--- /dev/null
+From 76d46f55bc71e5fcf2d20d7761359aedad105c71 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Nov 2023 16:26:59 +0000
+Subject: afs: Fix afs_server_list to be cleaned up with RCU
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit e6bace7313d61e31f2b16fa3d774fd8cb3cb869e ]
+
+afs_server_list is accessed with the rcu_read_lock() held from
+volume->servers, so it needs to be cleaned up correctly.
+
+Fix this by using kfree_rcu() instead of kfree().
+
+Fixes: 8a070a964877 ("afs: Detect cell aliases 1 - Cells with root volumes")
+Signed-off-by: David Howells <dhowells@redhat.com>
+cc: Marc Dionne <marc.dionne@auristor.com>
+cc: linux-afs@lists.infradead.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/afs/internal.h | 1 +
+ fs/afs/server_list.c | 2 +-
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/fs/afs/internal.h b/fs/afs/internal.h
+index 637cbe549397c..31c7a562147c2 100644
+--- a/fs/afs/internal.h
++++ b/fs/afs/internal.h
+@@ -546,6 +546,7 @@ struct afs_server_entry {
+ };
+
+ struct afs_server_list {
++ struct rcu_head rcu;
+ afs_volid_t vids[AFS_MAXTYPES]; /* Volume IDs */
+ refcount_t usage;
+ unsigned char nr_servers;
+diff --git a/fs/afs/server_list.c b/fs/afs/server_list.c
+index ed9056703505f..b59896b1de0af 100644
+--- a/fs/afs/server_list.c
++++ b/fs/afs/server_list.c
+@@ -17,7 +17,7 @@ void afs_put_serverlist(struct afs_net *net, struct afs_server_list *slist)
+ for (i = 0; i < slist->nr_servers; i++)
+ afs_unuse_server(net, slist->servers[i].server,
+ afs_server_trace_put_slist);
+- kfree(slist);
++ kfree_rcu(slist, rcu);
+ }
+ }
+
+--
+2.42.0
+
--- /dev/null
+From b56a65e7ae95aa8b9745cb1418c746c601f00328 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Nov 2023 22:03:28 +0000
+Subject: afs: Fix file locking on R/O volumes to operate in local mode
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit b590eb41be766c5a63acc7e8896a042f7a4e8293 ]
+
+AFS doesn't really do locking on R/O volumes as fileservers don't maintain
+state with each other and thus a lock on a R/O volume file on one
+fileserver will not be be visible to someone looking at the same file on
+another fileserver.
+
+Further, the server may return an error if you try it.
+
+Fix this by doing what other AFS clients do and handle filelocking on R/O
+volume files entirely within the client and don't touch the server.
+
+Fixes: 6c6c1d63c243 ("afs: Provide mount-time configurable byte-range file locking emulation")
+Signed-off-by: David Howells <dhowells@redhat.com>
+Reviewed-by: Marc Dionne <marc.dionne@auristor.com>
+cc: linux-afs@lists.infradead.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/afs/super.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/afs/super.c b/fs/afs/super.c
+index e38bb1e7a4d22..1b62a99b36731 100644
+--- a/fs/afs/super.c
++++ b/fs/afs/super.c
+@@ -406,6 +406,8 @@ static int afs_validate_fc(struct fs_context *fc)
+ return PTR_ERR(volume);
+
+ ctx->volume = volume;
++ if (volume->type != AFSVL_RWVOL)
++ ctx->flock_mode = afs_flock_mode_local;
+ }
+
+ return 0;
+--
+2.42.0
+
--- /dev/null
+From 9c4e2f0888251ba97ae68a1f553cc1099de1b0de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Jun 2023 09:43:54 +0100
+Subject: afs: Make error on cell lookup failure consistent with OpenAFS
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit 2a4ca1b4b77850544408595e2433f5d7811a9daa ]
+
+When kafs tries to look up a cell in the DNS or the local config, it will
+translate a lookup failure into EDESTADDRREQ whereas OpenAFS translates it
+into ENOENT. Applications such as West expect the latter behaviour and
+fail if they see the former.
+
+This can be seen by trying to mount an unknown cell:
+
+ # mount -t afs %example.com:cell.root /mnt
+ mount: /mnt: mount(2) system call failed: Destination address required.
+
+Fixes: 4d673da14533 ("afs: Support the AFS dynamic root")
+Reported-by: Markus Suvanto <markus.suvanto@gmail.com>
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=216637
+Signed-off-by: David Howells <dhowells@redhat.com>
+Reviewed-by: Jeffrey Altman <jaltman@auristor.com>
+cc: Marc Dionne <marc.dionne@auristor.com>
+cc: linux-afs@lists.infradead.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/afs/dynroot.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/afs/dynroot.c b/fs/afs/dynroot.c
+index db832cc931c87..b35c6081dbfe1 100644
+--- a/fs/afs/dynroot.c
++++ b/fs/afs/dynroot.c
+@@ -131,8 +131,8 @@ static int afs_probe_cell_name(struct dentry *dentry)
+
+ ret = dns_query(net->net, "afsdb", name, len, "srv=1",
+ NULL, NULL, false);
+- if (ret == -ENODATA)
+- ret = -EDESTADDRREQ;
++ if (ret == -ENODATA || ret == -ENOKEY)
++ ret = -ENOENT;
+ return ret;
+ }
+
+--
+2.42.0
+
--- /dev/null
+From 22e81497cb6de33a3e11171f8c4759b10b3456e1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Oct 2023 01:25:07 +0100
+Subject: afs: Return ENOENT if no cell DNS record can be found
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit 0167236e7d66c5e1e85d902a6abc2529b7544539 ]
+
+Make AFS return error ENOENT if no cell SRV or AFSDB DNS record (or
+cellservdb config file record) can be found rather than returning
+EDESTADDRREQ.
+
+Also add cell name lookup info to the cursor dump.
+
+Fixes: d5c32c89b208 ("afs: Fix cell DNS lookup")
+Reported-by: Markus Suvanto <markus.suvanto@gmail.com>
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=216637
+Signed-off-by: David Howells <dhowells@redhat.com>
+Reviewed-by: Marc Dionne <marc.dionne@auristor.com>
+cc: linux-afs@lists.infradead.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/afs/vl_rotate.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/fs/afs/vl_rotate.c b/fs/afs/vl_rotate.c
+index 488e58490b16e..eb415ce563600 100644
+--- a/fs/afs/vl_rotate.c
++++ b/fs/afs/vl_rotate.c
+@@ -58,6 +58,12 @@ static bool afs_start_vl_iteration(struct afs_vl_cursor *vc)
+ }
+
+ /* Status load is ordered after lookup counter load */
++ if (cell->dns_status == DNS_LOOKUP_GOT_NOT_FOUND) {
++ pr_warn("No record of cell %s\n", cell->name);
++ vc->error = -ENOENT;
++ return false;
++ }
++
+ if (cell->dns_source == DNS_RECORD_UNAVAILABLE) {
+ vc->error = -EDESTADDRREQ;
+ return false;
+@@ -285,6 +291,7 @@ bool afs_select_vlserver(struct afs_vl_cursor *vc)
+ */
+ static void afs_vl_dump_edestaddrreq(const struct afs_vl_cursor *vc)
+ {
++ struct afs_cell *cell = vc->cell;
+ static int count;
+ int i;
+
+@@ -294,6 +301,9 @@ static void afs_vl_dump_edestaddrreq(const struct afs_vl_cursor *vc)
+
+ rcu_read_lock();
+ pr_notice("EDESTADDR occurred\n");
++ pr_notice("CELL: %s err=%d\n", cell->name, cell->error);
++ pr_notice("DNS: src=%u st=%u lc=%x\n",
++ cell->dns_source, cell->dns_status, cell->dns_lookup_count);
+ pr_notice("VC: ut=%lx ix=%u ni=%hu fl=%hx err=%hd\n",
+ vc->untried, vc->index, vc->nr_iterations, vc->flags, vc->error);
+
+--
+2.42.0
+
--- /dev/null
+From f05e44a5ad902fc11b3f50e132f23d39a05af48a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Nov 2023 00:44:33 +0530
+Subject: amd-xgbe: handle corner-case during sfp hotplug
+
+From: Raju Rangoju <Raju.Rangoju@amd.com>
+
+[ Upstream commit 676ec53844cbdf2f47e68a076cdff7f0ec6cbe3f ]
+
+Force the mode change for SFI in Fixed PHY configurations. Fixed PHY
+configurations needs PLL to be enabled while doing mode set. When the
+SFP module isn't connected during boot, driver assumes AN is ON and
+attempts auto-negotiation. However, if the connected SFP comes up in
+Fixed PHY configuration the link will not come up as PLL isn't enabled
+while the initial mode set command is issued. So, force the mode change
+for SFI in Fixed PHY configuration to fix link issues.
+
+Fixes: e57f7a3feaef ("amd-xgbe: Prepare for working with more than one type of phy")
+Acked-by: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
+Signed-off-by: Raju Rangoju <Raju.Rangoju@amd.com>
+Reviewed-by: Wojciech Drewek <wojciech.drewek@intel.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/amd/xgbe/xgbe-mdio.c | 14 +++++++++++++-
+ 1 file changed, 13 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
+index ca7372369b3e6..60be836b294bb 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
+@@ -1178,7 +1178,19 @@ static int xgbe_phy_config_fixed(struct xgbe_prv_data *pdata)
+ if (pdata->phy.duplex != DUPLEX_FULL)
+ return -EINVAL;
+
+- xgbe_set_mode(pdata, mode);
++ /* Force the mode change for SFI in Fixed PHY config.
++ * Fixed PHY configs needs PLL to be enabled while doing mode set.
++ * When the SFP module isn't connected during boot, driver assumes
++ * AN is ON and attempts autonegotiation. However, if the connected
++ * SFP comes up in Fixed PHY config, the link will not come up as
++ * PLL isn't enabled while the initial mode set command is issued.
++ * So, force the mode change for SFI in Fixed PHY configuration to
++ * fix link issues.
++ */
++ if (mode == XGBE_MODE_SFI)
++ xgbe_change_mode(pdata, mode);
++ else
++ xgbe_set_mode(pdata, mode);
+
+ return 0;
+ }
+--
+2.42.0
+
--- /dev/null
+From 991abcae689eee3e3f38fb6d5477ad4375e0fb04 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Nov 2023 00:44:34 +0530
+Subject: amd-xgbe: handle the corner-case during tx completion
+
+From: Raju Rangoju <Raju.Rangoju@amd.com>
+
+[ Upstream commit 7121205d5330c6a3cb3379348886d47c77b78d06 ]
+
+The existing implementation uses software logic to accumulate tx
+completions until the specified time (1ms) is met and then poll them.
+However, there exists a tiny gap which leads to a race between
+resetting and checking the tx_activate flag. Due to this the tx
+completions are not reported to upper layer and tx queue timeout
+kicks-in restarting the device.
+
+To address this, introduce a tx cleanup mechanism as part of the
+periodic maintenance process.
+
+Fixes: c5aa9e3b8156 ("amd-xgbe: Initial AMD 10GbE platform driver")
+Acked-by: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
+Signed-off-by: Raju Rangoju <Raju.Rangoju@amd.com>
+Reviewed-by: Wojciech Drewek <wojciech.drewek@intel.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
+index a5d6faf7b89e1..23401958bc135 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
+@@ -682,10 +682,24 @@ static void xgbe_service(struct work_struct *work)
+ static void xgbe_service_timer(struct timer_list *t)
+ {
+ struct xgbe_prv_data *pdata = from_timer(pdata, t, service_timer);
++ struct xgbe_channel *channel;
++ unsigned int i;
+
+ queue_work(pdata->dev_workqueue, &pdata->service_work);
+
+ mod_timer(&pdata->service_timer, jiffies + HZ);
++
++ if (!pdata->tx_usecs)
++ return;
++
++ for (i = 0; i < pdata->channel_count; i++) {
++ channel = pdata->channel[i];
++ if (!channel->tx_ring || channel->tx_timer_active)
++ break;
++ channel->tx_timer_active = 1;
++ mod_timer(&channel->tx_timer,
++ jiffies + usecs_to_jiffies(pdata->tx_usecs));
++ }
+ }
+
+ static void xgbe_init_timers(struct xgbe_prv_data *pdata)
+--
+2.42.0
+
--- /dev/null
+From afb7d2738d2a6deabea52930c3a9c30eceeec1ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Nov 2023 00:44:35 +0530
+Subject: amd-xgbe: propagate the correct speed and duplex status
+
+From: Raju Rangoju <Raju.Rangoju@amd.com>
+
+[ Upstream commit 7a2323ac24a50311f64a3a9b54ed5bef5821ecae ]
+
+xgbe_get_link_ksettings() does not propagate correct speed and duplex
+information to ethtool during cable unplug. Due to which ethtool reports
+incorrect values for speed and duplex.
+
+Address this by propagating correct information.
+
+Fixes: 7c12aa08779c ("amd-xgbe: Move the PHY support into amd-xgbe")
+Acked-by: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
+Signed-off-by: Raju Rangoju <Raju.Rangoju@amd.com>
+Reviewed-by: Wojciech Drewek <wojciech.drewek@intel.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/amd/xgbe/xgbe-ethtool.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-ethtool.c b/drivers/net/ethernet/amd/xgbe/xgbe-ethtool.c
+index 61f39a0e04f95..64aebf922dda9 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-ethtool.c
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-ethtool.c
+@@ -314,10 +314,15 @@ static int xgbe_get_link_ksettings(struct net_device *netdev,
+
+ cmd->base.phy_address = pdata->phy.address;
+
+- cmd->base.autoneg = pdata->phy.autoneg;
+- cmd->base.speed = pdata->phy.speed;
+- cmd->base.duplex = pdata->phy.duplex;
++ if (netif_carrier_ok(netdev)) {
++ cmd->base.speed = pdata->phy.speed;
++ cmd->base.duplex = pdata->phy.duplex;
++ } else {
++ cmd->base.speed = SPEED_UNKNOWN;
++ cmd->base.duplex = DUPLEX_UNKNOWN;
++ }
+
++ cmd->base.autoneg = pdata->phy.autoneg;
+ cmd->base.port = PORT_NONE;
+
+ XGBE_LM_COPY(cmd, supported, lks, supported);
+--
+2.42.0
+
--- /dev/null
+From 40a9117d5de2d87802c5b595b795c691098f4494 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Nov 2023 15:07:41 -0800
+Subject: arm/xen: fix xen_vcpu_info allocation alignment
+
+From: Stefano Stabellini <sstabellini@kernel.org>
+
+[ Upstream commit 7bf9a6b46549852a37e6d07e52c601c3c706b562 ]
+
+xen_vcpu_info is a percpu area than needs to be mapped by Xen.
+Currently, it could cross a page boundary resulting in Xen being unable
+to map it:
+
+[ 0.567318] kernel BUG at arch/arm64/xen/../../arm/xen/enlighten.c:164!
+[ 0.574002] Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
+
+Fix the issue by using __alloc_percpu and requesting alignment for the
+memory allocation.
+
+Signed-off-by: Stefano Stabellini <stefano.stabellini@amd.com>
+
+Link: https://lore.kernel.org/r/alpine.DEB.2.22.394.2311221501340.2053963@ubuntu-linux-20-04-desktop
+Fixes: 24d5373dda7c ("arm/xen: Use alloc_percpu rather than __alloc_percpu")
+Reviewed-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/xen/enlighten.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm/xen/enlighten.c b/arch/arm/xen/enlighten.c
+index 3d25fd615250a..518c7557f78a2 100644
+--- a/arch/arm/xen/enlighten.c
++++ b/arch/arm/xen/enlighten.c
+@@ -351,7 +351,8 @@ static int __init xen_guest_init(void)
+ * for secondary CPUs as they are brought up.
+ * For uniformity we use VCPUOP_register_vcpu_info even on cpu0.
+ */
+- xen_vcpu_info = alloc_percpu(struct vcpu_info);
++ xen_vcpu_info = __alloc_percpu(sizeof(struct vcpu_info),
++ 1 << fls(sizeof(struct vcpu_info) - 1));
+ if (xen_vcpu_info == NULL)
+ return -ENOMEM;
+
+--
+2.42.0
+
--- /dev/null
+From 27841a967884ec81202e358e7793a31cdc6bb804 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Oct 2023 04:00:07 +0000
+Subject: ata: pata_isapnp: Add missing error check for devm_ioport_map()
+
+From: Chen Ni <nichen@iscas.ac.cn>
+
+[ Upstream commit a6925165ea82b7765269ddd8dcad57c731aa00de ]
+
+Add missing error return check for devm_ioport_map() and return the
+error if this function call fails.
+
+Fixes: 0d5ff566779f ("libata: convert to iomap")
+Signed-off-by: Chen Ni <nichen@iscas.ac.cn>
+Reviewed-by: Sergey Shtylyov <s.shtylyov@omp.ru>
+Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ata/pata_isapnp.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/ata/pata_isapnp.c b/drivers/ata/pata_isapnp.c
+index 43bb224430d3c..8892931ea8676 100644
+--- a/drivers/ata/pata_isapnp.c
++++ b/drivers/ata/pata_isapnp.c
+@@ -82,6 +82,9 @@ static int isapnp_init_one(struct pnp_dev *idev, const struct pnp_device_id *dev
+ if (pnp_port_valid(idev, 1)) {
+ ctl_addr = devm_ioport_map(&idev->dev,
+ pnp_port_start(idev, 1), 1);
++ if (!ctl_addr)
++ return -ENOMEM;
++
+ ap->ioaddr.altstatus_addr = ctl_addr;
+ ap->ioaddr.ctl_addr = ctl_addr;
+ ap->ops = &isapnp_port_ops;
+--
+2.42.0
+
--- /dev/null
+From 54478c2e4a510eb6dbc12c0449c47a8a777dcceb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Oct 2023 12:56:37 +0000
+Subject: drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is
+ NULL
+
+From: Qu Huang <qu.huang@linux.dev>
+
+[ Upstream commit 5104fdf50d326db2c1a994f8b35dcd46e63ae4ad ]
+
+In certain types of chips, such as VEGA20, reading the amdgpu_regs_smc file could result in an abnormal null pointer access when the smc_rreg pointer is NULL. Below are the steps to reproduce this issue and the corresponding exception log:
+
+1. Navigate to the directory: /sys/kernel/debug/dri/0
+2. Execute command: cat amdgpu_regs_smc
+3. Exception Log::
+[4005007.702554] BUG: kernel NULL pointer dereference, address: 0000000000000000
+[4005007.702562] #PF: supervisor instruction fetch in kernel mode
+[4005007.702567] #PF: error_code(0x0010) - not-present page
+[4005007.702570] PGD 0 P4D 0
+[4005007.702576] Oops: 0010 [#1] SMP NOPTI
+[4005007.702581] CPU: 4 PID: 62563 Comm: cat Tainted: G OE 5.15.0-43-generic #46-Ubunt u
+[4005007.702590] RIP: 0010:0x0
+[4005007.702598] Code: Unable to access opcode bytes at RIP 0xffffffffffffffd6.
+[4005007.702600] RSP: 0018:ffffa82b46d27da0 EFLAGS: 00010206
+[4005007.702605] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffa82b46d27e68
+[4005007.702609] RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffff9940656e0000
+[4005007.702612] RBP: ffffa82b46d27dd8 R08: 0000000000000000 R09: ffff994060c07980
+[4005007.702615] R10: 0000000000020000 R11: 0000000000000000 R12: 00007f5e06753000
+[4005007.702618] R13: ffff9940656e0000 R14: ffffa82b46d27e68 R15: 00007f5e06753000
+[4005007.702622] FS: 00007f5e0755b740(0000) GS:ffff99479d300000(0000) knlGS:0000000000000000
+[4005007.702626] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[4005007.702629] CR2: ffffffffffffffd6 CR3: 00000003253fc000 CR4: 00000000003506e0
+[4005007.702633] Call Trace:
+[4005007.702636] <TASK>
+[4005007.702640] amdgpu_debugfs_regs_smc_read+0xb0/0x120 [amdgpu]
+[4005007.703002] full_proxy_read+0x5c/0x80
+[4005007.703011] vfs_read+0x9f/0x1a0
+[4005007.703019] ksys_read+0x67/0xe0
+[4005007.703023] __x64_sys_read+0x19/0x20
+[4005007.703028] do_syscall_64+0x5c/0xc0
+[4005007.703034] ? do_user_addr_fault+0x1e3/0x670
+[4005007.703040] ? exit_to_user_mode_prepare+0x37/0xb0
+[4005007.703047] ? irqentry_exit_to_user_mode+0x9/0x20
+[4005007.703052] ? irqentry_exit+0x19/0x30
+[4005007.703057] ? exc_page_fault+0x89/0x160
+[4005007.703062] ? asm_exc_page_fault+0x8/0x30
+[4005007.703068] entry_SYSCALL_64_after_hwframe+0x44/0xae
+[4005007.703075] RIP: 0033:0x7f5e07672992
+[4005007.703079] Code: c0 e9 b2 fe ff ff 50 48 8d 3d fa b2 0c 00 e8 c5 1d 02 00 0f 1f 44 00 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 0f 05 <48> 3d 00 f0 ff ff 77 56 c3 0f 1f 44 00 00 48 83 e c 28 48 89 54 24
+[4005007.703083] RSP: 002b:00007ffe03097898 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
+[4005007.703088] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007f5e07672992
+[4005007.703091] RDX: 0000000000020000 RSI: 00007f5e06753000 RDI: 0000000000000003
+[4005007.703094] RBP: 00007f5e06753000 R08: 00007f5e06752010 R09: 00007f5e06752010
+[4005007.703096] R10: 0000000000000022 R11: 0000000000000246 R12: 0000000000022000
+[4005007.703099] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
+[4005007.703105] </TASK>
+[4005007.703107] Modules linked in: nf_tables libcrc32c nfnetlink algif_hash af_alg binfmt_misc nls_ iso8859_1 ipmi_ssif ast intel_rapl_msr intel_rapl_common drm_vram_helper drm_ttm_helper amd64_edac t tm edac_mce_amd kvm_amd ccp mac_hid k10temp kvm acpi_ipmi ipmi_si rapl sch_fq_codel ipmi_devintf ipm i_msghandler msr parport_pc ppdev lp parport mtd pstore_blk efi_pstore ramoops pstore_zone reed_solo mon ip_tables x_tables autofs4 ib_uverbs ib_core amdgpu(OE) amddrm_ttm_helper(OE) amdttm(OE) iommu_v 2 amd_sched(OE) amdkcl(OE) drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops cec rc_core drm igb ahci xhci_pci libahci i2c_piix4 i2c_algo_bit xhci_pci_renesas dca
+[4005007.703184] CR2: 0000000000000000
+[4005007.703188] ---[ end trace ac65a538d240da39 ]---
+[4005007.800865] RIP: 0010:0x0
+[4005007.800871] Code: Unable to access opcode bytes at RIP 0xffffffffffffffd6.
+[4005007.800874] RSP: 0018:ffffa82b46d27da0 EFLAGS: 00010206
+[4005007.800878] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffa82b46d27e68
+[4005007.800881] RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffff9940656e0000
+[4005007.800883] RBP: ffffa82b46d27dd8 R08: 0000000000000000 R09: ffff994060c07980
+[4005007.800886] R10: 0000000000020000 R11: 0000000000000000 R12: 00007f5e06753000
+[4005007.800888] R13: ffff9940656e0000 R14: ffffa82b46d27e68 R15: 00007f5e06753000
+[4005007.800891] FS: 00007f5e0755b740(0000) GS:ffff99479d300000(0000) knlGS:0000000000000000
+[4005007.800895] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[4005007.800898] CR2: ffffffffffffffd6 CR3: 00000003253fc000 CR4: 00000000003506e0
+
+Signed-off-by: Qu Huang <qu.huang@linux.dev>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
+index 48df32dd352ed..d7d3cf4da9e05 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
+@@ -456,6 +456,9 @@ static ssize_t amdgpu_debugfs_regs_didt_read(struct file *f, char __user *buf,
+ ssize_t result = 0;
+ int r;
+
++ if (!adev->smc_wreg)
++ return -EPERM;
++
+ if (size & 0x3 || *pos & 0x3)
+ return -EINVAL;
+
+@@ -515,6 +518,9 @@ static ssize_t amdgpu_debugfs_regs_didt_write(struct file *f, const char __user
+ ssize_t result = 0;
+ int r;
+
++ if (!adev->smc_rreg)
++ return -EPERM;
++
+ if (size & 0x3 || *pos & 0x3)
+ return -EINVAL;
+
+--
+2.42.0
+
--- /dev/null
+From ccdf2613e6dd283d86eb2c023d49aab7c28a7a38 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Nov 2023 12:42:05 +0800
+Subject: drm/panel: auo,b101uan08.3: Fine tune the panel power sequence
+
+From: Xuxin Xiong <xuxinxiong@huaqin.corp-partner.google.com>
+
+[ Upstream commit 6965809e526917b73c8f9178173184dcf13cec4b ]
+
+For "auo,b101uan08.3" this panel, it is stipulated in the panel spec that
+MIPI needs to keep the LP11 state before the lcm_reset pin is pulled high.
+
+Fixes: 56ad624b4cb5 ("drm/panel: support for auo, b101uan08.3 wuxga dsi video mode panel")
+Signed-off-by: Xuxin Xiong <xuxinxiong@huaqin.corp-partner.google.com>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20231114044205.613421-1-xuxinxiong@huaqin.corp-partner.google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c b/drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c
+index 3229e5eabbd21..9e518213a54ff 100644
+--- a/drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c
++++ b/drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c
+@@ -697,6 +697,7 @@ static const struct panel_desc auo_b101uan08_3_desc = {
+ .mode_flags = MIPI_DSI_MODE_VIDEO | MIPI_DSI_MODE_VIDEO_SYNC_PULSE |
+ MIPI_DSI_MODE_LPM,
+ .init_cmds = auo_b101uan08_3_init_cmd,
++ .lp11_before_reset = true,
+ };
+
+ static const struct drm_display_mode boe_tv105wum_nw0_default_mode = {
+--
+2.42.0
+
--- /dev/null
+From fa93f5aab2ff711235912ea966b0fef5b99ebb46 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 May 2023 17:49:55 +0800
+Subject: drm/panel: boe-tv101wum-nl6: Fine tune the panel power sequence
+
+From: Shuijing Li <shuijing.li@mediatek.com>
+
+[ Upstream commit 812562b8d881ce6d33fed8052b3a10b718430fb5 ]
+
+For "boe,tv105wum-nw0" this special panel, it is stipulated in
+the panel spec that MIPI needs to keep the LP11 state before
+the lcm_reset pin is pulled high.
+
+Signed-off-by: Shuijing Li <shuijing.li@mediatek.com>
+Signed-off-by: Xinlei Lee <xinlei.lee@mediatek.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230515094955.15982-3-shuijing.li@mediatek.com
+Stable-dep-of: 6965809e5269 ("drm/panel: auo,b101uan08.3: Fine tune the panel power sequence")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c b/drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c
+index db9d0b86d5428..3229e5eabbd21 100644
+--- a/drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c
++++ b/drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c
+@@ -36,6 +36,7 @@ struct panel_desc {
+ const struct panel_init_cmd *init_cmds;
+ unsigned int lanes;
+ bool discharge_on_disable;
++ bool lp11_before_reset;
+ };
+
+ struct boe_panel {
+@@ -551,6 +552,10 @@ static int boe_panel_prepare(struct drm_panel *panel)
+
+ usleep_range(5000, 10000);
+
++ if (boe->desc->lp11_before_reset) {
++ mipi_dsi_dcs_nop(boe->dsi);
++ usleep_range(1000, 2000);
++ }
+ gpiod_set_value(boe->enable_gpio, 1);
+ usleep_range(1000, 2000);
+ gpiod_set_value(boe->enable_gpio, 0);
+@@ -719,6 +724,7 @@ static const struct panel_desc boe_tv105wum_nw0_desc = {
+ .mode_flags = MIPI_DSI_MODE_VIDEO | MIPI_DSI_MODE_VIDEO_SYNC_PULSE |
+ MIPI_DSI_MODE_LPM,
+ .init_cmds = boe_init_cmd,
++ .lp11_before_reset = true,
+ };
+
+ static int boe_panel_get_modes(struct drm_panel *panel,
+--
+2.42.0
+
--- /dev/null
+From ba8239f165490c6d232776abd9def6ce17542040 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Oct 2023 00:33:15 +0200
+Subject: drm/panel: simple: Fix Innolux G101ICE-L01 bus flags
+
+From: Marek Vasut <marex@denx.de>
+
+[ Upstream commit 06fc41b09cfbc02977acd9189473593a37d82d9b ]
+
+Add missing .bus_flags = DRM_BUS_FLAG_DE_HIGH to this panel description,
+ones which match both the datasheet and the panel display_timing flags .
+
+Fixes: 1e29b840af9f ("drm/panel: simple: Add Innolux G101ICE-L01 panel")
+Signed-off-by: Marek Vasut <marex@denx.de>
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20231008223315.279215-1-marex@denx.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panel/panel-simple.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c
+index e90b518118881..7c470b4763cb4 100644
+--- a/drivers/gpu/drm/panel/panel-simple.c
++++ b/drivers/gpu/drm/panel/panel-simple.c
+@@ -2177,6 +2177,7 @@ static const struct panel_desc innolux_g101ice_l01 = {
+ .disable = 200,
+ },
+ .bus_format = MEDIA_BUS_FMT_RGB888_1X7X4_SPWG,
++ .bus_flags = DRM_BUS_FLAG_DE_HIGH,
+ .connector_type = DRM_MODE_CONNECTOR_LVDS,
+ };
+
+--
+2.42.0
+
--- /dev/null
+From 913388efd8ec389de0abaa8df9b59de9351201ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Oct 2023 00:32:56 +0200
+Subject: drm/panel: simple: Fix Innolux G101ICE-L01 timings
+
+From: Marek Vasut <marex@denx.de>
+
+[ Upstream commit 3f9a91b6c00e655d27bd785dcda1742dbdc31bda ]
+
+The Innolux G101ICE-L01 datasheet [1] page 17 table
+6.1 INPUT SIGNAL TIMING SPECIFICATIONS
+indicates that maximum vertical blanking time is 40 lines.
+Currently the driver uses 29 lines.
+
+Fix it, and since this panel is a DE panel, adjust the timings
+to make them less hostile to controllers which cannot do 1 px
+HSA/VSA, distribute the delays evenly between all three parts.
+
+[1] https://www.data-modul.com/sites/default/files/products/G101ICE-L01-C2-specification-12042389.pdf
+
+Fixes: 1e29b840af9f ("drm/panel: simple: Add Innolux G101ICE-L01 panel")
+Signed-off-by: Marek Vasut <marex@denx.de>
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20231008223256.279196-1-marex@denx.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panel/panel-simple.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c
+index 7c470b4763cb4..ee01b61a6bafa 100644
+--- a/drivers/gpu/drm/panel/panel-simple.c
++++ b/drivers/gpu/drm/panel/panel-simple.c
+@@ -2154,13 +2154,13 @@ static const struct panel_desc innolux_g070y2_l01 = {
+ static const struct display_timing innolux_g101ice_l01_timing = {
+ .pixelclock = { 60400000, 71100000, 74700000 },
+ .hactive = { 1280, 1280, 1280 },
+- .hfront_porch = { 41, 80, 100 },
+- .hback_porch = { 40, 79, 99 },
+- .hsync_len = { 1, 1, 1 },
++ .hfront_porch = { 30, 60, 70 },
++ .hback_porch = { 30, 60, 70 },
++ .hsync_len = { 22, 40, 60 },
+ .vactive = { 800, 800, 800 },
+- .vfront_porch = { 5, 11, 14 },
+- .vback_porch = { 4, 11, 14 },
+- .vsync_len = { 1, 1, 1 },
++ .vfront_porch = { 3, 8, 14 },
++ .vback_porch = { 3, 8, 14 },
++ .vsync_len = { 4, 7, 12 },
+ .flags = DISPLAY_FLAGS_DE_HIGH,
+ };
+
+--
+2.42.0
+
--- /dev/null
+From 4fbbd1bf9f4e41e328bd15b0142d6d3412bb4eb3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Oct 2023 19:14:58 +0000
+Subject: drm/rockchip: vop: Fix color for RGB888/BGR888 format on VOP full
+
+From: Jonas Karlman <jonas@kwiboo.se>
+
+[ Upstream commit bb0a05acd6121ff0e810b44fdc24dbdfaa46b642 ]
+
+Use of DRM_FORMAT_RGB888 and DRM_FORMAT_BGR888 on e.g. RK3288, RK3328
+and RK3399 result in wrong colors being displayed.
+
+The issue can be observed using modetest:
+
+ modetest -s <connector_id>@<crtc_id>:1920x1080-60@RG24
+ modetest -s <connector_id>@<crtc_id>:1920x1080-60@BG24
+
+Vendor 4.4 kernel apply an inverted rb swap for these formats on VOP
+full framework (IP version 3.x) compared to VOP little framework (2.x).
+
+Fix colors by applying different rb swap for VOP full framework (3.x)
+and VOP little framework (2.x) similar to vendor 4.4 kernel.
+
+Fixes: 85a359f25388 ("drm/rockchip: Add BGR formats to VOP")
+Signed-off-by: Jonas Karlman <jonas@kwiboo.se>
+Tested-by: Diederik de Haas <didi.debian@cknow.org>
+Reviewed-by: Christopher Obbard <chris.obbard@collabora.com>
+Tested-by: Christopher Obbard <chris.obbard@collabora.com>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Link: https://patchwork.freedesktop.org/patch/msgid/20231026191500.2994225-1-jonas@kwiboo.se
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/rockchip/rockchip_drm_vop.c | 14 +++++++++++---
+ 1 file changed, 11 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
+index 05fcc9e078d6d..682d78fab9a59 100644
+--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
++++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
+@@ -248,14 +248,22 @@ static inline void vop_cfg_done(struct vop *vop)
+ VOP_REG_SET(vop, common, cfg_done, 1);
+ }
+
+-static bool has_rb_swapped(uint32_t format)
++static bool has_rb_swapped(uint32_t version, uint32_t format)
+ {
+ switch (format) {
+ case DRM_FORMAT_XBGR8888:
+ case DRM_FORMAT_ABGR8888:
+- case DRM_FORMAT_BGR888:
+ case DRM_FORMAT_BGR565:
+ return true;
++ /*
++ * full framework (IP version 3.x) only need rb swapped for RGB888 and
++ * little framework (IP version 2.x) only need rb swapped for BGR888,
++ * check for 3.x to also only rb swap BGR888 for unknown vop version
++ */
++ case DRM_FORMAT_RGB888:
++ return VOP_MAJOR(version) == 3;
++ case DRM_FORMAT_BGR888:
++ return VOP_MAJOR(version) != 3;
+ default:
+ return false;
+ }
+@@ -988,7 +996,7 @@ static void vop_plane_atomic_update(struct drm_plane *plane,
+ VOP_WIN_SET(vop, win, dsp_info, dsp_info);
+ VOP_WIN_SET(vop, win, dsp_st, dsp_st);
+
+- rb_swap = has_rb_swapped(fb->format->format);
++ rb_swap = has_rb_swapped(vop->data->version, fb->format->format);
+ VOP_WIN_SET(vop, win, rb_swap, rb_swap);
+
+ /*
+--
+2.42.0
+
--- /dev/null
+From 2d0ea2e5157d84db94808e8b4da2a390b697b158 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Apr 2023 11:38:36 +0800
+Subject: ext4: add a new helper to check if es must be kept
+
+From: Baokun Li <libaokun1@huawei.com>
+
+[ Upstream commit 9649eb18c6288f514cacffdd699d5cd999c2f8f6 ]
+
+In the extent status tree, we have extents which we can just drop without
+issues and extents we must not drop - this depends on the extent's status
+- currently ext4_es_is_delayed() extents must stay, others may be dropped.
+
+A helper function is added to help determine if the current extent can
+be dropped, although only ext4_es_is_delayed() extents cannot be dropped
+currently.
+
+Suggested-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Baokun Li <libaokun1@huawei.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Link: https://lore.kernel.org/r/20230424033846.4732-3-libaokun1@huawei.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Stable-dep-of: 8e387c89e96b ("ext4: make sure allocate pending entry not fail")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/extents_status.c | 34 +++++++++++++++++++++-------------
+ 1 file changed, 21 insertions(+), 13 deletions(-)
+
+diff --git a/fs/ext4/extents_status.c b/fs/ext4/extents_status.c
+index 7806adcc41a7a..cf6a21baddbc4 100644
+--- a/fs/ext4/extents_status.c
++++ b/fs/ext4/extents_status.c
+@@ -448,6 +448,19 @@ static void ext4_es_list_del(struct inode *inode)
+ spin_unlock(&sbi->s_es_lock);
+ }
+
++/*
++ * Returns true if we cannot fail to allocate memory for this extent_status
++ * entry and cannot reclaim it until its status changes.
++ */
++static inline bool ext4_es_must_keep(struct extent_status *es)
++{
++ /* fiemap, bigalloc, and seek_data/hole need to use it. */
++ if (ext4_es_is_delayed(es))
++ return true;
++
++ return false;
++}
++
+ static struct extent_status *
+ ext4_es_alloc_extent(struct inode *inode, ext4_lblk_t lblk, ext4_lblk_t len,
+ ext4_fsblk_t pblk)
+@@ -460,10 +473,8 @@ ext4_es_alloc_extent(struct inode *inode, ext4_lblk_t lblk, ext4_lblk_t len,
+ es->es_len = len;
+ es->es_pblk = pblk;
+
+- /*
+- * We don't count delayed extent because we never try to reclaim them
+- */
+- if (!ext4_es_is_delayed(es)) {
++ /* We never try to reclaim a must kept extent, so we don't count it. */
++ if (!ext4_es_must_keep(es)) {
+ if (!EXT4_I(inode)->i_es_shk_nr++)
+ ext4_es_list_add(inode);
+ percpu_counter_inc(&EXT4_SB(inode->i_sb)->
+@@ -481,8 +492,8 @@ static void ext4_es_free_extent(struct inode *inode, struct extent_status *es)
+ EXT4_I(inode)->i_es_all_nr--;
+ percpu_counter_dec(&EXT4_SB(inode->i_sb)->s_es_stats.es_stats_all_cnt);
+
+- /* Decrease the shrink counter when this es is not delayed */
+- if (!ext4_es_is_delayed(es)) {
++ /* Decrease the shrink counter when we can reclaim the extent. */
++ if (!ext4_es_must_keep(es)) {
+ BUG_ON(EXT4_I(inode)->i_es_shk_nr == 0);
+ if (!--EXT4_I(inode)->i_es_shk_nr)
+ ext4_es_list_del(inode);
+@@ -854,7 +865,7 @@ int ext4_es_insert_extent(struct inode *inode, ext4_lblk_t lblk,
+ if (err == -ENOMEM && __es_shrink(EXT4_SB(inode->i_sb),
+ 128, EXT4_I(inode)))
+ goto retry;
+- if (err == -ENOMEM && !ext4_es_is_delayed(&newes))
++ if (err == -ENOMEM && !ext4_es_must_keep(&newes))
+ err = 0;
+
+ if (sbi->s_cluster_ratio > 1 && test_opt(inode->i_sb, DELALLOC) &&
+@@ -1704,11 +1715,8 @@ static int es_do_reclaim_extents(struct ext4_inode_info *ei, ext4_lblk_t end,
+
+ (*nr_to_scan)--;
+ node = rb_next(&es->rb_node);
+- /*
+- * We can't reclaim delayed extent from status tree because
+- * fiemap, bigallic, and seek_data/hole need to use it.
+- */
+- if (ext4_es_is_delayed(es))
++
++ if (ext4_es_must_keep(es))
+ goto next;
+ if (ext4_es_is_referenced(es)) {
+ ext4_es_clear_referenced(es);
+@@ -1772,7 +1780,7 @@ void ext4_clear_inode_es(struct inode *inode)
+ while (node) {
+ es = rb_entry(node, struct extent_status, rb_node);
+ node = rb_next(node);
+- if (!ext4_es_is_delayed(es)) {
++ if (!ext4_es_must_keep(es)) {
+ rb_erase(&es->rb_node, &tree->root);
+ ext4_es_free_extent(inode, es);
+ }
+--
+2.42.0
+
--- /dev/null
+From ba776b71782664238c51611e10b3643c050f0c6b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Apr 2023 11:38:37 +0800
+Subject: ext4: factor out __es_alloc_extent() and __es_free_extent()
+
+From: Baokun Li <libaokun1@huawei.com>
+
+[ Upstream commit 73a2f033656be11298912201ad50615307b4477a ]
+
+Factor out __es_alloc_extent() and __es_free_extent(), which only allocate
+and free extent_status in these two helpers.
+
+The ext4_es_alloc_extent() function is split into __es_alloc_extent()
+and ext4_es_init_extent(). In __es_alloc_extent() we allocate memory using
+GFP_KERNEL | __GFP_NOFAIL | __GFP_ZERO if the memory allocation cannot
+fail, otherwise we use GFP_ATOMIC. and the ext4_es_init_extent() is used to
+initialize extent_status and update related variables after a successful
+allocation.
+
+This is to prepare for the use of pre-allocated extent_status later.
+
+Signed-off-by: Baokun Li <libaokun1@huawei.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Link: https://lore.kernel.org/r/20230424033846.4732-4-libaokun1@huawei.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Stable-dep-of: 8e387c89e96b ("ext4: make sure allocate pending entry not fail")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/extents_status.c | 30 +++++++++++++++++++-----------
+ 1 file changed, 19 insertions(+), 11 deletions(-)
+
+diff --git a/fs/ext4/extents_status.c b/fs/ext4/extents_status.c
+index cf6a21baddbc4..012033db41062 100644
+--- a/fs/ext4/extents_status.c
++++ b/fs/ext4/extents_status.c
+@@ -461,14 +461,17 @@ static inline bool ext4_es_must_keep(struct extent_status *es)
+ return false;
+ }
+
+-static struct extent_status *
+-ext4_es_alloc_extent(struct inode *inode, ext4_lblk_t lblk, ext4_lblk_t len,
+- ext4_fsblk_t pblk)
++static inline struct extent_status *__es_alloc_extent(bool nofail)
++{
++ if (!nofail)
++ return kmem_cache_alloc(ext4_es_cachep, GFP_ATOMIC);
++
++ return kmem_cache_zalloc(ext4_es_cachep, GFP_KERNEL | __GFP_NOFAIL);
++}
++
++static void ext4_es_init_extent(struct inode *inode, struct extent_status *es,
++ ext4_lblk_t lblk, ext4_lblk_t len, ext4_fsblk_t pblk)
+ {
+- struct extent_status *es;
+- es = kmem_cache_alloc(ext4_es_cachep, GFP_ATOMIC);
+- if (es == NULL)
+- return NULL;
+ es->es_lblk = lblk;
+ es->es_len = len;
+ es->es_pblk = pblk;
+@@ -483,8 +486,11 @@ ext4_es_alloc_extent(struct inode *inode, ext4_lblk_t lblk, ext4_lblk_t len,
+
+ EXT4_I(inode)->i_es_all_nr++;
+ percpu_counter_inc(&EXT4_SB(inode->i_sb)->s_es_stats.es_stats_all_cnt);
++}
+
+- return es;
++static inline void __es_free_extent(struct extent_status *es)
++{
++ kmem_cache_free(ext4_es_cachep, es);
+ }
+
+ static void ext4_es_free_extent(struct inode *inode, struct extent_status *es)
+@@ -501,7 +507,7 @@ static void ext4_es_free_extent(struct inode *inode, struct extent_status *es)
+ s_es_stats.es_stats_shk_cnt);
+ }
+
+- kmem_cache_free(ext4_es_cachep, es);
++ __es_free_extent(es);
+ }
+
+ /*
+@@ -803,10 +809,12 @@ static int __es_insert_extent(struct inode *inode, struct extent_status *newes)
+ }
+ }
+
+- es = ext4_es_alloc_extent(inode, newes->es_lblk, newes->es_len,
+- newes->es_pblk);
++ es = __es_alloc_extent(false);
+ if (!es)
+ return -ENOMEM;
++ ext4_es_init_extent(inode, es, newes->es_lblk, newes->es_len,
++ newes->es_pblk);
++
+ rb_link_node(&es->rb_node, parent, p);
+ rb_insert_color(&es->rb_node, &tree->root);
+
+--
+2.42.0
+
--- /dev/null
+From 6c79ee8ed510a424530e25619ae727f898484bce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Aug 2023 15:08:08 +0800
+Subject: ext4: fix slab-use-after-free in ext4_es_insert_extent()
+
+From: Baokun Li <libaokun1@huawei.com>
+
+[ Upstream commit 768d612f79822d30a1e7d132a4d4b05337ce42ec ]
+
+Yikebaer reported an issue:
+==================================================================
+BUG: KASAN: slab-use-after-free in ext4_es_insert_extent+0xc68/0xcb0
+fs/ext4/extents_status.c:894
+Read of size 4 at addr ffff888112ecc1a4 by task syz-executor/8438
+
+CPU: 1 PID: 8438 Comm: syz-executor Not tainted 6.5.0-rc5 #1
+Call Trace:
+ [...]
+ kasan_report+0xba/0xf0 mm/kasan/report.c:588
+ ext4_es_insert_extent+0xc68/0xcb0 fs/ext4/extents_status.c:894
+ ext4_map_blocks+0x92a/0x16f0 fs/ext4/inode.c:680
+ ext4_alloc_file_blocks.isra.0+0x2df/0xb70 fs/ext4/extents.c:4462
+ ext4_zero_range fs/ext4/extents.c:4622 [inline]
+ ext4_fallocate+0x251c/0x3ce0 fs/ext4/extents.c:4721
+ [...]
+
+Allocated by task 8438:
+ [...]
+ kmem_cache_zalloc include/linux/slab.h:693 [inline]
+ __es_alloc_extent fs/ext4/extents_status.c:469 [inline]
+ ext4_es_insert_extent+0x672/0xcb0 fs/ext4/extents_status.c:873
+ ext4_map_blocks+0x92a/0x16f0 fs/ext4/inode.c:680
+ ext4_alloc_file_blocks.isra.0+0x2df/0xb70 fs/ext4/extents.c:4462
+ ext4_zero_range fs/ext4/extents.c:4622 [inline]
+ ext4_fallocate+0x251c/0x3ce0 fs/ext4/extents.c:4721
+ [...]
+
+Freed by task 8438:
+ [...]
+ kmem_cache_free+0xec/0x490 mm/slub.c:3823
+ ext4_es_try_to_merge_right fs/ext4/extents_status.c:593 [inline]
+ __es_insert_extent+0x9f4/0x1440 fs/ext4/extents_status.c:802
+ ext4_es_insert_extent+0x2ca/0xcb0 fs/ext4/extents_status.c:882
+ ext4_map_blocks+0x92a/0x16f0 fs/ext4/inode.c:680
+ ext4_alloc_file_blocks.isra.0+0x2df/0xb70 fs/ext4/extents.c:4462
+ ext4_zero_range fs/ext4/extents.c:4622 [inline]
+ ext4_fallocate+0x251c/0x3ce0 fs/ext4/extents.c:4721
+ [...]
+==================================================================
+
+The flow of issue triggering is as follows:
+1. remove es
+ raw es es removed es1
+|-------------------| -> |----|.......|------|
+
+2. insert es
+ es insert es1 merge with es es1 merge with es and free es1
+|----|.......|------| -> |------------|------| -> |-------------------|
+
+es merges with newes, then merges with es1, frees es1, then determines
+if es1->es_len is 0 and triggers a UAF.
+
+The code flow is as follows:
+ext4_es_insert_extent
+ es1 = __es_alloc_extent(true);
+ es2 = __es_alloc_extent(true);
+ __es_remove_extent(inode, lblk, end, NULL, es1)
+ __es_insert_extent(inode, &newes, es1) ---> insert es1 to es tree
+ __es_insert_extent(inode, &newes, es2)
+ ext4_es_try_to_merge_right
+ ext4_es_free_extent(inode, es1) ---> es1 is freed
+ if (es1 && !es1->es_len)
+ // Trigger UAF by determining if es1 is used.
+
+We determine whether es1 or es2 is used immediately after calling
+__es_remove_extent() or __es_insert_extent() to avoid triggering a
+UAF if es1 or es2 is freed.
+
+Reported-by: Yikebaer Aizezi <yikebaer61@gmail.com>
+Closes: https://lore.kernel.org/lkml/CALcu4raD4h9coiyEBL4Bm0zjDwxC2CyPiTwsP3zFuhot6y9Beg@mail.gmail.com
+Fixes: 2a69c450083d ("ext4: using nofail preallocation in ext4_es_insert_extent()")
+Cc: stable@kernel.org
+Signed-off-by: Baokun Li <libaokun1@huawei.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Link: https://lore.kernel.org/r/20230815070808.3377171-1-libaokun1@huawei.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Stable-dep-of: 8e387c89e96b ("ext4: make sure allocate pending entry not fail")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/extents_status.c | 44 +++++++++++++++++++++++++++-------------
+ 1 file changed, 30 insertions(+), 14 deletions(-)
+
+diff --git a/fs/ext4/extents_status.c b/fs/ext4/extents_status.c
+index 1327cd9505db7..6c55ab427e650 100644
+--- a/fs/ext4/extents_status.c
++++ b/fs/ext4/extents_status.c
+@@ -883,23 +883,29 @@ int ext4_es_insert_extent(struct inode *inode, ext4_lblk_t lblk,
+ err1 = __es_remove_extent(inode, lblk, end, NULL, es1);
+ if (err1 != 0)
+ goto error;
++ /* Free preallocated extent if it didn't get used. */
++ if (es1) {
++ if (!es1->es_len)
++ __es_free_extent(es1);
++ es1 = NULL;
++ }
+
+ err2 = __es_insert_extent(inode, &newes, es2);
+ if (err2 == -ENOMEM && !ext4_es_must_keep(&newes))
+ err2 = 0;
+ if (err2 != 0)
+ goto error;
++ /* Free preallocated extent if it didn't get used. */
++ if (es2) {
++ if (!es2->es_len)
++ __es_free_extent(es2);
++ es2 = NULL;
++ }
+
+ if (sbi->s_cluster_ratio > 1 && test_opt(inode->i_sb, DELALLOC) &&
+ (status & EXTENT_STATUS_WRITTEN ||
+ status & EXTENT_STATUS_UNWRITTEN))
+ __revise_pending(inode, lblk, len);
+-
+- /* es is pre-allocated but not used, free it. */
+- if (es1 && !es1->es_len)
+- __es_free_extent(es1);
+- if (es2 && !es2->es_len)
+- __es_free_extent(es2);
+ error:
+ write_unlock(&EXT4_I(inode)->i_es_lock);
+ if (err1 || err2)
+@@ -1496,8 +1502,12 @@ int ext4_es_remove_extent(struct inode *inode, ext4_lblk_t lblk,
+ */
+ write_lock(&EXT4_I(inode)->i_es_lock);
+ err = __es_remove_extent(inode, lblk, end, &reserved, es);
+- if (es && !es->es_len)
+- __es_free_extent(es);
++ /* Free preallocated extent if it didn't get used. */
++ if (es) {
++ if (!es->es_len)
++ __es_free_extent(es);
++ es = NULL;
++ }
+ write_unlock(&EXT4_I(inode)->i_es_lock);
+ if (err)
+ goto retry;
+@@ -2055,19 +2065,25 @@ int ext4_es_insert_delayed_block(struct inode *inode, ext4_lblk_t lblk,
+ err1 = __es_remove_extent(inode, lblk, lblk, NULL, es1);
+ if (err1 != 0)
+ goto error;
++ /* Free preallocated extent if it didn't get used. */
++ if (es1) {
++ if (!es1->es_len)
++ __es_free_extent(es1);
++ es1 = NULL;
++ }
+
+ err2 = __es_insert_extent(inode, &newes, es2);
+ if (err2 != 0)
+ goto error;
++ /* Free preallocated extent if it didn't get used. */
++ if (es2) {
++ if (!es2->es_len)
++ __es_free_extent(es2);
++ es2 = NULL;
++ }
+
+ if (allocated)
+ __insert_pending(inode, lblk);
+-
+- /* es is pre-allocated but not used, free it. */
+- if (es1 && !es1->es_len)
+- __es_free_extent(es1);
+- if (es2 && !es2->es_len)
+- __es_free_extent(es2);
+ error:
+ write_unlock(&EXT4_I(inode)->i_es_lock);
+ if (err1 || err2)
+--
+2.42.0
+
--- /dev/null
+From 0262a62c68892a5ee1e313efc8b92c7c9d77fee0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Aug 2023 17:26:05 +0800
+Subject: ext4: make sure allocate pending entry not fail
+
+From: Zhang Yi <yi.zhang@huawei.com>
+
+[ Upstream commit 8e387c89e96b9543a339f84043cf9df15fed2632 ]
+
+__insert_pending() allocate memory in atomic context, so the allocation
+could fail, but we are not handling that failure now. It could lead
+ext4_es_remove_extent() to get wrong reserved clusters, and the global
+data blocks reservation count will be incorrect. The same to
+extents_status entry preallocation, preallocate pending entry out of the
+i_es_lock with __GFP_NOFAIL, make sure __insert_pending() and
+__revise_pending() always succeeds.
