin.petersen@oracle.com>
+Cc: linux-scsi@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/snic/snic_debugfs.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/snic/snic_debugfs.c b/drivers/scsi/snic/snic_debugfs.c
+index 57bdc3ba49d9c..9dd975b36b5bd 100644
+--- a/drivers/scsi/snic/snic_debugfs.c
++++ b/drivers/scsi/snic/snic_debugfs.c
+@@ -437,6 +437,6 @@ void snic_trc_debugfs_init(void)
+ void
+ snic_trc_debugfs_term(void)
+ {
+- debugfs_remove(debugfs_lookup(TRC_FILE, snic_glob->trc_root));
+- debugfs_remove(debugfs_lookup(TRC_ENABLE_FILE, snic_glob->trc_root));
++ debugfs_lookup_and_remove(TRC_FILE, snic_glob->trc_root);
++ debugfs_lookup_and_remove(TRC_ENABLE_FILE, snic_glob->trc_root);
+ }
+--
+2.39.2
+
--- /dev/null
+From 9957986f1f8cd08066f06e0575a8e8ee467a5e75 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Dec 2022 11:25:33 +0800
+Subject: scsi: ufs: core: Fix device management cmd timeout flow
+
+From: Mason Zhang <Mason.Zhang@mediatek.com>
+
+[ Upstream commit 36822124f9de200cedc2f42516301b50d386a6cd ]
+
+In the UFS error handling flow, the host will send a device management cmd
+(NOP OUT) to the device for link recovery. If this cmd times out and
+clearing the doorbell fails, ufshcd_wait_for_dev_cmd() will do nothing and
+return. hba->dev_cmd.complete struct is not set to NULL.
+
+When this happens, if cmd has been completed by device, then we will call
+complete() in __ufshcd_transfer_req_compl(). Because the complete struct is
+allocated on the stack, the following crash will occur:
+
+ ipanic_die+0x24/0x38 [mrdump]
+ die+0x344/0x748
+ arm64_notify_die+0x44/0x104
+ do_debug_exception+0x104/0x1e0
+ el1_dbg+0x38/0x54
+ el1_sync_handler+0x40/0x88
+ el1_sync+0x8c/0x140
+ queued_spin_lock_slowpath+0x2e4/0x3c0
+ __ufshcd_transfer_req_compl+0x3b0/0x1164
+ ufshcd_trc_handler+0x15c/0x308
+ ufshcd_host_reset_and_restore+0x54/0x260
+ ufshcd_reset_and_restore+0x28c/0x57c
+ ufshcd_err_handler+0xeb8/0x1b6c
+ process_one_work+0x288/0x964
+ worker_thread+0x4bc/0xc7c
+ kthread+0x15c/0x264
+ ret_from_fork+0x10/0x30
+
+Link: https://lore.kernel.org/r/20221216032532.1280-1-mason.zhang@mediatek.com
+Signed-off-by: Mason Zhang <Mason.Zhang@mediatek.com>
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ufs/core/ufshcd.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c
+index fd6f421ff4a46..2ddc1aba0ad75 100644
+--- a/drivers/ufs/core/ufshcd.c
++++ b/drivers/ufs/core/ufshcd.c
+@@ -3008,6 +3008,22 @@ static int ufshcd_wait_for_dev_cmd(struct ufs_hba *hba,
+ } else {
+ dev_err(hba->dev, "%s: failed to clear tag %d\n",
+ __func__, lrbp->task_tag);
++
++ spin_lock_irqsave(&hba->outstanding_lock, flags);
++ pending = test_bit(lrbp->task_tag,
++ &hba->outstanding_reqs);
++ if (pending)
++ hba->dev_cmd.complete = NULL;
++ spin_unlock_irqrestore(&hba->outstanding_lock, flags);
++
++ if (!pending) {
++ /*
++ * The completion handler ran while we tried to
++ * clear the command.
++ */
++ time_left = 1;
++ goto retry;
++ }
+ }
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 45f3d506dbdf3329bc0a1ba1ea701beb0ca4aa5a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Jan 2023 15:42:13 -0800
+Subject: scsi: ufs: exynos: Fix DMA alignment for PAGE_SIZE != 4096
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+[ Upstream commit 86bd0c4a2a5dc4265884648cb92c681646509692 ]
+
+The Exynos UFS controller only supports scatter/gather list elements that
+are aligned on a 4 KiB boundary. Fix DMA alignment in case PAGE_SIZE !=
+4096. Rename UFSHCD_QUIRK_ALIGN_SG_WITH_PAGE_SIZE into
+UFSHCD_QUIRK_4KB_DMA_ALIGNMENT.
+
+Cc: Kiwoong Kim <kwmad.kim@samsung.com>
+Fixes: 2b2bfc8aa519 ("scsi: ufs: Introduce a quirk to allow only page-aligned sg entries")
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Reviewed-by: Alim Akhtar <alim.akhtar@samsung.com>
+Tested-by: Alim Akhtar <alim.akhtar@samsung.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ufs/core/ufshcd.c | 4 ++--
+ drivers/ufs/host/ufs-exynos.c | 2 +-
+ include/ufs/ufshcd.h | 4 ++--
+ 3 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c
+index 3a1c4d31e010d..fd6f421ff4a46 100644
+--- a/drivers/ufs/core/ufshcd.c
++++ b/drivers/ufs/core/ufshcd.c
+@@ -5030,8 +5030,8 @@ static int ufshcd_slave_configure(struct scsi_device *sdev)
+ ufshcd_hpb_configure(hba, sdev);
+
+ blk_queue_update_dma_pad(q, PRDT_DATA_BYTE_COUNT_PAD - 1);
+- if (hba->quirks & UFSHCD_QUIRK_ALIGN_SG_WITH_PAGE_SIZE)
+- blk_queue_update_dma_alignment(q, PAGE_SIZE - 1);
++ if (hba->quirks & UFSHCD_QUIRK_4KB_DMA_ALIGNMENT)
++ blk_queue_update_dma_alignment(q, 4096 - 1);
+ /*
+ * Block runtime-pm until all consumers are added.
+ * Refer ufshcd_setup_links().
+diff --git a/drivers/ufs/host/ufs-exynos.c b/drivers/ufs/host/ufs-exynos.c
+index c3628a8645a56..3cdac89a28b81 100644
+--- a/drivers/ufs/host/ufs-exynos.c
++++ b/drivers/ufs/host/ufs-exynos.c
+@@ -1673,7 +1673,7 @@ static const struct exynos_ufs_drv_data exynos_ufs_drvs = {
+ UFSHCD_QUIRK_BROKEN_OCS_FATAL_ERROR |
+ UFSHCI_QUIRK_SKIP_MANUAL_WB_FLUSH_CTRL |
+ UFSHCD_QUIRK_SKIP_DEF_UNIPRO_TIMEOUT_SETTING |
+- UFSHCD_QUIRK_ALIGN_SG_WITH_PAGE_SIZE,
++ UFSHCD_QUIRK_4KB_DMA_ALIGNMENT,
+ .opts = EXYNOS_UFS_OPT_HAS_APB_CLK_CTRL |
+ EXYNOS_UFS_OPT_BROKEN_AUTO_CLK_CTRL |
+ EXYNOS_UFS_OPT_BROKEN_RX_SEL_IDX |
+diff --git a/include/ufs/ufshcd.h b/include/ufs/ufshcd.h
+index 727084cd79be4..97a09a14c6349 100644
+--- a/include/ufs/ufshcd.h
++++ b/include/ufs/ufshcd.h
+@@ -566,9 +566,9 @@ enum ufshcd_quirks {
+ UFSHCD_QUIRK_SKIP_DEF_UNIPRO_TIMEOUT_SETTING = 1 << 13,
+
+ /*
+- * This quirk allows only sg entries aligned with page size.
++ * Align DMA SG entries on a 4 KiB boundary.
+ */
+- UFSHCD_QUIRK_ALIGN_SG_WITH_PAGE_SIZE = 1 << 14,
++ UFSHCD_QUIRK_4KB_DMA_ALIGNMENT = 1 << 14,
+
+ /*
+ * This quirk needs to be enabled if the host controller does not
+--
+2.39.2
+
--- /dev/null
+From f2ea449fd85c094f0f81cdca3d988360373f3fff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Feb 2023 14:23:36 +0100
+Subject: sefltests: netdevsim: wait for devlink instance after netns removal
+
+From: Jiri Pirko <jiri@nvidia.com>
+
+[ Upstream commit f922c7b1c1c45740d329bf248936fdb78c0cff6e ]
+
+When devlink instance is put into network namespace and that network
+namespace gets deleted, devlink instance is moved back into init_ns.
+This is done as a part of cleanup_net() routine. Since cleanup_net()
+is called asynchronously from workqueue, there is no guarantee that
+the devlink instance move is done after "ip netns del" returns.
+
+So fix this race by making sure that the devlink instance is present
+before any other operation.
+
+Reported-by: Amir Tzin <amirtz@nvidia.com>
+Fixes: b74c37fd35a2 ("selftests: netdevsim: add tests for devlink reload with resources")
+Signed-off-by: Jiri Pirko <jiri@nvidia.com>
+Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
+Link: https://lore.kernel.org/r/20230220132336.198597-1-jiri@resnulli.us
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../selftests/drivers/net/netdevsim/devlink.sh | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+diff --git a/tools/testing/selftests/drivers/net/netdevsim/devlink.sh b/tools/testing/selftests/drivers/net/netdevsim/devlink.sh
+index a08c02abde121..7f7d20f222070 100755
+--- a/tools/testing/selftests/drivers/net/netdevsim/devlink.sh
++++ b/tools/testing/selftests/drivers/net/netdevsim/devlink.sh
+@@ -17,6 +17,18 @@ SYSFS_NET_DIR=/sys/bus/netdevsim/devices/$DEV_NAME/net/
+ DEBUGFS_DIR=/sys/kernel/debug/netdevsim/$DEV_NAME/
+ DL_HANDLE=netdevsim/$DEV_NAME
+
++wait_for_devlink()
++{
++ "$@" | grep -q $DL_HANDLE
++}
++
++devlink_wait()
++{
++ local timeout=$1
++
++ busywait "$timeout" wait_for_devlink devlink dev
++}
++
+ fw_flash_test()
+ {
+ RET=0
+@@ -256,6 +268,9 @@ netns_reload_test()
+ ip netns del testns2
+ ip netns del testns1
+
++ # Wait until netns async cleanup is done.
++ devlink_wait 2000
++
+ log_test "netns reload test"
+ }
+
+@@ -348,6 +363,9 @@ resource_test()
+ ip netns del testns2
+ ip netns del testns1
+
++ # Wait until netns async cleanup is done.
++ devlink_wait 2000
++
+ log_test "resource test"
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 015d66d501e4a2ace5a443930384a42fb94e4a27 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Feb 2023 12:04:00 +0100
+Subject: selftest: fib_tests: Always cleanup before exit
+
+From: Roxana Nicolescu <roxana.nicolescu@canonical.com>
+
+[ Upstream commit b60417a9f2b890a8094477b2204d4f73c535725e ]
+
+Usage of `set -e` before executing a command causes immediate exit
+on failure, without cleanup up the resources allocated at setup.
+This can affect the next tests that use the same resources,
+leading to a chain of failures.
+
+A simple fix is to always call cleanup function when the script exists.
+This approach is already used by other existing tests.
+
+Fixes: 1056691b2680 ("selftests: fib_tests: Make test results more verbose")
+Signed-off-by: Roxana Nicolescu <roxana.nicolescu@canonical.com>
+Link: https://lore.kernel.org/r/20230220110400.26737-2-roxana.nicolescu@canonical.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/fib_tests.sh | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/tools/testing/selftests/net/fib_tests.sh b/tools/testing/selftests/net/fib_tests.sh
+index 5637b5dadabdb..70ea8798b1f60 100755
+--- a/tools/testing/selftests/net/fib_tests.sh
++++ b/tools/testing/selftests/net/fib_tests.sh
+@@ -2065,6 +2065,8 @@ EOF
+ ################################################################################
+ # main
+
++trap cleanup EXIT
++
+ while getopts :t:pPhv o
+ do
+ case $o in
+--
+2.39.2
+
--- /dev/null
+From bf90be07586d8abcbdf9c1f10f5eaf0ba6035bbf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Jan 2023 15:56:44 +0800
+Subject: selftests/bpf: Fix build errors if CONFIG_NF_CONNTRACK=m
+
+From: Tiezhu Yang <yangtiezhu@loongson.cn>
+
+[ Upstream commit 92afc5329a5b23d876b215b783d200352d5aaea6 ]
+
+If CONFIG_NF_CONNTRACK=m, there are no definitions of NF_NAT_MANIP_SRC
+and NF_NAT_MANIP_DST in vmlinux.h, build test_bpf_nf.c failed.
+
+$ make -C tools/testing/selftests/bpf/
+
+ CLNG-BPF [test_maps] test_bpf_nf.bpf.o
+progs/test_bpf_nf.c:160:42: error: use of undeclared identifier 'NF_NAT_MANIP_SRC'
+ bpf_ct_set_nat_info(ct, &saddr, sport, NF_NAT_MANIP_SRC);
+ ^
+progs/test_bpf_nf.c:163:42: error: use of undeclared identifier 'NF_NAT_MANIP_DST'
+ bpf_ct_set_nat_info(ct, &daddr, dport, NF_NAT_MANIP_DST);
+ ^
+2 errors generated.
+
+Copy the definitions in include/net/netfilter/nf_nat.h to test_bpf_nf.c,
+in order to avoid redefinitions if CONFIG_NF_CONNTRACK=y, rename them with
+___local suffix. This is similar with commit 1058b6a78db2 ("selftests/bpf:
+Do not fail build if CONFIG_NF_CONNTRACK=m/n").
+
+Fixes: b06b45e82b59 ("selftests/bpf: add tests for bpf_ct_set_nat_info kfunc")
+Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
+Acked-by: Jiri Olsa <jolsa@kernel.org>
+Tested-by: Jiri Olsa <jolsa@kernel.org>
+Acked-by: Yonghong Song <yhs@fb.com>
+Link: https://lore.kernel.org/r/1674028604-7113-1-git-send-email-yangtiezhu@loongson.cn
+Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/progs/test_bpf_nf.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/progs/test_bpf_nf.c b/tools/testing/selftests/bpf/progs/test_bpf_nf.c
+index 227e85e85ddaf..9fc603c9d673e 100644
+--- a/tools/testing/selftests/bpf/progs/test_bpf_nf.c
++++ b/tools/testing/selftests/bpf/progs/test_bpf_nf.c
+@@ -34,6 +34,11 @@ __be16 dport = 0;
+ int test_exist_lookup = -ENOENT;
+ u32 test_exist_lookup_mark = 0;
+
++enum nf_nat_manip_type___local {
++ NF_NAT_MANIP_SRC___local,
++ NF_NAT_MANIP_DST___local
++};
++
+ struct nf_conn;
+
+ struct bpf_ct_opts___local {
+@@ -58,7 +63,7 @@ int bpf_ct_change_timeout(struct nf_conn *, u32) __ksym;
+ int bpf_ct_set_status(struct nf_conn *, u32) __ksym;
+ int bpf_ct_change_status(struct nf_conn *, u32) __ksym;
+ int bpf_ct_set_nat_info(struct nf_conn *, union nf_inet_addr *,
+- int port, enum nf_nat_manip_type) __ksym;
++ int port, enum nf_nat_manip_type___local) __ksym;
+
+ static __always_inline void
+ nf_ct_test(struct nf_conn *(*lookup_fn)(void *, struct bpf_sock_tuple *, u32,
+@@ -157,10 +162,10 @@ nf_ct_test(struct nf_conn *(*lookup_fn)(void *, struct bpf_sock_tuple *, u32,
+
+ /* snat */
+ saddr.ip = bpf_get_prandom_u32();
+- bpf_ct_set_nat_info(ct, &saddr, sport, NF_NAT_MANIP_SRC);
++ bpf_ct_set_nat_info(ct, &saddr, sport, NF_NAT_MANIP_SRC___local);
+ /* dnat */
+ daddr.ip = bpf_get_prandom_u32();
+- bpf_ct_set_nat_info(ct, &daddr, dport, NF_NAT_MANIP_DST);
++ bpf_ct_set_nat_info(ct, &daddr, dport, NF_NAT_MANIP_DST___local);
+
+ ct_ins = bpf_ct_insert_entry(ct);
+ if (ct_ins) {
+--
+2.39.2
+
--- /dev/null
+From 6799dddfd40061961f7792545d666bd0e6efeaba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Feb 2023 15:50:51 -0800
+Subject: selftests/bpf: Fix map_kptr test.
+
+From: Alexei Starovoitov <ast@kernel.org>
+
+[ Upstream commit 62d101d5f422cde39b269f7eb4cbbe2f1e26f9d4 ]
+
+The compiler is optimizing out majority of unref_ptr read/writes, so the test
+wasn't testing much. For example, one could delete '__kptr' tag from
+'struct prog_test_ref_kfunc __kptr *unref_ptr;' and the test would still "pass".
+
+Convert it to volatile stores. Confirmed by comparing bpf asm before/after.
+
+Fixes: 2cbc469a6fc3 ("selftests/bpf: Add C tests for kptr")
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Acked-by: Stanislav Fomichev <sdf@google.com>
+Acked-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
+Link: https://lore.kernel.org/r/20230214235051.22938-1-alexei.starovoitov@gmail.com
+Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/progs/map_kptr.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/progs/map_kptr.c b/tools/testing/selftests/bpf/progs/map_kptr.c
+index eb82178034934..228ec45365a8d 100644
+--- a/tools/testing/selftests/bpf/progs/map_kptr.c
++++ b/tools/testing/selftests/bpf/progs/map_kptr.c
+@@ -62,21 +62,23 @@ extern struct prog_test_ref_kfunc *
+ bpf_kfunc_call_test_kptr_get(struct prog_test_ref_kfunc **p, int a, int b) __ksym;
+ extern void bpf_kfunc_call_test_release(struct prog_test_ref_kfunc *p) __ksym;
+
++#define WRITE_ONCE(x, val) ((*(volatile typeof(x) *) &(x)) = (val))
++
+ static void test_kptr_unref(struct map_value *v)
+ {
+ struct prog_test_ref_kfunc *p;
+
+ p = v->unref_ptr;
+ /* store untrusted_ptr_or_null_ */
+- v->unref_ptr = p;
++ WRITE_ONCE(v->unref_ptr, p);
+ if (!p)
+ return;
+ if (p->a + p->b > 100)
+ return;
+ /* store untrusted_ptr_ */
+- v->unref_ptr = p;
++ WRITE_ONCE(v->unref_ptr, p);
+ /* store NULL */
+- v->unref_ptr = NULL;
++ WRITE_ONCE(v->unref_ptr, NULL);
+ }
+
+ static void test_kptr_ref(struct map_value *v)
+@@ -85,7 +87,7 @@ static void test_kptr_ref(struct map_value *v)
+
+ p = v->ref_ptr;
+ /* store ptr_or_null_ */
+- v->unref_ptr = p;
++ WRITE_ONCE(v->unref_ptr, p);
+ if (!p)
+ return;
+ if (p->a + p->b > 100)
+@@ -99,7 +101,7 @@ static void test_kptr_ref(struct map_value *v)
+ return;
+ }
+ /* store ptr_ */
+- v->unref_ptr = p;
++ WRITE_ONCE(v->unref_ptr, p);
+ bpf_kfunc_call_test_release(p);
+
+ p = bpf_kfunc_call_test_acquire(&(unsigned long){0});
+--
+2.39.2
+
--- /dev/null
+From d49ddf6b4b3dceda3ceca9076fc0e85af0ec6cc5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Feb 2023 00:12:11 +0100
+Subject: selftests/bpf: Fix out-of-srctree build
+
+From: Ilya Leoshkevich <iii@linux.ibm.com>
+
+[ Upstream commit 0b0757244754ea1d0721195c824770f5576e119e ]
+
+Building BPF selftests out of srctree fails with:
+
+ make: *** No rule to make target '/linux-build//ima_setup.sh', needed by 'ima_setup.sh'. Stop.
+
+The culprit is the rule that defines convenient shorthands like
+"make test_progs", which builds $(OUTPUT)/test_progs. These shorthands
+make sense only for binaries that are built though; scripts that live
+in the source tree do not end up in $(OUTPUT).
+
+Therefore drop $(TEST_PROGS) and $(TEST_PROGS_EXTENDED) from the rule.
+
+The issue exists for a while, but it became a problem only after commit
+d68ae4982cb7 ("selftests/bpf: Install all required files to run selftests"),
+which added dependencies on these scripts.
+
+Fixes: 03dcb78460c2 ("selftests/bpf: Add simple per-test targets to Makefile")
+Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/20230208231211.283606-1-iii@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/Makefile | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/Makefile b/tools/testing/selftests/bpf/Makefile
+index 2323a2b98b815..43c559b7729b5 100644
+--- a/tools/testing/selftests/bpf/Makefile
++++ b/tools/testing/selftests/bpf/Makefile
+@@ -149,8 +149,6 @@ endif
+ # NOTE: Semicolon at the end is critical to override lib.mk's default static
+ # rule for binaries.
+ $(notdir $(TEST_GEN_PROGS) \
+- $(TEST_PROGS) \
+- $(TEST_PROGS_EXTENDED) \
+ $(TEST_GEN_PROGS_EXTENDED) \
+ $(TEST_CUSTOM_PROGS)): %: $(OUTPUT)/% ;
+
+--
+2.39.2
+
--- /dev/null
+From 0f104ecad99969486698b091e014b9c7ecab88f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Jan 2023 19:04:40 +0900
+Subject: selftests/bpf: Fix vmtest static compilation error
+
+From: Daniel T. Lee <danieltimlee@gmail.com>
+
+[ Upstream commit 2514a31241e1e9067d379e0fbdb60e4bc2bf4659 ]
+
+As stated in README.rst, in order to resolve errors with linker errors,
+'LDLIBS=-static' should be used. Most problems will be solved by this
+option, but in the case of urandom_read, this won't fix the problem. So
+the Makefile is currently implemented to strip the 'static' option when
+compiling the urandom_read. However, stripping this static option isn't
+configured properly on $(LDLIBS) correctly, which is now causing errors
+on static compilation.
+
+ # LDLIBS=-static ./vmtest.sh
+ ld.lld: error: attempted static link of dynamic object liburandom_read.so
+ clang: error: linker command failed with exit code 1 (use -v to see invocation)
+ make: *** [Makefile:190: /linux/tools/testing/selftests/bpf/urandom_read] Error 1
+ make: *** Waiting for unfinished jobs....
+
+This commit fixes this problem by configuring the strip with $(LDLIBS).
+
+Fixes: 68084a136420 ("selftests/bpf: Fix building bpf selftests statically")
+Signed-off-by: Daniel T. Lee <danieltimlee@gmail.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/20230125100440.21734-1-danieltimlee@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/Makefile | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/Makefile b/tools/testing/selftests/bpf/Makefile
+index c22c43bbee194..2323a2b98b815 100644
+--- a/tools/testing/selftests/bpf/Makefile
++++ b/tools/testing/selftests/bpf/Makefile
+@@ -181,14 +181,15 @@ endif
+ # do not fail. Static builds leave urandom_read relying on system-wide shared libraries.
+ $(OUTPUT)/liburandom_read.so: urandom_read_lib1.c urandom_read_lib2.c
+ $(call msg,LIB,,$@)
+- $(Q)$(CLANG) $(filter-out -static,$(CFLAGS) $(LDFLAGS)) $^ $(LDLIBS) \
++ $(Q)$(CLANG) $(filter-out -static,$(CFLAGS) $(LDFLAGS)) \
++ $^ $(filter-out -static,$(LDLIBS)) \
+ -fuse-ld=$(LLD) -Wl,-znoseparate-code -Wl,--build-id=sha1 \
+ -fPIC -shared -o $@
+
+ $(OUTPUT)/urandom_read: urandom_read.c urandom_read_aux.c $(OUTPUT)/liburandom_read.so
+ $(call msg,BINARY,,$@)
+ $(Q)$(CLANG) $(filter-out -static,$(CFLAGS) $(LDFLAGS)) $(filter %.c,$^) \
+- liburandom_read.so $(LDLIBS) \
++ liburandom_read.so $(filter-out -static,$(LDLIBS)) \
+ -fuse-ld=$(LLD) -Wl,-znoseparate-code -Wl,--build-id=sha1 \
+ -Wl,-rpath=. -o $@
+
+--
+2.39.2
+
--- /dev/null
+From 38d3484ee55dc7b3760caac86192f8df347a0236 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 28 Jan 2023 01:06:29 +0100
+Subject: selftests/bpf: Fix xdp_do_redirect on s390x
+
+From: Ilya Leoshkevich <iii@linux.ibm.com>
+
+[ Upstream commit 06c1865b0b0c7820ea53af2394dd7aff31100295 ]
+
+s390x cache line size is 256 bytes, so skb_shared_info must be aligned
+on a much larger boundary than for x86. This makes the maximum packet
+size smaller.
+
+Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
+Link: https://lore.kernel.org/r/20230128000650.1516334-11-iii@linux.ibm.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Stable-dep-of: 6c20822fada1 ("bpf, test_run: fix &xdp_frame misplacement for LIVE_FRAMES")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/prog_tests/xdp_do_redirect.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/tools/testing/selftests/bpf/prog_tests/xdp_do_redirect.c b/tools/testing/selftests/bpf/prog_tests/xdp_do_redirect.c
+index a50971c6cf4a5..ac70e871d62f8 100644
+--- a/tools/testing/selftests/bpf/prog_tests/xdp_do_redirect.c
++++ b/tools/testing/selftests/bpf/prog_tests/xdp_do_redirect.c
+@@ -65,7 +65,11 @@ static int attach_tc_prog(struct bpf_tc_hook *hook, int fd)
+ /* The maximum permissible size is: PAGE_SIZE - sizeof(struct xdp_page_head) -
+ * sizeof(struct skb_shared_info) - XDP_PACKET_HEADROOM = 3368 bytes
+ */
++#if defined(__s390x__)
++#define MAX_PKT_SIZE 3176
++#else
+ #define MAX_PKT_SIZE 3368
++#endif
+ static void test_max_pkt_size(int fd)
+ {
+ char data[MAX_PKT_SIZE + 1] = {};
+--
+2.39.2
+
--- /dev/null
+From 85cdb1e0c283e0c634e0d5da4e5ba89871cad61c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Feb 2023 00:53:35 +0100
+Subject: selftests/bpf: Initialize tc in xdp_synproxy
+
+From: Ilya Leoshkevich <iii@linux.ibm.com>
+
+[ Upstream commit 354bb4a0e0b6be8f55bacbe7f08c94b4741f5658 ]
+
+xdp_synproxy/xdp fails in CI with:
+
+ Error: bpf_tc_hook_create: File exists
+
+The XDP version of the test should not be calling bpf_tc_hook_create();
+the reason it's happening anyway is that if we don't specify --tc on the
+command line, tc variable remains uninitialized.
+
+Fixes: 784d5dc0efc2 ("selftests/bpf: Add selftests for raw syncookie helpers in TC mode")
+Reported-by: Alexei Starovoitov <ast@kernel.org>
+Reported-by: Joanne Koong <joannelkoong@gmail.com>
+Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
+Link: https://lore.kernel.org/r/20230202235335.3403781-1-iii@linux.ibm.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/xdp_synproxy.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/testing/selftests/bpf/xdp_synproxy.c b/tools/testing/selftests/bpf/xdp_synproxy.c
+index 410a1385a01dd..6dbe0b7451985 100644
+--- a/tools/testing/selftests/bpf/xdp_synproxy.c
++++ b/tools/testing/selftests/bpf/xdp_synproxy.c
+@@ -116,6 +116,7 @@ static void parse_options(int argc, char *argv[], unsigned int *ifindex, __u32 *
+ *tcpipopts = 0;
+ *ports = NULL;
+ *single = false;
++ *tc = false;
+
+ while (true) {
+ int opt;
+--
+2.39.2
+
--- /dev/null
+From ae4856791306b20082c52da09d1df0a6b135ec3a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Feb 2023 16:26:03 +0100
+Subject: selftests: find echo binary to use -ne options
+
+From: Guillaume Tucker <guillaume.tucker@collabora.com>
+
+[ Upstream commit 4ebe33398c40c1118b4d8546978036c0e0032d1b ]
+
+Find the actual echo binary using $(which echo) and use it for
+formatted output with -ne. On some systems, the default echo command
+doesn't handle the -e option and the output looks like this (arm64
+build):
+
+-ne Emit Tests for alsa
+
+-ne Emit Tests for amd-pstate
+
+-ne Emit Tests for arm64
+
+This is for example the case with the KernelCI Docker images
+e.g. kernelci/gcc-10:x86-kselftest-kernelci. With the actual echo
+binary (e.g. in /bin/echo), the output is formatted as expected (x86
+build this time):
+
+Emit Tests for alsa
+Emit Tests for amd-pstate
+Skipping non-existent dir: arm64
+
+Only the install target is using "echo -ne" so keep the $ECHO variable
+local to it.
+
+Reported-by: "kernelci.org bot" <bot@kernelci.org>
+Fixes: 3297a4df805d ("kselftests: Enable the echo command to print newlines in Makefile")
+Signed-off-by: Guillaume Tucker <guillaume.tucker@collabora.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/Makefile | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/tools/testing/selftests/Makefile b/tools/testing/selftests/Makefile
+index 41b649452560c..9619d0f3b2ffb 100644
+--- a/tools/testing/selftests/Makefile
++++ b/tools/testing/selftests/Makefile
+@@ -234,10 +234,11 @@ ifdef INSTALL_PATH
+ @# While building kselftest-list.text skip also non-existent TARGET dirs:
+ @# they could be the result of a build failure and should NOT be
+ @# included in the generated runlist.
++ ECHO=`which echo`; \
+ for TARGET in $(TARGETS); do \
+ BUILD_TARGET=$$BUILD/$$TARGET; \
+- [ ! -d $(INSTALL_PATH)/$$TARGET ] && echo "Skipping non-existent dir: $$TARGET" && continue; \
+- echo -ne "Emit Tests for $$TARGET\n"; \
++ [ ! -d $(INSTALL_PATH)/$$TARGET ] && $$ECHO "Skipping non-existent dir: $$TARGET" && continue; \
++ $$ECHO -ne "Emit Tests for $$TARGET\n"; \
+ $(MAKE) -s --no-print-directory OUTPUT=$$BUILD_TARGET COLLECTION=$$TARGET \
+ -C $$TARGET emit_tests >> $(TEST_LIST); \
+ done;
+--
+2.39.2
+
--- /dev/null
+From a999ac71cceebe46fdc7d340695680c186697356 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 22 Jan 2023 08:32:50 +0900
+Subject: selftests/ftrace: Fix bash specific "==" operator
+
+From: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+
+[ Upstream commit 1e6b485c922fbedf41d5a9f4e6449c5aeb923a32 ]
+
+Since commit a1d6cd88c897 ("selftests/ftrace: event_triggers: wait
+longer for test_event_enable") introduced bash specific "=="
+comparation operator, that test will fail when we run it on a
+posix-shell. `checkbashisms` warned it as below.
+
+possible bashism in ftrace/func_event_triggers.tc line 45 (should be 'b = a'):
+ if [ "$e" == $val ]; then
+
+This replaces it with "=".
+
+Fixes: a1d6cd88c897 ("selftests/ftrace: event_triggers: wait longer for test_event_enable")
+Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+Reviewed-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../selftests/ftrace/test.d/ftrace/func_event_triggers.tc | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/ftrace/test.d/ftrace/func_event_triggers.tc b/tools/testing/selftests/ftrace/test.d/ftrace/func_event_triggers.tc
+index 3eea2abf68f9e..2ad7d4b501cc1 100644
+--- a/tools/testing/selftests/ftrace/test.d/ftrace/func_event_triggers.tc
++++ b/tools/testing/selftests/ftrace/test.d/ftrace/func_event_triggers.tc
+@@ -42,7 +42,7 @@ test_event_enabled() {
+
+ while [ $check_times -ne 0 ]; do
+ e=`cat $EVENT_ENABLE`
+- if [ "$e" == $val ]; then
++ if [ "$e" = $val ]; then
+ return 0
+ fi
+ sleep $SLEEP_TIME
+--
+2.39.2
+
--- /dev/null
+From c5b58fec2404f8318acae6eaaf6530865a5e9745 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Feb 2023 08:49:16 +0900
+Subject: selftests/ftrace: Fix probepoint testcase to ignore __pfx_* symbols
+
+From: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+
+[ Upstream commit 96cd93af794cf3ef83ae1ad7291160029d7b525e ]
+
+Fix kprobe probepoint testcase to ignore __pfx_* prefix symbols. Those are
+introduced by commit b341b20d648b ("x86: Add prefix symbols for function
+padding") for identifying PADDING_BYTES of NOPs. Since kprobe events can
+not probe these prefix symbols, this testcase has to skip those symbols.
+
+Link: https://lore.kernel.org/all/167309835609.640500.9664678940260305746.stgit@devnote3/
+
+Fixes: b341b20d648b ("x86: Add prefix symbols for function padding")
+Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+Reviewed-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Acked-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/ftrace/test.d/kprobe/probepoint.tc | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/ftrace/test.d/kprobe/probepoint.tc b/tools/testing/selftests/ftrace/test.d/kprobe/probepoint.tc
+index 624269c8d5343..68425987a5dd9 100644
+--- a/tools/testing/selftests/ftrace/test.d/kprobe/probepoint.tc
++++ b/tools/testing/selftests/ftrace/test.d/kprobe/probepoint.tc
+@@ -21,7 +21,7 @@ set_offs() { # prev target next
+
+ # We have to decode symbol addresses to get correct offsets.
+ # If the offset is not an instruction boundary, it cause -EILSEQ.
+-set_offs `grep -A1 -B1 ${TARGET_FUNC} /proc/kallsyms | cut -f 1 -d " " | xargs`
++set_offs `grep -v __pfx_ /proc/kallsyms | grep -A1 -B1 ${TARGET_FUNC} | cut -f 1 -d " " | xargs`
+
+ UINT_TEST=no
+ # printf "%x" -1 returns (unsigned long)-1.
+--
+2.39.2
+
--- /dev/null
+From 7759fe5c73b31e2832eae8b76376a2e39080573e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Jan 2023 23:42:04 -0800
+Subject: selftests: iommu: Fix test_cmd_destroy_access() call in user_copy
+
+From: Nicolin Chen <nicolinc@nvidia.com>
+
+[ Upstream commit 9fabbdf338b701f2d763d9edbc3e82ce1e7fa1b4 ]
+
+The test_cmd_destroy_access() should end with a semicolon, so add one.
+There is a test_ioctl_destroy(ioas_id) following already, so drop one.
+
+Fixes: 57f0988706fe ("iommufd: Add a selftest")
+Link: https://lore.kernel.org/r/20230120074204.1368-1-nicolinc@nvidia.com
+Signed-off-by: Nicolin Chen <nicolinc@nvidia.com>
+Reviewed-by: Kevin Tian <kevin.tian@intel.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/iommu/iommufd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/iommu/iommufd.c b/tools/testing/selftests/iommu/iommufd.c
+index 8aa8a346cf221..fa08209268c42 100644
+--- a/tools/testing/selftests/iommu/iommufd.c
++++ b/tools/testing/selftests/iommu/iommufd.c
+@@ -1259,7 +1259,7 @@ TEST_F(iommufd_mock_domain, user_copy)
+
+ test_cmd_destroy_access_pages(
+ access_cmd.id, access_cmd.access_pages.out_access_pages_id);
+- test_cmd_destroy_access(access_cmd.id) test_ioctl_destroy(ioas_id);
++ test_cmd_destroy_access(access_cmd.id);
+
+ test_ioctl_destroy(ioas_id);
+ }
+--
+2.39.2
+
--- /dev/null
+From 61f39c2f8b1c6afb5362b772ba3fb5c9cb728beb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Feb 2023 13:43:40 +0100
+Subject: selftests/net: Interpret UDP_GRO cmsg data as an int value
+
+From: Jakub Sitnicki <jakub@cloudflare.com>
+
+[ Upstream commit 436864095a95fcc611c20c44a111985fa9848730 ]
+
+Data passed to user-space with a (SOL_UDP, UDP_GRO) cmsg carries an
+int (see udp_cmsg_recv), not a u16 value, as strace confirms:
+
+ recvmsg(8, {msg_name=...,
+ msg_iov=[{iov_base="\0\0..."..., iov_len=96000}],
+ msg_iovlen=1,
+ msg_control=[{cmsg_len=20, <-- sizeof(cmsghdr) + 4
+ cmsg_level=SOL_UDP,
+ cmsg_type=0x68}], <-- UDP_GRO
+ msg_controllen=24,
+ msg_flags=0}, 0) = 11200
+
+Interpreting the data as an u16 value won't work on big-endian platforms.
+Since it is too late to back out of this API decision [1], fix the test.
+
+[1]: https://lore.kernel.org/netdev/20230131174601.203127-1-jakub@cloudflare.com/
+
+Fixes: 3327a9c46352 ("selftests: add functionals test for UDP GRO")
+Suggested-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: Jakub Sitnicki <jakub@cloudflare.com>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/udpgso_bench_rx.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/tools/testing/selftests/net/udpgso_bench_rx.c b/tools/testing/selftests/net/udpgso_bench_rx.c
+index 4058c7451e70d..f35a924d4a303 100644
+--- a/tools/testing/selftests/net/udpgso_bench_rx.c
++++ b/tools/testing/selftests/net/udpgso_bench_rx.c
+@@ -214,11 +214,10 @@ static void do_verify_udp(const char *data, int len)
+
+ static int recv_msg(int fd, char *buf, int len, int *gso_size)
+ {
+- char control[CMSG_SPACE(sizeof(uint16_t))] = {0};
++ char control[CMSG_SPACE(sizeof(int))] = {0};
+ struct msghdr msg = {0};
+ struct iovec iov = {0};
+ struct cmsghdr *cmsg;
+- uint16_t *gsosizeptr;
+ int ret;
+
+ iov.iov_base = buf;
+@@ -237,8 +236,7 @@ static int recv_msg(int fd, char *buf, int len, int *gso_size)
+ cmsg = CMSG_NXTHDR(&msg, cmsg)) {
+ if (cmsg->cmsg_level == SOL_UDP
+ && cmsg->cmsg_type == UDP_GRO) {
+- gsosizeptr = (uint16_t *) CMSG_DATA(cmsg);
+- *gso_size = *gsosizeptr;
++ *gso_size = *(int *)CMSG_DATA(cmsg);
+ break;
+ }
+ }
+--
+2.39.2
+
--- /dev/null
+From 029bd98c88bbd59479ea1ff1c6f4fc2a72d561af Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Feb 2023 09:55:36 +0100
+Subject: selftests: use printf instead of echo -ne
+
+From: Guillaume Tucker <guillaume.tucker@collabora.com>
+
+[ Upstream commit 9e34fad00fc889abbb99d751a4c22cf2bded10df ]
+
+Rather than trying to guess which implementation of "echo" to run with
+support for "-ne" options, use "printf" instead of "echo -ne". It
+handles escape characters as a standard feature and it is widespread
+among modern shells.
+
+Reported-by: "kernelci.org bot" <bot@kernelci.org>
+Suggested-by: David Laight <David.Laight@ACULAB.COM>
+Fixes: 3297a4df805d ("kselftests: Enable the echo command to print newlines in Makefile")
+Fixes: 79c16b1120fe ("selftests: find echo binary to use -ne options")
+Signed-off-by: Guillaume Tucker <guillaume.tucker@collabora.com>
+Reviewed-by: Guenter Roeck <groeck@chromium.org>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/Makefile | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/tools/testing/selftests/Makefile b/tools/testing/selftests/Makefile
+index 9619d0f3b2ffb..06578963f4f1d 100644
+--- a/tools/testing/selftests/Makefile
++++ b/tools/testing/selftests/Makefile
+@@ -234,11 +234,10 @@ ifdef INSTALL_PATH
+ @# While building kselftest-list.text skip also non-existent TARGET dirs:
+ @# they could be the result of a build failure and should NOT be
+ @# included in the generated runlist.
+- ECHO=`which echo`; \
+ for TARGET in $(TARGETS); do \
+ BUILD_TARGET=$$BUILD/$$TARGET; \
+- [ ! -d $(INSTALL_PATH)/$$TARGET ] && $$ECHO "Skipping non-existent dir: $$TARGET" && continue; \
+- $$ECHO -ne "Emit Tests for $$TARGET\n"; \
++ [ ! -d $(INSTALL_PATH)/$$TARGET ] && printf "Skipping non-existent dir: $$TARGET\n" && continue; \
++ printf "Emit Tests for $$TARGET\n"; \
+ $(MAKE) -s --no-print-directory OUTPUT=$$BUILD_TARGET COLLECTION=$$TARGET \
+ -C $$TARGET emit_tests >> $(TEST_LIST); \
+ done;
+--
+2.39.2
+
--- /dev/null
+From 3bebf5993906d0006005acbedb1b5ced64e766d9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Jan 2023 10:35:15 +0100
+Subject: selftests/xsk: print correct error codes when exiting
+
+From: Magnus Karlsson <magnus.karlsson@intel.com>
+
+[ Upstream commit 085dcccfb7d3dc52ed708fc588587f319541bc83 ]
+
+Print the correct error codes when exiting the test suite due to some
+terminal error. Some of these had a switched sign and some of them
+printed zero instead of errno.
+
+Fixes: facb7cb2e909 ("selftests/bpf: Xsk selftests - SKB POLL, NOPOLL")
+Signed-off-by: Magnus Karlsson <magnus.karlsson@intel.com>
+Acked-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
+Link: https://lore.kernel.org/r/20230111093526.11682-5-magnus.karlsson@gmail.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/xskxceiver.c | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/xskxceiver.c b/tools/testing/selftests/bpf/xskxceiver.c
+index 2ff43b22180fa..1b9f48daa2257 100644
+--- a/tools/testing/selftests/bpf/xskxceiver.c
++++ b/tools/testing/selftests/bpf/xskxceiver.c
+@@ -350,7 +350,7 @@ static bool ifobj_zc_avail(struct ifobject *ifobject)
+ umem = calloc(1, sizeof(struct xsk_umem_info));
+ if (!umem) {
+ munmap(bufs, umem_sz);
+- exit_with_error(-ENOMEM);
++ exit_with_error(ENOMEM);
+ }
+ umem->frame_size = XSK_UMEM__DEFAULT_FRAME_SIZE;
+ ret = xsk_configure_umem(umem, bufs, umem_sz);
+@@ -936,7 +936,7 @@ static int receive_pkts(struct test_spec *test, struct pollfd *fds)
+ if (ifobj->use_poll) {
+ ret = poll(fds, 1, POLL_TMOUT);
+ if (ret < 0)
+- exit_with_error(-ret);
++ exit_with_error(errno);
+
+ if (!ret) {
+ if (!is_umem_valid(test->ifobj_tx))
+@@ -963,7 +963,7 @@ static int receive_pkts(struct test_spec *test, struct pollfd *fds)
+ if (xsk_ring_prod__needs_wakeup(&umem->fq)) {
+ ret = poll(fds, 1, POLL_TMOUT);
+ if (ret < 0)
+- exit_with_error(-ret);
++ exit_with_error(errno);
+ }
+ ret = xsk_ring_prod__reserve(&umem->fq, rcvd, &idx_fq);
+ }
+@@ -1015,7 +1015,7 @@ static int __send_pkts(struct ifobject *ifobject, u32 *pkt_nb, struct pollfd *fd
+ if (timeout) {
+ if (ret < 0) {
+ ksft_print_msg("ERROR: [%s] Poll error %d\n",
+- __func__, ret);
++ __func__, errno);
+ return TEST_FAILURE;
+ }
+ if (ret == 0)
+@@ -1024,7 +1024,7 @@ static int __send_pkts(struct ifobject *ifobject, u32 *pkt_nb, struct pollfd *fd
+ }
+ if (ret <= 0) {
+ ksft_print_msg("ERROR: [%s] Poll error %d\n",
+- __func__, ret);
++ __func__, errno);
+ return TEST_FAILURE;
+ }
+ }
+@@ -1323,18 +1323,18 @@ static void thread_common_ops(struct test_spec *test, struct ifobject *ifobject)
+ if (ifobject->xdp_flags & XDP_FLAGS_SKB_MODE) {
+ if (opts.attach_mode != XDP_ATTACHED_SKB) {
+ ksft_print_msg("ERROR: [%s] XDP prog not in SKB mode\n");
+- exit_with_error(-EINVAL);
++ exit_with_error(EINVAL);
+ }
+ } else if (ifobject->xdp_flags & XDP_FLAGS_DRV_MODE) {
+ if (opts.attach_mode != XDP_ATTACHED_DRV) {
+ ksft_print_msg("ERROR: [%s] XDP prog not in DRV mode\n");
+- exit_with_error(-EINVAL);
++ exit_with_error(EINVAL);
+ }
+ }
+
+ ret = xsk_socket__update_xskmap(ifobject->xsk->xsk, ifobject->xsk_map_fd);
+ if (ret)
+- exit_with_error(-ret);
++ exit_with_error(errno);
+ }
+
+ static void *worker_testapp_validate_tx(void *arg)
+@@ -1541,7 +1541,7 @@ static void swap_xsk_resources(struct ifobject *ifobj_tx, struct ifobject *ifobj
+
+ ret = xsk_socket__update_xskmap(ifobj_rx->xsk->xsk, ifobj_rx->xsk_map_fd);
+ if (ret)
+- exit_with_error(-ret);
++ exit_with_error(errno);
+ }
+
+ static void testapp_bpf_res(struct test_spec *test)
+--
+2.39.2
+
--- /dev/null
+From fd4d5f84629c0571e4fad1942528912601602d8b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Jan 2023 10:35:12 +0100
+Subject: selftests/xsk: print correct payload for packet dump
+
+From: Magnus Karlsson <magnus.karlsson@intel.com>
+
+[ Upstream commit 2d0b2ae2871ae6d42a9f0a4280e0fb5bff8d38b8 ]
+
+Print the correct payload when the packet dump option is selected. The
+network to host conversion was forgotten and the payload was
+erronously declared to be an int instead of an unsigned int.
+
+Fixes: facb7cb2e909 ("selftests/bpf: Xsk selftests - SKB POLL, NOPOLL")
+Signed-off-by: Magnus Karlsson <magnus.karlsson@intel.com>
+Acked-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
+Link: https://lore.kernel.org/r/20230111093526.11682-2-magnus.karlsson@gmail.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/xskxceiver.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/xskxceiver.c b/tools/testing/selftests/bpf/xskxceiver.c
+index 162d3a516f2ca..2ff43b22180fa 100644
+--- a/tools/testing/selftests/bpf/xskxceiver.c
++++ b/tools/testing/selftests/bpf/xskxceiver.c
+@@ -767,7 +767,7 @@ static void pkt_dump(void *pkt, u32 len)
+ struct ethhdr *ethhdr;
+ struct udphdr *udphdr;
+ struct iphdr *iphdr;
+- int payload, i;
++ u32 payload, i;
+
+ ethhdr = pkt;
+ iphdr = pkt + sizeof(*ethhdr);
+@@ -792,7 +792,7 @@ static void pkt_dump(void *pkt, u32 len)
+ fprintf(stdout, "DEBUG>> L4: udp_hdr->src: %d\n", ntohs(udphdr->source));
+ fprintf(stdout, "DEBUG>> L4: udp_hdr->dst: %d\n", ntohs(udphdr->dest));
+ /*extract L5 frame */
+- payload = *((uint32_t *)(pkt + PKT_HDR_SIZE));
++ payload = ntohl(*((u32 *)(pkt + PKT_HDR_SIZE)));
+
+ fprintf(stdout, "DEBUG>> L5: payload: %d\n", payload);
+ fprintf(stdout, "---------------------------------------\n");
+--
+2.39.2
+
--- /dev/null
+From ef7f83c231e2a24e0dd5331b628c8c728317fc2f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Feb 2023 10:24:20 -0600
+Subject: serial: fsl_lpuart: fix RS485 RTS polariy inverse issue
+
+From: Shenwei Wang <shenwei.wang@nxp.com>
+
+[ Upstream commit 3957b9501a5a8fa709ae4a47483714491471f6db ]
+
+The previous 'commit 846651eca073 ("serial: fsl_lpuart: RS485 RTS
+polariy is inverse")' only fixed the inverse issue on lpuart 8bit
+platforms.
+
+This is a follow-up patch to fix the RS485 polarity inverse
+issue on lpuart 32bit platforms.
+
+Fixes: 03895cf41d18 ("tty: serial: fsl_lpuart: Add support for RS-485")
+Reported-by: Sherry Sun <sherry.sun@nxp.com>
+Signed-off-by: Shenwei Wang <shenwei.wang@nxp.com>
+Link: https://lore.kernel.org/r/20230207162420.3647904-1-shenwei.wang@nxp.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/fsl_lpuart.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
+index f34fabdc2bb7d..23910ac724b11 100644
+--- a/drivers/tty/serial/fsl_lpuart.c
++++ b/drivers/tty/serial/fsl_lpuart.c
+@@ -1387,9 +1387,9 @@ static int lpuart32_config_rs485(struct uart_port *port, struct ktermios *termio
+ * Note: UART is assumed to be active high.
+ */
+ if (rs485->flags & SER_RS485_RTS_ON_SEND)
+- modem &= ~UARTMODEM_TXRTSPOL;
+- else if (rs485->flags & SER_RS485_RTS_AFTER_SEND)
+ modem |= UARTMODEM_TXRTSPOL;
++ else if (rs485->flags & SER_RS485_RTS_AFTER_SEND)
++ modem &= ~UARTMODEM_TXRTSPOL;
+ }
+
+ lpuart32_write(&sport->port, modem, UARTMODIR);
+--
+2.39.2
+
--- /dev/null
+From b6a512461d039f812f10644a94789d6b06a1892e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 26 Nov 2022 10:08:52 +0800
+Subject: serial: tegra: Add missing clk_disable_unprepare() in
+ tegra_uart_hw_init()
+
+From: Yi Yang <yiyang13@huawei.com>
+
+[ Upstream commit 38f28cfe9d08e3a47ef008798b275fef8118fc20 ]
+
+Add the missing clk_disable_unprepare() before return from
+tegra_uart_hw_init() in the error handling path.
+When request_irq() fails in tegra_uart_startup(), 'tup->uart_clk'
+has been enabled, fix it by adding clk_disable_unprepare().
