--- /dev/null
+From 17d2dbc68d13f23d3fca3e5a33d6823635e3ab53 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Oct 2022 15:41:04 +0300
+Subject: ARM: at91: pm: avoid soft resetting AC DLL
+
+From: Claudiu Beznea <claudiu.beznea@microchip.com>
+
+[ Upstream commit cef8cdc0d0e7c701fe4dcfba4ed3fd25d28a6020 ]
+
+Do not soft reset AC DLL as controller is buggy and this operation my
+introduce glitches in the controller leading to undefined behavior.
+
+Fixes: f0bbf17958e8 ("ARM: at91: pm: add self-refresh support for sama7g5")
+Depends-on: a02875c4cbd6 ("ARM: at91: pm: fix self-refresh for sama7g5")
+Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Link: https://lore.kernel.org/r/20221026124114.985876-2-claudiu.beznea@microchip.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-at91/pm_suspend.S | 7 ++++++-
+ include/soc/at91/sama7-ddr.h | 5 ++++-
+ 2 files changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/mach-at91/pm_suspend.S b/arch/arm/mach-at91/pm_suspend.S
+index ffed4d949042..e4904faf1753 100644
+--- a/arch/arm/mach-at91/pm_suspend.S
++++ b/arch/arm/mach-at91/pm_suspend.S
+@@ -169,10 +169,15 @@ sr_ena_2:
+ cmp tmp1, #UDDRC_STAT_SELFREF_TYPE_SW
+ bne sr_ena_2
+
+- /* Put DDR PHY's DLL in bypass mode for non-backup modes. */
++ /* Disable DX DLLs for non-backup modes. */
+ cmp r7, #AT91_PM_BACKUP
+ beq sr_ena_3
+
++ /* Do not soft reset the AC DLL. */
++ ldr tmp1, [r3, DDR3PHY_ACDLLCR]
++ bic tmp1, tmp1, DDR3PHY_ACDLLCR_DLLSRST
++ str tmp1, [r3, DDR3PHY_ACDLLCR]
++
+ /* Disable DX DLLs. */
+ ldr tmp1, [r3, #DDR3PHY_DX0DLLCR]
+ orr tmp1, tmp1, #DDR3PHY_DXDLLCR_DLLDIS
+diff --git a/include/soc/at91/sama7-ddr.h b/include/soc/at91/sama7-ddr.h
+index 6ce3bd22f6c6..5ad7ac2e3a7c 100644
+--- a/include/soc/at91/sama7-ddr.h
++++ b/include/soc/at91/sama7-ddr.h
+@@ -26,7 +26,10 @@
+ #define DDR3PHY_PGSR (0x0C) /* DDR3PHY PHY General Status Register */
+ #define DDR3PHY_PGSR_IDONE (1 << 0) /* Initialization Done */
+
+-#define DDR3PHY_ACIOCR (0x24) /* DDR3PHY AC I/O Configuration Register */
++#define DDR3PHY_ACDLLCR (0x14) /* DDR3PHY AC DLL Control Register */
++#define DDR3PHY_ACDLLCR_DLLSRST (1 << 30) /* DLL Soft Reset */
++
++#define DDR3PHY_ACIOCR (0x24) /* DDR3PHY AC I/O Configuration Register */
+ #define DDR3PHY_ACIOCR_CSPDD_CS0 (1 << 18) /* CS#[0] Power Down Driver */
+ #define DDR3PHY_ACIOCR_CKPDD_CK0 (1 << 8) /* CK[0] Power Down Driver */
+ #define DDR3PHY_ACIORC_ACPDD (1 << 3) /* AC Power Down Driver */
+--
+2.35.1
+
--- /dev/null
+From f99f1cb264161b6e989b1706e70cb25d912626fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Oct 2022 11:31:19 +0300
+Subject: ARM: dts: at91: sama7g5: fix signal name of pin PB2
+
+From: Mihai Sain <mihai.sain@microchip.com>
+
+[ Upstream commit 2b4337c8409b4e9e5aed15c597e4031dd567bdd8 ]
+
+The signal name of pin PB2 with function F is FLEXCOM11_IO1
+as it is defined in the datasheet.
+
+Fixes: 7540629e2fc7 ("ARM: dts: at91: add sama7g5 SoC DT and sama7g5-ek")
+Signed-off-by: Mihai Sain <mihai.sain@microchip.com>
+Reviewed-by: Tudor Ambarus <tudor.ambarus@microchip.com>
+Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Link: https://lore.kernel.org/r/20221017083119.1643-1-mihai.sain@microchip.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/sama7g5-pinfunc.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/sama7g5-pinfunc.h b/arch/arm/boot/dts/sama7g5-pinfunc.h
+index 4eb30445d205..6e87f0d4b8fc 100644
+--- a/arch/arm/boot/dts/sama7g5-pinfunc.h
++++ b/arch/arm/boot/dts/sama7g5-pinfunc.h
+@@ -261,7 +261,7 @@
+ #define PIN_PB2__FLEXCOM6_IO0 PINMUX_PIN(PIN_PB2, 2, 1)
+ #define PIN_PB2__ADTRG PINMUX_PIN(PIN_PB2, 3, 1)
+ #define PIN_PB2__A20 PINMUX_PIN(PIN_PB2, 4, 1)
+-#define PIN_PB2__FLEXCOM11_IO0 PINMUX_PIN(PIN_PB2, 6, 3)
++#define PIN_PB2__FLEXCOM11_IO1 PINMUX_PIN(PIN_PB2, 6, 3)
+ #define PIN_PB3 35
+ #define PIN_PB3__GPIO PINMUX_PIN(PIN_PB3, 0, 0)
+ #define PIN_PB3__RF1 PINMUX_PIN(PIN_PB3, 1, 1)
+--
+2.35.1
+
--- /dev/null
+From 6389325430ebb73bebcb54c7eb9ac4c7450b639f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Nov 2022 20:19:45 +0100
+Subject: ARM: dts: imx7: Fix NAND controller size-cells
+
+From: Marek Vasut <marex@denx.de>
+
+[ Upstream commit 753395ea1e45c724150070b5785900b6a44bd5fb ]
+
+The NAND controller size-cells should be 0 per DT bindings.
+Fix the following warning produces by DT bindings check:
+"
+nand-controller@33002000: #size-cells:0:0: 0 was expected
+nand-controller@33002000: Unevaluated properties are not allowed ('#address-cells', '#size-cells' were unexpected)
+"
+Fix the missing space in node name too.
+
+Fixes: e7495a45a76de ("ARM: dts: imx7: add GPMI NAND and APBH DMA")
+Signed-off-by: Marek Vasut <marex@denx.de>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx7s.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/imx7s.dtsi b/arch/arm/boot/dts/imx7s.dtsi
+index 29148285f9fc..1dc3bfac30b6 100644
+--- a/arch/arm/boot/dts/imx7s.dtsi
++++ b/arch/arm/boot/dts/imx7s.dtsi
+@@ -1270,10 +1270,10 @@ dma_apbh: dma-apbh@33000000 {
+ clocks = <&clks IMX7D_NAND_USDHC_BUS_RAWNAND_CLK>;
+ };
+
+- gpmi: nand-controller@33002000{
++ gpmi: nand-controller@33002000 {
+ compatible = "fsl,imx7d-gpmi-nand";
+ #address-cells = <1>;
+- #size-cells = <1>;
++ #size-cells = <0>;
+ reg = <0x33002000 0x2000>, <0x33004000 0x4000>;
+ reg-names = "gpmi-nand", "bch";
+ interrupts = <GIC_SPI 14 IRQ_TYPE_LEVEL_HIGH>;
+--
+2.35.1
+
--- /dev/null
+From 560fd13671d52a76c05e62b02a1b52ff22e56486 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Nov 2022 20:19:46 +0100
+Subject: arm64: dts: imx8mm: Fix NAND controller size-cells
+
+From: Marek Vasut <marex@denx.de>
+
+[ Upstream commit 1610233bc2c2cae2dff9e101e6ea5ef69cceb0e9 ]
+
+The NAND controller size-cells should be 0 per DT bindings.
+Fix the following warning produces by DT bindings check:
+"
+nand-controller@33002000: #size-cells:0:0: 0 was expected
+nand-controller@33002000: Unevaluated properties are not allowed ('#address-cells', '#size-cells' were unexpected)
+"
+Fix the missing space in node name too.
+
+Fixes: a05ea40eb384e ("arm64: dts: imx: Add i.mx8mm dtsi support")
+Signed-off-by: Marek Vasut <marex@denx.de>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/imx8mm.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8mm.dtsi b/arch/arm64/boot/dts/freescale/imx8mm.dtsi
+index dabd94dc30c4..50ef92915c67 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mm.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx8mm.dtsi
+@@ -1244,10 +1244,10 @@ dma_apbh: dma-controller@33000000 {
+ clocks = <&clk IMX8MM_CLK_NAND_USDHC_BUS_RAWNAND_CLK>;
+ };
+
+- gpmi: nand-controller@33002000{
++ gpmi: nand-controller@33002000 {
+ compatible = "fsl,imx8mm-gpmi-nand", "fsl,imx7d-gpmi-nand";
+ #address-cells = <1>;
+- #size-cells = <1>;
++ #size-cells = <0>;
+ reg = <0x33002000 0x2000>, <0x33004000 0x4000>;
+ reg-names = "gpmi-nand", "bch";
+ interrupts = <GIC_SPI 14 IRQ_TYPE_LEVEL_HIGH>;
+--
+2.35.1
+
--- /dev/null
+From 938f6239c08e209453e0c005673c8e8a484581bb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Nov 2022 10:30:31 +0100
+Subject: arm64: dts: imx8mm-tqma8mqml-mba8mx: Fix USB DR
+
+From: Alexander Stein <alexander.stein@ew.tq-group.com>
+
+[ Upstream commit 63fd9437ec81899fc36bb642d558378bc89aa4f9 ]
+
+Using extcon USB host mode works properly on DR interface, e.g.
+enabling/disabling VBUS. But USB device mode is not working.
+Fix this by switching to usb-role-switch instead.
+
+Fixes: dfcd1b6f7620 ("arm64: dts: freescale: add initial device tree for TQMa8MQML with i.MX8MM")
+Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../dts/freescale/imx8mm-tqma8mqml-mba8mx.dts | 32 +++++++++++++++----
+ 1 file changed, 26 insertions(+), 6 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8mm-tqma8mqml-mba8mx.dts b/arch/arm64/boot/dts/freescale/imx8mm-tqma8mqml-mba8mx.dts
+index 7e0aeb2db305..a0aeac619929 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mm-tqma8mqml-mba8mx.dts
++++ b/arch/arm64/boot/dts/freescale/imx8mm-tqma8mqml-mba8mx.dts
+@@ -34,11 +34,25 @@ reg_usdhc2_vmmc: regulator-vmmc {
+ off-on-delay-us = <12000>;
+ };
+
+- extcon_usbotg1: extcon-usbotg1 {
+- compatible = "linux,extcon-usb-gpio";
++ connector {
++ compatible = "gpio-usb-b-connector", "usb-b-connector";
++ type = "micro";
++ label = "X19";
+ pinctrl-names = "default";
+- pinctrl-0 = <&pinctrl_usb1_extcon>;
+- id-gpio = <&gpio1 10 GPIO_ACTIVE_HIGH>;
++ pinctrl-0 = <&pinctrl_usb1_connector>;
++ id-gpios = <&gpio1 10 GPIO_ACTIVE_HIGH>;
++
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
++
++ port@0 {
++ reg = <0>;
++ usb_dr_connector: endpoint {
++ remote-endpoint = <&usb1_drd_sw>;
++ };
++ };
++ };
+ };
+ };
+
+@@ -105,13 +119,19 @@ &usbotg1 {
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_usbotg1>;
+ dr_mode = "otg";
+- extcon = <&extcon_usbotg1>;
+ srp-disable;
+ hnp-disable;
+ adp-disable;
+ power-active-high;
+ over-current-active-low;
++ usb-role-switch;
+ status = "okay";
++
++ port {
++ usb1_drd_sw: endpoint {
++ remote-endpoint = <&usb_dr_connector>;
++ };
++ };
+ };
+
+ &usbotg2 {
+@@ -231,7 +251,7 @@ pinctrl_usbotg1: usbotg1grp {
+ <MX8MM_IOMUXC_GPIO1_IO13_USB1_OTG_OC 0x84>;
+ };
+
+- pinctrl_usb1_extcon: usb1-extcongrp {
++ pinctrl_usb1_connector: usb1-connectorgrp {
+ fsl,pins = <MX8MM_IOMUXC_GPIO1_IO10_GPIO1_IO10 0x1c0>;
+ };
+
+--
+2.35.1
+
--- /dev/null
+From f2a6d133d5b59d92d239282992d36c20d2ff7248 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Nov 2022 20:19:47 +0100
+Subject: arm64: dts: imx8mn: Fix NAND controller size-cells
+
+From: Marek Vasut <marex@denx.de>
+
+[ Upstream commit 5468e93b5b1083eaa729f98e59da18c85d9c4126 ]
+
+The NAND controller size-cells should be 0 per DT bindings.
+Fix the following warning produces by DT bindings check:
+"
+nand-controller@33002000: #size-cells:0:0: 0 was expected
+nand-controller@33002000: Unevaluated properties are not allowed ('#address-cells', '#size-cells' were unexpected)
+"
+
+Fixes: 6c3debcbae47a ("arm64: dts: freescale: Add i.MX8MN dtsi support")
+Signed-off-by: Marek Vasut <marex@denx.de>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/imx8mn.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8mn.dtsi b/arch/arm64/boot/dts/freescale/imx8mn.dtsi
+index ad0b99adf691..67b554ba690c 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mn.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx8mn.dtsi
+@@ -1102,7 +1102,7 @@ dma_apbh: dma-controller@33000000 {
+ gpmi: nand-controller@33002000 {
+ compatible = "fsl,imx8mn-gpmi-nand", "fsl,imx7d-gpmi-nand";
+ #address-cells = <1>;
+- #size-cells = <1>;
++ #size-cells = <0>;
+ reg = <0x33002000 0x2000>, <0x33004000 0x4000>;
+ reg-names = "gpmi-nand", "bch";
+ interrupts = <GIC_SPI 14 IRQ_TYPE_LEVEL_HIGH>;
+--
+2.35.1
+
--- /dev/null
+From 8ec43a2b83f2bc1aa3489798a28efe5a88072487 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Nov 2022 13:49:42 +0800
+Subject: arm64: dts: imx93-pinfunc: drop execution permission
+
+From: Peng Fan <peng.fan@nxp.com>
+
+[ Upstream commit 2db1fdb25d209a88112fd82eb493976d66057d10 ]
+
+Drop the header file execution permission
+
+Signed-off-by: Peng Fan <peng.fan@nxp.com>
+Fixes: ec8b5b5058ea ("arm64: dts: freescale: Add i.MX93 dtsi support")
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/imx93-pinfunc.h | 0
+ 1 file changed, 0 insertions(+), 0 deletions(-)
+ mode change 100755 => 100644 arch/arm64/boot/dts/freescale/imx93-pinfunc.h
+
+diff --git a/arch/arm64/boot/dts/freescale/imx93-pinfunc.h b/arch/arm64/boot/dts/freescale/imx93-pinfunc.h
+old mode 100755
+new mode 100644
+--
+2.35.1
+
--- /dev/null
+From 5beebf4805184f12ba2a2c34d72de66aceb1bb57 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Aug 2022 00:06:27 +0200
+Subject: arm64: dts: qcom: ipq8074: correct APCS register space size
+
+From: Robert Marko <robimarko@gmail.com>
+
+[ Upstream commit 40b21d466a86bd5b10d24f59746ed41283a9b3f6 ]
+
+APCS DTS addition that was merged, was not supposed to get merged as it
+was part of patch series that was superseded by 2 more patch series
+that resolved issues with this one and greatly simplified things.
+
+Since it already got merged, start by correcting the register space
+size as APCS will not be providing regmap for PLL and it will conflict
+with the standalone A53 PLL node.
+
+Fixes: 50ed9fffec3a ("arm64: dts: qcom: ipq8074: add APCS node")
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20220818220628.339366-8-robimarko@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/ipq8074.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/ipq8074.dtsi b/arch/arm64/boot/dts/qcom/ipq8074.dtsi
+index b9bf43215ada..79351c6157ea 100644
+--- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi
++++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi
+@@ -668,7 +668,7 @@ watchdog: watchdog@b017000 {
+
+ apcs_glb: mailbox@b111000 {
+ compatible = "qcom,ipq8074-apcs-apps-global";
+- reg = <0x0b111000 0x6000>;
++ reg = <0x0b111000 0x1000>;
+
+ #clock-cells = <1>;
+ #mbox-cells = <1>;
+--
+2.35.1
+
--- /dev/null
+From 0452862f7460d42b5fb489eea7341dccf58f365b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Aug 2022 09:49:47 -0700
+Subject: arm64: dts: qcom: sa8155p-adp: Specify which LDO modes are allowed
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit bd9f3dcf42d943b53190f99bcdbcfe98a56ac4cd ]
+
+This board uses RPMH, specifies "regulator-allow-set-load" for LDOs,
+but doesn't specify any modes with "regulator-allowed-modes".
+
+Prior to commit efb0cb50c427 ("regulator: qcom-rpmh: Implement
+get_optimum_mode(), not set_load()") the above meant that we were able
+to set either LPM or HPM mode. After that commit (and fixes [1]) we'll
+be stuck at the initial mode. Discussion of this has resulted in the
+decision that the old dts files were wrong and should be fixed to
+fully restore old functionality.
+
+Let's re-enable the old functionality by fixing the dts.
+
+NOTE: while here, let's also remove the nonsensical
+"regulator-allow-set-load" on the fixed regulator "vreg_s4a_1p8".
+
+[1] https://lore.kernel.org/r/20220824142229.RFT.v2.2.I6f77860e5cd98bf5c67208fa9edda4a08847c304@changeid
+
+Fixes: 5b85e8f2225c ("arm64: dts: qcom: sa8155p-adp: Add base dts file")
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Reviewed-by: Andrew Halaney <ahalaney@redhat.com>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@somainline.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20220829094903.v2.1.Id59c32b560c4662d8b3697de2bd494d08d654806@changeid
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sa8155p-adp.dts | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sa8155p-adp.dts b/arch/arm64/boot/dts/qcom/sa8155p-adp.dts
+index ba547ca9fc6b..ddb9cb182152 100644
+--- a/arch/arm64/boot/dts/qcom/sa8155p-adp.dts
++++ b/arch/arm64/boot/dts/qcom/sa8155p-adp.dts
+@@ -43,7 +43,6 @@ vreg_s4a_1p8: smps4 {
+
+ regulator-always-on;
+ regulator-boot-on;
+- regulator-allow-set-load;
+
+ vin-supply = <&vreg_3p3>;
+ };
+@@ -137,6 +136,9 @@ vreg_l5a_0p88: ldo5 {
+ regulator-max-microvolt = <880000>;
+ regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+ regulator-allow-set-load;
++ regulator-allowed-modes =
++ <RPMH_REGULATOR_MODE_LPM
++ RPMH_REGULATOR_MODE_HPM>;
+ };
+
+ vreg_l7a_1p8: ldo7 {
+@@ -152,6 +154,9 @@ vreg_l10a_2p96: ldo10 {
+ regulator-max-microvolt = <2960000>;
+ regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+ regulator-allow-set-load;
++ regulator-allowed-modes =
++ <RPMH_REGULATOR_MODE_LPM
++ RPMH_REGULATOR_MODE_HPM>;
+ };
+
+ vreg_l11a_0p8: ldo11 {
+@@ -258,6 +263,9 @@ vreg_l5c_1p2: ldo5 {
+ regulator-max-microvolt = <1200000>;
+ regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+ regulator-allow-set-load;
++ regulator-allowed-modes =
++ <RPMH_REGULATOR_MODE_LPM
++ RPMH_REGULATOR_MODE_HPM>;
+ };
+
+ vreg_l7c_1p8: ldo7 {
+@@ -273,6 +281,9 @@ vreg_l8c_1p2: ldo8 {
+ regulator-max-microvolt = <1200000>;
+ regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+ regulator-allow-set-load;
++ regulator-allowed-modes =
++ <RPMH_REGULATOR_MODE_LPM
++ RPMH_REGULATOR_MODE_HPM>;
+ };
+
+ vreg_l10c_3p3: ldo10 {
+--
+2.35.1
+
--- /dev/null
+From 9e92744f2e2a3b982e768fdfd321fa2c42896a2f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Aug 2022 09:49:48 -0700
+Subject: arm64: dts: qcom: sa8295p-adp: Specify which LDO modes are allowed
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit 09a1710b3e12e7ac8d871506bc395a9e8a0f63d6 ]
+
+This board uses RPMH, specifies "regulator-allow-set-load" for LDOs,
+but doesn't specify any modes with "regulator-allowed-modes".
+
+Prior to commit efb0cb50c427 ("regulator: qcom-rpmh: Implement
+get_optimum_mode(), not set_load()") the above meant that we were able
+to set either LPM or HPM mode. After that commit (and fixes [1]) we'll
+be stuck at the initial mode. Discussion of this has resulted in the
+decision that the old dts files were wrong and should be fixed to
+fully restore old functionality.
+
+Let's re-enable the old functionality by fixing the dts.
+
+[1] https://lore.kernel.org/r/20220824142229.RFT.v2.2.I6f77860e5cd98bf5c67208fa9edda4a08847c304@changeid
+
+Fixes: 519183af39b2 ("arm64: dts: qcom: add SA8540P and ADP")
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Reviewed-by: Andrew Halaney <ahalaney@redhat.com>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@somainline.org>
+Reviewed-by: Johan Hovold <johan+linaro@kernel.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20220829094903.v2.2.I430a56702ab0af65244e62667bb7743107de0c96@changeid
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sa8295p-adp.dts | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/qcom/sa8295p-adp.dts b/arch/arm64/boot/dts/qcom/sa8295p-adp.dts
+index ca5f5ad32ce5..5b16ac76fefb 100644
+--- a/arch/arm64/boot/dts/qcom/sa8295p-adp.dts
++++ b/arch/arm64/boot/dts/qcom/sa8295p-adp.dts
+@@ -83,6 +83,9 @@ vreg_l3c: ldo3 {
+ regulator-max-microvolt = <1200000>;
+ regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+ regulator-allow-set-load;
++ regulator-allowed-modes =
++ <RPMH_REGULATOR_MODE_LPM
++ RPMH_REGULATOR_MODE_HPM>;
+ };
+
+ vreg_l4c: ldo4 {
+@@ -98,6 +101,9 @@ vreg_l6c: ldo6 {
+ regulator-max-microvolt = <1200000>;
+ regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+ regulator-allow-set-load;
++ regulator-allowed-modes =
++ <RPMH_REGULATOR_MODE_LPM
++ RPMH_REGULATOR_MODE_HPM>;
+ };
+
+ vreg_l7c: ldo7 {
+@@ -113,6 +119,9 @@ vreg_l10c: ldo10 {
+ regulator-max-microvolt = <2504000>;
+ regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+ regulator-allow-set-load;
++ regulator-allowed-modes =
++ <RPMH_REGULATOR_MODE_LPM
++ RPMH_REGULATOR_MODE_HPM>;
+ };
+
+ vreg_l17c: ldo17 {
+@@ -121,6 +130,9 @@ vreg_l17c: ldo17 {
+ regulator-max-microvolt = <2504000>;
+ regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+ regulator-allow-set-load;
++ regulator-allowed-modes =
++ <RPMH_REGULATOR_MODE_LPM
++ RPMH_REGULATOR_MODE_HPM>;
+ };
+ };
+
+--
+2.35.1
+
--- /dev/null
+From 9ba4969043b0001bcce30e2ebcf141229bcdb297 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Sep 2022 17:18:15 +0530
+Subject: arm64: dts: qcom: sc7280: Add the reset reg for lpass audiocc on
+ SC7280
+
+From: Satya Priya <quic_c_skakit@quicinc.com>
+
+[ Upstream commit cb1d0aaa674e99957b85af570cb2730145af01df ]
+
+Add the reset register offset for clock gating.
+
+Fixes: 9499240d15f2 ("arm64: dts: qcom: sc7280: Add lpasscore & lpassaudio clock controllers")
+Signed-off-by: Satya Priya <quic_c_skakit@quicinc.com>
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/1663674495-25748-1-git-send-email-quic_c_skakit@quicinc.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sc7280.dtsi | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sc7280.dtsi b/arch/arm64/boot/dts/qcom/sc7280.dtsi
+index 51ed691075ad..b3c3844f97a0 100644
+--- a/arch/arm64/boot/dts/qcom/sc7280.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc7280.dtsi
+@@ -2177,7 +2177,8 @@ lpasscc: lpasscc@3000000 {
+
+ lpass_audiocc: clock-controller@3300000 {
+ compatible = "qcom,sc7280-lpassaudiocc";
+- reg = <0 0x03300000 0 0x30000>;
++ reg = <0 0x03300000 0 0x30000>,
++ <0 0x032a9000 0 0x1000>;
+ clocks = <&rpmhcc RPMH_CXO_CLK>,
+ <&lpass_aon LPASS_AON_CC_MAIN_RCG_CLK_SRC>;
+ clock-names = "bi_tcxo", "lpass_aon_cc_main_rcg_clk_src";
+--
+2.35.1
+
--- /dev/null
+From 4920acd959ffe1d44eb28878df4c65de50894ebb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Oct 2022 10:55:29 -0400
+Subject: arm64: dts: qcom: sc8280xp: correct ref clock for ufs_mem_phy
+
+From: Brian Masney <bmasney@redhat.com>
+
+[ Upstream commit f3aa975e230e060c07dcfdf3fe92b59809422c13 ]
+
+The first UFS host controller fails to start on the SA8540P automotive
+board (QDrive3) due to the following errors:
+
+ ufshcd-qcom 1d84000.ufs: ufshcd_query_flag: Sending flag query for idn 18 failed, err = 253
+ ufshcd-qcom 1d84000.ufs: ufshcd_query_flag: Sending flag query for idn 18 failed, err = 253
+ ufshcd-qcom 1d84000.ufs: ufshcd_query_flag: Sending flag query for idn 18 failed, err = 253
+ ufshcd-qcom 1d84000.ufs: ufshcd_query_flag_retry: query attribute, opcode 5, idn 18, failed
+ with error 253 after 3 retries
+
+The system eventually fails to boot with the warning:
+
+ gcc_ufs_phy_axi_clk status stuck at 'off'
+
+This issue can be worked around by adding clk_ignore_unused to the
+kernel command line since the system firmware sets up this clock for us.
+
+Let's fix this issue by updating the ref clock on ufs_mem_phy. Note
+that the downstream MSM 5.4 sources list this as ref_clk_parent. With
+this patch, the SA8540P is able to be booted without clk_ignore_unused.
+
+Signed-off-by: Brian Masney <bmasney@redhat.com>
+Fixes: 152d1faf1e2f ("arm64: dts: qcom: add SC8280XP platform")
+Tested-by: Johan Hovold <johan+linaro@kernel.org>
+Reviewed-by: Johan Hovold <johan+linaro@kernel.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20221006145529.755521-1-bmasney@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sc8280xp.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi
+index 92cbe84de0e5..cdc395d53c5a 100644
+--- a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi
+@@ -891,7 +891,7 @@ ufs_mem_phy: phy@1d87000 {
+ ranges;
+ clock-names = "ref",
+ "ref_aux";
+- clocks = <&rpmhcc RPMH_CXO_CLK>,
++ clocks = <&gcc GCC_UFS_REF_CLKREF_CLK>,
+ <&gcc GCC_UFS_PHY_PHY_AUX_CLK>;
+
+ resets = <&ufs_mem_hc 0>;
+--
+2.35.1
+
--- /dev/null
+From 9f598e84e7f8ef4cda024c673d178f0b1bf26c39 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Aug 2022 09:49:49 -0700
+Subject: arm64: dts: qcom: sc8280xp-crd: Specify which LDO modes are allowed
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit a4543e21ae363f4f094fb3c3503d77029e0c5d90 ]
+
+This board uses RPMH, specifies "regulator-allow-set-load" for LDOs,
+but doesn't specify any modes with "regulator-allowed-modes".
+
+Prior to commit efb0cb50c427 ("regulator: qcom-rpmh: Implement
+get_optimum_mode(), not set_load()") the above meant that we were able
+to set either LPM or HPM mode. After that commit (and fixes [1]) we'll
+be stuck at the initial mode. Discussion of this has resulted in the
+decision that the old dts files were wrong and should be fixed to
+fully restore old functionality.
+
+Let's re-enable the old functionality by fixing the dts.
+
+[1] https://lore.kernel.org/r/20220824142229.RFT.v2.2.I6f77860e5cd98bf5c67208fa9edda4a08847c304@changeid
+
+Fixes: ccd3517faf18 ("arm64: dts: qcom: sc8280xp: Add reference device")
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Reviewed-by: Andrew Halaney <ahalaney@redhat.com>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@somainline.org>
+Reviewed-by: Johan Hovold <johan+linaro@kernel.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20220829094903.v2.3.Ie7d2c50d2b42ef2d364f3a0c8e300e5ce1875b79@changeid
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sc8280xp-crd.dts | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/qcom/sc8280xp-crd.dts b/arch/arm64/boot/dts/qcom/sc8280xp-crd.dts
+index 6792e88b2c6c..a3796502d425 100644
+--- a/arch/arm64/boot/dts/qcom/sc8280xp-crd.dts
++++ b/arch/arm64/boot/dts/qcom/sc8280xp-crd.dts
+@@ -124,6 +124,9 @@ vreg_l7c: ldo7 {
+ regulator-max-microvolt = <2504000>;
+ regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+ regulator-allow-set-load;
++ regulator-allowed-modes =
++ <RPMH_REGULATOR_MODE_LPM
++ RPMH_REGULATOR_MODE_HPM>;
+ };
+
+ vreg_l13c: ldo13 {
+@@ -146,6 +149,9 @@ vreg_l3d: ldo3 {
+ regulator-max-microvolt = <1200000>;
+ regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+ regulator-allow-set-load;
++ regulator-allowed-modes =
++ <RPMH_REGULATOR_MODE_LPM
++ RPMH_REGULATOR_MODE_HPM>;
+ };
+
+ vreg_l4d: ldo4 {
+--
+2.35.1
+
--- /dev/null
+From fb20d916f161aaf8796de5de374ce02a788f4796 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Sep 2022 11:44:54 +0200
+Subject: arm64: dts: qcom: sc8280xp: drop broken DP PHY nodes
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+[ Upstream commit 7cdfb7a54ac88f7cb6d830ebb78bdbcbcb44bb4c ]
+
+The DP PHY register layout of the current binding do not apply to the
+newer USB4/USB3/DP PHY which uses a different register layout entirely.
+
+Drop the DP PHY subnodes until the binding has been updated to prevent
+the driver from corrupting unrelated registers.
+
+Note that this is also needed in order to not break USB with an upcoming
+PHY driver change that checks for overlapping register regions.
+
+Fixes: 152d1faf1e2f ("arm64: dts: qcom: add SC8280XP platform")
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20220919094454.1574-5-johan+linaro@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sc8280xp.dtsi | 20 --------------------
+ 1 file changed, 20 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi
+index cf6d1063bb84..2a702abcf51e 100644
+--- a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi
+@@ -1191,16 +1191,6 @@ usb_0_ssphy: usb3-phy@88eb400 {
+ clock-names = "pipe0";
+ clock-output-names = "usb0_phy_pipe_clk_src";
+ };
+-
+- usb_0_dpphy: dp-phy@88ed200 {
+- reg = <0 0x088ed200 0 0x200>,
+- <0 0x088ed400 0 0x200>,
+- <0 0x088eda00 0 0x200>,
+- <0 0x088ea600 0 0x200>,
+- <0 0x088ea800 0 0x200>;
+- #clock-cells = <1>;
+- #phy-cells = <0>;
+- };
+ };
+
+ usb_1_hsphy: phy@8902000 {
+@@ -1253,16 +1243,6 @@ usb_1_ssphy: usb3-phy@8903400 {
+ clock-names = "pipe0";
+ clock-output-names = "usb1_phy_pipe_clk_src";
+ };
+-
+- usb_1_dpphy: dp-phy@8904200 {
+- reg = <0 0x08904200 0 0x200>,
+- <0 0x08904400 0 0x200>,
+- <0 0x08904a00 0 0x200>,
+- <0 0x08904600 0 0x200>,
+- <0 0x08904800 0 0x200>;
+- #clock-cells = <1>;
+- #phy-cells = <0>;
+- };
+ };
+
+ system-cache-controller@9200000 {
+--
+2.35.1
+
--- /dev/null
+From a55b7fb5ffafe452050003962662ee91670dfa52 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Sep 2022 16:16:01 +0200
+Subject: arm64: dts: qcom: sc8280xp: fix UFS PHY serdes size
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+[ Upstream commit 8703d55bd5eac642275fe91b34ac62ad0ad312b5 ]
+
+The size of the UFS PHY serdes register region is 0x1c8 and the
+corresponding 'reg' property should specifically not include the
+adjacent regions that are defined in the child node (e.g. tx and rx).
+
+Fixes: 152d1faf1e2f ("arm64: dts: qcom: add SC8280XP platform")
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Tested-by: Andrew Halaney <ahalaney@redhat.com> #Qdrive3/sa8540p-adp-ride
+Reviewed-by: Brian Masney <bmasney@redhat.com>
+Reviewed-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20220915141601.18435-1-johan+linaro@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sc8280xp.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi
+index 2a702abcf51e..6d82dea3675b 100644
+--- a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi
+@@ -885,7 +885,7 @@ ufs_mem_hc: ufs@1d84000 {
+
+ ufs_mem_phy: phy@1d87000 {
+ compatible = "qcom,sc8280xp-qmp-ufs-phy";
+- reg = <0 0x01d87000 0 0xe10>;
++ reg = <0 0x01d87000 0 0x1c8>;
+ #address-cells = <2>;
+ #size-cells = <2>;
+ ranges;
+@@ -953,7 +953,7 @@ ufs_card_hc: ufs@1da4000 {
+
+ ufs_card_phy: phy@1da7000 {
+ compatible = "qcom,sc8280xp-qmp-ufs-phy";
+- reg = <0 0x01da7000 0 0xe10>;
++ reg = <0 0x01da7000 0 0x1c8>;
+ #address-cells = <2>;
+ #size-cells = <2>;
+ ranges;
+--
+2.35.1
+
--- /dev/null
+From c3dd7c6b6c98f7e8b3e58e9df26af8598e87149c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Oct 2022 16:33:05 +0200
+Subject: arm64: dts: qcom: sc8280xp: fix ufs_card_phy ref clock
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+[ Upstream commit 8d6b458ce6e93286a607e54f787f7a86067f58bd ]
+
+The GCC_UFS_REF_CLKREF_CLK must be enabled or the second UFS controller
+fails to enumerate on sa8295p-adp.
+
+Note that the vendor kernel enables both GCC_UFS_REF_CLKREF_CLK and
+GCC_UFS_1_CARD_CLKREF_CLK and it is possible that the former should be
+modelled as a parent of the latter. The clock driver also has a
+GCC_UFS_CARD_CLKREF_CLK clock which the firmware appears to enable on
+the ADP.
+
+The usual lack of documentation for Qualcomm SoCs makes this a highly
+annoying guessing game, but as the second controller works on the ADP
+without either card reference clock enabled, only enable
+GCC_UFS_REF_CLKREF_CLK for now.
+
+Fixes: 152d1faf1e2f ("arm64: dts: qcom: add SC8280XP platform")
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@somainline.org>
+Reviewed-by: Brian Masney <bmasney@redhat.com>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20221005143305.388-1-johan+linaro@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sc8280xp.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi
+index 49ea8b5612fc..92cbe84de0e5 100644
+--- a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi
+@@ -959,7 +959,7 @@ ufs_card_phy: phy@1da7000 {
+ ranges;
+ clock-names = "ref",
+ "ref_aux";
+- clocks = <&gcc GCC_UFS_1_CARD_CLKREF_CLK>,
++ clocks = <&gcc GCC_UFS_REF_CLKREF_CLK>,
+ <&gcc GCC_UFS_CARD_PHY_AUX_CLK>;
+
+ resets = <&ufs_card_hc 0>;
+--
+2.35.1
+
--- /dev/null
+From 81331d86ba49d8592a0fe8693474b0a3d25bad18 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Sep 2022 11:44:53 +0200
+Subject: arm64: dts: qcom: sc8280xp: fix USB PHY PCS registers
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+[ Upstream commit 8723c3f290c7b798c0cbd89998576e6b365bda3a ]
+
+With the current binding, the PCS register block (0x1400) needs to
+include the PCS_USB registers (0x1700).
+
+Fixes: 152d1faf1e2f ("arm64: dts: qcom: add SC8280XP platform")
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20220919094454.1574-4-johan+linaro@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sc8280xp.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi
+index 2b8eea373163..cf6d1063bb84 100644
+--- a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi
+@@ -1181,7 +1181,7 @@ usb_0_qmpphy: phy-wrapper@88ec000 {
+ usb_0_ssphy: usb3-phy@88eb400 {
+ reg = <0 0x088eb400 0 0x100>,
+ <0 0x088eb600 0 0x3ec>,
+- <0 0x088ec400 0 0x1f0>,
++ <0 0x088ec400 0 0x364>,
+ <0 0x088eba00 0 0x100>,
+ <0 0x088ebc00 0 0x3ec>,
+ <0 0x088ec200 0 0x18>;
+@@ -1243,7 +1243,7 @@ usb_1_qmpphy: phy-wrapper@8904000 {
+ usb_1_ssphy: usb3-phy@8903400 {
+ reg = <0 0x08903400 0 0x100>,
+ <0 0x08903600 0 0x3ec>,
+- <0 0x08904400 0 0x1f0>,
++ <0 0x08904400 0 0x364>,
+ <0 0x08903a00 0 0x100>,
+ <0 0x08903c00 0 0x3ec>,
+ <0 0x08904200 0 0x18>;
+--
+2.35.1
+
--- /dev/null
+From bacb6ebbd43ab51e6af1c76707b2c354f2e9ec23 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Sep 2022 11:44:51 +0200
+Subject: arm64: dts: qcom: sc8280xp: fix USB0 PHY PCS_MISC registers
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+[ Upstream commit 31b3b3059791be536e2ec0c6830767b596af340f ]
+
+The USB0 SS PHY node had the PCS_MISC register block (0x1200) replaced
+with PCS_USB (0x1700).
+
+Fixes: 152d1faf1e2f ("arm64: dts: qcom: add SC8280XP platform")
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20220919094454.1574-2-johan+linaro@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sc8280xp.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi
+index cdc395d53c5a..e3e192877a88 100644
+--- a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi
+@@ -1184,7 +1184,7 @@ usb_0_ssphy: usb3-phy@88eb400 {
+ <0 0x088ec400 0 0x1f0>,
+ <0 0x088eba00 0 0x100>,
+ <0 0x088ebc00 0 0x3ec>,
+- <0 0x088ec700 0 0x64>;
++ <0 0x088ec200 0 0x18>;
+ #phy-cells = <0>;
+ #clock-cells = <0>;
+ clocks = <&gcc GCC_USB3_PRIM_PHY_PIPE_CLK>;
+--
+2.35.1
+
--- /dev/null
+From a2258b3acf0c9cdbacf07c51a20b9ee8e3bfc18d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Sep 2022 11:44:52 +0200
+Subject: arm64: dts: qcom: sc8280xp: fix USB1 PHY RX1 registers
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+[ Upstream commit 81cad26c6c3984d01b0612069c70ffd820f62dfa ]
+
+The USB1 SS PHY node had the RX1 register block (0x600) replaced with
+RX2 (0xc00).
+
+Fixes: 152d1faf1e2f ("arm64: dts: qcom: add SC8280XP platform")
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20220919094454.1574-3-johan+linaro@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sc8280xp.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi
+index e3e192877a88..2b8eea373163 100644
+--- a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi
+@@ -1242,7 +1242,7 @@ usb_1_qmpphy: phy-wrapper@8904000 {
+
+ usb_1_ssphy: usb3-phy@8903400 {
+ reg = <0 0x08903400 0 0x100>,
+- <0 0x08903c00 0 0x3ec>,
++ <0 0x08903600 0 0x3ec>,
+ <0 0x08904400 0 0x1f0>,
+ <0 0x08903a00 0 0x100>,
+ <0 0x08903c00 0 0x3ec>,
+--
+2.35.1
+
--- /dev/null
+From 1d90e0ea4e97b8f64b3432c7511352b551822362 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Aug 2022 09:49:50 -0700
+Subject: arm64: dts: qcom: sm8150-xperia-kumano: Specify which LDO modes are
+ allowed
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit aa30e786202e4ed1df980442d305658441f65859 ]
+
+This board uses RPMH, specifies "regulator-allow-set-load" for LDOs,
+but doesn't specify any modes with "regulator-allowed-modes".
+
+Prior to commit efb0cb50c427 ("regulator: qcom-rpmh: Implement
+get_optimum_mode(), not set_load()") the above meant that we were able
+to set either LPM or HPM mode. After that commit (and fixes [1]) we'll
+be stuck at the initial mode. Discussion of this has resulted in the
+decision that the old dts files were wrong and should be fixed to
+fully restore old functionality.
+
+Let's re-enable the old functionality by fixing the dts.
+
+[1] https://lore.kernel.org/r/20220824142229.RFT.v2.2.I6f77860e5cd98bf5c67208fa9edda4a08847c304@changeid
+
+Fixes: d0a6ce59ea4e ("arm64: dts: qcom: sm8150: Add support for SONY Xperia 1 / 5 (Kumano platform)")
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Reviewed-by: Andrew Halaney <ahalaney@redhat.com>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@somainline.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20220829094903.v2.4.I51d60414a42ba9e3008e208d60a04c9ffc425fa7@changeid
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm8150-sony-xperia-kumano.dtsi | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8150-sony-xperia-kumano.dtsi b/arch/arm64/boot/dts/qcom/sm8150-sony-xperia-kumano.dtsi
+index 014fe3a31548..fb6e5a140c9f 100644
+--- a/arch/arm64/boot/dts/qcom/sm8150-sony-xperia-kumano.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm8150-sony-xperia-kumano.dtsi
+@@ -348,6 +348,9 @@ vreg_l6c_2p9: ldo6 {
+ regulator-max-microvolt = <2960000>;
+ regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+ regulator-allow-set-load;
++ regulator-allowed-modes =
++ <RPMH_REGULATOR_MODE_LPM
++ RPMH_REGULATOR_MODE_HPM>;
+ };
+
+ vreg_l7c_3p0: ldo7 {
+@@ -367,6 +370,9 @@ vreg_l9c_2p9: ldo9 {
+ regulator-max-microvolt = <2960000>;
+ regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+ regulator-allow-set-load;
++ regulator-allowed-modes =
++ <RPMH_REGULATOR_MODE_LPM
++ RPMH_REGULATOR_MODE_HPM>;
+ };
+
+ vreg_l10c_3p3: ldo10 {
+--
+2.35.1
+
--- /dev/null
+From 96ffcc0fca5586fb96bcb114729c4e941ca03923 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Oct 2022 13:57:45 +0200
+Subject: arm64: dts: qcom: sm8250: Disable the not yet supported cluster idle
+ state
+
+From: Ulf Hansson <ulf.hansson@linaro.org>
+
+[ Upstream commit cadaa773bcf161184fa428180516bae33a7bc667 ]
+
+To support the deeper cluster idle state for sm8250 platforms, some
+additional synchronization is needed between the rpmh-rsc device and the
+CPU cluster PM domain. Until that is supported, let's disable the cluster
+idle state.
+
+This fixes a problem that has been reported for the Qcom RB5 platform (see
+below), but most likely other sm8250 platforms suffers from similar issues,
+so let's make the fix generic for sm8250.
+
+vreg_l11c_3p3: failed to enable: -ETIMEDOUT
+qcom-rpmh-regulator 18200000.rsc:pm8150l-rpmh-regulators: ldo11: devm_regulator_register() failed, ret=-110
+qcom-rpmh-regulator: probe of 18200000.rsc:pm8150l-rpmh-regulators failed with error -110
+
+Reported-by: Amit Pundir <amit.pundir@linaro.org>
+Fixes: 32bc936d7321 ("arm64: dts: qcom: sm8250: Add cpuidle states")
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Tested-by: Amit Pundir <amit.pundir@linaro.org>
+Reviewed-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20221027115745.240516-1-ulf.hansson@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm8250.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8250.dtsi b/arch/arm64/boot/dts/qcom/sm8250.dtsi
+index bc773e210023..052b4dbc1ee4 100644
+--- a/arch/arm64/boot/dts/qcom/sm8250.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm8250.dtsi
+@@ -334,6 +334,7 @@ CLUSTER_SLEEP_0: cluster-sleep-0 {
+ exit-latency-us = <6562>;
+ min-residency-us = <9987>;
+ local-timer-stop;
++ status = "disabled";
+ };
+ };
+ };
+--
+2.35.1
+
--- /dev/null
+From be746d4f83de0bb2a237f5c9f061069c16dd11c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Aug 2022 09:49:51 -0700
+Subject: arm64: dts: qcom: sm8250-xperia-edo: Specify which LDO modes are
+ allowed
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit b7870d460c05ce31e2311036d91de1e2e0b32cea ]
+
+This board uses RPMH, specifies "regulator-allow-set-load" for LDOs,
+but doesn't specify any modes with "regulator-allowed-modes".
+
+Prior to commit efb0cb50c427 ("regulator: qcom-rpmh: Implement
+get_optimum_mode(), not set_load()") the above meant that we were able
+to set either LPM or HPM mode. After that commit (and fixes [1]) we'll
+be stuck at the initial mode. Discussion of this has resulted in the
+decision that the old dts files were wrong and should be fixed to
+fully restore old functionality.
+
+Let's re-enable the old functionality by fixing the dts.