+
+Signed-off-by: Zhang Yi <yi.zhang@huawei.com>
+Cc: stable@kernel.org
+Link: https://lore.kernel.org/r/20230824092619.1327976-3-yi.zhang@huaweicloud.com
+Reviewed-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/extents_status.c | 123 ++++++++++++++++++++++++++++-----------
+ 1 file changed, 89 insertions(+), 34 deletions(-)
+
+diff --git a/fs/ext4/extents_status.c b/fs/ext4/extents_status.c
+index 6c55ab427e650..cccbdfd49a86b 100644
+--- a/fs/ext4/extents_status.c
++++ b/fs/ext4/extents_status.c
+@@ -152,8 +152,9 @@ static int __es_remove_extent(struct inode *inode, ext4_lblk_t lblk,
+ static int es_reclaim_extents(struct ext4_inode_info *ei, int *nr_to_scan);
+ static int __es_shrink(struct ext4_sb_info *sbi, int nr_to_scan,
+ struct ext4_inode_info *locked_ei);
+-static void __revise_pending(struct inode *inode, ext4_lblk_t lblk,
+- ext4_lblk_t len);
++static int __revise_pending(struct inode *inode, ext4_lblk_t lblk,
++ ext4_lblk_t len,
++ struct pending_reservation **prealloc);
+
+ int __init ext4_init_es(void)
+ {
+@@ -450,6 +451,19 @@ static void ext4_es_list_del(struct inode *inode)
+ spin_unlock(&sbi->s_es_lock);
+ }
+
++static inline struct pending_reservation *__alloc_pending(bool nofail)
++{
++ if (!nofail)
++ return kmem_cache_alloc(ext4_pending_cachep, GFP_ATOMIC);
++
++ return kmem_cache_zalloc(ext4_pending_cachep, GFP_KERNEL | __GFP_NOFAIL);
++}
++
++static inline void __free_pending(struct pending_reservation *pr)
++{
++ kmem_cache_free(ext4_pending_cachep, pr);
++}
++
+ /*
+ * Returns true if we cannot fail to allocate memory for this extent_status
+ * entry and cannot reclaim it until its status changes.
+@@ -841,11 +855,12 @@ int ext4_es_insert_extent(struct inode *inode, ext4_lblk_t lblk,
+ {
+ struct extent_status newes;
+ ext4_lblk_t end = lblk + len - 1;
+- int err1 = 0;
+- int err2 = 0;
++ int err1 = 0, err2 = 0, err3 = 0;
+ struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
+ struct extent_status *es1 = NULL;
+ struct extent_status *es2 = NULL;
++ struct pending_reservation *pr = NULL;
++ bool revise_pending = false;
+
+ if (EXT4_SB(inode->i_sb)->s_mount_state & EXT4_FC_REPLAY)
+ return 0;
+@@ -873,11 +888,17 @@ int ext4_es_insert_extent(struct inode *inode, ext4_lblk_t lblk,
+
+ ext4_es_insert_extent_check(inode, &newes);
+
++ revise_pending = sbi->s_cluster_ratio > 1 &&
++ test_opt(inode->i_sb, DELALLOC) &&
++ (status & (EXTENT_STATUS_WRITTEN |
++ EXTENT_STATUS_UNWRITTEN));
+ retry:
+ if (err1 && !es1)
+ es1 = __es_alloc_extent(true);
+ if ((err1 || err2) && !es2)
+ es2 = __es_alloc_extent(true);
++ if ((err1 || err2 || err3) && revise_pending && !pr)
++ pr = __alloc_pending(true);
+ write_lock(&EXT4_I(inode)->i_es_lock);
+
+ err1 = __es_remove_extent(inode, lblk, end, NULL, es1);
+@@ -902,13 +923,18 @@ int ext4_es_insert_extent(struct inode *inode, ext4_lblk_t lblk,
+ es2 = NULL;
+ }
+
+- if (sbi->s_cluster_ratio > 1 && test_opt(inode->i_sb, DELALLOC) &&
+- (status & EXTENT_STATUS_WRITTEN ||
+- status & EXTENT_STATUS_UNWRITTEN))
+- __revise_pending(inode, lblk, len);
++ if (revise_pending) {
++ err3 = __revise_pending(inode, lblk, len, &pr);
++ if (err3 != 0)
++ goto error;
++ if (pr) {
++ __free_pending(pr);
++ pr = NULL;
++ }
++ }
+ error:
+ write_unlock(&EXT4_I(inode)->i_es_lock);
+- if (err1 || err2)
++ if (err1 || err2 || err3)
+ goto retry;
+
+ ext4_es_print_tree(inode);
+@@ -1316,7 +1342,7 @@ static unsigned int get_rsvd(struct inode *inode, ext4_lblk_t end,
+ rc->ndelonly--;
+ node = rb_next(&pr->rb_node);
+ rb_erase(&pr->rb_node, &tree->root);
+- kmem_cache_free(ext4_pending_cachep, pr);
++ __free_pending(pr);
+ if (!node)
+ break;
+ pr = rb_entry(node, struct pending_reservation,
+@@ -1913,11 +1939,13 @@ static struct pending_reservation *__get_pending(struct inode *inode,
+ *
+ * @inode - file containing the cluster
+ * @lblk - logical block in the cluster to be added
++ * @prealloc - preallocated pending entry
+ *
+ * Returns 0 on successful insertion and -ENOMEM on failure. If the
+ * pending reservation is already in the set, returns successfully.
+ */
+-static int __insert_pending(struct inode *inode, ext4_lblk_t lblk)
++static int __insert_pending(struct inode *inode, ext4_lblk_t lblk,
++ struct pending_reservation **prealloc)
+ {
+ struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
+ struct ext4_pending_tree *tree = &EXT4_I(inode)->i_pending_tree;
+@@ -1943,10 +1971,15 @@ static int __insert_pending(struct inode *inode, ext4_lblk_t lblk)
+ }
+ }
+
+- pr = kmem_cache_alloc(ext4_pending_cachep, GFP_ATOMIC);
+- if (pr == NULL) {
+- ret = -ENOMEM;
+- goto out;
++ if (likely(*prealloc == NULL)) {
++ pr = __alloc_pending(false);
++ if (!pr) {
++ ret = -ENOMEM;
++ goto out;
++ }
++ } else {
++ pr = *prealloc;
++ *prealloc = NULL;
+ }
+ pr->lclu = lclu;
+
+@@ -1976,7 +2009,7 @@ static void __remove_pending(struct inode *inode, ext4_lblk_t lblk)
+ if (pr != NULL) {
+ tree = &EXT4_I(inode)->i_pending_tree;
+ rb_erase(&pr->rb_node, &tree->root);
+- kmem_cache_free(ext4_pending_cachep, pr);
++ __free_pending(pr);
+ }
+ }
+
+@@ -2037,10 +2070,10 @@ int ext4_es_insert_delayed_block(struct inode *inode, ext4_lblk_t lblk,
+ bool allocated)
+ {
+ struct extent_status newes;
+- int err1 = 0;
+- int err2 = 0;
++ int err1 = 0, err2 = 0, err3 = 0;
+ struct extent_status *es1 = NULL;
+ struct extent_status *es2 = NULL;
++ struct pending_reservation *pr = NULL;
+
+ if (EXT4_SB(inode->i_sb)->s_mount_state & EXT4_FC_REPLAY)
+ return 0;
+@@ -2060,6 +2093,8 @@ int ext4_es_insert_delayed_block(struct inode *inode, ext4_lblk_t lblk,
+ es1 = __es_alloc_extent(true);
+ if ((err1 || err2) && !es2)
+ es2 = __es_alloc_extent(true);
++ if ((err1 || err2 || err3) && allocated && !pr)
++ pr = __alloc_pending(true);
+ write_lock(&EXT4_I(inode)->i_es_lock);
+
+ err1 = __es_remove_extent(inode, lblk, lblk, NULL, es1);
+@@ -2082,11 +2117,18 @@ int ext4_es_insert_delayed_block(struct inode *inode, ext4_lblk_t lblk,
+ es2 = NULL;
+ }
+
+- if (allocated)
+- __insert_pending(inode, lblk);
++ if (allocated) {
++ err3 = __insert_pending(inode, lblk, &pr);
++ if (err3 != 0)
++ goto error;
++ if (pr) {
++ __free_pending(pr);
++ pr = NULL;
++ }
++ }
+ error:
+ write_unlock(&EXT4_I(inode)->i_es_lock);
+- if (err1 || err2)
++ if (err1 || err2 || err3)
+ goto retry;
+
+ ext4_es_print_tree(inode);
+@@ -2192,21 +2234,24 @@ unsigned int ext4_es_delayed_clu(struct inode *inode, ext4_lblk_t lblk,
+ * @inode - file containing the range
+ * @lblk - logical block defining the start of range
+ * @len - length of range in blocks
++ * @prealloc - preallocated pending entry
+ *
+ * Used after a newly allocated extent is added to the extents status tree.
+ * Requires that the extents in the range have either written or unwritten
+ * status. Must be called while holding i_es_lock.
+ */
+-static void __revise_pending(struct inode *inode, ext4_lblk_t lblk,
+- ext4_lblk_t len)
++static int __revise_pending(struct inode *inode, ext4_lblk_t lblk,
++ ext4_lblk_t len,
++ struct pending_reservation **prealloc)
+ {
+ struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
+ ext4_lblk_t end = lblk + len - 1;
+ ext4_lblk_t first, last;
+ bool f_del = false, l_del = false;
++ int ret = 0;
+
+ if (len == 0)
+- return;
++ return 0;
+
+ /*
+ * Two cases - block range within single cluster and block range
+@@ -2227,7 +2272,9 @@ static void __revise_pending(struct inode *inode, ext4_lblk_t lblk,
+ f_del = __es_scan_range(inode, &ext4_es_is_delonly,
+ first, lblk - 1);
+ if (f_del) {
+- __insert_pending(inode, first);
++ ret = __insert_pending(inode, first, prealloc);
++ if (ret < 0)
++ goto out;
+ } else {
+ last = EXT4_LBLK_CMASK(sbi, end) +
+ sbi->s_cluster_ratio - 1;
+@@ -2235,9 +2282,11 @@ static void __revise_pending(struct inode *inode, ext4_lblk_t lblk,
+ l_del = __es_scan_range(inode,
+ &ext4_es_is_delonly,
+ end + 1, last);
+- if (l_del)
+- __insert_pending(inode, last);
+- else
++ if (l_del) {
++ ret = __insert_pending(inode, last, prealloc);
++ if (ret < 0)
++ goto out;
++ } else
+ __remove_pending(inode, last);
+ }
+ } else {
+@@ -2245,18 +2294,24 @@ static void __revise_pending(struct inode *inode, ext4_lblk_t lblk,
+ if (first != lblk)
+ f_del = __es_scan_range(inode, &ext4_es_is_delonly,
+ first, lblk - 1);
+- if (f_del)
+- __insert_pending(inode, first);
+- else
++ if (f_del) {
++ ret = __insert_pending(inode, first, prealloc);
++ if (ret < 0)
++ goto out;
++ } else
+ __remove_pending(inode, first);
+
+ last = EXT4_LBLK_CMASK(sbi, end) + sbi->s_cluster_ratio - 1;
+ if (last != end)
+ l_del = __es_scan_range(inode, &ext4_es_is_delonly,
+ end + 1, last);
+- if (l_del)
+- __insert_pending(inode, last);
+- else
++ if (l_del) {
++ ret = __insert_pending(inode, last, prealloc);
++ if (ret < 0)
++ goto out;
++ } else
+ __remove_pending(inode, last);
+ }
++out:
++ return ret;
+ }
+--
+2.42.0
+
--- /dev/null
+From 3fe4a530972711a8eea1f1d98088146406867d9e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Apr 2023 11:38:38 +0800
+Subject: ext4: use pre-allocated es in __es_insert_extent()
+
+From: Baokun Li <libaokun1@huawei.com>
+
+[ Upstream commit 95f0b320339a977cf69872eac107122bf536775d ]
+
+Pass a extent_status pointer prealloc to __es_insert_extent(). If the
+pointer is non-null, it is used directly when a new extent_status is
+needed to avoid memory allocation failures.
+
+Suggested-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Baokun Li <libaokun1@huawei.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Link: https://lore.kernel.org/r/20230424033846.4732-5-libaokun1@huawei.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Stable-dep-of: 8e387c89e96b ("ext4: make sure allocate pending entry not fail")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/extents_status.c | 19 ++++++++++++-------
+ 1 file changed, 12 insertions(+), 7 deletions(-)
+
+diff --git a/fs/ext4/extents_status.c b/fs/ext4/extents_status.c
+index 012033db41062..0d810ce7580d1 100644
+--- a/fs/ext4/extents_status.c
++++ b/fs/ext4/extents_status.c
+@@ -144,7 +144,8 @@
+ static struct kmem_cache *ext4_es_cachep;
+ static struct kmem_cache *ext4_pending_cachep;
+
+-static int __es_insert_extent(struct inode *inode, struct extent_status *newes);
++static int __es_insert_extent(struct inode *inode, struct extent_status *newes,
++ struct extent_status *prealloc);
+ static int __es_remove_extent(struct inode *inode, ext4_lblk_t lblk,
+ ext4_lblk_t end, int *reserved);
+ static int es_reclaim_extents(struct ext4_inode_info *ei, int *nr_to_scan);
+@@ -769,7 +770,8 @@ static inline void ext4_es_insert_extent_check(struct inode *inode,
+ }
+ #endif
+
+-static int __es_insert_extent(struct inode *inode, struct extent_status *newes)
++static int __es_insert_extent(struct inode *inode, struct extent_status *newes,
++ struct extent_status *prealloc)
+ {
+ struct ext4_es_tree *tree = &EXT4_I(inode)->i_es_tree;
+ struct rb_node **p = &tree->root.rb_node;
+@@ -809,7 +811,10 @@ static int __es_insert_extent(struct inode *inode, struct extent_status *newes)
+ }
+ }
+
+- es = __es_alloc_extent(false);
++ if (prealloc)
++ es = prealloc;
++ else
++ es = __es_alloc_extent(false);
+ if (!es)
+ return -ENOMEM;
+ ext4_es_init_extent(inode, es, newes->es_lblk, newes->es_len,
+@@ -869,7 +874,7 @@ int ext4_es_insert_extent(struct inode *inode, ext4_lblk_t lblk,
+ if (err != 0)
+ goto error;
+ retry:
+- err = __es_insert_extent(inode, &newes);
++ err = __es_insert_extent(inode, &newes, NULL);
+ if (err == -ENOMEM && __es_shrink(EXT4_SB(inode->i_sb),
+ 128, EXT4_I(inode)))
+ goto retry;
+@@ -919,7 +924,7 @@ void ext4_es_cache_extent(struct inode *inode, ext4_lblk_t lblk,
+
+ es = __es_tree_search(&EXT4_I(inode)->i_es_tree.root, lblk);
+ if (!es || es->es_lblk > end)
+- __es_insert_extent(inode, &newes);
++ __es_insert_extent(inode, &newes, NULL);
+ write_unlock(&EXT4_I(inode)->i_es_lock);
+ }
+
+@@ -1365,7 +1370,7 @@ static int __es_remove_extent(struct inode *inode, ext4_lblk_t lblk,
+ orig_es.es_len - len2;
+ ext4_es_store_pblock_status(&newes, block,
+ ext4_es_status(&orig_es));
+- err = __es_insert_extent(inode, &newes);
++ err = __es_insert_extent(inode, &newes, NULL);
+ if (err) {
+ es->es_lblk = orig_es.es_lblk;
+ es->es_len = orig_es.es_len;
+@@ -2020,7 +2025,7 @@ int ext4_es_insert_delayed_block(struct inode *inode, ext4_lblk_t lblk,
+ if (err != 0)
+ goto error;
+ retry:
+- err = __es_insert_extent(inode, &newes);
++ err = __es_insert_extent(inode, &newes, NULL);
+ if (err == -ENOMEM && __es_shrink(EXT4_SB(inode->i_sb),
+ 128, EXT4_I(inode)))
+ goto retry;
+--
+2.42.0
+
--- /dev/null
+From f4acc02ce25e074e1a7c1eb8e947e4d1b59da018 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Apr 2023 11:38:39 +0800
+Subject: ext4: use pre-allocated es in __es_remove_extent()
+
+From: Baokun Li <libaokun1@huawei.com>
+
+[ Upstream commit bda3efaf774fb687c2b7a555aaec3006b14a8857 ]
+
+When splitting extent, if the second extent can not be dropped, we return
+-ENOMEM and use GFP_NOFAIL to preallocate an extent_status outside of
+i_es_lock and pass it to __es_remove_extent() to be used as the second
+extent. This ensures that __es_remove_extent() is executed successfully,
+thus ensuring consistency in the extent status tree. If the second extent
+is not undroppable, we simply drop it and return 0. Then retry is no longer
+necessary, remove it.
+
+Now, __es_remove_extent() will always remove what it should, maybe more.
+
+Suggested-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Baokun Li <libaokun1@huawei.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Link: https://lore.kernel.org/r/20230424033846.4732-6-libaokun1@huawei.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Stable-dep-of: 8e387c89e96b ("ext4: make sure allocate pending entry not fail")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/extents_status.c | 26 +++++++++++++-------------
+ 1 file changed, 13 insertions(+), 13 deletions(-)
+
+diff --git a/fs/ext4/extents_status.c b/fs/ext4/extents_status.c
+index 0d810ce7580d1..10550d62a6763 100644
+--- a/fs/ext4/extents_status.c
++++ b/fs/ext4/extents_status.c
+@@ -147,7 +147,8 @@ static struct kmem_cache *ext4_pending_cachep;
+ static int __es_insert_extent(struct inode *inode, struct extent_status *newes,
+ struct extent_status *prealloc);
+ static int __es_remove_extent(struct inode *inode, ext4_lblk_t lblk,
+- ext4_lblk_t end, int *reserved);
++ ext4_lblk_t end, int *reserved,
++ struct extent_status *prealloc);
+ static int es_reclaim_extents(struct ext4_inode_info *ei, int *nr_to_scan);
+ static int __es_shrink(struct ext4_sb_info *sbi, int nr_to_scan,
+ struct ext4_inode_info *locked_ei);
+@@ -870,7 +871,7 @@ int ext4_es_insert_extent(struct inode *inode, ext4_lblk_t lblk,
+ ext4_es_insert_extent_check(inode, &newes);
+
+ write_lock(&EXT4_I(inode)->i_es_lock);
+- err = __es_remove_extent(inode, lblk, end, NULL);
++ err = __es_remove_extent(inode, lblk, end, NULL, NULL);
+ if (err != 0)
+ goto error;
+ retry:
+@@ -1314,6 +1315,7 @@ static unsigned int get_rsvd(struct inode *inode, ext4_lblk_t end,
+ * @lblk - first block in range
+ * @end - last block in range
+ * @reserved - number of cluster reservations released
++ * @prealloc - pre-allocated es to avoid memory allocation failures
+ *
+ * If @reserved is not NULL and delayed allocation is enabled, counts
+ * block/cluster reservations freed by removing range and if bigalloc
+@@ -1321,7 +1323,8 @@ static unsigned int get_rsvd(struct inode *inode, ext4_lblk_t end,
+ * error code on failure.
+ */
+ static int __es_remove_extent(struct inode *inode, ext4_lblk_t lblk,
+- ext4_lblk_t end, int *reserved)
++ ext4_lblk_t end, int *reserved,
++ struct extent_status *prealloc)
+ {
+ struct ext4_es_tree *tree = &EXT4_I(inode)->i_es_tree;
+ struct rb_node *node;
+@@ -1329,14 +1332,12 @@ static int __es_remove_extent(struct inode *inode, ext4_lblk_t lblk,
+ struct extent_status orig_es;
+ ext4_lblk_t len1, len2;
+ ext4_fsblk_t block;
+- int err;
++ int err = 0;
+ bool count_reserved = true;
+ struct rsvd_count rc;
+
+ if (reserved == NULL || !test_opt(inode->i_sb, DELALLOC))
+ count_reserved = false;
+-retry:
+- err = 0;
+
+ es = __es_tree_search(&tree->root, lblk);
+ if (!es)
+@@ -1370,14 +1371,13 @@ static int __es_remove_extent(struct inode *inode, ext4_lblk_t lblk,
+ orig_es.es_len - len2;
+ ext4_es_store_pblock_status(&newes, block,
+ ext4_es_status(&orig_es));
+- err = __es_insert_extent(inode, &newes, NULL);
++ err = __es_insert_extent(inode, &newes, prealloc);
+ if (err) {
++ if (!ext4_es_must_keep(&newes))
++ return 0;
++
+ es->es_lblk = orig_es.es_lblk;
+ es->es_len = orig_es.es_len;
+- if ((err == -ENOMEM) &&
+- __es_shrink(EXT4_SB(inode->i_sb),
+- 128, EXT4_I(inode)))
+- goto retry;
+ goto out;
+ }
+ } else {
+@@ -1477,7 +1477,7 @@ int ext4_es_remove_extent(struct inode *inode, ext4_lblk_t lblk,
+ * is reclaimed.
+ */
+ write_lock(&EXT4_I(inode)->i_es_lock);
+- err = __es_remove_extent(inode, lblk, end, &reserved);
++ err = __es_remove_extent(inode, lblk, end, &reserved, NULL);
+ write_unlock(&EXT4_I(inode)->i_es_lock);
+ ext4_es_print_tree(inode);
+ ext4_da_release_space(inode, reserved);
+@@ -2021,7 +2021,7 @@ int ext4_es_insert_delayed_block(struct inode *inode, ext4_lblk_t lblk,
+
+ write_lock(&EXT4_I(inode)->i_es_lock);
+
+- err = __es_remove_extent(inode, lblk, lblk, NULL);
++ err = __es_remove_extent(inode, lblk, lblk, NULL, NULL);
+ if (err != 0)
+ goto error;
+ retry:
+--
+2.42.0
+
--- /dev/null
+From 5ea968a7d71f676bb073af14e262b0cf3ce8721a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Apr 2023 11:38:41 +0800
+Subject: ext4: using nofail preallocation in ext4_es_insert_delayed_block()
+
+From: Baokun Li <libaokun1@huawei.com>
+
+[ Upstream commit 4a2d98447b37bcb68a7f06a1078edcb4f7e6ce7e ]
+
+Similar to in ext4_es_remove_extent(), we use a no-fail preallocation
+to avoid inconsistencies, except that here we may have to preallocate
+two extent_status.
+
+Suggested-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Baokun Li <libaokun1@huawei.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Link: https://lore.kernel.org/r/20230424033846.4732-8-libaokun1@huawei.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Stable-dep-of: 8e387c89e96b ("ext4: make sure allocate pending entry not fail")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/extents_status.c | 33 ++++++++++++++++++++++-----------
+ 1 file changed, 22 insertions(+), 11 deletions(-)
+
+diff --git a/fs/ext4/extents_status.c b/fs/ext4/extents_status.c
+index 4af825eb0cb45..4163a4801f969 100644
+--- a/fs/ext4/extents_status.c
++++ b/fs/ext4/extents_status.c
+@@ -2013,7 +2013,10 @@ int ext4_es_insert_delayed_block(struct inode *inode, ext4_lblk_t lblk,
+ bool allocated)
+ {
+ struct extent_status newes;
+- int err = 0;
++ int err1 = 0;
++ int err2 = 0;
++ struct extent_status *es1 = NULL;
++ struct extent_status *es2 = NULL;
+
+ if (EXT4_SB(inode->i_sb)->s_mount_state & EXT4_FC_REPLAY)
+ return 0;
+@@ -2028,29 +2031,37 @@ int ext4_es_insert_delayed_block(struct inode *inode, ext4_lblk_t lblk,
+
+ ext4_es_insert_extent_check(inode, &newes);
+
++retry:
++ if (err1 && !es1)
++ es1 = __es_alloc_extent(true);
++ if ((err1 || err2) && !es2)
++ es2 = __es_alloc_extent(true);
+ write_lock(&EXT4_I(inode)->i_es_lock);
+
+- err = __es_remove_extent(inode, lblk, lblk, NULL, NULL);
+- if (err != 0)
++ err1 = __es_remove_extent(inode, lblk, lblk, NULL, es1);
++ if (err1 != 0)
+ goto error;
+-retry:
+- err = __es_insert_extent(inode, &newes, NULL);
+- if (err == -ENOMEM && __es_shrink(EXT4_SB(inode->i_sb),
+- 128, EXT4_I(inode)))
+- goto retry;
+- if (err != 0)
++
++ err2 = __es_insert_extent(inode, &newes, es2);
++ if (err2 != 0)
+ goto error;
+
+ if (allocated)
+ __insert_pending(inode, lblk);
+
++ /* es is pre-allocated but not used, free it. */
++ if (es1 && !es1->es_len)
++ __es_free_extent(es1);
++ if (es2 && !es2->es_len)
++ __es_free_extent(es2);
+ error:
+ write_unlock(&EXT4_I(inode)->i_es_lock);
++ if (err1 || err2)
++ goto retry;
+
+ ext4_es_print_tree(inode);
+ ext4_print_pending_tree(inode);
+-
+- return err;
++ return 0;
+ }
+
+ /*
+--
+2.42.0
+
--- /dev/null
+From e350fdc97bd232bfdfc25baf4527bc757499bbc9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Apr 2023 11:38:42 +0800
+Subject: ext4: using nofail preallocation in ext4_es_insert_extent()
+
+From: Baokun Li <libaokun1@huawei.com>
+
+[ Upstream commit 2a69c450083db164596c75c0f5b4d9c4c0e18eba ]
+
+Similar to in ext4_es_insert_delayed_block(), we use preallocations that
+do not fail to avoid inconsistencies, but we do not care about es that are
+not must be kept, and we return 0 even if such es memory allocation fails.
+
+Suggested-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Baokun Li <libaokun1@huawei.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Link: https://lore.kernel.org/r/20230424033846.4732-9-libaokun1@huawei.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Stable-dep-of: 8e387c89e96b ("ext4: make sure allocate pending entry not fail")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/extents_status.c | 38 ++++++++++++++++++++++++++------------
+ 1 file changed, 26 insertions(+), 12 deletions(-)
+
+diff --git a/fs/ext4/extents_status.c b/fs/ext4/extents_status.c
+index 4163a4801f969..1327cd9505db7 100644
+--- a/fs/ext4/extents_status.c
++++ b/fs/ext4/extents_status.c
+@@ -841,8 +841,11 @@ int ext4_es_insert_extent(struct inode *inode, ext4_lblk_t lblk,
+ {
+ struct extent_status newes;
+ ext4_lblk_t end = lblk + len - 1;
+- int err = 0;
++ int err1 = 0;
++ int err2 = 0;
+ struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
++ struct extent_status *es1 = NULL;
++ struct extent_status *es2 = NULL;
+
+ if (EXT4_SB(inode->i_sb)->s_mount_state & EXT4_FC_REPLAY)
+ return 0;
+@@ -870,29 +873,40 @@ int ext4_es_insert_extent(struct inode *inode, ext4_lblk_t lblk,
+
+ ext4_es_insert_extent_check(inode, &newes);
+
++retry:
++ if (err1 && !es1)
++ es1 = __es_alloc_extent(true);
++ if ((err1 || err2) && !es2)
++ es2 = __es_alloc_extent(true);
+ write_lock(&EXT4_I(inode)->i_es_lock);
+- err = __es_remove_extent(inode, lblk, end, NULL, NULL);
+- if (err != 0)
++
++ err1 = __es_remove_extent(inode, lblk, end, NULL, es1);
++ if (err1 != 0)
++ goto error;
++
++ err2 = __es_insert_extent(inode, &newes, es2);
++ if (err2 == -ENOMEM && !ext4_es_must_keep(&newes))
++ err2 = 0;
++ if (err2 != 0)
+ goto error;
+-retry:
+- err = __es_insert_extent(inode, &newes, NULL);
+- if (err == -ENOMEM && __es_shrink(EXT4_SB(inode->i_sb),
+- 128, EXT4_I(inode)))
+- goto retry;
+- if (err == -ENOMEM && !ext4_es_must_keep(&newes))
+- err = 0;
+
+ if (sbi->s_cluster_ratio > 1 && test_opt(inode->i_sb, DELALLOC) &&
+ (status & EXTENT_STATUS_WRITTEN ||
+ status & EXTENT_STATUS_UNWRITTEN))
+ __revise_pending(inode, lblk, len);
+
++ /* es is pre-allocated but not used, free it. */
++ if (es1 && !es1->es_len)
++ __es_free_extent(es1);
++ if (es2 && !es2->es_len)
++ __es_free_extent(es2);
+ error:
+ write_unlock(&EXT4_I(inode)->i_es_lock);
++ if (err1 || err2)
++ goto retry;
+
+ ext4_es_print_tree(inode);
+-
+- return err;
++ return 0;
+ }
+
+ /*
+--
+2.42.0
+
--- /dev/null
+From 75d2ec91ef3a7ce24ce03adaf1b5a0f92dccc0f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Apr 2023 11:38:40 +0800
+Subject: ext4: using nofail preallocation in ext4_es_remove_extent()
+
+From: Baokun Li <libaokun1@huawei.com>
+
+[ Upstream commit e9fe2b882bd5b26b987c9ba110c2222796f72af5 ]
+
+If __es_remove_extent() returns an error it means that when splitting
+extent, allocating an extent that must be kept failed, where returning
+an error directly would cause the extent tree to be inconsistent. So we
+use GFP_NOFAIL to pre-allocate an extent_status and pass it to
+__es_remove_extent() to avoid this problem.
+
+In addition, since the allocated memory is outside the i_es_lock, the
+extent_status tree may change and the pre-allocated extent_status is
+no longer needed, so we release the pre-allocated extent_status when
+es->es_len is not initialized.
+
+Suggested-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Baokun Li <libaokun1@huawei.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Link: https://lore.kernel.org/r/20230424033846.4732-7-libaokun1@huawei.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Stable-dep-of: 8e387c89e96b ("ext4: make sure allocate pending entry not fail")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/extents_status.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/fs/ext4/extents_status.c b/fs/ext4/extents_status.c
+index 10550d62a6763..4af825eb0cb45 100644
+--- a/fs/ext4/extents_status.c
++++ b/fs/ext4/extents_status.c
+@@ -1457,6 +1457,7 @@ int ext4_es_remove_extent(struct inode *inode, ext4_lblk_t lblk,
+ ext4_lblk_t end;
+ int err = 0;
+ int reserved = 0;
++ struct extent_status *es = NULL;
+
+ if (EXT4_SB(inode->i_sb)->s_mount_state & EXT4_FC_REPLAY)
+ return 0;
+@@ -1471,17 +1472,25 @@ int ext4_es_remove_extent(struct inode *inode, ext4_lblk_t lblk,
+ end = lblk + len - 1;
+ BUG_ON(end < lblk);
+
++retry:
++ if (err && !es)
++ es = __es_alloc_extent(true);
+ /*
+ * ext4_clear_inode() depends on us taking i_es_lock unconditionally
+ * so that we are sure __es_shrink() is done with the inode before it
+ * is reclaimed.
+ */
+ write_lock(&EXT4_I(inode)->i_es_lock);
+- err = __es_remove_extent(inode, lblk, end, &reserved, NULL);
++ err = __es_remove_extent(inode, lblk, end, &reserved, es);
++ if (es && !es->es_len)
++ __es_free_extent(es);
+ write_unlock(&EXT4_I(inode)->i_es_lock);
++ if (err)
++ goto retry;
++
+ ext4_es_print_tree(inode);
+ ext4_da_release_space(inode, reserved);
+- return err;
++ return 0;
+ }
+
+ static int __es_shrink(struct ext4_sb_info *sbi, int nr_to_scan,
+--
+2.42.0
+
--- /dev/null
+From d235a1740f82d823a3d4abbc1d337244a834c597 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Sep 2022 15:29:23 +0200
+Subject: HID: core: store the unique system identifier in hid_device
+
+From: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+
+[ Upstream commit 1e839143d674603b0bbbc4c513bca35404967dbc ]
+
+This unique identifier is currently used only for ensuring uniqueness in
+sysfs. However, this could be handful for userspace to refer to a specific
+hid_device by this id.
+
+2 use cases are in my mind: LEDs (and their naming convention), and
+HID-BPF.
+
+Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Link: https://lore.kernel.org/r/20220902132938.2409206-9-benjamin.tissoires@redhat.com
+Stable-dep-of: fc43e9c857b7 ("HID: fix HID device resource race between HID core and debugging support")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-core.c | 4 +++-
+ include/linux/hid.h | 2 ++
+ 2 files changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
+index 524d6d712e724..ab3bca4d5ad2b 100644
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -2444,10 +2444,12 @@ int hid_add_device(struct hid_device *hdev)
+ hid_warn(hdev, "bad device descriptor (%d)\n", ret);
+ }
+
++ hdev->id = atomic_inc_return(&id);
++
+ /* XXX hack, any other cleaner solution after the driver core
+ * is converted to allow more than 20 bytes as the device name? */
+ dev_set_name(&hdev->dev, "%04X:%04X:%04X.%04X", hdev->bus,
+- hdev->vendor, hdev->product, atomic_inc_return(&id));
++ hdev->vendor, hdev->product, hdev->id);
+
+ hid_debug_register(hdev, dev_name(&hdev->dev));
+ ret = device_add(&hdev->dev);
+diff --git a/include/linux/hid.h b/include/linux/hid.h
+index 256f34f49167c..7818dbafab0f7 100644
+--- a/include/linux/hid.h
++++ b/include/linux/hid.h
+@@ -624,6 +624,8 @@ struct hid_device { /* device report descriptor */
+ struct list_head debug_list;
+ spinlock_t debug_list_lock;
+ wait_queue_head_t debug_wait;
++
++ unsigned int id; /* system unique id */
+ };
+
+ #define to_hid_device(pdev) \
+--
+2.42.0
+
--- /dev/null
+From b13dffafa0b8815f7cfbb7a4270af6689e937fa2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Oct 2023 12:32:39 +0800
+Subject: HID: fix HID device resource race between HID core and debugging
+ support
+
+From: Charles Yi <be286@163.com>
+
+[ Upstream commit fc43e9c857b7aa55efba9398419b14d9e35dcc7d ]
+
+hid_debug_events_release releases resources bound to the HID device instance.
+hid_device_release releases the underlying HID device instance potentially
+before hid_debug_events_release has completed releasing debug resources bound
+to the same HID device instance.
+
+Reference count to prevent the HID device instance from being torn down
+preemptively when HID debugging support is used. When count reaches zero,
+release core resources of HID device instance using hiddev_free.
+
+The crash:
+
+[ 120.728477][ T4396] kernel BUG at lib/list_debug.c:53!
+[ 120.728505][ T4396] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP
+[ 120.739806][ T4396] Modules linked in: bcmdhd dhd_static_buf 8822cu pcie_mhi r8168
+[ 120.747386][ T4396] CPU: 1 PID: 4396 Comm: hidt_bridge Not tainted 5.10.110 #257
+[ 120.754771][ T4396] Hardware name: Rockchip RK3588 EVB4 LP4 V10 Board (DT)
+[ 120.761643][ T4396] pstate: 60400089 (nZCv daIf +PAN -UAO -TCO BTYPE=--)
+[ 120.768338][ T4396] pc : __list_del_entry_valid+0x98/0xac
+[ 120.773730][ T4396] lr : __list_del_entry_valid+0x98/0xac
+[ 120.779120][ T4396] sp : ffffffc01e62bb60
+[ 120.783126][ T4396] x29: ffffffc01e62bb60 x28: ffffff818ce3a200
+[ 120.789126][ T4396] x27: 0000000000000009 x26: 0000000000980000
+[ 120.795126][ T4396] x25: ffffffc012431000 x24: ffffff802c6d4e00
+[ 120.801125][ T4396] x23: ffffff8005c66f00 x22: ffffffc01183b5b8
+[ 120.807125][ T4396] x21: ffffff819df2f100 x20: 0000000000000000
+[ 120.813124][ T4396] x19: ffffff802c3f0700 x18: ffffffc01d2cd058
+[ 120.819124][ T4396] x17: 0000000000000000 x16: 0000000000000000
+[ 120.825124][ T4396] x15: 0000000000000004 x14: 0000000000003fff
+[ 120.831123][ T4396] x13: ffffffc012085588 x12: 0000000000000003
+[ 120.837123][ T4396] x11: 00000000ffffbfff x10: 0000000000000003
+[ 120.843123][ T4396] x9 : 455103d46b329300 x8 : 455103d46b329300
+[ 120.849124][ T4396] x7 : 74707572726f6320 x6 : ffffffc0124b8cb5
+[ 120.855124][ T4396] x5 : ffffffffffffffff x4 : 0000000000000000
+[ 120.861123][ T4396] x3 : ffffffc011cf4f90 x2 : ffffff81fee7b948
+[ 120.867122][ T4396] x1 : ffffffc011cf4f90 x0 : 0000000000000054
+[ 120.873122][ T4396] Call trace:
+[ 120.876259][ T4396] __list_del_entry_valid+0x98/0xac
+[ 120.881304][ T4396] hid_debug_events_release+0x48/0x12c
+[ 120.886617][ T4396] full_proxy_release+0x50/0xbc
+[ 120.891323][ T4396] __fput+0xdc/0x238
+[ 120.895075][ T4396] ____fput+0x14/0x24
+[ 120.898911][ T4396] task_work_run+0x90/0x148
+[ 120.903268][ T4396] do_exit+0x1bc/0x8a4
+[ 120.907193][ T4396] do_group_exit+0x8c/0xa4
+[ 120.911458][ T4396] get_signal+0x468/0x744
+[ 120.915643][ T4396] do_signal+0x84/0x280
+[ 120.919650][ T4396] do_notify_resume+0xd0/0x218
+[ 120.924262][ T4396] work_pending+0xc/0x3f0
+
+[ Rahul Rameshbabu <sergeantsagara@protonmail.com>: rework changelog ]
+Fixes: cd667ce24796 ("HID: use debugfs for events/reports dumping")
+Signed-off-by: Charles Yi <be286@163.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-core.c | 12 ++++++++++--
+ drivers/hid/hid-debug.c | 3 +++
+ include/linux/hid.h | 3 +++
+ 3 files changed, 16 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
+index ab3bca4d5ad2b..476967ab6294c 100644
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -702,15 +702,22 @@ static void hid_close_report(struct hid_device *device)
+ * Free a device structure, all reports, and all fields.
+ */
+
+-static void hid_device_release(struct device *dev)
++void hiddev_free(struct kref *ref)
+ {
+- struct hid_device *hid = to_hid_device(dev);
++ struct hid_device *hid = container_of(ref, struct hid_device, ref);
+
+ hid_close_report(hid);
+ kfree(hid->dev_rdesc);
+ kfree(hid);
+ }
+
++static void hid_device_release(struct device *dev)
++{
++ struct hid_device *hid = to_hid_device(dev);
++
++ kref_put(&hid->ref, hiddev_free);
++}
++
+ /*
+ * Fetch a report description item from the data stream. We support long
+ * items, though they are not used yet.
+@@ -2492,6 +2499,7 @@ struct hid_device *hid_allocate_device(void)
+ spin_lock_init(&hdev->debug_list_lock);
+ sema_init(&hdev->driver_input_lock, 1);
+ mutex_init(&hdev->ll_open_lock);
++ kref_init(&hdev->ref);
+
+ return hdev;
+ }
+diff --git a/drivers/hid/hid-debug.c b/drivers/hid/hid-debug.c
+index 1f60a381ae63e..81da80f0c75b5 100644
+--- a/drivers/hid/hid-debug.c
++++ b/drivers/hid/hid-debug.c
+@@ -1082,6 +1082,7 @@ static int hid_debug_events_open(struct inode *inode, struct file *file)
+ goto out;
+ }
+ list->hdev = (struct hid_device *) inode->i_private;
++ kref_get(&list->hdev->ref);
+ file->private_data = list;
+ mutex_init(&list->read_mutex);
+
+@@ -1174,6 +1175,8 @@ static int hid_debug_events_release(struct inode *inode, struct file *file)
+ list_del(&list->node);
+ spin_unlock_irqrestore(&list->hdev->debug_list_lock, flags);
+ kfifo_free(&list->hid_debug_fifo);
++
++ kref_put(&list->hdev->ref, hiddev_free);
+ kfree(list);
+
+ return 0;
+diff --git a/include/linux/hid.h b/include/linux/hid.h
+index 7818dbafab0f7..9e306bf9959df 100644
+--- a/include/linux/hid.h
++++ b/include/linux/hid.h
+@@ -624,10 +624,13 @@ struct hid_device { /* device report descriptor */
+ struct list_head debug_list;
+ spinlock_t debug_list_lock;
+ wait_queue_head_t debug_wait;
++ struct kref ref;
+
+ unsigned int id; /* system unique id */
+ };
+
++void hiddev_free(struct kref *ref);
++
+ #define to_hid_device(pdev) \
+ container_of(pdev, struct hid_device, dev)
+
+--
+2.42.0
+
--- /dev/null
+From dab54a8c0116b011bf722a739768e1bfdb430298 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Apr 2016 08:54:30 +0800
+Subject: i2c: sun6i-p2wi: Prevent potential division by zero
+
+From: Axel Lin <axel.lin@ingics.com>
+
+[ Upstream commit 5ac61d26b8baff5b2e5a9f3dc1ef63297e4b53e7 ]
+
+Make sure we don't OOPS in case clock-frequency is set to 0 in a DT. The
+variable set here is later used as a divisor.
+
+Signed-off-by: Axel Lin <axel.lin@ingics.com>
+Acked-by: Boris Brezillon <boris.brezillon@free-electrons.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-sun6i-p2wi.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/i2c/busses/i2c-sun6i-p2wi.c b/drivers/i2c/busses/i2c-sun6i-p2wi.c
+index 4f7a4f5a1150a..389ca6fddc1db 100644
+--- a/drivers/i2c/busses/i2c-sun6i-p2wi.c
++++ b/drivers/i2c/busses/i2c-sun6i-p2wi.c
+@@ -206,6 +206,11 @@ static int p2wi_probe(struct platform_device *pdev)
+ return -EINVAL;
+ }
+
++ if (clk_freq == 0) {
++ dev_err(dev, "clock-frequency is set to 0 in DT\n");
++ return -EINVAL;
++ }
++
+ if (of_get_child_count(np) > 1) {
+ dev_err(dev, "P2WI only supports one slave device\n");
+ return -EINVAL;
+--
+2.42.0
+
--- /dev/null
+From 0a01ab17a19868a18fafc08fa058902fbad0f27e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 19 Nov 2023 22:17:59 +0800
+Subject: ipv4: Correct/silence an endian warning in __ip_do_redirect
+
+From: Kunwu Chan <chentao@kylinos.cn>
+
+[ Upstream commit c0e2926266af3b5acf28df0a8fc6e4d90effe0bb ]
+
+net/ipv4/route.c:783:46: warning: incorrect type in argument 2 (different base types)
+net/ipv4/route.c:783:46: expected unsigned int [usertype] key
+net/ipv4/route.c:783:46: got restricted __be32 [usertype] new_gw
+
+Fixes: 969447f226b4 ("ipv4: use new_gw for redirect neigh lookup")
+Suggested-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: Kunwu Chan <chentao@kylinos.cn>
+Link: https://lore.kernel.org/r/20231119141759.420477-1-chentao@kylinos.cn
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/route.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/ipv4/route.c b/net/ipv4/route.c
+index 445b1a2966d79..d360c7d70e8a2 100644
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -808,7 +808,7 @@ static void __ip_do_redirect(struct rtable *rt, struct sk_buff *skb, struct flow
+ goto reject_redirect;
+ }
+
+- n = __ipv4_neigh_lookup(rt->dst.dev, new_gw);
++ n = __ipv4_neigh_lookup(rt->dst.dev, (__force u32)new_gw);
+ if (!n)
+ n = neigh_create(&arp_tbl, &new_gw, rt->dst.dev);
+ if (!IS_ERR(n)) {
+--
+2.42.0
+
--- /dev/null
+From 800fc8815bfd2332760f3b4dc87f0c52e8020421 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Nov 2023 12:41:26 +0100
+Subject: lockdep: Fix block chain corruption
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+[ Upstream commit bca4104b00fec60be330cd32818dd5c70db3d469 ]
+
+Kent reported an occasional KASAN splat in lockdep. Mark then noted:
+
+> I suspect the dodgy access is to chain_block_buckets[-1], which hits the last 4
+> bytes of the redzone and gets (incorrectly/misleadingly) attributed to
+> nr_large_chain_blocks.
+
+That would mean @size == 0, at which point size_to_bucket() returns -1
+and the above happens.
+
+alloc_chain_hlocks() has 'size - req', for the first with the
+precondition 'size >= rq', which allows the 0.
+
+This code is trying to split a block, del_chain_block() takes what we
+need, and add_chain_block() puts back the remainder, except in the
+above case the remainder is 0 sized and things go sideways.
+
+Fixes: 810507fe6fd5 ("locking/lockdep: Reuse freed chain_hlocks entries")
+Reported-by: Kent Overstreet <kent.overstreet@linux.dev>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Tested-by: Kent Overstreet <kent.overstreet@linux.dev>
+Link: https://lkml.kernel.org/r/20231121114126.GH8262@noisy.programming.kicks-ass.net
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/locking/lockdep.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c
+index 6cbd2b4444769..7471d85f54ae5 100644
+--- a/kernel/locking/lockdep.c
++++ b/kernel/locking/lockdep.c
+@@ -3357,7 +3357,8 @@ static int alloc_chain_hlocks(int req)
+ size = chain_block_size(curr);
+ if (likely(size >= req)) {
+ del_chain_block(0, size, chain_block_next(curr));
+- add_chain_block(curr + req, size - req);
++ if (size > req)
++ add_chain_block(curr + req, size - req);
+ return curr;
+ }
+ }
+--
+2.42.0
+
--- /dev/null
+From 221bd319ad1f2f78a80d94e1ad69dc6d0760bf2d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Sep 2023 15:57:37 +0300
+Subject: media: ccs: Correctly initialise try compose rectangle
+
+From: Sakari Ailus <sakari.ailus@linux.intel.com>
+
+[ Upstream commit 724ff68e968b19d786870d333f9952bdd6b119cb ]
+
+Initialise the try sink compose rectangle size to the sink compose
+rectangle for binner and scaler sub-devices. This was missed due to the
+faulty condition that lead to the compose rectangles to be initialised for
+the pixel array sub-device where it is not relevant.
+
+Fixes: ccfc97bdb5ae ("[media] smiapp: Add driver")
+Cc: stable@vger.kernel.org
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/smiapp/smiapp-core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/i2c/smiapp/smiapp-core.c b/drivers/media/i2c/smiapp/smiapp-core.c
+index 8b8ef6c6d48d4..2d77829b514de 100644
+--- a/drivers/media/i2c/smiapp/smiapp-core.c
++++ b/drivers/media/i2c/smiapp/smiapp-core.c
+@@ -2764,7 +2764,7 @@ static int smiapp_open(struct v4l2_subdev *sd, struct v4l2_subdev_fh *fh)
+ try_fmt->code = sensor->internal_csi_format->code;
+ try_fmt->field = V4L2_FIELD_NONE;
+
+- if (ssd != sensor->pixel_array)
++ if (ssd == sensor->pixel_array)
+ continue;
+
+ try_comp = v4l2_subdev_get_try_compose(sd, fh->pad, i);
+--
+2.42.0
+
--- /dev/null
+From d3a9fd04ac0887211b23ac4adf3d24d3c030fba4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Sep 2020 18:23:41 +0200
+Subject: media: i2c: smiapp: simplify getting state container
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+[ Upstream commit b5783c4d1fbeb2fc2d2fc8f2844e07eb65fb2cd3 ]
+
+The pointer to 'struct v4l2_subdev' is stored in drvdata via
+v4l2_i2c_subdev_init() so there is no point of a dance like:
+
+ struct i2c_client *client = to_i2c_client(struct device *dev)
+ struct v4l2_subdev *sd = i2c_get_clientdata(client);
+
+This allows to remove local variable 'client' and few pointer
+dereferences.
+
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Stable-dep-of: 724ff68e968b ("media: ccs: Correctly initialise try compose rectangle")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/smiapp/smiapp-core.c | 28 ++++++++++++--------------
+ 1 file changed, 13 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/media/i2c/smiapp/smiapp-core.c b/drivers/media/i2c/smiapp/smiapp-core.c
+index 6fc0680a93d04..105ef29152e84 100644
+--- a/drivers/media/i2c/smiapp/smiapp-core.c
++++ b/drivers/media/i2c/smiapp/smiapp-core.c
+@@ -1185,8 +1185,7 @@ static int smiapp_setup_flash_strobe(struct smiapp_sensor *sensor)
+
+ static int smiapp_power_on(struct device *dev)
+ {
+- struct i2c_client *client = to_i2c_client(dev);
+- struct v4l2_subdev *subdev = i2c_get_clientdata(client);
++ struct v4l2_subdev *subdev = dev_get_drvdata(dev);
+ struct smiapp_subdev *ssd = to_smiapp_subdev(subdev);
+ /*
+ * The sub-device related to the I2C device is always the
+@@ -1199,14 +1198,14 @@ static int smiapp_power_on(struct device *dev)
+
+ rval = regulator_enable(sensor->vana);
+ if (rval) {
+- dev_err(&client->dev, "failed to enable vana regulator\n");
++ dev_err(dev, "failed to enable vana regulator\n");
+ return rval;
+ }
+ usleep_range(1000, 1000);
+
+ rval = clk_prepare_enable(sensor->ext_clk);
+ if (rval < 0) {
+- dev_dbg(&client->dev, "failed to enable xclk\n");
++ dev_dbg(dev, "failed to enable xclk\n");
+ goto out_xclk_fail;
+ }
+ usleep_range(1000, 1000);
+@@ -1230,7 +1229,7 @@ static int smiapp_power_on(struct device *dev)
+ if (sensor->hwcfg->i2c_addr_alt) {
+ rval = smiapp_change_cci_addr(sensor);
+ if (rval) {
+- dev_err(&client->dev, "cci address change error\n");
++ dev_err(dev, "cci address change error\n");
+ goto out_cci_addr_fail;
+ }
+ }
+@@ -1238,14 +1237,14 @@ static int smiapp_power_on(struct device *dev)
+ rval = smiapp_write(sensor, SMIAPP_REG_U8_SOFTWARE_RESET,
+ SMIAPP_SOFTWARE_RESET);
+ if (rval < 0) {
+- dev_err(&client->dev, "software reset failed\n");
++ dev_err(dev, "software reset failed\n");
+ goto out_cci_addr_fail;
+ }
+
+ if (sensor->hwcfg->i2c_addr_alt) {
+ rval = smiapp_change_cci_addr(sensor);
+ if (rval) {
+- dev_err(&client->dev, "cci address change error\n");
++ dev_err(dev, "cci address change error\n");
+ goto out_cci_addr_fail;
+ }
+ }
+@@ -1253,7 +1252,7 @@ static int smiapp_power_on(struct device *dev)
+ rval = smiapp_write(sensor, SMIAPP_REG_U16_COMPRESSION_MODE,
+ SMIAPP_COMPRESSION_MODE_SIMPLE_PREDICTOR);
+ if (rval) {
+- dev_err(&client->dev, "compression mode set failed\n");
++ dev_err(dev, "compression mode set failed\n");
+ goto out_cci_addr_fail;
+ }
+
+@@ -1261,28 +1260,28 @@ static int smiapp_power_on(struct device *dev)
+ sensor, SMIAPP_REG_U16_EXTCLK_FREQUENCY_MHZ,
+ sensor->hwcfg->ext_clk / (1000000 / (1 << 8)));
+ if (rval) {
+- dev_err(&client->dev, "extclk frequency set failed\n");
++ dev_err(dev, "extclk frequency set failed\n");
+ goto out_cci_addr_fail;
+ }
+
+ rval = smiapp_write(sensor, SMIAPP_REG_U8_CSI_LANE_MODE,
+ sensor->hwcfg->lanes - 1);
+ if (rval) {
+- dev_err(&client->dev, "csi lane mode set failed\n");
++ dev_err(dev, "csi lane mode set failed\n");
+ goto out_cci_addr_fail;
+ }
+
+ rval = smiapp_write(sensor, SMIAPP_REG_U8_FAST_STANDBY_CTRL,
+ SMIAPP_FAST_STANDBY_CTRL_IMMEDIATE);
+ if (rval) {
+- dev_err(&client->dev, "fast standby set failed\n");
++ dev_err(dev, "fast standby set failed\n");
+ goto out_cci_addr_fail;
+ }
+
+ rval = smiapp_write(sensor, SMIAPP_REG_U8_CSI_SIGNALLING_MODE,
+ sensor->hwcfg->csi_signalling_mode);
+ if (rval) {
+- dev_err(&client->dev, "csi signalling mode set failed\n");
++ dev_err(dev, "csi signalling mode set failed\n");
+ goto out_cci_addr_fail;
+ }
+
+@@ -1294,7 +1293,7 @@ static int smiapp_power_on(struct device *dev)
+
+ rval = smiapp_call_quirk(sensor, post_poweron);
+ if (rval) {
+- dev_err(&client->dev, "post_poweron quirks failed\n");
++ dev_err(dev, "post_poweron quirks failed\n");
+ goto out_cci_addr_fail;
+ }
+
+@@ -1312,8 +1311,7 @@ static int smiapp_power_on(struct device *dev)
+
+ static int smiapp_power_off(struct device *dev)
+ {
+- struct i2c_client *client = to_i2c_client(dev);
+- struct v4l2_subdev *subdev = i2c_get_clientdata(client);
++ struct v4l2_subdev *subdev = dev_get_drvdata(dev);
+ struct smiapp_subdev *ssd = to_smiapp_subdev(subdev);
+ struct smiapp_sensor *sensor =
+ container_of(ssd, struct smiapp_sensor, ssds[0]);
+--
+2.42.0
+
--- /dev/null
+From 0f37496a7f43d64678c633935964e014fcd677da Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Sep 2023 14:38:07 +0200
+Subject: media: imon: fix access to invalid resource for the second interface
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit a1766a4fd83befa0b34d932d532e7ebb7fab1fa7 ]
+
+imon driver probes two USB interfaces, and at the probe of the second
+interface, the driver assumes blindly that the first interface got
+bound with the same imon driver. It's usually true, but it's still
+possible that the first interface is bound with another driver via a
+malformed descriptor. Then it may lead to a memory corruption, as
+spotted by syzkaller; imon driver accesses the data from drvdata as
+struct imon_context object although it's a completely different one
+that was assigned by another driver.
