--- /dev/null
+From 90f8f346f34c85214646d24556b3ada0eb04fffa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Mar 2023 16:05:48 +0100
+Subject: ASoC: codecs: wcd938x: Convert to platform remove callback returning
+ void
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit 7cd686a59b36860511965882dad1f76df2c25766 ]
+
+The .remove() callback for a platform driver returns an int which makes
+many driver authors wrongly assume it's possible to do error handling by
+returning an error code. However the value returned is (mostly) ignored
+and this typically results in resource leaks. To improve here there is a
+quest to make the remove callback return void. In the first step of this
+quest all drivers are converted to .remove_new() which already returns
+void.
+
+Trivially convert this driver from always returning zero in the remove
+callback to the void returning variant.
+
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+Link: https://lore.kernel.org/r/20230315150745.67084-57-u.kleine-koenig@pengutronix.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Stable-dep-of: 69a026a2357e ("ASoC: codecs: wcd938x: fix regulator leaks on probe errors")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wcd938x.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/sound/soc/codecs/wcd938x.c b/sound/soc/codecs/wcd938x.c
+index c3964aa00b288..73d7c92e87242 100644
+--- a/sound/soc/codecs/wcd938x.c
++++ b/sound/soc/codecs/wcd938x.c
+@@ -3616,11 +3616,9 @@ static int wcd938x_probe(struct platform_device *pdev)
+ return 0;
+ }
+
+-static int wcd938x_remove(struct platform_device *pdev)
++static void wcd938x_remove(struct platform_device *pdev)
+ {
+ component_master_del(&pdev->dev, &wcd938x_comp_ops);
+-
+- return 0;
+ }
+
+ #if defined(CONFIG_OF)
+@@ -3634,7 +3632,7 @@ MODULE_DEVICE_TABLE(of, wcd938x_dt_match);
+
+ static struct platform_driver wcd938x_codec_driver = {
+ .probe = wcd938x_probe,
+- .remove = wcd938x_remove,
++ .remove_new = wcd938x_remove,
+ .driver = {
+ .name = "wcd938x_codec",
+ .of_match_table = of_match_ptr(wcd938x_dt_match),
+--
+2.42.0
+
--- /dev/null
+From 740d265b7166d7f65520e0a68e9bdb7b7939b79a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Oct 2023 17:55:55 +0200
+Subject: ASoC: codecs: wcd938x: fix regulator leaks on probe errors
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+[ Upstream commit 69a026a2357ee69983690d07976de44ef26ee38a ]
+
+Make sure to disable and free the regulators on probe errors and on
+driver unbind.
+
+Fixes: 16572522aece ("ASoC: codecs: wcd938x-sdw: add SoundWire driver")
+Cc: stable@vger.kernel.org # 5.14
+Cc: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Link: https://lore.kernel.org/r/20231003155558.27079-5-johan+linaro@kernel.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wcd938x.c | 18 +++++++++++++++---
+ 1 file changed, 15 insertions(+), 3 deletions(-)
+
+diff --git a/sound/soc/codecs/wcd938x.c b/sound/soc/codecs/wcd938x.c
+index f0aa44198f4c5..7181176feb73c 100644
+--- a/sound/soc/codecs/wcd938x.c
++++ b/sound/soc/codecs/wcd938x.c
+@@ -3324,8 +3324,10 @@ static int wcd938x_populate_dt_data(struct wcd938x_priv *wcd938x, struct device
+ return dev_err_probe(dev, ret, "Failed to get supplies\n");
+
+ ret = regulator_bulk_enable(WCD938X_MAX_SUPPLY, wcd938x->supplies);
+- if (ret)
++ if (ret) {
++ regulator_bulk_free(WCD938X_MAX_SUPPLY, wcd938x->supplies);
+ return dev_err_probe(dev, ret, "Failed to enable supplies\n");
++ }
+
+ wcd938x_dt_parse_micbias_info(dev, wcd938x);
+
+@@ -3591,13 +3593,13 @@ static int wcd938x_probe(struct platform_device *pdev)
+
+ ret = wcd938x_add_slave_components(wcd938x, dev, &match);
+ if (ret)
+- return ret;
++ goto err_disable_regulators;
+
+ wcd938x_reset(wcd938x);
+
+ ret = component_master_add_with_match(dev, &wcd938x_comp_ops, match);
+ if (ret)
+- return ret;
++ goto err_disable_regulators;
+
+ pm_runtime_set_autosuspend_delay(dev, 1000);
+ pm_runtime_use_autosuspend(dev);
+@@ -3607,11 +3609,21 @@ static int wcd938x_probe(struct platform_device *pdev)
+ pm_runtime_idle(dev);
+
+ return 0;
++
++err_disable_regulators:
++ regulator_bulk_disable(WCD938X_MAX_SUPPLY, wcd938x->supplies);
++ regulator_bulk_free(WCD938X_MAX_SUPPLY, wcd938x->supplies);
++
++ return ret;
+ }
+
+ static void wcd938x_remove(struct platform_device *pdev)
+ {
++ struct wcd938x_priv *wcd938x = dev_get_drvdata(&pdev->dev);
++
+ component_master_del(&pdev->dev, &wcd938x_comp_ops);
++ regulator_bulk_disable(WCD938X_MAX_SUPPLY, wcd938x->supplies);
++ regulator_bulk_free(WCD938X_MAX_SUPPLY, wcd938x->supplies);
+ }
+
+ #if defined(CONFIG_OF)
+--
+2.42.0
+
--- /dev/null
+From 48854878fd6970171c6fbe7826eb8fc8fa4fb5b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Oct 2023 17:55:56 +0200
+Subject: ASoC: codecs: wcd938x: fix runtime PM imbalance on remove
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+[ Upstream commit 3ebebb2c1eca92a15107b2d7aeff34196fd9e217 ]
+
+Make sure to balance the runtime PM operations, including the disable
+count, on driver unbind.