+
+[1] https://lore.kernel.org/r/20220824142229.RFT.v2.2.I6f77860e5cd98bf5c67208fa9edda4a08847c304@changeid
+
+Fixes: 69cdb97ef652 ("arm64: dts: qcom: sm8250: Add support for SONY Xperia 1 II / 5 II (Edo platform)")
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Reviewed-by: Andrew Halaney <ahalaney@redhat.com>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@somainline.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20220829094903.v2.5.Ie446d5183d8b1e9ec4e32228ca300e604e3315eb@changeid
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm8250-sony-xperia-edo.dtsi | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8250-sony-xperia-edo.dtsi b/arch/arm64/boot/dts/qcom/sm8250-sony-xperia-edo.dtsi
+index 549e0a2aa9fe..5428aab3058d 100644
+--- a/arch/arm64/boot/dts/qcom/sm8250-sony-xperia-edo.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm8250-sony-xperia-edo.dtsi
+@@ -317,6 +317,9 @@ vreg_l6c_2p9: ldo6 {
+ regulator-max-microvolt = <2960000>;
+ regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+ regulator-allow-set-load;
++ regulator-allowed-modes =
++ <RPMH_REGULATOR_MODE_LPM
++ RPMH_REGULATOR_MODE_HPM>;
+ };
+
+ vreg_l7c_2p85: ldo7 {
+@@ -339,6 +342,9 @@ vreg_l9c_2p9: ldo9 {
+ regulator-max-microvolt = <2960000>;
+ regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+ regulator-allow-set-load;
++ regulator-allowed-modes =
++ <RPMH_REGULATOR_MODE_LPM
++ RPMH_REGULATOR_MODE_HPM>;
+ };
+
+ vreg_l10c_3p3: ldo10 {
+--
+2.35.1
+
--- /dev/null
+From 3b62ffade119c6ef078e23f1538e723782df5e8e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Aug 2022 09:49:52 -0700
+Subject: arm64: dts: qcom: sm8350-hdk: Specify which LDO modes are allowed
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit 1ce8aaf6abdc35cde555924418b3d4516b4ec871 ]
+
+This board uses RPMH, specifies "regulator-allow-set-load" for LDOs,
+but doesn't specify any modes with "regulator-allowed-modes".
+
+Prior to commit efb0cb50c427 ("regulator: qcom-rpmh: Implement
+get_optimum_mode(), not set_load()") the above meant that we were able
+to set either LPM or HPM mode. After that commit (and fixes [1]) we'll
+be stuck at the initial mode. Discussion of this has resulted in the
+decision that the old dts files were wrong and should be fixed to
+fully restore old functionality.
+
+Let's re-enable the old functionality by fixing the dts.
+
+[1] https://lore.kernel.org/r/20220824142229.RFT.v2.2.I6f77860e5cd98bf5c67208fa9edda4a08847c304@changeid
+
+Fixes: 9208c19f2124 ("arm64: dts: qcom: Introduce SM8350 HDK")
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Reviewed-by: Andrew Halaney <ahalaney@redhat.com>
+Reviewed-by: Vinod Koul <vkoul@kernel.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@somainline.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20220829094903.v2.6.I6799be85cf36d3b494f803cba767a569080624f5@changeid
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm8350-hdk.dts | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8350-hdk.dts b/arch/arm64/boot/dts/qcom/sm8350-hdk.dts
+index 0fcf5bd88fc7..69ae6503c2f6 100644
+--- a/arch/arm64/boot/dts/qcom/sm8350-hdk.dts
++++ b/arch/arm64/boot/dts/qcom/sm8350-hdk.dts
+@@ -107,6 +107,9 @@ vreg_l5b_0p88: ldo5 {
+ regulator-max-microvolt = <888000>;
+ regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+ regulator-allow-set-load;
++ regulator-allowed-modes =
++ <RPMH_REGULATOR_MODE_LPM
++ RPMH_REGULATOR_MODE_HPM>;
+ };
+
+ vreg_l6b_1p2: ldo6 {
+@@ -115,6 +118,9 @@ vreg_l6b_1p2: ldo6 {
+ regulator-max-microvolt = <1208000>;
+ regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+ regulator-allow-set-load;
++ regulator-allowed-modes =
++ <RPMH_REGULATOR_MODE_LPM
++ RPMH_REGULATOR_MODE_HPM>;
+ };
+
+ vreg_l7b_2p96: ldo7 {
+@@ -123,6 +129,9 @@ vreg_l7b_2p96: ldo7 {
+ regulator-max-microvolt = <2504000>;
+ regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+ regulator-allow-set-load;
++ regulator-allowed-modes =
++ <RPMH_REGULATOR_MODE_LPM
++ RPMH_REGULATOR_MODE_HPM>;
+ };
+
+ vreg_l9b_1p2: ldo9 {
+@@ -131,6 +140,9 @@ vreg_l9b_1p2: ldo9 {
+ regulator-max-microvolt = <1200000>;
+ regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+ regulator-allow-set-load;
++ regulator-allowed-modes =
++ <RPMH_REGULATOR_MODE_LPM
++ RPMH_REGULATOR_MODE_HPM>;
+ };
+ };
+
+--
+2.35.1
+
--- /dev/null
+From 0f7d76518a7db6629c9a508288902af5699b169a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Nov 2022 09:01:06 -0700
+Subject: arm64: Fix bit-shifting UB in the MIDR_CPU_MODEL() macro
+
+From: D Scott Phillips <scott@os.amperecomputing.com>
+
+[ Upstream commit 8ec8490a1950efeccb00967698cf7cb2fcd25ca7 ]
+
+CONFIG_UBSAN_SHIFT with gcc-5 complains that the shifting of
+ARM_CPU_IMP_AMPERE (0xC0) into bits [31:24] by MIDR_CPU_MODEL() is
+undefined behavior. Well, sort of, it actually spells the error as:
+
+ arch/arm64/kernel/proton-pack.c: In function 'spectre_bhb_loop_affected':
+ arch/arm64/include/asm/cputype.h:44:2: error: initializer element is not constant
+ (((imp) << MIDR_IMPLEMENTOR_SHIFT) | \
+ ^
+
+This isn't an issue for other Implementor codes, as all the other codes
+have zero in the top bit and so are representable as a signed int.
+
+Cast the implementor code to unsigned in MIDR_CPU_MODEL to remove the
+undefined behavior.
+
+Fixes: 0e5d5ae837c8 ("arm64: Add AMPERE1 to the Spectre-BHB affected list")
+Reported-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: D Scott Phillips <scott@os.amperecomputing.com>
+Link: https://lore.kernel.org/r/20221102160106.1096948-1-scott@os.amperecomputing.com
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/include/asm/cputype.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/include/asm/cputype.h b/arch/arm64/include/asm/cputype.h
+index abc418650fec..65e53ef5a396 100644
+--- a/arch/arm64/include/asm/cputype.h
++++ b/arch/arm64/include/asm/cputype.h
+@@ -41,7 +41,7 @@
+ (((midr) & MIDR_IMPLEMENTOR_MASK) >> MIDR_IMPLEMENTOR_SHIFT)
+
+ #define MIDR_CPU_MODEL(imp, partnum) \
+- (((imp) << MIDR_IMPLEMENTOR_SHIFT) | \
++ ((_AT(u32, imp) << MIDR_IMPLEMENTOR_SHIFT) | \
+ (0xf << MIDR_ARCHITECTURE_SHIFT) | \
+ ((partnum) << MIDR_PARTNUM_SHIFT))
+
+--
+2.35.1
+
--- /dev/null
+From 701ce85a422cd8a8606b5a511ae7a77e8d3e9988 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Oct 2022 11:16:03 +0800
+Subject: ASoC: core: Fix use-after-free in snd_soc_exit()
+
+From: Chen Zhongjin <chenzhongjin@huawei.com>
+
+[ Upstream commit 6ec27c53886c8963729885bcf2dd996eba2767a7 ]
+
+KASAN reports a use-after-free:
+
+BUG: KASAN: use-after-free in device_del+0xb5b/0xc60
+Read of size 8 at addr ffff888008655050 by task rmmod/387
+CPU: 2 PID: 387 Comm: rmmod
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)
+Call Trace:
+<TASK>
+dump_stack_lvl+0x79/0x9a
+print_report+0x17f/0x47b
+kasan_report+0xbb/0xf0
+device_del+0xb5b/0xc60
+platform_device_del.part.0+0x24/0x200
+platform_device_unregister+0x2e/0x40
+snd_soc_exit+0xa/0x22 [snd_soc_core]
+__do_sys_delete_module.constprop.0+0x34f/0x5b0
+do_syscall_64+0x3a/0x90
+entry_SYSCALL_64_after_hwframe+0x63/0xcd
+...
+</TASK>
+
+It's bacause in snd_soc_init(), snd_soc_util_init() is possble to fail,
+but its ret is ignored, which makes soc_dummy_dev unregistered twice.
+
+snd_soc_init()
+ snd_soc_util_init()
+ platform_device_register_simple(soc_dummy_dev)
+ platform_driver_register() # fail
+ platform_device_unregister(soc_dummy_dev)
+ platform_driver_register() # success
+...
+snd_soc_exit()
+ snd_soc_util_exit()
+ # soc_dummy_dev will be unregistered for second time
+
+To fix it, handle error and stop snd_soc_init() when util_init() fail.
+Also clean debugfs when util_init() or driver_register() fail.
+
+Fixes: fb257897bf20 ("ASoC: Work around allmodconfig failure")
+Signed-off-by: Chen Zhongjin <chenzhongjin@huawei.com>
+Link: https://lore.kernel.org/r/20221028031603.59416-1-chenzhongjin@huawei.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/soc-core.c | 17 +++++++++++++++--
+ 1 file changed, 15 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
+index e824ff1a9fc0..3d057784cbd5 100644
+--- a/sound/soc/soc-core.c
++++ b/sound/soc/soc-core.c
+@@ -3472,10 +3472,23 @@ EXPORT_SYMBOL_GPL(snd_soc_of_get_dai_link_cpus);
+
+ static int __init snd_soc_init(void)
+ {
++ int ret;
++
+ snd_soc_debugfs_init();
+- snd_soc_util_init();
++ ret = snd_soc_util_init();
++ if (ret)
++ goto err_util_init;
+
+- return platform_driver_register(&soc_driver);
++ ret = platform_driver_register(&soc_driver);
++ if (ret)
++ goto err_register;
++ return 0;
++
++err_register:
++ snd_soc_util_exit();
++err_util_init:
++ snd_soc_debugfs_exit();
++ return ret;
+ }
+ module_init(snd_soc_init);
+
+--
+2.35.1
+
--- /dev/null
+From a7ed1133758142ee44c3e2ffd3debec5b3af7359 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Oct 2022 16:11:28 +0200
+Subject: ASoC: fsl_asrc fsl_esai fsl_sai: allow CONFIG_PM=N
+
+From: Maarten Zanders <maarten.zanders@mind.be>
+
+[ Upstream commit 6a564338a23cefcfc29c4a535b98402d13efdda6 ]
+
+When CONFIG_PM=N, pm_runtime_put_sync() returns -ENOSYS
+which breaks the probe function of these drivers.
+
+Other users of pm_runtime_put_sync() typically don't check
+the return value. In order to keep the program flow as
+intended, check for -ENOSYS.
+
+This commit is similar to commit 0434d3f (omap-mailbox.c).
+
+Fixes: cab04ab5900f ("ASoC: fsl_asrc: Don't use devm_regmap_init_mmio_clk")
+Fixes: 203773e39347 ("ASoC: fsl_esai: Don't use devm_regmap_init_mmio_clk")
+Fixes: 2277e7e36b4b ("ASoC: fsl_sai: Don't use devm_regmap_init_mmio_clk")
+Signed-off-by: Maarten Zanders <maarten.zanders@mind.be>
+Reviewed-by: Daniel Baluta <daniel.baluta@nxp.com>
+Link: https://lore.kernel.org/r/20221028141129.100702-1-maarten.zanders@mind.be
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/fsl/fsl_asrc.c | 2 +-
+ sound/soc/fsl/fsl_esai.c | 2 +-
+ sound/soc/fsl/fsl_sai.c | 2 +-
+ 3 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/sound/soc/fsl/fsl_asrc.c b/sound/soc/fsl/fsl_asrc.c
+index aa5edf32d988..d90adb6ee43d 100644
+--- a/sound/soc/fsl/fsl_asrc.c
++++ b/sound/soc/fsl/fsl_asrc.c
+@@ -1224,7 +1224,7 @@ static int fsl_asrc_probe(struct platform_device *pdev)
+ }
+
+ ret = pm_runtime_put_sync(&pdev->dev);
+- if (ret < 0)
++ if (ret < 0 && ret != -ENOSYS)
+ goto err_pm_get_sync;
+
+ ret = devm_snd_soc_register_component(&pdev->dev, &fsl_asrc_component,
+diff --git a/sound/soc/fsl/fsl_esai.c b/sound/soc/fsl/fsl_esai.c
+index 5c21fc490fce..17fefd27ec90 100644
+--- a/sound/soc/fsl/fsl_esai.c
++++ b/sound/soc/fsl/fsl_esai.c
+@@ -1069,7 +1069,7 @@ static int fsl_esai_probe(struct platform_device *pdev)
+ regmap_write(esai_priv->regmap, REG_ESAI_RSMB, 0);
+
+ ret = pm_runtime_put_sync(&pdev->dev);
+- if (ret < 0)
++ if (ret < 0 && ret != -ENOSYS)
+ goto err_pm_get_sync;
+
+ /*
+diff --git a/sound/soc/fsl/fsl_sai.c b/sound/soc/fsl/fsl_sai.c
+index d430eece1d6b..887063f9cbea 100644
+--- a/sound/soc/fsl/fsl_sai.c
++++ b/sound/soc/fsl/fsl_sai.c
+@@ -1415,7 +1415,7 @@ static int fsl_sai_probe(struct platform_device *pdev)
+ }
+
+ ret = pm_runtime_put_sync(dev);
+- if (ret < 0)
++ if (ret < 0 && ret != -ENOSYS)
+ goto err_pm_get_sync;
+
+ /*
+--
+2.35.1
+
--- /dev/null
+From 49ded87c27a777ad882d066dc8d42e7b7efb8731 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Nov 2022 10:46:11 -0400
+Subject: ASoC: rt5514: fix legacy dai naming
+
+From: Jason Montleon <jmontleo@redhat.com>
+
+[ Upstream commit 392cc13c5ec72ccd6bbfb1bc2339502cc59dd285 ]
+
+Starting with 6.0-rc1 these messages are logged and the sound card
+is unavailable. Adding legacy_dai_naming to the rt5514-spi causes
+it to function properly again.
+
+[ 16.928454] kbl_r5514_5663_max kbl_r5514_5663_max: ASoC: CPU DAI
+spi-PRP0001:00 not registered
+[ 16.928561] platform kbl_r5514_5663_max: deferred probe pending
+
+Fixes: fc34ece41f71 ("ASoC: Refactor non_legacy_dai_naming flag")
+BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=216641
+Signed-off-by: Jason Montleon <jmontleo@redhat.com>
+Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20221103144612.4431-1-jmontleo@redhat.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/rt5514-spi.c | 15 ++++++++-------
+ 1 file changed, 8 insertions(+), 7 deletions(-)
+
+diff --git a/sound/soc/codecs/rt5514-spi.c b/sound/soc/codecs/rt5514-spi.c
+index 1a25a3787935..362663abcb89 100644
+--- a/sound/soc/codecs/rt5514-spi.c
++++ b/sound/soc/codecs/rt5514-spi.c
+@@ -298,13 +298,14 @@ static int rt5514_spi_pcm_new(struct snd_soc_component *component,
+ }
+
+ static const struct snd_soc_component_driver rt5514_spi_component = {
+- .name = DRV_NAME,
+- .probe = rt5514_spi_pcm_probe,
+- .open = rt5514_spi_pcm_open,
+- .hw_params = rt5514_spi_hw_params,
+- .hw_free = rt5514_spi_hw_free,
+- .pointer = rt5514_spi_pcm_pointer,
+- .pcm_construct = rt5514_spi_pcm_new,
++ .name = DRV_NAME,
++ .probe = rt5514_spi_pcm_probe,
++ .open = rt5514_spi_pcm_open,
++ .hw_params = rt5514_spi_hw_params,
++ .hw_free = rt5514_spi_hw_free,
++ .pointer = rt5514_spi_pcm_pointer,
++ .pcm_construct = rt5514_spi_pcm_new,
++ .legacy_dai_naming = 1,
+ };
+
+ /**
+--
+2.35.1
+
--- /dev/null
+From 05557a9c62afdcd33fa9bfb8ea31135f6a65d40a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Nov 2022 10:46:12 -0400
+Subject: ASoC: rt5677: fix legacy dai naming
+
+From: Jason Montleon <jmontleo@redhat.com>
+
+[ Upstream commit a1dca8774faf3f77eb34fa0ac6f3e2b82290b1e4 ]
+
+Starting with 6.0-rc1 the CPU DAI is not registered and the sound
+card is unavailable. Adding legacy_dai_naming causes it to function
+properly again.
+
+Fixes: fc34ece41f71 ("ASoC: Refactor non_legacy_dai_naming flag")
+Signed-off-by: Jason Montleon <jmontleo@redhat.com>
+Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20221103144612.4431-2-jmontleo@redhat.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/rt5677-spi.c | 19 ++++++++++---------
+ 1 file changed, 10 insertions(+), 9 deletions(-)
+
+diff --git a/sound/soc/codecs/rt5677-spi.c b/sound/soc/codecs/rt5677-spi.c
+index 8f3993a4c1cc..d25703dd7499 100644
+--- a/sound/soc/codecs/rt5677-spi.c
++++ b/sound/soc/codecs/rt5677-spi.c
+@@ -396,15 +396,16 @@ static int rt5677_spi_pcm_probe(struct snd_soc_component *component)
+ }
+
+ static const struct snd_soc_component_driver rt5677_spi_dai_component = {
+- .name = DRV_NAME,
+- .probe = rt5677_spi_pcm_probe,
+- .open = rt5677_spi_pcm_open,
+- .close = rt5677_spi_pcm_close,
+- .hw_params = rt5677_spi_hw_params,
+- .hw_free = rt5677_spi_hw_free,
+- .prepare = rt5677_spi_prepare,
+- .pointer = rt5677_spi_pcm_pointer,
+- .pcm_construct = rt5677_spi_pcm_new,
++ .name = DRV_NAME,
++ .probe = rt5677_spi_pcm_probe,
++ .open = rt5677_spi_pcm_open,
++ .close = rt5677_spi_pcm_close,
++ .hw_params = rt5677_spi_hw_params,
++ .hw_free = rt5677_spi_hw_free,
++ .prepare = rt5677_spi_prepare,
++ .pointer = rt5677_spi_pcm_pointer,
++ .pcm_construct = rt5677_spi_pcm_new,
++ .legacy_dai_naming = 1,
+ };
+
+ /* Select a suitable transfer command for the next transfer to ensure
+--
+2.35.1
+
--- /dev/null
+From e7d9e839a2c9f49e84c552e684b1076fbb0f85de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 31 Oct 2022 21:40:31 +0800
+Subject: ASoC: soc-utils: Remove __exit for snd_soc_util_exit()
+
+From: Chen Zhongjin <chenzhongjin@huawei.com>
+
+[ Upstream commit 314d34fe7f0a5836cb0472950c1f17744b4efde8 ]
+
+snd_soc_util_exit() is called in __init snd_soc_init() for cleanup.
+Remove the __exit annotation for it to fix the build warning:
+
+WARNING: modpost: sound/soc/snd-soc-core.o: section mismatch in reference: init_module (section: .init.text) -> snd_soc_util_exit (section: .exit.text)
+
+Fixes: 6ec27c53886c ("ASoC: core: Fix use-after-free in snd_soc_exit()")
+Signed-off-by: Chen Zhongjin <chenzhongjin@huawei.com>
+Link: https://lore.kernel.org/r/20221031134031.256511-1-chenzhongjin@huawei.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/soc-utils.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/soc-utils.c b/sound/soc/soc-utils.c
+index 70c380c0ac7b..d1308904e6e0 100644
+--- a/sound/soc/soc-utils.c
++++ b/sound/soc/soc-utils.c
+@@ -263,7 +263,7 @@ int __init snd_soc_util_init(void)
+ return ret;
+ }
+
+-void __exit snd_soc_util_exit(void)
++void snd_soc_util_exit(void)
+ {
+ platform_driver_unregister(&soc_dummy_driver);
+ platform_device_unregister(soc_dummy_dev);
+--
+2.35.1
+
--- /dev/null
+From 9fd11bb1e0b40ba84ebcdbc7c482755cee0ec34a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Oct 2022 11:57:59 +0200
+Subject: ASoC: tas2764: Fix set_tdm_slot in case of single slot
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Martin Povišer <povik+lin@cutebit.org>
+
+[ Upstream commit faac764ea1ea6898d93e46c403271fb105c0906e ]
+
+There's a special branch in the set_tdm_slot op for the case of nslots
+being 1, but:
+
+ (1) That branch can never work (there's a check for tx_mask being
+ non-zero, later there's another check for it *being* zero; one or
+ the other always throws -EINVAL).
+
+ (2) The intention of the branch seems to be what the general other
+ branch reduces to in case of nslots being 1.
+
+For those reasons remove the 'nslots being 1' special case.
+
+Fixes: 827ed8a0fa50 ("ASoC: tas2764: Add the driver for the TAS2764")
+Suggested-by: Jos Dehaes <jos.dehaes@gmail.com>
+Signed-off-by: Martin Povišer <povik+lin@cutebit.org>
+Link: https://lore.kernel.org/r/20221027095800.16094-2-povik+lin@cutebit.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/tas2764.c | 19 ++++++-------------
+ 1 file changed, 6 insertions(+), 13 deletions(-)
+
+diff --git a/sound/soc/codecs/tas2764.c b/sound/soc/codecs/tas2764.c
+index 39902f77a2e0..6c87c3cf5ef7 100644
+--- a/sound/soc/codecs/tas2764.c
++++ b/sound/soc/codecs/tas2764.c
+@@ -386,20 +386,13 @@ static int tas2764_set_dai_tdm_slot(struct snd_soc_dai *dai,
+ if (tx_mask == 0 || rx_mask != 0)
+ return -EINVAL;
+
+- if (slots == 1) {
+- if (tx_mask != 1)
+- return -EINVAL;
+- left_slot = 0;
+- right_slot = 0;
++ left_slot = __ffs(tx_mask);
++ tx_mask &= ~(1 << left_slot);
++ if (tx_mask == 0) {
++ right_slot = left_slot;
+ } else {
+- left_slot = __ffs(tx_mask);
+- tx_mask &= ~(1 << left_slot);
+- if (tx_mask == 0) {
+- right_slot = left_slot;
+- } else {
+- right_slot = __ffs(tx_mask);
+- tx_mask &= ~(1 << right_slot);
+- }
++ right_slot = __ffs(tx_mask);
++ tx_mask &= ~(1 << right_slot);
+ }
+
+ if (tx_mask != 0 || left_slot >= slots || right_slot >= slots)
+--
+2.35.1
+
--- /dev/null
+From d6d3b534a98b90af5e893d51e57813690cb09611 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Oct 2022 11:57:58 +0200
+Subject: ASoC: tas2770: Fix set_tdm_slot in case of single slot
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Martin Povišer <povik+lin@cutebit.org>
+
+[ Upstream commit e59bf547a7dd366f93bfebb7487959580ca6c0ec ]
+
+There's a special branch in the set_tdm_slot op for the case of nslots
+being 1, but:
+
+ (1) That branch can never work (there's a check for tx_mask being
+ non-zero, later there's another check for it *being* zero; one or
+ the other always throws -EINVAL).
+
+ (2) The intention of the branch seems to be what the general other
+ branch reduces to in case of nslots being 1.
+
+For those reasons remove the 'nslots being 1' special case.
+
+Fixes: 1a476abc723e ("tas2770: add tas2770 smart PA kernel driver")
+Suggested-by: Jos Dehaes <jos.dehaes@gmail.com>
+Signed-off-by: Martin Povišer <povik+lin@cutebit.org>
+Link: https://lore.kernel.org/r/20221027095800.16094-1-povik+lin@cutebit.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/tas2770.c | 20 ++++++--------------
+ 1 file changed, 6 insertions(+), 14 deletions(-)
+
+diff --git a/sound/soc/codecs/tas2770.c b/sound/soc/codecs/tas2770.c
+index b6765235a4b3..8557759acb1f 100644
+--- a/sound/soc/codecs/tas2770.c
++++ b/sound/soc/codecs/tas2770.c
+@@ -395,21 +395,13 @@ static int tas2770_set_dai_tdm_slot(struct snd_soc_dai *dai,
+ if (tx_mask == 0 || rx_mask != 0)
+ return -EINVAL;
+
+- if (slots == 1) {
+- if (tx_mask != 1)
+- return -EINVAL;
+-
+- left_slot = 0;
+- right_slot = 0;
++ left_slot = __ffs(tx_mask);
++ tx_mask &= ~(1 << left_slot);
++ if (tx_mask == 0) {
++ right_slot = left_slot;
+ } else {
+- left_slot = __ffs(tx_mask);
+- tx_mask &= ~(1 << left_slot);
+- if (tx_mask == 0) {
+- right_slot = left_slot;
+- } else {
+- right_slot = __ffs(tx_mask);
+- tx_mask &= ~(1 << right_slot);
+- }
++ right_slot = __ffs(tx_mask);
++ tx_mask &= ~(1 << right_slot);
+ }
+
+ if (tx_mask != 0 || left_slot >= slots || right_slot >= slots)
+--
+2.35.1
+
--- /dev/null
+From 1bf9c515f46d247ec46c58d7645038b3e0e021f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Oct 2022 11:58:00 +0200
+Subject: ASoC: tas2780: Fix set_tdm_slot in case of single slot
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Martin Povišer <povik+lin@cutebit.org>
+
+[ Upstream commit 6f934afa6a980bb8d3ce73836b1a9922685e50d7 ]
+
+There's a special branch in the set_tdm_slot op for the case of nslots
+being 1, but:
+
+ (1) That branch can never work (there's a check for tx_mask being
+ non-zero, later there's another check for it *being* zero; one or
+ the other always throws -EINVAL).
+
+ (2) The intention of the branch seems to be what the general other
+ branch reduces to in case of nslots being 1.
+
+For those reasons remove the 'nslots being 1' special case.
+
+Fixes: eae9f9ce181b ("ASoC: add tas2780 driver")
+Suggested-by: Jos Dehaes <jos.dehaes@gmail.com>
+Signed-off-by: Martin Povišer <povik+lin@cutebit.org>
+Link: https://lore.kernel.org/r/20221027095800.16094-3-povik+lin@cutebit.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/tas2780.c | 19 ++++++-------------
+ 1 file changed, 6 insertions(+), 13 deletions(-)
+
+diff --git a/sound/soc/codecs/tas2780.c b/sound/soc/codecs/tas2780.c
+index a6db6f0e5431..afdf0c863aa1 100644
+--- a/sound/soc/codecs/tas2780.c
++++ b/sound/soc/codecs/tas2780.c
+@@ -380,20 +380,13 @@ static int tas2780_set_dai_tdm_slot(struct snd_soc_dai *dai,
+ if (tx_mask == 0 || rx_mask != 0)
+ return -EINVAL;
+
+- if (slots == 1) {
+- if (tx_mask != 1)
+- return -EINVAL;
+- left_slot = 0;
+- right_slot = 0;
++ left_slot = __ffs(tx_mask);
++ tx_mask &= ~(1 << left_slot);
++ if (tx_mask == 0) {
++ right_slot = left_slot;
+ } else {
+- left_slot = __ffs(tx_mask);
+- tx_mask &= ~(1 << left_slot);
+- if (tx_mask == 0) {
+- right_slot = left_slot;
+- } else {
+- right_slot = __ffs(tx_mask);
+- tx_mask &= ~(1 << right_slot);
+- }
++ right_slot = __ffs(tx_mask);
++ tx_mask &= ~(1 << right_slot);
+ }
+
+ if (tx_mask != 0 || left_slot >= slots || right_slot >= slots)
+--
+2.35.1
+
--- /dev/null
+From 2fb66d298304759813799d2bac678e29a3211a54 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Nov 2022 00:15:34 +0100
+Subject: ata: libata-core: do not issue non-internal commands once EH is
+ pending
+
+From: Niklas Cassel <niklas.cassel@wdc.com>
+
+[ Upstream commit e20e81a24a4d58744a29715aac2f795cd1651955 ]
+
+While the ATA specification states that a device should return command
+aborted for all commands queued after the device has entered error state,
+since ATA only keeps the sense data for the latest command (in non-NCQ
+case), we really don't want to send block layer commands to the device
+after it has entered error state. (Only ATA EH commands should be sent,
+to read the sense data etc.)
+
+Currently, scsi_queue_rq() will check if scsi_host_in_recovery()
+(state is SHOST_RECOVERY), and if so, it will _not_ issue a command via:
+scsi_dispatch_cmd() -> host->hostt->queuecommand() (ata_scsi_queuecmd())
+-> __ata_scsi_queuecmd() -> ata_scsi_translate() -> ata_qc_issue()
+
+Before commit e494f6a72839 ("[SCSI] improved eh timeout handler"),
+when receiving a TFES error IRQ, the call chain looked like this:
+ahci_error_intr() -> ata_port_abort() -> ata_do_link_abort() ->
+ata_qc_complete() -> ata_qc_schedule_eh() -> blk_abort_request() ->
+blk_rq_timed_out() -> q->rq_timed_out_fn() (scsi_times_out()) ->
+scsi_eh_scmd_add() -> scsi_host_set_state(shost, SHOST_RECOVERY)
+
+Which meant that as soon as an error IRQ was serviced, SHOST_RECOVERY
+would be set.
+
+However, after commit e494f6a72839 ("[SCSI] improved eh timeout handler"),
+scsi_times_out() will instead call scsi_abort_command() which will queue
+delayed work, and the worker function scmd_eh_abort_handler() will call
+scsi_eh_scmd_add(), which calls scsi_host_set_state(shost, SHOST_RECOVERY).
+
+So now, after the TFES error IRQ has been serviced, we need to wait for
+the SCSI workqueue to run its work before SHOST_RECOVERY gets set.
+
+It is worth noting that, even before commit e494f6a72839 ("[SCSI] improved
+eh timeout handler"), we could receive an error IRQ from the time when
+scsi_queue_rq() checks scsi_host_in_recovery(), to the time when
+ata_scsi_queuecmd() is actually called.
+
+In order to handle both the delayed setting of SHOST_RECOVERY and the
+window where we can receive an error IRQ, add a check against
+ATA_PFLAG_EH_PENDING (which gets set when servicing the error IRQ),
+inside ata_scsi_queuecmd() itself, while holding the ap->lock.
+(Since the ap->lock is held while servicing IRQs.)
+
+Fixes: e494f6a72839 ("[SCSI] improved eh timeout handler")
+Signed-off-by: Niklas Cassel <niklas.cassel@wdc.com>
+Tested-by: John Garry <john.g.garry@oracle.com>
+Signed-off-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ata/libata-scsi.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
+index b0e442a75690..d86e32b71efa 100644
+--- a/drivers/ata/libata-scsi.c
++++ b/drivers/ata/libata-scsi.c
+@@ -3966,9 +3966,19 @@ static inline ata_xlat_func_t ata_get_xlat_func(struct ata_device *dev, u8 cmd)
+
+ int __ata_scsi_queuecmd(struct scsi_cmnd *scmd, struct ata_device *dev)
+ {
++ struct ata_port *ap = dev->link->ap;
+ u8 scsi_op = scmd->cmnd[0];
+ ata_xlat_func_t xlat_func;
+
++ /*
++ * scsi_queue_rq() will defer commands if scsi_host_in_recovery().
++ * However, this check is done without holding the ap->lock (a libata
++ * specific lock), so we can have received an error irq since then,
++ * therefore we must check if EH is pending, while holding ap->lock.
++ */
++ if (ap->pflags & (ATA_PFLAG_EH_PENDING | ATA_PFLAG_EH_IN_PROGRESS))
++ return SCSI_MLQUEUE_DEVICE_BUSY;
++
+ if (unlikely(!scmd->cmd_len))
+ goto bad_cdb_len;
+
+--
+2.35.1
+
--- /dev/null
+From 35ecc9998cd347ad4f9c1323295f6fbd1d1e5cb2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Nov 2022 21:40:01 +0800
+Subject: ata: libata-transport: fix double ata_host_put() in ata_tport_add()
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit 8c76310740807ade5ecdab5888f70ecb6d35732e ]
+
+In the error path in ata_tport_add(), when calling put_device(),
+ata_tport_release() is called, it will put the refcount of 'ap->host'.
+
+And then ata_host_put() is called again, the refcount is decreased
+to 0, ata_host_release() is called, all ports are freed and set to
+null.
+
+When unbinding the device after failure, ata_host_stop() is called
+to release the resources, it leads a null-ptr-deref(), because all
+the ports all freed and null.
+
+Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008
+CPU: 7 PID: 18671 Comm: modprobe Kdump: loaded Tainted: G E 6.1.0-rc3+ #8
+pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+pc : ata_host_stop+0x3c/0x84 [libata]
+lr : release_nodes+0x64/0xd0
+Call trace:
+ ata_host_stop+0x3c/0x84 [libata]
+ release_nodes+0x64/0xd0
+ devres_release_all+0xbc/0x1b0
+ device_unbind_cleanup+0x20/0x70
+ really_probe+0x158/0x320
+ __driver_probe_device+0x84/0x120
+ driver_probe_device+0x44/0x120
+ __driver_attach+0xb4/0x220
+ bus_for_each_dev+0x78/0xdc
+ driver_attach+0x2c/0x40
+ bus_add_driver+0x184/0x240
+ driver_register+0x80/0x13c
+ __pci_register_driver+0x4c/0x60
+ ahci_pci_driver_init+0x30/0x1000 [ahci]
+
+Fix this by removing redundant ata_host_put() in the error path.
+
+Fixes: 2623c7a5f279 ("libata: add refcounting to ata_host")
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Signed-off-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ata/libata-transport.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/ata/libata-transport.c b/drivers/ata/libata-transport.c
+index a7e9a75410a3..105da3ec5eaa 100644
+--- a/drivers/ata/libata-transport.c
++++ b/drivers/ata/libata-transport.c
+@@ -317,7 +317,6 @@ int ata_tport_add(struct device *parent,
+ tport_err:
+ transport_destroy_device(dev);
+ put_device(dev);
+- ata_host_put(ap->host);
+ return error;
+ }
+
+--
+2.35.1
+
--- /dev/null
+From b71b62dcec789108e32d6689cfdff947e9707b06 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Nov 2022 21:40:04 +0800
+Subject: ata: libata-transport: fix error handling in ata_tdev_add()
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit 1ff36351309e3eadcff297480baf4785e726de9b ]
+
+In ata_tdev_add(), the return value of transport_add_device() is
+not checked. As a result, it causes null-ptr-deref while removing
+the module, because transport_remove_device() is called to remove
+the device that was not added.
+
+Unable to handle kernel NULL pointer dereference at virtual address 00000000000000d0
+CPU: 13 PID: 13603 Comm: rmmod Kdump: loaded Tainted: G W 6.1.0-rc3+ #36
+pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+pc : device_del+0x48/0x3a0
+lr : device_del+0x44/0x3a0
+Call trace:
+ device_del+0x48/0x3a0
+ attribute_container_class_device_del+0x28/0x40
+ transport_remove_classdev+0x60/0x7c
+ attribute_container_device_trigger+0x118/0x120
+ transport_remove_device+0x20/0x30
+ ata_tdev_delete+0x24/0x50 [libata]
+ ata_tlink_delete+0x40/0xa0 [libata]
+ ata_tport_delete+0x2c/0x60 [libata]
+ ata_port_detach+0x148/0x1b0 [libata]
+ ata_pci_remove_one+0x50/0x80 [libata]
+ ahci_remove_one+0x4c/0x8c [ahci]
+
+Fix this by checking and handling return value of transport_add_device()
+in ata_tdev_add(). In the error path, device_del() is called to delete
+the device which was added earlier in this function, and ata_tdev_free()
+is called to free ata_dev.
+
+Fixes: d9027470b886 ("[libata] Add ATA transport class")
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Signed-off-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ata/libata-transport.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/ata/libata-transport.c b/drivers/ata/libata-transport.c
+index aac9336e8153..e4fb9d1b9b39 100644
+--- a/drivers/ata/libata-transport.c
++++ b/drivers/ata/libata-transport.c
+@@ -713,7 +713,13 @@ static int ata_tdev_add(struct ata_device *ata_dev)
+ return error;
+ }
+
+- transport_add_device(dev);
++ error = transport_add_device(dev);
++ if (error) {
++ device_del(dev);
++ ata_tdev_free(ata_dev);
++ return error;
++ }
++
+ transport_configure_device(dev);
+ return 0;
+ }
+--
+2.35.1
+
--- /dev/null
+From 931ee766353bba3ae3649420b17b4a684b61e0b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Nov 2022 21:40:03 +0800
+Subject: ata: libata-transport: fix error handling in ata_tlink_add()
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit cf0816f6322c5c37ee52655f928e91ecf32da103 ]
+
+In ata_tlink_add(), the return value of transport_add_device() is
+not checked. As a result, it causes null-ptr-deref while removing
+the module, because transport_remove_device() is called to remove
+the device that was not added.
+
+Unable to handle kernel NULL pointer dereference at virtual address 00000000000000d0
+CPU: 33 PID: 13850 Comm: rmmod Kdump: loaded Tainted: G W 6.1.0-rc3+ #12
+pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+pc : device_del+0x48/0x39c
+lr : device_del+0x44/0x39c
+Call trace:
+ device_del+0x48/0x39c
+ attribute_container_class_device_del+0x28/0x40
+ transport_remove_classdev+0x60/0x7c
+ attribute_container_device_trigger+0x118/0x120
+ transport_remove_device+0x20/0x30
+ ata_tlink_delete+0x88/0xb0 [libata]
+ ata_tport_delete+0x2c/0x60 [libata]
+ ata_port_detach+0x148/0x1b0 [libata]
+ ata_pci_remove_one+0x50/0x80 [libata]
+ ahci_remove_one+0x4c/0x8c [ahci]
+
+Fix this by checking and handling return value of transport_add_device()
+in ata_tlink_add().
+
+Fixes: d9027470b886 ("[libata] Add ATA transport class")
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Signed-off-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ata/libata-transport.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/ata/libata-transport.c b/drivers/ata/libata-transport.c
+index ef53bdfbcbb2..aac9336e8153 100644
+--- a/drivers/ata/libata-transport.c
++++ b/drivers/ata/libata-transport.c
+@@ -458,7 +458,9 @@ int ata_tlink_add(struct ata_link *link)
+ goto tlink_err;
+ }
+
+- transport_add_device(dev);
++ error = transport_add_device(dev);
++ if (error)
++ goto tlink_transport_err;
+ transport_configure_device(dev);
+
+ ata_for_each_dev(ata_dev, link, ALL) {
+@@ -473,6 +475,7 @@ int ata_tlink_add(struct ata_link *link)
+ ata_tdev_delete(ata_dev);
+ }
+ transport_remove_device(dev);
++ tlink_transport_err:
+ device_del(dev);
+ tlink_err:
+ transport_destroy_device(dev);
+--
+2.35.1
+
--- /dev/null
+From 0f7b67655665b906d72a2d2854ce36b86add4827 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Nov 2022 21:40:02 +0800
+Subject: ata: libata-transport: fix error handling in ata_tport_add()
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit 3613dbe3909dcc637fe6be00e4dc43b4aa0470ee ]
+
+In ata_tport_add(), the return value of transport_add_device() is
+not checked. As a result, it causes null-ptr-deref while removing
+the module, because transport_remove_device() is called to remove
+the device that was not added.
+
+Unable to handle kernel NULL pointer dereference at virtual address 00000000000000d0
+CPU: 12 PID: 13605 Comm: rmmod Kdump: loaded Tainted: G W 6.1.0-rc3+ #8
+pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+pc : device_del+0x48/0x39c
+lr : device_del+0x44/0x39c
+Call trace:
+ device_del+0x48/0x39c
+ attribute_container_class_device_del+0x28/0x40
+ transport_remove_classdev+0x60/0x7c
+ attribute_container_device_trigger+0x118/0x120
+ transport_remove_device+0x20/0x30
+ ata_tport_delete+0x34/0x60 [libata]
+ ata_port_detach+0x148/0x1b0 [libata]
+ ata_pci_remove_one+0x50/0x80 [libata]
+ ahci_remove_one+0x4c/0x8c [ahci]
+
+Fix this by checking and handling return value of transport_add_device()
+in ata_tport_add().
+
+Fixes: d9027470b886 ("[libata] Add ATA transport class")
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Signed-off-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ata/libata-transport.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/ata/libata-transport.c b/drivers/ata/libata-transport.c
+index 105da3ec5eaa..ef53bdfbcbb2 100644
+--- a/drivers/ata/libata-transport.c
++++ b/drivers/ata/libata-transport.c
+@@ -301,7 +301,9 @@ int ata_tport_add(struct device *parent,
+ pm_runtime_enable(dev);
+ pm_runtime_forbid(dev);
+
+- transport_add_device(dev);
++ error = transport_add_device(dev);
++ if (error)
++ goto tport_transport_add_err;
+ transport_configure_device(dev);
+
+ error = ata_tlink_add(&ap->link);
+@@ -312,6 +314,7 @@ int ata_tport_add(struct device *parent,
+
+ tport_link_err:
+ transport_remove_device(dev);
++ tport_transport_add_err:
+ device_del(dev);
+
+ tport_err:
+--
+2.35.1
+
--- /dev/null
+From 2ec26c01e7fa3d6c208ba501c19120b2068b2c6c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Nov 2022 10:44:57 -0800
+Subject: block: make dma_alignment a stacking queue_limit
+
+From: Keith Busch <kbusch@kernel.org>
+
+[ Upstream commit c964d62f5cab7b43dd0534f22a96eab386c6ec5d ]
+
+Device mappers had always been getting the default 511 dma mask, but
+the underlying device might have a larger alignment requirement. Since
+this value is used to determine alloweable direct-io alignment, this
+needs to be a stackable limit.
+
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Link: https://lore.kernel.org/r/20221110184501.2451620-2-kbusch@meta.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Stable-dep-of: 86e4d3e8d183 ("dm-crypt: provide dma_alignment limit in io_hints")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-core.c | 1 -
+ block/blk-settings.c | 8 +++++---
+ include/linux/blkdev.h | 15 ++++++++-------
+ 3 files changed, 13 insertions(+), 11 deletions(-)
+
+diff --git a/block/blk-core.c b/block/blk-core.c
+index 651057c4146b..2fbdf17f2206 100644
+--- a/block/blk-core.c
++++ b/block/blk-core.c
+@@ -426,7 +426,6 @@ struct request_queue *blk_alloc_queue(int node_id, bool alloc_srcu)
+ PERCPU_REF_INIT_ATOMIC, GFP_KERNEL))
+ goto fail_stats;
+
+- blk_queue_dma_alignment(q, 511);
+ blk_set_default_limits(&q->limits);
+ q->nr_requests = BLKDEV_DEFAULT_RQ;
+
+diff --git a/block/blk-settings.c b/block/blk-settings.c
+index 8bb9eef5310e..4949ed3ce7c9 100644
+--- a/block/blk-settings.c
++++ b/block/blk-settings.c
+@@ -57,6 +57,7 @@ void blk_set_default_limits(struct queue_limits *lim)
+ lim->misaligned = 0;
+ lim->zoned = BLK_ZONED_NONE;
+ lim->zone_write_granularity = 0;
++ lim->dma_alignment = 511;
+ }
+ EXPORT_SYMBOL(blk_set_default_limits);
+
+@@ -600,6 +601,7 @@ int blk_stack_limits(struct queue_limits *t, struct queue_limits *b,
+
+ t->io_min = max(t->io_min, b->io_min);
+ t->io_opt = lcm_not_zero(t->io_opt, b->io_opt);
++ t->dma_alignment = max(t->dma_alignment, b->dma_alignment);
+
+ /* Set non-power-of-2 compatible chunk_sectors boundary */
+ if (b->chunk_sectors)
+@@ -773,7 +775,7 @@ EXPORT_SYMBOL(blk_queue_virt_boundary);
+ **/
+ void blk_queue_dma_alignment(struct request_queue *q, int mask)
+ {
+- q->dma_alignment = mask;
++ q->limits.dma_alignment = mask;
+ }
+ EXPORT_SYMBOL(blk_queue_dma_alignment);
+
+@@ -795,8 +797,8 @@ void blk_queue_update_dma_alignment(struct request_queue *q, int mask)
+ {
+ BUG_ON(mask > PAGE_SIZE);
+
+- if (mask > q->dma_alignment)
+- q->dma_alignment = mask;
++ if (mask > q->limits.dma_alignment)
++ q->limits.dma_alignment = mask;
+ }
+ EXPORT_SYMBOL(blk_queue_update_dma_alignment);
+
+diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
+index 84b13fdd34a7..79624711fda7 100644
+--- a/include/linux/blkdev.h
++++ b/include/linux/blkdev.h
+@@ -311,6 +311,13 @@ struct queue_limits {
+ unsigned char discard_misaligned;
+ unsigned char raid_partial_stripes_expensive;
+ enum blk_zoned_model zoned;
++
++ /*
++ * Drivers that set dma_alignment to less than 511 must be prepared to
++ * handle individual bvec's that are not a multiple of a SECTOR_SIZE
++ * due to possible offsets.
++ */
++ unsigned int dma_alignment;
+ };
+
+ typedef int (*report_zones_cb)(struct blk_zone *zone, unsigned int idx,
+@@ -456,12 +463,6 @@ struct request_queue {
+ unsigned long nr_requests; /* Max # of requests */
+
+ unsigned int dma_pad_mask;
+- /*
+- * Drivers that set dma_alignment to less than 511 must be prepared to
+- * handle individual bvec's that are not a multiple of a SECTOR_SIZE
+- * due to possible offsets.