+
+Fixes: cc9ca4d95846 ("serial: tegra: Only print FIFO error message when an error occurs")
+Fixes: d781ec21bae6 ("serial: tegra: report clk rate errors")
+Signed-off-by: Yi Yang <yiyang13@huawei.com>
+Link: https://lore.kernel.org/r/20221126020852.113378-1-yiyang13@huawei.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/serial-tegra.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/tty/serial/serial-tegra.c b/drivers/tty/serial/serial-tegra.c
+index e5b9773db5e36..1cf08b33456c9 100644
+--- a/drivers/tty/serial/serial-tegra.c
++++ b/drivers/tty/serial/serial-tegra.c
+@@ -1046,6 +1046,7 @@ static int tegra_uart_hw_init(struct tegra_uart_port *tup)
+ if (tup->cdata->fifo_mode_enable_status) {
+ ret = tegra_uart_wait_fifo_mode_enabled(tup);
+ if (ret < 0) {
++ clk_disable_unprepare(tup->uart_clk);
+ dev_err(tup->uport.dev,
+ "Failed to enable FIFO mode: %d\n", ret);
+ return ret;
+@@ -1067,6 +1068,7 @@ static int tegra_uart_hw_init(struct tegra_uart_port *tup)
+ */
+ ret = tegra_set_baudrate(tup, TEGRA_UART_DEFAULT_BAUD);
+ if (ret < 0) {
++ clk_disable_unprepare(tup->uart_clk);
+ dev_err(tup->uport.dev, "Failed to set baud rate\n");
+ return ret;
+ }
+@@ -1226,10 +1228,13 @@ static int tegra_uart_startup(struct uart_port *u)
+ dev_name(u->dev), tup);
+ if (ret < 0) {
+ dev_err(u->dev, "Failed to register ISR for IRQ %d\n", u->irq);
+- goto fail_hw_init;
++ goto fail_request_irq;
+ }
+ return 0;
+
++fail_request_irq:
++ /* tup->uart_clk is already enabled in tegra_uart_hw_init */
++ clk_disable_unprepare(tup->uart_clk);
+ fail_hw_init:
+ if (!tup->use_rx_pio)
+ tegra_uart_dma_channel_free(tup, true);
+--
+2.39.2
+
iommu-attach-device-group-to-old-domain-in-error-path.patch
powerpc-mm-rearrange-if-else-block-to-avoid-clang-warning.patch
ata-ahci-revert-ata-ahci-add-tiger-lake-up-3-4-ahci-controller.patch
+arm-omap2-fix-memory-leak-in-realtime_counter_init.patch
+arm64-dts-qcom-qcs404-use-symbol-names-for-pcie-rese.patch
+arm64-dts-qcom-msm8996-tone-fix-usb-taking-6-minutes.patch
+arm64-dts-qcom-sm6115-fix-ufs-node.patch
+arm64-dts-qcom-sm6115-provide-xo-clk-to-rpmcc.patch
+arm64-dts-qcom-sm8150-kumano-panel-framebuffer-is-2..patch
+arm64-dts-qcom-pmi8950-correct-rev_1250v-channel-lab.patch
+arm64-dts-qcom-sm6350-fix-up-the-ramoops-node.patch
+arm64-dts-qcom-sdm670-google-sargo-keep-pm660-ldo8-o.patch
+arm64-dts-qcom-re-enable-resin-on-msm8998-and-sdm845.patch
+arm64-dts-qcom-sm8350-sagami-configure-slg51000-pmic.patch
+arm64-dts-qcom-sm8350-sagami-add-gpio-line-names-for.patch
+arm64-dts-qcom-sm8350-sagami-rectify-gpio-keys.patch
+arm64-dts-qcom-sm6350-lena-flatten-gpio-keys-pinctrl.patch
+arm64-dts-qcom-sm6125-reorder-hsusb-phy-clocks-to-ma.patch
+arm64-dts-qcom-sm6125-seine-clean-up-gpio-keys-volum.patch
+arm64-dts-imx8m-align-soc-unique-id-node-unit-addres.patch
+arm-zynq-fix-refcount-leak-in-zynq_early_slcr_init.patch
+fs-dlm-fix-return-value-check-in-dlm_memory_init.patch
+arm64-dts-mediatek-mt8195-add-power-domain-to-u3phy1.patch
+arm64-dts-mediatek-mt8183-fix-systimer-13-mhz-clock-.patch
+arm64-dts-mediatek-mt8192-fix-systimer-13-mhz-clock-.patch
+arm64-dts-mediatek-mt8195-fix-systimer-13-mhz-clock-.patch
+arm64-dts-mediatek-mt8186-fix-systimer-13-mhz-clock-.patch
+arm64-dts-qcom-sdm845-db845c-fix-audio-codec-interru.patch
+arm64-dts-qcom-sdm845-xiaomi-beryllium-fix-audio-cod.patch
+x86-acpi-boot-do-not-register-processors-that-cannot.patch
+arm64-dts-qcom-sc7180-correct-spmi-bus-address-cells.patch
+arm64-dts-qcom-sc7280-correct-spmi-bus-address-cells.patch
+arm64-dts-qcom-sc8280xp-correct-spmi-bus-address-cel.patch
+arm64-dts-qcom-sm8450-correct-soundwire-wakeup-inter.patch
+arm64-dts-qcom-sdm845-make-dp-node-follow-the-schema.patch
+arm64-dts-qcom-msm8996-oneplus-common-drop-vdda-supp.patch
+arm64-dts-qcom-sc8280xp-vote-for-cx-in-usb-controlle.patch
+arm64-dts-meson-gxl-jethub-j80-fix-wifi-mac-address-.patch
+arm64-dts-meson-gxl-jethub-j80-fix-bluetooth-mac-nod.patch
+arm64-dts-meson-axg-jethub-j1xx-fix-mac-address-node.patch
+arm64-dts-meson-gx-fix-ethernet-mac-address-unit-nam.patch
+arm64-dts-meson-g12a-fix-internal-ethernet-phy-unit-.patch
+arm64-dts-meson-gx-fix-the-scpi-dvfs-node-name-and-u.patch
+cpuidle-intel_idle-fix-cpuidle_flag_irq_enable-again.patch
+arm64-dts-ti-k3-am62-main-fix-clocks-for-mcspi.patch
+arm64-tegra-fix-duplicate-regulator-on-jetson-tx1.patch
+arm64-dts-qcom-msm8992-bullhead-fix-cont_splash_mem-.patch
+arm64-dts-qcom-msm8992-bullhead-disable-dfps_data_me.patch
+arm64-dts-qcom-msm8956-use-soc-specific-compat-for-t.patch
+arm64-dts-qcom-ipq8074-correct-usb3-qmp-phy-s-clock-.patch
+arm64-dts-qcom-ipq8074-fix-gen2-pcie-qmp-phy.patch
+arm64-dts-qcom-ipq8074-fix-gen3-pcie-qmp-phy.patch
+arm64-dts-qcom-ipq8074-correct-gen2-pcie-ranges.patch
+arm64-dts-qcom-ipq8074-fix-gen3-pcie-node.patch
+arm64-dts-qcom-ipq8074-correct-pcie-qmp-phy-output-c.patch
+arm64-dts-meson-remove-cpu-opps-below-1ghz-for-g12a-.patch
+arm-omap1-call-platform_device_put-in-error-case-in-.patch
+arm64-dts-mediatek-mt8192-mark-scp_adsp-clock-as-bro.patch
+arm-bcm2835_defconfig-enable-the-framebuffer.patch
+arm-s3c-fix-s3c64xx_set_timer_source-prototype.patch
+arm64-dts-ti-k3-j7200-fix-wakeup-pinmux-range.patch
+arm-dts-exynos-correct-wr-active-property-in-exynos3.patch
+arm-imx-call-ida_simple_remove-for-ida_simple_get.patch
+arm64-dts-amlogic-meson-gx-fix-scpi-clock-dvfs-node-.patch
+arm64-dts-amlogic-meson-axg-fix-scpi-clock-dvfs-node.patch
+arm64-dts-amlogic-meson-gx-add-missing-scpi-sensors-.patch
+arm64-dts-amlogic-meson-axg-jethome-jethub-j1xx-fix-.patch
+arm64-dts-amlogic-meson-gxl-s905d-sml5442tw-drop-inv.patch
+arm64-dts-amlogic-meson-gx-add-missing-unit-address-.patch
+arm64-dts-amlogic-meson-gxl-s905w-jethome-jethub-j80.patch
+arm64-dts-amlogic-meson-axg-jethome-jethub-j1xx-fix-.patch-31615
+arm64-dts-amlogic-meson-gxl-add-missing-unit-address.patch
+arm64-dts-amlogic-meson-gx-libretech-pc-fix-update-b.patch
+arm64-dts-amlogic-meson-sm1-bananapi-m5-fix-adc-keys.patch
+arm64-dts-amlogic-meson-gxl-s905d-phicomm-n1-fix-led.patch
+arm64-dts-amlogic-meson-gxbb-kii-pro-fix-led-node-na.patch
+arm64-dts-amlogic-meson-g12b-odroid-go-ultra-fix-rk8.patch
+arm64-dts-amlogic-meson-sm1-odroid-hc4-fix-active-fa.patch
+locking-rwsem-disable-preemption-in-all-down_read-an.patch
+arm64-tegra-bump-address-cells-and-size-cells.patch
+arm64-tegra-sort-nodes-by-unit-address-then-alphabet.patch
+arm64-tegra-mark-host1x-as-dma-coherent-on-tegra194-.patch
+arm64-dts-renesas-beacon-renesom-fix-gpio-expander-r.patch
+arm64-dts-meson-radxa-zero-allow-usb-otg-mode.patch
+arm64-dts-meson-bananapi-m5-switch-vddio_c-pin-to-op.patch
+arm-dts-sun8i-nanopi-duo2-fix-regulator-gpio-referen.patch
+ublk_drv-remove-nr_aborted_queues-from-ublk_device.patch
+ublk_drv-don-t-probe-partitions-if-the-ubq-daemon-is.patch
+arm-dts-imx7s-correct-iomuxc-gpr-mux-controller-cell.patch
+sbitmap-remove-redundant-check-in-__sbitmap_queue_ge.patch
+sbitmap-correct-wake_batch-recalculation-to-avoid-po.patch
+arm64-dts-mt8195-fix-cpu-map-for-single-cluster-soc.patch
+arm64-dts-mt8192-fix-cpu-map-for-single-cluster-soc.patch
+arm64-dts-mt8186-fix-cpu-map-for-single-cluster-soc.patch
+arm64-dts-mediatek-mt7622-add-missing-pwm-cells-to-p.patch
+arm64-dts-mediatek-mt8186-fix-watchdog-compatible.patch
+arm64-dts-mediatek-mt8195-fix-watchdog-compatible.patch
+arm64-dts-mediatek-mt7986-fix-watchdog-compatible.patch
+arm-dts-stm32-update-part-number-nvmem-description-o.patch
+arm64-dts-qcom-sm8450-nagara-correct-firmware-paths.patch
+blk-mq-avoid-sleep-in-blk_mq_alloc_request_hctx.patch
+blk-mq-remove-stale-comment-for-blk_mq_sched_mark_re.patch
+blk-mq-wait-on-correct-sbitmap_queue-in-blk_mq_mark_.patch
+blk-mq-fix-potential-io-hung-for-shared-sbitmap-per-.patch
+blk-mq-correct-stale-comment-of-.get_budget.patch
+arm64-dts-qcom-msm8996-support-using-gpll0-as-kryocc.patch
+arm64-dts-qcom-msm8996-switch-from-rpm_smd_bb_clk1-t.patch
+arm64-dts-qcom-sm8350-drop-incorrect-cells-from-seri.patch
+arm64-dts-qcom-sm8450-drop-incorrect-cells-from-seri.patch
+arm64-dts-qcom-msm8992-lg-bullhead-correct-memory-ov.patch
+arm64-dts-qcom-msm8953-correct-tlmm-gpio-ranges.patch
+arm64-dts-qcom-sm6115-correct-tlmm-gpio-ranges.patch
+arm64-dts-qcom-msm8992-lg-bullhead-enable-regulators.patch
+s390-dasd-fix-potential-memleak-in-dasd_eckd_init.patch
+io_uring-audit-don-t-log-ioring_op_madvise.patch
+sched-rt-pick_next_rt_entity-check-list_entry.patch
+perf-x86-intel-ds-fix-the-conversion-from-tsc-to-per.patch
+x86-perf-zhaoxin-add-stepping-check-for-zxc.patch
+keys-asymmetric-fix-ecdsa-use-via-keyctl-uapi.patch
+block-ublk-check-io-buffer-based-on-flag-need_get_da.patch
+arm64-dts-qcom-pmk8350-use-the-correct-pon-compatibl.patch
+erofs-relinquish-volume-with-mutex-held.patch
+block-sync-mixed-merged-request-s-failfast-with-1st-.patch
+block-fix-io-statistics-for-cgroup-in-throttle-path.patch
+block-bio-integrity-copy-flags-when-bio_integrity_pa.patch
+block-use-proper-return-value-from-bio_failfast.patch
+wifi-mt76-mt7915-add-missing-of_node_put.patch
+wifi-mt76-mt7921s-fix-slab-out-of-bounds-access-in-s.patch
+wifi-mt76-mt7915-fix-mt7915_rate_txpower_get-resourc.patch
+wifi-mt76-mt7996-fix-insecure-data-handling-of-mt799.patch
+wifi-mt76-mt7996-fix-insecure-data-handling-of-mt799.patch-454
+wifi-mt76-mt7996-fix-integer-handling-issue-of-mt799.patch
+wifi-mt76-mt7915-check-return-value-before-accessing.patch
+wifi-mt76-mt7996-check-return-value-before-accessing.patch
+wifi-mt76-mt7915-drop-always-true-condition-of-__mt7.patch
+wifi-mt76-mt7996-drop-always-true-condition-of-__mt7.patch
+wifi-mt76-mt7996-fix-endianness-warning-in-mt7996_mc.patch
+wifi-mt76-mt76x0-fix-oob-access-in-mt76x0_phy_get_ta.patch
+wifi-mt76-mt7996-fix-unintended-sign-extension-of-mt.patch
+wifi-mt76-mt7915-fix-unintended-sign-extension-of-mt.patch
+wifi-mt76-fix-coverity-uninit_use_in_call-in-mt76_co.patch
+wifi-mt76-mt7921-resource-leaks-at-mt7921_check_offl.patch
+wifi-rsi-fix-memory-leak-in-rsi_coex_attach.patch
+wifi-rtlwifi-rtl8821ae-don-t-call-kfree_skb-under-sp.patch
+wifi-rtlwifi-rtl8188ee-don-t-call-kfree_skb-under-sp.patch
+wifi-rtlwifi-rtl8723be-don-t-call-kfree_skb-under-sp.patch
+wifi-iwlegacy-common-don-t-call-dev_kfree_skb-under-.patch
+wifi-libertas-fix-memory-leak-in-lbs_init_adapter.patch
+wifi-rtl8xxxu-fix-assignment-to-bit-field-priv-pi_en.patch
+wifi-rtl8xxxu-fix-assignment-to-bit-field-priv-cck_a.patch
+wifi-rtl8xxxu-don-t-call-dev_kfree_skb-under-spin_lo.patch
+wifi-rtw89-8852c-rfk-correct-dack-setting.patch
+wifi-rtw89-8852c-rfk-correct-dpk-settings.patch
+wifi-rtlwifi-fix-global-out-of-bounds-bug-in-_rtl881.patch
+libbpf-fix-single-line-struct-definition-output-in-b.patch
+libbpf-fix-btf__align_of-by-taking-into-account-fiel.patch
+wifi-ipw2x00-don-t-call-dev_kfree_skb-under-spin_loc.patch
+wifi-ipw2200-fix-memory-leak-in-ipw_wdev_init.patch
+wifi-wilc1000-fix-potential-memory-leak-in-wilc_mac_.patch
+wifi-wilc1000-add-missing-unregister_netdev-in-wilc_.patch
+wifi-brcmfmac-fix-potential-memory-leak-in-brcmf_net.patch
+wifi-brcmfmac-unmap-dma-buffer-in-brcmf_msgbuf_alloc.patch
+wifi-libertas_tf-don-t-call-kfree_skb-under-spin_loc.patch
+wifi-libertas-if_usb-don-t-call-kfree_skb-under-spin.patch
+wifi-libertas-main-don-t-call-kfree_skb-under-spin_l.patch
+wifi-libertas-cmdresp-don-t-call-kfree_skb-under-spi.patch
+wifi-wl3501_cs-don-t-call-kfree_skb-under-spin_lock_.patch
+libbpf-fix-invalid-return-address-register-in-s390.patch
+crypto-x86-ghash-fix-unaligned-access-in-ghash_setke.patch
+crypto-ux500-update-debug-config-after-ux500-cryp-dr.patch
+acpica-drop-port-i-o-validation-for-some-regions.patch
+genirq-fix-the-return-type-of-kstat_cpu_irqs_sum.patch
+rcu-tasks-improve-comments-explaining-tasks_rcu_exit.patch
+rcu-tasks-remove-preemption-disablement-around-srcu_.patch
+rcu-tasks-fix-synchronize_rcu_tasks-vs-zap_pid_ns_pr.patch
+lib-mpi-fix-buffer-overrun-when-sg-is-too-long.patch
+crypto-ccp-avoid-page-allocation-failure-warning-for.patch
+platform-chrome-cros_ec_typec-update-port-dp-vdo.patch
+acpica-nsrepair-handle-cases-without-a-return-value-.patch
+libbpf-fix-map-creation-flags-sanitization.patch
+bpf_doc-fix-build-error-with-older-python-versions.patch
+selftests-xsk-print-correct-payload-for-packet-dump.patch
+selftests-xsk-print-correct-error-codes-when-exiting.patch
+arm64-cpufeature-fix-field-sign-for-dit-hwcap-detect.patch
+arm64-sysreg-fix-errors-in-32-bit-enumeration-values.patch
+kselftest-arm64-fix-syscall-abi-for-systems-without-.patch
+workqueue-protects-wq_unbound_cpumask-with-wq_pool_a.patch
+s390-early-fix-sclp_early_sccb-variable-lifetime.patch
+s390-vfio-ap-fix-an-error-handling-path-in-vfio_ap_m.patch
+x86-signal-fix-the-value-returned-by-strict_sas_size.patch
+thermal-drivers-tsens-drop-msm8976-specific-defines.patch
+thermal-drivers-tsens-sort-out-msm8976-vs-msm8956-da.patch
+thermal-drivers-tsens-fix-slope-values-for-msm8939.patch
+thermal-drivers-tsens-limit-num_sensors-to-9-for-msm.patch
+wifi-rtw89-fix-potential-leak-in-rtw89_append_probe_.patch
+wifi-rtw89-add-missing-check-for-alloc_workqueue.patch
+wifi-rtl8xxxu-fix-memory-leaks-with-rtl8723bu-rtl819.patch
+wifi-orinoco-check-return-value-of-hermes_write_word.patch
+wifi-rtw88-use-rtw_iterate_vifs-for-rtw_vif_watch_do.patch
+wifi-rtw88-use-non-atomic-sta-iterator-in-rtw_ra_mas.patch
+thermal-drivers-imx_sc_thermal-fix-the-loop-conditio.patch
+wifi-ath9k-htc_hst-free-skb-in-ath9k_htc_rx_msg-if-t.patch
+wifi-ath9k-hif_usb-clean-up-skbs-if-ath9k_hif_usb_rx.patch
+wifi-ath9k-fix-potential-stack-out-of-bounds-write-i.patch
+wifi-ath11k-fix-memory-leak-in-ath11k_peer_rx_frag_s.patch
+wifi-cfg80211-fix-extended-kck-key-length-check-in-n.patch
+acpi-battery-fix-missing-nul-termination-with-large-.patch
+selftests-bpf-fix-build-errors-if-config_nf_conntrac.patch
+crypto-ccp-failure-on-re-initialization-due-to-dupli.patch
+crypto-essiv-handle-ebusy-correctly.patch
+crypto-seqiv-handle-ebusy-correctly.patch
+powercap-fix-possible-name-leak-in-powercap_register.patch
+bpf-fix-state-pruning-for-stack_dynptr-stack-slots.patch
+bpf-fix-missing-var_off-check-for-arg_ptr_to_dynptr.patch
+bpf-fix-partial-dynptr-stack-slot-reads-writes.patch
+x86-microcode-add-a-parameter-to-microcode_check-to-.patch
+x86-microcode-check-cpu-capabilities-after-late-micr.patch
+x86-microcode-adjust-late-loading-result-reporting-m.patch
+net-ethernet-ti-am65-cpsw-cpts-fix-cpts-release-acti.patch
+selftests-bpf-fix-vmtest-static-compilation-error.patch
+crypto-xts-handle-ebusy-correctly.patch
+leds-led-class-add-missing-put_device-to-led_put.patch
+drm-nouveau-disp-fix-nvif_outp_acquire_dp-argument-s.patch
+s390-bpf-add-expoline-to-tail-calls.patch
+wifi-iwlwifi-mei-fix-compilation-errors-in-rfkill.patch
+kselftest-arm64-fix-enumeration-of-systems-without-1.patch
+can-rcar_canfd-fix-r-car-v3u-can-mode-selection.patch
+can-rcar_canfd-fix-r-car-v3u-gaflcfg-field-accesses.patch
+selftests-bpf-initialize-tc-in-xdp_synproxy.patch
+crypto-ccp-flush-the-sev-es-tmr-memory-before-giving.patch
+bpftool-profile-online-cpus-instead-of-possible.patch
+wifi-mt76-mt7921-fix-deadlock-in-mt7921_abort_roc.patch
+wifi-mt76-mt7915-call-mt7915_mcu_set_thermal_throttl.patch
+wifi-mt76-mt7915-rework-mt7915_mcu_set_thermal_throt.patch
+wifi-mt76-mt7915-rework-mt7915_thermal_temp_store.patch
+wifi-mt76-mt7921-fix-channel-switch-fail-in-monitor-.patch
+wifi-mt76-mt7996-fix-chainmask-calculation-in-mt7996.patch
+wifi-mt76-mt7996-update-register-for-cfend_rate.patch
+wifi-mt76-connac-fix-power_ctrl-command-name-typo.patch
+wifi-mt76-mt7921-fix-invalid-remain_on_channel-durat.patch
+wifi-mt76-mt7915-fix-memory-leak-in-mt7915_mcu_exit.patch
+wifi-mt76-mt7996-fix-memory-leak-in-mt7996_mcu_exit.patch
+wifi-mt76-dma-fix-memory-leak-running-mt76_dma_tx_cl.patch
+wifi-mt76-fix-switch-default-case-in-mt7996_reverse_.patch
+wifi-mt76-mt7915-fix-wed-txs-reporting.patch
+wifi-mt76-add-memory-barrier-to-sdio-queue-kick.patch
+wifi-mt76-mt7921-fix-error-code-of-return-in-mt7921_.patch
+wifi-mt76-mt7996-rely-on-mt76_connac2_mac_tx_rate_va.patch
+net-mlx5-enhance-debug-print-in-page-allocation-fail.patch
+irqchip-fix-refcount-leak-in-platform_irqchip_probe.patch
+irqchip-alpine-msi-fix-refcount-leak-in-alpine_msix_.patch
+irqchip-irq-mvebu-gicp-fix-refcount-leak-in-mvebu_gi.patch
+irqchip-ti-sci-fix-refcount-leak-in-ti_sci_intr_irq_.patch
+s390-mem_detect-fix-detect_memory-error-handling.patch
+s390-vmem-fix-empty-page-tables-cleanup-under-kasan.patch
+s390-boot-cleanup-decompressor-header-files.patch
+s390-mem_detect-rely-on-diag260-if-sclp_early_get_me.patch
+s390-boot-fix-mem_detect-extended-area-allocation.patch
+net-add-sock_init_data_uid.patch
+tun-tun_chr_open-correctly-initialize-socket-uid.patch
+tap-tap_open-correctly-initialize-socket-uid.patch
+rxrpc-fix-overwaking-on-call-poking.patch
+opp-fix-error-checking-in-opp_migrate_dentry.patch
+cpufreq-davinci-fix-clk-use-after-free.patch
+bluetooth-hci_conn-refactor-hci_bind_bis-since-it-al.patch
+bluetooth-l2cap-fix-potential-user-after-free.patch
+bluetooth-hci_qca-get-wakeup-status-from-serdev-devi.patch
+net-ipa-generic-command-param-fix.patch
+s390-vfio-ap-tighten-the-nib-validity-check.patch
+s390-ap-fix-status-returned-by-ap_aqic.patch
+s390-ap-fix-status-returned-by-ap_qact.patch
+libbpf-fix-alen-calculation-in-libbpf_nla_dump_error.patch
+xen-grant-dma-iommu-implement-a-dummy-probe_device-c.patch
+rds-rds_rm_zerocopy_callback-correct-order-for-list_.patch
+crypto-rsa-pkcs1pad-use-akcipher_request_complete.patch
+m68k-proc-hardware-should-depend-on-proc_fs.patch
+risc-v-time-initialize-hrtimer-based-broadcast-clock.patch
+clocksource-drivers-riscv-patch-riscv_clock_next_eve.patch
+wifi-iwl3945-add-missing-check-for-create_singlethre.patch
+wifi-iwl4965-add-missing-check-for-create_singlethre.patch
+wifi-brcmfmac-rename-cypress-89459-to-bcm4355.patch
+wifi-brcmfmac-pcie-add-ids-properties-for-bcm4355.patch
+wifi-brcmfmac-pcie-add-ids-properties-for-bcm4377.patch
+wifi-brcmfmac-pcie-perform-correct-bcm4364-firmware-.patch
+wifi-mwifiex-fix-loop-iterator-in-mwifiex_update_amp.patch
+wifi-rtw89-fix-parsing-offset-for-mcc-c2h.patch
+selftests-bpf-fix-out-of-srctree-build.patch
+acpi-resource-add-irq-overrides-for-maingear-vector-.patch
+acpi-resource-do-irq-override-on-all-tongfang-gmxrgx.patch
+crypto-octeontx2-fix-objects-shared-between-several-.patch
+crypto-crypto4xx-call-dma_unmap_page-when-done.patch
+vfio-ccw-remove-warn_on-during-shutdown.patch
+wifi-mac80211-move-color-collision-detection-report-.patch
+wifi-mac80211-make-rate-u32-in-sta_set_rate_info_rx.patch
+wifi-mac80211-fix-non-mlo-station-association.patch
+wifi-mac80211-don-t-translate-mld-addresses-for-mult.patch
+wifi-mac80211-avoid-u32_encode_bits-warning.patch
+wifi-mac80211-fix-off-by-one-link-setting.patch
+tools-lib-thermal-fix-thermal_sampling_exit.patch
+thermal-drivers-hisi-drop-second-sensor-hi3660.patch
+selftests-bpf-fix-map_kptr-test.patch
+wifi-mac80211-pass-sta-to-ieee80211_rx_data_set_sta.patch
+bpf-zeroing-allocated-object-from-slab-in-bpf-memory.patch
+selftests-bpf-fix-xdp_do_redirect-on-s390x.patch
+can-esd_usb-move-mislocated-storage-of-sja1000_ecc_s.patch
+can-esd_usb-make-use-of-can_change_state-and-relocat.patch
+xsk-check-iff_up-earlier-in-tx-path.patch
+loongarch-bpf-use-4-instructions-for-function-addres.patch
+bpf-fix-global-subprog-context-argument-resolution-l.patch
+irqchip-irq-brcmstb-l2-set-irq_level-for-level-trigg.patch
+irqchip-irq-bcm7120-l2-set-irq_level-for-level-trigg.patch
+net-smc-fix-potential-panic-dues-to-unprotected-smc_.patch
+net-smc-fix-application-data-exception.patch
+selftests-net-interpret-udp_gro-cmsg-data-as-an-int-.patch
+l2tp-avoid-possible-recursive-deadlock-in-l2tp_tunne.patch
+net-bcmgenet-fix-moca-led-control.patch
+net-lan966x-fix-possible-deadlock-inside-ptp.patch
+net-mlx4_en-introduce-flexible-array-to-silence-over.patch
+net-mlx5e-align-ipsec-aso-result-memory-to-be-as-req.patch
+selftest-fib_tests-always-cleanup-before-exit.patch
+sefltests-netdevsim-wait-for-devlink-instance-after-.patch
+drm-fix-potential-null-ptr-deref-due-to-drmm_mode_co.patch
+drm-fourcc-add-missing-big-endian-xrgb1555-and-rgb56.patch
+drm-bridge-ti-sn65dsi83-fix-delay-after-reset-deasse.patch
+drm-mxsfb-drm_imx_lcdif-should-depend-on-arch_mxc.patch
+drm-mxsfb-drm_mxsfb-should-depend-on-arch_mxs-arch_m.patch
+drm-vc4-kms-sort-the-crtcs-by-output-before-assignin.patch
+drm-bridge-megachips-fix-error-handling-in-i2c_regis.patch
+drm-vkms-fix-memory-leak-in-vkms_init.patch
+drm-vkms-fix-null-ptr-deref-in-vkms_release.patch
+drm-modes-use-strscpy-to-copy-command-line-mode-name.patch
+drm-vc4-dpi-fix-format-mapping-for-rgb565.patch
+drm-bridge-it6505-guard-bridge-power-in-irq-handler.patch
+drm-tidss-fix-pixel-format-definition.patch
+gpu-ipu-v3-common-add-of_node_put-for-reference-retu.patch
+drm-ast-init-iosys_map-pointer-as-i-o-memory-for-dam.patch
+drm-vc4-drop-all-currently-held-locks-if-deadlock-ha.patch
+hwmon-ftsteutates-fix-scaling-of-measurements.patch
+drm-msm-dpu-check-for-null-return-of-devm_kzalloc-in.patch
+drm-msm-hdmi-add-missing-check-for-alloc_ordered_wor.patch
+pinctrl-qcom-pinctrl-msm8976-correct-function-names-.patch
+pinctrl-stm32-fix-refcount-leak-in-stm32_pctrl_get_i.patch
+pinctrl-rockchip-fix-refcount-leak-in-rockchip_pinct.patch
+drm-vc4-hvs-configure-the-hvs-cob-allocations.patch
+drm-vc4-hvs-set-axi-panic-modes.patch
+drm-vc4-hvs-scaler_dispbkgnd_autohs-is-only-valid-on.patch
+drm-vc4-hvs-correct-interrupt-masking-bit-assignment.patch
+drm-vc4-hvs-fix-colour-order-for-xrgb1555-on-hvs5.patch
+drm-vc4-hdmi-correct-interlaced-timings-again.patch
+drm-msm-clean-event_thread-worker-in-case-of-an-erro.patch
+drm-panel-edp-fix-name-for-ivo-product-id-854b.patch
+scsi-qla2xxx-fix-exchange-oversubscription.patch
+scsi-qla2xxx-fix-exchange-oversubscription-for-manag.patch
+scsi-qla2xxx-edif-fix-clang-warning.patch
+asoc-fsl_sai-initialize-is_dsp_mode-flag.patch
+drm-bridge-tc358767-set-default-clrsipo-count.patch
+drm-msm-adreno-fix-null-ptr-access-in-adreno_gpu_cle.patch
+alsa-hda-ca0132-minor-fix-for-allocation-size.patch
+drm-amdgpu-use-the-sched-from-entity-for-amdgpu_cs-t.patch
+drm-msm-gem-add-check-for-kmalloc.patch
+drm-msm-dpu-disallow-unallocated-resources-to-be-ret.patch
+drm-bridge-lt9611-fix-sleep-mode-setup.patch
+drm-bridge-lt9611-fix-hpd-reenablement.patch
+drm-bridge-lt9611-fix-polarity-programming.patch
+drm-bridge-lt9611-fix-programming-of-video-modes.patch
+drm-bridge-lt9611-fix-clock-calculation.patch
+drm-bridge-lt9611-pass-a-pointer-to-the-of-node.patch
+regulator-tps65219-use-is_err-to-detect-an-error-poi.patch
+drm-mipi-dsi-fix-byte-order-of-16-bit-dcs-set-get-br.patch
+drm-exynos-dsi-fix-mipi_dsi-_no_-mode-flags.patch
+drm-msm-dsi-allow-2-ctrls-on-v2.5.0.patch
+scsi-ufs-exynos-fix-dma-alignment-for-page_size-4096.patch
+drm-msm-dpu-sc7180-add-missing-wb2-clock-control.patch
+drm-msm-use-strscpy-instead-of-strncpy.patch
+drm-msm-dpu-add-check-for-cstate.patch
+drm-msm-dpu-add-check-for-pstates.patch
+drm-msm-mdp5-add-check-for-kzalloc.patch
+habanalabs-bugs-fixes-in-timestamps-buff-alloc.patch
+pinctrl-bcm2835-remove-of_node_put-in-bcm2835_of_gpi.patch
+pinctrl-mediatek-initialize-variable-pullen-and-pull.patch
+pinctrl-mediatek-initialize-variable-buf-to-zero.patch
+gpu-host1x-fix-mask-for-syncpoint-increment-register.patch
+gpu-host1x-don-t-skip-assigning-syncpoints-to-channe.patch
+drm-tegra-firewall-check-for-is_addr_reg-existence-i.patch
+drm-i915-mtl-add-initial-gt-workarounds.patch
+drm-i915-xehp-gam-registers-don-t-need-to-be-re-appl.patch
+pinctrl-renesas-rzg2l-fix-configuring-the-gpio-pins-.patch
+drm-i915-xehp-annotate-a-couple-more-workaround-regi.patch
+drm-msm-dpu-set-pdpu-is_rt_pipe-early-in-dpu_plane_s.patch
+drm-mediatek-dsi-reduce-the-time-of-dsi-from-lp11-to.patch
+drm-mediatek-use-null-instead-of-0-for-null-pointer.patch
+drm-mediatek-drop-unbalanced-obj-unref.patch
+drm-mediatek-mtk_drm_crtc-add-checks-for-devm_kcallo.patch
+drm-mediatek-clean-dangling-pointer-on-bind-error-pa.patch
+asoc-soc-compress.c-fixup-private_data-on-snd_soc_ne.patch
+dt-bindings-display-mediatek-fix-the-fallback-for-me.patch
+gpio-pca9570-rename-platform_data-to-chip_data.patch
+gpio-vf610-connect-gpio-label-to-dev-name.patch
+asoc-topology-properly-access-value-coming-from-topo.patch
+spi-dw_bt1-fix-mux_mmio-dependencies.patch
+asoc-mchp-spdifrx-fix-controls-which-rely-on-rsr-reg.patch
+asoc-mchp-spdifrx-fix-return-value-in-case-completio.patch
+asoc-mchp-spdifrx-fix-controls-that-works-with-compl.patch
+asoc-mchp-spdifrx-disable-all-interrupts-in-mchp_spd.patch
+dm-improve-shrinker-debug-names.patch
+regmap-apply-reg_base-and-reg_downshift-for-single-r.patch
+accel-fix-config_drm-dependencies.patch
+asoc-rsnd-fixup-endif-position.patch
+asoc-mchp-spdifrx-fix-uninitialized-use-of-mr-in-mch.patch
+asoc-dt-bindings-meson-fix-gx-card-codec-node-regex.patch
+regulator-tps65219-use-generic-set_bypass.patch
+hwmon-asus-ec-sensors-add-missing-mutex-path.patch
+hwmon-ltc2945-handle-error-case-in-ltc2945_value_sto.patch
+alsa-hda-fix-the-control-element-identification-for-.patch
+drm-amdgpu-fix-enum-odm_combine_mode-mismatch.patch
+scsi-mpt3sas-fix-a-memory-leak.patch
+scsi-aic94xx-add-missing-check-for-dma_map_single.patch
+hid-multitouch-add-quirks-for-flipped-axes.patch
+hid-retain-initial-quirks-set-up-when-creating-hid-d.patch
+asoc-qcom-q6apm-lpass-dai-unprepare-stream-if-its-al.patch
+asoc-qcom-q6apm-dai-fix-race-condition-while-updatin.patch
+asoc-qcom-q6apm-dai-add-sndrv_pcm_info_batch-flag.patch
+asoc-codecs-lpass-register-mclk-after-runtime-pm.patch
+asoc-codecs-lpass-fix-incorrect-mclk-rate.patch
+spi-bcm63xx-hsspi-endianness-fix-for-arm-based-soc.patch
+drm-amd-display-don-t-call-dc_interrupt_set-for-disa.patch
+hid-logitech-hidpp-hard-code-hid-1.0-fast-scroll-sup.patch
+spi-bcm63xx-hsspi-fix-multi-bit-mode-setting.patch
+hwmon-mlxreg-fan-return-zero-speed-for-broken-fan.patch
+asoc-tlv320adcx140-fix-ti-gpio-config-dt-property-in.patch
+dm-remove-flush_scheduled_work-during-local_exit.patch
+nfs4trace-fix-state-manager-flag-printing.patch
+nfs-fix-disabling-of-swap.patch
+drm-i915-pvc-implement-recommended-caching-policy.patch
+drm-i915-pvc-annotate-two-more-workaround-tuning-reg.patch
+drm-i915-fix-gen8_misccpctl.patch
+spi-synquacer-fix-timeout-handling-in-synquacer_spi_.patch
+asoc-soc-dapm.h-fixup-warning-struct-snd_pcm_substre.patch
+hid-bigben-use-spinlock-to-protect-concurrent-access.patch
+hid-bigben_worker-remove-unneeded-check-on-report_fi.patch
+hid-bigben-use-spinlock-to-safely-schedule-workers.patch
+hid-bigben_probe-validate-report-count.patch
+alsa-hda-hdmi-register-with-vga_switcheroo-on-dual-g.patch
+drm-shmem-helper-fix-locking-for-drm_gem_shmem_get_p.patch
+nfsd-enhance-inter-server-copy-cleanup.patch
+nfsd-fix-leaked-reference-count-of-nfsd4_ssc_umount_.patch
+nfsd-fix-race-to-check-ls_layouts.patch
+nfsd-clean-up-potential-nfsd_file-refcount-leaks-in-.patch
+nfsd-fix-problems-with-cleanup-on-errors-in-nfsd4_co.patch
+nfsd-fix-courtesy-client-with-deny-mode-handling-in-.patch
+nfsd-don-t-fsync-nfsd_files-on-last-close.patch
+nfsd-copy-the-whole-verifier-in-nfsd_copy_write_veri.patch
+cifs-fix-lost-destroy-smbd-connection-when-mr-alloca.patch
+cifs-fix-warning-and-uaf-when-destroy-the-mr-list.patch
+cifs-use-tcon-allocation-functions-even-for-dummy-tc.patch
+gfs2-jdata-writepage-fix.patch
+perf-llvm-fix-inadvertent-file-creation.patch
+leds-led-core-fix-refcount-leak-in-of_led_get.patch
+leds-is31fl319x-wrap-mutex_destroy-for-devm_add_acti.patch
+leds-simatic-ipc-leds-gpio-make-sure-we-have-the-gpi.patch
+tools-tracing-rtla-osnoise_hist-use-total-duration-f.patch
+perf-inject-use-perf_data__read-for-auxtrace.patch
+perf-intel-pt-do-not-try-to-queue-auxtrace-data-on-p.patch
+perf-stat-hide-invalid-uncore-event-output-for-aggr-.patch
+perf-jevents-correct-bad-character-encoding.patch
+perf-test-bpf-skip-test-if-kernel-debuginfo-is-not-p.patch
+perf-tools-fix-auto-complete-on-aarch64.patch
+perf-stat-avoid-merging-aggregating-metric-counts-tw.patch
+sparc-allow-pm-configs-for-sparc32-compile_test.patch
+selftests-find-echo-binary-to-use-ne-options.patch
+selftests-ftrace-fix-bash-specific-operator.patch
+selftests-use-printf-instead-of-echo-ne.patch
+perf-record-fix-segfault-with-overwrite-and-max-size.patch
+printf-fix-errname.c-list.patch
+perf-tests-stat_all_metrics-change-true-workload-to-.patch
+objtool-add-uaccess-exceptions-for-__tsan_volatile_r.patch
+selftests-ftrace-fix-probepoint-testcase-to-ignore-_.patch
+sysctl-fix-proc_dobool-usability.patch
+mfd-rk808-re-add-rk808-clkout-to-rk818.patch
+mfd-cs5535-don-t-build-on-uml.patch
+mfd-pcf50633-adc-fix-potential-memleak-in-pcf50633_a.patch
+dmaengine-idxd-set-traffic-class-values-in-grpcfg-on.patch
+rdma-erdma-fix-refcount-leak-in-erdma_mmap.patch
+dmaengine-hisi_dma-should-depend-on-arch_hisi.patch
+rdma-hns-fix-refcount-leak-in-hns_roce_mmap.patch
+iio-light-tsl2563-do-not-hardcode-interrupt-trigger-.patch
+usb-gadget-fusb300_udc-free-irq-on-the-error-path-in.patch
+i2c-designware-fix-i2c_dw_clk_rate-return-size-to-be.patch
+i2c-qcom-geni-change-i2c_master_hub-to-static.patch
+soundwire-cadence-don-t-overflow-the-command-fifos.patch
+driver-core-fix-potential-null-ptr-deref-in-device_a.patch
+kobject-fix-slab-out-of-bounds-in-fill_kobj_path.patch
+alpha-boot-tools-objstrip-fix-the-check-for-elf-head.patch
+media-uvcvideo-check-for-inactive-in-uvc_ctrl_is_acc.patch
+media-uvcvideo-implement-mask-for-v4l2_ctrl_type_men.patch
+media-uvcvideo-refactor-uvc_ctrl_mappings_uvcxx.patch
+media-uvcvideo-refactor-power_line_frequency_control.patch
+coresight-etm4x-fix-accesses-to-trcseqrstevr-and-trc.patch
+coresight-cti-prevent-negative-values-of-enable-coun.patch
+coresight-cti-add-pm-runtime-call-in-enable_store.patch
+usb-typec-intel_pmc_mux-don-t-leak-the-acpi-device-r.patch
+pci-iov-enlarge-virtfn-sysfs-name-buffer.patch
+pci-switchtec-return-efault-for-copy_to_user-errors.patch
+pci-endpoint-pci-epf-vntb-add-epf_ntb_mw_bar_clear-n.patch
+hwtracing-hisi_ptt-only-add-the-supported-devices-to.patch
+tty-serial-fsl_lpuart-disable-rx-tx-dma-in-lpuart32_.patch
+tty-serial-fsl_lpuart-clear-lpuart-status-register-i.patch
+tty-serial-qcom-geni-serial-stop-operations-in-progr.patch
+serial-tegra-add-missing-clk_disable_unprepare-in-te.patch
+revert-char-pcmcia-cm4000_cs-replace-mdelay-with-usl.patch
+eeprom-idt_89hpesx-fix-error-handling-in-idt_init.patch
+applicom-fix-pci-device-refcount-leak-in-applicom_in.patch
+firmware-stratix10-svc-add-missing-gen_pool_destroy-.patch
+firmware-stratix10-svc-fix-error-handle-while-alloc-.patch
+vmci-check-context-notify_page-after-call-to-get_use.patch
+mei-pxp-use-correct-macros-to-initialize-uuid_le.patch
+misc-mei-hdcp-use-correct-macros-to-initialize-uuid_.patch
+misc-fastrpc-fix-an-error-handling-path-in-fastrpc_r.patch
+iommu-exynos-fix-error-handling-in-exynos_iommu_init.patch
+driver-core-fix-resource-leak-in-device_add.patch
+driver-core-location-free-struct-acpi_pld_info-pld-b.patch
+drivers-base-transport_class-fix-possible-memory-lea.patch
+drivers-base-transport_class-fix-resource-leak-when-.patch
+firmware-dmi-sysfs-fix-null-ptr-deref-in-dmi_sysfs_r.patch
+selftests-iommu-fix-test_cmd_destroy_access-call-in-.patch
+iommufd-add-three-missing-structures-in-ucmd_buffer.patch
+fotg210-udc-add-missing-completion-handler.patch
+dmaengine-dw-edma-fix-missing-src-dst-address-of-int.patch
+fpga-microchip-spi-move-spi-i-o-buffers-out-of-stack.patch
+fpga-microchip-spi-rewrite-status-polling-in-a-time-.patch
+usb-early-xhci-dbc-fix-a-potential-out-of-bound-memo.patch
+tty-serial-fsl_lpuart-fix-the-wrong-rxwater-setting-.patch
+rdma-cxgb4-add-null-ptr-check-after-ip_dev_find.patch
+usb-musb-mediatek-don-t-unregister-something-that-wa.patch
+usb-gadget-configfs-restrict-symlink-creation-is-udc.patch
+phy-mediatek-remove-temporary-variable-mask_.patch
+pci-mt7621-delay-phy-ports-initialization.patch
+iommu-vt-d-set-no-execute-enable-bit-in-pasid-table-.patch
+power-supply-remove-faulty-cooling-logic.patch
+rdma-siw-fix-user-page-pinning-accounting.patch
+rdma-cxgb4-fix-potential-null-ptr-deref-in-pass_esta.patch
+usb-max-3421-fix-setting-of-i-o-pins.patch
+rdma-irdma-cap-msix-used-to-online-cpus-1.patch
+serial-fsl_lpuart-fix-rs485-rts-polariy-inverse-issu.patch
+tty-serial-imx-disable-ageing-timer-interrupt-reques.patch
+driver-core-fw_devlink-add-dl_flag_cycle-support-to-.patch
+driver-core-fw_devlink-don-t-purge-child-fwnode-s-co.patch
+driver-core-fw_devlink-allow-marking-a-fwnode-link-a.patch
+driver-core-fw_devlink-consolidate-device-link-flag-.patch
+driver-core-fw_devlink-improve-check-for-fwnode-with.patch
+driver-core-fw_devlink-make-cycle-detection-more-rob.patch
+mtd-mtdpart-don-t-create-platform-device-that-ll-nev.patch
+usb-host-fsl-mph-dr-of-reuse-device_set_of_node_from.patch
+dmaengine-dw-edma-fix-readq_ch-return-value-truncati.patch
+pci-fix-dropping-valid-root-bus-resources-with-.end-.patch
+phy-rockchip-typec-fix-tcphy_get_mode-error-case.patch
+pci-qcom-fix-host-init-error-handling.patch
+iw_cxgb4-fix-potential-null-dereference-in-c4iw_fill.patch
+iommu-fix-error-unwind-in-iommu_group_alloc.patch
+iommu-amd-do-not-identity-map-v2-capable-device-when.patch
+dmaengine-sf-pdma-pdma_desc-memory-leak-fix.patch
+dmaengine-dw-axi-dmac-do-not-dereference-null-struct.patch
+dmaengine-ptdma-check-for-null-desc-before-calling-p.patch
+iommu-vt-d-fix-error-handling-in-sva-enable-disable-.patch
+iommu-vt-d-allow-to-use-flush-queue-when-first-level.patch
+rdma-rxe-cleanup-mr_check_range.patch
+rdma-rxe-move-rxe_map_mr_sg-to-rxe_mr.c.patch
+rdma-rxe-isolate-mr-code-from-atomic_reply.patch
+rdma-rxe-isolate-mr-code-from-atomic_write_reply.patch
+rdma-rxe-cleanup-page-variables-in-rxe_mr.c.patch
+rdma-rxe-replace-rxe_map-and-rxe_phys_buf-by-xarray.patch
+subject-rdma-rxe-handle-zero-length-rdma.patch
+rdma-mana_ib-fix-a-bug-when-the-pf-indicates-more-en.patch
+rdma-rxe-fix-missing-memory-barriers-in-rxe_queue.h.patch
+ib-hfi1-fix-math-bugs-in-hfi1_can_pin_pages.patch
+ib-hfi1-fix-sdma.h-tx-num_descs-off-by-one-errors.patch
+revert-remoteproc-qcom_q6v5_mss-map-unmap-metadata-r.patch
+remoteproc-qcom_q6v5_mss-use-a-carveout-to-authentic.patch
+media-ti-cal-fix-possible-memory-leak-in-cal_ctx_cre.patch
+media-platform-ti-add-missing-check-for-devm_regulat.patch
+media-imx-imx7-media-csi-fix-missing-clk_disable_unp.patch
+powerpc-remove-linker-flag-from-kbuild_aflags.patch
+s390-vdso-drop-shared-from-kbuild_cflags_64.patch
+builddeb-clean-generated-package-content.patch
+media-max9286-fix-memleak-in-max9286_v4l2_register.patch
+media-ov2740-fix-memleak-in-ov2740_init_controls.patch
+media-ov5675-fix-memleak-in-ov5675_init_controls.patch
+media-i2c-tc358746-fix-missing-return-assignment.patch
+media-i2c-tc358746-fix-ignoring-read-error-in-g_regi.patch
+media-i2c-tc358746-fix-possible-endianness-issue.patch
+media-ov5640-fix-soft-reset-sequence-and-timings.patch
+media-ov5640-handle-delays-when-no-reset_gpio-set.patch
+media-mc-get-media_device-directly-from-pad.patch
+media-i2c-ov772x-fix-memleak-in-ov772x_probe.patch
+media-i2c-imx219-split-common-registers-from-mode-ta.patch
+media-i2c-imx219-fix-binning-for-raw8-capture.patch
+media-platform-mtk-mdp3-fix-return-value-check-in-md.patch
+media-camss-csiphy-3ph-avoid-undefined-behavior.patch
+media-platform-mtk-mdp3-fix-kconfig-dependencies.patch
+media-v4l2-jpeg-correct-the-skip-count-in-jpeg_parse.patch
+media-v4l2-jpeg-ignore-the-unknown-app14-marker.patch
+media-hantro-fix-jpeg-encoder-enum_frmsize-on-rk3399.patch
+media-imx-jpeg-apply-clk_bulk-api-instead-of-operati.patch
+media-amphion-correct-the-unspecified-color-space.patch
+media-drivers-media-v4l2-core-v4l2-h264-add-detectio.patch
+media-rc-fix-use-after-free-bugs-caused-by-ene_tx_ir.patch
+media-atomisp-fix-videobuf2-kconfig-depenendency.patch
+media-atomisp-only-set-default_run_mode-on-first-ope.patch
+media-i2c-ov7670-0-instead-of-einval-was-returned.patch
+media-usb-siano-fix-use-after-free-bugs-caused-by-do.patch
+media-saa7134-use-video_unregister_device-for-radio_.patch
+rpmsg-glink-avoid-infinite-loop-on-intent-for-missin.patch
+rpmsg-glink-release-driver_override.patch
+arm-omap2-omap4-common-fix-refcount-leak-bug.patch
+arm64-dts-qcom-msm8996-add-additional-a2noc-clocks.patch
+udf-define-efscorrupted-error-code.patch
+context_tracking-fix-noinstr-vs-kasan.patch
+exit-detect-and-fix-irq-disabled-state-in-oops.patch
+arm-dts-exynos-use-exynos5420-compatible-for-the-mip.patch
+fs-use-check_data_corruption-when-kernel-bugs-are-de.patch
+blk-iocost-fix-divide-by-0-error-in-calc_lcoefs.patch
+blk-cgroup-dropping-parent-refcount-after-pd_free_fn.patch
+blk-cgroup-synchronize-pd_free_fn-from-blkg_free_wor.patch
+trace-blktrace-fix-memory-leak-with-using-debugfs_lo.patch
+sched-fair-sanitize-vruntime-of-entity-being-placed.patch
+btrfs-scrub-improve-tree-block-error-reporting.patch
+arm64-zynqmp-enable-hs-termination-flag-for-usb-dwc3.patch
+cpuidle-intel_idle-fix-cpuidle_flag_init_xstate.patch
+x86-fpu-don-t-set-tif_need_fpu_load-for-pf_io_worker.patch
+cpuidle-drivers-firmware-psci-dont-instrument-suspen.patch
+cpuidle-lib-bug-disable-rcu_is_watching-during-warn-.patch
+perf-x86-intel-uncore-add-meteor-lake-support.patch
+wifi-ath9k-fix-use-after-free-in-ath9k_hif_usb_disco.patch
+wifi-ath11k-fix-monitor-mode-bringup-crash.patch
+wifi-brcmfmac-fix-potential-stack-out-of-bounds-in-b.patch
+rcu-make-rcu_lockdep_warn-avoid-early-lockdep-checks.patch
+rcu-suppress-smp_processor_id-complaint-in-synchroni.patch
+srcu-delegate-work-to-the-boot-cpu-if-using-srcu_siz.patch
+rcu-tasks-make-rude-rcu-tasks-work-well-with-cpu-hot.patch
+rcu-tasks-handle-queue-shrink-callback-enqueue-race-.patch
+wifi-ath11k-debugfs-fix-to-work-with-multiple-pci-de.patch
+thermal-intel-fix-unsigned-comparison-with-less-than.patch
+timers-prevent-union-confusion-from-unexpected-resta.patch
+x86-bugs-reset-speculation-control-settings-on-init.patch
+bpftool-always-disable-stack-protection-for-bpf-obje.patch
+wifi-brcmfmac-ensure-clm-version-is-null-terminated-.patch
+wifi-rtw89-fix-assignation-of-tx-bd-ram-table.patch
+wifi-mt7601u-fix-an-integer-underflow.patch
+inet-fix-fast-path-in-__inet_hash_connect.patch
+ice-restrict-ptp-hw-clock-freq-adjustments-to-100-00.patch
+ice-add-missing-checks-for-pf-vsi-type.patch
+compiler-attributes-gcc-cold-function-alignment-work.patch
+acpi-don-t-build-acpica-with-os.patch
+bpf-docs-fix-modulo-zero-division-by-zero-overflow-a.patch
+thermal-intel-intel_pch-add-support-for-wellsburg-pc.patch
+clocksource-suspend-the-watchdog-temporarily-when-hi.patch
+crypto-hisilicon-wipe-entire-pool-on-error.patch
+net-bcmgenet-add-a-check-for-oversized-packets.patch
+m68k-check-syscall_trace_enter-return-code.patch
+s390-mm-ptdump-avoid-kasan-vs-memcpy-real-markers-sw.patch
+netfilter-nf_tables-null-pointer-dereference-in-nf_t.patch
+can-isotp-check-can-address-family-in-isotp_bind.patch
+gcc-plugins-drop-std-gnu-11-to-fix-gcc-13-build.patch
+tools-power-x86-intel-speed-select-add-emerald-rapid.patch
+platform-x86-dell-ddv-add-support-for-interface-vers.patch
+wifi-mt76-dma-free-rx_head-in-mt76_dma_rx_cleanup.patch
+acpi-video-fix-lenovo-ideapad-z570-dmi-match.patch
+net-mlx5-fw_tracer-fix-debug-print.patch
+coda-avoid-partial-allocation-of-sig_inputargs.patch
+uaccess-add-minimum-bounds-check-on-kernel-buffer-si.patch
+s390-idle-mark-arch_cpu_idle-noinstr.patch
+time-debug-fix-memory-leak-with-using-debugfs_lookup.patch
+pm-domains-fix-memory-leak-with-using-debugfs_lookup.patch
+pm-em-fix-memory-leak-with-using-debugfs_lookup.patch
+bluetooth-fix-issue-with-actions-semi-ats2851-based-.patch
+bluetooth-btusb-add-new-pid-vid-0489-e0f2-for-mt7921.patch
+bluetooth-btusb-add-vid-pid-13d3-3529-for-realtek-rt.patch
+wifi-rtw89-debug-avoid-invalid-access-on-rtw89_dbg_s.patch
+hv_netvsc-check-status-in-send_rndis_pkt-completion-.patch
+s390-kfence-fix-page-fault-reporting.patch
+devlink-fix-tp_struct_entry-in-trace-of-devlink-heal.patch
+scm-add-user-copy-checks-to-put_cmsg.patch
+drm-panel-orientation-quirks-add-quirk-for-lenovo-yo.patch
+drm-panel-orientation-quirks-add-quirk-for-dynabook-.patch
+drm-amd-display-reduce-expected-sdp-bandwidth-for-dc.patch
+drm-amd-display-revert-reduce-delay-when-sink-device.patch
+drm-amd-display-fix-potential-null-deref-in-dm_resum.patch
+drm-omap-dsi-fix-excessive-stack-usage.patch
+hid-add-mapping-for-system-microphone-mute.patch
+drm-tiny-ili9486-do-not-assume-8-bit-only-spi-contro.patch
+drm-amd-display-defer-dig-fifo-disable-after-vid-str.patch
+drm-radeon-free-iio-for-atombios-when-driver-shutdow.patch
+drm-amd-avoid-bug-for-case-of-sriov-missing-ip-versi.patch
+drm-amdkfd-page-aligned-memory-reserve-size.patch
+scsi-lpfc-fix-use-after-free-kfence-violation-during.patch
+revert-fbcon-don-t-lose-the-console-font-across-gene.patch
+drm-amd-avoid-assert-for-some-message-failures.patch
+drm-amd-display-fix-memory-leakage.patch
+drm-amd-display-fix-mapping-to-non-allocated-address.patch
+hid-uclogic-add-frame-type-quirk.patch
+hid-uclogic-add-battery-quirk.patch
+hid-uclogic-add-support-for-xp-pen-deco-pro-sw.patch
+hid-uclogic-add-support-for-xp-pen-deco-pro-mw.patch
+drm-msm-dsi-add-missing-check-for-alloc_ordered_work.patch
+drm-rcar-du-add-quirk-for-h3-es1.x-pclk-workaround.patch
+drm-rcar-du-fix-setting-a-reserved-bit-in-dpllcr.patch
+drm-drm_print-correct-format-problem.patch
+drm-amd-display-set-hvm_enabled-flag-for-s-g-mode.patch
+drm-client-test-for-connectors-before-sending-hotplu.patch
+habanalabs-extend-fatal-messages-to-contain-pci-info.patch
+habanalabs-fix-bug-in-timestamps-registration-code.patch
+docs-scripts-gdb-add-necessary-make-scripts_gdb-step.patch
+drm-msm-dpu-add-dsc-hardware-blocks-to-register-snap.patch
+asoc-soc-compress-reposition-and-add-pcm_mutex.patch
+asoc-kirkwood-iterate-over-array-indexes-instead-of-.patch
+regulator-max77802-bounds-check-regulator-id-against.patch
+regulator-s5m8767-bounds-check-id-indexing-into-arra.patch
+revert-drm-amdgpu-ta-unload-messages-are-not-actuall.patch
+drm-amd-display-fix-fclk-pstate-change-underflow.patch
+gfs2-improve-gfs2_make_fs_rw-error-handling.patch
+hwmon-coretemp-simplify-platform-device-handling.patch
+hwmon-nct6775-directly-call-asus-acpi-wmi-method.patch
+hwmon-nct6775-b650-b660-x670-asus-boards-support.patch
+pinctrl-at91-use-devm_kasprintf-to-avoid-potential-l.patch
+drm-amd-display-do-not-commit-pipe-when-updating-drr.patch
+scsi-snic-fix-memory-leak-with-using-debugfs_lookup.patch
+scsi-ufs-core-fix-device-management-cmd-timeout-flow.patch
+hid-logitech-hidpp-don-t-restart-communication-if-no.patch
+drm-amd-display-enable-p-state-validation-checks-for.patch
+drm-panel-orientation-quirks-add-quirk-for-lenovo-id.patch
+drm-amd-display-disable-hubp-dpp-pg-on-dcn314-for-no.patch
+drm-amd-display-disable-subvp-drr-to-prevent-underfl.patch
+dm-thin-add-cond_resched-to-various-workqueue-loops.patch
+dm-cache-add-cond_resched-to-various-workqueue-loops.patch
+nfsd-zero-out-pointers-after-putting-nfsd_files-on-c.patch
+nfsd-don-t-hand-out-delegation-on-setuid-files-being.patch
+cifs-prevent-data-race-in-smb2_reconnect.patch
+drm-i915-mtl-correct-implementation-of-wa_1801878132.patch
+drm-shmem-helper-revert-accidental-non-gpl-export.patch
+driver-core-fw_devlink-avoid-spurious-error-message.patch
--- /dev/null
+From 6805ffb2ac1cd310862139311d69eeb648761ac2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Dec 2022 16:18:10 +0000
+Subject: soundwire: cadence: Don't overflow the command FIFOs
+
+From: Richard Fitzgerald <rf@opensource.cirrus.com>
+
+[ Upstream commit 7cbfee2e2e40d2be54196362a845a3ea0a3f877d ]
+
+The command FIFOs in the Cadence IP can be configured during design
+up to 32 entries, and the code in cadence_master.c was assuming the
+full 32-entry FIFO. But all current Intel implementations use an 8-entry
+FIFO.
+
+Up to now the longest message used was 6 entries so this wasn't
+causing any problem. But future Cirrus Logic codecs have downloadable
+firmware or tuning blobs. It is more efficient for the codec driver to
+issue long transfers that can take advantage of any queuing in the
+Soundwire controller and avoid the overhead of repeatedly writing the
+page registers.
+
+Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com>
+Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Fixes: 2f52a5177caa ("soundwire: cdns: Add cadence library")
+Link: https://lore.kernel.org/r/20221202161812.4186897-2-rf@opensource.cirrus.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soundwire/cadence_master.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/soundwire/cadence_master.c b/drivers/soundwire/cadence_master.c
+index a1de363eba3ff..27699f341f2c5 100644
+--- a/drivers/soundwire/cadence_master.c
++++ b/drivers/soundwire/cadence_master.c
+@@ -127,7 +127,8 @@ MODULE_PARM_DESC(cdns_mcp_int_mask, "Cadence MCP IntMask");
+
+ #define CDNS_MCP_CMD_BASE 0x80
+ #define CDNS_MCP_RESP_BASE 0x80
+-#define CDNS_MCP_CMD_LEN 0x20
++/* FIFO can hold 8 commands */
++#define CDNS_MCP_CMD_LEN 8
+ #define CDNS_MCP_CMD_WORD_LEN 0x4
+
+ #define CDNS_MCP_CMD_SSP_TAG BIT(31)
+--
+2.39.2
+
--- /dev/null
+From d774054c1d41f093327345063142fdda04020bd3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 4 Feb 2023 16:43:57 -0800
+Subject: sparc: allow PM configs for sparc32 COMPILE_TEST
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 7be6a87c2473957090995b7eb541e31d57a2c801 ]
+
+When doing randconfig builds for sparc32 with COMPILE_TEST, some
+(non-Sparc) drivers cause kconfig warnings with the Kconfig symbols PM,
+PM_GENERIC_DOMAINS, or PM_GENERIC_DOMAINS_OF.
+
+This is due to arch/sparc/Kconfig not using the PM Kconfig for
+Sparc32:
+
+ if SPARC64
+ source "kernel/power/Kconfig"
+ endif
+
+Arnd suggested adding "|| COMPILE_TEST" to the conditional,
+instead of trying to track down every driver that selects
+any of these PM symbols.
+
+Fixes the following kconfig warnings:
+
+WARNING: unmet direct dependencies detected for PM
+ Depends on [n]: SPARC64 [=n]
+ Selected by [y]:
+ - SUN20I_PPU [=y] && (ARCH_SUNXI || COMPILE_TEST [=y])
+
+WARNING: unmet direct dependencies detected for PM
+ Depends on [n]: SPARC64 [=n]
+ Selected by [y]:
+ - SUN20I_PPU [=y] && (ARCH_SUNXI || COMPILE_TEST [=y])
+
+WARNING: unmet direct dependencies detected for PM_GENERIC_DOMAINS
+ Depends on [n]: SPARC64 [=n] && PM [=y]
+ Selected by [y]:
+ - QCOM_GDSC [=y] && COMMON_CLK [=y] && PM [=y]
+ - SUN20I_PPU [=y] && (ARCH_SUNXI || COMPILE_TEST [=y])
+ - MESON_GX_PM_DOMAINS [=y] && (ARCH_MESON || COMPILE_TEST [=y]) && PM [=y] && OF [=y]
+ - BCM2835_POWER [=y] && (ARCH_BCM2835 || COMPILE_TEST [=y] && OF [=y]) && PM [=y]
+ - BCM_PMB [=y] && (ARCH_BCMBCA || COMPILE_TEST [=y] && OF [=y]) && PM [=y]
+ - ROCKCHIP_PM_DOMAINS [=y] && (ARCH_ROCKCHIP || COMPILE_TEST [=y]) && PM [=y]
+ Selected by [m]:
+ - ARM_SCPI_POWER_DOMAIN [=m] && (ARM_SCPI_PROTOCOL [=m] || COMPILE_TEST [=y] && OF [=y]) && PM [=y]
+ - MESON_EE_PM_DOMAINS [=m] && (ARCH_MESON || COMPILE_TEST [=y]) && PM [=y] && OF [=y]
+ - QCOM_AOSS_QMP [=m] && (ARCH_QCOM || COMPILE_TEST [=y]) && MAILBOX [=y] && COMMON_CLK [=y] && PM [=y]
+
+WARNING: unmet direct dependencies detected for PM_GENERIC_DOMAINS_OF
+ Depends on [n]: SPARC64 [=n] && PM_GENERIC_DOMAINS [=y] && OF [=y]
+ Selected by [y]:
+ - MESON_GX_PM_DOMAINS [=y] && (ARCH_MESON || COMPILE_TEST [=y]) && PM [=y] && OF [=y]
+ Selected by [m]:
+ - MESON_EE_PM_DOMAINS [=m] && (ARCH_MESON || COMPILE_TEST [=y]) && PM [=y] && OF [=y]
+
+Link: https://lkml.kernel.org/r/20230205004357.29459-1-rdunlap@infradead.org
+Fixes: bdde6b3c8ba4 ("sparc64: Hibernation support")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Suggested-by: Arnd Bergmann <arnd@arndb.de>
+Acked-by: Sam Ravnborg <sam@ravnborg.org>
+Cc: "David S. Miller" <davem@davemloft.net>
+Cc: Kirill Tkhai <tkhai@yandex.ru>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig
+index 4d3d1af90d521..84437a4c65454 100644
+--- a/arch/sparc/Kconfig
++++ b/arch/sparc/Kconfig
+@@ -283,7 +283,7 @@ config ARCH_FORCE_MAX_ORDER
+ This config option is actually maximum order plus one. For example,
+ a value of 13 means that the largest free memory block is 2^12 pages.
+
+-if SPARC64
++if SPARC64 || COMPILE_TEST
+ source "kernel/power/Kconfig"
+ endif
+
+--
+2.39.2
+
--- /dev/null
+From a8a67407f1e1f787a2a27ae140a965d7975e2648 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Feb 2023 22:58:17 -0800
+Subject: spi: bcm63xx-hsspi: Endianness fix for ARM based SoC
+
+From: William Zhang <william.zhang@broadcom.com>
+
+[ Upstream commit 85a84a61699990db6a025b5073f337f49933a875 ]
+
+HSSPI controller uses big endian for the opcode in the message to the
+controller ping pong buffer. Use cpu_to_be16 to properly handle the
+endianness for both big and little endian host.
+
+Fixes: 142168eba9dc ("spi: bcm63xx-hsspi: add bcm63xx HSSPI driver")
+Signed-off-by: Kursad Oney <kursad.oney@broadcom.com>
+Signed-off-by: William Zhang <william.zhang@broadcom.com>
+Acked-by: Florian Fainelli <f.fainelli@gmail.com>
+
+Link: https://lore.kernel.org/r/20230207065826.285013-7-william.zhang@broadcom.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-bcm63xx-hsspi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-bcm63xx-hsspi.c b/drivers/spi/spi-bcm63xx-hsspi.c
+index b871fd810d801..a74345ed0e2ff 100644
+--- a/drivers/spi/spi-bcm63xx-hsspi.c
++++ b/drivers/spi/spi-bcm63xx-hsspi.c
+@@ -194,7 +194,7 @@ static int bcm63xx_hsspi_do_txrx(struct spi_device *spi, struct spi_transfer *t)
+ tx += curr_step;
+ }
+
+- __raw_writew(opcode | curr_step, bs->fifo);
++ __raw_writew((u16)cpu_to_be16(opcode | curr_step), bs->fifo);
+
+ /* enable interrupt */
+ __raw_writel(HSSPI_PINGx_CMD_DONE(0),
+--
+2.39.2
+
--- /dev/null
+From 83525bf04985e6c44e56b7ea0697d9330aaae105 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Feb 2023 12:02:41 -0800
+Subject: spi: bcm63xx-hsspi: Fix multi-bit mode setting
+
+From: William Zhang <william.zhang@broadcom.com>
+
+[ Upstream commit 811ff802aaf878ebbbaeac0307a0164fa21e7d40 ]
+
+Currently the driver always sets the controller to dual data bit mode
+for both tx and rx data in the profile mode control register even for
+single data bit transfer. Luckily the opcode is set correctly according
+to SPI transfer data bit width so it does not actually cause issues.
+
+This change fixes the problem by setting tx and rx data bit mode field
+correctly according to the actual SPI transfer tx and rx data bit width.
+
+Fixes: 142168eba9dc ("spi: bcm63xx-hsspi: add bcm63xx HSSPI driver")
+Signed-off-by: William Zhang <william.zhang@broadcom.com>
+Link: https://lore.kernel.org/r/20230209200246.141520-11-william.zhang@broadcom.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-bcm63xx-hsspi.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/spi/spi-bcm63xx-hsspi.c b/drivers/spi/spi-bcm63xx-hsspi.c
+index a74345ed0e2ff..9ec33745c1472 100644
+--- a/drivers/spi/spi-bcm63xx-hsspi.c
++++ b/drivers/spi/spi-bcm63xx-hsspi.c
+@@ -163,6 +163,7 @@ static int bcm63xx_hsspi_do_txrx(struct spi_device *spi, struct spi_transfer *t)
+ int step_size = HSSPI_BUFFER_LEN;
+ const u8 *tx = t->tx_buf;
+ u8 *rx = t->rx_buf;
++ u32 val = 0;
+
+ bcm63xx_hsspi_set_clk(bs, spi, t->speed_hz);
+ bcm63xx_hsspi_set_cs(bs, spi->chip_select, true);
+@@ -178,11 +179,16 @@ static int bcm63xx_hsspi_do_txrx(struct spi_device *spi, struct spi_transfer *t)
+ step_size -= HSSPI_OPCODE_LEN;
+
+ if ((opcode == HSSPI_OP_READ && t->rx_nbits == SPI_NBITS_DUAL) ||
+- (opcode == HSSPI_OP_WRITE && t->tx_nbits == SPI_NBITS_DUAL))
++ (opcode == HSSPI_OP_WRITE && t->tx_nbits == SPI_NBITS_DUAL)) {
+ opcode |= HSSPI_OP_MULTIBIT;
+
+- __raw_writel(1 << MODE_CTRL_MULTIDATA_WR_SIZE_SHIFT |
+- 1 << MODE_CTRL_MULTIDATA_RD_SIZE_SHIFT | 0xff,
++ if (t->rx_nbits == SPI_NBITS_DUAL)
++ val |= 1 << MODE_CTRL_MULTIDATA_RD_SIZE_SHIFT;
++ if (t->tx_nbits == SPI_NBITS_DUAL)
++ val |= 1 << MODE_CTRL_MULTIDATA_WR_SIZE_SHIFT;
++ }
++
++ __raw_writel(val | 0xff,
+ bs->regs + HSSPI_PROFILE_MODE_CTRL_REG(chip_select));
+
+ while (pending > 0) {
+--
+2.39.2
+
--- /dev/null
+From b7a8f2ffdb92103cf1e6e97bb703135737558dc3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Jan 2023 15:01:40 +0100
+Subject: spi: dw_bt1: fix MUX_MMIO dependencies
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit d4bde04318c0d33705e9a77d4c7df72f262011e0 ]
+
+Selecting a symbol with additional dependencies requires
+adding the same dependency here:
+
+WARNING: unmet direct dependencies detected for MUX_MMIO
+ Depends on [n]: MULTIPLEXER [=y] && OF [=n]
+ Selected by [y]:
+ - SPI_DW_BT1 [=y] && SPI [=y] && SPI_MASTER [=y] && SPI_DESIGNWARE [=y] && (MIPS_BAIKAL_T1 || COMPILE_TEST [=y])
+
+Drop the 'select' here to avoid the problem. Anyone using
+the dw-bt1 SPI driver should make sure they include the
+mux driver as well now.
+
+Fixes: 7218838109fe ("spi: dw-bt1: Fix undefined devm_mux_control_get symbol")
+Fixes: abf00907538e ("spi: dw: Add Baikal-T1 SPI Controller glue driver")
+Link: https://lore.kernel.org/all/20221218192523.c6vnfo26ua6xqf26@mobilestation/
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Serge Semin <fancer.lancer@gmail.com>
+Link: https://lore.kernel.org/r/20230130140156.3620863-1-arnd@kernel.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/Kconfig | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/spi/Kconfig b/drivers/spi/Kconfig
+index 3b1c0878bb857..930c6075b78cf 100644
+--- a/drivers/spi/Kconfig
++++ b/drivers/spi/Kconfig
+@@ -295,7 +295,6 @@ config SPI_DW_BT1
+ tristate "Baikal-T1 SPI driver for DW SPI core"
+ depends on MIPS_BAIKAL_T1 || COMPILE_TEST
+ select MULTIPLEXER
+- select MUX_MMIO
+ help
+ Baikal-T1 SoC is equipped with three DW APB SSI-based MMIO SPI
+ controllers. Two of them are pretty much normal: with IRQ, DMA,
+--
+2.39.2
+
--- /dev/null
+From 9cfddeedf09da9bd021481d310b1335d47c649cb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Feb 2023 14:01:28 +0100
+Subject: spi: synquacer: Fix timeout handling in synquacer_spi_transfer_one()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit e6a0b671880207566e1ece983bf989dde60bc1d7 ]
+
+wait_for_completion_timeout() never returns a <0 value. It returns either
+on timeout or a positive value (at least 1, or number of jiffies left
+till timeout)
+
+So, fix the error handling path and return -ETIMEDOUT should a timeout
+occur.
+
+Fixes: b0823ee35cf9 ("spi: Add spi driver for Socionext SynQuacer platform")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Acked-by: Jassi Brar <jaswinder.singh@linaro.org>
+Link: https://lore.kernel.org/r/c2040bf3cfa201fd8890cfab14fa5a701ffeca14.1676466072.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-synquacer.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/spi/spi-synquacer.c b/drivers/spi/spi-synquacer.c
+index 47cbe73137c23..dc188f9202c97 100644
+--- a/drivers/spi/spi-synquacer.c
++++ b/drivers/spi/spi-synquacer.c
+@@ -472,10 +472,9 @@ static int synquacer_spi_transfer_one(struct spi_master *master,
+ read_fifo(sspi);
+ }
+
+- if (status < 0) {
+- dev_err(sspi->dev, "failed to transfer. status: 0x%x\n",
+- status);
+- return status;
++ if (status == 0) {
++ dev_err(sspi->dev, "failed to transfer. Timeout.\n");
++ return -ETIMEDOUT;
+ }
+
+ return 0;
+--
+2.39.2
+
--- /dev/null
+From 1d2a7f9dae801341aa052a179831b77152e866ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 31 Oct 2022 09:52:37 +0800
+Subject: srcu: Delegate work to the boot cpu if using SRCU_SIZE_SMALL
+
+From: Pingfan Liu <kernelfans@gmail.com>
+
+[ Upstream commit 7f24626d6dd844bfc6d1f492d214d29c86d02550 ]
+
+Commit 994f706872e6 ("srcu: Make Tree SRCU able to operate without
+snp_node array") assumes that cpu 0 is always online. However, there
+really are situations when some other CPU is the boot CPU, for example,
+when booting a kdump kernel with the maxcpus=1 boot parameter.
+
+On PowerPC, the kdump kernel can hang as follows:
+...
+[ 1.740036] systemd[1]: Hostname set to <xyz.com>
+[ 243.686240] INFO: task systemd:1 blocked for more than 122 seconds.
+[ 243.686264] Not tainted 6.1.0-rc1 #1
+[ 243.686272] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
+[ 243.686281] task:systemd state:D stack:0 pid:1 ppid:0 flags:0x00042000
+[ 243.686296] Call Trace:
+[ 243.686301] [c000000016657640] [c000000016657670] 0xc000000016657670 (unreliable)
+[ 243.686317] [c000000016657830] [c00000001001dec0] __switch_to+0x130/0x220
+[ 243.686333] [c000000016657890] [c000000010f607b8] __schedule+0x1f8/0x580
+[ 243.686347] [c000000016657940] [c000000010f60bb4] schedule+0x74/0x140
+[ 243.686361] [c0000000166579b0] [c000000010f699b8] schedule_timeout+0x168/0x1c0
+[ 243.686374] [c000000016657a80] [c000000010f61de8] __wait_for_common+0x148/0x360
+[ 243.686387] [c000000016657b20] [c000000010176bb0] __flush_work.isra.0+0x1c0/0x3d0
+[ 243.686401] [c000000016657bb0] [c0000000105f2768] fsnotify_wait_marks_destroyed+0x28/0x40
+[ 243.686415] [c000000016657bd0] [c0000000105f21b8] fsnotify_destroy_group+0x68/0x160
+[ 243.686428] [c000000016657c40] [c0000000105f6500] inotify_release+0x30/0xa0
+[ 243.686440] [c000000016657cb0] [c0000000105751a8] __fput+0xc8/0x350
+[ 243.686452] [c000000016657d00] [c00000001017d524] task_work_run+0xe4/0x170
+[ 243.686464] [c000000016657d50] [c000000010020e94] do_notify_resume+0x134/0x140
+[ 243.686478] [c000000016657d80] [c00000001002eb18] interrupt_exit_user_prepare_main+0x198/0x270
+[ 243.686493] [c000000016657de0] [c00000001002ec60] syscall_exit_prepare+0x70/0x180
+[ 243.686505] [c000000016657e10] [c00000001000bf7c] system_call_vectored_common+0xfc/0x280
+[ 243.686520] --- interrupt: 3000 at 0x7fffa47d5ba4
+[ 243.686528] NIP: 00007fffa47d5ba4 LR: 0000000000000000 CTR: 0000000000000000
+[ 243.686538] REGS: c000000016657e80 TRAP: 3000 Not tainted (6.1.0-rc1)
+[ 243.686548] MSR: 800000000000d033 <SF,EE,PR,ME,IR,DR,RI,LE> CR: 42044440 XER: 00000000
+[ 243.686572] IRQMASK: 0
+[ 243.686572] GPR00: 0000000000000006 00007ffffa606710 00007fffa48e7200 0000000000000000
+[ 243.686572] GPR04: 0000000000000002 000000000000000a 0000000000000000 0000000000000001
+[ 243.686572] GPR08: 000001000c172dd0 0000000000000000 0000000000000000 0000000000000000
+[ 243.686572] GPR12: 0000000000000000 00007fffa4ff4bc0 0000000000000000 0000000000000000
+[ 243.686572] GPR16: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
+[ 243.686572] GPR20: 0000000132dfdc50 000000000000000e 0000000000189375 0000000000000000
+[ 243.686572] GPR24: 00007ffffa606ae0 0000000000000005 000001000c185490 000001000c172570
+[ 243.686572] GPR28: 000001000c172990 000001000c184850 000001000c172e00 00007fffa4fedd98
+[ 243.686683] NIP [00007fffa47d5ba4] 0x7fffa47d5ba4
+[ 243.686691] LR [0000000000000000] 0x0
+[ 243.686698] --- interrupt: 3000
+[ 243.686708] INFO: task kworker/u16:1:24 blocked for more than 122 seconds.
+[ 243.686717] Not tainted 6.1.0-rc1 #1
+[ 243.686724] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
+[ 243.686733] task:kworker/u16:1 state:D stack:0 pid:24 ppid:2 flags:0x00000800
+[ 243.686747] Workqueue: events_unbound fsnotify_mark_destroy_workfn
+[ 243.686758] Call Trace:
+[ 243.686762] [c0000000166736e0] [c00000004fd91000] 0xc00000004fd91000 (unreliable)
+[ 243.686775] [c0000000166738d0] [c00000001001dec0] __switch_to+0x130/0x220
+[ 243.686788] [c000000016673930] [c000000010f607b8] __schedule+0x1f8/0x580
+[ 243.686801] [c0000000166739e0] [c000000010f60bb4] schedule+0x74/0x140
+[ 243.686814] [c000000016673a50] [c000000010f699b8] schedule_timeout+0x168/0x1c0
+[ 243.686827] [c000000016673b20] [c000000010f61de8] __wait_for_common+0x148/0x360
+[ 243.686840] [c000000016673bc0] [c000000010210840] __synchronize_srcu.part.0+0xa0/0xe0
+[ 243.686855] [c000000016673c30] [c0000000105f2c64] fsnotify_mark_destroy_workfn+0xc4/0x1a0
+[ 243.686868] [c000000016673ca0] [c000000010174ea8] process_one_work+0x2a8/0x570
+[ 243.686882] [c000000016673d40] [c000000010175208] worker_thread+0x98/0x5e0
+[ 243.686895] [c000000016673dc0] [c0000000101828d4] kthread+0x124/0x130
+[ 243.686908] [c000000016673e10] [c00000001000cd40] ret_from_kernel_thread+0x5c/0x64
+[ 366.566274] INFO: task systemd:1 blocked for more than 245 seconds.
+[ 366.566298] Not tainted 6.1.0-rc1 #1
+[ 366.566305] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
+[ 366.566314] task:systemd state:D stack:0 pid:1 ppid:0 flags:0x00042000
+[ 366.566329] Call Trace:
+...
+
+The above splat occurs because PowerPC really does use maxcpus=1
+instead of nr_cpus=1 in the kernel command line. Consequently, the
+(quite possibly non-zero) kdump CPU is the only online CPU in the kdump
+kernel. SRCU unconditionally queues a sdp->work on cpu 0, for which no
+worker thread has been created, so sdp->work will be never executed and
+__synchronize_srcu() will never be completed.
+
+This commit therefore replaces CPU ID 0 with get_boot_cpu_id() in key
+places in Tree SRCU. Since the CPU indicated by get_boot_cpu_id()
+is guaranteed to be online, this avoids the above splat.
+
+Signed-off-by: Pingfan Liu <kernelfans@gmail.com>
+Cc: "Paul E. McKenney" <paulmck@kernel.org>
+Cc: Lai Jiangshan <jiangshanlai@gmail.com>
+Cc: Josh Triplett <josh@joshtriplett.org>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+To: rcu@vger.kernel.org
+Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/rcu/srcutree.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/kernel/rcu/srcutree.c b/kernel/rcu/srcutree.c
+index ca4b5dcec675b..16953784a0bdf 100644
+--- a/kernel/rcu/srcutree.c
++++ b/kernel/rcu/srcutree.c
+@@ -726,7 +726,7 @@ static void srcu_gp_start(struct srcu_struct *ssp)
+ int state;
+
+ if (smp_load_acquire(&ssp->srcu_size_state) < SRCU_SIZE_WAIT_BARRIER)
+- sdp = per_cpu_ptr(ssp->sda, 0);
++ sdp = per_cpu_ptr(ssp->sda, get_boot_cpu_id());
+ else
+ sdp = this_cpu_ptr(ssp->sda);
+ lockdep_assert_held(&ACCESS_PRIVATE(ssp, lock));
+@@ -837,7 +837,8 @@ static void srcu_gp_end(struct srcu_struct *ssp)
+ /* Initiate callback invocation as needed. */
+ ss_state = smp_load_acquire(&ssp->srcu_size_state);
+ if (ss_state < SRCU_SIZE_WAIT_BARRIER) {
+- srcu_schedule_cbs_sdp(per_cpu_ptr(ssp->sda, 0), cbdelay);
++ srcu_schedule_cbs_sdp(per_cpu_ptr(ssp->sda, get_boot_cpu_id()),
++ cbdelay);
+ } else {
+ idx = rcu_seq_ctr(gpseq) % ARRAY_SIZE(snp->srcu_have_cbs);
+ srcu_for_each_node_breadth_first(ssp, snp) {
+@@ -1161,7 +1162,7 @@ static unsigned long srcu_gp_start_if_needed(struct srcu_struct *ssp,
+ idx = __srcu_read_lock_nmisafe(ssp);
+ ss_state = smp_load_acquire(&ssp->srcu_size_state);
+ if (ss_state < SRCU_SIZE_WAIT_CALL)
+- sdp = per_cpu_ptr(ssp->sda, 0);
++ sdp = per_cpu_ptr(ssp->sda, get_boot_cpu_id());
+ else
+ sdp = raw_cpu_ptr(ssp->sda);
+ spin_lock_irqsave_sdp_contention(sdp, &flags);
+@@ -1497,7 +1498,7 @@ void srcu_barrier(struct srcu_struct *ssp)
+
+ idx = __srcu_read_lock_nmisafe(ssp);
+ if (smp_load_acquire(&ssp->srcu_size_state) < SRCU_SIZE_WAIT_BARRIER)
+- srcu_barrier_one_cpu(ssp, per_cpu_ptr(ssp->sda, 0));
++ srcu_barrier_one_cpu(ssp, per_cpu_ptr(ssp->sda, get_boot_cpu_id()));
+ else
+ for_each_possible_cpu(cpu)
+ srcu_barrier_one_cpu(ssp, per_cpu_ptr(ssp->sda, cpu));
+--
+2.39.2
+
--- /dev/null
+From be4f432aed1487de611d074078e9a265b7d6185f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Feb 2023 22:42:41 -0600
+Subject: Subject: RDMA/rxe: Handle zero length rdma
+
+From: Bob Pearson <rpearsonhpe@gmail.com>
+
+[ Upstream commit 5ff31dfcd6d23f9c1bd5dd1a2c648ba499659357 ]
+
+Currently the rxe driver does not handle all cases of zero length rdma
+operations correctly. The client does not have to provide an rkey for zero
+length RDMA read or write operations so the rkey provided may be invalid
+and should not be used to lookup an mr.
+
+This patch corrects the driver to ignore the provided rkey if the reth
+length is zero for read or write operations and make sure to set the mr to
+NULL. In read_reply() if length is zero rxe_recheck_mr() is not
+called. Warnings are added in the routines in rxe_mr.c to catch NULL MRs
+when the length is non-zero.