+
+This patch adds a sanity check -- whether the first interface is
+really bound with the imon driver or not -- for avoiding the problem
+above at the probe time.
+
+Reported-by: syzbot+59875ffef5cb9c9b29e9@syzkaller.appspotmail.com
+Closes: https://lore.kernel.org/all/000000000000a838aa0603cc74d6@google.com/
+Tested-by: Ricardo B. Marliere <ricardo@marliere.net>
+Link: https://lore.kernel.org/r/20230922005152.163640-1-ricardo@marliere.net
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/rc/imon.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/media/rc/imon.c b/drivers/media/rc/imon.c
+index 253a1d1a840a0..c6d9a6de8e4ed 100644
+--- a/drivers/media/rc/imon.c
++++ b/drivers/media/rc/imon.c
+@@ -2436,6 +2436,12 @@ static int imon_probe(struct usb_interface *interface,
+ goto fail;
+ }
+
++ if (first_if->dev.driver != interface->dev.driver) {
++ dev_err(&interface->dev, "inconsistent driver matching\n");
++ ret = -EINVAL;
++ goto fail;
++ }
++
+ if (ifnum == 0) {
+ ictx = imon_init_intf0(interface, id);
+ if (!ictx) {
+--
+2.42.0
+
--- /dev/null
+From 21d2748df5bd6a44dc5c8e88df0567d141f33bbc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Feb 2020 14:48:48 +0100
+Subject: media: smiapp: Add macros for accessing CCS registers
+
+From: Sakari Ailus <sakari.ailus@linux.intel.com>
+
+[ Upstream commit e66a7c84908688e99bd7da4a48bfcba1b292fe54 ]
+
+Add two helper macros for reading and writing the CCS registers as defined
+in ccs-regs.h.
+
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Stable-dep-of: 724ff68e968b ("media: ccs: Correctly initialise try compose rectangle")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/smiapp/smiapp-regs.h | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/media/i2c/smiapp/smiapp-regs.h b/drivers/media/i2c/smiapp/smiapp-regs.h
+index 7223f5f891096..dc946096f3686 100644
+--- a/drivers/media/i2c/smiapp/smiapp-regs.h
++++ b/drivers/media/i2c/smiapp/smiapp-regs.h
+@@ -28,4 +28,10 @@ int smiapp_write(struct smiapp_sensor *sensor, u32 reg, u32 val);
+
+ unsigned int ccs_reg_width(u32 reg);
+
++#define ccs_read(sensor, reg_name, val) \
++ smiapp_read(sensor, CCS_R_##reg_name, val)
++
++#define ccs_write(sensor, reg_name, val) \
++ smiapp_write(sensor, CCS_R_##reg_name, val)
++
+ #endif
+--
+2.42.0
+
--- /dev/null
+From f7bc61fb8d08581534257dce1ad5542f7d244463 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Feb 2020 15:21:06 +0100
+Subject: media: smiapp: Calculate CCS limit offsets and limit buffer size
+
+From: Sakari Ailus <sakari.ailus@linux.intel.com>
+
+[ Upstream commit ab47d5cd825310478900b33d712a0e39bf3bb716 ]
+
+Calculate the limit offsets and the size of the limit buffer. CCS limits
+are read into this buffer, and the offsets are helpful in accessing the
+information in it.
+
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Stable-dep-of: 724ff68e968b ("media: ccs: Correctly initialise try compose rectangle")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/smiapp/Makefile | 2 +-
+ drivers/media/i2c/smiapp/smiapp-core.c | 40 +++++++++++++++++++++++++-
+ 2 files changed, 40 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/i2c/smiapp/Makefile b/drivers/media/i2c/smiapp/Makefile
+index 86f57a43f8e8b..efb643d2acace 100644
+--- a/drivers/media/i2c/smiapp/Makefile
++++ b/drivers/media/i2c/smiapp/Makefile
+@@ -1,6 +1,6 @@
+ # SPDX-License-Identifier: GPL-2.0-only
+ smiapp-objs += smiapp-core.o smiapp-regs.o \
+- smiapp-quirk.o smiapp-limits.o
++ smiapp-quirk.o smiapp-limits.o ccs-limits.o
+ obj-$(CONFIG_VIDEO_SMIAPP) += smiapp.o
+
+ ccflags-y += -I $(srctree)/drivers/media/i2c
+diff --git a/drivers/media/i2c/smiapp/smiapp-core.c b/drivers/media/i2c/smiapp/smiapp-core.c
+index 105ef29152e84..75862e7647f87 100644
+--- a/drivers/media/i2c/smiapp/smiapp-core.c
++++ b/drivers/media/i2c/smiapp/smiapp-core.c
+@@ -27,6 +27,7 @@
+ #include <media/v4l2-fwnode.h>
+ #include <media/v4l2-device.h>
+
++#include "ccs-limits.h"
+ #include "smiapp.h"
+
+ #define SMIAPP_ALIGN_DIM(dim, flags) \
+@@ -34,6 +35,11 @@
+ ? ALIGN((dim), 2) \
+ : (dim) & ~1)
+
++static struct ccs_limit_offset {
++ u16 lim;
++ u16 info;
++} ccs_limit_offsets[CCS_L_LAST + 1];
++
+ /*
+ * smiapp_module_idents - supported camera modules
+ */
+@@ -3166,7 +3172,39 @@ static struct i2c_driver smiapp_i2c_driver = {
+ .id_table = smiapp_id_table,
+ };
+
+-module_i2c_driver(smiapp_i2c_driver);
++static int smiapp_module_init(void)
++{
++ unsigned int i, l;
++
++ for (i = 0, l = 0; ccs_limits[i].size && l < CCS_L_LAST; i++) {
++ if (!(ccs_limits[i].flags & CCS_L_FL_SAME_REG)) {
++ ccs_limit_offsets[l + 1].lim =
++ ALIGN(ccs_limit_offsets[l].lim +
++ ccs_limits[i].size,
++ ccs_reg_width(ccs_limits[i + 1].reg));
++ ccs_limit_offsets[l].info = i;
++ l++;
++ } else {
++ ccs_limit_offsets[l].lim += ccs_limits[i].size;
++ }
++ }
++
++ if (WARN_ON(ccs_limits[i].size))
++ return -EINVAL;
++
++ if (WARN_ON(l != CCS_L_LAST))
++ return -EINVAL;
++
++ return i2c_register_driver(THIS_MODULE, &smiapp_i2c_driver);
++}
++
++static void smiapp_module_cleanup(void)
++{
++ i2c_del_driver(&smiapp_i2c_driver);
++}
++
++module_init(smiapp_module_init);
++module_exit(smiapp_module_cleanup);
+
+ MODULE_AUTHOR("Sakari Ailus <sakari.ailus@iki.fi>");
+ MODULE_DESCRIPTION("Generic SMIA/SMIA++ camera module driver");
+--
+2.42.0
+
--- /dev/null
+From ddd0987d1d1f12092ffe79de2fb85eb05fbedce1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Oct 2020 08:57:04 +0200
+Subject: media: smiapp: Import CCS definitions
+
+From: Sakari Ailus <sakari.ailus@linux.intel.com>
+
+[ Upstream commit 6493c4b777c2bca7fcfaabca2388d82f186f9be3 ]
+
+Import CCS register and limit definitions. These files are generated by a
+Perl script based on a text-based register definition file. The generator
+was added on
+commit 1ec0b899c2b7 ("media: ccs: Add the generator for CCS register definitions and limits")
+
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Stable-dep-of: 724ff68e968b ("media: ccs: Correctly initialise try compose rectangle")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/smiapp/ccs-limits.c | 239 +++++++
+ drivers/media/i2c/smiapp/ccs-limits.h | 259 +++++++
+ drivers/media/i2c/smiapp/ccs-regs.h | 954 ++++++++++++++++++++++++++
+ 3 files changed, 1452 insertions(+)
+ create mode 100644 drivers/media/i2c/smiapp/ccs-limits.c
+ create mode 100644 drivers/media/i2c/smiapp/ccs-limits.h
+ create mode 100644 drivers/media/i2c/smiapp/ccs-regs.h
+
+diff --git a/drivers/media/i2c/smiapp/ccs-limits.c b/drivers/media/i2c/smiapp/ccs-limits.c
+new file mode 100644
+index 0000000000000..f5511789ac837
+--- /dev/null
++++ b/drivers/media/i2c/smiapp/ccs-limits.c
+@@ -0,0 +1,239 @@
++// SPDX-License-Identifier: GPL-2.0-only OR BSD-3-Clause
++/* Copyright (C) 2019--2020 Intel Corporation */
++
++#include "ccs-limits.h"
++#include "ccs-regs.h"
++
++const struct ccs_limit ccs_limits[] = {
++ { CCS_R_FRAME_FORMAT_MODEL_TYPE, 1, 0, "frame_format_model_type" },
++ { CCS_R_FRAME_FORMAT_MODEL_SUBTYPE, 1, 0, "frame_format_model_subtype" },
++ { CCS_R_FRAME_FORMAT_DESCRIPTOR(0), 30, 0, "frame_format_descriptor" },
++ { CCS_R_FRAME_FORMAT_DESCRIPTOR_4(0), 32, 0, "frame_format_descriptor_4" },
++ { CCS_R_ANALOG_GAIN_CAPABILITY, 2, 0, "analog_gain_capability" },
++ { CCS_R_ANALOG_GAIN_CODE_MIN, 2, 0, "analog_gain_code_min" },
++ { CCS_R_ANALOG_GAIN_CODE_MAX, 2, 0, "analog_gain_code_max" },
++ { CCS_R_ANALOG_GAIN_CODE_STEP, 2, 0, "analog_gain_code_step" },
++ { CCS_R_ANALOG_GAIN_TYPE, 2, 0, "analog_gain_type" },
++ { CCS_R_ANALOG_GAIN_M0, 2, 0, "analog_gain_m0" },
++ { CCS_R_ANALOG_GAIN_C0, 2, 0, "analog_gain_c0" },
++ { CCS_R_ANALOG_GAIN_M1, 2, 0, "analog_gain_m1" },
++ { CCS_R_ANALOG_GAIN_C1, 2, 0, "analog_gain_c1" },
++ { CCS_R_ANALOG_LINEAR_GAIN_MIN, 2, 0, "analog_linear_gain_min" },
++ { CCS_R_ANALOG_LINEAR_GAIN_MAX, 2, 0, "analog_linear_gain_max" },
++ { CCS_R_ANALOG_LINEAR_GAIN_STEP_SIZE, 2, 0, "analog_linear_gain_step_size" },
++ { CCS_R_ANALOG_EXPONENTIAL_GAIN_MIN, 2, 0, "analog_exponential_gain_min" },
++ { CCS_R_ANALOG_EXPONENTIAL_GAIN_MAX, 2, 0, "analog_exponential_gain_max" },
++ { CCS_R_ANALOG_EXPONENTIAL_GAIN_STEP_SIZE, 2, 0, "analog_exponential_gain_step_size" },
++ { CCS_R_DATA_FORMAT_MODEL_TYPE, 1, 0, "data_format_model_type" },
++ { CCS_R_DATA_FORMAT_MODEL_SUBTYPE, 1, 0, "data_format_model_subtype" },
++ { CCS_R_DATA_FORMAT_DESCRIPTOR(0), 32, 0, "data_format_descriptor" },
++ { CCS_R_INTEGRATION_TIME_CAPABILITY, 2, 0, "integration_time_capability" },
++ { CCS_R_COARSE_INTEGRATION_TIME_MIN, 2, 0, "coarse_integration_time_min" },
++ { CCS_R_COARSE_INTEGRATION_TIME_MAX_MARGIN, 2, 0, "coarse_integration_time_max_margin" },
++ { CCS_R_FINE_INTEGRATION_TIME_MIN, 2, 0, "fine_integration_time_min" },
++ { CCS_R_FINE_INTEGRATION_TIME_MAX_MARGIN, 2, 0, "fine_integration_time_max_margin" },
++ { CCS_R_DIGITAL_GAIN_CAPABILITY, 1, 0, "digital_gain_capability" },
++ { CCS_R_DIGITAL_GAIN_MIN, 2, 0, "digital_gain_min" },
++ { CCS_R_DIGITAL_GAIN_MAX, 2, 0, "digital_gain_max" },
++ { CCS_R_DIGITAL_GAIN_STEP_SIZE, 2, 0, "digital_gain_step_size" },
++ { CCS_R_PEDESTAL_CAPABILITY, 1, 0, "Pedestal_capability" },
++ { CCS_R_ADC_CAPABILITY, 1, 0, "ADC_capability" },
++ { CCS_R_ADC_BIT_DEPTH_CAPABILITY, 4, 0, "ADC_bit_depth_capability" },
++ { CCS_R_MIN_EXT_CLK_FREQ_MHZ, 4, 0, "min_ext_clk_freq_mhz" },
++ { CCS_R_MAX_EXT_CLK_FREQ_MHZ, 4, 0, "max_ext_clk_freq_mhz" },
++ { CCS_R_MIN_PRE_PLL_CLK_DIV, 2, 0, "min_pre_pll_clk_div" },
++ { CCS_R_MAX_PRE_PLL_CLK_DIV, 2, 0, "max_pre_pll_clk_div" },
++ { CCS_R_MIN_PLL_IP_CLK_FREQ_MHZ, 4, 0, "min_pll_ip_clk_freq_mhz" },
++ { CCS_R_MAX_PLL_IP_CLK_FREQ_MHZ, 4, 0, "max_pll_ip_clk_freq_mhz" },
++ { CCS_R_MIN_PLL_MULTIPLIER, 2, 0, "min_pll_multiplier" },
++ { CCS_R_MAX_PLL_MULTIPLIER, 2, 0, "max_pll_multiplier" },
++ { CCS_R_MIN_PLL_OP_CLK_FREQ_MHZ, 4, 0, "min_pll_op_clk_freq_mhz" },
++ { CCS_R_MAX_PLL_OP_CLK_FREQ_MHZ, 4, 0, "max_pll_op_clk_freq_mhz" },
++ { CCS_R_MIN_VT_SYS_CLK_DIV, 2, 0, "min_vt_sys_clk_div" },
++ { CCS_R_MAX_VT_SYS_CLK_DIV, 2, 0, "max_vt_sys_clk_div" },
++ { CCS_R_MIN_VT_SYS_CLK_FREQ_MHZ, 4, 0, "min_vt_sys_clk_freq_mhz" },
++ { CCS_R_MAX_VT_SYS_CLK_FREQ_MHZ, 4, 0, "max_vt_sys_clk_freq_mhz" },
++ { CCS_R_MIN_VT_PIX_CLK_FREQ_MHZ, 4, 0, "min_vt_pix_clk_freq_mhz" },
++ { CCS_R_MAX_VT_PIX_CLK_FREQ_MHZ, 4, 0, "max_vt_pix_clk_freq_mhz" },
++ { CCS_R_MIN_VT_PIX_CLK_DIV, 2, 0, "min_vt_pix_clk_div" },
++ { CCS_R_MAX_VT_PIX_CLK_DIV, 2, 0, "max_vt_pix_clk_div" },
++ { CCS_R_CLOCK_CALCULATION, 1, 0, "clock_calculation" },
++ { CCS_R_NUM_OF_VT_LANES, 1, 0, "num_of_vt_lanes" },
++ { CCS_R_NUM_OF_OP_LANES, 1, 0, "num_of_op_lanes" },
++ { CCS_R_OP_BITS_PER_LANE, 1, 0, "op_bits_per_lane" },
++ { CCS_R_MIN_FRAME_LENGTH_LINES, 2, 0, "min_frame_length_lines" },
++ { CCS_R_MAX_FRAME_LENGTH_LINES, 2, 0, "max_frame_length_lines" },
++ { CCS_R_MIN_LINE_LENGTH_PCK, 2, 0, "min_line_length_pck" },
++ { CCS_R_MAX_LINE_LENGTH_PCK, 2, 0, "max_line_length_pck" },
++ { CCS_R_MIN_LINE_BLANKING_PCK, 2, 0, "min_line_blanking_pck" },
++ { CCS_R_MIN_FRAME_BLANKING_LINES, 2, 0, "min_frame_blanking_lines" },
++ { CCS_R_MIN_LINE_LENGTH_PCK_STEP_SIZE, 1, 0, "min_line_length_pck_step_size" },
++ { CCS_R_TIMING_MODE_CAPABILITY, 1, 0, "timing_mode_capability" },
++ { CCS_R_FRAME_MARGIN_MAX_VALUE, 2, 0, "frame_margin_max_value" },
++ { CCS_R_FRAME_MARGIN_MIN_VALUE, 1, 0, "frame_margin_min_value" },
++ { CCS_R_GAIN_DELAY_TYPE, 1, 0, "gain_delay_type" },
++ { CCS_R_MIN_OP_SYS_CLK_DIV, 2, 0, "min_op_sys_clk_div" },
++ { CCS_R_MAX_OP_SYS_CLK_DIV, 2, 0, "max_op_sys_clk_div" },
++ { CCS_R_MIN_OP_SYS_CLK_FREQ_MHZ, 4, 0, "min_op_sys_clk_freq_mhz" },
++ { CCS_R_MAX_OP_SYS_CLK_FREQ_MHZ, 4, 0, "max_op_sys_clk_freq_mhz" },
++ { CCS_R_MIN_OP_PIX_CLK_DIV, 2, 0, "min_op_pix_clk_div" },
++ { CCS_R_MAX_OP_PIX_CLK_DIV, 2, 0, "max_op_pix_clk_div" },
++ { CCS_R_MIN_OP_PIX_CLK_FREQ_MHZ, 4, 0, "min_op_pix_clk_freq_mhz" },
++ { CCS_R_MAX_OP_PIX_CLK_FREQ_MHZ, 4, 0, "max_op_pix_clk_freq_mhz" },
++ { CCS_R_X_ADDR_MIN, 2, 0, "x_addr_min" },
++ { CCS_R_Y_ADDR_MIN, 2, 0, "y_addr_min" },
++ { CCS_R_X_ADDR_MAX, 2, 0, "x_addr_max" },
++ { CCS_R_Y_ADDR_MAX, 2, 0, "y_addr_max" },
++ { CCS_R_MIN_X_OUTPUT_SIZE, 2, 0, "min_x_output_size" },
++ { CCS_R_MIN_Y_OUTPUT_SIZE, 2, 0, "min_y_output_size" },
++ { CCS_R_MAX_X_OUTPUT_SIZE, 2, 0, "max_x_output_size" },
++ { CCS_R_MAX_Y_OUTPUT_SIZE, 2, 0, "max_y_output_size" },
++ { CCS_R_X_ADDR_START_DIV_CONSTANT, 1, 0, "x_addr_start_div_constant" },
++ { CCS_R_Y_ADDR_START_DIV_CONSTANT, 1, 0, "y_addr_start_div_constant" },
++ { CCS_R_X_ADDR_END_DIV_CONSTANT, 1, 0, "x_addr_end_div_constant" },
++ { CCS_R_Y_ADDR_END_DIV_CONSTANT, 1, 0, "y_addr_end_div_constant" },
++ { CCS_R_X_SIZE_DIV, 1, 0, "x_size_div" },
++ { CCS_R_Y_SIZE_DIV, 1, 0, "y_size_div" },
++ { CCS_R_X_OUTPUT_DIV, 1, 0, "x_output_div" },
++ { CCS_R_Y_OUTPUT_DIV, 1, 0, "y_output_div" },
++ { CCS_R_NON_FLEXIBLE_RESOLUTION_SUPPORT, 1, 0, "non_flexible_resolution_support" },
++ { CCS_R_MIN_OP_PRE_PLL_CLK_DIV, 2, 0, "min_op_pre_pll_clk_div" },
++ { CCS_R_MAX_OP_PRE_PLL_CLK_DIV, 2, 0, "max_op_pre_pll_clk_div" },
++ { CCS_R_MIN_OP_PLL_IP_CLK_FREQ_MHZ, 4, 0, "min_op_pll_ip_clk_freq_mhz" },
++ { CCS_R_MAX_OP_PLL_IP_CLK_FREQ_MHZ, 4, 0, "max_op_pll_ip_clk_freq_mhz" },
++ { CCS_R_MIN_OP_PLL_MULTIPLIER, 2, 0, "min_op_pll_multiplier" },
++ { CCS_R_MAX_OP_PLL_MULTIPLIER, 2, 0, "max_op_pll_multiplier" },
++ { CCS_R_MIN_OP_PLL_OP_CLK_FREQ_MHZ, 4, 0, "min_op_pll_op_clk_freq_mhz" },
++ { CCS_R_MAX_OP_PLL_OP_CLK_FREQ_MHZ, 4, 0, "max_op_pll_op_clk_freq_mhz" },
++ { CCS_R_CLOCK_TREE_PLL_CAPABILITY, 1, 0, "clock_tree_pll_capability" },
++ { CCS_R_CLOCK_CAPA_TYPE_CAPABILITY, 1, 0, "clock_capa_type_capability" },
++ { CCS_R_MIN_EVEN_INC, 2, 0, "min_even_inc" },
++ { CCS_R_MIN_ODD_INC, 2, 0, "min_odd_inc" },
++ { CCS_R_MAX_EVEN_INC, 2, 0, "max_even_inc" },
++ { CCS_R_MAX_ODD_INC, 2, 0, "max_odd_inc" },
++ { CCS_R_AUX_SUBSAMP_CAPABILITY, 1, 0, "aux_subsamp_capability" },
++ { CCS_R_AUX_SUBSAMP_MONO_CAPABILITY, 1, 0, "aux_subsamp_mono_capability" },
++ { CCS_R_MONOCHROME_CAPABILITY, 1, 0, "monochrome_capability" },
++ { CCS_R_PIXEL_READOUT_CAPABILITY, 1, 0, "pixel_readout_capability" },
++ { CCS_R_MIN_EVEN_INC_MONO, 2, 0, "min_even_inc_mono" },
++ { CCS_R_MAX_EVEN_INC_MONO, 2, 0, "max_even_inc_mono" },
++ { CCS_R_MIN_ODD_INC_MONO, 2, 0, "min_odd_inc_mono" },
++ { CCS_R_MAX_ODD_INC_MONO, 2, 0, "max_odd_inc_mono" },
++ { CCS_R_MIN_EVEN_INC_BC2, 2, 0, "min_even_inc_bc2" },
++ { CCS_R_MAX_EVEN_INC_BC2, 2, 0, "max_even_inc_bc2" },
++ { CCS_R_MIN_ODD_INC_BC2, 2, 0, "min_odd_inc_bc2" },
++ { CCS_R_MAX_ODD_INC_BC2, 2, 0, "max_odd_inc_bc2" },
++ { CCS_R_MIN_EVEN_INC_MONO_BC2, 2, 0, "min_even_inc_mono_bc2" },
++ { CCS_R_MAX_EVEN_INC_MONO_BC2, 2, 0, "max_even_inc_mono_bc2" },
++ { CCS_R_MIN_ODD_INC_MONO_BC2, 2, 0, "min_odd_inc_mono_bc2" },
++ { CCS_R_MAX_ODD_INC_MONO_BC2, 2, 0, "max_odd_inc_mono_bc2" },
++ { CCS_R_SCALING_CAPABILITY, 2, 0, "scaling_capability" },
++ { CCS_R_SCALER_M_MIN, 2, 0, "scaler_m_min" },
++ { CCS_R_SCALER_M_MAX, 2, 0, "scaler_m_max" },
++ { CCS_R_SCALER_N_MIN, 2, 0, "scaler_n_min" },
++ { CCS_R_SCALER_N_MAX, 2, 0, "scaler_n_max" },
++ { CCS_R_DIGITAL_CROP_CAPABILITY, 1, 0, "digital_crop_capability" },
++ { CCS_R_HDR_CAPABILITY_1, 1, 0, "hdr_capability_1" },
++ { CCS_R_MIN_HDR_BIT_DEPTH, 1, 0, "min_hdr_bit_depth" },
++ { CCS_R_HDR_RESOLUTION_SUB_TYPES, 1, 0, "hdr_resolution_sub_types" },
++ { CCS_R_HDR_RESOLUTION_SUB_TYPE(0), 2, 0, "hdr_resolution_sub_type" },
++ { CCS_R_HDR_CAPABILITY_2, 1, 0, "hdr_capability_2" },
++ { CCS_R_MAX_HDR_BIT_DEPTH, 1, 0, "max_hdr_bit_depth" },
++ { CCS_R_USL_SUPPORT_CAPABILITY, 1, 0, "usl_support_capability" },
++ { CCS_R_USL_CLOCK_MODE_D_CAPABILITY, 1, 0, "usl_clock_mode_d_capability" },
++ { CCS_R_MIN_OP_SYS_CLK_DIV_REV, 1, 0, "min_op_sys_clk_div_rev" },
++ { CCS_R_MAX_OP_SYS_CLK_DIV_REV, 1, 0, "max_op_sys_clk_div_rev" },
++ { CCS_R_MIN_OP_PIX_CLK_DIV_REV, 1, 0, "min_op_pix_clk_div_rev" },
++ { CCS_R_MAX_OP_PIX_CLK_DIV_REV, 1, 0, "max_op_pix_clk_div_rev" },
++ { CCS_R_MIN_OP_SYS_CLK_FREQ_REV_MHZ, 4, 0, "min_op_sys_clk_freq_rev_mhz" },
++ { CCS_R_MAX_OP_SYS_CLK_FREQ_REV_MHZ, 4, 0, "max_op_sys_clk_freq_rev_mhz" },
++ { CCS_R_MIN_OP_PIX_CLK_FREQ_REV_MHZ, 4, 0, "min_op_pix_clk_freq_rev_mhz" },
++ { CCS_R_MAX_OP_PIX_CLK_FREQ_REV_MHZ, 4, 0, "max_op_pix_clk_freq_rev_mhz" },
++ { CCS_R_MAX_BITRATE_REV_D_MODE_MBPS, 4, 0, "max_bitrate_rev_d_mode_mbps" },
++ { CCS_R_MAX_SYMRATE_REV_C_MODE_MSPS, 4, 0, "max_symrate_rev_c_mode_msps" },
++ { CCS_R_COMPRESSION_CAPABILITY, 1, 0, "compression_capability" },
++ { CCS_R_TEST_MODE_CAPABILITY, 2, 0, "test_mode_capability" },
++ { CCS_R_PN9_DATA_FORMAT1, 1, 0, "pn9_data_format1" },
++ { CCS_R_PN9_DATA_FORMAT2, 1, 0, "pn9_data_format2" },
++ { CCS_R_PN9_DATA_FORMAT3, 1, 0, "pn9_data_format3" },
++ { CCS_R_PN9_DATA_FORMAT4, 1, 0, "pn9_data_format4" },
++ { CCS_R_PN9_MISC_CAPABILITY, 1, 0, "pn9_misc_capability" },
++ { CCS_R_TEST_PATTERN_CAPABILITY, 1, 0, "test_pattern_capability" },
++ { CCS_R_PATTERN_SIZE_DIV_M1, 1, 0, "pattern_size_div_m1" },
++ { CCS_R_FIFO_SUPPORT_CAPABILITY, 1, 0, "fifo_support_capability" },
++ { CCS_R_PHY_CTRL_CAPABILITY, 1, 0, "phy_ctrl_capability" },
++ { CCS_R_CSI_DPHY_LANE_MODE_CAPABILITY, 1, 0, "csi_dphy_lane_mode_capability" },
++ { CCS_R_CSI_SIGNALING_MODE_CAPABILITY, 1, 0, "csi_signaling_mode_capability" },
++ { CCS_R_FAST_STANDBY_CAPABILITY, 1, 0, "fast_standby_capability" },
++ { CCS_R_CSI_ADDRESS_CONTROL_CAPABILITY, 1, 0, "csi_address_control_capability" },
++ { CCS_R_DATA_TYPE_CAPABILITY, 1, 0, "data_type_capability" },
++ { CCS_R_CSI_CPHY_LANE_MODE_CAPABILITY, 1, 0, "csi_cphy_lane_mode_capability" },
++ { CCS_R_EMB_DATA_CAPABILITY, 1, 0, "emb_data_capability" },
++ { CCS_R_MAX_PER_LANE_BITRATE_LANE_D_MODE_MBPS(0), 16, 0, "max_per_lane_bitrate_lane_d_mode_mbps 0" },
++ { CCS_R_MAX_PER_LANE_BITRATE_LANE_D_MODE_MBPS(4), 16, CCS_L_FL_SAME_REG, "max_per_lane_bitrate_lane_d_mode_mbps 4" },
++ { CCS_R_TEMP_SENSOR_CAPABILITY, 1, 0, "temp_sensor_capability" },
++ { CCS_R_MAX_PER_LANE_BITRATE_LANE_C_MODE_MBPS(0), 16, 0, "max_per_lane_bitrate_lane_c_mode_mbps 0" },
++ { CCS_R_MAX_PER_LANE_BITRATE_LANE_C_MODE_MBPS(4), 16, CCS_L_FL_SAME_REG, "max_per_lane_bitrate_lane_c_mode_mbps 4" },
++ { CCS_R_DPHY_EQUALIZATION_CAPABILITY, 1, 0, "dphy_equalization_capability" },
++ { CCS_R_CPHY_EQUALIZATION_CAPABILITY, 1, 0, "cphy_equalization_capability" },
++ { CCS_R_DPHY_PREAMBLE_CAPABILITY, 1, 0, "dphy_preamble_capability" },
++ { CCS_R_DPHY_SSC_CAPABILITY, 1, 0, "dphy_ssc_capability" },
++ { CCS_R_CPHY_CALIBRATION_CAPABILITY, 1, 0, "cphy_calibration_capability" },
++ { CCS_R_DPHY_CALIBRATION_CAPABILITY, 1, 0, "dphy_calibration_capability" },
++ { CCS_R_PHY_CTRL_CAPABILITY_2, 1, 0, "phy_ctrl_capability_2" },
++ { CCS_R_LRTE_CPHY_CAPABILITY, 1, 0, "lrte_cphy_capability" },
++ { CCS_R_LRTE_DPHY_CAPABILITY, 1, 0, "lrte_dphy_capability" },
++ { CCS_R_ALPS_CAPABILITY_DPHY, 1, 0, "alps_capability_dphy" },
++ { CCS_R_ALPS_CAPABILITY_CPHY, 1, 0, "alps_capability_cphy" },
++ { CCS_R_SCRAMBLING_CAPABILITY, 1, 0, "scrambling_capability" },
++ { CCS_R_DPHY_MANUAL_CONSTANT, 1, 0, "dphy_manual_constant" },
++ { CCS_R_CPHY_MANUAL_CONSTANT, 1, 0, "cphy_manual_constant" },
++ { CCS_R_CSI2_INTERFACE_CAPABILITY_MISC, 1, 0, "CSI2_interface_capability_misc" },
++ { CCS_R_PHY_CTRL_CAPABILITY_3, 1, 0, "PHY_ctrl_capability_3" },
++ { CCS_R_DPHY_SF, 1, 0, "dphy_sf" },
++ { CCS_R_CPHY_SF, 1, 0, "cphy_sf" },
++ { CCS_R_DPHY_LIMITS_1, 1, 0, "dphy_limits_1" },
++ { CCS_R_DPHY_LIMITS_2, 1, 0, "dphy_limits_2" },
++ { CCS_R_DPHY_LIMITS_3, 1, 0, "dphy_limits_3" },
++ { CCS_R_DPHY_LIMITS_4, 1, 0, "dphy_limits_4" },
++ { CCS_R_DPHY_LIMITS_5, 1, 0, "dphy_limits_5" },
++ { CCS_R_DPHY_LIMITS_6, 1, 0, "dphy_limits_6" },
++ { CCS_R_CPHY_LIMITS_1, 1, 0, "cphy_limits_1" },
++ { CCS_R_CPHY_LIMITS_2, 1, 0, "cphy_limits_2" },
++ { CCS_R_CPHY_LIMITS_3, 1, 0, "cphy_limits_3" },
++ { CCS_R_MIN_FRAME_LENGTH_LINES_BIN, 2, 0, "min_frame_length_lines_bin" },
++ { CCS_R_MAX_FRAME_LENGTH_LINES_BIN, 2, 0, "max_frame_length_lines_bin" },
++ { CCS_R_MIN_LINE_LENGTH_PCK_BIN, 2, 0, "min_line_length_pck_bin" },
++ { CCS_R_MAX_LINE_LENGTH_PCK_BIN, 2, 0, "max_line_length_pck_bin" },
++ { CCS_R_MIN_LINE_BLANKING_PCK_BIN, 2, 0, "min_line_blanking_pck_bin" },
++ { CCS_R_FINE_INTEGRATION_TIME_MIN_BIN, 2, 0, "fine_integration_time_min_bin" },
++ { CCS_R_FINE_INTEGRATION_TIME_MAX_MARGIN_BIN, 2, 0, "fine_integration_time_max_margin_bin" },
++ { CCS_R_BINNING_CAPABILITY, 1, 0, "binning_capability" },
++ { CCS_R_BINNING_WEIGHTING_CAPABILITY, 1, 0, "binning_weighting_capability" },
++ { CCS_R_BINNING_SUB_TYPES, 1, 0, "binning_sub_types" },
++ { CCS_R_BINNING_SUB_TYPE(0), 64, 0, "binning_sub_type" },
++ { CCS_R_BINNING_WEIGHTING_MONO_CAPABILITY, 1, 0, "binning_weighting_mono_capability" },
++ { CCS_R_BINNING_SUB_TYPES_MONO, 1, 0, "binning_sub_types_mono" },
++ { CCS_R_BINNING_SUB_TYPE_MONO(0), 64, 0, "binning_sub_type_mono" },
++ { CCS_R_DATA_TRANSFER_IF_CAPABILITY, 1, 0, "data_transfer_if_capability" },
++ { CCS_R_SHADING_CORRECTION_CAPABILITY, 1, 0, "shading_correction_capability" },
++ { CCS_R_GREEN_IMBALANCE_CAPABILITY, 1, 0, "green_imbalance_capability" },
++ { CCS_R_MODULE_SPECIFIC_CORRECTION_CAPABILITY, 1, 0, "module_specific_correction_capability" },
++ { CCS_R_DEFECT_CORRECTION_CAPABILITY, 2, 0, "defect_correction_capability" },
++ { CCS_R_DEFECT_CORRECTION_CAPABILITY_2, 2, 0, "defect_correction_capability_2" },
++ { CCS_R_NF_CAPABILITY, 1, 0, "nf_capability" },
++ { CCS_R_OB_READOUT_CAPABILITY, 1, 0, "ob_readout_capability" },
++ { CCS_R_COLOR_FEEDBACK_CAPABILITY, 1, 0, "color_feedback_capability" },
++ { CCS_R_CFA_PATTERN_CAPABILITY, 1, 0, "CFA_pattern_capability" },
++ { CCS_R_CFA_PATTERN_CONVERSION_CAPABILITY, 1, 0, "CFA_pattern_conversion_capability" },
++ { CCS_R_FLASH_MODE_CAPABILITY, 1, 0, "flash_mode_capability" },
++ { CCS_R_SA_STROBE_MODE_CAPABILITY, 1, 0, "sa_strobe_mode_capability" },
++ { CCS_R_RESET_MAX_DELAY, 1, 0, "reset_max_delay" },
++ { CCS_R_RESET_MIN_TIME, 1, 0, "reset_min_time" },
++ { CCS_R_PDAF_CAPABILITY_1, 1, 0, "pdaf_capability_1" },
++ { CCS_R_PDAF_CAPABILITY_2, 1, 0, "pdaf_capability_2" },
++ { CCS_R_BRACKETING_LUT_CAPABILITY_1, 1, 0, "bracketing_lut_capability_1" },
++ { CCS_R_BRACKETING_LUT_CAPABILITY_2, 1, 0, "bracketing_lut_capability_2" },
++ { CCS_R_BRACKETING_LUT_SIZE, 1, 0, "bracketing_lut_size" },
++ { 0 } /* Guardian */
++};
+diff --git a/drivers/media/i2c/smiapp/ccs-limits.h b/drivers/media/i2c/smiapp/ccs-limits.h
+new file mode 100644
+index 0000000000000..1efa43c23a2eb
+--- /dev/null
++++ b/drivers/media/i2c/smiapp/ccs-limits.h
+@@ -0,0 +1,259 @@
++/* SPDX-License-Identifier: GPL-2.0-only OR BSD-3-Clause */
++/* Copyright (C) 2019--2020 Intel Corporation */
++
++#ifndef __CCS_LIMITS_H__
++#define __CCS_LIMITS_H__
++
++#include <linux/bits.h>
++#include <linux/types.h>
++
++struct ccs_limit {
++ u32 reg;
++ u16 size;
++ u16 flags;
++ const char *name;
++};
++
++#define CCS_L_FL_SAME_REG BIT(0)
++
++extern const struct ccs_limit ccs_limits[];
++
++#define CCS_L_FRAME_FORMAT_MODEL_TYPE 0
++#define CCS_L_FRAME_FORMAT_MODEL_SUBTYPE 1
++#define CCS_L_FRAME_FORMAT_DESCRIPTOR 2
++#define CCS_L_FRAME_FORMAT_DESCRIPTOR_OFFSET(n) ((n) * 2)
++#define CCS_L_FRAME_FORMAT_DESCRIPTOR_4 3
++#define CCS_L_FRAME_FORMAT_DESCRIPTOR_4_OFFSET(n) ((n) * 4)
++#define CCS_L_ANALOG_GAIN_CAPABILITY 4
++#define CCS_L_ANALOG_GAIN_CODE_MIN 5
++#define CCS_L_ANALOG_GAIN_CODE_MAX 6
++#define CCS_L_ANALOG_GAIN_CODE_STEP 7
++#define CCS_L_ANALOG_GAIN_TYPE 8
++#define CCS_L_ANALOG_GAIN_M0 9
++#define CCS_L_ANALOG_GAIN_C0 10
++#define CCS_L_ANALOG_GAIN_M1 11
++#define CCS_L_ANALOG_GAIN_C1 12
++#define CCS_L_ANALOG_LINEAR_GAIN_MIN 13
++#define CCS_L_ANALOG_LINEAR_GAIN_MAX 14
++#define CCS_L_ANALOG_LINEAR_GAIN_STEP_SIZE 15
++#define CCS_L_ANALOG_EXPONENTIAL_GAIN_MIN 16
++#define CCS_L_ANALOG_EXPONENTIAL_GAIN_MAX 17
++#define CCS_L_ANALOG_EXPONENTIAL_GAIN_STEP_SIZE 18
++#define CCS_L_DATA_FORMAT_MODEL_TYPE 19
++#define CCS_L_DATA_FORMAT_MODEL_SUBTYPE 20
++#define CCS_L_DATA_FORMAT_DESCRIPTOR 21
++#define CCS_L_DATA_FORMAT_DESCRIPTOR_OFFSET(n) ((n) * 2)
++#define CCS_L_INTEGRATION_TIME_CAPABILITY 22
++#define CCS_L_COARSE_INTEGRATION_TIME_MIN 23
++#define CCS_L_COARSE_INTEGRATION_TIME_MAX_MARGIN 24
++#define CCS_L_FINE_INTEGRATION_TIME_MIN 25
++#define CCS_L_FINE_INTEGRATION_TIME_MAX_MARGIN 26
++#define CCS_L_DIGITAL_GAIN_CAPABILITY 27
++#define CCS_L_DIGITAL_GAIN_MIN 28
++#define CCS_L_DIGITAL_GAIN_MAX 29
++#define CCS_L_DIGITAL_GAIN_STEP_SIZE 30
++#define CCS_L_PEDESTAL_CAPABILITY 31
++#define CCS_L_ADC_CAPABILITY 32
++#define CCS_L_ADC_BIT_DEPTH_CAPABILITY 33
++#define CCS_L_MIN_EXT_CLK_FREQ_MHZ 34
++#define CCS_L_MAX_EXT_CLK_FREQ_MHZ 35
++#define CCS_L_MIN_PRE_PLL_CLK_DIV 36
++#define CCS_L_MAX_PRE_PLL_CLK_DIV 37
++#define CCS_L_MIN_PLL_IP_CLK_FREQ_MHZ 38
++#define CCS_L_MAX_PLL_IP_CLK_FREQ_MHZ 39
++#define CCS_L_MIN_PLL_MULTIPLIER 40
++#define CCS_L_MAX_PLL_MULTIPLIER 41
++#define CCS_L_MIN_PLL_OP_CLK_FREQ_MHZ 42
++#define CCS_L_MAX_PLL_OP_CLK_FREQ_MHZ 43
++#define CCS_L_MIN_VT_SYS_CLK_DIV 44
++#define CCS_L_MAX_VT_SYS_CLK_DIV 45
++#define CCS_L_MIN_VT_SYS_CLK_FREQ_MHZ 46
++#define CCS_L_MAX_VT_SYS_CLK_FREQ_MHZ 47
++#define CCS_L_MIN_VT_PIX_CLK_FREQ_MHZ 48
++#define CCS_L_MAX_VT_PIX_CLK_FREQ_MHZ 49
++#define CCS_L_MIN_VT_PIX_CLK_DIV 50
++#define CCS_L_MAX_VT_PIX_CLK_DIV 51
++#define CCS_L_CLOCK_CALCULATION 52
++#define CCS_L_NUM_OF_VT_LANES 53
++#define CCS_L_NUM_OF_OP_LANES 54
++#define CCS_L_OP_BITS_PER_LANE 55
++#define CCS_L_MIN_FRAME_LENGTH_LINES 56
++#define CCS_L_MAX_FRAME_LENGTH_LINES 57
++#define CCS_L_MIN_LINE_LENGTH_PCK 58
++#define CCS_L_MAX_LINE_LENGTH_PCK 59
++#define CCS_L_MIN_LINE_BLANKING_PCK 60
++#define CCS_L_MIN_FRAME_BLANKING_LINES 61
++#define CCS_L_MIN_LINE_LENGTH_PCK_STEP_SIZE 62
++#define CCS_L_TIMING_MODE_CAPABILITY 63
++#define CCS_L_FRAME_MARGIN_MAX_VALUE 64
++#define CCS_L_FRAME_MARGIN_MIN_VALUE 65
++#define CCS_L_GAIN_DELAY_TYPE 66
++#define CCS_L_MIN_OP_SYS_CLK_DIV 67
++#define CCS_L_MAX_OP_SYS_CLK_DIV 68
++#define CCS_L_MIN_OP_SYS_CLK_FREQ_MHZ 69
++#define CCS_L_MAX_OP_SYS_CLK_FREQ_MHZ 70
++#define CCS_L_MIN_OP_PIX_CLK_DIV 71
++#define CCS_L_MAX_OP_PIX_CLK_DIV 72
++#define CCS_L_MIN_OP_PIX_CLK_FREQ_MHZ 73
++#define CCS_L_MAX_OP_PIX_CLK_FREQ_MHZ 74
++#define CCS_L_X_ADDR_MIN 75
++#define CCS_L_Y_ADDR_MIN 76
++#define CCS_L_X_ADDR_MAX 77
++#define CCS_L_Y_ADDR_MAX 78
++#define CCS_L_MIN_X_OUTPUT_SIZE 79
++#define CCS_L_MIN_Y_OUTPUT_SIZE 80
++#define CCS_L_MAX_X_OUTPUT_SIZE 81
++#define CCS_L_MAX_Y_OUTPUT_SIZE 82
++#define CCS_L_X_ADDR_START_DIV_CONSTANT 83
++#define CCS_L_Y_ADDR_START_DIV_CONSTANT 84
++#define CCS_L_X_ADDR_END_DIV_CONSTANT 85
++#define CCS_L_Y_ADDR_END_DIV_CONSTANT 86
++#define CCS_L_X_SIZE_DIV 87
++#define CCS_L_Y_SIZE_DIV 88
++#define CCS_L_X_OUTPUT_DIV 89
++#define CCS_L_Y_OUTPUT_DIV 90
++#define CCS_L_NON_FLEXIBLE_RESOLUTION_SUPPORT 91
++#define CCS_L_MIN_OP_PRE_PLL_CLK_DIV 92
++#define CCS_L_MAX_OP_PRE_PLL_CLK_DIV 93
++#define CCS_L_MIN_OP_PLL_IP_CLK_FREQ_MHZ 94
++#define CCS_L_MAX_OP_PLL_IP_CLK_FREQ_MHZ 95
++#define CCS_L_MIN_OP_PLL_MULTIPLIER 96
++#define CCS_L_MAX_OP_PLL_MULTIPLIER 97
++#define CCS_L_MIN_OP_PLL_OP_CLK_FREQ_MHZ 98
++#define CCS_L_MAX_OP_PLL_OP_CLK_FREQ_MHZ 99
++#define CCS_L_CLOCK_TREE_PLL_CAPABILITY 100
++#define CCS_L_CLOCK_CAPA_TYPE_CAPABILITY 101
++#define CCS_L_MIN_EVEN_INC 102
++#define CCS_L_MIN_ODD_INC 103
++#define CCS_L_MAX_EVEN_INC 104
++#define CCS_L_MAX_ODD_INC 105
++#define CCS_L_AUX_SUBSAMP_CAPABILITY 106
++#define CCS_L_AUX_SUBSAMP_MONO_CAPABILITY 107
++#define CCS_L_MONOCHROME_CAPABILITY 108
++#define CCS_L_PIXEL_READOUT_CAPABILITY 109
++#define CCS_L_MIN_EVEN_INC_MONO 110
++#define CCS_L_MAX_EVEN_INC_MONO 111
++#define CCS_L_MIN_ODD_INC_MONO 112
++#define CCS_L_MAX_ODD_INC_MONO 113
++#define CCS_L_MIN_EVEN_INC_BC2 114
++#define CCS_L_MAX_EVEN_INC_BC2 115
++#define CCS_L_MIN_ODD_INC_BC2 116
++#define CCS_L_MAX_ODD_INC_BC2 117
++#define CCS_L_MIN_EVEN_INC_MONO_BC2 118
++#define CCS_L_MAX_EVEN_INC_MONO_BC2 119
++#define CCS_L_MIN_ODD_INC_MONO_BC2 120
++#define CCS_L_MAX_ODD_INC_MONO_BC2 121
++#define CCS_L_SCALING_CAPABILITY 122
++#define CCS_L_SCALER_M_MIN 123
++#define CCS_L_SCALER_M_MAX 124
++#define CCS_L_SCALER_N_MIN 125
++#define CCS_L_SCALER_N_MAX 126
++#define CCS_L_DIGITAL_CROP_CAPABILITY 127
++#define CCS_L_HDR_CAPABILITY_1 128
++#define CCS_L_MIN_HDR_BIT_DEPTH 129
++#define CCS_L_HDR_RESOLUTION_SUB_TYPES 130
++#define CCS_L_HDR_RESOLUTION_SUB_TYPE 131
++#define CCS_L_HDR_RESOLUTION_SUB_TYPE_OFFSET(n) (n)
++#define CCS_L_HDR_CAPABILITY_2 132
++#define CCS_L_MAX_HDR_BIT_DEPTH 133
++#define CCS_L_USL_SUPPORT_CAPABILITY 134
++#define CCS_L_USL_CLOCK_MODE_D_CAPABILITY 135
++#define CCS_L_MIN_OP_SYS_CLK_DIV_REV 136
++#define CCS_L_MAX_OP_SYS_CLK_DIV_REV 137
++#define CCS_L_MIN_OP_PIX_CLK_DIV_REV 138
++#define CCS_L_MAX_OP_PIX_CLK_DIV_REV 139
++#define CCS_L_MIN_OP_SYS_CLK_FREQ_REV_MHZ 140
++#define CCS_L_MAX_OP_SYS_CLK_FREQ_REV_MHZ 141
++#define CCS_L_MIN_OP_PIX_CLK_FREQ_REV_MHZ 142
++#define CCS_L_MAX_OP_PIX_CLK_FREQ_REV_MHZ 143
++#define CCS_L_MAX_BITRATE_REV_D_MODE_MBPS 144
++#define CCS_L_MAX_SYMRATE_REV_C_MODE_MSPS 145
++#define CCS_L_COMPRESSION_CAPABILITY 146
++#define CCS_L_TEST_MODE_CAPABILITY 147
++#define CCS_L_PN9_DATA_FORMAT1 148
++#define CCS_L_PN9_DATA_FORMAT2 149
++#define CCS_L_PN9_DATA_FORMAT3 150
++#define CCS_L_PN9_DATA_FORMAT4 151
++#define CCS_L_PN9_MISC_CAPABILITY 152
++#define CCS_L_TEST_PATTERN_CAPABILITY 153
++#define CCS_L_PATTERN_SIZE_DIV_M1 154
++#define CCS_L_FIFO_SUPPORT_CAPABILITY 155
++#define CCS_L_PHY_CTRL_CAPABILITY 156
++#define CCS_L_CSI_DPHY_LANE_MODE_CAPABILITY 157
++#define CCS_L_CSI_SIGNALING_MODE_CAPABILITY 158
++#define CCS_L_FAST_STANDBY_CAPABILITY 159
++#define CCS_L_CSI_ADDRESS_CONTROL_CAPABILITY 160
++#define CCS_L_DATA_TYPE_CAPABILITY 161
++#define CCS_L_CSI_CPHY_LANE_MODE_CAPABILITY 162
++#define CCS_L_EMB_DATA_CAPABILITY 163
++#define CCS_L_MAX_PER_LANE_BITRATE_LANE_D_MODE_MBPS 164
++#define CCS_L_MAX_PER_LANE_BITRATE_LANE_D_MODE_MBPS_OFFSET(n) ((n) * 4)
++#define CCS_L_TEMP_SENSOR_CAPABILITY 165
++#define CCS_L_MAX_PER_LANE_BITRATE_LANE_C_MODE_MBPS 166
++#define CCS_L_MAX_PER_LANE_BITRATE_LANE_C_MODE_MBPS_OFFSET(n) ((n) * 4)
++#define CCS_L_DPHY_EQUALIZATION_CAPABILITY 167
++#define CCS_L_CPHY_EQUALIZATION_CAPABILITY 168
++#define CCS_L_DPHY_PREAMBLE_CAPABILITY 169
++#define CCS_L_DPHY_SSC_CAPABILITY 170
++#define CCS_L_CPHY_CALIBRATION_CAPABILITY 171
++#define CCS_L_DPHY_CALIBRATION_CAPABILITY 172
++#define CCS_L_PHY_CTRL_CAPABILITY_2 173
++#define CCS_L_LRTE_CPHY_CAPABILITY 174
++#define CCS_L_LRTE_DPHY_CAPABILITY 175
++#define CCS_L_ALPS_CAPABILITY_DPHY 176
++#define CCS_L_ALPS_CAPABILITY_CPHY 177
++#define CCS_L_SCRAMBLING_CAPABILITY 178
++#define CCS_L_DPHY_MANUAL_CONSTANT 179