+- */
+- unsigned int dma_alignment;
+
+ #ifdef CONFIG_BLK_INLINE_ENCRYPTION
+ struct blk_crypto_profile *crypto_profile;
+@@ -1311,7 +1312,7 @@ static inline sector_t bdev_zone_sectors(struct block_device *bdev)
+
+ static inline int queue_dma_alignment(const struct request_queue *q)
+ {
+- return q ? q->dma_alignment : 511;
++ return q ? q->limits.dma_alignment : 511;
+ }
+
+ static inline unsigned int bdev_dma_alignment(struct block_device *bdev)
+--
+2.35.1
+
--- /dev/null
+From bef59ea866bac1e550f39ab66e1cd8ecf2a1fdfe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Nov 2022 23:39:44 +0300
+Subject: block: sed-opal: kmalloc the cmd/resp buffers
+
+From: Serge Semin <Sergey.Semin@baikalelectronics.ru>
+
+[ Upstream commit f829230dd51974c1f4478900ed30bb77ba530b40 ]
+
+In accordance with [1] the DMA-able memory buffers must be
+cacheline-aligned otherwise the cache writing-back and invalidation
+performed during the mapping may cause the adjacent data being lost. It's
+specifically required for the DMA-noncoherent platforms [2]. Seeing the
+opal_dev.{cmd,resp} buffers are implicitly used for DMAs in the NVME and
+SCSI/SD drivers in framework of the nvme_sec_submit() and sd_sec_submit()
+methods respectively they must be cacheline-aligned to prevent the denoted
+problem. One of the option to guarantee that is to kmalloc the buffers
+[2]. Let's explicitly allocate them then instead of embedding into the
+opal_dev structure instance.
+
+Note this fix was inspired by the commit c94b7f9bab22 ("nvme-hwmon:
+kmalloc the NVME SMART log buffer").
+
+[1] Documentation/core-api/dma-api.rst
+[2] Documentation/core-api/dma-api-howto.rst
+
+Fixes: 455a7b238cd6 ("block: Add Sed-opal library")
+Signed-off-by: Serge Semin <Sergey.Semin@baikalelectronics.ru>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Link: https://lore.kernel.org/r/20221107203944.31686-1-Sergey.Semin@baikalelectronics.ru
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/sed-opal.c | 32 ++++++++++++++++++++++++++++----
+ 1 file changed, 28 insertions(+), 4 deletions(-)
+
+diff --git a/block/sed-opal.c b/block/sed-opal.c
+index 9700197000f2..55cd37e868c0 100644
+--- a/block/sed-opal.c
++++ b/block/sed-opal.c
+@@ -88,8 +88,8 @@ struct opal_dev {
+ u64 lowest_lba;
+
+ size_t pos;
+- u8 cmd[IO_BUFFER_LENGTH];
+- u8 resp[IO_BUFFER_LENGTH];
++ u8 *cmd;
++ u8 *resp;
+
+ struct parsed_resp parsed;
+ size_t prev_d_len;
+@@ -2134,6 +2134,8 @@ void free_opal_dev(struct opal_dev *dev)
+ return;
+
+ clean_opal_dev(dev);
++ kfree(dev->resp);
++ kfree(dev->cmd);
+ kfree(dev);
+ }
+ EXPORT_SYMBOL(free_opal_dev);
+@@ -2146,17 +2148,39 @@ struct opal_dev *init_opal_dev(void *data, sec_send_recv *send_recv)
+ if (!dev)
+ return NULL;
+
++ /*
++ * Presumably DMA-able buffers must be cache-aligned. Kmalloc makes
++ * sure the allocated buffer is DMA-safe in that regard.
++ */
++ dev->cmd = kmalloc(IO_BUFFER_LENGTH, GFP_KERNEL);
++ if (!dev->cmd)
++ goto err_free_dev;
++
++ dev->resp = kmalloc(IO_BUFFER_LENGTH, GFP_KERNEL);
++ if (!dev->resp)
++ goto err_free_cmd;
++
+ INIT_LIST_HEAD(&dev->unlk_lst);
+ mutex_init(&dev->dev_lock);
+ dev->data = data;
+ dev->send_recv = send_recv;
+ if (check_opal_support(dev) != 0) {
+ pr_debug("Opal is not supported on this device\n");
+- kfree(dev);
+- return NULL;
++ goto err_free_resp;
+ }
+
+ return dev;
++
++err_free_resp:
++ kfree(dev->resp);
++
++err_free_cmd:
++ kfree(dev->cmd);
++
++err_free_dev:
++ kfree(dev);
++
++ return NULL;
+ }
+ EXPORT_SYMBOL(init_opal_dev);
+
+--
+2.35.1
+
--- /dev/null
+From 268fc001e13232ddd6fbc61e4783236030cee4c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Nov 2022 19:33:25 -0400
+Subject: bnxt_en: fix the handling of PCIE-AER
+
+From: Vikas Gupta <vikas.gupta@broadcom.com>
+
+[ Upstream commit 0cf736a18a1e804037839bd8df9e36f0efdb8745 ]
+
+Fix the sequence required for PCIE-AER. While slot reset occurs, firmware
+might not be ready and the driver needs to check for its recovery. We
+also need to remap the health registers for some chips and clear the
+resource reservations. The resources will be allocated again during
+bnxt_io_resume().
+
+Fixes: fb1e6e562b37 ("bnxt_en: Fix AER recovery.")
+Signed-off-by: Vikas Gupta <vikas.gupta@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 29 ++++++++++++++++++-
+ drivers/net/ethernet/broadcom/bnxt/bnxt.h | 1 +
+ .../net/ethernet/broadcom/bnxt/bnxt_hwrm.c | 3 +-
+ 3 files changed, 31 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index 72915f40c7a0..55d4efbb8614 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -13922,7 +13922,9 @@ static pci_ers_result_t bnxt_io_slot_reset(struct pci_dev *pdev)
+ pci_ers_result_t result = PCI_ERS_RESULT_DISCONNECT;
+ struct net_device *netdev = pci_get_drvdata(pdev);
+ struct bnxt *bp = netdev_priv(netdev);
+- int err = 0, off;
++ int retry = 0;
++ int err = 0;
++ int off;
+
+ netdev_info(bp->dev, "PCI Slot Reset\n");
+
+@@ -13950,11 +13952,36 @@ static pci_ers_result_t bnxt_io_slot_reset(struct pci_dev *pdev)
+ pci_restore_state(pdev);
+ pci_save_state(pdev);
+
++ bnxt_inv_fw_health_reg(bp);
++ bnxt_try_map_fw_health_reg(bp);
++
++ /* In some PCIe AER scenarios, firmware may take up to
++ * 10 seconds to become ready in the worst case.
++ */
++ do {
++ err = bnxt_try_recover_fw(bp);
++ if (!err)
++ break;
++ retry++;
++ } while (retry < BNXT_FW_SLOT_RESET_RETRY);
++
++ if (err) {
++ dev_err(&pdev->dev, "Firmware not ready\n");
++ goto reset_exit;
++ }
++
+ err = bnxt_hwrm_func_reset(bp);
+ if (!err)
+ result = PCI_ERS_RESULT_RECOVERED;
++
++ bnxt_ulp_irq_stop(bp);
++ bnxt_clear_int_mode(bp);
++ err = bnxt_init_int_mode(bp);
++ bnxt_ulp_irq_restart(bp, err);
+ }
+
++reset_exit:
++ bnxt_clear_reservations(bp, true);
+ rtnl_unlock();
+
+ return result;
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+index b1b17f911300..d5fa43cfe524 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+@@ -1621,6 +1621,7 @@ struct bnxt_fw_health {
+
+ #define BNXT_FW_RETRY 5
+ #define BNXT_FW_IF_RETRY 10
++#define BNXT_FW_SLOT_RESET_RETRY 4
+
+ enum board_idx {
+ BCM57301,
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_hwrm.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_hwrm.c
+index b01d42928a53..132442f16fe6 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_hwrm.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_hwrm.c
+@@ -476,7 +476,8 @@ static int __hwrm_send(struct bnxt *bp, struct bnxt_hwrm_ctx *ctx)
+ memset(ctx->resp, 0, PAGE_SIZE);
+
+ req_type = le16_to_cpu(ctx->req->req_type);
+- if (BNXT_NO_FW_ACCESS(bp) && req_type != HWRM_FUNC_RESET) {
++ if (BNXT_NO_FW_ACCESS(bp) &&
++ (req_type != HWRM_FUNC_RESET && req_type != HWRM_VER_GET)) {
+ netdev_dbg(bp->dev, "hwrm req_type 0x%x skipped, FW channel down\n",
+ req_type);
+ goto exit;
+--
+2.35.1
+
--- /dev/null
+From f305bc387af1357aed41a181827611d12ef33014 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Nov 2022 19:33:24 -0400
+Subject: bnxt_en: refactor bnxt_cancel_reservations()
+
+From: Vikas Gupta <vikas.gupta@broadcom.com>
+
+[ Upstream commit b4c66425771ddb910316c7b4cd7fa0614098ec45 ]
+
+Introduce bnxt_clear_reservations() to clear the reserved attributes only.
+This will be used in the next patch to fix PCI AER handling.
+
+Signed-off-by: Vikas Gupta <vikas.gupta@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Stable-dep-of: 0cf736a18a1e ("bnxt_en: fix the handling of PCIE-AER")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 23 ++++++++++++++++-------
+ 1 file changed, 16 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index be5df8fca264..72915f40c7a0 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -9983,17 +9983,12 @@ static int bnxt_try_recover_fw(struct bnxt *bp)
+ return -ENODEV;
+ }
+
+-int bnxt_cancel_reservations(struct bnxt *bp, bool fw_reset)
++static void bnxt_clear_reservations(struct bnxt *bp, bool fw_reset)
+ {
+ struct bnxt_hw_resc *hw_resc = &bp->hw_resc;
+- int rc;
+
+ if (!BNXT_NEW_RM(bp))
+- return 0; /* no resource reservations required */
+-
+- rc = bnxt_hwrm_func_resc_qcaps(bp, true);
+- if (rc)
+- netdev_err(bp->dev, "resc_qcaps failed\n");
++ return; /* no resource reservations required */
+
+ hw_resc->resv_cp_rings = 0;
+ hw_resc->resv_stat_ctxs = 0;
+@@ -10006,6 +10001,20 @@ int bnxt_cancel_reservations(struct bnxt *bp, bool fw_reset)
+ bp->tx_nr_rings = 0;
+ bp->rx_nr_rings = 0;
+ }
++}
++
++int bnxt_cancel_reservations(struct bnxt *bp, bool fw_reset)
++{
++ int rc;
++
++ if (!BNXT_NEW_RM(bp))
++ return 0; /* no resource reservations required */
++
++ rc = bnxt_hwrm_func_resc_qcaps(bp, true);
++ if (rc)
++ netdev_err(bp->dev, "resc_qcaps failed\n");
++
++ bnxt_clear_reservations(bp, fw_reset);
+
+ return rc;
+ }
+--
+2.35.1
+
--- /dev/null
+From 9f346810127652e29e332921a9cc54f28eeba49e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Nov 2022 15:04:33 +0800
+Subject: bnxt_en: Remove debugfs when pci_register_driver failed
+
+From: Gaosheng Cui <cuigaosheng1@huawei.com>
+
+[ Upstream commit 991aef4ee4f6eb999924f429b943441a32835c8f ]
+
+When pci_register_driver failed, we need to remove debugfs,
+which will caused a resource leak, fix it.
+
+Resource leak logs as follows:
+[ 52.184456] debugfs: Directory 'bnxt_en' with parent '/' already present!
+
+Fixes: cabfb09d87bd ("bnxt_en: add debugfs support for DIM")
+Signed-off-by: Gaosheng Cui <cuigaosheng1@huawei.com>
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Reviewed-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index 55d4efbb8614..57cabe20aa12 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -14037,8 +14037,16 @@ static struct pci_driver bnxt_pci_driver = {
+
+ static int __init bnxt_init(void)
+ {
++ int err;
++
+ bnxt_debug_init();
+- return pci_register_driver(&bnxt_pci_driver);
++ err = pci_register_driver(&bnxt_pci_driver);
++ if (err) {
++ bnxt_debug_exit();
++ return err;
++ }
++
++ return 0;
+ }
+
+ static void __exit bnxt_exit(void)
+--
+2.35.1
+
--- /dev/null
+From f2cfcbd3403c4a7e7321b5108102e881717ea2f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Nov 2022 13:11:31 +0800
+Subject: bpf: Fix memory leaks in __check_func_call
+
+From: Wang Yufen <wangyufen@huawei.com>
+
+[ Upstream commit eb86559a691cea5fa63e57a03ec3dc9c31e97955 ]
+
+kmemleak reports this issue:
+
+unreferenced object 0xffff88817139d000 (size 2048):
+ comm "test_progs", pid 33246, jiffies 4307381979 (age 45851.820s)
+ hex dump (first 32 bytes):
+ 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
+ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
+ backtrace:
+ [<0000000045f075f0>] kmalloc_trace+0x27/0xa0
+ [<0000000098b7c90a>] __check_func_call+0x316/0x1230
+ [<00000000b4c3c403>] check_helper_call+0x172e/0x4700
+ [<00000000aa3875b7>] do_check+0x21d8/0x45e0
+ [<000000001147357b>] do_check_common+0x767/0xaf0
+ [<00000000b5a595b4>] bpf_check+0x43e3/0x5bc0
+ [<0000000011e391b1>] bpf_prog_load+0xf26/0x1940
+ [<0000000007f765c0>] __sys_bpf+0xd2c/0x3650
+ [<00000000839815d6>] __x64_sys_bpf+0x75/0xc0
+ [<00000000946ee250>] do_syscall_64+0x3b/0x90
+ [<0000000000506b7f>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
+
+The root case here is: In function prepare_func_exit(), the callee is
+not released in the abnormal scenario after "state->curframe--;". To
+fix, move "state->curframe--;" to the very bottom of the function,
+right when we free callee and reset frame[] pointer to NULL, as Andrii
+suggested.
+
+In addition, function __check_func_call() has a similar problem. In
+the abnormal scenario before "state->curframe++;", the callee also
+should be released by free_func_state().
+
+Fixes: 69c087ba6225 ("bpf: Add bpf_for_each_map_elem() helper")
+Fixes: fd978bf7fd31 ("bpf: Add reference tracking to verifier")
+Signed-off-by: Wang Yufen <wangyufen@huawei.com>
+Link: https://lore.kernel.org/r/1667884291-15666-1-git-send-email-wangyufen@huawei.com
+Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/verifier.c | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index 69fb46fdf763..b781075dd510 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -6674,11 +6674,11 @@ static int __check_func_call(struct bpf_verifier_env *env, struct bpf_insn *insn
+ /* Transfer references to the callee */
+ err = copy_reference_state(callee, caller);
+ if (err)
+- return err;
++ goto err_out;
+
+ err = set_callee_state_cb(env, caller, callee, *insn_idx);
+ if (err)
+- return err;
++ goto err_out;
+
+ clear_caller_saved_regs(env, caller->regs);
+
+@@ -6695,6 +6695,11 @@ static int __check_func_call(struct bpf_verifier_env *env, struct bpf_insn *insn
+ print_verifier_state(env, callee, true);
+ }
+ return 0;
++
++err_out:
++ free_func_state(callee);
++ state->frame[state->curframe + 1] = NULL;
++ return err;
+ }
+
+ int map_set_for_each_callback_args(struct bpf_verifier_env *env,
+@@ -6880,8 +6885,7 @@ static int prepare_func_exit(struct bpf_verifier_env *env, int *insn_idx)
+ return -EINVAL;
+ }
+
+- state->curframe--;
+- caller = state->frame[state->curframe];
++ caller = state->frame[state->curframe - 1];
+ if (callee->in_callback_fn) {
+ /* enforce R0 return value range [0, 1]. */
+ struct tnum range = tnum_range(0, 1);
+@@ -6920,7 +6924,7 @@ static int prepare_func_exit(struct bpf_verifier_env *env, int *insn_idx)
+ }
+ /* clear everything in the callee */
+ free_func_state(callee);
+- state->frame[state->curframe + 1] = NULL;
++ state->frame[state->curframe--] = NULL;
+ return 0;
+ }
+
+--
+2.35.1
+
--- /dev/null
+From 90c4292d94519c4f6379371b76fb34ea4532316e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Nov 2022 07:21:28 -0500
+Subject: bpf: Initialize same number of free nodes for each pcpu_freelist
+
+From: Xu Kuohai <xukuohai@huawei.com>
+
+[ Upstream commit 4b45cd81f737d79d0fbfc0d320a1e518e7f0bbf0 ]
+
+pcpu_freelist_populate() initializes nr_elems / num_possible_cpus() + 1
+free nodes for some CPUs, and then possibly one CPU with fewer nodes,
+followed by remaining cpus with 0 nodes. For example, when nr_elems == 256
+and num_possible_cpus() == 32, CPU 0~27 each gets 9 free nodes, CPU 28 gets
+4 free nodes, CPU 29~31 get 0 free nodes, while in fact each CPU should get
+8 nodes equally.
+
+This patch initializes nr_elems / num_possible_cpus() free nodes for each
+CPU firstly, then allocates the remaining free nodes by one for each CPU
+until no free nodes left.
+
+Fixes: e19494edab82 ("bpf: introduce percpu_freelist")
+Signed-off-by: Xu Kuohai <xukuohai@huawei.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Acked-by: Yonghong Song <yhs@fb.com>
+Link: https://lore.kernel.org/bpf/20221110122128.105214-1-xukuohai@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/percpu_freelist.c | 23 +++++++++++------------
+ 1 file changed, 11 insertions(+), 12 deletions(-)
+
+diff --git a/kernel/bpf/percpu_freelist.c b/kernel/bpf/percpu_freelist.c
+index 00b874c8e889..2ffb741eee8d 100644
+--- a/kernel/bpf/percpu_freelist.c
++++ b/kernel/bpf/percpu_freelist.c
+@@ -102,22 +102,21 @@ void pcpu_freelist_populate(struct pcpu_freelist *s, void *buf, u32 elem_size,
+ u32 nr_elems)
+ {
+ struct pcpu_freelist_head *head;
+- int i, cpu, pcpu_entries;
++ unsigned int cpu, cpu_idx, i, j, n, m;
+
+- pcpu_entries = nr_elems / num_possible_cpus() + 1;
+- i = 0;
++ n = nr_elems / num_possible_cpus();
++ m = nr_elems % num_possible_cpus();
+
++ cpu_idx = 0;
+ for_each_possible_cpu(cpu) {
+-again:
+ head = per_cpu_ptr(s->freelist, cpu);
+- /* No locking required as this is not visible yet. */
+- pcpu_freelist_push_node(head, buf);
+- i++;
+- buf += elem_size;
+- if (i == nr_elems)
+- break;
+- if (i % pcpu_entries)
+- goto again;
++ j = n + (cpu_idx < m ? 1 : 0);
++ for (i = 0; i < j; i++) {
++ /* No locking required as this is not visible yet. */
++ pcpu_freelist_push_node(head, buf);
++ buf += elem_size;
++ }
++ cpu_idx++;
+ }
+ }
+
+--
+2.35.1
+
--- /dev/null
+From bce6e94a778cbd9739f208e8574d34f280d8663f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Nov 2022 16:16:20 +0800
+Subject: bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb()
+
+From: Baisong Zhong <zhongbaisong@huawei.com>
+
+[ Upstream commit d3fd203f36d46aa29600a72d57a1b61af80e4a25 ]
+
+We got a syzkaller problem because of aarch64 alignment fault
+if KFENCE enabled. When the size from user bpf program is an odd
+number, like 399, 407, etc, it will cause the struct skb_shared_info's
+unaligned access. As seen below:
+
+ BUG: KFENCE: use-after-free read in __skb_clone+0x23c/0x2a0 net/core/skbuff.c:1032
+
+ Use-after-free read at 0xffff6254fffac077 (in kfence-#213):
+ __lse_atomic_add arch/arm64/include/asm/atomic_lse.h:26 [inline]
+ arch_atomic_add arch/arm64/include/asm/atomic.h:28 [inline]
+ arch_atomic_inc include/linux/atomic-arch-fallback.h:270 [inline]
+ atomic_inc include/asm-generic/atomic-instrumented.h:241 [inline]
+ __skb_clone+0x23c/0x2a0 net/core/skbuff.c:1032
+ skb_clone+0xf4/0x214 net/core/skbuff.c:1481
+ ____bpf_clone_redirect net/core/filter.c:2433 [inline]
+ bpf_clone_redirect+0x78/0x1c0 net/core/filter.c:2420
+ bpf_prog_d3839dd9068ceb51+0x80/0x330
+ bpf_dispatcher_nop_func include/linux/bpf.h:728 [inline]
+ bpf_test_run+0x3c0/0x6c0 net/bpf/test_run.c:53
+ bpf_prog_test_run_skb+0x638/0xa7c net/bpf/test_run.c:594
+ bpf_prog_test_run kernel/bpf/syscall.c:3148 [inline]
+ __do_sys_bpf kernel/bpf/syscall.c:4441 [inline]
+ __se_sys_bpf+0xad0/0x1634 kernel/bpf/syscall.c:4381
+
+ kfence-#213: 0xffff6254fffac000-0xffff6254fffac196, size=407, cache=kmalloc-512
+
+ allocated by task 15074 on cpu 0 at 1342.585390s:
+ kmalloc include/linux/slab.h:568 [inline]
+ kzalloc include/linux/slab.h:675 [inline]
+ bpf_test_init.isra.0+0xac/0x290 net/bpf/test_run.c:191
+ bpf_prog_test_run_skb+0x11c/0xa7c net/bpf/test_run.c:512
+ bpf_prog_test_run kernel/bpf/syscall.c:3148 [inline]
+ __do_sys_bpf kernel/bpf/syscall.c:4441 [inline]
+ __se_sys_bpf+0xad0/0x1634 kernel/bpf/syscall.c:4381
+ __arm64_sys_bpf+0x50/0x60 kernel/bpf/syscall.c:4381
+
+To fix the problem, we adjust @size so that (@size + @hearoom) is a
+multiple of SMP_CACHE_BYTES. So we make sure the struct skb_shared_info
+is aligned to a cache line.
+
+Fixes: 1cf1cae963c2 ("bpf: introduce BPF_PROG_TEST_RUN command")
+Signed-off-by: Baisong Zhong <zhongbaisong@huawei.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Cc: Eric Dumazet <edumazet@google.com>
+Link: https://lore.kernel.org/bpf/20221102081620.1465154-1-zhongbaisong@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bpf/test_run.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/bpf/test_run.c b/net/bpf/test_run.c
+index d11209367dd0..b422238f9f86 100644
+--- a/net/bpf/test_run.c
++++ b/net/bpf/test_run.c
+@@ -733,6 +733,7 @@ static void *bpf_test_init(const union bpf_attr *kattr, u32 user_size,
+ if (user_size > size)
+ return ERR_PTR(-EMSGSIZE);
+
++ size = SKB_DATA_ALIGN(size);
+ data = kzalloc(size + headroom + tailroom, GFP_USER);
+ if (!data)
+ return ERR_PTR(-ENOMEM);
+--
+2.35.1
+
--- /dev/null
+From 45b600dacc856cfb24cc0f54409068bf81d9a05f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Nov 2022 10:45:09 +0200
+Subject: bridge: switchdev: Fix memory leaks when changing VLAN protocol
+
+From: Ido Schimmel <idosch@nvidia.com>
+
+[ Upstream commit 9d45921ee4cb364910097e7d1b7558559c2f9fd2 ]
+
+The bridge driver can offload VLANs to the underlying hardware either
+via switchdev or the 8021q driver. When the former is used, the VLAN is
+marked in the bridge driver with the 'BR_VLFLAG_ADDED_BY_SWITCHDEV'
+private flag.
+
+To avoid the memory leaks mentioned in the cited commit, the bridge
+driver will try to delete a VLAN via the 8021q driver if the VLAN is not
+marked with the previously mentioned flag.
+
+When the VLAN protocol of the bridge changes, switchdev drivers are
+notified via the 'SWITCHDEV_ATTR_ID_BRIDGE_VLAN_PROTOCOL' attribute, but
+the 8021q driver is also called to add the existing VLANs with the new
+protocol and delete them with the old protocol.
+
+In case the VLANs were offloaded via switchdev, the above behavior is
+both redundant and buggy. Redundant because the VLANs are already
+programmed in hardware and drivers that support VLAN protocol change
+(currently only mlx5) change the protocol upon the switchdev attribute
+notification. Buggy because the 8021q driver is called despite these
+VLANs being marked with 'BR_VLFLAG_ADDED_BY_SWITCHDEV'. This leads to
+memory leaks [1] when the VLANs are deleted.
+
+Fix by not calling the 8021q driver for VLANs that were already
+programmed via switchdev.
+
+[1]
+unreferenced object 0xffff8881f6771200 (size 256):
+ comm "ip", pid 446855, jiffies 4298238841 (age 55.240s)
+ hex dump (first 32 bytes):
+ 00 00 7f 0e 83 88 ff ff 00 00 00 00 00 00 00 00 ................
+ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
+ backtrace:
+ [<00000000012819ac>] vlan_vid_add+0x437/0x750
+ [<00000000f2281fad>] __br_vlan_set_proto+0x289/0x920
+ [<000000000632b56f>] br_changelink+0x3d6/0x13f0
+ [<0000000089d25f04>] __rtnl_newlink+0x8ae/0x14c0
+ [<00000000f6276baf>] rtnl_newlink+0x5f/0x90
+ [<00000000746dc902>] rtnetlink_rcv_msg+0x336/0xa00
+ [<000000001c2241c0>] netlink_rcv_skb+0x11d/0x340
+ [<0000000010588814>] netlink_unicast+0x438/0x710
+ [<00000000e1a4cd5c>] netlink_sendmsg+0x788/0xc40
+ [<00000000e8992d4e>] sock_sendmsg+0xb0/0xe0
+ [<00000000621b8f91>] ____sys_sendmsg+0x4ff/0x6d0
+ [<000000000ea26996>] ___sys_sendmsg+0x12e/0x1b0
+ [<00000000684f7e25>] __sys_sendmsg+0xab/0x130
+ [<000000004538b104>] do_syscall_64+0x3d/0x90
+ [<0000000091ed9678>] entry_SYSCALL_64_after_hwframe+0x46/0xb0
+
+Fixes: 279737939a81 ("net: bridge: Fix VLANs memory leak")
+Reported-by: Vlad Buslov <vladbu@nvidia.com>
+Tested-by: Vlad Buslov <vladbu@nvidia.com>
+Signed-off-by: Ido Schimmel <idosch@nvidia.com>
+Acked-by: Nikolay Aleksandrov <razor@blackwall.org>
+Link: https://lore.kernel.org/r/20221114084509.860831-1-idosch@nvidia.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bridge/br_vlan.c | 17 ++++++++++++++---
+ 1 file changed, 14 insertions(+), 3 deletions(-)
+
+diff --git a/net/bridge/br_vlan.c b/net/bridge/br_vlan.c
+index 6e53dc991409..9ffd40b8270c 100644
+--- a/net/bridge/br_vlan.c
++++ b/net/bridge/br_vlan.c
+@@ -959,6 +959,8 @@ int __br_vlan_set_proto(struct net_bridge *br, __be16 proto,
+ list_for_each_entry(p, &br->port_list, list) {
+ vg = nbp_vlan_group(p);
+ list_for_each_entry(vlan, &vg->vlan_list, vlist) {
++ if (vlan->priv_flags & BR_VLFLAG_ADDED_BY_SWITCHDEV)
++ continue;
+ err = vlan_vid_add(p->dev, proto, vlan->vid);
+ if (err)
+ goto err_filt;
+@@ -973,8 +975,11 @@ int __br_vlan_set_proto(struct net_bridge *br, __be16 proto,
+ /* Delete VLANs for the old proto from the device filter. */
+ list_for_each_entry(p, &br->port_list, list) {
+ vg = nbp_vlan_group(p);
+- list_for_each_entry(vlan, &vg->vlan_list, vlist)
++ list_for_each_entry(vlan, &vg->vlan_list, vlist) {
++ if (vlan->priv_flags & BR_VLFLAG_ADDED_BY_SWITCHDEV)
++ continue;
+ vlan_vid_del(p->dev, oldproto, vlan->vid);
++ }
+ }
+
+ return 0;
+@@ -983,13 +988,19 @@ int __br_vlan_set_proto(struct net_bridge *br, __be16 proto,
+ attr.u.vlan_protocol = ntohs(oldproto);
+ switchdev_port_attr_set(br->dev, &attr, NULL);
+
+- list_for_each_entry_continue_reverse(vlan, &vg->vlan_list, vlist)
++ list_for_each_entry_continue_reverse(vlan, &vg->vlan_list, vlist) {
++ if (vlan->priv_flags & BR_VLFLAG_ADDED_BY_SWITCHDEV)
++ continue;
+ vlan_vid_del(p->dev, proto, vlan->vid);
++ }
+
+ list_for_each_entry_continue_reverse(p, &br->port_list, list) {
+ vg = nbp_vlan_group(p);
+- list_for_each_entry(vlan, &vg->vlan_list, vlist)
++ list_for_each_entry(vlan, &vg->vlan_list, vlist) {
++ if (vlan->priv_flags & BR_VLFLAG_ADDED_BY_SWITCHDEV)
++ continue;
+ vlan_vid_del(p->dev, proto, vlan->vid);
++ }
+ }
+
+ return err;
+--
+2.35.1
+
--- /dev/null
+From 52eaa2cbe2d18e9bedd9ee377d2267520a99cfa9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Nov 2022 17:27:01 +0300
+Subject: cifs: add check for returning value of SMB2_close_init
+
+From: Anastasia Belova <abelova@astralinux.ru>
+
+[ Upstream commit d520de6cb42e88a1d008b54f935caf9fc05951da ]
+
+If the returning value of SMB2_close_init is an error-value,
+exit the function.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: 352d96f3acc6 ("cifs: multichannel: move channel selection above transport layer")
+
+Signed-off-by: Anastasia Belova <abelova@astralinux.ru>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/cifs/smb2ops.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
+index c258a7b122b6..86a1f282c8b4 100644
+--- a/fs/cifs/smb2ops.c
++++ b/fs/cifs/smb2ops.c
+@@ -1133,6 +1133,8 @@ smb2_set_ea(const unsigned int xid, struct cifs_tcon *tcon,
+ rqst[2].rq_nvec = 1;
+ rc = SMB2_close_init(tcon, server,
+ &rqst[2], COMPOUND_FID, COMPOUND_FID, false);
++ if (rc)
++ goto sea_exit;
+ smb2_set_related(&rqst[2]);
+
+ rc = compound_send_recv(xid, ses, server,
+--
+2.35.1
+
--- /dev/null
+From acee8fab49e2823c491c7eda801952cdcb5aeee8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Nov 2022 17:10:27 +0300
+Subject: cifs: add check for returning value of SMB2_set_info_init
+
+From: Anastasia Belova <abelova@astralinux.ru>
+
+[ Upstream commit a51e5d293dd1c2e7bf6f7be788466cd9b5d280fb ]
+
+If the returning value of SMB2_set_info_init is an error-value,
+exit the function.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: 0967e5457954 ("cifs: use a compound for setting an xattr")
+
+Signed-off-by: Anastasia Belova <abelova@astralinux.ru>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/cifs/smb2ops.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
+index 86a1f282c8b4..b724bf42b540 100644
+--- a/fs/cifs/smb2ops.c
++++ b/fs/cifs/smb2ops.c
+@@ -1123,6 +1123,8 @@ smb2_set_ea(const unsigned int xid, struct cifs_tcon *tcon,
+ COMPOUND_FID, current->tgid,
+ FILE_FULL_EA_INFORMATION,
+ SMB2_O_INFO_FILE, 0, data, size);
++ if (rc)
++ goto sea_exit;
+ smb2_set_next_command(tcon, &rqst[1]);
+ smb2_set_related(&rqst[1]);
+
+--
+2.35.1
+
--- /dev/null
+From 0537529314e35192b1c113acc0d56204bde38058 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Nov 2022 15:12:12 +0800
+Subject: cifs: Fix connections leak when tlink setup failed
+
+From: Zhang Xiaoxu <zhangxiaoxu5@huawei.com>
+
+[ Upstream commit 1dcdf5f5b2137185cbdd5385f29949ab3da4f00c ]
+
+If the tlink setup failed, lost to put the connections, then
+the module refcnt leak since the cifsd kthread not exit.
+
+Also leak the fscache info, and for next mount with fsc, it will
+print the follow errors:
+ CIFS: Cache volume key already in use (cifs,127.0.0.1:445,TEST)
+
+Let's check the result of tlink setup, and do some cleanup.
+
+Fixes: 56c762eb9bee ("cifs: Refactor out cifs_mount()")
+Reviewed-by: Paulo Alcantara (SUSE) <pc@cjr.nz>
+Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5@huawei.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/cifs/connect.c | 14 +++++++++++---
+ 1 file changed, 11 insertions(+), 3 deletions(-)
+
+diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
+index c2c36451a883..317ca1be9c4c 100644
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -3846,9 +3846,13 @@ int cifs_mount(struct cifs_sb_info *cifs_sb, struct smb3_fs_context *ctx)
+ uuid_copy(&cifs_sb->dfs_mount_id, &mnt_ctx.mount_id);
+
+ out:
+- free_xid(mnt_ctx.xid);
+ cifs_try_adding_channels(cifs_sb, mnt_ctx.ses);
+- return mount_setup_tlink(cifs_sb, mnt_ctx.ses, mnt_ctx.tcon);
++ rc = mount_setup_tlink(cifs_sb, mnt_ctx.ses, mnt_ctx.tcon);
++ if (rc)
++ goto error;
++
++ free_xid(mnt_ctx.xid);
++ return rc;
+
+ error:
+ dfs_cache_put_refsrv_sessions(&mnt_ctx.mount_id);
+@@ -3875,8 +3879,12 @@ int cifs_mount(struct cifs_sb_info *cifs_sb, struct smb3_fs_context *ctx)
+ goto error;
+ }
+
++ rc = mount_setup_tlink(cifs_sb, mnt_ctx.ses, mnt_ctx.tcon);
++ if (rc)
++ goto error;
++
+ free_xid(mnt_ctx.xid);
+- return mount_setup_tlink(cifs_sb, mnt_ctx.ses, mnt_ctx.tcon);
++ return rc;
+
+ error:
+ mount_put_conns(&mnt_ctx);
+--
+2.35.1
+
--- /dev/null
+From 734edc668c631d48bd4ec61a2a45c8cbff9078a3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Nov 2022 18:39:34 +0800
+Subject: cifs: Fix wrong return value checking when GETFLAGS
+
+From: Zhang Xiaoxu <zhangxiaoxu5@huawei.com>
+
+[ Upstream commit 92bbd67a55fee50743b42825d1c016e7fd5c79f9 ]
+
+The return value of CIFSGetExtAttr is negative, should be checked
+with -EOPNOTSUPP rather than EOPNOTSUPP.
+
+Fixes: 64a5cfa6db94 ("Allow setting per-file compression via SMB2/3")
+Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5@huawei.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/cifs/ioctl.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/cifs/ioctl.c b/fs/cifs/ioctl.c
+index b6e6e5d6c8dd..baccda02deab 100644
+--- a/fs/cifs/ioctl.c
++++ b/fs/cifs/ioctl.c
+@@ -343,7 +343,7 @@ long cifs_ioctl(struct file *filep, unsigned int command, unsigned long arg)
+ rc = put_user(ExtAttrBits &
+ FS_FL_USER_VISIBLE,
+ (int __user *)arg);
+- if (rc != EOPNOTSUPP)
++ if (rc != -EOPNOTSUPP)
+ break;
+ }
+ #endif /* CONFIG_CIFS_ALLOW_INSECURE_LEGACY */
+@@ -373,7 +373,7 @@ long cifs_ioctl(struct file *filep, unsigned int command, unsigned long arg)
+ * pSMBFile->fid.netfid,
+ * extAttrBits,
+ * &ExtAttrMask);
+- * if (rc != EOPNOTSUPP)
++ * if (rc != -EOPNOTSUPP)
+ * break;
+ */
+
+--
+2.35.1
+
--- /dev/null
+From e6bb09b02e87cbde45c6d2692fb710579a08c366 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Nov 2022 10:44:58 -0800
+Subject: dm-crypt: provide dma_alignment limit in io_hints
+
+From: Keith Busch <kbusch@kernel.org>
+
+[ Upstream commit 86e4d3e8d1838ca88fb9267e669c36f6c8f7c6cd ]
+
+This device mapper needs bio vectors to be sized and memory aligned to
+the logical block size. Set the minimum required queue limit
+accordingly.
+
+Link: https://lore.kernel.org/linux-block/20221101001558.648ee024@xps.demsh.org/
+Fixes: b1a000d3b8ec5 ("block: relax direct io memory alignment")
+Reportred-by: Eric Biggers <ebiggers@kernel.org>
+Reported-by: Dmitrii Tcvetkov <me@demsh.org>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Reviewed-by: Mike Snitzer <snitzer@kernel.org>
+Link: https://lore.kernel.org/r/20221110184501.2451620-3-kbusch@meta.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/dm-crypt.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
+index 159c6806c19b..2653516bcdef 100644
+--- a/drivers/md/dm-crypt.c
++++ b/drivers/md/dm-crypt.c
+@@ -3630,6 +3630,7 @@ static void crypt_io_hints(struct dm_target *ti, struct queue_limits *limits)
+ limits->physical_block_size =
+ max_t(unsigned, limits->physical_block_size, cc->sector_size);
+ limits->io_min = max_t(unsigned, limits->io_min, cc->sector_size);
++ limits->dma_alignment = limits->logical_block_size - 1;
+ }
+
+ static struct target_type crypt_target = {
+--
+2.35.1
+
--- /dev/null
+From ea43f58b02d4fa89d95bb64b383ba3bc2f3cc059 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Nov 2022 16:16:43 +0300
+Subject: drbd: use after free in drbd_create_device()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Dan Carpenter <error27@gmail.com>
+
+[ Upstream commit a7a1598189228b5007369a9622ccdf587be0730f ]
+
+The drbd_destroy_connection() frees the "connection" so use the _safe()
+iterator to prevent a use after free.
+
+Fixes: b6f85ef9538b ("drbd: Iterate over all connections")
+Signed-off-by: Dan Carpenter <error27@gmail.com>
+Reviewed-by: Christoph Böhmwalder <christoph.boehmwalder@linbit.com>
+Link: https://lore.kernel.org/r/Y3Jd5iZRbNQ9w6gm@kili
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/drbd/drbd_main.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c
+index f3e4db16fd07..8532b839a343 100644
+--- a/drivers/block/drbd/drbd_main.c
++++ b/drivers/block/drbd/drbd_main.c
+@@ -2672,7 +2672,7 @@ static int init_submitter(struct drbd_device *device)
+ enum drbd_ret_code drbd_create_device(struct drbd_config_context *adm_ctx, unsigned int minor)
+ {
+ struct drbd_resource *resource = adm_ctx->resource;
+- struct drbd_connection *connection;
++ struct drbd_connection *connection, *n;
+ struct drbd_device *device;
+ struct drbd_peer_device *peer_device, *tmp_peer_device;
+ struct gendisk *disk;
+@@ -2789,7 +2789,7 @@ enum drbd_ret_code drbd_create_device(struct drbd_config_context *adm_ctx, unsig
+ return NO_ERROR;
+
+ out_idr_remove_from_resource:
+- for_each_connection(connection, resource) {
++ for_each_connection_safe(connection, n, resource) {
+ peer_device = idr_remove(&connection->peer_devices, vnr);
+ if (peer_device)
+ kref_put(&connection->kref, drbd_destroy_connection);
+--
+2.35.1
+
--- /dev/null
+From ba8a4faecfd04fad95c0ccc945819bae147ff59e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Nov 2022 15:07:15 +0800
+Subject: drm/drv: Fix potential memory leak in drm_dev_init()
+
+From: Shang XiaoJing <shangxiaojing@huawei.com>
+
+[ Upstream commit ff963634f7b2e0dc011349abb3fb81a0d074f443 ]
+
+drm_dev_init() will add drm_dev_init_release() as a callback. When
+drmm_add_action() failed, the release function won't be added. As the
+result, the ref cnt added by device_get() in drm_dev_init() won't be put
+by drm_dev_init_release(), which leads to the memleak. Use
+drmm_add_action_or_reset() instead of drmm_add_action() to prevent
+memleak.
+
+unreferenced object 0xffff88810bc0c800 (size 2048):
+ comm "modprobe", pid 8322, jiffies 4305809845 (age 15.292s)
+ hex dump (first 32 bytes):
+ e8 cc c0 0b 81 88 ff ff ff ff ff ff 00 00 00 00 ................
+ 20 24 3c 0c 81 88 ff ff 18 c8 c0 0b 81 88 ff ff $<.............
+ backtrace:
+ [<000000007251f72d>] __kmalloc+0x4b/0x1c0
+ [<0000000045f21f26>] platform_device_alloc+0x2d/0xe0
+ [<000000004452a479>] platform_device_register_full+0x24/0x1c0
+ [<0000000089f4ea61>] 0xffffffffa0736051
+ [<00000000235b2441>] do_one_initcall+0x7a/0x380
+ [<0000000001a4a177>] do_init_module+0x5c/0x230
+ [<000000002bf8a8e2>] load_module+0x227d/0x2420
+ [<00000000637d6d0a>] __do_sys_finit_module+0xd5/0x140
+ [<00000000c99fc324>] do_syscall_64+0x3f/0x90
+ [<000000004d85aa77>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
+
+Fixes: 2cbf7fc6718b ("drm: Use drmm_ for drm_dev_init cleanup")
+Signed-off-by: Shang XiaoJing <shangxiaojing@huawei.com>
+Reviewed-by: Lyude Paul <lyude@redhat.com>
+Signed-off-by: Lyude Paul <lyude@redhat.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20221101070716.9189-2-shangxiaojing@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_drv.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
+index 8214a0b1ab7f..203bf8d6c34c 100644
+--- a/drivers/gpu/drm/drm_drv.c
++++ b/drivers/gpu/drm/drm_drv.c
+@@ -615,7 +615,7 @@ static int drm_dev_init(struct drm_device *dev,
+ mutex_init(&dev->clientlist_mutex);
+ mutex_init(&dev->master_mutex);
+
+- ret = drmm_add_action(dev, drm_dev_init_release, NULL);
++ ret = drmm_add_action_or_reset(dev, drm_dev_init_release, NULL);
+ if (ret)
+ return ret;
+
+--
+2.35.1
+
--- /dev/null
+From 75e66b654ae2ebc41fa6af510e6e4ace78a15c9c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Nov 2022 15:07:16 +0800
+Subject: drm: Fix potential null-ptr-deref in drm_vblank_destroy_worker()
+
+From: Shang XiaoJing <shangxiaojing@huawei.com>
+
+[ Upstream commit 4979524f5a2a8210e87fde2f642b0dc060860821 ]
+
+drm_vblank_init() call drmm_add_action_or_reset() with
+drm_vblank_init_release() as action. If __drmm_add_action() failed, will
+directly call drm_vblank_init_release() with the vblank whose worker is
+NULL. As the resule, a null-ptr-deref will happen in
+kthread_destroy_worker(). Add the NULL check before calling
+drm_vblank_destroy_worker().
+
+BUG: null-ptr-deref
+KASAN: null-ptr-deref in range [0x0000000000000068-0x000000000000006f]
+CPU: 5 PID: 961 Comm: modprobe Not tainted 6.0.0-11331-gd465bff130bf-dirty
+RIP: 0010:kthread_destroy_worker+0x25/0xb0
+ Call Trace:
+ <TASK>
+ drm_vblank_init_release+0x124/0x220 [drm]
+ ? drm_crtc_vblank_restore+0x8b0/0x8b0 [drm]
+ __drmm_add_action_or_reset+0x41/0x50 [drm]
+ drm_vblank_init+0x282/0x310 [drm]
+ vkms_init+0x35f/0x1000 [vkms]
+ ? 0xffffffffc4508000
+ ? lock_is_held_type+0xd7/0x130
+ ? __kmem_cache_alloc_node+0x1c2/0x2b0
+ ? lock_is_held_type+0xd7/0x130
+ ? 0xffffffffc4508000
+ do_one_initcall+0xd0/0x4f0
+ ...
+ do_syscall_64+0x35/0x80
+ entry_SYSCALL_64_after_hwframe+0x46/0xb0
+
+Fixes: 5e6c2b4f9161 ("drm/vblank: Add vblank works")
+Signed-off-by: Shang XiaoJing <shangxiaojing@huawei.com>
+Reviewed-by: Lyude Paul <lyude@redhat.com>
+Signed-off-by: Lyude Paul <lyude@redhat.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20221101070716.9189-3-shangxiaojing@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_internal.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/drm_internal.h b/drivers/gpu/drm/drm_internal.h
+index 7bb98e6a446d..5ea5e260118c 100644
+--- a/drivers/gpu/drm/drm_internal.h
++++ b/drivers/gpu/drm/drm_internal.h
+@@ -104,7 +104,8 @@ static inline void drm_vblank_flush_worker(struct drm_vblank_crtc *vblank)
+
+ static inline void drm_vblank_destroy_worker(struct drm_vblank_crtc *vblank)
+ {
+- kthread_destroy_worker(vblank->worker);
++ if (vblank->worker)
++ kthread_destroy_worker(vblank->worker);
+ }
+
+ int drm_vblank_worker_init(struct drm_vblank_crtc *vblank);
+--
+2.35.1
+
--- /dev/null
+From 557f29ff0d3fb94fd4c4865a8583c8a0ace53a74 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Oct 2022 09:32:00 +0200
+Subject: drm/lima: Fix opp clkname setting in case of missing regulator
+
+From: Erico Nunes <nunes.erico@gmail.com>
+
+[ Upstream commit e17a025a47c66ca8499ae88d8046c4f0d7c9c057 ]
+
+Commit d8c32d3971e4 ("drm/lima: Migrate to dev_pm_opp_set_config()")
+introduced a regression as it may undo the clk_names setting in case
+the optional regulator is missing. This resulted in test and performance
+regressions with lima.
+
+Restore the old behavior where clk_names is set separately so it is not
+undone in case of a missing optional regulator.
+
+Fixes: d8c32d3971e4 ("drm/lima: Migrate to dev_pm_opp_set_config()")
+Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Erico Nunes <nunes.erico@gmail.com>
+Signed-off-by: Qiang Yu <yuq825@gmail.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20221027073200.3885839-1-nunes.erico@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/lima/lima_devfreq.c | 15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/lima/lima_devfreq.c b/drivers/gpu/drm/lima/lima_devfreq.c
+index 011be7ff51e1..bc8fb4e38d0a 100644
+--- a/drivers/gpu/drm/lima/lima_devfreq.c
++++ b/drivers/gpu/drm/lima/lima_devfreq.c
+@@ -112,11 +112,6 @@ int lima_devfreq_init(struct lima_device *ldev)
+ unsigned long cur_freq;
+ int ret;
+ const char *regulator_names[] = { "mali", NULL };
+- const char *clk_names[] = { "core", NULL };
+- struct dev_pm_opp_config config = {
+- .regulator_names = regulator_names,
+- .clk_names = clk_names,
+- };
+
+ if (!device_property_present(dev, "operating-points-v2"))
+ /* Optional, continue without devfreq */
+@@ -124,7 +119,15 @@ int lima_devfreq_init(struct lima_device *ldev)
+
+ spin_lock_init(&ldevfreq->lock);
+
+- ret = devm_pm_opp_set_config(dev, &config);
++ /*
++ * clkname is set separately so it is not affected by the optional
++ * regulator setting which may return error.