+
+Fixes: 8700e3e7c485 ("Soft RoCE driver")
+Link: https://lore.kernel.org/r/20230202044240.6304-1-rpearsonhpe@gmail.com
+Signed-off-by: Bob Pearson <rpearsonhpe@gmail.com>
+Reviewed-by: Daisuke Matsuda <matsuda-daisuke@fujitsu.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe_mr.c | 7 ++++
+ drivers/infiniband/sw/rxe/rxe_resp.c | 59 +++++++++++++++++++++-------
+ 2 files changed, 51 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_mr.c b/drivers/infiniband/sw/rxe/rxe_mr.c
+index c80458634962c..5e9a03831bf9f 100644
+--- a/drivers/infiniband/sw/rxe/rxe_mr.c
++++ b/drivers/infiniband/sw/rxe/rxe_mr.c
+@@ -314,6 +314,9 @@ int rxe_mr_copy(struct rxe_mr *mr, u64 iova, void *addr,
+ if (length == 0)
+ return 0;
+
++ if (WARN_ON(!mr))
++ return -EINVAL;
++
+ if (mr->ibmr.type == IB_MR_TYPE_DMA) {
+ rxe_mr_copy_dma(mr, iova, addr, length, dir);
+ return 0;
+@@ -432,6 +435,10 @@ int rxe_flush_pmem_iova(struct rxe_mr *mr, u64 iova, unsigned int length)
+ int err;
+ u8 *va;
+
++ /* mr must be valid even if length is zero */
++ if (WARN_ON(!mr))
++ return -EINVAL;
++
+ if (length == 0)
+ return 0;
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_resp.c b/drivers/infiniband/sw/rxe/rxe_resp.c
+index cd2d88de287ca..0cc1ba91d48cc 100644
+--- a/drivers/infiniband/sw/rxe/rxe_resp.c
++++ b/drivers/infiniband/sw/rxe/rxe_resp.c
+@@ -420,13 +420,23 @@ static enum resp_states rxe_resp_check_length(struct rxe_qp *qp,
+ return RESPST_CHK_RKEY;
+ }
+
++/* if the reth length field is zero we can assume nothing
++ * about the rkey value and should not validate or use it.
++ * Instead set qp->resp.rkey to 0 which is an invalid rkey
++ * value since the minimum index part is 1.
++ */
+ static void qp_resp_from_reth(struct rxe_qp *qp, struct rxe_pkt_info *pkt)
+ {
++ unsigned int length = reth_len(pkt);
++
+ qp->resp.va = reth_va(pkt);
+ qp->resp.offset = 0;
+- qp->resp.rkey = reth_rkey(pkt);
+- qp->resp.resid = reth_len(pkt);
+- qp->resp.length = reth_len(pkt);
++ qp->resp.resid = length;
++ qp->resp.length = length;
++ if (pkt->mask & RXE_READ_OR_WRITE_MASK && length == 0)
++ qp->resp.rkey = 0;
++ else
++ qp->resp.rkey = reth_rkey(pkt);
+ }
+
+ static void qp_resp_from_atmeth(struct rxe_qp *qp, struct rxe_pkt_info *pkt)
+@@ -437,6 +447,10 @@ static void qp_resp_from_atmeth(struct rxe_qp *qp, struct rxe_pkt_info *pkt)
+ qp->resp.resid = sizeof(u64);
+ }
+
++/* resolve the packet rkey to qp->resp.mr or set qp->resp.mr to NULL
++ * if an invalid rkey is received or the rdma length is zero. For middle
++ * or last packets use the stored value of mr.
++ */
+ static enum resp_states check_rkey(struct rxe_qp *qp,
+ struct rxe_pkt_info *pkt)
+ {
+@@ -473,10 +487,12 @@ static enum resp_states check_rkey(struct rxe_qp *qp,
+ return RESPST_EXECUTE;
+ }
+
+- /* A zero-byte op is not required to set an addr or rkey. See C9-88 */
++ /* A zero-byte read or write op is not required to
++ * set an addr or rkey. See C9-88
++ */
+ if ((pkt->mask & RXE_READ_OR_WRITE_MASK) &&
+- (pkt->mask & RXE_RETH_MASK) &&
+- reth_len(pkt) == 0) {
++ (pkt->mask & RXE_RETH_MASK) && reth_len(pkt) == 0) {
++ qp->resp.mr = NULL;
+ return RESPST_EXECUTE;
+ }
+
+@@ -555,6 +571,7 @@ static enum resp_states check_rkey(struct rxe_qp *qp,
+ return RESPST_EXECUTE;
+
+ err:
++ qp->resp.mr = NULL;
+ if (mr)
+ rxe_put(mr);
+ if (mw)
+@@ -885,7 +902,11 @@ static enum resp_states read_reply(struct rxe_qp *qp,
+ }
+
+ if (res->state == rdatm_res_state_new) {
+- if (!res->replay) {
++ if (!res->replay || qp->resp.length == 0) {
++ /* if length == 0 mr will be NULL (is ok)
++ * otherwise qp->resp.mr holds a ref on mr
++ * which we transfer to mr and drop below.
++ */
+ mr = qp->resp.mr;
+ qp->resp.mr = NULL;
+ } else {
+@@ -899,6 +920,10 @@ static enum resp_states read_reply(struct rxe_qp *qp,
+ else
+ opcode = IB_OPCODE_RC_RDMA_READ_RESPONSE_FIRST;
+ } else {
++ /* re-lookup mr from rkey on all later packets.
++ * length will be non-zero. This can fail if someone
++ * modifies or destroys the mr since the first packet.
++ */
+ mr = rxe_recheck_mr(qp, res->read.rkey);
+ if (!mr)
+ return RESPST_ERR_RKEY_VIOLATION;
+@@ -916,18 +941,16 @@ static enum resp_states read_reply(struct rxe_qp *qp,
+ skb = prepare_ack_packet(qp, &ack_pkt, opcode, payload,
+ res->cur_psn, AETH_ACK_UNLIMITED);
+ if (!skb) {
+- if (mr)
+- rxe_put(mr);
+- return RESPST_ERR_RNR;
++ state = RESPST_ERR_RNR;
++ goto err_out;
+ }
+
+ err = rxe_mr_copy(mr, res->read.va, payload_addr(&ack_pkt),
+ payload, RXE_FROM_MR_OBJ);
+- if (mr)
+- rxe_put(mr);
+ if (err) {
+ kfree_skb(skb);
+- return RESPST_ERR_RKEY_VIOLATION;
++ state = RESPST_ERR_RKEY_VIOLATION;
++ goto err_out;
+ }
+
+ if (bth_pad(&ack_pkt)) {
+@@ -936,9 +959,12 @@ static enum resp_states read_reply(struct rxe_qp *qp,
+ memset(pad, 0, bth_pad(&ack_pkt));
+ }
+
++ /* rxe_xmit_packet always consumes the skb */
+ err = rxe_xmit_packet(qp, &ack_pkt, skb);
+- if (err)
+- return RESPST_ERR_RNR;
++ if (err) {
++ state = RESPST_ERR_RNR;
++ goto err_out;
++ }
+
+ res->read.va += payload;
+ res->read.resid -= payload;
+@@ -955,6 +981,9 @@ static enum resp_states read_reply(struct rxe_qp *qp,
+ state = RESPST_CLEANUP;
+ }
+
++err_out:
++ if (mr)
++ rxe_put(mr);
+ return state;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From fd06e8e2000632099bc291230fb396a545adf5f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Feb 2023 15:58:23 +0100
+Subject: sysctl: fix proc_dobool() usability
+
+From: Ondrej Mosnacek <omosnace@redhat.com>
+
+[ Upstream commit f1aa2eb5ea05ccd1fd92d235346e60e90a1ed949 ]
+
+Currently proc_dobool expects a (bool *) in table->data, but sizeof(int)
+in table->maxsize, because it uses do_proc_dointvec() directly.
+
+This is unsafe for at least two reasons:
+1. A sysctl table definition may use { .data = &variable, .maxsize =
+ sizeof(variable) }, not realizing that this makes the sysctl unusable
+ (see the Fixes: tag) and that they need to use the completely
+ counterintuitive sizeof(int) instead.
+2. proc_dobool() will currently try to parse an array of values if given
+ .maxsize >= 2*sizeof(int), but will try to write values of type bool
+ by offsets of sizeof(int), so it will not work correctly with neither
+ an (int *) nor a (bool *). There is no .maxsize validation to prevent
+ this.
+
+Fix this by:
+1. Constraining proc_dobool() to allow only one value and .maxsize ==
+ sizeof(bool).
+2. Wrapping the original struct ctl_table in a temporary one with .data
+ pointing to a local int variable and .maxsize set to sizeof(int) and
+ passing this one to proc_dointvec(), converting the value to/from
+ bool as needed (using proc_dou8vec_minmax() as an example).
+3. Extending sysctl_check_table() to enforce proc_dobool() expectations.
+4. Fixing the proc_dobool() docstring (it was just copy-pasted from
+ proc_douintvec, apparently...).
+5. Converting all existing proc_dobool() users to set .maxsize to
+ sizeof(bool) instead of sizeof(int).
+
+Fixes: 83efeeeb3d04 ("tty: Allow TIOCSTI to be disabled")
+Fixes: a2071573d634 ("sysctl: introduce new proc handler proc_dobool")
+Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
+Acked-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Luis Chamberlain <mcgrof@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/lockd/svc.c | 2 +-
+ fs/proc/proc_sysctl.c | 6 ++++++
+ kernel/sysctl.c | 43 ++++++++++++++++++++++++-------------------
+ mm/hugetlb_vmemmap.c | 2 +-
+ 4 files changed, 32 insertions(+), 21 deletions(-)
+
+diff --git a/fs/lockd/svc.c b/fs/lockd/svc.c
+index 59ef8a1f843f3..914ea1c3537d1 100644
+--- a/fs/lockd/svc.c
++++ b/fs/lockd/svc.c
+@@ -496,7 +496,7 @@ static struct ctl_table nlm_sysctls[] = {
+ {
+ .procname = "nsm_use_hostnames",
+ .data = &nsm_use_hostnames,
+- .maxlen = sizeof(int),
++ .maxlen = sizeof(bool),
+ .mode = 0644,
+ .proc_handler = proc_dobool,
+ },
+diff --git a/fs/proc/proc_sysctl.c b/fs/proc/proc_sysctl.c
+index 48f2d60bd78a2..436025e0f77a6 100644
+--- a/fs/proc/proc_sysctl.c
++++ b/fs/proc/proc_sysctl.c
+@@ -1124,6 +1124,11 @@ static int sysctl_check_table_array(const char *path, struct ctl_table *table)
+ err |= sysctl_err(path, table, "array not allowed");
+ }
+
++ if (table->proc_handler == proc_dobool) {
++ if (table->maxlen != sizeof(bool))
++ err |= sysctl_err(path, table, "array not allowed");
++ }
++
+ return err;
+ }
+
+@@ -1136,6 +1141,7 @@ static int sysctl_check_table(const char *path, struct ctl_table *table)
+ err |= sysctl_err(path, entry, "Not a file");
+
+ if ((entry->proc_handler == proc_dostring) ||
++ (entry->proc_handler == proc_dobool) ||
+ (entry->proc_handler == proc_dointvec) ||
+ (entry->proc_handler == proc_douintvec) ||
+ (entry->proc_handler == proc_douintvec_minmax) ||
+diff --git a/kernel/sysctl.c b/kernel/sysctl.c
+index 137d4abe3eda1..1c240d2c99bcb 100644
+--- a/kernel/sysctl.c
++++ b/kernel/sysctl.c
+@@ -425,21 +425,6 @@ static void proc_put_char(void **buf, size_t *size, char c)
+ }
+ }
+
+-static int do_proc_dobool_conv(bool *negp, unsigned long *lvalp,
+- int *valp,
+- int write, void *data)
+-{
+- if (write) {
+- *(bool *)valp = *lvalp;
+- } else {
+- int val = *(bool *)valp;
+-
+- *lvalp = (unsigned long)val;
+- *negp = false;
+- }
+- return 0;
+-}
+-
+ static int do_proc_dointvec_conv(bool *negp, unsigned long *lvalp,
+ int *valp,
+ int write, void *data)
+@@ -710,16 +695,36 @@ int do_proc_douintvec(struct ctl_table *table, int write,
+ * @lenp: the size of the user buffer
+ * @ppos: file position
+ *
+- * Reads/writes up to table->maxlen/sizeof(unsigned int) integer
+- * values from/to the user buffer, treated as an ASCII string.
++ * Reads/writes one integer value from/to the user buffer,
++ * treated as an ASCII string.
++ *
++ * table->data must point to a bool variable and table->maxlen must
++ * be sizeof(bool).
+ *
+ * Returns 0 on success.
+ */
+ int proc_dobool(struct ctl_table *table, int write, void *buffer,
+ size_t *lenp, loff_t *ppos)
+ {
+- return do_proc_dointvec(table, write, buffer, lenp, ppos,
+- do_proc_dobool_conv, NULL);
++ struct ctl_table tmp;
++ bool *data = table->data;
++ int res, val;
++
++ /* Do not support arrays yet. */
++ if (table->maxlen != sizeof(bool))
++ return -EINVAL;
++
++ tmp = *table;
++ tmp.maxlen = sizeof(val);
++ tmp.data = &val;
++
++ val = READ_ONCE(*data);
++ res = proc_dointvec(&tmp, write, buffer, lenp, ppos);
++ if (res)
++ return res;
++ if (write)
++ WRITE_ONCE(*data, val);
++ return 0;
+ }
+
+ /**
+diff --git a/mm/hugetlb_vmemmap.c b/mm/hugetlb_vmemmap.c
+index 45e93a545dd7e..a559037cce00c 100644
+--- a/mm/hugetlb_vmemmap.c
++++ b/mm/hugetlb_vmemmap.c
+@@ -581,7 +581,7 @@ static struct ctl_table hugetlb_vmemmap_sysctls[] = {
+ {
+ .procname = "hugetlb_optimize_vmemmap",
+ .data = &vmemmap_optimize_enabled,
+- .maxlen = sizeof(int),
++ .maxlen = sizeof(vmemmap_optimize_enabled),
+ .mode = 0644,
+ .proc_handler = proc_dobool,
+ },
+--
+2.39.2
+
--- /dev/null
+From 86422e17534a7dae991d13d5f3f0b20e11160d8b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 4 Feb 2023 17:39:22 +0000
+Subject: tap: tap_open(): correctly initialize socket uid
+
+From: Pietro Borrello <borrello@diag.uniroma1.it>
+
+[ Upstream commit 66b2c338adce580dfce2199591e65e2bab889cff ]
+
+sock_init_data() assumes that the `struct socket` passed in input is
+contained in a `struct socket_alloc` allocated with sock_alloc().
+However, tap_open() passes a `struct socket` embedded in a `struct
+tap_queue` allocated with sk_alloc().
+This causes a type confusion when issuing a container_of() with
+SOCK_INODE() in sock_init_data() which results in assigning a wrong
+sk_uid to the `struct sock` in input.
+On default configuration, the type confused field overlaps with
+padding bytes between `int vnet_hdr_sz` and `struct tap_dev __rcu
+*tap` in `struct tap_queue`, which makes the uid of all tap sockets 0,
+i.e., the root one.
+Fix the assignment by using sock_init_data_uid().
+
+Fixes: 86741ec25462 ("net: core: Add a UID field to struct sock.")
+Signed-off-by: Pietro Borrello <borrello@diag.uniroma1.it>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/tap.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/tap.c b/drivers/net/tap.c
+index a2be1994b3894..8941aa199ea33 100644
+--- a/drivers/net/tap.c
++++ b/drivers/net/tap.c
+@@ -533,7 +533,7 @@ static int tap_open(struct inode *inode, struct file *file)
+ q->sock.state = SS_CONNECTED;
+ q->sock.file = file;
+ q->sock.ops = &tap_socket_ops;
+- sock_init_data(&q->sock, &q->sk);
++ sock_init_data_uid(&q->sock, &q->sk, inode->i_uid);
+ q->sk.sk_write_space = tap_sock_write_space;
+ q->sk.sk_destruct = tap_sock_destruct;
+ q->flags = IFF_VNET_HDR | IFF_NO_PI | IFF_TAP;
+--
+2.39.2
+
--- /dev/null
+From 9e6e2b877d1b9c97faef3fe28d0235b28f736c77 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Feb 2023 22:15:07 +0800
+Subject: thermal/drivers/hisi: Drop second sensor hi3660
+
+From: Yongqin Liu <yongqin.liu@linaro.org>
+
+[ Upstream commit 15cc25829a97c3957e520e971868aacc84341317 ]
+
+The commit 74c8e6bffbe1 ("driver core: Add __alloc_size hint to devm
+allocators") exposes a panic "BRK handler: Fatal exception" on the
+hi3660_thermal_probe funciton.
+This is because the function allocates memory for only one
+sensors array entry, but tries to fill up a second one.
+
+Fix this by removing the unneeded second access.
+
+Fixes: 7d3a2a2bbadb ("thermal/drivers/hisi: Fix number of sensors on hi3660")
+Signed-off-by: Yongqin Liu <yongqin.liu@linaro.org>
+Link: https://lore.kernel.org/linux-mm/20221101223321.1326815-5-keescook@chromium.org/
+Link: https://lore.kernel.org/r/20230210141507.71014-1-yongqin.liu@linaro.org
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/thermal/hisi_thermal.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/drivers/thermal/hisi_thermal.c b/drivers/thermal/hisi_thermal.c
+index d6974db7aaf76..15af90f5c7d91 100644
+--- a/drivers/thermal/hisi_thermal.c
++++ b/drivers/thermal/hisi_thermal.c
+@@ -427,10 +427,6 @@ static int hi3660_thermal_probe(struct hisi_thermal_data *data)
+ data->sensor[0].irq_name = "tsensor_a73";
+ data->sensor[0].data = data;
+
+- data->sensor[1].id = HI3660_LITTLE_SENSOR;
+- data->sensor[1].irq_name = "tsensor_a53";
+- data->sensor[1].data = data;
+-
+ return 0;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 1f34641e4609b282fb14eb8f7bc8db50afd37faa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Jan 2023 11:19:55 +0200
+Subject: thermal/drivers/imx_sc_thermal: Fix the loop condition
+
+From: Viorel Suman <viorel.suman@nxp.com>
+
+[ Upstream commit 4b26b7c9cdefdcb478047c30901d2379ef9e50fc ]
+
+The minimal resource ID is 0: IMX_SC_R_AP_0=0, so fix
+the loop condition. Aside of this - constify the array.
+
+Fixes: 31fd4b9db13b ("thermal/drivers/imx_sc: Rely on the platform data to get the resource id")
+Signed-off-by: Viorel Suman <viorel.suman@nxp.com>
+Reviewed-by: Dong Aisheng <Aisheng.dong@nxp.com>
+Link: https://lore.kernel.org/r/20230117091956.61729-1-viorel.suman@oss.nxp.com
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/thermal/imx_sc_thermal.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/thermal/imx_sc_thermal.c b/drivers/thermal/imx_sc_thermal.c
+index 4df925e3a80bd..dfadb03580ae1 100644
+--- a/drivers/thermal/imx_sc_thermal.c
++++ b/drivers/thermal/imx_sc_thermal.c
+@@ -88,7 +88,7 @@ static int imx_sc_thermal_probe(struct platform_device *pdev)
+ if (!resource_id)
+ return -EINVAL;
+
+- for (i = 0; resource_id[i] > 0; i++) {
++ for (i = 0; resource_id[i] >= 0; i++) {
+
+ sensor = devm_kzalloc(&pdev->dev, sizeof(*sensor), GFP_KERNEL);
+ if (!sensor)
+@@ -127,7 +127,7 @@ static int imx_sc_thermal_probe(struct platform_device *pdev)
+ return 0;
+ }
+
+-static int imx_sc_sensors[] = { IMX_SC_R_SYSTEM, IMX_SC_R_PMIC_0, -1 };
++static const int imx_sc_sensors[] = { IMX_SC_R_SYSTEM, IMX_SC_R_PMIC_0, -1 };
+
+ static const struct of_device_id imx_sc_thermal_table[] = {
+ { .compatible = "fsl,imx-sc-thermal", .data = imx_sc_sensors },
+--
+2.39.2
+
--- /dev/null
+From 5e123eea5b6f34b57dfba1ea7218bddca897ed83 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 1 Jan 2023 21:40:19 +0200
+Subject: thermal/drivers/tsens: Drop msm8976-specific defines
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit 3bf0ea99e2e32b0335106b86d84404cc85bcd113 ]
+
+Drop msm8976-specific defines, which duplicate generic ones.
+
+Fixes: 0e580290170d ("thermal: qcom: tsens-v1: Add support for MSM8956 and MSM8976")
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/20230101194034.831222-6-dmitry.baryshkov@linaro.org
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/thermal/qcom/tsens-v1.c | 9 ++-------
+ 1 file changed, 2 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/thermal/qcom/tsens-v1.c b/drivers/thermal/qcom/tsens-v1.c
+index 1d7f8a80bd13a..a795b08bb017e 100644
+--- a/drivers/thermal/qcom/tsens-v1.c
++++ b/drivers/thermal/qcom/tsens-v1.c
+@@ -78,11 +78,6 @@
+
+ #define MSM8976_CAL_SEL_MASK 0x3
+
+-#define MSM8976_CAL_DEGC_PT1 30
+-#define MSM8976_CAL_DEGC_PT2 120
+-#define MSM8976_SLOPE_FACTOR 1000
+-#define MSM8976_SLOPE_DEFAULT 3200
+-
+ /* eeprom layout data for qcs404/405 (v1) */
+ #define BASE0_MASK 0x000007f8
+ #define BASE1_MASK 0x0007f800
+@@ -160,8 +155,8 @@ static void compute_intercept_slope_8976(struct tsens_priv *priv,
+ priv->sensor[10].slope = 3286;
+
+ for (i = 0; i < priv->num_sensors; i++) {
+- priv->sensor[i].offset = (p1[i] * MSM8976_SLOPE_FACTOR) -
+- (MSM8976_CAL_DEGC_PT1 *
++ priv->sensor[i].offset = (p1[i] * SLOPE_FACTOR) -
++ (CAL_DEGC_PT1 *
+ priv->sensor[i].slope);
+ }
+ }
+--
+2.39.2
+
--- /dev/null
+From 52130939da4d11582a3025df709d508acf99c7ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 1 Jan 2023 21:40:21 +0200
+Subject: thermal/drivers/tsens: fix slope values for msm8939
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit 5aec3b035e0cbf3f042c2a03d654e5ad6748feb7 ]
+
+According to the vendor kernels (msm-3.10, 3.14 and 3.18), msm8939
+uses non-standard slope values for calibrating the sensors. Fill them
+accordingly.
+
+Fixes: 332bc8ebab2c ("thermal: qcom: tsens-v0_1: Add support for MSM8939")
+Cc: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Cc: Shawn Guo <shawn.guo@linaro.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Acked-by: Shawn Guo <shawn.guo@linaro.org>
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Link: https://lore.kernel.org/r/20230101194034.831222-8-dmitry.baryshkov@linaro.org
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/thermal/qcom/tsens-v0_1.c | 17 ++++++++++++++++-
+ 1 file changed, 16 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/thermal/qcom/tsens-v0_1.c b/drivers/thermal/qcom/tsens-v0_1.c
+index 04d012e4f7288..af2659037f010 100644
+--- a/drivers/thermal/qcom/tsens-v0_1.c
++++ b/drivers/thermal/qcom/tsens-v0_1.c
+@@ -534,6 +534,21 @@ static int calibrate_9607(struct tsens_priv *priv)
+ return 0;
+ }
+
++static int __init init_8939(struct tsens_priv *priv) {
++ priv->sensor[0].slope = 2911;
++ priv->sensor[1].slope = 2789;
++ priv->sensor[2].slope = 2906;
++ priv->sensor[3].slope = 2763;
++ priv->sensor[4].slope = 2922;
++ priv->sensor[5].slope = 2867;
++ priv->sensor[6].slope = 2833;
++ priv->sensor[7].slope = 2838;
++ priv->sensor[8].slope = 2840;
++ priv->sensor[9].slope = 2852;
++
++ return init_common(priv);
++}
++
+ /* v0.1: 8916, 8939, 8974, 9607 */
+
+ static struct tsens_features tsens_v0_1_feat = {
+@@ -599,7 +614,7 @@ struct tsens_plat_data data_8916 = {
+ };
+
+ static const struct tsens_ops ops_8939 = {
+- .init = init_common,
++ .init = init_8939,
+ .calibrate = calibrate_8939,
+ .get_temp = get_temp_common,
+ };
+--
+2.39.2
+
--- /dev/null
+From 817f91430b57b2e4b20a5d0a5e4773d16326e525 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 1 Jan 2023 21:40:22 +0200
+Subject: thermal/drivers/tsens: limit num_sensors to 9 for msm8939
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit 903238a33c116edf5f64f7a3fd246e6169cccfa6 ]
+
+On msm8939 last (hwid=10) sensor was added in the hw revision 3.0.
+Calibration data for it was placed outside of the main calibration data
+blob, so it is not accessible by the current blob-parsing code.
+
+Moreover data for the sensor's p2 is not contiguous in the fuses. This
+makes it hard to use nvmem_cell API to parse calibration data in a
+generic way.
+
+Since the sensor doesn't seem to be actually used by the existing
+hardware, disable the sensor for now.
+
+Fixes: 332bc8ebab2c ("thermal: qcom: tsens-v0_1: Add support for MSM8939")
+Cc: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Cc: Shawn Guo <shawn.guo@linaro.org>
+Acked-by: Shawn Guo <shawn.guo@linaro.org>
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Link: https://lore.kernel.org/r/20230101194034.831222-9-dmitry.baryshkov@linaro.org
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/thermal/qcom/tsens-v0_1.c | 13 ++++---------
+ 1 file changed, 4 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/thermal/qcom/tsens-v0_1.c b/drivers/thermal/qcom/tsens-v0_1.c
+index af2659037f010..3158f13c54305 100644
+--- a/drivers/thermal/qcom/tsens-v0_1.c
++++ b/drivers/thermal/qcom/tsens-v0_1.c
+@@ -285,7 +285,7 @@ static int calibrate_8939(struct tsens_priv *priv)
+ u32 p1[10], p2[10];
+ int mode = 0;
+ u32 *qfprom_cdata;
+- u32 cdata[6];
++ u32 cdata[4];
+
+ qfprom_cdata = (u32 *)qfprom_read(priv->dev, "calib");
+ if (IS_ERR(qfprom_cdata))
+@@ -296,8 +296,6 @@ static int calibrate_8939(struct tsens_priv *priv)
+ cdata[1] = qfprom_cdata[13];
+ cdata[2] = qfprom_cdata[0];
+ cdata[3] = qfprom_cdata[1];
+- cdata[4] = qfprom_cdata[22];
+- cdata[5] = qfprom_cdata[21];
+
+ mode = (cdata[0] & MSM8939_CAL_SEL_MASK) >> MSM8939_CAL_SEL_SHIFT;
+ dev_dbg(priv->dev, "calibration mode is %d\n", mode);
+@@ -314,8 +312,6 @@ static int calibrate_8939(struct tsens_priv *priv)
+ p2[6] = (cdata[2] & MSM8939_S6_P2_MASK) >> MSM8939_S6_P2_SHIFT;
+ p2[7] = (cdata[3] & MSM8939_S7_P2_MASK) >> MSM8939_S7_P2_SHIFT;
+ p2[8] = (cdata[3] & MSM8939_S8_P2_MASK) >> MSM8939_S8_P2_SHIFT;
+- p2[9] = (cdata[4] & MSM8939_S9_P2_MASK_0_4) >> MSM8939_S9_P2_SHIFT_0_4;
+- p2[9] |= ((cdata[5] & MSM8939_S9_P2_MASK_5) >> MSM8939_S9_P2_SHIFT_5) << 5;
+ for (i = 0; i < priv->num_sensors; i++)
+ p2[i] = (base1 + p2[i]) << 2;
+ fallthrough;
+@@ -331,7 +327,6 @@ static int calibrate_8939(struct tsens_priv *priv)
+ p1[6] = (cdata[2] & MSM8939_S6_P1_MASK) >> MSM8939_S6_P1_SHIFT;
+ p1[7] = (cdata[3] & MSM8939_S7_P1_MASK) >> MSM8939_S7_P1_SHIFT;
+ p1[8] = (cdata[3] & MSM8939_S8_P1_MASK) >> MSM8939_S8_P1_SHIFT;
+- p1[9] = (cdata[4] & MSM8939_S9_P1_MASK) >> MSM8939_S9_P1_SHIFT;
+ for (i = 0; i < priv->num_sensors; i++)
+ p1[i] = ((base0) + p1[i]) << 2;
+ break;
+@@ -544,7 +539,7 @@ static int __init init_8939(struct tsens_priv *priv) {
+ priv->sensor[6].slope = 2833;
+ priv->sensor[7].slope = 2838;
+ priv->sensor[8].slope = 2840;
+- priv->sensor[9].slope = 2852;
++ /* priv->sensor[9].slope = 2852; */
+
+ return init_common(priv);
+ }
+@@ -620,9 +615,9 @@ static const struct tsens_ops ops_8939 = {
+ };
+
+ struct tsens_plat_data data_8939 = {
+- .num_sensors = 10,
++ .num_sensors = 9,
+ .ops = &ops_8939,
+- .hw_ids = (unsigned int []){ 0, 1, 2, 3, 5, 6, 7, 8, 9, 10 },
++ .hw_ids = (unsigned int []){ 0, 1, 2, 3, 5, 6, 7, 8, 9, /* 10 */ },
+
+ .feat = &tsens_v0_1_feat,
+ .fields = tsens_v0_1_regfields,
+--
+2.39.2
+
--- /dev/null
+From c609c69195e8886e754c3d5ec4d2f8a4c06d4040 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 1 Jan 2023 21:40:20 +0200
+Subject: thermal/drivers/tsens: Sort out msm8976 vs msm8956 data
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit a7d3006be5ca7b04e4b84b5ceaae55a700e511bd ]
+
+Tsens driver mentions that msm8976 data should be used for both msm8976
+and msm8956 SoCs. This is not quite correct, as according to the
+vendor kernels, msm8976 should use standard slope values (3200), while
+msm8956 really uses the slope values found in the driver.
+
+Add separate compatibility string for msm8956, move slope value
+overrides to the corresponding init function and use the standard
+compute_intercept_slope() function for both platforms.
+
+Fixes: 0e580290170d ("thermal: qcom: tsens-v1: Add support for MSM8956 and MSM8976")
+Cc: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/20230101194034.831222-7-dmitry.baryshkov@linaro.org
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/thermal/qcom/tsens-v1.c | 56 ++++++++++++++++++---------------
+ drivers/thermal/qcom/tsens.c | 3 ++
+ drivers/thermal/qcom/tsens.h | 2 +-
+ 3 files changed, 34 insertions(+), 27 deletions(-)
+
+diff --git a/drivers/thermal/qcom/tsens-v1.c b/drivers/thermal/qcom/tsens-v1.c
+index a795b08bb017e..9c443a2fb32ca 100644
+--- a/drivers/thermal/qcom/tsens-v1.c
++++ b/drivers/thermal/qcom/tsens-v1.c
+@@ -137,30 +137,6 @@
+ #define CAL_SEL_MASK 7
+ #define CAL_SEL_SHIFT 0
+
+-static void compute_intercept_slope_8976(struct tsens_priv *priv,
+- u32 *p1, u32 *p2, u32 mode)
+-{
+- int i;
+-
+- priv->sensor[0].slope = 3313;
+- priv->sensor[1].slope = 3275;
+- priv->sensor[2].slope = 3320;
+- priv->sensor[3].slope = 3246;
+- priv->sensor[4].slope = 3279;
+- priv->sensor[5].slope = 3257;
+- priv->sensor[6].slope = 3234;
+- priv->sensor[7].slope = 3269;
+- priv->sensor[8].slope = 3255;
+- priv->sensor[9].slope = 3239;
+- priv->sensor[10].slope = 3286;
+-
+- for (i = 0; i < priv->num_sensors; i++) {
+- priv->sensor[i].offset = (p1[i] * SLOPE_FACTOR) -
+- (CAL_DEGC_PT1 *
+- priv->sensor[i].slope);
+- }
+-}
+-
+ static int calibrate_v1(struct tsens_priv *priv)
+ {
+ u32 base0 = 0, base1 = 0;
+@@ -286,7 +262,7 @@ static int calibrate_8976(struct tsens_priv *priv)
+ break;
+ }
+
+- compute_intercept_slope_8976(priv, p1, p2, mode);
++ compute_intercept_slope(priv, p1, p2, mode);
+ kfree(qfprom_cdata);
+
+ return 0;
+@@ -360,6 +336,22 @@ static const struct reg_field tsens_v1_regfields[MAX_REGFIELDS] = {
+ [TRDY] = REG_FIELD(TM_TRDY_OFF, 0, 0),
+ };
+
++static int __init init_8956(struct tsens_priv *priv) {
++ priv->sensor[0].slope = 3313;
++ priv->sensor[1].slope = 3275;
++ priv->sensor[2].slope = 3320;
++ priv->sensor[3].slope = 3246;
++ priv->sensor[4].slope = 3279;
++ priv->sensor[5].slope = 3257;
++ priv->sensor[6].slope = 3234;
++ priv->sensor[7].slope = 3269;
++ priv->sensor[8].slope = 3255;
++ priv->sensor[9].slope = 3239;
++ priv->sensor[10].slope = 3286;
++
++ return init_common(priv);
++}
++
+ static const struct tsens_ops ops_generic_v1 = {
+ .init = init_common,
+ .calibrate = calibrate_v1,
+@@ -372,13 +364,25 @@ struct tsens_plat_data data_tsens_v1 = {
+ .fields = tsens_v1_regfields,
+ };
+
++static const struct tsens_ops ops_8956 = {
++ .init = init_8956,
++ .calibrate = calibrate_8976,
++ .get_temp = get_temp_tsens_valid,
++};
++
++struct tsens_plat_data data_8956 = {
++ .num_sensors = 11,
++ .ops = &ops_8956,
++ .feat = &tsens_v1_feat,
++ .fields = tsens_v1_regfields,
++};
++
+ static const struct tsens_ops ops_8976 = {
+ .init = init_common,
+ .calibrate = calibrate_8976,
+ .get_temp = get_temp_tsens_valid,
+ };
+
+-/* Valid for both MSM8956 and MSM8976. */
+ struct tsens_plat_data data_8976 = {
+ .num_sensors = 11,
+ .ops = &ops_8976,
+diff --git a/drivers/thermal/qcom/tsens.c b/drivers/thermal/qcom/tsens.c
+index b5b136ff323f9..b191e19df93dc 100644
+--- a/drivers/thermal/qcom/tsens.c
++++ b/drivers/thermal/qcom/tsens.c
+@@ -983,6 +983,9 @@ static const struct of_device_id tsens_table[] = {
+ }, {
+ .compatible = "qcom,msm8939-tsens",
+ .data = &data_8939,
++ }, {
++ .compatible = "qcom,msm8956-tsens",
++ .data = &data_8956,
+ }, {
+ .compatible = "qcom,msm8960-tsens",
+ .data = &data_8960,
+diff --git a/drivers/thermal/qcom/tsens.h b/drivers/thermal/qcom/tsens.h
+index 899af128855f7..7dd5fc2468945 100644
+--- a/drivers/thermal/qcom/tsens.h
++++ b/drivers/thermal/qcom/tsens.h
+@@ -594,7 +594,7 @@ extern struct tsens_plat_data data_8960;
+ extern struct tsens_plat_data data_8916, data_8939, data_8974, data_9607;
+
+ /* TSENS v1 targets */
+-extern struct tsens_plat_data data_tsens_v1, data_8976;
++extern struct tsens_plat_data data_tsens_v1, data_8976, data_8956;
+
+ /* TSENS v2 targets */
+ extern struct tsens_plat_data data_8996, data_ipq8074, data_tsens_v2;
+--
+2.39.2
+
--- /dev/null
+From bcc752bc743b4b5abce162c8e180e596bfb02e74 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Jan 2023 08:59:51 +0800
+Subject: thermal: intel: Fix unsigned comparison with less than zero
+
+From: Yang Li <yang.lee@linux.alibaba.com>
+
+[ Upstream commit e7fcfe67f9f410736b758969477b17ea285e8e6c ]
+
+The return value from the call to intel_tcc_get_tjmax() is int, which can
+be a negative error code. However, the return value is being assigned to
+an u32 variable 'tj_max', so making 'tj_max' an int.
+
+Eliminate the following warning:
+./drivers/thermal/intel/intel_soc_dts_iosf.c:394:5-11: WARNING: Unsigned expression compared with zero: tj_max < 0
+
+Link: https://bugzilla.openanolis.cn/show_bug.cgi?id=3637
+Reported-by: Abaci Robot <abaci@linux.alibaba.com>
+Signed-off-by: Yang Li <yang.lee@linux.alibaba.com>
+Acked-by: Zhang Rui <rui.zhang@intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/thermal/intel/intel_soc_dts_iosf.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/thermal/intel/intel_soc_dts_iosf.c b/drivers/thermal/intel/intel_soc_dts_iosf.c
+index 342b0bb5a56d9..8651ff1abe754 100644
+--- a/drivers/thermal/intel/intel_soc_dts_iosf.c
++++ b/drivers/thermal/intel/intel_soc_dts_iosf.c
+@@ -405,7 +405,7 @@ struct intel_soc_dts_sensors *intel_soc_dts_iosf_init(
+ {
+ struct intel_soc_dts_sensors *sensors;
+ bool notification;
+- u32 tj_max;
++ int tj_max;
+ int ret;
+ int i;
+
+--
+2.39.2
+
--- /dev/null
+From 349b79ce3e7b0f0796244023fac47fde66a727a8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 7 Jan 2023 20:25:13 +0100
+Subject: thermal: intel: intel_pch: Add support for Wellsburg PCH
+
+From: Tim Zimmermann <tim@linux4.de>
+
+[ Upstream commit 40dc1929089fc844ea06d9f8bdb6211ed4517c2e ]
+
+Add the PCI ID for the Wellsburg C610 series chipset PCH.
+
+The driver can read the temperature from the Wellsburg PCH with only
+the PCI ID added and no other modifications.
+
+Signed-off-by: Tim Zimmermann <tim@linux4.de>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/thermal/intel/intel_pch_thermal.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/thermal/intel/intel_pch_thermal.c b/drivers/thermal/intel/intel_pch_thermal.c
+index dabf11a687a15..9e27f430e0345 100644
+--- a/drivers/thermal/intel/intel_pch_thermal.c
++++ b/drivers/thermal/intel/intel_pch_thermal.c
+@@ -29,6 +29,7 @@
+ #define PCH_THERMAL_DID_CNL_LP 0x02F9 /* CNL-LP PCH */
+ #define PCH_THERMAL_DID_CML_H 0X06F9 /* CML-H PCH */
+ #define PCH_THERMAL_DID_LWB 0xA1B1 /* Lewisburg PCH */
++#define PCH_THERMAL_DID_WBG 0x8D24 /* Wellsburg PCH */
+
+ /* Wildcat Point-LP PCH Thermal registers */
+ #define WPT_TEMP 0x0000 /* Temperature */
+@@ -350,6 +351,7 @@ enum board_ids {
+ board_cnl,
+ board_cml,
+ board_lwb,
++ board_wbg,
+ };
+
+ static const struct board_info {
+@@ -380,6 +382,10 @@ static const struct board_info {
+ .name = "pch_lewisburg",
+ .ops = &pch_dev_ops_wpt,
+ },
++ [board_wbg] = {
++ .name = "pch_wellsburg",
++ .ops = &pch_dev_ops_wpt,
++ },
+ };
+
+ static int intel_pch_thermal_probe(struct pci_dev *pdev,
+@@ -495,6 +501,8 @@ static const struct pci_device_id intel_pch_thermal_id[] = {
+ .driver_data = board_cml, },
+ { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCH_THERMAL_DID_LWB),
+ .driver_data = board_lwb, },
++ { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCH_THERMAL_DID_WBG),
++ .driver_data = board_wbg, },
+ { 0, },
+ };
+ MODULE_DEVICE_TABLE(pci, intel_pch_thermal_id);
+--
+2.39.2
+
--- /dev/null
+From 1b686dcf1c92223793c05d35fe4e3475e0ddedbf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Feb 2023 16:12:14 +0100
+Subject: time/debug: Fix memory leak with using debugfs_lookup()
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+[ Upstream commit 5b268d8abaec6cbd4bd70d062e769098d96670aa ]
+
+When calling debugfs_lookup() the result must have dput() called on it,
+otherwise the memory will leak over time. To make things simpler, just
+call debugfs_lookup_and_remove() instead which handles all of the logic at
+once.
+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/r/20230202151214.2306822-1-gregkh@linuxfoundation.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/time/test_udelay.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/time/test_udelay.c b/kernel/time/test_udelay.c
+index 13b11eb62685e..20d5df631570e 100644
+--- a/kernel/time/test_udelay.c
++++ b/kernel/time/test_udelay.c
+@@ -149,7 +149,7 @@ module_init(udelay_test_init);
+ static void __exit udelay_test_exit(void)
+ {
+ mutex_lock(&udelay_test_lock);
+- debugfs_remove(debugfs_lookup(DEBUGFS_FILENAME, NULL));
++ debugfs_lookup_and_remove(DEBUGFS_FILENAME, NULL);
+ mutex_unlock(&udelay_test_lock);
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 96563115d9961e28c977a354d40508864e7a1377 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Jan 2023 14:44:03 +0100
+Subject: timers: Prevent union confusion from unexpected restart_syscall()
+
+From: Jann Horn <jannh@google.com>
+
+[ Upstream commit 9f76d59173d9d146e96c66886b671c1915a5c5e5 ]
+
+The nanosleep syscalls use the restart_block mechanism, with a quirk:
+The `type` and `rmtp`/`compat_rmtp` fields are set up unconditionally on
+syscall entry, while the rest of the restart_block is only set up in the
+unlikely case that the syscall is actually interrupted by a signal (or
+pseudo-signal) that doesn't have a signal handler.
+
+If the restart_block was set up by a previous syscall (futex(...,
+FUTEX_WAIT, ...) or poll()) and hasn't been invalidated somehow since then,
+this will clobber some of the union fields used by futex_wait_restart() and
+do_restart_poll().
+
+If userspace afterwards wrongly calls the restart_syscall syscall,
+futex_wait_restart()/do_restart_poll() will read struct fields that have
+been clobbered.
+
+This doesn't actually lead to anything particularly interesting because
+none of the union fields contain trusted kernel data, and
+futex(..., FUTEX_WAIT, ...) and poll() aren't syscalls where it makes much
+sense to apply seccomp filters to their arguments.
+
+So the current consequences are just of the "if userspace does bad stuff,
+it can damage itself, and that's not a problem" flavor.
+
+But still, it seems like a hazard for future developers, so invalidate the
+restart_block when partly setting it up in the nanosleep syscalls.
+
+Signed-off-by: Jann Horn <jannh@google.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/r/20230105134403.754986-1-jannh@google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/time/hrtimer.c | 2 ++
+ kernel/time/posix-stubs.c | 2 ++
+ kernel/time/posix-timers.c | 2 ++
+ 3 files changed, 6 insertions(+)
+
+diff --git a/kernel/time/hrtimer.c b/kernel/time/hrtimer.c
+index 3ae661ab62603..e4f0e3b0c4f4f 100644
+--- a/kernel/time/hrtimer.c
++++ b/kernel/time/hrtimer.c
+@@ -2126,6 +2126,7 @@ SYSCALL_DEFINE2(nanosleep, struct __kernel_timespec __user *, rqtp,
+ if (!timespec64_valid(&tu))
+ return -EINVAL;
+
++ current->restart_block.fn = do_no_restart_syscall;
+ current->restart_block.nanosleep.type = rmtp ? TT_NATIVE : TT_NONE;
+ current->restart_block.nanosleep.rmtp = rmtp;
+ return hrtimer_nanosleep(timespec64_to_ktime(tu), HRTIMER_MODE_REL,
+@@ -2147,6 +2148,7 @@ SYSCALL_DEFINE2(nanosleep_time32, struct old_timespec32 __user *, rqtp,
+ if (!timespec64_valid(&tu))
+ return -EINVAL;
+
++ current->restart_block.fn = do_no_restart_syscall;
+ current->restart_block.nanosleep.type = rmtp ? TT_COMPAT : TT_NONE;
+ current->restart_block.nanosleep.compat_rmtp = rmtp;
+ return hrtimer_nanosleep(timespec64_to_ktime(tu), HRTIMER_MODE_REL,
+diff --git a/kernel/time/posix-stubs.c b/kernel/time/posix-stubs.c
+index 90ea5f373e50e..828aeecbd1e8a 100644
+--- a/kernel/time/posix-stubs.c
++++ b/kernel/time/posix-stubs.c
+@@ -147,6 +147,7 @@ SYSCALL_DEFINE4(clock_nanosleep, const clockid_t, which_clock, int, flags,
+ return -EINVAL;
+ if (flags & TIMER_ABSTIME)
+ rmtp = NULL;
++ current->restart_block.fn = do_no_restart_syscall;
+ current->restart_block.nanosleep.type = rmtp ? TT_NATIVE : TT_NONE;
+ current->restart_block.nanosleep.rmtp = rmtp;
+ texp = timespec64_to_ktime(t);
+@@ -240,6 +241,7 @@ SYSCALL_DEFINE4(clock_nanosleep_time32, clockid_t, which_clock, int, flags,
+ return -EINVAL;
+ if (flags & TIMER_ABSTIME)
+ rmtp = NULL;
++ current->restart_block.fn = do_no_restart_syscall;
+ current->restart_block.nanosleep.type = rmtp ? TT_COMPAT : TT_NONE;
+ current->restart_block.nanosleep.compat_rmtp = rmtp;
+ texp = timespec64_to_ktime(t);
+diff --git a/kernel/time/posix-timers.c b/kernel/time/posix-timers.c
+index 5dead89308b74..0c8a87a11b39d 100644
+--- a/kernel/time/posix-timers.c
++++ b/kernel/time/posix-timers.c
+@@ -1270,6 +1270,7 @@ SYSCALL_DEFINE4(clock_nanosleep, const clockid_t, which_clock, int, flags,
+ return -EINVAL;
+ if (flags & TIMER_ABSTIME)
+ rmtp = NULL;
++ current->restart_block.fn = do_no_restart_syscall;
+ current->restart_block.nanosleep.type = rmtp ? TT_NATIVE : TT_NONE;
+ current->restart_block.nanosleep.rmtp = rmtp;
+
+@@ -1297,6 +1298,7 @@ SYSCALL_DEFINE4(clock_nanosleep_time32, clockid_t, which_clock, int, flags,
+ return -EINVAL;
+ if (flags & TIMER_ABSTIME)
+ rmtp = NULL;
++ current->restart_block.fn = do_no_restart_syscall;
+ current->restart_block.nanosleep.type = rmtp ? TT_COMPAT : TT_NONE;
+ current->restart_block.nanosleep.compat_rmtp = rmtp;
+
+--
+2.39.2
+
--- /dev/null
+From e3c05c815174029f34d11a1e811d8ca1ef794fa6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Feb 2023 11:28:12 +0100
+Subject: tools/lib/thermal: Fix thermal_sampling_exit()
+
+From: Vincent Guittot <vincent.guittot@linaro.org>
+
+[ Upstream commit a29cbd76aaf63f5493e962aa2fbaadcdc4615143 ]
+
+thermal_sampling_init() suscribes to THERMAL_GENL_SAMPLING_GROUP_NAME group
+so thermal_sampling_exit() should unsubscribe from the same group.
+
+Fixes: 47c4b0de080a ("tools/lib/thermal: Add a thermal library")
+Signed-off-by: Vincent Guittot <vincent.guittot@linaro.org>
+Link: https://lore.kernel.org/r/20230202102812.453357-1-vincent.guittot@linaro.org
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/thermal/sampling.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/lib/thermal/sampling.c b/tools/lib/thermal/sampling.c
+index ee818f4e9654d..70577423a9f0c 100644
+--- a/tools/lib/thermal/sampling.c
++++ b/tools/lib/thermal/sampling.c
+@@ -54,7 +54,7 @@ int thermal_sampling_fd(struct thermal_handler *th)
+ thermal_error_t thermal_sampling_exit(struct thermal_handler *th)
+ {
+ if (nl_unsubscribe_thermal(th->sk_sampling, th->cb_sampling,
+- THERMAL_GENL_EVENT_GROUP_NAME))
++ THERMAL_GENL_SAMPLING_GROUP_NAME))
+ return THERMAL_ERROR;
+
+ nl_thermal_disconnect(th->sk_sampling, th->cb_sampling);
+--
+2.39.2
+
--- /dev/null
+From 1a068dd4fb4a97ae4d40f3dc413414f3ce2dd1fd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Aug 2022 15:44:42 +0800
+Subject: tools/power/x86/intel-speed-select: Add Emerald Rapid quirk
+
+From: Zhang Rui <rui.zhang@intel.com>
+
+[ Upstream commit 61f9fdcdcd01f9a996b6db4e7092fcdfe8414ad5 ]
+
+Need memory frequency quirk as Sapphire Rapids in Emerald Rapids.
+So add Emerald Rapids CPU model check in is_spr_platform().
+
+Signed-off-by: Zhang Rui <rui.zhang@intel.com>
+[srinivas.pandruvada@linux.intel.com: Subject, changelog and code edits]
+Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/power/x86/intel-speed-select/isst-config.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/power/x86/intel-speed-select/isst-config.c b/tools/power/x86/intel-speed-select/isst-config.c
+index a160bad291eb7..be3668d37d654 100644
+--- a/tools/power/x86/intel-speed-select/isst-config.c
++++ b/tools/power/x86/intel-speed-select/isst-config.c
+@@ -110,7 +110,7 @@ int is_skx_based_platform(void)
+
+ int is_spr_platform(void)
+ {
+- if (cpu_model == 0x8F)
++ if (cpu_model == 0x8F || cpu_model == 0xCF)
+ return 1;
+
+ return 0;
+--
+2.39.2
+
--- /dev/null
+From 44fe366f3cde9691eb145853d5733c4ccfac5c54 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Jan 2023 11:33:59 +0100
+Subject: tools/tracing/rtla: osnoise_hist: use total duration for average
+ calculation
+
+From: Andreas Ziegler <br015@umbiko.net>
+
+[ Upstream commit fe137a4fe0e77eb95396cfc5c3dd7df404421aa4 ]
+
+Sampled durations must be weighted by observed quantity, to arrive at a correct
+average duration value.
+
+Perform calculation of total duration by summing (duration * count).
+
+Link: https://lkml.kernel.org/r/20230103103400.275566-2-br015@umbiko.net
+
+Fixes: 829a6c0b5698 ("rtla/osnoise: Add the hist mode")
+
+Signed-off-by: Andreas Ziegler <br015@umbiko.net>
+Acked-by: Daniel Bristot de Oliveira <bristot@kernel.org>
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/tracing/rtla/src/osnoise_hist.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/tools/tracing/rtla/src/osnoise_hist.c b/tools/tracing/rtla/src/osnoise_hist.c
+index 5d7ea479ac89f..fe34452fc4ec0 100644
+--- a/tools/tracing/rtla/src/osnoise_hist.c
++++ b/tools/tracing/rtla/src/osnoise_hist.c
+@@ -121,6 +121,7 @@ static void osnoise_hist_update_multiple(struct osnoise_tool *tool, int cpu,
+ {
+ struct osnoise_hist_params *params = tool->params;
+ struct osnoise_hist_data *data = tool->data;
++ unsigned long long total_duration;
+ int entries = data->entries;
+ int bucket;
+ int *hist;
+@@ -131,10 +132,12 @@ static void osnoise_hist_update_multiple(struct osnoise_tool *tool, int cpu,
+ if (data->bucket_size)
+ bucket = duration / data->bucket_size;
+
++ total_duration = duration * count;
++
+ hist = data->hist[cpu].samples;
+ data->hist[cpu].count += count;
+ update_min(&data->hist[cpu].min_sample, &duration);
+- update_sum(&data->hist[cpu].sum_sample, &duration);
++ update_sum(&data->hist[cpu].sum_sample, &total_duration);
+ update_max(&data->hist[cpu].max_sample, &duration);
+
+ if (bucket < entries)
+--
+2.39.2
+
--- /dev/null
+From 75ae500182d785019b00f4f6744e760f14a962f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Feb 2023 15:19:56 +0100
+Subject: trace/blktrace: fix memory leak with using debugfs_lookup()
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+[ Upstream commit 83e8864fee26f63a7435e941b7c36a20fd6fe93e ]
+
+When calling debugfs_lookup() the result must have dput() called on it,
+otherwise the memory will leak over time. To make things simpler, just
+call debugfs_lookup_and_remove() instead which handles all of the logic
+at once.
+
+Cc: Jens Axboe <axboe@kernel.dk>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Cc: Masami Hiramatsu <mhiramat@kernel.org>
+Cc: linux-block@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Cc: linux-trace-kernel@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Link: https://lore.kernel.org/r/20230202141956.2299521-1-gregkh@linuxfoundation.org
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/blktrace.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
+index 918a7d12df8ff..5743be5594153 100644
+--- a/kernel/trace/blktrace.c
++++ b/kernel/trace/blktrace.c
+@@ -320,8 +320,8 @@ static void blk_trace_free(struct request_queue *q, struct blk_trace *bt)
+ * under 'q->debugfs_dir', thus lookup and remove them.
+ */
+ if (!bt->dir) {
+- debugfs_remove(debugfs_lookup("dropped", q->debugfs_dir));
+- debugfs_remove(debugfs_lookup("msg", q->debugfs_dir));
++ debugfs_lookup_and_remove("dropped", q->debugfs_dir);
++ debugfs_lookup_and_remove("msg", q->debugfs_dir);
+ } else {
+ debugfs_remove(bt->dir);
+ }
+--
+2.39.2
+
--- /dev/null
+From 57325088d81a1fd197c393021193d581425b488a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Nov 2022 18:19:53 +0800
+Subject: tty: serial: fsl_lpuart: clear LPUART Status Register in
+ lpuart32_shutdown()
+
+From: Sherry Sun <sherry.sun@nxp.com>
+
+[ Upstream commit 4029dfc034febb54f6dd8ea83568accc943bc088 ]
+
+The LPUART Status Register needs to be cleared when closing the uart
+port to get a clean environment when reopening the uart.
+
+Fixes: 380c966c093e ("tty: serial: fsl_lpuart: add 32-bit register interface support")
+Signed-off-by: Sherry Sun <sherry.sun@nxp.com>
+Link: https://lore.kernel.org/r/20221125101953.18753-4-sherry.sun@nxp.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/fsl_lpuart.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
+index 5d1c28e094bb2..986ec8323c526 100644
+--- a/drivers/tty/serial/fsl_lpuart.c
++++ b/drivers/tty/serial/fsl_lpuart.c
+@@ -1796,6 +1796,10 @@ static void lpuart32_shutdown(struct uart_port *port)
+
+ spin_lock_irqsave(&port->lock, flags);
+
++ /* clear status */
++ temp = lpuart32_read(&sport->port, UARTSTAT);
++ lpuart32_write(&sport->port, temp, UARTSTAT);
++
+ /* disable Rx/Tx DMA */
+ temp = lpuart32_read(port, UARTBAUD);
+ temp &= ~(UARTBAUD_TDMAE | UARTBAUD_RDMAE);
+--
+2.39.2
+
--- /dev/null
+From 2f8f4e7a1a331be30ccc00450321de915ee5c4f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Nov 2022 18:19:52 +0800
+Subject: tty: serial: fsl_lpuart: disable Rx/Tx DMA in lpuart32_shutdown()
+
+From: Sherry Sun <sherry.sun@nxp.com>
+
+[ Upstream commit 1d4bd0e4ae4ba95892bef919a8d4d3f08f122d7e ]
+
+UARTBAUD_RDMAE and UARTBAUD_TDMAE are enabled in lpuart32_startup(), but
+lpuart32_shutdown() not disable them, only free the dma ring buffer and
+release the dma channels, so here disable the Rx/Tx DMA first in
+lpuart32_shutdown().
+
+Fixes: 42b68768e51b ("serial: fsl_lpuart: DMA support for 32-bit variant")
+Signed-off-by: Sherry Sun <sherry.sun@nxp.com>
+Link: https://lore.kernel.org/r/20221125101953.18753-3-sherry.sun@nxp.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/fsl_lpuart.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
+index 5e69fb73f570f..5d1c28e094bb2 100644
+--- a/drivers/tty/serial/fsl_lpuart.c
++++ b/drivers/tty/serial/fsl_lpuart.c
+@@ -1796,6 +1796,11 @@ static void lpuart32_shutdown(struct uart_port *port)
+
+ spin_lock_irqsave(&port->lock, flags);
+
++ /* disable Rx/Tx DMA */
++ temp = lpuart32_read(port, UARTBAUD);
++ temp &= ~(UARTBAUD_TDMAE | UARTBAUD_RDMAE);
++ lpuart32_write(port, temp, UARTBAUD);
++
+ /* disable Rx/Tx and interrupts */
+ temp = lpuart32_read(port, UARTCTRL);
+ temp &= ~(UARTCTRL_TE | UARTCTRL_RE |
+--
+2.39.2
+
--- /dev/null
+From f944f07caeed77eff02ad9b9f121d8b4cf7280ff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Jan 2023 14:44:46 +0800
+Subject: tty: serial: fsl_lpuart: Fix the wrong RXWATER setting for rx dma
+ case
+
+From: Sherry Sun <sherry.sun@nxp.com>
+
+[ Upstream commit 9ad9df8447547febe9dd09b040f4528a09e495f0 ]
+
+The RXWATER value must be greater than 0 according to the LPUART
+reference manual. And when the number of datawords in the receive
+FIFO is greater than RXWATER, an interrupt or a DMA request is
+generated, so no need to set the different value for lpuart interrupt
+case and dma case. Here delete the wrong RXWATER setting for dma case
+directly.
+
+Fixes: 42b68768e51b ("serial: fsl_lpuart: DMA support for 32-bit variant")
+Signed-off-by: Sherry Sun <sherry.sun@nxp.com>
+Link: https://lore.kernel.org/r/20230130064449.9564-4-sherry.sun@nxp.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/fsl_lpuart.c | 6 ------
+ 1 file changed, 6 deletions(-)
+
+diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
+index 986ec8323c526..f34fabdc2bb7d 100644
+--- a/drivers/tty/serial/fsl_lpuart.c
++++ b/drivers/tty/serial/fsl_lpuart.c
+@@ -1683,12 +1683,6 @@ static void lpuart32_configure(struct lpuart_port *sport)
+ {
+ unsigned long temp;
+
+- if (sport->lpuart_dma_rx_use) {
+- /* RXWATER must be 0 */
+- temp = lpuart32_read(&sport->port, UARTWATER);
+- temp &= ~(UARTWATER_WATER_MASK << UARTWATER_RXWATER_OFF);
+- lpuart32_write(&sport->port, temp, UARTWATER);
+- }
+ temp = lpuart32_read(&sport->port, UARTCTRL);
+ if (!sport->lpuart_dma_rx_use)
+ temp |= UARTCTRL_RIE;
+--
+2.39.2
+
--- /dev/null
+From 725997e2eb1198cc7cf5567ee6ea5ae383abd6f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Feb 2023 09:30:16 +0800
+Subject: tty: serial: imx: disable Ageing Timer interrupt request irq
+
+From: Peng Fan <peng.fan@nxp.com>
+
+[ Upstream commit ef25e16ea9674b713a68c3bda821556ce9901254 ]
+
+There maybe pending USR interrupt before requesting irq, however
+uart_add_one_port has not executed, so there will be kernel panic:
+[ 0.795668] Unable to handle kernel NULL pointer dereference at virtual addre
+ss 0000000000000080
+[ 0.802701] Mem abort info:
+[ 0.805367] ESR = 0x0000000096000004
+[ 0.808950] EC = 0x25: DABT (current EL), IL = 32 bits
+[ 0.814033] SET = 0, FnV = 0
+[ 0.816950] EA = 0, S1PTW = 0
+[ 0.819950] FSC = 0x04: level 0 translation fault
+[ 0.824617] Data abort info:
+[ 0.827367] ISV = 0, ISS = 0x00000004
+[ 0.831033] CM = 0, WnR = 0
+[ 0.833866] [0000000000000080] user address but active_mm is swapper
+[ 0.839951] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP
+[ 0.845953] Modules linked in:
+[ 0.848869] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.1.1+g56321e101aca #1
+[ 0.855617] Hardware name: Freescale i.MX8MP EVK (DT)
+[ 0.860452] pstate: 000000c5 (nzcv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+[ 0.867117] pc : __imx_uart_rxint.constprop.0+0x11c/0x2c0
+[ 0.872283] lr : imx_uart_int+0xf8/0x1ec
+
+The issue only happends in the inmate linux when Jailhouse hypervisor
+enabled. The test procedure is:
+while true; do
+ jailhouse enable imx8mp.cell
+ jailhouse cell linux xxxx
+ sleep 10
+ jailhouse cell destroy 1
+ jailhouse disable
+ sleep 5
+done
+
+And during the upper test, press keys to the 2nd linux console.
+When `jailhouse cell destroy 1`, the 2nd linux has no chance to put
+the uart to a quiese state, so USR1/2 may has pending interrupts. Then
+when `jailhosue cell linux xx` to start 2nd linux again, the issue
+trigger.
+
+In order to disable irqs before requesting them, both UCR1 and UCR2 irqs
+should be disabled, so here fix that, disable the Ageing Timer interrupt
+in UCR2 as UCR1 does.
+
+Fixes: 8a61f0c70ae6 ("serial: imx: Disable irqs before requesting them")
+Suggested-by: Sherry Sun <sherry.sun@nxp.com>
+Reviewed-by: Sherry Sun <sherry.sun@nxp.com>
+Signed-off-by: Peng Fan <peng.fan@nxp.com>
+Acked-by: Jason Liu <jason.hui.liu@nxp.com>
+Link: https://lore.kernel.org/r/20230206013016.29352-1-sherry.sun@nxp.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/imx.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c
+index 757825edb0cd9..5f35343f81309 100644
+--- a/drivers/tty/serial/imx.c
++++ b/drivers/tty/serial/imx.c
+@@ -2374,6 +2374,11 @@ static int imx_uart_probe(struct platform_device *pdev)
+ ucr1 &= ~(UCR1_ADEN | UCR1_TRDYEN | UCR1_IDEN | UCR1_RRDYEN | UCR1_RTSDEN);
+ imx_uart_writel(sport, ucr1, UCR1);
+
++ /* Disable Ageing Timer interrupt */
++ ucr2 = imx_uart_readl(sport, UCR2);
++ ucr2 &= ~UCR2_ATEN;
++ imx_uart_writel(sport, ucr2, UCR2);
++
+ /*
+ * In case RS485 is enabled without GPIO RTS control, the UART IP
+ * is used to control CTS signal. Keep both the UART and Receiver
+--
+2.39.2
+
--- /dev/null
+From 9b2d194639636fba58fa5dc6a9e8d119a90e592c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Dec 2022 16:50:17 +0100
+Subject: tty: serial: qcom-geni-serial: stop operations in progress at
+ shutdown
+
+From: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+
+[ Upstream commit d8aca2f96813d51df574a811eda9a2cbed00f261 ]
+
+We don't stop transmissions in progress at shutdown. This is fine with
+FIFO SE mode but with DMA (support for which we'll introduce later) it
+causes trouble so fix it now.
+
+Fixes: e83766334f96 ("tty: serial: qcom_geni_serial: No need to stop tx/rx on UART shutdown")
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20221229155030.418800-2-brgl@bgdev.pl
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/qcom_geni_serial.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/tty/serial/qcom_geni_serial.c b/drivers/tty/serial/qcom_geni_serial.c
+index 57f04f8bf5043..851a5d2133aa2 100644
+--- a/drivers/tty/serial/qcom_geni_serial.c
++++ b/drivers/tty/serial/qcom_geni_serial.c
+@@ -891,6 +891,8 @@ static int setup_fifos(struct qcom_geni_serial_port *port)
+ static void qcom_geni_serial_shutdown(struct uart_port *uport)
+ {
+ disable_irq(uport->irq);
++ qcom_geni_serial_stop_tx(uport);
++ qcom_geni_serial_stop_rx(uport);
+ }
+
+ static int qcom_geni_serial_port_setup(struct uart_port *uport)
+--
+2.39.2
+
--- /dev/null
+From 4aa1f9ba28dc8973a65d27034a1d22faa02ef823 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 4 Feb 2023 17:39:21 +0000
+Subject: tun: tun_chr_open(): correctly initialize socket uid
+
+From: Pietro Borrello <borrello@diag.uniroma1.it>
+
+[ Upstream commit a096ccca6e503a5c575717ff8a36ace27510ab0a ]
+
+sock_init_data() assumes that the `struct socket` passed in input is
+contained in a `struct socket_alloc` allocated with sock_alloc().
+However, tun_chr_open() passes a `struct socket` embedded in a `struct
+tun_file` allocated with sk_alloc().
+This causes a type confusion when issuing a container_of() with
+SOCK_INODE() in sock_init_data() which results in assigning a wrong
+sk_uid to the `struct sock` in input.
+On default configuration, the type confused field overlaps with the
+high 4 bytes of `struct tun_struct __rcu *tun` of `struct tun_file`,
+NULL at the time of call, which makes the uid of all tun sockets 0,
+i.e., the root one.
+Fix the assignment by using sock_init_data_uid().
+
+Fixes: 86741ec25462 ("net: core: Add a UID field to struct sock.")
+Signed-off-by: Pietro Borrello <borrello@diag.uniroma1.it>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/tun.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/tun.c b/drivers/net/tun.c
+index a7d17c680f4a0..745131b2d6dbf 100644
+--- a/drivers/net/tun.c
++++ b/drivers/net/tun.c
+@@ -3448,7 +3448,7 @@ static int tun_chr_open(struct inode *inode, struct file * file)
+ tfile->socket.file = file;
+ tfile->socket.ops = &tun_socket_ops;
+
+- sock_init_data(&tfile->socket, &tfile->sk);
++ sock_init_data_uid(&tfile->socket, &tfile->sk, inode->i_uid);
+
+ tfile->sk.sk_write_space = tun_sock_write_space;
+ tfile->sk.sk_sndbuf = INT_MAX;
+--
+2.39.2
+
--- /dev/null
+From dea9e0b6ac5c961097c61e0410b8fe7fd0e4f7ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Jan 2023 17:37:59 -0800
+Subject: uaccess: Add minimum bounds check on kernel buffer size
+
+From: Kees Cook <keescook@chromium.org>
+
+[ Upstream commit 04ffde1319a715bd0550ded3580d4ea3bc003776 ]
+
+While there is logic about the difference between ksize and usize,
+copy_struct_from_user() didn't check the size of the destination buffer
+(when it was known) against ksize. Add this check so there is an upper
+bounds check on the possible memset() call, otherwise lower bounds
+checks made by callers will trigger bounds warnings under -Warray-bounds.