++#define CCS_L_CPHY_MANUAL_CONSTANT 180
++#define CCS_L_CSI2_INTERFACE_CAPABILITY_MISC 181
++#define CCS_L_PHY_CTRL_CAPABILITY_3 182
++#define CCS_L_DPHY_SF 183
++#define CCS_L_CPHY_SF 184
++#define CCS_L_DPHY_LIMITS_1 185
++#define CCS_L_DPHY_LIMITS_2 186
++#define CCS_L_DPHY_LIMITS_3 187
++#define CCS_L_DPHY_LIMITS_4 188
++#define CCS_L_DPHY_LIMITS_5 189
++#define CCS_L_DPHY_LIMITS_6 190
++#define CCS_L_CPHY_LIMITS_1 191
++#define CCS_L_CPHY_LIMITS_2 192
++#define CCS_L_CPHY_LIMITS_3 193
++#define CCS_L_MIN_FRAME_LENGTH_LINES_BIN 194
++#define CCS_L_MAX_FRAME_LENGTH_LINES_BIN 195
++#define CCS_L_MIN_LINE_LENGTH_PCK_BIN 196
++#define CCS_L_MAX_LINE_LENGTH_PCK_BIN 197
++#define CCS_L_MIN_LINE_BLANKING_PCK_BIN 198
++#define CCS_L_FINE_INTEGRATION_TIME_MIN_BIN 199
++#define CCS_L_FINE_INTEGRATION_TIME_MAX_MARGIN_BIN 200
++#define CCS_L_BINNING_CAPABILITY 201
++#define CCS_L_BINNING_WEIGHTING_CAPABILITY 202
++#define CCS_L_BINNING_SUB_TYPES 203
++#define CCS_L_BINNING_SUB_TYPE 204
++#define CCS_L_BINNING_SUB_TYPE_OFFSET(n) (n)
++#define CCS_L_BINNING_WEIGHTING_MONO_CAPABILITY 205
++#define CCS_L_BINNING_SUB_TYPES_MONO 206
++#define CCS_L_BINNING_SUB_TYPE_MONO 207
++#define CCS_L_BINNING_SUB_TYPE_MONO_OFFSET(n) (n)
++#define CCS_L_DATA_TRANSFER_IF_CAPABILITY 208
++#define CCS_L_SHADING_CORRECTION_CAPABILITY 209
++#define CCS_L_GREEN_IMBALANCE_CAPABILITY 210
++#define CCS_L_MODULE_SPECIFIC_CORRECTION_CAPABILITY 211
++#define CCS_L_DEFECT_CORRECTION_CAPABILITY 212
++#define CCS_L_DEFECT_CORRECTION_CAPABILITY_2 213
++#define CCS_L_NF_CAPABILITY 214
++#define CCS_L_OB_READOUT_CAPABILITY 215
++#define CCS_L_COLOR_FEEDBACK_CAPABILITY 216
++#define CCS_L_CFA_PATTERN_CAPABILITY 217
++#define CCS_L_CFA_PATTERN_CONVERSION_CAPABILITY 218
++#define CCS_L_FLASH_MODE_CAPABILITY 219
++#define CCS_L_SA_STROBE_MODE_CAPABILITY 220
++#define CCS_L_RESET_MAX_DELAY 221
++#define CCS_L_RESET_MIN_TIME 222
++#define CCS_L_PDAF_CAPABILITY_1 223
++#define CCS_L_PDAF_CAPABILITY_2 224
++#define CCS_L_BRACKETING_LUT_CAPABILITY_1 225
++#define CCS_L_BRACKETING_LUT_CAPABILITY_2 226
++#define CCS_L_BRACKETING_LUT_SIZE 227
++#define CCS_L_LAST 228
++
++#endif /* __CCS_LIMITS_H__ */
+diff --git a/drivers/media/i2c/smiapp/ccs-regs.h b/drivers/media/i2c/smiapp/ccs-regs.h
+new file mode 100644
+index 0000000000000..4b3e5df2121f8
+--- /dev/null
++++ b/drivers/media/i2c/smiapp/ccs-regs.h
+@@ -0,0 +1,954 @@
++/* SPDX-License-Identifier: GPL-2.0-only OR BSD-3-Clause */
++/* Copyright (C) 2019--2020 Intel Corporation */
++
++#ifndef __CCS_REGS_H__
++#define __CCS_REGS_H__
++
++#include <linux/bits.h>
++
++#define CCS_FL_BASE 16
++#define CCS_FL_16BIT BIT(CCS_FL_BASE)
++#define CCS_FL_32BIT BIT(CCS_FL_BASE + 1)
++#define CCS_FL_FLOAT_IREAL BIT(CCS_FL_BASE + 2)
++#define CCS_FL_IREAL BIT(CCS_FL_BASE + 3)
++#define CCS_R_ADDR(r) ((r) & 0xffff)
++
++#define CCS_R_MODULE_MODEL_ID (0x0000 | CCS_FL_16BIT)
++#define CCS_R_MODULE_REVISION_NUMBER_MAJOR 0x0002
++#define CCS_R_FRAME_COUNT 0x0005
++#define CCS_R_PIXEL_ORDER 0x0006
++#define CCS_PIXEL_ORDER_GRBG 0U
++#define CCS_PIXEL_ORDER_RGGB 1U
++#define CCS_PIXEL_ORDER_BGGR 2U
++#define CCS_PIXEL_ORDER_GBRG 3U
++#define CCS_R_MIPI_CCS_VERSION 0x0007
++#define CCS_MIPI_CCS_VERSION_V1_0 0x10
++#define CCS_MIPI_CCS_VERSION_V1_1 0x11
++#define CCS_MIPI_CCS_VERSION_MAJOR_SHIFT 4U
++#define CCS_MIPI_CCS_VERSION_MAJOR_MASK 0xf0
++#define CCS_MIPI_CCS_VERSION_MINOR_SHIFT 0U
++#define CCS_MIPI_CCS_VERSION_MINOR_MASK 0xf
++#define CCS_R_DATA_PEDESTAL (0x0008 | CCS_FL_16BIT)
++#define CCS_R_MODULE_MANUFACTURER_ID (0x000e | CCS_FL_16BIT)
++#define CCS_R_MODULE_REVISION_NUMBER_MINOR 0x0010
++#define CCS_R_MODULE_DATE_YEAR 0x0012
++#define CCS_R_MODULE_DATE_MONTH 0x0013
++#define CCS_R_MODULE_DATE_DAY 0x0014
++#define CCS_R_MODULE_DATE_PHASE 0x0015
++#define CCS_MODULE_DATE_PHASE_SHIFT 0U
++#define CCS_MODULE_DATE_PHASE_MASK 0x7
++#define CCS_MODULE_DATE_PHASE_TS 0U
++#define CCS_MODULE_DATE_PHASE_ES 1U
++#define CCS_MODULE_DATE_PHASE_CS 2U
++#define CCS_MODULE_DATE_PHASE_MP 3U
++#define CCS_R_SENSOR_MODEL_ID (0x0016 | CCS_FL_16BIT)
++#define CCS_R_SENSOR_REVISION_NUMBER 0x0018
++#define CCS_R_SENSOR_FIRMWARE_VERSION 0x001a
++#define CCS_R_SERIAL_NUMBER (0x001c | CCS_FL_32BIT)
++#define CCS_R_SENSOR_MANUFACTURER_ID (0x0020 | CCS_FL_16BIT)
++#define CCS_R_SENSOR_REVISION_NUMBER_16 (0x0022 | CCS_FL_16BIT)
++#define CCS_R_FRAME_FORMAT_MODEL_TYPE 0x0040
++#define CCS_FRAME_FORMAT_MODEL_TYPE_2_BYTE 1U
++#define CCS_FRAME_FORMAT_MODEL_TYPE_4_BYTE 2U
++#define CCS_R_FRAME_FORMAT_MODEL_SUBTYPE 0x0041
++#define CCS_FRAME_FORMAT_MODEL_SUBTYPE_ROWS_SHIFT 0U
++#define CCS_FRAME_FORMAT_MODEL_SUBTYPE_ROWS_MASK 0xf
++#define CCS_FRAME_FORMAT_MODEL_SUBTYPE_COLUMNS_SHIFT 4U
++#define CCS_FRAME_FORMAT_MODEL_SUBTYPE_COLUMNS_MASK 0xf0
++#define CCS_R_FRAME_FORMAT_DESCRIPTOR(n) ((0x0042 | CCS_FL_16BIT) + (n) * 2)
++#define CCS_LIM_FRAME_FORMAT_DESCRIPTOR_MIN_N 0U
++#define CCS_LIM_FRAME_FORMAT_DESCRIPTOR_MAX_N 14U
++#define CCS_R_FRAME_FORMAT_DESCRIPTOR_4(n) ((0x0060 | CCS_FL_32BIT) + (n) * 4)
++#define CCS_FRAME_FORMAT_DESCRIPTOR_PIXELS_SHIFT 0U
++#define CCS_FRAME_FORMAT_DESCRIPTOR_PIXELS_MASK 0xfff
++#define CCS_FRAME_FORMAT_DESCRIPTOR_PCODE_SHIFT 12U
++#define CCS_FRAME_FORMAT_DESCRIPTOR_PCODE_MASK 0xf000
++#define CCS_FRAME_FORMAT_DESCRIPTOR_PCODE_EMBEDDED 1U
++#define CCS_FRAME_FORMAT_DESCRIPTOR_PCODE_DUMMY_PIXEL 2U
++#define CCS_FRAME_FORMAT_DESCRIPTOR_PCODE_BLACK_PIXEL 3U
++#define CCS_FRAME_FORMAT_DESCRIPTOR_PCODE_DARK_PIXEL 4U
++#define CCS_FRAME_FORMAT_DESCRIPTOR_PCODE_VISIBLE_PIXEL 5U
++#define CCS_FRAME_FORMAT_DESCRIPTOR_PCODE_MANUF_SPECIFIC_0 8U
++#define CCS_FRAME_FORMAT_DESCRIPTOR_PCODE_MANUF_SPECIFIC_1 9U
++#define CCS_FRAME_FORMAT_DESCRIPTOR_PCODE_MANUF_SPECIFIC_2 10U
++#define CCS_FRAME_FORMAT_DESCRIPTOR_PCODE_MANUF_SPECIFIC_3 11U
++#define CCS_FRAME_FORMAT_DESCRIPTOR_PCODE_MANUF_SPECIFIC_4 12U
++#define CCS_FRAME_FORMAT_DESCRIPTOR_PCODE_MANUF_SPECIFIC_5 13U
++#define CCS_FRAME_FORMAT_DESCRIPTOR_PCODE_MANUF_SPECIFIC_6 14U
++#define CCS_LIM_FRAME_FORMAT_DESCRIPTOR_4_MIN_N 0U
++#define CCS_LIM_FRAME_FORMAT_DESCRIPTOR_4_MAX_N 7U
++#define CCS_FRAME_FORMAT_DESCRIPTOR_4_PIXELS_SHIFT 0U
++#define CCS_FRAME_FORMAT_DESCRIPTOR_4_PIXELS_MASK 0xffff
++#define CCS_FRAME_FORMAT_DESCRIPTOR_4_PCODE_SHIFT 28U
++#define CCS_FRAME_FORMAT_DESCRIPTOR_4_PCODE_MASK 0xf0000000
++#define CCS_FRAME_FORMAT_DESCRIPTOR_4_PCODE_EMBEDDED 1U
++#define CCS_FRAME_FORMAT_DESCRIPTOR_4_PCODE_DUMMY_PIXEL 2U
++#define CCS_FRAME_FORMAT_DESCRIPTOR_4_PCODE_BLACK_PIXEL 3U
++#define CCS_FRAME_FORMAT_DESCRIPTOR_4_PCODE_DARK_PIXEL 4U
++#define CCS_FRAME_FORMAT_DESCRIPTOR_4_PCODE_VISIBLE_PIXEL 5U
++#define CCS_FRAME_FORMAT_DESCRIPTOR_4_PCODE_MANUF_SPECIFIC_0 8U
++#define CCS_FRAME_FORMAT_DESCRIPTOR_4_PCODE_MANUF_SPECIFIC_1 9U
++#define CCS_FRAME_FORMAT_DESCRIPTOR_4_PCODE_MANUF_SPECIFIC_2 10U
++#define CCS_FRAME_FORMAT_DESCRIPTOR_4_PCODE_MANUF_SPECIFIC_3 11U
++#define CCS_FRAME_FORMAT_DESCRIPTOR_4_PCODE_MANUF_SPECIFIC_4 12U
++#define CCS_FRAME_FORMAT_DESCRIPTOR_4_PCODE_MANUF_SPECIFIC_5 13U
++#define CCS_FRAME_FORMAT_DESCRIPTOR_4_PCODE_MANUF_SPECIFIC_6 14U
++#define CCS_R_ANALOG_GAIN_CAPABILITY (0x0080 | CCS_FL_16BIT)
++#define CCS_ANALOG_GAIN_CAPABILITY_GLOBAL 0U
++#define CCS_ANALOG_GAIN_CAPABILITY_ALTERNATE_GLOBAL 2U
++#define CCS_R_ANALOG_GAIN_CODE_MIN (0x0084 | CCS_FL_16BIT)
++#define CCS_R_ANALOG_GAIN_CODE_MAX (0x0086 | CCS_FL_16BIT)
++#define CCS_R_ANALOG_GAIN_CODE_STEP (0x0088 | CCS_FL_16BIT)
++#define CCS_R_ANALOG_GAIN_TYPE (0x008a | CCS_FL_16BIT)
++#define CCS_R_ANALOG_GAIN_M0 (0x008c | CCS_FL_16BIT)
++#define CCS_R_ANALOG_GAIN_C0 (0x008e | CCS_FL_16BIT)
++#define CCS_R_ANALOG_GAIN_M1 (0x0090 | CCS_FL_16BIT)
++#define CCS_R_ANALOG_GAIN_C1 (0x0092 | CCS_FL_16BIT)
++#define CCS_R_ANALOG_LINEAR_GAIN_MIN (0x0094 | CCS_FL_16BIT)
++#define CCS_R_ANALOG_LINEAR_GAIN_MAX (0x0096 | CCS_FL_16BIT)
++#define CCS_R_ANALOG_LINEAR_GAIN_STEP_SIZE (0x0098 | CCS_FL_16BIT)
++#define CCS_R_ANALOG_EXPONENTIAL_GAIN_MIN (0x009a | CCS_FL_16BIT)
++#define CCS_R_ANALOG_EXPONENTIAL_GAIN_MAX (0x009c | CCS_FL_16BIT)
++#define CCS_R_ANALOG_EXPONENTIAL_GAIN_STEP_SIZE (0x009e | CCS_FL_16BIT)
++#define CCS_R_DATA_FORMAT_MODEL_TYPE 0x00c0
++#define CCS_DATA_FORMAT_MODEL_TYPE_NORMAL 1U
++#define CCS_DATA_FORMAT_MODEL_TYPE_EXTENDED 2U
++#define CCS_R_DATA_FORMAT_MODEL_SUBTYPE 0x00c1
++#define CCS_DATA_FORMAT_MODEL_SUBTYPE_ROWS_SHIFT 0U
++#define CCS_DATA_FORMAT_MODEL_SUBTYPE_ROWS_MASK 0xf
++#define CCS_DATA_FORMAT_MODEL_SUBTYPE_COLUMNS_SHIFT 4U
++#define CCS_DATA_FORMAT_MODEL_SUBTYPE_COLUMNS_MASK 0xf0
++#define CCS_R_DATA_FORMAT_DESCRIPTOR(n) ((0x00c2 | CCS_FL_16BIT) + (n) * 2)
++#define CCS_LIM_DATA_FORMAT_DESCRIPTOR_MIN_N 0U
++#define CCS_LIM_DATA_FORMAT_DESCRIPTOR_MAX_N 15U
++#define CCS_DATA_FORMAT_DESCRIPTOR_COMPRESSED_SHIFT 0U
++#define CCS_DATA_FORMAT_DESCRIPTOR_COMPRESSED_MASK 0xff
++#define CCS_DATA_FORMAT_DESCRIPTOR_UNCOMPRESSED_SHIFT 8U
++#define CCS_DATA_FORMAT_DESCRIPTOR_UNCOMPRESSED_MASK 0xff00
++#define CCS_R_MODE_SELECT 0x0100
++#define CCS_MODE_SELECT_SOFTWARE_STANDBY 0U
++#define CCS_MODE_SELECT_STREAMING 1U
++#define CCS_R_IMAGE_ORIENTATION 0x0101
++#define CCS_IMAGE_ORIENTATION_HORIZONTAL_MIRROR BIT(0)
++#define CCS_IMAGE_ORIENTATION_VERTICAL_FLIP BIT(1)
++#define CCS_R_SOFTWARE_RESET 0x0103
++#define CCS_SOFTWARE_RESET_OFF 0U
++#define CCS_SOFTWARE_RESET_ON 1U
++#define CCS_R_GROUPED_PARAMETER_HOLD 0x0104
++#define CCS_R_MASK_CORRUPTED_FRAMES 0x0105
++#define CCS_MASK_CORRUPTED_FRAMES_ALLOW 0U
++#define CCS_MASK_CORRUPTED_FRAMES_MASK 1U
++#define CCS_R_FAST_STANDBY_CTRL 0x0106
++#define CCS_FAST_STANDBY_CTRL_COMPLETE_FRAMES 0U
++#define CCS_FAST_STANDBY_CTRL_FRAME_TRUNCATION 1U
++#define CCS_R_CCI_ADDRESS_CTRL 0x0107
++#define CCS_R_2ND_CCI_IF_CTRL 0x0108
++#define CCS_2ND_CCI_IF_CTRL_ENABLE BIT(0)
++#define CCS_2ND_CCI_IF_CTRL_ACK BIT(1)
++#define CCS_R_2ND_CCI_ADDRESS_CTRL 0x0109
++#define CCS_R_CSI_CHANNEL_IDENTIFIER 0x0110
++#define CCS_R_CSI_SIGNALING_MODE 0x0111
++#define CCS_CSI_SIGNALING_MODE_CSI_2_DPHY 2U
++#define CCS_CSI_SIGNALING_MODE_CSI_2_CPHY 3U
++#define CCS_R_CSI_DATA_FORMAT (0x0112 | CCS_FL_16BIT)
++#define CCS_R_CSI_LANE_MODE 0x0114
++#define CCS_R_DPCM_FRAME_DT 0x011d
++#define CCS_R_BOTTOM_EMBEDDED_DATA_DT 0x011e
++#define CCS_R_BOTTOM_EMBEDDED_DATA_VC 0x011f
++#define CCS_R_GAIN_MODE 0x0120
++#define CCS_GAIN_MODE_GLOBAL 0U
++#define CCS_GAIN_MODE_ALTERNATE 1U
++#define CCS_R_ADC_BIT_DEPTH 0x0121
++#define CCS_R_EMB_DATA_CTRL 0x0122
++#define CCS_EMB_DATA_CTRL_RAW8_PACKING_FOR_RAW16 BIT(0)
++#define CCS_EMB_DATA_CTRL_RAW10_PACKING_FOR_RAW20 BIT(1)
++#define CCS_EMB_DATA_CTRL_RAW12_PACKING_FOR_RAW24 BIT(2)
++#define CCS_R_GPIO_TRIG_MODE 0x0130
++#define CCS_R_EXTCLK_FREQUENCY_MHZ (0x0136 | (CCS_FL_16BIT | CCS_FL_IREAL))
++#define CCS_R_TEMP_SENSOR_CTRL 0x0138
++#define CCS_TEMP_SENSOR_CTRL_ENABLE BIT(0)
++#define CCS_R_TEMP_SENSOR_MODE 0x0139
++#define CCS_R_TEMP_SENSOR_OUTPUT 0x013a
++#define CCS_R_FINE_INTEGRATION_TIME (0x0200 | CCS_FL_16BIT)
++#define CCS_R_COARSE_INTEGRATION_TIME (0x0202 | CCS_FL_16BIT)
++#define CCS_R_ANALOG_GAIN_CODE_GLOBAL (0x0204 | CCS_FL_16BIT)
++#define CCS_R_ANALOG_LINEAR_GAIN_GLOBAL (0x0206 | CCS_FL_16BIT)
++#define CCS_R_ANALOG_EXPONENTIAL_GAIN_GLOBAL (0x0208 | CCS_FL_16BIT)
++#define CCS_R_DIGITAL_GAIN_GLOBAL (0x020e | CCS_FL_16BIT)
++#define CCS_R_SHORT_ANALOG_GAIN_GLOBAL (0x0216 | CCS_FL_16BIT)
++#define CCS_R_SHORT_DIGITAL_GAIN_GLOBAL (0x0218 | CCS_FL_16BIT)
++#define CCS_R_HDR_MODE 0x0220
++#define CCS_HDR_MODE_ENABLED BIT(0)
++#define CCS_HDR_MODE_SEPARATE_ANALOG_GAIN BIT(1)
++#define CCS_HDR_MODE_UPSCALING BIT(2)
++#define CCS_HDR_MODE_RESET_SYNC BIT(3)
++#define CCS_HDR_MODE_TIMING_MODE BIT(4)
++#define CCS_HDR_MODE_EXPOSURE_CTRL_DIRECT BIT(5)
++#define CCS_HDR_MODE_SEPARATE_DIGITAL_GAIN BIT(6)
++#define CCS_R_HDR_RESOLUTION_REDUCTION 0x0221
++#define CCS_HDR_RESOLUTION_REDUCTION_ROW_SHIFT 0U
++#define CCS_HDR_RESOLUTION_REDUCTION_ROW_MASK 0xf
++#define CCS_HDR_RESOLUTION_REDUCTION_COLUMN_SHIFT 4U
++#define CCS_HDR_RESOLUTION_REDUCTION_COLUMN_MASK 0xf0
++#define CCS_R_EXPOSURE_RATIO 0x0222
++#define CCS_R_HDR_INTERNAL_BIT_DEPTH 0x0223
++#define CCS_R_DIRECT_SHORT_INTEGRATION_TIME (0x0224 | CCS_FL_16BIT)
++#define CCS_R_SHORT_ANALOG_LINEAR_GAIN_GLOBAL (0x0226 | CCS_FL_16BIT)
++#define CCS_R_SHORT_ANALOG_EXPONENTIAL_GAIN_GLOBAL (0x0228 | CCS_FL_16BIT)
++#define CCS_R_VT_PIX_CLK_DIV (0x0300 | CCS_FL_16BIT)
++#define CCS_R_VT_SYS_CLK_DIV (0x0302 | CCS_FL_16BIT)
++#define CCS_R_PRE_PLL_CLK_DIV (0x0304 | CCS_FL_16BIT)
++#define CCS_R_PLL_MULTIPLIER (0x0306 | CCS_FL_16BIT)
++#define CCS_R_OP_PIX_CLK_DIV (0x0308 | CCS_FL_16BIT)
++#define CCS_R_OP_SYS_CLK_DIV (0x030a | CCS_FL_16BIT)
++#define CCS_R_OP_PRE_PLL_CLK_DIV (0x030c | CCS_FL_16BIT)
++#define CCS_R_OP_PLL_MULTIPLIER (0x031e | CCS_FL_16BIT)
++#define CCS_R_PLL_MODE 0x0310
++#define CCS_PLL_MODE_SHIFT 0U
++#define CCS_PLL_MODE_MASK 0x1
++#define CCS_PLL_MODE_SINGLE 0U
++#define CCS_PLL_MODE_DUAL 1U
++#define CCS_R_OP_PIX_CLK_DIV_REV (0x0312 | CCS_FL_16BIT)
++#define CCS_R_OP_SYS_CLK_DIV_REV (0x0314 | CCS_FL_16BIT)
++#define CCS_R_FRAME_LENGTH_LINES (0x0340 | CCS_FL_16BIT)
++#define CCS_R_LINE_LENGTH_PCK (0x0342 | CCS_FL_16BIT)
++#define CCS_R_X_ADDR_START (0x0344 | CCS_FL_16BIT)
++#define CCS_R_Y_ADDR_START (0x0346 | CCS_FL_16BIT)
++#define CCS_R_X_ADDR_END (0x0348 | CCS_FL_16BIT)
++#define CCS_R_Y_ADDR_END (0x034a | CCS_FL_16BIT)
++#define CCS_R_X_OUTPUT_SIZE (0x034c | CCS_FL_16BIT)
++#define CCS_R_Y_OUTPUT_SIZE (0x034e | CCS_FL_16BIT)
++#define CCS_R_FRAME_LENGTH_CTRL 0x0350
++#define CCS_FRAME_LENGTH_CTRL_AUTOMATIC BIT(0)
++#define CCS_R_TIMING_MODE_CTRL 0x0352
++#define CCS_TIMING_MODE_CTRL_MANUAL_READOUT BIT(0)
++#define CCS_TIMING_MODE_CTRL_DELAYED_EXPOSURE BIT(1)
++#define CCS_R_START_READOUT_RS 0x0353
++#define CCS_START_READOUT_RS_MANUAL_READOUT_START BIT(0)
++#define CCS_R_FRAME_MARGIN (0x0354 | CCS_FL_16BIT)
++#define CCS_R_X_EVEN_INC (0x0380 | CCS_FL_16BIT)
++#define CCS_R_X_ODD_INC (0x0382 | CCS_FL_16BIT)
++#define CCS_R_Y_EVEN_INC (0x0384 | CCS_FL_16BIT)
++#define CCS_R_Y_ODD_INC (0x0386 | CCS_FL_16BIT)
++#define CCS_R_MONOCHROME_EN 0x0390
++#define CCS_MONOCHROME_EN_ENABLED 0U
++#define CCS_R_SCALING_MODE (0x0400 | CCS_FL_16BIT)
++#define CCS_SCALING_MODE_NO_SCALING 0U
++#define CCS_SCALING_MODE_HORIZONTAL 1U
++#define CCS_R_SCALE_M (0x0404 | CCS_FL_16BIT)
++#define CCS_R_SCALE_N (0x0406 | CCS_FL_16BIT)
++#define CCS_R_DIGITAL_CROP_X_OFFSET (0x0408 | CCS_FL_16BIT)
++#define CCS_R_DIGITAL_CROP_Y_OFFSET (0x040a | CCS_FL_16BIT)
++#define CCS_R_DIGITAL_CROP_IMAGE_WIDTH (0x040c | CCS_FL_16BIT)
++#define CCS_R_DIGITAL_CROP_IMAGE_HEIGHT (0x040e | CCS_FL_16BIT)
++#define CCS_R_COMPRESSION_MODE (0x0500 | CCS_FL_16BIT)
++#define CCS_COMPRESSION_MODE_NONE 0U
++#define CCS_COMPRESSION_MODE_DPCM_PCM_SIMPLE 1U
++#define CCS_R_TEST_PATTERN_MODE (0x0600 | CCS_FL_16BIT)
++#define CCS_TEST_PATTERN_MODE_NONE 0U
++#define CCS_TEST_PATTERN_MODE_SOLID_COLOR 1U
++#define CCS_TEST_PATTERN_MODE_COLOR_BARS 2U
++#define CCS_TEST_PATTERN_MODE_FADE_TO_GREY 3U
++#define CCS_TEST_PATTERN_MODE_PN9 4U
++#define CCS_TEST_PATTERN_MODE_COLOR_TILE 5U
++#define CCS_R_TEST_DATA_RED (0x0602 | CCS_FL_16BIT)
++#define CCS_R_TEST_DATA_GREENR (0x0604 | CCS_FL_16BIT)
++#define CCS_R_TEST_DATA_BLUE (0x0606 | CCS_FL_16BIT)
++#define CCS_R_TEST_DATA_GREENB (0x0608 | CCS_FL_16BIT)
++#define CCS_R_VALUE_STEP_SIZE_SMOOTH 0x060a
++#define CCS_R_VALUE_STEP_SIZE_QUANTISED 0x060b
++#define CCS_R_TCLK_POST 0x0800
++#define CCS_R_THS_PREPARE 0x0801
++#define CCS_R_THS_ZERO_MIN 0x0802
++#define CCS_R_THS_TRAIL 0x0803
++#define CCS_R_TCLK_TRAIL_MIN 0x0804
++#define CCS_R_TCLK_PREPARE 0x0805
++#define CCS_R_TCLK_ZERO 0x0806
++#define CCS_R_TLPX 0x0807
++#define CCS_R_PHY_CTRL 0x0808
++#define CCS_PHY_CTRL_AUTO 0U
++#define CCS_PHY_CTRL_UI 1U
++#define CCS_PHY_CTRL_MANUAL 2U
++#define CCS_R_TCLK_POST_EX (0x080a | CCS_FL_16BIT)
++#define CCS_R_THS_PREPARE_EX (0x080c | CCS_FL_16BIT)
++#define CCS_R_THS_ZERO_MIN_EX (0x080e | CCS_FL_16BIT)
++#define CCS_R_THS_TRAIL_EX (0x0810 | CCS_FL_16BIT)
++#define CCS_R_TCLK_TRAIL_MIN_EX (0x0812 | CCS_FL_16BIT)
++#define CCS_R_TCLK_PREPARE_EX (0x0814 | CCS_FL_16BIT)
++#define CCS_R_TCLK_ZERO_EX (0x0816 | CCS_FL_16BIT)
++#define CCS_R_TLPX_EX (0x0818 | CCS_FL_16BIT)
++#define CCS_R_REQUESTED_LINK_RATE (0x0820 | CCS_FL_32BIT)
++#define CCS_R_DPHY_EQUALIZATION_MODE 0x0824
++#define CCS_DPHY_EQUALIZATION_MODE_EQ2 BIT(0)
++#define CCS_R_PHY_EQUALIZATION_CTRL 0x0825
++#define CCS_PHY_EQUALIZATION_CTRL_ENABLE BIT(0)
++#define CCS_R_DPHY_PREAMBLE_CTRL 0x0826
++#define CCS_DPHY_PREAMBLE_CTRL_ENABLE BIT(0)
++#define CCS_R_DPHY_PREAMBLE_LENGTH 0x0826
++#define CCS_R_PHY_SSC_CTRL 0x0828
++#define CCS_PHY_SSC_CTRL_ENABLE BIT(0)
++#define CCS_R_MANUAL_LP_CTRL 0x0829
++#define CCS_MANUAL_LP_CTRL_ENABLE BIT(0)
++#define CCS_R_TWAKEUP 0x082a
++#define CCS_R_TINIT 0x082b
++#define CCS_R_THS_EXIT 0x082c
++#define CCS_R_THS_EXIT_EX (0x082e | CCS_FL_16BIT)
++#define CCS_R_PHY_PERIODIC_CALIBRATION_CTRL 0x0830
++#define CCS_PHY_PERIODIC_CALIBRATION_CTRL_FRAME_BLANKING BIT(0)
++#define CCS_R_PHY_PERIODIC_CALIBRATION_INTERVAL 0x0831
++#define CCS_R_PHY_INIT_CALIBRATION_CTRL 0x0832
++#define CCS_PHY_INIT_CALIBRATION_CTRL_STREAM_START BIT(0)
++#define CCS_R_DPHY_CALIBRATION_MODE 0x0833
++#define CCS_DPHY_CALIBRATION_MODE_ALSO_ALTERNATE BIT(0)
++#define CCS_R_CPHY_CALIBRATION_MODE 0x0834
++#define CCS_CPHY_CALIBRATION_MODE_FORMAT_1 0U
++#define CCS_CPHY_CALIBRATION_MODE_FORMAT_2 1U
++#define CCS_CPHY_CALIBRATION_MODE_FORMAT_3 2U
++#define CCS_R_T3_CALPREAMBLE_LENGTH 0x0835
++#define CCS_R_T3_CALPREAMBLE_LENGTH_PER 0x0836
++#define CCS_R_T3_CALALTSEQ_LENGTH 0x0837
++#define CCS_R_T3_CALALTSEQ_LENGTH_PER 0x0838
++#define CCS_R_FM2_INIT_SEED (0x083a | CCS_FL_16BIT)
++#define CCS_R_T3_CALUDEFSEQ_LENGTH (0x083c | CCS_FL_16BIT)
++#define CCS_R_T3_CALUDEFSEQ_LENGTH_PER (0x083e | CCS_FL_16BIT)
++#define CCS_R_TGR_PREAMBLE_LENGTH 0x0841
++#define CCS_TGR_PREAMBLE_LENGTH_PREAMABLE_PROG_SEQ BIT(7)
++#define CCS_TGR_PREAMBLE_LENGTH_BEGIN_PREAMBLE_LENGTH_SHIFT 0U
++#define CCS_TGR_PREAMBLE_LENGTH_BEGIN_PREAMBLE_LENGTH_MASK 0x3f
++#define CCS_R_TGR_POST_LENGTH 0x0842
++#define CCS_TGR_POST_LENGTH_POST_LENGTH_SHIFT 0U
++#define CCS_TGR_POST_LENGTH_POST_LENGTH_MASK 0x1f
++#define CCS_R_TGR_PREAMBLE_PROG_SEQUENCE(n2) (0x0843 + (n2))
++#define CCS_LIM_TGR_PREAMBLE_PROG_SEQUENCE_MIN_N2 0U
++#define CCS_LIM_TGR_PREAMBLE_PROG_SEQUENCE_MAX_N2 6U
++#define CCS_TGR_PREAMBLE_PROG_SEQUENCE_SYMBOL_N_1_SHIFT 3U
++#define CCS_TGR_PREAMBLE_PROG_SEQUENCE_SYMBOL_N_1_MASK 0x38
++#define CCS_TGR_PREAMBLE_PROG_SEQUENCE_SYMBOL_N_SHIFT 0U
++#define CCS_TGR_PREAMBLE_PROG_SEQUENCE_SYMBOL_N_MASK 0x7
++#define CCS_R_T3_PREPARE (0x084e | CCS_FL_16BIT)
++#define CCS_R_T3_LPX (0x0850 | CCS_FL_16BIT)
++#define CCS_R_ALPS_CTRL 0x085a
++#define CCS_ALPS_CTRL_LVLP_DPHY BIT(0)
++#define CCS_ALPS_CTRL_LVLP_CPHY BIT(1)
++#define CCS_ALPS_CTRL_ALP_CPHY BIT(2)
++#define CCS_R_TX_REG_CSI_EPD_EN_SSP_CPHY (0x0860 | CCS_FL_16BIT)
++#define CCS_R_TX_REG_CSI_EPD_OP_SLP_CPHY (0x0862 | CCS_FL_16BIT)
++#define CCS_R_TX_REG_CSI_EPD_EN_SSP_DPHY (0x0864 | CCS_FL_16BIT)
++#define CCS_R_TX_REG_CSI_EPD_OP_SLP_DPHY (0x0866 | CCS_FL_16BIT)
++#define CCS_R_TX_REG_CSI_EPD_MISC_OPTION_CPHY 0x0868
++#define CCS_R_TX_REG_CSI_EPD_MISC_OPTION_DPHY 0x0869
++#define CCS_R_SCRAMBLING_CTRL 0x0870
++#define CCS_SCRAMBLING_CTRL_ENABLED BIT(0)
++#define CCS_SCRAMBLING_CTRL_SHIFT 2U
++#define CCS_SCRAMBLING_CTRL_MASK 0xc
++#define CCS_SCRAMBLING_CTRL_1_SEED_CPHY 0U
++#define CCS_SCRAMBLING_CTRL_4_SEED_CPHY 3U
++#define CCS_R_LANE_SEED_VALUE(seed, lane) ((0x0872 | CCS_FL_16BIT) + (seed) * 16 + (lane) * 2)
++#define CCS_LIM_LANE_SEED_VALUE_MIN_SEED 0U
++#define CCS_LIM_LANE_SEED_VALUE_MAX_SEED 3U
++#define CCS_LIM_LANE_SEED_VALUE_MIN_LANE 0U
++#define CCS_LIM_LANE_SEED_VALUE_MAX_LANE 7U
++#define CCS_R_TX_USL_REV_ENTRY (0x08c0 | CCS_FL_16BIT)
++#define CCS_R_TX_USL_REV_CLOCK_COUNTER (0x08c2 | CCS_FL_16BIT)
++#define CCS_R_TX_USL_REV_LP_COUNTER (0x08c4 | CCS_FL_16BIT)
++#define CCS_R_TX_USL_REV_FRAME_COUNTER (0x08c6 | CCS_FL_16BIT)
++#define CCS_R_TX_USL_REV_CHRONOLOGICAL_TIMER (0x08c8 | CCS_FL_16BIT)
++#define CCS_R_TX_USL_FWD_ENTRY (0x08ca | CCS_FL_16BIT)
++#define CCS_R_TX_USL_GPIO (0x08cc | CCS_FL_16BIT)
++#define CCS_R_TX_USL_OPERATION (0x08ce | CCS_FL_16BIT)
++#define CCS_TX_USL_OPERATION_RESET BIT(0)
++#define CCS_R_TX_USL_ALP_CTRL (0x08d0 | CCS_FL_16BIT)
++#define CCS_TX_USL_ALP_CTRL_CLOCK_PAUSE BIT(0)
++#define CCS_R_TX_USL_APP_BTA_ACK_TIMEOUT (0x08d2 | CCS_FL_16BIT)
++#define CCS_R_TX_USL_SNS_BTA_ACK_TIMEOUT (0x08d2 | CCS_FL_16BIT)
++#define CCS_R_USL_CLOCK_MODE_D_CTRL 0x08d2
++#define CCS_USL_CLOCK_MODE_D_CTRL_CONT_CLOCK_STANDBY BIT(0)
++#define CCS_USL_CLOCK_MODE_D_CTRL_CONT_CLOCK_VBLANK BIT(1)
++#define CCS_USL_CLOCK_MODE_D_CTRL_CONT_CLOCK_HBLANK BIT(2)
++#define CCS_R_BINNING_MODE 0x0900
++#define CCS_R_BINNING_TYPE 0x0901
++#define CCS_R_BINNING_WEIGHTING 0x0902
++#define CCS_R_DATA_TRANSFER_IF_1_CTRL 0x0a00
++#define CCS_DATA_TRANSFER_IF_1_CTRL_ENABLE BIT(0)
++#define CCS_DATA_TRANSFER_IF_1_CTRL_WRITE BIT(1)
++#define CCS_DATA_TRANSFER_IF_1_CTRL_CLEAR_ERROR BIT(2)
++#define CCS_R_DATA_TRANSFER_IF_1_STATUS 0x0a01
++#define CCS_DATA_TRANSFER_IF_1_STATUS_READ_IF_READY BIT(0)
++#define CCS_DATA_TRANSFER_IF_1_STATUS_WRITE_IF_READY BIT(1)
++#define CCS_DATA_TRANSFER_IF_1_STATUS_DATA_CORRUPTED BIT(2)
++#define CCS_DATA_TRANSFER_IF_1_STATUS_IMPROPER_IF_USAGE BIT(3)
++#define CCS_R_DATA_TRANSFER_IF_1_PAGE_SELECT 0x0a02
++#define CCS_R_DATA_TRANSFER_IF_1_DATA(p) (0x0a04 + (p))
++#define CCS_LIM_DATA_TRANSFER_IF_1_DATA_MIN_P 0U
++#define CCS_LIM_DATA_TRANSFER_IF_1_DATA_MAX_P 63U
++#define CCS_R_SHADING_CORRECTION_EN 0x0b00
++#define CCS_SHADING_CORRECTION_EN_ENABLE BIT(0)
++#define CCS_R_LUMINANCE_CORRECTION_LEVEL 0x0b01
++#define CCS_R_GREEN_IMBALANCE_FILTER_EN 0x0b02
++#define CCS_GREEN_IMBALANCE_FILTER_EN_ENABLE BIT(0)
++#define CCS_R_MAPPED_DEFECT_CORRECT_EN 0x0b05
++#define CCS_MAPPED_DEFECT_CORRECT_EN_ENABLE BIT(0)
++#define CCS_R_SINGLE_DEFECT_CORRECT_EN 0x0b06
++#define CCS_SINGLE_DEFECT_CORRECT_EN_ENABLE BIT(0)
++#define CCS_R_DYNAMIC_COUPLET_CORRECT_EN 0x0b08
++#define CCS_DYNAMIC_COUPLET_CORRECT_EN_ENABLE BIT(0)
++#define CCS_R_COMBINED_DEFECT_CORRECT_EN 0x0b0a
++#define CCS_COMBINED_DEFECT_CORRECT_EN_ENABLE BIT(0)
++#define CCS_R_MODULE_SPECIFIC_CORRECTION_EN 0x0b0c
++#define CCS_MODULE_SPECIFIC_CORRECTION_EN_ENABLE BIT(0)
++#define CCS_R_DYNAMIC_TRIPLET_DEFECT_CORRECT_EN 0x0b13
++#define CCS_DYNAMIC_TRIPLET_DEFECT_CORRECT_EN_ENABLE BIT(0)
++#define CCS_R_NF_CTRL 0x0b15
++#define CCS_NF_CTRL_LUMA BIT(0)
++#define CCS_NF_CTRL_CHROMA BIT(1)
++#define CCS_NF_CTRL_COMBINED BIT(2)
++#define CCS_R_OB_READOUT_CONTROL 0x0b30
++#define CCS_OB_READOUT_CONTROL_ENABLE BIT(0)
++#define CCS_OB_READOUT_CONTROL_INTERLEAVING BIT(1)
++#define CCS_R_OB_VIRTUAL_CHANNEL 0x0b31
++#define CCS_R_OB_DT 0x0b32
++#define CCS_R_OB_DATA_FORMAT 0x0b33
++#define CCS_R_COLOR_TEMPERATURE (0x0b8c | CCS_FL_16BIT)
++#define CCS_R_ABSOLUTE_GAIN_GREENR (0x0b8e | CCS_FL_16BIT)
++#define CCS_R_ABSOLUTE_GAIN_RED (0x0b90 | CCS_FL_16BIT)
++#define CCS_R_ABSOLUTE_GAIN_BLUE (0x0b92 | CCS_FL_16BIT)
++#define CCS_R_ABSOLUTE_GAIN_GREENB (0x0b94 | CCS_FL_16BIT)
++#define CCS_R_CFA_CONVERSION_CTRL 0x0ba0
++#define CCS_CFA_CONVERSION_CTRL_BAYER_CONVERSION_ENABLE BIT(0)
++#define CCS_R_FLASH_STROBE_ADJUSTMENT 0x0c12
++#define CCS_R_FLASH_STROBE_START_POINT (0x0c14 | CCS_FL_16BIT)
++#define CCS_R_TFLASH_STROBE_DELAY_RS_CTRL (0x0c16 | CCS_FL_16BIT)
++#define CCS_R_TFLASH_STROBE_WIDTH_HIGH_RS_CTRL (0x0c18 | CCS_FL_16BIT)
++#define CCS_R_FLASH_MODE_RS 0x0c1a
++#define CCS_FLASH_MODE_RS_CONTINUOUS BIT(0)
++#define CCS_FLASH_MODE_RS_TRUNCATE BIT(1)
++#define CCS_FLASH_MODE_RS_ASYNC BIT(3)
++#define CCS_R_FLASH_TRIGGER_RS 0x0c1b
++#define CCS_R_FLASH_STATUS 0x0c1c
++#define CCS_FLASH_STATUS_RETIMED BIT(0)
++#define CCS_R_SA_STROBE_MODE 0x0c1d
++#define CCS_SA_STROBE_MODE_CONTINUOUS BIT(0)
++#define CCS_SA_STROBE_MODE_TRUNCATE BIT(1)
++#define CCS_SA_STROBE_MODE_ASYNC BIT(3)
++#define CCS_SA_STROBE_MODE_ADJUST_EDGE BIT(4)
++#define CCS_R_SA_STROBE_START_POINT (0x0c1e | CCS_FL_16BIT)
++#define CCS_R_TSA_STROBE_DELAY_CTRL (0x0c20 | CCS_FL_16BIT)
++#define CCS_R_TSA_STROBE_WIDTH_CTRL (0x0c22 | CCS_FL_16BIT)
++#define CCS_R_SA_STROBE_TRIGGER 0x0c24
++#define CCS_R_SA_STROBE_STATUS 0x0c25
++#define CCS_SA_STROBE_STATUS_RETIMED BIT(0)
++#define CCS_R_TSA_STROBE_RE_DELAY_CTRL (0x0c30 | CCS_FL_16BIT)
++#define CCS_R_TSA_STROBE_FE_DELAY_CTRL (0x0c32 | CCS_FL_16BIT)
++#define CCS_R_PDAF_CTRL (0x0d00 | CCS_FL_16BIT)
++#define CCS_PDAF_CTRL_ENABLE BIT(0)
++#define CCS_PDAF_CTRL_PROCESSED BIT(1)
++#define CCS_PDAF_CTRL_INTERLEAVED BIT(2)
++#define CCS_PDAF_CTRL_VISIBLE_PDAF_CORRECTION BIT(3)
++#define CCS_R_PDAF_VC 0x0d02
++#define CCS_R_PDAF_DT 0x0d03
++#define CCS_R_PD_X_ADDR_START (0x0d04 | CCS_FL_16BIT)
++#define CCS_R_PD_Y_ADDR_START (0x0d06 | CCS_FL_16BIT)
++#define CCS_R_PD_X_ADDR_END (0x0d08 | CCS_FL_16BIT)
++#define CCS_R_PD_Y_ADDR_END (0x0d0a | CCS_FL_16BIT)
++#define CCS_R_BRACKETING_LUT_CTRL 0x0e00
++#define CCS_R_BRACKETING_LUT_MODE 0x0e01
++#define CCS_BRACKETING_LUT_MODE_CONTINUE_STREAMING BIT(0)
++#define CCS_BRACKETING_LUT_MODE_LOOP_MODE BIT(1)
++#define CCS_R_BRACKETING_LUT_ENTRY_CTRL 0x0e02
++#define CCS_R_BRACKETING_LUT_FRAME(n) (0x0e10 + (n))
++#define CCS_LIM_BRACKETING_LUT_FRAME_MIN_N 0U
++#define CCS_LIM_BRACKETING_LUT_FRAME_MAX_N 239U
++#define CCS_R_INTEGRATION_TIME_CAPABILITY (0x1000 | CCS_FL_16BIT)
++#define CCS_INTEGRATION_TIME_CAPABILITY_FINE BIT(0)
++#define CCS_R_COARSE_INTEGRATION_TIME_MIN (0x1004 | CCS_FL_16BIT)
++#define CCS_R_COARSE_INTEGRATION_TIME_MAX_MARGIN (0x1006 | CCS_FL_16BIT)
++#define CCS_R_FINE_INTEGRATION_TIME_MIN (0x1008 | CCS_FL_16BIT)
++#define CCS_R_FINE_INTEGRATION_TIME_MAX_MARGIN (0x100a | CCS_FL_16BIT)
++#define CCS_R_DIGITAL_GAIN_CAPABILITY 0x1081
++#define CCS_DIGITAL_GAIN_CAPABILITY_NONE 0U
++#define CCS_DIGITAL_GAIN_CAPABILITY_GLOBAL 2U
++#define CCS_R_DIGITAL_GAIN_MIN (0x1084 | CCS_FL_16BIT)
++#define CCS_R_DIGITAL_GAIN_MAX (0x1086 | CCS_FL_16BIT)
++#define CCS_R_DIGITAL_GAIN_STEP_SIZE (0x1088 | CCS_FL_16BIT)
++#define CCS_R_PEDESTAL_CAPABILITY 0x10e0
++#define CCS_R_ADC_CAPABILITY 0x10f0
++#define CCS_ADC_CAPABILITY_BIT_DEPTH_CTRL BIT(0)
++#define CCS_R_ADC_BIT_DEPTH_CAPABILITY (0x10f4 | CCS_FL_32BIT)
++#define CCS_R_MIN_EXT_CLK_FREQ_MHZ (0x1100 | (CCS_FL_32BIT | CCS_FL_FLOAT_IREAL))
++#define CCS_R_MAX_EXT_CLK_FREQ_MHZ (0x1104 | (CCS_FL_32BIT | CCS_FL_FLOAT_IREAL))
++#define CCS_R_MIN_PRE_PLL_CLK_DIV (0x1108 | CCS_FL_16BIT)
++#define CCS_R_MAX_PRE_PLL_CLK_DIV (0x110a | CCS_FL_16BIT)
++#define CCS_R_MIN_PLL_IP_CLK_FREQ_MHZ (0x110c | (CCS_FL_32BIT | CCS_FL_FLOAT_IREAL))
++#define CCS_R_MAX_PLL_IP_CLK_FREQ_MHZ (0x1110 | (CCS_FL_32BIT | CCS_FL_FLOAT_IREAL))
++#define CCS_R_MIN_PLL_MULTIPLIER (0x1114 | CCS_FL_16BIT)
++#define CCS_R_MAX_PLL_MULTIPLIER (0x1116 | CCS_FL_16BIT)
++#define CCS_R_MIN_PLL_OP_CLK_FREQ_MHZ (0x1118 | (CCS_FL_32BIT | CCS_FL_FLOAT_IREAL))
++#define CCS_R_MAX_PLL_OP_CLK_FREQ_MHZ (0x111c | (CCS_FL_32BIT | CCS_FL_FLOAT_IREAL))
++#define CCS_R_MIN_VT_SYS_CLK_DIV (0x1120 | CCS_FL_16BIT)
++#define CCS_R_MAX_VT_SYS_CLK_DIV (0x1122 | CCS_FL_16BIT)
++#define CCS_R_MIN_VT_SYS_CLK_FREQ_MHZ (0x1124 | (CCS_FL_32BIT | CCS_FL_FLOAT_IREAL))
++#define CCS_R_MAX_VT_SYS_CLK_FREQ_MHZ (0x1128 | (CCS_FL_32BIT | CCS_FL_FLOAT_IREAL))
++#define CCS_R_MIN_VT_PIX_CLK_FREQ_MHZ (0x112c | (CCS_FL_32BIT | CCS_FL_FLOAT_IREAL))
++#define CCS_R_MAX_VT_PIX_CLK_FREQ_MHZ (0x1130 | (CCS_FL_32BIT | CCS_FL_FLOAT_IREAL))
++#define CCS_R_MIN_VT_PIX_CLK_DIV (0x1134 | CCS_FL_16BIT)
++#define CCS_R_MAX_VT_PIX_CLK_DIV (0x1136 | CCS_FL_16BIT)
++#define CCS_R_CLOCK_CALCULATION 0x1138
++#define CCS_CLOCK_CALCULATION_LANE_SPEED BIT(0)
++#define CCS_CLOCK_CALCULATION_LINK_DECOUPLED BIT(1)
++#define CCS_CLOCK_CALCULATION_DUAL_PLL_OP_SYS_DDR BIT(2)
++#define CCS_CLOCK_CALCULATION_DUAL_PLL_OP_PIX_DDR BIT(3)
++#define CCS_R_NUM_OF_VT_LANES 0x1139
++#define CCS_R_NUM_OF_OP_LANES 0x113a
++#define CCS_R_OP_BITS_PER_LANE 0x113b
++#define CCS_R_MIN_FRAME_LENGTH_LINES (0x1140 | CCS_FL_16BIT)
++#define CCS_R_MAX_FRAME_LENGTH_LINES (0x1142 | CCS_FL_16BIT)
++#define CCS_R_MIN_LINE_LENGTH_PCK (0x1144 | CCS_FL_16BIT)
++#define CCS_R_MAX_LINE_LENGTH_PCK (0x1146 | CCS_FL_16BIT)
++#define CCS_R_MIN_LINE_BLANKING_PCK (0x1148 | CCS_FL_16BIT)
++#define CCS_R_MIN_FRAME_BLANKING_LINES (0x114a | CCS_FL_16BIT)
++#define CCS_R_MIN_LINE_LENGTH_PCK_STEP_SIZE 0x114c
++#define CCS_R_TIMING_MODE_CAPABILITY 0x114d
++#define CCS_TIMING_MODE_CAPABILITY_AUTO_FRAME_LENGTH BIT(0)
++#define CCS_TIMING_MODE_CAPABILITY_ROLLING_SHUTTER_MANUAL_READOUT BIT(2)
++#define CCS_TIMING_MODE_CAPABILITY_DELAYED_EXPOSURE_START BIT(3)
++#define CCS_TIMING_MODE_CAPABILITY_MANUAL_EXPOSURE_EMBEDDED_DATA BIT(4)
++#define CCS_R_FRAME_MARGIN_MAX_VALUE (0x114e | CCS_FL_16BIT)
++#define CCS_R_FRAME_MARGIN_MIN_VALUE 0x1150
++#define CCS_R_GAIN_DELAY_TYPE 0x1151
++#define CCS_GAIN_DELAY_TYPE_FIXED 0U
++#define CCS_GAIN_DELAY_TYPE_VARIABLE 1U
++#define CCS_R_MIN_OP_SYS_CLK_DIV (0x1160 | CCS_FL_16BIT)
++#define CCS_R_MAX_OP_SYS_CLK_DIV (0x1162 | CCS_FL_16BIT)
++#define CCS_R_MIN_OP_SYS_CLK_FREQ_MHZ (0x1164 | (CCS_FL_32BIT | CCS_FL_FLOAT_IREAL))
++#define CCS_R_MAX_OP_SYS_CLK_FREQ_MHZ (0x1168 | (CCS_FL_32BIT | CCS_FL_FLOAT_IREAL))
++#define CCS_R_MIN_OP_PIX_CLK_DIV (0x116c | CCS_FL_16BIT)
++#define CCS_R_MAX_OP_PIX_CLK_DIV (0x116e | CCS_FL_16BIT)
++#define CCS_R_MIN_OP_PIX_CLK_FREQ_MHZ (0x1170 | (CCS_FL_32BIT | CCS_FL_FLOAT_IREAL))
++#define CCS_R_MAX_OP_PIX_CLK_FREQ_MHZ (0x1174 | (CCS_FL_32BIT | CCS_FL_FLOAT_IREAL))
++#define CCS_R_X_ADDR_MIN (0x1180 | CCS_FL_16BIT)
++#define CCS_R_Y_ADDR_MIN (0x1182 | CCS_FL_16BIT)
++#define CCS_R_X_ADDR_MAX (0x1184 | CCS_FL_16BIT)
++#define CCS_R_Y_ADDR_MAX (0x1186 | CCS_FL_16BIT)
++#define CCS_R_MIN_X_OUTPUT_SIZE (0x1188 | CCS_FL_16BIT)
++#define CCS_R_MIN_Y_OUTPUT_SIZE (0x118a | CCS_FL_16BIT)
++#define CCS_R_MAX_X_OUTPUT_SIZE (0x118c | CCS_FL_16BIT)
++#define CCS_R_MAX_Y_OUTPUT_SIZE (0x118e | CCS_FL_16BIT)
++#define CCS_R_X_ADDR_START_DIV_CONSTANT 0x1190
++#define CCS_R_Y_ADDR_START_DIV_CONSTANT 0x1191
++#define CCS_R_X_ADDR_END_DIV_CONSTANT 0x1192
++#define CCS_R_Y_ADDR_END_DIV_CONSTANT 0x1193
++#define CCS_R_X_SIZE_DIV 0x1194
++#define CCS_R_Y_SIZE_DIV 0x1195
++#define CCS_R_X_OUTPUT_DIV 0x1196
++#define CCS_R_Y_OUTPUT_DIV 0x1197
++#define CCS_R_NON_FLEXIBLE_RESOLUTION_SUPPORT 0x1198
++#define CCS_NON_FLEXIBLE_RESOLUTION_SUPPORT_NEW_PIX_ADDR BIT(0)
++#define CCS_NON_FLEXIBLE_RESOLUTION_SUPPORT_NEW_OUTPUT_RES BIT(1)
++#define CCS_NON_FLEXIBLE_RESOLUTION_SUPPORT_OUTPUT_CROP_NO_PAD BIT(2)
++#define CCS_NON_FLEXIBLE_RESOLUTION_SUPPORT_OUTPUT_SIZE_LANE_DEP BIT(3)