++ */
++ ret = devm_pm_opp_set_clkname(dev, "core");
++ if (ret)
++ return ret;
++
++ ret = devm_pm_opp_set_regulators(dev, regulator_names);
+ if (ret) {
+ /* Continue if the optional regulator is missing */
+ if (ret != -ENODEV)
+--
+2.35.1
+
--- /dev/null
+From 9fa09042c05bf82fc8e98bce2d8b799784a2ffd7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Aug 2022 16:16:22 +0200
+Subject: drm/panel: simple: set bpc field for logic technologies displays
+
+From: Aishwarya Kothari <aishwarya.kothari@toradex.com>
+
+[ Upstream commit 876153ab068b2507a19aa3ef481f5b00a2cc780f ]
+
+In case bpc is not set for a panel it then throws a WARN(). Add bpc to
+the panels logictechno_lt170410_2whc and logictechno_lt161010_2nh.
+
+Fixes: 5728fe7fa539 ("drm/panel: simple: add display timings for logic technologies displays")
+Signed-off-by: Aishwarya Kothari <aishwarya.kothari@toradex.com>
+Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com>
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20220831141622.39605-1-francesco.dolcini@toradex.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panel/panel-simple.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c
+index 1e716c23019a..eb938bfb0573 100644
+--- a/drivers/gpu/drm/panel/panel-simple.c
++++ b/drivers/gpu/drm/panel/panel-simple.c
+@@ -2505,6 +2505,7 @@ static const struct display_timing logictechno_lt161010_2nh_timing = {
+ static const struct panel_desc logictechno_lt161010_2nh = {
+ .timings = &logictechno_lt161010_2nh_timing,
+ .num_timings = 1,
++ .bpc = 6,
+ .size = {
+ .width = 154,
+ .height = 86,
+@@ -2534,6 +2535,7 @@ static const struct display_timing logictechno_lt170410_2whc_timing = {
+ static const struct panel_desc logictechno_lt170410_2whc = {
+ .timings = &logictechno_lt170410_2whc_timing,
+ .num_timings = 1,
++ .bpc = 8,
+ .size = {
+ .width = 217,
+ .height = 136,
+--
+2.35.1
+
--- /dev/null
+From 30c903e2fe78f122fba5858430c220fee442f3c2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Nov 2022 17:44:45 +0800
+Subject: drm/vc4: kms: Fix IS_ERR() vs NULL check for vc4_kms
+
+From: Gaosheng Cui <cuigaosheng1@huawei.com>
+
+[ Upstream commit dba9e3467425800f9d3a14e8b6a0f85c731c1650 ]
+
+The drm_atomic_get_new_private_obj_state() function returns NULL
+on error path, drm_atomic_get_old_private_obj_state() function
+returns NULL on error path, too, they does not return error pointers.
+
+By the way, vc4_hvs_get_new/old_global_state() should return
+ERR_PTR(-EINVAL), otherwise there will be null-ptr-defer issue,
+such as follows:
+
+In function vc4_atomic_commit_tail():
+ |-- old_hvs_state = vc4_hvs_get_old_global_state(state); <-- return NULL
+ |-- if (WARN_ON(IS_ERR(old_hvs_state))) <-- no return
+ |-- unsigned long state_rate = max(old_hvs_state->core_clock_rate,
+ new_hvs_state->core_clock_rate); <-- null-ptr-defer
+
+Fixes: 9ec03d7f1ed3 ("drm/vc4: kms: Wait on previous FIFO users before a commit")
+Signed-off-by: Gaosheng Cui <cuigaosheng1@huawei.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://patchwork.freedesktop.org/patch/msgid/20221110094445.2930509-6-cuigaosheng1@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vc4/vc4_kms.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/vc4/vc4_kms.c b/drivers/gpu/drm/vc4/vc4_kms.c
+index b45dcdfd7306..a3678178b022 100644
+--- a/drivers/gpu/drm/vc4/vc4_kms.c
++++ b/drivers/gpu/drm/vc4/vc4_kms.c
+@@ -198,8 +198,8 @@ vc4_hvs_get_new_global_state(struct drm_atomic_state *state)
+ struct drm_private_state *priv_state;
+
+ priv_state = drm_atomic_get_new_private_obj_state(state, &vc4->hvs_channels);
+- if (IS_ERR(priv_state))
+- return ERR_CAST(priv_state);
++ if (!priv_state)
++ return ERR_PTR(-EINVAL);
+
+ return to_vc4_hvs_state(priv_state);
+ }
+@@ -211,8 +211,8 @@ vc4_hvs_get_old_global_state(struct drm_atomic_state *state)
+ struct drm_private_state *priv_state;
+
+ priv_state = drm_atomic_get_old_private_obj_state(state, &vc4->hvs_channels);
+- if (IS_ERR(priv_state))
+- return ERR_CAST(priv_state);
++ if (!priv_state)
++ return ERR_PTR(-EINVAL);
+
+ return to_vc4_hvs_state(priv_state);
+ }
+--
+2.35.1
+
--- /dev/null
+From 30d007e256e6dd8a1ec8a31266b1872428fb2194 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Sep 2022 14:24:14 +0800
+Subject: erofs: clean up .read_folio() and .readahead() in fscache mode
+
+From: Jingbo Xu <jefflexu@linux.alibaba.com>
+
+[ Upstream commit 1ae9470c3e14624b0f4d8741c22b5a94062c0e33 ]
+
+The implementation of these two functions in fscache mode is almost the
+same. Extract the same part as a generic helper to remove the code
+duplication.
+
+Signed-off-by: Jingbo Xu <jefflexu@linux.alibaba.com>
+Reviewed-by: Jia Zhu <zhujia.zj@bytedance.com>
+Link: https://lore.kernel.org/r/20220922062414.20437-1-jefflexu@linux.alibaba.com
+Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
+Stable-dep-of: e6d9f9ba111b ("erofs: get correct count for unmapped range in fscache mode")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/erofs/fscache.c | 213 ++++++++++++++++++---------------------------
+ 1 file changed, 83 insertions(+), 130 deletions(-)
+
+diff --git a/fs/erofs/fscache.c b/fs/erofs/fscache.c
+index b5fd9d71e67f..508b1a4df15e 100644
+--- a/fs/erofs/fscache.c
++++ b/fs/erofs/fscache.c
+@@ -234,113 +234,111 @@ static int erofs_fscache_meta_read_folio(struct file *data, struct folio *folio)
+ return ret;
+ }
+
+-static int erofs_fscache_read_folio_inline(struct folio *folio,
+- struct erofs_map_blocks *map)
+-{
+- struct super_block *sb = folio_mapping(folio)->host->i_sb;
+- struct erofs_buf buf = __EROFS_BUF_INITIALIZER;
+- erofs_blk_t blknr;
+- size_t offset, len;
+- void *src, *dst;
+-
+- /* For tail packing layout, the offset may be non-zero. */
+- offset = erofs_blkoff(map->m_pa);
+- blknr = erofs_blknr(map->m_pa);
+- len = map->m_llen;
+-
+- src = erofs_read_metabuf(&buf, sb, blknr, EROFS_KMAP);
+- if (IS_ERR(src))
+- return PTR_ERR(src);
+-
+- dst = kmap_local_folio(folio, 0);
+- memcpy(dst, src + offset, len);
+- memset(dst + len, 0, PAGE_SIZE - len);
+- kunmap_local(dst);
+-
+- erofs_put_metabuf(&buf);
+- return 0;
+-}
+-
+-static int erofs_fscache_read_folio(struct file *file, struct folio *folio)
++/*
++ * Read into page cache in the range described by (@pos, @len).
++ *
++ * On return, the caller is responsible for page unlocking if the output @unlock
++ * is true, or the callee will take this responsibility through netfs_io_request
++ * interface.
++ *
++ * The return value is the number of bytes successfully handled, or negative
++ * error code on failure. The only exception is that, the length of the range
++ * instead of the error code is returned on failure after netfs_io_request is
++ * allocated, so that .readahead() could advance rac accordingly.
++ */
++static int erofs_fscache_data_read(struct address_space *mapping,
++ loff_t pos, size_t len, bool *unlock)
+ {
+- struct inode *inode = folio_mapping(folio)->host;
++ struct inode *inode = mapping->host;
+ struct super_block *sb = inode->i_sb;
++ struct netfs_io_request *rreq;
+ struct erofs_map_blocks map;
+ struct erofs_map_dev mdev;
+- struct netfs_io_request *rreq;
+- erofs_off_t pos;
+- loff_t pstart;
++ struct iov_iter iter;
++ size_t count;
+ int ret;
+
+- DBG_BUGON(folio_size(folio) != EROFS_BLKSIZ);
++ *unlock = true;
+
+- pos = folio_pos(folio);
+ map.m_la = pos;
+-
+ ret = erofs_map_blocks(inode, &map, EROFS_GET_BLOCKS_RAW);
+ if (ret)
+- goto out_unlock;
++ return ret;
+
+- if (!(map.m_flags & EROFS_MAP_MAPPED)) {
+- folio_zero_range(folio, 0, folio_size(folio));
+- goto out_uptodate;
++ if (map.m_flags & EROFS_MAP_META) {
++ struct erofs_buf buf = __EROFS_BUF_INITIALIZER;
++ erofs_blk_t blknr;
++ size_t offset, size;
++ void *src;
++
++ /* For tail packing layout, the offset may be non-zero. */
++ offset = erofs_blkoff(map.m_pa);
++ blknr = erofs_blknr(map.m_pa);
++ size = map.m_llen;
++
++ src = erofs_read_metabuf(&buf, sb, blknr, EROFS_KMAP);
++ if (IS_ERR(src))
++ return PTR_ERR(src);
++
++ iov_iter_xarray(&iter, READ, &mapping->i_pages, pos, PAGE_SIZE);
++ if (copy_to_iter(src + offset, size, &iter) != size)
++ return -EFAULT;
++ iov_iter_zero(PAGE_SIZE - size, &iter);
++ erofs_put_metabuf(&buf);
++ return PAGE_SIZE;
+ }
+
+- if (map.m_flags & EROFS_MAP_META) {
+- ret = erofs_fscache_read_folio_inline(folio, &map);
+- goto out_uptodate;
++ count = min_t(size_t, map.m_llen - (pos - map.m_la), len);
++ DBG_BUGON(!count || count % PAGE_SIZE);
++
++ if (!(map.m_flags & EROFS_MAP_MAPPED)) {
++ iov_iter_xarray(&iter, READ, &mapping->i_pages, pos, count);
++ iov_iter_zero(count, &iter);
++ return count;
+ }
+
+ mdev = (struct erofs_map_dev) {
+ .m_deviceid = map.m_deviceid,
+ .m_pa = map.m_pa,
+ };
+-
+ ret = erofs_map_dev(sb, &mdev);
+ if (ret)
+- goto out_unlock;
+-
+-
+- rreq = erofs_fscache_alloc_request(folio_mapping(folio),
+- folio_pos(folio), folio_size(folio));
+- if (IS_ERR(rreq)) {
+- ret = PTR_ERR(rreq);
+- goto out_unlock;
+- }
++ return ret;
+
+- pstart = mdev.m_pa + (pos - map.m_la);
+- return erofs_fscache_read_folios_async(mdev.m_fscache->cookie,
+- rreq, pstart);
++ rreq = erofs_fscache_alloc_request(mapping, pos, count);
++ if (IS_ERR(rreq))
++ return PTR_ERR(rreq);
+
+-out_uptodate:
+- if (!ret)
+- folio_mark_uptodate(folio);
+-out_unlock:
+- folio_unlock(folio);
+- return ret;
++ *unlock = false;
++ erofs_fscache_read_folios_async(mdev.m_fscache->cookie,
++ rreq, mdev.m_pa + (pos - map.m_la));
++ return count;
+ }
+
+-static void erofs_fscache_advance_folios(struct readahead_control *rac,
+- size_t len, bool unlock)
++static int erofs_fscache_read_folio(struct file *file, struct folio *folio)
+ {
+- while (len) {
+- struct folio *folio = readahead_folio(rac);
+- len -= folio_size(folio);
+- if (unlock) {
++ bool unlock;
++ int ret;
++
++ DBG_BUGON(folio_size(folio) != EROFS_BLKSIZ);
++
++ ret = erofs_fscache_data_read(folio_mapping(folio), folio_pos(folio),
++ folio_size(folio), &unlock);
++ if (unlock) {
++ if (ret > 0)
+ folio_mark_uptodate(folio);
+- folio_unlock(folio);
+- }
++ folio_unlock(folio);
+ }
++ return ret < 0 ? ret : 0;
+ }
+
+ static void erofs_fscache_readahead(struct readahead_control *rac)
+ {
+- struct inode *inode = rac->mapping->host;
+- struct super_block *sb = inode->i_sb;
+- size_t len, count, done = 0;
+- erofs_off_t pos;
+- loff_t start, offset;
+- int ret;
++ struct folio *folio;
++ size_t len, done = 0;
++ loff_t start, pos;
++ bool unlock;
++ int ret, size;
+
+ if (!readahead_count(rac))
+ return;
+@@ -349,67 +347,22 @@ static void erofs_fscache_readahead(struct readahead_control *rac)
+ len = readahead_length(rac);
+
+ do {
+- struct erofs_map_blocks map;
+- struct erofs_map_dev mdev;
+- struct netfs_io_request *rreq;
+-
+ pos = start + done;
+- map.m_la = pos;
+-
+- ret = erofs_map_blocks(inode, &map, EROFS_GET_BLOCKS_RAW);
+- if (ret)
++ ret = erofs_fscache_data_read(rac->mapping, pos,
++ len - done, &unlock);
++ if (ret <= 0)
+ return;
+
+- offset = start + done;
+- count = min_t(size_t, map.m_llen - (pos - map.m_la),
+- len - done);
+-
+- if (!(map.m_flags & EROFS_MAP_MAPPED)) {
+- struct iov_iter iter;
+-
+- iov_iter_xarray(&iter, READ, &rac->mapping->i_pages,
+- offset, count);
+- iov_iter_zero(count, &iter);
+-
+- erofs_fscache_advance_folios(rac, count, true);
+- ret = count;
+- continue;
+- }
+-
+- if (map.m_flags & EROFS_MAP_META) {
+- struct folio *folio = readahead_folio(rac);
+-
+- ret = erofs_fscache_read_folio_inline(folio, &map);
+- if (!ret) {
++ size = ret;
++ while (size) {
++ folio = readahead_folio(rac);
++ size -= folio_size(folio);
++ if (unlock) {
+ folio_mark_uptodate(folio);
+- ret = folio_size(folio);
++ folio_unlock(folio);
+ }
+-
+- folio_unlock(folio);
+- continue;
+ }
+-
+- mdev = (struct erofs_map_dev) {
+- .m_deviceid = map.m_deviceid,
+- .m_pa = map.m_pa,
+- };
+- ret = erofs_map_dev(sb, &mdev);
+- if (ret)
+- return;
+-
+- rreq = erofs_fscache_alloc_request(rac->mapping, offset, count);
+- if (IS_ERR(rreq))
+- return;
+- /*
+- * Drop the ref of folios here. Unlock them in
+- * rreq_unlock_folios() when rreq complete.
+- */
+- erofs_fscache_advance_folios(rac, count, false);
+- ret = erofs_fscache_read_folios_async(mdev.m_fscache->cookie,
+- rreq, mdev.m_pa + (pos - map.m_la));
+- if (!ret)
+- ret = count;
+- } while (ret > 0 && ((done += ret) < len));
++ } while ((done += ret) < len);
+ }
+
+ static const struct address_space_operations erofs_fscache_meta_aops = {
+--
+2.35.1
+
--- /dev/null
+From c250e490c04c28e9b939ca25d327056ff94500d3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Nov 2022 20:19:43 +0800
+Subject: erofs: fix missing xas_retry() in fscache mode
+
+From: Jingbo Xu <jefflexu@linux.alibaba.com>
+
+[ Upstream commit 37020bbb71d911431e16c2c940b97cf86ae4f2f6 ]
+
+The xarray iteration only holds the RCU read lock and thus may encounter
+XA_RETRY_ENTRY if there's process modifying the xarray concurrently.
+This will cause oops when referring to the invalid entry.
+
+Fix this by adding the missing xas_retry(), which will make the
+iteration wind back to the root node if XA_RETRY_ENTRY is encountered.
+
+Fixes: d435d53228dd ("erofs: change to use asynchronous io for fscache readpage/readahead")
+Suggested-by: David Howells <dhowells@redhat.com>
+Reviewed-by: Gao Xiang <hsiangkao@linux.alibaba.com>
+Reviewed-by: Jia Zhu <zhujia.zj@bytedance.com>
+Signed-off-by: Jingbo Xu <jefflexu@linux.alibaba.com>
+Link: https://lore.kernel.org/r/20221114121943.29987-1-jefflexu@linux.alibaba.com
+Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/erofs/fscache.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/fs/erofs/fscache.c b/fs/erofs/fscache.c
+index 79af25f0a56c..46ab2b3f9a3c 100644
+--- a/fs/erofs/fscache.c
++++ b/fs/erofs/fscache.c
+@@ -69,11 +69,15 @@ static void erofs_fscache_rreq_unlock_folios(struct netfs_io_request *rreq)
+
+ rcu_read_lock();
+ xas_for_each(&xas, folio, last_page) {
+- unsigned int pgpos =
+- (folio_index(folio) - start_page) * PAGE_SIZE;
+- unsigned int pgend = pgpos + folio_size(folio);
++ unsigned int pgpos, pgend;
+ bool pg_failed = false;
+
++ if (xas_retry(&xas, folio))
++ continue;
++
++ pgpos = (folio_index(folio) - start_page) * PAGE_SIZE;
++ pgend = pgpos + folio_size(folio);
++
+ for (;;) {
+ if (!subreq) {
+ pg_failed = true;
+--
+2.35.1
+
--- /dev/null
+From 3d24abab4974c3dd9b0bd5a420d8694de6db2e89 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Nov 2022 13:40:28 +0800
+Subject: erofs: get correct count for unmapped range in fscache mode
+
+From: Jingbo Xu <jefflexu@linux.alibaba.com>
+
+[ Upstream commit e6d9f9ba111b56154f1b1120252aff269cebd49c ]
+
+For unmapped range, the returned map.m_llen is zero, and thus the
+calculated count is unexpected zero.
+
+Prior to the refactoring introduced by commit 1ae9470c3e14 ("erofs:
+clean up .read_folio() and .readahead() in fscache mode"), only the
+readahead routine suffers from this. With the refactoring of making
+.read_folio() and .readahead() calling one common routine, both
+read_folio and readahead have this issue now.
+
+Fix this by calculating count separately in unmapped condition.
+
+Fixes: c665b394b9e8 ("erofs: implement fscache-based data readahead")
+Fixes: 1ae9470c3e14 ("erofs: clean up .read_folio() and .readahead() in fscache mode")
+Signed-off-by: Jingbo Xu <jefflexu@linux.alibaba.com>
+Reviewed-by: Gao Xiang <hsiangkao@linux.alibaba.com>
+Reviewed-by: Chao Yu <chao@kernel.org>
+Link: https://lore.kernel.org/r/20221104054028.52208-3-jefflexu@linux.alibaba.com
+Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/erofs/fscache.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/fs/erofs/fscache.c b/fs/erofs/fscache.c
+index 508b1a4df15e..8585e324298c 100644
+--- a/fs/erofs/fscache.c
++++ b/fs/erofs/fscache.c
+@@ -288,15 +288,16 @@ static int erofs_fscache_data_read(struct address_space *mapping,
+ return PAGE_SIZE;
+ }
+
+- count = min_t(size_t, map.m_llen - (pos - map.m_la), len);
+- DBG_BUGON(!count || count % PAGE_SIZE);
+-
+ if (!(map.m_flags & EROFS_MAP_MAPPED)) {
++ count = len;
+ iov_iter_xarray(&iter, READ, &mapping->i_pages, pos, count);
+ iov_iter_zero(count, &iter);
+ return count;
+ }
+
++ count = min_t(size_t, map.m_llen - (pos - map.m_la), len);
++ DBG_BUGON(!count || count % PAGE_SIZE);
++
+ mdev = (struct erofs_map_dev) {
+ .m_deviceid = map.m_deviceid,
+ .m_pa = map.m_pa,
+--
+2.35.1
+
--- /dev/null
+From 2f1a8d4cadcdbd29e6bf38a6d16e5c4490087236 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Nov 2022 13:40:27 +0800
+Subject: erofs: put metabuf in error path in fscache mode
+
+From: Jingbo Xu <jefflexu@linux.alibaba.com>
+
+[ Upstream commit 75e43355cbe4d5948a79bd592f2ffecb9f75f75d ]
+
+For tail packing layout, put metabuf when error is encountered.
+
+Fixes: 1ae9470c3e14 ("erofs: clean up .read_folio() and .readahead() in fscache mode")
+Signed-off-by: Jingbo Xu <jefflexu@linux.alibaba.com>
+Reviewed-by: Gao Xiang <hsiangkao@linux.alibaba.com>
+Reviewed-by: Jia Zhu <zhujia.zj@bytedance.com>
+Reviewed-by: Chao Yu <chao@kernel.org>
+Link: https://lore.kernel.org/r/20221104054028.52208-2-jefflexu@linux.alibaba.com
+Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/erofs/fscache.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/fs/erofs/fscache.c b/fs/erofs/fscache.c
+index 8585e324298c..79af25f0a56c 100644
+--- a/fs/erofs/fscache.c
++++ b/fs/erofs/fscache.c
+@@ -281,8 +281,10 @@ static int erofs_fscache_data_read(struct address_space *mapping,
+ return PTR_ERR(src);
+
+ iov_iter_xarray(&iter, READ, &mapping->i_pages, pos, PAGE_SIZE);
+- if (copy_to_iter(src + offset, size, &iter) != size)
++ if (copy_to_iter(src + offset, size, &iter) != size) {
++ erofs_put_metabuf(&buf);
+ return -EFAULT;
++ }
+ iov_iter_zero(PAGE_SIZE - size, &iter);
+ erofs_put_metabuf(&buf);
+ return PAGE_SIZE;
+--
+2.35.1
+
--- /dev/null
+From 4010147f56a145a4f70e05a23ce5b47c9128dfef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Nov 2022 07:30:16 -0800
+Subject: io_uring: calculate CQEs from the user visible value
+
+From: Dylan Yudaken <dylany@meta.com>
+
+[ Upstream commit 0fc8c2acbfc789a977a50a4a9812a8e4b37958ce ]
+
+io_cqring_wait (and it's wake function io_has_work) used cached_cq_tail in
+order to calculate the number of CQEs. cached_cq_tail is set strictly
+before the user visible rings->cq.tail
+
+However as far as userspace is concerned, if io_uring_enter(2) is called
+with a minimum number of events, they will verify by checking
+rings->cq.tail.
+
+It is therefore possible for io_uring_enter(2) to return early with fewer
+events visible to the user.
+
+Instead make the wait functions read from the user visible value, so there
+will be no discrepency.
+
+This is triggered eventually by the following reproducer:
+
+struct io_uring_sqe *sqe;
+struct io_uring_cqe *cqe;
+unsigned int cqe_ready;
+struct io_uring ring;
+int ret, i;
+
+ret = io_uring_queue_init(N, &ring, 0);
+assert(!ret);
+while(true) {
+ for (i = 0; i < N; i++) {
+ sqe = io_uring_get_sqe(&ring);
+ io_uring_prep_nop(sqe);
+ sqe->flags |= IOSQE_ASYNC;
+ }
+ ret = io_uring_submit(&ring);
+ assert(ret == N);
+
+ do {
+ ret = io_uring_wait_cqes(&ring, &cqe, N, NULL, NULL);
+ } while(ret == -EINTR);
+ cqe_ready = io_uring_cq_ready(&ring);
+ assert(!ret);
+ assert(cqe_ready == N);
+ io_uring_cq_advance(&ring, N);
+}
+
+Fixes: ad3eb2c89fb2 ("io_uring: split overflow state into SQ and CQ side")
+Signed-off-by: Dylan Yudaken <dylany@meta.com>
+Link: https://lore.kernel.org/r/20221108153016.1854297-1-dylany@meta.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ io_uring/io_uring.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c
+index d29f397f095e..f347e81e2d98 100644
+--- a/io_uring/io_uring.c
++++ b/io_uring/io_uring.c
+@@ -171,6 +171,11 @@ static inline unsigned int __io_cqring_events(struct io_ring_ctx *ctx)
+ return ctx->cached_cq_tail - READ_ONCE(ctx->rings->cq.head);
+ }
+
++static inline unsigned int __io_cqring_events_user(struct io_ring_ctx *ctx)
++{
++ return READ_ONCE(ctx->rings->cq.tail) - READ_ONCE(ctx->rings->cq.head);
++}
++
+ static bool io_match_linked(struct io_kiocb *head)
+ {
+ struct io_kiocb *req;
+@@ -2163,7 +2168,7 @@ struct io_wait_queue {
+ static inline bool io_should_wake(struct io_wait_queue *iowq)
+ {
+ struct io_ring_ctx *ctx = iowq->ctx;
+- int dist = ctx->cached_cq_tail - (int) iowq->cq_tail;
++ int dist = READ_ONCE(ctx->rings->cq.tail) - (int) iowq->cq_tail;
+
+ /*
+ * Wake up if we have enough events, or if a timeout occurred since we
+@@ -2240,7 +2245,8 @@ static int io_cqring_wait(struct io_ring_ctx *ctx, int min_events,
+ do {
+ io_cqring_overflow_flush(ctx);
+
+- if (io_cqring_events(ctx) >= min_events)
++ /* if user messes with these they will just get an early return */
++ if (__io_cqring_events_user(ctx) >= min_events)
+ return 0;
+ if (!io_run_task_work())
+ break;
+--
+2.35.1
+
--- /dev/null
+From 3080b51851fa522b3a9e707af4aafe549f587579 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Nov 2022 16:51:29 +0000
+Subject: io_uring/poll: fix double poll req->flags races
+
+From: Pavel Begunkov <asml.silence@gmail.com>
+
+[ Upstream commit 30a33669fa21cd3dc7d92a00ba736358059014b7 ]
+
+io_poll_double_prepare() | io_poll_wake()
+ | poll->head = NULL
+smp_load(&poll->head); /* NULL */ |
+flags = req->flags; |
+ | req->flags &= ~SINGLE_POLL;
+req->flags = flags | DOUBLE_POLL |
+
+The idea behind io_poll_double_prepare() is to serialise with the
+first poll entry by taking the wq lock. However, it's not safe to assume
+that io_poll_wake() is not running when we can't grab the lock and so we
+may race modifying req->flags.
+
+Skip double poll setup if that happens. It's ok because the first poll
+entry will only be removed when it's definitely completing, e.g.
+pollfree or oneshot with a valid mask.
+
+Fixes: 49f1c68e048f1 ("io_uring: optimise submission side poll_refs")
+Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
+Link: https://lore.kernel.org/r/b7fab2d502f6121a7d7b199fe4d914a43ca9cdfd.1668184658.git.asml.silence@gmail.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ io_uring/poll.c | 29 +++++++++++++++++------------
+ 1 file changed, 17 insertions(+), 12 deletions(-)
+
+diff --git a/io_uring/poll.c b/io_uring/poll.c
+index 0d9f49c575e0..97c214aa688c 100644
+--- a/io_uring/poll.c
++++ b/io_uring/poll.c
+@@ -394,7 +394,8 @@ static int io_poll_wake(struct wait_queue_entry *wait, unsigned mode, int sync,
+ return 1;
+ }
+
+-static void io_poll_double_prepare(struct io_kiocb *req)
++/* fails only when polling is already completing by the first entry */
++static bool io_poll_double_prepare(struct io_kiocb *req)
+ {
+ struct wait_queue_head *head;
+ struct io_poll *poll = io_poll_get_single(req);
+@@ -403,20 +404,20 @@ static void io_poll_double_prepare(struct io_kiocb *req)
+ rcu_read_lock();
+ head = smp_load_acquire(&poll->head);
+ /*
+- * poll arm may not hold ownership and so race with
+- * io_poll_wake() by modifying req->flags. There is only one
+- * poll entry queued, serialise with it by taking its head lock.
++ * poll arm might not hold ownership and so race for req->flags with
++ * io_poll_wake(). There is only one poll entry queued, serialise with
++ * it by taking its head lock. As we're still arming the tw hanlder
++ * is not going to be run, so there are no races with it.
+ */
+- if (head)
++ if (head) {
+ spin_lock_irq(&head->lock);
+-
+- req->flags |= REQ_F_DOUBLE_POLL;
+- if (req->opcode == IORING_OP_POLL_ADD)
+- req->flags |= REQ_F_ASYNC_DATA;
+-
+- if (head)
++ req->flags |= REQ_F_DOUBLE_POLL;
++ if (req->opcode == IORING_OP_POLL_ADD)
++ req->flags |= REQ_F_ASYNC_DATA;
+ spin_unlock_irq(&head->lock);
++ }
+ rcu_read_unlock();
++ return !!head;
+ }
+
+ static void __io_queue_proc(struct io_poll *poll, struct io_poll_table *pt,
+@@ -454,7 +455,11 @@ static void __io_queue_proc(struct io_poll *poll, struct io_poll_table *pt,
+ /* mark as double wq entry */
+ wqe_private |= IO_WQE_F_DOUBLE;
+ io_init_poll_iocb(poll, first->events, first->wait.func);
+- io_poll_double_prepare(req);
++ if (!io_poll_double_prepare(req)) {
++ /* the request is completing, just back off */
++ kfree(poll);
++ return;
++ }
+ *poll_ptr = poll;
+ } else {
+ /* fine to modify, there is no poll queued to race with us */
+--
+2.35.1
+
--- /dev/null
+From df6138aaff655f389cade99e82a646586aad6c92 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 13 Nov 2022 16:51:19 -0800
+Subject: kcm: close race conditions on sk_receive_queue
+
+From: Cong Wang <cong.wang@bytedance.com>
+
+[ Upstream commit 5121197ecc5db58c07da95eb1ff82b98b121a221 ]
+
+sk->sk_receive_queue is protected by skb queue lock, but for KCM
+sockets its RX path takes mux->rx_lock to protect more than just
+skb queue. However, kcm_recvmsg() still only grabs the skb queue
+lock, so race conditions still exist.
+
+We can teach kcm_recvmsg() to grab mux->rx_lock too but this would
+introduce a potential performance regression as struct kcm_mux can
+be shared by multiple KCM sockets.
+
+So we have to enforce skb queue lock in requeue_rx_msgs() and handle
+skb peek case carefully in kcm_wait_data(). Fortunately,
+skb_recv_datagram() already handles it nicely and is widely used by
+other sockets, we can just switch to skb_recv_datagram() after
+getting rid of the unnecessary sock lock in kcm_recvmsg() and
+kcm_splice_read(). Side note: SOCK_DONE is not used by KCM sockets,
+so it is safe to get rid of this check too.
+
+I ran the original syzbot reproducer for 30 min without seeing any
+issue.
+
+Fixes: ab7ac4eb9832 ("kcm: Kernel Connection Multiplexor module")
+Reported-by: syzbot+278279efdd2730dd14bf@syzkaller.appspotmail.com
+Reported-by: shaozhengchao <shaozhengchao@huawei.com>
+Cc: Paolo Abeni <pabeni@redhat.com>
+Cc: Tom Herbert <tom@herbertland.com>
+Signed-off-by: Cong Wang <cong.wang@bytedance.com>
+Link: https://lore.kernel.org/r/20221114005119.597905-1-xiyou.wangcong@gmail.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/kcm/kcmsock.c | 58 +++++------------------------------------------
+ 1 file changed, 6 insertions(+), 52 deletions(-)
+
+diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c
+index befc62606cdf..9e4b40a30a72 100644
+--- a/net/kcm/kcmsock.c
++++ b/net/kcm/kcmsock.c
+@@ -222,7 +222,7 @@ static void requeue_rx_msgs(struct kcm_mux *mux, struct sk_buff_head *head)
+ struct sk_buff *skb;
+ struct kcm_sock *kcm;
+
+- while ((skb = __skb_dequeue(head))) {
++ while ((skb = skb_dequeue(head))) {
+ /* Reset destructor to avoid calling kcm_rcv_ready */
+ skb->destructor = sock_rfree;
+ skb_orphan(skb);
+@@ -1085,53 +1085,17 @@ static int kcm_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
+ return err;
+ }
+
+-static struct sk_buff *kcm_wait_data(struct sock *sk, int flags,
+- long timeo, int *err)
+-{
+- struct sk_buff *skb;
+-
+- while (!(skb = skb_peek(&sk->sk_receive_queue))) {
+- if (sk->sk_err) {
+- *err = sock_error(sk);
+- return NULL;
+- }
+-
+- if (sock_flag(sk, SOCK_DONE))
+- return NULL;
+-
+- if ((flags & MSG_DONTWAIT) || !timeo) {
+- *err = -EAGAIN;
+- return NULL;
+- }
+-
+- sk_wait_data(sk, &timeo, NULL);
+-
+- /* Handle signals */
+- if (signal_pending(current)) {
+- *err = sock_intr_errno(timeo);
+- return NULL;
+- }
+- }
+-
+- return skb;
+-}
+-
+ static int kcm_recvmsg(struct socket *sock, struct msghdr *msg,
+ size_t len, int flags)
+ {
+ struct sock *sk = sock->sk;
+ struct kcm_sock *kcm = kcm_sk(sk);
+ int err = 0;
+- long timeo;
+ struct strp_msg *stm;
+ int copied = 0;
+ struct sk_buff *skb;
+
+- timeo = sock_rcvtimeo(sk, flags & MSG_DONTWAIT);
+-
+- lock_sock(sk);
+-
+- skb = kcm_wait_data(sk, flags, timeo, &err);
++ skb = skb_recv_datagram(sk, flags, &err);
+ if (!skb)
+ goto out;
+
+@@ -1162,14 +1126,11 @@ static int kcm_recvmsg(struct socket *sock, struct msghdr *msg,
+ /* Finished with message */
+ msg->msg_flags |= MSG_EOR;
+ KCM_STATS_INCR(kcm->stats.rx_msgs);
+- skb_unlink(skb, &sk->sk_receive_queue);
+- kfree_skb(skb);
+ }
+ }
+
+ out:
+- release_sock(sk);
+-
++ skb_free_datagram(sk, skb);
+ return copied ? : err;
+ }
+
+@@ -1179,7 +1140,6 @@ static ssize_t kcm_splice_read(struct socket *sock, loff_t *ppos,
+ {
+ struct sock *sk = sock->sk;
+ struct kcm_sock *kcm = kcm_sk(sk);
+- long timeo;
+ struct strp_msg *stm;
+ int err = 0;
+ ssize_t copied;
+@@ -1187,11 +1147,7 @@ static ssize_t kcm_splice_read(struct socket *sock, loff_t *ppos,
+
+ /* Only support splice for SOCKSEQPACKET */
+
+- timeo = sock_rcvtimeo(sk, flags & MSG_DONTWAIT);
+-
+- lock_sock(sk);
+-
+- skb = kcm_wait_data(sk, flags, timeo, &err);
++ skb = skb_recv_datagram(sk, flags, &err);
+ if (!skb)
+ goto err_out;
+
+@@ -1219,13 +1175,11 @@ static ssize_t kcm_splice_read(struct socket *sock, loff_t *ppos,
+ * finish reading the message.
+ */
+
+- release_sock(sk);
+-
++ skb_free_datagram(sk, skb);
+ return copied;
+
+ err_out:
+- release_sock(sk);
+-
++ skb_free_datagram(sk, skb);
+ return err;
+ }
+
+--
+2.35.1
+
--- /dev/null
+From 87a828cfa5ce4b2075d26660756c07751648d13f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Nov 2022 20:16:19 +0100
+Subject: l2tp: Serialize access to sk_user_data with sk_callback_lock
+
+From: Jakub Sitnicki <jakub@cloudflare.com>
+
+[ Upstream commit b68777d54fac21fc833ec26ea1a2a84f975ab035 ]
+
+sk->sk_user_data has multiple users, which are not compatible with each
+other. Writers must synchronize by grabbing the sk->sk_callback_lock.
+
+l2tp currently fails to grab the lock when modifying the underlying tunnel
+socket fields. Fix it by adding appropriate locking.
+
+We err on the side of safety and grab the sk_callback_lock also inside the
+sk_destruct callback overridden by l2tp, even though there should be no
+refs allowing access to the sock at the time when sk_destruct gets called.
+
+v4:
+- serialize write to sk_user_data in l2tp sk_destruct
+
+v3:
+- switch from sock lock to sk_callback_lock
+- document write-protection for sk_user_data
+
+v2:
+- update Fixes to point to origin of the bug
+- use real names in Reported/Tested-by tags
+
+Cc: Tom Parkin <tparkin@katalix.com>
+Fixes: 3557baabf280 ("[L2TP]: PPP over L2TP driver core")
+Reported-by: Haowei Yan <g1042620637@gmail.com>
+Signed-off-by: Jakub Sitnicki <jakub@cloudflare.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/sock.h | 2 +-
+ net/l2tp/l2tp_core.c | 19 +++++++++++++------
+ 2 files changed, 14 insertions(+), 7 deletions(-)
+
+diff --git a/include/net/sock.h b/include/net/sock.h
+index f6e6838c82df..03a4ebe3ccc8 100644
+--- a/include/net/sock.h
++++ b/include/net/sock.h
+@@ -323,7 +323,7 @@ struct sk_filter;
+ * @sk_tskey: counter to disambiguate concurrent tstamp requests
+ * @sk_zckey: counter to order MSG_ZEROCOPY notifications
+ * @sk_socket: Identd and reporting IO signals
+- * @sk_user_data: RPC layer private data
++ * @sk_user_data: RPC layer private data. Write-protected by @sk_callback_lock.
+ * @sk_frag: cached page frag
+ * @sk_peek_off: current peek_offset value
+ * @sk_send_head: front of stuff to transmit
+diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
+index 7499c51b1850..754fdda8a5f5 100644
+--- a/net/l2tp/l2tp_core.c
++++ b/net/l2tp/l2tp_core.c
+@@ -1150,8 +1150,10 @@ static void l2tp_tunnel_destruct(struct sock *sk)
+ }
+
+ /* Remove hooks into tunnel socket */
++ write_lock_bh(&sk->sk_callback_lock);
+ sk->sk_destruct = tunnel->old_sk_destruct;
+ sk->sk_user_data = NULL;
++ write_unlock_bh(&sk->sk_callback_lock);
+
+ /* Call the original destructor */
+ if (sk->sk_destruct)
+@@ -1469,16 +1471,18 @@ int l2tp_tunnel_register(struct l2tp_tunnel *tunnel, struct net *net,
+ sock = sockfd_lookup(tunnel->fd, &ret);
+ if (!sock)
+ goto err;
+-
+- ret = l2tp_validate_socket(sock->sk, net, tunnel->encap);
+- if (ret < 0)
+- goto err_sock;
+ }
+
++ sk = sock->sk;
++ write_lock(&sk->sk_callback_lock);
++
++ ret = l2tp_validate_socket(sk, net, tunnel->encap);
++ if (ret < 0)
++ goto err_sock;
++
+ tunnel->l2tp_net = net;
+ pn = l2tp_pernet(net);
+
+- sk = sock->sk;
+ sock_hold(sk);
+ tunnel->sock = sk;
+
+@@ -1504,7 +1508,7 @@ int l2tp_tunnel_register(struct l2tp_tunnel *tunnel, struct net *net,
+
+ setup_udp_tunnel_sock(net, sock, &udp_cfg);
+ } else {
+- sk->sk_user_data = tunnel;
++ rcu_assign_sk_user_data(sk, tunnel);
+ }
+
+ tunnel->old_sk_destruct = sk->sk_destruct;
+@@ -1518,6 +1522,7 @@ int l2tp_tunnel_register(struct l2tp_tunnel *tunnel, struct net *net,
+ if (tunnel->fd >= 0)
+ sockfd_put(sock);
+
++ write_unlock(&sk->sk_callback_lock);
+ return 0;
+
+ err_sock:
+@@ -1525,6 +1530,8 @@ int l2tp_tunnel_register(struct l2tp_tunnel *tunnel, struct net *net,
+ sock_release(sock);
+ else
+ sockfd_put(sock);
++
++ write_unlock(&sk->sk_callback_lock);
+ err:
+ return ret;
+ }
+--
+2.35.1
+
--- /dev/null
+From 692c01925ad7fffd7c22ea0ea7d3ad0fc87ff1d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Nov 2022 13:31:35 +0800
+Subject: mctp i2c: don't count unused / invalid keys for flow release
+
+From: Jeremy Kerr <jk@codeconstruct.com.au>
+
+[ Upstream commit 9cbd48d5fa14e4c65f8580de16686077f7cea02b ]
+
+We're currently hitting the WARN_ON in mctp_i2c_flow_release:
+
+ if (midev->release_count > midev->i2c_lock_count) {
+ WARN_ONCE(1, "release count overflow");
+
+This may be hit if we expire a flow before sending the first packet it
+contains - as we will not be pairing the increment of release_count
+(performed on flow release) with the i2c lock operation (only
+performed on actual TX).
+
+To fix this, only release a flow if we've encountered it previously (ie,
+dev_flow_state does not indicate NEW), as we will mark the flow as
+ACTIVE at the same time as accounting for the i2c lock operation. We
+also need to add an INVALID flow state, to indicate when we've done the
+release.
+
+Fixes: f5b8abf9fc3d ("mctp i2c: MCTP I2C binding driver")
+Reported-by: Jian Zhang <zhangjian.3032@bytedance.com>
+Tested-by: Jian Zhang <zhangjian.3032@bytedance.com>
+Signed-off-by: Jeremy Kerr <jk@codeconstruct.com.au>
+Link: https://lore.kernel.org/r/20221110053135.329071-1-jk@codeconstruct.com.au
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/mctp/mctp-i2c.c | 47 +++++++++++++++++++++++++------------
+ 1 file changed, 32 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/net/mctp/mctp-i2c.c b/drivers/net/mctp/mctp-i2c.c
+index 53846c6b56ca..aca3697b0962 100644
+--- a/drivers/net/mctp/mctp-i2c.c
++++ b/drivers/net/mctp/mctp-i2c.c
+@@ -43,6 +43,7 @@
+ enum {
+ MCTP_I2C_FLOW_STATE_NEW = 0,
+ MCTP_I2C_FLOW_STATE_ACTIVE,
++ MCTP_I2C_FLOW_STATE_INVALID,
+ };
+
+ /* List of all struct mctp_i2c_client
+@@ -374,12 +375,18 @@ mctp_i2c_get_tx_flow_state(struct mctp_i2c_dev *midev, struct sk_buff *skb)
+ */
+ if (!key->valid) {
+ state = MCTP_I2C_TX_FLOW_INVALID;
+-
+- } else if (key->dev_flow_state == MCTP_I2C_FLOW_STATE_NEW) {
+- key->dev_flow_state = MCTP_I2C_FLOW_STATE_ACTIVE;
+- state = MCTP_I2C_TX_FLOW_NEW;
+ } else {
+- state = MCTP_I2C_TX_FLOW_EXISTING;
++ switch (key->dev_flow_state) {
++ case MCTP_I2C_FLOW_STATE_NEW:
++ key->dev_flow_state = MCTP_I2C_FLOW_STATE_ACTIVE;
++ state = MCTP_I2C_TX_FLOW_NEW;
++ break;
++ case MCTP_I2C_FLOW_STATE_ACTIVE:
++ state = MCTP_I2C_TX_FLOW_EXISTING;
++ break;
++ default:
++ state = MCTP_I2C_TX_FLOW_INVALID;
++ }
+ }
+
+ spin_unlock_irqrestore(&key->lock, flags);
+@@ -617,21 +624,31 @@ static void mctp_i2c_release_flow(struct mctp_dev *mdev,
+
+ {
+ struct mctp_i2c_dev *midev = netdev_priv(mdev->dev);
++ bool queue_release = false;
+ unsigned long flags;
+
+ spin_lock_irqsave(&midev->lock, flags);
+- midev->release_count++;
+- spin_unlock_irqrestore(&midev->lock, flags);
+-
+- /* Ensure we have a release operation queued, through the fake
+- * marker skb
++ /* if we have seen the flow/key previously, we need to pair the
++ * original lock with a release
+ */
+- spin_lock(&midev->tx_queue.lock);
+- if (!midev->unlock_marker.next)
+- __skb_queue_tail(&midev->tx_queue, &midev->unlock_marker);
+- spin_unlock(&midev->tx_queue.lock);
++ if (key->dev_flow_state == MCTP_I2C_FLOW_STATE_ACTIVE) {
++ midev->release_count++;
++ queue_release = true;
++ }
++ key->dev_flow_state = MCTP_I2C_FLOW_STATE_INVALID;
++ spin_unlock_irqrestore(&midev->lock, flags);
+
+- wake_up(&midev->tx_wq);
++ if (queue_release) {
++ /* Ensure we have a release operation queued, through the fake
++ * marker skb
++ */
++ spin_lock(&midev->tx_queue.lock);
++ if (!midev->unlock_marker.next)
++ __skb_queue_tail(&midev->tx_queue,
++ &midev->unlock_marker);
++ spin_unlock(&midev->tx_queue.lock);
++ wake_up(&midev->tx_wq);
++ }
+ }
+
+ static const struct net_device_ops mctp_i2c_ops = {
+--
+2.35.1
+
--- /dev/null
+From 5ec87988c6554e961bce8e60ce78a7ac318ad1ff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Nov 2022 20:27:39 +0800
+Subject: MIPS: fix duplicate definitions for exported symbols
+
+From: Rongwei Zhang <pudh4418@gmail.com>
+
+[ Upstream commit 612d80784fdc0c2e2ee2e2d901a55ef2f72ebf4b ]
+
+Building with clang-14 fails with:
+
+AS arch/mips/kernel/relocate_kernel.o
+<unknown>:0: error: symbol 'kexec_args' is already defined
+<unknown>:0: error: symbol 'secondary_kexec_args' is already defined
+<unknown>:0: error: symbol 'kexec_start_address' is already defined
+<unknown>:0: error: symbol 'kexec_indirection_page' is already defined
+<unknown>:0: error: symbol 'relocate_new_kernel_size' is already defined
+
+It turns out EXPORT defined in asm/asm.h expands to a symbol definition,
+so there is no need to define these symbols again. Remove duplicated
+symbol definitions.