+Seen under GCC 13:
+
+In function 'copy_struct_from_user',
+ inlined from 'iommufd_fops_ioctl' at
+../drivers/iommu/iommufd/main.c:333:8:
+../include/linux/fortify-string.h:59:33: warning: '__builtin_memset' offset [57, 4294967294] is out of the bounds [0, 56] of object 'buf' with type 'union ucmd_buffer' [-Warray-bounds=]
+ 59 | #define __underlying_memset __builtin_memset
+ | ^
+../include/linux/fortify-string.h:453:9: note: in expansion of macro '__underlying_memset'
+ 453 | __underlying_memset(p, c, __fortify_size); \
+ | ^~~~~~~~~~~~~~~~~~~
+../include/linux/fortify-string.h:461:25: note: in expansion of macro '__fortify_memset_chk'
+ 461 | #define memset(p, c, s) __fortify_memset_chk(p, c, s, \
+ | ^~~~~~~~~~~~~~~~~~~~
+../include/linux/uaccess.h:334:17: note: in expansion of macro 'memset'
+ 334 | memset(dst + size, 0, rest);
+ | ^~~~~~
+../drivers/iommu/iommufd/main.c: In function 'iommufd_fops_ioctl':
+../drivers/iommu/iommufd/main.c:311:27: note: 'buf' declared here
+ 311 | union ucmd_buffer buf;
+ | ^~~
+
+Cc: Christian Brauner <brauner@kernel.org>
+Cc: Rasmus Villemoes <linux@rasmusvillemoes.dk>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Cc: Dinh Nguyen <dinguyen@kernel.org>
+Cc: Catalin Marinas <catalin.marinas@arm.com>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Cc: Geert Uytterhoeven <geert@linux-m68k.org>
+Cc: Alexander Potapenko <glider@google.com>
+Acked-by: Aleksa Sarai <cyphar@cyphar.com>
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Link: https://lore.kernel.org/lkml/20230203193523.never.667-kees@kernel.org/
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/uaccess.h | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/include/linux/uaccess.h b/include/linux/uaccess.h
+index afb18f198843b..ab9728138ad67 100644
+--- a/include/linux/uaccess.h
++++ b/include/linux/uaccess.h
+@@ -329,6 +329,10 @@ copy_struct_from_user(void *dst, size_t ksize, const void __user *src,
+ size_t size = min(ksize, usize);
+ size_t rest = max(ksize, usize) - size;
+
++ /* Double check if ksize is larger than a known object size. */
++ if (WARN_ON_ONCE(ksize > __builtin_object_size(dst, 1)))
++ return -E2BIG;
++
+ /* Deal with trailing bytes. */
+ if (usize < ksize) {
+ memset(dst + size, 0, rest);
+--
+2.39.2
+
--- /dev/null
+From 14bed80b0952fcd246140005b3b736f6f9beff32 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Jan 2023 12:17:07 +0800
+Subject: ublk_drv: don't probe partitions if the ubq daemon isn't trusted
+
+From: Ming Lei <ming.lei@redhat.com>
+
+[ Upstream commit 73a166d9749230d598320fdae3b687cdc0e2e205 ]
+
+If any ubq daemon is unprivileged, the ublk char device is allowed
+for unprivileged user actually, and we can't trust the current user,
+so not probe partitions.
+
+Fixes: 71f28f3136af ("ublk_drv: add io_uring based userspace block driver")
+Reviewed-by: ZiyangZhang <ZiyangZhang@linux.alibaba.com>
+Signed-off-by: Ming Lei <ming.lei@redhat.com>
+Link: https://lore.kernel.org/r/20230106041711.914434-3-ming.lei@redhat.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/ublk_drv.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c
+index f44b9467720c9..450bd54fd0061 100644
+--- a/drivers/block/ublk_drv.c
++++ b/drivers/block/ublk_drv.c
+@@ -159,6 +159,7 @@ struct ublk_device {
+
+ struct completion completion;
+ unsigned int nr_queues_ready;
++ unsigned int nr_privileged_daemon;
+
+ /*
+ * Our ubq->daemon may be killed without any notification, so
+@@ -1178,6 +1179,9 @@ static void ublk_mark_io_ready(struct ublk_device *ub, struct ublk_queue *ubq)
+ ubq->ubq_daemon = current;
+ get_task_struct(ubq->ubq_daemon);
+ ub->nr_queues_ready++;
++
++ if (capable(CAP_SYS_ADMIN))
++ ub->nr_privileged_daemon++;
+ }
+ if (ub->nr_queues_ready == ub->dev_info.nr_hw_queues)
+ complete_all(&ub->completion);
+@@ -1534,6 +1538,10 @@ static int ublk_ctrl_start_dev(struct io_uring_cmd *cmd)
+ if (ret)
+ goto out_put_disk;
+
++ /* don't probe partitions if any one ubq daemon is un-trusted */
++ if (ub->nr_privileged_daemon != ub->nr_queues_ready)
++ set_bit(GD_SUPPRESS_PART_SCAN, &disk->state);
++
+ get_device(&ub->cdev_dev);
+ ret = add_disk(disk);
+ if (ret) {
+@@ -1935,6 +1943,7 @@ static int ublk_ctrl_start_recovery(struct io_uring_cmd *cmd)
+ /* set to NULL, otherwise new ubq_daemon cannot mmap the io_cmd_buf */
+ ub->mm = NULL;
+ ub->nr_queues_ready = 0;
++ ub->nr_privileged_daemon = 0;
+ init_completion(&ub->completion);
+ ret = 0;
+ out_unlock:
+--
+2.39.2
+
--- /dev/null
+From 4f01d1f1b84556fc609aa83db4c04bdd9a41184f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Jan 2023 12:17:06 +0800
+Subject: ublk_drv: remove nr_aborted_queues from ublk_device
+
+From: Ming Lei <ming.lei@redhat.com>
+
+[ Upstream commit ed878d1c1c641c4a6bd366658fc8e6bc842b80d1 ]
+
+No one uses 'nr_aborted_queues' any more, so remove it.
+
+Reviewed-by: ZiyangZhang <ZiyangZhang@linux.alibaba.com>
+Signed-off-by: Ming Lei <ming.lei@redhat.com>
+Link: https://lore.kernel.org/r/20230106041711.914434-2-ming.lei@redhat.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Stable-dep-of: 73a166d97492 ("ublk_drv: don't probe partitions if the ubq daemon isn't trusted")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/ublk_drv.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c
+index 6368b56eacf11..f44b9467720c9 100644
+--- a/drivers/block/ublk_drv.c
++++ b/drivers/block/ublk_drv.c
+@@ -159,7 +159,6 @@ struct ublk_device {
+
+ struct completion completion;
+ unsigned int nr_queues_ready;
+- atomic_t nr_aborted_queues;
+
+ /*
+ * Our ubq->daemon may be killed without any notification, so
+--
+2.39.2
+
--- /dev/null
+From 0a102b85fa657f83201500ff0da35a239e6c0cee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Sep 2022 16:34:45 +0200
+Subject: udf: Define EFSCORRUPTED error code
+
+From: Jan Kara <jack@suse.cz>
+
+[ Upstream commit 3d2d7e61553dbcc8ba45201d8ae4f383742c8202 ]
+
+Similarly to other filesystems define EFSCORRUPTED error code for
+reporting internal filesystem corruption.
+
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/udf/udf_sb.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/udf/udf_sb.h b/fs/udf/udf_sb.h
+index 291b56dd011ee..6bccff3c70f54 100644
+--- a/fs/udf/udf_sb.h
++++ b/fs/udf/udf_sb.h
+@@ -55,6 +55,8 @@
+ #define MF_DUPLICATE_MD 0x01
+ #define MF_MIRROR_FE_LOADED 0x02
+
++#define EFSCORRUPTED EUCLEAN
++
+ struct udf_meta_data {
+ __u32 s_meta_file_loc;
+ __u32 s_mirror_file_loc;
+--
+2.39.2
+
--- /dev/null
+From d342c57b6e5e0269b8bcb86dedd83f31dc05f179 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Jan 2023 19:23:08 +0100
+Subject: usb: early: xhci-dbc: Fix a potential out-of-bound memory access
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit a4a97ab3db5c081eb6e7dba91306adefb461e0bd ]
+
+If xdbc_bulk_write() fails, the values in 'buf' can be anything. So the
+string is not guaranteed to be NULL terminated when xdbc_trace() is called.
+
+Reserve an extra byte, which will be zeroed automatically because 'buf' is
+a static variable, in order to avoid troubles, should it happen.
+
+Fixes: aeb9dd1de98c ("usb/early: Add driver for xhci debug capability")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Link: https://lore.kernel.org/r/d6a7562c5e839a195cee85db6dc81817f9372cb1.1675016180.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/early/xhci-dbc.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/early/xhci-dbc.c b/drivers/usb/early/xhci-dbc.c
+index 7970471548202..f3e23be227d41 100644
+--- a/drivers/usb/early/xhci-dbc.c
++++ b/drivers/usb/early/xhci-dbc.c
+@@ -874,7 +874,8 @@ static int xdbc_bulk_write(const char *bytes, int size)
+
+ static void early_xdbc_write(struct console *con, const char *str, u32 n)
+ {
+- static char buf[XDBC_MAX_PACKET];
++ /* static variables are zeroed, so buf is always NULL terminated */
++ static char buf[XDBC_MAX_PACKET + 1];
+ int chunk, ret;
+ int use_cr = 0;
+
+--
+2.39.2
+
--- /dev/null
+From bc6e40c5264d3eb3948b32a1cb7918bca6fc8900 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Feb 2023 18:53:08 +0530
+Subject: usb: gadget: configfs: Restrict symlink creation is UDC already
+ binded
+
+From: Udipto Goswami <quic_ugoswami@quicinc.com>
+
+[ Upstream commit 89e7252d6c7e7eeb31971cd7df987316ecc64ff5 ]
+
+During enumeration or composition switch,a userspace process
+agnostic of the conventions of configs can try to create function
+symlinks even after the UDC is bound to current config which is
+not correct. Potentially it can create duplicates within the
+current config.
+
+Prevent this by adding a check if udc_name already exists, then bail
+out of cfg_link.
+
+Following is an example:
+
+Step1:
+ln -s X1 ffs.a
+-->cfg_link
+--> usb_get_function(ffs.a)
+ ->ffs_alloc
+
+ CFG->FUNC_LIST: <ffs.a>
+ C->FUNCTION: <empty>
+
+Step2:
+echo udc.name > /config/usb_gadget/g1/UDC
+--> UDC_store
+ ->composite_bind
+ ->usb_add_function
+
+ CFG->FUNC_LIST: <empty>
+ C->FUNCTION: <ffs.a>
+
+Step3:
+ln -s Y1 ffs.a
+-->cfg_link
+-->usb_get_function(ffs.a)
+ ->ffs_alloc
+
+ CFG->FUNC_LIST: <ffs.a>
+ C->FUNCTION: <ffs.a>
+
+both the lists corresponds to the same function instance ffs.a
+but the usb_function* pointer is different because in step 3
+ffs_alloc has created a new reference to usb_function* for
+ffs.a and added it to cfg_list.
+
+Step4:
+Now a composition switch involving <ffs.b,ffs.a> is executed.
+
+the composition switch will involve 3 things:
+ 1. unlinking the previous functions existing
+ 2. creating new symlinks
+ 3. writing UDC
+
+However, the composition switch is generally taken care by
+userspace process which creates the symlinks in its own
+nomenclature(X*) and removes only those.
+So it won't be able to remove Y1 which user had created
+by own.
+
+Due to this the new symlinks cannot be created for ffs.a
+since the entry already exists in CFG->FUNC_LIST.
+
+The state of the CFG->FUNC_LIST is as follows:
+ CFG->FUNC_LIST: <ffs.a>
+
+Fixes: 88af8bbe4ef7 ("usb: gadget: the start of the configfs interface")
+Signed-off-by: Krishna Kurapati PSSNV <quic_kriskura@quicinc.com>
+Signed-off-by: Udipto Goswami <quic_ugoswami@quicinc.com>
+Link: https://lore.kernel.org/r/20230201132308.31523-1-quic_ugoswami@quicinc.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/configfs.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
+index 0853536cbf2e6..2ff34dc129c40 100644
+--- a/drivers/usb/gadget/configfs.c
++++ b/drivers/usb/gadget/configfs.c
+@@ -430,6 +430,12 @@ static int config_usb_cfg_link(
+ * from another gadget or a random directory.
+ * Also a function instance can only be linked once.
+ */
++
++ if (gi->composite.gadget_driver.udc_name) {
++ ret = -EINVAL;
++ goto out;
++ }
++
+ list_for_each_entry(iter, &gi->available_func, cfs_list) {
+ if (iter != fi)
+ continue;
+--
+2.39.2
+
--- /dev/null
+From 037c8d4a7284a2cf42d0571cfe573fb30a88f184 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Nov 2022 09:41:21 +0800
+Subject: usb: gadget: fusb300_udc: free irq on the error path in
+ fusb300_probe()
+
+From: Gaosheng Cui <cuigaosheng1@huawei.com>
+
+[ Upstream commit a8d3392e0e5cfeb03f0cea1f2bc3f5f183c1deb4 ]
+
+When request_irq(ires1->start) failed in w5300_hw_probe(), irq
+ires->start has not been freed, and on the clean_up3 error path,
+we also need to free ires1->start irq, fix it.
+
+In addition, We should add free_irq in fusb300_remove(), and give
+the lables a proper name so that they can be understood easily,
+so add free_irq in fusb300_remove(), and update clean_up3 to
+err_alloc_request.
+
+Fixes: 0fe6f1d1f612 ("usb: udc: add Faraday fusb300 driver")
+Signed-off-by: Gaosheng Cui <cuigaosheng1@huawei.com>
+Link: https://lore.kernel.org/r/20221123014121.1989721-1-cuigaosheng1@huawei.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/udc/fusb300_udc.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/usb/gadget/udc/fusb300_udc.c b/drivers/usb/gadget/udc/fusb300_udc.c
+index 5954800d652ca..08ba9c8c1e677 100644
+--- a/drivers/usb/gadget/udc/fusb300_udc.c
++++ b/drivers/usb/gadget/udc/fusb300_udc.c
+@@ -1346,6 +1346,7 @@ static int fusb300_remove(struct platform_device *pdev)
+ usb_del_gadget_udc(&fusb300->gadget);
+ iounmap(fusb300->reg);
+ free_irq(platform_get_irq(pdev, 0), fusb300);
++ free_irq(platform_get_irq(pdev, 1), fusb300);
+
+ fusb300_free_request(&fusb300->ep[0]->ep, fusb300->ep0_req);
+ for (i = 0; i < FUSB300_MAX_NUM_EP; i++)
+@@ -1431,7 +1432,7 @@ static int fusb300_probe(struct platform_device *pdev)
+ IRQF_SHARED, udc_name, fusb300);
+ if (ret < 0) {
+ pr_err("request_irq1 error (%d)\n", ret);
+- goto clean_up;
++ goto err_request_irq1;
+ }
+
+ INIT_LIST_HEAD(&fusb300->gadget.ep_list);
+@@ -1470,7 +1471,7 @@ static int fusb300_probe(struct platform_device *pdev)
+ GFP_KERNEL);
+ if (fusb300->ep0_req == NULL) {
+ ret = -ENOMEM;
+- goto clean_up3;
++ goto err_alloc_request;
+ }
+
+ init_controller(fusb300);
+@@ -1485,7 +1486,10 @@ static int fusb300_probe(struct platform_device *pdev)
+ err_add_udc:
+ fusb300_free_request(&fusb300->ep[0]->ep, fusb300->ep0_req);
+
+-clean_up3:
++err_alloc_request:
++ free_irq(ires1->start, fusb300);
++
++err_request_irq1:
+ free_irq(ires->start, fusb300);
+
+ clean_up:
+--
+2.39.2
+
--- /dev/null
+From 4c4439eb8359483a631d9d1ec8dbf35938a5e38e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Feb 2023 12:05:31 +0100
+Subject: usb: host: fsl-mph-dr-of: reuse device_set_of_node_from_dev
+
+From: Alexander Stein <alexander.stein@ew.tq-group.com>
+
+[ Upstream commit e2ffae3ed92a9f768902c1cf82642c3a09cd0345 ]
+
+This sets both of_node fields and takes a of_node reference as well.
+
+Fixes: bb160ee61c04 ("drivers/usb/host/ehci-fsl: Fix interrupt setup in host mode.")
+Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Reviewed-by: Rob Herring <robh@kernel.org>
+Link: https://lore.kernel.org/r/20230207110531.1060252-4-alexander.stein@ew.tq-group.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/fsl-mph-dr-of.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/usb/host/fsl-mph-dr-of.c b/drivers/usb/host/fsl-mph-dr-of.c
+index e5df175228928..46c6a152b8655 100644
+--- a/drivers/usb/host/fsl-mph-dr-of.c
++++ b/drivers/usb/host/fsl-mph-dr-of.c
+@@ -112,8 +112,7 @@ static struct platform_device *fsl_usb2_device_register(
+ goto error;
+ }
+
+- pdev->dev.of_node = ofdev->dev.of_node;
+- pdev->dev.of_node_reused = true;
++ device_set_of_node_from_dev(&pdev->dev, &ofdev->dev);
+
+ retval = platform_device_add(pdev);
+ if (retval)
+--
+2.39.2
+
--- /dev/null
+From d71788417ffdfdbc509596f5765839b75600be1b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Feb 2023 16:33:37 +1300
+Subject: usb: max-3421: Fix setting of I/O pins
+
+From: Mark Tomlinson <mark.tomlinson@alliedtelesis.co.nz>
+
+[ Upstream commit a7efe3fc7cbe27c6eb2c2a3ab612194f8f800f4c ]
+
+To update the I/O pins, the registers are read/modified/written. The
+read operation incorrectly always read the first register. Although
+wrong, there wasn't any impact as all the output pins are always
+written, and the inputs are read only anyway.
+
+Fixes: 2d53139f3162 ("Add support for using a MAX3421E chip as a host driver.")
+Signed-off-by: Mark Tomlinson <mark.tomlinson@alliedtelesis.co.nz>
+Link: https://lore.kernel.org/r/20230207033337.18112-1-mark.tomlinson@alliedtelesis.co.nz
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/max3421-hcd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/host/max3421-hcd.c b/drivers/usb/host/max3421-hcd.c
+index 352e3ac2b377b..19111e83ac131 100644
+--- a/drivers/usb/host/max3421-hcd.c
++++ b/drivers/usb/host/max3421-hcd.c
+@@ -1436,7 +1436,7 @@ max3421_spi_thread(void *dev_id)
+ * use spi_wr_buf().
+ */
+ for (i = 0; i < ARRAY_SIZE(max3421_hcd->iopins); ++i) {
+- u8 val = spi_rd8(hcd, MAX3421_REG_IOPINS1);
++ u8 val = spi_rd8(hcd, MAX3421_REG_IOPINS1 + i);
+
+ val = ((val & 0xf0) |
+ (max3421_hcd->iopins[i] & 0x0f));
+--
+2.39.2
+
--- /dev/null
+From 98bdaeab73ebf7b7f336e9f2474a60c0c71a4d0b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Jan 2023 18:20:46 +0300
+Subject: usb: musb: mediatek: don't unregister something that wasn't
+ registered
+
+From: Dan Carpenter <error27@gmail.com>
+
+[ Upstream commit ba883de971d1ad018f3083d9195b8abe54d87407 ]
+
+This function only calls mtk_otg_switch_init() when the ->port_mode
+is MUSB_OTG so the clean up code should only call mtk_otg_switch_exit()
+for that mode.
+
+Fixes: 0990366bab3c ("usb: musb: Add support for MediaTek musb controller")
+Signed-off-by: Dan Carpenter <error27@gmail.com>
+Link: https://lore.kernel.org/r/Y8/3TqpqiSr0RxFH@kili
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/musb/mediatek.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/musb/mediatek.c b/drivers/usb/musb/mediatek.c
+index cad991380b0cf..27b9bd2583400 100644
+--- a/drivers/usb/musb/mediatek.c
++++ b/drivers/usb/musb/mediatek.c
+@@ -294,7 +294,8 @@ static int mtk_musb_init(struct musb *musb)
+ err_phy_power_on:
+ phy_exit(glue->phy);
+ err_phy_init:
+- mtk_otg_switch_exit(glue);
++ if (musb->port_mode == MUSB_OTG)
++ mtk_otg_switch_exit(glue);
+ return ret;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From ad72f7350ef8dcd60ca9f08e1db7df716d52ca19 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Jan 2023 22:29:32 +0200
+Subject: usb: typec: intel_pmc_mux: Don't leak the ACPI device reference count
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit c3194949ae8fcbe2b7e38670e7c6a5cfd2605edc ]
+
+When acpi_dev_get_memory_resources() fails, the reference count is
+left bumped. Drop it as it's done in the other error paths.
+
+Fixes: 43d596e32276 ("usb: typec: intel_pmc_mux: Check the port status before connect")
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Link: https://lore.kernel.org/r/20230102202933.15968-1-andriy.shevchenko@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/typec/mux/intel_pmc_mux.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/typec/mux/intel_pmc_mux.c b/drivers/usb/typec/mux/intel_pmc_mux.c
+index fdbf3694e21f4..87e2c91306070 100644
+--- a/drivers/usb/typec/mux/intel_pmc_mux.c
++++ b/drivers/usb/typec/mux/intel_pmc_mux.c
+@@ -614,8 +614,10 @@ static int pmc_usb_probe_iom(struct pmc_usb *pmc)
+
+ INIT_LIST_HEAD(&resource_list);
+ ret = acpi_dev_get_memory_resources(adev, &resource_list);
+- if (ret < 0)
++ if (ret < 0) {
++ acpi_dev_put(adev);
+ return ret;
++ }
+
+ rentry = list_first_entry_or_null(&resource_list, struct resource_entry, node);
+ if (rentry)
+--
+2.39.2
+
--- /dev/null
+From 63fbf1396eafccd99f6d0069f2f8f5a213a9a808 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Feb 2023 18:42:27 +0100
+Subject: vfio/ccw: remove WARN_ON during shutdown
+
+From: Eric Farman <farman@linux.ibm.com>
+
+[ Upstream commit 1c06bb87afb2d95b8e9f4f2e3d0d6772c68f3e76 ]
+
+The logic in vfio_ccw_sch_shutdown() always assumed that the input
+subchannel would point to a vfio_ccw_private struct, without checking
+that one exists. The blamed commit put in a check for this scenario,
+to prevent the possibility of a missing private.
+
+The trouble is that check was put alongside a WARN_ON(), presuming
+that such a scenario would be a cause for concern. But this can be
+triggered by binding a subchannel to vfio-ccw, and rebooting the
+system before starting the mdev (via "mdevctl start" or similar)
+or after stopping it. In those cases, shutdown doesn't need to
+worry because either the private was never allocated, or it was
+cleaned up by vfio_ccw_mdev_remove().
+
+Remove the WARN_ON() piece of this check, since there are plausible
+scenarios where private would be NULL in this path.
+
+Fixes: 9e6f07cd1eaa ("vfio/ccw: create a parent struct")
+Signed-off-by: Eric Farman <farman@linux.ibm.com>
+Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>
+Link: https://lore.kernel.org/r/20230210174227.2256424-1-farman@linux.ibm.com
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/cio/vfio_ccw_drv.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/s390/cio/vfio_ccw_drv.c b/drivers/s390/cio/vfio_ccw_drv.c
+index 54aba7cceb33f..ff538a086fc77 100644
+--- a/drivers/s390/cio/vfio_ccw_drv.c
++++ b/drivers/s390/cio/vfio_ccw_drv.c
+@@ -225,7 +225,7 @@ static void vfio_ccw_sch_shutdown(struct subchannel *sch)
+ struct vfio_ccw_parent *parent = dev_get_drvdata(&sch->dev);
+ struct vfio_ccw_private *private = dev_get_drvdata(&parent->dev);
+
+- if (WARN_ON(!private))
++ if (!private)
+ return;
+
+ vfio_ccw_fsm_event(private, VFIO_CCW_EVENT_CLOSE);
+--
+2.39.2
+
--- /dev/null
+From e38aa513d7c08dca74d623de5f50a44076d36853 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Nov 2022 15:18:25 -0500
+Subject: VMCI: check context->notify_page after call to get_user_pages_fast()
+ to avoid GPF
+
+From: George Kennedy <george.kennedy@oracle.com>
+
+[ Upstream commit 1a726cb47fd204109c767409fa9ca15a96328f14 ]
+
+The call to get_user_pages_fast() in vmci_host_setup_notify() can return
+NULL context->notify_page causing a GPF. To avoid GPF check if
+context->notify_page == NULL and return error if so.
+
+general protection fault, probably for non-canonical address
+ 0xe0009d1000000060: 0000 [#1] PREEMPT SMP KASAN NOPTI
+KASAN: maybe wild-memory-access in range [0x0005088000000300-
+ 0x0005088000000307]
+CPU: 2 PID: 26180 Comm: repro_34802241 Not tainted 6.1.0-rc4 #1
+Hardware name: Red Hat KVM, BIOS 1.15.0-2.module+el8.6.0 04/01/2014
+RIP: 0010:vmci_ctx_check_signal_notify+0x91/0xe0
+Call Trace:
+ <TASK>
+ vmci_host_unlocked_ioctl+0x362/0x1f40
+ __x64_sys_ioctl+0x1a1/0x230
+ do_syscall_64+0x3a/0x90
+ entry_SYSCALL_64_after_hwframe+0x63/0xcd
+
+Fixes: a1d88436d53a ("VMCI: Fix two UVA mapping bugs")
+Reported-by: syzkaller <syzkaller@googlegroups.com>
+Signed-off-by: George Kennedy <george.kennedy@oracle.com>
+Reviewed-by: Vishnu Dasa <vdasa@vmware.com>
+Link: https://lore.kernel.org/r/1669666705-24012-1-git-send-email-george.kennedy@oracle.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/vmw_vmci/vmci_host.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/misc/vmw_vmci/vmci_host.c b/drivers/misc/vmw_vmci/vmci_host.c
+index da1e2a773823e..857b9851402a6 100644
+--- a/drivers/misc/vmw_vmci/vmci_host.c
++++ b/drivers/misc/vmw_vmci/vmci_host.c
+@@ -242,6 +242,8 @@ static int vmci_host_setup_notify(struct vmci_ctx *context,
+ context->notify_page = NULL;
+ return VMCI_ERROR_GENERIC;
+ }
++ if (context->notify_page == NULL)
++ return VMCI_ERROR_UNAVAILABLE;
+
+ /*
+ * Map the locked page and set up notify pointer.
+--
+2.39.2
+
--- /dev/null
+From 77113dff633523bc5d2d07535fb0e3ce15bb081c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Dec 2022 19:15:59 +0200
+Subject: wifi: ath11k: debugfs: fix to work with multiple PCI devices
+
+From: Kalle Valo <quic_kvalo@quicinc.com>
+
+[ Upstream commit 323d91d4684d238f6bc3693fed93caf795378fe0 ]
+
+ath11k fails to load if there are multiple ath11k PCI devices with same name:
+
+ ath11k_pci 0000:01:00.0: Hardware name qcn9074 hw1.0
+ debugfs: Directory 'ath11k' with parent '/' already present!
+ ath11k_pci 0000:01:00.0: failed to create ath11k debugfs
+ ath11k_pci 0000:01:00.0: failed to create soc core: -17
+ ath11k_pci 0000:01:00.0: failed to init core: -17
+ ath11k_pci: probe of 0000:01:00.0 failed with error -17
+
+Fix this by creating a directory for each ath11k device using schema
+<bus>-<devname>, for example "pci-0000:06:00.0". This directory created under
+the top-level ath11k directory, for example /sys/kernel/debug/ath11k.
+
+The reference to the toplevel ath11k directory is not stored anymore within ath11k, instead
+it's retrieved using debugfs_lookup(). If the directory does not exist it will
+be created. After the last directory from the ath11k directory is removed, for
+example when doing rmmod ath11k, the empty ath11k directory is left in place,
+it's a minor cosmetic issue anyway.
+
+Here's an example hierarchy with one WCN6855:
+
+ath11k
+`-- pci-0000:06:00.0
+ |-- mac0
+ | |-- dfs_block_radar_events
+ | |-- dfs_simulate_radar
+ | |-- ext_rx_stats
+ | |-- ext_tx_stats
+ | |-- fw_dbglog_config
+ | |-- fw_stats
+ | | |-- beacon_stats
+ | | |-- pdev_stats
+ | | `-- vdev_stats
+ | |-- htt_stats
+ | |-- htt_stats_reset
+ | |-- htt_stats_type
+ | `-- pktlog_filter
+ |-- simulate_fw_crash
+ `-- soc_dp_stats
+
+I didn't have a test setup where I could connect multiple ath11k devices to the
+same the host, so I have only tested this with one device.
+
+Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.9
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.5.0.1-01208-QCAHKSWPL_SILICONZ-1
+Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.5.0.1-01208-QCAHKSWPL_SILICONZ-1
+
+Tested-by: Robert Marko <robert.marko@sartura.hr>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20221220121231.20120-1-kvalo@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath11k/core.h | 1 -
+ drivers/net/wireless/ath/ath11k/debugfs.c | 48 +++++++++++++++++++----
+ 2 files changed, 40 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath11k/core.h b/drivers/net/wireless/ath/ath11k/core.h
+index 22460b0abf037..ac34c57e4bc69 100644
+--- a/drivers/net/wireless/ath/ath11k/core.h
++++ b/drivers/net/wireless/ath/ath11k/core.h
+@@ -912,7 +912,6 @@ struct ath11k_base {
+ enum ath11k_dfs_region dfs_region;
+ #ifdef CONFIG_ATH11K_DEBUGFS
+ struct dentry *debugfs_soc;
+- struct dentry *debugfs_ath11k;
+ #endif
+ struct ath11k_soc_dp_stats soc_stats;
+
+diff --git a/drivers/net/wireless/ath/ath11k/debugfs.c b/drivers/net/wireless/ath/ath11k/debugfs.c
+index ccdf3d5ba1ab6..5bb6fd17fdf6f 100644
+--- a/drivers/net/wireless/ath/ath11k/debugfs.c
++++ b/drivers/net/wireless/ath/ath11k/debugfs.c
+@@ -976,10 +976,6 @@ int ath11k_debugfs_pdev_create(struct ath11k_base *ab)
+ if (test_bit(ATH11K_FLAG_REGISTERED, &ab->dev_flags))
+ return 0;
+
+- ab->debugfs_soc = debugfs_create_dir(ab->hw_params.name, ab->debugfs_ath11k);
+- if (IS_ERR(ab->debugfs_soc))
+- return PTR_ERR(ab->debugfs_soc);
+-
+ debugfs_create_file("simulate_fw_crash", 0600, ab->debugfs_soc, ab,
+ &fops_simulate_fw_crash);
+
+@@ -1001,15 +997,51 @@ void ath11k_debugfs_pdev_destroy(struct ath11k_base *ab)
+
+ int ath11k_debugfs_soc_create(struct ath11k_base *ab)
+ {
+- ab->debugfs_ath11k = debugfs_create_dir("ath11k", NULL);
++ struct dentry *root;
++ bool dput_needed;
++ char name[64];
++ int ret;
++
++ root = debugfs_lookup("ath11k", NULL);
++ if (!root) {
++ root = debugfs_create_dir("ath11k", NULL);
++ if (IS_ERR_OR_NULL(root))
++ return PTR_ERR(root);
++
++ dput_needed = false;
++ } else {
++ /* a dentry from lookup() needs dput() after we don't use it */
++ dput_needed = true;
++ }
++
++ scnprintf(name, sizeof(name), "%s-%s", ath11k_bus_str(ab->hif.bus),
++ dev_name(ab->dev));
++
++ ab->debugfs_soc = debugfs_create_dir(name, root);
++ if (IS_ERR_OR_NULL(ab->debugfs_soc)) {
++ ret = PTR_ERR(ab->debugfs_soc);
++ goto out;
++ }
++
++ ret = 0;
+
+- return PTR_ERR_OR_ZERO(ab->debugfs_ath11k);
++out:
++ if (dput_needed)
++ dput(root);
++
++ return ret;
+ }
+
+ void ath11k_debugfs_soc_destroy(struct ath11k_base *ab)
+ {
+- debugfs_remove_recursive(ab->debugfs_ath11k);
+- ab->debugfs_ath11k = NULL;
++ debugfs_remove_recursive(ab->debugfs_soc);
++ ab->debugfs_soc = NULL;
++
++ /* We are not removing ath11k directory on purpose, even if it
++ * would be empty. This simplifies the directory handling and it's
++ * a minor cosmetic issue to leave an empty ath11k directory to
++ * debugfs.
++ */
+ }
+ EXPORT_SYMBOL(ath11k_debugfs_soc_destroy);
+
+--
+2.39.2
+
--- /dev/null
+From 851160896adc94e29999a34cfb70822093bc6afa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Jan 2023 12:11:42 +0400
+Subject: wifi: ath11k: Fix memory leak in ath11k_peer_rx_frag_setup
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit ed3f83b3459a67a3ab9d806490ac304b567b1c2d ]
+
+crypto_alloc_shash() allocates resources, which should be released by
+crypto_free_shash(). When ath11k_peer_find() fails, there has memory
+leak. Add missing crypto_free_shash() to fix this.
+
+Fixes: 243874c64c81 ("ath11k: handle RX fragments")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230102081142.3937570-1-linmq006@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath11k/dp_rx.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/wireless/ath/ath11k/dp_rx.c b/drivers/net/wireless/ath/ath11k/dp_rx.c
+index c5a4c34d77499..0c53d88293eb7 100644
+--- a/drivers/net/wireless/ath/ath11k/dp_rx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
+@@ -3126,6 +3126,7 @@ int ath11k_peer_rx_frag_setup(struct ath11k *ar, const u8 *peer_mac, int vdev_id
+ if (!peer) {
+ ath11k_warn(ab, "failed to find the peer to set up fragment info\n");
+ spin_unlock_bh(&ab->base_lock);
++ crypto_free_shash(tfm);
+ return -ENOENT;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From b28887adb7f7316d8ec0c8053ed430954166736d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Nov 2022 19:55:32 +0530
+Subject: wifi: ath11k: fix monitor mode bringup crash
+
+From: Nagarajan Maran <quic_nmaran@quicinc.com>
+
+[ Upstream commit 950b43f8bd8a4d476d2da6d2a083a89bcd3c90d7 ]
+
+When the interface is brought up in monitor mode, it leads
+to NULL pointer dereference crash. This crash happens when
+the packet type is extracted for a SKB. This extraction
+which is present in the received msdu delivery path,is
+not needed for the monitor ring packets since they are
+all RAW packets. Hence appending the flags with
+"RX_FLAG_ONLY_MONITOR" to skip that extraction.
+
+Observed calltrace:
+
+Unable to handle kernel NULL pointer dereference at virtual address
+0000000000000064
+Mem abort info:
+ ESR = 0x0000000096000004
+ EC = 0x25: DABT (current EL), IL = 32 bits
+ SET = 0, FnV = 0
+ EA = 0, S1PTW = 0
+ FSC = 0x04: level 0 translation fault
+Data abort info:
+ ISV = 0, ISS = 0x00000004
+ CM = 0, WnR = 0
+user pgtable: 4k pages, 48-bit VAs, pgdp=0000000048517000
+[0000000000000064] pgd=0000000000000000, p4d=0000000000000000
+Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP
+Modules linked in: ath11k_pci ath11k qmi_helpers
+CPU: 2 PID: 1781 Comm: napi/-271 Not tainted
+6.1.0-rc5-wt-ath-656295-gef907406320c-dirty #6
+Hardware name: Qualcomm Technologies, Inc. IPQ8074/AP-HK10-C2 (DT)
+pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+pc : ath11k_hw_qcn9074_rx_desc_get_decap_type+0x34/0x60 [ath11k]
+lr : ath11k_hw_qcn9074_rx_desc_get_decap_type+0x5c/0x60 [ath11k]
+sp : ffff80000ef5bb10
+x29: ffff80000ef5bb10 x28: 0000000000000000 x27: ffff000007baafa0
+x26: ffff000014a91ed0 x25: 0000000000000000 x24: 0000000000000000
+x23: ffff800002b77378 x22: ffff000014a91ec0 x21: ffff000006c8d600
+x20: 0000000000000000 x19: ffff800002b77740 x18: 0000000000000006
+x17: 736564203634343a x16: 656e694c20657079 x15: 0000000000000143
+x14: 00000000ffffffea x13: ffff80000ef5b8b8 x12: ffff80000ef5b8c8
+x11: ffff80000a591d30 x10: ffff80000a579d40 x9 : c0000000ffffefff
+x8 : 0000000000000003 x7 : 0000000000017fe8 x6 : ffff80000a579ce8
+x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000
+x2 : 3a35ec12ed7f8900 x1 : 0000000000000000 x0 : 0000000000000052
+Call trace:
+ ath11k_hw_qcn9074_rx_desc_get_decap_type+0x34/0x60 [ath11k]
+ ath11k_dp_rx_deliver_msdu.isra.42+0xa4/0x3d0 [ath11k]
+ ath11k_dp_rx_mon_deliver.isra.43+0x2f8/0x458 [ath11k]
+ ath11k_dp_rx_process_mon_rings+0x310/0x4c0 [ath11k]
+ ath11k_dp_service_srng+0x234/0x338 [ath11k]
+ ath11k_pcic_ext_grp_napi_poll+0x30/0xb8 [ath11k]
+ __napi_poll+0x5c/0x190
+ napi_threaded_poll+0xf0/0x118
+ kthread+0xf4/0x110
+ ret_from_fork+0x10/0x20
+
+Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+Reported-by: Florian Schmidt <florian@fls.name>
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=216573
+Signed-off-by: Nagarajan Maran <quic_nmaran@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20221129142532.23421-1-quic_nmaran@quicinc.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath11k/dp_rx.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/wireless/ath/ath11k/dp_rx.c b/drivers/net/wireless/ath/ath11k/dp_rx.c
+index 0c53d88293eb7..e964e1b722871 100644
+--- a/drivers/net/wireless/ath/ath11k/dp_rx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
+@@ -5023,6 +5023,7 @@ static int ath11k_dp_rx_mon_deliver(struct ath11k *ar, u32 mac_id,
+ } else {
+ rxs->flag |= RX_FLAG_ALLOW_SAME_PN;
+ }
++ rxs->flag |= RX_FLAG_ONLY_MONITOR;
+ ath11k_update_radiotap(ar, ppduinfo, mon_skb, rxs);
+
+ ath11k_dp_rx_deliver_msdu(ar, napi, mon_skb, rxs);
+--
+2.39.2
+
--- /dev/null
+From 8ff1edd617224dd9c0a1ec192e8656d7dce72f92 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Jan 2023 21:41:30 +0900
+Subject: wifi: ath9k: Fix potential stack-out-of-bounds write in
+ ath9k_wmi_rsp_callback()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Minsuk Kang <linuxlovemin@yonsei.ac.kr>
+
+[ Upstream commit 8a2f35b9830692f7a616f2f627f943bc748af13a ]
+
+Fix a stack-out-of-bounds write that occurs in a WMI response callback
+function that is called after a timeout occurs in ath9k_wmi_cmd().
+The callback writes to wmi->cmd_rsp_buf, a stack-allocated buffer that
+could no longer be valid when a timeout occurs. Set wmi->last_seq_id to
+0 when a timeout occurred.
+
+Found by a modified version of syzkaller.
+
+BUG: KASAN: stack-out-of-bounds in ath9k_wmi_ctrl_rx
+Write of size 4
+Call Trace:
+ memcpy
+ ath9k_wmi_ctrl_rx
+ ath9k_htc_rx_msg
+ ath9k_hif_usb_reg_in_cb
+ __usb_hcd_giveback_urb
+ usb_hcd_giveback_urb
+ dummy_timer
+ call_timer_fn
+ run_timer_softirq
+ __do_softirq
+ irq_exit_rcu
+ sysvec_apic_timer_interrupt
+
+Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.")
+Signed-off-by: Minsuk Kang <linuxlovemin@yonsei.ac.kr>
+Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230104124130.10996-1-linuxlovemin@yonsei.ac.kr
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath9k/wmi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/wireless/ath/ath9k/wmi.c b/drivers/net/wireless/ath/ath9k/wmi.c
+index f315c54bd3ac0..19345b8f7bfd5 100644
+--- a/drivers/net/wireless/ath/ath9k/wmi.c
++++ b/drivers/net/wireless/ath/ath9k/wmi.c
+@@ -341,6 +341,7 @@ int ath9k_wmi_cmd(struct wmi *wmi, enum wmi_cmd_id cmd_id,
+ if (!time_left) {
+ ath_dbg(common, WMI, "Timeout waiting for WMI command: %s\n",
+ wmi_cmd_to_name(cmd_id));
++ wmi->last_seq_id = 0;
+ mutex_unlock(&wmi->op_mutex);
+ return -ETIMEDOUT;
+ }
+--
+2.39.2
+
--- /dev/null
+From 309ce5a3e83c255a386af25e4df47063859a02da Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Dec 2022 10:43:08 +0900
+Subject: wifi: ath9k: Fix use-after-free in ath9k_hif_usb_disconnect()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Minsuk Kang <linuxlovemin@yonsei.ac.kr>
+
+[ Upstream commit f099c5c9e2ba08a379bd354a82e05ef839ae29ac ]
+
+This patch fixes a use-after-free in ath9k that occurs in
+ath9k_hif_usb_disconnect() when ath9k_destroy_wmi() is trying to access
+'drv_priv' that has already been freed by ieee80211_free_hw(), called by
+ath9k_htc_hw_deinit(). The patch moves ath9k_destroy_wmi() before
+ieee80211_free_hw(). Note that urbs from the driver should be killed
+before freeing 'wmi' with ath9k_destroy_wmi() as their callbacks will
+access 'wmi'.
+
+Found by a modified version of syzkaller.
+
+==================================================================
+BUG: KASAN: use-after-free in ath9k_destroy_wmi+0x38/0x40
+Read of size 8 at addr ffff8881069132a0 by task kworker/0:1/7
+
+CPU: 0 PID: 7 Comm: kworker/0:1 Tainted: G O 5.14.0+ #131
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014
+Workqueue: usb_hub_wq hub_event
+Call Trace:
+ dump_stack_lvl+0x8e/0xd1
+ print_address_description.constprop.0.cold+0x93/0x334
+ ? ath9k_destroy_wmi+0x38/0x40
+ ? ath9k_destroy_wmi+0x38/0x40
+ kasan_report.cold+0x83/0xdf
+ ? ath9k_destroy_wmi+0x38/0x40
+ ath9k_destroy_wmi+0x38/0x40
+ ath9k_hif_usb_disconnect+0x329/0x3f0
+ ? ath9k_hif_usb_suspend+0x120/0x120
+ ? usb_disable_interface+0xfc/0x180
+ usb_unbind_interface+0x19b/0x7e0
+ ? usb_autoresume_device+0x50/0x50
+ device_release_driver_internal+0x44d/0x520
+ bus_remove_device+0x2e5/0x5a0
+ device_del+0x5b2/0xe30
+ ? __device_link_del+0x370/0x370
+ ? usb_remove_ep_devs+0x43/0x80
+ ? remove_intf_ep_devs+0x112/0x1a0
+ usb_disable_device+0x1e3/0x5a0
+ usb_disconnect+0x267/0x870
+ hub_event+0x168d/0x3950
+ ? rcu_read_lock_sched_held+0xa1/0xd0
+ ? hub_port_debounce+0x2e0/0x2e0
+ ? check_irq_usage+0x860/0xf20
+ ? drain_workqueue+0x281/0x360
+ ? lock_release+0x640/0x640
+ ? rcu_read_lock_sched_held+0xa1/0xd0
+ ? rcu_read_lock_bh_held+0xb0/0xb0
+ ? lockdep_hardirqs_on_prepare+0x273/0x3e0
+ process_one_work+0x92b/0x1460
+ ? pwq_dec_nr_in_flight+0x330/0x330
+ ? rwlock_bug.part.0+0x90/0x90
+ worker_thread+0x95/0xe00
+ ? __kthread_parkme+0x115/0x1e0
+ ? process_one_work+0x1460/0x1460
+ kthread+0x3a1/0x480
+ ? set_kthread_struct+0x120/0x120
+ ret_from_fork+0x1f/0x30
+
+The buggy address belongs to the page:
+page:ffffea00041a44c0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106913
+flags: 0x200000000000000(node=0|zone=2)
+raw: 0200000000000000 0000000000000000 dead000000000122 0000000000000000
+raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
+page dumped because: kasan: bad access detected
+page_owner tracks the page as freed
+page last allocated via order 3, migratetype Unmovable, gfp_mask 0x40dc0(GFP_KERNEL|__GFP_COMP|__GFP_ZERO), pid 7, ts 38347963444, free_ts 41399957635
+ prep_new_page+0x1aa/0x240
+ get_page_from_freelist+0x159a/0x27c0
+ __alloc_pages+0x2da/0x6a0
+ alloc_pages+0xec/0x1e0
+ kmalloc_order+0x39/0xf0
+ kmalloc_order_trace+0x19/0x120
+ __kmalloc+0x308/0x390
+ wiphy_new_nm+0x6f5/0x1dd0
+ ieee80211_alloc_hw_nm+0x36d/0x2230
+ ath9k_htc_probe_device+0x9d/0x1e10
+ ath9k_htc_hw_init+0x34/0x50
+ ath9k_hif_usb_firmware_cb+0x25f/0x4e0
+ request_firmware_work_func+0x131/0x240
+ process_one_work+0x92b/0x1460
+ worker_thread+0x95/0xe00
+ kthread+0x3a1/0x480
+page last free stack trace:
+ free_pcp_prepare+0x3d3/0x7f0
+ free_unref_page+0x1e/0x3d0
+ device_release+0xa4/0x240
+ kobject_put+0x186/0x4c0
+ put_device+0x20/0x30
+ ath9k_htc_disconnect_device+0x1cf/0x2c0
+ ath9k_htc_hw_deinit+0x26/0x30
+ ath9k_hif_usb_disconnect+0x2d9/0x3f0
+ usb_unbind_interface+0x19b/0x7e0
+ device_release_driver_internal+0x44d/0x520
+ bus_remove_device+0x2e5/0x5a0
+ device_del+0x5b2/0xe30
+ usb_disable_device+0x1e3/0x5a0
+ usb_disconnect+0x267/0x870
+ hub_event+0x168d/0x3950
+ process_one_work+0x92b/0x1460
+
+Memory state around the buggy address:
+ ffff888106913180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
+ ffff888106913200: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
+>ffff888106913280: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
+ ^
+ ffff888106913300: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
+ ffff888106913380: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
+==================================================================
+
+Reported-by: Dokyung Song <dokyungs@yonsei.ac.kr>
+Reported-by: Jisoo Jang <jisoo.jang@yonsei.ac.kr>
+Reported-by: Minsuk Kang <linuxlovemin@yonsei.ac.kr>
+Signed-off-by: Minsuk Kang <linuxlovemin@yonsei.ac.kr>
+Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20221205014308.1617597-1-linuxlovemin@yonsei.ac.kr
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath9k/hif_usb.c | 2 --
+ drivers/net/wireless/ath/ath9k/htc_drv_init.c | 2 ++
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c
+index de6c0824c9cab..f521dfa2f1945 100644
+--- a/drivers/net/wireless/ath/ath9k/hif_usb.c
++++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
+@@ -1424,8 +1424,6 @@ static void ath9k_hif_usb_disconnect(struct usb_interface *interface)
+
+ if (hif_dev->flags & HIF_USB_READY) {
+ ath9k_htc_hw_deinit(hif_dev->htc_handle, unplugged);
+- ath9k_hif_usb_dev_deinit(hif_dev);
+- ath9k_destroy_wmi(hif_dev->htc_handle->drv_priv);
+ ath9k_htc_hw_free(hif_dev->htc_handle);
+ }
+
+diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+index 07ac88fb1c577..96a3185a96d75 100644
+--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c
++++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+@@ -988,6 +988,8 @@ void ath9k_htc_disconnect_device(struct htc_target *htc_handle, bool hotunplug)
+
+ ath9k_deinit_device(htc_handle->drv_priv);
+ ath9k_stop_wmi(htc_handle->drv_priv);
++ ath9k_hif_usb_dealloc_urbs((struct hif_device_usb *)htc_handle->hif_dev);
++ ath9k_destroy_wmi(htc_handle->drv_priv);
+ ieee80211_free_hw(htc_handle->drv_priv->hw);
+ }
+ }
+--
+2.39.2
+
--- /dev/null
+From cb7bd77f7140dc62e787c90fb8b6e8fb5591e4d7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Jan 2023 15:36:15 +0300
+Subject: wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream()
+ fails
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Fedor Pchelkin <pchelkin@ispras.ru>
+
+[ Upstream commit 0af54343a76263a12dbae7fafb64eb47c4a6ad38 ]
+
+Syzkaller detected a memory leak of skbs in ath9k_hif_usb_rx_stream().
+While processing skbs in ath9k_hif_usb_rx_stream(), the already allocated
+skbs in skb_pool are not freed if ath9k_hif_usb_rx_stream() fails. If we
+have an incorrect pkt_len or pkt_tag, the input skb is considered invalid
+and dropped. All the associated packets already in skb_pool should be
+dropped and freed. Added a comment describing this issue.
+
+The patch also makes remain_skb NULL after being processed so that it
+cannot be referenced after potential free. The initialization of hif_dev
+fields which are associated with remain_skb (rx_remain_len,
+rx_transfer_len and rx_pad_len) is moved after a new remain_skb is
+allocated.
+
+Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
+
+Fixes: 6ce708f54cc8 ("ath9k: Fix out-of-bound memcpy in ath9k_hif_usb_rx_stream")
+Fixes: 44b23b488d44 ("ath9k: hif_usb: Reduce indent 1 column")
+Reported-by: syzbot+e9632e3eb038d93d6bc6@syzkaller.appspotmail.com
+Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
+Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
+Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230104123615.51511-1-pchelkin@ispras.ru
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath9k/hif_usb.c | 31 +++++++++++++++++-------
+ 1 file changed, 22 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c
+index 1a2e0c7eeb023..de6c0824c9cab 100644
+--- a/drivers/net/wireless/ath/ath9k/hif_usb.c
++++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
+@@ -561,11 +561,11 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev,
+ memcpy(ptr, skb->data, rx_remain_len);
+
+ rx_pkt_len += rx_remain_len;
+- hif_dev->rx_remain_len = 0;
+ skb_put(remain_skb, rx_pkt_len);
+
+ skb_pool[pool_index++] = remain_skb;
+-
++ hif_dev->remain_skb = NULL;
++ hif_dev->rx_remain_len = 0;
+ } else {
+ index = rx_remain_len;
+ }
+@@ -584,16 +584,21 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev,
+ pkt_len = get_unaligned_le16(ptr + index);
+ pkt_tag = get_unaligned_le16(ptr + index + 2);
+
++ /* It is supposed that if we have an invalid pkt_tag or
++ * pkt_len then the whole input SKB is considered invalid
++ * and dropped; the associated packets already in skb_pool
++ * are dropped, too.
++ */
+ if (pkt_tag != ATH_USB_RX_STREAM_MODE_TAG) {
+ RX_STAT_INC(hif_dev, skb_dropped);
+- return;
++ goto invalid_pkt;
+ }
+
+ if (pkt_len > 2 * MAX_RX_BUF_SIZE) {
+ dev_err(&hif_dev->udev->dev,
+ "ath9k_htc: invalid pkt_len (%x)\n", pkt_len);
+ RX_STAT_INC(hif_dev, skb_dropped);
+- return;
++ goto invalid_pkt;
+ }
+
+ pad_len = 4 - (pkt_len & 0x3);
+@@ -605,11 +610,6 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev,
+
+ if (index > MAX_RX_BUF_SIZE) {
+ spin_lock(&hif_dev->rx_lock);
+- hif_dev->rx_remain_len = index - MAX_RX_BUF_SIZE;
+- hif_dev->rx_transfer_len =
+- MAX_RX_BUF_SIZE - chk_idx - 4;
+- hif_dev->rx_pad_len = pad_len;
+-
+ nskb = __dev_alloc_skb(pkt_len + 32, GFP_ATOMIC);
+ if (!nskb) {
+ dev_err(&hif_dev->udev->dev,
+@@ -617,6 +617,12 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev,
+ spin_unlock(&hif_dev->rx_lock);
+ goto err;
+ }
++
++ hif_dev->rx_remain_len = index - MAX_RX_BUF_SIZE;
++ hif_dev->rx_transfer_len =
++ MAX_RX_BUF_SIZE - chk_idx - 4;
++ hif_dev->rx_pad_len = pad_len;
++
+ skb_reserve(nskb, 32);
+ RX_STAT_INC(hif_dev, skb_allocated);
+
+@@ -654,6 +660,13 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev,
+ skb_pool[i]->len, USB_WLAN_RX_PIPE);
+ RX_STAT_INC(hif_dev, skb_completed);
+ }
++ return;
++invalid_pkt:
++ for (i = 0; i < pool_index; i++) {
++ dev_kfree_skb_any(skb_pool[i]);
++ RX_STAT_INC(hif_dev, skb_dropped);
++ }
++ return;
+ }
+
+ static void ath9k_hif_usb_rx_cb(struct urb *urb)
+--
+2.39.2
+
--- /dev/null
+From 55f4526f0af743724784205b46d96a28c535575b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Jan 2023 15:35:46 +0300
+Subject: wifi: ath9k: htc_hst: free skb in ath9k_htc_rx_msg() if there is no
+ callback function
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Fedor Pchelkin <pchelkin@ispras.ru>
+
+[ Upstream commit 9b25e3985477ac3f02eca5fc1e0cc6850a3f7e69 ]
+
+It is stated that ath9k_htc_rx_msg() either frees the provided skb or
+passes its management to another callback function. However, the skb is
+not freed in case there is no another callback function, and Syzkaller was
+able to cause a memory leak. Also minor comment fix.
+
+Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
+
+Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.")
+Reported-by: syzbot+e008dccab31bd3647609@syzkaller.appspotmail.com
+Reported-by: syzbot+6692c72009680f7c4eb2@syzkaller.appspotmail.com
+Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
+Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
+Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230104123546.51427-1-pchelkin@ispras.ru
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath9k/htc_hst.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c
+index ca05b07a45e67..fe62ff668f757 100644
+--- a/drivers/net/wireless/ath/ath9k/htc_hst.c
++++ b/drivers/net/wireless/ath/ath9k/htc_hst.c
+@@ -391,7 +391,7 @@ static void ath9k_htc_fw_panic_report(struct htc_target *htc_handle,
+ * HTC Messages are handled directly here and the obtained SKB
+ * is freed.
+ *
+- * Service messages (Data, WMI) passed to the corresponding
++ * Service messages (Data, WMI) are passed to the corresponding
+ * endpoint RX handlers, which have to free the SKB.
+ */
+ void ath9k_htc_rx_msg(struct htc_target *htc_handle,
+@@ -478,6 +478,8 @@ void ath9k_htc_rx_msg(struct htc_target *htc_handle,
+ if (endpoint->ep_callbacks.rx)
+ endpoint->ep_callbacks.rx(endpoint->ep_callbacks.priv,
+ skb, epid);
++ else
++ goto invalid;
+ }
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 4b6eaced482f4863814787b7bb4e4c735b5cd3e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Dec 2022 16:51:39 +0900
+Subject: wifi: brcmfmac: ensure CLM version is null-terminated to prevent
+ stack-out-of-bounds
+
+From: Jisoo Jang <jisoo.jang@yonsei.ac.kr>
+
+[ Upstream commit 660145d708be52f946a82e5b633c020f58f996de ]
+
+Fix a stack-out-of-bounds read in brcmfmac that occurs
+when 'buf' that is not null-terminated is passed as an argument of
+strreplace() in brcmf_c_preinit_dcmds(). This buffer is filled with
+a CLM version string by memcpy() in brcmf_fil_iovar_data_get().
+Ensure buf is null-terminated.
+
+Found by a modified version of syzkaller.
+
+[ 33.004414][ T1896] brcmfmac: brcmf_c_process_clm_blob: no clm_blob available (err=-2), device may have limited channels available
+[ 33.013486][ T1896] brcmfmac: brcmf_c_preinit_dcmds: Firmware: BCM43236/3 wl0: Nov 30 2011 17:33:42 version 5.90.188.22
+[ 33.021554][ T1896] ==================================================================
+[ 33.022379][ T1896] BUG: KASAN: stack-out-of-bounds in strreplace+0xf2/0x110
+[ 33.023122][ T1896] Read of size 1 at addr ffffc90001d6efc8 by task kworker/0:2/1896
+[ 33.023852][ T1896]
+[ 33.024096][ T1896] CPU: 0 PID: 1896 Comm: kworker/0:2 Tainted: G O 5.14.0+ #132
+[ 33.024927][ T1896] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014
+[ 33.026065][ T1896] Workqueue: usb_hub_wq hub_event
+[ 33.026581][ T1896] Call Trace:
+[ 33.026896][ T1896] dump_stack_lvl+0x57/0x7d
+[ 33.027372][ T1896] print_address_description.constprop.0.cold+0xf/0x334
+[ 33.028037][ T1896] ? strreplace+0xf2/0x110
+[ 33.028403][ T1896] ? strreplace+0xf2/0x110
+[ 33.028807][ T1896] kasan_report.cold+0x83/0xdf
+[ 33.029283][ T1896] ? strreplace+0xf2/0x110
+[ 33.029666][ T1896] strreplace+0xf2/0x110
+[ 33.029966][ T1896] brcmf_c_preinit_dcmds+0xab1/0xc40
+[ 33.030351][ T1896] ? brcmf_c_set_joinpref_default+0x100/0x100
+[ 33.030787][ T1896] ? rcu_read_lock_sched_held+0xa1/0xd0
+[ 33.031223][ T1896] ? rcu_read_lock_bh_held+0xb0/0xb0
+[ 33.031661][ T1896] ? lock_acquire+0x19d/0x4e0
+[ 33.032091][ T1896] ? find_held_lock+0x2d/0x110
+[ 33.032605][ T1896] ? brcmf_usb_deq+0x1a7/0x260
+[ 33.033087][ T1896] ? brcmf_usb_rx_fill_all+0x5a/0xf0
+[ 33.033582][ T1896] brcmf_attach+0x246/0xd40
+[ 33.034022][ T1896] ? wiphy_new_nm+0x1476/0x1d50
+[ 33.034383][ T1896] ? kmemdup+0x30/0x40
+[ 33.034722][ T1896] brcmf_usb_probe+0x12de/0x1690
+[ 33.035223][ T1896] ? brcmf_usbdev_qinit.constprop.0+0x470/0x470
+[ 33.035833][ T1896] usb_probe_interface+0x25f/0x710
+[ 33.036315][ T1896] really_probe+0x1be/0xa90
+[ 33.036656][ T1896] __driver_probe_device+0x2ab/0x460
+[ 33.037026][ T1896] ? usb_match_id.part.0+0x88/0xc0
+[ 33.037383][ T1896] driver_probe_device+0x49/0x120
+[ 33.037790][ T1896] __device_attach_driver+0x18a/0x250
+[ 33.038300][ T1896] ? driver_allows_async_probing+0x120/0x120
+[ 33.038986][ T1896] bus_for_each_drv+0x123/0x1a0
+[ 33.039906][ T1896] ? bus_rescan_devices+0x20/0x20
+[ 33.041412][ T1896] ? lockdep_hardirqs_on_prepare+0x273/0x3e0
+[ 33.041861][ T1896] ? trace_hardirqs_on+0x1c/0x120
+[ 33.042330][ T1896] __device_attach+0x207/0x330
+[ 33.042664][ T1896] ? device_bind_driver+0xb0/0xb0
+[ 33.043026][ T1896] ? kobject_uevent_env+0x230/0x12c0
+[ 33.043515][ T1896] bus_probe_device+0x1a2/0x260
+[ 33.043914][ T1896] device_add+0xa61/0x1ce0
+[ 33.044227][ T1896] ? __mutex_unlock_slowpath+0xe7/0x660
+[ 33.044891][ T1896] ? __fw_devlink_link_to_suppliers+0x550/0x550
+[ 33.045531][ T1896] usb_set_configuration+0x984/0x1770
+[ 33.046051][ T1896] ? kernfs_create_link+0x175/0x230
+[ 33.046548][ T1896] usb_generic_driver_probe+0x69/0x90
+[ 33.046931][ T1896] usb_probe_device+0x9c/0x220
+[ 33.047434][ T1896] really_probe+0x1be/0xa90
+[ 33.047760][ T1896] __driver_probe_device+0x2ab/0x460
+[ 33.048134][ T1896] driver_probe_device+0x49/0x120
+[ 33.048516][ T1896] __device_attach_driver+0x18a/0x250
+[ 33.048910][ T1896] ? driver_allows_async_probing+0x120/0x120
+[ 33.049437][ T1896] bus_for_each_drv+0x123/0x1a0
+[ 33.049814][ T1896] ? bus_rescan_devices+0x20/0x20
+[ 33.050164][ T1896] ? lockdep_hardirqs_on_prepare+0x273/0x3e0
+[ 33.050579][ T1896] ? trace_hardirqs_on+0x1c/0x120
+[ 33.050936][ T1896] __device_attach+0x207/0x330
+[ 33.051399][ T1896] ? device_bind_driver+0xb0/0xb0
+[ 33.051888][ T1896] ? kobject_uevent_env+0x230/0x12c0
+[ 33.052314][ T1896] bus_probe_device+0x1a2/0x260
+[ 33.052688][ T1896] device_add+0xa61/0x1ce0
+[ 33.053121][ T1896] ? __fw_devlink_link_to_suppliers+0x550/0x550
+[ 33.053568][ T1896] usb_new_device.cold+0x463/0xf66
+[ 33.053953][ T1896] ? hub_disconnect+0x400/0x400
+[ 33.054313][ T1896] ? rwlock_bug.part.0+0x90/0x90
+[ 33.054661][ T1896] ? lockdep_hardirqs_on_prepare+0x273/0x3e0
+[ 33.055094][ T1896] hub_event+0x10d5/0x3330
+[ 33.055530][ T1896] ? hub_port_debounce+0x280/0x280
+[ 33.055934][ T1896] ? __lock_acquire+0x1671/0x5790
+[ 33.056387][ T1896] ? wq_calc_node_cpumask+0x170/0x2a0
+[ 33.056924][ T1896] ? lock_release+0x640/0x640
+[ 33.057383][ T1896] ? rcu_read_lock_sched_held+0xa1/0xd0
+[ 33.057916][ T1896] ? rcu_read_lock_bh_held+0xb0/0xb0
+[ 33.058402][ T1896] ? lockdep_hardirqs_on_prepare+0x273/0x3e0
+[ 33.059019][ T1896] process_one_work+0x873/0x13e0
+[ 33.059488][ T1896] ? lock_release+0x640/0x640
+[ 33.059932][ T1896] ? pwq_dec_nr_in_flight+0x320/0x320
+[ 33.060446][ T1896] ? rwlock_bug.part.0+0x90/0x90
+[ 33.060898][ T1896] worker_thread+0x8b/0xd10
+[ 33.061348][ T1896] ? __kthread_parkme+0xd9/0x1d0
+[ 33.061810][ T1896] ? process_one_work+0x13e0/0x13e0
+[ 33.062288][ T1896] kthread+0x379/0x450
+[ 33.062660][ T1896] ? _raw_spin_unlock_irq+0x24/0x30
+[ 33.063148][ T1896] ? set_kthread_struct+0x100/0x100
+[ 33.063606][ T1896] ret_from_fork+0x1f/0x30
+[ 33.064070][ T1896]
+[ 33.064313][ T1896]
+[ 33.064545][ T1896] addr ffffc90001d6efc8 is located in stack of task kworker/0:2/1896 at offset 512 in frame:
+[ 33.065478][ T1896] brcmf_c_preinit_dcmds+0x0/0xc40
+[ 33.065973][ T1896]
+[ 33.066191][ T1896] this frame has 4 objects:
+[ 33.066614][ T1896] [48, 56) 'ptr'
+[ 33.066618][ T1896] [80, 148) 'revinfo'
+[ 33.066957][ T1896] [192, 210) 'eventmask'
+[ 33.067338][ T1896] [256, 512) 'buf'
+[ 33.067742][ T1896]
+[ 33.068304][ T1896] Memory state around the buggy address:
+[ 33.068838][ T1896] ffffc90001d6ee80: f2 00 00 02 f2 f2 f2 f2 f2 00 00 00 00 00 00 00
+[ 33.069545][ T1896] ffffc90001d6ef00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+[ 33.070626][ T1896] >ffffc90001d6ef80: 00 00 00 00 00 00 00 00 00 f3 f3 f3 f3 f3 f3 f3
+[ 33.072052][ T1896] ^
+[ 33.073043][ T1896] ffffc90001d6f000: f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+[ 33.074230][ T1896] ffffc90001d6f080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+[ 33.074914][ T1896] ==================================================================
+[ 33.075713][ T1896] Disabling lock debugging due to kernel taint
+
+Reviewed-by: Arend van Spriel<arend.vanspriel@broadcom.com>
+Signed-off-by: Jisoo Jang <jisoo.jang@yonsei.ac.kr>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20221230075139.56591-1-jisoo.jang@yonsei.ac.kr
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
+index 5b484bbac8a79..f235beaddddba 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
+@@ -320,15 +320,17 @@ int brcmf_c_preinit_dcmds(struct brcmf_if *ifp)
+ if (err) {
+ brcmf_dbg(TRACE, "retrieving clmver failed, %d\n", err);
+ } else {
++ buf[sizeof(buf) - 1] = '\0';
+ clmver = (char *)buf;
+- /* store CLM version for adding it to revinfo debugfs file */
+- memcpy(ifp->drvr->clmver, clmver, sizeof(ifp->drvr->clmver));
+
+ /* Replace all newline/linefeed characters with space
+ * character
+ */
+ strreplace(clmver, '\n', ' ');
+
++ /* store CLM version for adding it to revinfo debugfs file */
++ memcpy(ifp->drvr->clmver, clmver, sizeof(ifp->drvr->clmver));
++
+ brcmf_dbg(INFO, "CLM version = %s\n", clmver);
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 3a28266a136629087b4b3d7c6b414adacfca062f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Nov 2022 19:33:01 +0800
+Subject: wifi: brcmfmac: fix potential memory leak in
+ brcmf_netdev_start_xmit()
+
+From: Zhang Changzhong <zhangchangzhong@huawei.com>
+
+[ Upstream commit 212fde3fe76e962598ce1d47b97cc78afdfc71b3 ]
+
+The brcmf_netdev_start_xmit() returns NETDEV_TX_OK without freeing skb
+in case of pskb_expand_head() fails, add dev_kfree_skb() to fix it.
+Compile tested only.
+
+Fixes: 270a6c1f65fe ("brcmfmac: rework headroom check in .start_xmit()")
+Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
+Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/1668684782-47422-1-git-send-email-zhangchangzhong@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+index 83ea251cfcecf..f599d5f896e89 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+@@ -336,6 +336,7 @@ static netdev_tx_t brcmf_netdev_start_xmit(struct sk_buff *skb,
+ bphy_err(drvr, "%s: failed to expand headroom\n",
+ brcmf_ifname(ifp));
+ atomic_inc(&drvr->bus_if->stats.pktcow_failed);
++ dev_kfree_skb(skb);
+ goto done;
+ }
+ }
+--
+2.39.2
+
--- /dev/null
+From 45cbb10f5499cb13fad884524ccbfe3e89a3f6b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Nov 2022 13:34:58 +0900
+Subject: wifi: brcmfmac: Fix potential stack-out-of-bounds in
+ brcmf_c_preinit_dcmds()
+
+From: Jisoo Jang <jisoo.jang@yonsei.ac.kr>
+
+[ Upstream commit 0a06cadcc2a0044e4a117cc0e61436fc3a0dad69 ]
+
+This patch fixes a stack-out-of-bounds read in brcmfmac that occurs
+when 'buf' that is not null-terminated is passed as an argument of
+strsep() in brcmf_c_preinit_dcmds(). This buffer is filled with a firmware
+version string by memcpy() in brcmf_fil_iovar_data_get().
+The patch ensures buf is null-terminated.
+
+Found by a modified version of syzkaller.