+
+Fixes: 16572522aece ("ASoC: codecs: wcd938x-sdw: add SoundWire driver")
+Cc: stable@vger.kernel.org # 5.14
+Cc: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Link: https://lore.kernel.org/r/20231003155558.27079-6-johan+linaro@kernel.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wcd938x.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/codecs/wcd938x.c b/sound/soc/codecs/wcd938x.c
+index 7181176feb73c..a2abd1a111612 100644
+--- a/sound/soc/codecs/wcd938x.c
++++ b/sound/soc/codecs/wcd938x.c
+@@ -3619,9 +3619,15 @@ static int wcd938x_probe(struct platform_device *pdev)
+
+ static void wcd938x_remove(struct platform_device *pdev)
+ {
+- struct wcd938x_priv *wcd938x = dev_get_drvdata(&pdev->dev);
++ struct device *dev = &pdev->dev;
++ struct wcd938x_priv *wcd938x = dev_get_drvdata(dev);
++
++ component_master_del(dev, &wcd938x_comp_ops);
++
++ pm_runtime_disable(dev);
++ pm_runtime_set_suspended(dev);
++ pm_runtime_dont_use_autosuspend(dev);
+
+- component_master_del(&pdev->dev, &wcd938x_comp_ops);
+ regulator_bulk_disable(WCD938X_MAX_SUPPLY, wcd938x->supplies);
+ regulator_bulk_free(WCD938X_MAX_SUPPLY, wcd938x->supplies);
+ }
+--
+2.42.0
+
--- /dev/null
+From 55407f68cd39f41466fb8d2279fbf870d9819e17 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Apr 2023 09:46:30 +0200
+Subject: ASoC: codecs: wcd938x: Simplify with dev_err_probe
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit 60ba2fda5280528e70fa26b44e36d1530f6d1d7e ]
+
+Replace dev_err() in probe() path with dev_err_probe() to:
+1. Make code a bit simpler and easier to read,
+2. Do not print messages on deferred probe.
+
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Link: https://lore.kernel.org/r/20230418074630.8681-4-krzysztof.kozlowski@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Stable-dep-of: 69a026a2357e ("ASoC: codecs: wcd938x: fix regulator leaks on probe errors")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wcd938x.c | 27 ++++++++++-----------------
+ 1 file changed, 10 insertions(+), 17 deletions(-)
+
+diff --git a/sound/soc/codecs/wcd938x.c b/sound/soc/codecs/wcd938x.c
+index 73d7c92e87242..f0aa44198f4c5 100644
+--- a/sound/soc/codecs/wcd938x.c
++++ b/sound/soc/codecs/wcd938x.c
+@@ -3302,18 +3302,15 @@ static int wcd938x_populate_dt_data(struct wcd938x_priv *wcd938x, struct device
+ int ret;
+
+ wcd938x->reset_gpio = of_get_named_gpio(dev->of_node, "reset-gpios", 0);
+- if (wcd938x->reset_gpio < 0) {
+- dev_err(dev, "Failed to get reset gpio: err = %d\n",
+- wcd938x->reset_gpio);
+- return wcd938x->reset_gpio;
+- }
++ if (wcd938x->reset_gpio < 0)
++ return dev_err_probe(dev, wcd938x->reset_gpio,
++ "Failed to get reset gpio\n");
+
+ wcd938x->us_euro_gpio = devm_gpiod_get_optional(dev, "us-euro",
+ GPIOD_OUT_LOW);
+- if (IS_ERR(wcd938x->us_euro_gpio)) {
+- dev_err(dev, "us-euro swap Control GPIO not found\n");
+- return PTR_ERR(wcd938x->us_euro_gpio);
+- }
++ if (IS_ERR(wcd938x->us_euro_gpio))
++ return dev_err_probe(dev, PTR_ERR(wcd938x->us_euro_gpio),
++ "us-euro swap Control GPIO not found\n");
+
+ cfg->swap_gnd_mic = wcd938x_swap_gnd_mic;
+
+@@ -3323,16 +3320,12 @@ static int wcd938x_populate_dt_data(struct wcd938x_priv *wcd938x, struct device
+ wcd938x->supplies[3].supply = "vdd-mic-bias";
+
+ ret = regulator_bulk_get(dev, WCD938X_MAX_SUPPLY, wcd938x->supplies);
+- if (ret) {
+- dev_err(dev, "Failed to get supplies: err = %d\n", ret);
+- return ret;
+- }
++ if (ret)
++ return dev_err_probe(dev, ret, "Failed to get supplies\n");
+
+ ret = regulator_bulk_enable(WCD938X_MAX_SUPPLY, wcd938x->supplies);
+- if (ret) {
+- dev_err(dev, "Failed to enable supplies: err = %d\n", ret);
+- return ret;
+- }
++ if (ret)
++ return dev_err_probe(dev, ret, "Failed to enable supplies\n");
+
+ wcd938x_dt_parse_micbias_info(dev, wcd938x);
+
+--
+2.42.0
+
--- /dev/null
+From 76da8887abaa6aa6d00484823d5b4e2a13b3c89d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 May 2023 14:00:42 +0200
+Subject: KVM: x86/pmu: Truncate counter value to allowed width on write
+
+From: Roman Kagan <rkagan@amazon.de>
+
+[ Upstream commit b29a2acd36dd7a33c63f260df738fb96baa3d4f8 ]
+
+Performance counters are defined to have width less than 64 bits. The
+vPMU code maintains the counters in u64 variables but assumes the value
+to fit within the defined width. However, for Intel non-full-width
+counters (MSR_IA32_PERFCTRx) the value receieved from the guest is
+truncated to 32 bits and then sign-extended to full 64 bits. If a
+negative value is set, it's sign-extended to 64 bits, but then in
+kvm_pmu_incr_counter() it's incremented, truncated, and compared to the
+previous value for overflow detection.