++#define CCS_R_MIN_OP_PRE_PLL_CLK_DIV (0x11a0 | CCS_FL_16BIT)
++#define CCS_R_MAX_OP_PRE_PLL_CLK_DIV (0x11a2 | CCS_FL_16BIT)
++#define CCS_R_MIN_OP_PLL_IP_CLK_FREQ_MHZ (0x11a4 | (CCS_FL_32BIT | CCS_FL_FLOAT_IREAL))
++#define CCS_R_MAX_OP_PLL_IP_CLK_FREQ_MHZ (0x11a8 | (CCS_FL_32BIT | CCS_FL_FLOAT_IREAL))
++#define CCS_R_MIN_OP_PLL_MULTIPLIER (0x11ac | CCS_FL_16BIT)
++#define CCS_R_MAX_OP_PLL_MULTIPLIER (0x11ae | CCS_FL_16BIT)
++#define CCS_R_MIN_OP_PLL_OP_CLK_FREQ_MHZ (0x11b0 | (CCS_FL_32BIT | CCS_FL_FLOAT_IREAL))
++#define CCS_R_MAX_OP_PLL_OP_CLK_FREQ_MHZ (0x11b4 | (CCS_FL_32BIT | CCS_FL_FLOAT_IREAL))
++#define CCS_R_CLOCK_TREE_PLL_CAPABILITY 0x11b8
++#define CCS_CLOCK_TREE_PLL_CAPABILITY_DUAL_PLL BIT(0)
++#define CCS_CLOCK_TREE_PLL_CAPABILITY_SINGLE_PLL BIT(1)
++#define CCS_CLOCK_TREE_PLL_CAPABILITY_EXT_DIVIDER BIT(2)
++#define CCS_CLOCK_TREE_PLL_CAPABILITY_FLEXIBLE_OP_PIX_CLK_DIV BIT(3)
++#define CCS_R_CLOCK_CAPA_TYPE_CAPABILITY 0x11b9
++#define CCS_CLOCK_CAPA_TYPE_CAPABILITY_IREAL BIT(0)
++#define CCS_R_MIN_EVEN_INC (0x11c0 | CCS_FL_16BIT)
++#define CCS_R_MIN_ODD_INC (0x11c2 | CCS_FL_16BIT)
++#define CCS_R_MAX_EVEN_INC (0x11c4 | CCS_FL_16BIT)
++#define CCS_R_MAX_ODD_INC (0x11c6 | CCS_FL_16BIT)
++#define CCS_R_AUX_SUBSAMP_CAPABILITY 0x11c8
++#define CCS_AUX_SUBSAMP_CAPABILITY_FACTOR_POWER_OF_2 BIT(1)
++#define CCS_R_AUX_SUBSAMP_MONO_CAPABILITY 0x11c9
++#define CCS_AUX_SUBSAMP_MONO_CAPABILITY_FACTOR_POWER_OF_2 BIT(1)
++#define CCS_R_MONOCHROME_CAPABILITY 0x11ca
++#define CCS_MONOCHROME_CAPABILITY_INC_ODD 0U
++#define CCS_MONOCHROME_CAPABILITY_INC_EVEN 1U
++#define CCS_R_PIXEL_READOUT_CAPABILITY 0x11cb
++#define CCS_PIXEL_READOUT_CAPABILITY_BAYER 0U
++#define CCS_PIXEL_READOUT_CAPABILITY_MONOCHROME 1U
++#define CCS_PIXEL_READOUT_CAPABILITY_BAYER_AND_MONO 2U
++#define CCS_R_MIN_EVEN_INC_MONO (0x11cc | CCS_FL_16BIT)
++#define CCS_R_MAX_EVEN_INC_MONO (0x11ce | CCS_FL_16BIT)
++#define CCS_R_MIN_ODD_INC_MONO (0x11d0 | CCS_FL_16BIT)
++#define CCS_R_MAX_ODD_INC_MONO (0x11d2 | CCS_FL_16BIT)
++#define CCS_R_MIN_EVEN_INC_BC2 (0x11d4 | CCS_FL_16BIT)
++#define CCS_R_MAX_EVEN_INC_BC2 (0x11d6 | CCS_FL_16BIT)
++#define CCS_R_MIN_ODD_INC_BC2 (0x11d8 | CCS_FL_16BIT)
++#define CCS_R_MAX_ODD_INC_BC2 (0x11da | CCS_FL_16BIT)
++#define CCS_R_MIN_EVEN_INC_MONO_BC2 (0x11dc | CCS_FL_16BIT)
++#define CCS_R_MAX_EVEN_INC_MONO_BC2 (0x11de | CCS_FL_16BIT)
++#define CCS_R_MIN_ODD_INC_MONO_BC2 (0x11f0 | CCS_FL_16BIT)
++#define CCS_R_MAX_ODD_INC_MONO_BC2 (0x11f2 | CCS_FL_16BIT)
++#define CCS_R_SCALING_CAPABILITY (0x1200 | CCS_FL_16BIT)
++#define CCS_SCALING_CAPABILITY_NONE 0U
++#define CCS_SCALING_CAPABILITY_HORIZONTAL 1U
++#define CCS_SCALING_CAPABILITY_RESERVED 2U
++#define CCS_R_SCALER_M_MIN (0x1204 | CCS_FL_16BIT)
++#define CCS_R_SCALER_M_MAX (0x1206 | CCS_FL_16BIT)
++#define CCS_R_SCALER_N_MIN (0x1208 | CCS_FL_16BIT)
++#define CCS_R_SCALER_N_MAX (0x120a | CCS_FL_16BIT)
++#define CCS_R_DIGITAL_CROP_CAPABILITY 0x120e
++#define CCS_DIGITAL_CROP_CAPABILITY_NONE 0U
++#define CCS_DIGITAL_CROP_CAPABILITY_INPUT_CROP 1U
++#define CCS_R_HDR_CAPABILITY_1 0x1210
++#define CCS_HDR_CAPABILITY_1_2X2_BINNING BIT(0)
++#define CCS_HDR_CAPABILITY_1_COMBINED_ANALOG_GAIN BIT(1)
++#define CCS_HDR_CAPABILITY_1_SEPARATE_ANALOG_GAIN BIT(2)
++#define CCS_HDR_CAPABILITY_1_UPSCALING BIT(3)
++#define CCS_HDR_CAPABILITY_1_RESET_SYNC BIT(4)
++#define CCS_HDR_CAPABILITY_1_DIRECT_SHORT_EXP_TIMING BIT(5)
++#define CCS_HDR_CAPABILITY_1_DIRECT_SHORT_EXP_SYNTHESIS BIT(6)
++#define CCS_R_MIN_HDR_BIT_DEPTH 0x1211
++#define CCS_R_HDR_RESOLUTION_SUB_TYPES 0x1212
++#define CCS_R_HDR_RESOLUTION_SUB_TYPE(n) (0x1213 + (n))
++#define CCS_LIM_HDR_RESOLUTION_SUB_TYPE_MIN_N 0U
++#define CCS_LIM_HDR_RESOLUTION_SUB_TYPE_MAX_N 1U
++#define CCS_HDR_RESOLUTION_SUB_TYPE_ROW_SHIFT 0U
++#define CCS_HDR_RESOLUTION_SUB_TYPE_ROW_MASK 0xf
++#define CCS_HDR_RESOLUTION_SUB_TYPE_COLUMN_SHIFT 4U
++#define CCS_HDR_RESOLUTION_SUB_TYPE_COLUMN_MASK 0xf0
++#define CCS_R_HDR_CAPABILITY_2 0x121b
++#define CCS_HDR_CAPABILITY_2_COMBINED_DIGITAL_GAIN BIT(0)
++#define CCS_HDR_CAPABILITY_2_SEPARATE_DIGITAL_GAIN BIT(1)
++#define CCS_HDR_CAPABILITY_2_TIMING_MODE BIT(3)
++#define CCS_HDR_CAPABILITY_2_SYNTHESIS_MODE BIT(4)
++#define CCS_R_MAX_HDR_BIT_DEPTH 0x121c
++#define CCS_R_USL_SUPPORT_CAPABILITY 0x1230
++#define CCS_USL_SUPPORT_CAPABILITY_CLOCK_TREE BIT(0)
++#define CCS_USL_SUPPORT_CAPABILITY_REV_CLOCK_TREE BIT(1)
++#define CCS_USL_SUPPORT_CAPABILITY_REV_CLOCK_CALC BIT(2)
++#define CCS_R_USL_CLOCK_MODE_D_CAPABILITY 0x1231
++#define CCS_USL_CLOCK_MODE_D_CAPABILITY_CONT_CLOCK_STANDBY BIT(0)
++#define CCS_USL_CLOCK_MODE_D_CAPABILITY_CONT_CLOCK_VBLANK BIT(1)
++#define CCS_USL_CLOCK_MODE_D_CAPABILITY_CONT_CLOCK_HBLANK BIT(2)
++#define CCS_USL_CLOCK_MODE_D_CAPABILITY_NONCONT_CLOCK_STANDBY BIT(3)
++#define CCS_USL_CLOCK_MODE_D_CAPABILITY_NONCONT_CLOCK_VBLANK BIT(4)
++#define CCS_USL_CLOCK_MODE_D_CAPABILITY_NONCONT_CLOCK_HBLANK BIT(5)
++#define CCS_R_MIN_OP_SYS_CLK_DIV_REV 0x1234
++#define CCS_R_MAX_OP_SYS_CLK_DIV_REV 0x1236
++#define CCS_R_MIN_OP_PIX_CLK_DIV_REV 0x1238
++#define CCS_R_MAX_OP_PIX_CLK_DIV_REV 0x123a
++#define CCS_R_MIN_OP_SYS_CLK_FREQ_REV_MHZ (0x123c | (CCS_FL_32BIT | CCS_FL_FLOAT_IREAL))
++#define CCS_R_MAX_OP_SYS_CLK_FREQ_REV_MHZ (0x1240 | (CCS_FL_32BIT | CCS_FL_FLOAT_IREAL))
++#define CCS_R_MIN_OP_PIX_CLK_FREQ_REV_MHZ (0x1244 | (CCS_FL_32BIT | CCS_FL_FLOAT_IREAL))
++#define CCS_R_MAX_OP_PIX_CLK_FREQ_REV_MHZ (0x1248 | (CCS_FL_32BIT | CCS_FL_FLOAT_IREAL))
++#define CCS_R_MAX_BITRATE_REV_D_MODE_MBPS (0x124c | (CCS_FL_32BIT | CCS_FL_IREAL))
++#define CCS_R_MAX_SYMRATE_REV_C_MODE_MSPS (0x1250 | (CCS_FL_32BIT | CCS_FL_IREAL))
++#define CCS_R_COMPRESSION_CAPABILITY 0x1300
++#define CCS_COMPRESSION_CAPABILITY_DPCM_PCM_SIMPLE BIT(0)
++#define CCS_R_TEST_MODE_CAPABILITY (0x1310 | CCS_FL_16BIT)
++#define CCS_TEST_MODE_CAPABILITY_SOLID_COLOR BIT(0)
++#define CCS_TEST_MODE_CAPABILITY_COLOR_BARS BIT(1)
++#define CCS_TEST_MODE_CAPABILITY_FADE_TO_GREY BIT(2)
++#define CCS_TEST_MODE_CAPABILITY_PN9 BIT(3)
++#define CCS_TEST_MODE_CAPABILITY_COLOR_TILE BIT(5)
++#define CCS_R_PN9_DATA_FORMAT1 0x1312
++#define CCS_R_PN9_DATA_FORMAT2 0x1313
++#define CCS_R_PN9_DATA_FORMAT3 0x1314
++#define CCS_R_PN9_DATA_FORMAT4 0x1315
++#define CCS_R_PN9_MISC_CAPABILITY 0x1316
++#define CCS_PN9_MISC_CAPABILITY_NUM_PIXELS_SHIFT 0U
++#define CCS_PN9_MISC_CAPABILITY_NUM_PIXELS_MASK 0x7
++#define CCS_PN9_MISC_CAPABILITY_COMPRESSION BIT(3)
++#define CCS_R_TEST_PATTERN_CAPABILITY 0x1317
++#define CCS_TEST_PATTERN_CAPABILITY_NO_REPEAT BIT(1)
++#define CCS_R_PATTERN_SIZE_DIV_M1 0x1318
++#define CCS_R_FIFO_SUPPORT_CAPABILITY 0x1502
++#define CCS_FIFO_SUPPORT_CAPABILITY_NONE 0U
++#define CCS_FIFO_SUPPORT_CAPABILITY_DERATING 1U
++#define CCS_FIFO_SUPPORT_CAPABILITY_DERATING_OVERRATING 2U
++#define CCS_R_PHY_CTRL_CAPABILITY 0x1600
++#define CCS_PHY_CTRL_CAPABILITY_AUTO_PHY_CTL BIT(0)
++#define CCS_PHY_CTRL_CAPABILITY_UI_PHY_CTL BIT(1)
++#define CCS_PHY_CTRL_CAPABILITY_DPHY_TIME_UI_REG_1_CTL BIT(2)
++#define CCS_PHY_CTRL_CAPABILITY_DPHY_TIME_UI_REG_2_CTL BIT(3)
++#define CCS_PHY_CTRL_CAPABILITY_DPHY_TIME_CTL BIT(4)
++#define CCS_PHY_CTRL_CAPABILITY_DPHY_EXT_TIME_UI_REG_1_CTL BIT(5)
++#define CCS_PHY_CTRL_CAPABILITY_DPHY_EXT_TIME_UI_REG_2_CTL BIT(6)
++#define CCS_PHY_CTRL_CAPABILITY_DPHY_EXT_TIME_CTL BIT(7)
++#define CCS_R_CSI_DPHY_LANE_MODE_CAPABILITY 0x1601
++#define CCS_CSI_DPHY_LANE_MODE_CAPABILITY_1_LANE BIT(0)
++#define CCS_CSI_DPHY_LANE_MODE_CAPABILITY_2_LANE BIT(1)
++#define CCS_CSI_DPHY_LANE_MODE_CAPABILITY_3_LANE BIT(2)
++#define CCS_CSI_DPHY_LANE_MODE_CAPABILITY_4_LANE BIT(3)
++#define CCS_CSI_DPHY_LANE_MODE_CAPABILITY_5_LANE BIT(4)
++#define CCS_CSI_DPHY_LANE_MODE_CAPABILITY_6_LANE BIT(5)
++#define CCS_CSI_DPHY_LANE_MODE_CAPABILITY_7_LANE BIT(6)
++#define CCS_CSI_DPHY_LANE_MODE_CAPABILITY_8_LANE BIT(7)
++#define CCS_R_CSI_SIGNALING_MODE_CAPABILITY 0x1602
++#define CCS_CSI_SIGNALING_MODE_CAPABILITY_CSI_DPHY BIT(2)
++#define CCS_CSI_SIGNALING_MODE_CAPABILITY_CSI_CPHY BIT(3)
++#define CCS_R_FAST_STANDBY_CAPABILITY 0x1603
++#define CCS_FAST_STANDBY_CAPABILITY_NO_FRAME_TRUNCATION 0U
++#define CCS_FAST_STANDBY_CAPABILITY_FRAME_TRUNCATION 1U
++#define CCS_R_CSI_ADDRESS_CONTROL_CAPABILITY 0x1604
++#define CCS_CSI_ADDRESS_CONTROL_CAPABILITY_CCI_ADDR_CHANGE BIT(0)
++#define CCS_CSI_ADDRESS_CONTROL_CAPABILITY_2ND_CCI_ADDR BIT(1)
++#define CCS_CSI_ADDRESS_CONTROL_CAPABILITY_SW_CHANGEABLE_2ND_CCI_ADDR BIT(2)
++#define CCS_R_DATA_TYPE_CAPABILITY 0x1605
++#define CCS_DATA_TYPE_CAPABILITY_DPCM_PROGRAMMABLE BIT(0)
++#define CCS_DATA_TYPE_CAPABILITY_BOTTOM_EMBEDDED_DT_PROGRAMMABLE BIT(1)
++#define CCS_DATA_TYPE_CAPABILITY_BOTTOM_EMBEDDED_VC_PROGRAMMABLE BIT(2)
++#define CCS_DATA_TYPE_CAPABILITY_EXT_VC_RANGE BIT(3)
++#define CCS_R_CSI_CPHY_LANE_MODE_CAPABILITY 0x1606
++#define CCS_CSI_CPHY_LANE_MODE_CAPABILITY_1_LANE BIT(0)
++#define CCS_CSI_CPHY_LANE_MODE_CAPABILITY_2_LANE BIT(1)
++#define CCS_CSI_CPHY_LANE_MODE_CAPABILITY_3_LANE BIT(2)
++#define CCS_CSI_CPHY_LANE_MODE_CAPABILITY_4_LANE BIT(3)
++#define CCS_CSI_CPHY_LANE_MODE_CAPABILITY_5_LANE BIT(4)
++#define CCS_CSI_CPHY_LANE_MODE_CAPABILITY_6_LANE BIT(5)
++#define CCS_CSI_CPHY_LANE_MODE_CAPABILITY_7_LANE BIT(6)
++#define CCS_CSI_CPHY_LANE_MODE_CAPABILITY_8_LANE BIT(7)
++#define CCS_R_EMB_DATA_CAPABILITY 0x1607
++#define CCS_EMB_DATA_CAPABILITY_TWO_BYTES_PER_RAW16 BIT(0)
++#define CCS_EMB_DATA_CAPABILITY_TWO_BYTES_PER_RAW20 BIT(1)
++#define CCS_EMB_DATA_CAPABILITY_TWO_BYTES_PER_RAW24 BIT(2)
++#define CCS_EMB_DATA_CAPABILITY_NO_ONE_BYTE_PER_RAW16 BIT(3)
++#define CCS_EMB_DATA_CAPABILITY_NO_ONE_BYTE_PER_RAW20 BIT(4)
++#define CCS_EMB_DATA_CAPABILITY_NO_ONE_BYTE_PER_RAW24 BIT(5)
++#define CCS_R_MAX_PER_LANE_BITRATE_LANE_D_MODE_MBPS(n) ((0x1608 | (CCS_FL_32BIT | CCS_FL_IREAL)) + ((n) < 4 ? (n) * 4 : 0x32 + ((n) - 4) * 4))
++#define CCS_LIM_MAX_PER_LANE_BITRATE_LANE_D_MODE_MBPS_MIN_N 0U
++#define CCS_LIM_MAX_PER_LANE_BITRATE_LANE_D_MODE_MBPS_MAX_N 7U
++#define CCS_R_TEMP_SENSOR_CAPABILITY 0x1618
++#define CCS_TEMP_SENSOR_CAPABILITY_SUPPORTED BIT(0)
++#define CCS_TEMP_SENSOR_CAPABILITY_CCS_FORMAT BIT(1)
++#define CCS_TEMP_SENSOR_CAPABILITY_RESET_0X80 BIT(2)
++#define CCS_R_MAX_PER_LANE_BITRATE_LANE_C_MODE_MBPS(n) ((0x161a | (CCS_FL_32BIT | CCS_FL_IREAL)) + ((n) < 4 ? (n) * 4 : 0x30 + ((n) - 4) * 4))
++#define CCS_LIM_MAX_PER_LANE_BITRATE_LANE_C_MODE_MBPS_MIN_N 0U
++#define CCS_LIM_MAX_PER_LANE_BITRATE_LANE_C_MODE_MBPS_MAX_N 7U
++#define CCS_R_DPHY_EQUALIZATION_CAPABILITY 0x162b
++#define CCS_DPHY_EQUALIZATION_CAPABILITY_EQUALIZATION_CTRL BIT(0)
++#define CCS_DPHY_EQUALIZATION_CAPABILITY_EQ1 BIT(1)
++#define CCS_DPHY_EQUALIZATION_CAPABILITY_EQ2 BIT(2)
++#define CCS_R_CPHY_EQUALIZATION_CAPABILITY 0x162c
++#define CCS_CPHY_EQUALIZATION_CAPABILITY_EQUALIZATION_CTRL BIT(0)
++#define CCS_R_DPHY_PREAMBLE_CAPABILITY 0x162d
++#define CCS_DPHY_PREAMBLE_CAPABILITY_PREAMBLE_SEQ_CTRL BIT(0)
++#define CCS_R_DPHY_SSC_CAPABILITY 0x162e
++#define CCS_DPHY_SSC_CAPABILITY_SUPPORTED BIT(0)
++#define CCS_R_CPHY_CALIBRATION_CAPABILITY 0x162f
++#define CCS_CPHY_CALIBRATION_CAPABILITY_MANUAL BIT(0)
++#define CCS_CPHY_CALIBRATION_CAPABILITY_MANUAL_STREAMING BIT(1)
++#define CCS_CPHY_CALIBRATION_CAPABILITY_FORMAT_1_CTRL BIT(2)
++#define CCS_CPHY_CALIBRATION_CAPABILITY_FORMAT_2_CTRL BIT(3)
++#define CCS_CPHY_CALIBRATION_CAPABILITY_FORMAT_3_CTRL BIT(4)
++#define CCS_R_DPHY_CALIBRATION_CAPABILITY 0x1630
++#define CCS_DPHY_CALIBRATION_CAPABILITY_MANUAL BIT(0)
++#define CCS_DPHY_CALIBRATION_CAPABILITY_MANUAL_STREAMING BIT(1)
++#define CCS_DPHY_CALIBRATION_CAPABILITY_ALTERNATE_SEQ BIT(2)
++#define CCS_R_PHY_CTRL_CAPABILITY_2 0x1631
++#define CCS_PHY_CTRL_CAPABILITY_2_TGR_LENGTH BIT(0)
++#define CCS_PHY_CTRL_CAPABILITY_2_TGR_PREAMBLE_PROG_SEQ BIT(1)
++#define CCS_PHY_CTRL_CAPABILITY_2_EXTRA_CPHY_MANUAL_TIMING BIT(2)
++#define CCS_PHY_CTRL_CAPABILITY_2_CLOCK_BASED_MANUAL_CDPHY BIT(3)
++#define CCS_PHY_CTRL_CAPABILITY_2_CLOCK_BASED_MANUAL_DPHY BIT(4)
++#define CCS_PHY_CTRL_CAPABILITY_2_CLOCK_BASED_MANUAL_CPHY BIT(5)
++#define CCS_PHY_CTRL_CAPABILITY_2_MANUAL_LP_DPHY BIT(6)
++#define CCS_PHY_CTRL_CAPABILITY_2_MANUAL_LP_CPHY BIT(7)
++#define CCS_R_LRTE_CPHY_CAPABILITY 0x1632
++#define CCS_LRTE_CPHY_CAPABILITY_PDQ_SHORT BIT(0)
++#define CCS_LRTE_CPHY_CAPABILITY_SPACER_SHORT BIT(1)
++#define CCS_LRTE_CPHY_CAPABILITY_PDQ_LONG BIT(2)
++#define CCS_LRTE_CPHY_CAPABILITY_SPACER_LONG BIT(3)
++#define CCS_LRTE_CPHY_CAPABILITY_SPACER_NO_PDQ BIT(4)
++#define CCS_R_LRTE_DPHY_CAPABILITY 0x1633
++#define CCS_LRTE_DPHY_CAPABILITY_PDQ_SHORT_OPT1 BIT(0)
++#define CCS_LRTE_DPHY_CAPABILITY_SPACER_SHORT_OPT1 BIT(1)
++#define CCS_LRTE_DPHY_CAPABILITY_PDQ_LONG_OPT1 BIT(2)
++#define CCS_LRTE_DPHY_CAPABILITY_SPACER_LONG_OPT1 BIT(3)
++#define CCS_LRTE_DPHY_CAPABILITY_SPACER_SHORT_OPT2 BIT(4)
++#define CCS_LRTE_DPHY_CAPABILITY_SPACER_LONG_OPT2 BIT(5)
++#define CCS_LRTE_DPHY_CAPABILITY_SPACER_NO_PDQ_OPT1 BIT(6)
++#define CCS_LRTE_DPHY_CAPABILITY_SPACER_VARIABLE_OPT2 BIT(7)
++#define CCS_R_ALPS_CAPABILITY_DPHY 0x1634
++#define CCS_ALPS_CAPABILITY_DPHY_LVLP_NOT_SUPPORTED 0U
++#define CCS_ALPS_CAPABILITY_DPHY_LVLP_SUPPORTED 1U
++#define CCS_ALPS_CAPABILITY_DPHY_CONTROLLABLE_LVLP 2U
++#define CCS_R_ALPS_CAPABILITY_CPHY 0x1635
++#define CCS_ALPS_CAPABILITY_CPHY_LVLP_NOT_SUPPORTED 0U
++#define CCS_ALPS_CAPABILITY_CPHY_LVLP_SUPPORTED 1U
++#define CCS_ALPS_CAPABILITY_CPHY_CONTROLLABLE_LVLP 2U
++#define CCS_ALPS_CAPABILITY_CPHY_ALP_NOT_SUPPORTED 0xc
++#define CCS_ALPS_CAPABILITY_CPHY_ALP_SUPPORTED 0xd
++#define CCS_ALPS_CAPABILITY_CPHY_CONTROLLABLE_ALP 0xe
++#define CCS_R_SCRAMBLING_CAPABILITY 0x1636
++#define CCS_SCRAMBLING_CAPABILITY_SCRAMBLING_SUPPORTED BIT(0)
++#define CCS_SCRAMBLING_CAPABILITY_MAX_SEEDS_PER_LANE_C_SHIFT 1U
++#define CCS_SCRAMBLING_CAPABILITY_MAX_SEEDS_PER_LANE_C_MASK 0x6
++#define CCS_SCRAMBLING_CAPABILITY_MAX_SEEDS_PER_LANE_C_1 0U
++#define CCS_SCRAMBLING_CAPABILITY_MAX_SEEDS_PER_LANE_C_4 3U
++#define CCS_SCRAMBLING_CAPABILITY_NUM_SEED_REGS_SHIFT 3U
++#define CCS_SCRAMBLING_CAPABILITY_NUM_SEED_REGS_MASK 0x38
++#define CCS_SCRAMBLING_CAPABILITY_NUM_SEED_REGS_0 0U
++#define CCS_SCRAMBLING_CAPABILITY_NUM_SEED_REGS_1 1U
++#define CCS_SCRAMBLING_CAPABILITY_NUM_SEED_REGS_4 4U
++#define CCS_SCRAMBLING_CAPABILITY_NUM_SEED_PER_LANE BIT(6)
++#define CCS_R_DPHY_MANUAL_CONSTANT 0x1637
++#define CCS_R_CPHY_MANUAL_CONSTANT 0x1638
++#define CCS_R_CSI2_INTERFACE_CAPABILITY_MISC 0x1639
++#define CCS_CSI2_INTERFACE_CAPABILITY_MISC_EOTP_SHORT_PKT_OPT2 BIT(0)
++#define CCS_R_PHY_CTRL_CAPABILITY_3 0x165c
++#define CCS_PHY_CTRL_CAPABILITY_3_DPHY_TIMING_NOT_MULTIPLE BIT(0)
++#define CCS_PHY_CTRL_CAPABILITY_3_DPHY_MIN_TIMING_VALUE_1 BIT(1)
++#define CCS_PHY_CTRL_CAPABILITY_3_TWAKEUP_SUPPORTED BIT(2)
++#define CCS_PHY_CTRL_CAPABILITY_3_TINIT_SUPPORTED BIT(3)
++#define CCS_PHY_CTRL_CAPABILITY_3_THS_EXIT_SUPPORTED BIT(4)
++#define CCS_PHY_CTRL_CAPABILITY_3_CPHY_TIMING_NOT_MULTIPLE BIT(5)
++#define CCS_PHY_CTRL_CAPABILITY_3_CPHY_MIN_TIMING_VALUE_1 BIT(6)
++#define CCS_R_DPHY_SF 0x165d
++#define CCS_R_CPHY_SF 0x165e
++#define CCS_CPHY_SF_TWAKEUP_SHIFT 0U
++#define CCS_CPHY_SF_TWAKEUP_MASK 0xf
++#define CCS_CPHY_SF_TINIT_SHIFT 4U
++#define CCS_CPHY_SF_TINIT_MASK 0xf0
++#define CCS_R_DPHY_LIMITS_1 0x165f
++#define CCS_DPHY_LIMITS_1_THS_PREPARE_SHIFT 0U
++#define CCS_DPHY_LIMITS_1_THS_PREPARE_MASK 0xf
++#define CCS_DPHY_LIMITS_1_THS_ZERO_SHIFT 4U
++#define CCS_DPHY_LIMITS_1_THS_ZERO_MASK 0xf0
++#define CCS_R_DPHY_LIMITS_2 0x1660
++#define CCS_DPHY_LIMITS_2_THS_TRAIL_SHIFT 0U
++#define CCS_DPHY_LIMITS_2_THS_TRAIL_MASK 0xf
++#define CCS_DPHY_LIMITS_2_TCLK_TRAIL_MIN_SHIFT 4U
++#define CCS_DPHY_LIMITS_2_TCLK_TRAIL_MIN_MASK 0xf0
++#define CCS_R_DPHY_LIMITS_3 0x1661
++#define CCS_DPHY_LIMITS_3_TCLK_PREPARE_SHIFT 0U
++#define CCS_DPHY_LIMITS_3_TCLK_PREPARE_MASK 0xf
++#define CCS_DPHY_LIMITS_3_TCLK_ZERO_SHIFT 4U
++#define CCS_DPHY_LIMITS_3_TCLK_ZERO_MASK 0xf0
++#define CCS_R_DPHY_LIMITS_4 0x1662
++#define CCS_DPHY_LIMITS_4_TCLK_POST_SHIFT 0U
++#define CCS_DPHY_LIMITS_4_TCLK_POST_MASK 0xf
++#define CCS_DPHY_LIMITS_4_TLPX_SHIFT 4U
++#define CCS_DPHY_LIMITS_4_TLPX_MASK 0xf0
++#define CCS_R_DPHY_LIMITS_5 0x1663
++#define CCS_DPHY_LIMITS_5_THS_EXIT_SHIFT 0U
++#define CCS_DPHY_LIMITS_5_THS_EXIT_MASK 0xf
++#define CCS_DPHY_LIMITS_5_TWAKEUP_SHIFT 4U
++#define CCS_DPHY_LIMITS_5_TWAKEUP_MASK 0xf0
++#define CCS_R_DPHY_LIMITS_6 0x1664
++#define CCS_DPHY_LIMITS_6_TINIT_SHIFT 0U
++#define CCS_DPHY_LIMITS_6_TINIT_MASK 0xf
++#define CCS_R_CPHY_LIMITS_1 0x1665
++#define CCS_CPHY_LIMITS_1_T3_PREPARE_MAX_SHIFT 0U
++#define CCS_CPHY_LIMITS_1_T3_PREPARE_MAX_MASK 0xf
++#define CCS_CPHY_LIMITS_1_T3_LPX_MAX_SHIFT 4U
++#define CCS_CPHY_LIMITS_1_T3_LPX_MAX_MASK 0xf0
++#define CCS_R_CPHY_LIMITS_2 0x1666
++#define CCS_CPHY_LIMITS_2_THS_EXIT_MAX_SHIFT 0U
++#define CCS_CPHY_LIMITS_2_THS_EXIT_MAX_MASK 0xf
++#define CCS_CPHY_LIMITS_2_TWAKEUP_MAX_SHIFT 4U
++#define CCS_CPHY_LIMITS_2_TWAKEUP_MAX_MASK 0xf0
++#define CCS_R_CPHY_LIMITS_3 0x1667
++#define CCS_CPHY_LIMITS_3_TINIT_MAX_SHIFT 0U
++#define CCS_CPHY_LIMITS_3_TINIT_MAX_MASK 0xf
++#define CCS_R_MIN_FRAME_LENGTH_LINES_BIN (0x1700 | CCS_FL_16BIT)
++#define CCS_R_MAX_FRAME_LENGTH_LINES_BIN (0x1702 | CCS_FL_16BIT)
++#define CCS_R_MIN_LINE_LENGTH_PCK_BIN (0x1704 | CCS_FL_16BIT)
++#define CCS_R_MAX_LINE_LENGTH_PCK_BIN (0x1706 | CCS_FL_16BIT)
++#define CCS_R_MIN_LINE_BLANKING_PCK_BIN (0x1708 | CCS_FL_16BIT)
++#define CCS_R_FINE_INTEGRATION_TIME_MIN_BIN (0x170a | CCS_FL_16BIT)
++#define CCS_R_FINE_INTEGRATION_TIME_MAX_MARGIN_BIN (0x170c | CCS_FL_16BIT)
++#define CCS_R_BINNING_CAPABILITY 0x1710
++#define CCS_BINNING_CAPABILITY_UNSUPPORTED 0U
++#define CCS_BINNING_CAPABILITY_BINNING_THEN_SUBSAMPLING 1U
++#define CCS_BINNING_CAPABILITY_SUBSAMPLING_THEN_BINNING 2U
++#define CCS_R_BINNING_WEIGHTING_CAPABILITY 0x1711
++#define CCS_BINNING_WEIGHTING_CAPABILITY_AVERAGED BIT(0)
++#define CCS_BINNING_WEIGHTING_CAPABILITY_SUMMED BIT(1)
++#define CCS_BINNING_WEIGHTING_CAPABILITY_BAYER_CORRECTED BIT(2)
++#define CCS_BINNING_WEIGHTING_CAPABILITY_MODULE_SPECIFIC_WEIGHT BIT(3)
++#define CCS_R_BINNING_SUB_TYPES 0x1712
++#define CCS_R_BINNING_SUB_TYPE(n) (0x1713 + (n))
++#define CCS_LIM_BINNING_SUB_TYPE_MIN_N 0U
++#define CCS_LIM_BINNING_SUB_TYPE_MAX_N 63U
++#define CCS_BINNING_SUB_TYPE_ROW_SHIFT 0U
++#define CCS_BINNING_SUB_TYPE_ROW_MASK 0xf
++#define CCS_BINNING_SUB_TYPE_COLUMN_SHIFT 4U
++#define CCS_BINNING_SUB_TYPE_COLUMN_MASK 0xf0
++#define CCS_R_BINNING_WEIGHTING_MONO_CAPABILITY 0x1771
++#define CCS_BINNING_WEIGHTING_MONO_CAPABILITY_AVERAGED BIT(0)
++#define CCS_BINNING_WEIGHTING_MONO_CAPABILITY_SUMMED BIT(1)
++#define CCS_BINNING_WEIGHTING_MONO_CAPABILITY_BAYER_CORRECTED BIT(2)
++#define CCS_BINNING_WEIGHTING_MONO_CAPABILITY_MODULE_SPECIFIC_WEIGHT BIT(3)
++#define CCS_R_BINNING_SUB_TYPES_MONO 0x1772
++#define CCS_R_BINNING_SUB_TYPE_MONO(n) (0x1773 + (n))
++#define CCS_LIM_BINNING_SUB_TYPE_MONO_MIN_N 0U
++#define CCS_LIM_BINNING_SUB_TYPE_MONO_MAX_N 63U
++#define CCS_R_DATA_TRANSFER_IF_CAPABILITY 0x1800
++#define CCS_DATA_TRANSFER_IF_CAPABILITY_SUPPORTED BIT(0)
++#define CCS_DATA_TRANSFER_IF_CAPABILITY_POLLING BIT(2)
++#define CCS_R_SHADING_CORRECTION_CAPABILITY 0x1900
++#define CCS_SHADING_CORRECTION_CAPABILITY_COLOR_SHADING BIT(0)
++#define CCS_SHADING_CORRECTION_CAPABILITY_LUMINANCE_CORRECTION BIT(1)
++#define CCS_R_GREEN_IMBALANCE_CAPABILITY 0x1901
++#define CCS_GREEN_IMBALANCE_CAPABILITY_SUPPORTED BIT(0)
++#define CCS_R_MODULE_SPECIFIC_CORRECTION_CAPABILITY 0x1903
++#define CCS_R_DEFECT_CORRECTION_CAPABILITY (0x1904 | CCS_FL_16BIT)
++#define CCS_DEFECT_CORRECTION_CAPABILITY_MAPPED_DEFECT BIT(0)
++#define CCS_DEFECT_CORRECTION_CAPABILITY_DYNAMIC_COUPLET BIT(2)
++#define CCS_DEFECT_CORRECTION_CAPABILITY_DYNAMIC_SINGLE BIT(5)
++#define CCS_DEFECT_CORRECTION_CAPABILITY_COMBINED_DYNAMIC BIT(8)
++#define CCS_R_DEFECT_CORRECTION_CAPABILITY_2 (0x1906 | CCS_FL_16BIT)
++#define CCS_DEFECT_CORRECTION_CAPABILITY_2_DYNAMIC_TRIPLET BIT(3)
++#define CCS_R_NF_CAPABILITY 0x1908
++#define CCS_NF_CAPABILITY_LUMA BIT(0)
++#define CCS_NF_CAPABILITY_CHROMA BIT(1)
++#define CCS_NF_CAPABILITY_COMBINED BIT(2)
++#define CCS_R_OB_READOUT_CAPABILITY 0x1980
++#define CCS_OB_READOUT_CAPABILITY_CONTROLLABLE_READOUT BIT(0)
++#define CCS_OB_READOUT_CAPABILITY_VISIBLE_PIXEL_READOUT BIT(1)
++#define CCS_OB_READOUT_CAPABILITY_DIFFERENT_VC_READOUT BIT(2)
++#define CCS_OB_READOUT_CAPABILITY_DIFFERENT_DT_READOUT BIT(3)
++#define CCS_OB_READOUT_CAPABILITY_PROG_DATA_FORMAT BIT(4)
++#define CCS_R_COLOR_FEEDBACK_CAPABILITY 0x1987
++#define CCS_COLOR_FEEDBACK_CAPABILITY_KELVIN BIT(0)
++#define CCS_COLOR_FEEDBACK_CAPABILITY_AWB_GAIN BIT(1)
++#define CCS_R_CFA_PATTERN_CAPABILITY 0x1990
++#define CCS_CFA_PATTERN_CAPABILITY_BAYER 0U
++#define CCS_CFA_PATTERN_CAPABILITY_MONOCHROME 1U
++#define CCS_CFA_PATTERN_CAPABILITY_4X4_QUAD_BAYER 2U
++#define CCS_CFA_PATTERN_CAPABILITY_VENDOR_SPECIFIC 3U
++#define CCS_R_CFA_PATTERN_CONVERSION_CAPABILITY 0x1991
++#define CCS_CFA_PATTERN_CONVERSION_CAPABILITY_BAYER BIT(0)
++#define CCS_R_FLASH_MODE_CAPABILITY 0x1a02
++#define CCS_FLASH_MODE_CAPABILITY_SINGLE_STROBE BIT(0)
++#define CCS_R_SA_STROBE_MODE_CAPABILITY 0x1a03
++#define CCS_SA_STROBE_MODE_CAPABILITY_FIXED_WIDTH BIT(0)
++#define CCS_SA_STROBE_MODE_CAPABILITY_EDGE_CTRL BIT(1)
++#define CCS_R_RESET_MAX_DELAY 0x1a10
++#define CCS_R_RESET_MIN_TIME 0x1a11
++#define CCS_R_PDAF_CAPABILITY_1 0x1b80
++#define CCS_PDAF_CAPABILITY_1_SUPPORTED BIT(0)
++#define CCS_PDAF_CAPABILITY_1_PROCESSED_BOTTOM_EMBEDDED BIT(1)
++#define CCS_PDAF_CAPABILITY_1_PROCESSED_INTERLEAVED BIT(2)
++#define CCS_PDAF_CAPABILITY_1_RAW_BOTTOM_EMBEDDED BIT(3)
++#define CCS_PDAF_CAPABILITY_1_RAW_INTERLEAVED BIT(4)
++#define CCS_PDAF_CAPABILITY_1_VISIBLE_PDAF_CORRECTION BIT(5)
++#define CCS_PDAF_CAPABILITY_1_VC_INTERLEAVING BIT(6)
++#define CCS_PDAF_CAPABILITY_1_DT_INTERLEAVING BIT(7)
++#define CCS_R_PDAF_CAPABILITY_2 0x1b81
++#define CCS_PDAF_CAPABILITY_2_ROI BIT(0)
++#define CCS_PDAF_CAPABILITY_2_AFTER_DIGITAL_CROP BIT(1)
++#define CCS_PDAF_CAPABILITY_2_CTRL_RETIMED BIT(2)
++#define CCS_R_BRACKETING_LUT_CAPABILITY_1 0x1c00
++#define CCS_BRACKETING_LUT_CAPABILITY_1_COARSE_INTEGRATION BIT(0)
++#define CCS_BRACKETING_LUT_CAPABILITY_1_GLOBAL_ANALOG_GAIN BIT(1)
++#define CCS_BRACKETING_LUT_CAPABILITY_1_FLASH BIT(4)
++#define CCS_BRACKETING_LUT_CAPABILITY_1_GLOBAL_DIGITAL_GAIN BIT(5)
++#define CCS_BRACKETING_LUT_CAPABILITY_1_ALTERNATE_GLOBAL_ANALOG_GAIN BIT(6)
++#define CCS_R_BRACKETING_LUT_CAPABILITY_2 0x1c01
++#define CCS_BRACKETING_LUT_CAPABILITY_2_SINGLE_BRACKETING_MODE BIT(0)
++#define CCS_BRACKETING_LUT_CAPABILITY_2_LOOPED_BRACKETING_MODE BIT(1)
++#define CCS_R_BRACKETING_LUT_SIZE 0x1c02
++
++#endif /* __CCS_REGS_H__ */
+--
+2.42.0
+
--- /dev/null
+From 27daa653924573d9d8f6a7d67418e93fdb1cc47d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Feb 2020 15:06:12 +0100
+Subject: media: smiapp: Read CCS limit values
+
+From: Sakari Ailus <sakari.ailus@linux.intel.com>
+
+[ Upstream commit ca296a11156a00cc2336ba5fbcbcf2c6c41755c5 ]
+
+Read limit and capability values into a driver allocated buffer. This will
+later replace (most of) the existing SMIA limits.
+
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Stable-dep-of: 724ff68e968b ("media: ccs: Correctly initialise try compose rectangle")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/smiapp/smiapp-core.c | 177 ++++++++++++++++++++++++-
+ drivers/media/i2c/smiapp/smiapp.h | 4 +
+ 2 files changed, 176 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/media/i2c/smiapp/smiapp-core.c b/drivers/media/i2c/smiapp/smiapp-core.c
+index bc9c80221d2fb..4b33b9a1d52cd 100644
+--- a/drivers/media/i2c/smiapp/smiapp-core.c
++++ b/drivers/media/i2c/smiapp/smiapp-core.c
+@@ -28,6 +28,7 @@
+ #include <media/v4l2-device.h>
+
+ #include "ccs-limits.h"
++#include "ccs-regs.h"
+ #include "smiapp.h"
+
+ #define SMIAPP_ALIGN_DIM(dim, flags) \
+@@ -102,6 +103,164 @@ static int smiapp_read_all_smia_limits(struct smiapp_sensor *sensor)
+ return 0;
+ }
+
++static void ccs_assign_limit(void *ptr, unsigned int width, u32 val)
++{
++ switch (width) {
++ case sizeof(u8):
++ *(u8 *)ptr = val;
++ break;
++ case sizeof(u16):
++ *(u16 *)ptr = val;
++ break;
++ case sizeof(u32):
++ *(u32 *)ptr = val;
++ break;
++ }
++}
++
++static int ccs_limit_ptr(struct smiapp_sensor *sensor, unsigned int limit,
++ unsigned int offset, void **__ptr)
++{
++ const struct ccs_limit *linfo;
++
++ if (WARN_ON(limit >= CCS_L_LAST))
++ return -EINVAL;
++
++ linfo = &ccs_limits[ccs_limit_offsets[limit].info];
++
++ if (WARN_ON(!sensor->ccs_limits) ||
++ WARN_ON(offset + ccs_reg_width(linfo->reg) >
++ ccs_limit_offsets[limit + 1].lim))
++ return -EINVAL;
++
++ *__ptr = sensor->ccs_limits + ccs_limit_offsets[limit].lim + offset;
++
++ return 0;
++}
++
++void ccs_replace_limit(struct smiapp_sensor *sensor,
++ unsigned int limit, unsigned int offset, u32 val)
++{
++ struct i2c_client *client = v4l2_get_subdevdata(&sensor->src->sd);
++ const struct ccs_limit *linfo;
++ void *ptr;
++ int ret;
++
++ ret = ccs_limit_ptr(sensor, limit, offset, &ptr);
++ if (ret)
++ return;
++
++ linfo = &ccs_limits[ccs_limit_offsets[limit].info];
++
++ dev_dbg(&client->dev, "quirk: 0x%8.8x \"%s\" %u = %d, 0x%x\n",
++ linfo->reg, linfo->name, offset, val, val);
++
++ ccs_assign_limit(ptr, ccs_reg_width(linfo->reg), val);
++}
++
++static u32 ccs_get_limit(struct smiapp_sensor *sensor,
++ unsigned int limit, unsigned int offset)
++{
++ void *ptr;
++ int ret;
++
++ ret = ccs_limit_ptr(sensor, limit, offset, &ptr);
++ if (ret)
++ return 0;
++
++ switch (ccs_reg_width(ccs_limits[ccs_limit_offsets[limit].info].reg)) {
++ case sizeof(u8):
++ return *(u8 *)ptr;
++ case sizeof(u16):
++ return *(u16 *)ptr;
++ case sizeof(u32):
++ return *(u32 *)ptr;
++ }
++
++ WARN_ON(1);
++
++ return 0;
++}
++
++#define CCS_LIM(sensor, limit) \
++ ccs_get_limit(sensor, CCS_L_##limit, 0)
++
++#define CCS_LIM_AT(sensor, limit, offset) \
++ ccs_get_limit(sensor, CCS_L_##limit, CCS_L_##limit##_OFFSET(offset))
++
++static int ccs_read_all_limits(struct smiapp_sensor *sensor)
++{
++ struct i2c_client *client = v4l2_get_subdevdata(&sensor->src->sd);
++ void *ptr, *alloc, *end;
++ unsigned int i, l;
++ int ret;
++
++ kfree(sensor->ccs_limits);
++ sensor->ccs_limits = NULL;
++
++ alloc = kzalloc(ccs_limit_offsets[CCS_L_LAST].lim, GFP_KERNEL);
++ if (!alloc)
++ return -ENOMEM;
++
++ end = alloc + ccs_limit_offsets[CCS_L_LAST].lim;
++
++ for (i = 0, l = 0, ptr = alloc; ccs_limits[i].size; i++) {
++ u32 reg = ccs_limits[i].reg;
++ unsigned int width = ccs_reg_width(reg);
++ unsigned int j;
++
++ if (l == CCS_L_LAST) {
++ dev_err(&client->dev,
++ "internal error --- end of limit array\n");
++ ret = -EINVAL;
++ goto out_err;
++ }
++
++ for (j = 0; j < ccs_limits[i].size / width;
++ j++, reg += width, ptr += width) {
++ u32 val;
++
++ ret = smiapp_read(sensor, reg, &val);
++ if (ret)
++ goto out_err;
++
++ if (ptr + width > end) {
++ dev_err(&client->dev,
++ "internal error --- no room for regs\n");
++ ret = -EINVAL;
++ goto out_err;
++ }
++
++ ccs_assign_limit(ptr, width, val);
++
++ dev_dbg(&client->dev, "0x%8.8x \"%s\" = %u, 0x%x\n",
++ reg, ccs_limits[i].name, val, val);
++ }
++
++ if (ccs_limits[i].flags & CCS_L_FL_SAME_REG)
++ continue;
++
++ l++;
++ ptr = alloc + ccs_limit_offsets[l].lim;
++ }
++
++ if (l != CCS_L_LAST) {
++ dev_err(&client->dev,
++ "internal error --- insufficient limits\n");
++ ret = -EINVAL;
++ goto out_err;
++ }
++
++ sensor->ccs_limits = alloc;
++
++ return 0;
++
++out_err:
++ kfree(alloc);
++
++ return ret;
++}
++
+ static int smiapp_read_frame_fmt(struct smiapp_sensor *sensor)
+ {
+ struct i2c_client *client = v4l2_get_subdevdata(&sensor->src->sd);
+@@ -2970,10 +3129,14 @@ static int smiapp_probe(struct i2c_client *client)
+ goto out_power_off;
+ }
+
++ rval = ccs_read_all_limits(sensor);
++ if (rval)
++ goto out_power_off;
++
+ rval = smiapp_read_frame_fmt(sensor);
+ if (rval) {
+ rval = -ENODEV;
+- goto out_power_off;
++ goto out_free_ccs_limits;
+ }
+
+ /*
+@@ -2997,7 +3160,7 @@ static int smiapp_probe(struct i2c_client *client)
+ rval = smiapp_call_quirk(sensor, limits);
+ if (rval) {
+ dev_err(&client->dev, "limits quirks failed\n");
+- goto out_power_off;
++ goto out_free_ccs_limits;
+ }
+
+ if (SMIA_LIM(sensor, BINNING_CAPABILITY)) {
+@@ -3007,7 +3170,7 @@ static int smiapp_probe(struct i2c_client *client)
+ SMIAPP_REG_U8_BINNING_SUBTYPES, &val);
+ if (rval < 0) {
+ rval = -ENODEV;
+- goto out_power_off;
++ goto out_free_ccs_limits;
+ }
+ sensor->nbinning_subtypes = min_t(u8, val,
+ SMIAPP_BINNING_SUBTYPES);
+@@ -3017,7 +3180,7 @@ static int smiapp_probe(struct i2c_client *client)
+ sensor, SMIAPP_REG_U8_BINNING_TYPE_n(i), &val);
+ if (rval < 0) {
+ rval = -ENODEV;
+- goto out_power_off;
++ goto out_free_ccs_limits;
+ }
+ sensor->binning_subtypes[i] =
+ *(struct smiapp_binning_subtype *)&val;
+@@ -3033,7 +3196,7 @@ static int smiapp_probe(struct i2c_client *client)
+ if (device_create_file(&client->dev, &dev_attr_ident) != 0) {
+ dev_err(&client->dev, "sysfs ident entry creation failed\n");
+ rval = -ENOENT;
+- goto out_power_off;
++ goto out_free_ccs_limits;
+ }
+
+ if (sensor->minfo.smiapp_version &&
+@@ -3150,6 +3313,9 @@ static int smiapp_probe(struct i2c_client *client)
+ out_cleanup:
+ smiapp_cleanup(sensor);
+
++out_free_ccs_limits:
++ kfree(sensor->ccs_limits);
++
+ out_power_off:
+ smiapp_power_off(&client->dev);
+ mutex_destroy(&sensor->mutex);
+@@ -3176,6 +3342,7 @@ static int smiapp_remove(struct i2c_client *client)
+ }
+ smiapp_cleanup(sensor);
+ mutex_destroy(&sensor->mutex);
++ kfree(sensor->ccs_limits);
+
+ return 0;
+ }
+diff --git a/drivers/media/i2c/smiapp/smiapp.h b/drivers/media/i2c/smiapp/smiapp.h
+index 27643b36cd92b..6a20f83c3f64a 100644
+--- a/drivers/media/i2c/smiapp/smiapp.h
++++ b/drivers/media/i2c/smiapp/smiapp.h
+@@ -228,6 +228,7 @@ struct smiapp_sensor {
+ struct clk *ext_clk;
+ struct gpio_desc *xshutdown;
+ u32 limits[SMIAPP_LIMIT_LAST];
++ void *ccs_limits;
+ u8 nbinning_subtypes;
+ struct smiapp_binning_subtype binning_subtypes[SMIAPP_BINNING_SUBTYPES];
+ u32 mbus_frame_fmts;
+@@ -281,4 +282,7 @@ struct smiapp_sensor {
+ #define to_smiapp_sensor(_sd) \
+ (to_smiapp_subdev(_sd)->sensor)
+
++void ccs_replace_limit(struct smiapp_sensor *sensor,
++ unsigned int limit, unsigned int offset, u32 val);
++
+ #endif /* __SMIAPP_PRIV_H_ */
+--
+2.42.0
+
--- /dev/null
+From 745df51e46729efd9b14407647267117f4a312f8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Feb 2020 10:09:03 +0100
+Subject: media: smiapp: Switch to CCS limits
+
+From: Sakari Ailus <sakari.ailus@linux.intel.com>
+
+[ Upstream commit 3e158e1f1ec2aca4287bc12323c7e88d4e3b4f38 ]
+
+Use the CCS limit definitions instead of the SMIA ones. This allows
+accessing CCS capabilities where needed as well as dropping the old SMIA
+limits.