+
+[ 47.569679][ T1897] brcmfmac: brcmf_fw_alloc_request: using brcm/brcmfmac43236b for chip BCM43236/3
+[ 47.582839][ T1897] brcmfmac: brcmf_c_process_clm_blob: no clm_blob available (err=-2), device may have limited channels available
+[ 47.601565][ T1897] ==================================================================
+[ 47.602574][ T1897] BUG: KASAN: stack-out-of-bounds in strsep+0x1b2/0x1f0
+[ 47.603447][ T1897] Read of size 1 at addr ffffc90001f6f000 by task kworker/0:2/1897
+[ 47.604336][ T1897]
+[ 47.604621][ T1897] CPU: 0 PID: 1897 Comm: kworker/0:2 Tainted: G O 5.14.0+ #131
+[ 47.605617][ T1897] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014
+[ 47.606907][ T1897] Workqueue: usb_hub_wq hub_event
+[ 47.607453][ T1897] Call Trace:
+[ 47.607801][ T1897] dump_stack_lvl+0x8e/0xd1
+[ 47.608295][ T1897] print_address_description.constprop.0.cold+0xf/0x334
+[ 47.609009][ T1897] ? strsep+0x1b2/0x1f0
+[ 47.609434][ T1897] ? strsep+0x1b2/0x1f0
+[ 47.609863][ T1897] kasan_report.cold+0x83/0xdf
+[ 47.610366][ T1897] ? strsep+0x1b2/0x1f0
+[ 47.610882][ T1897] strsep+0x1b2/0x1f0
+[ 47.611300][ T1897] ? brcmf_fil_iovar_data_get+0x3a/0xf0
+[ 47.611883][ T1897] brcmf_c_preinit_dcmds+0x995/0xc40
+[ 47.612434][ T1897] ? brcmf_c_set_joinpref_default+0x100/0x100
+[ 47.613078][ T1897] ? rcu_read_lock_sched_held+0xa1/0xd0
+[ 47.613662][ T1897] ? rcu_read_lock_bh_held+0xb0/0xb0
+[ 47.614208][ T1897] ? lock_acquire+0x19d/0x4e0
+[ 47.614704][ T1897] ? find_held_lock+0x2d/0x110
+[ 47.615236][ T1897] ? brcmf_usb_deq+0x1a7/0x260
+[ 47.615741][ T1897] ? brcmf_usb_rx_fill_all+0x5a/0xf0
+[ 47.616288][ T1897] brcmf_attach+0x246/0xd40
+[ 47.616758][ T1897] ? wiphy_new_nm+0x1703/0x1dd0
+[ 47.617280][ T1897] ? kmemdup+0x43/0x50
+[ 47.617720][ T1897] brcmf_usb_probe+0x12de/0x1690
+[ 47.618244][ T1897] ? brcmf_usbdev_qinit.constprop.0+0x470/0x470
+[ 47.618901][ T1897] usb_probe_interface+0x2aa/0x760
+[ 47.619429][ T1897] ? usb_probe_device+0x250/0x250
+[ 47.619950][ T1897] really_probe+0x205/0xb70
+[ 47.620435][ T1897] ? driver_allows_async_probing+0x130/0x130
+[ 47.621048][ T1897] __driver_probe_device+0x311/0x4b0
+[ 47.621595][ T1897] ? driver_allows_async_probing+0x130/0x130
+[ 47.622209][ T1897] driver_probe_device+0x4e/0x150
+[ 47.622739][ T1897] __device_attach_driver+0x1cc/0x2a0
+[ 47.623287][ T1897] bus_for_each_drv+0x156/0x1d0
+[ 47.623796][ T1897] ? bus_rescan_devices+0x30/0x30
+[ 47.624309][ T1897] ? lockdep_hardirqs_on_prepare+0x273/0x3e0
+[ 47.624907][ T1897] ? trace_hardirqs_on+0x46/0x160
+[ 47.625437][ T1897] __device_attach+0x23f/0x3a0
+[ 47.625924][ T1897] ? device_bind_driver+0xd0/0xd0
+[ 47.626433][ T1897] ? kobject_uevent_env+0x287/0x14b0
+[ 47.627057][ T1897] bus_probe_device+0x1da/0x290
+[ 47.627557][ T1897] device_add+0xb7b/0x1eb0
+[ 47.628027][ T1897] ? wait_for_completion+0x290/0x290
+[ 47.628593][ T1897] ? __fw_devlink_link_to_suppliers+0x5a0/0x5a0
+[ 47.629249][ T1897] usb_set_configuration+0xf59/0x16f0
+[ 47.629829][ T1897] usb_generic_driver_probe+0x82/0xa0
+[ 47.630385][ T1897] usb_probe_device+0xbb/0x250
+[ 47.630927][ T1897] ? usb_suspend+0x590/0x590
+[ 47.631397][ T1897] really_probe+0x205/0xb70
+[ 47.631855][ T1897] ? driver_allows_async_probing+0x130/0x130
+[ 47.632469][ T1897] __driver_probe_device+0x311/0x4b0
+[ 47.633002][ T1897] ? usb_generic_driver_match+0x75/0x90
+[ 47.633573][ T1897] ? driver_allows_async_probing+0x130/0x130
+[ 47.634170][ T1897] driver_probe_device+0x4e/0x150
+[ 47.634703][ T1897] __device_attach_driver+0x1cc/0x2a0
+[ 47.635248][ T1897] bus_for_each_drv+0x156/0x1d0
+[ 47.635748][ T1897] ? bus_rescan_devices+0x30/0x30
+[ 47.636271][ T1897] ? lockdep_hardirqs_on_prepare+0x273/0x3e0
+[ 47.636881][ T1897] ? trace_hardirqs_on+0x46/0x160
+[ 47.637396][ T1897] __device_attach+0x23f/0x3a0
+[ 47.637904][ T1897] ? device_bind_driver+0xd0/0xd0
+[ 47.638426][ T1897] ? kobject_uevent_env+0x287/0x14b0
+[ 47.638985][ T1897] bus_probe_device+0x1da/0x290
+[ 47.639512][ T1897] device_add+0xb7b/0x1eb0
+[ 47.639977][ T1897] ? __fw_devlink_link_to_suppliers+0x5a0/0x5a0
+[ 47.640612][ T1897] ? kfree+0x14a/0x6b0
+[ 47.641055][ T1897] ? __usb_get_extra_descriptor+0x116/0x160
+[ 47.641679][ T1897] usb_new_device.cold+0x49c/0x1029
+[ 47.642245][ T1897] ? hub_disconnect+0x450/0x450
+[ 47.642756][ T1897] ? rwlock_bug.part.0+0x90/0x90
+[ 47.643273][ T1897] ? _raw_spin_unlock_irq+0x24/0x30
+[ 47.643822][ T1897] ? lockdep_hardirqs_on_prepare+0x273/0x3e0
+[ 47.644445][ T1897] hub_event+0x1c98/0x3950
+[ 47.644939][ T1897] ? hub_port_debounce+0x2e0/0x2e0
+[ 47.645467][ T1897] ? check_irq_usage+0x861/0xf20
+[ 47.645975][ T1897] ? drain_workqueue+0x280/0x360
+[ 47.646506][ T1897] ? lock_release+0x640/0x640
+[ 47.646994][ T1897] ? rcu_read_lock_sched_held+0xa1/0xd0
+[ 47.647572][ T1897] ? rcu_read_lock_bh_held+0xb0/0xb0
+[ 47.648111][ T1897] ? lockdep_hardirqs_on_prepare+0x273/0x3e0
+[ 47.648735][ T1897] process_one_work+0x92b/0x1460
+[ 47.649262][ T1897] ? pwq_dec_nr_in_flight+0x330/0x330
+[ 47.649816][ T1897] ? rwlock_bug.part.0+0x90/0x90
+[ 47.650336][ T1897] worker_thread+0x95/0xe00
+[ 47.650830][ T1897] ? __kthread_parkme+0x115/0x1e0
+[ 47.651361][ T1897] ? process_one_work+0x1460/0x1460
+[ 47.651904][ T1897] kthread+0x3a1/0x480
+[ 47.652329][ T1897] ? set_kthread_struct+0x120/0x120
+[ 47.652878][ T1897] ret_from_fork+0x1f/0x30
+[ 47.653370][ T1897]
+[ 47.653608][ T1897]
+[ 47.653848][ T1897] addr ffffc90001f6f000 is located in stack of task kworker/0:2/1897 at offset 512 in frame:
+[ 47.654891][ T1897] brcmf_c_preinit_dcmds+0x0/0xc40
+[ 47.655442][ T1897]
+[ 47.655690][ T1897] this frame has 4 objects:
+[ 47.656151][ T1897] [48, 56) 'ptr'
+[ 47.656159][ T1897] [80, 148) 'revinfo'
+[ 47.656534][ T1897] [192, 210) 'eventmask'
+[ 47.656953][ T1897] [256, 512) 'buf'
+[ 47.657410][ T1897]
+[ 47.658035][ T1897] Memory state around the buggy address:
+[ 47.658743][ T1897] ffffc90001f6ef00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+[ 47.659577][ T1897] ffffc90001f6ef80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+[ 47.660394][ T1897] >ffffc90001f6f000: f3 f3 f3 f3 f3 f3 f3 f3 00 00 00 00 00 00 00 00
+[ 47.661199][ T1897] ^
+[ 47.661625][ T1897] ffffc90001f6f080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+[ 47.662455][ T1897] ffffc90001f6f100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1
+[ 47.663318][ T1897] ==================================================================
+[ 47.664147][ T1897] Disabling lock debugging due to kernel taint
+
+Reported-by: Dokyung Song <dokyungs@yonsei.ac.kr>
+Reported-by: Jisoo Jang <jisoo.jang@yonsei.ac.kr>
+Reported-by: Minsuk Kang <linuxlovemin@yonsei.ac.kr>
+Signed-off-by: Jisoo Jang <jisoo.jang@yonsei.ac.kr>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20221115043458.37562-1-jisoo.jang@yonsei.ac.kr
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
+index 4a309e5a5707b..5b484bbac8a79 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
+@@ -299,6 +299,7 @@ int brcmf_c_preinit_dcmds(struct brcmf_if *ifp)
+ err);
+ goto done;
+ }
++ buf[sizeof(buf) - 1] = '\0';
+ ptr = (char *)buf;
+ strsep(&ptr, "\n");
+
+--
+2.39.2
+
--- /dev/null
+From c95052a9a3a8314723487ac3396009c54539ace4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 12 Feb 2023 15:38:11 +0900
+Subject: wifi: brcmfmac: pcie: Add IDs/properties for BCM4355
+
+From: Hector Martin <marcan@marcan.st>
+
+[ Upstream commit 69005e67ce54cb837b8218b002c1bb868c83b7a9 ]
+
+This chip is present on at least these Apple T2 Macs:
+
+* hawaii: MacBook Air 13" (Late 2018)
+* hawaii: MacBook Air 13" (True Tone, 2019)
+
+Users report seeing PCI revision ID 12 for this chip, which Arend
+reports should be revision C2, but Apple has the firmware tagged as
+revision C1. Assume the right cutoff point for firmware versions is
+revision ID 11 then, and leave older revisions using the non-versioned
+firmware filename (Apple only uses C1 firmware builds).
+
+Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Hector Martin <marcan@marcan.st>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20230212063813.27622-3-marcan@marcan.st
+Stable-dep-of: 6a142f70774f ("wifi: brcmfmac: pcie: Perform correct BCM4364 firmware selection")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/broadcom/brcm80211/brcmfmac/pcie.c | 10 +++++++++-
+ .../wireless/broadcom/brcm80211/include/brcm_hw_ids.h | 1 +
+ 2 files changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+index 8f8d605a7f2da..a8d77569faf70 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+@@ -52,6 +52,7 @@ BRCMF_FW_DEF(43602, "brcmfmac43602-pcie");
+ BRCMF_FW_DEF(4350, "brcmfmac4350-pcie");
+ BRCMF_FW_DEF(4350C, "brcmfmac4350c2-pcie");
+ BRCMF_FW_CLM_DEF(4355, "brcmfmac4355-pcie");
++BRCMF_FW_CLM_DEF(4355C1, "brcmfmac4355c1-pcie");
+ BRCMF_FW_CLM_DEF(4356, "brcmfmac4356-pcie");
+ BRCMF_FW_CLM_DEF(43570, "brcmfmac43570-pcie");
+ BRCMF_FW_DEF(4358, "brcmfmac4358-pcie");
+@@ -78,7 +79,8 @@ static const struct brcmf_firmware_mapping brcmf_pcie_fwnames[] = {
+ BRCMF_FW_ENTRY(BRCM_CC_4350_CHIP_ID, 0x000000FF, 4350C),
+ BRCMF_FW_ENTRY(BRCM_CC_4350_CHIP_ID, 0xFFFFFF00, 4350),
+ BRCMF_FW_ENTRY(BRCM_CC_43525_CHIP_ID, 0xFFFFFFF0, 4365C),
+- BRCMF_FW_ENTRY(BRCM_CC_4355_CHIP_ID, 0xFFFFFFFF, 4355),
++ BRCMF_FW_ENTRY(BRCM_CC_4355_CHIP_ID, 0x000007FF, 4355),
++ BRCMF_FW_ENTRY(BRCM_CC_4355_CHIP_ID, 0xFFFFF800, 4355C1), /* rev ID 12/C2 seen */
+ BRCMF_FW_ENTRY(BRCM_CC_4356_CHIP_ID, 0xFFFFFFFF, 4356),
+ BRCMF_FW_ENTRY(BRCM_CC_43567_CHIP_ID, 0xFFFFFFFF, 43570),
+ BRCMF_FW_ENTRY(BRCM_CC_43569_CHIP_ID, 0xFFFFFFFF, 43570),
+@@ -1994,6 +1996,11 @@ static int brcmf_pcie_read_otp(struct brcmf_pciedev_info *devinfo)
+ int ret;
+
+ switch (devinfo->ci->chip) {
++ case BRCM_CC_4355_CHIP_ID:
++ coreid = BCMA_CORE_CHIPCOMMON;
++ base = 0x8c0;
++ words = 0xb2;
++ break;
+ case BRCM_CC_4378_CHIP_ID:
+ coreid = BCMA_CORE_GCI;
+ base = 0x1120;
+@@ -2590,6 +2597,7 @@ static const struct pci_device_id brcmf_pcie_devid_table[] = {
+ BRCMF_PCIE_DEVICE(BRCM_PCIE_4350_DEVICE_ID, WCC),
+ BRCMF_PCIE_DEVICE_SUB(0x4355, BRCM_PCIE_VENDOR_ID_BROADCOM, 0x4355, WCC),
+ BRCMF_PCIE_DEVICE(BRCM_PCIE_4354_RAW_DEVICE_ID, WCC),
++ BRCMF_PCIE_DEVICE(BRCM_PCIE_4355_DEVICE_ID, WCC),
+ BRCMF_PCIE_DEVICE(BRCM_PCIE_4356_DEVICE_ID, WCC),
+ BRCMF_PCIE_DEVICE(BRCM_PCIE_43567_DEVICE_ID, WCC),
+ BRCMF_PCIE_DEVICE(BRCM_PCIE_43570_DEVICE_ID, WCC),
+diff --git a/drivers/net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h b/drivers/net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h
+index 28b6cf8ff2864..6e27e39666551 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h
++++ b/drivers/net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h
+@@ -72,6 +72,7 @@
+ #define BRCM_PCIE_4350_DEVICE_ID 0x43a3
+ #define BRCM_PCIE_4354_DEVICE_ID 0x43df
+ #define BRCM_PCIE_4354_RAW_DEVICE_ID 0x4354
++#define BRCM_PCIE_4355_DEVICE_ID 0x43dc
+ #define BRCM_PCIE_4356_DEVICE_ID 0x43ec
+ #define BRCM_PCIE_43567_DEVICE_ID 0x43d3
+ #define BRCM_PCIE_43570_DEVICE_ID 0x43d9
+--
+2.39.2
+
--- /dev/null
+From 0eedf49c4215d5861ea89707b8a621379e2c7cef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 12 Feb 2023 15:38:12 +0900
+Subject: wifi: brcmfmac: pcie: Add IDs/properties for BCM4377
+
+From: Hector Martin <marcan@marcan.st>
+
+[ Upstream commit bf8bbd903f07aabfef8d4cb3b513163a3e974d2b ]
+
+This chip is present on at least these Apple T2 Macs:
+
+* tahiti: MacBook Pro 13" (2020, 2 TB3)
+* formosa: MacBook Pro 13" (Touch/2019)
+* fiji: MacBook Air 13" (Scissor, 2020)
+
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Hector Martin <marcan@marcan.st>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20230212063813.27622-4-marcan@marcan.st
+Stable-dep-of: 6a142f70774f ("wifi: brcmfmac: pcie: Perform correct BCM4364 firmware selection")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c | 1 +
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c | 5 +++++
+ .../net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h | 2 ++
+ 3 files changed, 8 insertions(+)
+
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
+index 3e42c2bd0d9ad..8073f31be27d9 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
+@@ -733,6 +733,7 @@ static u32 brcmf_chip_tcm_rambase(struct brcmf_chip_priv *ci)
+ case CY_CC_4373_CHIP_ID:
+ return 0x160000;
+ case CY_CC_43752_CHIP_ID:
++ case BRCM_CC_4377_CHIP_ID:
+ return 0x170000;
+ case BRCM_CC_4378_CHIP_ID:
+ return 0x352000;
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+index a8d77569faf70..b752a65de2dcb 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+@@ -63,6 +63,7 @@ BRCMF_FW_DEF(4365C, "brcmfmac4365c-pcie");
+ BRCMF_FW_DEF(4366B, "brcmfmac4366b-pcie");
+ BRCMF_FW_DEF(4366C, "brcmfmac4366c-pcie");
+ BRCMF_FW_DEF(4371, "brcmfmac4371-pcie");
++BRCMF_FW_CLM_DEF(4377B3, "brcmfmac4377b3-pcie");
+ BRCMF_FW_CLM_DEF(4378B1, "brcmfmac4378b1-pcie");
+
+ /* firmware config files */
+@@ -95,6 +96,7 @@ static const struct brcmf_firmware_mapping brcmf_pcie_fwnames[] = {
+ BRCMF_FW_ENTRY(BRCM_CC_43664_CHIP_ID, 0xFFFFFFF0, 4366C),
+ BRCMF_FW_ENTRY(BRCM_CC_43666_CHIP_ID, 0xFFFFFFF0, 4366C),
+ BRCMF_FW_ENTRY(BRCM_CC_4371_CHIP_ID, 0xFFFFFFFF, 4371),
++ BRCMF_FW_ENTRY(BRCM_CC_4377_CHIP_ID, 0xFFFFFFFF, 4377B3), /* revision ID 4 */
+ BRCMF_FW_ENTRY(BRCM_CC_4378_CHIP_ID, 0xFFFFFFFF, 4378B1), /* revision ID 3 */
+ };
+
+@@ -2001,6 +2003,7 @@ static int brcmf_pcie_read_otp(struct brcmf_pciedev_info *devinfo)
+ base = 0x8c0;
+ words = 0xb2;
+ break;
++ case BRCM_CC_4377_CHIP_ID:
+ case BRCM_CC_4378_CHIP_ID:
+ coreid = BCMA_CORE_GCI;
+ base = 0x1120;
+@@ -2618,7 +2621,9 @@ static const struct pci_device_id brcmf_pcie_devid_table[] = {
+ BRCMF_PCIE_DEVICE(BRCM_PCIE_4366_5G_DEVICE_ID, BCA),
+ BRCMF_PCIE_DEVICE(BRCM_PCIE_4371_DEVICE_ID, WCC),
+ BRCMF_PCIE_DEVICE(BRCM_PCIE_43596_DEVICE_ID, CYW),
++ BRCMF_PCIE_DEVICE(BRCM_PCIE_4377_DEVICE_ID, WCC),
+ BRCMF_PCIE_DEVICE(BRCM_PCIE_4378_DEVICE_ID, WCC),
++
+ { /* end: all zeroes */ }
+ };
+
+diff --git a/drivers/net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h b/drivers/net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h
+index 6e27e39666551..896615f579522 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h
++++ b/drivers/net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h
+@@ -52,6 +52,7 @@
+ #define BRCM_CC_43664_CHIP_ID 43664
+ #define BRCM_CC_43666_CHIP_ID 43666
+ #define BRCM_CC_4371_CHIP_ID 0x4371
++#define BRCM_CC_4377_CHIP_ID 0x4377
+ #define BRCM_CC_4378_CHIP_ID 0x4378
+ #define CY_CC_4373_CHIP_ID 0x4373
+ #define CY_CC_43012_CHIP_ID 43012
+@@ -92,6 +93,7 @@
+ #define BRCM_PCIE_4366_5G_DEVICE_ID 0x43c5
+ #define BRCM_PCIE_4371_DEVICE_ID 0x440d
+ #define BRCM_PCIE_43596_DEVICE_ID 0x4415
++#define BRCM_PCIE_4377_DEVICE_ID 0x4488
+ #define BRCM_PCIE_4378_DEVICE_ID 0x4425
+
+ /* brcmsmac IDs */
+--
+2.39.2
+
--- /dev/null
+From dad3048f5d0696b3b7979080bc1b271039d81b41 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 12 Feb 2023 15:38:13 +0900
+Subject: wifi: brcmfmac: pcie: Perform correct BCM4364 firmware selection
+
+From: Hector Martin <marcan@marcan.st>
+
+[ Upstream commit 6a142f70774fd10350a52a10ba1297d52da46780 ]
+
+This chip exists in two revisions (B2=r3 and B3=r4) on different
+platforms, and was added without regard to doing proper firmware
+selection or differentiating between them. Fix this to have proper
+per-revision firmwares and support Apple NVRAM selection.
+
+Revision B2 is present on at least these Apple T2 Macs:
+
+kauai: MacBook Pro 15" (Touch/2018-2019)
+maui: MacBook Pro 13" (Touch/2018-2019)
+lanai: Mac mini (Late 2018)
+ekans: iMac Pro 27" (5K, Late 2017)
+
+And these non-T2 Macs:
+
+nihau: iMac 27" (5K, 2019)
+
+Revision B3 is present on at least these Apple T2 Macs:
+
+bali: MacBook Pro 16" (2019)
+trinidad: MacBook Pro 13" (2020, 4 TB3)
+borneo: MacBook Pro 16" (2019, 5600M)
+kahana: Mac Pro (2019)
+kahana: Mac Pro (2019, Rack)
+hanauma: iMac 27" (5K, 2020)
+kure: iMac 27" (5K, 2020, 5700/XT)
+
+Also fix the firmware interface for 4364, from BCA to WCC.
+
+Fixes: 24f0bd136264 ("brcmfmac: add the BRCM 4364 found in MacBook Pro 15,2")
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Hector Martin <marcan@marcan.st>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20230212063813.27622-5-marcan@marcan.st
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/broadcom/brcm80211/brcmfmac/pcie.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+index b752a65de2dcb..a9b9b2dc62d4f 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+@@ -57,7 +57,8 @@ BRCMF_FW_CLM_DEF(4356, "brcmfmac4356-pcie");
+ BRCMF_FW_CLM_DEF(43570, "brcmfmac43570-pcie");
+ BRCMF_FW_DEF(4358, "brcmfmac4358-pcie");
+ BRCMF_FW_DEF(4359, "brcmfmac4359-pcie");
+-BRCMF_FW_DEF(4364, "brcmfmac4364-pcie");
++BRCMF_FW_CLM_DEF(4364B2, "brcmfmac4364b2-pcie");
++BRCMF_FW_CLM_DEF(4364B3, "brcmfmac4364b3-pcie");
+ BRCMF_FW_DEF(4365B, "brcmfmac4365b-pcie");
+ BRCMF_FW_DEF(4365C, "brcmfmac4365c-pcie");
+ BRCMF_FW_DEF(4366B, "brcmfmac4366b-pcie");
+@@ -88,7 +89,8 @@ static const struct brcmf_firmware_mapping brcmf_pcie_fwnames[] = {
+ BRCMF_FW_ENTRY(BRCM_CC_43570_CHIP_ID, 0xFFFFFFFF, 43570),
+ BRCMF_FW_ENTRY(BRCM_CC_4358_CHIP_ID, 0xFFFFFFFF, 4358),
+ BRCMF_FW_ENTRY(BRCM_CC_4359_CHIP_ID, 0xFFFFFFFF, 4359),
+- BRCMF_FW_ENTRY(BRCM_CC_4364_CHIP_ID, 0xFFFFFFFF, 4364),
++ BRCMF_FW_ENTRY(BRCM_CC_4364_CHIP_ID, 0x0000000F, 4364B2), /* 3 */
++ BRCMF_FW_ENTRY(BRCM_CC_4364_CHIP_ID, 0xFFFFFFF0, 4364B3), /* 4 */
+ BRCMF_FW_ENTRY(BRCM_CC_4365_CHIP_ID, 0x0000000F, 4365B),
+ BRCMF_FW_ENTRY(BRCM_CC_4365_CHIP_ID, 0xFFFFFFF0, 4365C),
+ BRCMF_FW_ENTRY(BRCM_CC_4366_CHIP_ID, 0x0000000F, 4366B),
+@@ -2003,6 +2005,11 @@ static int brcmf_pcie_read_otp(struct brcmf_pciedev_info *devinfo)
+ base = 0x8c0;
+ words = 0xb2;
+ break;
++ case BRCM_CC_4364_CHIP_ID:
++ coreid = BCMA_CORE_CHIPCOMMON;
++ base = 0x8c0;
++ words = 0x1a0;
++ break;
+ case BRCM_CC_4377_CHIP_ID:
+ case BRCM_CC_4378_CHIP_ID:
+ coreid = BCMA_CORE_GCI;
+@@ -2611,7 +2618,7 @@ static const struct pci_device_id brcmf_pcie_devid_table[] = {
+ BRCMF_PCIE_DEVICE(BRCM_PCIE_43602_2G_DEVICE_ID, WCC),
+ BRCMF_PCIE_DEVICE(BRCM_PCIE_43602_5G_DEVICE_ID, WCC),
+ BRCMF_PCIE_DEVICE(BRCM_PCIE_43602_RAW_DEVICE_ID, WCC),
+- BRCMF_PCIE_DEVICE(BRCM_PCIE_4364_DEVICE_ID, BCA),
++ BRCMF_PCIE_DEVICE(BRCM_PCIE_4364_DEVICE_ID, WCC),
+ BRCMF_PCIE_DEVICE(BRCM_PCIE_4365_DEVICE_ID, BCA),
+ BRCMF_PCIE_DEVICE(BRCM_PCIE_4365_2G_DEVICE_ID, BCA),
+ BRCMF_PCIE_DEVICE(BRCM_PCIE_4365_5G_DEVICE_ID, BCA),
+--
+2.39.2
+
--- /dev/null
+From db7aa1e13ee1d6b90c483bbf5b2bcb75d0e11ffc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 12 Feb 2023 15:38:10 +0900
+Subject: wifi: brcmfmac: Rename Cypress 89459 to BCM4355
+
+From: Hector Martin <marcan@marcan.st>
+
+[ Upstream commit 54f01f56cf63ebb92ac37450d65c7e4da379d4ca ]
+
+The commit that introduced support for this chip incorrectly claimed it
+is a Cypress-specific part, while in actuality it is just a variant of
+BCM4355 silicon (as evidenced by the chip ID).
+
+The relationship between Cypress products and Broadcom products isn't
+entirely clear but given what little information is available and prior
+art in the driver, it seems the convention should be that originally
+Broadcom parts should retain the Broadcom name.
+
+Thus, rename the relevant constants and firmware file. Also rename the
+specific 89459 PCIe ID to BCM43596, which seems to be the original
+subvariant name for this PCI ID (as defined in the out-of-tree bcmdhd
+driver).
+
+Since Cypress added this part and will presumably be providing its
+supported firmware, we keep the CYW designation for this device.
+
+We also drop the RAW device ID in this commit. We don't do this for the
+other chips since apparently some devices with them exist in the wild,
+but there is already a 4355 entry with the Broadcom subvendor and WCC
+firmware vendor, so adding a generic fallback to Cypress seems
+redundant (no reason why a device would have the raw device ID *and* an
+explicitly programmed subvendor).
+
+Fixes: dce45ded7619 ("brcmfmac: Support 89459 pcie")
+Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Hector Martin <marcan@marcan.st>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20230212063813.27622-2-marcan@marcan.st
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c | 5 ++---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c | 7 +++----
+ .../net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h | 5 ++---
+ 3 files changed, 7 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
+index 121893bbaa1d7..3e42c2bd0d9ad 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
+@@ -726,6 +726,7 @@ static u32 brcmf_chip_tcm_rambase(struct brcmf_chip_priv *ci)
+ case BRCM_CC_43664_CHIP_ID:
+ case BRCM_CC_43666_CHIP_ID:
+ return 0x200000;
++ case BRCM_CC_4355_CHIP_ID:
+ case BRCM_CC_4359_CHIP_ID:
+ return (ci->pub.chiprev < 9) ? 0x180000 : 0x160000;
+ case BRCM_CC_4364_CHIP_ID:
+@@ -735,8 +736,6 @@ static u32 brcmf_chip_tcm_rambase(struct brcmf_chip_priv *ci)
+ return 0x170000;
+ case BRCM_CC_4378_CHIP_ID:
+ return 0x352000;
+- case CY_CC_89459_CHIP_ID:
+- return ((ci->pub.chiprev < 9) ? 0x180000 : 0x160000);
+ default:
+ brcmf_err("unknown chip: %s\n", ci->pub.name);
+ break;
+@@ -1426,8 +1425,8 @@ bool brcmf_chip_sr_capable(struct brcmf_chip *pub)
+ addr = CORE_CC_REG(base, sr_control1);
+ reg = chip->ops->read32(chip->ctx, addr);
+ return reg != 0;
++ case BRCM_CC_4355_CHIP_ID:
+ case CY_CC_4373_CHIP_ID:
+- case CY_CC_89459_CHIP_ID:
+ /* explicitly check SR engine enable bit */
+ addr = CORE_CC_REG(base, sr_control0);
+ reg = chip->ops->read32(chip->ctx, addr);
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+index b67f6d0810b6c..8f8d605a7f2da 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+@@ -51,6 +51,7 @@ enum brcmf_pcie_state {
+ BRCMF_FW_DEF(43602, "brcmfmac43602-pcie");
+ BRCMF_FW_DEF(4350, "brcmfmac4350-pcie");
+ BRCMF_FW_DEF(4350C, "brcmfmac4350c2-pcie");
++BRCMF_FW_CLM_DEF(4355, "brcmfmac4355-pcie");
+ BRCMF_FW_CLM_DEF(4356, "brcmfmac4356-pcie");
+ BRCMF_FW_CLM_DEF(43570, "brcmfmac43570-pcie");
+ BRCMF_FW_DEF(4358, "brcmfmac4358-pcie");
+@@ -62,7 +63,6 @@ BRCMF_FW_DEF(4366B, "brcmfmac4366b-pcie");
+ BRCMF_FW_DEF(4366C, "brcmfmac4366c-pcie");
+ BRCMF_FW_DEF(4371, "brcmfmac4371-pcie");
+ BRCMF_FW_CLM_DEF(4378B1, "brcmfmac4378b1-pcie");
+-BRCMF_FW_DEF(4355, "brcmfmac89459-pcie");
+
+ /* firmware config files */
+ MODULE_FIRMWARE(BRCMF_FW_DEFAULT_PATH "brcmfmac*-pcie.txt");
+@@ -78,6 +78,7 @@ static const struct brcmf_firmware_mapping brcmf_pcie_fwnames[] = {
+ BRCMF_FW_ENTRY(BRCM_CC_4350_CHIP_ID, 0x000000FF, 4350C),
+ BRCMF_FW_ENTRY(BRCM_CC_4350_CHIP_ID, 0xFFFFFF00, 4350),
+ BRCMF_FW_ENTRY(BRCM_CC_43525_CHIP_ID, 0xFFFFFFF0, 4365C),
++ BRCMF_FW_ENTRY(BRCM_CC_4355_CHIP_ID, 0xFFFFFFFF, 4355),
+ BRCMF_FW_ENTRY(BRCM_CC_4356_CHIP_ID, 0xFFFFFFFF, 4356),
+ BRCMF_FW_ENTRY(BRCM_CC_43567_CHIP_ID, 0xFFFFFFFF, 43570),
+ BRCMF_FW_ENTRY(BRCM_CC_43569_CHIP_ID, 0xFFFFFFFF, 43570),
+@@ -93,7 +94,6 @@ static const struct brcmf_firmware_mapping brcmf_pcie_fwnames[] = {
+ BRCMF_FW_ENTRY(BRCM_CC_43666_CHIP_ID, 0xFFFFFFF0, 4366C),
+ BRCMF_FW_ENTRY(BRCM_CC_4371_CHIP_ID, 0xFFFFFFFF, 4371),
+ BRCMF_FW_ENTRY(BRCM_CC_4378_CHIP_ID, 0xFFFFFFFF, 4378B1), /* revision ID 3 */
+- BRCMF_FW_ENTRY(CY_CC_89459_CHIP_ID, 0xFFFFFFFF, 4355),
+ };
+
+ #define BRCMF_PCIE_FW_UP_TIMEOUT 5000 /* msec */
+@@ -2609,9 +2609,8 @@ static const struct pci_device_id brcmf_pcie_devid_table[] = {
+ BRCMF_PCIE_DEVICE(BRCM_PCIE_4366_2G_DEVICE_ID, BCA),
+ BRCMF_PCIE_DEVICE(BRCM_PCIE_4366_5G_DEVICE_ID, BCA),
+ BRCMF_PCIE_DEVICE(BRCM_PCIE_4371_DEVICE_ID, WCC),
++ BRCMF_PCIE_DEVICE(BRCM_PCIE_43596_DEVICE_ID, CYW),
+ BRCMF_PCIE_DEVICE(BRCM_PCIE_4378_DEVICE_ID, WCC),
+- BRCMF_PCIE_DEVICE(CY_PCIE_89459_DEVICE_ID, CYW),
+- BRCMF_PCIE_DEVICE(CY_PCIE_89459_RAW_DEVICE_ID, CYW),
+ { /* end: all zeroes */ }
+ };
+
+diff --git a/drivers/net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h b/drivers/net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h
+index f4939cf627672..28b6cf8ff2864 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h
++++ b/drivers/net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h
+@@ -37,6 +37,7 @@
+ #define BRCM_CC_4350_CHIP_ID 0x4350
+ #define BRCM_CC_43525_CHIP_ID 43525
+ #define BRCM_CC_4354_CHIP_ID 0x4354
++#define BRCM_CC_4355_CHIP_ID 0x4355
+ #define BRCM_CC_4356_CHIP_ID 0x4356
+ #define BRCM_CC_43566_CHIP_ID 43566
+ #define BRCM_CC_43567_CHIP_ID 43567
+@@ -56,7 +57,6 @@
+ #define CY_CC_43012_CHIP_ID 43012
+ #define CY_CC_43439_CHIP_ID 43439
+ #define CY_CC_43752_CHIP_ID 43752
+-#define CY_CC_89459_CHIP_ID 0x4355
+
+ /* USB Device IDs */
+ #define BRCM_USB_43143_DEVICE_ID 0xbd1e
+@@ -90,9 +90,8 @@
+ #define BRCM_PCIE_4366_2G_DEVICE_ID 0x43c4
+ #define BRCM_PCIE_4366_5G_DEVICE_ID 0x43c5
+ #define BRCM_PCIE_4371_DEVICE_ID 0x440d
++#define BRCM_PCIE_43596_DEVICE_ID 0x4415
+ #define BRCM_PCIE_4378_DEVICE_ID 0x4425
+-#define CY_PCIE_89459_DEVICE_ID 0x4415
+-#define CY_PCIE_89459_RAW_DEVICE_ID 0x4355
+
+ /* brcmsmac IDs */
+ #define BCM4313_D11N2G_ID 0x4727 /* 4313 802.11n 2.4G device */
+--
+2.39.2
+
--- /dev/null
+From 3b6ffcf78ce7793f2f09792e18187372f511d084 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Dec 2022 09:31:14 +0800
+Subject: wifi: brcmfmac: unmap dma buffer in brcmf_msgbuf_alloc_pktid()
+
+From: Zhengchao Shao <shaozhengchao@huawei.com>
+
+[ Upstream commit b9f420032f2ba1e634b22ca7b433e5c40ea663af ]
+
+After the DMA buffer is mapped to a physical address, address is stored
+in pktids in brcmf_msgbuf_alloc_pktid(). Then, pktids is parsed in
+brcmf_msgbuf_get_pktid()/brcmf_msgbuf_release_array() to obtain physaddr
+and later unmap the DMA buffer. But when count is always equal to
+pktids->array_size, physaddr isn't stored in pktids and the DMA buffer
+will not be unmapped anyway.
+
+Fixes: 9a1bb60250d2 ("brcmfmac: Adding msgbuf protocol.")
+Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com>
+Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20221207013114.1748936-1-shaozhengchao@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
+index cec53f934940a..45fbcbdc7d9e4 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
+@@ -347,8 +347,11 @@ brcmf_msgbuf_alloc_pktid(struct device *dev,
+ count++;
+ } while (count < pktids->array_size);
+
+- if (count == pktids->array_size)
++ if (count == pktids->array_size) {
++ dma_unmap_single(dev, *physaddr, skb->len - data_offset,
++ pktids->direction);
+ return -ENOMEM;
++ }
+
+ array[*idx].data_offset = data_offset;
+ array[*idx].physaddr = *physaddr;
+--
+2.39.2
+
--- /dev/null
+From ca7d375f349534ff3209583c79021da597afb03b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Dec 2022 20:07:14 +0530
+Subject: wifi: cfg80211: Fix extended KCK key length check in
+ nl80211_set_rekey_data()
+
+From: Shivani Baranwal <quic_shivbara@quicinc.com>
+
+[ Upstream commit df4969ca135b9b3b2c38c07514aaa775112ac835 ]
+
+The extended KCK key length check wrongly using the KEK key attribute
+for validation. Due to this GTK rekey offload is failing when the KCK
+key length is 24 bytes even though the driver advertising
+WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK flag. Use correct attribute to fix the
+same.
+
+Fixes: 093a48d2aa4b ("cfg80211: support bigger kek/kck key length")
+Signed-off-by: Shivani Baranwal <quic_shivbara@quicinc.com>
+Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
+Link: https://lore.kernel.org/r/20221206143715.1802987-2-quic_vjakkam@quicinc.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/wireless/nl80211.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index 33a82ecab9d56..02b9a0280896c 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -13809,7 +13809,7 @@ static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
+ return -ERANGE;
+ if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN &&
+ !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK &&
+- nla_len(tb[NL80211_REKEY_DATA_KEK]) == NL80211_KCK_EXT_LEN))
++ nla_len(tb[NL80211_REKEY_DATA_KCK]) == NL80211_KCK_EXT_LEN))
+ return -ERANGE;
+
+ rekey_data.kek = nla_data(tb[NL80211_REKEY_DATA_KEK]);
+--
+2.39.2
+
--- /dev/null
+From a2e616606e77602b62356c8d0122f50991e1f5f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Dec 2022 09:24:22 +0800
+Subject: wifi: ipw2200: fix memory leak in ipw_wdev_init()
+
+From: Zhengchao Shao <shaozhengchao@huawei.com>
+
+[ Upstream commit 9fe21dc626117fb44a8eb393713a86a620128ce3 ]
+
+In the error path of ipw_wdev_init(), exception value is returned, and
+the memory applied for in the function is not released. Also the memory
+is not released in ipw_pci_probe(). As a result, memory leakage occurs.
+So memory release needs to be added to the error path of ipw_wdev_init().
+
+Fixes: a3caa99e6c68 ("libipw: initiate cfg80211 API conversion (v2)")
+Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20221209012422.182669-1-shaozhengchao@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/ipw2x00/ipw2200.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/ipw2x00/ipw2200.c b/drivers/net/wireless/intel/ipw2x00/ipw2200.c
+index cc66fd92278e4..d382f20173256 100644
+--- a/drivers/net/wireless/intel/ipw2x00/ipw2200.c
++++ b/drivers/net/wireless/intel/ipw2x00/ipw2200.c
+@@ -11383,9 +11383,14 @@ static int ipw_wdev_init(struct net_device *dev)
+ set_wiphy_dev(wdev->wiphy, &priv->pci_dev->dev);
+
+ /* With that information in place, we can now register the wiphy... */
+- if (wiphy_register(wdev->wiphy))
+- rc = -EIO;
++ rc = wiphy_register(wdev->wiphy);
++ if (rc)
++ goto out;
++
++ return 0;
+ out:
++ kfree(priv->ieee->a_band.channels);
++ kfree(priv->ieee->bg_band.channels);
+ return rc;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From f322bbd0658ac8462974f707644846fa8ae0d23d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Dec 2022 22:38:26 +0800
+Subject: wifi: ipw2x00: don't call dev_kfree_skb() under spin_lock_irqsave()
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit 45fc6d7461f18df2f238caf0cbc5acc4163203d1 ]
+
+It is not allowed to call kfree_skb() or consume_skb() from hardware
+interrupt context or with hardware interrupts being disabled.
+
+It should use dev_kfree_skb_irq() or dev_consume_skb_irq() instead.
+The difference between them is free reason, dev_kfree_skb_irq() means
+the SKB is dropped in error and dev_consume_skb_irq() means the SKB
+is consumed in normal.
+
+In this case, dev_kfree_skb() is called to free and drop the SKB when
+it's reset, so replace it with dev_kfree_skb_irq(). Compile tested
+only.
+
+Fixes: 43f66a6ce8da ("Add ipw2200 wireless driver.")
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20221208143826.2385218-1-yangyingliang@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/ipw2x00/ipw2200.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intel/ipw2x00/ipw2200.c b/drivers/net/wireless/intel/ipw2x00/ipw2200.c
+index ca802af8cddcc..cc66fd92278e4 100644
+--- a/drivers/net/wireless/intel/ipw2x00/ipw2200.c
++++ b/drivers/net/wireless/intel/ipw2x00/ipw2200.c
+@@ -3427,7 +3427,7 @@ static void ipw_rx_queue_reset(struct ipw_priv *priv,
+ dma_unmap_single(&priv->pci_dev->dev,
+ rxq->pool[i].dma_addr,
+ IPW_RX_BUF_SIZE, DMA_FROM_DEVICE);
+- dev_kfree_skb(rxq->pool[i].skb);
++ dev_kfree_skb_irq(rxq->pool[i].skb);
+ rxq->pool[i].skb = NULL;
+ }
+ list_add_tail(&rxq->pool[i].list, &rxq->rx_used);
+--
+2.39.2
+
--- /dev/null
+From 6aa6c102bd6eb390d80c4e66cd52b6e8d6e19202 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Feb 2023 14:30:32 +0800
+Subject: wifi: iwl3945: Add missing check for create_singlethread_workqueue
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit 1fdeb8b9f29dfd64805bb49475ac7566a3cb06cb ]
+
+Add the check for the return value of the create_singlethread_workqueue
+in order to avoid NULL pointer dereference.
+
+Fixes: b481de9ca074 ("[IWLWIFI]: add iwlwifi wireless drivers")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20230208063032.42763-2-jiasheng@iscas.ac.cn
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlegacy/3945-mac.c | 16 ++++++++++++----
+ 1 file changed, 12 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlegacy/3945-mac.c b/drivers/net/wireless/intel/iwlegacy/3945-mac.c
+index d7e99d50b287b..9eaf5ec133f9e 100644
+--- a/drivers/net/wireless/intel/iwlegacy/3945-mac.c
++++ b/drivers/net/wireless/intel/iwlegacy/3945-mac.c
+@@ -3372,10 +3372,12 @@ static DEVICE_ATTR(dump_errors, 0200, NULL, il3945_dump_error_log);
+ *
+ *****************************************************************************/
+
+-static void
++static int
+ il3945_setup_deferred_work(struct il_priv *il)
+ {
+ il->workqueue = create_singlethread_workqueue(DRV_NAME);
++ if (!il->workqueue)
++ return -ENOMEM;
+
+ init_waitqueue_head(&il->wait_command_queue);
+
+@@ -3392,6 +3394,8 @@ il3945_setup_deferred_work(struct il_priv *il)
+ timer_setup(&il->watchdog, il_bg_watchdog, 0);
+
+ tasklet_setup(&il->irq_tasklet, il3945_irq_tasklet);
++
++ return 0;
+ }
+
+ static void
+@@ -3712,7 +3716,10 @@ il3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ }
+
+ il_set_rxon_channel(il, &il->bands[NL80211_BAND_2GHZ].channels[5]);
+- il3945_setup_deferred_work(il);
++ err = il3945_setup_deferred_work(il);
++ if (err)
++ goto out_remove_sysfs;
++
+ il3945_setup_handlers(il);
+ il_power_initialize(il);
+
+@@ -3724,7 +3731,7 @@ il3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+
+ err = il3945_setup_mac(il);
+ if (err)
+- goto out_remove_sysfs;
++ goto out_destroy_workqueue;
+
+ il_dbgfs_register(il, DRV_NAME);
+
+@@ -3733,9 +3740,10 @@ il3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+
+ return 0;
+
+-out_remove_sysfs:
++out_destroy_workqueue:
+ destroy_workqueue(il->workqueue);
+ il->workqueue = NULL;
++out_remove_sysfs:
+ sysfs_remove_group(&pdev->dev.kobj, &il3945_attribute_group);
+ out_release_irq:
+ free_irq(il->pci_dev->irq, il);
+--
+2.39.2
+
--- /dev/null
+From 3280cae12df284b9641442e03301ced1e4b1deda Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Feb 2023 09:07:48 +0800
+Subject: wifi: iwl4965: Add missing check for create_singlethread_workqueue()
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit 26e6775f75517ad6844fe5b79bc5f3fa8c22ee61 ]
+
+Add the check for the return value of the create_singlethread_workqueue()
+in order to avoid NULL pointer dereference.
+
+Fixes: b481de9ca074 ("[IWLWIFI]: add iwlwifi wireless drivers")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20230209010748.45454-1-jiasheng@iscas.ac.cn
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlegacy/4965-mac.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlegacy/4965-mac.c b/drivers/net/wireless/intel/iwlegacy/4965-mac.c
+index 721b4042b4bf7..4d3c544ff2e66 100644
+--- a/drivers/net/wireless/intel/iwlegacy/4965-mac.c
++++ b/drivers/net/wireless/intel/iwlegacy/4965-mac.c
+@@ -6211,10 +6211,12 @@ il4965_bg_txpower_work(struct work_struct *work)
+ mutex_unlock(&il->mutex);
+ }
+
+-static void
++static int
+ il4965_setup_deferred_work(struct il_priv *il)
+ {
+ il->workqueue = create_singlethread_workqueue(DRV_NAME);
++ if (!il->workqueue)
++ return -ENOMEM;
+
+ init_waitqueue_head(&il->wait_command_queue);
+
+@@ -6233,6 +6235,8 @@ il4965_setup_deferred_work(struct il_priv *il)
+ timer_setup(&il->watchdog, il_bg_watchdog, 0);
+
+ tasklet_setup(&il->irq_tasklet, il4965_irq_tasklet);
++
++ return 0;
+ }
+
+ static void
+@@ -6618,7 +6622,10 @@ il4965_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ goto out_disable_msi;
+ }
+
+- il4965_setup_deferred_work(il);
++ err = il4965_setup_deferred_work(il);
++ if (err)
++ goto out_free_irq;
++
+ il4965_setup_handlers(il);
+
+ /*********************************************
+@@ -6656,6 +6663,7 @@ il4965_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ out_destroy_workqueue:
+ destroy_workqueue(il->workqueue);
+ il->workqueue = NULL;
++out_free_irq:
+ free_irq(il->pci_dev->irq, il);
+ out_disable_msi:
+ pci_disable_msi(il->pci_dev);
+--
+2.39.2
+
--- /dev/null
+From e6d97947d87511d4ea2fb623545dce3c42584fb0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Dec 2022 22:40:13 +0800
+Subject: wifi: iwlegacy: common: don't call dev_kfree_skb() under
+ spin_lock_irqsave()
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit 0c1528675d7a9787cb516b64d8f6c0f6f8efcb48 ]
+
+It is not allowed to call consume_skb() from hardware interrupt context
+or with interrupts being disabled. So replace dev_kfree_skb() with
+dev_consume_skb_irq() under spin_lock_irqsave(). Compile tested only.
+
+Fixes: 4bc85c1324aa ("Revert "iwlwifi: split the drivers for agn and legacy devices 3945/4965"")
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20221207144013.70210-1-yangyingliang@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlegacy/common.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlegacy/common.c b/drivers/net/wireless/intel/iwlegacy/common.c
+index 341c17fe2af4d..96002121bb8b2 100644
+--- a/drivers/net/wireless/intel/iwlegacy/common.c
++++ b/drivers/net/wireless/intel/iwlegacy/common.c
+@@ -5174,7 +5174,7 @@ il_mac_reset_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
+ memset(&il->current_ht_config, 0, sizeof(struct il_ht_config));
+
+ /* new association get rid of ibss beacon skb */
+- dev_kfree_skb(il->beacon_skb);
++ dev_consume_skb_irq(il->beacon_skb);
+ il->beacon_skb = NULL;
+ il->timestamp = 0;
+
+@@ -5293,7 +5293,7 @@ il_beacon_update(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
+ }
+
+ spin_lock_irqsave(&il->lock, flags);
+- dev_kfree_skb(il->beacon_skb);
++ dev_consume_skb_irq(il->beacon_skb);
+ il->beacon_skb = skb;
+
+ timestamp = ((struct ieee80211_mgmt *)skb->data)->u.beacon.timestamp;
+--
+2.39.2
+
--- /dev/null
+From 7b8d9163e7758d73c612cd100598ef17c61243fc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Jan 2023 00:28:21 +0200
+Subject: wifi: iwlwifi: mei: fix compilation errors in rfkill()
+
+From: Gregory Greenman <gregory.greenman@intel.com>
+
+[ Upstream commit 9cbd5a8abca904441e36861e3a92961bec41d13f ]
+
+The rfkill() callback was invoked with wrong parameters.
+It was missed since MEI is defined now as depending on BROKEN.
+Fix that.
+
+Fixes: d288067ede4b ("wifi: iwlwifi: mei: avoid blocking sap messages handling due to rtnl lock")
+Fixes: 5aa7ce31bd84 ("wifi: iwlwifi: mei: make sure ownership confirmed message is sent")
+Fixes: 95170a46b7dd ("wifi: iwlwifi: mei: don't send SAP commands if AMT is disabled")
+Link: https://lore.kernel.org/r/20230126222821.305122-2-gregory.greenman@intel.com
+Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mei/main.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mei/main.c b/drivers/net/wireless/intel/iwlwifi/mei/main.c
+index f9d11935ed97e..67dfb77fedf79 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mei/main.c
++++ b/drivers/net/wireless/intel/iwlwifi/mei/main.c
+@@ -788,7 +788,7 @@ static void iwl_mei_handle_amt_state(struct mei_cl_device *cldev,
+ if (mei->amt_enabled)
+ iwl_mei_set_init_conf(mei);
+ else if (iwl_mei_cache.ops)
+- iwl_mei_cache.ops->rfkill(iwl_mei_cache.priv, false, false);
++ iwl_mei_cache.ops->rfkill(iwl_mei_cache.priv, false);
+
+ schedule_work(&mei->netdev_work);
+
+@@ -829,7 +829,7 @@ static void iwl_mei_handle_csme_taking_ownership(struct mei_cl_device *cldev,
+ */
+ mei->csme_taking_ownership = true;
+
+- iwl_mei_cache.ops->rfkill(iwl_mei_cache.priv, true, true);
++ iwl_mei_cache.ops->rfkill(iwl_mei_cache.priv, true);
+ } else {
+ iwl_mei_send_sap_msg(cldev,
+ SAP_MSG_NOTIF_CSME_OWNERSHIP_CONFIRMED);
+@@ -1774,7 +1774,7 @@ int iwl_mei_register(void *priv, const struct iwl_mei_ops *ops)
+ if (mei->amt_enabled)
+ iwl_mei_send_sap_msg(mei->cldev,
+ SAP_MSG_NOTIF_WIFIDR_UP);
+- ops->rfkill(priv, mei->link_prot_state, false);
++ ops->rfkill(priv, mei->link_prot_state);
+ }
+ }
+ ret = 0;
+--
+2.39.2
+
--- /dev/null
+From ca52b93c2ff8f0ff06f6678f094e14e86489e40b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Dec 2022 23:00:08 +0800
+Subject: wifi: libertas: cmdresp: don't call kfree_skb() under
+ spin_lock_irqsave()
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit 708a49a64237f19bd404852f297aaadbc9e7fee0 ]
+
+It is not allowed to call kfree_skb() from hardware interrupt
+context or with interrupts being disabled. So replace kfree_skb()
+with dev_kfree_skb_irq() under spin_lock_irqsave(). Compile
+tested only.
+
+Fixes: f52b041aed77 ("libertas: Add spinlock to avoid race condition")
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20221207150008.111743-5-yangyingliang@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/marvell/libertas/cmdresp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/marvell/libertas/cmdresp.c b/drivers/net/wireless/marvell/libertas/cmdresp.c
+index cb515c5584c1f..74cb7551f4275 100644
+--- a/drivers/net/wireless/marvell/libertas/cmdresp.c
++++ b/drivers/net/wireless/marvell/libertas/cmdresp.c
+@@ -48,7 +48,7 @@ void lbs_mac_event_disconnected(struct lbs_private *priv,
+
+ /* Free Tx and Rx packets */
+ spin_lock_irqsave(&priv->driver_lock, flags);
+- kfree_skb(priv->currenttxskb);
++ dev_kfree_skb_irq(priv->currenttxskb);
+ priv->currenttxskb = NULL;
+ priv->tx_pending_len = 0;
+ spin_unlock_irqrestore(&priv->driver_lock, flags);
+--
+2.39.2
+
--- /dev/null
+From 6a312322368889eede2e9aa133cd47240e089ab3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Dec 2022 20:14:48 +0800
+Subject: wifi: libertas: fix memory leak in lbs_init_adapter()
+
+From: Zhengchao Shao <shaozhengchao@huawei.com>
+
+[ Upstream commit 16a03958618fb91bb1bc7077cf3211055162cc2f ]
+
+When kfifo_alloc() failed in lbs_init_adapter(), cmd buffer is not
+released. Add free memory to processing error path.
+
+Fixes: 7919b89c8276 ("libertas: convert libertas driver to use an event/cmdresp queue")
+Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com>
+Reviewed-by: Jiri Pirko <jiri@nvidia.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20221208121448.2845986-1-shaozhengchao@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/marvell/libertas/main.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/wireless/marvell/libertas/main.c b/drivers/net/wireless/marvell/libertas/main.c
+index 8f5220cee1123..ae975304cfcfa 100644
+--- a/drivers/net/wireless/marvell/libertas/main.c
++++ b/drivers/net/wireless/marvell/libertas/main.c
+@@ -869,6 +869,7 @@ static int lbs_init_adapter(struct lbs_private *priv)
+ ret = kfifo_alloc(&priv->event_fifo, sizeof(u32) * 16, GFP_KERNEL);
+ if (ret) {
+ pr_err("Out of memory allocating event FIFO buffer\n");
++ lbs_free_cmd_buffer(priv);
+ goto out;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 522b0dc9391093724c8977eced6b922decee36a4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Dec 2022 23:00:06 +0800
+Subject: wifi: libertas: if_usb: don't call kfree_skb() under
+ spin_lock_irqsave()
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit 3968e81ba644f10a7d45bae2539560db9edac501 ]
+
+It is not allowed to call kfree_skb() from hardware interrupt
+context or with interrupts being disabled. So replace kfree_skb()
+with dev_kfree_skb_irq() under spin_lock_irqsave(). Compile
+tested only.
+
+Fixes: a3128feef6d5 ("libertas: use irqsave() in USB's complete callback")
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20221207150008.111743-3-yangyingliang@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/marvell/libertas/if_usb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/marvell/libertas/if_usb.c b/drivers/net/wireless/marvell/libertas/if_usb.c
+index 32fdc4150b605..2240b4db8c036 100644
+--- a/drivers/net/wireless/marvell/libertas/if_usb.c
++++ b/drivers/net/wireless/marvell/libertas/if_usb.c
+@@ -637,7 +637,7 @@ static inline void process_cmdrequest(int recvlength, uint8_t *recvbuff,
+ priv->resp_len[i] = (recvlength - MESSAGE_HEADER_LEN);
+ memcpy(priv->resp_buf[i], recvbuff + MESSAGE_HEADER_LEN,
+ priv->resp_len[i]);
+- kfree_skb(skb);
++ dev_kfree_skb_irq(skb);
+ lbs_notify_command_response(priv, i);
+
+ spin_unlock_irqrestore(&priv->driver_lock, flags);
+--
+2.39.2
+
--- /dev/null
+From 40abe758976438742999bda58d8b37328294fedb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Dec 2022 23:00:07 +0800
+Subject: wifi: libertas: main: don't call kfree_skb() under
+ spin_lock_irqsave()
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit f393df151540bf858effbd29ff572ab94e76a4c4 ]
+
+It is not allowed to call kfree_skb() from hardware interrupt
+context or with interrupts being disabled. So replace kfree_skb()
+with dev_kfree_skb_irq() under spin_lock_irqsave(). Compile
+tested only.
+
+Fixes: d2e7b3425c47 ("libertas: disable functionality when interface is down")
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20221207150008.111743-4-yangyingliang@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/marvell/libertas/main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/marvell/libertas/main.c b/drivers/net/wireless/marvell/libertas/main.c
+index ae975304cfcfa..78e8b5aecec0e 100644
+--- a/drivers/net/wireless/marvell/libertas/main.c
++++ b/drivers/net/wireless/marvell/libertas/main.c
+@@ -216,7 +216,7 @@ int lbs_stop_iface(struct lbs_private *priv)
+
+ spin_lock_irqsave(&priv->driver_lock, flags);
+ priv->iface_running = false;
+- kfree_skb(priv->currenttxskb);
++ dev_kfree_skb_irq(priv->currenttxskb);
+ priv->currenttxskb = NULL;
+ priv->tx_pending_len = 0;
+ spin_unlock_irqrestore(&priv->driver_lock, flags);
+--
+2.39.2
+
--- /dev/null
+From 1453691d92f762f5d17055bf3b661c5754d37a32 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Dec 2022 23:00:05 +0800
+Subject: wifi: libertas_tf: don't call kfree_skb() under spin_lock_irqsave()
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit 9388ce97b98216833c969191ee6df61a7201d797 ]
+
+It is not allowed to call kfree_skb() from hardware interrupt
+context or with interrupts being disabled. So replace kfree_skb()
+with dev_kfree_skb_irq() under spin_lock_irqsave(). Compile
+tested only.
+
+Fixes: fc75122fabb5 ("libertas_tf: use irqsave() in USB's complete callback")
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20221207150008.111743-2-yangyingliang@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/marvell/libertas_tf/if_usb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/marvell/libertas_tf/if_usb.c b/drivers/net/wireless/marvell/libertas_tf/if_usb.c
+index 75b5319d033f3..1750f5e93de21 100644
+--- a/drivers/net/wireless/marvell/libertas_tf/if_usb.c
++++ b/drivers/net/wireless/marvell/libertas_tf/if_usb.c
+@@ -613,7 +613,7 @@ static inline void process_cmdrequest(int recvlength, uint8_t *recvbuff,
+ spin_lock_irqsave(&priv->driver_lock, flags);
+ memcpy(priv->cmd_resp_buff, recvbuff + MESSAGE_HEADER_LEN,
+ recvlength - MESSAGE_HEADER_LEN);
+- kfree_skb(skb);
++ dev_kfree_skb_irq(skb);
+ lbtf_cmd_response_rx(priv);
+ spin_unlock_irqrestore(&priv->driver_lock, flags);
+ }
+--
+2.39.2
+
--- /dev/null
+From 93a8851ed5c1afc96a97abbed3a8215776cf77e4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Feb 2023 14:20:21 +0100
+Subject: wifi: mac80211: avoid u32_encode_bits() warning
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 1d8d4af4347420d657be448f8be4c39c558f3b5d ]
+
+gcc-9 triggers a false-postive warning in ieee80211_mlo_multicast_tx()
+for u32_encode_bits(ffs(links) - 1, ...), since ffs() can return zero
+on an empty bitmask, and the negative argument to u32_encode_bits()
+is then out of range:
+
+In file included from include/linux/ieee80211.h:21,
+ from include/net/cfg80211.h:23,
+ from net/mac80211/tx.c:23:
+In function 'u32_encode_bits',
+ inlined from 'ieee80211_mlo_multicast_tx' at net/mac80211/tx.c:4437:17,
+ inlined from 'ieee80211_subif_start_xmit' at net/mac80211/tx.c:4485:3:
+include/linux/bitfield.h:177:3: error: call to '__field_overflow' declared with attribute error: value doesn't fit into mask
+ 177 | __field_overflow(); \
+ | ^~~~~~~~~~~~~~~~~~
+include/linux/bitfield.h:197:2: note: in expansion of macro '____MAKE_OP'
+ 197 | ____MAKE_OP(u##size,u##size,,)
+ | ^~~~~~~~~~~
+include/linux/bitfield.h:200:1: note: in expansion of macro '__MAKE_OP'
+ 200 | __MAKE_OP(32)
+ | ^~~~~~~~~
+
+Newer compiler versions do not cause problems with the zero argument
+because they do not consider this a __builtin_constant_p().
+It's also harmless since the hweight16() check already guarantees
+that this cannot be 0.
+
+Replace the ffs() with an equivalent find_first_bit() check that
+matches the later for_each_set_bit() style and avoids the warning.
+
+Fixes: 963d0e8d08d9 ("wifi: mac80211: optionally implement MLO multicast TX")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/r/20230214132025.1532147-1-arnd@kernel.org
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/tx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
+index defe97a31724d..118648af979c7 100644
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -4434,7 +4434,7 @@ static void ieee80211_mlo_multicast_tx(struct net_device *dev,
+ u32 ctrl_flags = IEEE80211_TX_CTRL_MCAST_MLO_FIRST_TX;
+
+ if (hweight16(links) == 1) {
+- ctrl_flags |= u32_encode_bits(ffs(links) - 1,
++ ctrl_flags |= u32_encode_bits(find_first_bit(&links, 16) - 1,
+ IEEE80211_TX_CTRL_MLO_LINK);
+
+ __ieee80211_subif_start_xmit(skb, sdata->dev, 0, ctrl_flags,
+--
+2.39.2
+
--- /dev/null
+From bbc73e3684071ee76c4b1195aba01bbcb6dd18d3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Feb 2023 12:10:48 +0200
+Subject: wifi: mac80211: Don't translate MLD addresses for multicast
+
+From: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
+
+[ Upstream commit daf8fb4295dccc032515cdc1bd3873370063542b ]
+
+MLD address translation should be done only for individually addressed
+frames. Otherwise, AAD calculation would be wrong and the decryption
+would fail.
+
+Fixes: e66b7920aa5ac ("wifi: mac80211: fix initialization of rx->link and rx->link_sta")
+Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
+Link: https://lore.kernel.org/r/20230214101048.792414-1-andrei.otcheretianski@intel.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/rx.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index 3c4541ee9e6d4..870b8d042b799 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -4840,7 +4840,8 @@ static bool ieee80211_prepare_and_rx_handle(struct ieee80211_rx_data *rx,
+ hdr = (struct ieee80211_hdr *)rx->skb->data;
+ }
+
+- if (unlikely(rx->sta && rx->sta->sta.mlo)) {
++ if (unlikely(rx->sta && rx->sta->sta.mlo) &&
++ is_unicast_ether_addr(hdr->addr1)) {
+ /* translate to MLD addresses */
+ if (ether_addr_equal(link->conf->addr, hdr->addr1))
+ ether_addr_copy(hdr->addr1, rx->sdata->vif.addr);
+--
+2.39.2
+
--- /dev/null
+From 9a21c20770bef4473ec46707b77c6b5f8f146fe6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Feb 2023 21:33:30 +0530
+Subject: wifi: mac80211: fix non-MLO station association
+
+From: Karthikeyan Periyasamy <quic_periyasa@quicinc.com>
+
+[ Upstream commit aaacf1740f2f95e0c5449ff3bbcff252d69cf952 ]
+
+Non-MLO station frames are dropped in Rx path due to the condition
+check in ieee80211_rx_is_valid_sta_link_id(). In multi-link AP scenario,
+non-MLO stations try to connect in any of the valid links in the ML AP,
+where the station valid_links and link_id params are valid in the
+ieee80211_sta object. But ieee80211_rx_is_valid_sta_link_id() always
+return false for the non-MLO stations by the assumption taken is
+valid_links and link_id are not valid in non-MLO stations object
+(ieee80211_sta), this assumption is wrong. Due to this assumption,
+non-MLO station frames are dropped which leads to failure in association.
+
+Fix it by removing the condition check and allow the link validation
+check for the non-MLO stations.
+
+Fixes: e66b7920aa5a ("wifi: mac80211: fix initialization of rx->link and rx->link_sta")
+Signed-off-by: Karthikeyan Periyasamy <quic_periyasa@quicinc.com>
+Link: https://lore.kernel.org/r/20230206160330.1613-1-quic_periyasa@quicinc.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/rx.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index c6562a6d25035..3c4541ee9e6d4 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -4052,9 +4052,6 @@ static void ieee80211_invoke_rx_handlers(struct ieee80211_rx_data *rx)
+ static bool
+ ieee80211_rx_is_valid_sta_link_id(struct ieee80211_sta *sta, u8 link_id)
+ {
+- if (!sta->mlo)
+- return false;
+-
+ return !!(sta->valid_links & BIT(link_id));
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 68a6fe1954ebb8c521cf13fb076032b7fe8ff874 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Feb 2023 20:08:15 +0100
+Subject: wifi: mac80211: fix off-by-one link setting
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit cf08e29db760b144bde51e2444f3430c75763e26 ]
+
+The convention for find_first_bit() is 0-based, while ffs()
+is 1-based, so this is now off-by-one. I cannot reproduce the
+gcc-9 problem, but since the -1 is now removed, I'm hoping it
+will still avoid the original issue.
+
+Reported-by: Alexander Lobakin <alexandr.lobakin@intel.com>
+Fixes: 1d8d4af43474 ("wifi: mac80211: avoid u32_encode_bits() warning")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/tx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
+index 118648af979c7..7699fb4106701 100644
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -4434,7 +4434,7 @@ static void ieee80211_mlo_multicast_tx(struct net_device *dev,
+ u32 ctrl_flags = IEEE80211_TX_CTRL_MCAST_MLO_FIRST_TX;
+
+ if (hweight16(links) == 1) {
+- ctrl_flags |= u32_encode_bits(find_first_bit(&links, 16) - 1,
++ ctrl_flags |= u32_encode_bits(__ffs(links),
+ IEEE80211_TX_CTRL_MLO_LINK);
+
+ __ieee80211_subif_start_xmit(skb, sdata->dev, 0, ctrl_flags,
+--
+2.39.2
+
--- /dev/null
+From 5b84e42cf2cd3a3241f32cc3a3b78f9d00d307d5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Feb 2023 19:06:59 +0800
+Subject: wifi: mac80211: make rate u32 in sta_set_rate_info_rx()
+
+From: Shayne Chen <shayne.chen@mediatek.com>
+
+[ Upstream commit 59336e07b287d91dc4ec265e07724e8f7e3d0209 ]
+
+The value of last_rate in ieee80211_sta_rx_stats is degraded from u32 to
+u16 after being assigned to rate variable, which causes information loss
+in STA_STATS_FIELD_TYPE and later bitfields.
+
+Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
+Link: https://lore.kernel.org/r/20230209110659.25447-1-shayne.chen@mediatek.com
+Fixes: 41cbb0f5a295 ("mac80211: add support for HE")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/sta_info.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
+index 04e0f132b1d9c..34cb833db25f5 100644
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -2411,7 +2411,7 @@ static void sta_stats_decode_rate(struct ieee80211_local *local, u32 rate,
+
+ static int sta_set_rate_info_rx(struct sta_info *sta, struct rate_info *rinfo)
+ {
+- u16 rate = READ_ONCE(sta_get_last_rx_stats(sta)->last_rate);
++ u32 rate = READ_ONCE(sta_get_last_rx_stats(sta)->last_rate);
+
+ if (rate == STA_STATS_RATE_INVALID)
+ return -EINVAL;
+--
+2.39.2
+
--- /dev/null
+From 75906c3a993526e0c0fdd4e9a63dc3c3e87aaf84 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Jan 2023 12:01:02 +0100
+Subject: wifi: mac80211: move color collision detection report in a delayed
+ work
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+[ Upstream commit 9288188438d85e22c23cfd6657ee8a801babc83c ]
+
+Move color collision report in a dedicated delayed work and do not run
+it in interrupt context in order to rate-limit the number of events
+reported to userspace. Moreover grab wdev mutex in
+ieee80211_color_collision_detection_work routine since it is required
+by cfg80211_obss_color_collision_notify().