+
+That previous value is not truncated, so it always evaluates bigger than
+the truncated new one, and a PMI is injected. If the PMI handler writes
+a negative counter value itself, the vCPU never quits the PMI loop.
+
+Turns out that Linux PMI handler actually does write the counter with
+the value just read with RDPMC, so when no full-width support is exposed
+via MSR_IA32_PERF_CAPABILITIES, and the guest initializes the counter to
+a negative value, it locks up.
+
+This has been observed in the field, for example, when the guest configures
+atop to use perfevents and runs two instances of it simultaneously.
+
+To address the problem, maintain the invariant that the counter value
+always fits in the defined bit width, by truncating the received value
+in the respective set_msr methods. For better readability, factor the
+out into a helper function, pmc_write_counter(), shared by vmx and svm
+parts.
+
+Fixes: 9cd803d496e7 ("KVM: x86: Update vPMCs when retiring instructions")
+Cc: stable@vger.kernel.org
+Signed-off-by: Roman Kagan <rkagan@amazon.de>
+Link: https://lore.kernel.org/all/20230504120042.785651-1-rkagan@amazon.de
+Tested-by: Like Xu <likexu@tencent.com>
+[sean: tweak changelog, s/set/write in the helper]
+Signed-off-by: Sean Christopherson <seanjc@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kvm/pmu.h | 6 ++++++
+ arch/x86/kvm/svm/pmu.c | 2 +-
+ arch/x86/kvm/vmx/pmu_intel.c | 4 ++--
+ 3 files changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/arch/x86/kvm/pmu.h b/arch/x86/kvm/pmu.h
+index c976490b75568..3666578b88a00 100644
+--- a/arch/x86/kvm/pmu.h
++++ b/arch/x86/kvm/pmu.h
+@@ -63,6 +63,12 @@ static inline u64 pmc_read_counter(struct kvm_pmc *pmc)
+ return counter & pmc_bitmask(pmc);
+ }
+
++static inline void pmc_write_counter(struct kvm_pmc *pmc, u64 val)
++{
++ pmc->counter += val - pmc_read_counter(pmc);
++ pmc->counter &= pmc_bitmask(pmc);
++}
++
+ static inline void pmc_release_perf_event(struct kvm_pmc *pmc)
+ {
+ if (pmc->perf_event) {
+diff --git a/arch/x86/kvm/svm/pmu.c b/arch/x86/kvm/svm/pmu.c
+index 9d65cd095691b..1cb2bf9808f57 100644
+--- a/arch/x86/kvm/svm/pmu.c
++++ b/arch/x86/kvm/svm/pmu.c
+@@ -149,7 +149,7 @@ static int amd_pmu_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
+ /* MSR_PERFCTRn */
+ pmc = get_gp_pmc_amd(pmu, msr, PMU_TYPE_COUNTER);
+ if (pmc) {
+- pmc->counter += data - pmc_read_counter(pmc);
++ pmc_write_counter(pmc, data);
+ pmc_update_sample_period(pmc);
+ return 0;
+ }
+diff --git a/arch/x86/kvm/vmx/pmu_intel.c b/arch/x86/kvm/vmx/pmu_intel.c
+index 9fabfe71fd879..9a75a0d5deae1 100644
+--- a/arch/x86/kvm/vmx/pmu_intel.c
++++ b/arch/x86/kvm/vmx/pmu_intel.c
+@@ -461,11 +461,11 @@ static int intel_pmu_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
+ if (!msr_info->host_initiated &&
+ !(msr & MSR_PMC_FULL_WIDTH_BIT))
+ data = (s64)(s32)data;
+- pmc->counter += data - pmc_read_counter(pmc);
++ pmc_write_counter(pmc, data);
+ pmc_update_sample_period(pmc);
+ return 0;
+ } else if ((pmc = get_fixed_pmc(pmu, msr))) {
+- pmc->counter += data - pmc_read_counter(pmc);
++ pmc_write_counter(pmc, data);
+ pmc_update_sample_period(pmc);
+ return 0;
+ } else if ((pmc = get_gp_pmc(pmu, msr, MSR_P6_EVNTSEL0))) {
+--
+2.42.0
+
--- /dev/null
+From 35acc668dd4fc2534fcc2d5450d38390d9b3a5de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Apr 2023 10:33:29 +0200
+Subject: mcb-lpc: Reallocate memory region to avoid memory overlapping
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rodríguez Barbarin, José Javier <JoseJavier.Rodriguez@duagon.com>
+
+[ Upstream commit 2025b2ca8004c04861903d076c67a73a0ec6dfca ]
+
+mcb-lpc requests a fixed-size memory region to parse the chameleon
+table, however, if the chameleon table is smaller that the allocated
+region, it could overlap with the IP Cores' memory regions.