+
+Fixes: 7aa1c8f47e7e ("MIPS: kdump: Add support")
+Signed-off-by: Rongwei Zhang <pudh4418@gmail.com>
+Reviewed-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/kernel/relocate_kernel.S | 15 +++++----------
+ 1 file changed, 5 insertions(+), 10 deletions(-)
+
+diff --git a/arch/mips/kernel/relocate_kernel.S b/arch/mips/kernel/relocate_kernel.S
+index cfde14b48fd8..f5b2ef979b43 100644
+--- a/arch/mips/kernel/relocate_kernel.S
++++ b/arch/mips/kernel/relocate_kernel.S
+@@ -145,8 +145,7 @@ LEAF(kexec_smp_wait)
+ * kexec_args[0..3] are used to prepare register values.
+ */
+
+-kexec_args:
+- EXPORT(kexec_args)
++EXPORT(kexec_args)
+ arg0: PTR_WD 0x0
+ arg1: PTR_WD 0x0
+ arg2: PTR_WD 0x0
+@@ -159,8 +158,7 @@ arg3: PTR_WD 0x0
+ * their registers a0-a3. secondary_kexec_args[0..3] are used
+ * to prepare register values.
+ */
+-secondary_kexec_args:
+- EXPORT(secondary_kexec_args)
++EXPORT(secondary_kexec_args)
+ s_arg0: PTR_WD 0x0
+ s_arg1: PTR_WD 0x0
+ s_arg2: PTR_WD 0x0
+@@ -171,19 +169,16 @@ kexec_flag:
+
+ #endif
+
+-kexec_start_address:
+- EXPORT(kexec_start_address)
++EXPORT(kexec_start_address)
+ PTR_WD 0x0
+ .size kexec_start_address, PTRSIZE
+
+-kexec_indirection_page:
+- EXPORT(kexec_indirection_page)
++EXPORT(kexec_indirection_page)
+ PTR_WD 0
+ .size kexec_indirection_page, PTRSIZE
+
+ relocate_new_kernel_end:
+
+-relocate_new_kernel_size:
+- EXPORT(relocate_new_kernel_size)
++EXPORT(relocate_new_kernel_size)
+ PTR_WD relocate_new_kernel_end - relocate_new_kernel
+ .size relocate_new_kernel_size, PTRSIZE
+--
+2.35.1
+
--- /dev/null
+From f386e5f994ee04d102405207a8bfdc5c2e570daa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Nov 2022 09:18:15 +0800
+Subject: MIPS: Loongson64: Add WARN_ON on kexec related kmalloc failed
+
+From: Liao Chang <liaochang1@huawei.com>
+
+[ Upstream commit fa706927f4722a2df723b2a28d139b1904a3e7fa ]
+
+Add WARN_ON on kexec related kmalloc failed, avoid to pass NULL pointer
+to following memcpy and loongson_kexec_prepare.
+
+Fixes: 6ce48897ce47 ("MIPS: Loongson64: Add kexec/kdump support")
+Signed-off-by: Liao Chang <liaochang1@huawei.com>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/loongson64/reset.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/arch/mips/loongson64/reset.c b/arch/mips/loongson64/reset.c
+index 758d5d26aaaa..e420800043b0 100644
+--- a/arch/mips/loongson64/reset.c
++++ b/arch/mips/loongson64/reset.c
+@@ -16,6 +16,7 @@
+ #include <asm/bootinfo.h>
+ #include <asm/idle.h>
+ #include <asm/reboot.h>
++#include <asm/bug.h>
+
+ #include <loongson.h>
+ #include <boot_param.h>
+@@ -159,8 +160,17 @@ static int __init mips_reboot_setup(void)
+
+ #ifdef CONFIG_KEXEC
+ kexec_argv = kmalloc(KEXEC_ARGV_SIZE, GFP_KERNEL);
++ if (WARN_ON(!kexec_argv))
++ return -ENOMEM;
++
+ kdump_argv = kmalloc(KEXEC_ARGV_SIZE, GFP_KERNEL);
++ if (WARN_ON(!kdump_argv))
++ return -ENOMEM;
++
+ kexec_envp = kmalloc(KEXEC_ENVP_SIZE, GFP_KERNEL);
++ if (WARN_ON(!kexec_envp))
++ return -ENOMEM;
++
+ fw_arg1 = KEXEC_ARGV_ADDR;
+ memcpy(kexec_envp, (void *)fw_arg2, KEXEC_ENVP_SIZE);
+
+--
+2.35.1
+
--- /dev/null
+From 75bdb224cdf0f17398694abf30aeea3ad4245bbf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Nov 2022 19:38:23 +0800
+Subject: mISDN: fix misuse of put_device() in mISDN_register_device()
+
+From: Wang ShaoBo <bobo.shaobowang@huawei.com>
+
+[ Upstream commit 2d25107e111a85c56f601a5470f1780ec054e6ac ]
+
+We should not release reference by put_device() before calling device_initialize().
+
+Fixes: e7d1d4d9ac0d ("mISDN: fix possible memory leak in mISDN_register_device()")
+Signed-off-by: Wang ShaoBo <bobo.shaobowang@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/isdn/mISDN/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/isdn/mISDN/core.c b/drivers/isdn/mISDN/core.c
+index 7ea0100f218a..90ee56d07a6e 100644
+--- a/drivers/isdn/mISDN/core.c
++++ b/drivers/isdn/mISDN/core.c
+@@ -222,7 +222,7 @@ mISDN_register_device(struct mISDNdevice *dev,
+
+ err = get_free_devid();
+ if (err < 0)
+- goto error1;
++ return err;
+ dev->id = err;
+
+ device_initialize(&dev->dev);
+--
+2.35.1
+
--- /dev/null
+From e4f56dc4bb05347c903439ce20a8eddb513bec66 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Nov 2022 21:28:32 +0800
+Subject: mISDN: fix possible memory leak in mISDN_dsp_element_register()
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit 98a2ac1ca8fd6eca6867726fe238d06e75eb1acd ]
+
+Afer commit 1fa5ae857bb1 ("driver core: get rid of struct device's
+bus_id string array"), the name of device is allocated dynamically,
+use put_device() to give up the reference, so that the name can be
+freed in kobject_cleanup() when the refcount is 0.
+
+The 'entry' is going to be freed in mISDN_dsp_dev_release(), so the
+kfree() is removed. list_del() is called in mISDN_dsp_dev_release(),
+so it need be initialized.
+
+Fixes: 1fa5ae857bb1 ("driver core: get rid of struct device's bus_id string array")
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Link: https://lore.kernel.org/r/20221109132832.3270119-1-yangyingliang@huawei.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/isdn/mISDN/dsp_pipeline.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/isdn/mISDN/dsp_pipeline.c b/drivers/isdn/mISDN/dsp_pipeline.c
+index c3b2c99b5cd5..cfbcd9e973c2 100644
+--- a/drivers/isdn/mISDN/dsp_pipeline.c
++++ b/drivers/isdn/mISDN/dsp_pipeline.c
+@@ -77,6 +77,7 @@ int mISDN_dsp_element_register(struct mISDN_dsp_element *elem)
+ if (!entry)
+ return -ENOMEM;
+
++ INIT_LIST_HEAD(&entry->list);
+ entry->elem = elem;
+
+ entry->dev.class = elements_class;
+@@ -107,7 +108,7 @@ int mISDN_dsp_element_register(struct mISDN_dsp_element *elem)
+ device_unregister(&entry->dev);
+ return ret;
+ err1:
+- kfree(entry);
++ put_device(&entry->dev);
+ return ret;
+ }
+ EXPORT_SYMBOL(mISDN_dsp_element_register);
+--
+2.35.1
+
--- /dev/null
+From b9adddf7a807f1b3ac5dbceb328820a52ae12e04 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Nov 2022 18:03:27 +0100
+Subject: mlxsw: Avoid warnings when not offloaded FDB entry with IPv6 is
+ removed
+
+From: Amit Cohen <amcohen@nvidia.com>
+
+[ Upstream commit 30f5312d2c722107364f266cfa98ef4f0857c1fb ]
+
+FDB entries that perform VXLAN encapsulation with an IPv6 underlay hold
+a reference on a resource - the KVDL entry where the IPv6 underlay
+destination IP is stored. For that, the driver maintains two hash tables:
+1. Maps IPv6 to KVDL index
+2. Maps {MAC, FID index} to IPv6 address
+
+When a FDB entry is removed, the second table is used to find the relevant
+IPv6 address and the first table is used to remove the reference count and
+free the index if is not used anymore.
+
+In order for a packet to be forwarded to a single remote VTEP, FDB
+entries need to be configured at both the bridge and VXLAN devices' FDB
+tables. Both entries are squashed into one {MAC, VLAN/VNI} -> IP entry
+in the hardware. Therefore, in case one entry is removed, the entry will
+be removed from the hardware and the remaining entry will be unmarked
+with 'offload' flag since it is not offloaded anymore.
+
+For example, the two FDB entries should be added to allow packets to be
+forwarded via vx10:
+$ bridge fdb add dev vx10 aa:bb:cc:dd:ee:ff self static dst 2001:db8:5::1
+$ bridge fdb add dev vx10 aa:bb:cc:dd:ee:ff master static vlan 10
+
+When one entry will be removed, the second one will not be offloaded
+anymore. When the first entry (in VXLAN FDB) will be removed / will not be
+offloaded anymore, the two mappings in IPv6 hash tables will be removed.
+
+In case that the second entry is removed before the first one, unexpected
+warnings[1][2] will be shown in user space as a result of removing the
+first entry. The issue is that not offloaded entry is removed, the driver
+tries to search the relevant entries in the hash tables, does not find them
+and therefore warns.
+
+Do not handle removing of not offloaded VXLAN FDB entries, as they were
+already removed when the offload flag was removed.
+
+[1]:
+WARNING: CPU: 1 PID: 239 at drivers/net/ethernet/mellanox/mlxsw/spectrum_nve.c:914 mlxsw_sp_nve_ipv6_addr_map_del+0x6b/0x80 [mlxsw_spectrum]
+...
+Hardware name: Mellanox Technologies Ltd. Mellanox switch/Mellanox switch, BIOS 4.6.5 05/21/2015
+Workqueue: mlxsw_core_ordered mlxsw_sp_switchdev_vxlan_fdb_event_work [mlxsw_spectrum]
+RIP: 0010:mlxsw_sp_nve_ipv6_addr_map_del+0x6b/0x80 [mlxsw_spectrum]
+...
+Call Trace:
+ <TASK>
+ mlxsw_sp_port_fdb_tunnel_uc_op+0x6cf/0x7b0 [mlxsw_spectrum]
+ mlxsw_sp_switchdev_vxlan_fdb_event_work+0x17c/0x420 [mlxsw_spectrum]
+ ? finish_task_switch.isra.0+0x8c/0x290
+ process_one_work+0x1cd/0x390
+ worker_thread+0x48/0x3c0
+ ? process_one_work+0x390/0x390
+ kthread+0xe0/0x110
+ ? kthread_complete_and_exit+0x20/0x20
+ ret_from_fork+0x1f/0x30
+ </TASK>
+
+[2]:
+WARNING: CPU: 0 PID: 239 at drivers/net/ethernet/mellanox/mlxsw/spectrum.c:3035 mlxsw_sp_ipv6_addr_put+0x142/0x220 [mlxsw_spectrum]
+...
+Hardware name: Mellanox Technologies Ltd. Mellanox switch/Mellanox switch, BIOS 4.6.5 05/21/2015
+Workqueue: mlxsw_core_ordered mlxsw_sp_switchdev_vxlan_fdb_event_work [mlxsw_spectrum]
+RIP: 0010:mlxsw_sp_ipv6_addr_put+0x142/0x220 [mlxsw_spectrum]
+...
+Call Trace:
+ <TASK>
+ ? mlxsw_sp_port_fdb_tun_uc_op6_sfd_write+0x5c1/0x610 [mlxsw_spectrum]
+ mlxsw_sp_port_fdb_tunnel_uc_op+0x6ec/0x7b0 [mlxsw_spectrum]
+ mlxsw_sp_switchdev_vxlan_fdb_event_work+0x17c/0x420 [mlxsw_spectrum]
+ ? finish_task_switch.isra.0+0x8c/0x290
+ process_one_work+0x1cd/0x390
+ worker_thread+0x48/0x3c0
+ ? process_one_work+0x390/0x390
+ kthread+0xe0/0x110
+ ? kthread_complete_and_exit+0x20/0x20
+ ret_from_fork+0x1f/0x30
+ </TASK>
+
+Fixes: 0860c7641634 ("mlxsw: spectrum_nve: Keep track of IPv6 addresses used by FDB entries")
+Signed-off-by: Amit Cohen <amcohen@nvidia.com>
+Reviewed-by: Ido Schimmel <idosch@nvidia.com>
+Signed-off-by: Petr Machata <petrm@nvidia.com>
+Link: https://lore.kernel.org/r/c186de8cbd28e3eb661e06f31f7f2f2dff30020f.1668184350.git.petrm@nvidia.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
+index 4efccd942fb8..1290b2d3eae6 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
+@@ -3470,6 +3470,8 @@ mlxsw_sp_switchdev_vxlan_fdb_del(struct mlxsw_sp *mlxsw_sp,
+ u16 vid;
+
+ vxlan_fdb_info = &switchdev_work->vxlan_fdb_info;
++ if (!vxlan_fdb_info->offloaded)
++ return;
+
+ bridge_device = mlxsw_sp_bridge_device_find(mlxsw_sp->bridge, br_dev);
+ if (!bridge_device)
+--
+2.35.1
+
--- /dev/null
+From f5a0df6e38aa061250722b21491e13b56dc230b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Nov 2022 10:15:20 +0100
+Subject: mtd: onenand: omap2: add dependency on GPMC
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit c717b9b7d6de9e024e47f7cd5bbff49f581d3db9 ]
+
+OMAP2 OneNAND driver uses gpmc_omap_onenand_set_timings() provided by
+OMAP_GPMC driver, so the latter cannot be module if OneNAND driver is
+built-in:
+
+ /usr/bin/arm-linux-gnueabi-ld: drivers/mtd/nand/onenand/onenand_omap2.o: in function `omap2_onenand_probe':
+ onenand_omap2.c:(.text+0x520): undefined reference to `gpmc_omap_onenand_set_timings'
+
+The OMAP_GPMC is also a runtime dependency.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Fixes: 854fd9209b20 ("memory: omap-gpmc: Allow building as a module")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: Roger Quadros <rogerq@kernel.org>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20221107091520.127053-1-krzysztof.kozlowski@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/nand/onenand/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/mtd/nand/onenand/Kconfig b/drivers/mtd/nand/onenand/Kconfig
+index 34d9a7a82ad4..c94bf483541e 100644
+--- a/drivers/mtd/nand/onenand/Kconfig
++++ b/drivers/mtd/nand/onenand/Kconfig
+@@ -26,6 +26,7 @@ config MTD_ONENAND_OMAP2
+ tristate "OneNAND on OMAP2/OMAP3 support"
+ depends on ARCH_OMAP2 || ARCH_OMAP3 || (COMPILE_TEST && ARM)
+ depends on OF || COMPILE_TEST
++ depends on OMAP_GPMC
+ help
+ Support for a OneNAND flash device connected to an OMAP2/OMAP3 SoC
+ via the GPMC memory controller.
+--
+2.35.1
+
--- /dev/null
+From 7d3d2cda29c4bbd0f2b0796036ca15e8c751f110 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Nov 2022 17:55:49 +0800
+Subject: net: ag71xx: call phylink_disconnect_phy if ag71xx_hw_enable() fail
+ in ag71xx_open()
+
+From: Liu Jian <liujian56@huawei.com>
+
+[ Upstream commit c9b895c6878bdb6789dc1d7af60fd10f4a9f1937 ]
+
+If ag71xx_hw_enable() fails, call phylink_disconnect_phy() to clean up.
+And if phylink_of_phy_connect() fails, nothing needs to be done.
+Compile tested only.
+
+Fixes: 892e09153fa3 ("net: ag71xx: port to phylink")
+Signed-off-by: Liu Jian <liujian56@huawei.com>
+Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Link: https://lore.kernel.org/r/20221114095549.40342-1-liujian56@huawei.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/atheros/ag71xx.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/atheros/ag71xx.c b/drivers/net/ethernet/atheros/ag71xx.c
+index e461f4764066..e23d8734d4e4 100644
+--- a/drivers/net/ethernet/atheros/ag71xx.c
++++ b/drivers/net/ethernet/atheros/ag71xx.c
+@@ -1427,7 +1427,7 @@ static int ag71xx_open(struct net_device *ndev)
+ if (ret) {
+ netif_err(ag, link, ndev, "phylink_of_phy_connect filed with err: %i\n",
+ ret);
+- goto err;
++ return ret;
+ }
+
+ max_frame_len = ag71xx_max_frame_len(ndev->mtu);
+@@ -1448,6 +1448,7 @@ static int ag71xx_open(struct net_device *ndev)
+
+ err:
+ ag71xx_rings_cleanup(ag);
++ phylink_disconnect_phy(ag->phylink);
+ return ret;
+ }
+
+--
+2.35.1
+
--- /dev/null
+From 8d3ece31d706afccbb51986a4a94d51f7b224135 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Nov 2022 15:01:36 +0000
+Subject: net: bgmac: Drop free_netdev() from bgmac_enet_remove()
+
+From: Wei Yongjun <weiyongjun1@huawei.com>
+
+[ Upstream commit 6f928ab8ee9bfbcb0e631c47ea8a16c3d5116ff1 ]
+
+netdev is allocated in bgmac_alloc() with devm_alloc_etherdev() and will
+be auto released in ->remove and ->probe failure path. Using free_netdev()
+in bgmac_enet_remove() leads to double free.
+
+Fixes: 34a5102c3235 ("net: bgmac: allocate struct bgmac just once & don't copy it")
+Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
+
+Link: https://lore.kernel.org/r/20221109150136.2991171-1-weiyongjun@huaweicloud.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bgmac.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bgmac.c b/drivers/net/ethernet/broadcom/bgmac.c
+index 93580484a3f4..91c054eef701 100644
+--- a/drivers/net/ethernet/broadcom/bgmac.c
++++ b/drivers/net/ethernet/broadcom/bgmac.c
+@@ -1568,7 +1568,6 @@ void bgmac_enet_remove(struct bgmac *bgmac)
+ phy_disconnect(bgmac->net_dev->phydev);
+ netif_napi_del(&bgmac->napi);
+ bgmac_dma_free(bgmac);
+- free_netdev(bgmac->net_dev);
+ }
+ EXPORT_SYMBOL_GPL(bgmac_enet_remove);
+
+--
+2.35.1
+
--- /dev/null
+From 3f2ccae1764a49bc15c75582001b7b9c94bcb5ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Nov 2022 09:47:34 +0800
+Subject: net: caif: fix double disconnect client in chnl_net_open()
+
+From: Zhengchao Shao <shaozhengchao@huawei.com>
+
+[ Upstream commit 8fbb53c8bfd8c56ecf1f78dc821778b58f505503 ]
+
+When connecting to client timeout, disconnect client for twice in
+chnl_net_open(). Remove one. Compile tested only.
+
+Fixes: 2aa40aef9deb ("caif: Use link layer MTU instead of fixed MTU")
+Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/caif/chnl_net.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/net/caif/chnl_net.c b/net/caif/chnl_net.c
+index 4d63ef13a1fd..f35fc87c453a 100644
+--- a/net/caif/chnl_net.c
++++ b/net/caif/chnl_net.c
+@@ -310,9 +310,6 @@ static int chnl_net_open(struct net_device *dev)
+
+ if (result == 0) {
+ pr_debug("connect timeout\n");
+- caif_disconnect_client(dev_net(dev), &priv->chnl);
+- priv->state = CAIF_DISCONNECTED;
+- pr_debug("state disconnected\n");
+ result = -ETIMEDOUT;
+ goto error;
+ }
+--
+2.35.1
+
--- /dev/null
+From 529d959e5a938c3e2acb7aaa5126231ced047677 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Nov 2022 16:35:51 +0200
+Subject: net: dsa: don't leak tagger-owned storage on switch driver unbind
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit 4e0c19fcb8b5323716140fa82b79aa9f60e60407 ]
+
+In the initial commit dc452a471dba ("net: dsa: introduce tagger-owned
+storage for private and shared data"), we had a call to
+tag_ops->disconnect(dst) issued from dsa_tree_free(), which is called at
+tree teardown time.
+
+There were problems with connecting to a switch tree as a whole, so this
+got reworked to connecting to individual switches within the tree. In
+this process, tag_ops->disconnect(ds) was made to be called only from
+switch.c (cross-chip notifiers emitted as a result of dynamic tag proto
+changes), but the normal driver teardown code path wasn't replaced with
+anything.
+
+Solve this problem by adding a function that does the opposite of
+dsa_switch_setup_tag_protocol(), which is called from the equivalent
+spot in dsa_switch_teardown(). The positioning here also ensures that we
+won't have any use-after-free in tagging protocol (*rcv) ops, since the
+teardown sequence is as follows:
+
+dsa_tree_teardown
+-> dsa_tree_teardown_master
+ -> dsa_master_teardown
+ -> unsets master->dsa_ptr, making no further packets match the
+ ETH_P_XDSA packet type handler
+-> dsa_tree_teardown_ports
+ -> dsa_port_teardown
+ -> dsa_slave_destroy
+ -> unregisters DSA net devices, there is even a synchronize_net()
+ in unregister_netdevice_many()
+-> dsa_tree_teardown_switches
+ -> dsa_switch_teardown
+ -> dsa_switch_teardown_tag_protocol
+ -> finally frees the tagger-owned storage
+
+Fixes: 7f2973149c22 ("net: dsa: make tagging protocols connect to individual switches from a tree")
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Reviewed-by: Saeed Mahameed <saeed@kernel.org>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Link: https://lore.kernel.org/r/20221114143551.1906361-1-vladimir.oltean@nxp.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/dsa/dsa2.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/net/dsa/dsa2.c b/net/dsa/dsa2.c
+index e537655e442b..befa954b0a47 100644
+--- a/net/dsa/dsa2.c
++++ b/net/dsa/dsa2.c
+@@ -850,6 +850,14 @@ static int dsa_switch_setup_tag_protocol(struct dsa_switch *ds)
+ return err;
+ }
+
++static void dsa_switch_teardown_tag_protocol(struct dsa_switch *ds)
++{
++ const struct dsa_device_ops *tag_ops = ds->dst->tag_ops;
++
++ if (tag_ops->disconnect)
++ tag_ops->disconnect(ds);
++}
++
+ static int dsa_switch_setup(struct dsa_switch *ds)
+ {
+ struct dsa_devlink_priv *dl_priv;
+@@ -953,6 +961,8 @@ static void dsa_switch_teardown(struct dsa_switch *ds)
+ ds->slave_mii_bus = NULL;
+ }
+
++ dsa_switch_teardown_tag_protocol(ds);
++
+ if (ds->ops->teardown)
+ ds->ops->teardown(ds);
+
+--
+2.35.1
+
--- /dev/null
+From 87d4a9f78f29217db127ff9ca51939b3f9258645 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Nov 2022 23:10:20 +0200
+Subject: net: dsa: make dsa_master_ioctl() see through port_hwtstamp_get()
+ shims
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit ed1fe1bebe18884b11e5536b5ac42e3a48960835 ]
+
+There are multi-generational drivers like mv88e6xxx which have code like
+this:
+
+int mv88e6xxx_port_hwtstamp_get(struct dsa_switch *ds, int port,
+ struct ifreq *ifr)
+{
+ if (!chip->info->ptp_support)
+ return -EOPNOTSUPP;
+
+ ...
+}
+
+DSA wants to deny PTP timestamping on the master if the switch supports
+timestamping too. However it currently relies on the presence of the
+port_hwtstamp_get() callback to determine PTP capability, and this
+clearly does not work in that case (method is present but returns
+-EOPNOTSUPP).
+
+We should not deny PTP on the DSA master for those switches which truly
+do not support hardware timestamping.
+
+Create a dsa_port_supports_hwtstamp() method which actually probes for
+support by calling port_hwtstamp_get() and seeing whether that returned
+-EOPNOTSUPP or not.
+
+Fixes: f685e609a301 ("net: dsa: Deny PTP on master if switch supports it")
+Link: https://patchwork.kernel.org/project/netdevbpf/patch/20221110124345.3901389-1-festevam@gmail.com/
+Reported-by: Fabio Estevam <festevam@gmail.com>
+Reported-by: Steffen Bätz <steffen@innosonix.de>
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Tested-by: Fabio Estevam <festevam@denx.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/dsa/dsa_priv.h | 1 +
+ net/dsa/master.c | 3 +--
+ net/dsa/port.c | 16 ++++++++++++++++
+ 3 files changed, 18 insertions(+), 2 deletions(-)
+
+diff --git a/net/dsa/dsa_priv.h b/net/dsa/dsa_priv.h
+index d9722e49864b..acea875c05e5 100644
+--- a/net/dsa/dsa_priv.h
++++ b/net/dsa/dsa_priv.h
+@@ -201,6 +201,7 @@ static inline struct net_device *dsa_master_find_slave(struct net_device *dev,
+ }
+
+ /* port.c */
++bool dsa_port_supports_hwtstamp(struct dsa_port *dp, struct ifreq *ifr);
+ void dsa_port_set_tag_protocol(struct dsa_port *cpu_dp,
+ const struct dsa_device_ops *tag_ops);
+ int dsa_port_set_state(struct dsa_port *dp, u8 state, bool do_fast_age);
+diff --git a/net/dsa/master.c b/net/dsa/master.c
+index 2851e44c4cf0..46b1f0455a7b 100644
+--- a/net/dsa/master.c
++++ b/net/dsa/master.c
+@@ -204,8 +204,7 @@ static int dsa_master_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
+ * switch in the tree that is PTP capable.
+ */
+ list_for_each_entry(dp, &dst->ports, list)
+- if (dp->ds->ops->port_hwtstamp_get ||
+- dp->ds->ops->port_hwtstamp_set)
++ if (dsa_port_supports_hwtstamp(dp, ifr))
+ return -EBUSY;
+ break;
+ }
+diff --git a/net/dsa/port.c b/net/dsa/port.c
+index a8895ee3cd60..9ac87063cca8 100644
+--- a/net/dsa/port.c
++++ b/net/dsa/port.c
+@@ -109,6 +109,22 @@ static bool dsa_port_can_configure_learning(struct dsa_port *dp)
+ return !err;
+ }
+
++bool dsa_port_supports_hwtstamp(struct dsa_port *dp, struct ifreq *ifr)
++{
++ struct dsa_switch *ds = dp->ds;
++ int err;
++
++ if (!ds->ops->port_hwtstamp_get || !ds->ops->port_hwtstamp_set)
++ return false;
++
++ /* "See through" shim implementations of the "get" method.
++ * This will clobber the ifreq structure, but we will either return an
++ * error, or the master will overwrite it with proper values.
++ */
++ err = ds->ops->port_hwtstamp_get(ds, dp->index, ifr);
++ return err != -EOPNOTSUPP;
++}
++
+ int dsa_port_set_state(struct dsa_port *dp, u8 state, bool do_fast_age)
+ {
+ struct dsa_switch *ds = dp->ds;
+--
+2.35.1
+
--- /dev/null
+From 1756350071f293451314a3bf577bc21665886b56 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Nov 2022 02:56:59 +0000
+Subject: net: ena: Fix error handling in ena_init()
+
+From: Yuan Can <yuancan@huawei.com>
+
+[ Upstream commit d349e9be5a2c2d7588a2c4e4bfa0bb3dc1226769 ]
+
+The ena_init() won't destroy workqueue created by
+create_singlethread_workqueue() when pci_register_driver() failed.
+Call destroy_workqueue() when pci_register_driver() failed to prevent the
+resource leak.
+
+Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)")
+Signed-off-by: Yuan Can <yuancan@huawei.com>
+Acked-by: Shay Agroskin <shayagr@amazon.com>
+Link: https://lore.kernel.org/r/20221114025659.124726-1-yuancan@huawei.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/amazon/ena/ena_netdev.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c
+index 6a356a6cee15..41c821348476 100644
+--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
+@@ -4545,13 +4545,19 @@ static struct pci_driver ena_pci_driver = {
+
+ static int __init ena_init(void)
+ {
++ int ret;
++
+ ena_wq = create_singlethread_workqueue(DRV_MODULE_NAME);
+ if (!ena_wq) {
+ pr_err("Failed to create workqueue\n");
+ return -ENOMEM;
+ }
+
+- return pci_register_driver(&ena_pci_driver);
++ ret = pci_register_driver(&ena_pci_driver);
++ if (ret)
++ destroy_workqueue(ena_wq);
++
++ return ret;
+ }
+
+ static void __exit ena_cleanup(void)
+--
+2.35.1
+
--- /dev/null
+From 8c1d493b18fe5f88a2316a763b596738690b5285 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Nov 2022 02:16:42 +0000
+Subject: net: hinic: Fix error handling in hinic_module_init()
+
+From: Yuan Can <yuancan@huawei.com>
+
+[ Upstream commit 8eab9be56cc6b702a445d2b6d0256aa0992316b3 ]
+
+A problem about hinic create debugfs failed is triggered with the
+following log given:
+
+ [ 931.419023] debugfs: Directory 'hinic' with parent '/' already present!
+
+The reason is that hinic_module_init() returns pci_register_driver()
+directly without checking its return value, if pci_register_driver()
+failed, it returns without destroy the newly created debugfs, resulting
+the debugfs of hinic can never be created later.
+
+ hinic_module_init()
+ hinic_dbg_register_debugfs() # create debugfs directory
+ pci_register_driver()
+ driver_register()
+ bus_add_driver()
+ priv = kzalloc(...) # OOM happened
+ # return without destroy debugfs directory
+
+Fix by removing debugfs when pci_register_driver() returns error.
+
+Fixes: 253ac3a97921 ("hinic: add support to query sq info")
+Signed-off-by: Yuan Can <yuancan@huawei.com>
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Link: https://lore.kernel.org/r/20221110021642.80378-1-yuancan@huawei.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/huawei/hinic/hinic_main.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/huawei/hinic/hinic_main.c b/drivers/net/ethernet/huawei/hinic/hinic_main.c
+index c23ee2ddbce3..1a6534c35ef3 100644
+--- a/drivers/net/ethernet/huawei/hinic/hinic_main.c
++++ b/drivers/net/ethernet/huawei/hinic/hinic_main.c
+@@ -1478,8 +1478,15 @@ static struct pci_driver hinic_driver = {
+
+ static int __init hinic_module_init(void)
+ {
++ int ret;
++
+ hinic_dbg_register_debugfs(HINIC_DRV_NAME);
+- return pci_register_driver(&hinic_driver);
++
++ ret = pci_register_driver(&hinic_driver);
++ if (ret)
++ hinic_dbg_unregister_debugfs();
++
++ return ret;
+ }
+
+ static void __exit hinic_module_exit(void)
+--
+2.35.1
+
--- /dev/null
+From 05769372effe5c64fabe8fb7830d871b812aa3d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Nov 2022 16:20:46 +0800
+Subject: net: hns3: fix incorrect hw rss hash type of rx packet
+
+From: Jian Shen <shenjian15@huawei.com>
+
+[ Upstream commit a56cad694767ebdb7d80f27ffc239db46fff64de ]
+
+Currently, the HNS3 driver reports the rss hash type
+of each packet based on the rss hash tuples set. It
+always reports PKT_HASH_TYPE_L4, without checking the
+type of current packet. It's incorrect.
+Fixes it by reporting it base on the packet type.
+
+Fixes: 796640778c26 ("net: hns3: support RXD advanced layout")
+Fixes: 232fc64b6e62 ("net: hns3: Add HW RSS hash information to RX skb")
+Fixes: ea4858670717 ("net: hns3: handle the BD info on the last BD of the packet")
+Signed-off-by: Jian Shen <shenjian15@huawei.com>
+Signed-off-by: Hao Lan <lanhao@huawei.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hnae3.h | 1 -
+ .../hns3/hns3_common/hclge_comm_rss.c | 20 ---
+ .../hns3/hns3_common/hclge_comm_rss.h | 2 -
+ .../net/ethernet/hisilicon/hns3/hns3_enet.c | 163 ++++++++++--------
+ .../net/ethernet/hisilicon/hns3/hns3_enet.h | 1 +
+ .../hisilicon/hns3/hns3pf/hclge_main.c | 1 -
+ 6 files changed, 94 insertions(+), 94 deletions(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hnae3.h b/drivers/net/ethernet/hisilicon/hns3/hnae3.h
+index 94f80e1c4020..bf7daab88689 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hnae3.h
++++ b/drivers/net/ethernet/hisilicon/hns3/hnae3.h
+@@ -790,7 +790,6 @@ struct hnae3_knic_private_info {
+ const struct hnae3_dcb_ops *dcb_ops;
+
+ u16 int_rl_setting;
+- enum pkt_hash_types rss_type;
+ void __iomem *io_base;
+ };
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_rss.c b/drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_rss.c
+index e23729ac3bb8..ae2736549526 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_rss.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_rss.c
+@@ -191,23 +191,6 @@ u32 hclge_comm_get_rss_key_size(struct hnae3_handle *handle)
+ return HCLGE_COMM_RSS_KEY_SIZE;
+ }
+
+-void hclge_comm_get_rss_type(struct hnae3_handle *nic,
+- struct hclge_comm_rss_tuple_cfg *rss_tuple_sets)
+-{
+- if (rss_tuple_sets->ipv4_tcp_en ||
+- rss_tuple_sets->ipv4_udp_en ||
+- rss_tuple_sets->ipv4_sctp_en ||
+- rss_tuple_sets->ipv6_tcp_en ||
+- rss_tuple_sets->ipv6_udp_en ||
+- rss_tuple_sets->ipv6_sctp_en)
+- nic->kinfo.rss_type = PKT_HASH_TYPE_L4;
+- else if (rss_tuple_sets->ipv4_fragment_en ||
+- rss_tuple_sets->ipv6_fragment_en)
+- nic->kinfo.rss_type = PKT_HASH_TYPE_L3;
+- else
+- nic->kinfo.rss_type = PKT_HASH_TYPE_NONE;
+-}
+-
+ int hclge_comm_parse_rss_hfunc(struct hclge_comm_rss_cfg *rss_cfg,
+ const u8 hfunc, u8 *hash_algo)
+ {
+@@ -344,9 +327,6 @@ int hclge_comm_set_rss_input_tuple(struct hnae3_handle *nic,
+ req->ipv6_sctp_en = rss_cfg->rss_tuple_sets.ipv6_sctp_en;
+ req->ipv6_fragment_en = rss_cfg->rss_tuple_sets.ipv6_fragment_en;
+
+- if (is_pf)
+- hclge_comm_get_rss_type(nic, &rss_cfg->rss_tuple_sets);
+-
+ ret = hclge_comm_cmd_send(hw, &desc, 1);
+ if (ret)
+ dev_err(&hw->cmq.csq.pdev->dev,
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_rss.h b/drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_rss.h
+index 946d166a452d..92af3d2980d3 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_rss.h
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_rss.h
+@@ -95,8 +95,6 @@ struct hclge_comm_rss_tc_mode_cmd {
+ };
+
+ u32 hclge_comm_get_rss_key_size(struct hnae3_handle *handle);
+-void hclge_comm_get_rss_type(struct hnae3_handle *nic,
+- struct hclge_comm_rss_tuple_cfg *rss_tuple_sets);
+ void hclge_comm_rss_indir_init_cfg(struct hnae3_ae_dev *ae_dev,
+ struct hclge_comm_rss_cfg *rss_cfg);
+ int hclge_comm_get_rss_tuple(struct hclge_comm_rss_cfg *rss_cfg, int flow_type,
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+index 35d70041b9e8..944f36e4d66f 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+@@ -105,26 +105,28 @@ static const struct pci_device_id hns3_pci_tbl[] = {
+ };
+ MODULE_DEVICE_TABLE(pci, hns3_pci_tbl);
+
+-#define HNS3_RX_PTYPE_ENTRY(ptype, l, s, t) \
++#define HNS3_RX_PTYPE_ENTRY(ptype, l, s, t, h) \
+ { ptype, \
+ l, \
+ CHECKSUM_##s, \
+ HNS3_L3_TYPE_##t, \
+- 1 }
++ 1, \
++ h}
+
+ #define HNS3_RX_PTYPE_UNUSED_ENTRY(ptype) \
+- { ptype, 0, CHECKSUM_NONE, HNS3_L3_TYPE_PARSE_FAIL, 0 }
++ { ptype, 0, CHECKSUM_NONE, HNS3_L3_TYPE_PARSE_FAIL, 0, \
++ PKT_HASH_TYPE_NONE }
+
+ static const struct hns3_rx_ptype hns3_rx_ptype_tbl[] = {
+ HNS3_RX_PTYPE_UNUSED_ENTRY(0),
+- HNS3_RX_PTYPE_ENTRY(1, 0, COMPLETE, ARP),
+- HNS3_RX_PTYPE_ENTRY(2, 0, COMPLETE, RARP),
+- HNS3_RX_PTYPE_ENTRY(3, 0, COMPLETE, LLDP),
+- HNS3_RX_PTYPE_ENTRY(4, 0, COMPLETE, PARSE_FAIL),
+- HNS3_RX_PTYPE_ENTRY(5, 0, COMPLETE, PARSE_FAIL),
+- HNS3_RX_PTYPE_ENTRY(6, 0, COMPLETE, PARSE_FAIL),
+- HNS3_RX_PTYPE_ENTRY(7, 0, COMPLETE, CNM),
+- HNS3_RX_PTYPE_ENTRY(8, 0, NONE, PARSE_FAIL),
++ HNS3_RX_PTYPE_ENTRY(1, 0, COMPLETE, ARP, PKT_HASH_TYPE_NONE),
++ HNS3_RX_PTYPE_ENTRY(2, 0, COMPLETE, RARP, PKT_HASH_TYPE_NONE),
++ HNS3_RX_PTYPE_ENTRY(3, 0, COMPLETE, LLDP, PKT_HASH_TYPE_NONE),
++ HNS3_RX_PTYPE_ENTRY(4, 0, COMPLETE, PARSE_FAIL, PKT_HASH_TYPE_NONE),
++ HNS3_RX_PTYPE_ENTRY(5, 0, COMPLETE, PARSE_FAIL, PKT_HASH_TYPE_NONE),
++ HNS3_RX_PTYPE_ENTRY(6, 0, COMPLETE, PARSE_FAIL, PKT_HASH_TYPE_NONE),
++ HNS3_RX_PTYPE_ENTRY(7, 0, COMPLETE, CNM, PKT_HASH_TYPE_NONE),
++ HNS3_RX_PTYPE_ENTRY(8, 0, NONE, PARSE_FAIL, PKT_HASH_TYPE_NONE),
+ HNS3_RX_PTYPE_UNUSED_ENTRY(9),
+ HNS3_RX_PTYPE_UNUSED_ENTRY(10),
+ HNS3_RX_PTYPE_UNUSED_ENTRY(11),
+@@ -132,36 +134,36 @@ static const struct hns3_rx_ptype hns3_rx_ptype_tbl[] = {
+ HNS3_RX_PTYPE_UNUSED_ENTRY(13),
+ HNS3_RX_PTYPE_UNUSED_ENTRY(14),
+ HNS3_RX_PTYPE_UNUSED_ENTRY(15),
+- HNS3_RX_PTYPE_ENTRY(16, 0, COMPLETE, PARSE_FAIL),
+- HNS3_RX_PTYPE_ENTRY(17, 0, COMPLETE, IPV4),
+- HNS3_RX_PTYPE_ENTRY(18, 0, COMPLETE, IPV4),
+- HNS3_RX_PTYPE_ENTRY(19, 0, UNNECESSARY, IPV4),
+- HNS3_RX_PTYPE_ENTRY(20, 0, UNNECESSARY, IPV4),
+- HNS3_RX_PTYPE_ENTRY(21, 0, NONE, IPV4),
+- HNS3_RX_PTYPE_ENTRY(22, 0, UNNECESSARY, IPV4),
+- HNS3_RX_PTYPE_ENTRY(23, 0, NONE, IPV4),
+- HNS3_RX_PTYPE_ENTRY(24, 0, NONE, IPV4),
+- HNS3_RX_PTYPE_ENTRY(25, 0, UNNECESSARY, IPV4),
++ HNS3_RX_PTYPE_ENTRY(16, 0, COMPLETE, PARSE_FAIL, PKT_HASH_TYPE_NONE),
++ HNS3_RX_PTYPE_ENTRY(17, 0, COMPLETE, IPV4, PKT_HASH_TYPE_NONE),
++ HNS3_RX_PTYPE_ENTRY(18, 0, COMPLETE, IPV4, PKT_HASH_TYPE_NONE),
++ HNS3_RX_PTYPE_ENTRY(19, 0, UNNECESSARY, IPV4, PKT_HASH_TYPE_L4),
++ HNS3_RX_PTYPE_ENTRY(20, 0, UNNECESSARY, IPV4, PKT_HASH_TYPE_L4),
++ HNS3_RX_PTYPE_ENTRY(21, 0, NONE, IPV4, PKT_HASH_TYPE_NONE),
++ HNS3_RX_PTYPE_ENTRY(22, 0, UNNECESSARY, IPV4, PKT_HASH_TYPE_L4),
++ HNS3_RX_PTYPE_ENTRY(23, 0, NONE, IPV4, PKT_HASH_TYPE_L3),
++ HNS3_RX_PTYPE_ENTRY(24, 0, NONE, IPV4, PKT_HASH_TYPE_L3),
++ HNS3_RX_PTYPE_ENTRY(25, 0, UNNECESSARY, IPV4, PKT_HASH_TYPE_L4),
+ HNS3_RX_PTYPE_UNUSED_ENTRY(26),
+ HNS3_RX_PTYPE_UNUSED_ENTRY(27),
+ HNS3_RX_PTYPE_UNUSED_ENTRY(28),
+- HNS3_RX_PTYPE_ENTRY(29, 0, COMPLETE, PARSE_FAIL),
+- HNS3_RX_PTYPE_ENTRY(30, 0, COMPLETE, PARSE_FAIL),
+- HNS3_RX_PTYPE_ENTRY(31, 0, COMPLETE, IPV4),
+- HNS3_RX_PTYPE_ENTRY(32, 0, COMPLETE, IPV4),
+- HNS3_RX_PTYPE_ENTRY(33, 1, UNNECESSARY, IPV4),
+- HNS3_RX_PTYPE_ENTRY(34, 1, UNNECESSARY, IPV4),
+- HNS3_RX_PTYPE_ENTRY(35, 1, UNNECESSARY, IPV4),
+- HNS3_RX_PTYPE_ENTRY(36, 0, COMPLETE, IPV4),
+- HNS3_RX_PTYPE_ENTRY(37, 0, COMPLETE, IPV4),
++ HNS3_RX_PTYPE_ENTRY(29, 0, COMPLETE, PARSE_FAIL, PKT_HASH_TYPE_NONE),
++ HNS3_RX_PTYPE_ENTRY(30, 0, COMPLETE, PARSE_FAIL, PKT_HASH_TYPE_NONE),
++ HNS3_RX_PTYPE_ENTRY(31, 0, COMPLETE, IPV4, PKT_HASH_TYPE_L3),
++ HNS3_RX_PTYPE_ENTRY(32, 0, COMPLETE, IPV4, PKT_HASH_TYPE_L3),
++ HNS3_RX_PTYPE_ENTRY(33, 1, UNNECESSARY, IPV4, PKT_HASH_TYPE_L4),
++ HNS3_RX_PTYPE_ENTRY(34, 1, UNNECESSARY, IPV4, PKT_HASH_TYPE_L4),
++ HNS3_RX_PTYPE_ENTRY(35, 1, UNNECESSARY, IPV4, PKT_HASH_TYPE_L4),
++ HNS3_RX_PTYPE_ENTRY(36, 0, COMPLETE, IPV4, PKT_HASH_TYPE_L3),
++ HNS3_RX_PTYPE_ENTRY(37, 0, COMPLETE, IPV4, PKT_HASH_TYPE_L3),
+ HNS3_RX_PTYPE_UNUSED_ENTRY(38),
+- HNS3_RX_PTYPE_ENTRY(39, 0, COMPLETE, IPV6),
+- HNS3_RX_PTYPE_ENTRY(40, 0, COMPLETE, IPV6),
+- HNS3_RX_PTYPE_ENTRY(41, 1, UNNECESSARY, IPV6),
+- HNS3_RX_PTYPE_ENTRY(42, 1, UNNECESSARY, IPV6),
+- HNS3_RX_PTYPE_ENTRY(43, 1, UNNECESSARY, IPV6),
+- HNS3_RX_PTYPE_ENTRY(44, 0, COMPLETE, IPV6),
+- HNS3_RX_PTYPE_ENTRY(45, 0, COMPLETE, IPV6),
++ HNS3_RX_PTYPE_ENTRY(39, 0, COMPLETE, IPV6, PKT_HASH_TYPE_L3),
++ HNS3_RX_PTYPE_ENTRY(40, 0, COMPLETE, IPV6, PKT_HASH_TYPE_L3),
++ HNS3_RX_PTYPE_ENTRY(41, 1, UNNECESSARY, IPV6, PKT_HASH_TYPE_L4),
++ HNS3_RX_PTYPE_ENTRY(42, 1, UNNECESSARY, IPV6, PKT_HASH_TYPE_L4),
++ HNS3_RX_PTYPE_ENTRY(43, 1, UNNECESSARY, IPV6, PKT_HASH_TYPE_L4),
++ HNS3_RX_PTYPE_ENTRY(44, 0, COMPLETE, IPV6, PKT_HASH_TYPE_L3),
++ HNS3_RX_PTYPE_ENTRY(45, 0, COMPLETE, IPV6, PKT_HASH_TYPE_L3),
+ HNS3_RX_PTYPE_UNUSED_ENTRY(46),
+ HNS3_RX_PTYPE_UNUSED_ENTRY(47),
+ HNS3_RX_PTYPE_UNUSED_ENTRY(48),
+@@ -227,35 +229,35 @@ static const struct hns3_rx_ptype hns3_rx_ptype_tbl[] = {
+ HNS3_RX_PTYPE_UNUSED_ENTRY(108),
+ HNS3_RX_PTYPE_UNUSED_ENTRY(109),
+ HNS3_RX_PTYPE_UNUSED_ENTRY(110),
+- HNS3_RX_PTYPE_ENTRY(111, 0, COMPLETE, IPV6),
+- HNS3_RX_PTYPE_ENTRY(112, 0, COMPLETE, IPV6),
+- HNS3_RX_PTYPE_ENTRY(113, 0, UNNECESSARY, IPV6),
+- HNS3_RX_PTYPE_ENTRY(114, 0, UNNECESSARY, IPV6),
+- HNS3_RX_PTYPE_ENTRY(115, 0, NONE, IPV6),
+- HNS3_RX_PTYPE_ENTRY(116, 0, UNNECESSARY, IPV6),
+- HNS3_RX_PTYPE_ENTRY(117, 0, NONE, IPV6),
+- HNS3_RX_PTYPE_ENTRY(118, 0, NONE, IPV6),
+- HNS3_RX_PTYPE_ENTRY(119, 0, UNNECESSARY, IPV6),
++ HNS3_RX_PTYPE_ENTRY(111, 0, COMPLETE, IPV6, PKT_HASH_TYPE_L3),
++ HNS3_RX_PTYPE_ENTRY(112, 0, COMPLETE, IPV6, PKT_HASH_TYPE_L3),
++ HNS3_RX_PTYPE_ENTRY(113, 0, UNNECESSARY, IPV6, PKT_HASH_TYPE_L4),
++ HNS3_RX_PTYPE_ENTRY(114, 0, UNNECESSARY, IPV6, PKT_HASH_TYPE_L4),
++ HNS3_RX_PTYPE_ENTRY(115, 0, NONE, IPV6, PKT_HASH_TYPE_L3),
++ HNS3_RX_PTYPE_ENTRY(116, 0, UNNECESSARY, IPV6, PKT_HASH_TYPE_L4),
++ HNS3_RX_PTYPE_ENTRY(117, 0, NONE, IPV6, PKT_HASH_TYPE_L3),
++ HNS3_RX_PTYPE_ENTRY(118, 0, NONE, IPV6, PKT_HASH_TYPE_L3),
++ HNS3_RX_PTYPE_ENTRY(119, 0, UNNECESSARY, IPV6, PKT_HASH_TYPE_L4),
+ HNS3_RX_PTYPE_UNUSED_ENTRY(120),
+ HNS3_RX_PTYPE_UNUSED_ENTRY(121),
+ HNS3_RX_PTYPE_UNUSED_ENTRY(122),
+- HNS3_RX_PTYPE_ENTRY(123, 0, COMPLETE, PARSE_FAIL),
+- HNS3_RX_PTYPE_ENTRY(124, 0, COMPLETE, PARSE_FAIL),
+- HNS3_RX_PTYPE_ENTRY(125, 0, COMPLETE, IPV4),
+- HNS3_RX_PTYPE_ENTRY(126, 0, COMPLETE, IPV4),
+- HNS3_RX_PTYPE_ENTRY(127, 1, UNNECESSARY, IPV4),
+- HNS3_RX_PTYPE_ENTRY(128, 1, UNNECESSARY, IPV4),
+- HNS3_RX_PTYPE_ENTRY(129, 1, UNNECESSARY, IPV4),
+- HNS3_RX_PTYPE_ENTRY(130, 0, COMPLETE, IPV4),
+- HNS3_RX_PTYPE_ENTRY(131, 0, COMPLETE, IPV4),
++ HNS3_RX_PTYPE_ENTRY(123, 0, COMPLETE, PARSE_FAIL, PKT_HASH_TYPE_NONE),
++ HNS3_RX_PTYPE_ENTRY(124, 0, COMPLETE, PARSE_FAIL, PKT_HASH_TYPE_NONE),
++ HNS3_RX_PTYPE_ENTRY(125, 0, COMPLETE, IPV4, PKT_HASH_TYPE_L3),
++ HNS3_RX_PTYPE_ENTRY(126, 0, COMPLETE, IPV4, PKT_HASH_TYPE_L3),
++ HNS3_RX_PTYPE_ENTRY(127, 1, UNNECESSARY, IPV4, PKT_HASH_TYPE_L4),
++ HNS3_RX_PTYPE_ENTRY(128, 1, UNNECESSARY, IPV4, PKT_HASH_TYPE_L4),
++ HNS3_RX_PTYPE_ENTRY(129, 1, UNNECESSARY, IPV4, PKT_HASH_TYPE_L4),
++ HNS3_RX_PTYPE_ENTRY(130, 0, COMPLETE, IPV4, PKT_HASH_TYPE_L3),
++ HNS3_RX_PTYPE_ENTRY(131, 0, COMPLETE, IPV4, PKT_HASH_TYPE_L3),
+ HNS3_RX_PTYPE_UNUSED_ENTRY(132),
+- HNS3_RX_PTYPE_ENTRY(133, 0, COMPLETE, IPV6),
+- HNS3_RX_PTYPE_ENTRY(134, 0, COMPLETE, IPV6),
+- HNS3_RX_PTYPE_ENTRY(135, 1, UNNECESSARY, IPV6),
+- HNS3_RX_PTYPE_ENTRY(136, 1, UNNECESSARY, IPV6),
+- HNS3_RX_PTYPE_ENTRY(137, 1, UNNECESSARY, IPV6),
+- HNS3_RX_PTYPE_ENTRY(138, 0, COMPLETE, IPV6),
+- HNS3_RX_PTYPE_ENTRY(139, 0, COMPLETE, IPV6),
++ HNS3_RX_PTYPE_ENTRY(133, 0, COMPLETE, IPV6, PKT_HASH_TYPE_L3),
++ HNS3_RX_PTYPE_ENTRY(134, 0, COMPLETE, IPV6, PKT_HASH_TYPE_L3),
++ HNS3_RX_PTYPE_ENTRY(135, 1, UNNECESSARY, IPV6, PKT_HASH_TYPE_L4),
++ HNS3_RX_PTYPE_ENTRY(136, 1, UNNECESSARY, IPV6, PKT_HASH_TYPE_L4),
++ HNS3_RX_PTYPE_ENTRY(137, 1, UNNECESSARY, IPV6, PKT_HASH_TYPE_L4),
++ HNS3_RX_PTYPE_ENTRY(138, 0, COMPLETE, IPV6, PKT_HASH_TYPE_L3),
++ HNS3_RX_PTYPE_ENTRY(139, 0, COMPLETE, IPV6, PKT_HASH_TYPE_L3),
+ HNS3_RX_PTYPE_UNUSED_ENTRY(140),
+ HNS3_RX_PTYPE_UNUSED_ENTRY(141),
+ HNS3_RX_PTYPE_UNUSED_ENTRY(142),
+@@ -4129,15 +4131,35 @@ static int hns3_set_gro_and_checksum(struct hns3_enet_ring *ring,
+ }
+
+ static void hns3_set_rx_skb_rss_type(struct hns3_enet_ring *ring,
+- struct sk_buff *skb, u32 rss_hash)
++ struct sk_buff *skb, u32 rss_hash,
++ u32 l234info, u32 ol_info)
+ {
+- struct hnae3_handle *handle = ring->tqp->handle;
+- enum pkt_hash_types rss_type;
++ enum pkt_hash_types rss_type = PKT_HASH_TYPE_NONE;
++ struct net_device *netdev = ring_to_netdev(ring);
++ struct hns3_nic_priv *priv = netdev_priv(netdev);
+
+- if (rss_hash)
+- rss_type = handle->kinfo.rss_type;
+- else
+- rss_type = PKT_HASH_TYPE_NONE;
++ if (test_bit(HNS3_NIC_STATE_RXD_ADV_LAYOUT_ENABLE, &priv->state)) {
++ u32 ptype = hnae3_get_field(ol_info, HNS3_RXD_PTYPE_M,
++ HNS3_RXD_PTYPE_S);
++
++ rss_type = hns3_rx_ptype_tbl[ptype].hash_type;
++ } else {
++ int l3_type = hnae3_get_field(l234info, HNS3_RXD_L3ID_M,
++ HNS3_RXD_L3ID_S);
++ int l4_type = hnae3_get_field(l234info, HNS3_RXD_L4ID_M,
++ HNS3_RXD_L4ID_S);
++
++ if (l3_type == HNS3_L3_TYPE_IPV4 ||
++ l3_type == HNS3_L3_TYPE_IPV6) {
++ if (l4_type == HNS3_L4_TYPE_UDP ||
++ l4_type == HNS3_L4_TYPE_TCP ||
++ l4_type == HNS3_L4_TYPE_SCTP)
++ rss_type = PKT_HASH_TYPE_L4;
++ else if (l4_type == HNS3_L4_TYPE_IGMP ||
++ l4_type == HNS3_L4_TYPE_ICMP)
++ rss_type = PKT_HASH_TYPE_L3;
++ }
++ }
+
+ skb_set_hash(skb, rss_hash, rss_type);
+ }
+@@ -4240,7 +4262,8 @@ static int hns3_handle_bdinfo(struct hns3_enet_ring *ring, struct sk_buff *skb)
+
+ ring->tqp_vector->rx_group.total_bytes += len;
+
+- hns3_set_rx_skb_rss_type(ring, skb, le32_to_cpu(desc->rx.rss_hash));
++ hns3_set_rx_skb_rss_type(ring, skb, le32_to_cpu(desc->rx.rss_hash),
++ l234info, ol_info);
+ return 0;
+ }
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h
+index 4a3253692dcc..408635d11a24 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h
+@@ -404,6 +404,7 @@ struct hns3_rx_ptype {
+ u32 ip_summed : 2;
+ u32 l3_type : 4;
+ u32 valid : 1;
++ u32 hash_type: 3;
+ };
+
+ struct ring_stats {
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+index fae79764dc44..bd9a3b8f9e79 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+@@ -4662,7 +4662,6 @@ static int hclge_set_rss_tuple(struct hnae3_handle *handle,
+ return ret;
+ }
+
+- hclge_comm_get_rss_type(&vport->nic, &hdev->rss_cfg.rss_tuple_sets);
+ return 0;
+ }
+
+--
+2.35.1
+
--- /dev/null
+From faae1038432bc351b5fc0eb6bbe8d91decdb9a34 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Nov 2022 16:20:47 +0800
+Subject: net: hns3: fix return value check bug of rx copybreak
+
+From: Jie Wang <wangjie125@huawei.com>
+
+[ Upstream commit 29df7c695ed67a8fa32bb7805bad8fe2a76c1f88 ]
+
+The refactoring of rx copybreak modifies the original return logic, which
+will make this feature unavailable. So this patch fixes the return logic of
+rx copybreak.