+
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Stable-dep-of: 724ff68e968b ("media: ccs: Correctly initialise try compose rectangle")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/smiapp/Makefile | 2 +-
+ drivers/media/i2c/smiapp/smiapp-core.c | 255 ++++++++++-------------
+ drivers/media/i2c/smiapp/smiapp-limits.c | 118 -----------
+ drivers/media/i2c/smiapp/smiapp-limits.h | 114 ----------
+ drivers/media/i2c/smiapp/smiapp-quirk.c | 25 +--
+ drivers/media/i2c/smiapp/smiapp-quirk.h | 3 -
+ drivers/media/i2c/smiapp/smiapp.h | 10 -
+ 7 files changed, 113 insertions(+), 414 deletions(-)
+ delete mode 100644 drivers/media/i2c/smiapp/smiapp-limits.c
+ delete mode 100644 drivers/media/i2c/smiapp/smiapp-limits.h
+
+diff --git a/drivers/media/i2c/smiapp/Makefile b/drivers/media/i2c/smiapp/Makefile
+index efb643d2acace..a7bf53dd4a637 100644
+--- a/drivers/media/i2c/smiapp/Makefile
++++ b/drivers/media/i2c/smiapp/Makefile
+@@ -1,6 +1,6 @@
+ # SPDX-License-Identifier: GPL-2.0-only
+ smiapp-objs += smiapp-core.o smiapp-regs.o \
+- smiapp-quirk.o smiapp-limits.o ccs-limits.o
++ smiapp-quirk.o ccs-limits.o
+ obj-$(CONFIG_VIDEO_SMIAPP) += smiapp.o
+
+ ccflags-y += -I $(srctree)/drivers/media/i2c
+diff --git a/drivers/media/i2c/smiapp/smiapp-core.c b/drivers/media/i2c/smiapp/smiapp-core.c
+index 4b33b9a1d52cd..2c1a135079654 100644
+--- a/drivers/media/i2c/smiapp/smiapp-core.c
++++ b/drivers/media/i2c/smiapp/smiapp-core.c
+@@ -64,45 +64,6 @@ static const struct smiapp_module_ident smiapp_module_idents[] = {
+ *
+ */
+
+-static u32 smiapp_get_limit(struct smiapp_sensor *sensor,
+- unsigned int limit)
+-{
+- if (WARN_ON(limit >= SMIAPP_LIMIT_LAST))
+- return 1;
+-
+- return sensor->limits[limit];
+-}
+-
+-#define SMIA_LIM(sensor, limit) \
+- smiapp_get_limit(sensor, SMIAPP_LIMIT_##limit)
+-
+-static int smiapp_read_all_smia_limits(struct smiapp_sensor *sensor)
+-{
+- struct i2c_client *client = v4l2_get_subdevdata(&sensor->src->sd);
+- unsigned int i;
+- int rval;
+-
+- for (i = 0; i < SMIAPP_LIMIT_LAST; i++) {
+- u32 val;
+-
+- rval = smiapp_read(
+- sensor, smiapp_reg_limits[i].addr, &val);
+- if (rval)
+- return rval;
+-
+- sensor->limits[i] = val;
+-
+- dev_dbg(&client->dev, "0x%8.8x \"%s\" = %u, 0x%x\n",
+- smiapp_reg_limits[i].addr,
+- smiapp_reg_limits[i].what, val, val);
+- }
+-
+- if (SMIA_LIM(sensor, SCALER_N_MIN) == 0)
+- smiapp_replace_limit(sensor, SMIAPP_LIMIT_SCALER_N_MIN, 16);
+-
+- return 0;
+-}
+-
+ static void ccs_assign_limit(void *ptr, unsigned int width, u32 val)
+ {
+ switch (width) {
+@@ -253,6 +214,9 @@ static int ccs_read_all_limits(struct smiapp_sensor *sensor)
+
+ sensor->ccs_limits = alloc;
+
++ if (CCS_LIM(sensor, SCALER_N_MIN) < 16)
++ ccs_replace_limit(sensor, CCS_L_SCALER_N_MIN, 0, 16);
++
+ return 0;
+
+ out_err:
+@@ -444,35 +408,35 @@ static int smiapp_pll_try(struct smiapp_sensor *sensor,
+ {
+ struct i2c_client *client = v4l2_get_subdevdata(&sensor->src->sd);
+ struct smiapp_pll_limits lim = {
+- .min_pre_pll_clk_div = SMIA_LIM(sensor, MIN_PRE_PLL_CLK_DIV),
+- .max_pre_pll_clk_div = SMIA_LIM(sensor, MAX_PRE_PLL_CLK_DIV),
+- .min_pll_ip_freq_hz = SMIA_LIM(sensor, MIN_PLL_IP_FREQ_HZ),
+- .max_pll_ip_freq_hz = SMIA_LIM(sensor, MAX_PLL_IP_FREQ_HZ),
+- .min_pll_multiplier = SMIA_LIM(sensor, MIN_PLL_MULTIPLIER),
+- .max_pll_multiplier = SMIA_LIM(sensor, MAX_PLL_MULTIPLIER),
+- .min_pll_op_freq_hz = SMIA_LIM(sensor, MIN_PLL_OP_FREQ_HZ),
+- .max_pll_op_freq_hz = SMIA_LIM(sensor, MAX_PLL_OP_FREQ_HZ),
+-
+- .op.min_sys_clk_div = SMIA_LIM(sensor, MIN_OP_SYS_CLK_DIV),
+- .op.max_sys_clk_div = SMIA_LIM(sensor, MAX_OP_SYS_CLK_DIV),
+- .op.min_pix_clk_div = SMIA_LIM(sensor, MIN_OP_PIX_CLK_DIV),
+- .op.max_pix_clk_div = SMIA_LIM(sensor, MAX_OP_PIX_CLK_DIV),
+- .op.min_sys_clk_freq_hz = SMIA_LIM(sensor, MIN_OP_SYS_CLK_FREQ_HZ),
+- .op.max_sys_clk_freq_hz = SMIA_LIM(sensor, MAX_OP_SYS_CLK_FREQ_HZ),
+- .op.min_pix_clk_freq_hz = SMIA_LIM(sensor, MIN_OP_PIX_CLK_FREQ_HZ),
+- .op.max_pix_clk_freq_hz = SMIA_LIM(sensor, MAX_OP_PIX_CLK_FREQ_HZ),
+-
+- .vt.min_sys_clk_div = SMIA_LIM(sensor, MIN_VT_SYS_CLK_DIV),
+- .vt.max_sys_clk_div = SMIA_LIM(sensor, MAX_VT_SYS_CLK_DIV),
+- .vt.min_pix_clk_div = SMIA_LIM(sensor, MIN_VT_PIX_CLK_DIV),
+- .vt.max_pix_clk_div = SMIA_LIM(sensor, MAX_VT_PIX_CLK_DIV),
+- .vt.min_sys_clk_freq_hz = SMIA_LIM(sensor, MIN_VT_SYS_CLK_FREQ_HZ),
+- .vt.max_sys_clk_freq_hz = SMIA_LIM(sensor, MAX_VT_SYS_CLK_FREQ_HZ),
+- .vt.min_pix_clk_freq_hz = SMIA_LIM(sensor, MIN_VT_PIX_CLK_FREQ_HZ),
+- .vt.max_pix_clk_freq_hz = SMIA_LIM(sensor, MAX_VT_PIX_CLK_FREQ_HZ),
+-
+- .min_line_length_pck_bin = SMIA_LIM(sensor, MIN_LINE_LENGTH_PCK_BIN),
+- .min_line_length_pck = SMIA_LIM(sensor, MIN_LINE_LENGTH_PCK),
++ .min_pre_pll_clk_div = CCS_LIM(sensor, MIN_PRE_PLL_CLK_DIV),
++ .max_pre_pll_clk_div = CCS_LIM(sensor, MAX_PRE_PLL_CLK_DIV),
++ .min_pll_ip_freq_hz = CCS_LIM(sensor, MIN_PLL_IP_CLK_FREQ_MHZ),
++ .max_pll_ip_freq_hz = CCS_LIM(sensor, MAX_PLL_IP_CLK_FREQ_MHZ),
++ .min_pll_multiplier = CCS_LIM(sensor, MIN_PLL_MULTIPLIER),
++ .max_pll_multiplier = CCS_LIM(sensor, MAX_PLL_MULTIPLIER),
++ .min_pll_op_freq_hz = CCS_LIM(sensor, MIN_PLL_OP_CLK_FREQ_MHZ),
++ .max_pll_op_freq_hz = CCS_LIM(sensor, MAX_PLL_OP_CLK_FREQ_MHZ),
++
++ .op.min_sys_clk_div = CCS_LIM(sensor, MIN_OP_SYS_CLK_DIV),
++ .op.max_sys_clk_div = CCS_LIM(sensor, MAX_OP_SYS_CLK_DIV),
++ .op.min_pix_clk_div = CCS_LIM(sensor, MIN_OP_PIX_CLK_DIV),
++ .op.max_pix_clk_div = CCS_LIM(sensor, MAX_OP_PIX_CLK_DIV),
++ .op.min_sys_clk_freq_hz = CCS_LIM(sensor, MIN_OP_SYS_CLK_FREQ_MHZ),
++ .op.max_sys_clk_freq_hz = CCS_LIM(sensor, MAX_OP_SYS_CLK_FREQ_MHZ),
++ .op.min_pix_clk_freq_hz = CCS_LIM(sensor, MIN_OP_PIX_CLK_FREQ_MHZ),
++ .op.max_pix_clk_freq_hz = CCS_LIM(sensor, MAX_OP_PIX_CLK_FREQ_MHZ),
++
++ .vt.min_sys_clk_div = CCS_LIM(sensor, MIN_VT_SYS_CLK_DIV),
++ .vt.max_sys_clk_div = CCS_LIM(sensor, MAX_VT_SYS_CLK_DIV),
++ .vt.min_pix_clk_div = CCS_LIM(sensor, MIN_VT_PIX_CLK_DIV),
++ .vt.max_pix_clk_div = CCS_LIM(sensor, MAX_VT_PIX_CLK_DIV),
++ .vt.min_sys_clk_freq_hz = CCS_LIM(sensor, MIN_VT_SYS_CLK_FREQ_MHZ),
++ .vt.max_sys_clk_freq_hz = CCS_LIM(sensor, MAX_VT_SYS_CLK_FREQ_MHZ),
++ .vt.min_pix_clk_freq_hz = CCS_LIM(sensor, MIN_VT_PIX_CLK_FREQ_MHZ),
++ .vt.max_pix_clk_freq_hz = CCS_LIM(sensor, MAX_VT_PIX_CLK_FREQ_MHZ),
++
++ .min_line_length_pck_bin = CCS_LIM(sensor, MIN_LINE_LENGTH_PCK_BIN),
++ .min_line_length_pck = CCS_LIM(sensor, MIN_LINE_LENGTH_PCK),
+ };
+
+ return smiapp_pll_calculate(&client->dev, &lim, pll);
+@@ -515,7 +479,7 @@ static void __smiapp_update_exposure_limits(struct smiapp_sensor *sensor)
+
+ max = sensor->pixel_array->crop[SMIAPP_PA_PAD_SRC].height
+ + sensor->vblank->val
+- - SMIA_LIM(sensor, COARSE_INTEGRATION_TIME_MAX_MARGIN);
++ - CCS_LIM(sensor, COARSE_INTEGRATION_TIME_MAX_MARGIN);
+
+ __v4l2_ctrl_modify_range(ctrl, ctrl->minimum, max, ctrl->step, max);
+ }
+@@ -770,10 +734,10 @@ static int smiapp_init_controls(struct smiapp_sensor *sensor)
+ sensor->analog_gain = v4l2_ctrl_new_std(
+ &sensor->pixel_array->ctrl_handler, &smiapp_ctrl_ops,
+ V4L2_CID_ANALOGUE_GAIN,
+- SMIA_LIM(sensor, ANALOGUE_GAIN_CODE_MIN),
+- SMIA_LIM(sensor, ANALOGUE_GAIN_CODE_MAX),
+- max(SMIA_LIM(sensor, ANALOGUE_GAIN_CODE_STEP), 1U),
+- SMIA_LIM(sensor, ANALOGUE_GAIN_CODE_MIN));
++ CCS_LIM(sensor, ANALOG_GAIN_CODE_MIN),
++ CCS_LIM(sensor, ANALOG_GAIN_CODE_MAX),
++ max(CCS_LIM(sensor, ANALOG_GAIN_CODE_STEP), 1U),
++ CCS_LIM(sensor, ANALOG_GAIN_CODE_MIN));
+
+ /* Exposure limits will be updated soon, use just something here. */
+ sensor->exposure = v4l2_ctrl_new_std(
+@@ -1032,21 +996,21 @@ static void smiapp_update_blanking(struct smiapp_sensor *sensor)
+ int min, max;
+
+ if (sensor->binning_vertical > 1 || sensor->binning_horizontal > 1) {
+- min_fll = SMIA_LIM(sensor, MIN_FRAME_LENGTH_LINES_BIN);
+- max_fll = SMIA_LIM(sensor, MAX_FRAME_LENGTH_LINES_BIN);
+- min_llp = SMIA_LIM(sensor, MIN_LINE_LENGTH_PCK_BIN);
+- max_llp = SMIA_LIM(sensor, MAX_LINE_LENGTH_PCK_BIN);
+- min_lbp = SMIA_LIM(sensor, MIN_LINE_BLANKING_PCK_BIN);
++ min_fll = CCS_LIM(sensor, MIN_FRAME_LENGTH_LINES_BIN);
++ max_fll = CCS_LIM(sensor, MAX_FRAME_LENGTH_LINES_BIN);
++ min_llp = CCS_LIM(sensor, MIN_LINE_LENGTH_PCK_BIN);
++ max_llp = CCS_LIM(sensor, MAX_LINE_LENGTH_PCK_BIN);
++ min_lbp = CCS_LIM(sensor, MIN_LINE_BLANKING_PCK_BIN);
+ } else {
+- min_fll = SMIA_LIM(sensor, MIN_FRAME_LENGTH_LINES);
+- max_fll = SMIA_LIM(sensor, MAX_FRAME_LENGTH_LINES);
+- min_llp = SMIA_LIM(sensor, MIN_LINE_LENGTH_PCK);
+- max_llp = SMIA_LIM(sensor, MAX_LINE_LENGTH_PCK);
+- min_lbp = SMIA_LIM(sensor, MIN_LINE_BLANKING_PCK);
++ min_fll = CCS_LIM(sensor, MIN_FRAME_LENGTH_LINES);
++ max_fll = CCS_LIM(sensor, MAX_FRAME_LENGTH_LINES);
++ min_llp = CCS_LIM(sensor, MIN_LINE_LENGTH_PCK);
++ max_llp = CCS_LIM(sensor, MAX_LINE_LENGTH_PCK);
++ min_lbp = CCS_LIM(sensor, MIN_LINE_BLANKING_PCK);
+ }
+
+ min = max_t(int,
+- SMIA_LIM(sensor, MIN_FRAME_BLANKING_LINES),
++ CCS_LIM(sensor, MIN_FRAME_BLANKING_LINES),
+ min_fll -
+ sensor->pixel_array->crop[SMIAPP_PA_PAD_SRC].height);
+ max = max_fll - sensor->pixel_array->crop[SMIAPP_PA_PAD_SRC].height;
+@@ -1124,8 +1088,8 @@ static int smiapp_read_nvm_page(struct smiapp_sensor *sensor, u32 p, u8 *nvm,
+ return -ENODATA;
+ }
+
+- if (SMIA_LIM(sensor, DATA_TRANSFER_IF_CAPABILITY) &
+- SMIAPP_DATA_TRANSFER_IF_CAPABILITY_POLL) {
++ if (CCS_LIM(sensor, DATA_TRANSFER_IF_CAPABILITY) &
++ CCS_DATA_TRANSFER_IF_CAPABILITY_POLLING) {
+ for (i = 1000; i > 0; i--) {
+ if (s & SMIAPP_DATA_TRANSFER_IF_1_STATUS_RD_READY)
+ break;
+@@ -1577,8 +1541,8 @@ static int smiapp_start_streaming(struct smiapp_sensor *sensor)
+ */
+
+ /* Digital crop */
+- if (SMIA_LIM(sensor, DIGITAL_CROP_CAPABILITY)
+- == SMIAPP_DIGITAL_CROP_CAPABILITY_INPUT_CROP) {
++ if (CCS_LIM(sensor, DIGITAL_CROP_CAPABILITY)
++ == CCS_DIGITAL_CROP_CAPABILITY_INPUT_CROP) {
+ rval = smiapp_write(
+ sensor, SMIAPP_REG_U16_DIGITAL_CROP_X_OFFSET,
+ sensor->scaler->crop[SMIAPP_PAD_SINK].left);
+@@ -1605,8 +1569,8 @@ static int smiapp_start_streaming(struct smiapp_sensor *sensor)
+ }
+
+ /* Scaling */
+- if (SMIA_LIM(sensor, SCALING_CAPABILITY)
+- != SMIAPP_SCALING_CAPABILITY_NONE) {
++ if (CCS_LIM(sensor, SCALING_CAPABILITY)
++ != CCS_SCALING_CAPABILITY_NONE) {
+ rval = smiapp_write(sensor, SMIAPP_REG_U16_SCALING_MODE,
+ sensor->scaling_mode);
+ if (rval < 0)
+@@ -1628,9 +1592,9 @@ static int smiapp_start_streaming(struct smiapp_sensor *sensor)
+ if (rval < 0)
+ goto out;
+
+- if ((SMIA_LIM(sensor, FLASH_MODE_CAPABILITY) &
+- (SMIAPP_FLASH_MODE_CAPABILITY_SINGLE_STROBE |
+- SMIAPP_FLASH_MODE_CAPABILITY_MULTIPLE_STROBE)) &&
++ if (CCS_LIM(sensor, FLASH_MODE_CAPABILITY) &
++ (CCS_FLASH_MODE_CAPABILITY_SINGLE_STROBE |
++ SMIAPP_FLASH_MODE_CAPABILITY_MULTIPLE_STROBE) &&
+ sensor->hwcfg->strobe_setup != NULL &&
+ sensor->hwcfg->strobe_setup->trigger != 0) {
+ rval = smiapp_setup_flash_strobe(sensor);
+@@ -1876,7 +1840,7 @@ static void smiapp_propagate(struct v4l2_subdev *subdev,
+ if (which == V4L2_SUBDEV_FORMAT_ACTIVE) {
+ if (ssd == sensor->scaler) {
+ sensor->scale_m =
+- SMIA_LIM(sensor, SCALER_N_MIN);
++ CCS_LIM(sensor, SCALER_N_MIN);
+ sensor->scaling_mode =
+ SMIAPP_SCALING_MODE_NONE;
+ } else if (ssd == sensor->binner) {
+@@ -1988,12 +1952,12 @@ static int smiapp_set_format(struct v4l2_subdev *subdev,
+
+ fmt->format.width =
+ clamp(fmt->format.width,
+- SMIA_LIM(sensor, MIN_X_OUTPUT_SIZE),
+- SMIA_LIM(sensor, MAX_X_OUTPUT_SIZE));
++ CCS_LIM(sensor, MIN_X_OUTPUT_SIZE),
++ CCS_LIM(sensor, MAX_X_OUTPUT_SIZE));
+ fmt->format.height =
+ clamp(fmt->format.height,
+- SMIA_LIM(sensor, MIN_Y_OUTPUT_SIZE),
+- SMIA_LIM(sensor, MAX_Y_OUTPUT_SIZE));
++ CCS_LIM(sensor, MIN_Y_OUTPUT_SIZE),
++ CCS_LIM(sensor, MAX_Y_OUTPUT_SIZE));
+
+ smiapp_get_crop_compose(subdev, cfg, crops, NULL, fmt->which);
+
+@@ -2046,7 +2010,7 @@ static int scaling_goodness(struct v4l2_subdev *subdev, int w, int ask_w,
+ val -= abs(w - ask_w);
+ val -= abs(h - ask_h);
+
+- if (w < SMIA_LIM(sensor, MIN_X_OUTPUT_SIZE))
++ if (w < CCS_LIM(sensor, MIN_X_OUTPUT_SIZE))
+ val -= SCALING_GOODNESS_EXTREME;
+
+ dev_dbg(&client->dev, "w %d ask_w %d h %d ask_h %d goodness %d\n",
+@@ -2112,7 +2076,7 @@ static void smiapp_set_compose_scaler(struct v4l2_subdev *subdev,
+ struct i2c_client *client = v4l2_get_subdevdata(subdev);
+ struct smiapp_sensor *sensor = to_smiapp_sensor(subdev);
+ u32 min, max, a, b, max_m;
+- u32 scale_m = SMIA_LIM(sensor, SCALER_N_MIN);
++ u32 scale_m = CCS_LIM(sensor, SCALER_N_MIN);
+ int mode = SMIAPP_SCALING_MODE_HORIZONTAL;
+ u32 try[4];
+ u32 ntry = 0;
+@@ -2125,19 +2089,19 @@ static void smiapp_set_compose_scaler(struct v4l2_subdev *subdev,
+ crops[SMIAPP_PAD_SINK]->height);
+
+ a = crops[SMIAPP_PAD_SINK]->width
+- * SMIA_LIM(sensor, SCALER_N_MIN) / sel->r.width;
++ * CCS_LIM(sensor, SCALER_N_MIN) / sel->r.width;
+ b = crops[SMIAPP_PAD_SINK]->height
+- * SMIA_LIM(sensor, SCALER_N_MIN) / sel->r.height;
++ * CCS_LIM(sensor, SCALER_N_MIN) / sel->r.height;
+ max_m = crops[SMIAPP_PAD_SINK]->width
+- * SMIA_LIM(sensor, SCALER_N_MIN)
+- / SMIA_LIM(sensor, MIN_X_OUTPUT_SIZE);
++ * CCS_LIM(sensor, SCALER_N_MIN)
++ / CCS_LIM(sensor, MIN_X_OUTPUT_SIZE);
+
+- a = clamp(a, SMIA_LIM(sensor, SCALER_M_MIN),
+- SMIA_LIM(sensor, SCALER_M_MAX));
+- b = clamp(b, SMIA_LIM(sensor, SCALER_M_MIN),
+- SMIA_LIM(sensor, SCALER_M_MAX));
+- max_m = clamp(max_m, SMIA_LIM(sensor, SCALER_M_MIN),
+- SMIA_LIM(sensor, SCALER_M_MAX));
++ a = clamp(a, CCS_LIM(sensor, SCALER_M_MIN),
++ CCS_LIM(sensor, SCALER_M_MAX));
++ b = clamp(b, CCS_LIM(sensor, SCALER_M_MIN),
++ CCS_LIM(sensor, SCALER_M_MAX));
++ max_m = clamp(max_m, CCS_LIM(sensor, SCALER_M_MIN),
++ CCS_LIM(sensor, SCALER_M_MAX));
+
+ dev_dbg(&client->dev, "scaling: a %d b %d max_m %d\n", a, b, max_m);
+
+@@ -2163,8 +2127,7 @@ static void smiapp_set_compose_scaler(struct v4l2_subdev *subdev,
+ int this = scaling_goodness(
+ subdev,
+ crops[SMIAPP_PAD_SINK]->width
+- / try[i]
+- * SMIA_LIM(sensor, SCALER_N_MIN),
++ / try[i] * CCS_LIM(sensor, SCALER_N_MIN),
+ sel->r.width,
+ crops[SMIAPP_PAD_SINK]->height,
+ sel->r.height,
+@@ -2178,18 +2141,18 @@ static void smiapp_set_compose_scaler(struct v4l2_subdev *subdev,
+ best = this;
+ }
+
+- if (SMIA_LIM(sensor, SCALING_CAPABILITY)
+- == SMIAPP_SCALING_CAPABILITY_HORIZONTAL)
++ if (CCS_LIM(sensor, SCALING_CAPABILITY)
++ == CCS_SCALING_CAPABILITY_HORIZONTAL)
+ continue;
+
+ this = scaling_goodness(
+ subdev, crops[SMIAPP_PAD_SINK]->width
+ / try[i]
+- * SMIA_LIM(sensor, SCALER_N_MIN),
++ * CCS_LIM(sensor, SCALER_N_MIN),
+ sel->r.width,
+ crops[SMIAPP_PAD_SINK]->height
+ / try[i]
+- * SMIA_LIM(sensor, SCALER_N_MIN),
++ * CCS_LIM(sensor, SCALER_N_MIN),
+ sel->r.height,
+ sel->flags);
+
+@@ -2203,12 +2166,12 @@ static void smiapp_set_compose_scaler(struct v4l2_subdev *subdev,
+ sel->r.width =
+ (crops[SMIAPP_PAD_SINK]->width
+ / scale_m
+- * SMIA_LIM(sensor, SCALER_N_MIN)) & ~1;
++ * CCS_LIM(sensor, SCALER_N_MIN)) & ~1;
+ if (mode == SMIAPP_SCALING_MODE_BOTH)
+ sel->r.height =
+ (crops[SMIAPP_PAD_SINK]->height
+ / scale_m
+- * SMIA_LIM(sensor, SCALER_N_MIN))
++ * CCS_LIM(sensor, SCALER_N_MIN))
+ & ~1;
+ else
+ sel->r.height = crops[SMIAPP_PAD_SINK]->height;
+@@ -2262,10 +2225,9 @@ static int __smiapp_sel_supported(struct v4l2_subdev *subdev,
+ if (ssd == sensor->src
+ && sel->pad == SMIAPP_PAD_SRC)
+ return 0;
+- if (ssd == sensor->scaler
+- && sel->pad == SMIAPP_PAD_SINK
+- && SMIA_LIM(sensor, DIGITAL_CROP_CAPABILITY)
+- == SMIAPP_DIGITAL_CROP_CAPABILITY_INPUT_CROP)
++ if (ssd == sensor->scaler && sel->pad == SMIAPP_PAD_SINK &&
++ CCS_LIM(sensor, DIGITAL_CROP_CAPABILITY)
++ == CCS_DIGITAL_CROP_CAPABILITY_INPUT_CROP)
+ return 0;
+ return -EINVAL;
+ case V4L2_SEL_TGT_NATIVE_SIZE:
+@@ -2279,9 +2241,8 @@ static int __smiapp_sel_supported(struct v4l2_subdev *subdev,
+ return -EINVAL;
+ if (ssd == sensor->binner)
+ return 0;
+- if (ssd == sensor->scaler
+- && SMIA_LIM(sensor, SCALING_CAPABILITY)
+- != SMIAPP_SCALING_CAPABILITY_NONE)
++ if (ssd == sensor->scaler && CCS_LIM(sensor, SCALING_CAPABILITY)
++ != CCS_SCALING_CAPABILITY_NONE)
+ return 0;
+ fallthrough;
+ default:
+@@ -2345,8 +2306,8 @@ static void smiapp_get_native_size(struct smiapp_subdev *ssd,
+ {
+ r->top = 0;
+ r->left = 0;
+- r->width = SMIA_LIM(ssd->sensor, X_ADDR_MAX) + 1;
+- r->height = SMIA_LIM(ssd->sensor, Y_ADDR_MAX) + 1;
++ r->width = CCS_LIM(ssd->sensor, X_ADDR_MAX) + 1;
++ r->height = CCS_LIM(ssd->sensor, Y_ADDR_MAX) + 1;
+ }
+
+ static int __smiapp_get_selection(struct v4l2_subdev *subdev,
+@@ -2431,10 +2392,10 @@ static int smiapp_set_selection(struct v4l2_subdev *subdev,
+ sel->r.height = SMIAPP_ALIGN_DIM(sel->r.height, sel->flags);
+
+ sel->r.width = max_t(unsigned int,
+- SMIA_LIM(sensor, MIN_X_OUTPUT_SIZE),
++ CCS_LIM(sensor, MIN_X_OUTPUT_SIZE),
+ sel->r.width);
+ sel->r.height = max_t(unsigned int,
+- SMIA_LIM(sensor, MIN_Y_OUTPUT_SIZE),
++ CCS_LIM(sensor, MIN_Y_OUTPUT_SIZE),
+ sel->r.height);
+
+ switch (sel->target) {
+@@ -3123,12 +3084,6 @@ static int smiapp_probe(struct i2c_client *client)
+ goto out_power_off;
+ }
+
+- rval = smiapp_read_all_smia_limits(sensor);
+- if (rval) {
+- rval = -ENODEV;
+- goto out_power_off;
+- }
+-
+ rval = ccs_read_all_limits(sensor);
+ if (rval)
+ goto out_power_off;
+@@ -3163,7 +3118,7 @@ static int smiapp_probe(struct i2c_client *client)
+ goto out_free_ccs_limits;
+ }
+
+- if (SMIA_LIM(sensor, BINNING_CAPABILITY)) {
++ if (CCS_LIM(sensor, BINNING_CAPABILITY)) {
+ u32 val;
+
+ rval = smiapp_read(sensor,
+@@ -3200,8 +3155,8 @@ static int smiapp_probe(struct i2c_client *client)
+ }
+
+ if (sensor->minfo.smiapp_version &&
+- SMIA_LIM(sensor, DATA_TRANSFER_IF_CAPABILITY) &
+- SMIAPP_DATA_TRANSFER_IF_CAPABILITY_SUPPORTED) {
++ CCS_LIM(sensor, DATA_TRANSFER_IF_CAPABILITY) &
++ CCS_DATA_TRANSFER_IF_CAPABILITY_SUPPORTED) {
+ if (device_create_file(&client->dev, &dev_attr_nvm) != 0) {
+ dev_err(&client->dev, "sysfs nvm entry failed\n");
+ rval = -EBUSY;
+@@ -3210,22 +3165,22 @@ static int smiapp_probe(struct i2c_client *client)
+ }
+
+ /* We consider this as profile 0 sensor if any of these are zero. */
+- if (!SMIA_LIM(sensor, MIN_OP_SYS_CLK_DIV) ||
+- !SMIA_LIM(sensor, MAX_OP_SYS_CLK_DIV) ||
+- !SMIA_LIM(sensor, MIN_OP_PIX_CLK_DIV) ||
+- !SMIA_LIM(sensor, MAX_OP_PIX_CLK_DIV)) {
++ if (!CCS_LIM(sensor, MIN_OP_SYS_CLK_DIV) ||
++ !CCS_LIM(sensor, MAX_OP_SYS_CLK_DIV) ||
++ !CCS_LIM(sensor, MIN_OP_PIX_CLK_DIV) ||
++ !CCS_LIM(sensor, MAX_OP_PIX_CLK_DIV)) {
+ sensor->minfo.smiapp_profile = SMIAPP_PROFILE_0;
+- } else if (SMIA_LIM(sensor, SCALING_CAPABILITY)
+- != SMIAPP_SCALING_CAPABILITY_NONE) {
+- if (SMIA_LIM(sensor, SCALING_CAPABILITY)
+- == SMIAPP_SCALING_CAPABILITY_HORIZONTAL)
++ } else if (CCS_LIM(sensor, SCALING_CAPABILITY)
++ != CCS_SCALING_CAPABILITY_NONE) {
++ if (CCS_LIM(sensor, SCALING_CAPABILITY)
++ == CCS_SCALING_CAPABILITY_HORIZONTAL)
+ sensor->minfo.smiapp_profile = SMIAPP_PROFILE_1;
+ else
+ sensor->minfo.smiapp_profile = SMIAPP_PROFILE_2;
+ sensor->scaler = &sensor->ssds[sensor->ssds_used];
+ sensor->ssds_used++;
+- } else if (SMIA_LIM(sensor, DIGITAL_CROP_CAPABILITY)
+- == SMIAPP_DIGITAL_CROP_CAPABILITY_INPUT_CROP) {
++ } else if (CCS_LIM(sensor, DIGITAL_CROP_CAPABILITY)
++ == CCS_DIGITAL_CROP_CAPABILITY_INPUT_CROP) {
+ sensor->scaler = &sensor->ssds[sensor->ssds_used];
+ sensor->ssds_used++;
+ }
+@@ -3234,13 +3189,13 @@ static int smiapp_probe(struct i2c_client *client)
+ sensor->pixel_array = &sensor->ssds[sensor->ssds_used];
+ sensor->ssds_used++;
+
+- sensor->scale_m = SMIA_LIM(sensor, SCALER_N_MIN);
++ sensor->scale_m = CCS_LIM(sensor, SCALER_N_MIN);
+
+ /* prepare PLL configuration input values */
+ sensor->pll.bus_type = SMIAPP_PLL_BUS_TYPE_CSI2;
+ sensor->pll.csi2.lanes = sensor->hwcfg->lanes;
+ sensor->pll.ext_clk_freq_hz = sensor->hwcfg->ext_clk;
+- sensor->pll.scale_n = SMIA_LIM(sensor, SCALER_N_MIN);
++ sensor->pll.scale_n = CCS_LIM(sensor, SCALER_N_MIN);
+ /* Profile 0 sensors have no separate OP clock branch. */
+ if (sensor->minfo.smiapp_profile == SMIAPP_PROFILE_0)
+ sensor->pll.flags |= SMIAPP_PLL_FLAG_NO_OP_CLOCKS;
+diff --git a/drivers/media/i2c/smiapp/smiapp-limits.c b/drivers/media/i2c/smiapp/smiapp-limits.c
+deleted file mode 100644
+index de5ee52967138..0000000000000
+--- a/drivers/media/i2c/smiapp/smiapp-limits.c
++++ /dev/null
+@@ -1,118 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0-only
+-/*
+- * drivers/media/i2c/smiapp/smiapp-limits.c
+- *
+- * Generic driver for SMIA/SMIA++ compliant camera modules
+- *
+- * Copyright (C) 2011--2012 Nokia Corporation
+- * Contact: Sakari Ailus <sakari.ailus@iki.fi>
+- */
+-
+-#include "smiapp.h"
+-
+-struct smiapp_reg_limits smiapp_reg_limits[] = {
+- { SMIAPP_REG_U16_ANALOGUE_GAIN_CAPABILITY, "analogue_gain_capability" }, /* 0 */
+- { SMIAPP_REG_U16_ANALOGUE_GAIN_CODE_MIN, "analogue_gain_code_min" },
+- { SMIAPP_REG_U16_ANALOGUE_GAIN_CODE_MAX, "analogue_gain_code_max" },
+- { SMIAPP_REG_U8_THS_ZERO_MIN, "ths_zero_min" },
+- { SMIAPP_REG_U8_TCLK_TRAIL_MIN, "tclk_trail_min" },
+- { SMIAPP_REG_U16_INTEGRATION_TIME_CAPABILITY, "integration_time_capability" }, /* 5 */
+- { SMIAPP_REG_U16_COARSE_INTEGRATION_TIME_MIN, "coarse_integration_time_min" },
+- { SMIAPP_REG_U16_COARSE_INTEGRATION_TIME_MAX_MARGIN, "coarse_integration_time_max_margin" },
+- { SMIAPP_REG_U16_FINE_INTEGRATION_TIME_MIN, "fine_integration_time_min" },
+- { SMIAPP_REG_U16_FINE_INTEGRATION_TIME_MAX_MARGIN, "fine_integration_time_max_margin" },
+- { SMIAPP_REG_U16_DIGITAL_GAIN_CAPABILITY, "digital_gain_capability" }, /* 10 */
+- { SMIAPP_REG_U16_DIGITAL_GAIN_MIN, "digital_gain_min" },
+- { SMIAPP_REG_U16_DIGITAL_GAIN_MAX, "digital_gain_max" },
+- { SMIAPP_REG_F32_MIN_EXT_CLK_FREQ_HZ, "min_ext_clk_freq_hz" },
+- { SMIAPP_REG_F32_MAX_EXT_CLK_FREQ_HZ, "max_ext_clk_freq_hz" },
+- { SMIAPP_REG_U16_MIN_PRE_PLL_CLK_DIV, "min_pre_pll_clk_div" }, /* 15 */
+- { SMIAPP_REG_U16_MAX_PRE_PLL_CLK_DIV, "max_pre_pll_clk_div" },
+- { SMIAPP_REG_F32_MIN_PLL_IP_FREQ_HZ, "min_pll_ip_freq_hz" },
+- { SMIAPP_REG_F32_MAX_PLL_IP_FREQ_HZ, "max_pll_ip_freq_hz" },
+- { SMIAPP_REG_U16_MIN_PLL_MULTIPLIER, "min_pll_multiplier" },
+- { SMIAPP_REG_U16_MAX_PLL_MULTIPLIER, "max_pll_multiplier" }, /* 20 */
+- { SMIAPP_REG_F32_MIN_PLL_OP_FREQ_HZ, "min_pll_op_freq_hz" },
+- { SMIAPP_REG_F32_MAX_PLL_OP_FREQ_HZ, "max_pll_op_freq_hz" },
+- { SMIAPP_REG_U16_MIN_VT_SYS_CLK_DIV, "min_vt_sys_clk_div" },
+- { SMIAPP_REG_U16_MAX_VT_SYS_CLK_DIV, "max_vt_sys_clk_div" },
+- { SMIAPP_REG_F32_MIN_VT_SYS_CLK_FREQ_HZ, "min_vt_sys_clk_freq_hz" }, /* 25 */
+- { SMIAPP_REG_F32_MAX_VT_SYS_CLK_FREQ_HZ, "max_vt_sys_clk_freq_hz" },
+- { SMIAPP_REG_F32_MIN_VT_PIX_CLK_FREQ_HZ, "min_vt_pix_clk_freq_hz" },
+- { SMIAPP_REG_F32_MAX_VT_PIX_CLK_FREQ_HZ, "max_vt_pix_clk_freq_hz" },
+- { SMIAPP_REG_U16_MIN_VT_PIX_CLK_DIV, "min_vt_pix_clk_div" },
+- { SMIAPP_REG_U16_MAX_VT_PIX_CLK_DIV, "max_vt_pix_clk_div" }, /* 30 */
+- { SMIAPP_REG_U16_MIN_FRAME_LENGTH_LINES, "min_frame_length_lines" },
+- { SMIAPP_REG_U16_MAX_FRAME_LENGTH_LINES, "max_frame_length_lines" },
+- { SMIAPP_REG_U16_MIN_LINE_LENGTH_PCK, "min_line_length_pck" },
+- { SMIAPP_REG_U16_MAX_LINE_LENGTH_PCK, "max_line_length_pck" },
+- { SMIAPP_REG_U16_MIN_LINE_BLANKING_PCK, "min_line_blanking_pck" }, /* 35 */
+- { SMIAPP_REG_U16_MIN_FRAME_BLANKING_LINES, "min_frame_blanking_lines" },
+- { SMIAPP_REG_U8_MIN_LINE_LENGTH_PCK_STEP_SIZE, "min_line_length_pck_step_size" },
+- { SMIAPP_REG_U16_MIN_OP_SYS_CLK_DIV, "min_op_sys_clk_div" },
+- { SMIAPP_REG_U16_MAX_OP_SYS_CLK_DIV, "max_op_sys_clk_div" },
+- { SMIAPP_REG_F32_MIN_OP_SYS_CLK_FREQ_HZ, "min_op_sys_clk_freq_hz" }, /* 40 */
+- { SMIAPP_REG_F32_MAX_OP_SYS_CLK_FREQ_HZ, "max_op_sys_clk_freq_hz" },
+- { SMIAPP_REG_U16_MIN_OP_PIX_CLK_DIV, "min_op_pix_clk_div" },
+- { SMIAPP_REG_U16_MAX_OP_PIX_CLK_DIV, "max_op_pix_clk_div" },
+- { SMIAPP_REG_F32_MIN_OP_PIX_CLK_FREQ_HZ, "min_op_pix_clk_freq_hz" },
+- { SMIAPP_REG_F32_MAX_OP_PIX_CLK_FREQ_HZ, "max_op_pix_clk_freq_hz" }, /* 45 */
+- { SMIAPP_REG_U16_X_ADDR_MIN, "x_addr_min" },
+- { SMIAPP_REG_U16_Y_ADDR_MIN, "y_addr_min" },
+- { SMIAPP_REG_U16_X_ADDR_MAX, "x_addr_max" },
+- { SMIAPP_REG_U16_Y_ADDR_MAX, "y_addr_max" },
+- { SMIAPP_REG_U16_MIN_X_OUTPUT_SIZE, "min_x_output_size" }, /* 50 */
+- { SMIAPP_REG_U16_MIN_Y_OUTPUT_SIZE, "min_y_output_size" },
+- { SMIAPP_REG_U16_MAX_X_OUTPUT_SIZE, "max_x_output_size" },
+- { SMIAPP_REG_U16_MAX_Y_OUTPUT_SIZE, "max_y_output_size" },
+- { SMIAPP_REG_U16_MIN_EVEN_INC, "min_even_inc" },
+- { SMIAPP_REG_U16_MAX_EVEN_INC, "max_even_inc" }, /* 55 */
+- { SMIAPP_REG_U16_MIN_ODD_INC, "min_odd_inc" },
+- { SMIAPP_REG_U16_MAX_ODD_INC, "max_odd_inc" },
+- { SMIAPP_REG_U16_SCALING_CAPABILITY, "scaling_capability" },
+- { SMIAPP_REG_U16_SCALER_M_MIN, "scaler_m_min" },
+- { SMIAPP_REG_U16_SCALER_M_MAX, "scaler_m_max" }, /* 60 */
+- { SMIAPP_REG_U16_SCALER_N_MIN, "scaler_n_min" },
+- { SMIAPP_REG_U16_SCALER_N_MAX, "scaler_n_max" },
+- { SMIAPP_REG_U16_SPATIAL_SAMPLING_CAPABILITY, "spatial_sampling_capability" },
+- { SMIAPP_REG_U8_DIGITAL_CROP_CAPABILITY, "digital_crop_capability" },
+- { SMIAPP_REG_U16_COMPRESSION_CAPABILITY, "compression_capability" }, /* 65 */
+- { SMIAPP_REG_U8_FIFO_SUPPORT_CAPABILITY, "fifo_support_capability" },
+- { SMIAPP_REG_U8_DPHY_CTRL_CAPABILITY, "dphy_ctrl_capability" },
+- { SMIAPP_REG_U8_CSI_LANE_MODE_CAPABILITY, "csi_lane_mode_capability" },
+- { SMIAPP_REG_U8_CSI_SIGNALLING_MODE_CAPABILITY, "csi_signalling_mode_capability" },
+- { SMIAPP_REG_U8_FAST_STANDBY_CAPABILITY, "fast_standby_capability" }, /* 70 */
+- { SMIAPP_REG_U8_CCI_ADDRESS_CONTROL_CAPABILITY, "cci_address_control_capability" },
+- { SMIAPP_REG_U32_MAX_PER_LANE_BITRATE_1_LANE_MODE_MBPS, "max_per_lane_bitrate_1_lane_mode_mbps" },
+- { SMIAPP_REG_U32_MAX_PER_LANE_BITRATE_2_LANE_MODE_MBPS, "max_per_lane_bitrate_2_lane_mode_mbps" },
+- { SMIAPP_REG_U32_MAX_PER_LANE_BITRATE_3_LANE_MODE_MBPS, "max_per_lane_bitrate_3_lane_mode_mbps" },
+- { SMIAPP_REG_U32_MAX_PER_LANE_BITRATE_4_LANE_MODE_MBPS, "max_per_lane_bitrate_4_lane_mode_mbps" }, /* 75 */
+- { SMIAPP_REG_U8_TEMP_SENSOR_CAPABILITY, "temp_sensor_capability" },
+- { SMIAPP_REG_U16_MIN_FRAME_LENGTH_LINES_BIN, "min_frame_length_lines_bin" },
+- { SMIAPP_REG_U16_MAX_FRAME_LENGTH_LINES_BIN, "max_frame_length_lines_bin" },
+- { SMIAPP_REG_U16_MIN_LINE_LENGTH_PCK_BIN, "min_line_length_pck_bin" },
+- { SMIAPP_REG_U16_MAX_LINE_LENGTH_PCK_BIN, "max_line_length_pck_bin" }, /* 80 */
+- { SMIAPP_REG_U16_MIN_LINE_BLANKING_PCK_BIN, "min_line_blanking_pck_bin" },
+- { SMIAPP_REG_U16_FINE_INTEGRATION_TIME_MIN_BIN, "fine_integration_time_min_bin" },
+- { SMIAPP_REG_U16_FINE_INTEGRATION_TIME_MAX_MARGIN_BIN, "fine_integration_time_max_margin_bin" },
+- { SMIAPP_REG_U8_BINNING_CAPABILITY, "binning_capability" },
+- { SMIAPP_REG_U8_BINNING_WEIGHTING_CAPABILITY, "binning_weighting_capability" }, /* 85 */
+- { SMIAPP_REG_U8_DATA_TRANSFER_IF_CAPABILITY, "data_transfer_if_capability" },
+- { SMIAPP_REG_U8_SHADING_CORRECTION_CAPABILITY, "shading_correction_capability" },
+- { SMIAPP_REG_U8_GREEN_IMBALANCE_CAPABILITY, "green_imbalance_capability" },
+- { SMIAPP_REG_U8_BLACK_LEVEL_CAPABILITY, "black_level_capability" },
+- { SMIAPP_REG_U8_MODULE_SPECIFIC_CORRECTION_CAPABILITY, "module_specific_correction_capability" }, /* 90 */
+- { SMIAPP_REG_U16_DEFECT_CORRECTION_CAPABILITY, "defect_correction_capability" },
+- { SMIAPP_REG_U16_DEFECT_CORRECTION_CAPABILITY_2, "defect_correction_capability_2" },
+- { SMIAPP_REG_U8_EDOF_CAPABILITY, "edof_capability" },
+- { SMIAPP_REG_U8_COLOUR_FEEDBACK_CAPABILITY, "colour_feedback_capability" },
+- { SMIAPP_REG_U8_ESTIMATION_MODE_CAPABILITY, "estimation_mode_capability" }, /* 95 */
+- { SMIAPP_REG_U8_ESTIMATION_ZONE_CAPABILITY, "estimation_zone_capability" },
+- { SMIAPP_REG_U16_CAPABILITY_TRDY_MIN, "capability_trdy_min" },
+- { SMIAPP_REG_U8_FLASH_MODE_CAPABILITY, "flash_mode_capability" },
+- { SMIAPP_REG_U8_ACTUATOR_CAPABILITY, "actuator_capability" },
+- { SMIAPP_REG_U8_BRACKETING_LUT_CAPABILITY_1, "bracketing_lut_capability_1" }, /* 100 */
+- { SMIAPP_REG_U8_BRACKETING_LUT_CAPABILITY_2, "bracketing_lut_capability_2" },
+- { SMIAPP_REG_U16_ANALOGUE_GAIN_CODE_STEP, "analogue_gain_code_step" },
+- { 0, NULL },
+-};
+diff --git a/drivers/media/i2c/smiapp/smiapp-limits.h b/drivers/media/i2c/smiapp/smiapp-limits.h
+deleted file mode 100644
+index dbac0b4975f96..0000000000000
+--- a/drivers/media/i2c/smiapp/smiapp-limits.h
++++ /dev/null
+@@ -1,114 +0,0 @@
+-/* SPDX-License-Identifier: GPL-2.0-only */
+-/*
+- * drivers/media/i2c/smiapp/smiapp-limits.h
+- *
+- * Generic driver for SMIA/SMIA++ compliant camera modules
+- *
+- * Copyright (C) 2011--2012 Nokia Corporation
+- * Contact: Sakari Ailus <sakari.ailus@iki.fi>
+- */
+-
+-#define SMIAPP_LIMIT_ANALOGUE_GAIN_CAPABILITY 0
+-#define SMIAPP_LIMIT_ANALOGUE_GAIN_CODE_MIN 1
+-#define SMIAPP_LIMIT_ANALOGUE_GAIN_CODE_MAX 2
+-#define SMIAPP_LIMIT_THS_ZERO_MIN 3
+-#define SMIAPP_LIMIT_TCLK_TRAIL_MIN 4
+-#define SMIAPP_LIMIT_INTEGRATION_TIME_CAPABILITY 5
+-#define SMIAPP_LIMIT_COARSE_INTEGRATION_TIME_MIN 6
+-#define SMIAPP_LIMIT_COARSE_INTEGRATION_TIME_MAX_MARGIN 7
+-#define SMIAPP_LIMIT_FINE_INTEGRATION_TIME_MIN 8
+-#define SMIAPP_LIMIT_FINE_INTEGRATION_TIME_MAX_MARGIN 9
+-#define SMIAPP_LIMIT_DIGITAL_GAIN_CAPABILITY 10
+-#define SMIAPP_LIMIT_DIGITAL_GAIN_MIN 11
+-#define SMIAPP_LIMIT_DIGITAL_GAIN_MAX 12
+-#define SMIAPP_LIMIT_MIN_EXT_CLK_FREQ_HZ 13
+-#define SMIAPP_LIMIT_MAX_EXT_CLK_FREQ_HZ 14
+-#define SMIAPP_LIMIT_MIN_PRE_PLL_CLK_DIV 15
+-#define SMIAPP_LIMIT_MAX_PRE_PLL_CLK_DIV 16
+-#define SMIAPP_LIMIT_MIN_PLL_IP_FREQ_HZ 17
+-#define SMIAPP_LIMIT_MAX_PLL_IP_FREQ_HZ 18
+-#define SMIAPP_LIMIT_MIN_PLL_MULTIPLIER 19
+-#define SMIAPP_LIMIT_MAX_PLL_MULTIPLIER 20
+-#define SMIAPP_LIMIT_MIN_PLL_OP_FREQ_HZ 21
+-#define SMIAPP_LIMIT_MAX_PLL_OP_FREQ_HZ 22
+-#define SMIAPP_LIMIT_MIN_VT_SYS_CLK_DIV 23
+-#define SMIAPP_LIMIT_MAX_VT_SYS_CLK_DIV 24
+-#define SMIAPP_LIMIT_MIN_VT_SYS_CLK_FREQ_HZ 25
+-#define SMIAPP_LIMIT_MAX_VT_SYS_CLK_FREQ_HZ 26
+-#define SMIAPP_LIMIT_MIN_VT_PIX_CLK_FREQ_HZ 27
+-#define SMIAPP_LIMIT_MAX_VT_PIX_CLK_FREQ_HZ 28
+-#define SMIAPP_LIMIT_MIN_VT_PIX_CLK_DIV 29
+-#define SMIAPP_LIMIT_MAX_VT_PIX_CLK_DIV 30
+-#define SMIAPP_LIMIT_MIN_FRAME_LENGTH_LINES 31
+-#define SMIAPP_LIMIT_MAX_FRAME_LENGTH_LINES 32
+-#define SMIAPP_LIMIT_MIN_LINE_LENGTH_PCK 33
+-#define SMIAPP_LIMIT_MAX_LINE_LENGTH_PCK 34
+-#define SMIAPP_LIMIT_MIN_LINE_BLANKING_PCK 35
+-#define SMIAPP_LIMIT_MIN_FRAME_BLANKING_LINES 36
+-#define SMIAPP_LIMIT_MIN_LINE_LENGTH_PCK_STEP_SIZE 37
+-#define SMIAPP_LIMIT_MIN_OP_SYS_CLK_DIV 38
+-#define SMIAPP_LIMIT_MAX_OP_SYS_CLK_DIV 39
+-#define SMIAPP_LIMIT_MIN_OP_SYS_CLK_FREQ_HZ 40
+-#define SMIAPP_LIMIT_MAX_OP_SYS_CLK_FREQ_HZ 41
+-#define SMIAPP_LIMIT_MIN_OP_PIX_CLK_DIV 42
+-#define SMIAPP_LIMIT_MAX_OP_PIX_CLK_DIV 43
+-#define SMIAPP_LIMIT_MIN_OP_PIX_CLK_FREQ_HZ 44
+-#define SMIAPP_LIMIT_MAX_OP_PIX_CLK_FREQ_HZ 45
+-#define SMIAPP_LIMIT_X_ADDR_MIN 46
+-#define SMIAPP_LIMIT_Y_ADDR_MIN 47
+-#define SMIAPP_LIMIT_X_ADDR_MAX 48
+-#define SMIAPP_LIMIT_Y_ADDR_MAX 49
+-#define SMIAPP_LIMIT_MIN_X_OUTPUT_SIZE 50
+-#define SMIAPP_LIMIT_MIN_Y_OUTPUT_SIZE 51
+-#define SMIAPP_LIMIT_MAX_X_OUTPUT_SIZE 52
+-#define SMIAPP_LIMIT_MAX_Y_OUTPUT_SIZE 53
+-#define SMIAPP_LIMIT_MIN_EVEN_INC 54
+-#define SMIAPP_LIMIT_MAX_EVEN_INC 55
+-#define SMIAPP_LIMIT_MIN_ODD_INC 56
+-#define SMIAPP_LIMIT_MAX_ODD_INC 57
+-#define SMIAPP_LIMIT_SCALING_CAPABILITY 58
+-#define SMIAPP_LIMIT_SCALER_M_MIN 59
+-#define SMIAPP_LIMIT_SCALER_M_MAX 60
+-#define SMIAPP_LIMIT_SCALER_N_MIN 61
+-#define SMIAPP_LIMIT_SCALER_N_MAX 62
+-#define SMIAPP_LIMIT_SPATIAL_SAMPLING_CAPABILITY 63
+-#define SMIAPP_LIMIT_DIGITAL_CROP_CAPABILITY 64
+-#define SMIAPP_LIMIT_COMPRESSION_CAPABILITY 65
+-#define SMIAPP_LIMIT_FIFO_SUPPORT_CAPABILITY 66
+-#define SMIAPP_LIMIT_DPHY_CTRL_CAPABILITY 67
+-#define SMIAPP_LIMIT_CSI_LANE_MODE_CAPABILITY 68
+-#define SMIAPP_LIMIT_CSI_SIGNALLING_MODE_CAPABILITY 69
+-#define SMIAPP_LIMIT_FAST_STANDBY_CAPABILITY 70
+-#define SMIAPP_LIMIT_CCI_ADDRESS_CONTROL_CAPABILITY 71
+-#define SMIAPP_LIMIT_MAX_PER_LANE_BITRATE_1_LANE_MODE_MBPS 72
+-#define SMIAPP_LIMIT_MAX_PER_LANE_BITRATE_2_LANE_MODE_MBPS 73
+-#define SMIAPP_LIMIT_MAX_PER_LANE_BITRATE_3_LANE_MODE_MBPS 74
+-#define SMIAPP_LIMIT_MAX_PER_LANE_BITRATE_4_LANE_MODE_MBPS 75
+-#define SMIAPP_LIMIT_TEMP_SENSOR_CAPABILITY 76
+-#define SMIAPP_LIMIT_MIN_FRAME_LENGTH_LINES_BIN 77
+-#define SMIAPP_LIMIT_MAX_FRAME_LENGTH_LINES_BIN 78
+-#define SMIAPP_LIMIT_MIN_LINE_LENGTH_PCK_BIN 79
+-#define SMIAPP_LIMIT_MAX_LINE_LENGTH_PCK_BIN 80
+-#define SMIAPP_LIMIT_MIN_LINE_BLANKING_PCK_BIN 81
+-#define SMIAPP_LIMIT_FINE_INTEGRATION_TIME_MIN_BIN 82
+-#define SMIAPP_LIMIT_FINE_INTEGRATION_TIME_MAX_MARGIN_BIN 83
+-#define SMIAPP_LIMIT_BINNING_CAPABILITY 84
+-#define SMIAPP_LIMIT_BINNING_WEIGHTING_CAPABILITY 85
+-#define SMIAPP_LIMIT_DATA_TRANSFER_IF_CAPABILITY 86
+-#define SMIAPP_LIMIT_SHADING_CORRECTION_CAPABILITY 87
+-#define SMIAPP_LIMIT_GREEN_IMBALANCE_CAPABILITY 88
+-#define SMIAPP_LIMIT_BLACK_LEVEL_CAPABILITY 89
+-#define SMIAPP_LIMIT_MODULE_SPECIFIC_CORRECTION_CAPABILITY 90
+-#define SMIAPP_LIMIT_DEFECT_CORRECTION_CAPABILITY 91
+-#define SMIAPP_LIMIT_DEFECT_CORRECTION_CAPABILITY_2 92
+-#define SMIAPP_LIMIT_EDOF_CAPABILITY 93
+-#define SMIAPP_LIMIT_COLOUR_FEEDBACK_CAPABILITY 94
+-#define SMIAPP_LIMIT_ESTIMATION_MODE_CAPABILITY 95
+-#define SMIAPP_LIMIT_ESTIMATION_ZONE_CAPABILITY 96
+-#define SMIAPP_LIMIT_CAPABILITY_TRDY_MIN 97
+-#define SMIAPP_LIMIT_FLASH_MODE_CAPABILITY 98
+-#define SMIAPP_LIMIT_ACTUATOR_CAPABILITY 99
+-#define SMIAPP_LIMIT_BRACKETING_LUT_CAPABILITY_1 100
+-#define SMIAPP_LIMIT_BRACKETING_LUT_CAPABILITY_2 101
+-#define SMIAPP_LIMIT_ANALOGUE_GAIN_CODE_STEP 102
+-#define SMIAPP_LIMIT_LAST 103
+diff --git a/drivers/media/i2c/smiapp/smiapp-quirk.c b/drivers/media/i2c/smiapp/smiapp-quirk.c
+index ab96d6067fc35..3251026e030a7 100644
+--- a/drivers/media/i2c/smiapp/smiapp-quirk.c
++++ b/drivers/media/i2c/smiapp/smiapp-quirk.c
+@@ -10,6 +10,8 @@
+
+ #include <linux/delay.h>
+
++#include "ccs-limits.h"
++
+ #include "smiapp.h"
+
+ static int smiapp_write_8(struct smiapp_sensor *sensor, u16 reg, u8 val)
+@@ -36,17 +38,6 @@ static int smiapp_write_8s(struct smiapp_sensor *sensor,
+ return 0;
+ }
+
+-void smiapp_replace_limit(struct smiapp_sensor *sensor,
+- u32 limit, u32 val)
+-{
+- struct i2c_client *client = v4l2_get_subdevdata(&sensor->src->sd);
+-
+- dev_dbg(&client->dev, "quirk: 0x%8.8x \"%s\" = %d, 0x%x\n",
+- smiapp_reg_limits[limit].addr,
+- smiapp_reg_limits[limit].what, val, val);
+- sensor->limits[limit] = val;
+-}
+-
+ static int jt8ew9_limits(struct smiapp_sensor *sensor)
+ {
+ if (sensor->minfo.revision_number_major < 0x03)
+@@ -54,9 +45,8 @@ static int jt8ew9_limits(struct smiapp_sensor *sensor)
+
+ /* Below 24 gain doesn't have effect at all, */
+ /* but ~59 is needed for full dynamic range */
+- smiapp_replace_limit(sensor, SMIAPP_LIMIT_ANALOGUE_GAIN_CODE_MIN, 59);
+- smiapp_replace_limit(
+- sensor, SMIAPP_LIMIT_ANALOGUE_GAIN_CODE_MAX, 6000);
++ ccs_replace_limit(sensor, CCS_L_ANALOG_GAIN_CODE_MIN, 0, 59);
++ ccs_replace_limit(sensor, CCS_L_ANALOG_GAIN_CODE_MAX, 0, 6000);
+
+ return 0;
+ }
+@@ -126,9 +116,8 @@ const struct smiapp_quirk smiapp_imx125es_quirk = {
+
+ static int jt8ev1_limits(struct smiapp_sensor *sensor)
+ {
+- smiapp_replace_limit(sensor, SMIAPP_LIMIT_X_ADDR_MAX, 4271);
+- smiapp_replace_limit(sensor,
+- SMIAPP_LIMIT_MIN_LINE_BLANKING_PCK_BIN, 184);
++ ccs_replace_limit(sensor, CCS_L_X_ADDR_MAX, 0, 4271);
++ ccs_replace_limit(sensor, CCS_L_MIN_LINE_BLANKING_PCK_BIN, 0, 184);
+
+ return 0;
+ }
+@@ -221,7 +210,7 @@ const struct smiapp_quirk smiapp_jt8ev1_quirk = {
+
+ static int tcm8500md_limits(struct smiapp_sensor *sensor)
+ {
+- smiapp_replace_limit(sensor, SMIAPP_LIMIT_MIN_PLL_IP_FREQ_HZ, 2700000);
++ ccs_replace_limit(sensor, CCS_L_MIN_PLL_IP_CLK_FREQ_MHZ, 0, 2700000);
+
+ return 0;
+ }
+diff --git a/drivers/media/i2c/smiapp/smiapp-quirk.h b/drivers/media/i2c/smiapp/smiapp-quirk.h
+index 17505be60c1d4..8a479f17cd19b 100644
+--- a/drivers/media/i2c/smiapp/smiapp-quirk.h
++++ b/drivers/media/i2c/smiapp/smiapp-quirk.h
+@@ -55,9 +55,6 @@ struct smiapp_reg_8 {
+ u8 val;
+ };
+
+-void smiapp_replace_limit(struct smiapp_sensor *sensor,
+- u32 limit, u32 val);
+-
+ #define SMIAPP_MK_QUIRK_REG_8(_reg, _val) \
+ { \
+ .reg = (u16)_reg, \
+diff --git a/drivers/media/i2c/smiapp/smiapp.h b/drivers/media/i2c/smiapp/smiapp.h
+index 6a20f83c3f64a..76c29b7723fb1 100644
+--- a/drivers/media/i2c/smiapp/smiapp.h
++++ b/drivers/media/i2c/smiapp/smiapp.h
+@@ -84,8 +84,6 @@ struct smiapp_hwconfig {
+ struct smiapp_flash_strobe_parms *strobe_setup;
+ };
+
+-#include "smiapp-limits.h"
+-
+ struct smiapp_quirk;
+
+ #define SMIAPP_MODULE_IDENT_FLAG_REV_LE (1 << 0)
+@@ -167,13 +165,6 @@ struct smiapp_module_info {
+ .flags = 0, \
+ .name = _name, }
+
+-struct smiapp_reg_limits {
+- u32 addr;
+- char *what;
+-};
+-
+-extern struct smiapp_reg_limits smiapp_reg_limits[];
+-
+ struct smiapp_csi_data_format {
+ u32 code;
+ u8 width;
+@@ -227,7 +218,6 @@ struct smiapp_sensor {
+ struct regulator *vana;
+ struct clk *ext_clk;
+ struct gpio_desc *xshutdown;
+- u32 limits[SMIAPP_LIMIT_LAST];
+ void *ccs_limits;
+ u8 nbinning_subtypes;
+ struct smiapp_binning_subtype binning_subtypes[SMIAPP_BINNING_SUBTYPES];
+--
+2.42.0
+
--- /dev/null
+From cdd031141f715e84c9bd3954c32dc484b7da30a1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Feb 2020 12:38:42 +0100
+Subject: media: smiapp: Use CCS register flags
+
+From: Sakari Ailus <sakari.ailus@linux.intel.com>
+
+[ Upstream commit 82731a194fc155eb734941bb1f777caea4077ffa ]
+
+Use the CCS register flags instead of the old smia flags. The
+new flags include the register width information that was separate from
+the register flags previously.