+
+After parsing the chameleon table, drop/reallocate the memory region
+with the actual chameleon table size.
+
+Co-developed-by: Jorge Sanjuan Garcia <jorge.sanjuangarcia@duagon.com>
+Signed-off-by: Jorge Sanjuan Garcia <jorge.sanjuangarcia@duagon.com>
+Signed-off-by: Javier Rodriguez <josejavier.rodriguez@duagon.com>
+Signed-off-by: Johannes Thumshirn <jth@kernel.org>
+Link: https://lore.kernel.org/r/20230411083329.4506-4-jth@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mcb/mcb-lpc.c | 35 +++++++++++++++++++++++++++++++----
+ 1 file changed, 31 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/mcb/mcb-lpc.c b/drivers/mcb/mcb-lpc.c
+index 53decd89876ee..a851e02364642 100644
+--- a/drivers/mcb/mcb-lpc.c
++++ b/drivers/mcb/mcb-lpc.c
+@@ -23,7 +23,7 @@ static int mcb_lpc_probe(struct platform_device *pdev)
+ {
+ struct resource *res;
+ struct priv *priv;
+- int ret = 0;
++ int ret = 0, table_size;
+
+ priv = devm_kzalloc(&pdev->dev, sizeof(*priv), GFP_KERNEL);
+ if (!priv)
+@@ -58,16 +58,43 @@ static int mcb_lpc_probe(struct platform_device *pdev)
+
+ ret = chameleon_parse_cells(priv->bus, priv->mem->start, priv->base);
+ if (ret < 0) {
+- mcb_release_bus(priv->bus);
+- return ret;
++ goto out_mcb_bus;
+ }
+
+- dev_dbg(&pdev->dev, "Found %d cells\n", ret);
++ table_size = ret;
++
++ if (table_size < CHAM_HEADER_SIZE) {
++ /* Release the previous resources */
++ devm_iounmap(&pdev->dev, priv->base);
++ devm_release_mem_region(&pdev->dev, priv->mem->start, resource_size(priv->mem));
++
++ /* Then, allocate it again with the actual chameleon table size */
++ res = devm_request_mem_region(&pdev->dev, priv->mem->start,
++ table_size,
++ KBUILD_MODNAME);
++ if (!res) {
++ dev_err(&pdev->dev, "Failed to request PCI memory\n");
++ ret = -EBUSY;
++ goto out_mcb_bus;
++ }
++
++ priv->base = devm_ioremap(&pdev->dev, priv->mem->start, table_size);
++ if (!priv->base) {
++ dev_err(&pdev->dev, "Cannot ioremap\n");
++ ret = -ENOMEM;
++ goto out_mcb_bus;
++ }
++
++ platform_set_drvdata(pdev, priv);
++ }
+
+ mcb_bus_add_devices(priv->bus);
+
+ return 0;
+
++out_mcb_bus:
++ mcb_release_bus(priv->bus);
++ return ret;
+ }
+
+ static int mcb_lpc_remove(struct platform_device *pdev)
+--
+2.42.0
+
--- /dev/null
+From b17b1e5855b8df645480de9b45c86e8942bb7660 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Apr 2023 10:33:27 +0200
+Subject: mcb: Return actual parsed size when reading chameleon table
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rodríguez Barbarin, José Javier <JoseJavier.Rodriguez@duagon.com>
+
+[ Upstream commit a889c276d33d333ae96697510f33533f6e9d9591 ]
+
+The function chameleon_parse_cells() returns the number of cells
+parsed which has an undetermined size. This return value is only
+used for error checking but the number of cells is never used.
+
+Change return value to be number of bytes parsed to allow for
+memory management improvements.