+
+Tested-by: Nicolas Cavallari <nicolas.cavallari@green-communications.fr>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Fixes: 5f9404abdf2a ("mac80211: add support for BSS color change")
+Link: https://lore.kernel.org/r/3f6cf60c892ad40c1cca4a55d62b1224ef1c6ce9.1674644379.git.lorenzo@kernel.org
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/cfg.c | 26 +++++++++++++++++++++++++-
+ net/mac80211/ieee80211_i.h | 3 +++
+ net/mac80211/link.c | 3 +++
+ 3 files changed, 31 insertions(+), 1 deletion(-)
+
+diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
+index 672eff6f5d328..d611e15301839 100644
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -4622,6 +4622,20 @@ void ieee80211_color_change_finalize_work(struct work_struct *work)
+ sdata_unlock(sdata);
+ }
+
++void ieee80211_color_collision_detection_work(struct work_struct *work)
++{
++ struct delayed_work *delayed_work = to_delayed_work(work);
++ struct ieee80211_link_data *link =
++ container_of(delayed_work, struct ieee80211_link_data,
++ color_collision_detect_work);
++ struct ieee80211_sub_if_data *sdata = link->sdata;
++
++ sdata_lock(sdata);
++ cfg80211_obss_color_collision_notify(sdata->dev, link->color_bitmap,
++ GFP_KERNEL);
++ sdata_unlock(sdata);
++}
++
+ void ieee80211_color_change_finish(struct ieee80211_vif *vif)
+ {
+ struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
+@@ -4636,11 +4650,21 @@ ieeee80211_obss_color_collision_notify(struct ieee80211_vif *vif,
+ u64 color_bitmap, gfp_t gfp)
+ {
+ struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
++ struct ieee80211_link_data *link = &sdata->deflink;
+
+ if (sdata->vif.bss_conf.color_change_active || sdata->vif.bss_conf.csa_active)
+ return;
+
+- cfg80211_obss_color_collision_notify(sdata->dev, color_bitmap, gfp);
++ if (delayed_work_pending(&link->color_collision_detect_work))
++ return;
++
++ link->color_bitmap = color_bitmap;
++ /* queue the color collision detection event every 500 ms in order to
++ * avoid sending too much netlink messages to userspace.
++ */
++ ieee80211_queue_delayed_work(&sdata->local->hw,
++ &link->color_collision_detect_work,
++ msecs_to_jiffies(500));
+ }
+ EXPORT_SYMBOL_GPL(ieeee80211_obss_color_collision_notify);
+
+diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
+index d16606e84e22d..7ca9bde3c6d25 100644
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -974,6 +974,8 @@ struct ieee80211_link_data {
+ struct cfg80211_chan_def csa_chandef;
+
+ struct work_struct color_change_finalize_work;
++ struct delayed_work color_collision_detect_work;
++ u64 color_bitmap;
+
+ /* context reservation -- protected with chanctx_mtx */
+ struct ieee80211_chanctx *reserved_chanctx;
+@@ -1929,6 +1931,7 @@ int ieee80211_channel_switch(struct wiphy *wiphy, struct net_device *dev,
+
+ /* color change handling */
+ void ieee80211_color_change_finalize_work(struct work_struct *work);
++void ieee80211_color_collision_detection_work(struct work_struct *work);
+
+ /* interface handling */
+ #define MAC80211_SUPPORTED_FEATURES_TX (NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM | \
+diff --git a/net/mac80211/link.c b/net/mac80211/link.c
+index d1f5a9f7c6470..8c8869cc1fb4c 100644
+--- a/net/mac80211/link.c
++++ b/net/mac80211/link.c
+@@ -39,6 +39,8 @@ void ieee80211_link_init(struct ieee80211_sub_if_data *sdata,
+ ieee80211_csa_finalize_work);
+ INIT_WORK(&link->color_change_finalize_work,
+ ieee80211_color_change_finalize_work);
++ INIT_DELAYED_WORK(&link->color_collision_detect_work,
++ ieee80211_color_collision_detection_work);
+ INIT_LIST_HEAD(&link->assigned_chanctx_list);
+ INIT_LIST_HEAD(&link->reserved_chanctx_list);
+ INIT_DELAYED_WORK(&link->dfs_cac_timer_work,
+@@ -66,6 +68,7 @@ void ieee80211_link_stop(struct ieee80211_link_data *link)
+ if (link->sdata->vif.type == NL80211_IFTYPE_STATION)
+ ieee80211_mgd_stop_link(link);
+
++ cancel_delayed_work_sync(&link->color_collision_detect_work);
+ ieee80211_link_release_channel(link);
+ }
+
+--
+2.39.2
+
--- /dev/null
+From a51771092c0c3b80fbcd2c83c98853d8eeeee766 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Feb 2023 10:07:05 +0100
+Subject: wifi: mac80211: pass 'sta' to ieee80211_rx_data_set_sta()
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 0d846bdc11101ac0ba4d89c2be359af08cb9379b ]
+
+There's at least one case in ieee80211_rx_for_interface()
+where we might pass &((struct sta_info *)NULL)->sta to it
+only to then do container_of(), and then checking the
+result for NULL, but checking the result of container_of()
+for NULL looks really odd.
+
+Fix this by just passing the struct sta_info * instead.
+
+Fixes: e66b7920aa5a ("wifi: mac80211: fix initialization of rx->link and rx->link_sta")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/rx.c | 26 +++++++++++---------------
+ 1 file changed, 11 insertions(+), 15 deletions(-)
+
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index 870b8d042b799..1ed345d072b3f 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -4073,13 +4073,8 @@ static bool ieee80211_rx_data_set_link(struct ieee80211_rx_data *rx,
+ }
+
+ static bool ieee80211_rx_data_set_sta(struct ieee80211_rx_data *rx,
+- struct ieee80211_sta *pubsta,
+- int link_id)
++ struct sta_info *sta, int link_id)
+ {
+- struct sta_info *sta;
+-
+- sta = container_of(pubsta, struct sta_info, sta);
+-
+ rx->link_id = link_id;
+ rx->sta = sta;
+
+@@ -4117,7 +4112,7 @@ void ieee80211_release_reorder_timeout(struct sta_info *sta, int tid)
+ if (sta->sta.valid_links)
+ link_id = ffs(sta->sta.valid_links) - 1;
+
+- if (!ieee80211_rx_data_set_sta(&rx, &sta->sta, link_id))
++ if (!ieee80211_rx_data_set_sta(&rx, sta, link_id))
+ return;
+
+ tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
+@@ -4163,7 +4158,7 @@ void ieee80211_mark_rx_ba_filtered_frames(struct ieee80211_sta *pubsta, u8 tid,
+
+ sta = container_of(pubsta, struct sta_info, sta);
+
+- if (!ieee80211_rx_data_set_sta(&rx, pubsta, -1))
++ if (!ieee80211_rx_data_set_sta(&rx, sta, -1))
+ return;
+
+ rcu_read_lock();
+@@ -4871,6 +4866,7 @@ static void __ieee80211_rx_handle_8023(struct ieee80211_hw *hw,
+ struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
+ struct ieee80211_fast_rx *fast_rx;
+ struct ieee80211_rx_data rx;
++ struct sta_info *sta;
+ int link_id = -1;
+
+ memset(&rx, 0, sizeof(rx));
+@@ -4898,7 +4894,8 @@ static void __ieee80211_rx_handle_8023(struct ieee80211_hw *hw,
+ * link_id is used only for stats purpose and updating the stats on
+ * the deflink is fine?
+ */
+- if (!ieee80211_rx_data_set_sta(&rx, pubsta, link_id))
++ sta = container_of(pubsta, struct sta_info, sta);
++ if (!ieee80211_rx_data_set_sta(&rx, sta, link_id))
+ goto drop;
+
+ fast_rx = rcu_dereference(rx.sta->fast_rx);
+@@ -4938,7 +4935,7 @@ static bool ieee80211_rx_for_interface(struct ieee80211_rx_data *rx,
+ link_id = status->link_id;
+ }
+
+- if (!ieee80211_rx_data_set_sta(rx, &sta->sta, link_id))
++ if (!ieee80211_rx_data_set_sta(rx, sta, link_id))
+ return false;
+
+ return ieee80211_prepare_and_rx_handle(rx, skb, consume);
+@@ -5005,7 +5002,8 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
+ link_id = status->link_id;
+
+ if (pubsta) {
+- if (!ieee80211_rx_data_set_sta(&rx, pubsta, link_id))
++ sta = container_of(pubsta, struct sta_info, sta);
++ if (!ieee80211_rx_data_set_sta(&rx, sta, link_id))
+ goto out;
+
+ /*
+@@ -5042,8 +5040,7 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
+ }
+
+ rx.sdata = prev_sta->sdata;
+- if (!ieee80211_rx_data_set_sta(&rx, &prev_sta->sta,
+- link_id))
++ if (!ieee80211_rx_data_set_sta(&rx, prev_sta, link_id))
+ goto out;
+
+ if (!status->link_valid && prev_sta->sta.mlo)
+@@ -5056,8 +5053,7 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
+
+ if (prev_sta) {
+ rx.sdata = prev_sta->sdata;
+- if (!ieee80211_rx_data_set_sta(&rx, &prev_sta->sta,
+- link_id))
++ if (!ieee80211_rx_data_set_sta(&rx, prev_sta, link_id))
+ goto out;
+
+ if (!status->link_valid && prev_sta->sta.mlo)
+--
+2.39.2
+
--- /dev/null
+From 852cdf2e558e119cbb5686b322fa85c2e861c304 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 15 Jan 2023 12:44:57 +0800
+Subject: wifi: mt76: add memory barrier to SDIO queue kick
+
+From: Deren Wu <deren.wu@mediatek.com>
+
+[ Upstream commit 5f54237ad798f41cb6a503271aa9ca47188cfb9b ]
+
+Ensure the entry has been fully updated before SDIO bus worker access
+it. This patch would fix potential memory risk in both mt7663s and
+mt7921s.
+
+Fixes: 764dee47e2c1 ("mt76: sdio: move common code in mt76_sdio module")
+Signed-off-by: Deren Wu <deren.wu@mediatek.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/sdio.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/sdio.c b/drivers/net/wireless/mediatek/mt76/sdio.c
+index 228bc7d45011c..419723118ded8 100644
+--- a/drivers/net/wireless/mediatek/mt76/sdio.c
++++ b/drivers/net/wireless/mediatek/mt76/sdio.c
+@@ -562,6 +562,10 @@ mt76s_tx_queue_skb_raw(struct mt76_dev *dev, struct mt76_queue *q,
+
+ q->entry[q->head].buf_sz = len;
+ q->entry[q->head].skb = skb;
++
++ /* ensure the entry fully updated before bus access */
++ smp_wmb();
++
+ q->head = (q->head + 1) % q->ndesc;
+ q->queued++;
+
+--
+2.39.2
+
--- /dev/null
+From 83aa2ff21a75c98486863ebe522c68a84e0c53f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Dec 2022 18:13:48 +0800
+Subject: wifi: mt76: connac: fix POWER_CTRL command name typo
+
+From: Shayne Chen <shayne.chen@mediatek.com>
+
+[ Upstream commit 0d82fc956edb67b5755cc64ac6b9aee79cfbbff0 ]
+
+Fix typo MCU_UNI_CMD_POWER_CREL to MCU_UNI_CMD_POWER_CTRL.
+
+Fixes: 779d34de055e ("wifi: mt76: connac: add more unified command IDs")
+Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h | 2 +-
+ drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h
+index f1e942b9a887b..82fdf6d794bcf 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h
++++ b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h
+@@ -1198,7 +1198,7 @@ enum {
+ MCU_UNI_CMD_REPT_MUAR = 0x09,
+ MCU_UNI_CMD_WSYS_CONFIG = 0x0b,
+ MCU_UNI_CMD_REG_ACCESS = 0x0d,
+- MCU_UNI_CMD_POWER_CREL = 0x0f,
++ MCU_UNI_CMD_POWER_CTRL = 0x0f,
+ MCU_UNI_CMD_RX_HDR_TRANS = 0x12,
+ MCU_UNI_CMD_SER = 0x13,
+ MCU_UNI_CMD_TWT = 0x14,
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
+index a88fc7680b1a9..d781c6e0f33ac 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
+@@ -2399,7 +2399,7 @@ mt7996_mcu_restart(struct mt76_dev *dev)
+ .power_mode = 1,
+ };
+
+- return mt76_mcu_send_msg(dev, MCU_WM_UNI_CMD(POWER_CREL), &req,
++ return mt76_mcu_send_msg(dev, MCU_WM_UNI_CMD(POWER_CTRL), &req,
+ sizeof(req), false);
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 01f6daa8b25ed6f7a77617274198c0982e1cf030 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 1 Jan 2023 12:50:05 +0100
+Subject: wifi: mt76: dma: fix memory leak running mt76_dma_tx_cleanup
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+[ Upstream commit 3f7dda36e0b6dfa2cd26191f754ba061ab8191f2 ]
+
+Fix device unregister memory leak and alway cleanup all configured
+rx queues in mt76_dma_tx_cleanup routine.
+
+Fixes: 52546e27787e ("wifi: mt76: add WED RX support to dma queue alloc")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/dma.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/dma.c b/drivers/net/wireless/mediatek/mt76/dma.c
+index 06161815c180e..dee4449de9082 100644
+--- a/drivers/net/wireless/mediatek/mt76/dma.c
++++ b/drivers/net/wireless/mediatek/mt76/dma.c
+@@ -975,8 +975,7 @@ void mt76_dma_cleanup(struct mt76_dev *dev)
+ struct mt76_queue *q = &dev->q_rx[i];
+
+ netif_napi_del(&dev->napi[i]);
+- if (FIELD_GET(MT_QFLAG_WED_TYPE, q->flags))
+- mt76_dma_rx_cleanup(dev, q);
++ mt76_dma_rx_cleanup(dev, q);
+ }
+
+ mt76_free_pending_txwi(dev);
+--
+2.39.2
+
--- /dev/null
+From c86f8c2bac3433c505c1f0925ae3d13cca407c05 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 1 Jan 2023 12:47:57 +0100
+Subject: wifi: mt76: dma: free rx_head in mt76_dma_rx_cleanup
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+[ Upstream commit 1b88b47e898edef0e56e3a2f4e49f052a136153d ]
+
+Free rx_head skb in mt76_dma_rx_cleanup routine in order to avoid
+possible memory leak at module unload.
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/dma.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/dma.c b/drivers/net/wireless/mediatek/mt76/dma.c
+index dee4449de9082..d147dc698c9db 100644
+--- a/drivers/net/wireless/mediatek/mt76/dma.c
++++ b/drivers/net/wireless/mediatek/mt76/dma.c
+@@ -737,6 +737,7 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
+ return;
+
+ spin_lock_bh(&q->lock);
++
+ do {
+ buf = mt76_dma_dequeue(dev, q, true, NULL, NULL, &more, NULL);
+ if (!buf)
+@@ -744,6 +745,12 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
+
+ skb_free_frag(buf);
+ } while (1);
++
++ if (q->rx_head) {
++ dev_kfree_skb(q->rx_head);
++ q->rx_head = NULL;
++ }
++
+ spin_unlock_bh(&q->lock);
+
+ if (!q->rx_page.va)
+@@ -769,12 +776,6 @@ mt76_dma_rx_reset(struct mt76_dev *dev, enum mt76_rxq_id qid)
+ mt76_dma_rx_cleanup(dev, q);
+ mt76_dma_sync_idx(dev, q);
+ mt76_dma_rx_fill(dev, q);
+-
+- if (!q->rx_head)
+- return;
+-
+- dev_kfree_skb(q->rx_head);
+- q->rx_head = NULL;
+ }
+
+ static void
+--
+2.39.2
+
--- /dev/null
+From aa68156a4362a8a0327976aeed391b0d42bff2a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Dec 2022 00:03:10 +0800
+Subject: wifi: mt76: fix coverity uninit_use_in_call in
+ mt76_connac2_reverse_frag0_hdr_trans()
+
+From: Deren Wu <deren.wu@mediatek.com>
+
+[ Upstream commit 0ffcb2a68b15bd63d5555a923ae7dfe8bfdb14a7 ]
+
+The default case for frame_contorl is invalid. We should always
+assign addr3 of this frame properly.
+
+Coverity error message:
+if (ieee80211_has_a4(hdr.frame_control))
+(19) Event uninit_use_in_call: Using uninitialized value "hdr".
+Field "hdr.addr3" is uninitialized when calling "memcpy".
+ memcpy(skb_push(skb, sizeof(hdr)), &hdr, sizeof(hdr));
+else
+ memcpy(skb_push(skb, sizeof(hdr) - 6), &hdr, sizeof(hdr) - 6);
+
+Fixes: 0880d40871d1 ("mt76: connac: move mt76_connac2_reverse_frag0_hdr_trans in mt76-connac module")
+Signed-off-by: Deren Wu <deren.wu@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c b/drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c
+index fd60123fb2840..c8d0c84e688b8 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c
++++ b/drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c
+@@ -930,7 +930,7 @@ int mt76_connac2_reverse_frag0_hdr_trans(struct ieee80211_vif *vif,
+ ether_addr_copy(hdr.addr4, eth_hdr->h_source);
+ break;
+ default:
+- break;
++ return -EINVAL;
+ }
+
+ skb_pull(skb, hdr_offset + sizeof(struct ethhdr) - 2);
+--
+2.39.2
+
--- /dev/null
+From e8fa25319a46ef86719da4afc3ff86869fca356d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Jan 2023 14:56:19 +0100
+Subject: wifi: mt76: fix switch default case in mt7996_reverse_frag0_hdr_trans
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+[ Upstream commit aed8d9b506c22848add261ffad8fdabc57f21964 ]
+
+The switch default case for frame_contorl is invalid. Return -EINVAL
+error for it.
+
+Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7996/mac.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
+index ce4242f90e9f9..96ced4c039ce1 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
+@@ -469,7 +469,7 @@ static int mt7996_reverse_frag0_hdr_trans(struct sk_buff *skb, u16 hdr_gap)
+ ether_addr_copy(hdr.addr4, eth_hdr->h_source);
+ break;
+ default:
+- break;
++ return -EINVAL;
+ }
+
+ skb_pull(skb, hdr_gap + sizeof(struct ethhdr) - 2);
+--
+2.39.2
+
--- /dev/null
+From 37cfbe8106a32bf4ecf7e34ec8230232eafd32ab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Dec 2022 17:59:04 +0100
+Subject: wifi: mt76: mt76x0: fix oob access in mt76x0_phy_get_target_power
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+[ Upstream commit 6e1abc51c945663bddebfa1beb9590ff5b250eb7 ]
+
+After 'commit ba45841ca5eb ("wifi: mt76: mt76x02: simplify struct
+mt76x02_rate_power")', mt76x02 relies on ht[0-7] rate_power data for
+vht mcs{0,7}, while it uses vth[0-1] rate_power for vht mcs {8,9}.
+Fix a possible out-of-bound access in mt76x0_phy_get_target_power routine.
+
+Fixes: ba45841ca5eb ("wifi: mt76: mt76x02: simplify struct mt76x02_rate_power")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt76x0/phy.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt76x0/phy.c b/drivers/net/wireless/mediatek/mt76/mt76x0/phy.c
+index 6c6c8ada7943b..d543ef3de65be 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt76x0/phy.c
++++ b/drivers/net/wireless/mediatek/mt76/mt76x0/phy.c
+@@ -642,7 +642,12 @@ mt76x0_phy_get_target_power(struct mt76x02_dev *dev, u8 tx_mode,
+ if (tx_rate > 9)
+ return -EINVAL;
+
+- *target_power = cur_power + dev->rate_power.vht[tx_rate];
++ *target_power = cur_power;
++ if (tx_rate > 7)
++ *target_power += dev->rate_power.vht[tx_rate - 8];
++ else
++ *target_power += dev->rate_power.ht[tx_rate];
++
+ *target_pa_power = mt76x0_phy_get_rf_pa_mode(dev, 1, tx_rate);
+ break;
+ default:
+--
+2.39.2
+
--- /dev/null
+From 98bda82d5e0adb95667445470d2f4f9996a3298e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Nov 2022 17:06:07 +0800
+Subject: wifi: mt76: mt7915: add missing of_node_put()
+
+From: Wang Yufen <wangyufen@huawei.com>
+
+[ Upstream commit 18425d7d74c5be88b13b970a21e52e2498abf4ba ]
+
+Add missing of_node_put() after of_reserved_mem_lookup()
+
+Fixes: 99ad32a4ca3a ("mt76: mt7915: add support for MT7986")
+Signed-off-by: Wang Yufen <wangyufen@huawei.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7915/soc.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/soc.c b/drivers/net/wireless/mediatek/mt76/mt7915/soc.c
+index c06c56a0270d6..686c9bbd59293 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7915/soc.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7915/soc.c
+@@ -278,6 +278,7 @@ static int mt7986_wmac_coninfra_setup(struct mt7915_dev *dev)
+ return -EINVAL;
+
+ rmem = of_reserved_mem_lookup(np);
++ of_node_put(np);
+ if (!rmem)
+ return -EINVAL;
+
+--
+2.39.2
+
--- /dev/null
+From 424ff89f6c4980bae638b9f32eda1072af4046b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Dec 2022 10:28:06 +0800
+Subject: wifi: mt76: mt7915: call mt7915_mcu_set_thermal_throttling() only
+ after init_work
+
+From: Howard Hsu <howard-yh.hsu@mediatek.com>
+
+[ Upstream commit 7d12b38ab6f6b77198cd3a66db19587bbdd3308c ]
+
+Enable thermal management by default shall not be executed during mcu
+init. This causes thermal configuration being reset to the firmware
+default settings.
+
+Fixes: 0063b86c9120 ("mt76: mt7915e: Enable thermal management by default")
+Reviewed-by: Ryder Lee <ryder.lee@mediatek.com>
+Signed-off-by: Howard Hsu <howard-yh.hsu@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7915/init.c | 3 +--
+ drivers/net/wireless/mediatek/mt76/mt7915/main.c | 6 ++++++
+ 2 files changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/init.c b/drivers/net/wireless/mediatek/mt76/mt7915/init.c
+index c810c31fbd6e9..41019ba24a048 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7915/init.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7915/init.c
+@@ -201,8 +201,7 @@ static int mt7915_thermal_init(struct mt7915_phy *phy)
+ phy->throttle_temp[0] = 110;
+ phy->throttle_temp[1] = 120;
+
+- return mt7915_mcu_set_thermal_throttling(phy,
+- MT7915_THERMAL_THROTTLE_MAX);
++ return 0;
+ }
+
+ static void mt7915_led_set_config(struct led_classdev *led_cdev,
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/main.c b/drivers/net/wireless/mediatek/mt76/mt7915/main.c
+index 0511d6a505b09..98af032eba097 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7915/main.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7915/main.c
+@@ -57,6 +57,12 @@ int mt7915_run(struct ieee80211_hw *hw)
+ mt7915_mac_enable_nf(dev, phy->mt76->band_idx);
+ }
+
++ ret = mt7915_mcu_set_thermal_throttling(phy,
++ MT7915_THERMAL_THROTTLE_MAX);
++
++ if (ret)
++ goto out;
++
+ ret = mt76_connac_mcu_set_rts_thresh(&dev->mt76, 0x92b,
+ phy->mt76->band_idx);
+ if (ret)
+--
+2.39.2
+
--- /dev/null
+From 477123bc87b4cfa6c0be54859fa4d76008c94e3f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 4 Dec 2022 05:33:17 +0800
+Subject: wifi: mt76: mt7915: check return value before accessing
+ free_block_num
+
+From: Ryder Lee <ryder.lee@mediatek.com>
+
+[ Upstream commit 59b27a7d472f100ac8998e15a63c47a03cced12a ]
+
+Check return value of mt7915_mcu_get_eeprom_free_block() first before
+accessing free_block_num.
+
+Fixes: bbc1d4154ec1 ("mt76: mt7915: add default calibrated data support")
+Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../wireless/mediatek/mt76/mt7915/eeprom.c | 19 ++++++++++++-------
+ .../net/wireless/mediatek/mt76/mt7915/mcu.c | 10 ++++++----
+ 2 files changed, 18 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.c b/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.c
+index 59069fb864147..24efa280dd868 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.c
+@@ -110,18 +110,23 @@ static int mt7915_eeprom_load(struct mt7915_dev *dev)
+ } else {
+ u8 free_block_num;
+ u32 block_num, i;
++ u32 eeprom_blk_size = MT7915_EEPROM_BLOCK_SIZE;
+
+- mt7915_mcu_get_eeprom_free_block(dev, &free_block_num);
+- /* efuse info not enough */
++ ret = mt7915_mcu_get_eeprom_free_block(dev, &free_block_num);
++ if (ret < 0)
++ return ret;
++
++ /* efuse info isn't enough */
+ if (free_block_num >= 29)
+ return -EINVAL;
+
+ /* read eeprom data from efuse */
+- block_num = DIV_ROUND_UP(eeprom_size,
+- MT7915_EEPROM_BLOCK_SIZE);
+- for (i = 0; i < block_num; i++)
+- mt7915_mcu_get_eeprom(dev,
+- i * MT7915_EEPROM_BLOCK_SIZE);
++ block_num = DIV_ROUND_UP(eeprom_size, eeprom_blk_size);
++ for (i = 0; i < block_num; i++) {
++ ret = mt7915_mcu_get_eeprom(dev, i * eeprom_blk_size);
++ if (ret < 0)
++ return ret;
++ }
+ }
+
+ return mt7915_check_eeprom(dev);
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
+index b2652de082baa..d9d6846ba8e02 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
+@@ -2792,8 +2792,9 @@ int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset)
+ int ret;
+ u8 *buf;
+
+- ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_QUERY(EFUSE_ACCESS), &req,
+- sizeof(req), true, &skb);
++ ret = mt76_mcu_send_and_get_msg(&dev->mt76,
++ MCU_EXT_QUERY(EFUSE_ACCESS),
++ &req, sizeof(req), true, &skb);
+ if (ret)
+ return ret;
+
+@@ -2818,8 +2819,9 @@ int mt7915_mcu_get_eeprom_free_block(struct mt7915_dev *dev, u8 *block_num)
+ struct sk_buff *skb;
+ int ret;
+
+- ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_QUERY(EFUSE_FREE_BLOCK), &req,
+- sizeof(req), true, &skb);
++ ret = mt76_mcu_send_and_get_msg(&dev->mt76,
++ MCU_EXT_QUERY(EFUSE_FREE_BLOCK),
++ &req, sizeof(req), true, &skb);
+ if (ret)
+ return ret;
+
+--
+2.39.2
+
--- /dev/null
+From 58db72d6ad53c461f66bd871c7b5700ff3238510 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 4 Dec 2022 15:18:14 +0800
+Subject: wifi: mt76: mt7915: drop always true condition of __mt7915_reg_addr()
+
+From: Ryder Lee <ryder.lee@mediatek.com>
+
+[ Upstream commit b0f7b9563358493dfe70d3e4c3ebeffc92d4b494 ]
+
+smatch warnings:
+addr <= MT_CBTOP2_PHY_END(0xffffffff) is always true (<= u32max),
+so drop it.
+
+Fixes: cd4c314a65d3 ("mt76: mt7915: refine register definition")
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7915/mmio.c | 2 +-
+ drivers/net/wireless/mediatek/mt76/mt7915/regs.h | 1 -
+ 2 files changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mmio.c b/drivers/net/wireless/mediatek/mt76/mt7915/mmio.c
+index 8388e2a658535..afa558c9a9302 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7915/mmio.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7915/mmio.c
+@@ -495,7 +495,7 @@ static u32 __mt7915_reg_addr(struct mt7915_dev *dev, u32 addr)
+
+ if (dev_is_pci(dev->mt76.dev) &&
+ ((addr >= MT_CBTOP1_PHY_START && addr <= MT_CBTOP1_PHY_END) ||
+- (addr >= MT_CBTOP2_PHY_START && addr <= MT_CBTOP2_PHY_END)))
++ addr >= MT_CBTOP2_PHY_START))
+ return mt7915_reg_map_l1(dev, addr);
+
+ /* CONN_INFRA: covert to phyiscal addr and use layer 1 remap */
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/regs.h b/drivers/net/wireless/mediatek/mt76/mt7915/regs.h
+index aca1b2f1e9e3b..7e0d86366c778 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7915/regs.h
++++ b/drivers/net/wireless/mediatek/mt76/mt7915/regs.h
+@@ -803,7 +803,6 @@ enum offs_rev {
+ #define MT_CBTOP1_PHY_START 0x70000000
+ #define MT_CBTOP1_PHY_END __REG(CBTOP1_PHY_END)
+ #define MT_CBTOP2_PHY_START 0xf0000000
+-#define MT_CBTOP2_PHY_END 0xffffffff
+ #define MT_INFRA_MCU_START 0x7c000000
+ #define MT_INFRA_MCU_END __REG(INFRA_MCU_ADDR_END)
+ #define MT_CONN_INFRA_OFFSET(p) ((p) - MT_INFRA_BASE)
+--
+2.39.2
+
--- /dev/null
+From d5fa681e6c816513ad0b965287f6af00a8a54a35 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 1 Jan 2023 12:42:04 +0100
+Subject: wifi: mt76: mt7915: fix memory leak in mt7915_mcu_exit
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+[ Upstream commit 49bd78282e79ad177d14f37f4049f0605bf92dad ]
+
+Always purge mcu skb queues in mt7915_mcu_exit routine even if
+mt7915_firmware_state fails.
+
+Fixes: e57b7901469f ("mt76: add mac80211 driver for MT7915 PCIe-based chipsets")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
+index a861312ba3ed1..f566ba77b2ed4 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
+@@ -2349,13 +2349,14 @@ void mt7915_mcu_exit(struct mt7915_dev *dev)
+ __mt76_mcu_restart(&dev->mt76);
+ if (mt7915_firmware_state(dev, false)) {
+ dev_err(dev->mt76.dev, "Failed to exit mcu\n");
+- return;
++ goto out;
+ }
+
+ mt76_wr(dev, MT_TOP_LPCR_HOST_BAND(0), MT_TOP_LPCR_HOST_FW_OWN);
+ if (dev->hif2)
+ mt76_wr(dev, MT_TOP_LPCR_HOST_BAND(1),
+ MT_TOP_LPCR_HOST_FW_OWN);
++out:
+ skb_queue_purge(&dev->mt76.mcu.res_q);
+ }
+
+--
+2.39.2
+
--- /dev/null
+From f66a98acc5fdde25079a6ae4875f04288273d32e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 3 Dec 2022 11:22:22 +0800
+Subject: wifi: mt76: mt7915: fix mt7915_rate_txpower_get() resource leaks
+
+From: Ryder Lee <ryder.lee@mediatek.com>
+
+[ Upstream commit 8b25301af01566f4b5a301fc1ad7c5d2b1788d7f ]
+
+Coverity message: variable "buf" going out of scope leaks the storage.
+
+Reported-by: coverity-bot <keescook+coverity-bot@chromium.org>
+Addresses-Coverity-ID: 1527799 ("Resource leaks")
+Fixes: e3296759f347 ("wifi: mt76: mt7915: enable per bandwidth power limit support")
+Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c b/drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c
+index fb46c2c1784f2..a7fdcd1f3d988 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c
+@@ -996,7 +996,7 @@ mt7915_rate_txpower_get(struct file *file, char __user *user_buf,
+
+ ret = mt7915_mcu_get_txpower_sku(phy, txpwr, sizeof(txpwr));
+ if (ret)
+- return ret;
++ goto out;
+
+ /* Txpower propagation path: TMAC -> TXV -> BBP */
+ len += scnprintf(buf + len, sz - len,
+@@ -1047,6 +1047,8 @@ mt7915_rate_txpower_get(struct file *file, char __user *user_buf,
+ mt76_get_field(dev, reg, MT_WF_PHY_TPC_POWER));
+
+ ret = simple_read_from_buffer(user_buf, count, ppos, buf, len);
++
++out:
+ kfree(buf);
+ return ret;
+ }
+--
+2.39.2
+
--- /dev/null
+From c7f35fe77a71b7d1d8c5db23ce70414f79e6551c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Dec 2022 15:30:05 +0800
+Subject: wifi: mt76: mt7915: fix unintended sign extension of
+ mt7915_hw_queue_read()
+
+From: Ryder Lee <ryder.lee@mediatek.com>
+
+[ Upstream commit edb0406bda4629ef496f52eb11cbea7e92ed301b ]
+
+In the expression "map[i].qid << 24" starts as u8, but is promoted to
+"signed int", then sign-extended to type "unsigned long", which is not
+intended. Cast to u32 to avoid the sign extension.
+
+Fixes: 776ec4e77aa6 ("mt76: mt7915: rework debugfs queue info")
+Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c b/drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c
+index a7fdcd1f3d988..5a46813a59eac 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c
+@@ -811,7 +811,7 @@ mt7915_hw_queue_read(struct seq_file *s, u32 size,
+ if (val & BIT(map[i].index))
+ continue;
+
+- ctrl = BIT(31) | (map[i].pid << 10) | (map[i].qid << 24);
++ ctrl = BIT(31) | (map[i].pid << 10) | ((u32)map[i].qid << 24);
+ mt76_wr(dev, MT_FL_Q0_CTRL, ctrl);
+
+ head = mt76_get_field(dev, MT_FL_Q2_CTRL,
+--
+2.39.2
+
--- /dev/null
+From 1fef98d0fee75b460afb703891a3b996cc319f29 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 7 Jan 2023 05:40:42 +0800
+Subject: wifi: mt76: mt7915: fix WED TxS reporting
+
+From: Ryder Lee <ryder.lee@mediatek.com>
+
+[ Upstream commit 0d7084e209a9e2c924cb0d6e7f1f978db2a54127 ]
+
+The previous commit forgot to remove a leftover check.
+
+Fixes: 43eaa3689507 ("wifi: mt76: add PPDU based TxS support for WED device")
+Reported-By: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7915/mac.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mac.c b/drivers/net/wireless/mediatek/mt76/mt7915/mac.c
+index f0d5a3603902a..1a6def77db571 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7915/mac.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7915/mac.c
+@@ -1061,9 +1061,6 @@ static void mt7915_mac_add_txs(struct mt7915_dev *dev, void *data)
+ u16 wcidx;
+ u8 pid;
+
+- if (le32_get_bits(txs_data[0], MT_TXS0_TXS_FORMAT) > 1)
+- return;
+-
+ wcidx = le32_get_bits(txs_data[2], MT_TXS2_WCID);
+ pid = le32_get_bits(txs_data[3], MT_TXS3_PID);
+
+--
+2.39.2
+
--- /dev/null
+From 5d3d36f5460ba06eaa7d7cb744177f928f63a66e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Dec 2022 10:28:07 +0800
+Subject: wifi: mt76: mt7915: rework mt7915_mcu_set_thermal_throttling
+
+From: Howard Hsu <howard-yh.hsu@mediatek.com>
+
+[ Upstream commit 5ad42d19f6596e54b091827c397fdb7c091d45f7 ]
+
+This patch includes 2 changes:
+1. Firmware expects to disable thermal protect first before
+reconfiguring.
+2. Separate setting thermal_protect and setting thermal_tx_duty into
+different functions. These two firmware commands do not need to send
+together.
+
+Fixes: 34b877d972be ("mt76: mt7915: add thermal cooling device support")
+Reviewed-by: Ryder Lee <ryder.lee@mediatek.com>
+Signed-off-by: Howard Hsu <howard-yh.hsu@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/mediatek/mt76/mt7915/init.c | 3 --
+ .../net/wireless/mediatek/mt76/mt7915/main.c | 5 ++
+ .../net/wireless/mediatek/mt76/mt7915/mcu.c | 54 +++++++++++--------
+ .../wireless/mediatek/mt76/mt7915/mt7915.h | 1 +
+ 4 files changed, 37 insertions(+), 26 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/init.c b/drivers/net/wireless/mediatek/mt76/mt7915/init.c
+index 41019ba24a048..4c351bfd4b270 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7915/init.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7915/init.c
+@@ -134,9 +134,6 @@ mt7915_thermal_set_cur_throttle_state(struct thermal_cooling_device *cdev,
+ if (state > MT7915_CDEV_THROTTLE_MAX)
+ return -EINVAL;
+
+- if (phy->throttle_temp[0] > phy->throttle_temp[1])
+- return 0;
+-
+ if (state == phy->cdev_state)
+ return 0;
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/main.c b/drivers/net/wireless/mediatek/mt76/mt7915/main.c
+index 98af032eba097..7589af4b3dab7 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7915/main.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7915/main.c
+@@ -60,6 +60,11 @@ int mt7915_run(struct ieee80211_hw *hw)
+ ret = mt7915_mcu_set_thermal_throttling(phy,
+ MT7915_THERMAL_THROTTLE_MAX);
+
++ if (ret)
++ goto out;
++
++ ret = mt7915_mcu_set_thermal_protect(phy);
++
+ if (ret)
+ goto out;
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
+index d9d6846ba8e02..a861312ba3ed1 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
+@@ -3060,6 +3060,29 @@ int mt7915_mcu_get_temperature(struct mt7915_phy *phy)
+ }
+
+ int mt7915_mcu_set_thermal_throttling(struct mt7915_phy *phy, u8 state)
++{
++ struct mt7915_dev *dev = phy->dev;
++ struct mt7915_mcu_thermal_ctrl req = {
++ .band_idx = phy->mt76->band_idx,
++ .ctrl_id = THERMAL_PROTECT_DUTY_CONFIG,
++ };
++ int level, ret;
++
++ /* set duty cycle and level */
++ for (level = 0; level < 4; level++) {
++ req.duty.duty_level = level;
++ req.duty.duty_cycle = state;
++ state /= 2;
++
++ ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_PROT),
++ &req, sizeof(req), false);
++ if (ret)
++ return ret;
++ }
++ return 0;
++}
++
++int mt7915_mcu_set_thermal_protect(struct mt7915_phy *phy)
+ {
+ struct mt7915_dev *dev = phy->dev;
+ struct {
+@@ -3072,29 +3095,18 @@ int mt7915_mcu_set_thermal_throttling(struct mt7915_phy *phy, u8 state)
+ } __packed req = {
+ .ctrl = {
+ .band_idx = phy->mt76->band_idx,
++ .type.protect_type = 1,
++ .type.trigger_type = 1,
+ },
+ };
+- int level;
+-
+- if (!state) {
+- req.ctrl.ctrl_id = THERMAL_PROTECT_DISABLE;
+- goto out;
+- }
+-
+- /* set duty cycle and level */
+- for (level = 0; level < 4; level++) {
+- int ret;
++ int ret;
+
+- req.ctrl.ctrl_id = THERMAL_PROTECT_DUTY_CONFIG;
+- req.ctrl.duty.duty_level = level;
+- req.ctrl.duty.duty_cycle = state;
+- state /= 2;
++ req.ctrl.ctrl_id = THERMAL_PROTECT_DISABLE;
++ ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_PROT),
++ &req, sizeof(req.ctrl), false);
+
+- ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_PROT),
+- &req, sizeof(req.ctrl), false);
+- if (ret)
+- return ret;
+- }
++ if (ret)
++ return ret;
+
+ /* set high-temperature trigger threshold */
+ req.ctrl.ctrl_id = THERMAL_PROTECT_ENABLE;
+@@ -3103,10 +3115,6 @@ int mt7915_mcu_set_thermal_throttling(struct mt7915_phy *phy, u8 state)
+ req.trigger_temp = cpu_to_le32(phy->throttle_temp[1]);
+ req.sustain_time = cpu_to_le16(10);
+
+-out:
+- req.ctrl.type.protect_type = 1;
+- req.ctrl.type.trigger_type = 1;
+-
+ return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_PROT),
+ &req, sizeof(req), false);
+ }
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h b/drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h
+index 6351feba6bdf9..855779f86bde0 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h
++++ b/drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h
+@@ -543,6 +543,7 @@ int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy);
+ int mt7915_mcu_get_chan_mib_info(struct mt7915_phy *phy, bool chan_switch);
+ int mt7915_mcu_get_temperature(struct mt7915_phy *phy);
+ int mt7915_mcu_set_thermal_throttling(struct mt7915_phy *phy, u8 state);
++int mt7915_mcu_set_thermal_protect(struct mt7915_phy *phy);
+ int mt7915_mcu_get_rx_rate(struct mt7915_phy *phy, struct ieee80211_vif *vif,
+ struct ieee80211_sta *sta, struct rate_info *rate);
+ int mt7915_mcu_rdd_background_enable(struct mt7915_phy *phy,
+--
+2.39.2
+
--- /dev/null
+From 6b5655c5f6eb2bd97e277c80d17ee573d7fcc9dd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Dec 2022 10:28:08 +0800
+Subject: wifi: mt76: mt7915: rework mt7915_thermal_temp_store()
+
+From: Howard Hsu <howard-yh.hsu@mediatek.com>
+
+[ Upstream commit ecaccdae7a7e8f76eeb6544295ca0593c2f65a33 ]
+
+Call mt7915_mcu_set_thermal_protect() through
+mt7915_thermal_temp_store() to update firmware trigger/restore temp
+directly.
+
+Fixes: 02ee68b95d81 ("mt76: mt7915: add control knobs for thermal throttling")
+Reviewed-by: Ryder Lee <ryder.lee@mediatek.com>
+Signed-off-by: Howard Hsu <howard-yh.hsu@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/mediatek/mt76/mt7915/init.c | 18 ++++++++++++++++--
+ .../net/wireless/mediatek/mt76/mt7915/mt7915.h | 3 +++
+ 2 files changed, 19 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/init.c b/drivers/net/wireless/mediatek/mt76/mt7915/init.c
+index 4c351bfd4b270..a80ae31e7abff 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7915/init.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7915/init.c
+@@ -83,9 +83,23 @@ static ssize_t mt7915_thermal_temp_store(struct device *dev,
+
+ mutex_lock(&phy->dev->mt76.mutex);
+ val = clamp_val(DIV_ROUND_CLOSEST(val, 1000), 60, 130);
++
++ if ((i - 1 == MT7915_CRIT_TEMP_IDX &&
++ val > phy->throttle_temp[MT7915_MAX_TEMP_IDX]) ||
++ (i - 1 == MT7915_MAX_TEMP_IDX &&
++ val < phy->throttle_temp[MT7915_CRIT_TEMP_IDX])) {
++ dev_err(phy->dev->mt76.dev,
++ "temp1_max shall be greater than temp1_crit.");
++ return -EINVAL;
++ }
++
+ phy->throttle_temp[i - 1] = val;
+ mutex_unlock(&phy->dev->mt76.mutex);
+
++ ret = mt7915_mcu_set_thermal_protect(phy);
++ if (ret)
++ return ret;
++
+ return count;
+ }
+
+@@ -195,8 +209,8 @@ static int mt7915_thermal_init(struct mt7915_phy *phy)
+ return PTR_ERR(hwmon);
+
+ /* initialize critical/maximum high temperature */
+- phy->throttle_temp[0] = 110;
+- phy->throttle_temp[1] = 120;
++ phy->throttle_temp[MT7915_CRIT_TEMP_IDX] = 110;
++ phy->throttle_temp[MT7915_MAX_TEMP_IDX] = 120;
+
+ return 0;
+ }
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h b/drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h
+index 855779f86bde0..e58650bbbd14a 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h
++++ b/drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h
+@@ -70,6 +70,9 @@
+
+ #define MT7915_WED_RX_TOKEN_SIZE 12288
+
++#define MT7915_CRIT_TEMP_IDX 0
++#define MT7915_MAX_TEMP_IDX 1
++
+ struct mt7915_vif;
+ struct mt7915_sta;
+ struct mt7915_dfs_pulse;
+--
+2.39.2
+
--- /dev/null
+From d946a8cdfb4f925dd8c3cfab07e4cfdd45ebe1d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Dec 2022 19:04:38 +0800
+Subject: wifi: mt76: mt7921: fix channel switch fail in monitor mode
+
+From: Deren Wu <deren.wu@mediatek.com>
+
+[ Upstream commit 914189af23b83c9a83a0137a3a40f17de7d2c618 ]
+
+When the chanctx enabled, IEEE80211_CONF_CHANGE_CHANNEL in .config()
+would not be called anymore. mt76 cannot control RF channel for monitor.
+Add monitor type set-channel flow in .change_chanctx().
+
+Fixes: 41ac53c899bd ("wifi: mt76: mt7921: introduce chanctx support")
+Reviewed-by: Sean Wang <sean.wang@mediatek.com>
+Signed-off-by: Deren Wu <deren.wu@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/mediatek/mt76/mt7921/main.c | 5 +-
+ .../net/wireless/mediatek/mt76/mt7921/mcu.c | 68 +++++++++++++++++++
+ .../wireless/mediatek/mt76/mt7921/mt7921.h | 2 +
+ 3 files changed, 74 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/main.c b/drivers/net/wireless/mediatek/mt76/mt7921/main.c
+index 722df8eea91f7..cdb0d61903935 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7921/main.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7921/main.c
+@@ -1706,7 +1706,10 @@ static void mt7921_ctx_iter(void *priv, u8 *mac,
+ if (ctx != mvif->ctx)
+ return;
+
+- mt76_connac_mcu_uni_set_chctx(mvif->phy->mt76, &mvif->mt76, ctx);
++ if (vif->type & NL80211_IFTYPE_MONITOR)
++ mt7921_mcu_config_sniffer(mvif, ctx);
++ else
++ mt76_connac_mcu_uni_set_chctx(mvif->phy->mt76, &mvif->mt76, ctx);
+ }
+
+ static void
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
+index fb9c0f66cb27c..bd929b5f2504f 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
+@@ -1093,6 +1093,74 @@ int mt7921_mcu_set_sniffer(struct mt7921_dev *dev, struct ieee80211_vif *vif,
+ true);
+ }
+
++int mt7921_mcu_config_sniffer(struct mt7921_vif *vif,
++ struct ieee80211_chanctx_conf *ctx)
++{
++ struct cfg80211_chan_def *chandef = &ctx->def;
++ int freq1 = chandef->center_freq1, freq2 = chandef->center_freq2;
++ const u8 ch_band[] = {
++ [NL80211_BAND_2GHZ] = 1,
++ [NL80211_BAND_5GHZ] = 2,
++ [NL80211_BAND_6GHZ] = 3,
++ };
++ const u8 ch_width[] = {
++ [NL80211_CHAN_WIDTH_20_NOHT] = 0,
++ [NL80211_CHAN_WIDTH_20] = 0,
++ [NL80211_CHAN_WIDTH_40] = 0,
++ [NL80211_CHAN_WIDTH_80] = 1,
++ [NL80211_CHAN_WIDTH_160] = 2,
++ [NL80211_CHAN_WIDTH_80P80] = 3,
++ [NL80211_CHAN_WIDTH_5] = 4,
++ [NL80211_CHAN_WIDTH_10] = 5,
++ [NL80211_CHAN_WIDTH_320] = 6,
++ };
++ struct {
++ struct {
++ u8 band_idx;
++ u8 pad[3];
++ } __packed hdr;
++ struct config_tlv {
++ __le16 tag;
++ __le16 len;
++ u16 aid;
++ u8 ch_band;
++ u8 bw;
++ u8 control_ch;
++ u8 sco;
++ u8 center_ch;
++ u8 center_ch2;
++ u8 drop_err;
++ u8 pad[3];
++ } __packed tlv;
++ } __packed req = {
++ .hdr = {
++ .band_idx = vif->mt76.band_idx,
++ },
++ .tlv = {
++ .tag = cpu_to_le16(1),
++ .len = cpu_to_le16(sizeof(req.tlv)),
++ .control_ch = chandef->chan->hw_value,
++ .center_ch = ieee80211_frequency_to_channel(freq1),
++ .drop_err = 1,
++ },
++ };
++ if (chandef->chan->band < ARRAY_SIZE(ch_band))
++ req.tlv.ch_band = ch_band[chandef->chan->band];
++ if (chandef->width < ARRAY_SIZE(ch_width))
++ req.tlv.bw = ch_width[chandef->width];
++
++ if (freq2)
++ req.tlv.center_ch2 = ieee80211_frequency_to_channel(freq2);
++
++ if (req.tlv.control_ch < req.tlv.center_ch)
++ req.tlv.sco = 1; /* SCA */
++ else if (req.tlv.control_ch > req.tlv.center_ch)
++ req.tlv.sco = 3; /* SCB */
++
++ return mt76_mcu_send_msg(vif->phy->mt76->dev, MCU_UNI_CMD(SNIFFER),
++ &req, sizeof(req), true);
++}
++
+ int
+ mt7921_mcu_uni_add_beacon_offload(struct mt7921_dev *dev,
+ struct ieee80211_hw *hw,
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mt7921.h b/drivers/net/wireless/mediatek/mt76/mt7921/mt7921.h
+index 15d6b7fe1c6c8..d4cfa26c373c3 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7921/mt7921.h
++++ b/drivers/net/wireless/mediatek/mt76/mt7921/mt7921.h
+@@ -529,6 +529,8 @@ void mt7921_set_ipv6_ns_work(struct work_struct *work);
+
+ int mt7921_mcu_set_sniffer(struct mt7921_dev *dev, struct ieee80211_vif *vif,
+ bool enable);
++int mt7921_mcu_config_sniffer(struct mt7921_vif *vif,
++ struct ieee80211_chanctx_conf *ctx);
+
+ int mt7921_usb_sdio_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+ enum mt76_txq_id qid, struct mt76_wcid *wcid,
+--
+2.39.2
+
--- /dev/null
+From 8c2a46b825eaca51c7a2e24de9967b97c260f07b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Dec 2022 11:47:47 +0100
+Subject: wifi: mt76: mt7921: fix deadlock in mt7921_abort_roc
+
+From: Felix Fietkau <nbd@nbd.name>
+
+[ Upstream commit de19b9c83654e323d83f839a550ca4af37fea15b ]
+
+When mt7921_abort_roc is called with dev->mutex held, it can deadlock while
+calling cancel_work_sync(&phy->roc_work), because the work function could
+be waiting to acquire the mutex.
+
+Fix this by flushing the work before taking the mutex
+
+Reported-by: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com>
+Fixes: 034ae28b56f1 ("wifi: mt76: mt7921: introduce remain_on_channel support")
+Fixes: 41ac53c899bd ("wifi: mt76: mt7921: introduce chanctx support")
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/mediatek/mt76/mt7921/main.c | 22 ++++++-------------
+ 1 file changed, 7 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/main.c b/drivers/net/wireless/mediatek/mt76/mt7921/main.c
+index 76ac5069638fe..722df8eea91f7 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7921/main.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7921/main.c
+@@ -422,15 +422,15 @@ void mt7921_roc_timer(struct timer_list *timer)
+
+ static int mt7921_abort_roc(struct mt7921_phy *phy, struct mt7921_vif *vif)
+ {
+- int err;
+-
+- if (!test_and_clear_bit(MT76_STATE_ROC, &phy->mt76->state))
+- return 0;
++ int err = 0;
+
+ del_timer_sync(&phy->roc_timer);
+ cancel_work_sync(&phy->roc_work);
+- err = mt7921_mcu_abort_roc(phy, vif, phy->roc_token_id);
+- clear_bit(MT76_STATE_ROC, &phy->mt76->state);
++
++ mt7921_mutex_acquire(phy->dev);
++ if (test_and_clear_bit(MT76_STATE_ROC, &phy->mt76->state))
++ err = mt7921_mcu_abort_roc(phy, vif, phy->roc_token_id);
++ mt7921_mutex_release(phy->dev);
+
+ return err;
+ }
+@@ -487,13 +487,8 @@ static int mt7921_cancel_remain_on_channel(struct ieee80211_hw *hw,
+ {
+ struct mt7921_vif *mvif = (struct mt7921_vif *)vif->drv_priv;
+ struct mt7921_phy *phy = mt7921_hw_phy(hw);
+- int err;
+
+- mt7921_mutex_acquire(phy->dev);
+- err = mt7921_abort_roc(phy, mvif);
+- mt7921_mutex_release(phy->dev);
+-
+- return err;
++ return mt7921_abort_roc(phy, mvif);
+ }
+
+ static int mt7921_set_channel(struct mt7921_phy *phy)
+@@ -1778,11 +1773,8 @@ static void mt7921_mgd_complete_tx(struct ieee80211_hw *hw,
+ struct ieee80211_prep_tx_info *info)
+ {
+ struct mt7921_vif *mvif = (struct mt7921_vif *)vif->drv_priv;
+- struct mt7921_dev *dev = mt7921_hw_dev(hw);
+
+- mt7921_mutex_acquire(dev);
+ mt7921_abort_roc(mvif->phy, mvif);
+- mt7921_mutex_release(dev);
+ }
+
+ const struct ieee80211_ops mt7921_ops = {
+--
+2.39.2
+
--- /dev/null
+From 66a0469eba4ddc85096b7f0a7d3182962f5115e8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Jan 2023 23:22:35 +0800
+Subject: wifi: mt76: mt7921: fix error code of return in mt7921_acpi_read
+
+From: Aaron Ma <aaron.ma@canonical.com>
+
+[ Upstream commit 888d89034f9eaeab9b5b75f13dbe35376c7dd471 ]
+
+Kernel NULL pointer dereference when ACPI SAR table isn't implemented well.
+Fix the error code of return to mark the ACPI SAR table as invalid.
+
+[ 5.077128] mt7921e 0000:06:00.0: sar cnt = 0
+[ 5.077381] BUG: kernel NULL pointer dereference, address:
+0000000000000004
+[ 5.077630] #PF: supervisor read access in kernel mode
+[ 5.077883] #PF: error_code(0x0000) - not-present page
+[ 5.078138] PGD 0 P4D 0
+[ 5.078398] Oops: 0000 [#1] PREEMPT SMP NOPTI
+[ 5.079202] RIP: 0010:mt7921_init_acpi_sar+0x106/0x220
+[mt7921_common]
+...
+[ 5.080786] Call Trace:
+[ 5.080786] <TASK>
+[ 5.080786] mt7921_register_device+0x37d/0x490 [mt7921_common]
+[ 5.080786] mt7921_pci_probe.part.0+0x2ee/0x310 [mt7921e]
+[ 5.080786] mt7921_pci_probe+0x52/0x70 [mt7921e]
+[ 5.080786] local_pci_probe+0x47/0x90
+[ 5.080786] pci_call_probe+0x55/0x190
+[ 5.080786] pci_device_probe+0x84/0x120
+
+Fixes: f965333e491e ("mt76: mt7921: introduce ACPI SAR support")
+Signed-off-by: Aaron Ma <aaron.ma@canonical.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7921/acpi_sar.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/acpi_sar.c b/drivers/net/wireless/mediatek/mt76/mt7921/acpi_sar.c
+index 47e034a9b0037..ed9241d4aa641 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7921/acpi_sar.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7921/acpi_sar.c
+@@ -33,14 +33,17 @@ mt7921_acpi_read(struct mt7921_dev *dev, u8 *method, u8 **tbl, u32 *len)
+ sar_root->package.elements[0].type != ACPI_TYPE_INTEGER) {
+ dev_err(mdev->dev, "sar cnt = %d\n",
+ sar_root->package.count);
++ ret = -EINVAL;
+ goto free;
+ }
+
+ if (!*tbl) {
+ *tbl = devm_kzalloc(mdev->dev, sar_root->package.count,
+ GFP_KERNEL);
+- if (!*tbl)
++ if (!*tbl) {
++ ret = -ENOMEM;
+ goto free;
++ }
+ }
+ if (len)
+ *len = sar_root->package.count;
+@@ -52,9 +55,9 @@ mt7921_acpi_read(struct mt7921_dev *dev, u8 *method, u8 **tbl, u32 *len)
+ break;
+ *(*tbl + i) = (u8)sar_unit->integer.value;
+ }
+-free:
+ ret = (i == sar_root->package.count) ? 0 : -EINVAL;
+
++free:
+ kfree(sar_root);
+
+ return ret;
+--
+2.39.2
+
--- /dev/null
+From f8985c4dcafc77651a2ebfed9f6c5a1b780058a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 31 Dec 2022 17:01:10 +0800
+Subject: wifi: mt76: mt7921: fix invalid remain_on_channel duration
+
+From: Deren Wu <deren.wu@mediatek.com>
+
+[ Upstream commit c36457a8f34d1e0fc55fbbd7b8b2d716af3f6289 ]
+
+round_jiffies_up() may change the duration reported from chip. We should
+take the real timeout for current channel privilege.
+
+Fixes: 034ae28b56f1 ("wifi: mt76: mt7921: introduce remain_on_channel support")
+Signed-off-by: Deren Wu <deren.wu@mediatek.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
+index bd929b5f2504f..7253ce90234ef 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
+@@ -174,7 +174,7 @@ mt7921_mcu_uni_roc_event(struct mt7921_dev *dev, struct sk_buff *skb)
+ wake_up(&dev->phy.roc_wait);
+ duration = le32_to_cpu(grant->max_interval);
+ mod_timer(&dev->phy.roc_timer,
+- round_jiffies_up(jiffies + msecs_to_jiffies(duration)));
++ jiffies + msecs_to_jiffies(duration));
+ }
+
+ static void
+--
+2.39.2
+
--- /dev/null
+From fe2e184b24900546f93b3b2e33e953805d741a60 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Dec 2022 07:01:57 +0800
+Subject: wifi: mt76: mt7921: resource leaks at
+ mt7921_check_offload_capability()
+
+From: Sean Wang <sean.wang@mediatek.com>
+
+[ Upstream commit 47180ecf4541146836c5307c1d5526f8ac6a5a6d ]
+
+Fixed coverity issue with resource leaks at variable "fw" going out of
+scope leaks the storage it points to mt7921_check_offload_capability().
+
+Reported-by: coverity-bot <keescook+coverity-bot@chromium.org>
+Addresses-Coverity-ID: 1527806 ("Resource leaks")
+Fixes: 034ae28b56f1 ("wifi: mt76: mt7921: introduce remain_on_channel support")
+Signed-off-by: Sean Wang <sean.wang@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7921/init.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/init.c b/drivers/net/wireless/mediatek/mt76/mt7921/init.c
+index 542dfd4251290..d4b681d7e1d22 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7921/init.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7921/init.c
+@@ -175,7 +175,7 @@ u8 mt7921_check_offload_capability(struct device *dev, const char *fw_wm)
+
+ if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
+ dev_err(dev, "Invalid firmware\n");
+- return -EINVAL;
++ goto out;
+ }
+
+ data = fw->data;
+@@ -206,6 +206,7 @@ u8 mt7921_check_offload_capability(struct device *dev, const char *fw_wm)
+ data += le16_to_cpu(rel_info->len) + rel_info->pad_len;
+ }
+
++out:
+ release_firmware(fw);
+
+ return features ? features->data : 0;
+--
+2.39.2
+
--- /dev/null
+From c7bf3221764abce5a8aaf68aeb9d2fe8a850be1a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Dec 2022 23:53:37 +0800
+Subject: wifi: mt76: mt7921s: fix slab-out-of-bounds access in sdio host
+
+From: Deren Wu <deren.wu@mediatek.com>
+
+[ Upstream commit aec4cf2ea0797e28f18f8dbe01943a56d987fe56 ]
+
+SDIO may need addtional 511 bytes to align bus operation. If the tailroom
+of this skb is not big enough, we would access invalid memory region.
+For low level operation, increase skb size to keep valid memory access in
+SDIO host.
+
+Error message:
+[69.951] BUG: KASAN: slab-out-of-bounds in sg_copy_buffer+0xe9/0x1a0
+[69.951] Read of size 64 at addr ffff88811c9cf000 by task kworker/u16:7/451
+[69.951] CPU: 4 PID: 451 Comm: kworker/u16:7 Tainted: G W OE 6.1.0-rc5 #1
+[69.951] Workqueue: kvub300c vub300_cmndwork_thread [vub300]
+[69.951] Call Trace:
+[69.951] <TASK>
+[69.952] dump_stack_lvl+0x49/0x63
+[69.952] print_report+0x171/0x4a8
+[69.952] kasan_report+0xb4/0x130
+[69.952] kasan_check_range+0x149/0x1e0
+[69.952] memcpy+0x24/0x70
+[69.952] sg_copy_buffer+0xe9/0x1a0
+[69.952] sg_copy_to_buffer+0x12/0x20
+[69.952] __command_write_data.isra.0+0x23c/0xbf0 [vub300]
+[69.952] vub300_cmndwork_thread+0x17f3/0x58b0 [vub300]
+[69.952] process_one_work+0x7ee/0x1320
+[69.952] worker_thread+0x53c/0x1240
+[69.952] kthread+0x2b8/0x370
+[69.952] ret_from_fork+0x1f/0x30
+[69.952] </TASK>
+
+[69.952] Allocated by task 854:
+[69.952] kasan_save_stack+0x26/0x50
+[69.952] kasan_set_track+0x25/0x30
+[69.952] kasan_save_alloc_info+0x1b/0x30
+[69.952] __kasan_kmalloc+0x87/0xa0
+[69.952] __kmalloc_node_track_caller+0x63/0x150
+[69.952] kmalloc_reserve+0x31/0xd0
+[69.952] __alloc_skb+0xfc/0x2b0
+[69.952] __mt76_mcu_msg_alloc+0xbf/0x230 [mt76]
+[69.952] mt76_mcu_send_and_get_msg+0xab/0x110 [mt76]
+[69.952] __mt76_mcu_send_firmware.cold+0x94/0x15d [mt76]
+[69.952] mt76_connac_mcu_send_ram_firmware+0x415/0x54d [mt76_connac_lib]
+[69.952] mt76_connac2_load_ram.cold+0x118/0x4bc [mt76_connac_lib]
+[69.952] mt7921_run_firmware.cold+0x2e9/0x405 [mt7921_common]
+[69.952] mt7921s_mcu_init+0x45/0x80 [mt7921s]
+[69.953] mt7921_init_work+0xe1/0x2a0 [mt7921_common]
+[69.953] process_one_work+0x7ee/0x1320
+[69.953] worker_thread+0x53c/0x1240
+[69.953] kthread+0x2b8/0x370
+[69.953] ret_from_fork+0x1f/0x30
+[69.953] The buggy address belongs to the object at ffff88811c9ce800
+ which belongs to the cache kmalloc-2k of size 2048
+[69.953] The buggy address is located 0 bytes to the right of
+ 2048-byte region [ffff88811c9ce800, ffff88811c9cf000)
+
+[69.953] Memory state around the buggy address:
+[69.953] ffff88811c9cef00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+[69.953] ffff88811c9cef80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+[69.953] >ffff88811c9cf000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
+[69.953] ^
+[69.953] ffff88811c9cf080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
+[69.953] ffff88811c9cf100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
+
+Fixes: 764dee47e2c1 ("mt76: sdio: move common code in mt76_sdio module")
+Suggested-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Tested-by: YN Chen <YN.Chen@mediatek.com>
+Signed-off-by: Deren Wu <deren.wu@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/sdio_txrx.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/sdio_txrx.c b/drivers/net/wireless/mediatek/mt76/sdio_txrx.c
+index bfc4de50a4d23..ddd8c0cc744df 100644
+--- a/drivers/net/wireless/mediatek/mt76/sdio_txrx.c
++++ b/drivers/net/wireless/mediatek/mt76/sdio_txrx.c
+@@ -254,6 +254,10 @@ static int mt76s_tx_run_queue(struct mt76_dev *dev, struct mt76_queue *q)
+
+ if (!test_bit(MT76_STATE_MCU_RUNNING, &dev->phy.state)) {
+ __skb_put_zero(e->skb, 4);
++ err = __skb_grow(e->skb, roundup(e->skb->len,
++ sdio->func->cur_blksize));
++ if (err)
++ return err;
+ err = __mt76s_xmit_queue(dev, e->skb->data,
+ e->skb->len);
+ if (err)
+--
+2.39.2
+
--- /dev/null
+From 0f61c8efd3cec99981be8c50a0d454d9c2c95428 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 4 Dec 2022 05:33:18 +0800
+Subject: wifi: mt76: mt7996: check return value before accessing
+ free_block_num
+
+From: Ryder Lee <ryder.lee@mediatek.com>
+
+[ Upstream commit 783ef7da7a53c7ab98471f47fbabab6cf6f45c8f ]
+
+Check return value of mt7996_mcu_get_eeprom_free_block() first before
+accessing free_block_num.
+
+Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
+Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/mediatek/mt76/mt7996/eeprom.c | 18 ++++++++++++------
+ .../net/wireless/mediatek/mt76/mt7996/mcu.c | 5 +++--
+ 2 files changed, 15 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/eeprom.c b/drivers/net/wireless/mediatek/mt76/mt7996/eeprom.c
+index b9f62bedbc485..5d8e0353627e1 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/eeprom.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/eeprom.c
+@@ -65,17 +65,23 @@ static int mt7996_eeprom_load(struct mt7996_dev *dev)
+ } else {
+ u8 free_block_num;
+ u32 block_num, i;
++ u32 eeprom_blk_size = MT7996_EEPROM_BLOCK_SIZE;
+
+- /* TODO: check free block event */
+- mt7996_mcu_get_eeprom_free_block(dev, &free_block_num);
+- /* efuse info not enough */
++ ret = mt7996_mcu_get_eeprom_free_block(dev, &free_block_num);
++ if (ret < 0)
++ return ret;
++
++ /* efuse info isn't enough */
+ if (free_block_num >= 59)
+ return -EINVAL;
+
+ /* read eeprom data from efuse */
+- block_num = DIV_ROUND_UP(MT7996_EEPROM_SIZE, MT7996_EEPROM_BLOCK_SIZE);
+- for (i = 0; i < block_num; i++)
+- mt7996_mcu_get_eeprom(dev, i * MT7996_EEPROM_BLOCK_SIZE);
++ block_num = DIV_ROUND_UP(MT7996_EEPROM_SIZE, eeprom_blk_size);
++ for (i = 0; i < block_num; i++) {
++ ret = mt7996_mcu_get_eeprom(dev, i * eeprom_blk_size);
++ if (ret < 0)
++ return ret;
++ }
+ }
+
+ return mt7996_check_eeprom(dev);
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
+index efb245c8ac840..da72684e43083 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
+@@ -2927,8 +2927,9 @@ int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset)
+ bool valid;
+ int ret;
+
+- ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_WM_UNI_CMD_QUERY(EFUSE_CTRL), &req,
+- sizeof(req), true, &skb);
++ ret = mt76_mcu_send_and_get_msg(&dev->mt76,
++ MCU_WM_UNI_CMD_QUERY(EFUSE_CTRL),
++ &req, sizeof(req), true, &skb);
+ if (ret)
+ return ret;
+
+--
+2.39.2
+
--- /dev/null
+From 084920c30bc3c3a3119fc3cae2e2bef56aabb30a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 4 Dec 2022 15:18:15 +0800
+Subject: wifi: mt76: mt7996: drop always true condition of __mt7996_reg_addr()
+
+From: Ryder Lee <ryder.lee@mediatek.com>
+
+[ Upstream commit ef1ea24cb0ecfd42c1ff266d92613163792aec77 ]
+
+addr <= MT_CBTOP2_PHY_END(0xffffffff) is always true (<= u32max),
+so drop it.
+
+Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
+Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7996/mmio.c | 2 +-
+ drivers/net/wireless/mediatek/mt76/mt7996/regs.h | 1 -
+ 2 files changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mmio.c b/drivers/net/wireless/mediatek/mt76/mt7996/mmio.c
+index 521769eb6b0e9..60781d046216a 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/mmio.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mmio.c
+@@ -149,7 +149,7 @@ static u32 __mt7996_reg_addr(struct mt7996_dev *dev, u32 addr)
+
+ if (dev_is_pci(dev->mt76.dev) &&
+ ((addr >= MT_CBTOP1_PHY_START && addr <= MT_CBTOP1_PHY_END) ||
+- (addr >= MT_CBTOP2_PHY_START && addr <= MT_CBTOP2_PHY_END)))
++ addr >= MT_CBTOP2_PHY_START))
+ return mt7996_reg_map_l1(dev, addr);
+
+ /* CONN_INFRA: covert to phyiscal addr and use layer 1 remap */
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/regs.h b/drivers/net/wireless/mediatek/mt76/mt7996/regs.h
+index 794f61b93a466..42980b97b4d41 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/regs.h
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/regs.h
+@@ -463,7 +463,6 @@ enum base_rev {
+ #define MT_CBTOP1_PHY_START 0x70000000
+ #define MT_CBTOP1_PHY_END 0x77ffffff
+ #define MT_CBTOP2_PHY_START 0xf0000000
+-#define MT_CBTOP2_PHY_END 0xffffffff
+ #define MT_INFRA_MCU_START 0x7c000000
+ #define MT_INFRA_MCU_END 0x7c3fffff
+
+--
+2.39.2
+
--- /dev/null
+From 7efabee87eda123798ff1d0e4a1cc1b865335068 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Dec 2022 18:13:45 +0800
+Subject: wifi: mt76: mt7996: fix chainmask calculation in mt7996_set_antenna()
+
+From: Shayne Chen <shayne.chen@mediatek.com>
+
+[ Upstream commit eb1fdb9f5a2280de6820624cd02e0863babab683 ]
+
+Fix per-band chainmask when restoring from the dev chainmask.