+
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Stable-dep-of: 724ff68e968b ("media: ccs: Correctly initialise try compose rectangle")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/smiapp/smiapp-reg-defs.h | 8 ++++----
+ drivers/media/i2c/smiapp/smiapp-regs.c | 20 +++++++++++++-------
+ drivers/media/i2c/smiapp/smiapp-regs.h | 13 ++++---------
+ 3 files changed, 21 insertions(+), 20 deletions(-)
+
+diff --git a/drivers/media/i2c/smiapp/smiapp-reg-defs.h b/drivers/media/i2c/smiapp/smiapp-reg-defs.h
+index 865488befc09c..ec574007908bc 100644
+--- a/drivers/media/i2c/smiapp/smiapp-reg-defs.h
++++ b/drivers/media/i2c/smiapp/smiapp-reg-defs.h
+@@ -7,11 +7,11 @@
+ * Copyright (C) 2011--2012 Nokia Corporation
+ * Contact: Sakari Ailus <sakari.ailus@iki.fi>
+ */
+-#define SMIAPP_REG_MK_U8(r) ((SMIAPP_REG_8BIT << 16) | (r))
+-#define SMIAPP_REG_MK_U16(r) ((SMIAPP_REG_16BIT << 16) | (r))
+-#define SMIAPP_REG_MK_U32(r) ((SMIAPP_REG_32BIT << 16) | (r))
++#define SMIAPP_REG_MK_U8(r) (r)
++#define SMIAPP_REG_MK_U16(r) (CCS_FL_16BIT | (r))
++#define SMIAPP_REG_MK_U32(r) (CCS_FL_32BIT | (r))
+
+-#define SMIAPP_REG_MK_F32(r) (SMIAPP_REG_FLAG_FLOAT | (SMIAPP_REG_32BIT << 16) | (r))
++#define SMIAPP_REG_MK_F32(r) (CCS_FL_FLOAT_IREAL | CCS_FL_32BIT | (r))
+
+ #define SMIAPP_REG_U16_MODEL_ID SMIAPP_REG_MK_U16(0x0000)
+ #define SMIAPP_REG_U8_REVISION_NUMBER_MAJOR SMIAPP_REG_MK_U8(0x0002)
+diff --git a/drivers/media/i2c/smiapp/smiapp-regs.c b/drivers/media/i2c/smiapp/smiapp-regs.c
+index 1b58b7c6c8393..904054d303ba6 100644
+--- a/drivers/media/i2c/smiapp/smiapp-regs.c
++++ b/drivers/media/i2c/smiapp/smiapp-regs.c
+@@ -133,6 +133,16 @@ static int ____smiapp_read_8only(struct smiapp_sensor *sensor, u16 reg,
+ return 0;
+ }
+
++unsigned int ccs_reg_width(u32 reg)
++{
++ if (reg & CCS_FL_16BIT)
++ return sizeof(uint16_t);
++ if (reg & CCS_FL_32BIT)
++ return sizeof(uint32_t);
++
++ return sizeof(uint8_t);
++}
++
+ /*
+ * Read a 8/16/32-bit i2c register. The value is returned in 'val'.
+ * Returns zero if successful, or non-zero otherwise.
+@@ -141,13 +151,9 @@ static int __smiapp_read(struct smiapp_sensor *sensor, u32 reg, u32 *val,
+ bool only8)
+ {
+ struct i2c_client *client = v4l2_get_subdevdata(&sensor->src->sd);
+- u8 len = SMIAPP_REG_WIDTH(reg);
++ unsigned int len = ccs_reg_width(reg);
+ int rval;
+
+- if (len != SMIAPP_REG_8BIT && len != SMIAPP_REG_16BIT
+- && len != SMIAPP_REG_32BIT)
+- return -EINVAL;
+-
+ if (!only8)
+ rval = ____smiapp_read(sensor, SMIAPP_REG_ADDR(reg), len, val);
+ else
+@@ -156,7 +162,7 @@ static int __smiapp_read(struct smiapp_sensor *sensor, u32 reg, u32 *val,
+ if (rval < 0)
+ return rval;
+
+- if (reg & SMIAPP_REG_FLAG_FLOAT)
++ if (reg & CCS_FL_FLOAT_IREAL)
+ *val = float_to_u32_mul_1000000(client, *val);
+
+ return 0;
+@@ -204,7 +210,7 @@ int smiapp_write_no_quirk(struct smiapp_sensor *sensor, u32 reg, u32 val)
+ struct i2c_msg msg;
+ unsigned char data[6];
+ unsigned int retries;
+- u8 len = SMIAPP_REG_WIDTH(reg);
++ unsigned int len = ccs_reg_width(reg);
+ int r;
+
+ if (len > sizeof(data) - 2)
+diff --git a/drivers/media/i2c/smiapp/smiapp-regs.h b/drivers/media/i2c/smiapp/smiapp-regs.h
+index 8fda6ed5668c2..7223f5f891096 100644
+--- a/drivers/media/i2c/smiapp/smiapp-regs.h
++++ b/drivers/media/i2c/smiapp/smiapp-regs.h
+@@ -14,16 +14,9 @@
+ #include <linux/i2c.h>
+ #include <linux/types.h>
+
+-#define SMIAPP_REG_ADDR(reg) ((u16)reg)
+-#define SMIAPP_REG_WIDTH(reg) ((u8)(reg >> 16))
+-#define SMIAPP_REG_FLAGS(reg) ((u8)(reg >> 24))
+-
+-/* Use upper 8 bits of the type field for flags */
+-#define SMIAPP_REG_FLAG_FLOAT (1 << 24)
++#include "ccs-regs.h"
+
+-#define SMIAPP_REG_8BIT 1
+-#define SMIAPP_REG_16BIT 2
+-#define SMIAPP_REG_32BIT 4
++#define SMIAPP_REG_ADDR(reg) ((u16)reg)
+
+ struct smiapp_sensor;
+
+@@ -33,4 +26,6 @@ int smiapp_read_8only(struct smiapp_sensor *sensor, u32 reg, u32 *val);
+ int smiapp_write_no_quirk(struct smiapp_sensor *sensor, u32 reg, u32 val);
+ int smiapp_write(struct smiapp_sensor *sensor, u32 reg, u32 val);
+
++unsigned int ccs_reg_width(u32 reg);
++
+ #endif
+--
+2.42.0
+
--- /dev/null
+From 4d15535316eaa5027af4a7407f5238f350cfe8d2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Feb 2020 10:18:31 +0100
+Subject: media: smiapp: Use CCS registers
+
+From: Sakari Ailus <sakari.ailus@linux.intel.com>
+
+[ Upstream commit 42aab58f456a28a5d4b175e7cf7d43276ed3d06b ]
+
+Switch to CCS standard registers where they exist. The still relevant SMIA
+registers are left as-is and the redundant ones are removed.
+
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Stable-dep-of: 724ff68e968b ("media: ccs: Correctly initialise try compose rectangle")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/smiapp/smiapp-core.c | 272 +++++++++++--------------
+ drivers/media/i2c/smiapp/smiapp.h | 4 +-
+ 2 files changed, 118 insertions(+), 158 deletions(-)
+
+diff --git a/drivers/media/i2c/smiapp/smiapp-core.c b/drivers/media/i2c/smiapp/smiapp-core.c
+index 2c1a135079654..8b8ef6c6d48d4 100644
+--- a/drivers/media/i2c/smiapp/smiapp-core.c
++++ b/drivers/media/i2c/smiapp/smiapp-core.c
+@@ -28,7 +28,6 @@
+ #include <media/v4l2-device.h>
+
+ #include "ccs-limits.h"
+-#include "ccs-regs.h"
+ #include "smiapp.h"
+
+ #define SMIAPP_ALIGN_DIM(dim, flags) \
+@@ -367,40 +366,34 @@ static int smiapp_pll_configure(struct smiapp_sensor *sensor)
+ struct smiapp_pll *pll = &sensor->pll;
+ int rval;
+
+- rval = smiapp_write(
+- sensor, SMIAPP_REG_U16_VT_PIX_CLK_DIV, pll->vt.pix_clk_div);
++ rval = ccs_write(sensor, VT_PIX_CLK_DIV, pll->vt.pix_clk_div);
+ if (rval < 0)
+ return rval;
+
+- rval = smiapp_write(
+- sensor, SMIAPP_REG_U16_VT_SYS_CLK_DIV, pll->vt.sys_clk_div);
++ rval = ccs_write(sensor, VT_SYS_CLK_DIV, pll->vt.sys_clk_div);
+ if (rval < 0)
+ return rval;
+
+- rval = smiapp_write(
+- sensor, SMIAPP_REG_U16_PRE_PLL_CLK_DIV, pll->pre_pll_clk_div);
++ rval = ccs_write(sensor, PRE_PLL_CLK_DIV, pll->pre_pll_clk_div);
+ if (rval < 0)
+ return rval;
+
+- rval = smiapp_write(
+- sensor, SMIAPP_REG_U16_PLL_MULTIPLIER, pll->pll_multiplier);
++ rval = ccs_write(sensor, PLL_MULTIPLIER, pll->pll_multiplier);
+ if (rval < 0)
+ return rval;
+
+ /* Lane op clock ratio does not apply here. */
+- rval = smiapp_write(
+- sensor, SMIAPP_REG_U32_REQUESTED_LINK_BIT_RATE_MBPS,
+- DIV_ROUND_UP(pll->op.sys_clk_freq_hz, 1000000 / 256 / 256));
++ rval = ccs_write(sensor, REQUESTED_LINK_RATE,
++ DIV_ROUND_UP(pll->op.sys_clk_freq_hz,
++ 1000000 / 256 / 256));
+ if (rval < 0 || sensor->minfo.smiapp_profile == SMIAPP_PROFILE_0)
+ return rval;
+
+- rval = smiapp_write(
+- sensor, SMIAPP_REG_U16_OP_PIX_CLK_DIV, pll->op.pix_clk_div);
++ rval = ccs_write(sensor, OP_PIX_CLK_DIV, pll->op.pix_clk_div);
+ if (rval < 0)
+ return rval;
+
+- return smiapp_write(
+- sensor, SMIAPP_REG_U16_OP_SYS_CLK_DIV, pll->op.sys_clk_div);
++ return ccs_write(sensor, OP_SYS_CLK_DIV, pll->op.sys_clk_div);
+ }
+
+ static int smiapp_pll_try(struct smiapp_sensor *sensor,
+@@ -532,10 +525,10 @@ static u32 smiapp_pixel_order(struct smiapp_sensor *sensor)
+
+ if (sensor->hflip) {
+ if (sensor->hflip->val)
+- flip |= SMIAPP_IMAGE_ORIENTATION_HFLIP;
++ flip |= CCS_IMAGE_ORIENTATION_HORIZONTAL_MIRROR;
+
+ if (sensor->vflip->val)
+- flip |= SMIAPP_IMAGE_ORIENTATION_VFLIP;
++ flip |= CCS_IMAGE_ORIENTATION_VERTICAL_FLIP;
+ }
+
+ flip ^= sensor->hvflip_inv_mask;
+@@ -595,10 +588,10 @@ static int smiapp_set_ctrl(struct v4l2_ctrl *ctrl)
+ return -EBUSY;
+
+ if (sensor->hflip->val)
+- orient |= SMIAPP_IMAGE_ORIENTATION_HFLIP;
++ orient |= CCS_IMAGE_ORIENTATION_HORIZONTAL_MIRROR;
+
+ if (sensor->vflip->val)
+- orient |= SMIAPP_IMAGE_ORIENTATION_VFLIP;
++ orient |= CCS_IMAGE_ORIENTATION_VERTICAL_FLIP;
+
+ orient ^= sensor->hvflip_inv_mask;
+
+@@ -643,60 +636,50 @@ static int smiapp_set_ctrl(struct v4l2_ctrl *ctrl)
+
+ switch (ctrl->id) {
+ case V4L2_CID_ANALOGUE_GAIN:
+- rval = smiapp_write(
+- sensor,
+- SMIAPP_REG_U16_ANALOGUE_GAIN_CODE_GLOBAL, ctrl->val);
++ rval = ccs_write(sensor, ANALOG_GAIN_CODE_GLOBAL, ctrl->val);
+
+ break;
+ case V4L2_CID_EXPOSURE:
+- rval = smiapp_write(
+- sensor,
+- SMIAPP_REG_U16_COARSE_INTEGRATION_TIME, ctrl->val);
++ rval = ccs_write(sensor, COARSE_INTEGRATION_TIME, ctrl->val);
+
+ break;
+ case V4L2_CID_HFLIP:
+ case V4L2_CID_VFLIP:
+- rval = smiapp_write(sensor, SMIAPP_REG_U8_IMAGE_ORIENTATION,
+- orient);
++ rval = ccs_write(sensor, IMAGE_ORIENTATION, orient);
+
+ break;
+ case V4L2_CID_VBLANK:
+- rval = smiapp_write(
+- sensor, SMIAPP_REG_U16_FRAME_LENGTH_LINES,
+- sensor->pixel_array->crop[SMIAPP_PA_PAD_SRC].height
+- + ctrl->val);
++ rval = ccs_write(sensor, FRAME_LENGTH_LINES,
++ sensor->pixel_array->crop[
++ SMIAPP_PA_PAD_SRC].height
++ + ctrl->val);
+
+ break;
+ case V4L2_CID_HBLANK:
+- rval = smiapp_write(
+- sensor, SMIAPP_REG_U16_LINE_LENGTH_PCK,
+- sensor->pixel_array->crop[SMIAPP_PA_PAD_SRC].width
+- + ctrl->val);
++ rval = ccs_write(sensor, LINE_LENGTH_PCK,
++ sensor->pixel_array->crop[
++ SMIAPP_PA_PAD_SRC].width
++ + ctrl->val);
+
+ break;
+ case V4L2_CID_TEST_PATTERN:
+- rval = smiapp_write(
+- sensor, SMIAPP_REG_U16_TEST_PATTERN_MODE, ctrl->val);
++ rval = ccs_write(sensor, TEST_PATTERN_MODE, ctrl->val);
+
+ break;
+ case V4L2_CID_TEST_PATTERN_RED:
+- rval = smiapp_write(
+- sensor, SMIAPP_REG_U16_TEST_DATA_RED, ctrl->val);
++ rval = ccs_write(sensor, TEST_DATA_RED, ctrl->val);
+
+ break;
+ case V4L2_CID_TEST_PATTERN_GREENR:
+- rval = smiapp_write(
+- sensor, SMIAPP_REG_U16_TEST_DATA_GREENR, ctrl->val);
++ rval = ccs_write(sensor, TEST_DATA_GREENR, ctrl->val);
+
+ break;
+ case V4L2_CID_TEST_PATTERN_BLUE:
+- rval = smiapp_write(
+- sensor, SMIAPP_REG_U16_TEST_DATA_BLUE, ctrl->val);
++ rval = ccs_write(sensor, TEST_DATA_BLUE, ctrl->val);
+
+ break;
+ case V4L2_CID_TEST_PATTERN_GREENB:
+- rval = smiapp_write(
+- sensor, SMIAPP_REG_U16_TEST_DATA_GREENB, ctrl->val);
++ rval = ccs_write(sensor, TEST_DATA_GREENB, ctrl->val);
+
+ break;
+ case V4L2_CID_PIXEL_RATE:
+@@ -859,8 +842,7 @@ static int smiapp_get_mbus_formats(struct smiapp_sensor *sensor)
+
+ dev_dbg(&client->dev, "data_format_model_type %d\n", type);
+
+- rval = smiapp_read(sensor, SMIAPP_REG_U8_PIXEL_ORDER,
+- &pixel_order);
++ rval = ccs_read(sensor, PIXEL_ORDER, &pixel_order);
+ if (rval)
+ return rval;
+
+@@ -1068,22 +1050,20 @@ static int smiapp_read_nvm_page(struct smiapp_sensor *sensor, u32 p, u8 *nvm,
+
+ *status = 0;
+
+- rval = smiapp_write(sensor,
+- SMIAPP_REG_U8_DATA_TRANSFER_IF_1_PAGE_SELECT, p);
++ rval = ccs_write(sensor, DATA_TRANSFER_IF_1_PAGE_SELECT, p);
+ if (rval)
+ return rval;
+
+- rval = smiapp_write(sensor, SMIAPP_REG_U8_DATA_TRANSFER_IF_1_CTRL,
+- SMIAPP_DATA_TRANSFER_IF_1_CTRL_EN);
++ rval = ccs_write(sensor, DATA_TRANSFER_IF_1_CTRL,
++ CCS_DATA_TRANSFER_IF_1_CTRL_ENABLE);
+ if (rval)
+ return rval;
+
+- rval = smiapp_read(sensor, SMIAPP_REG_U8_DATA_TRANSFER_IF_1_STATUS,
+- &s);
++ rval = ccs_read(sensor, DATA_TRANSFER_IF_1_STATUS, &s);
+ if (rval)
+ return rval;
+
+- if (s & SMIAPP_DATA_TRANSFER_IF_1_STATUS_EUSAGE) {
++ if (s & CCS_DATA_TRANSFER_IF_1_STATUS_IMPROPER_IF_USAGE) {
+ *status = s;
+ return -ENODATA;
+ }
+@@ -1091,14 +1071,10 @@ static int smiapp_read_nvm_page(struct smiapp_sensor *sensor, u32 p, u8 *nvm,
+ if (CCS_LIM(sensor, DATA_TRANSFER_IF_CAPABILITY) &
+ CCS_DATA_TRANSFER_IF_CAPABILITY_POLLING) {
+ for (i = 1000; i > 0; i--) {
+- if (s & SMIAPP_DATA_TRANSFER_IF_1_STATUS_RD_READY)
++ if (s & CCS_DATA_TRANSFER_IF_1_STATUS_READ_IF_READY)
+ break;
+
+- rval = smiapp_read(
+- sensor,
+- SMIAPP_REG_U8_DATA_TRANSFER_IF_1_STATUS,
+- &s);
+-
++ rval = ccs_read(sensor, DATA_TRANSFER_IF_1_STATUS, &s);
+ if (rval)
+ return rval;
+ }
+@@ -1107,12 +1083,10 @@ static int smiapp_read_nvm_page(struct smiapp_sensor *sensor, u32 p, u8 *nvm,
+ return -ETIMEDOUT;
+ }
+
+- for (i = 0; i < SMIAPP_NVM_PAGE_SIZE; i++) {
++ for (i = 0; i <= CCS_LIM_DATA_TRANSFER_IF_1_DATA_MAX_P; i++) {
+ u32 v;
+
+- rval = smiapp_read(sensor,
+- SMIAPP_REG_U8_DATA_TRANSFER_IF_1_DATA_0 + i,
+- &v);
++ rval = ccs_read(sensor, DATA_TRANSFER_IF_1_DATA(i), &v);
+ if (rval)
+ return rval;
+
+@@ -1129,20 +1103,21 @@ static int smiapp_read_nvm(struct smiapp_sensor *sensor, unsigned char *nvm,
+ u32 p;
+ int rval = 0, rval2;
+
+- for (p = 0; p < nvm_size / SMIAPP_NVM_PAGE_SIZE && !rval; p++) {
++ for (p = 0; p < nvm_size / (CCS_LIM_DATA_TRANSFER_IF_1_DATA_MAX_P + 1)
++ && !rval; p++) {
+ rval = smiapp_read_nvm_page(sensor, p, nvm, &status);
+- nvm += SMIAPP_NVM_PAGE_SIZE;
++ nvm += CCS_LIM_DATA_TRANSFER_IF_1_DATA_MAX_P + 1;
+ }
+
+ if (rval == -ENODATA &&
+- status & SMIAPP_DATA_TRANSFER_IF_1_STATUS_EUSAGE)
++ status & CCS_DATA_TRANSFER_IF_1_STATUS_IMPROPER_IF_USAGE)
+ rval = 0;
+
+- rval2 = smiapp_write(sensor, SMIAPP_REG_U8_DATA_TRANSFER_IF_1_CTRL, 0);
++ rval2 = ccs_write(sensor, DATA_TRANSFER_IF_1_CTRL, 0);
+ if (rval < 0)
+ return rval;
+ else
+- return rval2 ?: p * SMIAPP_NVM_PAGE_SIZE;
++ return rval2 ?: p * (CCS_LIM_DATA_TRANSFER_IF_1_DATA_MAX_P + 1);
+ }
+
+ /*
+@@ -1158,16 +1133,15 @@ static int smiapp_change_cci_addr(struct smiapp_sensor *sensor)
+
+ client->addr = sensor->hwcfg->i2c_addr_dfl;
+
+- rval = smiapp_write(sensor,
+- SMIAPP_REG_U8_CCI_ADDRESS_CONTROL,
+- sensor->hwcfg->i2c_addr_alt << 1);
++ rval = ccs_write(sensor, CCI_ADDRESS_CTRL,
++ sensor->hwcfg->i2c_addr_alt << 1);
+ if (rval)
+ return rval;
+
+ client->addr = sensor->hwcfg->i2c_addr_alt;
+
+ /* verify addr change went ok */
+- rval = smiapp_read(sensor, SMIAPP_REG_U8_CCI_ADDRESS_CONTROL, &val);
++ rval = ccs_read(sensor, CCI_ADDRESS_CTRL, &val);
+ if (rval)
+ return rval;
+
+@@ -1273,34 +1247,30 @@ static int smiapp_setup_flash_strobe(struct smiapp_sensor *sensor)
+ strobe_width_high_rs = (tmp + strobe_adjustment - 1) /
+ strobe_adjustment;
+
+- rval = smiapp_write(sensor, SMIAPP_REG_U8_FLASH_MODE_RS,
+- strobe_setup->mode);
++ rval = ccs_write(sensor, FLASH_MODE_RS, strobe_setup->mode);
+ if (rval < 0)
+ goto out;
+
+- rval = smiapp_write(sensor, SMIAPP_REG_U8_FLASH_STROBE_ADJUSTMENT,
+- strobe_adjustment);
++ rval = ccs_write(sensor, FLASH_STROBE_ADJUSTMENT, strobe_adjustment);
+ if (rval < 0)
+ goto out;
+
+- rval = smiapp_write(
+- sensor, SMIAPP_REG_U16_TFLASH_STROBE_WIDTH_HIGH_RS_CTRL,
+- strobe_width_high_rs);
++ rval = ccs_write(sensor, TFLASH_STROBE_WIDTH_HIGH_RS_CTRL,
++ strobe_width_high_rs);
+ if (rval < 0)
+ goto out;
+
+- rval = smiapp_write(sensor, SMIAPP_REG_U16_TFLASH_STROBE_DELAY_RS_CTRL,
+- strobe_setup->strobe_delay);
++ rval = ccs_write(sensor, TFLASH_STROBE_DELAY_RS_CTRL,
++ strobe_setup->strobe_delay);
+ if (rval < 0)
+ goto out;
+
+- rval = smiapp_write(sensor, SMIAPP_REG_U16_FLASH_STROBE_START_POINT,
+- strobe_setup->stobe_start_point);
++ rval = ccs_write(sensor, FLASH_STROBE_START_POINT,
++ strobe_setup->stobe_start_point);
+ if (rval < 0)
+ goto out;
+
+- rval = smiapp_write(sensor, SMIAPP_REG_U8_FLASH_TRIGGER_RS,
+- strobe_setup->trigger);
++ rval = ccs_write(sensor, FLASH_TRIGGER_RS, strobe_setup->trigger);
+
+ out:
+ sensor->hwcfg->strobe_setup->trigger = 0;
+@@ -1363,8 +1333,7 @@ static int smiapp_power_on(struct device *dev)
+ }
+ }
+
+- rval = smiapp_write(sensor, SMIAPP_REG_U8_SOFTWARE_RESET,
+- SMIAPP_SOFTWARE_RESET);
++ rval = ccs_write(sensor, SOFTWARE_RESET, CCS_SOFTWARE_RESET_ON);
+ if (rval < 0) {
+ dev_err(dev, "software reset failed\n");
+ goto out_cci_addr_fail;
+@@ -1378,45 +1347,42 @@ static int smiapp_power_on(struct device *dev)
+ }
+ }
+
+- rval = smiapp_write(sensor, SMIAPP_REG_U16_COMPRESSION_MODE,
+- SMIAPP_COMPRESSION_MODE_SIMPLE_PREDICTOR);
++ rval = ccs_write(sensor, COMPRESSION_MODE,
++ CCS_COMPRESSION_MODE_DPCM_PCM_SIMPLE);
+ if (rval) {
+ dev_err(dev, "compression mode set failed\n");
+ goto out_cci_addr_fail;
+ }
+
+- rval = smiapp_write(
+- sensor, SMIAPP_REG_U16_EXTCLK_FREQUENCY_MHZ,
+- sensor->hwcfg->ext_clk / (1000000 / (1 << 8)));
++ rval = ccs_write(sensor, EXTCLK_FREQUENCY_MHZ,
++ sensor->hwcfg->ext_clk / (1000000 / (1 << 8)));
+ if (rval) {
+ dev_err(dev, "extclk frequency set failed\n");
+ goto out_cci_addr_fail;
+ }
+
+- rval = smiapp_write(sensor, SMIAPP_REG_U8_CSI_LANE_MODE,
+- sensor->hwcfg->lanes - 1);
++ rval = ccs_write(sensor, CSI_LANE_MODE, sensor->hwcfg->lanes - 1);
+ if (rval) {
+ dev_err(dev, "csi lane mode set failed\n");
+ goto out_cci_addr_fail;
+ }
+
+- rval = smiapp_write(sensor, SMIAPP_REG_U8_FAST_STANDBY_CTRL,
+- SMIAPP_FAST_STANDBY_CTRL_IMMEDIATE);
++ rval = ccs_write(sensor, FAST_STANDBY_CTRL,
++ CCS_FAST_STANDBY_CTRL_FRAME_TRUNCATION);
+ if (rval) {
+ dev_err(dev, "fast standby set failed\n");
+ goto out_cci_addr_fail;
+ }
+
+- rval = smiapp_write(sensor, SMIAPP_REG_U8_CSI_SIGNALLING_MODE,
+- sensor->hwcfg->csi_signalling_mode);
++ rval = ccs_write(sensor, CSI_SIGNALING_MODE,
++ sensor->hwcfg->csi_signalling_mode);
+ if (rval) {
+ dev_err(dev, "csi signalling mode set failed\n");
+ goto out_cci_addr_fail;
+ }
+
+ /* DPHY control done by sensor based on requested link rate */
+- rval = smiapp_write(sensor, SMIAPP_REG_U8_DPHY_CTRL,
+- SMIAPP_DPHY_CTRL_UI);
++ rval = ccs_write(sensor, PHY_CTRL, CCS_PHY_CTRL_UI);
+ if (rval < 0)
+ goto out_cci_addr_fail;
+
+@@ -1453,9 +1419,7 @@ static int smiapp_power_off(struct device *dev)
+ * will fail. So do a soft reset explicitly here.
+ */
+ if (sensor->hwcfg->i2c_addr_alt)
+- smiapp_write(sensor,
+- SMIAPP_REG_U8_SOFTWARE_RESET,
+- SMIAPP_SOFTWARE_RESET);
++ ccs_write(sensor, SOFTWARE_RESET, CCS_SOFTWARE_RESET_ON);
+
+ gpiod_set_value(sensor->xshutdown, 0);
+ clk_disable_unprepare(sensor->ext_clk);
+@@ -1478,9 +1442,9 @@ static int smiapp_start_streaming(struct smiapp_sensor *sensor)
+
+ mutex_lock(&sensor->mutex);
+
+- rval = smiapp_write(sensor, SMIAPP_REG_U16_CSI_DATA_FORMAT,
+- (sensor->csi_format->width << 8) |
+- sensor->csi_format->compressed);
++ rval = ccs_write(sensor, CSI_DATA_FORMAT,
++ (sensor->csi_format->width << 8) |
++ sensor->csi_format->compressed);
+ if (rval)
+ goto out;
+
+@@ -1493,14 +1457,13 @@ static int smiapp_start_streaming(struct smiapp_sensor *sensor)
+ (sensor->binning_horizontal << 4)
+ | sensor->binning_vertical;
+
+- rval = smiapp_write(
+- sensor, SMIAPP_REG_U8_BINNING_TYPE, binning_type);
++ rval = ccs_write(sensor, BINNING_TYPE, binning_type);
+ if (rval < 0)
+ goto out;
+
+ binning_mode = 1;
+ }
+- rval = smiapp_write(sensor, SMIAPP_REG_U8_BINNING_MODE, binning_mode);
++ rval = ccs_write(sensor, BINNING_MODE, binning_mode);
+ if (rval < 0)
+ goto out;
+
+@@ -1510,26 +1473,26 @@ static int smiapp_start_streaming(struct smiapp_sensor *sensor)
+ goto out;
+
+ /* Analog crop start coordinates */
+- rval = smiapp_write(sensor, SMIAPP_REG_U16_X_ADDR_START,
+- sensor->pixel_array->crop[SMIAPP_PA_PAD_SRC].left);
++ rval = ccs_write(sensor, X_ADDR_START,
++ sensor->pixel_array->crop[SMIAPP_PA_PAD_SRC].left);
+ if (rval < 0)
+ goto out;
+
+- rval = smiapp_write(sensor, SMIAPP_REG_U16_Y_ADDR_START,
+- sensor->pixel_array->crop[SMIAPP_PA_PAD_SRC].top);
++ rval = ccs_write(sensor, Y_ADDR_START,
++ sensor->pixel_array->crop[SMIAPP_PA_PAD_SRC].top);
+ if (rval < 0)
+ goto out;
+
+ /* Analog crop end coordinates */
+- rval = smiapp_write(
+- sensor, SMIAPP_REG_U16_X_ADDR_END,
++ rval = ccs_write(
++ sensor, X_ADDR_END,
+ sensor->pixel_array->crop[SMIAPP_PA_PAD_SRC].left
+ + sensor->pixel_array->crop[SMIAPP_PA_PAD_SRC].width - 1);
+ if (rval < 0)
+ goto out;
+
+- rval = smiapp_write(
+- sensor, SMIAPP_REG_U16_Y_ADDR_END,
++ rval = ccs_write(
++ sensor, Y_ADDR_END,
+ sensor->pixel_array->crop[SMIAPP_PA_PAD_SRC].top
+ + sensor->pixel_array->crop[SMIAPP_PA_PAD_SRC].height - 1);
+ if (rval < 0)
+@@ -1543,26 +1506,26 @@ static int smiapp_start_streaming(struct smiapp_sensor *sensor)
+ /* Digital crop */
+ if (CCS_LIM(sensor, DIGITAL_CROP_CAPABILITY)
+ == CCS_DIGITAL_CROP_CAPABILITY_INPUT_CROP) {
+- rval = smiapp_write(
+- sensor, SMIAPP_REG_U16_DIGITAL_CROP_X_OFFSET,
++ rval = ccs_write(
++ sensor, DIGITAL_CROP_X_OFFSET,
+ sensor->scaler->crop[SMIAPP_PAD_SINK].left);
+ if (rval < 0)
+ goto out;
+
+- rval = smiapp_write(
+- sensor, SMIAPP_REG_U16_DIGITAL_CROP_Y_OFFSET,
++ rval = ccs_write(
++ sensor, DIGITAL_CROP_Y_OFFSET,
+ sensor->scaler->crop[SMIAPP_PAD_SINK].top);
+ if (rval < 0)
+ goto out;
+
+- rval = smiapp_write(
+- sensor, SMIAPP_REG_U16_DIGITAL_CROP_IMAGE_WIDTH,
++ rval = ccs_write(
++ sensor, DIGITAL_CROP_IMAGE_WIDTH,
+ sensor->scaler->crop[SMIAPP_PAD_SINK].width);
+ if (rval < 0)
+ goto out;
+
+- rval = smiapp_write(
+- sensor, SMIAPP_REG_U16_DIGITAL_CROP_IMAGE_HEIGHT,
++ rval = ccs_write(
++ sensor, DIGITAL_CROP_IMAGE_HEIGHT,
+ sensor->scaler->crop[SMIAPP_PAD_SINK].height);
+ if (rval < 0)
+ goto out;
+@@ -1571,24 +1534,22 @@ static int smiapp_start_streaming(struct smiapp_sensor *sensor)
+ /* Scaling */
+ if (CCS_LIM(sensor, SCALING_CAPABILITY)
+ != CCS_SCALING_CAPABILITY_NONE) {
+- rval = smiapp_write(sensor, SMIAPP_REG_U16_SCALING_MODE,
+- sensor->scaling_mode);
++ rval = ccs_write(sensor, SCALING_MODE, sensor->scaling_mode);
+ if (rval < 0)
+ goto out;
+
+- rval = smiapp_write(sensor, SMIAPP_REG_U16_SCALE_M,
+- sensor->scale_m);
++ rval = ccs_write(sensor, SCALE_M, sensor->scale_m);
+ if (rval < 0)
+ goto out;
+ }
+
+ /* Output size from sensor */
+- rval = smiapp_write(sensor, SMIAPP_REG_U16_X_OUTPUT_SIZE,
+- sensor->src->crop[SMIAPP_PAD_SRC].width);
++ rval = ccs_write(sensor, X_OUTPUT_SIZE,
++ sensor->src->crop[SMIAPP_PAD_SRC].width);
+ if (rval < 0)
+ goto out;
+- rval = smiapp_write(sensor, SMIAPP_REG_U16_Y_OUTPUT_SIZE,
+- sensor->src->crop[SMIAPP_PAD_SRC].height);
++ rval = ccs_write(sensor, Y_OUTPUT_SIZE,
++ sensor->src->crop[SMIAPP_PAD_SRC].height);
+ if (rval < 0)
+ goto out;
+
+@@ -1608,8 +1569,7 @@ static int smiapp_start_streaming(struct smiapp_sensor *sensor)
+ goto out;
+ }
+
+- rval = smiapp_write(sensor, SMIAPP_REG_U8_MODE_SELECT,
+- SMIAPP_MODE_SELECT_STREAMING);
++ rval = ccs_write(sensor, MODE_SELECT, CCS_MODE_SELECT_STREAMING);
+
+ out:
+ mutex_unlock(&sensor->mutex);
+@@ -1623,8 +1583,7 @@ static int smiapp_stop_streaming(struct smiapp_sensor *sensor)
+ int rval;
+
+ mutex_lock(&sensor->mutex);
+- rval = smiapp_write(sensor, SMIAPP_REG_U8_MODE_SELECT,
+- SMIAPP_MODE_SELECT_SOFTWARE_STANDBY);
++ rval = ccs_write(sensor, MODE_SELECT, CCS_MODE_SELECT_SOFTWARE_STANDBY);
+ if (rval)
+ goto out;
+
+@@ -1842,7 +1801,7 @@ static void smiapp_propagate(struct v4l2_subdev *subdev,
+ sensor->scale_m =
+ CCS_LIM(sensor, SCALER_N_MIN);
+ sensor->scaling_mode =
+- SMIAPP_SCALING_MODE_NONE;
++ CCS_SCALING_MODE_NO_SCALING;
+ } else if (ssd == sensor->binner) {
+ sensor->binning_horizontal = 1;
+ sensor->binning_vertical = 1;
+@@ -2077,7 +2036,7 @@ static void smiapp_set_compose_scaler(struct v4l2_subdev *subdev,
+ struct smiapp_sensor *sensor = to_smiapp_sensor(subdev);
+ u32 min, max, a, b, max_m;
+ u32 scale_m = CCS_LIM(sensor, SCALER_N_MIN);
+- int mode = SMIAPP_SCALING_MODE_HORIZONTAL;
++ int mode = CCS_SCALING_MODE_HORIZONTAL;
+ u32 try[4];
+ u32 ntry = 0;
+ unsigned int i;
+@@ -2137,7 +2096,7 @@ static void smiapp_set_compose_scaler(struct v4l2_subdev *subdev,
+
+ if (this > best) {
+ scale_m = try[i];
+- mode = SMIAPP_SCALING_MODE_HORIZONTAL;
++ mode = CCS_SCALING_MODE_HORIZONTAL;
+ best = this;
+ }
+
+@@ -2508,26 +2467,24 @@ static int smiapp_identify_module(struct smiapp_sensor *sensor)
+ rval = smiapp_read_8only(sensor, SMIAPP_REG_U8_MANUFACTURER_ID,
+ &minfo->smia_manufacturer_id);
+ if (!rval)
+- rval = smiapp_read_8only(sensor, SMIAPP_REG_U16_MODEL_ID,
++ rval = smiapp_read_8only(sensor, CCS_R_MODULE_MODEL_ID,
+ &minfo->model_id);
+ if (!rval)
+ rval = smiapp_read_8only(sensor,
+- SMIAPP_REG_U8_REVISION_NUMBER_MAJOR,
++ CCS_R_MODULE_REVISION_NUMBER_MAJOR,
+ &minfo->revision_number_major);
+ if (!rval)
+ rval = smiapp_read_8only(sensor,
+- SMIAPP_REG_U8_REVISION_NUMBER_MINOR,
++ CCS_R_MODULE_REVISION_NUMBER_MINOR,
+ &minfo->revision_number_minor);
+ if (!rval)
+- rval = smiapp_read_8only(sensor,
+- SMIAPP_REG_U8_MODULE_DATE_YEAR,
++ rval = smiapp_read_8only(sensor, CCS_R_MODULE_DATE_YEAR,
+ &minfo->module_year);
+ if (!rval)
+- rval = smiapp_read_8only(sensor,
+- SMIAPP_REG_U8_MODULE_DATE_MONTH,
++ rval = smiapp_read_8only(sensor, CCS_R_MODULE_DATE_MONTH,
+ &minfo->module_month);
+ if (!rval)
+- rval = smiapp_read_8only(sensor, SMIAPP_REG_U8_MODULE_DATE_DAY,
++ rval = smiapp_read_8only(sensor, CCS_R_MODULE_DATE_DAY,
+ &minfo->module_day);
+
+ /* Sensor info */
+@@ -2536,19 +2493,19 @@ static int smiapp_identify_module(struct smiapp_sensor *sensor)
+ &minfo->sensor_mipi_manufacturer_id);
+ if (!rval && !minfo->sensor_mipi_manufacturer_id)
+ rval = smiapp_read_8only(sensor,
+- SMIAPP_REG_U8_SENSOR_MANUFACTURER_ID,
++ CCS_R_SENSOR_MANUFACTURER_ID,
+ &minfo->sensor_smia_manufacturer_id);
+ if (!rval)
+ rval = smiapp_read_8only(sensor,
+- SMIAPP_REG_U16_SENSOR_MODEL_ID,
++ CCS_R_SENSOR_MODEL_ID,
+ &minfo->sensor_model_id);
+ if (!rval)
+ rval = smiapp_read_8only(sensor,
+- SMIAPP_REG_U8_SENSOR_REVISION_NUMBER,
++ CCS_R_SENSOR_REVISION_NUMBER,
+ &minfo->sensor_revision_number);
+ if (!rval)
+ rval = smiapp_read_8only(sensor,
+- SMIAPP_REG_U8_SENSOR_FIRMWARE_VERSION,
++ CCS_R_SENSOR_FIRMWARE_VERSION,
+ &minfo->sensor_firmware_version);
+
+ /* SMIA */
+@@ -2933,7 +2890,7 @@ static struct smiapp_hwconfig *smiapp_get_hwconfig(struct device *dev)
+
+ switch (bus_cfg.bus_type) {
+ case V4L2_MBUS_CSI2_DPHY:
+- hwcfg->csi_signalling_mode = SMIAPP_CSI_SIGNALLING_MODE_CSI2;
++ hwcfg->csi_signalling_mode = CCS_CSI_SIGNALING_MODE_CSI_2_DPHY;
+ hwcfg->lanes = bus_cfg.bus.mipi_csi2.num_data_lanes;
+ break;
+ case V4L2_MBUS_CCP2:
+@@ -3109,8 +3066,9 @@ static int smiapp_probe(struct i2c_client *client)
+ */
+ if (sensor->hwcfg->module_board_orient ==
+ SMIAPP_MODULE_BOARD_ORIENT_180)
+- sensor->hvflip_inv_mask = SMIAPP_IMAGE_ORIENTATION_HFLIP |
+- SMIAPP_IMAGE_ORIENTATION_VFLIP;
++ sensor->hvflip_inv_mask =
++ CCS_IMAGE_ORIENTATION_HORIZONTAL_MIRROR |
++ CCS_IMAGE_ORIENTATION_VERTICAL_FLIP;
+
+ rval = smiapp_call_quirk(sensor, limits);
+ if (rval) {
+diff --git a/drivers/media/i2c/smiapp/smiapp.h b/drivers/media/i2c/smiapp/smiapp.h
+index 76c29b7723fb1..3b607a2b4ca79 100644
+--- a/drivers/media/i2c/smiapp/smiapp.h
++++ b/drivers/media/i2c/smiapp/smiapp.h
+@@ -15,6 +15,8 @@
+ #include <media/v4l2-ctrls.h>
+ #include <media/v4l2-subdev.h>
+
++#include "ccs-regs.h"
++
+ #include "smiapp-pll.h"
+ #include "smiapp-reg.h"
+ #include "smiapp-regs.h"
+@@ -220,7 +222,7 @@ struct smiapp_sensor {
+ struct gpio_desc *xshutdown;
+ void *ccs_limits;
+ u8 nbinning_subtypes;
+- struct smiapp_binning_subtype binning_subtypes[SMIAPP_BINNING_SUBTYPES];
++ struct smiapp_binning_subtype binning_subtypes[CCS_LIM_BINNING_SUB_TYPE_MAX_N + 1];
+ u32 mbus_frame_fmts;
+ const struct smiapp_csi_data_format *csi_format;
+ const struct smiapp_csi_data_format *internal_csi_format;
+--
+2.42.0
+
--- /dev/null
+From 340436e3503871d105f5e2060c0809f55293d6ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Feb 2020 15:54:53 +0100
+Subject: media: smiapp: Use MIPI CCS version and manufacturer ID information
+
+From: Sakari Ailus <sakari.ailus@linux.intel.com>
+
+[ Upstream commit 503a88422fb0fc021b22b276f5d906eb9e7fce6e ]
+
+Read MIPI CCS manufacturer and version information, and use the CCS IDs
+over SMIA whenever they are set.
+
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Stable-dep-of: 724ff68e968b ("media: ccs: Correctly initialise try compose rectangle")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/smiapp/smiapp-core.c | 76 +++++++++++++++++++-------
+ drivers/media/i2c/smiapp/smiapp.h | 20 ++++---
+ 2 files changed, 68 insertions(+), 28 deletions(-)
+
+diff --git a/drivers/media/i2c/smiapp/smiapp-core.c b/drivers/media/i2c/smiapp/smiapp-core.c
+index 75862e7647f87..bc9c80221d2fb 100644
+--- a/drivers/media/i2c/smiapp/smiapp-core.c
++++ b/drivers/media/i2c/smiapp/smiapp-core.c
+@@ -2356,9 +2356,14 @@ smiapp_sysfs_ident_read(struct device *dev, struct device_attribute *attr,
+ struct smiapp_sensor *sensor = to_smiapp_sensor(subdev);
+ struct smiapp_module_info *minfo = &sensor->minfo;
+
+- return snprintf(buf, PAGE_SIZE, "%2.2x%4.4x%2.2x\n",
+- minfo->manufacturer_id, minfo->model_id,
+- minfo->revision_number_major) + 1;
++ if (minfo->mipi_manufacturer_id)
++ return snprintf(buf, PAGE_SIZE, "%4.4x%4.4x%2.2x\n",
++ minfo->mipi_manufacturer_id, minfo->model_id,
++ minfo->revision_number_major) + 1;
++ else
++ return snprintf(buf, PAGE_SIZE, "%2.2x%4.4x%2.2x\n",
++ minfo->smia_manufacturer_id, minfo->model_id,
++ minfo->revision_number_major) + 1;
+ }
+
+ static DEVICE_ATTR(ident, S_IRUGO, smiapp_sysfs_ident_read, NULL);
+@@ -2377,8 +2382,11 @@ static int smiapp_identify_module(struct smiapp_sensor *sensor)
+ minfo->name = SMIAPP_NAME;
+
+ /* Module info */
+- rval = smiapp_read_8only(sensor, SMIAPP_REG_U8_MANUFACTURER_ID,
+- &minfo->manufacturer_id);
++ rval = ccs_read(sensor, MODULE_MANUFACTURER_ID,
++ &minfo->mipi_manufacturer_id);
++ if (!rval && !minfo->mipi_manufacturer_id)
++ rval = smiapp_read_8only(sensor, SMIAPP_REG_U8_MANUFACTURER_ID,
++ &minfo->smia_manufacturer_id);
+ if (!rval)
+ rval = smiapp_read_8only(sensor, SMIAPP_REG_U16_MODEL_ID,
+ &minfo->model_id);
+@@ -2404,9 +2412,12 @@ static int smiapp_identify_module(struct smiapp_sensor *sensor)
+
+ /* Sensor info */
+ if (!rval)
++ rval = ccs_read(sensor, SENSOR_MANUFACTURER_ID,
++ &minfo->sensor_mipi_manufacturer_id);
++ if (!rval && !minfo->sensor_mipi_manufacturer_id)
+ rval = smiapp_read_8only(sensor,
+ SMIAPP_REG_U8_SENSOR_MANUFACTURER_ID,
+- &minfo->sensor_manufacturer_id);
++ &minfo->sensor_smia_manufacturer_id);
+ if (!rval)
+ rval = smiapp_read_8only(sensor,
+ SMIAPP_REG_U16_SENSOR_MODEL_ID,
+@@ -2422,9 +2433,11 @@ static int smiapp_identify_module(struct smiapp_sensor *sensor)
+
+ /* SMIA */
+ if (!rval)
++ rval = ccs_read(sensor, MIPI_CCS_VERSION, &minfo->ccs_version);
++ if (!rval && !minfo->ccs_version)
+ rval = smiapp_read_8only(sensor, SMIAPP_REG_U8_SMIA_VERSION,
+ &minfo->smia_version);
+- if (!rval)
++ if (!rval && !minfo->ccs_version)
+ rval = smiapp_read_8only(sensor, SMIAPP_REG_U8_SMIAPP_VERSION,
+ &minfo->smiapp_version);
+
+@@ -2433,38 +2446,62 @@ static int smiapp_identify_module(struct smiapp_sensor *sensor)
+ return -ENODEV;
+ }
+
+- dev_dbg(&client->dev, "module 0x%2.2x-0x%4.4x\n",
+- minfo->manufacturer_id, minfo->model_id);
++ if (minfo->mipi_manufacturer_id)
++ dev_dbg(&client->dev, "MIPI CCS module 0x%4.4x-0x%4.4x\n",
++ minfo->mipi_manufacturer_id, minfo->model_id);
++ else
++ dev_dbg(&client->dev, "SMIA module 0x%2.2x-0x%4.4x\n",
++ minfo->smia_manufacturer_id, minfo->model_id);
+
+ dev_dbg(&client->dev,
+ "module revision 0x%2.2x-0x%2.2x date %2.2d-%2.2d-%2.2d\n",
+ minfo->revision_number_major, minfo->revision_number_minor,
+ minfo->module_year, minfo->module_month, minfo->module_day);
+
+- dev_dbg(&client->dev, "sensor 0x%2.2x-0x%4.4x\n",
+- minfo->sensor_manufacturer_id, minfo->sensor_model_id);
++ if (minfo->sensor_mipi_manufacturer_id)
++ dev_dbg(&client->dev, "MIPI CCS sensor 0x%4.4x-0x%4.4x\n",
++ minfo->sensor_mipi_manufacturer_id,
++ minfo->sensor_model_id);
++ else
++ dev_dbg(&client->dev, "SMIA sensor 0x%2.2x-0x%4.4x\n",
++ minfo->sensor_smia_manufacturer_id,
++ minfo->sensor_model_id);
+
+ dev_dbg(&client->dev,
+ "sensor revision 0x%2.2x firmware version 0x%2.2x\n",
+ minfo->sensor_revision_number, minfo->sensor_firmware_version);
+
+- dev_dbg(&client->dev, "smia version %2.2d smiapp version %2.2d\n",
+- minfo->smia_version, minfo->smiapp_version);
++ if (minfo->ccs_version)
++ dev_dbg(&client->dev, "MIPI CCS version %u.%u",
++ (minfo->ccs_version & CCS_MIPI_CCS_VERSION_MAJOR_MASK)
++ >> CCS_MIPI_CCS_VERSION_MAJOR_SHIFT,
++ (minfo->ccs_version & CCS_MIPI_CCS_VERSION_MINOR_MASK));
++ else
++ dev_dbg(&client->dev,
++ "smia version %2.2d smiapp version %2.2d\n",
++ minfo->smia_version, minfo->smiapp_version);
+
+ /*
+ * Some modules have bad data in the lvalues below. Hope the
+ * rvalues have better stuff. The lvalues are module
+ * parameters whereas the rvalues are sensor parameters.