+
+Co-developed-by: Jorge Sanjuan Garcia <jorge.sanjuangarcia@duagon.com>
+Signed-off-by: Jorge Sanjuan Garcia <jorge.sanjuangarcia@duagon.com>
+Signed-off-by: Javier Rodriguez <josejavier.rodriguez@duagon.com>
+Signed-off-by: Johannes Thumshirn <jth@kernel.org>
+Link: https://lore.kernel.org/r/20230411083329.4506-2-jth@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mcb/mcb-parse.c | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/mcb/mcb-parse.c b/drivers/mcb/mcb-parse.c
+index c41cbacc75a2c..656b6b71c7682 100644
+--- a/drivers/mcb/mcb-parse.c
++++ b/drivers/mcb/mcb-parse.c
+@@ -128,7 +128,7 @@ static void chameleon_parse_bar(void __iomem *base,
+ }
+ }
+
+-static int chameleon_get_bar(char __iomem **base, phys_addr_t mapbase,
++static int chameleon_get_bar(void __iomem **base, phys_addr_t mapbase,
+ struct chameleon_bar **cb)
+ {
+ struct chameleon_bar *c;
+@@ -177,12 +177,13 @@ int chameleon_parse_cells(struct mcb_bus *bus, phys_addr_t mapbase,
+ {
+ struct chameleon_fpga_header *header;
+ struct chameleon_bar *cb;
+- char __iomem *p = base;
++ void __iomem *p = base;
+ int num_cells = 0;
+ uint32_t dtype;
+ int bar_count;
+ int ret;
+ u32 hsize;
++ u32 table_size;
+
+ hsize = sizeof(struct chameleon_fpga_header);
+
+@@ -237,12 +238,16 @@ int chameleon_parse_cells(struct mcb_bus *bus, phys_addr_t mapbase,
+ num_cells++;
+ }
+
+- if (num_cells == 0)
+- num_cells = -EINVAL;
++ if (num_cells == 0) {
++ ret = -EINVAL;
++ goto free_bar;
++ }
+
++ table_size = p - base;
++ pr_debug("%d cell(s) found. Chameleon table size: 0x%04x bytes\n", num_cells, table_size);
+ kfree(cb);
+ kfree(header);
+- return num_cells;
++ return table_size;
+
+ free_bar:
+ kfree(cb);
+--
+2.42.0
+
--- /dev/null
+From 7ca0ffedfd777cdf271a683ebeae69fc20c8a9c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 May 2023 09:56:04 +0000
+Subject: mmc: block: ioctl: do write error check for spi
+
+From: Christian Loehle <CLoehle@hyperstone.com>
+
+[ Upstream commit 568898cbc8b570311b3b94a3202b8233f4168144 ]
+
+SPI doesn't have the usual PROG path we can check for error bits
+after moving back to TRAN. Instead it holds the line LOW until
+completion. We can then check if the card shows any errors or
+is in IDLE state, indicating the line is no longer LOW because
+the card was reset.
+
+Signed-off-by: Christian Loehle <cloehle@hyperstone.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/55920f880c9742f486f64aa44e25508e@hyperstone.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Stable-dep-of: f19c5a73e6f7 ("mmc: core: Fix error propagation for some ioctl commands")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/core/block.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
+index baefe2886f0b2..1aab4f47eab98 100644
+--- a/drivers/mmc/core/block.c
++++ b/drivers/mmc/core/block.c
+@@ -180,6 +180,7 @@ static void mmc_blk_rw_rq_prep(struct mmc_queue_req *mqrq,
+ int recovery_mode,
+ struct mmc_queue *mq);
+ static void mmc_blk_hsq_req_done(struct mmc_request *mrq);
++static int mmc_spi_err_check(struct mmc_card *card);
+
+ static struct mmc_blk_data *mmc_blk_get(struct gendisk *disk)
+ {
+@@ -623,6 +624,11 @@ static int __mmc_blk_ioctl_cmd(struct mmc_card *card, struct mmc_blk_data *md,
+ if ((card->host->caps & MMC_CAP_WAIT_WHILE_BUSY) && use_r1b_resp)
+ return 0;
+
++ if (mmc_host_is_spi(card->host)) {
++ if (idata->ic.write_flag || r1b_resp || cmd.flags & MMC_RSP_SPI_BUSY)
++ return mmc_spi_err_check(card);
++ return err;
++ }
+ /* Ensure RPMB/R1B command has completed by polling with CMD13. */
+ if (idata->rpmb || r1b_resp)
+ err = mmc_poll_for_busy(card, busy_timeout_ms, false,
+--
+2.42.0
+
--- /dev/null
+From 12b8930ad2355a26e9f45dcced16a928858427b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Feb 2023 14:37:07 +0100
+Subject: mmc: core: Align to common busy polling behaviour for mmc ioctls
+
+From: Ulf Hansson <ulf.hansson@linaro.org>
+
+[ Upstream commit 51f5b3056790bc0518e49587996f1e6f3058cca9 ]
+
+Let's align to the common busy polling behaviour for mmc ioctls, by
+updating the below two corresponding parts, that comes into play when using
+an R1B response for a command.
+
+*) A command with an R1B response should be prepared by calling
+mmc_prepare_busy_cmd(), which make us respects the host's busy timeout
+constraints.
+**) When an R1B response is being used and the host also supports HW busy
+detection, we should skip to poll for busy completion.