+
+Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
+Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7996/main.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/main.c b/drivers/net/wireless/mediatek/mt76/mt7996/main.c
+index 4421cd54311b1..c423b052e4f4c 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/main.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/main.c
+@@ -880,7 +880,10 @@ mt7996_set_antenna(struct ieee80211_hw *hw, u32 tx_ant, u32 rx_ant)
+ phy->mt76->antenna_mask = tx_ant;
+
+ /* restore to the origin chainmask which might have auxiliary path */
+- if (hweight8(tx_ant) == max_nss)
++ if (hweight8(tx_ant) == max_nss && band_idx < MT_BAND2)
++ phy->mt76->chainmask = ((dev->chainmask >> shift) &
++ (BIT(dev->chainshift[band_idx + 1] - shift) - 1)) << shift;
++ else if (hweight8(tx_ant) == max_nss)
+ phy->mt76->chainmask = (dev->chainmask >> shift) << shift;
+ else
+ phy->mt76->chainmask = tx_ant << shift;
+--
+2.39.2
+
--- /dev/null
+From 7283686f8f661dc0de891d861fd8f37c5dec0488 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 4 Dec 2022 23:01:37 +0100
+Subject: wifi: mt76: mt7996: fix endianness warning in mt7996_mcu_sta_he_tlv
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+[ Upstream commit 54ccb836ffb28eacba51b674cbe94cb5613f8441 ]
+
+Fix the following sparse warnings in mt7996_mcu_sta_he_tlv routine:
+
+warning: incorrect type in assignment (different base types)
+ expected unsigned char
+ got restricted __le16 [usertype]
+warning: incorrect type in assignment (different base types)
+ expected unsigned char
+ got restricted __le16 [usertype]
+
+Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
+index da72684e43083..a88fc7680b1a9 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
+@@ -909,8 +909,8 @@ mt7996_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
+ he = (struct sta_rec_he_v2 *)tlv;
+ for (i = 0; i < 11; i++) {
+ if (i < 6)
+- he->he_mac_cap[i] = cpu_to_le16(elem->mac_cap_info[i]);
+- he->he_phy_cap[i] = cpu_to_le16(elem->phy_cap_info[i]);
++ he->he_mac_cap[i] = elem->mac_cap_info[i];
++ he->he_phy_cap[i] = elem->phy_cap_info[i];
+ }
+
+ mcs_map = sta->deflink.he_cap.he_mcs_nss_supp;
+--
+2.39.2
+
--- /dev/null
+From 1e14a79ee1df5870106dde126a764e3666a87be9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 3 Dec 2022 11:22:23 +0800
+Subject: wifi: mt76: mt7996: fix insecure data handling of
+ mt7996_mcu_ie_countdown()
+
+From: Ryder Lee <ryder.lee@mediatek.com>
+
+[ Upstream commit 5202b983f9894d31110e49c4ec6b57955b5eaa1a ]
+
+Coverity message:
+using tainted "hdr->band" variable as an index into an array "(*dev).mt76.phys".
+
+Reported-by: coverity-bot <keescook+coverity-bot@chromium.org>
+Addresses-Coverity-ID: 1527797 ("Insecure data handling")
+Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
+Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
+index 04e1d10bbd21e..a90b7ca2df63c 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
+@@ -412,6 +412,9 @@ mt7996_mcu_ie_countdown(struct mt7996_dev *dev, struct sk_buff *skb)
+ struct header *hdr = (struct header *)data;
+ struct tlv *tlv = (struct tlv *)(data + 4);
+
++ if (hdr->band >= ARRAY_SIZE(dev->mt76.phys))
++ return;
++
+ if (hdr->band && dev->mt76.phys[hdr->band])
+ mphy = dev->mt76.phys[hdr->band];
+
+--
+2.39.2
+
--- /dev/null
+From eb7dd32b311b45a3c0f1090135f21a81e1987496 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 3 Dec 2022 11:22:24 +0800
+Subject: wifi: mt76: mt7996: fix insecure data handling of
+ mt7996_mcu_rx_radar_detected()
+
+From: Ryder Lee <ryder.lee@mediatek.com>
+
+[ Upstream commit f37c6e5c75029443bc72c45acf92b2f2de2945be ]
+
+Coverity message:
+using tainted "r->band_idx" variable as an index into an array "(*dev).mt76.phys".
+
+Reported-by: coverity-bot <keescook+coverity-bot@chromium.org>
+Addresses-Coverity-ID: 1527812 ("Insecure data handling")
+Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
+Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
+index a90b7ca2df63c..efb245c8ac840 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
+@@ -335,6 +335,9 @@ mt7996_mcu_rx_radar_detected(struct mt7996_dev *dev, struct sk_buff *skb)
+
+ r = (struct mt7996_mcu_rdd_report *)skb->data;
+
++ if (r->band_idx >= ARRAY_SIZE(dev->mt76.phys))
++ return;
++
+ mphy = dev->mt76.phys[r->band_idx];
+ if (!mphy)
+ return;
+--
+2.39.2
+
--- /dev/null
+From 971979ec27061a007a0babafc75d9bc7163b0aa8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 3 Dec 2022 11:22:25 +0800
+Subject: wifi: mt76: mt7996: fix integer handling issue of
+ mt7996_rf_regval_set()
+
+From: Ryder Lee <ryder.lee@mediatek.com>
+
+[ Upstream commit aab169ad3a7aa8678aed90d7fdbc243e3d4b32a6 ]
+
+This code is supposed to set a u32 value, but casting will not work on
+big endian systems.
+
+Reported-by: coverity-bot <keescook+coverity-bot@chromium.org>
+Addresses-Coverity-ID: 1527816 ("Integer handling issues")
+Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
+Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7996/debugfs.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/debugfs.c b/drivers/net/wireless/mediatek/mt76/mt7996/debugfs.c
+index 2e4a8909b9e80..99b23aef53a50 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/debugfs.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/debugfs.c
+@@ -653,8 +653,9 @@ static int
+ mt7996_rf_regval_set(void *data, u64 val)
+ {
+ struct mt7996_dev *dev = data;
++ u32 val32 = val;
+
+- return mt7996_mcu_rf_regval(dev, dev->mt76.debugfs_reg, (u32 *)&val, true);
++ return mt7996_mcu_rf_regval(dev, dev->mt76.debugfs_reg, &val32, true);
+ }
+
+ DEFINE_DEBUGFS_ATTRIBUTE(fops_rf_regval, mt7996_rf_regval_get,
+--
+2.39.2
+
--- /dev/null
+From 0162aa9472e2da89e69332a5a5bf2e0e9843deb8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 1 Jan 2023 12:43:52 +0100
+Subject: wifi: mt76: mt7996: fix memory leak in mt7996_mcu_exit
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+[ Upstream commit da5b4d93e141b52c5a71d0c41a042d1bcaf70d2e ]
+
+Always purge mcu skb queues in mt7996_mcu_exit routine even if
+mt7996_firmware_state fails.
+
+Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
+index d781c6e0f33ac..d593ed9e3f73c 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
+@@ -2460,13 +2460,14 @@ void mt7996_mcu_exit(struct mt7996_dev *dev)
+ __mt76_mcu_restart(&dev->mt76);
+ if (mt7996_firmware_state(dev, false)) {
+ dev_err(dev->mt76.dev, "Failed to exit mcu\n");
+- return;
++ goto out;
+ }
+
+ mt76_wr(dev, MT_TOP_LPCR_HOST_BAND(0), MT_TOP_LPCR_HOST_FW_OWN);
+ if (dev->hif2)
+ mt76_wr(dev, MT_TOP_LPCR_HOST_BAND(1),
+ MT_TOP_LPCR_HOST_FW_OWN);
++out:
+ skb_queue_purge(&dev->mt76.mcu.res_q);
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 8330e40807f6533fd2d9c8ab409f8660e56d57e8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Dec 2022 15:30:04 +0800
+Subject: wifi: mt76: mt7996: fix unintended sign extension of
+ mt7996_hw_queue_read()
+
+From: Ryder Lee <ryder.lee@mediatek.com>
+
+[ Upstream commit 063cca0252b46970e7e9ca423d5e930be3179aa1 ]
+
+In the expression "map[i].qid << 24" starts as u8, but is promoted to
+"signed int", then sign-extended to type "unsigned long", which is not
+intended. Cast to u32 to avoid the sign extension.
+
+Reported-by: coverity-bot <keescook+coverity-bot@chromium.org>
+Addresses-Coverity-ID: 1527813 ("Integer handling issues")
+Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
+Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7996/debugfs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/debugfs.c b/drivers/net/wireless/mediatek/mt76/mt7996/debugfs.c
+index 99b23aef53a50..3d4fbbbcc2062 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/debugfs.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/debugfs.c
+@@ -457,7 +457,7 @@ mt7996_hw_queue_read(struct seq_file *s, u32 size,
+ if (val & BIT(map[i].index))
+ continue;
+
+- ctrl = BIT(31) | (map[i].pid << 10) | (map[i].qid << 24);
++ ctrl = BIT(31) | (map[i].pid << 10) | ((u32)map[i].qid << 24);
+ mt76_wr(dev, MT_FL_Q0_CTRL, ctrl);
+
+ head = mt76_get_field(dev, MT_FL_Q2_CTRL,
+--
+2.39.2
+
--- /dev/null
+From 15ec08b57ea3d26076cd8dcc71c33f244d73b368 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Jan 2023 01:16:07 +0100
+Subject: wifi: mt76: mt7996: rely on mt76_connac2_mac_tx_rate_val
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+[ Upstream commit 0b8e2d69467f78a7c9d87b452220e87012435e33 ]
+
+In order to fix a possible NULL pointer dereference in
+mt7996_mac_write_txwi() of vif pointer, export
+mt76_connac2_mac_tx_rate_val utility routine and reuse it
+in mt7996 driver.
+
+Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/mediatek/mt76/mt76_connac.h | 3 ++
+ .../wireless/mediatek/mt76/mt76_connac_mac.c | 7 +--
+ .../net/wireless/mediatek/mt76/mt7996/mac.c | 48 +------------------
+ 3 files changed, 9 insertions(+), 49 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt76_connac.h b/drivers/net/wireless/mediatek/mt76/mt76_connac.h
+index 8ba883b03e500..2ee9a3c8e25c4 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt76_connac.h
++++ b/drivers/net/wireless/mediatek/mt76/mt76_connac.h
+@@ -370,6 +370,9 @@ void mt76_connac2_mac_write_txwi(struct mt76_dev *dev, __le32 *txwi,
+ struct sk_buff *skb, struct mt76_wcid *wcid,
+ struct ieee80211_key_conf *key, int pid,
+ enum mt76_txq_id qid, u32 changed);
++u16 mt76_connac2_mac_tx_rate_val(struct mt76_phy *mphy,
++ struct ieee80211_vif *vif,
++ bool beacon, bool mcast);
+ bool mt76_connac2_mac_fill_txs(struct mt76_dev *dev, struct mt76_wcid *wcid,
+ __le32 *txs_data);
+ bool mt76_connac2_mac_add_txs_skb(struct mt76_dev *dev, struct mt76_wcid *wcid,
+diff --git a/drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c b/drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c
+index c8d0c84e688b8..aed4ee95fb2ec 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c
++++ b/drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c
+@@ -267,9 +267,9 @@ int mt76_connac_init_tx_queues(struct mt76_phy *phy, int idx, int n_desc,
+ }
+ EXPORT_SYMBOL_GPL(mt76_connac_init_tx_queues);
+
+-static u16
+-mt76_connac2_mac_tx_rate_val(struct mt76_phy *mphy, struct ieee80211_vif *vif,
+- bool beacon, bool mcast)
++u16 mt76_connac2_mac_tx_rate_val(struct mt76_phy *mphy,
++ struct ieee80211_vif *vif,
++ bool beacon, bool mcast)
+ {
+ u8 mode = 0, band = mphy->chandef.chan->band;
+ int rateidx = 0, mcast_rate;
+@@ -319,6 +319,7 @@ mt76_connac2_mac_tx_rate_val(struct mt76_phy *mphy, struct ieee80211_vif *vif,
+ return FIELD_PREP(MT_TX_RATE_IDX, rateidx) |
+ FIELD_PREP(MT_TX_RATE_MODE, mode);
+ }
++EXPORT_SYMBOL_GPL(mt76_connac2_mac_tx_rate_val);
+
+ static void
+ mt76_connac2_mac_write_txwi_8023(__le32 *txwi, struct sk_buff *skb,
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
+index 96ced4c039ce1..0eb9e4d73f2c1 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
+@@ -959,51 +959,6 @@ mt7996_mac_write_txwi_80211(struct mt7996_dev *dev, __le32 *txwi,
+ }
+ }
+
+-static u16
+-mt7996_mac_tx_rate_val(struct mt76_phy *mphy, struct ieee80211_vif *vif,
+- bool beacon, bool mcast)
+-{
+- u8 mode = 0, band = mphy->chandef.chan->band;
+- int rateidx = 0, mcast_rate;
+-
+- if (beacon) {
+- struct cfg80211_bitrate_mask *mask;
+-
+- mask = &vif->bss_conf.beacon_tx_rate;
+- if (hweight16(mask->control[band].he_mcs[0]) == 1) {
+- rateidx = ffs(mask->control[band].he_mcs[0]) - 1;
+- mode = MT_PHY_TYPE_HE_SU;
+- goto out;
+- } else if (hweight16(mask->control[band].vht_mcs[0]) == 1) {
+- rateidx = ffs(mask->control[band].vht_mcs[0]) - 1;
+- mode = MT_PHY_TYPE_VHT;
+- goto out;
+- } else if (hweight8(mask->control[band].ht_mcs[0]) == 1) {
+- rateidx = ffs(mask->control[band].ht_mcs[0]) - 1;
+- mode = MT_PHY_TYPE_HT;
+- goto out;
+- } else if (hweight32(mask->control[band].legacy) == 1) {
+- rateidx = ffs(mask->control[band].legacy) - 1;
+- goto legacy;
+- }
+- }
+-
+- mcast_rate = vif->bss_conf.mcast_rate[band];
+- if (mcast && mcast_rate > 0)
+- rateidx = mcast_rate - 1;
+- else
+- rateidx = ffs(vif->bss_conf.basic_rates) - 1;
+-
+-legacy:
+- rateidx = mt76_calculate_default_rate(mphy, rateidx);
+- mode = rateidx >> 8;
+- rateidx &= GENMASK(7, 0);
+-
+-out:
+- return FIELD_PREP(MT_TX_RATE_IDX, rateidx) |
+- FIELD_PREP(MT_TX_RATE_MODE, mode);
+-}
+-
+ void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi,
+ struct sk_buff *skb, struct mt76_wcid *wcid, int pid,
+ struct ieee80211_key_conf *key, u32 changed)
+@@ -1091,7 +1046,8 @@ void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi,
+ /* Fixed rata is available just for 802.11 txd */
+ struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+ bool multicast = is_multicast_ether_addr(hdr->addr1);
+- u16 rate = mt7996_mac_tx_rate_val(mphy, vif, beacon, multicast);
++ u16 rate = mt76_connac2_mac_tx_rate_val(mphy, vif, beacon,
++ multicast);
+
+ /* fix to bw 20 */
+ val = MT_TXD6_FIXED_BW |
+--
+2.39.2
+
--- /dev/null
+From 73b5004c7effdf80ed09136bcaf03c0eefd7698b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Dec 2022 18:13:46 +0800
+Subject: wifi: mt76: mt7996: update register for CFEND_RATE
+
+From: Shayne Chen <shayne.chen@mediatek.com>
+
+[ Upstream commit 793445cf812506375cbe4c59d0fb9f648f716e88 ]
+
+In newer chipsets, CFEND_RATE setting has been moved to different hw
+module.
+
+Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
+Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7996/mac.c | 2 +-
+ drivers/net/wireless/mediatek/mt76/mt7996/mmio.c | 1 +
+ drivers/net/wireless/mediatek/mt76/mt7996/regs.h | 15 ++++++++-------
+ 3 files changed, 10 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
+index 0b3e28748e76b..ce4242f90e9f9 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
+@@ -1690,7 +1690,7 @@ void mt7996_mac_set_timing(struct mt7996_phy *phy)
+ else
+ val = MT7996_CFEND_RATE_11B;
+
+- mt76_rmw_field(dev, MT_AGG_ACR0(band_idx), MT_AGG_ACR_CFEND_RATE, val);
++ mt76_rmw_field(dev, MT_RATE_HRCR0(band_idx), MT_RATE_HRCR0_CFEND_RATE, val);
+ mt76_clear(dev, MT_ARB_SCR(band_idx),
+ MT_ARB_SCR_TX_DISABLE | MT_ARB_SCR_RX_DISABLE);
+ }
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mmio.c b/drivers/net/wireless/mediatek/mt76/mt7996/mmio.c
+index 60781d046216a..d8a2c1a744b25 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/mmio.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mmio.c
+@@ -21,6 +21,7 @@ static const struct __base mt7996_reg_base[] = {
+ [WF_ETBF_BASE] = { { 0x820ea000, 0x820fa000, 0x830ea000 } },
+ [WF_LPON_BASE] = { { 0x820eb000, 0x820fb000, 0x830eb000 } },
+ [WF_MIB_BASE] = { { 0x820ed000, 0x820fd000, 0x830ed000 } },
++ [WF_RATE_BASE] = { { 0x820ee000, 0x820fe000, 0x830ee000 } },
+ };
+
+ static const struct __map mt7996_reg_map[] = {
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/regs.h b/drivers/net/wireless/mediatek/mt76/mt7996/regs.h
+index 42980b97b4d41..7a28cae34e34b 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/regs.h
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/regs.h
+@@ -33,6 +33,7 @@ enum base_rev {
+ WF_ETBF_BASE,
+ WF_LPON_BASE,
+ WF_MIB_BASE,
++ WF_RATE_BASE,
+ __MT_REG_BASE_MAX,
+ };
+
+@@ -235,13 +236,6 @@ enum base_rev {
+ FIELD_PREP(MT_WTBL_LMAC_ID, _id) | \
+ FIELD_PREP(MT_WTBL_LMAC_DW, _dw))
+
+-/* AGG: band 0(0x820e2000), band 1(0x820f2000), band 2(0x830e2000) */
+-#define MT_WF_AGG_BASE(_band) __BASE(WF_AGG_BASE, (_band))
+-#define MT_WF_AGG(_band, ofs) (MT_WF_AGG_BASE(_band) + (ofs))
+-
+-#define MT_AGG_ACR0(_band) MT_WF_AGG(_band, 0x054)
+-#define MT_AGG_ACR_CFEND_RATE GENMASK(13, 0)
+-
+ /* ARB: band 0(0x820e3000), band 1(0x820f3000), band 2(0x830e3000) */
+ #define MT_WF_ARB_BASE(_band) __BASE(WF_ARB_BASE, (_band))
+ #define MT_WF_ARB(_band, ofs) (MT_WF_ARB_BASE(_band) + (ofs))
+@@ -300,6 +294,13 @@ enum base_rev {
+ #define MT_WF_RMAC_RSVD0(_band) MT_WF_RMAC(_band, 0x03e0)
+ #define MT_WF_RMAC_RSVD0_EIFS_CLR BIT(21)
+
++/* RATE: band 0(0x820ee000), band 1(0x820fe000), band 2(0x830ee000) */
++#define MT_WF_RATE_BASE(_band) __BASE(WF_RATE_BASE, (_band))
++#define MT_WF_RATE(_band, ofs) (MT_WF_RATE_BASE(_band) + (ofs))
++
++#define MT_RATE_HRCR0(_band) MT_WF_RATE(_band, 0x050)
++#define MT_RATE_HRCR0_CFEND_RATE GENMASK(14, 0)
++
+ /* WFDMA0 */
+ #define MT_WFDMA0_BASE 0xd4000
+ #define MT_WFDMA0(ofs) (MT_WFDMA0_BASE + (ofs))
+--
+2.39.2
+
--- /dev/null
+From 421b60b670b11a1671a495c8f5f1178b12a39720 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Dec 2022 18:29:06 +0900
+Subject: wifi: mt7601u: fix an integer underflow
+
+From: Jisoo Jang <jisoo.jang@yonsei.ac.kr>
+
+[ Upstream commit 803f3176c5df3b5582c27ea690f204abb60b19b9 ]
+
+Fix an integer underflow that leads to a null pointer dereference in
+'mt7601u_rx_skb_from_seg()'. The variable 'dma_len' in the URB packet
+could be manipulated, which could trigger an integer underflow of
+'seg_len' in 'mt7601u_rx_process_seg()'. This underflow subsequently
+causes the 'bad_frame' checks in 'mt7601u_rx_skb_from_seg()' to be
+bypassed, eventually leading to a dereference of the pointer 'p', which
+is a null pointer.
+
+Ensure that 'dma_len' is greater than 'min_seg_len'.
+
+Found by a modified version of syzkaller.
+
+KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
+CPU: 0 PID: 12 Comm: ksoftirqd/0 Tainted: G W O 5.14.0+
+#139
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
+rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014
+RIP: 0010:skb_add_rx_frag+0x143/0x370
+Code: e2 07 83 c2 03 38 ca 7c 08 84 c9 0f 85 86 01 00 00 4c 8d 7d 08 44
+89 68 08 48 b8 00 00 00 00 00 fc ff df 4c 89 fa 48 c1 ea 03 <80> 3c 02
+00 0f 85 cd 01 00 00 48 8b 45 08 a8 01 0f 85 3d 01 00 00
+RSP: 0018:ffffc900000cfc90 EFLAGS: 00010202
+RAX: dffffc0000000000 RBX: ffff888115520dc0 RCX: 0000000000000000
+RDX: 0000000000000001 RSI: ffff8881118430c0 RDI: ffff8881118430f8
+RBP: 0000000000000000 R08: 0000000000000e09 R09: 0000000000000010
+R10: ffff888111843017 R11: ffffed1022308602 R12: 0000000000000000
+R13: 0000000000000e09 R14: 0000000000000010 R15: 0000000000000008
+FS: 0000000000000000(0000) GS:ffff88811a800000(0000)
+knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 000000004035af40 CR3: 00000001157f2000 CR4: 0000000000750ef0
+DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+PKRU: 55555554
+Call Trace:
+ mt7601u_rx_tasklet+0xc73/0x1270
+ ? mt7601u_submit_rx_buf.isra.0+0x510/0x510
+ ? tasklet_action_common.isra.0+0x79/0x2f0
+ tasklet_action_common.isra.0+0x206/0x2f0
+ __do_softirq+0x1b5/0x880
+ ? tasklet_unlock+0x30/0x30
+ run_ksoftirqd+0x26/0x50
+ smpboot_thread_fn+0x34f/0x7d0
+ ? smpboot_register_percpu_thread+0x370/0x370
+ kthread+0x3a1/0x480
+ ? set_kthread_struct+0x120/0x120
+ ret_from_fork+0x1f/0x30
+Modules linked in: 88XXau(O) 88x2bu(O)
+---[ end trace 57f34f93b4da0f9b ]---
+RIP: 0010:skb_add_rx_frag+0x143/0x370
+Code: e2 07 83 c2 03 38 ca 7c 08 84 c9 0f 85 86 01 00 00 4c 8d 7d 08 44
+89 68 08 48 b8 00 00 00 00 00 fc ff df 4c 89 fa 48 c1 ea 03 <80> 3c 02
+00 0f 85 cd 01 00 00 48 8b 45 08 a8 01 0f 85 3d 01 00 00
+RSP: 0018:ffffc900000cfc90 EFLAGS: 00010202
+RAX: dffffc0000000000 RBX: ffff888115520dc0 RCX: 0000000000000000
+RDX: 0000000000000001 RSI: ffff8881118430c0 RDI: ffff8881118430f8
+RBP: 0000000000000000 R08: 0000000000000e09 R09: 0000000000000010
+R10: ffff888111843017 R11: ffffed1022308602 R12: 0000000000000000
+R13: 0000000000000e09 R14: 0000000000000010 R15: 0000000000000008
+FS: 0000000000000000(0000) GS:ffff88811a800000(0000)
+knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 000000004035af40 CR3: 00000001157f2000 CR4: 0000000000750ef0
+DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+PKRU: 55555554
+
+Signed-off-by: Jisoo Jang <jisoo.jang@yonsei.ac.kr>
+Acked-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20221229092906.2328282-1-jisoo.jang@yonsei.ac.kr
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt7601u/dma.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt7601u/dma.c b/drivers/net/wireless/mediatek/mt7601u/dma.c
+index 457147394edc4..773a1cc2f8520 100644
+--- a/drivers/net/wireless/mediatek/mt7601u/dma.c
++++ b/drivers/net/wireless/mediatek/mt7601u/dma.c
+@@ -123,7 +123,8 @@ static u16 mt7601u_rx_next_seg_len(u8 *data, u32 data_len)
+ if (data_len < min_seg_len ||
+ WARN_ON_ONCE(!dma_len) ||
+ WARN_ON_ONCE(dma_len + MT_DMA_HDRS > data_len) ||
+- WARN_ON_ONCE(dma_len & 0x3))
++ WARN_ON_ONCE(dma_len & 0x3) ||
++ WARN_ON_ONCE(dma_len < min_seg_len))
+ return 0;
+
+ return MT_DMA_HDRS + dma_len;
+--
+2.39.2
+
--- /dev/null
+From af3ea534228949950881fc8d2589a9ce76d4a5ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Feb 2023 17:41:33 +0300
+Subject: wifi: mwifiex: fix loop iterator in mwifiex_update_ampdu_txwinsize()
+
+From: Dan Carpenter <error27@gmail.com>
+
+[ Upstream commit 3cfb7df24cee0f5fdc4cc5d3176cab9aadfcb430 ]
+
+This code re-uses "i" to be the iterator for both the inside and outside
+loops. It means the outside loop will exit earlier than intended.
+
+Fixes: d219b7eb3792 ("mwifiex: handle BT coex event to adjust Rx BA window size")
+Signed-off-by: Dan Carpenter <error27@gmail.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/Y+ERnaDaZD7RtLvX@kili
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/marvell/mwifiex/11n.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/marvell/mwifiex/11n.c b/drivers/net/wireless/marvell/mwifiex/11n.c
+index 4af57e6d43932..90e4011008981 100644
+--- a/drivers/net/wireless/marvell/mwifiex/11n.c
++++ b/drivers/net/wireless/marvell/mwifiex/11n.c
+@@ -878,7 +878,7 @@ mwifiex_send_delba_txbastream_tbl(struct mwifiex_private *priv, u8 tid)
+ */
+ void mwifiex_update_ampdu_txwinsize(struct mwifiex_adapter *adapter)
+ {
+- u8 i;
++ u8 i, j;
+ u32 tx_win_size;
+ struct mwifiex_private *priv;
+
+@@ -909,8 +909,8 @@ void mwifiex_update_ampdu_txwinsize(struct mwifiex_adapter *adapter)
+ if (tx_win_size != priv->add_ba_param.tx_win_size) {
+ if (!priv->media_connected)
+ continue;
+- for (i = 0; i < MAX_NUM_TID; i++)
+- mwifiex_send_delba_txbastream_tbl(priv, i);
++ for (j = 0; j < MAX_NUM_TID; j++)
++ mwifiex_send_delba_txbastream_tbl(priv, j);
+ }
+ }
+ }
+--
+2.39.2
+
--- /dev/null
+From 3ca4449b14f26fcd61f7dc37666b3230e7468439 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Dec 2022 16:33:06 +0300
+Subject: wifi: orinoco: check return value of hermes_write_wordrec()
+
+From: Alexey Kodanev <aleksei.kodanev@bell-sw.com>
+
+[ Upstream commit 1e346cbb096a5351a637ec1992beffbf330547f0 ]
+
+There is currently no return check for writing an authentication
+type (HERMES_AUTH_SHARED_KEY or HERMES_AUTH_OPEN). It looks like
+it was accidentally skipped.
+
+This patch adds a return check similar to the other checks in
+__orinoco_hw_setup_enc() for hermes_write_wordrec().
+
+Detected using the static analysis tool - Svace.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Alexey Kodanev <aleksei.kodanev@bell-sw.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20221227133306.201356-1-aleksei.kodanev@bell-sw.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intersil/orinoco/hw.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/wireless/intersil/orinoco/hw.c b/drivers/net/wireless/intersil/orinoco/hw.c
+index 0aea35c9c11c7..4fcca08e50de2 100644
+--- a/drivers/net/wireless/intersil/orinoco/hw.c
++++ b/drivers/net/wireless/intersil/orinoco/hw.c
+@@ -931,6 +931,8 @@ int __orinoco_hw_setup_enc(struct orinoco_private *priv)
+ err = hermes_write_wordrec(hw, USER_BAP,
+ HERMES_RID_CNFAUTHENTICATION_AGERE,
+ auth_flag);
++ if (err)
++ return err;
+ }
+ err = hermes_write_wordrec(hw, USER_BAP,
+ HERMES_RID_CNFWEPENABLED_AGERE,
+--
+2.39.2
+
--- /dev/null
+From c1f5516aa0dc11d31a7b4fc3086afac71e4414c2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Dec 2022 06:14:41 +0000
+Subject: wifi: rsi: Fix memory leak in rsi_coex_attach()
+
+From: Yuan Can <yuancan@huawei.com>
+
+[ Upstream commit 956fb851a6e19da5ab491e19c1bc323bb2c2cf6f ]
+
+The coex_cb needs to be freed when rsi_create_kthread() failed in
+rsi_coex_attach().
+
+Fixes: 2108df3c4b18 ("rsi: add coex support")
+Signed-off-by: Yuan Can <yuancan@huawei.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20221205061441.114632-1-yuancan@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/rsi/rsi_91x_coex.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/wireless/rsi/rsi_91x_coex.c b/drivers/net/wireless/rsi/rsi_91x_coex.c
+index 8a3d86897ea8e..45ac9371f2621 100644
+--- a/drivers/net/wireless/rsi/rsi_91x_coex.c
++++ b/drivers/net/wireless/rsi/rsi_91x_coex.c
+@@ -160,6 +160,7 @@ int rsi_coex_attach(struct rsi_common *common)
+ rsi_coex_scheduler_thread,
+ "Coex-Tx-Thread")) {
+ rsi_dbg(ERR_ZONE, "%s: Unable to init tx thrd\n", __func__);
++ kfree(coex_cb);
+ return -EINVAL;
+ }
+ return 0;
+--
+2.39.2
+
--- /dev/null
+From 9b0cc807e16ebf45cc94089ef9e30206e3c2c5e6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Dec 2022 22:35:17 +0800
+Subject: wifi: rtl8xxxu: don't call dev_kfree_skb() under spin_lock_irqsave()
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit 4c2005ac87685907b3719b4f40215b578efd27c4 ]
+
+It is not allowed to call kfree_skb() or consume_skb() from hardware
+interrupt context or with hardware interrupts being disabled.
+
+It should use dev_kfree_skb_irq() or dev_consume_skb_irq() instead.
+The difference between them is free reason, dev_kfree_skb_irq() means
+the SKB is dropped in error and dev_consume_skb_irq() means the SKB
+is consumed in normal.
+
+In this case, dev_kfree_skb() is called to free and drop the SKB when
+it's shutdown, so replace it with dev_kfree_skb_irq(). Compile tested
+only.
+
+Fixes: 26f1fad29ad9 ("New driver: rtl8xxxu (mac80211)")
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Reviewed-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20221208143517.2383424-1-yangyingliang@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
+index 799b03ec19806..c8b82c5810111 100644
+--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
+@@ -5276,7 +5276,7 @@ static void rtl8xxxu_queue_rx_urb(struct rtl8xxxu_priv *priv,
+ pending = priv->rx_urb_pending_count;
+ } else {
+ skb = (struct sk_buff *)rx_urb->urb.context;
+- dev_kfree_skb(skb);
++ dev_kfree_skb_irq(skb);
+ usb_free_urb(&rx_urb->urb);
+ }
+
+--
+2.39.2
+
--- /dev/null
+From abb1ca627d0d07e887c9894008f9da254304cb67 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Dec 2022 21:34:02 +0200
+Subject: wifi: rtl8xxxu: Fix assignment to bit field priv->cck_agc_report_type
+
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+
+[ Upstream commit 639c26faf9b15922bc620af341545d6c5d6aab2d ]
+
+Just because priv->cck_agc_report_type is only one bit doesn't mean
+it works like a bool. The value assigned to it loses all bits except
+bit 0, so only assign 0 or 1 to it.
+
+This affects the RTL8192EU, but rtl8xxxu already can't connect to any
+networks with this chip, so it probably didn't bother anyone.
+
+Fixes: 2ad2a813b803 ("wifi: rtl8xxxu: Fix the CCK RSSI calculation")
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Reviewed-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/7bb4858c-5cef-9cae-5e08-7e8444e8ba89@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
+index 3ed435401e570..799b03ec19806 100644
+--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
+@@ -4208,10 +4208,12 @@ static int rtl8xxxu_init_device(struct ieee80211_hw *hw)
+ * should be equal or CCK RSSI report may be incorrect
+ */
+ val32 = rtl8xxxu_read32(priv, REG_FPGA0_XA_HSSI_PARM2);
+- priv->cck_agc_report_type = val32 & FPGA0_HSSI_PARM2_CCK_HIGH_PWR;
++ priv->cck_agc_report_type =
++ u32_get_bits(val32, FPGA0_HSSI_PARM2_CCK_HIGH_PWR);
+
+ val32 = rtl8xxxu_read32(priv, REG_FPGA0_XB_HSSI_PARM2);
+- if (priv->cck_agc_report_type != (bool)(val32 & FPGA0_HSSI_PARM2_CCK_HIGH_PWR)) {
++ if (priv->cck_agc_report_type !=
++ u32_get_bits(val32, FPGA0_HSSI_PARM2_CCK_HIGH_PWR)) {
+ if (priv->cck_agc_report_type)
+ val32 |= FPGA0_HSSI_PARM2_CCK_HIGH_PWR;
+ else
+--
+2.39.2
+
--- /dev/null
+From 16b363c859b608b6bb8920257980b8d6bd7dfa4c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Dec 2022 21:32:18 +0200
+Subject: wifi: rtl8xxxu: Fix assignment to bit field priv->pi_enabled
+
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+
+[ Upstream commit 9e32b4a709f0f7b7adf5d9939c3bd47c78c4f003 ]
+
+Just because priv->pi_enabled is only one bit doesn't mean it works
+like a bool. The value assigned to it loses all bits except bit 0,
+so only assign 0 or 1 to it.
+
+This affects the RTL8188FU, but fixing the assignment didn't make
+a difference for my device.
+
+Fixes: c888183b21f3 ("wifi: rtl8xxxu: Support new chip RTL8188FU")
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Reviewed-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/4368d585-11ec-d3c7-ec12-7f0afdcedfda@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8188f.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8188f.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8188f.c
+index 2c4f403ba68f3..97e7ff7289fab 100644
+--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8188f.c
++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8188f.c
+@@ -1122,7 +1122,7 @@ static void rtl8188fu_phy_iqcalibrate(struct rtl8xxxu_priv *priv,
+
+ if (t == 0) {
+ val32 = rtl8xxxu_read32(priv, REG_FPGA0_XA_HSSI_PARM1);
+- priv->pi_enabled = val32 & FPGA0_HSSI_PARM1_PI;
++ priv->pi_enabled = u32_get_bits(val32, FPGA0_HSSI_PARM1_PI);
+ }
+
+ /* save RF path */
+--
+2.39.2
+
--- /dev/null
+From 1afa753bbd0ecca70476ebd9c41e94d7050f3fa9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Dec 2022 13:48:04 +0200
+Subject: wifi: rtl8xxxu: Fix memory leaks with RTL8723BU, RTL8192EU
+
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+
+[ Upstream commit b39f662ce1648db0b9de32e6a849b098480793cb ]
+
+The wifi + bluetooth combo chip RTL8723BU can leak memory (especially?)
+when it's connected to a bluetooth audio device. The busy bluetooth
+traffic generates lots of C2H (card to host) messages, which are not
+freed correctly.
+
+To fix this, move the dev_kfree_skb() call in rtl8xxxu_c2hcmd_callback()
+inside the loop where skb_dequeue() is called.
+
+The RTL8192EU leaks memory because the C2H messages are added to the
+queue and left there forever. (This was fine in the past because it
+probably wasn't sending any C2H messages until commit e542e66b7c2e
+("wifi: rtl8xxxu: gen2: Turn on the rate control"). Since that commit
+it sends a C2H message when the TX rate changes.)
+
+To fix this, delete the check for rf_paths > 1 and the goto. Let the
+function process the C2H messages from RTL8192EU like the ones from
+the other chips.
+
+Theoretically the RTL8188FU could also leak like RTL8723BU, but it
+most likely doesn't send C2H messages frequently enough.
+
+This change was tested with RTL8723BU by Erhard F. I tested it with
+RTL8188FU and RTL8192EU.
+
+Reported-by: Erhard F. <erhard_f@mailbox.org>
+Tested-by: Erhard F. <erhard_f@mailbox.org>
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=215197
+Fixes: e542e66b7c2e ("rtl8xxxu: add bluetooth co-existence support for single antenna")
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Reviewed-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/03b099c1-c671-d252-36f4-57b70d721f9d@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 8 ++------
+ 1 file changed, 2 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
+index c8b82c5810111..75d393b5dbe5e 100644
+--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
+@@ -5552,9 +5552,6 @@ static void rtl8xxxu_c2hcmd_callback(struct work_struct *work)
+ btcoex = &priv->bt_coex;
+ rarpt = &priv->ra_report;
+
+- if (priv->rf_paths > 1)
+- goto out;
+-
+ while (!skb_queue_empty(&priv->c2hcmd_queue)) {
+ skb = skb_dequeue(&priv->c2hcmd_queue);
+
+@@ -5587,10 +5584,9 @@ static void rtl8xxxu_c2hcmd_callback(struct work_struct *work)
+ default:
+ break;
+ }
+- }
+
+-out:
+- dev_kfree_skb(skb);
++ dev_kfree_skb(skb);
++ }
+ }
+
+ static void rtl8723bu_handle_c2h(struct rtl8xxxu_priv *priv,
+--
+2.39.2
+
--- /dev/null
+From 789fc73d79d60c8f16985af8434cfe1204cc3fea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Dec 2022 10:58:12 +0800
+Subject: wifi: rtlwifi: Fix global-out-of-bounds bug in
+ _rtl8812ae_phy_set_txpower_limit()
+
+From: Li Zetao <lizetao1@huawei.com>
+
+[ Upstream commit 117dbeda22ec5ea0918254d03b540ef8b8a64d53 ]
+
+There is a global-out-of-bounds reported by KASAN:
+
+ BUG: KASAN: global-out-of-bounds in
+ _rtl8812ae_eq_n_byte.part.0+0x3d/0x84 [rtl8821ae]
+ Read of size 1 at addr ffffffffa0773c43 by task NetworkManager/411
+
+ CPU: 6 PID: 411 Comm: NetworkManager Tainted: G D
+ 6.1.0-rc8+ #144 e15588508517267d37
+ Hardware name: QEMU Standard PC (Q35 + ICH9, 2009),
+ Call Trace:
+ <TASK>
+ ...
+ kasan_report+0xbb/0x1c0
+ _rtl8812ae_eq_n_byte.part.0+0x3d/0x84 [rtl8821ae]
+ rtl8821ae_phy_bb_config.cold+0x346/0x641 [rtl8821ae]
+ rtl8821ae_hw_init+0x1f5e/0x79b0 [rtl8821ae]
+ ...
+ </TASK>
+
+The root cause of the problem is that the comparison order of
+"prate_section" in _rtl8812ae_phy_set_txpower_limit() is wrong. The
+_rtl8812ae_eq_n_byte() is used to compare the first n bytes of the two
+strings from tail to head, which causes the problem. In the
+_rtl8812ae_phy_set_txpower_limit(), it was originally intended to meet
+this requirement by carefully designing the comparison order.
+For example, "pregulation" and "pbandwidth" are compared in order of
+length from small to large, first is 3 and last is 4. However, the
+comparison order of "prate_section" dose not obey such order requirement,
+therefore when "prate_section" is "HT", when comparing from tail to head,
+it will lead to access out of bounds in _rtl8812ae_eq_n_byte(). As
+mentioned above, the _rtl8812ae_eq_n_byte() has the same function as
+strcmp(), so just strcmp() is enough.
+
+Fix it by removing _rtl8812ae_eq_n_byte() and use strcmp() barely.
+Although it can be fixed by adjusting the comparison order of
+"prate_section", this may cause the value of "rate_section" to not be
+from 0 to 5. In addition, commit "21e4b0726dc6" not only moved driver
+from staging to regular tree, but also added setting txpower limit
+function during the driver config phase, so the problem was introduced
+by this commit.
+
+Fixes: 21e4b0726dc6 ("rtlwifi: rtl8821ae: Move driver from staging to regular tree")
+Signed-off-by: Li Zetao <lizetao1@huawei.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20221212025812.1541311-1-lizetao1@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../wireless/realtek/rtlwifi/rtl8821ae/phy.c | 52 +++++++------------
+ 1 file changed, 20 insertions(+), 32 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c
+index a29321e2fa72f..5323ead30db03 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c
+@@ -1598,18 +1598,6 @@ static bool _rtl8812ae_get_integer_from_string(const char *str, u8 *pint)
+ return true;
+ }
+
+-static bool _rtl8812ae_eq_n_byte(const char *str1, const char *str2, u32 num)
+-{
+- if (num == 0)
+- return false;
+- while (num > 0) {
+- num--;
+- if (str1[num] != str2[num])
+- return false;
+- }
+- return true;
+-}
+-
+ static s8 _rtl8812ae_phy_get_chnl_idx_of_txpwr_lmt(struct ieee80211_hw *hw,
+ u8 band, u8 channel)
+ {
+@@ -1659,42 +1647,42 @@ static void _rtl8812ae_phy_set_txpower_limit(struct ieee80211_hw *hw,
+ power_limit = power_limit > MAX_POWER_INDEX ?
+ MAX_POWER_INDEX : power_limit;
+
+- if (_rtl8812ae_eq_n_byte(pregulation, "FCC", 3))
++ if (strcmp(pregulation, "FCC") == 0)
+ regulation = 0;
+- else if (_rtl8812ae_eq_n_byte(pregulation, "MKK", 3))
++ else if (strcmp(pregulation, "MKK") == 0)
+ regulation = 1;
+- else if (_rtl8812ae_eq_n_byte(pregulation, "ETSI", 4))
++ else if (strcmp(pregulation, "ETSI") == 0)
+ regulation = 2;
+- else if (_rtl8812ae_eq_n_byte(pregulation, "WW13", 4))
++ else if (strcmp(pregulation, "WW13") == 0)
+ regulation = 3;
+
+- if (_rtl8812ae_eq_n_byte(prate_section, "CCK", 3))
++ if (strcmp(prate_section, "CCK") == 0)
+ rate_section = 0;
+- else if (_rtl8812ae_eq_n_byte(prate_section, "OFDM", 4))
++ else if (strcmp(prate_section, "OFDM") == 0)
+ rate_section = 1;
+- else if (_rtl8812ae_eq_n_byte(prate_section, "HT", 2) &&
+- _rtl8812ae_eq_n_byte(prf_path, "1T", 2))
++ else if (strcmp(prate_section, "HT") == 0 &&
++ strcmp(prf_path, "1T") == 0)
+ rate_section = 2;
+- else if (_rtl8812ae_eq_n_byte(prate_section, "HT", 2) &&
+- _rtl8812ae_eq_n_byte(prf_path, "2T", 2))
++ else if (strcmp(prate_section, "HT") == 0 &&
++ strcmp(prf_path, "2T") == 0)
+ rate_section = 3;
+- else if (_rtl8812ae_eq_n_byte(prate_section, "VHT", 3) &&
+- _rtl8812ae_eq_n_byte(prf_path, "1T", 2))
++ else if (strcmp(prate_section, "VHT") == 0 &&
++ strcmp(prf_path, "1T") == 0)
+ rate_section = 4;
+- else if (_rtl8812ae_eq_n_byte(prate_section, "VHT", 3) &&
+- _rtl8812ae_eq_n_byte(prf_path, "2T", 2))
++ else if (strcmp(prate_section, "VHT") == 0 &&
++ strcmp(prf_path, "2T") == 0)
+ rate_section = 5;
+
+- if (_rtl8812ae_eq_n_byte(pbandwidth, "20M", 3))
++ if (strcmp(pbandwidth, "20M") == 0)
+ bandwidth = 0;
+- else if (_rtl8812ae_eq_n_byte(pbandwidth, "40M", 3))
++ else if (strcmp(pbandwidth, "40M") == 0)
+ bandwidth = 1;
+- else if (_rtl8812ae_eq_n_byte(pbandwidth, "80M", 3))
++ else if (strcmp(pbandwidth, "80M") == 0)
+ bandwidth = 2;
+- else if (_rtl8812ae_eq_n_byte(pbandwidth, "160M", 4))
++ else if (strcmp(pbandwidth, "160M") == 0)
+ bandwidth = 3;
+
+- if (_rtl8812ae_eq_n_byte(pband, "2.4G", 4)) {
++ if (strcmp(pband, "2.4G") == 0) {
+ ret = _rtl8812ae_phy_get_chnl_idx_of_txpwr_lmt(hw,
+ BAND_ON_2_4G,
+ channel);
+@@ -1718,7 +1706,7 @@ static void _rtl8812ae_phy_set_txpower_limit(struct ieee80211_hw *hw,
+ regulation, bandwidth, rate_section, channel_index,
+ rtlphy->txpwr_limit_2_4g[regulation][bandwidth]
+ [rate_section][channel_index][RF90_PATH_A]);
+- } else if (_rtl8812ae_eq_n_byte(pband, "5G", 2)) {
++ } else if (strcmp(pband, "5G") == 0) {
+ ret = _rtl8812ae_phy_get_chnl_idx_of_txpwr_lmt(hw,
+ BAND_ON_5G,
+ channel);
+--
+2.39.2
+
--- /dev/null
+From 157ecbe6ef9981c451b2a1efc9d9feec6cb7af41 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Dec 2022 22:14:10 +0800
+Subject: wifi: rtlwifi: rtl8188ee: don't call kfree_skb() under
+ spin_lock_irqsave()
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit 2611687fa7ffc84190f92292de0b80468de17220 ]
+
+It is not allowed to call kfree_skb() from hardware interrupt
+context or with interrupts being disabled. All the SKBs have
+been dequeued from the old queue, so it's safe to enqueue these
+SKBs to a free queue, then free them after spin_unlock_irqrestore()
+at once. Compile tested only.
+
+Fixes: 7fe3b3abb5da ("rtlwifi: rtl8188ee: rtl8821ae: Fix a queue locking problem")
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20221207141411.46098-3-yangyingliang@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtlwifi/rtl8188ee/hw.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/hw.c
+index 58c2ab3d44bef..de61c9c0ddec4 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/hw.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/hw.c
+@@ -68,8 +68,10 @@ static void _rtl88ee_return_beacon_queue_skb(struct ieee80211_hw *hw)
+ struct rtl_priv *rtlpriv = rtl_priv(hw);
+ struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
+ struct rtl8192_tx_ring *ring = &rtlpci->tx_ring[BEACON_QUEUE];
++ struct sk_buff_head free_list;
+ unsigned long flags;
+
++ skb_queue_head_init(&free_list);
+ spin_lock_irqsave(&rtlpriv->locks.irq_th_lock, flags);
+ while (skb_queue_len(&ring->queue)) {
+ struct rtl_tx_desc *entry = &ring->desc[ring->idx];
+@@ -79,10 +81,12 @@ static void _rtl88ee_return_beacon_queue_skb(struct ieee80211_hw *hw)
+ rtlpriv->cfg->ops->get_desc(hw, (u8 *)entry,
+ true, HW_DESC_TXBUFF_ADDR),
+ skb->len, DMA_TO_DEVICE);
+- kfree_skb(skb);
++ __skb_queue_tail(&free_list, skb);
+ ring->idx = (ring->idx + 1) % ring->entries;
+ }
+ spin_unlock_irqrestore(&rtlpriv->locks.irq_th_lock, flags);
++
++ __skb_queue_purge(&free_list);
+ }
+
+ static void _rtl88ee_disable_bcn_sub_func(struct ieee80211_hw *hw)
+--
+2.39.2
+
--- /dev/null
+From 3542a3de1ff48b8e350e925e81a3b64ceef5fff6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Dec 2022 22:14:11 +0800
+Subject: wifi: rtlwifi: rtl8723be: don't call kfree_skb() under
+ spin_lock_irqsave()
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit 313950c2114e7051c4e3020fd82495fa1fb526a8 ]
+
+It is not allowed to call kfree_skb() from hardware interrupt
+context or with interrupts being disabled. All the SKBs have
+been dequeued from the old queue, so it's safe to enqueue these
+SKBs to a free queue, then free them after spin_unlock_irqrestore()
+at once. Compile tested only.
+
+Fixes: 5c99f04fec93 ("rtlwifi: rtl8723be: Update driver to match Realtek release of 06/28/14")
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20221207141411.46098-4-yangyingliang@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c
+index 189cc6437600f..0ba3bbed6ed36 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c
+@@ -30,8 +30,10 @@ static void _rtl8723be_return_beacon_queue_skb(struct ieee80211_hw *hw)
+ struct rtl_priv *rtlpriv = rtl_priv(hw);
+ struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
+ struct rtl8192_tx_ring *ring = &rtlpci->tx_ring[BEACON_QUEUE];
++ struct sk_buff_head free_list;
+ unsigned long flags;
+
++ skb_queue_head_init(&free_list);
+ spin_lock_irqsave(&rtlpriv->locks.irq_th_lock, flags);
+ while (skb_queue_len(&ring->queue)) {
+ struct rtl_tx_desc *entry = &ring->desc[ring->idx];
+@@ -41,10 +43,12 @@ static void _rtl8723be_return_beacon_queue_skb(struct ieee80211_hw *hw)
+ rtlpriv->cfg->ops->get_desc(hw, (u8 *)entry,
+ true, HW_DESC_TXBUFF_ADDR),
+ skb->len, DMA_TO_DEVICE);
+- kfree_skb(skb);
++ __skb_queue_tail(&free_list, skb);
+ ring->idx = (ring->idx + 1) % ring->entries;
+ }
+ spin_unlock_irqrestore(&rtlpriv->locks.irq_th_lock, flags);
++
++ __skb_queue_purge(&free_list);
+ }
+
+ static void _rtl8723be_set_bcn_ctrl_reg(struct ieee80211_hw *hw,
+--
+2.39.2
+
--- /dev/null
+From 18d642d915e290002ee854ff0d8a9f71d5cce568 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Dec 2022 22:14:09 +0800
+Subject: wifi: rtlwifi: rtl8821ae: don't call kfree_skb() under
+ spin_lock_irqsave()
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit 106031c1f4a850915190d7ec1026696282f9359b ]
+
+It is not allowed to call kfree_skb() from hardware interrupt
+context or with interrupts being disabled. All the SKBs have
+been dequeued from the old queue, so it's safe to enqueue these
+SKBs to a free queue, then free them after spin_unlock_irqrestore()
+at once. Compile tested only.
+
+Fixes: 5c99f04fec93 ("rtlwifi: rtl8723be: Update driver to match Realtek release of 06/28/14")
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20221207141411.46098-2-yangyingliang@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c
+index 7e0f62d59fe17..a7e3250957dc9 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c
+@@ -26,8 +26,10 @@ static void _rtl8821ae_return_beacon_queue_skb(struct ieee80211_hw *hw)
+ struct rtl_priv *rtlpriv = rtl_priv(hw);
+ struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
+ struct rtl8192_tx_ring *ring = &rtlpci->tx_ring[BEACON_QUEUE];
++ struct sk_buff_head free_list;
+ unsigned long flags;
+
++ skb_queue_head_init(&free_list);
+ spin_lock_irqsave(&rtlpriv->locks.irq_th_lock, flags);
+ while (skb_queue_len(&ring->queue)) {
+ struct rtl_tx_desc *entry = &ring->desc[ring->idx];
+@@ -37,10 +39,12 @@ static void _rtl8821ae_return_beacon_queue_skb(struct ieee80211_hw *hw)
+ rtlpriv->cfg->ops->get_desc(hw, (u8 *)entry,
+ true, HW_DESC_TXBUFF_ADDR),
+ skb->len, DMA_TO_DEVICE);
+- kfree_skb(skb);
++ __skb_queue_tail(&free_list, skb);
+ ring->idx = (ring->idx + 1) % ring->entries;
+ }
+ spin_unlock_irqrestore(&rtlpriv->locks.irq_th_lock, flags);
++
++ __skb_queue_purge(&free_list);
+ }
+
+ static void _rtl8821ae_set_bcn_ctrl_reg(struct ieee80211_hw *hw,
+--
+2.39.2
+
--- /dev/null
+From 892e2b7de6e30009d1c04189c0ca6d232b16fafc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 8 Jan 2023 22:13:24 +0100
+Subject: wifi: rtw88: Use non-atomic sta iterator in rtw_ra_mask_info_update()
+
+From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+
+[ Upstream commit 2931978cd74f4a643deeea5b211523001d95aa44 ]
+
+USB and (upcoming) SDIO support may sleep in the read/write handlers.
+Use non-atomic rtw_iterate_stas() in rtw_ra_mask_info_update() because
+the iterator function rtw_ra_mask_info_update_iter() needs to read and
+write registers from within rtw_update_sta_info(). Using the non-atomic
+iterator ensures that we can sleep during USB and SDIO register reads
+and writes. This fixes "scheduling while atomic" or "Voluntary context
+switch within RCU read-side critical section!" warnings as seen by SDIO
+card users (but it also affects USB cards).
+
+Fixes: 78d5bf925f30 ("wifi: rtw88: iterate over vif/sta list non-atomically")
+Suggested-by: Ping-Ke Shih <pkshih@realtek.com>
+Reviewed-by: Ping-Ke Shih <pkshih@realtek.com>
+Tested-by: Sascha Hauer <s.hauer@pengutronix.de>
+Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20230108211324.442823-4-martin.blumenstingl@googlemail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw88/mac80211.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw88/mac80211.c b/drivers/net/wireless/realtek/rtw88/mac80211.c
+index 776a9a9884b5d..3b92ac611d3fd 100644
+--- a/drivers/net/wireless/realtek/rtw88/mac80211.c
++++ b/drivers/net/wireless/realtek/rtw88/mac80211.c
+@@ -737,7 +737,7 @@ static void rtw_ra_mask_info_update(struct rtw_dev *rtwdev,
+ br_data.rtwdev = rtwdev;
+ br_data.vif = vif;
+ br_data.mask = mask;
+- rtw_iterate_stas_atomic(rtwdev, rtw_ra_mask_info_update_iter, &br_data);
++ rtw_iterate_stas(rtwdev, rtw_ra_mask_info_update_iter, &br_data);
+ }
+
+ static int rtw_ops_set_bitrate_mask(struct ieee80211_hw *hw,
+@@ -746,7 +746,9 @@ static int rtw_ops_set_bitrate_mask(struct ieee80211_hw *hw,
+ {
+ struct rtw_dev *rtwdev = hw->priv;
+
++ mutex_lock(&rtwdev->mutex);
+ rtw_ra_mask_info_update(rtwdev, vif, mask);
++ mutex_unlock(&rtwdev->mutex);
+
+ return 0;
+ }
+--
+2.39.2
+
--- /dev/null
+From b01aee55220aa729d60b6d0d90e05b606ae8add8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 8 Jan 2023 22:13:23 +0100
+Subject: wifi: rtw88: Use rtw_iterate_vifs() for rtw_vif_watch_dog_iter()
+
+From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+
+[ Upstream commit 313f6dc7c5ed723d0c5691553eff4c0090f16bb8 ]
+
+USB and (upcoming) SDIO support may sleep in the read/write handlers.
+Make rtw_watch_dog_work() use rtw_iterate_vifs() to prevent "scheduling
+while atomic" or "Voluntary context switch within RCU read-side
+critical section!" warnings when accessing the registers using an SDIO
+card (which is where this issue has been spotted in the real world but
+it also affects USB cards).
+
+Fixes: 78d5bf925f30 ("wifi: rtw88: iterate over vif/sta list non-atomically")
+Suggested-by: Ping-Ke Shih <pkshih@realtek.com>
+Reviewed-by: Ping-Ke Shih <pkshih@realtek.com>
+Tested-by: Sascha Hauer <s.hauer@pengutronix.de>
+Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20230108211324.442823-3-martin.blumenstingl@googlemail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw88/main.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw88/main.c b/drivers/net/wireless/realtek/rtw88/main.c
+index 888427cf3bdf9..b2e78737bd5d0 100644
+--- a/drivers/net/wireless/realtek/rtw88/main.c
++++ b/drivers/net/wireless/realtek/rtw88/main.c
+@@ -241,8 +241,10 @@ static void rtw_watch_dog_work(struct work_struct *work)
+ rtw_phy_dynamic_mechanism(rtwdev);
+
+ data.rtwdev = rtwdev;
+- /* use atomic version to avoid taking local->iflist_mtx mutex */
+- rtw_iterate_vifs_atomic(rtwdev, rtw_vif_watch_dog_iter, &data);
++ /* rtw_iterate_vifs internally uses an atomic iterator which is needed
++ * to avoid taking local->iflist_mtx mutex
++ */
++ rtw_iterate_vifs(rtwdev, rtw_vif_watch_dog_iter, &data);
+
+ /* fw supports only one station associated to enter lps, if there are
+ * more than two stations associated to the AP, then we can not enter
+--
+2.39.2
+
--- /dev/null
+From 9fbe8a6d8931c55690dfb98d4336549c1b69d955 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Dec 2022 10:09:38 +0800
+Subject: wifi: rtw89: 8852c: rfk: correct DACK setting
+
+From: Ping-Ke Shih <pkshih@realtek.com>
+
+[ Upstream commit b2bab7b14098dcf5d405fa8c76b2c3f6ce9184f9 ]
+
+After filling calibration parameters, set BIT(0) to enable the hardware
+circuit, but original set incorrect bit that affects a little TX
+performance.
+
+Fixes: 76599a8d0b7d ("rtw89: 8852c: rfk: add DACK")
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20221209020940.9573-2-pkshih@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/rtw8852c_rfk.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/rtw8852c_rfk.c b/drivers/net/wireless/realtek/rtw89/rtw8852c_rfk.c
+index 60cd676fe22c9..f5b0b57f33207 100644
+--- a/drivers/net/wireless/realtek/rtw89/rtw8852c_rfk.c
++++ b/drivers/net/wireless/realtek/rtw89/rtw8852c_rfk.c
+@@ -337,7 +337,7 @@ static void _dack_reload_by_path(struct rtw89_dev *rtwdev,
+ (dack->dadck_d[path][index] << 14);
+ addr = 0xc210 + offset;
+ rtw89_phy_write32(rtwdev, addr, val32);
+- rtw89_phy_write32_set(rtwdev, addr, BIT(1));
++ rtw89_phy_write32_set(rtwdev, addr, BIT(0));
+ }
+
+ static void _dack_reload(struct rtw89_dev *rtwdev, enum rtw89_rf_path path)
+--
+2.39.2
+
--- /dev/null
+From 44aa3486f080325f1f10ec905186b1b9e9289545 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Dec 2022 10:09:39 +0800
+Subject: wifi: rtw89: 8852c: rfk: correct DPK settings
+
+From: Ping-Ke Shih <pkshih@realtek.com>
+
+[ Upstream commit 21b5f159a2ee47d30f418559f6ece0088c80199f ]
+
+Some DPK settings are wrong, and causes bad TX performance occasionally.
+So, fix them by internal suggestions.
+
+Fixes: da4cea16cb13 ("rtw89: 8852c: rfk: add DPK")
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20221209020940.9573-3-pkshih@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/reg.h | 2 ++
+ drivers/net/wireless/realtek/rtw89/rtw8852c_rfk.c | 9 ++++-----
+ 2 files changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/reg.h b/drivers/net/wireless/realtek/rtw89/reg.h
+index 5324e645728bb..ca6f6c3e63095 100644
+--- a/drivers/net/wireless/realtek/rtw89/reg.h
++++ b/drivers/net/wireless/realtek/rtw89/reg.h
+@@ -3671,6 +3671,8 @@
+ #define RR_TXRSV_GAPK BIT(19)
+ #define RR_BIAS 0x5e
+ #define RR_BIAS_GAPK BIT(19)
++#define RR_TXAC 0x5f
++#define RR_TXAC_IQG GENMASK(3, 0)
+ #define RR_BIASA 0x60
+ #define RR_BIASA_TXG GENMASK(15, 12)
+ #define RR_BIASA_TXA GENMASK(19, 16)
+diff --git a/drivers/net/wireless/realtek/rtw89/rtw8852c_rfk.c b/drivers/net/wireless/realtek/rtw89/rtw8852c_rfk.c
+index f5b0b57f33207..f3a07b0e672f7 100644
+--- a/drivers/net/wireless/realtek/rtw89/rtw8852c_rfk.c
++++ b/drivers/net/wireless/realtek/rtw89/rtw8852c_rfk.c
+@@ -1872,12 +1872,11 @@ static void _dpk_rf_setting(struct rtw89_dev *rtwdev, u8 gain,
+ 0x50101 | BIT(rtwdev->dbcc_en));
+ rtw89_write_rf(rtwdev, path, RR_MOD_V1, RR_MOD_MASK, RF_DPK);
+
+- if (dpk->bp[path][kidx].band == RTW89_BAND_6G && dpk->bp[path][kidx].ch >= 161) {
++ if (dpk->bp[path][kidx].band == RTW89_BAND_6G && dpk->bp[path][kidx].ch >= 161)
+ rtw89_write_rf(rtwdev, path, RR_IQGEN, RR_IQGEN_BIAS, 0x8);
+- rtw89_write_rf(rtwdev, path, RR_LOGEN, RR_LOGEN_RPT, 0xd);
+- } else {
+- rtw89_write_rf(rtwdev, path, RR_LOGEN, RR_LOGEN_RPT, 0xd);
+- }
++
++ rtw89_write_rf(rtwdev, path, RR_LOGEN, RR_LOGEN_RPT, 0xd);
++ rtw89_write_rf(rtwdev, path, RR_TXAC, RR_TXAC_IQG, 0x8);
+
+ rtw89_write_rf(rtwdev, path, RR_RXA2, RR_RXA2_ATT, 0x0);
+ rtw89_write_rf(rtwdev, path, RR_TXIQK, RR_TXIQK_ATT2, 0x3);
+--
+2.39.2
+
--- /dev/null
+From 80176b1628648ce73d854ee7ecc833d74e983172 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Jan 2023 22:29:01 +0800
+Subject: wifi: rtw89: Add missing check for alloc_workqueue
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit ed9e6166eb0984b718facb7ca59296098cc3aa64 ]
+
+Add check for the return value of alloc_workqueue since it may return
+NULL pointer.
+Moreover, add destroy_workqueue when rtw89_load_firmware fails.
+
+Fixes: e3ec7017f6a2 ("rtw89: add Realtek 802.11ax driver")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20230104142901.1611-1-jiasheng@iscas.ac.cn
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/core.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/core.c b/drivers/net/wireless/realtek/rtw89/core.c
+index 931aff8b5dc95..e99eccf11c762 100644
+--- a/drivers/net/wireless/realtek/rtw89/core.c
++++ b/drivers/net/wireless/realtek/rtw89/core.c
+@@ -3124,6 +3124,8 @@ int rtw89_core_init(struct rtw89_dev *rtwdev)
+ INIT_DELAYED_WORK(&rtwdev->cfo_track_work, rtw89_phy_cfo_track_work);
+ INIT_DELAYED_WORK(&rtwdev->forbid_ba_work, rtw89_forbid_ba_work);
+ rtwdev->txq_wq = alloc_workqueue("rtw89_tx_wq", WQ_UNBOUND | WQ_HIGHPRI, 0);
++ if (!rtwdev->txq_wq)
++ return -ENOMEM;
+ spin_lock_init(&rtwdev->ba_lock);
+ spin_lock_init(&rtwdev->rpwm_lock);
+ mutex_init(&rtwdev->mutex);
+@@ -3149,6 +3151,7 @@ int rtw89_core_init(struct rtw89_dev *rtwdev)
+ ret = rtw89_load_firmware(rtwdev);
+ if (ret) {
+ rtw89_warn(rtwdev, "no firmware loaded\n");
++ destroy_workqueue(rtwdev->txq_wq);
+ return ret;
+ }
+ rtw89_ser_init(rtwdev);
+--
+2.39.2
+
--- /dev/null
+From 6702093d4d928469c1899fd9cfc6017527615194 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Jan 2023 14:35:28 +0800
+Subject: wifi: rtw89: debug: avoid invalid access on RTW89_DBG_SEL_MAC_30
+
+From: Zong-Zhe Yang <kevin_yang@realtek.com>
+
+[ Upstream commit c074da21dd346e0cfef5d08b0715078d7aea7f8d ]
+
+Only 8852C chip has valid pages on RTW89_DBG_SEL_MAC_30. To other chips,
+this section is an address hole. It will lead to crash if trying to access
+this section on chips except for 8852C. So, we avoid that.
+
+Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20230119063529.61563-2-pkshih@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/debug.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/debug.c b/drivers/net/wireless/realtek/rtw89/debug.c
+index 8297e35bfa52b..6730eea930ece 100644
+--- a/drivers/net/wireless/realtek/rtw89/debug.c
++++ b/drivers/net/wireless/realtek/rtw89/debug.c
+@@ -615,6 +615,7 @@ rtw89_debug_priv_mac_reg_dump_select(struct file *filp,
+ struct seq_file *m = (struct seq_file *)filp->private_data;
+ struct rtw89_debugfs_priv *debugfs_priv = m->private;
+ struct rtw89_dev *rtwdev = debugfs_priv->rtwdev;
++ const struct rtw89_chip_info *chip = rtwdev->chip;
+ char buf[32];
+ size_t buf_size;
+ int sel;
+@@ -634,6 +635,12 @@ rtw89_debug_priv_mac_reg_dump_select(struct file *filp,
+ return -EINVAL;
+ }
+
++ if (sel == RTW89_DBG_SEL_MAC_30 && chip->chip_id != RTL8852C) {
++ rtw89_info(rtwdev, "sel %d is address hole on chip %d\n", sel,
++ chip->chip_id);
++ return -EINVAL;
++ }
++
+ debugfs_priv->cb_data = sel;
+ rtw89_info(rtwdev, "select mac page dump %d\n", debugfs_priv->cb_data);
+
+--
+2.39.2
+
--- /dev/null
+From 65152ebeb3c24a082439c550a15b5ac2f8e9e77e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Jan 2023 17:06:31 +0800
+Subject: wifi: rtw89: fix assignation of TX BD RAM table
+
+From: Zong-Zhe Yang <kevin_yang@realtek.com>
+
+[ Upstream commit 7f495de6ae7d31f098970fb45a038c9f69b1bf75 ]
+
+TX BD's RAM table describes how HW allocates usable buffer section
+for each TX channel at fetch time. The total RAM size for TX BD is
+chip-dependent. For 8852BE, it has only half size (32) for TX channels
+of single band. Original table arrange total size (64) for dual band.
+It will overflow on 8852BE circuit and cause section conflicts between
+different TX channels.
+
+So, we do the changes below.