+ */
+- if (!minfo->manufacturer_id && !minfo->model_id) {
+- minfo->manufacturer_id = minfo->sensor_manufacturer_id;
++ if (minfo->sensor_smia_manufacturer_id &&
++ !minfo->smia_manufacturer_id && !minfo->model_id) {
++ minfo->smia_manufacturer_id =
++ minfo->sensor_smia_manufacturer_id;
+ minfo->model_id = minfo->sensor_model_id;
+ minfo->revision_number_major = minfo->sensor_revision_number;
+ }
+
+ for (i = 0; i < ARRAY_SIZE(smiapp_module_idents); i++) {
+- if (smiapp_module_idents[i].manufacturer_id
+- != minfo->manufacturer_id)
++ if (smiapp_module_idents[i].mipi_manufacturer_id &&
++ smiapp_module_idents[i].mipi_manufacturer_id
++ != minfo->mipi_manufacturer_id)
++ continue;
++ if (smiapp_module_idents[i].smia_manufacturer_id &&
++ smiapp_module_idents[i].smia_manufacturer_id
++ != minfo->smia_manufacturer_id)
+ continue;
+ if (smiapp_module_idents[i].model_id != minfo->model_id)
+ continue;
+@@ -2488,9 +2525,8 @@ static int smiapp_identify_module(struct smiapp_sensor *sensor)
+ dev_warn(&client->dev,
+ "no quirks for this module; let's hope it's fully compliant\n");
+
+- dev_dbg(&client->dev, "the sensor is called %s, ident %2.2x%4.4x%2.2x\n",
+- minfo->name, minfo->manufacturer_id, minfo->model_id,
+- minfo->revision_number_major);
++ dev_dbg(&client->dev, "the sensor is called %s\n",
++ minfo->name);
+
+ return 0;
+ }
+diff --git a/drivers/media/i2c/smiapp/smiapp.h b/drivers/media/i2c/smiapp/smiapp.h
+index 6f469934f9e36..27643b36cd92b 100644
+--- a/drivers/media/i2c/smiapp/smiapp.h
++++ b/drivers/media/i2c/smiapp/smiapp.h
+@@ -91,8 +91,9 @@ struct smiapp_quirk;
+ #define SMIAPP_MODULE_IDENT_FLAG_REV_LE (1 << 0)
+
+ struct smiapp_module_ident {
+- u8 manufacturer_id;
++ u16 mipi_manufacturer_id;
+ u16 model_id;
++ u8 smia_manufacturer_id;
+ u8 revision_number_major;
+
+ u8 flags;
+@@ -102,7 +103,8 @@ struct smiapp_module_ident {
+ };
+
+ struct smiapp_module_info {
+- u32 manufacturer_id;
++ u32 smia_manufacturer_id;
++ u32 mipi_manufacturer_id;
+ u32 model_id;
+ u32 revision_number_major;
+ u32 revision_number_minor;
+@@ -111,13 +113,15 @@ struct smiapp_module_info {
+ u32 module_month;
+ u32 module_day;
+
+- u32 sensor_manufacturer_id;
++ u32 sensor_smia_manufacturer_id;
++ u32 sensor_mipi_manufacturer_id;
+ u32 sensor_model_id;
+ u32 sensor_revision_number;
+ u32 sensor_firmware_version;
+
+ u32 smia_version;
+ u32 smiapp_version;
++ u32 ccs_version;
+
+ u32 smiapp_profile;
+
+@@ -126,7 +130,7 @@ struct smiapp_module_info {
+ };
+
+ #define SMIAPP_IDENT_FQ(manufacturer, model, rev, fl, _name, _quirk) \
+- { .manufacturer_id = manufacturer, \
++ { .smia_manufacturer_id = manufacturer, \
+ .model_id = model, \
+ .revision_number_major = rev, \
+ .flags = fl, \
+@@ -134,7 +138,7 @@ struct smiapp_module_info {
+ .quirk = _quirk, }
+
+ #define SMIAPP_IDENT_LQ(manufacturer, model, rev, _name, _quirk) \
+- { .manufacturer_id = manufacturer, \
++ { .smia_manufacturer_id = manufacturer, \
+ .model_id = model, \
+ .revision_number_major = rev, \
+ .flags = SMIAPP_MODULE_IDENT_FLAG_REV_LE, \
+@@ -142,14 +146,14 @@ struct smiapp_module_info {
+ .quirk = _quirk, }
+
+ #define SMIAPP_IDENT_L(manufacturer, model, rev, _name) \
+- { .manufacturer_id = manufacturer, \
++ { .smia_manufacturer_id = manufacturer, \
+ .model_id = model, \
+ .revision_number_major = rev, \
+ .flags = SMIAPP_MODULE_IDENT_FLAG_REV_LE, \
+ .name = _name, }
+
+ #define SMIAPP_IDENT_Q(manufacturer, model, rev, _name, _quirk) \
+- { .manufacturer_id = manufacturer, \
++ { .smia_manufacturer_id = manufacturer, \
+ .model_id = model, \
+ .revision_number_major = rev, \
+ .flags = 0, \
+@@ -157,7 +161,7 @@ struct smiapp_module_info {
+ .quirk = _quirk, }
+
+ #define SMIAPP_IDENT(manufacturer, model, rev, _name) \
+- { .manufacturer_id = manufacturer, \
++ { .smia_manufacturer_id = manufacturer, \
+ .model_id = model, \
+ .revision_number_major = rev, \
+ .flags = 0, \
+--
+2.42.0
+
--- /dev/null
+From 51c954e48c09e13352ebb5cab8b809482fb4c65e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Oct 2023 16:54:34 +0800
+Subject: MIPS: KVM: Fix a build warning about variable set but not used
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Huacai Chen <chenhuacai@loongson.cn>
+
+[ Upstream commit 83767a67e7b6a0291cde5681ec7e3708f3f8f877 ]
+
+After commit 411740f5422a ("KVM: MIPS/MMU: Implement KVM_CAP_SYNC_MMU")
+old_pte is no longer used in kvm_mips_map_page(). So remove it to fix a
+build warning about variable set but not used:
+
+ arch/mips/kvm/mmu.c: In function 'kvm_mips_map_page':
+>> arch/mips/kvm/mmu.c:701:29: warning: variable 'old_pte' set but not used [-Wunused-but-set-variable]
+ 701 | pte_t *ptep, entry, old_pte;
+ | ^~~~~~~
+
+Cc: stable@vger.kernel.org
+Fixes: 411740f5422a960 ("KVM: MIPS/MMU: Implement KVM_CAP_SYNC_MMU")
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202310070530.aARZCSfh-lkp@intel.com/
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/kvm/mmu.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/arch/mips/kvm/mmu.c b/arch/mips/kvm/mmu.c
+index 28c366d307e70..38a5be10a3dbc 100644
+--- a/arch/mips/kvm/mmu.c
++++ b/arch/mips/kvm/mmu.c
+@@ -667,7 +667,7 @@ static int kvm_mips_map_page(struct kvm_vcpu *vcpu, unsigned long gpa,
+ gfn_t gfn = gpa >> PAGE_SHIFT;
+ int srcu_idx, err;
+ kvm_pfn_t pfn;
+- pte_t *ptep, entry, old_pte;
++ pte_t *ptep, entry;
+ bool writeable;
+ unsigned long prot_bits;
+ unsigned long mmu_seq;
+@@ -739,7 +739,6 @@ static int kvm_mips_map_page(struct kvm_vcpu *vcpu, unsigned long gpa,
+ entry = pfn_pte(pfn, __pgprot(prot_bits));
+
+ /* Write the PTE */
+- old_pte = *ptep;
+ set_pte(ptep, entry);
+
+ err = 0;
+--
+2.42.0
+
--- /dev/null
+From 666cd339d9a4ae6c88698eeb5a6bbd30d3da3948 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Nov 2023 16:42:17 -0800
+Subject: net: axienet: Fix check for partial TX checksum
+
+From: Samuel Holland <samuel.holland@sifive.com>
+
+[ Upstream commit fd0413bbf8b11f56e8aa842783b0deda0dfe2926 ]
+
+Due to a typo, the code checked the RX checksum feature in the TX path.
+
+Fixes: 8a3b7a252dca ("drivers/net/ethernet/xilinx: added Xilinx AXI Ethernet driver")
+Signed-off-by: Samuel Holland <samuel.holland@sifive.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Reviewed-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
+Link: https://lore.kernel.org/r/20231122004219.3504219-1-samuel.holland@sifive.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+index 9d362283196aa..2a5a3f8761c30 100644
+--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
++++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+@@ -763,7 +763,7 @@ axienet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
+ if (lp->features & XAE_FEATURE_FULL_TX_CSUM) {
+ /* Tx Full Checksum Offload Enabled */
+ cur_p->app0 |= 2;
+- } else if (lp->features & XAE_FEATURE_PARTIAL_RX_CSUM) {
++ } else if (lp->features & XAE_FEATURE_PARTIAL_TX_CSUM) {
+ csum_start_off = skb_transport_offset(skb);
+ csum_index_off = csum_start_off + skb->csum_offset;
+ /* Tx Partial Checksum Offload Enabled */
+--
+2.42.0
+
--- /dev/null
+From c171a3f38a2b79ee7150594aabcbfd6e31919851 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Oct 2023 16:50:14 -0400
+Subject: net: r8169: Disable multicast filter for RTL8168H and RTL8107E
+
+From: Patrick Thompson <ptf@google.com>
+
+[ Upstream commit efa5f1311c4998e9e6317c52bc5ee93b3a0f36df ]
+
+RTL8168H and RTL8107E ethernet adapters erroneously filter unicast
+eapol packets unless allmulti is enabled. These devices correspond to
+RTL_GIGA_MAC_VER_46 and VER_48. Add an exception for VER_46 and VER_48
+in the same way that VER_35 has an exception.
+
+Fixes: 6e1d0b898818 ("r8169:add support for RTL8168H and RTL8107E")
+Signed-off-by: Patrick Thompson <ptf@google.com>
+Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
+Reviewed-by: Heiner Kallweit <hkallweit1@gmail.com>
+Link: https://lore.kernel.org/r/20231030205031.177855-1-ptf@google.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169_main.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c
+index ab6af1f1ad5bb..6e0fe77d1019c 100644
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -2581,7 +2581,9 @@ static void rtl_set_rx_mode(struct net_device *dev)
+ rx_mode &= ~AcceptMulticast;
+ } else if (netdev_mc_count(dev) > MC_FILTER_LIMIT ||
+ dev->flags & IFF_ALLMULTI ||
+- tp->mac_version == RTL_GIGA_MAC_VER_35) {
++ tp->mac_version == RTL_GIGA_MAC_VER_35 ||
++ tp->mac_version == RTL_GIGA_MAC_VER_46 ||
++ tp->mac_version == RTL_GIGA_MAC_VER_48) {
+ /* accept all multicasts */
+ } else if (netdev_mc_empty(dev)) {
+ rx_mode &= ~AcceptMulticast;
+--
+2.42.0
+
--- /dev/null
+From 8ed11ce3d6e511ac13584d0e012ca1507c826180 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Nov 2023 10:37:05 +0800
+Subject: net/smc: avoid data corruption caused by decline
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: D. Wythe <alibuda@linux.alibaba.com>
+
+[ Upstream commit e6d71b437abc2f249e3b6a1ae1a7228e09c6e563 ]
+
+We found a data corruption issue during testing of SMC-R on Redis
+applications.
+
+The benchmark has a low probability of reporting a strange error as
+shown below.
+
+"Error: Protocol error, got "\xe2" as reply type byte"
+
+Finally, we found that the retrieved error data was as follows:
+
+0xE2 0xD4 0xC3 0xD9 0x04 0x00 0x2C 0x20 0xA6 0x56 0x00 0x16 0x3E 0x0C
+0xCB 0x04 0x02 0x01 0x00 0x00 0x20 0x00 0x00 0x00 0x00 0x00 0x00 0x00
+0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0xE2
+
+It is quite obvious that this is a SMC DECLINE message, which means that
+the applications received SMC protocol message.
+We found that this was caused by the following situations:
+
+client server
+ ¦ clc proposal
+ ------------->
+ ¦ clc accept
+ <-------------
+ ¦ clc confirm
+ ------------->
+wait llc confirm
+ send llc confirm
+ ¦failed llc confirm
+ ¦ x------
+(after 2s)timeout
+ wait llc confirm rsp
+
+wait decline
+
+(after 1s) timeout
+ (after 2s) timeout
+ ¦ decline
+ -------------->
+ ¦ decline
+ <--------------
+
+As a result, a decline message was sent in the implementation, and this
+message was read from TCP by the already-fallback connection.
+
+This patch double the client timeout as 2x of the server value,
+With this simple change, the Decline messages should never cross or
+collide (during Confirm link timeout).
+
+This issue requires an immediate solution, since the protocol updates
+involve a more long-term solution.
+
+Fixes: 0fb0b02bd6fd ("net/smc: adapt SMC client code to use the LLC flow")
+Signed-off-by: D. Wythe <alibuda@linux.alibaba.com>
+Reviewed-by: Wen Gu <guwen@linux.alibaba.com>
+Reviewed-by: Wenjia Zhang <wenjia@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/smc/af_smc.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
+index 9fc47292b68d8..664ddf5641dea 100644
+--- a/net/smc/af_smc.c
++++ b/net/smc/af_smc.c
+@@ -396,8 +396,12 @@ static int smcr_clnt_conf_first_link(struct smc_sock *smc)
+ struct smc_llc_qentry *qentry;
+ int rc;
+
+- /* receive CONFIRM LINK request from server over RoCE fabric */
+- qentry = smc_llc_wait(link->lgr, NULL, SMC_LLC_WAIT_TIME,
++ /* Receive CONFIRM LINK request from server over RoCE fabric.
++ * Increasing the client's timeout by twice as much as the server's
++ * timeout by default can temporarily avoid decline messages of
++ * both sides crossing or colliding
++ */
++ qentry = smc_llc_wait(link->lgr, NULL, 2 * SMC_LLC_WAIT_TIME,
+ SMC_LLC_CONFIRM_LINK);
+ if (!qentry) {
+ struct smc_clc_msg_decline dclc;
+--
+2.42.0
+
--- /dev/null
+From 43064131abdf6010549695a4d83aefbd626108e6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Nov 2023 13:06:29 +0100
+Subject: net: usb: ax88179_178a: fix failed operations during ax88179_reset
+
+From: Jose Ignacio Tornos Martinez <jtornosm@redhat.com>
+
+[ Upstream commit 0739af07d1d947af27c877f797cb82ceee702515 ]
+
+Using generic ASIX Electronics Corp. AX88179 Gigabit Ethernet device,
+the following test cycle has been implemented:
+ - power on
+ - check logs
+ - shutdown
+ - after detecting the system shutdown, disconnect power
+ - after approximately 60 seconds of sleep, power is restored
+Running some cycles, sometimes error logs like this appear:
+ kernel: ax88179_178a 2-9:1.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0001: -19
+ kernel: ax88179_178a 2-9:1.0 (unnamed net_device) (uninitialized): Failed to read reg index 0x0001: -19
+ ...
+These failed operation are happening during ax88179_reset execution, so
+the initialization could not be correct.
+
+In order to avoid this, we need to increase the delay after reset and
+clock initial operations. By using these larger values, many cycles
+have been run and no failed operations appear.
+
+It would be better to check some status register to verify when the
+operation has finished, but I do not have found any available information
+(neither in the public datasheets nor in the manufacturer's driver). The
+only available information for the necessary delays is the maufacturer's
+driver (original values) but the proposed values are not enough for the
+tested devices.
+
+Fixes: e2ca90c276e1f ("ax88179_178a: ASIX AX88179_178A USB 3.0/2.0 to gigabit ethernet adapter driver")
+Reported-by: Herb Wei <weihao.bj@ieisystem.com>
+Tested-by: Herb Wei <weihao.bj@ieisystem.com>
+Signed-off-by: Jose Ignacio Tornos Martinez <jtornosm@redhat.com>
+Link: https://lore.kernel.org/r/20231120120642.54334-1-jtornosm@redhat.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/ax88179_178a.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c
+index 79a53fe245e5c..38cb863ccb911 100644
+--- a/drivers/net/usb/ax88179_178a.c
++++ b/drivers/net/usb/ax88179_178a.c
+@@ -1700,11 +1700,11 @@ static int ax88179_reset(struct usbnet *dev)
+
+ *tmp16 = AX_PHYPWR_RSTCTL_IPRL;
+ ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_PHYPWR_RSTCTL, 2, 2, tmp16);
+- msleep(200);
++ msleep(500);
+
+ *tmp = AX_CLK_SELECT_ACS | AX_CLK_SELECT_BCS;
+ ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_CLK_SELECT, 1, 1, tmp);
+- msleep(100);
++ msleep(200);
+
+ /* Ethernet PHY Auto Detach*/
+ ax88179_auto_detach(dev, 0);
+--
+2.42.0
+
--- /dev/null
+From 985632288160004ae28c14928653e7ecf0767473 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Nov 2023 08:13:36 -0500
+Subject: nvmet: nul-terminate the NQNs passed in the connect command
+
+From: Christoph Hellwig <hch@lst.de>
+
+[ Upstream commit 1c22e0295a5eb571c27b53c7371f95699ef705ff ]
+
+The host and subsystem NQNs are passed in the connect command payload and
+interpreted as nul-terminated strings. Ensure they actually are
+nul-terminated before using them.
+
+Fixes: a07b4970f464 "nvmet: add a generic NVMe target")
+Reported-by: Alon Zahavi <zahavi.alon@gmail.com>
+Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/target/fabrics-cmd.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/nvme/target/fabrics-cmd.c b/drivers/nvme/target/fabrics-cmd.c
+index 5baaace31c68c..fb4f62982cb7e 100644
+--- a/drivers/nvme/target/fabrics-cmd.c
++++ b/drivers/nvme/target/fabrics-cmd.c
+@@ -189,6 +189,8 @@ static void nvmet_execute_admin_connect(struct nvmet_req *req)
+ goto out;
+ }
+
++ d->subsysnqn[NVMF_NQN_FIELD_LEN - 1] = '\0';
++ d->hostnqn[NVMF_NQN_FIELD_LEN - 1] = '\0';
+ status = nvmet_alloc_ctrl(d->subsysnqn, d->hostnqn, req,
+ le32_to_cpu(c->kato), &ctrl);
+ if (status) {
+@@ -250,6 +252,8 @@ static void nvmet_execute_io_connect(struct nvmet_req *req)
+ goto out;
+ }
+
++ d->subsysnqn[NVMF_NQN_FIELD_LEN - 1] = '\0';
++ d->hostnqn[NVMF_NQN_FIELD_LEN - 1] = '\0';
+ ctrl = nvmet_ctrl_find_get(d->subsysnqn, d->hostnqn,
+ le16_to_cpu(d->cntlid), req);
+ if (!ctrl) {
+--
+2.42.0
+
--- /dev/null
+From 7a588d585af98b524ff5e150199567a1e8d5b5bb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Mar 2021 17:16:32 -0800
+Subject: nvmet: remove unnecessary ctrl parameter
+
+From: Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com>
+
+[ Upstream commit de5878048e11f1ec44164ebb8994de132074367a ]
+
+The function nvmet_ctrl_find_get() accepts out pointer to nvmet_ctrl
+structure. This function returns the same error value from two places
+that is :- NVME_SC_CONNECT_INVALID_PARAM | NVME_SC_DNR.
+
+Move this to the caller so we can change the return type to nvmet_ctrl.
+
+Now that we can changed the return type, instead of taking out pointer
+to the nvmet_ctrl structure remove that function parameter and return
+the valid nvmet_ctrl pointer on success and NULL on failure.
+
+Also, add and rename the goto labels for more readability with comments.
+
+Signed-off-by: Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Stable-dep-of: 1c22e0295a5e ("nvmet: nul-terminate the NQNs passed in the connect command")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/target/core.c | 21 +++++++++++----------
+ drivers/nvme/target/fabrics-cmd.c | 11 ++++++-----
+ drivers/nvme/target/nvmet.h | 5 +++--
+ 3 files changed, 20 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c
+index a82a0796a6148..59109eb8e8e46 100644
+--- a/drivers/nvme/target/core.c
++++ b/drivers/nvme/target/core.c
+@@ -1189,19 +1189,19 @@ static void nvmet_init_cap(struct nvmet_ctrl *ctrl)
+ ctrl->cap |= NVMET_QUEUE_SIZE - 1;
+ }
+
+-u16 nvmet_ctrl_find_get(const char *subsysnqn, const char *hostnqn, u16 cntlid,
+- struct nvmet_req *req, struct nvmet_ctrl **ret)
++struct nvmet_ctrl *nvmet_ctrl_find_get(const char *subsysnqn,
++ const char *hostnqn, u16 cntlid,
++ struct nvmet_req *req)
+ {
++ struct nvmet_ctrl *ctrl = NULL;
+ struct nvmet_subsys *subsys;
+- struct nvmet_ctrl *ctrl;
+- u16 status = 0;
+
+ subsys = nvmet_find_get_subsys(req->port, subsysnqn);
+ if (!subsys) {
+ pr_warn("connect request for invalid subsystem %s!\n",
+ subsysnqn);
+ req->cqe->result.u32 = IPO_IATTR_CONNECT_DATA(subsysnqn);
+- return NVME_SC_CONNECT_INVALID_PARAM | NVME_SC_DNR;
++ goto out;
+ }
+
+ mutex_lock(&subsys->lock);
+@@ -1214,20 +1214,21 @@ u16 nvmet_ctrl_find_get(const char *subsysnqn, const char *hostnqn, u16 cntlid,
+ if (!kref_get_unless_zero(&ctrl->ref))
+ continue;
+
+- *ret = ctrl;
+- goto out;
++ /* ctrl found */
++ goto found;
+ }
+ }
+
++ ctrl = NULL; /* ctrl not found */
+ pr_warn("could not find controller %d for subsys %s / host %s\n",
+ cntlid, subsysnqn, hostnqn);
+ req->cqe->result.u32 = IPO_IATTR_CONNECT_DATA(cntlid);
+- status = NVME_SC_CONNECT_INVALID_PARAM | NVME_SC_DNR;
+
+-out:
++found:
+ mutex_unlock(&subsys->lock);
+ nvmet_subsys_put(subsys);
+- return status;
++out:
++ return ctrl;
+ }
+
+ u16 nvmet_check_ctrl_status(struct nvmet_req *req, struct nvme_command *cmd)
+diff --git a/drivers/nvme/target/fabrics-cmd.c b/drivers/nvme/target/fabrics-cmd.c
+index e62d3d0fa6c85..5baaace31c68c 100644
+--- a/drivers/nvme/target/fabrics-cmd.c
++++ b/drivers/nvme/target/fabrics-cmd.c
+@@ -223,7 +223,7 @@ static void nvmet_execute_io_connect(struct nvmet_req *req)
+ {
+ struct nvmf_connect_command *c = &req->cmd->connect;
+ struct nvmf_connect_data *d;
+- struct nvmet_ctrl *ctrl = NULL;
++ struct nvmet_ctrl *ctrl;
+ u16 qid = le16_to_cpu(c->qid);
+ u16 status = 0;
+
+@@ -250,11 +250,12 @@ static void nvmet_execute_io_connect(struct nvmet_req *req)
+ goto out;
+ }
+
+- status = nvmet_ctrl_find_get(d->subsysnqn, d->hostnqn,
+- le16_to_cpu(d->cntlid),
+- req, &ctrl);
+- if (status)
++ ctrl = nvmet_ctrl_find_get(d->subsysnqn, d->hostnqn,
++ le16_to_cpu(d->cntlid), req);
++ if (!ctrl) {
++ status = NVME_SC_CONNECT_INVALID_PARAM | NVME_SC_DNR;
+ goto out;
++ }
+
+ if (unlikely(qid > ctrl->subsys->max_qid)) {
+ pr_warn("invalid queue id (%d)\n", qid);
+diff --git a/drivers/nvme/target/nvmet.h b/drivers/nvme/target/nvmet.h
+index 4bf6d21290c23..ef162b64fabef 100644
+--- a/drivers/nvme/target/nvmet.h
++++ b/drivers/nvme/target/nvmet.h
+@@ -430,8 +430,9 @@ void nvmet_ctrl_fatal_error(struct nvmet_ctrl *ctrl);
+ void nvmet_update_cc(struct nvmet_ctrl *ctrl, u32 new);
+ u16 nvmet_alloc_ctrl(const char *subsysnqn, const char *hostnqn,
+ struct nvmet_req *req, u32 kato, struct nvmet_ctrl **ctrlp);
+-u16 nvmet_ctrl_find_get(const char *subsysnqn, const char *hostnqn, u16 cntlid,
+- struct nvmet_req *req, struct nvmet_ctrl **ret);
++struct nvmet_ctrl *nvmet_ctrl_find_get(const char *subsysnqn,
++ const char *hostnqn, u16 cntlid,
++ struct nvmet_req *req);
+ void nvmet_ctrl_put(struct nvmet_ctrl *ctrl);
+ u16 nvmet_check_ctrl_status(struct nvmet_req *req, struct nvme_command *cmd);
+
+--
+2.42.0
+
--- /dev/null
+From b289a8a0fd5948ef3c1fc965876ec1bff952d270 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Nov 2023 09:09:33 +0100
+Subject: Revert "net: r8169: Disable multicast filter for RTL8168H and
+ RTL8107E"
+
+From: Heiner Kallweit <hkallweit1@gmail.com>
+
+commit 6a26310273c323380da21eb23fcfd50e31140913 upstream.
+
+This reverts commit efa5f1311c4998e9e6317c52bc5ee93b3a0f36df.
+
+I couldn't reproduce the reported issue. What I did, based on a pcap
+packet log provided by the reporter:
+- Used same chip version (RTL8168h)
+- Set MAC address to the one used on the reporters system
+- Replayed the EAPOL unicast packet that, according to the reporter,
+ was filtered out by the mc filter.
+The packet was properly received.
+
+Therefore the root cause of the reported issue seems to be somewhere
+else. Disabling mc filtering completely for the most common chip
+version is a quite big hammer. Therefore revert the change and wait
+for further analysis results from the reporter.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169_main.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c
+index 6e0fe77d1019c..ab6af1f1ad5bb 100644
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -2581,9 +2581,7 @@ static void rtl_set_rx_mode(struct net_device *dev)
+ rx_mode &= ~AcceptMulticast;
+ } else if (netdev_mc_count(dev) > MC_FILTER_LIMIT ||
+ dev->flags & IFF_ALLMULTI ||
+- tp->mac_version == RTL_GIGA_MAC_VER_35 ||
+- tp->mac_version == RTL_GIGA_MAC_VER_46 ||
+- tp->mac_version == RTL_GIGA_MAC_VER_48) {
++ tp->mac_version == RTL_GIGA_MAC_VER_35) {
+ /* accept all multicasts */
+ } else if (netdev_mc_empty(dev)) {
+ rx_mode &= ~AcceptMulticast;
+--
+2.42.0
+
--- /dev/null
+From 41012fc2aa29a3d34c4950dd83774e9fb54e32a4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Oct 2023 09:57:10 +0200
+Subject: s390/ap: fix AP bus crash on early config change callback invocation
+
+From: Harald Freudenberger <freude@linux.ibm.com>
+
+commit e14aec23025eeb1f2159ba34dbc1458467c4c347 upstream.
+
+Fix kernel crash in AP bus code caused by very early invocation of the
+config change callback function via SCLP.
+
+After a fresh IML of the machine the crypto cards are still offline and
+will get switched online only with activation of any LPAR which has the
+card in it's configuration. A crypto card coming online is reported
+to the LPAR via SCLP and the AP bus offers a callback function to get
+this kind of information. However, it may happen that the callback is
+invoked before the AP bus init function is complete. As the callback
+triggers a synchronous AP bus scan, the scan may already run but some
+internal states are not initialized by the AP bus init function resulting
+in a crash like this:
+
+ [ 11.635859] Unable to handle kernel pointer dereference in virtual kernel address space
+ [ 11.635861] Failing address: 0000000000000000 TEID: 0000000000000887
+ [ 11.635862] Fault in home space mode while using kernel ASCE.
+ [ 11.635864] AS:00000000894c4007 R3:00000001fece8007 S:00000001fece7800 P:000000000000013d
+ [ 11.635879] Oops: 0004 ilc:1 [#1] SMP
+ [ 11.635882] Modules linked in:
+ [ 11.635884] CPU: 5 PID: 42 Comm: kworker/5:0 Not tainted 6.6.0-rc3-00003-g4dbf7cdc6b42 #12
+ [ 11.635886] Hardware name: IBM 3931 A01 751 (LPAR)
+ [ 11.635887] Workqueue: events_long ap_scan_bus
+ [ 11.635891] Krnl PSW : 0704c00180000000 0000000000000000 (0x0)
+ [ 11.635895] R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:0 PM:0 RI:0 EA:3
+ [ 11.635897] Krnl GPRS: 0000000001000a00 0000000000000000 0000000000000006 0000000089591940
+ [ 11.635899] 0000000080000000 0000000000000a00 0000000000000000 0000000000000000
+ [ 11.635901] 0000000081870c00 0000000089591000 000000008834e4e2 0000000002625a00
+ [ 11.635903] 0000000081734200 0000038000913c18 000000008834c6d6 0000038000913ac8
+ [ 11.635906] Krnl Code:>0000000000000000: 0000 illegal
+ [ 11.635906] 0000000000000002: 0000 illegal
+ [ 11.635906] 0000000000000004: 0000 illegal
+ [ 11.635906] 0000000000000006: 0000 illegal
+ [ 11.635906] 0000000000000008: 0000 illegal
+ [ 11.635906] 000000000000000a: 0000 illegal
+ [ 11.635906] 000000000000000c: 0000 illegal
+ [ 11.635906] 000000000000000e: 0000 illegal
+ [ 11.635915] Call Trace:
+ [ 11.635916] [<0000000000000000>] 0x0
+ [ 11.635918] [<000000008834e4e2>] ap_queue_init_state+0x82/0xb8
+ [ 11.635921] [<000000008834ba1c>] ap_scan_domains+0x6fc/0x740
+ [ 11.635923] [<000000008834c092>] ap_scan_adapter+0x632/0x8b0
+ [ 11.635925] [<000000008834c3e4>] ap_scan_bus+0xd4/0x288
+ [ 11.635927] [<00000000879a33ba>] process_one_work+0x19a/0x410
+ [ 11.635930] Discipline DIAG cannot be used without z/VM
+ [ 11.635930] [<00000000879a3a2c>] worker_thread+0x3fc/0x560
+ [ 11.635933] [<00000000879aea60>] kthread+0x120/0x128
+ [ 11.635936] [<000000008792afa4>] __ret_from_fork+0x3c/0x58
+ [ 11.635938] [<00000000885ebe62>] ret_from_fork+0xa/0x30
+ [ 11.635942] Last Breaking-Event-Address:
+ [ 11.635942] [<000000008834c6d4>] ap_wait+0xcc/0x148
+
+This patch improves the ap_bus_force_rescan() function which is
+invoked by the config change callback by checking if a first
+initial AP bus scan has been done. If not, the force rescan request
+is simple ignored. Anyhow it does not make sense to trigger AP bus
+re-scans even before the very first bus scan is complete.
+
+Cc: stable@vger.kernel.org
+Reviewed-by: Holger Dengler <dengler@linux.ibm.com>
+Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/crypto/ap_bus.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/s390/crypto/ap_bus.c b/drivers/s390/crypto/ap_bus.c
+index c00a288a4eca2..602438a8c2a26 100644
+--- a/drivers/s390/crypto/ap_bus.c
++++ b/drivers/s390/crypto/ap_bus.c
+@@ -787,6 +787,10 @@ EXPORT_SYMBOL(ap_driver_unregister);
+
+ void ap_bus_force_rescan(void)
+ {
++ /* Only trigger AP bus scans after the initial scan is done */
++ if (atomic64_read(&ap_scan_bus_count) <= 0)
++ return;
++
+ /* processing a asynchronous bus rescan */
+ del_timer(&ap_config_timer);
+ queue_work(system_long_wq, &ap_scan_work);
+--
+2.42.0
+
--- /dev/null
+net-r8169-disable-multicast-filter-for-rtl8168h-and-.patch
+drm-amdgpu-fix-a-null-pointer-access-when-the-smc_rr.patch
+i2c-sun6i-p2wi-prevent-potential-division-by-zero.patch
+media-imon-fix-access-to-invalid-resource-for-the-se.patch
+tty-serial-meson-retrieve-port-fifo-size-from-dt.patch
+s390-ap-fix-ap-bus-crash-on-early-config-change-call.patch
+revert-net-r8169-disable-multicast-filter-for-rtl816.patch
+afs-fix-afs_server_list-to-be-cleaned-up-with-rcu.patch
+afs-make-error-on-cell-lookup-failure-consistent-wit.patch
+drm-panel-boe-tv101wum-nl6-fine-tune-the-panel-power.patch
+drm-panel-auo-b101uan08.3-fine-tune-the-panel-power-.patch
+drm-panel-simple-fix-innolux-g101ice-l01-bus-flags.patch
+drm-panel-simple-fix-innolux-g101ice-l01-timings.patch
+wireguard-use-dev_stats_inc.patch
+ata-pata_isapnp-add-missing-error-check-for-devm_iop.patch
+drm-rockchip-vop-fix-color-for-rgb888-bgr888-format-.patch
+hid-core-store-the-unique-system-identifier-in-hid_d.patch
+hid-fix-hid-device-resource-race-between-hid-core-an.patch
+ipv4-correct-silence-an-endian-warning-in-__ip_do_re.patch
+net-usb-ax88179_178a-fix-failed-operations-during-ax.patch
+net-smc-avoid-data-corruption-caused-by-decline.patch
+arm-xen-fix-xen_vcpu_info-allocation-alignment.patch
+amd-xgbe-handle-corner-case-during-sfp-hotplug.patch
+amd-xgbe-handle-the-corner-case-during-tx-completion.patch
+amd-xgbe-propagate-the-correct-speed-and-duplex-stat.patch
+net-axienet-fix-check-for-partial-tx-checksum.patch
+afs-return-enoent-if-no-cell-dns-record-can-be-found.patch
+afs-fix-file-locking-on-r-o-volumes-to-operate-in-lo.patch
+nvmet-remove-unnecessary-ctrl-parameter.patch
+nvmet-nul-terminate-the-nqns-passed-in-the-connect-c.patch
+usb-dwc3-qcom-fix-resource-leaks-on-probe-deferral.patch
+usb-dwc3-qcom-fix-acpi-platform-device-leak.patch
+lockdep-fix-block-chain-corruption.patch
+media-i2c-smiapp-simplify-getting-state-container.patch
+media-smiapp-import-ccs-definitions.patch
+media-smiapp-use-ccs-register-flags.patch
+media-smiapp-calculate-ccs-limit-offsets-and-limit-b.patch
+media-smiapp-add-macros-for-accessing-ccs-registers.patch
+media-smiapp-use-mipi-ccs-version-and-manufacturer-i.patch
+media-smiapp-read-ccs-limit-values.patch
+media-smiapp-switch-to-ccs-limits.patch
+media-smiapp-use-ccs-registers.patch
+media-ccs-correctly-initialise-try-compose-rectangle.patch
+mips-kvm-fix-a-build-warning-about-variable-set-but-.patch
+ext4-add-a-new-helper-to-check-if-es-must-be-kept.patch
+ext4-factor-out-__es_alloc_extent-and-__es_free_exte.patch
+ext4-use-pre-allocated-es-in-__es_insert_extent.patch
+ext4-use-pre-allocated-es-in-__es_remove_extent.patch
+ext4-using-nofail-preallocation-in-ext4_es_remove_ex.patch
+ext4-using-nofail-preallocation-in-ext4_es_insert_de.patch
+ext4-using-nofail-preallocation-in-ext4_es_insert_ex.patch
+ext4-fix-slab-use-after-free-in-ext4_es_insert_exten.patch
+ext4-make-sure-allocate-pending-entry-not-fail.patch
--- /dev/null
+From edbcc63ffa6dee7fad8a540dd84edce15833a079 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 May 2021 09:58:32 +0200
+Subject: tty: serial: meson: retrieve port FIFO size from DT
+
+From: Neil Armstrong <narmstrong@baylibre.com>
+
+[ Upstream commit 27d44e05d7b85d9d4cfe0a3c0663ea49752ece93 ]
+
+Now the DT bindings has a property to get the FIFO size for a particular port,
+retrieve it and use to setup the FIFO interrupts threshold.
+
+Reviewed-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
+Link: https://lore.kernel.org/r/20210518075833.3736038-3-narmstrong@baylibre.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Stable-dep-of: 2a1d728f20ed ("tty: serial: meson: fix hard LOCKUP on crtscts mode")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/meson_uart.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/tty/serial/meson_uart.c b/drivers/tty/serial/meson_uart.c
+index bb66a3f06626c..c44ab21a9b7dd 100644
+--- a/drivers/tty/serial/meson_uart.c
++++ b/drivers/tty/serial/meson_uart.c
+@@ -765,6 +765,8 @@ static int meson_uart_probe(struct platform_device *pdev)
+ of_property_read_u32(pdev->dev.of_node, "fifo-size", &fifosize);
+ has_rtscts = of_property_read_bool(pdev->dev.of_node, "uart-has-rtscts");
+
++ of_property_read_u32(pdev->dev.of_node, "fifo-size", &fifosize);
++
+ if (meson_ports[pdev->id]) {
+ dev_err(&pdev->dev, "port %d already allocated\n", pdev->id);
+ return -EBUSY;
+--
+2.42.0
+
--- /dev/null
+From 8ed9ee40190fdb45f0562284c978fbbf5846ab9c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Nov 2023 18:36:50 +0100
+Subject: USB: dwc3: qcom: fix ACPI platform device leak
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+[ Upstream commit 9cf87666fc6e08572341fe08ecd909935998fbbd ]
+
+Make sure to free the "urs" platform device, which is created for some
+ACPI platforms, on probe errors and on driver unbind.
+
+Compile-tested only.
+
+Fixes: c25c210f590e ("usb: dwc3: qcom: add URS Host support for sdm845 ACPI boot")
+Cc: Shawn Guo <shawn.guo@linaro.org>
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Acked-by: Andrew Halaney <ahalaney@redhat.com>
+Acked-by: Shawn Guo <shawn.guo@linaro.org>
+Link: https://lore.kernel.org/r/20231117173650.21161-4-johan+linaro@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc3/dwc3-qcom.c | 37 +++++++++++++++++++++++++++++-------
+ 1 file changed, 30 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/usb/dwc3/dwc3-qcom.c b/drivers/usb/dwc3/dwc3-qcom.c
+index 0d11d282c0a2e..58d5169e8cab5 100644
+--- a/drivers/usb/dwc3/dwc3-qcom.c
++++ b/drivers/usb/dwc3/dwc3-qcom.c
+@@ -699,9 +699,9 @@ static int dwc3_qcom_of_register_core(struct platform_device *pdev)
+ return ret;
+ }
+
+-static struct platform_device *
+-dwc3_qcom_create_urs_usb_platdev(struct device *dev)
++static struct platform_device *dwc3_qcom_create_urs_usb_platdev(struct device *dev)
+ {
++ struct platform_device *urs_usb = NULL;
+ struct fwnode_handle *fwh;
+ struct acpi_device *adev;
+ char name[8];
+@@ -721,9 +721,26 @@ dwc3_qcom_create_urs_usb_platdev(struct device *dev)
+
+ adev = to_acpi_device_node(fwh);
+ if (!adev)
+- return NULL;
++ goto err_put_handle;
++
++ urs_usb = acpi_create_platform_device(adev, NULL);
++ if (IS_ERR_OR_NULL(urs_usb))
++ goto err_put_handle;
++
++ return urs_usb;
+
+- return acpi_create_platform_device(adev, NULL);
++err_put_handle:
++ fwnode_handle_put(fwh);
++
++ return urs_usb;
++}
++
++static void dwc3_qcom_destroy_urs_usb_platdev(struct platform_device *urs_usb)
++{
++ struct fwnode_handle *fwh = urs_usb->dev.fwnode;
++
++ platform_device_unregister(urs_usb);
++ fwnode_handle_put(fwh);
+ }
+
+ static int dwc3_qcom_probe(struct platform_device *pdev)
+@@ -808,13 +825,13 @@ static int dwc3_qcom_probe(struct platform_device *pdev)
+ if (IS_ERR(qcom->qscratch_base)) {
+ dev_err(dev, "failed to map qscratch, err=%d\n", ret);
+ ret = PTR_ERR(qcom->qscratch_base);
+- goto clk_disable;
++ goto free_urs;
+ }
+
+ ret = dwc3_qcom_setup_irq(pdev);
+ if (ret) {
+ dev_err(dev, "failed to setup IRQs, err=%d\n", ret);
+- goto clk_disable;
++ goto free_urs;
+ }
+
+ /*
+@@ -833,7 +850,7 @@ static int dwc3_qcom_probe(struct platform_device *pdev)
+
+ if (ret) {
+ dev_err(dev, "failed to register DWC3 Core, err=%d\n", ret);
+- goto clk_disable;
++ goto free_urs;
+ }
+
+ ret = dwc3_qcom_interconnect_init(qcom);
+@@ -867,6 +884,9 @@ static int dwc3_qcom_probe(struct platform_device *pdev)
+ else
+ platform_device_del(qcom->dwc3);
+ platform_device_put(qcom->dwc3);
++free_urs:
++ if (qcom->urs_usb)
++ dwc3_qcom_destroy_urs_usb_platdev(qcom->urs_usb);
+ clk_disable:
+ for (i = qcom->num_clocks - 1; i >= 0; i--) {
+ clk_disable_unprepare(qcom->clks[i]);
+@@ -891,6 +911,9 @@ static int dwc3_qcom_remove(struct platform_device *pdev)
+ platform_device_del(qcom->dwc3);
+ platform_device_put(qcom->dwc3);
+
++ if (qcom->urs_usb)
++ dwc3_qcom_destroy_urs_usb_platdev(qcom->urs_usb);
++
+ for (i = qcom->num_clocks - 1; i >= 0; i--) {
+ clk_disable_unprepare(qcom->clks[i]);
+ clk_put(qcom->clks[i]);
+--
+2.42.0
+
--- /dev/null
+From b8f451b4f8475e4a9b3f5bb3a0c3f1916212b940 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Nov 2023 18:36:48 +0100
+Subject: USB: dwc3: qcom: fix resource leaks on probe deferral
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+[ Upstream commit 51392a1879ff06dc21b68aef4825f6ef68a7be42 ]
+
+The driver needs to deregister and free the newly allocated dwc3 core
+platform device on ACPI probe errors (e.g. probe deferral) and on driver
+unbind but instead it leaked those resources while erroneously dropping
+a reference to the parent platform device which is still in use.
+
+For OF probing the driver takes a reference to the dwc3 core platform
+device which has also always been leaked.
+
+Fix the broken ACPI tear down and make sure to drop the dwc3 core
+reference for both OF and ACPI.
+
+Fixes: 8fd95da2cfb5 ("usb: dwc3: qcom: Release the correct resources in dwc3_qcom_remove()")
+Fixes: 2bc02355f8ba ("usb: dwc3: qcom: Add support for booting with ACPI")
+Fixes: a4333c3a6ba9 ("usb: dwc3: Add Qualcomm DWC3 glue driver")
+Cc: stable@vger.kernel.org # 4.18
+Cc: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Cc: Lee Jones <lee@kernel.org>
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Acked-by: Andrew Halaney <ahalaney@redhat.com>
+Link: https://lore.kernel.org/r/20231117173650.21161-2-johan+linaro@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Stable-dep-of: 9cf87666fc6e ("USB: dwc3: qcom: fix ACPI platform device leak")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc3/dwc3-qcom.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/usb/dwc3/dwc3-qcom.c b/drivers/usb/dwc3/dwc3-qcom.c
+index 3973f6c18857e..0d11d282c0a2e 100644
+--- a/drivers/usb/dwc3/dwc3-qcom.c
++++ b/drivers/usb/dwc3/dwc3-qcom.c
+@@ -690,6 +690,7 @@ static int dwc3_qcom_of_register_core(struct platform_device *pdev)
+ if (!qcom->dwc3) {
+ ret = -ENODEV;
+ dev_err(dev, "failed to get dwc3 platform device\n");
++ of_platform_depopulate(dev);
+ }
+
+ node_put:
+@@ -832,7 +833,7 @@ static int dwc3_qcom_probe(struct platform_device *pdev)
+
+ if (ret) {
+ dev_err(dev, "failed to register DWC3 Core, err=%d\n", ret);
+- goto depopulate;
++ goto clk_disable;
+ }
+
+ ret = dwc3_qcom_interconnect_init(qcom);
+@@ -864,7 +865,8 @@ static int dwc3_qcom_probe(struct platform_device *pdev)
+ if (np)
+ of_platform_depopulate(&pdev->dev);
+ else
+- platform_device_put(pdev);
++ platform_device_del(qcom->dwc3);
++ platform_device_put(qcom->dwc3);
+ clk_disable:
+ for (i = qcom->num_clocks - 1; i >= 0; i--) {
+ clk_disable_unprepare(qcom->clks[i]);
+@@ -886,7 +888,8 @@ static int dwc3_qcom_remove(struct platform_device *pdev)
+ if (np)
+ of_platform_depopulate(&pdev->dev);
+ else
+- platform_device_put(pdev);
++ platform_device_del(qcom->dwc3);
++ platform_device_put(qcom->dwc3);
+
+ for (i = qcom->num_clocks - 1; i >= 0; i--) {
+ clk_disable_unprepare(qcom->clks[i]);
+--
+2.42.0
+
--- /dev/null
+From c54aabb8f891940ad95a17135007a67fe61d0817 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Nov 2023 14:17:33 +0000
+Subject: wireguard: use DEV_STATS_INC()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 93da8d75a66568ba4bb5b14ad2833acd7304cd02 ]
+
+wg_xmit() can be called concurrently, KCSAN reported [1]
+some device stats updates can be lost.
+
+Use DEV_STATS_INC() for this unlikely case.
+
+[1]
+BUG: KCSAN: data-race in wg_xmit / wg_xmit
+
+read-write to 0xffff888104239160 of 8 bytes by task 1375 on cpu 0:
+wg_xmit+0x60f/0x680 drivers/net/wireguard/device.c:231
+__netdev_start_xmit include/linux/netdevice.h:4918 [inline]
+netdev_start_xmit include/linux/netdevice.h:4932 [inline]
+xmit_one net/core/dev.c:3543 [inline]
+dev_hard_start_xmit+0x11b/0x3f0 net/core/dev.c:3559
+...
+
+read-write to 0xffff888104239160 of 8 bytes by task 1378 on cpu 1:
+wg_xmit+0x60f/0x680 drivers/net/wireguard/device.c:231
+__netdev_start_xmit include/linux/netdevice.h:4918 [inline]
+netdev_start_xmit include/linux/netdevice.h:4932 [inline]
+xmit_one net/core/dev.c:3543 [inline]
+dev_hard_start_xmit+0x11b/0x3f0 net/core/dev.c:3559
+...
+
+v2: also change wg_packet_consume_data_done() (Hangbin Liu)
+ and wg_packet_purge_staged_packets()
+
+Fixes: e7096c131e51 ("net: WireGuard secure network tunnel")
+Reported-by: syzbot <syzkaller@googlegroups.com>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Jason A. Donenfeld <Jason@zx2c4.com>
+Cc: Hangbin Liu <liuhangbin@gmail.com>
+Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
+Reviewed-by: Hangbin Liu <liuhangbin@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireguard/device.c | 4 ++--
+ drivers/net/wireguard/receive.c | 12 ++++++------
+ drivers/net/wireguard/send.c | 3 ++-
+ 3 files changed, 10 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/net/wireguard/device.c b/drivers/net/wireguard/device.c
+index e0693cd965ec4..713ca20feaef4 100644
+--- a/drivers/net/wireguard/device.c
++++ b/drivers/net/wireguard/device.c
+@@ -193,7 +193,7 @@ static netdev_tx_t wg_xmit(struct sk_buff *skb, struct net_device *dev)
+ */
+ while (skb_queue_len(&peer->staged_packet_queue) > MAX_STAGED_PACKETS) {
+ dev_kfree_skb(__skb_dequeue(&peer->staged_packet_queue));
+- ++dev->stats.tx_dropped;
++ DEV_STATS_INC(dev, tx_dropped);
+ }
+ skb_queue_splice_tail(&packets, &peer->staged_packet_queue);
+ spin_unlock_bh(&peer->staged_packet_queue.lock);
+@@ -211,7 +211,7 @@ static netdev_tx_t wg_xmit(struct sk_buff *skb, struct net_device *dev)
+ else if (skb->protocol == htons(ETH_P_IPV6))
+ icmpv6_ndo_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_ADDR_UNREACH, 0);
+ err:
+- ++dev->stats.tx_errors;
++ DEV_STATS_INC(dev, tx_errors);
+ kfree_skb(skb);
+ return ret;
+ }
+diff --git a/drivers/net/wireguard/receive.c b/drivers/net/wireguard/receive.c
+index f500aaf678370..d38b24339a1f9 100644
+--- a/drivers/net/wireguard/receive.c
++++ b/drivers/net/wireguard/receive.c
+@@ -423,20 +423,20 @@ static void wg_packet_consume_data_done(struct wg_peer *peer,
+ net_dbg_skb_ratelimited("%s: Packet has unallowed src IP (%pISc) from peer %llu (%pISpfsc)\n",
+ dev->name, skb, peer->internal_id,
+ &peer->endpoint.addr);
+- ++dev->stats.rx_errors;
+- ++dev->stats.rx_frame_errors;
++ DEV_STATS_INC(dev, rx_errors);
++ DEV_STATS_INC(dev, rx_frame_errors);
+ goto packet_processed;
+ dishonest_packet_type:
+ net_dbg_ratelimited("%s: Packet is neither ipv4 nor ipv6 from peer %llu (%pISpfsc)\n",
+ dev->name, peer->internal_id, &peer->endpoint.addr);
+- ++dev->stats.rx_errors;
+- ++dev->stats.rx_frame_errors;
++ DEV_STATS_INC(dev, rx_errors);
++ DEV_STATS_INC(dev, rx_frame_errors);
+ goto packet_processed;
+ dishonest_packet_size:
+ net_dbg_ratelimited("%s: Packet has incorrect size from peer %llu (%pISpfsc)\n",
+ dev->name, peer->internal_id, &peer->endpoint.addr);
+- ++dev->stats.rx_errors;
+- ++dev->stats.rx_length_errors;
++ DEV_STATS_INC(dev, rx_errors);
++ DEV_STATS_INC(dev, rx_length_errors);
+ goto packet_processed;
+ packet_processed:
+ dev_kfree_skb(skb);
+diff --git a/drivers/net/wireguard/send.c b/drivers/net/wireguard/send.c
+index 95c853b59e1da..0d48e0f4a1ba3 100644
+--- a/drivers/net/wireguard/send.c
++++ b/drivers/net/wireguard/send.c
+@@ -333,7 +333,8 @@ static void wg_packet_create_data(struct wg_peer *peer, struct sk_buff *first)
+ void wg_packet_purge_staged_packets(struct wg_peer *peer)
+ {
+ spin_lock_bh(&peer->staged_packet_queue.lock);
+- peer->device->dev->stats.tx_dropped += peer->staged_packet_queue.qlen;
++ DEV_STATS_ADD(peer->device->dev, tx_dropped,
++ peer->staged_packet_queue.qlen);
+ __skb_queue_purge(&peer->staged_packet_queue);
+ spin_unlock_bh(&peer->staged_packet_queue.lock);
+ }
+--
+2.42.0
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