+
+Suggested-by: Christian Loehle <cloehle@hyperstone.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Reviewed-by: Christian Loehle <cloehle@hyperstone.com>
+Link: https://lore.kernel.org/r/20230213133707.27857-1-ulf.hansson@linaro.org
+Stable-dep-of: f19c5a73e6f7 ("mmc: core: Fix error propagation for some ioctl commands")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/core/block.c | 25 +++++++++++++++++--------
+ drivers/mmc/core/mmc_ops.c | 1 +
+ 2 files changed, 18 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
+index cdd7f126d4aea..baefe2886f0b2 100644
+--- a/drivers/mmc/core/block.c
++++ b/drivers/mmc/core/block.c
+@@ -471,6 +471,8 @@ static int __mmc_blk_ioctl_cmd(struct mmc_card *card, struct mmc_blk_data *md,
+ struct mmc_data data = {};
+ struct mmc_request mrq = {};
+ struct scatterlist sg;
++ bool r1b_resp, use_r1b_resp = false;
++ unsigned int busy_timeout_ms;
+ int err;
+ unsigned int target_part;
+
+@@ -559,6 +561,13 @@ static int __mmc_blk_ioctl_cmd(struct mmc_card *card, struct mmc_blk_data *md,
+ (cmd.opcode == MMC_SWITCH))
+ return mmc_sanitize(card, idata->ic.cmd_timeout_ms);
+
++ /* If it's an R1B response we need some more preparations. */
++ busy_timeout_ms = idata->ic.cmd_timeout_ms ? : MMC_BLK_TIMEOUT_MS;
++ r1b_resp = (cmd.flags & MMC_RSP_R1B) == MMC_RSP_R1B;
++ if (r1b_resp)
++ use_r1b_resp = mmc_prepare_busy_cmd(card->host, &cmd,
++ busy_timeout_ms);
++
+ mmc_wait_for_req(card->host, &mrq);
+ memcpy(&idata->ic.response, cmd.resp, sizeof(cmd.resp));
+
+@@ -610,14 +619,14 @@ static int __mmc_blk_ioctl_cmd(struct mmc_card *card, struct mmc_blk_data *md,
+ if (idata->ic.postsleep_min_us)
+ usleep_range(idata->ic.postsleep_min_us, idata->ic.postsleep_max_us);
+
+- if (idata->rpmb || (cmd.flags & MMC_RSP_R1B) == MMC_RSP_R1B) {
+- /*
+- * Ensure RPMB/R1B command has completed by polling CMD13 "Send Status". Here we
+- * allow to override the default timeout value if a custom timeout is specified.
+- */
+- err = mmc_poll_for_busy(card, idata->ic.cmd_timeout_ms ? : MMC_BLK_TIMEOUT_MS,
+- false, MMC_BUSY_IO);
+- }
++ /* No need to poll when using HW busy detection. */
++ if ((card->host->caps & MMC_CAP_WAIT_WHILE_BUSY) && use_r1b_resp)
++ return 0;
++
++ /* Ensure RPMB/R1B command has completed by polling with CMD13. */
++ if (idata->rpmb || r1b_resp)
++ err = mmc_poll_for_busy(card, busy_timeout_ms, false,
++ MMC_BUSY_IO);
+
+ return err;
+ }
+diff --git a/drivers/mmc/core/mmc_ops.c b/drivers/mmc/core/mmc_ops.c
+index 81c55bfd6e0c2..3b3adbddf6641 100644
+--- a/drivers/mmc/core/mmc_ops.c
++++ b/drivers/mmc/core/mmc_ops.c
+@@ -575,6 +575,7 @@ bool mmc_prepare_busy_cmd(struct mmc_host *host, struct mmc_command *cmd,
+ cmd->busy_timeout = timeout_ms;
+ return true;
+ }
++EXPORT_SYMBOL_GPL(mmc_prepare_busy_cmd);
+
+ /**
+ * __mmc_switch - modify EXT_CSD register
+--
+2.42.0
+
--- /dev/null
+From 7fa091612306a00052153f69a1b8d42476050c0a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Sep 2023 13:29:21 +0200
+Subject: mmc: core: Fix error propagation for some ioctl commands
+
+From: Ulf Hansson <ulf.hansson@linaro.org>
+
+[ Upstream commit f19c5a73e6f78d69efce66cfdce31148c76a61a6 ]
+
+Userspace has currently no way of checking the internal R1 response error
+bits for some commands. This is a problem for some commands, like RPMB for
+example. Typically, we may detect that the busy completion has successfully
+ended, while in fact the card did not complete the requested operation.
+
+To fix the problem, let's always poll with CMD13 for these commands and
+during the polling, let's also aggregate the R1 response bits. Before
+completing the ioctl request, let's propagate the R1 response bits too.