+* add another table for single band chip and export both kind of tables
+* point to the expected one in rtw89_pci_info by chip
+
+Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20230113090632.60957-4-pkshih@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/pci.c | 15 ++++++++++++++-
+ drivers/net/wireless/realtek/rtw89/pci.h | 15 +++++++++------
+ drivers/net/wireless/realtek/rtw89/rtw8852ae.c | 1 +
+ drivers/net/wireless/realtek/rtw89/rtw8852be.c | 1 +
+ drivers/net/wireless/realtek/rtw89/rtw8852ce.c | 1 +
+ 5 files changed, 26 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/pci.c b/drivers/net/wireless/realtek/rtw89/pci.c
+index 1c4500ba777c6..0ea734c81b4f0 100644
+--- a/drivers/net/wireless/realtek/rtw89/pci.c
++++ b/drivers/net/wireless/realtek/rtw89/pci.c
+@@ -1384,7 +1384,7 @@ static int rtw89_pci_ops_tx_write(struct rtw89_dev *rtwdev, struct rtw89_core_tx
+ return 0;
+ }
+
+-static const struct rtw89_pci_bd_ram bd_ram_table[RTW89_TXCH_NUM] = {
++const struct rtw89_pci_bd_ram rtw89_bd_ram_table_dual[RTW89_TXCH_NUM] = {
+ [RTW89_TXCH_ACH0] = {.start_idx = 0, .max_num = 5, .min_num = 2},
+ [RTW89_TXCH_ACH1] = {.start_idx = 5, .max_num = 5, .min_num = 2},
+ [RTW89_TXCH_ACH2] = {.start_idx = 10, .max_num = 5, .min_num = 2},
+@@ -1399,11 +1399,24 @@ static const struct rtw89_pci_bd_ram bd_ram_table[RTW89_TXCH_NUM] = {
+ [RTW89_TXCH_CH11] = {.start_idx = 55, .max_num = 5, .min_num = 1},
+ [RTW89_TXCH_CH12] = {.start_idx = 60, .max_num = 4, .min_num = 1},
+ };
++EXPORT_SYMBOL(rtw89_bd_ram_table_dual);
++
++const struct rtw89_pci_bd_ram rtw89_bd_ram_table_single[RTW89_TXCH_NUM] = {
++ [RTW89_TXCH_ACH0] = {.start_idx = 0, .max_num = 5, .min_num = 2},
++ [RTW89_TXCH_ACH1] = {.start_idx = 5, .max_num = 5, .min_num = 2},
++ [RTW89_TXCH_ACH2] = {.start_idx = 10, .max_num = 5, .min_num = 2},
++ [RTW89_TXCH_ACH3] = {.start_idx = 15, .max_num = 5, .min_num = 2},
++ [RTW89_TXCH_CH8] = {.start_idx = 20, .max_num = 4, .min_num = 1},
++ [RTW89_TXCH_CH9] = {.start_idx = 24, .max_num = 4, .min_num = 1},
++ [RTW89_TXCH_CH12] = {.start_idx = 28, .max_num = 4, .min_num = 1},
++};
++EXPORT_SYMBOL(rtw89_bd_ram_table_single);
+
+ static void rtw89_pci_reset_trx_rings(struct rtw89_dev *rtwdev)
+ {
+ struct rtw89_pci *rtwpci = (struct rtw89_pci *)rtwdev->priv;
+ const struct rtw89_pci_info *info = rtwdev->pci_info;
++ const struct rtw89_pci_bd_ram *bd_ram_table = *info->bd_ram_table;
+ struct rtw89_pci_tx_ring *tx_ring;
+ struct rtw89_pci_rx_ring *rx_ring;
+ struct rtw89_pci_dma_ring *bd_ring;
+diff --git a/drivers/net/wireless/realtek/rtw89/pci.h b/drivers/net/wireless/realtek/rtw89/pci.h
+index 7d033501d4d95..1e19740db8c54 100644
+--- a/drivers/net/wireless/realtek/rtw89/pci.h
++++ b/drivers/net/wireless/realtek/rtw89/pci.h
+@@ -750,6 +750,12 @@ struct rtw89_pci_ch_dma_addr_set {
+ struct rtw89_pci_ch_dma_addr rx[RTW89_RXCH_NUM];
+ };
+
++struct rtw89_pci_bd_ram {
++ u8 start_idx;
++ u8 max_num;
++ u8 min_num;
++};
++
+ struct rtw89_pci_info {
+ enum mac_ax_bd_trunc_mode txbd_trunc_mode;
+ enum mac_ax_bd_trunc_mode rxbd_trunc_mode;
+@@ -785,6 +791,7 @@ struct rtw89_pci_info {
+ u32 tx_dma_ch_mask;
+ const struct rtw89_pci_bd_idx_addr *bd_idx_addr_low_power;
+ const struct rtw89_pci_ch_dma_addr_set *dma_addr_set;
++ const struct rtw89_pci_bd_ram (*bd_ram_table)[RTW89_TXCH_NUM];
+
+ int (*ltr_set)(struct rtw89_dev *rtwdev, bool en);
+ u32 (*fill_txaddr_info)(struct rtw89_dev *rtwdev,
+@@ -798,12 +805,6 @@ struct rtw89_pci_info {
+ struct rtw89_pci_isrs *isrs);
+ };
+
+-struct rtw89_pci_bd_ram {
+- u8 start_idx;
+- u8 max_num;
+- u8 min_num;
+-};
+-
+ struct rtw89_pci_tx_data {
+ dma_addr_t dma;
+ };
+@@ -1057,6 +1058,8 @@ static inline bool rtw89_pci_ltr_is_err_reg_val(u32 val)
+ extern const struct dev_pm_ops rtw89_pm_ops;
+ extern const struct rtw89_pci_ch_dma_addr_set rtw89_pci_ch_dma_addr_set;
+ extern const struct rtw89_pci_ch_dma_addr_set rtw89_pci_ch_dma_addr_set_v1;
++extern const struct rtw89_pci_bd_ram rtw89_bd_ram_table_dual[RTW89_TXCH_NUM];
++extern const struct rtw89_pci_bd_ram rtw89_bd_ram_table_single[RTW89_TXCH_NUM];
+
+ struct pci_device_id;
+
+diff --git a/drivers/net/wireless/realtek/rtw89/rtw8852ae.c b/drivers/net/wireless/realtek/rtw89/rtw8852ae.c
+index 0cd8c0c44d19d..d835a44a1d0d0 100644
+--- a/drivers/net/wireless/realtek/rtw89/rtw8852ae.c
++++ b/drivers/net/wireless/realtek/rtw89/rtw8852ae.c
+@@ -44,6 +44,7 @@ static const struct rtw89_pci_info rtw8852a_pci_info = {
+ .tx_dma_ch_mask = 0,
+ .bd_idx_addr_low_power = NULL,
+ .dma_addr_set = &rtw89_pci_ch_dma_addr_set,
++ .bd_ram_table = &rtw89_bd_ram_table_dual,
+
+ .ltr_set = rtw89_pci_ltr_set,
+ .fill_txaddr_info = rtw89_pci_fill_txaddr_info,
+diff --git a/drivers/net/wireless/realtek/rtw89/rtw8852be.c b/drivers/net/wireless/realtek/rtw89/rtw8852be.c
+index 0ef2ca8efeb0e..ecf39d2d9f81f 100644
+--- a/drivers/net/wireless/realtek/rtw89/rtw8852be.c
++++ b/drivers/net/wireless/realtek/rtw89/rtw8852be.c
+@@ -46,6 +46,7 @@ static const struct rtw89_pci_info rtw8852b_pci_info = {
+ BIT(RTW89_TXCH_CH10) | BIT(RTW89_TXCH_CH11),
+ .bd_idx_addr_low_power = NULL,
+ .dma_addr_set = &rtw89_pci_ch_dma_addr_set,
++ .bd_ram_table = &rtw89_bd_ram_table_single,
+
+ .ltr_set = rtw89_pci_ltr_set,
+ .fill_txaddr_info = rtw89_pci_fill_txaddr_info,
+diff --git a/drivers/net/wireless/realtek/rtw89/rtw8852ce.c b/drivers/net/wireless/realtek/rtw89/rtw8852ce.c
+index 35901f64d17de..80490a5437df6 100644
+--- a/drivers/net/wireless/realtek/rtw89/rtw8852ce.c
++++ b/drivers/net/wireless/realtek/rtw89/rtw8852ce.c
+@@ -53,6 +53,7 @@ static const struct rtw89_pci_info rtw8852c_pci_info = {
+ .tx_dma_ch_mask = 0,
+ .bd_idx_addr_low_power = &rtw8852c_bd_idx_addr_low_power,
+ .dma_addr_set = &rtw89_pci_ch_dma_addr_set_v1,
++ .bd_ram_table = &rtw89_bd_ram_table_dual,
+
+ .ltr_set = rtw89_pci_ltr_set_v1,
+ .fill_txaddr_info = rtw89_pci_fill_txaddr_info_v1,
+--
+2.39.2
+
--- /dev/null
+From c4fd4eb3de852e6d15d91925310e82428d7409ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Jan 2023 14:43:41 +0800
+Subject: wifi: rtw89: fix parsing offset for MCC C2H
+
+From: Zong-Zhe Yang <kevin_yang@realtek.com>
+
+[ Upstream commit 24d72944d79e6795ba4330c114de0387386bf3aa ]
+
+A 8-byte offset is missed during parsing C2Hs (chip to host packets)
+of MCC (multi-channel concurrent) series.
+So, we fix it.
+
+Fixes: ef9dff4cb491 ("wifi: rtw89: mac: process MCC related C2H")
+Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20230119064342.65391-1-pkshih@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/fw.h | 34 ++++++++++++-------------
+ 1 file changed, 17 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/fw.h b/drivers/net/wireless/realtek/rtw89/fw.h
+index 4d2f9ea9e0022..2e4ca1cc5cae9 100644
+--- a/drivers/net/wireless/realtek/rtw89/fw.h
++++ b/drivers/net/wireless/realtek/rtw89/fw.h
+@@ -3209,16 +3209,16 @@ static inline struct rtw89_fw_c2h_attr *RTW89_SKB_C2H_CB(struct sk_buff *skb)
+ le32_get_bits(*((const __le32 *)(c2h) + 5), GENMASK(25, 24))
+
+ #define RTW89_GET_MAC_C2H_MCC_RCV_ACK_GROUP(c2h) \
+- le32_get_bits(*((const __le32 *)(c2h)), GENMASK(1, 0))
++ le32_get_bits(*((const __le32 *)(c2h) + 2), GENMASK(1, 0))
+ #define RTW89_GET_MAC_C2H_MCC_RCV_ACK_H2C_FUNC(c2h) \
+- le32_get_bits(*((const __le32 *)(c2h)), GENMASK(15, 8))
++ le32_get_bits(*((const __le32 *)(c2h) + 2), GENMASK(15, 8))
+
+ #define RTW89_GET_MAC_C2H_MCC_REQ_ACK_GROUP(c2h) \
+- le32_get_bits(*((const __le32 *)(c2h)), GENMASK(1, 0))
++ le32_get_bits(*((const __le32 *)(c2h) + 2), GENMASK(1, 0))
+ #define RTW89_GET_MAC_C2H_MCC_REQ_ACK_H2C_RETURN(c2h) \
+- le32_get_bits(*((const __le32 *)(c2h)), GENMASK(7, 2))
++ le32_get_bits(*((const __le32 *)(c2h) + 2), GENMASK(7, 2))
+ #define RTW89_GET_MAC_C2H_MCC_REQ_ACK_H2C_FUNC(c2h) \
+- le32_get_bits(*((const __le32 *)(c2h)), GENMASK(15, 8))
++ le32_get_bits(*((const __le32 *)(c2h) + 2), GENMASK(15, 8))
+
+ struct rtw89_mac_mcc_tsf_rpt {
+ u32 macid_x;
+@@ -3232,30 +3232,30 @@ struct rtw89_mac_mcc_tsf_rpt {
+ static_assert(sizeof(struct rtw89_mac_mcc_tsf_rpt) <= RTW89_COMPLETION_BUF_SIZE);
+
+ #define RTW89_GET_MAC_C2H_MCC_TSF_RPT_MACID_X(c2h) \
+- le32_get_bits(*((const __le32 *)(c2h)), GENMASK(7, 0))
++ le32_get_bits(*((const __le32 *)(c2h) + 2), GENMASK(7, 0))
+ #define RTW89_GET_MAC_C2H_MCC_TSF_RPT_MACID_Y(c2h) \
+- le32_get_bits(*((const __le32 *)(c2h)), GENMASK(15, 8))
++ le32_get_bits(*((const __le32 *)(c2h) + 2), GENMASK(15, 8))
+ #define RTW89_GET_MAC_C2H_MCC_TSF_RPT_GROUP(c2h) \
+- le32_get_bits(*((const __le32 *)(c2h)), GENMASK(17, 16))
++ le32_get_bits(*((const __le32 *)(c2h) + 2), GENMASK(17, 16))
+ #define RTW89_GET_MAC_C2H_MCC_TSF_RPT_TSF_LOW_X(c2h) \
+- le32_get_bits(*((const __le32 *)(c2h) + 1), GENMASK(31, 0))
++ le32_get_bits(*((const __le32 *)(c2h) + 3), GENMASK(31, 0))
+ #define RTW89_GET_MAC_C2H_MCC_TSF_RPT_TSF_HIGH_X(c2h) \
+- le32_get_bits(*((const __le32 *)(c2h) + 2), GENMASK(31, 0))
++ le32_get_bits(*((const __le32 *)(c2h) + 4), GENMASK(31, 0))
+ #define RTW89_GET_MAC_C2H_MCC_TSF_RPT_TSF_LOW_Y(c2h) \
+- le32_get_bits(*((const __le32 *)(c2h) + 3), GENMASK(31, 0))
++ le32_get_bits(*((const __le32 *)(c2h) + 5), GENMASK(31, 0))
+ #define RTW89_GET_MAC_C2H_MCC_TSF_RPT_TSF_HIGH_Y(c2h) \
+- le32_get_bits(*((const __le32 *)(c2h) + 4), GENMASK(31, 0))
++ le32_get_bits(*((const __le32 *)(c2h) + 6), GENMASK(31, 0))
+
+ #define RTW89_GET_MAC_C2H_MCC_STATUS_RPT_STATUS(c2h) \
+- le32_get_bits(*((const __le32 *)(c2h)), GENMASK(5, 0))
++ le32_get_bits(*((const __le32 *)(c2h) + 2), GENMASK(5, 0))
+ #define RTW89_GET_MAC_C2H_MCC_STATUS_RPT_GROUP(c2h) \
+- le32_get_bits(*((const __le32 *)(c2h)), GENMASK(7, 6))
++ le32_get_bits(*((const __le32 *)(c2h) + 2), GENMASK(7, 6))
+ #define RTW89_GET_MAC_C2H_MCC_STATUS_RPT_MACID(c2h) \
+- le32_get_bits(*((const __le32 *)(c2h)), GENMASK(15, 8))
++ le32_get_bits(*((const __le32 *)(c2h) + 2), GENMASK(15, 8))
+ #define RTW89_GET_MAC_C2H_MCC_STATUS_RPT_TSF_LOW(c2h) \
+- le32_get_bits(*((const __le32 *)(c2h) + 1), GENMASK(31, 0))
++ le32_get_bits(*((const __le32 *)(c2h) + 3), GENMASK(31, 0))
+ #define RTW89_GET_MAC_C2H_MCC_STATUS_RPT_TSF_HIGH(c2h) \
+- le32_get_bits(*((const __le32 *)(c2h) + 2), GENMASK(31, 0))
++ le32_get_bits(*((const __le32 *)(c2h) + 4), GENMASK(31, 0))
+
+ #define RTW89_FW_HDR_SIZE 32
+ #define RTW89_FW_SECTION_HDR_SIZE 16
+--
+2.39.2
+
--- /dev/null
+From ef12ad9fca5633ae45a1c3b60fafe0f789bb607b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Jan 2023 22:10:54 +0800
+Subject: wifi: rtw89: fix potential leak in rtw89_append_probe_req_ie()
+
+From: Zong-Zhe Yang <kevin_yang@realtek.com>
+
+[ Upstream commit 4a0e218cc9c42d1903ade8b5a371dcf48cf918c5 ]
+
+Do `kfree_skb(new)` before `goto out` to prevent potential leak.
+
+Fixes: 895907779752 ("rtw89: 8852a: add ieee80211_ops::hw_scan")
+Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20230103141054.17372-1-pkshih@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/fw.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/fw.c b/drivers/net/wireless/realtek/rtw89/fw.c
+index de1f23779fc62..3b7af8faca505 100644
+--- a/drivers/net/wireless/realtek/rtw89/fw.c
++++ b/drivers/net/wireless/realtek/rtw89/fw.c
+@@ -2665,8 +2665,10 @@ static int rtw89_append_probe_req_ie(struct rtw89_dev *rtwdev,
+
+ list_add_tail(&info->list, &scan_info->pkt_list[band]);
+ ret = rtw89_fw_h2c_add_pkt_offload(rtwdev, &info->id, new);
+- if (ret)
++ if (ret) {
++ kfree_skb(new);
+ goto out;
++ }
+
+ kfree_skb(new);
+ }
+--
+2.39.2
+
--- /dev/null
+From c848311e49956e079185bb5f4cd3455d720912e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Nov 2022 19:38:22 +0800
+Subject: wifi: wilc1000: add missing unregister_netdev() in
+ wilc_netdev_ifc_init()
+
+From: Wang Yufen <wangyufen@huawei.com>
+
+[ Upstream commit 2b88974ecb358990e1c33fabcd0b9e142bab7f21 ]
+
+Fault injection test reports this issue:
+
+kernel BUG at net/core/dev.c:10731!
+invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI
+Call Trace:
+ <TASK>
+ wilc_netdev_ifc_init+0x19f/0x220 [wilc1000 884bf126e9e98af6a708f266a8dffd53f99e4bf5]
+ wilc_cfg80211_init+0x30c/0x380 [wilc1000 884bf126e9e98af6a708f266a8dffd53f99e4bf5]
+ wilc_bus_probe+0xad/0x2b0 [wilc1000_spi 1520a7539b6589cc6cde2ae826a523a33f8bacff]
+ spi_probe+0xe4/0x140
+ really_probe+0x17e/0x3f0
+ __driver_probe_device+0xe3/0x170
+ driver_probe_device+0x49/0x120
+
+The root case here is alloc_ordered_workqueue() fails, but
+cfg80211_unregister_netdevice() or unregister_netdev() not be called in
+error handling path. To fix add unregister_netdev goto lable to add the
+unregister operation in error handling path.
+
+Fixes: 09ed8bfc5215 ("wilc1000: Rename workqueue from "WILC_wq" to "NETDEV-wq"")
+Signed-off-by: Wang Yufen <wangyufen@huawei.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/1669289902-23639-1-git-send-email-wangyufen@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/microchip/wilc1000/netdev.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/microchip/wilc1000/netdev.c b/drivers/net/wireless/microchip/wilc1000/netdev.c
+index 6f3ae0dff77ce..e9f59de31b0b9 100644
+--- a/drivers/net/wireless/microchip/wilc1000/netdev.c
++++ b/drivers/net/wireless/microchip/wilc1000/netdev.c
+@@ -981,7 +981,7 @@ struct wilc_vif *wilc_netdev_ifc_init(struct wilc *wl, const char *name,
+ ndev->name);
+ if (!wl->hif_workqueue) {
+ ret = -ENOMEM;
+- goto error;
++ goto unregister_netdev;
+ }
+
+ ndev->needs_free_netdev = true;
+@@ -996,6 +996,11 @@ struct wilc_vif *wilc_netdev_ifc_init(struct wilc *wl, const char *name,
+
+ return vif;
+
++unregister_netdev:
++ if (rtnl_locked)
++ cfg80211_unregister_netdevice(ndev);
++ else
++ unregister_netdev(ndev);
+ error:
+ free_netdev(ndev);
+ return ERR_PTR(ret);
+--
+2.39.2
+
--- /dev/null
+From c6b1899e5d0dcb03a90a9c64b2c0581223cd702e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Nov 2022 19:36:03 +0800
+Subject: wifi: wilc1000: fix potential memory leak in wilc_mac_xmit()
+
+From: Zhang Changzhong <zhangchangzhong@huawei.com>
+
+[ Upstream commit deb962ec9e1c9a81babd3d37542ad4bd6ac3396e ]
+
+The wilc_mac_xmit() returns NETDEV_TX_OK without freeing skb, add
+dev_kfree_skb() to fix it. Compile tested only.
+
+Fixes: c5c77ba18ea6 ("staging: wilc1000: Add SDIO/SPI 802.11 driver")
+Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/1668684964-48622-1-git-send-email-zhangchangzhong@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/microchip/wilc1000/netdev.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/wireless/microchip/wilc1000/netdev.c b/drivers/net/wireless/microchip/wilc1000/netdev.c
+index 9b319a455b96d..6f3ae0dff77ce 100644
+--- a/drivers/net/wireless/microchip/wilc1000/netdev.c
++++ b/drivers/net/wireless/microchip/wilc1000/netdev.c
+@@ -730,6 +730,7 @@ netdev_tx_t wilc_mac_xmit(struct sk_buff *skb, struct net_device *ndev)
+
+ if (skb->dev != ndev) {
+ netdev_err(ndev, "Packet not destined to this device\n");
++ dev_kfree_skb(skb);
+ return NETDEV_TX_OK;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 74ccae46abd3f4ba322613537801d99c85ed563f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Dec 2022 23:04:53 +0800
+Subject: wifi: wl3501_cs: don't call kfree_skb() under spin_lock_irqsave()
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit 44bacbdf9066c590423259dbd6d520baac99c1a8 ]
+
+It is not allowed to call kfree_skb() from hardware interrupt
+context or with interrupts being disabled. So replace kfree_skb()
+with dev_kfree_skb_irq() under spin_lock_irqsave(). Compile
+tested only.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20221207150453.114742-1-yangyingliang@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/wl3501_cs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/wl3501_cs.c b/drivers/net/wireless/wl3501_cs.c
+index 1b532e00a56fb..7fb2f95134760 100644
+--- a/drivers/net/wireless/wl3501_cs.c
++++ b/drivers/net/wireless/wl3501_cs.c
+@@ -1328,7 +1328,7 @@ static netdev_tx_t wl3501_hard_start_xmit(struct sk_buff *skb,
+ } else {
+ ++dev->stats.tx_packets;
+ dev->stats.tx_bytes += skb->len;
+- kfree_skb(skb);
++ dev_kfree_skb_irq(skb);
+
+ if (this->tx_buffer_cnt < 2)
+ netif_stop_queue(dev);
+--
+2.39.2
+
--- /dev/null
+From e714340ee7ae5a8d5019691f3c249d0741f86a26 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Jan 2023 16:14:27 +0000
+Subject: workqueue: Protects wq_unbound_cpumask with wq_pool_attach_mutex
+
+From: Lai Jiangshan <jiangshan.ljs@antgroup.com>
+
+[ Upstream commit 99c621ef243bda726fb8d982a274ded96570b410 ]
+
+When unbind_workers() reads wq_unbound_cpumask to set the affinity of
+freshly-unbound kworkers, it only holds wq_pool_attach_mutex. This isn't
+sufficient as wq_unbound_cpumask is only protected by wq_pool_mutex.
+
+Make wq_unbound_cpumask protected with wq_pool_attach_mutex and also
+remove the need of temporary saved_cpumask.
+
+Fixes: 10a5a651e3af ("workqueue: Restrict kworker in the offline CPU pool running on housekeeping CPUs")
+Reported-by: Valentin Schneider <vschneid@redhat.com>
+Signed-off-by: Lai Jiangshan <jiangshan.ljs@antgroup.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/workqueue.c | 41 ++++++++++++++++-------------------------
+ 1 file changed, 16 insertions(+), 25 deletions(-)
+
+diff --git a/kernel/workqueue.c b/kernel/workqueue.c
+index 07895deca2711..76ea87b0251ce 100644
+--- a/kernel/workqueue.c
++++ b/kernel/workqueue.c
+@@ -326,7 +326,7 @@ static struct rcuwait manager_wait = __RCUWAIT_INITIALIZER(manager_wait);
+ static LIST_HEAD(workqueues); /* PR: list of all workqueues */
+ static bool workqueue_freezing; /* PL: have wqs started freezing? */
+
+-/* PL: allowable cpus for unbound wqs and work items */
++/* PL&A: allowable cpus for unbound wqs and work items */
+ static cpumask_var_t wq_unbound_cpumask;
+
+ /* CPU where unbound work was last round robin scheduled from this CPU */
+@@ -3952,7 +3952,8 @@ static void apply_wqattrs_cleanup(struct apply_wqattrs_ctx *ctx)
+ /* allocate the attrs and pwqs for later installation */
+ static struct apply_wqattrs_ctx *
+ apply_wqattrs_prepare(struct workqueue_struct *wq,
+- const struct workqueue_attrs *attrs)
++ const struct workqueue_attrs *attrs,
++ const cpumask_var_t unbound_cpumask)
+ {
+ struct apply_wqattrs_ctx *ctx;
+ struct workqueue_attrs *new_attrs, *tmp_attrs;
+@@ -3968,14 +3969,15 @@ apply_wqattrs_prepare(struct workqueue_struct *wq,
+ goto out_free;
+
+ /*
+- * Calculate the attrs of the default pwq.
++ * Calculate the attrs of the default pwq with unbound_cpumask
++ * which is wq_unbound_cpumask or to set to wq_unbound_cpumask.
+ * If the user configured cpumask doesn't overlap with the
+ * wq_unbound_cpumask, we fallback to the wq_unbound_cpumask.
+ */
+ copy_workqueue_attrs(new_attrs, attrs);
+- cpumask_and(new_attrs->cpumask, new_attrs->cpumask, wq_unbound_cpumask);
++ cpumask_and(new_attrs->cpumask, new_attrs->cpumask, unbound_cpumask);
+ if (unlikely(cpumask_empty(new_attrs->cpumask)))
+- cpumask_copy(new_attrs->cpumask, wq_unbound_cpumask);
++ cpumask_copy(new_attrs->cpumask, unbound_cpumask);
+
+ /*
+ * We may create multiple pwqs with differing cpumasks. Make a
+@@ -4072,7 +4074,7 @@ static int apply_workqueue_attrs_locked(struct workqueue_struct *wq,
+ wq->flags &= ~__WQ_ORDERED;
+ }
+
+- ctx = apply_wqattrs_prepare(wq, attrs);
++ ctx = apply_wqattrs_prepare(wq, attrs, wq_unbound_cpumask);
+ if (!ctx)
+ return -ENOMEM;
+
+@@ -5334,7 +5336,7 @@ void thaw_workqueues(void)
+ }
+ #endif /* CONFIG_FREEZER */
+
+-static int workqueue_apply_unbound_cpumask(void)
++static int workqueue_apply_unbound_cpumask(const cpumask_var_t unbound_cpumask)
+ {
+ LIST_HEAD(ctxs);
+ int ret = 0;
+@@ -5350,7 +5352,7 @@ static int workqueue_apply_unbound_cpumask(void)
+ if (wq->flags & __WQ_ORDERED)
+ continue;
+
+- ctx = apply_wqattrs_prepare(wq, wq->unbound_attrs);
++ ctx = apply_wqattrs_prepare(wq, wq->unbound_attrs, unbound_cpumask);
+ if (!ctx) {
+ ret = -ENOMEM;
+ break;
+@@ -5365,6 +5367,11 @@ static int workqueue_apply_unbound_cpumask(void)
+ apply_wqattrs_cleanup(ctx);
+ }
+
++ if (!ret) {
++ mutex_lock(&wq_pool_attach_mutex);
++ cpumask_copy(wq_unbound_cpumask, unbound_cpumask);
++ mutex_unlock(&wq_pool_attach_mutex);
++ }
+ return ret;
+ }
+
+@@ -5383,7 +5390,6 @@ static int workqueue_apply_unbound_cpumask(void)
+ int workqueue_set_unbound_cpumask(cpumask_var_t cpumask)
+ {
+ int ret = -EINVAL;
+- cpumask_var_t saved_cpumask;
+
+ /*
+ * Not excluding isolated cpus on purpose.
+@@ -5397,23 +5403,8 @@ int workqueue_set_unbound_cpumask(cpumask_var_t cpumask)
+ goto out_unlock;
+ }
+
+- if (!zalloc_cpumask_var(&saved_cpumask, GFP_KERNEL)) {
+- ret = -ENOMEM;
+- goto out_unlock;
+- }
+-
+- /* save the old wq_unbound_cpumask. */
+- cpumask_copy(saved_cpumask, wq_unbound_cpumask);
+-
+- /* update wq_unbound_cpumask at first and apply it to wqs. */
+- cpumask_copy(wq_unbound_cpumask, cpumask);
+- ret = workqueue_apply_unbound_cpumask();
+-
+- /* restore the wq_unbound_cpumask when failed. */
+- if (ret < 0)
+- cpumask_copy(wq_unbound_cpumask, saved_cpumask);
++ ret = workqueue_apply_unbound_cpumask(cpumask);
+
+- free_cpumask_var(saved_cpumask);
+ out_unlock:
+ apply_wqattrs_unlock();
+ }
+--
+2.39.2
+
--- /dev/null
+From 8b83281a8f69cc1699340bca4c0e1bb8f27d0e49 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Jan 2023 04:10:59 +0000
+Subject: x86/acpi/boot: Do not register processors that cannot be onlined for
+ x2APIC
+
+From: Kishon Vijay Abraham I <kvijayab@amd.com>
+
+[ Upstream commit e2869bd7af608c343988429ceb1c2fe99644a01f ]
+
+Section 5.2.12.12 Processor Local x2APIC Structure in the ACPI v6.5
+spec mandates that both "enabled" and "online capable" Local APIC Flags
+should be used to determine if the processor is usable or not.
+
+However, Linux doesn't use the "online capable" flag for x2APIC to
+determine if the processor is usable. As a result, cpu_possible_mask has
+incorrect value and results in more memory getting allocated for per_cpu
+variables than it is going to be used.
+
+Make sure Linux parses both "enabled" and "online capable" flags for
+x2APIC to correctly determine if the processor is usable.
+
+Fixes: aa06e20f1be6 ("x86/ACPI: Don't add CPUs that are not online capable")
+Reported-by: Leo Duran <leo.duran@amd.com>
+Signed-off-by: Kishon Vijay Abraham I <kvijayab@amd.com>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Reviewed-by: Borislav Petkov (AMD) <bp@alien8.de>
+Reviewed-by: Zhang Rui <rui.zhang@intel.com>
+Acked-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Link: https://lore.kernel.org/r/20230105041059.39366-1-kvijayab@amd.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/acpi/boot.c | 19 ++++++++++++++++---
+ 1 file changed, 16 insertions(+), 3 deletions(-)
+
+diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c
+index 907cc98b19380..518bda50068cb 100644
+--- a/arch/x86/kernel/acpi/boot.c
++++ b/arch/x86/kernel/acpi/boot.c
+@@ -188,6 +188,17 @@ static int acpi_register_lapic(int id, u32 acpiid, u8 enabled)
+ return cpu;
+ }
+
++static bool __init acpi_is_processor_usable(u32 lapic_flags)
++{
++ if (lapic_flags & ACPI_MADT_ENABLED)
++ return true;
++
++ if (acpi_support_online_capable && (lapic_flags & ACPI_MADT_ONLINE_CAPABLE))
++ return true;
++
++ return false;
++}
++
+ static int __init
+ acpi_parse_x2apic(union acpi_subtable_headers *header, const unsigned long end)
+ {
+@@ -212,6 +223,10 @@ acpi_parse_x2apic(union acpi_subtable_headers *header, const unsigned long end)
+ if (apic_id == 0xffffffff)
+ return 0;
+
++ /* don't register processors that cannot be onlined */
++ if (!acpi_is_processor_usable(processor->lapic_flags))
++ return 0;
++
+ /*
+ * We need to register disabled CPU as well to permit
+ * counting disabled CPUs. This allows us to size
+@@ -250,9 +265,7 @@ acpi_parse_lapic(union acpi_subtable_headers * header, const unsigned long end)
+ return 0;
+
+ /* don't register processors that can not be onlined */
+- if (acpi_support_online_capable &&
+- !(processor->lapic_flags & ACPI_MADT_ENABLED) &&
+- !(processor->lapic_flags & ACPI_MADT_ONLINE_CAPABLE))
++ if (!acpi_is_processor_usable(processor->lapic_flags))
+ return 0;
+
+ /*
+--
+2.39.2
+
--- /dev/null
+From 06f333f99a7cfe4332b441448ae20115fe7d25cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Nov 2022 07:31:48 -0800
+Subject: x86/bugs: Reset speculation control settings on init
+
+From: Breno Leitao <leitao@debian.org>
+
+[ Upstream commit 0125acda7d76b943ca55811df40ed6ec0ecf670f ]
+
+Currently, x86_spec_ctrl_base is read at boot time and speculative bits
+are set if Kconfig items are enabled. For example, IBRS is enabled if
+CONFIG_CPU_IBRS_ENTRY is configured, etc. These MSR bits are not cleared
+if the mitigations are disabled.
+
+This is a problem when kexec-ing a kernel that has the mitigation
+disabled from a kernel that has the mitigation enabled. In this case,
+the MSR bits are not cleared during the new kernel boot. As a result,
+this might have some performance degradation that is hard to pinpoint.
+
+This problem does not happen if the machine is (hard) rebooted because
+the bit will be cleared by default.
+
+ [ bp: Massage. ]
+
+Suggested-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
+Signed-off-by: Breno Leitao <leitao@debian.org>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Link: https://lore.kernel.org/r/20221128153148.1129350-1-leitao@debian.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/include/asm/msr-index.h | 4 ++++
+ arch/x86/kernel/cpu/bugs.c | 10 +++++++++-
+ 2 files changed, 13 insertions(+), 1 deletion(-)
+
+diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h
+index d3fe82c5d6b66..978a3e203cdbb 100644
+--- a/arch/x86/include/asm/msr-index.h
++++ b/arch/x86/include/asm/msr-index.h
+@@ -49,6 +49,10 @@
+ #define SPEC_CTRL_RRSBA_DIS_S_SHIFT 6 /* Disable RRSBA behavior */
+ #define SPEC_CTRL_RRSBA_DIS_S BIT(SPEC_CTRL_RRSBA_DIS_S_SHIFT)
+
++/* A mask for bits which the kernel toggles when controlling mitigations */
++#define SPEC_CTRL_MITIGATIONS_MASK (SPEC_CTRL_IBRS | SPEC_CTRL_STIBP | SPEC_CTRL_SSBD \
++ | SPEC_CTRL_RRSBA_DIS_S)
++
+ #define MSR_IA32_PRED_CMD 0x00000049 /* Prediction Command */
+ #define PRED_CMD_IBPB BIT(0) /* Indirect Branch Prediction Barrier */
+
+diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
+index bca0bd8f48464..374bc620fb867 100644
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -144,9 +144,17 @@ void __init check_bugs(void)
+ * have unknown values. AMD64_LS_CFG MSR is cached in the early AMD
+ * init code as it is not enumerated and depends on the family.
+ */
+- if (boot_cpu_has(X86_FEATURE_MSR_SPEC_CTRL))
++ if (cpu_feature_enabled(X86_FEATURE_MSR_SPEC_CTRL)) {
+ rdmsrl(MSR_IA32_SPEC_CTRL, x86_spec_ctrl_base);
+
++ /*
++ * Previously running kernel (kexec), may have some controls
++ * turned ON. Clear them and let the mitigations setup below
++ * rediscover them based on configuration.
++ */
++ x86_spec_ctrl_base &= ~SPEC_CTRL_MITIGATIONS_MASK;
++ }
++
+ /* Select the proper CPU mitigations before patching alternatives: */
+ spectre_v1_select_mitigation();
+ spectre_v2_select_mitigation();
+--
+2.39.2
+
--- /dev/null
+From 214e6c28a29204c5017f3c0ecf81665f1d1cce67 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Jan 2023 08:23:20 -0700
+Subject: x86/fpu: Don't set TIF_NEED_FPU_LOAD for PF_IO_WORKER threads
+
+From: Jens Axboe <axboe@kernel.dk>
+
+[ Upstream commit cb3ea4b7671b7cfbac3ee609976b790aebd0bbda ]
+
+We don't set it on PF_KTHREAD threads as they never return to userspace,
+and PF_IO_WORKER threads are identical in that regard. As they keep
+running in the kernel until they die, skip setting the FPU flag on them.
+
+More of a cosmetic thing that was found while debugging and
+issue and pondering why the FPU flag is set on these threads.
+
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Acked-by: Peter Zijlstra <peterz@infradead.org>
+Link: https://lore.kernel.org/r/560c844c-f128-555b-40c6-31baff27537f@kernel.dk
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/include/asm/fpu/sched.h | 2 +-
+ arch/x86/kernel/fpu/context.h | 2 +-
+ arch/x86/kernel/fpu/core.c | 2 +-
+ 3 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/x86/include/asm/fpu/sched.h b/arch/x86/include/asm/fpu/sched.h
+index b2486b2cbc6e0..c2d6cd78ed0c2 100644
+--- a/arch/x86/include/asm/fpu/sched.h
++++ b/arch/x86/include/asm/fpu/sched.h
+@@ -39,7 +39,7 @@ extern void fpu_flush_thread(void);
+ static inline void switch_fpu_prepare(struct fpu *old_fpu, int cpu)
+ {
+ if (cpu_feature_enabled(X86_FEATURE_FPU) &&
+- !(current->flags & PF_KTHREAD)) {
++ !(current->flags & (PF_KTHREAD | PF_IO_WORKER))) {
+ save_fpregs_to_fpstate(old_fpu);
+ /*
+ * The save operation preserved register state, so the
+diff --git a/arch/x86/kernel/fpu/context.h b/arch/x86/kernel/fpu/context.h
+index 958accf2ccf07..9fcfa5c4dad79 100644
+--- a/arch/x86/kernel/fpu/context.h
++++ b/arch/x86/kernel/fpu/context.h
+@@ -57,7 +57,7 @@ static inline void fpregs_restore_userregs(void)
+ struct fpu *fpu = ¤t->thread.fpu;
+ int cpu = smp_processor_id();
+
+- if (WARN_ON_ONCE(current->flags & PF_KTHREAD))
++ if (WARN_ON_ONCE(current->flags & (PF_KTHREAD | PF_IO_WORKER)))
+ return;
+
+ if (!fpregs_state_valid(fpu, cpu)) {
+diff --git a/arch/x86/kernel/fpu/core.c b/arch/x86/kernel/fpu/core.c
+index dccce58201b7c..caf33486dc5ee 100644
+--- a/arch/x86/kernel/fpu/core.c
++++ b/arch/x86/kernel/fpu/core.c
+@@ -426,7 +426,7 @@ void kernel_fpu_begin_mask(unsigned int kfpu_mask)
+
+ this_cpu_write(in_kernel_fpu, true);
+
+- if (!(current->flags & PF_KTHREAD) &&
++ if (!(current->flags & (PF_KTHREAD | PF_IO_WORKER)) &&
+ !test_thread_flag(TIF_NEED_FPU_LOAD)) {
+ set_thread_flag(TIF_NEED_FPU_LOAD);
+ save_fpregs_to_fpstate(¤t->thread.fpu);
+--
+2.39.2
+
--- /dev/null
+From 60a166533c050b5addd346c27816487b9834c54f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Jan 2023 07:35:50 -0800
+Subject: x86/microcode: Add a parameter to microcode_check() to store CPU
+ capabilities
+
+From: Ashok Raj <ashok.raj@intel.com>
+
+[ Upstream commit ab31c74455c64e69342ddab21fd9426fcbfefde7 ]
+
+Add a parameter to store CPU capabilities before performing a microcode
+update so that CPU capabilities can be compared before and after update.
+
+ [ bp: Massage. ]
+
+Signed-off-by: Ashok Raj <ashok.raj@intel.com>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Link: https://lore.kernel.org/r/20230109153555.4986-2-ashok.raj@intel.com
+Stable-dep-of: c0dd9245aa9e ("x86/microcode: Check CPU capabilities after late microcode update correctly")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/include/asm/processor.h | 2 +-
+ arch/x86/kernel/cpu/common.c | 21 +++++++++++++--------
+ arch/x86/kernel/cpu/microcode/core.c | 3 ++-
+ 3 files changed, 16 insertions(+), 10 deletions(-)
+
+diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
+index 4e35c66edeb7d..f256a4ddd25da 100644
+--- a/arch/x86/include/asm/processor.h
++++ b/arch/x86/include/asm/processor.h
+@@ -697,7 +697,7 @@ bool xen_set_default_idle(void);
+ #endif
+
+ void __noreturn stop_this_cpu(void *dummy);
+-void microcode_check(void);
++void microcode_check(struct cpuinfo_x86 *prev_info);
+
+ enum l1tf_mitigations {
+ L1TF_MITIGATION_OFF,
+diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
+index f3cc7699e1e1b..cda7ded29213e 100644
+--- a/arch/x86/kernel/cpu/common.c
++++ b/arch/x86/kernel/cpu/common.c
+@@ -2302,30 +2302,35 @@ void cpu_init_secondary(void)
+ #endif
+
+ #ifdef CONFIG_MICROCODE_LATE_LOADING
+-/*
++/**
++ * microcode_check() - Check if any CPU capabilities changed after an update.
++ * @prev_info: CPU capabilities stored before an update.
++ *
+ * The microcode loader calls this upon late microcode load to recheck features,
+ * only when microcode has been updated. Caller holds microcode_mutex and CPU
+ * hotplug lock.
++ *
++ * Return: None
+ */
+-void microcode_check(void)
++void microcode_check(struct cpuinfo_x86 *prev_info)
+ {
+- struct cpuinfo_x86 info;
+-
+ perf_check_microcode();
+
+ /* Reload CPUID max function as it might've changed. */
+- info.cpuid_level = cpuid_eax(0);
++ prev_info->cpuid_level = cpuid_eax(0);
+
+ /*
+ * Copy all capability leafs to pick up the synthetic ones so that
+ * memcmp() below doesn't fail on that. The ones coming from CPUID will
+ * get overwritten in get_cpu_cap().
+ */
+- memcpy(&info.x86_capability, &boot_cpu_data.x86_capability, sizeof(info.x86_capability));
++ memcpy(&prev_info->x86_capability, &boot_cpu_data.x86_capability,
++ sizeof(prev_info->x86_capability));
+
+- get_cpu_cap(&info);
++ get_cpu_cap(prev_info);
+
+- if (!memcmp(&info.x86_capability, &boot_cpu_data.x86_capability, sizeof(info.x86_capability)))
++ if (!memcmp(&prev_info->x86_capability, &boot_cpu_data.x86_capability,
++ sizeof(prev_info->x86_capability)))
+ return;
+
+ pr_warn("x86/CPU: CPU features have changed after loading microcode, but might not take effect.\n");
+diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c
+index 712aafff96e03..b2068ce2c86bf 100644
+--- a/arch/x86/kernel/cpu/microcode/core.c
++++ b/arch/x86/kernel/cpu/microcode/core.c
+@@ -438,6 +438,7 @@ static int __reload_late(void *info)
+ static int microcode_reload_late(void)
+ {
+ int old = boot_cpu_data.microcode, ret;
++ struct cpuinfo_x86 prev_info;
+
+ pr_err("Attempting late microcode loading - it is dangerous and taints the kernel.\n");
+ pr_err("You should switch to early loading, if possible.\n");
+@@ -447,7 +448,7 @@ static int microcode_reload_late(void)
+
+ ret = stop_machine_cpuslocked(__reload_late, NULL, cpu_online_mask);
+ if (ret == 0)
+- microcode_check();
++ microcode_check(&prev_info);
+
+ pr_info("Reload completed, microcode revision: 0x%x -> 0x%x\n",
+ old, boot_cpu_data.microcode);
+--
+2.39.2
+
--- /dev/null
+From 4b7310817948535e0464df4f3081931930e012ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Jan 2023 07:35:52 -0800
+Subject: x86/microcode: Adjust late loading result reporting message
+
+From: Ashok Raj <ashok.raj@intel.com>
+
+[ Upstream commit 6eab3abac7043226e5375e9ead0c7607ced6767b ]
+
+During late microcode loading, the "Reload completed" message is issued
+unconditionally, regardless of success or failure.
+
+Adjust the message to report the result of the update.
+
+ [ bp: Massage. ]
+
+Fixes: 9bd681251b7c ("x86/microcode: Announce reload operation's completion")
+Suggested-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Ashok Raj <ashok.raj@intel.com>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Reviewed-by: Tony Luck <tony.luck@intel.com>
+Link: https://lore.kernel.org/lkml/874judpqqd.ffs@tglx/
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/cpu/microcode/core.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c
+index a25ba851a9208..3c4e732a61dff 100644
+--- a/arch/x86/kernel/cpu/microcode/core.c
++++ b/arch/x86/kernel/cpu/microcode/core.c
+@@ -453,11 +453,14 @@ static int microcode_reload_late(void)
+ store_cpu_caps(&prev_info);
+
+ ret = stop_machine_cpuslocked(__reload_late, NULL, cpu_online_mask);
+- if (ret == 0)
++ if (!ret) {
++ pr_info("Reload succeeded, microcode revision: 0x%x -> 0x%x\n",
++ old, boot_cpu_data.microcode);
+ microcode_check(&prev_info);
+-
+- pr_info("Reload completed, microcode revision: 0x%x -> 0x%x\n",
+- old, boot_cpu_data.microcode);
++ } else {
++ pr_info("Reload failed, current microcode revision: 0x%x\n",
++ boot_cpu_data.microcode);
++ }
+
+ return ret;
+ }
+--
+2.39.2
+
--- /dev/null
+From 1572e6f4fc0c26f64891a33d914b059f6458e1f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Jan 2023 07:35:51 -0800
+Subject: x86/microcode: Check CPU capabilities after late microcode update
+ correctly
+
+From: Ashok Raj <ashok.raj@intel.com>
+
+[ Upstream commit c0dd9245aa9e25a697181f6085692272c9ec61bc ]
+
+The kernel caches each CPU's feature bits at boot in an x86_capability[]
+structure. However, the capabilities in the BSP's copy can be turned off
+as a result of certain command line parameters or configuration
+restrictions, for example the SGX bit. This can cause a mismatch when
+comparing the values before and after the microcode update.
+
+Another example is X86_FEATURE_SRBDS_CTRL which gets added only after
+microcode update:
+
+ --- cpuid.before 2023-01-21 14:54:15.652000747 +0100
+ +++ cpuid.after 2023-01-21 14:54:26.632001024 +0100
+ @@ -10,7 +10,7 @@ CPU:
+ 0x00000004 0x04: eax=0x00000000 ebx=0x00000000 ecx=0x00000000 edx=0x00000000
+ 0x00000005 0x00: eax=0x00000040 ebx=0x00000040 ecx=0x00000003 edx=0x11142120
+ 0x00000006 0x00: eax=0x000027f7 ebx=0x00000002 ecx=0x00000001 edx=0x00000000
+ - 0x00000007 0x00: eax=0x00000000 ebx=0x029c6fbf ecx=0x40000000 edx=0xbc002400
+ + 0x00000007 0x00: eax=0x00000000 ebx=0x029c6fbf ecx=0x40000000 edx=0xbc002e00
+ ^^^
+
+and which proves for a gazillionth time that late loading is a bad bad
+idea.
+
+microcode_check() is called after an update to report any previously
+cached CPUID bits which might have changed due to the update.
+
+Therefore, store the cached CPU caps before the update and compare them
+with the CPU caps after the microcode update has succeeded.
+
+Thus, the comparison is done between the CPUID *hardware* bits before
+and after the upgrade instead of using the cached, possibly runtime
+modified values in BSP's boot_cpu_data copy.
+
+As a result, false warnings about CPUID bits changes are avoided.
+
+ [ bp:
+ - Massage.
+ - Add SRBDS_CTRL example.
+ - Add kernel-doc.
+ - Incorporate forgotten review feedback from dhansen.
+ ]
+
+Fixes: 1008c52c09dc ("x86/CPU: Add a microcode loader callback")
+Signed-off-by: Ashok Raj <ashok.raj@intel.com>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Link: https://lore.kernel.org/r/20230109153555.4986-3-ashok.raj@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/include/asm/processor.h | 1 +
+ arch/x86/kernel/cpu/common.c | 36 ++++++++++++++++++----------
+ arch/x86/kernel/cpu/microcode/core.c | 6 +++++
+ 3 files changed, 30 insertions(+), 13 deletions(-)
+
+diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
+index f256a4ddd25da..a77dee6a2bf2e 100644
+--- a/arch/x86/include/asm/processor.h
++++ b/arch/x86/include/asm/processor.h
+@@ -698,6 +698,7 @@ bool xen_set_default_idle(void);
+
+ void __noreturn stop_this_cpu(void *dummy);
+ void microcode_check(struct cpuinfo_x86 *prev_info);
++void store_cpu_caps(struct cpuinfo_x86 *info);
+
+ enum l1tf_mitigations {
+ L1TF_MITIGATION_OFF,
+diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
+index cda7ded29213e..6a25e93f2a87c 100644
+--- a/arch/x86/kernel/cpu/common.c
++++ b/arch/x86/kernel/cpu/common.c
+@@ -2302,6 +2302,25 @@ void cpu_init_secondary(void)
+ #endif
+
+ #ifdef CONFIG_MICROCODE_LATE_LOADING
++/**
++ * store_cpu_caps() - Store a snapshot of CPU capabilities
++ * @curr_info: Pointer where to store it
++ *
++ * Returns: None
++ */
++void store_cpu_caps(struct cpuinfo_x86 *curr_info)
++{
++ /* Reload CPUID max function as it might've changed. */
++ curr_info->cpuid_level = cpuid_eax(0);
++
++ /* Copy all capability leafs and pick up the synthetic ones. */
++ memcpy(&curr_info->x86_capability, &boot_cpu_data.x86_capability,
++ sizeof(curr_info->x86_capability));
++
++ /* Get the hardware CPUID leafs */
++ get_cpu_cap(curr_info);
++}
++
+ /**
+ * microcode_check() - Check if any CPU capabilities changed after an update.
+ * @prev_info: CPU capabilities stored before an update.
+@@ -2314,22 +2333,13 @@ void cpu_init_secondary(void)
+ */
+ void microcode_check(struct cpuinfo_x86 *prev_info)
+ {
+- perf_check_microcode();
+-
+- /* Reload CPUID max function as it might've changed. */
+- prev_info->cpuid_level = cpuid_eax(0);
++ struct cpuinfo_x86 curr_info;
+
+- /*
+- * Copy all capability leafs to pick up the synthetic ones so that
+- * memcmp() below doesn't fail on that. The ones coming from CPUID will
+- * get overwritten in get_cpu_cap().
+- */
+- memcpy(&prev_info->x86_capability, &boot_cpu_data.x86_capability,
+- sizeof(prev_info->x86_capability));
++ perf_check_microcode();
+
+- get_cpu_cap(prev_info);
++ store_cpu_caps(&curr_info);
+
+- if (!memcmp(&prev_info->x86_capability, &boot_cpu_data.x86_capability,
++ if (!memcmp(&prev_info->x86_capability, &curr_info.x86_capability,
+ sizeof(prev_info->x86_capability)))
+ return;
+
+diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c
+index b2068ce2c86bf..a25ba851a9208 100644
+--- a/arch/x86/kernel/cpu/microcode/core.c
++++ b/arch/x86/kernel/cpu/microcode/core.c
+@@ -446,6 +446,12 @@ static int microcode_reload_late(void)
+ atomic_set(&late_cpus_in, 0);
+ atomic_set(&late_cpus_out, 0);
+
++ /*
++ * Take a snapshot before the microcode update in order to compare and
++ * check whether any bits changed after an update.
++ */
++ store_cpu_caps(&prev_info);
++
+ ret = stop_machine_cpuslocked(__reload_late, NULL, cpu_online_mask);
+ if (ret == 0)
+ microcode_check(&prev_info);
+--
+2.39.2
+
--- /dev/null
+From 180bc5cfad1e3284af7e361f9723a875a9bb52ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Feb 2023 16:27:22 +0800
+Subject: x86/perf/zhaoxin: Add stepping check for ZXC
+
+From: silviazhao <silviazhao-oc@zhaoxin.com>
+
+[ Upstream commit fd636b6a9bc6034f2e5bb869658898a2b472c037 ]
+
+Some of Nano series processors will lead GP when accessing
+PMC fixed counter. Meanwhile, their hardware support for PMC
+has not announced externally. So exclude Nano CPUs from ZXC
+by checking stepping information. This is an unambiguous way
+to differentiate between ZXC and Nano CPUs.
+
+Following are Nano and ZXC FMS information:
+Nano FMS: Family=6, Model=F, Stepping=[0-A][C-D]
+ZXC FMS: Family=6, Model=F, Stepping=E-F OR
+ Family=6, Model=0x19, Stepping=0-3
+
+Fixes: 3a4ac121c2ca ("x86/perf: Add hardware performance events support for Zhaoxin CPU.")
+
+Reported-by: Arjan <8vvbbqzo567a@nospam.xutrox.com>
+Reported-by: Kevin Brace <kevinbrace@gmx.com>
+Signed-off-by: silviazhao <silviazhao-oc@zhaoxin.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=212389
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/events/zhaoxin/core.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/arch/x86/events/zhaoxin/core.c b/arch/x86/events/zhaoxin/core.c
+index 949d845c922b4..3e9acdaeed1ec 100644
+--- a/arch/x86/events/zhaoxin/core.c
++++ b/arch/x86/events/zhaoxin/core.c
+@@ -541,7 +541,13 @@ __init int zhaoxin_pmu_init(void)
+
+ switch (boot_cpu_data.x86) {
+ case 0x06:
+- if (boot_cpu_data.x86_model == 0x0f || boot_cpu_data.x86_model == 0x19) {
++ /*
++ * Support Zhaoxin CPU from ZXC series, exclude Nano series through FMS.
++ * Nano FMS: Family=6, Model=F, Stepping=[0-A][C-D]
++ * ZXC FMS: Family=6, Model=F, Stepping=E-F OR Family=6, Model=0x19, Stepping=0-3
++ */
++ if ((boot_cpu_data.x86_model == 0x0f && boot_cpu_data.x86_stepping >= 0x0e) ||
++ boot_cpu_data.x86_model == 0x19) {
+
+ x86_pmu.max_period = x86_pmu.cntval_mask >> 1;
+
+--
+2.39.2
+
--- /dev/null
+From 2e6ece505928d4f51b56c08a77e01b41ce0a0774 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 14 Jan 2023 18:33:09 +0100
+Subject: x86/signal: Fix the value returned by strict_sas_size()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit ef6dfc4b238a435ab552207ec09e4a82b6426d31 ]
+
+Functions used with __setup() return 1 when the argument has been
+successfully parsed.
+
+Reverse the returned value so that 1 is returned when kstrtobool() is
+successful (i.e. returns 0).
+
+My understanding of these __setup() functions is that returning 1 or 0
+does not change much anyway - so this is more of a cleanup than a
+functional fix.
+
+I spot it and found it spurious while looking at something else.
+Even if the output is not perfect, you'll get the idea with:
+
+ $ git grep -B2 -A10 retu.*kstrtobool | grep __setup -B10
+
+Fixes: 3aac3ebea08f ("x86/signal: Implement sigaltstack size validation")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Link: https://lore.kernel.org/r/73882d43ebe420c9d8fb82d0560021722b243000.1673717552.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/signal.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/kernel/signal.c b/arch/x86/kernel/signal.c
+index 1504eb8d25aa6..004cb30b74198 100644
+--- a/arch/x86/kernel/signal.c
++++ b/arch/x86/kernel/signal.c
+@@ -360,7 +360,7 @@ static bool strict_sigaltstack_size __ro_after_init = false;
+
+ static int __init strict_sas_size(char *arg)
+ {
+- return kstrtobool(arg, &strict_sigaltstack_size);
++ return kstrtobool(arg, &strict_sigaltstack_size) == 0;
+ }
+ __setup("strict_sas_size", strict_sas_size);
+
+--
+2.39.2
+
--- /dev/null
+From 3031e29653e6d838095f4f0116fdd0749b0fb2fc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Feb 2023 17:36:49 +0200
+Subject: xen/grant-dma-iommu: Implement a dummy probe_device() callback
+
+From: Oleksandr Tyshchenko <oleksandr_tyshchenko@epam.com>
+
+[ Upstream commit 2062f9fb6445451b189595e295765c69f43bc12e ]
+
+Update stub IOMMU driver (which main purpose is to reuse generic
+IOMMU device-tree bindings by Xen grant DMA-mapping layer on Arm)
+according to the recent changes done in the following
+commit 57365a04c921 ("iommu: Move bus setup to IOMMU device registration").
+
+With probe_device() callback being called during IOMMU device registration,
+the uninitialized callback just leads to the "kernel NULL pointer
+dereference" issue during boot. Fix that by adding a dummy callback.
+
+Looks like the release_device() callback is not mandatory to be
+implemented as IOMMU framework makes sure that callback is initialized
+before dereferencing.
+
+Reported-by: Viresh Kumar <viresh.kumar@linaro.org>
+Fixes: 57365a04c921 ("iommu: Move bus setup to IOMMU device registration")
+Signed-off-by: Oleksandr Tyshchenko <oleksandr_tyshchenko@epam.com>
+Tested-by: Viresh Kumar <viresh.kumar@linaro.org>
+Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
+Link: https://lore.kernel.org/r/20230208153649.3604857-1-olekstysh@gmail.com
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/xen/grant-dma-iommu.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/xen/grant-dma-iommu.c b/drivers/xen/grant-dma-iommu.c
+index 16b8bc0c0b33d..6a9fe02c6bfcc 100644
+--- a/drivers/xen/grant-dma-iommu.c
++++ b/drivers/xen/grant-dma-iommu.c
+@@ -16,8 +16,15 @@ struct grant_dma_iommu_device {
+ struct iommu_device iommu;
+ };
+
+-/* Nothing is really needed here */
+-static const struct iommu_ops grant_dma_iommu_ops;
++static struct iommu_device *grant_dma_iommu_probe_device(struct device *dev)
++{
++ return ERR_PTR(-ENODEV);
++}
++
++/* Nothing is really needed here except a dummy probe_device callback */
++static const struct iommu_ops grant_dma_iommu_ops = {
++ .probe_device = grant_dma_iommu_probe_device,
++};
+
+ static const struct of_device_id grant_dma_iommu_of_match[] = {
+ { .compatible = "xen,grant-dma" },
+--
+2.39.2
+
--- /dev/null
+From 932b6036971fd641608c408163a159f4c1225913 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Feb 2023 15:33:09 +0100
+Subject: xsk: check IFF_UP earlier in Tx path
+
+From: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
+
+[ Upstream commit 1596dae2f17ec5c6e8c8f0e3fec78c5ae55c1e0b ]
+
+Xsk Tx can be triggered via either sendmsg() or poll() syscalls. These
+two paths share a call to common function xsk_xmit() which has two
+sanity checks within. A pseudo code example to show the two paths:
+
+__xsk_sendmsg() : xsk_poll():
+if (unlikely(!xsk_is_bound(xs))) if (unlikely(!xsk_is_bound(xs)))
+ return -ENXIO; return mask;
+if (unlikely(need_wait)) (...)
+ return -EOPNOTSUPP; xsk_xmit()
+mark napi id
+(...)
+xsk_xmit()
+
+xsk_xmit():
+if (unlikely(!(xs->dev->flags & IFF_UP)))
+ return -ENETDOWN;
+if (unlikely(!xs->tx))
+ return -ENOBUFS;
+
+As it can be observed above, in sendmsg() napi id can be marked on
+interface that was not brought up and this causes a NULL ptr
+dereference:
+
+[31757.505631] BUG: kernel NULL pointer dereference, address: 0000000000000018
+[31757.512710] #PF: supervisor read access in kernel mode
+[31757.517936] #PF: error_code(0x0000) - not-present page
+[31757.523149] PGD 0 P4D 0
+[31757.525726] Oops: 0000 [#1] PREEMPT SMP NOPTI
+[31757.530154] CPU: 26 PID: 95641 Comm: xdpsock Not tainted 6.2.0-rc5+ #40
+[31757.536871] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0008.031920191559 03/19/2019
+[31757.547457] RIP: 0010:xsk_sendmsg+0xde/0x180
+[31757.551799] Code: 00 75 a2 48 8b 00 a8 04 75 9b 84 d2 74 69 8b 85 14 01 00 00 85 c0 75 1b 48 8b 85 28 03 00 00 48 8b 80 98 00 00 00 48 8b 40 20 <8b> 40 18 89 85 14 01 00 00 8b bd 14 01 00 00 81 ff 00 01 00 00 0f
+[31757.570840] RSP: 0018:ffffc90034f27dc0 EFLAGS: 00010246
+[31757.576143] RAX: 0000000000000000 RBX: ffffc90034f27e18 RCX: 0000000000000000
+[31757.583389] RDX: 0000000000000001 RSI: ffffc90034f27e18 RDI: ffff88984cf3c100
+[31757.590631] RBP: ffff88984714a800 R08: ffff88984714a800 R09: 0000000000000000
+[31757.597877] R10: 0000000000000001 R11: 0000000000000000 R12: 00000000fffffffa
+[31757.605123] R13: 0000000000000000 R14: 0000000000000003 R15: 0000000000000000
+[31757.612364] FS: 00007fb4c5931180(0000) GS:ffff88afdfa00000(0000) knlGS:0000000000000000
+[31757.620571] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[31757.626406] CR2: 0000000000000018 CR3: 000000184b41c003 CR4: 00000000007706e0
+[31757.633648] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[31757.640894] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+[31757.648139] PKRU: 55555554
+[31757.650894] Call Trace:
+[31757.653385] <TASK>
+[31757.655524] sock_sendmsg+0x8f/0xa0
+[31757.659077] ? sockfd_lookup_light+0x12/0x70
+[31757.663416] __sys_sendto+0xfc/0x170
+[31757.667051] ? do_sched_setscheduler+0xdb/0x1b0
+[31757.671658] __x64_sys_sendto+0x20/0x30
+[31757.675557] do_syscall_64+0x38/0x90
+[31757.679197] entry_SYSCALL_64_after_hwframe+0x72/0xdc
+[31757.687969] Code: 8e f6 ff 44 8b 4c 24 2c 4c 8b 44 24 20 41 89 c4 44 8b 54 24 28 48 8b 54 24 18 b8 2c 00 00 00 48 8b 74 24 10 8b 7c 24 08 0f 05 <48> 3d 00 f0 ff ff 77 3a 44 89 e7 48 89 44 24 08 e8 b5 8e f6 ff 48
+[31757.707007] RSP: 002b:00007ffd49c73c70 EFLAGS: 00000293 ORIG_RAX: 000000000000002c
+[31757.714694] RAX: ffffffffffffffda RBX: 000055a996565380 RCX: 00007fb4c5727c16
+[31757.721939] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003
+[31757.729184] RBP: 0000000000000040 R08: 0000000000000000 R09: 0000000000000000
+[31757.736429] R10: 0000000000000040 R11: 0000000000000293 R12: 0000000000000000
+[31757.743673] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
+[31757.754940] </TASK>
+
+To fix this, let's make xsk_xmit a function that will be responsible for
+generic Tx, where RCU is handled accordingly and pull out sanity checks
+and xs->zc handling. Populate sanity checks to __xsk_sendmsg() and
+xsk_poll().
+
+Fixes: ca2e1a627035 ("xsk: Mark napi_id on sendmsg()")
+Fixes: 18b1ab7aa76b ("xsk: Fix race at socket teardown")
+Signed-off-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
+Reviewed-by: Alexander Lobakin <aleksander.lobakin@intel.com>
+Link: https://lore.kernel.org/r/20230215143309.13145-1-maciej.fijalkowski@intel.com
+Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/xdp/xsk.c | 59 ++++++++++++++++++++++++++++-----------------------
+ 1 file changed, 33 insertions(+), 26 deletions(-)
+
+diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c
+index 9f0561b67c12e..13f62d2402e71 100644
+--- a/net/xdp/xsk.c
++++ b/net/xdp/xsk.c
+@@ -511,7 +511,7 @@ static struct sk_buff *xsk_build_skb(struct xdp_sock *xs,
+ return skb;
+ }
+
+-static int xsk_generic_xmit(struct sock *sk)
++static int __xsk_generic_xmit(struct sock *sk)
+ {
+ struct xdp_sock *xs = xdp_sk(sk);
+ u32 max_batch = TX_BATCH_SIZE;
+@@ -594,22 +594,13 @@ static int xsk_generic_xmit(struct sock *sk)
+ return err;
+ }
+
+-static int xsk_xmit(struct sock *sk)
++static int xsk_generic_xmit(struct sock *sk)
+ {
+- struct xdp_sock *xs = xdp_sk(sk);
+ int ret;
+
+- if (unlikely(!(xs->dev->flags & IFF_UP)))
+- return -ENETDOWN;
+- if (unlikely(!xs->tx))
+- return -ENOBUFS;
+-
+- if (xs->zc)
+- return xsk_wakeup(xs, XDP_WAKEUP_TX);
+-
+ /* Drop the RCU lock since the SKB path might sleep. */
+ rcu_read_unlock();
+- ret = xsk_generic_xmit(sk);
++ ret = __xsk_generic_xmit(sk);
+ /* Reaquire RCU lock before going into common code. */
+ rcu_read_lock();
+
+@@ -627,17 +618,31 @@ static bool xsk_no_wakeup(struct sock *sk)
+ #endif
+ }
+
++static int xsk_check_common(struct xdp_sock *xs)
++{
++ if (unlikely(!xsk_is_bound(xs)))
++ return -ENXIO;
++ if (unlikely(!(xs->dev->flags & IFF_UP)))
++ return -ENETDOWN;
++
++ return 0;
++}
++
+ static int __xsk_sendmsg(struct socket *sock, struct msghdr *m, size_t total_len)
+ {
+ bool need_wait = !(m->msg_flags & MSG_DONTWAIT);
+ struct sock *sk = sock->sk;
+ struct xdp_sock *xs = xdp_sk(sk);
+ struct xsk_buff_pool *pool;
++ int err;
+
+- if (unlikely(!xsk_is_bound(xs)))
+- return -ENXIO;
++ err = xsk_check_common(xs);
++ if (err)
++ return err;
+ if (unlikely(need_wait))
+ return -EOPNOTSUPP;
++ if (unlikely(!xs->tx))
++ return -ENOBUFS;
+
+ if (sk_can_busy_loop(sk)) {
+ if (xs->zc)
+@@ -649,8 +654,11 @@ static int __xsk_sendmsg(struct socket *sock, struct msghdr *m, size_t total_len
+ return 0;
+
+ pool = xs->pool;
+- if (pool->cached_need_wakeup & XDP_WAKEUP_TX)
+- return xsk_xmit(sk);
++ if (pool->cached_need_wakeup & XDP_WAKEUP_TX) {
++ if (xs->zc)
++ return xsk_wakeup(xs, XDP_WAKEUP_TX);
++ return xsk_generic_xmit(sk);
++ }
+ return 0;
+ }
+
+@@ -670,11 +678,11 @@ static int __xsk_recvmsg(struct socket *sock, struct msghdr *m, size_t len, int
+ bool need_wait = !(flags & MSG_DONTWAIT);
+ struct sock *sk = sock->sk;
+ struct xdp_sock *xs = xdp_sk(sk);
++ int err;
+
+- if (unlikely(!xsk_is_bound(xs)))
+- return -ENXIO;
+- if (unlikely(!(xs->dev->flags & IFF_UP)))
+- return -ENETDOWN;
++ err = xsk_check_common(xs);
++ if (err)
++ return err;
+ if (unlikely(!xs->rx))
+ return -ENOBUFS;
+ if (unlikely(need_wait))
+@@ -713,21 +721,20 @@ static __poll_t xsk_poll(struct file *file, struct socket *sock,
+ sock_poll_wait(file, sock, wait);
+
+ rcu_read_lock();
+- if (unlikely(!xsk_is_bound(xs))) {
+- rcu_read_unlock();
+- return mask;
+- }
++ if (xsk_check_common(xs))
++ goto skip_tx;
+
+ pool = xs->pool;
+
+ if (pool->cached_need_wakeup) {
+ if (xs->zc)
+ xsk_wakeup(xs, pool->cached_need_wakeup);
+- else
++ else if (xs->tx)
+ /* Poll needs to drive Tx also in copy mode */
+- xsk_xmit(sk);
++ xsk_generic_xmit(sk);
+ }
+
++skip_tx:
+ if (xs->rx && !xskq_prod_is_empty(xs->rx))
+ mask |= EPOLLIN | EPOLLRDNORM;
+ if (xs->tx && xsk_tx_writeable(xs))
+--
+2.39.2
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