+
+Fixes: e74a726da2c4 ("net: hns3: refactor hns3_nic_reuse_page()")
+Fixes: 99f6b5fb5f63 ("net: hns3: use bounce buffer when rx page can not be reused")
+Signed-off-by: Jie Wang <wangjie125@huawei.com>
+Signed-off-by: Hao Lan <lanhao@huawei.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+index 944f36e4d66f..44d4265f109a 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+@@ -3736,8 +3736,8 @@ static void hns3_nic_reuse_page(struct sk_buff *skb, int i,
+ desc_cb->reuse_flag = 1;
+ } else if (frag_size <= ring->rx_copybreak) {
+ ret = hns3_handle_rx_copybreak(skb, i, ring, pull_len, desc_cb);
+- if (ret)
+- goto out;
++ if (!ret)
++ return;
+ }
+
+ out:
+--
+2.35.1
+
--- /dev/null
+From ef86e0c5fedb02760882803374137893279fea3b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Nov 2022 16:20:48 +0800
+Subject: net: hns3: fix setting incorrect phy link ksettings for firmware in
+ resetting process
+
+From: Guangbin Huang <huangguangbin2@huawei.com>
+
+[ Upstream commit 510d7b6ae842e59ee00d57e5f07ac15131b6d899 ]
+
+Currently, if driver is in phy-imp(phy controlled by imp firmware) mode, as
+driver did not update phy link ksettings after initialization process or
+not update advertising when getting phy link ksettings from firmware, it
+may set incorrect phy link ksettings for firmware in resetting process.
+So fix it.
+
+Fixes: f5f2b3e4dcc0 ("net: hns3: add support for imp-controlled PHYs")
+Fixes: c5ef83cbb1e9 ("net: hns3: fix for phy_addr error in hclge_mac_mdio_config")
+Fixes: 2312e050f42b ("net: hns3: Fix for deadlock problem occurring when unregistering ae_algo")
+Signed-off-by: Guangbin Huang <huangguangbin2@huawei.com>
+Signed-off-by: Hao Lan <lanhao@huawei.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+index bd9a3b8f9e79..7e8a60f2401c 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+@@ -3246,6 +3246,7 @@ static int hclge_update_tp_port_info(struct hclge_dev *hdev)
+ hdev->hw.mac.autoneg = cmd.base.autoneg;
+ hdev->hw.mac.speed = cmd.base.speed;
+ hdev->hw.mac.duplex = cmd.base.duplex;
++ linkmode_copy(hdev->hw.mac.advertising, cmd.link_modes.advertising);
+
+ return 0;
+ }
+@@ -11373,9 +11374,12 @@ static int hclge_init_ae_dev(struct hnae3_ae_dev *ae_dev)
+ if (ret)
+ goto err_msi_irq_uninit;
+
+- if (hdev->hw.mac.media_type == HNAE3_MEDIA_TYPE_COPPER &&
+- !hnae3_dev_phy_imp_supported(hdev)) {
+- ret = hclge_mac_mdio_config(hdev);
++ if (hdev->hw.mac.media_type == HNAE3_MEDIA_TYPE_COPPER) {
++ if (hnae3_dev_phy_imp_supported(hdev))
++ ret = hclge_update_tp_port_info(hdev);
++ else
++ ret = hclge_mac_mdio_config(hdev);
++
+ if (ret)
+ goto err_msi_irq_uninit;
+ }
+--
+2.35.1
+
--- /dev/null
+From 42685463ece03095c0867254e7d33db43d556edd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 13 Nov 2022 09:29:29 +0000
+Subject: net: ionic: Fix error handling in ionic_init_module()
+
+From: Yuan Can <yuancan@huawei.com>
+
+[ Upstream commit 280c0f7cd0aa4d190619b18243110e052a90775c ]
+
+A problem about ionic create debugfs failed is triggered with the
+following log given:
+
+ [ 415.799514] debugfs: Directory 'ionic' with parent '/' already present!
+
+The reason is that ionic_init_module() returns ionic_bus_register_driver()
+directly without checking its return value, if ionic_bus_register_driver()
+failed, it returns without destroy the newly created debugfs, resulting
+the debugfs of ionic can never be created later.
+
+ ionic_init_module()
+ ionic_debugfs_create() # create debugfs directory
+ ionic_bus_register_driver()
+ pci_register_driver()
+ driver_register()
+ bus_add_driver()
+ priv = kzalloc(...) # OOM happened
+ # return without destroy debugfs directory
+
+Fix by removing debugfs when ionic_bus_register_driver() returns error.
+
+Fixes: fbfb8031533c ("ionic: Add hardware init and device commands")
+Signed-off-by: Yuan Can <yuancan@huawei.com>
+Acked-by: Shannon Nelson <snelson@pensando.io>
+Link: https://lore.kernel.org/r/20221113092929.19161-1-yuancan@huawei.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/pensando/ionic/ionic_main.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/pensando/ionic/ionic_main.c b/drivers/net/ethernet/pensando/ionic/ionic_main.c
+index 56f93b030551..5456c2b15d9b 100644
+--- a/drivers/net/ethernet/pensando/ionic/ionic_main.c
++++ b/drivers/net/ethernet/pensando/ionic/ionic_main.c
+@@ -687,8 +687,14 @@ int ionic_port_reset(struct ionic *ionic)
+
+ static int __init ionic_init_module(void)
+ {
++ int ret;
++
+ ionic_debugfs_create();
+- return ionic_bus_register_driver();
++ ret = ionic_bus_register_driver();
++ if (ret)
++ ionic_debugfs_destroy();
++
++ return ret;
+ }
+
+ static void __exit ionic_cleanup_module(void)
+--
+2.35.1
+
--- /dev/null
+From 543af0efd315ca1a711260280e62cae0cb18fd06 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Nov 2022 21:38:52 +0800
+Subject: net: lan966x: Fix potential null-ptr-deref in lan966x_stats_init()
+
+From: Shang XiaoJing <shangxiaojing@huawei.com>
+
+[ Upstream commit ba86af3733aece88dbcee0dfebf7e2dcfefb2be4 ]
+
+lan966x_stats_init() calls create_singlethread_workqueue() and not
+checked the ret value, which may return NULL. And a null-ptr-deref may
+happen:
+
+lan966x_stats_init()
+ create_singlethread_workqueue() # failed, lan966x->stats_queue is NULL
+ queue_delayed_work()
+ queue_delayed_work_on()
+ __queue_delayed_work() # warning here, but continue
+ __queue_work() # access wq->flags, null-ptr-deref
+
+Check the ret value and return -ENOMEM if it is NULL.
+
+Fixes: 12c2d0a5b8e2 ("net: lan966x: add ethtool configuration and statistics")
+Signed-off-by: Shang XiaoJing <shangxiaojing@huawei.com>
+Reviewed-by: Horatiu Vultur <horatiu.vultur@microchip.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/microchip/lan966x/lan966x_ethtool.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/ethernet/microchip/lan966x/lan966x_ethtool.c b/drivers/net/ethernet/microchip/lan966x/lan966x_ethtool.c
+index fea42542be28..06811c60d598 100644
+--- a/drivers/net/ethernet/microchip/lan966x/lan966x_ethtool.c
++++ b/drivers/net/ethernet/microchip/lan966x/lan966x_ethtool.c
+@@ -716,6 +716,9 @@ int lan966x_stats_init(struct lan966x *lan966x)
+ snprintf(queue_name, sizeof(queue_name), "%s-stats",
+ dev_name(lan966x->dev));
+ lan966x->stats_queue = create_singlethread_workqueue(queue_name);
++ if (!lan966x->stats_queue)
++ return -ENOMEM;
++
+ INIT_DELAYED_WORK(&lan966x->stats_work, lan966x_check_stats_work);
+ queue_delayed_work(lan966x->stats_queue, &lan966x->stats_work,
+ LAN966X_STATS_CHECK_DELAY);
+--
+2.35.1
+
--- /dev/null
+From 6f3df62b95640288094c6edb06bfe42cf735b814 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Nov 2022 18:30:37 +0800
+Subject: net: liquidio: release resources when liquidio driver open failed
+
+From: Zhengchao Shao <shaozhengchao@huawei.com>
+
+[ Upstream commit 8979f428a4afc215e390006e5ea19fd4e22c7ca9 ]
+
+When liquidio driver open failed, it doesn't release resources. Compile
+tested only.
+
+Fixes: 5b07aee11227 ("liquidio: MSIX support for CN23XX")
+Fixes: dbc97bfd3918 ("net: liquidio: Add missing null pointer checks")
+Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com>
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/cavium/liquidio/lio_main.c | 34 ++++++++++++++-----
+ 1 file changed, 26 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/net/ethernet/cavium/liquidio/lio_main.c b/drivers/net/ethernet/cavium/liquidio/lio_main.c
+index bee35ce60171..bf6a72143040 100644
+--- a/drivers/net/ethernet/cavium/liquidio/lio_main.c
++++ b/drivers/net/ethernet/cavium/liquidio/lio_main.c
+@@ -1799,13 +1799,10 @@ static int liquidio_open(struct net_device *netdev)
+
+ ifstate_set(lio, LIO_IFSTATE_RUNNING);
+
+- if (OCTEON_CN23XX_PF(oct)) {
+- if (!oct->msix_on)
+- if (setup_tx_poll_fn(netdev))
+- return -1;
+- } else {
+- if (setup_tx_poll_fn(netdev))
+- return -1;
++ if (!OCTEON_CN23XX_PF(oct) || (OCTEON_CN23XX_PF(oct) && !oct->msix_on)) {
++ ret = setup_tx_poll_fn(netdev);
++ if (ret)
++ goto err_poll;
+ }
+
+ netif_tx_start_all_queues(netdev);
+@@ -1818,7 +1815,7 @@ static int liquidio_open(struct net_device *netdev)
+ /* tell Octeon to start forwarding packets to host */
+ ret = send_rx_ctrl_cmd(lio, 1);
+ if (ret)
+- return ret;
++ goto err_rx_ctrl;
+
+ /* start periodical statistics fetch */
+ INIT_DELAYED_WORK(&lio->stats_wk.work, lio_fetch_stats);
+@@ -1829,6 +1826,27 @@ static int liquidio_open(struct net_device *netdev)
+ dev_info(&oct->pci_dev->dev, "%s interface is opened\n",
+ netdev->name);
+
++ return 0;
++
++err_rx_ctrl:
++ if (!OCTEON_CN23XX_PF(oct) || (OCTEON_CN23XX_PF(oct) && !oct->msix_on))
++ cleanup_tx_poll_fn(netdev);
++err_poll:
++ if (lio->ptp_clock) {
++ ptp_clock_unregister(lio->ptp_clock);
++ lio->ptp_clock = NULL;
++ }
++
++ if (oct->props[lio->ifidx].napi_enabled == 1) {
++ list_for_each_entry_safe(napi, n, &netdev->napi_list, dev_list)
++ napi_disable(napi);
++
++ oct->props[lio->ifidx].napi_enabled = 0;
++
++ if (OCTEON_CN23XX_PF(oct))
++ oct->droq[0]->ops.poll_mode = 0;
++ }
++
+ return ret;
+ }
+
+--
+2.35.1
+
--- /dev/null
+From ca9e47570bdb4028b044280cc602948b448a5575 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Nov 2022 09:41:30 +0800
+Subject: net: macvlan: Use built-in RCU list checking
+
+From: Chuang Wang <nashuiliang@gmail.com>
+
+[ Upstream commit 5df1341ea822292275c56744aab9c536d75c33be ]
+
+hlist_for_each_entry_rcu() has built-in RCU and lock checking.
+
+Pass cond argument to hlist_for_each_entry_rcu() to silence false
+lockdep warning when CONFIG_PROVE_RCU_LIST is enabled.
+
+Execute as follow:
+
+ ip link add link eth0 type macvlan mode source macaddr add <MAC-ADDR>
+
+The rtnl_lock is held when macvlan_hash_lookup_source() or
+macvlan_fill_info_macaddr() are called in the non-RCU read side section.
+So, pass lockdep_rtnl_is_held() to silence false lockdep warning.
+
+Fixes: 79cf79abce71 ("macvlan: add source mode")
+Signed-off-by: Chuang Wang <nashuiliang@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/macvlan.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
+index 9983d37ee87d..059e4ff0e510 100644
+--- a/drivers/net/macvlan.c
++++ b/drivers/net/macvlan.c
+@@ -141,7 +141,7 @@ static struct macvlan_source_entry *macvlan_hash_lookup_source(
+ u32 idx = macvlan_eth_hash(addr);
+ struct hlist_head *h = &vlan->port->vlan_source_hash[idx];
+
+- hlist_for_each_entry_rcu(entry, h, hlist) {
++ hlist_for_each_entry_rcu(entry, h, hlist, lockdep_rtnl_is_held()) {
+ if (ether_addr_equal_64bits(entry->addr, addr) &&
+ entry->vlan == vlan)
+ return entry;
+@@ -1647,7 +1647,7 @@ static int macvlan_fill_info_macaddr(struct sk_buff *skb,
+ struct hlist_head *h = &vlan->port->vlan_source_hash[i];
+ struct macvlan_source_entry *entry;
+
+- hlist_for_each_entry_rcu(entry, h, hlist) {
++ hlist_for_each_entry_rcu(entry, h, hlist, lockdep_rtnl_is_held()) {
+ if (entry->vlan != vlan)
+ continue;
+ if (nla_put(skb, IFLA_MACVLAN_MACADDR, ETH_ALEN, entry->addr))
+--
+2.35.1
+
--- /dev/null
+From 260c2ea112fb73d985ac235e8f6676e1944ef72e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Nov 2022 09:20:44 +0000
+Subject: net: mhi: Fix memory leak in mhi_net_dellink()
+
+From: Wei Yongjun <weiyongjun1@huawei.com>
+
+[ Upstream commit f7c125bd79f50ec6094761090be81d02726ec6f4 ]
+
+MHI driver registers network device without setting the
+needs_free_netdev flag, and does NOT call free_netdev() when
+unregisters network device, which causes a memory leak.
+
+This patch calls free_netdev() to fix it since netdev_priv
+is used after unregister.
+
+Fixes: 13adac032982 ("net: mhi_net: Register wwan_ops for link creation")
+Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/mhi_net.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/mhi_net.c b/drivers/net/mhi_net.c
+index 0b1b6f650104..0b9d37979133 100644
+--- a/drivers/net/mhi_net.c
++++ b/drivers/net/mhi_net.c
+@@ -343,6 +343,8 @@ static void mhi_net_dellink(struct mhi_device *mhi_dev, struct net_device *ndev)
+
+ kfree_skb(mhi_netdev->skbagg_head);
+
++ free_netdev(ndev);
++
+ dev_set_drvdata(&mhi_dev->dev, NULL);
+ }
+
+--
+2.35.1
+
--- /dev/null
+From 7e0428e9a99649d618bc2f25f63868e4f109a3be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Nov 2022 21:38:53 +0800
+Subject: net: microchip: sparx5: Fix potential null-ptr-deref in
+ sparx_stats_init() and sparx5_start()
+
+From: Shang XiaoJing <shangxiaojing@huawei.com>
+
+[ Upstream commit 639f5d006e36bb303f525d9479448c412b720c39 ]
+
+sparx_stats_init() calls create_singlethread_workqueue() and not
+checked the ret value, which may return NULL. And a null-ptr-deref may
+happen:
+
+sparx_stats_init()
+ create_singlethread_workqueue() # failed, sparx5->stats_queue is NULL
+ queue_delayed_work()
+ queue_delayed_work_on()
+ __queue_delayed_work() # warning here, but continue
+ __queue_work() # access wq->flags, null-ptr-deref
+
+Check the ret value and return -ENOMEM if it is NULL. So as
+sparx5_start().
+
+Fixes: af4b11022e2d ("net: sparx5: add ethtool configuration and statistics support")
+Fixes: b37a1bae742f ("net: sparx5: add mactable support")
+Signed-off-by: Shang XiaoJing <shangxiaojing@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/microchip/sparx5/sparx5_ethtool.c | 3 +++
+ drivers/net/ethernet/microchip/sparx5/sparx5_main.c | 3 +++
+ 2 files changed, 6 insertions(+)
+
+diff --git a/drivers/net/ethernet/microchip/sparx5/sparx5_ethtool.c b/drivers/net/ethernet/microchip/sparx5/sparx5_ethtool.c
+index 6b0febcb7fa9..01f3a3a41cdb 100644
+--- a/drivers/net/ethernet/microchip/sparx5/sparx5_ethtool.c
++++ b/drivers/net/ethernet/microchip/sparx5/sparx5_ethtool.c
+@@ -1253,6 +1253,9 @@ int sparx_stats_init(struct sparx5 *sparx5)
+ snprintf(queue_name, sizeof(queue_name), "%s-stats",
+ dev_name(sparx5->dev));
+ sparx5->stats_queue = create_singlethread_workqueue(queue_name);
++ if (!sparx5->stats_queue)
++ return -ENOMEM;
++
+ INIT_DELAYED_WORK(&sparx5->stats_work, sparx5_check_stats_work);
+ queue_delayed_work(sparx5->stats_queue, &sparx5->stats_work,
+ SPX5_STATS_CHECK_DELAY);
+diff --git a/drivers/net/ethernet/microchip/sparx5/sparx5_main.c b/drivers/net/ethernet/microchip/sparx5/sparx5_main.c
+index 01be7bd84181..30815c0e3f76 100644
+--- a/drivers/net/ethernet/microchip/sparx5/sparx5_main.c
++++ b/drivers/net/ethernet/microchip/sparx5/sparx5_main.c
+@@ -657,6 +657,9 @@ static int sparx5_start(struct sparx5 *sparx5)
+ snprintf(queue_name, sizeof(queue_name), "%s-mact",
+ dev_name(sparx5->dev));
+ sparx5->mact_queue = create_singlethread_workqueue(queue_name);
++ if (!sparx5->mact_queue)
++ return -ENOMEM;
++
+ INIT_DELAYED_WORK(&sparx5->mact_work, sparx5_mact_pull_work);
+ queue_delayed_work(sparx5->mact_queue, &sparx5->mact_work,
+ SPX5_MACT_PULL_DELAY);
+--
+2.35.1
+
--- /dev/null
+From 2e7da1f2feb08607e04e95d7e9676db61f7712b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Nov 2022 13:49:38 +0800
+Subject: net: phy: dp83867: Fix SGMII FIFO depth for non OF devices
+
+From: Michael Sit Wei Hong <michael.wei.hong.sit@intel.com>
+
+[ Upstream commit e2a54350dc9642e7dfc07335ca355581caa9dbfe ]
+
+Current driver code will read device tree node information,
+and set default values if there is no info provided.
+
+This is not done in non-OF devices leading to SGMII fifo depths being
+set to the smallest size.
+
+This patch sets the value to the default value of the PHY as stated in the
+PHY datasheet.
+
+Fixes: 4dc08dcc9f6f ("net: phy: dp83867: introduce critical chip default init for non-of platform")
+Signed-off-by: Michael Sit Wei Hong <michael.wei.hong.sit@intel.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://lore.kernel.org/r/20221110054938.925347-1-michael.wei.hong.sit@intel.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/dp83867.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/net/phy/dp83867.c b/drivers/net/phy/dp83867.c
+index 417527f8bbf5..7446d5c6c714 100644
+--- a/drivers/net/phy/dp83867.c
++++ b/drivers/net/phy/dp83867.c
+@@ -682,6 +682,13 @@ static int dp83867_of_init(struct phy_device *phydev)
+ */
+ dp83867->io_impedance = DP83867_IO_MUX_CFG_IO_IMPEDANCE_MIN / 2;
+
++ /* For non-OF device, the RX and TX FIFO depths are taken from
++ * default value. So, we init RX & TX FIFO depths here
++ * so that it is configured correctly later in dp83867_config_init();
++ */
++ dp83867->tx_fifo_depth = DP83867_PHYCR_FIFO_DEPTH_4_B_NIB;
++ dp83867->rx_fifo_depth = DP83867_PHYCR_FIFO_DEPTH_4_B_NIB;
++
+ return 0;
+ }
+ #endif /* CONFIG_OF_MDIO */
+--
+2.35.1
+
--- /dev/null
+From 653df8452802e92ed3509ea1b16128979ccaf2a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Nov 2022 14:45:52 +0800
+Subject: net: stmmac: ensure tx function is not running in
+ stmmac_xdp_release()
+
+From: Mohd Faizal Abdul Rahim <faizal.abdul.rahim@intel.com>
+
+[ Upstream commit 77711683a50477de39757d67ab1a3638220d6860 ]
+
+When stmmac_xdp_release() is called, there is a possibility that tx
+function is still running on other queues which will lead to tx queue
+timed out and reset adapter.
+
+This commit ensure that tx function is not running xdp before release
+flow continue to run.
+
+Fixes: ac746c8520d9 ("net: stmmac: enhance XDP ZC driver level switching performance")
+Signed-off-by: Song Yoong Siang <yoong.siang.song@intel.com>
+Signed-off-by: Mohd Faizal Abdul Rahim <faizal.abdul.rahim@intel.com>
+Signed-off-by: Noor Azura Ahmad Tarmizi <noor.azura.ahmad.tarmizi@intel.com>
+Link: https://lore.kernel.org/r/20221110064552.22504-1-noor.azura.ahmad.tarmizi@linux.intel.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+index bc060ef558d3..02827829463f 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -6564,6 +6564,9 @@ void stmmac_xdp_release(struct net_device *dev)
+ struct stmmac_priv *priv = netdev_priv(dev);
+ u32 chan;
+
++ /* Ensure tx function is not running */
++ netif_tx_disable(dev);
++
+ /* Disable NAPI process */
+ stmmac_disable_all_queues(priv);
+
+--
+2.35.1
+
--- /dev/null
+From ef60f173cff356bfaaf1f5ba7a50113b1dac4976 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Nov 2022 14:22:25 +0000
+Subject: net: thunderbolt: Fix error handling in tbnet_init()
+
+From: Yuan Can <yuancan@huawei.com>
+
+[ Upstream commit f524b7289bbb0c8ffaa2ba3c34c146e43da54fb2 ]
+
+A problem about insmod thunderbolt-net failed is triggered with following
+log given while lsmod does not show thunderbolt_net:
+
+ insmod: ERROR: could not insert module thunderbolt-net.ko: File exists
+
+The reason is that tbnet_init() returns tb_register_service_driver()
+directly without checking its return value, if tb_register_service_driver()
+failed, it returns without removing property directory, resulting the
+property directory can never be created later.
+
+ tbnet_init()
+ tb_register_property_dir() # register property directory
+ tb_register_service_driver()
+ driver_register()
+ bus_add_driver()
+ priv = kzalloc(...) # OOM happened
+ # return without remove property directory
+
+Fix by remove property directory when tb_register_service_driver() returns
+error.
+
+Fixes: e69b6c02b4c3 ("net: Add support for networking over Thunderbolt cable")
+Signed-off-by: Yuan Can <yuancan@huawei.com>
+Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/thunderbolt.c | 19 ++++++++++++++-----
+ 1 file changed, 14 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/thunderbolt.c b/drivers/net/thunderbolt.c
+index ab3f04562980..8391f8303499 100644
+--- a/drivers/net/thunderbolt.c
++++ b/drivers/net/thunderbolt.c
+@@ -1379,12 +1379,21 @@ static int __init tbnet_init(void)
+ TBNET_MATCH_FRAGS_ID | TBNET_64K_FRAMES);
+
+ ret = tb_register_property_dir("network", tbnet_dir);
+- if (ret) {
+- tb_property_free_dir(tbnet_dir);
+- return ret;
+- }
++ if (ret)
++ goto err_free_dir;
++
++ ret = tb_register_service_driver(&tbnet_driver);
++ if (ret)
++ goto err_unregister;
+
+- return tb_register_service_driver(&tbnet_driver);
++ return 0;
++
++err_unregister:
++ tb_unregister_property_dir("network", tbnet_dir);
++err_free_dir:
++ tb_property_free_dir(tbnet_dir);
++
++ return ret;
+ }
+ module_init(tbnet_init);
+
+--
+2.35.1
+
--- /dev/null
+From 513fdfbadd36418d91cb8664236c4a82e3cdda8d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Nov 2022 11:05:19 +0000
+Subject: net/x25: Fix skb leak in x25_lapb_receive_frame()
+
+From: Wei Yongjun <weiyongjun1@huawei.com>
+
+[ Upstream commit 2929cceb2fcf0ded7182562e4888afafece82cce ]
+
+x25_lapb_receive_frame() using skb_copy() to get a private copy of
+skb, the new skb should be freed in the undersized/fragmented skb
+error handling path. Otherwise there is a memory leak.
+
+Fixes: cb101ed2c3c7 ("x25: Handle undersized/fragmented skbs")
+Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
+Acked-by: Martin Schiller <ms@dev.tdt.de>
+Link: https://lore.kernel.org/r/20221114110519.514538-1-weiyongjun@huaweicloud.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/x25/x25_dev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/x25/x25_dev.c b/net/x25/x25_dev.c
+index 5259ef8f5242..748d8630ab58 100644
+--- a/net/x25/x25_dev.c
++++ b/net/x25/x25_dev.c
+@@ -117,7 +117,7 @@ int x25_lapb_receive_frame(struct sk_buff *skb, struct net_device *dev,
+
+ if (!pskb_may_pull(skb, 1)) {
+ x25_neigh_put(nb);
+- return 0;
++ goto drop;
+ }
+
+ switch (skb->data[0]) {
+--
+2.35.1
+
--- /dev/null
+From 3933fd714a4c0bd53889fba8f5e0eabcd353bee1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Nov 2022 17:30:25 +0800
+Subject: netdevsim: Fix memory leak of nsim_dev->fa_cookie
+
+From: Wang Yufen <wangyufen@huawei.com>
+
+[ Upstream commit 064bc7312bd09a48798418663090be0c776183db ]
+
+kmemleak reports this issue:
+
+unreferenced object 0xffff8881bac872d0 (size 8):
+ comm "sh", pid 58603, jiffies 4481524462 (age 68.065s)
+ hex dump (first 8 bytes):
+ 04 00 00 00 de ad be ef ........
+ backtrace:
+ [<00000000c80b8577>] __kmalloc+0x49/0x150
+ [<000000005292b8c6>] nsim_dev_trap_fa_cookie_write+0xc1/0x210 [netdevsim]
+ [<0000000093d78e77>] full_proxy_write+0xf3/0x180
+ [<000000005a662c16>] vfs_write+0x1c5/0xaf0
+ [<000000007aabf84a>] ksys_write+0xed/0x1c0
+ [<000000005f1d2e47>] do_syscall_64+0x3b/0x90
+ [<000000006001c6ec>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
+
+The issue occurs in the following scenarios:
+
+nsim_dev_trap_fa_cookie_write()
+ kmalloc() fa_cookie
+ nsim_dev->fa_cookie = fa_cookie
+..
+nsim_drv_remove()
+
+The fa_cookie allocked in nsim_dev_trap_fa_cookie_write() is not freed. To
+fix, add kfree(nsim_dev->fa_cookie) to nsim_drv_remove().
+
+Fixes: d3cbb907ae57 ("netdevsim: add ACL trap reporting cookie as a metadata")
+Signed-off-by: Wang Yufen <wangyufen@huawei.com>
+Cc: Jiri Pirko <jiri@mellanox.com>
+Link: https://lore.kernel.org/r/1668504625-14698-1-git-send-email-wangyufen@huawei.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/netdevsim/dev.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/netdevsim/dev.c b/drivers/net/netdevsim/dev.c
+index b17e4e94a060..38562ed833da 100644
+--- a/drivers/net/netdevsim/dev.c
++++ b/drivers/net/netdevsim/dev.c
+@@ -1675,6 +1675,7 @@ void nsim_drv_remove(struct nsim_bus_dev *nsim_bus_dev)
+ ARRAY_SIZE(nsim_devlink_params));
+ devl_resources_unregister(devlink);
+ kfree(nsim_dev->vfconfigs);
++ kfree(nsim_dev->fa_cookie);
+ devl_unlock(devlink);
+ devlink_free(devlink);
+ dev_set_drvdata(&nsim_bus_dev->dev, NULL);
+--
+2.35.1
+
--- /dev/null
+From 625be603e23120fbce0eff9024603d95d4e6e8fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Nov 2022 15:36:49 +0000
+Subject: netfs: Fix dodgy maths
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit 5e51c627c5acbcf82bb552e17533a79d2a6a2600 ]
+
+Fix the dodgy maths in netfs_rreq_unlock_folios(). start_page could be
+inside the folio, in which case the calculation of pgpos will be come up
+with a negative number (though for the moment rreq->start is rounded down
+earlier and folios would have to get merged whilst locked)
+
+Alter how this works to just frame the tracking in terms of absolute file
+positions, rather than offsets from the start of the I/O request. This
+simplifies the maths and makes it easier to follow.
+
+Fix the issue by using folio_pos() and folio_size() to calculate the end
+position of the page.
+
+Fixes: 3d3c95046742 ("netfs: Provide readahead and readpage netfs helpers")
+Reported-by: Matthew Wilcox <willy@infradead.org>
+Signed-off-by: David Howells <dhowells@redhat.com>
+Reviewed-by: Jeff Layton <jlayton@kernel.org>
+Reviewed-by: Jingbo Xu <jefflexu@linux.alibaba.com>
+cc: linux-cachefs@redhat.com
+cc: linux-fsdevel@vger.kernel.org
+Link: https://lore.kernel.org/r/Y2SJw7w1IsIik3nb@casper.infradead.org/
+Link: https://lore.kernel.org/r/166757988611.950645.7626959069846893164.stgit@warthog.procyon.org.uk/ # v2
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/netfs/buffered_read.c | 17 +++++++++--------
+ 1 file changed, 9 insertions(+), 8 deletions(-)
+
+diff --git a/fs/netfs/buffered_read.c b/fs/netfs/buffered_read.c
+index baf668fb4315..7679a68e8193 100644
+--- a/fs/netfs/buffered_read.c
++++ b/fs/netfs/buffered_read.c
+@@ -17,9 +17,9 @@ void netfs_rreq_unlock_folios(struct netfs_io_request *rreq)
+ {
+ struct netfs_io_subrequest *subreq;
+ struct folio *folio;
+- unsigned int iopos, account = 0;
+ pgoff_t start_page = rreq->start / PAGE_SIZE;
+ pgoff_t last_page = ((rreq->start + rreq->len) / PAGE_SIZE) - 1;
++ size_t account = 0;
+ bool subreq_failed = false;
+
+ XA_STATE(xas, &rreq->mapping->i_pages, start_page);
+@@ -39,23 +39,23 @@ void netfs_rreq_unlock_folios(struct netfs_io_request *rreq)
+ */
+ subreq = list_first_entry(&rreq->subrequests,
+ struct netfs_io_subrequest, rreq_link);
+- iopos = 0;
+ subreq_failed = (subreq->error < 0);
+
+ trace_netfs_rreq(rreq, netfs_rreq_trace_unlock);
+
+ rcu_read_lock();
+ xas_for_each(&xas, folio, last_page) {
+- unsigned int pgpos, pgend;
++ loff_t pg_end;
+ bool pg_failed = false;
+
+ if (xas_retry(&xas, folio))
+ continue;
+
+- pgpos = (folio_index(folio) - start_page) * PAGE_SIZE;
+- pgend = pgpos + folio_size(folio);
++ pg_end = folio_pos(folio) + folio_size(folio) - 1;
+
+ for (;;) {
++ loff_t sreq_end;
++
+ if (!subreq) {
+ pg_failed = true;
+ break;
+@@ -63,11 +63,11 @@ void netfs_rreq_unlock_folios(struct netfs_io_request *rreq)
+ if (test_bit(NETFS_SREQ_COPY_TO_CACHE, &subreq->flags))
+ folio_start_fscache(folio);
+ pg_failed |= subreq_failed;
+- if (pgend < iopos + subreq->len)
++ sreq_end = subreq->start + subreq->len - 1;
++ if (pg_end < sreq_end)
+ break;
+
+ account += subreq->transferred;
+- iopos += subreq->len;
+ if (!list_is_last(&subreq->rreq_link, &rreq->subrequests)) {
+ subreq = list_next_entry(subreq, rreq_link);
+ subreq_failed = (subreq->error < 0);
+@@ -75,7 +75,8 @@ void netfs_rreq_unlock_folios(struct netfs_io_request *rreq)
+ subreq = NULL;
+ subreq_failed = false;
+ }
+- if (pgend == iopos)
++
++ if (pg_end == sreq_end)
+ break;
+ }
+
+--
+2.35.1
+
--- /dev/null
+From a5816519667a4312e1ce9460c66e9726297fb62d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Nov 2022 16:08:14 +0000
+Subject: netfs: Fix missing xas_retry() calls in xarray iteration
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit 7e043a80b5dae5c2d2cf84031501de7827fd6c00 ]
+
+netfslib has a number of places in which it performs iteration of an xarray
+whilst being under the RCU read lock. It *should* call xas_retry() as the
+first thing inside of the loop and do "continue" if it returns true in case
+the xarray walker passed out a special value indicating that the walk needs
+to be redone from the root[*].
+
+Fix this by adding the missing retry checks.
+
+[*] I wonder if this should be done inside xas_find(), xas_next_node() and
+ suchlike, but I'm told that's not an simple change to effect.
+
+This can cause an oops like that below. Note the faulting address - this
+is an internal value (|0x2) returned from xarray.
+
+BUG: kernel NULL pointer dereference, address: 0000000000000402
+...
+RIP: 0010:netfs_rreq_unlock+0xef/0x380 [netfs]
+...
+Call Trace:
+ netfs_rreq_assess+0xa6/0x240 [netfs]
+ netfs_readpage+0x173/0x3b0 [netfs]
+ ? init_wait_var_entry+0x50/0x50
+ filemap_read_page+0x33/0xf0
+ filemap_get_pages+0x2f2/0x3f0
+ filemap_read+0xaa/0x320
+ ? do_filp_open+0xb2/0x150
+ ? rmqueue+0x3be/0xe10
+ ceph_read_iter+0x1fe/0x680 [ceph]
+ ? new_sync_read+0x115/0x1a0
+ new_sync_read+0x115/0x1a0
+ vfs_read+0xf3/0x180
+ ksys_read+0x5f/0xe0
+ do_syscall_64+0x38/0x90
+ entry_SYSCALL_64_after_hwframe+0x44/0xae
+
+Changes:
+========
+ver #2)
+ - Changed an unsigned int to a size_t to reduce the likelihood of an
+ overflow as per Willy's suggestion.
+ - Added an additional patch to fix the maths.