+
+Reviewed-by: Avri Altman <avri.altman@wdc.com>
+Co-developed-by: Christian Loehle <christian.loehle@arm.com>
+Signed-off-by: Christian Loehle <christian.loehle@arm.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20230913112921.553019-1-ulf.hansson@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/core/block.c | 31 ++++++++++++++++++++-----------
+ 1 file changed, 20 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
+index 1aab4f47eab98..1fc6767f18782 100644
+--- a/drivers/mmc/core/block.c
++++ b/drivers/mmc/core/block.c
+@@ -181,6 +181,7 @@ static void mmc_blk_rw_rq_prep(struct mmc_queue_req *mqrq,
+ struct mmc_queue *mq);
+ static void mmc_blk_hsq_req_done(struct mmc_request *mrq);
+ static int mmc_spi_err_check(struct mmc_card *card);
++static int mmc_blk_busy_cb(void *cb_data, bool *busy);
+
+ static struct mmc_blk_data *mmc_blk_get(struct gendisk *disk)
+ {
+@@ -472,7 +473,7 @@ static int __mmc_blk_ioctl_cmd(struct mmc_card *card, struct mmc_blk_data *md,
+ struct mmc_data data = {};
+ struct mmc_request mrq = {};
+ struct scatterlist sg;
+- bool r1b_resp, use_r1b_resp = false;
++ bool r1b_resp;
+ unsigned int busy_timeout_ms;
+ int err;
+ unsigned int target_part;
+@@ -566,8 +567,7 @@ static int __mmc_blk_ioctl_cmd(struct mmc_card *card, struct mmc_blk_data *md,
+ busy_timeout_ms = idata->ic.cmd_timeout_ms ? : MMC_BLK_TIMEOUT_MS;
+ r1b_resp = (cmd.flags & MMC_RSP_R1B) == MMC_RSP_R1B;
+ if (r1b_resp)
+- use_r1b_resp = mmc_prepare_busy_cmd(card->host, &cmd,
+- busy_timeout_ms);
++ mmc_prepare_busy_cmd(card->host, &cmd, busy_timeout_ms);
+
+ mmc_wait_for_req(card->host, &mrq);
+ memcpy(&idata->ic.response, cmd.resp, sizeof(cmd.resp));
+@@ -620,19 +620,28 @@ static int __mmc_blk_ioctl_cmd(struct mmc_card *card, struct mmc_blk_data *md,
+ if (idata->ic.postsleep_min_us)
+ usleep_range(idata->ic.postsleep_min_us, idata->ic.postsleep_max_us);
+
+- /* No need to poll when using HW busy detection. */
+- if ((card->host->caps & MMC_CAP_WAIT_WHILE_BUSY) && use_r1b_resp)
+- return 0;
+-
+ if (mmc_host_is_spi(card->host)) {
+ if (idata->ic.write_flag || r1b_resp || cmd.flags & MMC_RSP_SPI_BUSY)
+ return mmc_spi_err_check(card);
+ return err;
+ }
+- /* Ensure RPMB/R1B command has completed by polling with CMD13. */
+- if (idata->rpmb || r1b_resp)
+- err = mmc_poll_for_busy(card, busy_timeout_ms, false,
+- MMC_BUSY_IO);
++
++ /*
++ * Ensure RPMB, writes and R1B responses are completed by polling with
++ * CMD13. Note that, usually we don't need to poll when using HW busy
++ * detection, but here it's needed since some commands may indicate the
++ * error through the R1 status bits.
++ */
++ if (idata->rpmb || idata->ic.write_flag || r1b_resp) {
++ struct mmc_blk_busy_data cb_data = {
++ .card = card,
++ };
++
++ err = __mmc_poll_for_busy(card->host, 0, busy_timeout_ms,
++ &mmc_blk_busy_cb, &cb_data);
++
++ idata->ic.response[0] = cb_data.status;
++ }
+
+ return err;
+ }
+--
+2.42.0
+
--- /dev/null
+From 56c073d6670278d3fe9cd941dfce6507d5ba1f8b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Oct 2023 16:57:05 +0200
+Subject: pinctrl: qcom: lpass-lpi: fix concurrent register updates
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit c8befdc411e5fd1bf95a13e8744c8ca79b412bee ]
+
+The Qualcomm LPASS LPI pin controller driver uses one lock for guarding
+Read-Modify-Write code for slew rate registers. However the pin
+configuration and muxing registers have exactly the same RMW code but
+are not protected.
+
+Pin controller framework does not provide locking here, thus it is
+possible to trigger simultaneous change of pin configuration registers
+resulting in non-atomic changes.
+
+Protect from concurrent access by re-using the same lock used to cover
+the slew rate register. Using the same lock instead of adding second
+one will make more sense, once we add support for newer Qualcomm SoC,
+where slew rate is configured in the same register as pin
+configuration/muxing.
+
+Fixes: 6e261d1090d6 ("pinctrl: qcom: Add sm8250 lpass lpi pinctrl driver")
+Cc: stable@vger.kernel.org
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Link: https://lore.kernel.org/r/20231013145705.219954-1-krzysztof.kozlowski@linaro.org
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/qcom/pinctrl-lpass-lpi.c | 17 +++++++++++------
+ 1 file changed, 11 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/pinctrl/qcom/pinctrl-lpass-lpi.c b/drivers/pinctrl/qcom/pinctrl-lpass-lpi.c
+index a55998ae29fa4..bfcc5c45b8fa5 100644
+--- a/drivers/pinctrl/qcom/pinctrl-lpass-lpi.c
++++ b/drivers/pinctrl/qcom/pinctrl-lpass-lpi.c
+@@ -24,7 +24,8 @@ struct lpi_pinctrl {
+ char __iomem *tlmm_base;
+ char __iomem *slew_base;
+ struct clk_bulk_data clks[MAX_LPI_NUM_CLKS];
+- struct mutex slew_access_lock;
++ /* Protects from concurrent register updates */
++ struct mutex lock;
+ const struct lpi_pinctrl_variant_data *data;
+ };
+
+@@ -94,9 +95,11 @@ static int lpi_gpio_set_mux(struct pinctrl_dev *pctldev, unsigned int function,
+ if (WARN_ON(i == g->nfuncs))
+ return -EINVAL;
+
++ mutex_lock(&pctrl->lock);
+ val = lpi_gpio_read(pctrl, pin, LPI_GPIO_CFG_REG);
+ u32p_replace_bits(&val, i, LPI_GPIO_FUNCTION_MASK);
+ lpi_gpio_write(pctrl, pin, LPI_GPIO_CFG_REG, val);
++ mutex_unlock(&pctrl->lock);
+
+ return 0;
+ }
+@@ -202,14 +205,14 @@ static int lpi_config_set(struct pinctrl_dev *pctldev, unsigned int group,
+ if (slew_offset == LPI_NO_SLEW)
+ break;
+
+- mutex_lock(&pctrl->slew_access_lock);
++ mutex_lock(&pctrl->lock);
+
+ sval = ioread32(pctrl->slew_base + LPI_SLEW_RATE_CTL_REG);
+ sval &= ~(LPI_SLEW_RATE_MASK << slew_offset);
+ sval |= arg << slew_offset;
+ iowrite32(sval, pctrl->slew_base + LPI_SLEW_RATE_CTL_REG);
+
+- mutex_unlock(&pctrl->slew_access_lock);
++ mutex_unlock(&pctrl->lock);
+ break;
+ default:
+ return -EINVAL;
+@@ -225,6 +228,7 @@ static int lpi_config_set(struct pinctrl_dev *pctldev, unsigned int group,
+ lpi_gpio_write(pctrl, group, LPI_GPIO_VALUE_REG, val);
+ }
+
++ mutex_lock(&pctrl->lock);
+ val = lpi_gpio_read(pctrl, group, LPI_GPIO_CFG_REG);
+
+ u32p_replace_bits(&val, pullup, LPI_GPIO_PULL_MASK);
+@@ -233,6 +237,7 @@ static int lpi_config_set(struct pinctrl_dev *pctldev, unsigned int group,
+ u32p_replace_bits(&val, output_enabled, LPI_GPIO_OE_MASK);
+
+ lpi_gpio_write(pctrl, group, LPI_GPIO_CFG_REG, val);
++ mutex_unlock(&pctrl->lock);
+
+ return 0;
+ }
+@@ -432,7 +437,7 @@ int lpi_pinctrl_probe(struct platform_device *pdev)
+ pctrl->chip.of_gpio_n_cells = 2;
+ pctrl->chip.can_sleep = false;
+
+- mutex_init(&pctrl->slew_access_lock);
++ mutex_init(&pctrl->lock);
+
+ pctrl->ctrl = devm_pinctrl_register(dev, &pctrl->desc, pctrl);
+ if (IS_ERR(pctrl->ctrl)) {
+@@ -454,7 +459,7 @@ int lpi_pinctrl_probe(struct platform_device *pdev)
+ return 0;
+
+ err_pinctrl:
+- mutex_destroy(&pctrl->slew_access_lock);
++ mutex_destroy(&pctrl->lock);
+ clk_bulk_disable_unprepare(MAX_LPI_NUM_CLKS, pctrl->clks);
+
+ return ret;
+@@ -466,7 +471,7 @@ int lpi_pinctrl_remove(struct platform_device *pdev)
+ struct lpi_pinctrl *pctrl = platform_get_drvdata(pdev);
+ int i;
+
+- mutex_destroy(&pctrl->slew_access_lock);
++ mutex_destroy(&pctrl->lock);
+ clk_bulk_disable_unprepare(MAX_LPI_NUM_CLKS, pctrl->clks);
+
+ for (i = 0; i < pctrl->data->npins; i++)
+--
+2.42.0
+
--- /dev/null
+kvm-x86-pmu-truncate-counter-value-to-allowed-width-.patch
+mmc-core-align-to-common-busy-polling-behaviour-for-.patch
+mmc-block-ioctl-do-write-error-check-for-spi.patch
+mmc-core-fix-error-propagation-for-some-ioctl-comman.patch
+asoc-codecs-wcd938x-convert-to-platform-remove-callb.patch
+asoc-codecs-wcd938x-simplify-with-dev_err_probe.patch
+asoc-codecs-wcd938x-fix-regulator-leaks-on-probe-err.patch
+asoc-codecs-wcd938x-fix-runtime-pm-imbalance-on-remo.patch
+pinctrl-qcom-lpass-lpi-fix-concurrent-register-updat.patch
+mcb-return-actual-parsed-size-when-reading-chameleon.patch
+mcb-lpc-reallocate-memory-region-to-avoid-memory-ove.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