+
+Fixes: 3d3c95046742 ("netfs: Provide readahead and readpage netfs helpers")
+Reported-by: George Law <glaw@redhat.com>
+Signed-off-by: David Howells <dhowells@redhat.com>
+Reviewed-by: Jeff Layton <jlayton@kernel.org>
+Reviewed-by: Jingbo Xu <jefflexu@linux.alibaba.com>
+cc: Matthew Wilcox <willy@infradead.org>
+cc: linux-cachefs@redhat.com
+cc: linux-fsdevel@vger.kernel.org
+Link: https://lore.kernel.org/r/166749229733.107206.17482609105741691452.stgit@warthog.procyon.org.uk/ # v1
+Link: https://lore.kernel.org/r/166757987929.950645.12595273010425381286.stgit@warthog.procyon.org.uk/ # v2
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/netfs/buffered_read.c | 9 +++++++--
+ fs/netfs/io.c | 3 +++
+ 2 files changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/fs/netfs/buffered_read.c b/fs/netfs/buffered_read.c
+index 0ce535852151..baf668fb4315 100644
+--- a/fs/netfs/buffered_read.c
++++ b/fs/netfs/buffered_read.c
+@@ -46,10 +46,15 @@ void netfs_rreq_unlock_folios(struct netfs_io_request *rreq)
+
+ rcu_read_lock();
+ xas_for_each(&xas, folio, last_page) {
+- unsigned int pgpos = (folio_index(folio) - start_page) * PAGE_SIZE;
+- unsigned int pgend = pgpos + folio_size(folio);
++ unsigned int pgpos, pgend;
+ bool pg_failed = false;
+
++ if (xas_retry(&xas, folio))
++ continue;
++
++ pgpos = (folio_index(folio) - start_page) * PAGE_SIZE;
++ pgend = pgpos + folio_size(folio);
++
+ for (;;) {
+ if (!subreq) {
+ pg_failed = true;
+diff --git a/fs/netfs/io.c b/fs/netfs/io.c
+index 428925899282..e374767d1b68 100644
+--- a/fs/netfs/io.c
++++ b/fs/netfs/io.c
+@@ -121,6 +121,9 @@ static void netfs_rreq_unmark_after_write(struct netfs_io_request *rreq,
+ XA_STATE(xas, &rreq->mapping->i_pages, subreq->start / PAGE_SIZE);
+
+ xas_for_each(&xas, folio, (subreq->start + subreq->len - 1) / PAGE_SIZE) {
++ if (xas_retry(&xas, folio))
++ continue;
++
+ /* We might have multiple writes from the same huge
+ * folio, but we mustn't unlock a folio more than once.
+ */
+--
+2.35.1
+
--- /dev/null
+From 74c8aee47988dec5dc12d2bf767f939138e1216c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Nov 2022 15:27:57 -0500
+Subject: nfp: change eeprom length to max length enumerators
+
+From: Jaco Coetzee <jaco.coetzee@corigine.com>
+
+[ Upstream commit f3a72878a3de720661b7ed0d6b7f7c506ddb8a52 ]
+
+Extend the size of QSFP EEPROM for types SSF8436 and SFF8636
+from 256 to 640 bytes in order to expose all the EEPROM pages by
+ethtool.
+
+For SFF-8636 and SFF-8436 specifications, the driver exposes
+256 bytes of EEPROM data for ethtool's get_module_eeprom()
+callback, resulting in "netlink error: Invalid argument" when
+an EEPROM read with an offset larger than 256 bytes is attempted.
+
+Changing the length enumerators to the _MAX_LEN
+variants exposes all 640 bytes of the EEPROM allowing upper
+pages 1, 2 and 3 to be read.
+
+Fixes: 96d971e307cc ("ethtool: Add fallback to get_module_eeprom from netlink command")
+Signed-off-by: Jaco Coetzee <jaco.coetzee@corigine.com>
+Reviewed-by: Louis Peens <louis.peens@corigine.com>
+Signed-off-by: Simon Horman <simon.horman@corigine.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
+index b1b1b648e40c..b19bff0db1fd 100644
+--- a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
++++ b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
+@@ -1440,15 +1440,15 @@ nfp_port_get_module_info(struct net_device *netdev,
+
+ if (data < 0x3) {
+ modinfo->type = ETH_MODULE_SFF_8436;
+- modinfo->eeprom_len = ETH_MODULE_SFF_8436_LEN;
++ modinfo->eeprom_len = ETH_MODULE_SFF_8436_MAX_LEN;
+ } else {
+ modinfo->type = ETH_MODULE_SFF_8636;
+- modinfo->eeprom_len = ETH_MODULE_SFF_8636_LEN;
++ modinfo->eeprom_len = ETH_MODULE_SFF_8636_MAX_LEN;
+ }
+ break;
+ case NFP_INTERFACE_QSFP28:
+ modinfo->type = ETH_MODULE_SFF_8636;
+- modinfo->eeprom_len = ETH_MODULE_SFF_8636_LEN;
++ modinfo->eeprom_len = ETH_MODULE_SFF_8636_MAX_LEN;
+ break;
+ default:
+ netdev_err(netdev, "Unsupported module 0x%x detected\n",
+--
+2.35.1
+
--- /dev/null
+From b4a3e59db2b181f58776de146cc20d3c51d4da25 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Nov 2022 11:23:11 -0500
+Subject: nfsd: put the export reference in nfsd4_verify_deleg_dentry
+
+From: Jeff Layton <jlayton@kernel.org>
+
+[ Upstream commit 50256e4793a5e5ab77703c82a47344ad2e774a59 ]
+
+nfsd_lookup_dentry returns an export reference in addition to the dentry
+ref. Ensure that we put it too.
+
+Link: https://bugzilla.redhat.com/show_bug.cgi?id=2138866
+Fixes: 876c553cb410 ("NFSD: verify the opened dentry after setting a delegation")
+Reported-by: Yongcheng Yang <yoyang@redhat.com>
+Signed-off-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfsd/nfs4state.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
+index 0bc36472f8b7..ddb2bf078fda 100644
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -5313,6 +5313,7 @@ nfsd4_verify_deleg_dentry(struct nfsd4_open *open, struct nfs4_file *fp,
+ if (err)
+ return -EAGAIN;
+
++ exp_put(exp);
+ dput(child);
+ if (child != file_dentry(fp->fi_deleg_file->nf_file))
+ return -EAGAIN;
+--
+2.35.1
+
--- /dev/null
+From e68076fd9eb3dba61864cf77363560498ab06938 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Nov 2022 08:45:02 +0200
+Subject: nvmet: fix a memory leak in nvmet_auth_set_key
+
+From: Sagi Grimberg <sagi@grimberg.me>
+
+[ Upstream commit 0a52566279b4ee65ecd2503d7b7342851f84755c ]
+
+When changing dhchap secrets we need to release the old
+secrets as well.
+
+kmemleak complaint:
+--
+unreferenced object 0xffff8c7f44ed8180 (size 64):
+ comm "check", pid 7304, jiffies 4295686133 (age 72034.246s)
+ hex dump (first 32 bytes):
+ 44 48 48 43 2d 31 3a 30 30 3a 4c 64 4c 4f 64 71 DHHC-1:00:LdLOdq
+ 79 56 69 67 77 48 55 32 6d 5a 59 4c 7a 35 59 38 yVigwHU2mZYLz5Y8
+ backtrace:
+ [<00000000b6fc5071>] kstrdup+0x2e/0x60
+ [<00000000f0f4633f>] 0xffffffffc0e07ee6
+ [<0000000053006c05>] 0xffffffffc0dff783
+ [<00000000419ae922>] configfs_write_iter+0xb1/0x120
+ [<000000008183c424>] vfs_write+0x2be/0x3c0
+ [<000000009005a2a5>] ksys_write+0x5f/0xe0
+ [<00000000cd495c89>] do_syscall_64+0x38/0x90
+ [<00000000f2a84ac5>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
+
+Fixes: db1312dd9548 ("nvmet: implement basic In-Band Authentication")
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/target/auth.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/nvme/target/auth.c b/drivers/nvme/target/auth.c
+index c4113b43dbfe..4dcddcf95279 100644
+--- a/drivers/nvme/target/auth.c
++++ b/drivers/nvme/target/auth.c
+@@ -45,9 +45,11 @@ int nvmet_auth_set_key(struct nvmet_host *host, const char *secret,
+ if (!dhchap_secret)
+ return -ENOMEM;
+ if (set_ctrl) {
++ kfree(host->dhchap_ctrl_secret);
+ host->dhchap_ctrl_secret = strim(dhchap_secret);
+ host->dhchap_ctrl_key_hash = key_hash;
+ } else {
++ kfree(host->dhchap_secret);
+ host->dhchap_secret = strim(dhchap_secret);
+ host->dhchap_key_hash = key_hash;
+ }
+--
+2.35.1
+
--- /dev/null
+From b5ade57db6d742ba919d6a0f5d51e309641d86ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Nov 2022 05:29:57 +0200
+Subject: nvmet: fix a memory leak
+
+From: Sagi Grimberg <sagi@grimberg.me>
+
+[ Upstream commit e65fdf530f55c5e387db14470a59a399faa29613 ]
+
+We need to also free the dhchap_ctrl_secret when releasing nvmet_host.
+kmemleak complaint:
+--
+unreferenced object 0xffff99b1cbca5140 (size 64):
+ comm "check", pid 4864, jiffies 4305092436 (age 2913.583s)
+ hex dump (first 32 bytes):
+ 44 48 48 43 2d 31 3a 30 30 3a 65 36 2b 41 63 44 DHHC-1:00:e6+AcD
+ 39 76 47 4d 52 57 59 78 67 54 47 44 51 59 47 78 9vGMRWYxgTGDQYGx
+ backtrace:
+ [<00000000c07d369d>] kstrdup+0x2e/0x60
+ [<000000001372171c>] 0xffffffffc0cceec6
+ [<0000000010dbf50b>] 0xffffffffc0cc6783
+ [<000000007465e93c>] configfs_write_iter+0xb1/0x120
+ [<0000000039c23f62>] vfs_write+0x2be/0x3c0
+ [<000000002da4351c>] ksys_write+0x5f/0xe0
+ [<00000000d5011e32>] do_syscall_64+0x38/0x90
+ [<00000000503870cf>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
+
+Fixes: db1312dd9548 ("nvmet: implement basic In-Band Authentication")
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/target/configfs.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/nvme/target/configfs.c b/drivers/nvme/target/configfs.c
+index 2bcd60758919..7f52d9dac443 100644
+--- a/drivers/nvme/target/configfs.c
++++ b/drivers/nvme/target/configfs.c
+@@ -1811,6 +1811,7 @@ static void nvmet_host_release(struct config_item *item)
+
+ #ifdef CONFIG_NVME_TARGET_AUTH
+ kfree(host->dhchap_secret);
++ kfree(host->dhchap_ctrl_secret);
+ #endif
+ kfree(host);
+ }
+--
+2.35.1
+
--- /dev/null
+From 0f11a2ec54aad23e6378718d8bff2e6eae155adf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Nov 2022 15:08:27 +0800
+Subject: octeon_ep: delete unnecessary napi rollback under set_queues_err in
+ octep_open()
+
+From: Ziyang Xuan <william.xuanziyang@huawei.com>
+
+[ Upstream commit 298b83e180d53a310f9b47e3bf13b7b583e75e9c ]
+
+octep_napi_add() and octep_napi_enable() are all after
+netif_set_real_num_{tx,rx}_queues() in octep_open(), so it is unnecessary
+napi rollback under set_queues_err. Delete them to fix it.
+
+Fixes: 37d79d059606 ("octeon_ep: add Tx/Rx processing and interrupt support")
+Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/octeon_ep/octep_main.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/marvell/octeon_ep/octep_main.c b/drivers/net/ethernet/marvell/octeon_ep/octep_main.c
+index 97f080c66dd4..7083c995d0c1 100644
+--- a/drivers/net/ethernet/marvell/octeon_ep/octep_main.c
++++ b/drivers/net/ethernet/marvell/octeon_ep/octep_main.c
+@@ -527,8 +527,6 @@ static int octep_open(struct net_device *netdev)
+ return 0;
+
+ set_queues_err:
+- octep_napi_disable(oct);
+- octep_napi_delete(oct);
+ octep_clean_irqs(oct);
+ setup_irq_err:
+ octep_free_oqs(oct);
+--
+2.35.1
+
--- /dev/null
+From 9c559d557a401691f0f3299732c95f7e40ebc931 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Nov 2022 15:09:35 +0800
+Subject: octeon_ep: ensure get mac address successfully before
+ eth_hw_addr_set()
+
+From: Ziyang Xuan <william.xuanziyang@huawei.com>
+
+[ Upstream commit 848ffce2f0c93f3481052340a919123a21f808b6 ]
+
+octep_get_mac_addr() can fail because send mbox message failed. If this
+happens, octep_dev->mac_addr will be zero. It should not continue to
+initialize. Add exception handling for octep_get_mac_addr() to fix it.
+
+Fixes: 862cd659a6fb ("octeon_ep: Add driver framework and device initialization")
+Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/octeon_ep/octep_main.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/marvell/octeon_ep/octep_main.c b/drivers/net/ethernet/marvell/octeon_ep/octep_main.c
+index ac1e37afbe7b..8a6a81bcec5c 100644
+--- a/drivers/net/ethernet/marvell/octeon_ep/octep_main.c
++++ b/drivers/net/ethernet/marvell/octeon_ep/octep_main.c
+@@ -1072,7 +1072,11 @@ static int octep_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ netdev->max_mtu = OCTEP_MAX_MTU;
+ netdev->mtu = OCTEP_DEFAULT_MTU;
+
+- octep_get_mac_addr(octep_dev, octep_dev->mac_addr);
++ err = octep_get_mac_addr(octep_dev, octep_dev->mac_addr);
++ if (err) {
++ dev_err(&pdev->dev, "Failed to get mac address\n");
++ goto register_dev_err;
++ }
+ eth_hw_addr_set(netdev, octep_dev->mac_addr);
+
+ err = register_netdev(netdev);
+--
+2.35.1
+
--- /dev/null
+From 6e74b4f4fc48ff898f91a361f8613a9aa6d643ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Nov 2022 15:08:47 +0800
+Subject: octeon_ep: ensure octep_get_link_status() successfully before
+ octep_link_up()
+
+From: Ziyang Xuan <william.xuanziyang@huawei.com>
+
+[ Upstream commit 9d3ff7131877fb092185c369fbb14b57ac4e7cec ]
+
+octep_get_link_status() can fail because send mbox message failed, then
+octep_get_link_status() will return ret less than 0. Excute octep_link_up()
+as long as ret is not equal to 0 in octep_open() now. That is not correct.
+
+The value type of link.state is enum octep_ctrl_net_state. Positive value
+represents up. Excute octep_link_up() when ret is bigger than 0.
+
+Fixes: 862cd659a6fb ("octeon_ep: Add driver framework and device initialization")
+Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/octeon_ep/octep_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/marvell/octeon_ep/octep_main.c b/drivers/net/ethernet/marvell/octeon_ep/octep_main.c
+index 7083c995d0c1..92ca3e502465 100644
+--- a/drivers/net/ethernet/marvell/octeon_ep/octep_main.c
++++ b/drivers/net/ethernet/marvell/octeon_ep/octep_main.c
+@@ -521,7 +521,7 @@ static int octep_open(struct net_device *netdev)
+ octep_oq_dbell_init(oct);
+
+ ret = octep_get_link_status(oct);
+- if (ret)
++ if (ret > 0)
+ octep_link_up(netdev);
+
+ return 0;
+--
+2.35.1
+
--- /dev/null
+From 8ed866ba41c7564f701cc5fa04bf29725a2b3a70 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Nov 2022 15:09:23 +0800
+Subject: octeon_ep: fix potential memory leak in octep_device_setup()
+
+From: Ziyang Xuan <william.xuanziyang@huawei.com>
+
+[ Upstream commit e4041be97b15302ebfffda8bbd45f3b2d096048f ]
+
+When occur unsupported_dev and mbox init errors, it did not free oct->conf
+and iounmap() oct->mmio[i].hw_addr. That would trigger memory leak problem.
+Add kfree() for oct->conf and iounmap() for oct->mmio[i].hw_addr under
+unsupported_dev and mbox init errors to fix the problem.
+
+Fixes: 862cd659a6fb ("octeon_ep: Add driver framework and device initialization")
+Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/octeon_ep/octep_main.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/marvell/octeon_ep/octep_main.c b/drivers/net/ethernet/marvell/octeon_ep/octep_main.c
+index 92ca3e502465..ac1e37afbe7b 100644
+--- a/drivers/net/ethernet/marvell/octeon_ep/octep_main.c
++++ b/drivers/net/ethernet/marvell/octeon_ep/octep_main.c
+@@ -956,7 +956,7 @@ int octep_device_setup(struct octep_device *oct)
+ ret = octep_ctrl_mbox_init(ctrl_mbox);
+ if (ret) {
+ dev_err(&pdev->dev, "Failed to initialize control mbox\n");
+- return -1;
++ goto unsupported_dev;
+ }
+ oct->ctrl_mbox_ifstats_offset = OCTEP_CTRL_MBOX_SZ(ctrl_mbox->h2fq.elem_sz,
+ ctrl_mbox->h2fq.elem_cnt,
+@@ -966,6 +966,10 @@ int octep_device_setup(struct octep_device *oct)
+ return 0;
+
+ unsupported_dev:
++ for (i = 0; i < OCTEP_MMIO_REGIONS; i++)
++ iounmap(oct->mmio[i].hw_addr);
++
++ kfree(oct->conf);
+ return -1;
+ }
+
+--
+2.35.1
+
--- /dev/null
+From 179c935b6f0450fa26eaff39a9eeaff9e5e94ea7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Sep 2022 19:52:08 +0100
+Subject: parport_pc: Avoid FIFO port location truncation
+
+From: Maciej W. Rozycki <macro@orcam.me.uk>
+
+[ Upstream commit ab126f51c93a15093df604f661c9480854c005a3 ]
+
+Match the data type of a temporary holding a reference to the FIFO port
+with the type of the original reference coming from `struct parport',
+avoiding data truncation with LP64 ports such as SPARC64 that refer to
+PCI port I/O locations via their corresponding MMIO addresses and will
+therefore have non-zero bits in the high 32-bit part of the reference.
+And in any case it is cleaner to have the data types matching here.
+
+Signed-off-by: Maciej W. Rozycki <macro@orcam.me.uk>
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Link: https://lore.kernel.org/linux-pci/20220419033752.GA1101844@bhelgaas/
+Acked-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
+Link: https://lore.kernel.org/r/alpine.DEB.2.21.2209231912550.29493@angie.orcam.me.uk
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/parport/parport_pc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/parport/parport_pc.c b/drivers/parport/parport_pc.c
+index eda4ded4d5e5..925be41eeebe 100644
+--- a/drivers/parport/parport_pc.c
++++ b/drivers/parport/parport_pc.c
+@@ -468,7 +468,7 @@ static size_t parport_pc_fifo_write_block_pio(struct parport *port,
+ const unsigned char *bufp = buf;
+ size_t left = length;
+ unsigned long expire = jiffies + port->physport->cad->timeout;
+- const int fifo = FIFO(port);
++ const unsigned long fifo = FIFO(port);
+ int poll_for = 8; /* 80 usecs */
+ const struct parport_pc_private *priv = port->physport->private_data;
+ const int fifo_depth = priv->fifo_depth;
+--
+2.35.1
+
--- /dev/null
+From d3aa7d023deb94facd1298a0135d04bfb1307435 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Nov 2022 16:20:56 +0800
+Subject: pinctrl: devicetree: fix null pointer dereferencing in
+ pinctrl_dt_to_map
+
+From: Zeng Heng <zengheng4@huawei.com>
+
+[ Upstream commit 91d5c5060ee24fe8da88cd585bb43b843d2f0dce ]
+
+Here is the BUG report by KASAN about null pointer dereference:
+
+BUG: KASAN: null-ptr-deref in strcmp+0x2e/0x50
+Read of size 1 at addr 0000000000000000 by task python3/2640
+Call Trace:
+ strcmp
+ __of_find_property
+ of_find_property
+ pinctrl_dt_to_map
+
+kasprintf() would return NULL pointer when kmalloc() fail to allocate.
+So directly return ENOMEM, if kasprintf() return NULL pointer.
+
+Fixes: 57291ce295c0 ("pinctrl: core device tree mapping table parsing support")
+Signed-off-by: Zeng Heng <zengheng4@huawei.com>
+Link: https://lore.kernel.org/r/20221110082056.2014898-1-zengheng4@huawei.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/devicetree.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/pinctrl/devicetree.c b/drivers/pinctrl/devicetree.c
+index ef898ee8ca6b..6e0a40962f38 100644
+--- a/drivers/pinctrl/devicetree.c
++++ b/drivers/pinctrl/devicetree.c
+@@ -220,6 +220,8 @@ int pinctrl_dt_to_map(struct pinctrl *p, struct pinctrl_dev *pctldev)
+ for (state = 0; ; state++) {
+ /* Retrieve the pinctrl-* property */
+ propname = kasprintf(GFP_KERNEL, "pinctrl-%d", state);
++ if (!propname)
++ return -ENOMEM;
+ prop = of_find_property(np, propname, &size);
+ kfree(propname);
+ if (!prop) {
+--
+2.35.1
+
--- /dev/null
+From d0bd4c64c3ea275cb21c9f23fc2ec9c5bc2b2ca9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Nov 2022 11:56:05 +0100
+Subject: pinctrl: mediatek: common-v2: Fix bias-disable for
+ PULL_PU_PD_RSEL_TYPE
+
+From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+
+[ Upstream commit fed74d75277da865da9ba334d3f5d5e3e327971d ]
+
+In pinctrl-paris we're calling the .bias_set_combo() callback when we
+are asked to set the pin bias to either pull up/down or pull disable.
+
+On newer platforms, this callback is mtk_pinconf_bias_set_combo(),
+located in pinctrl-mtk-common-v2.c: this will check the "pull type"
+assigned to the requested pin and in case said pin's pull type is
+MTK_PULL_PU_PD_RSEL_TYPE, this function will set RSEL first, PUPD
+last, which is fine.
+
+The issue comes when we're requesting PIN_CONFIG_BIAS_DISABLE, as
+this does *not* require setting RSEL but only PU_PD: in this case,
+the arg is MTK_DISABLE (zero), which is not a supported RSEL, due
+to which function mtk_pinconf_bias_set_rsel() returns a failure;
+because of that, mtk_pinconf_bias_set_pu_pd() is never called,
+hence the pin bias is never set to DISABLE.
+
+To fix this issue, add a check to mtk_pinconf_bias_set_rsel(): if
+we are entering that function with no pullup requested and at the
+same time the arg is MTK_DISABLE, this means that we're trying to
+disable pin bias, hence it's safe to return cleanly without ever
+setting any RSEL register.
+This makes mtk_pinconf_bias_set_combo() happy, going on with setting
+the PU_PD registers, which is the only action to actually take to
+disable bias on a pin/pingroup.
+
+Fixes: fb34a9ae383a ("pinctrl: mediatek: support rsel feature")
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20221104105605.33720-1-angelogioacchino.delregno@collabora.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c b/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c
+index e1ae3beb9f72..b7921b59eb7b 100644
+--- a/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c
++++ b/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c
+@@ -709,6 +709,9 @@ static int mtk_pinconf_bias_set_rsel(struct mtk_pinctrl *hw,
+ {
+ int err, rsel_val;
+
++ if (!pullup && arg == MTK_DISABLE)
++ return 0;
++
+ if (hw->rsel_si_unit) {
+ /* find pin rsel_index from pin_rsel array*/
+ err = mtk_hw_pin_rsel_lookup(hw, desc, pullup, arg, &rsel_val);
+--
+2.35.1
+
--- /dev/null
+From 970158f98becfcefb84da9c06b972e6890d69cfb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Oct 2022 14:17:23 +0200
+Subject: pinctrl: rockchip: list all pins in a possible mux route for PX30
+
+From: Quentin Schulz <quentin.schulz@theobroma-systems.com>
+
+[ Upstream commit bee55f2e7a44e7a7676e264b42f026e34bd244d9 ]
+
+The mux routes are incomplete for the PX30. This was discovered because
+we had a HW design using cif-clkoutm1 with the correct pinmux in the
+Device Tree but the clock would still not work.
+
+There are actually two muxing required: the pin muxing (performed by the
+usual Device Tree pinctrl nodes) and the "function" muxing (m0 vs m1;
+performed by the mux routing inside the driver). The pin muxing was
+correct but the function muxing was not.
+
+This adds the missing pins and their configuration for the mux routes
+that are already specified in the driver.
+
+Note that there are some "conflicts": it is possible *in Device Tree* to
+(attempt to) mux the pins for e.g. clkoutm1 and clkinm0 at the same time
+but this is actually not possible in hardware (because both share the
+same bit for the function muxing). Since it is an impossible hardware
+design, it is not deemed necessary to prevent the user from attempting
+to "misconfigure" the pins/functions.
+
+Fixes: 87065ca9b8e5 ("pinctrl: rockchip: Add pinctrl support for PX30")
+Signed-off-by: Quentin Schulz <quentin.schulz@theobroma-systems.com>
+Link: https://lore.kernel.org/r/20221017-upstream-px30-cif-clkoutm1-v1-0-4ea1389237f7@theobroma-systems.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/pinctrl-rockchip.c | 40 ++++++++++++++++++++++++++++++
+ 1 file changed, 40 insertions(+)
+
+diff --git a/drivers/pinctrl/pinctrl-rockchip.c b/drivers/pinctrl/pinctrl-rockchip.c
+index c84bd0e1ce5a..f4d2b64c0670 100644
+--- a/drivers/pinctrl/pinctrl-rockchip.c
++++ b/drivers/pinctrl/pinctrl-rockchip.c
+@@ -632,14 +632,54 @@ static void rockchip_get_recalced_mux(struct rockchip_pin_bank *bank, int pin,
+ }
+
+ static struct rockchip_mux_route_data px30_mux_route_data[] = {
++ RK_MUXROUTE_SAME(2, RK_PB4, 1, 0x184, BIT(16 + 7)), /* cif-d0m0 */
++ RK_MUXROUTE_SAME(3, RK_PA1, 3, 0x184, BIT(16 + 7) | BIT(7)), /* cif-d0m1 */
++ RK_MUXROUTE_SAME(2, RK_PB6, 1, 0x184, BIT(16 + 7)), /* cif-d1m0 */
++ RK_MUXROUTE_SAME(3, RK_PA2, 3, 0x184, BIT(16 + 7) | BIT(7)), /* cif-d1m1 */
+ RK_MUXROUTE_SAME(2, RK_PA0, 1, 0x184, BIT(16 + 7)), /* cif-d2m0 */
+ RK_MUXROUTE_SAME(3, RK_PA3, 3, 0x184, BIT(16 + 7) | BIT(7)), /* cif-d2m1 */
++ RK_MUXROUTE_SAME(2, RK_PA1, 1, 0x184, BIT(16 + 7)), /* cif-d3m0 */
++ RK_MUXROUTE_SAME(3, RK_PA5, 3, 0x184, BIT(16 + 7) | BIT(7)), /* cif-d3m1 */
++ RK_MUXROUTE_SAME(2, RK_PA2, 1, 0x184, BIT(16 + 7)), /* cif-d4m0 */
++ RK_MUXROUTE_SAME(3, RK_PA7, 3, 0x184, BIT(16 + 7) | BIT(7)), /* cif-d4m1 */
++ RK_MUXROUTE_SAME(2, RK_PA3, 1, 0x184, BIT(16 + 7)), /* cif-d5m0 */
++ RK_MUXROUTE_SAME(3, RK_PB0, 3, 0x184, BIT(16 + 7) | BIT(7)), /* cif-d5m1 */
++ RK_MUXROUTE_SAME(2, RK_PA4, 1, 0x184, BIT(16 + 7)), /* cif-d6m0 */
++ RK_MUXROUTE_SAME(3, RK_PB1, 3, 0x184, BIT(16 + 7) | BIT(7)), /* cif-d6m1 */
++ RK_MUXROUTE_SAME(2, RK_PA5, 1, 0x184, BIT(16 + 7)), /* cif-d7m0 */
++ RK_MUXROUTE_SAME(3, RK_PB4, 3, 0x184, BIT(16 + 7) | BIT(7)), /* cif-d7m1 */
++ RK_MUXROUTE_SAME(2, RK_PA6, 1, 0x184, BIT(16 + 7)), /* cif-d8m0 */
++ RK_MUXROUTE_SAME(3, RK_PB6, 3, 0x184, BIT(16 + 7) | BIT(7)), /* cif-d8m1 */
++ RK_MUXROUTE_SAME(2, RK_PA7, 1, 0x184, BIT(16 + 7)), /* cif-d9m0 */
++ RK_MUXROUTE_SAME(3, RK_PB7, 3, 0x184, BIT(16 + 7) | BIT(7)), /* cif-d9m1 */
++ RK_MUXROUTE_SAME(2, RK_PB7, 1, 0x184, BIT(16 + 7)), /* cif-d10m0 */
++ RK_MUXROUTE_SAME(3, RK_PC6, 3, 0x184, BIT(16 + 7) | BIT(7)), /* cif-d10m1 */
++ RK_MUXROUTE_SAME(2, RK_PC0, 1, 0x184, BIT(16 + 7)), /* cif-d11m0 */
++ RK_MUXROUTE_SAME(3, RK_PC7, 3, 0x184, BIT(16 + 7) | BIT(7)), /* cif-d11m1 */
++ RK_MUXROUTE_SAME(2, RK_PB0, 1, 0x184, BIT(16 + 7)), /* cif-vsyncm0 */
++ RK_MUXROUTE_SAME(3, RK_PD1, 3, 0x184, BIT(16 + 7) | BIT(7)), /* cif-vsyncm1 */
++ RK_MUXROUTE_SAME(2, RK_PB1, 1, 0x184, BIT(16 + 7)), /* cif-hrefm0 */
++ RK_MUXROUTE_SAME(3, RK_PD2, 3, 0x184, BIT(16 + 7) | BIT(7)), /* cif-hrefm1 */
++ RK_MUXROUTE_SAME(2, RK_PB2, 1, 0x184, BIT(16 + 7)), /* cif-clkinm0 */
++ RK_MUXROUTE_SAME(3, RK_PD3, 3, 0x184, BIT(16 + 7) | BIT(7)), /* cif-clkinm1 */
++ RK_MUXROUTE_SAME(2, RK_PB3, 1, 0x184, BIT(16 + 7)), /* cif-clkoutm0 */
++ RK_MUXROUTE_SAME(3, RK_PD0, 3, 0x184, BIT(16 + 7) | BIT(7)), /* cif-clkoutm1 */
+ RK_MUXROUTE_SAME(3, RK_PC6, 2, 0x184, BIT(16 + 8)), /* pdm-m0 */
+ RK_MUXROUTE_SAME(2, RK_PC6, 1, 0x184, BIT(16 + 8) | BIT(8)), /* pdm-m1 */
++ RK_MUXROUTE_SAME(3, RK_PD3, 2, 0x184, BIT(16 + 8)), /* pdm-sdi0m0 */
++ RK_MUXROUTE_SAME(2, RK_PC5, 2, 0x184, BIT(16 + 8) | BIT(8)), /* pdm-sdi0m1 */
+ RK_MUXROUTE_SAME(1, RK_PD3, 2, 0x184, BIT(16 + 10)), /* uart2-rxm0 */
+ RK_MUXROUTE_SAME(2, RK_PB6, 2, 0x184, BIT(16 + 10) | BIT(10)), /* uart2-rxm1 */
++ RK_MUXROUTE_SAME(1, RK_PD2, 2, 0x184, BIT(16 + 10)), /* uart2-txm0 */
++ RK_MUXROUTE_SAME(2, RK_PB4, 2, 0x184, BIT(16 + 10) | BIT(10)), /* uart2-txm1 */
+ RK_MUXROUTE_SAME(0, RK_PC1, 2, 0x184, BIT(16 + 9)), /* uart3-rxm0 */
+ RK_MUXROUTE_SAME(1, RK_PB7, 2, 0x184, BIT(16 + 9) | BIT(9)), /* uart3-rxm1 */
++ RK_MUXROUTE_SAME(0, RK_PC0, 2, 0x184, BIT(16 + 9)), /* uart3-txm0 */
++ RK_MUXROUTE_SAME(1, RK_PB6, 2, 0x184, BIT(16 + 9) | BIT(9)), /* uart3-txm1 */
++ RK_MUXROUTE_SAME(0, RK_PC2, 2, 0x184, BIT(16 + 9)), /* uart3-ctsm0 */
++ RK_MUXROUTE_SAME(1, RK_PB4, 2, 0x184, BIT(16 + 9) | BIT(9)), /* uart3-ctsm1 */
++ RK_MUXROUTE_SAME(0, RK_PC3, 2, 0x184, BIT(16 + 9)), /* uart3-rtsm0 */
++ RK_MUXROUTE_SAME(1, RK_PB5, 2, 0x184, BIT(16 + 9) | BIT(9)), /* uart3-rtsm1 */
+ };
+
+ static struct rockchip_mux_route_data rk3128_mux_route_data[] = {
+--
+2.35.1
+
--- /dev/null
+From 1207ae09231c6b41e57596251a8f5a442fa70bc0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 13 Nov 2022 19:59:50 +0100
+Subject: platform/surface: aggregator: Do not check for repeated unsequenced
+ packets
+
+From: Maximilian Luz <luzmaximilian@gmail.com>
+
+[ Upstream commit d9a477f643eb3de71fbea5ae6103b800ceb8f547 ]
+
+Currently, we check any received packet whether we have already seen it
+previously, regardless of the packet type (sequenced / unsequenced). We
+do this by checking the sequence number. This assumes that sequence
+numbers are valid for both sequenced and unsequenced packets. However,
+this assumption appears to be incorrect.
+
+On some devices, the sequence number field of unsequenced packets (in
+particular HID input events on the Surface Pro 9) is always zero. As a
+result, the current retransmission check kicks in and discards all but
+the first unsequenced packet, breaking (among other things) keyboard and
+touchpad input.
+
+Note that we have, so far, only seen packets being retransmitted in
+sequenced communication. In particular, this happens when there is an
+ACK timeout, causing the EC (or us) to re-send the packet waiting for an
+ACK. Arguably, retransmission / duplication of unsequenced packets
+should not be an issue as there is no logical condition (such as an ACK
+timeout) to determine when a packet should be sent again.
+
+Therefore, remove the retransmission check for unsequenced packets
+entirely to resolve the issue.
+
+Fixes: c167b9c7e3d6 ("platform/surface: Add Surface Aggregator subsystem")
+Signed-off-by: Maximilian Luz <luzmaximilian@gmail.com>
+Link: https://lore.kernel.org/r/20221113185951.224759-1-luzmaximilian@gmail.com
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../surface/aggregator/ssh_packet_layer.c | 24 +++++++++++++++----
+ 1 file changed, 20 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/platform/surface/aggregator/ssh_packet_layer.c b/drivers/platform/surface/aggregator/ssh_packet_layer.c
+index 6748fe4ac5d5..def8d7ac541f 100644
+--- a/drivers/platform/surface/aggregator/ssh_packet_layer.c
++++ b/drivers/platform/surface/aggregator/ssh_packet_layer.c
+@@ -1596,16 +1596,32 @@ static void ssh_ptl_timeout_reap(struct work_struct *work)
+ ssh_ptl_tx_wakeup_packet(ptl);
+ }
+
+-static bool ssh_ptl_rx_retransmit_check(struct ssh_ptl *ptl, u8 seq)
++static bool ssh_ptl_rx_retransmit_check(struct ssh_ptl *ptl, const struct ssh_frame *frame)
+ {
+ int i;
+
++ /*
++ * Ignore unsequenced packets. On some devices (notably Surface Pro 9),
++ * unsequenced events will always be sent with SEQ=0x00. Attempting to
++ * detect retransmission would thus just block all events.
++ *
++ * While sequence numbers would also allow detection of retransmitted
++ * packets in unsequenced communication, they have only ever been used
++ * to cover edge-cases in sequenced transmission. In particular, the
++ * only instance of packets being retransmitted (that we are aware of)
++ * is due to an ACK timeout. As this does not happen in unsequenced
++ * communication, skip the retransmission check for those packets
++ * entirely.
++ */
++ if (frame->type == SSH_FRAME_TYPE_DATA_NSQ)
++ return false;
++
+ /*
+ * Check if SEQ has been seen recently (i.e. packet was
+ * re-transmitted and we should ignore it).
+ */
+ for (i = 0; i < ARRAY_SIZE(ptl->rx.blocked.seqs); i++) {
+- if (likely(ptl->rx.blocked.seqs[i] != seq))
++ if (likely(ptl->rx.blocked.seqs[i] != frame->seq))
+ continue;
+
+ ptl_dbg(ptl, "ptl: ignoring repeated data packet\n");
+@@ -1613,7 +1629,7 @@ static bool ssh_ptl_rx_retransmit_check(struct ssh_ptl *ptl, u8 seq)
+ }
+
+ /* Update list of blocked sequence IDs. */
+- ptl->rx.blocked.seqs[ptl->rx.blocked.offset] = seq;
++ ptl->rx.blocked.seqs[ptl->rx.blocked.offset] = frame->seq;
+ ptl->rx.blocked.offset = (ptl->rx.blocked.offset + 1)
+ % ARRAY_SIZE(ptl->rx.blocked.seqs);
+
+@@ -1624,7 +1640,7 @@ static void ssh_ptl_rx_dataframe(struct ssh_ptl *ptl,
+ const struct ssh_frame *frame,
+ const struct ssam_span *payload)
+ {
+- if (ssh_ptl_rx_retransmit_check(ptl, frame->seq))
++ if (ssh_ptl_rx_retransmit_check(ptl, frame))
+ return;
+
+ ptl->ops.data_received(ptl, payload);
+--
+2.35.1
+
--- /dev/null
+From aee5a93c99be7acc1666b0df4dbc228eca8efdc1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Nov 2022 17:31:44 +0100
+Subject: platform/x86/intel: pmc: Don't unconditionally attach Intel PMC when
+ virtualized
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Roger Pau Monné <roger.pau@citrix.com>
+
+[ Upstream commit 2dbfb3f33350e1e868d3d7ed4c176d8777150878 ]
+
+The current logic in the Intel PMC driver will forcefully attach it
+when detecting any CPU on the intel_pmc_core_platform_ids array,
+even if the matching ACPI device is not present.
+
+There's no checking in pmc_core_probe() to assert that the PMC device
+is present, and hence on virtualized environments the PMC device
+probes successfully, even if the underlying registers are not present.
+Before commit 21ae43570940 ("platform/x86: intel_pmc_core: Substitute PCI
+with CPUID enumeration") the driver would check for the presence of a
+specific PCI device, and that prevented the driver from attaching when
+running virtualized.
+
+Fix by only forcefully attaching the PMC device when not running
+virtualized. Note that virtualized platforms can still get the device
+to load if the appropriate ACPI device is present on the tables
+provided to the VM.
+
+Make an exception for the Xen initial domain, which does have full
+hardware access, and hence can attach to the PMC if present.
+
+Fixes: 21ae43570940 ("platform/x86: intel_pmc_core: Substitute PCI with CPUID enumeration")
+Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
+Acked-by: David E. Box <david.e.box@linux.intel.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://lore.kernel.org/r/20221110163145.80374-1-roger.pau@citrix.com
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/intel/pmc/pltdrv.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/platform/x86/intel/pmc/pltdrv.c b/drivers/platform/x86/intel/pmc/pltdrv.c
+index 15ca8afdd973..ddfba38c2104 100644
+--- a/drivers/platform/x86/intel/pmc/pltdrv.c
++++ b/drivers/platform/x86/intel/pmc/pltdrv.c
+@@ -18,6 +18,8 @@
+ #include <asm/cpu_device_id.h>
+ #include <asm/intel-family.h>
+
++#include <xen/xen.h>
++
+ static void intel_pmc_core_release(struct device *dev)
+ {
+ kfree(dev);
+@@ -53,6 +55,13 @@ static int __init pmc_core_platform_init(void)
+ if (acpi_dev_present("INT33A1", NULL, -1))
+ return -ENODEV;
+
++ /*
++ * Skip forcefully attaching the device for VMs. Make an exception for
++ * Xen dom0, which does have full hardware access.
++ */
++ if (cpu_feature_enabled(X86_FEATURE_HYPERVISOR) && !xen_initial_domain())
++ return -ENODEV;
++
+ if (!x86_match_cpu(intel_pmc_core_platform_ids))
+ return -ENODEV;
+
+--
+2.35.1
+
--- /dev/null
+From 5cf034818461de9907d4771b3c827d2f1f728004 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Nov 2022 12:06:47 +0100
+Subject: s390: avoid using global register for current_stack_pointer
+
+From: Vasily Gorbik <gor@linux.ibm.com>
+
+[ Upstream commit e3c11025bcd2142a61abe5806b2f86a0e78118df ]
+
+Commit 30de14b1884b ("s390: current_stack_pointer shouldn't be a
+function") made current_stack_pointer a global register variable like
+on many other architectures. Unfortunately on s390 it uncovers old
+gcc bug which is fixed only since gcc-9.1 [gcc commit 3ad7fed1cc87
+("S/390: Fix PR89775. Stackpointer save/restore instructions removed")]
+and backported to gcc-8.4 and later. Due to this bug gcc versions prior
+to 8.4 generate broken code which leads to stack corruptions.
+
+Current minimal gcc version required to build the kernel is declared
+as 5.1. It is not possible to fix all old gcc versions, so work
+around this problem by avoiding using global register variable for
+current_stack_pointer.
+
+Fixes: 30de14b1884b ("s390: current_stack_pointer shouldn't be a function")
+Reviewed-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/include/asm/processor.h | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/arch/s390/include/asm/processor.h b/arch/s390/include/asm/processor.h
+index bd66f8e34949..00f45d8f1efa 100644
+--- a/arch/s390/include/asm/processor.h
++++ b/arch/s390/include/asm/processor.h
+@@ -202,7 +202,16 @@ unsigned long __get_wchan(struct task_struct *p);
+ /* Has task runtime instrumentation enabled ? */
+ #define is_ri_task(tsk) (!!(tsk)->thread.ri_cb)
+
+-register unsigned long current_stack_pointer asm("r15");
++/* avoid using global register due to gcc bug in versions < 8.4 */
++#define current_stack_pointer (__current_stack_pointer())
++
++static __always_inline unsigned long __current_stack_pointer(void)
++{
++ unsigned long sp;
++
++ asm volatile("lgr %0,15" : "=d" (sp));
++ return sp;
++}
+
+ static __always_inline unsigned short stap(void)
+ {
+--
+2.35.1
+
--- /dev/null
+From a96c4558c7e5aece7d7d69a807bb4d9620742137 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Nov 2022 20:48:28 +0800
+Subject: scsi: scsi_transport_sas: Fix error handling in sas_phy_add()
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit 5d7bebf2dfb0dc97aac1fbace0910e557ecdb16f ]
+
+If transport_add_device() fails in sas_phy_add(), the kernel will crash
+trying to delete the device in transport_remove_device() called from
+sas_remove_host().
+
+Unable to handle kernel NULL pointer dereference at virtual address 0000000000000108
+CPU: 61 PID: 42829 Comm: rmmod Kdump: loaded Tainted: G W 6.1.0-rc1+ #173
+pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+pc : device_del+0x54/0x3d0
+lr : device_del+0x37c/0x3d0
+Call trace:
+ device_del+0x54/0x3d0
+ attribute_container_class_device_del+0x28/0x38
+ transport_remove_classdev+0x6c/0x80
+ attribute_container_device_trigger+0x108/0x110
+ transport_remove_device+0x28/0x38
+ sas_phy_delete+0x30/0x60 [scsi_transport_sas]
+ do_sas_phy_delete+0x6c/0x80 [scsi_transport_sas]
+ device_for_each_child+0x68/0xb0
+ sas_remove_children+0x40/0x50 [scsi_transport_sas]
+ sas_remove_host+0x20/0x38 [scsi_transport_sas]
+ hisi_sas_remove+0x40/0x68 [hisi_sas_main]
+ hisi_sas_v2_remove+0x20/0x30 [hisi_sas_v2_hw]
+ platform_remove+0x2c/0x60
+
+Fix this by checking and handling return value of transport_add_device()
+in sas_phy_add().
+
+Fixes: c7ebbbce366c ("[SCSI] SAS transport class")
+Suggested-by: John Garry <john.g.garry@oracle.com>
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Link: https://lore.kernel.org/r/20221107124828.115557-1-yangyingliang@huawei.com
+Reviewed-by: John Garry <john.g.garry@oracle.com>
+Reviewed-by: Jason Yan <yanaijie@huawei.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/scsi_transport_sas.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/scsi/scsi_transport_sas.c b/drivers/scsi/scsi_transport_sas.c
+index 2f88c61216ee..74b99f2b0b74 100644
+--- a/drivers/scsi/scsi_transport_sas.c
++++ b/drivers/scsi/scsi_transport_sas.c
+@@ -722,12 +722,17 @@ int sas_phy_add(struct sas_phy *phy)
+ int error;
+
+ error = device_add(&phy->dev);
+- if (!error) {
+- transport_add_device(&phy->dev);
+- transport_configure_device(&phy->dev);
++ if (error)
++ return error;
++
++ error = transport_add_device(&phy->dev);
++ if (error) {
++ device_del(&phy->dev);
++ return error;
+ }
++ transport_configure_device(&phy->dev);
+
+- return error;
++ return 0;
+ }
+ EXPORT_SYMBOL(sas_phy_add);
+
+--
+2.35.1
+
--- /dev/null
+From f379ed1edb698e6b058c932908dced5ce9c10b6c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Nov 2022 17:45:16 -0400
+Subject: sctp: clear out_curr if all frag chunks of current msg are pruned
+
+From: Xin Long <lucien.xin@gmail.com>
+
+[ Upstream commit 2f201ae14ae0f91dbf1cffea7bb1e29e81d4d108 ]
+
+A crash was reported by Zhen Chen:
+
+ list_del corruption, ffffa035ddf01c18->next is NULL
+ WARNING: CPU: 1 PID: 250682 at lib/list_debug.c:49 __list_del_entry_valid+0x59/0xe0
+ RIP: 0010:__list_del_entry_valid+0x59/0xe0
+ Call Trace:
+ sctp_sched_dequeue_common+0x17/0x70 [sctp]
+ sctp_sched_fcfs_dequeue+0x37/0x50 [sctp]
+ sctp_outq_flush_data+0x85/0x360 [sctp]
+ sctp_outq_uncork+0x77/0xa0 [sctp]
+ sctp_cmd_interpreter.constprop.0+0x164/0x1450 [sctp]
+ sctp_side_effects+0x37/0xe0 [sctp]
+ sctp_do_sm+0xd0/0x230 [sctp]
+ sctp_primitive_SEND+0x2f/0x40 [sctp]
+ sctp_sendmsg_to_asoc+0x3fa/0x5c0 [sctp]
+ sctp_sendmsg+0x3d5/0x440 [sctp]
+ sock_sendmsg+0x5b/0x70
+
+and in sctp_sched_fcfs_dequeue() it dequeued a chunk from stream
+out_curr outq while this outq was empty.
+
+Normally stream->out_curr must be set to NULL once all frag chunks of
+current msg are dequeued, as we can see in sctp_sched_dequeue_done().
+However, in sctp_prsctp_prune_unsent() as it is not a proper dequeue,
+sctp_sched_dequeue_done() is not called to do this.
+
+This patch is to fix it by simply setting out_curr to NULL when the
+last frag chunk of current msg is dequeued from out_curr stream in
+sctp_prsctp_prune_unsent().
+
+Fixes: 5bbbbe32a431 ("sctp: introduce stream scheduler foundations")
+Reported-by: Zhen Chen <chenzhen126@huawei.com>
+Tested-by: Caowangbao <caowangbao@huawei.com>
+Signed-off-by: Xin Long <lucien.xin@gmail.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sctp/outqueue.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
+index c99fe3dc19bc..20831079fb09 100644
+--- a/net/sctp/outqueue.c
++++ b/net/sctp/outqueue.c
+@@ -403,6 +403,11 @@ static int sctp_prsctp_prune_unsent(struct sctp_association *asoc,
+ sout = SCTP_SO(&asoc->stream, chk->sinfo.sinfo_stream);
+ sout->ext->abandoned_unsent[SCTP_PR_INDEX(PRIO)]++;
+
++ /* clear out_curr if all frag chunks are pruned */
++ if (asoc->stream.out_curr == sout &&
++ list_is_last(&chk->frag_list, &chk->msg->chunks))
++ asoc->stream.out_curr = NULL;
++
+ msg_len -= chk->skb->truesize + sizeof(struct sctp_chunk);
+ sctp_chunk_free(chk);
+ if (msg_len <= 0)
+--
+2.35.1
+
--- /dev/null
+From 944c7c9c09c95fa637a72f6e969582cf46341521 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Nov 2022 17:45:15 -0400
+Subject: sctp: remove the unnecessary sinfo_stream check in
+ sctp_prsctp_prune_unsent
+
+From: Xin Long <lucien.xin@gmail.com>
+
+[ Upstream commit 9f0b773210c27a8f5d98ddb2fc4ba60a42a3285f ]
+
+Since commit 5bbbbe32a431 ("sctp: introduce stream scheduler foundations"),
+sctp_stream_outq_migrate() has been called in sctp_stream_init/update to
+removes those chunks to streams higher than the new max. There is no longer
+need to do such check in sctp_prsctp_prune_unsent().
+
+Signed-off-by: Xin Long <lucien.xin@gmail.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Stable-dep-of: 2f201ae14ae0 ("sctp: clear out_curr if all frag chunks of current msg are pruned")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sctp/outqueue.c | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
+index e213aaf45d67..c99fe3dc19bc 100644
+--- a/net/sctp/outqueue.c
++++ b/net/sctp/outqueue.c
+@@ -384,6 +384,7 @@ static int sctp_prsctp_prune_unsent(struct sctp_association *asoc,
+ {
+ struct sctp_outq *q = &asoc->outqueue;
+ struct sctp_chunk *chk, *temp;
++ struct sctp_stream_out *sout;
+
+ q->sched->unsched_all(&asoc->stream);
+
+@@ -398,12 +399,9 @@ static int sctp_prsctp_prune_unsent(struct sctp_association *asoc,
+ sctp_sched_dequeue_common(q, chk);
+ asoc->sent_cnt_removable--;
+ asoc->abandoned_unsent[SCTP_PR_INDEX(PRIO)]++;
+- if (chk->sinfo.sinfo_stream < asoc->stream.outcnt) {
+- struct sctp_stream_out *streamout =
+- SCTP_SO(&asoc->stream, chk->sinfo.sinfo_stream);
+
+- streamout->ext->abandoned_unsent[SCTP_PR_INDEX(PRIO)]++;
+- }
++ sout = SCTP_SO(&asoc->stream, chk->sinfo.sinfo_stream);
++ sout->ext->abandoned_unsent[SCTP_PR_INDEX(PRIO)]++;
+
+ msg_len -= chk->skb->truesize + sizeof(struct sctp_chunk);
+ sctp_chunk_free(chk);
+--
+2.35.1
+
--- /dev/null
+From f50b1325911a00d01e5b86bb6cf858074c57b44d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Nov 2022 20:19:45 +0800
+Subject: selftests/bpf: Fix casting error when cross-compiling test_verifier
+ for 32-bit platforms
+
+From: Pu Lehui <pulehui@huawei.com>
+
+[ Upstream commit 0811664da064c6d7ca64c02f5579f758a007e52d ]
+
+When cross-compiling test_verifier for 32-bit platforms, the casting error is shown below:
+
+test_verifier.c:1263:27: error: cast from pointer to integer of different size [-Werror=pointer-to-int-cast]
+ 1263 | info.xlated_prog_insns = (__u64)*buf;
+ | ^
+cc1: all warnings being treated as errors
+
+Fix it by adding zero-extension for it.
+
+Fixes: 933ff53191eb ("selftests/bpf: specify expected instructions in test_verifier tests")
+Signed-off-by: Pu Lehui <pulehui@huawei.com>
+Acked-by: Yonghong Song <yhs@fb.com>
+Link: https://lore.kernel.org/r/20221108121945.4104644-1-pulehui@huaweicloud.com
+Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/test_verifier.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/bpf/test_verifier.c b/tools/testing/selftests/bpf/test_verifier.c
+index f9d553fbf68a..ce97a9262698 100644
+--- a/tools/testing/selftests/bpf/test_verifier.c
++++ b/tools/testing/selftests/bpf/test_verifier.c
+@@ -1260,7 +1260,7 @@ static int get_xlated_program(int fd_prog, struct bpf_insn **buf, int *cnt)
+
+ bzero(&info, sizeof(info));
+ info.xlated_prog_len = xlated_prog_len;
+- info.xlated_prog_insns = (__u64)*buf;
++ info.xlated_prog_insns = (__u64)(unsigned long)*buf;
+ if (bpf_obj_get_info_by_fd(fd_prog, &info, &info_len)) {
+ perror("second bpf_obj_get_info_by_fd failed");
+ goto out_free_buf;
+--
+2.35.1
+
--- /dev/null
+From 5537f867cf1fca75eaa2b2ca1418ad4a36b232a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Nov 2022 09:58:57 +0800
+Subject: selftests/bpf: Fix test_progs compilation failure in 32-bit arch
+
+From: Yang Jihong <yangjihong1@huawei.com>
+
+[ Upstream commit 5704bc7e8991164b14efb748b5afa0715c25fac3 ]
+
+test_progs fails to be compiled in the 32-bit arch, log is as follows:
+
+ test_progs.c:1013:52: error: format '%ld' expects argument of type 'long int', but argument 3 has type 'size_t' {aka 'unsigned int'} [-Werror=format=]
+ 1013 | sprintf(buf, "MSG_TEST_LOG (cnt: %ld, last: %d)",
+ | ~~^
+ | |
+ | long int
+ | %d
+ 1014 | strlen(msg->test_log.log_buf),
+ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ | |
+ | size_t {aka unsigned int}
+
+Fix it.
+
+Fixes: 91b2c0afd00c ("selftests/bpf: Add parallelism to test_progs")
+Signed-off-by: Yang Jihong <yangjihong1@huawei.com>
+Acked-by: Yonghong Song <yhs@fb.com>
+Link: https://lore.kernel.org/r/20221108015857.132457-1-yangjihong1@huawei.com
+Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/test_progs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/bpf/test_progs.c b/tools/testing/selftests/bpf/test_progs.c
+index 3561c97701f2..a07b8ae64bf8 100644
+--- a/tools/testing/selftests/bpf/test_progs.c
++++ b/tools/testing/selftests/bpf/test_progs.c
+@@ -993,7 +993,7 @@ static inline const char *str_msg(const struct msg *msg, char *buf)
+ msg->subtest_done.have_log);
+ break;
+ case MSG_TEST_LOG:
+- sprintf(buf, "MSG_TEST_LOG (cnt: %ld, last: %d)",
++ sprintf(buf, "MSG_TEST_LOG (cnt: %zu, last: %d)",
+ strlen(msg->test_log.log_buf),
+ msg->test_log.is_last);
+ break;
+--
+2.35.1
+
--- /dev/null
+From ccef46beab3333b82a00f4cc3c2631c8f85482da Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Oct 2022 09:36:13 +0300
+Subject: serial: 8250: omap: Fix missing PM runtime calls for
+ omap8250_set_mctrl()
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit 93810191f5d23652c0b8a1a9b3a4a89d6fd5063e ]
+
+There are cases where omap8250_set_mctrl() may get called after the
+UART has already autoidled causing an asynchronous external abort.
+
+This can happen on ttyport_open():
+
+mem_serial_in from omap8250_set_mctrl+0x38/0xa0
+omap8250_set_mctrl from uart_update_mctrl+0x4c/0x58
+uart_update_mctrl from uart_dtr_rts+0x60/0xa8
+uart_dtr_rts from tty_port_block_til_ready+0xd0/0x2a8
+tty_port_block_til_ready from uart_open+0x14/0x1c
+uart_open from ttyport_open+0x64/0x148
+
+And on ttyport_close():
+
+omap8250_set_mctrl from uart_update_mctrl+0x3c/0x48
+uart_update_mctrl from uart_dtr_rts+0x54/0x9c
+uart_dtr_rts from tty_port_shutdown+0x78/0x9c
+tty_port_shutdown from tty_port_close+0x3c/0x74
+tty_port_close from ttyport_close+0x40/0x58
+
+It can also happen on disassociate_ctty() calling uart_shutdown()
+that ends up calling omap8250_set_mctrl().
+
+Let's fix the issue by adding missing PM runtime calls to
+omap8250_set_mctrl(). To do this, we need to add __omap8250_set_mctrl()
+that can be called from both omap8250_set_mctrl(), and from runtime PM
+resume path when restoring the registers.
+
+Fixes: 61929cf0169d ("tty: serial: Add 8250-core based omap driver")
+Reported-by: Merlijn Wajer <merlijn@wizzup.org>
+Reported-by: Romain Naour <romain.naour@smile.fr>
+Reported-by: Ivaylo Dimitrov <ivo.g.dimitrov.75@gmail.com>
+Tested-by: Ivaylo Dimitrov <ivo.g.dimitrov.75@gmail.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Depends-on: dd8088d5a896 ("PM: runtime: Add pm_runtime_resume_and_get to deal with usage counter")
+Link: https://lore.kernel.org/r/20221024063613.25943-1-tony@atomide.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/8250/8250_omap.c | 22 ++++++++++++++++++++--
+ 1 file changed, 20 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c
+index 38ee3e42251a..03a026bdba3c 100644
+--- a/drivers/tty/serial/8250/8250_omap.c
++++ b/drivers/tty/serial/8250/8250_omap.c
+@@ -157,7 +157,11 @@ static u32 uart_read(struct uart_8250_port *up, u32 reg)
+ return readl(up->port.membase + (reg << up->port.regshift));
+ }
+
+-static void omap8250_set_mctrl(struct uart_port *port, unsigned int mctrl)
++/*
++ * Called on runtime PM resume path from omap8250_restore_regs(), and
++ * omap8250_set_mctrl().
++ */
++static void __omap8250_set_mctrl(struct uart_port *port, unsigned int mctrl)
+ {
+ struct uart_8250_port *up = up_to_u8250p(port);
+ struct omap8250_priv *priv = up->port.private_data;
+@@ -181,6 +185,20 @@ static void omap8250_set_mctrl(struct uart_port *port, unsigned int mctrl)
+ }
+ }
+
++static void omap8250_set_mctrl(struct uart_port *port, unsigned int mctrl)
++{
++ int err;
++
++ err = pm_runtime_resume_and_get(port->dev);
++ if (err)
++ return;
++
++ __omap8250_set_mctrl(port, mctrl);
++
++ pm_runtime_mark_last_busy(port->dev);
++ pm_runtime_put_autosuspend(port->dev);
++}
++
+ /*
+ * Work Around for Errata i202 (2430, 3430, 3630, 4430 and 4460)
+ * The access to uart register after MDR1 Access
+@@ -341,7 +359,7 @@ static void omap8250_restore_regs(struct uart_8250_port *up)
+
+ omap8250_update_mdr1(up, priv);
+
+- up->port.ops->set_mctrl(&up->port, up->port.mctrl);
++ __omap8250_set_mctrl(&up->port, up->port.mctrl);
+
+ if (up->port.rs485.flags & SER_RS485_ENABLED)
+ serial8250_em485_stop_tx(up);
+--
+2.35.1
+
--- /dev/null
+From 0484ac24cfb4126283d63d7ecdb69fa5d4ccda7a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Oct 2022 13:58:13 +0300
+Subject: serial: 8250: omap: Fix unpaired pm_runtime_put_sync() in
+ omap8250_remove()
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit e3f0c638f428fd66b5871154b62706772045f91a ]
+
+On remove, we get an error for "Runtime PM usage count underflow!". I guess
+this driver is mostly built-in, and this issue has gone unnoticed for a
+while. Somehow I did not catch this issue with my earlier fix done with
+commit 4e0f5cc65098 ("serial: 8250_omap: Fix probe and remove for PM
+runtime").
+
+Fixes: 4e0f5cc65098 ("serial: 8250_omap: Fix probe and remove for PM runtime")
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Depends-on: dd8088d5a896 ("PM: runtime: Add pm_runtime_resume_and_get to deal with usage counter")
+Link: https://lore.kernel.org/r/20221028105813.54290-1-tony@atomide.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/8250/8250_omap.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c
+index c772735035b5..3ba1526ccd20 100644
+--- a/drivers/tty/serial/8250/8250_omap.c
++++ b/drivers/tty/serial/8250/8250_omap.c
+@@ -1461,6 +1461,11 @@ static int omap8250_probe(struct platform_device *pdev)
+ static int omap8250_remove(struct platform_device *pdev)
+ {
+ struct omap8250_priv *priv = platform_get_drvdata(pdev);
++ int err;
++
++ err = pm_runtime_resume_and_get(&pdev->dev);
++ if (err)
++ return err;
+
+ pm_runtime_dont_use_autosuspend(&pdev->dev);
+ pm_runtime_put_sync(&pdev->dev);
+--
+2.35.1
+
--- /dev/null
+From 7b904a04834e9fad624345461484a35cf690a48e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Oct 2022 14:00:44 +0300
+Subject: serial: 8250: omap: Flush PM QOS work on remove
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit d0b68629bd2fb61e0171a62f2e8da3db322f5cf6 ]
+
+Rebinding 8250_omap in a loop will at some point produce a warning for
+kernel/power/qos.c:296 cpu_latency_qos_update_request() with error
+"cpu_latency_qos_update_request called for unknown object". Let's flush
+the possibly pending PM QOS work scheduled from omap8250_runtime_suspend()
+before we disable runtime PM.
+
+Fixes: 61929cf0169d ("tty: serial: Add 8250-core based omap driver")
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Link: https://lore.kernel.org/r/20221028110044.54719-1-tony@atomide.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/8250/8250_omap.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c
+index 3ba1526ccd20..b96fbf8d31df 100644
+--- a/drivers/tty/serial/8250/8250_omap.c
++++ b/drivers/tty/serial/8250/8250_omap.c
+@@ -1469,6 +1469,7 @@ static int omap8250_remove(struct platform_device *pdev)
+
+ pm_runtime_dont_use_autosuspend(&pdev->dev);
+ pm_runtime_put_sync(&pdev->dev);
++ flush_work(&priv->qos_work);
+ pm_runtime_disable(&pdev->dev);
+ serial8250_unregister_port(priv->line);
+ cpu_latency_qos_remove_request(&priv->pm_qos_request);
+--
+2.35.1
+
--- /dev/null
+From 99c8ec2905c3d915faecf83c58c939407d919608 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Oct 2022 13:23:39 +0200
+Subject: serial: 8250_omap: remove wait loop from Errata i202 workaround
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Matthias Schiffer <matthias.schiffer@ew.tq-group.com>
+
+[ Upstream commit e828e56684d61b17317e0cfdef83791fa61cb76b ]
+
+We were occasionally seeing the "Errata i202: timedout" on an AM335x
+board when repeatedly opening and closing a UART connected to an active
+sender. As new input may arrive at any time, it is possible to miss the
+"RX FIFO empty" condition, forcing the loop to wait until it times out.
+
+Nothing in the i202 Advisory states that such a wait is even necessary;
+other FIFO clear functions like serial8250_clear_fifos() do not wait
+either. For this reason, it seems safe to remove the wait, fixing the
+mentioned issue.
+
+Fixes: 61929cf0169d ("tty: serial: Add 8250-core based omap driver")
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Matthias Schiffer <matthias.schiffer@ew.tq-group.com>
+Link: https://lore.kernel.org/r/20221013112339.2540767-1-matthias.schiffer@ew.tq-group.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/8250/8250_omap.c | 17 -----------------
+ 1 file changed, 17 deletions(-)
+
+diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c
+index 03a026bdba3c..c772735035b5 100644
+--- a/drivers/tty/serial/8250/8250_omap.c
++++ b/drivers/tty/serial/8250/8250_omap.c
+@@ -211,27 +211,10 @@ static void omap8250_set_mctrl(struct uart_port *port, unsigned int mctrl)
+ static void omap_8250_mdr1_errataset(struct uart_8250_port *up,
+ struct omap8250_priv *priv)
+ {
+- u8 timeout = 255;
+-
+ serial_out(up, UART_OMAP_MDR1, priv->mdr1);
+ udelay(2);
+ serial_out(up, UART_FCR, up->fcr | UART_FCR_CLEAR_XMIT |
+ UART_FCR_CLEAR_RCVR);
+- /*
+- * Wait for FIFO to empty: when empty, RX_FIFO_E bit is 0 and
+- * TX_FIFO_E bit is 1.
+- */
+- while (UART_LSR_THRE != (serial_in(up, UART_LSR) &
+- (UART_LSR_THRE | UART_LSR_DR))) {
+- timeout--;
+- if (!timeout) {
+- /* Should *never* happen. we warn and carry on */
+- dev_crit(up->port.dev, "Errata i202: timedout %x\n",
+- serial_in(up, UART_LSR));
+- break;
+- }
+- udelay(1);
+- }
+ }
+
+ static void omap_8250_get_divisor(struct uart_port *port, unsigned int baud,
+--
+2.35.1
+
--- /dev/null
+From 49d00dc6498bb384342b2193ab9e0fb754ab12a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Oct 2022 20:13:53 +0800
+Subject: serial: imx: Add missing .thaw_noirq hook
+
+From: Shawn Guo <shawn.guo@linaro.org>
+
+[ Upstream commit 4561d8008a467cb05ac632a215391d6b787f40aa ]
+
+The following warning is seen with non-console UART instance when
+system hibernates.
+
+[ 37.371969] ------------[ cut here ]------------
+[ 37.376599] uart3_root_clk already disabled
+[ 37.380810] WARNING: CPU: 0 PID: 296 at drivers/clk/clk.c:952 clk_core_disable+0xa4/0xb0
+...
+[ 37.506986] Call trace:
+[ 37.509432] clk_core_disable+0xa4/0xb0
+[ 37.513270] clk_disable+0x34/0x50
+[ 37.516672] imx_uart_thaw+0x38/0x5c
+[ 37.520250] platform_pm_thaw+0x30/0x6c
+[ 37.524089] dpm_run_callback.constprop.0+0x3c/0xd4
+[ 37.528972] device_resume+0x7c/0x160
+[ 37.532633] dpm_resume+0xe8/0x230
+[ 37.536036] hibernation_snapshot+0x288/0x430
+[ 37.540397] hibernate+0x10c/0x2e0
+[ 37.543798] state_store+0xc4/0xd0
+[ 37.547203] kobj_attr_store+0x1c/0x30
+[ 37.550953] sysfs_kf_write+0x48/0x60
+[ 37.554619] kernfs_fop_write_iter+0x118/0x1ac
+[ 37.559063] new_sync_write+0xe8/0x184
+[ 37.562812] vfs_write+0x230/0x290
+[ 37.566214] ksys_write+0x68/0xf4
+[ 37.569529] __arm64_sys_write+0x20/0x2c
+[ 37.573452] invoke_syscall.constprop.0+0x50/0xf0
+[ 37.578156] do_el0_svc+0x11c/0x150
+[ 37.581648] el0_svc+0x30/0x140
+[ 37.584792] el0t_64_sync_handler+0xe8/0xf0
+[ 37.588976] el0t_64_sync+0x1a0/0x1a4
+[ 37.592639] ---[ end trace 56e22eec54676d75 ]---
+
+On hibernating, pm core calls into related hooks in sequence like:
+
+ .freeze
+ .freeze_noirq
+ .thaw_noirq
+ .thaw
+
+With .thaw_noirq hook being absent, the clock will be disabled in a
+unbalanced call which results the warning above.
+
+ imx_uart_freeze()
+ clk_prepare_enable()
+ imx_uart_suspend_noirq()
+ clk_disable()
+ imx_uart_thaw
+ clk_disable_unprepare()
+
+Adding the missing .thaw_noirq hook as imx_uart_resume_noirq() will have
+the call sequence corrected as below and thus fix the warning.
+
+ imx_uart_freeze()
+ clk_prepare_enable()
+ imx_uart_suspend_noirq()
+ clk_disable()
+ imx_uart_resume_noirq()
+ clk_enable()
+ imx_uart_thaw
+ clk_disable_unprepare()
+
+Fixes: 09df0b3464e5 ("serial: imx: fix endless loop during suspend")
+Reviewed-by: Martin Kaiser <martin@kaiser.cx>
+Signed-off-by: Shawn Guo <shawn.guo@linaro.org>
+Link: https://lore.kernel.org/r/20221012121353.2346280-1-shawn.guo@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/imx.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c
+index 278b4033a3cc..57e3fda979ea 100644
+--- a/drivers/tty/serial/imx.c
++++ b/drivers/tty/serial/imx.c
+@@ -2594,6 +2594,7 @@ static const struct dev_pm_ops imx_uart_pm_ops = {
+ .suspend_noirq = imx_uart_suspend_noirq,
+ .resume_noirq = imx_uart_resume_noirq,
+ .freeze_noirq = imx_uart_suspend_noirq,
++ .thaw_noirq = imx_uart_resume_noirq,
+ .restore_noirq = imx_uart_resume_noirq,
+ .suspend = imx_uart_suspend,
+ .resume = imx_uart_resume,
+--
+2.35.1
+
kvm-svm-do-not-allocate-struct-svm_cpu_data-dynamica.patch
kvm-svm-restore-host-save-area-from-assembly.patch
kvm-svm-move-msr_ia32_spec_ctrl-save-restore-to-asse.patch
+arm64-dts-qcom-ipq8074-correct-apcs-register-space-s.patch
+arm64-dts-qcom-sa8155p-adp-specify-which-ldo-modes-a.patch
+arm64-dts-qcom-sa8295p-adp-specify-which-ldo-modes-a.patch
+arm64-dts-qcom-sc8280xp-crd-specify-which-ldo-modes-.patch
+arm64-dts-qcom-sm8150-xperia-kumano-specify-which-ld.patch
+arm64-dts-qcom-sm8250-xperia-edo-specify-which-ldo-m.patch
+arm64-dts-qcom-sm8350-hdk-specify-which-ldo-modes-ar.patch
+arm64-dts-qcom-sc8280xp-fix-ufs_card_phy-ref-clock.patch
+arm64-dts-qcom-sc8280xp-correct-ref-clock-for-ufs_me.patch
+arm64-dts-qcom-sc8280xp-fix-usb0-phy-pcs_misc-regist.patch
+arm64-dts-qcom-sc8280xp-fix-usb1-phy-rx1-registers.patch
+arm64-dts-qcom-sc8280xp-fix-usb-phy-pcs-registers.patch
+arm64-dts-qcom-sc8280xp-drop-broken-dp-phy-nodes.patch
+arm64-dts-qcom-sc8280xp-fix-ufs-phy-serdes-size.patch
+arm64-dts-qcom-sc7280-add-the-reset-reg-for-lpass-au.patch
+spi-stm32-print-summary-callbacks-suppressed-message.patch
+arm-dts-at91-sama7g5-fix-signal-name-of-pin-pb2.patch
+asoc-core-fix-use-after-free-in-snd_soc_exit.patch
+asoc-fsl_asrc-fsl_esai-fsl_sai-allow-config_pm-n.patch
+arm64-dts-qcom-sm8250-disable-the-not-yet-supported-.patch
+asoc-tas2770-fix-set_tdm_slot-in-case-of-single-slot.patch
+asoc-tas2764-fix-set_tdm_slot-in-case-of-single-slot.patch
+asoc-tas2780-fix-set_tdm_slot-in-case-of-single-slot.patch
+arm-at91-pm-avoid-soft-resetting-ac-dll.patch
+serial-8250-omap-fix-missing-pm-runtime-calls-for-om.patch
+serial-8250_omap-remove-wait-loop-from-errata-i202-w.patch
+serial-8250-omap-fix-unpaired-pm_runtime_put_sync-in.patch
+serial-8250-omap-flush-pm-qos-work-on-remove.patch
+tty-serial-fsl_lpuart-don-t-break-the-on-going-trans.patch
+serial-imx-add-missing-.thaw_noirq-hook.patch
+tty-n_gsm-fix-sleep-in-atomic-context-bug-in-gsm_con.patch
+asoc-rt5514-fix-legacy-dai-naming.patch
+asoc-rt5677-fix-legacy-dai-naming.patch
+bpf-test_run-fix-alignment-problem-in-bpf_prog_test_.patch
+bnxt_en-refactor-bnxt_cancel_reservations.patch
+bnxt_en-fix-the-handling-of-pcie-aer.patch
+asoc-soc-utils-remove-__exit-for-snd_soc_util_exit.patch
+pinctrl-rockchip-list-all-pins-in-a-possible-mux-rou.patch
+mtd-onenand-omap2-add-dependency-on-gpmc.patch
+scsi-scsi_transport_sas-fix-error-handling-in-sas_ph.patch
+sctp-remove-the-unnecessary-sinfo_stream-check-in-sc.patch
+sctp-clear-out_curr-if-all-frag-chunks-of-current-ms.patch
+erofs-clean-up-.read_folio-and-.readahead-in-fscache.patch
+erofs-get-correct-count-for-unmapped-range-in-fscach.patch
+block-sed-opal-kmalloc-the-cmd-resp-buffers.patch
+nfsd-put-the-export-reference-in-nfsd4_verify_deleg_.patch
+bpf-fix-memory-leaks-in-__check_func_call.patch
+io_uring-calculate-cqes-from-the-user-visible-value.patch
+pinctrl-mediatek-common-v2-fix-bias-disable-for-pull.patch
+arm64-fix-bit-shifting-ub-in-the-midr_cpu_model-macr.patch
+nvmet-fix-a-memory-leak.patch
+siox-fix-possible-memory-leak-in-siox_device_add.patch
+parport_pc-avoid-fifo-port-location-truncation.patch
+selftests-bpf-fix-casting-error-when-cross-compiling.patch
+selftests-bpf-fix-test_progs-compilation-failure-in-.patch
+pinctrl-devicetree-fix-null-pointer-dereferencing-in.patch
+drm-vc4-kms-fix-is_err-vs-null-check-for-vc4_kms.patch
+drm-panel-simple-set-bpc-field-for-logic-technologie.patch
+drm-drv-fix-potential-memory-leak-in-drm_dev_init.patch
+drm-fix-potential-null-ptr-deref-in-drm_vblank_destr.patch
+arm64-dts-imx8mm-tqma8mqml-mba8mx-fix-usb-dr.patch
+arm-dts-imx7-fix-nand-controller-size-cells.patch
+arm64-dts-imx8mm-fix-nand-controller-size-cells.patch
+erofs-put-metabuf-in-error-path-in-fscache-mode.patch
+arm64-dts-imx8mn-fix-nand-controller-size-cells.patch
+arm64-dts-imx93-pinfunc-drop-execution-permission.patch
+ata-libata-transport-fix-double-ata_host_put-in-ata_.patch
+ata-libata-transport-fix-error-handling-in-ata_tport.patch
+ata-libata-transport-fix-error-handling-in-ata_tlink.patch
+ata-libata-transport-fix-error-handling-in-ata_tdev_.patch
+nfp-change-eeprom-length-to-max-length-enumerators.patch
+mips-fix-duplicate-definitions-for-exported-symbols.patch
+mips-loongson64-add-warn_on-on-kexec-related-kmalloc.patch
+io_uring-poll-fix-double-poll-req-flags-races.patch
+cifs-fix-connections-leak-when-tlink-setup-failed.patch
+bpf-initialize-same-number-of-free-nodes-for-each-pc.patch
+ata-libata-core-do-not-issue-non-internal-commands-o.patch
+net-bgmac-drop-free_netdev-from-bgmac_enet_remove.patch
+misdn-fix-possible-memory-leak-in-misdn_dsp_element_.patch
+net-hinic-fix-error-handling-in-hinic_module_init.patch
+net-phy-dp83867-fix-sgmii-fifo-depth-for-non-of-devi.patch
+net-stmmac-ensure-tx-function-is-not-running-in-stmm.patch
+mctp-i2c-don-t-count-unused-invalid-keys-for-flow-re.patch
+soc-imx8m-enable-ocotp-clock-before-reading-the-regi.patch
+net-liquidio-release-resources-when-liquidio-driver-.patch
+misdn-fix-misuse-of-put_device-in-misdn_register_dev.patch
+net-macvlan-use-built-in-rcu-list-checking.patch
+net-caif-fix-double-disconnect-client-in-chnl_net_op.patch
+bnxt_en-remove-debugfs-when-pci_register_driver-fail.patch
+octeon_ep-delete-unnecessary-napi-rollback-under-set.patch
+octeon_ep-ensure-octep_get_link_status-successfully-.patch
+octeon_ep-fix-potential-memory-leak-in-octep_device_.patch
+octeon_ep-ensure-get-mac-address-successfully-before.patch
+drm-lima-fix-opp-clkname-setting-in-case-of-missing-.patch
+net-mhi-fix-memory-leak-in-mhi_net_dellink.patch
+net-dsa-make-dsa_master_ioctl-see-through-port_hwtst.patch
+xen-pcpu-fix-possible-memory-leak-in-register_pcpu.patch
+erofs-fix-missing-xas_retry-in-fscache-mode.patch
+mlxsw-avoid-warnings-when-not-offloaded-fdb-entry-wi.patch
+net-ionic-fix-error-handling-in-ionic_init_module.patch
+kcm-close-race-conditions-on-sk_receive_queue.patch
+net-ena-fix-error-handling-in-ena_init.patch
+net-hns3-fix-incorrect-hw-rss-hash-type-of-rx-packet.patch
+net-hns3-fix-return-value-check-bug-of-rx-copybreak.patch
+net-hns3-fix-setting-incorrect-phy-link-ksettings-fo.patch
+bridge-switchdev-fix-memory-leaks-when-changing-vlan.patch
+drbd-use-after-free-in-drbd_create_device.patch
+platform-x86-intel-pmc-don-t-unconditionally-attach-.patch
+platform-surface-aggregator-do-not-check-for-repeate.patch
+netfs-fix-missing-xas_retry-calls-in-xarray-iteratio.patch
+netfs-fix-dodgy-maths.patch
+cifs-add-check-for-returning-value-of-smb2_close_ini.patch
+net-ag71xx-call-phylink_disconnect_phy-if-ag71xx_hw_.patch
+net-x25-fix-skb-leak-in-x25_lapb_receive_frame.patch
+net-dsa-don-t-leak-tagger-owned-storage-on-switch-dr.patch
+nvmet-fix-a-memory-leak-in-nvmet_auth_set_key.patch
+cifs-fix-wrong-return-value-checking-when-getflags.patch
+net-lan966x-fix-potential-null-ptr-deref-in-lan966x_.patch
+net-microchip-sparx5-fix-potential-null-ptr-deref-in.patch
+net-thunderbolt-fix-error-handling-in-tbnet_init.patch
+s390-avoid-using-global-register-for-current_stack_p.patch
+l2tp-serialize-access-to-sk_user_data-with-sk_callba.patch
+cifs-add-check-for-returning-value-of-smb2_set_info_.patch
+netdevsim-fix-memory-leak-of-nsim_dev-fa_cookie.patch
+block-make-dma_alignment-a-stacking-queue_limit.patch
+dm-crypt-provide-dma_alignment-limit-in-io_hints.patch
--- /dev/null
+From acf348aa80ddb307ccfcca224685be14a81296f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Nov 2022 10:13:34 +0800
+Subject: siox: fix possible memory leak in siox_device_add()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit 6e63153db50059fb78b8a8447b132664887d24e3 ]
+
+If device_register() returns error in siox_device_add(),
+the name allocated by dev_set_name() need be freed. As
+comment of device_register() says, it should use put_device()
+to give up the reference in the error path. So fix this
+by calling put_device(), then the name can be freed in
+kobject_cleanup(), and sdevice is freed in siox_device_release(),
+set it to null in error path.
+
+Fixes: bbecb07fa0af ("siox: new driver framework for eckelmann SIOX")
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Reviewed-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Link: https://lore.kernel.org/r/20221104021334.618189-1-yangyingliang@huawei.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/siox/siox-core.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/siox/siox-core.c b/drivers/siox/siox-core.c
+index 7c4f32d76966..561408583b2b 100644
+--- a/drivers/siox/siox-core.c
++++ b/drivers/siox/siox-core.c
+@@ -839,6 +839,8 @@ static struct siox_device *siox_device_add(struct siox_master *smaster,
+
+ err_device_register:
+ /* don't care to make the buffer smaller again */
++ put_device(&sdevice->dev);
++ sdevice = NULL;
+
+ err_buf_alloc:
+ siox_master_unlock(smaster);
+--
+2.35.1
+
--- /dev/null
+From 060ca32c3a095011a93240925289d4848addfe79 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Oct 2022 12:14:18 +0800
+Subject: soc: imx8m: Enable OCOTP clock before reading the register
+
+From: Xiaolei Wang <xiaolei.wang@windriver.com>
+
+[ Upstream commit 836fb30949d9edf91d7de696a884ceeae7e426d2 ]
+
+Commit 7d981405d0fd ("soc: imx8m: change to use platform driver") ever
+removed the dependency on bootloader for enabling OCOTP clock. It
+helped to fix a kexec kernel hang issue. But unfortunately it caused
+a regression on CAAM driver and got reverted.
+
+This is the second try to enable the OCOTP clock by directly calling
+clock API instead of indirectly enabling the clock via nvmem API.
+
+Fixes: ac34de14ac30 ("Revert "soc: imx8m: change to use platform driver"")
+Signed-off-by: Xiaolei Wang <xiaolei.wang@windriver.com>
+Reviewed-by: Lucas Stach <l.stach@pengutronix.de>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/imx/soc-imx8m.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/drivers/soc/imx/soc-imx8m.c b/drivers/soc/imx/soc-imx8m.c
+index cc57a384d74d..28144c699b0c 100644
+--- a/drivers/soc/imx/soc-imx8m.c
++++ b/drivers/soc/imx/soc-imx8m.c
+@@ -11,6 +11,7 @@
+ #include <linux/platform_device.h>
+ #include <linux/arm-smccc.h>
+ #include <linux/of.h>
++#include <linux/clk.h>
+
+ #define REV_B1 0x21
+
+@@ -56,6 +57,7 @@ static u32 __init imx8mq_soc_revision(void)
+ void __iomem *ocotp_base;
+ u32 magic;
+ u32 rev;
++ struct clk *clk;
+
+ np = of_find_compatible_node(NULL, NULL, "fsl,imx8mq-ocotp");
+ if (!np)
+@@ -63,6 +65,13 @@ static u32 __init imx8mq_soc_revision(void)
+
+ ocotp_base = of_iomap(np, 0);
+ WARN_ON(!ocotp_base);
++ clk = of_clk_get_by_name(np, NULL);
++ if (!clk) {
++ WARN_ON(!clk);
++ return 0;
++ }
++
++ clk_prepare_enable(clk);
+
+ /*
+ * SOC revision on older imx8mq is not available in fuses so query
+@@ -79,6 +88,8 @@ static u32 __init imx8mq_soc_revision(void)
+ soc_uid <<= 32;
+ soc_uid |= readl_relaxed(ocotp_base + OCOTP_UID_LOW);
+
++ clk_disable_unprepare(clk);
++ clk_put(clk);
+ iounmap(ocotp_base);
+ of_node_put(np);
+
+--
+2.35.1
+
--- /dev/null
+From 223d99d575a4b393287b74f4df56b03c84a2652e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Oct 2022 20:35:13 +0200
+Subject: spi: stm32: Print summary 'callbacks suppressed' message
+
+From: Marek Vasut <marex@denx.de>
+
+[ Upstream commit 195583504be28df5d608a4677dd796117aea875f ]
+
+The original fix "spi: stm32: Rate-limit the 'Communication suspended' message"
+still leads to "stm32h7_spi_irq_thread: 1696 callbacks suppressed" spew in the
+kernel log. Since this 'Communication suspended' message is a debug print, add
+RATELIMIT_MSG_ON_RELEASE flag to inhibit the "callbacks suspended" part during
+normal operation and only print summary at the end.
+
+Fixes: ea8be08cc9358 ("spi: stm32: Rate-limit the 'Communication suspended' message")
+Signed-off-by: Marek Vasut <marex@denx.de>
+Link: https://lore.kernel.org/r/20221018183513.206706-1-marex@denx.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-stm32.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c
+index 6fe617b445a5..3c2fa2e2f94a 100644
+--- a/drivers/spi/spi-stm32.c
++++ b/drivers/spi/spi-stm32.c
+@@ -886,6 +886,7 @@ static irqreturn_t stm32h7_spi_irq_thread(int irq, void *dev_id)
+ static DEFINE_RATELIMIT_STATE(rs,
+ DEFAULT_RATELIMIT_INTERVAL * 10,
+ 1);
++ ratelimit_set_flags(&rs, RATELIMIT_MSG_ON_RELEASE);
+ if (__ratelimit(&rs))
+ dev_dbg_ratelimited(spi->dev, "Communication suspended\n");
+ if (!spi->cur_usedma && (spi->rx_buf && (spi->rx_len > 0)))
+--
+2.35.1
+
--- /dev/null
+From 7f4e8b4508a832cb66c141664f6bac4b17c9a2a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 2 Oct 2022 12:07:09 +0800
+Subject: tty: n_gsm: fix sleep-in-atomic-context bug in gsm_control_send
+
+From: Duoming Zhou <duoming@zju.edu.cn>
+
+[ Upstream commit 7b7dfe4833c70a11cdfa51b38705103bd31eddaa ]
+
+The function gsm_dlci_t1() is a timer handler that runs in an
+atomic context, but it calls "kzalloc(..., GFP_KERNEL)" that
+may sleep. As a result, the sleep-in-atomic-context bug will
+happen. The process is shown below:
+
+gsm_dlci_t1()
+ gsm_dlci_open()
+ gsm_modem_update()
+ gsm_modem_upd_via_msc()
+ gsm_control_send()
+ kzalloc(sizeof(.., GFP_KERNEL) //may sleep
+
+This patch changes the gfp_t parameter of kzalloc() from GFP_KERNEL to
+GFP_ATOMIC in order to mitigate the bug.
+
+Fixes: e1eaea46bb40 ("tty: n_gsm line discipline")
+Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
+Link: https://lore.kernel.org/r/20221002040709.27849-1-duoming@zju.edu.cn
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/n_gsm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
+index 01c112e2e214..2a0de70e0be4 100644
+--- a/drivers/tty/n_gsm.c
++++ b/drivers/tty/n_gsm.c
+@@ -1670,7 +1670,7 @@ static struct gsm_control *gsm_control_send(struct gsm_mux *gsm,
+ unsigned int command, u8 *data, int clen)
+ {
+ struct gsm_control *ctrl = kzalloc(sizeof(struct gsm_control),
+- GFP_KERNEL);
++ GFP_ATOMIC);
+ unsigned long flags;
+ if (ctrl == NULL)
+ return NULL;
+--
+2.35.1
+
--- /dev/null
+From a6377af606c72dcc78ba51d83b85b904e667a6f8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Oct 2022 16:58:44 +0800
+Subject: tty: serial: fsl_lpuart: don't break the on-going transfer when
+ global reset
+
+From: Sherry Sun <sherry.sun@nxp.com>
+
+[ Upstream commit 76bad3f88750f8cc465c489e6846249e0bc3d8f5 ]
+
+lpuart_global_reset() shouldn't break the on-going transmit engine, need
+to recover the on-going data transfer after reset.
+
+This can help earlycon here, since commit 60f361722ad2 ("serial:
+fsl_lpuart: Reset prior to registration") moved lpuart_global_reset()
+before uart_add_one_port(), earlycon is writing during global reset,
+as global reset will disable the TX and clear the baud rate register,
+which caused the earlycon cannot work any more after reset, needs to
+restore the baud rate and re-enable the transmitter to recover the
+earlycon write.
+
+Also move the lpuart_global_reset() down, then we can reuse the
+lpuart32_tx_empty() without declaration.
+
+Fixes: bd5305dcabbc ("tty: serial: fsl_lpuart: do software reset for imx7ulp and imx8qxp")
+Signed-off-by: Sherry Sun <sherry.sun@nxp.com>
+Link: https://lore.kernel.org/r/20221024085844.22786-1-sherry.sun@nxp.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/fsl_lpuart.c | 76 +++++++++++++++++++++------------
+ 1 file changed, 49 insertions(+), 27 deletions(-)
+
+diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
+index 34990901c805..c8297102e087 100644
+--- a/drivers/tty/serial/fsl_lpuart.c
++++ b/drivers/tty/serial/fsl_lpuart.c
+@@ -12,6 +12,7 @@
+ #include <linux/dmaengine.h>
+ #include <linux/dmapool.h>
+ #include <linux/io.h>
++#include <linux/iopoll.h>
+ #include <linux/irq.h>
+ #include <linux/module.h>
+ #include <linux/of.h>
+@@ -404,33 +405,6 @@ static unsigned int lpuart_get_baud_clk_rate(struct lpuart_port *sport)
+ #define lpuart_enable_clks(x) __lpuart_enable_clks(x, true)
+ #define lpuart_disable_clks(x) __lpuart_enable_clks(x, false)
+
+-static int lpuart_global_reset(struct lpuart_port *sport)
+-{
+- struct uart_port *port = &sport->port;
+- void __iomem *global_addr;
+- int ret;
+-
+- if (uart_console(port))
+- return 0;
+-
+- ret = clk_prepare_enable(sport->ipg_clk);
+- if (ret) {
+- dev_err(sport->port.dev, "failed to enable uart ipg clk: %d\n", ret);
+- return ret;
+- }
+-
+- if (is_imx7ulp_lpuart(sport) || is_imx8qxp_lpuart(sport)) {
+- global_addr = port->membase + UART_GLOBAL - IMX_REG_OFF;
+- writel(UART_GLOBAL_RST, global_addr);
+- usleep_range(GLOBAL_RST_MIN_US, GLOBAL_RST_MAX_US);
+- writel(0, global_addr);
+- usleep_range(GLOBAL_RST_MIN_US, GLOBAL_RST_MAX_US);
+- }
+-
+- clk_disable_unprepare(sport->ipg_clk);
+- return 0;
+-}
+-
+ static void lpuart_stop_tx(struct uart_port *port)
+ {
+ unsigned char temp;
+@@ -2641,6 +2615,54 @@ static const struct serial_rs485 lpuart_rs485_supported = {
+ /* delay_rts_* and RX_DURING_TX are not supported */
+ };
+
++static int lpuart_global_reset(struct lpuart_port *sport)
++{
++ struct uart_port *port = &sport->port;
++ void __iomem *global_addr;
++ unsigned long ctrl, bd;
++ unsigned int val = 0;
++ int ret;
++
++ ret = clk_prepare_enable(sport->ipg_clk);
++ if (ret) {
++ dev_err(sport->port.dev, "failed to enable uart ipg clk: %d\n", ret);
++ return ret;
++ }
++
++ if (is_imx7ulp_lpuart(sport) || is_imx8qxp_lpuart(sport)) {
++ /*
++ * If the transmitter is used by earlycon, wait for transmit engine to
++ * complete and then reset.
++ */
++ ctrl = lpuart32_read(port, UARTCTRL);
++ if (ctrl & UARTCTRL_TE) {
++ bd = lpuart32_read(&sport->port, UARTBAUD);
++ if (read_poll_timeout(lpuart32_tx_empty, val, val, 1, 100000, false,
++ port)) {
++ dev_warn(sport->port.dev,
++ "timeout waiting for transmit engine to complete\n");
++ clk_disable_unprepare(sport->ipg_clk);
++ return 0;
++ }
++ }
++
++ global_addr = port->membase + UART_GLOBAL - IMX_REG_OFF;
++ writel(UART_GLOBAL_RST, global_addr);
++ usleep_range(GLOBAL_RST_MIN_US, GLOBAL_RST_MAX_US);
++ writel(0, global_addr);
++ usleep_range(GLOBAL_RST_MIN_US, GLOBAL_RST_MAX_US);
++
++ /* Recover the transmitter for earlycon. */
++ if (ctrl & UARTCTRL_TE) {
++ lpuart32_write(port, bd, UARTBAUD);
++ lpuart32_write(port, ctrl, UARTCTRL);
++ }
++ }
++
++ clk_disable_unprepare(sport->ipg_clk);
++ return 0;
++}
++
+ static int lpuart_probe(struct platform_device *pdev)
+ {
+ const struct lpuart_soc_data *sdata = of_device_get_match_data(&pdev->dev);
+--
+2.35.1
+
--- /dev/null
+From 53cb34088e28a620b0b28e76525037bbbdf7251f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Nov 2022 23:24:41 +0800
+Subject: xen/pcpu: fix possible memory leak in register_pcpu()
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit da36a2a76b01b210ffaa55cdc2c99bc8783697c5 ]
+
+In device_add(), dev_set_name() is called to allocate name, if it returns
+error, the name need be freed. As comment of device_register() says, it
+should use put_device() to give up the reference in the error path. So fix
+this by calling put_device(), then the name can be freed in kobject_cleanup().
+
+Fixes: f65c9bb3fb72 ("xen/pcpu: Xen physical cpus online/offline sys interface")
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Reviewed-by: Juergen Gross <jgross@suse.com>
+Link: https://lore.kernel.org/r/20221110152441.401630-1-yangyingliang@huawei.com
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/xen/pcpu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/xen/pcpu.c b/drivers/xen/pcpu.c
+index 47aa3a1ccaf5..fd3a644b0855 100644
+--- a/drivers/xen/pcpu.c
++++ b/drivers/xen/pcpu.c
+@@ -228,7 +228,7 @@ static int register_pcpu(struct pcpu *pcpu)
+
+ err = device_register(dev);
+ if (err) {
+- pcpu_release(dev);
++ put_device(dev);
+ return err;
+ }
+
+--
+2.35.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
